@mrpatronz/nexusflow 0.2.7 → 0.2.11

package/src/server.ts

@@ -19,9 +19,11 @@ import { createWorkspace, listWorkspaces, loadFeatureConfig, deleteWorkspace, ad
 import { analyzeAllRepos } from './analyzers/index.js';
 import { generateContextFiles } from './generators/index.js';
 import { packWorkspace } from './core/packer.js';
+import { isOllamaModelAvailable, getOpenAiCompatibleUrl, callLocalLlm } from './utils/local-ai.js';
 import { detectAIAssistants } from './utils/detect-ai.js';
 import { detectEditors } from './utils/detect-editors.js';
 import { findSessions, getSessionTranscript } from './utils/session-finder.js';
+import { scanSystemSpecs } from './utils/system-scanner.js';
 import { getWorkspaceRepos, rebaseRepo, commitAndPush, getRepoStatus } from './utils/multi-git.js';
 import {
   detectAllServices,
@@ -43,6 +45,9 @@ const guiPath = path.join(__dirname, 'gui');
 
 export const app = new Hono();
 
+// Allowed editor binaries/scripts to prevent command injection
+const ALLOWED_EDITORS = new Set(['code', 'code-insiders', 'cursor', 'agy', 'idea', 'charm', 'webstorm', 'subl', 'nano', 'vim', 'nvim', 'emacs']);
+
 // Enable CORS for frontend dev server
 app.use('/api/*', cors());
 
@@ -66,10 +71,32 @@ app.get('/api/config', async (c) => {
   }
 });
 
+function isSafeLocalEndpoint(urlStr: string): boolean {
+  try {
+    const url = new URL(urlStr);
+    const hostname = url.hostname.toLowerCase();
+    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]') {
+      return true;
+    }
+    const ipv4Pattern = /^(?:10|127|192\.168|172\.(?:1[6-9]|2[0-9]|3[01]))\.\d+\.\d+\.\d+$/;
+    if (ipv4Pattern.test(hostname)) {
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
 // 2. Save configuration
 app.post('/api/config', async (c) => {
   try {
     const newConfig = await c.req.json();
+    if (newConfig?.localLlm?.enabled && newConfig.localLlm.endpoint) {
+      if (!isSafeLocalEndpoint(newConfig.localLlm.endpoint)) {
+        return c.json({ error: 'Local AI endpoint must be localhost, 127.0.0.1, or a private LAN IP.' }, 400);
+      }
+    }
     await saveConfig(newConfig);
     return c.json({ success: true, config: newConfig });
   } catch (error) {
@@ -124,6 +151,66 @@ app.get('/api/editor-detect', async (c) => {
   }
 });
 
+// 6.5. Local LLM test & recommendation
+app.post('/api/local-llm/test', async (c) => {
+  try {
+    const { provider, endpoint, model, shoot } = await c.req.json();
+    if (!endpoint || !isSafeLocalEndpoint(endpoint)) {
+      return c.json({ success: false, error: 'Local AI endpoint must be localhost, 127.0.0.1, or a private LAN IP.' }, 400);
+    }
+    const cleanEndpoint = endpoint.replace(/\/$/, '');
+    
+    if (shoot) {
+      const responseText = await callLocalLlm(
+        { enabled: true, provider, endpoint, model },
+        [{ role: 'user', content: 'Respond with the exact word "OK" and nothing else.' }]
+      );
+      const cleanResponse = responseText.trim();
+      return c.json({
+        success: true,
+        modelReady: true,
+        message: `Inference test succeeded! Response from model: "${cleanResponse}"`
+      });
+    }
+
+    if (provider === 'ollama') {
+      const res = await fetch(`${cleanEndpoint}/api/tags`);
+      if (!res.ok) throw new Error(`Ollama responded with status ${res.status}`);
+      const data: any = await res.json();
+      const models = data?.models || [];
+      const isModelLoaded = isOllamaModelAvailable(models, model);
+      return c.json({ 
+        success: true, 
+        modelReady: isModelLoaded,
+        message: isModelLoaded ? 'Connected successfully! Model is ready.' : `Connected successfully, but model "${model}" is not pulled. Run "ollama pull ${model}" to install it.`
+      });
+    } else {
+      const testUrl = getOpenAiCompatibleUrl(cleanEndpoint, '/v1/models');
+      const res = await fetch(testUrl);
+      if (!res.ok) throw new Error(`OpenAI-compatible server responded with status ${res.status}`);
+      return c.json({ success: true, modelReady: true, message: 'Connected successfully to OpenAI-compatible server!' });
+    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    return c.json({ success: false, error: msg }, 400);
+  }
+});
+
+app.get('/api/local-llm/recommend', async (c) => {
+  try {
+    const specs = await scanSystemSpecs();
+    return c.json(specs);
+  } catch (error) {
+    return c.json({
+      totalRamGb: 8,
+      gpuName: 'Unknown/Integrated',
+      hasHardwareAcceleration: false,
+      recommendedModel: 'qwen2.5-coder:1.5b',
+    });
+  }
+});
+
+
 interface JobStep {
   id: string;
   name: string;
@@ -160,7 +247,8 @@ function updateJobStep(
     step.message = message;
   }
 
