@oar-sh/oar 0.9.0

package/server/routes/preview-routes.mjs

@@ -0,0 +1,108 @@
+'use strict';
+
+// Preview management API. Lives on the *relay* port behind `auth` — the preview
+// listener itself has no routes and no way to register anything. Creating or
+// closing a preview therefore always requires the relay token, even though the
+// resulting URL is public.
+
+import { validateStaticRoot } from '../services/preview-static-handler.mjs';
+
+export function registerPreviewRoutes(app, deps) {
+  const {
+    auth,
+    previewRegistry,
+    previewHealthProbe = null,
+    // (conversationId) => absolute workspace root or ''. Static previews are
+    // jailed to it; without one they are refused rather than served unscoped.
+    resolvePreviewWorkspaceRoot = () => '',
+    // (conversationId, preview) => void. Pins a transcript card when a turn is
+    // in flight for the conversation; a no-op otherwise (manual /preview
+    // publishes stay panel-only — the transcript records the conversation, not
+    // panel actions).
+    recordPreviewCard = () => {},
+  } = deps;
+
+  function laneUnavailable(res) {
+    const settings = previewRegistry?.settings;
+    if (!settings) return res.status(503).json({ error: 'Preview lane is unavailable' });
+    // The interlock errors are the actionable part of a disabled lane ("you set
+    // publicBaseUrl to the relay's hostname"), so they are handed back verbatim
+    // rather than collapsed into a generic 503.
+    return res.status(503).json({
+      error: settings.requested
+        ? 'Preview lane failed its startup checks'
+        : 'Preview lane is disabled (set previews.enabled and previews.publicBaseUrl)',
+      details: settings.errors || [],
+    });
+  }
+
+  // GET /api/previews — every live preview, or one conversation's when filtered.
+  // Unfiltered is what the settings "Live previews" list uses: nothing expires
+  // on its own, so there has to be one place that shows everything.
+  app.get('/api/previews', auth, (req, res) => {
+    const conversationId = String(req.query?.conversationId || '').trim();
+    const previews = conversationId
+      ? previewRegistry.listForConversation(conversationId)
+      : previewRegistry.list();
+    res.json({
+      previews,
+      enabled: previewRegistry.settings?.enabled === true,
+      publicBaseUrl: previewRegistry.settings?.publicBaseUrl || '',
+      errors: previewRegistry.settings?.errors || [],
+    });
+  });
+
+  // POST /api/previews — publish an already-listening local port, or a
+  // directory the lane serves itself (static mode).
+  app.post('/api/previews', auth, (req, res) => {
+    if (previewRegistry.settings?.enabled !== true) return laneUnavailable(res);
+
+    const dir = String(req.body?.dir || '').trim();
+    const hasPort = req.body?.port !== undefined && req.body?.port !== null && String(req.body.port).trim() !== '';
+    if (dir && hasPort) {
+      return res.status(400).json({ error: 'Pass either port or dir, not both' });
+    }
+
+    let created;
+    if (dir) {
+      const conversationId = String(req.body?.conversationId || '').trim();
+      let workspaceRoot = '';
+      try {
+        workspaceRoot = String(resolvePreviewWorkspaceRoot(conversationId) || '');
+      } catch {}
+      const jailed = validateStaticRoot(dir, { workspaceRoot });
+      if (!jailed.ok) return res.status(400).json({ error: jailed.error });
+      created = previewRegistry.createStatic({
+        conversationId,
+        rootDir: jailed.rootDir,
+        label: req.body?.label,
+      });
+    } else {
+      const port = Number(req.body?.port);
+      if (!Number.isFinite(port)) return res.status(400).json({ error: 'Missing or invalid port (or pass dir for a static preview)' });
+      created = previewRegistry.create({
+        conversationId: req.body?.conversationId,
+        port,
+        host: req.body?.host,
+        label: req.body?.label,
+      });
+    }
+    if (!created.ok) return res.status(created.status || 400).json({ error: created.error });
+
+    try {
+      recordPreviewCard(String(req.body?.conversationId || '').trim(), created.preview);
+    } catch {}
+    // Probe immediately so the card does not sit badge-less until the next
+    // scheduled sweep — and so a typo'd port shows as offline right away.