-  if (stepId === 'pack' && status === 'completed') {
+  const isLastStep = job.steps[job.steps.length - 1]?.id === stepId;
+  if (isLastStep && status === 'completed') {
     job.status = 'completed';
     job.progress = 100;
   } else if (status === 'failed') {
@@ -203,11 +291,13 @@ async function runCreationJob(jobId: string, body: any, config: any) {
       id: body.branchName,
       branchName: body.branchName,
       description: body.description,
-      repos: body.repos.map((r: any) => r.path),
+      repos: body.repos.map((r: any) => path.join(workspacePath, r.name)),
+      originalRepos: body.repos.map((r: any) => r.path),
       assistants: body.assistants,
       workspacePath,
       createdAt: new Date().toISOString(),
       resumption: body.resumption,
+      localLlmEnabled: body.localLlmEnabled,
     };
     if (job) {
       job.feature = feature;
@@ -233,14 +323,17 @@ async function runCreationJob(jobId: string, body: any, config: any) {
       feature,
       repos: workspaceRepos,
       analysis,
+      localLlm: config.localLlm,
     };
     await generateContextFiles(ctx, body.assistants, workspacePath);
     updateJobStep(jobId, 'context', 'completed', 'AI context files generated.');
 
     // Step 4: Pack codebase context
-    updateJobStep(jobId, 'pack', 'running', 'Packing codebase context with Repomix...');
-    const packResult = await packWorkspace(workspacePath);
-    updateJobStep(jobId, 'pack', 'completed', `Packed codebase context (${packResult.totalFiles} files, ${(packResult.fileSize / 1024).toFixed(2)} KB).`);
+    if (config.packContextXml) {
+      updateJobStep(jobId, 'pack', 'running', 'Packing codebase context with Repomix...');
+      const packResult = await packWorkspace(workspacePath);
+      updateJobStep(jobId, 'pack', 'completed', `Packed codebase context (${packResult.totalFiles} files, ${(packResult.fileSize / 1024).toFixed(2)} KB).`);
+    }
 
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);
@@ -261,6 +354,7 @@ app.post('/api/workspace', async (c) => {
       description: string;
       repos: RepoInfo[];
       assistants: any[];
+      localLlmEnabled?: boolean;
       resumption?: {
         testCommand?: string;
         mockCommand?: string;
@@ -282,8 +376,10 @@ app.post('/api/workspace', async (c) => {
       { id: 'worktrees', name: 'Create Git Worktrees', status: 'pending', message: 'Waiting...' },
       { id: 'analysis', name: 'Analyze Repositories', status: 'pending', message: 'Waiting...' },
       { id: 'context', name: 'Generate AI Context Files', status: 'pending', message: 'Waiting...' },
-      { id: 'pack', name: 'Pack Codebase Context', status: 'pending', message: 'Waiting...' },
     ];
+    if (config.packContextXml) {
+      steps.push({ id: 'pack', name: 'Pack Codebase Context', status: 'pending', message: 'Waiting...' });
+    }
 
     const job: CreationJob = {
       id: jobId,
@@ -396,8 +492,33 @@ app.post('/api/open-editor', async (c) => {
       command: string;
     };
 
+    if (!ALLOWED_EDITORS.has(command)) {
+      return c.json({ error: 'Forbidden editor command' }, 400);
+    }
+
+    // Validate path exists and is a directory
+    try {
+      const stats = await fs.stat(workspacePath);
+      if (!stats.isDirectory()) {
+        return c.json({ error: 'Workspace path is not a directory' }, 400);
+      }
+    } catch {
+      return c.json({ error: 'Workspace path does not exist' }, 400);
+    }
+
     // Spawn editor process
-    execa(command, [workspacePath], { detached: true, stdio: 'ignore' }).unref();
+    const isWin = process.platform === 'win32';
+    const child = execa(command, [workspacePath], {
+      detached: true,
+      stdio: 'ignore',
+      shell: isWin,
+      cleanup: false,
+    });
+    child.unref();
+    child.catch((err) => {
+      console.error(`Failed to launch editor ${command} for path ${workspacePath}:`, err);
+    });
+
     return c.json({ success: true });
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);
@@ -758,11 +879,20 @@ app.post('/api/workspace/:id/resume', async (c) => {
 
     // Open in editor if command is provided
     if (body.command) {
-      try {
-        execa(body.command, [workspacePath], { detached: true, stdio: 'ignore' }).unref();
-      } catch (e) {
-        console.error('Failed to launch editor:', e);
+      if (!ALLOWED_EDITORS.has(body.command)) {
+        return c.json({ error: 'Forbidden editor command' }, 400);
       }
+      const isWin = process.platform === 'win32';
+      const child = execa(body.command, [workspacePath], {
+        detached: true,
+        stdio: 'ignore',
+        shell: isWin,
+        cleanup: false,
+      });
+      child.unref();
+      child.catch((err) => {
+        console.error(`Failed to launch editor ${body.command} for path ${workspacePath}:`, err);
+      });
     }
 
     return c.json({ success: true, resumeCommand, workspacePath });

package/src/types.ts

@@ -6,6 +6,13 @@
 /** Supported AI assistant identifiers. */
 export type AIAssistant = 'claude' | 'antigravity' | 'codex' | 'copilot' | 'cursor';
 
+export interface LocalLlmConfig {
+  enabled: boolean;
+  provider: 'ollama' | 'openai-compatible';
+  endpoint: string;
+  model: string;
+}
+
 /** Top-level NexusFlow configuration stored in ~/.nexusflow/config.json. */
 export interface NexusFlowConfig {
   /** Semantic version of the NexusFlow config schema. */
@@ -37,6 +44,9 @@ export interface NexusFlowConfig {
 
   /** The last checked latest version from NPM. */
   latestVersion?: string;
+
+  /** Local LLM settings for delegating simple tasks. */
+  localLlm?: LocalLlmConfig;
 }
 
 /** Result of probing for an AI assistant on the system. */
@@ -135,6 +145,9 @@ export interface Feature {
 
   /** Resumption configuration. */
   resumption?: ResumptionConfig;
+
+  /** Whether the Local LLM Co-processor is active for this workspace. */
+  localLlmEnabled?: boolean;
 }
 
 /** Runtime context for an active workspace — now includes analysis data. */
@@ -147,6 +160,9 @@ export interface WorkspaceContext {
 
   /** Analysis results for each repo (keyed by repo path). */
   analysis?: Map<string, ProjectAnalysis>;
+
+  /** The global local LLM config, to provide model context. */
+  localLlm?: LocalLlmConfig;
 }
 
 // ─── Phase 2: Project Analysis Types ──────────────────────────────────────

package/src/utils/detect-ai.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { execa } from 'execa';
+import { detectAIAssistants } from './detect-ai.js';
+
+vi.mock('execa');
+
+describe('detectAIAssistants', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should detect claude and antigravity when commands exit with 0', async () => {
+    vi.mocked(execa).mockImplementation((command: any, args?: any, options?: any): any => {
+      if (command === 'claude' || command === 'agy') {
+        return Promise.resolve({ exitCode: 0 } as any);
+      }
+      return Promise.resolve({ exitCode: 1 } as any);
+    });
+
+    const result = await detectAIAssistants();
+
+    expect(result).toEqual([
+      { name: 'claude', displayName: 'Claude Code', detected: true, command: 'claude' },
+      { name: 'antigravity', displayName: 'Antigravity', detected: true, command: 'agy' },
+      { name: 'codex', displayName: 'OpenAI Codex', detected: false },
+      { name: 'copilot', displayName: 'GitHub Copilot', detected: true },
+      { name: 'cursor', displayName: 'Cursor', detected: false },
+    ]);
+  });
+
+  it('should handle failures gracefully and set detected to false', async () => {
+    vi.mocked(execa).mockRejectedValue(new Error('Spawn error'));
+
+    const result = await detectAIAssistants();
+
+    expect(result).toEqual([
+      { name: 'claude', displayName: 'Claude Code', detected: false },
+      { name: 'antigravity', displayName: 'Antigravity', detected: false },
+      { name: 'codex', displayName: 'OpenAI Codex', detected: false },
+      { name: 'copilot', displayName: 'GitHub Copilot', detected: true },
+      { name: 'cursor', displayName: 'Cursor', detected: false },
+    ]);
+  });
+});