+    previewHealthProbe?.probeNow?.(created.preview.token);
+    res.json({ ok: true, preview: created.preview, url: created.preview.url, basePath: created.preview.basePath });
+  });
+
+  // DELETE /api/previews/:token — the link stops resolving immediately. The dev
+  // server behind it is untouched; it is a separate background task.
+  app.delete('/api/previews/:token', auth, (req, res) => {
+    const closed = previewRegistry.close(req.params?.token);
+    if (!closed.ok) return res.status(closed.status || 404).json({ error: closed.error });
+    res.json({ ok: true, preview: closed.preview });
+  });
+}

package/server/routes/push-routes.mjs

@@ -0,0 +1,59 @@
+'use strict';
+
+/**
+ * Web Push subscription management. All endpoints sit behind the token auth
+ * middleware, so shared read-only viewers (who authenticate with a share
+ * token, not the relay token) cannot reach them.
+ */
+export function registerPushRoutes(app, deps) {
+  const {
+    auth,
+    pushDispatchService,
+    getPushVapidPublicKey,
+  } = deps;
+
+  app.get('/api/push/vapid-public-key', auth, (req, res) => {
+    const publicKey = String(getPushVapidPublicKey() || '').trim();
+    if (!publicKey) return res.status(503).json({ error: 'Push is not configured' });
+    res.json({ publicKey });
+  });
+
+  app.get('/api/push/devices', auth, (req, res) => {
+    res.json({ devices: pushDispatchService.listDevices() });
+  });
+
+  app.post('/api/push/subscribe', auth, (req, res) => {
+    const { deviceId, label, subscription, preferences } = req.body || {};
+    const endpoint = String(subscription?.endpoint || '').trim();
+    const keys = subscription?.keys && typeof subscription.keys === 'object' ? subscription.keys : null;
+    if (!String(deviceId || '').trim() || !endpoint || !keys?.p256dh || !keys?.auth) {
+      return res.status(400).json({ error: 'Missing deviceId or subscription' });
+    }
+    const result = pushDispatchService.upsertSubscription({
+      deviceId,
+      label,
+      endpoint,
+      keys,
+      preferences,
+      userAgent: req.headers['user-agent'] || null,
+    });
+    if (!result.ok) return res.status(400).json({ error: result.error || 'Invalid subscription' });
+    res.json({ device: result.device });
+  });
+
+  app.patch('/api/push/devices/:id', auth, (req, res) => {
+    const { label, preferences } = req.body || {};
+    if (label === undefined && preferences === undefined) {
+      return res.status(400).json({ error: 'Nothing to update' });
+    }
+    const result = pushDispatchService.updateDevice(req.params.id, { label, preferences });
+    if (!result.ok) return res.status(404).json({ error: result.error || 'Not found' });
+    res.json({ device: result.device });
+  });
+
+  app.delete('/api/push/devices/:id', auth, (req, res) => {
+    const result = pushDispatchService.deleteDevice(req.params.id);
+    if (!result.ok) return res.status(404).json({ error: 'Not found' });
+    res.json({ ok: true });
+  });
+}

package/server/routes/relay-board-routes.mjs

@@ -0,0 +1,268 @@
+'use strict';
+
+function normalizeId(value) {
+  const text = String(value || '').trim();
+  return text || null;
+}
+
+function normalizeBoardText(value, fallback = '') {
+  const text = String(value || '').trim();
+  if (!text) return fallback;
+  return text.slice(0, 12_000);
+}
+
+function normalizeBoardType(value) {
+  const text = String(value || '').trim().toLowerCase();
+  if (!text) return 'generic';
+  return text.replace(/[^a-z0-9_-]+/g, '-').replace(/^-+|-+$/g, '') || 'generic';
+}
+
+function labelForAction(actionId) {
+  const id = String(actionId || '').trim().toLowerCase();
+  if (id === 'autopilot') return 'Implement in autopilot';
+  if (id === 'autopilot_fleet') return 'Implement with autopilot fleet';