package/src/utils/detect-editors.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { execa } from 'execa';
+import { detectEditors } from './detect-editors.js';
+
+vi.mock('execa');
+
+describe('detectEditors', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should return detected = true for editors whose commands exit with 0', async () => {
+    vi.mocked(execa).mockImplementation((command: any, args?: any, options?: any): any => {
+      if (command === 'code' || command === 'cursor') {
+        return Promise.resolve({ exitCode: 0 } as any);
+      }
+      return Promise.resolve({ exitCode: 1 } as any);
+    });
+
+    const result = await detectEditors();
+
+    expect(result).toEqual([
+      { name: 'VS Code', command: 'code', detected: true },
+      { name: 'VS Code Insiders', command: 'code-insiders', detected: false },
+      { name: 'Cursor', command: 'cursor', detected: true },
+      { name: 'Antigravity', command: 'agy', detected: false },
+    ]);
+
+    expect(execa).toHaveBeenCalledWith('code', ['--version'], { reject: false });
+    expect(execa).toHaveBeenCalledWith('code-insiders', ['--version'], { reject: false });
+    expect(execa).toHaveBeenCalledWith('cursor', ['--version'], { reject: false });
+    expect(execa).toHaveBeenCalledWith('agy', ['--version'], { reject: false });
+  });
+
+  it('should return detected = false for all editors if execa throws an error', async () => {
+    vi.mocked(execa).mockRejectedValue(new Error('Spawn error'));
+
+    const result = await detectEditors();
+
+    expect(result).toEqual([
+      { name: 'VS Code', command: 'code', detected: false },
+      { name: 'VS Code Insiders', command: 'code-insiders', detected: false },
+      { name: 'Cursor', command: 'cursor', detected: false },
+      { name: 'Antigravity', command: 'agy', detected: false },
+    ]);
+  });
+});

package/src/utils/git.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { execa } from 'execa';
+import { isGitRepo, gitFetch, detectDefaultBranch } from './git.js';
+
+vi.mock('node:fs/promises');
+vi.mock('execa');
+
+describe('git utilities', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('isGitRepo', () => {
+    it('should return true if .git directory exists and is accessible', async () => {
+      vi.mocked(fs.access).mockResolvedValue(undefined);
+
+      const result = await isGitRepo('/mock/repo');
+
+      expect(result).toBe(true);
+      expect(fs.access).toHaveBeenCalledWith(path.join('/mock/repo', '.git'));
+    });
+
+    it('should return false if .git directory is not accessible', async () => {
+      vi.mocked(fs.access).mockRejectedValue(new Error('ENOENT'));
+
+      const result = await isGitRepo('/mock/repo');
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('gitFetch', () => {
+    it('should run git fetch origin', async () => {
+      vi.mocked(execa).mockResolvedValue({} as any);
+
+      await gitFetch('/mock/repo');
+
+      expect(execa).toHaveBeenCalledWith('git', ['fetch', 'origin'], { cwd: '/mock/repo' });
+    });
+  });
+
+  describe('detectDefaultBranch', () => {
+    it('should prefer main over master', async () => {
+      vi.mocked(execa).mockResolvedValue({
+        stdout: '  origin/master\n  origin/main\n'
+      } as any);
+
+      const branch = await detectDefaultBranch('/mock/repo');
+
+      expect(branch).toBe('main');
+      expect(execa).toHaveBeenCalledWith('git', ['branch', '-r'], { cwd: '/mock/repo' });
+    });
+
+    it('should match master if main is not present', async () => {
+      vi.mocked(execa).mockResolvedValue({
+        stdout: '  origin/master\n  origin/feature-branch\n'
+      } as any);
+
+      const branch = await detectDefaultBranch('/mock/repo');
+
+      expect(branch).toBe('master');
+    });
+
+    it('should fallback to main if neither is present or command fails', async () => {
+      vi.mocked(execa).mockRejectedValue(new Error('git command failed'));
+
+      const branch = await detectDefaultBranch('/mock/repo');
+
+      expect(branch).toBe('main');
+    });
+  });
+});