+  if (id === 'interactive') return 'Stop here and prompt myself';
+  if (id === 'exit_only') return 'Stop here';
+  return id.replace(/[_-]+/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase()) || 'Select';
+}
+
+function defaultPromptForAction(actionId, board = null) {
+  const summary = String(board?.body || '').trim();
+  if (actionId === 'autopilot') {
+    return `Please implement the approved plan now.\n\nPlan summary:\n${summary}`;
+  }
+  if (actionId === 'autopilot_fleet') {
+    return `Please implement the approved plan using autopilot_fleet where useful.\n\nPlan summary:\n${summary}`;
+  }
+  if (actionId === 'interactive') {
+    return `I approved the plan. Let's proceed interactively with implementation.\n\nPlan summary:\n${summary}`;
+  }
+  return '';
+}
+
+function modeForAction(actionId, fallbackMode) {
+  if (actionId === 'autopilot' || actionId === 'autopilot_fleet') return 'autopilot';
+  if (actionId === 'interactive') return 'agent';
+  return fallbackMode;
+}
+
+function normalizeBoardActions(rawActions) {
+  const input = Array.isArray(rawActions) ? rawActions : [];
+  const normalized = [];
+  const seen = new Set();
+  for (const entry of input) {
+    const item = (typeof entry === 'string')
+      ? { id: entry }
+      : (entry && typeof entry === 'object' ? entry : null);
+    if (!item) continue;
+    const id = String(item.id || item.actionId || item.value || '').trim().toLowerCase();
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    const label = String(item.label || item.title || labelForAction(id)).trim().slice(0, 120) || labelForAction(id);
+    const mode = normalizeId(item.mode);
+    const prompt = normalizeBoardText(item.prompt || '', '');
+    normalized.push({
+      id,
+      label,
+      mode: mode || null,
+      prompt: prompt || null,
+    });
+  }
+  return normalized.slice(0, 8);
+}
+
+function parseContext(value) {
+  if (!value) return null;
+  if (typeof value === 'object') return value;
+  if (typeof value !== 'string') return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+export function registerRelayBoardRoutes(app, deps) {
+  const {
+    auth,
+    io,
+    stmts,
+    uuidv4,
+    normalizeRelayMode,
+    resolveRequestedModel,
+    DEFAULT_RELAY_MODE,
+    DEFAULT_MODEL,
+    formatRelayBoardRow,
+    pushDispatchService,
+  } = deps;
+
+  app.get('/api/relay-boards', auth, (req, res) => {
+    const conversationId = req.query.conversationId ? String(req.query.conversationId) : null;
+    const status = String(req.query.status || 'pending').trim() || 'pending';
+    const rows = stmts.listBoards.all(status, conversationId, conversationId);
+    res.json({ boards: rows.map(formatRelayBoardRow).filter(Boolean) });
+  });
+
+  app.get('/api/relay-board/:id', auth, (req, res) => {
+    const row = stmts.getBoard.get(req.params.id);
+    if (!row) return res.status(404).json({ error: 'Not found' });
+    res.json({ board: formatRelayBoardRow(row) });
+  });
+
+  app.post('/api/relay-board', auth, (req, res) => {
+    const {
+      queueId,
+      messageId,
+      conversationId,
+      mode,
+      boardType,
+      title,
+      body,
+      actions,
+      recommendedAction,
+      context,
+    } = req.body || {};
+    const q = stmts.findQById.get(queueId || messageId);
+    if (!q || q.status !== 'processing') {
+      return res.status(409).json({ error: 'No active relay turn' });
+    }
+
+    const effectiveMessageId = normalizeId(messageId) || q.id;
+    const normalizedBoardType = normalizeBoardType(boardType || 'generic');
+    const existing = stmts.findBoardByMessageType.get(effectiveMessageId, normalizedBoardType);
+    if (existing) {
+      return res.json({ board: formatRelayBoardRow(existing), reused: true });
+    }
+
+    const now = new Date().toISOString();
+    const boardId = uuidv4();