package/src/utils/local-ai.test.ts

@@ -0,0 +1,130 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { callLocalLlm, isOllamaModelAvailable, getOpenAiCompatibleUrl } from './local-ai.js';
+
+describe('local-ai utilities', () => {
+  beforeEach(() => {
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('isOllamaModelAvailable', () => {
+    it('should match exact model names and tag variations', () => {
+      const models = [{ name: 'qwen2.5-coder:1.5b' }, { name: 'llama3:latest' }];
+      expect(isOllamaModelAvailable(models, 'qwen2.5-coder:1.5b')).toBe(true);
+      expect(isOllamaModelAvailable(models, 'llama3')).toBe(true);
+      expect(isOllamaModelAvailable(models, 'llama3:latest')).toBe(true);
+      expect(isOllamaModelAvailable(models, 'non-existent')).toBe(false);
+    });
+  });
+
+  describe('getOpenAiCompatibleUrl', () => {
+    it('should properly format endpoint URLs', () => {
+      expect(getOpenAiCompatibleUrl('http://localhost:11434', '/v1/chat/completions')).toBe('http://localhost:11434/v1/chat/completions');
+      expect(getOpenAiCompatibleUrl('http://localhost:11434/', '/v1/chat/completions')).toBe('http://localhost:11434/v1/chat/completions');
+      expect(getOpenAiCompatibleUrl('http://localhost:1234/v1', '/v1/chat/completions')).toBe('http://localhost:1234/v1/chat/completions');
+      expect(getOpenAiCompatibleUrl('http://localhost:1234/v1/', '/v1/chat/completions')).toBe('http://localhost:1234/v1/chat/completions');
+    });
+  });
+
+  describe('callLocalLlm', () => {
+    const configOllama = {
+      enabled: true,
+      provider: 'ollama' as const,
+      endpoint: 'http://localhost:11434',
+      model: 'qwen2.5-coder:1.5b',
+    };
+
+    const configOpenAi = {
+      enabled: true,
+      provider: 'openai-compatible' as const,
+      endpoint: 'http://localhost:1234/v1',
+      model: 'custom-model',
+    };
+
+    const messages = [{ role: 'user' as const, content: 'Hello' }];
+
+    it('should request and return message content for Ollama provider', async () => {
+      const mockResponse = {
+        message: {
+          content: 'Hello from Ollama!',
+        },
+      };
+
+      vi.mocked(fetch).mockResolvedValue({
+        ok: true,
+        json: () => Promise.resolve(mockResponse),
+      } as any);
+
+      const response = await callLocalLlm(configOllama, messages);
+
+      expect(response).toBe('Hello from Ollama!');
+      expect(fetch).toHaveBeenCalledWith('http://localhost:11434/api/chat', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          model: 'qwen2.5-coder:1.5b',
+          messages,
+          stream: false,
+        }),
+        signal: expect.any(AbortSignal),
+      });
+    });
+
+    it('should throw an error if Ollama response is not ok', async () => {
+      vi.mocked(fetch).mockResolvedValue({
+        ok: false,
+        status: 500,
+        text: () => Promise.resolve('Internal server error'),
+      } as any);
+
+      await expect(callLocalLlm(configOllama, messages)).rejects.toThrow(
+        'Ollama request failed with status 500: Internal server error'
+      );
+    });
+
+    it('should request and return message content for OpenAI provider', async () => {
+      const mockResponse = {
+        choices: [
+          {
+            message: {
+              content: 'Hello from OpenAI!',
+            },
+          },
+        ],
+      };
+
+      vi.mocked(fetch).mockResolvedValue({
+        ok: true,
+        json: () => Promise.resolve(mockResponse),
+      } as any);
+
+      const response = await callLocalLlm(configOpenAi, messages);
+
+      expect(response).toBe('Hello from OpenAI!');
+      expect(fetch).toHaveBeenCalledWith('http://localhost:1234/v1/chat/completions', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          model: 'custom-model',
+          messages,
+          stream: false,
+        }),
+        signal: expect.any(AbortSignal),
+      });
+    });
+
+    it('should throw an error if OpenAI response has invalid format', async () => {
+      vi.mocked(fetch).mockResolvedValue({
+        ok: true,
+        json: () => Promise.resolve({}),
+      } as any);
+
+      await expect(callLocalLlm(configOpenAi, messages)).rejects.toThrow(
+        'Invalid response format received from OpenAI-compatible endpoint'
+      );
+    });
+  });
+});