+    const relayMode = normalizeRelayMode(mode || q.relay_mode) || DEFAULT_RELAY_MODE;
+    const normalizedActions = normalizeBoardActions(actions);
+    const normalizedRecommended = normalizeId(recommendedAction);
+    const boardContext = parseContext(context);
+
+    stmts.insertBoard.run(
+      boardId,
+      q.id,
+      normalizeId(conversationId) || q.conversation_id,
+      effectiveMessageId,
+      normalizedBoardType,
+      relayMode,
+      normalizeBoardText(title, 'Plan ready for review'),
+      normalizeBoardText(body, ''),
+      normalizedActions.length ? JSON.stringify(normalizedActions) : null,
+      normalizedRecommended,
+      boardContext ? JSON.stringify(boardContext) : null,
+      now,
+      now,
+    );
+
+    const board = formatRelayBoardRow(stmts.getBoard.get(boardId));
+    io.emit('relay_board', { board });
+    void pushDispatchService?.notifyBoard?.(board);
+    io.emit('relay_board_changed', { conversationId: board?.conversationId || null, boardId });
+    return res.json({ board });
+  });
+
+  app.post('/api/relay-board/:id/action', auth, (req, res) => {
+    const boardId = normalizeId(req.params.id);
+    const actionId = normalizeId(req.body?.actionId || req.body?.action_id);
+    const clientId = normalizeId(req.body?.clientId || req.body?.client_id);
+    if (!boardId || !actionId) return res.status(400).json({ error: 'Missing board/action id' });
+
+    const row = stmts.getBoard.get(boardId);
+    if (!row) return res.status(404).json({ error: 'Not found' });
+    if (String(row.status || '').trim().toLowerCase() !== 'pending') {
+      return res.status(409).json({ error: `Board already ${row.status}` });
+    }
+
+    const board = formatRelayBoardRow(row);
+    const actions = Array.isArray(board?.actions) ? board.actions : [];
+    const selected = actions.find((item) => String(item?.id || '').trim().toLowerCase() === actionId.toLowerCase());
+    if (!selected) return res.status(400).json({ error: 'Unknown board action' });
+
+    const now = new Date().toISOString();
+    const shouldDismiss = actionId.toLowerCase() === 'exit_only';
+    if (shouldDismiss) {
+      stmts.dismissBoard.run(actionId, now, now, boardId);
+    } else {
+      stmts.markBoardAction.run(actionId, now, now, boardId);
+    }
+
+    let queuedMessageId = null;
+    if (!shouldDismiss) {
+      const followupPrompt = normalizeBoardText(selected.prompt || defaultPromptForAction(actionId.toLowerCase(), board), '');
+      if (followupPrompt) {
+        const relayMode = normalizeRelayMode(selected.mode || modeForAction(actionId.toLowerCase(), board.mode)) || DEFAULT_RELAY_MODE;
+        const convId = String(board?.conversationId || '').trim();
+        const runtimeSession = stmts.getRuntimeSessionByConversation?.get?.(convId) || null;
+        const latestModel = stmts.getLatestConversationModel?.get?.(convId)?.model || null;
+        const modelResolution = typeof resolveRequestedModel === 'function'
+          ? resolveRequestedModel(latestModel || DEFAULT_MODEL)
+          : { ok: true, model: latestModel || DEFAULT_MODEL, modelVariantId: latestModel || DEFAULT_MODEL, reasoningEffort: null };
+        const resolvedBaseModel = modelResolution?.ok ? String(modelResolution.model || '').trim() : (latestModel || DEFAULT_MODEL);
+        const resolvedVariantModel = modelResolution?.ok
+          ? String(modelResolution.modelVariantId || latestModel || resolvedBaseModel).trim()
+          : String(latestModel || resolvedBaseModel).trim();
+        const resolvedReasoningEffort = modelResolution?.ok
+          ? String(modelResolution.reasoningEffort || '').trim() || null
+          : null;
+        queuedMessageId = uuidv4();
+        stmts.insertMsg.run(
+          queuedMessageId,
+          convId,
+          'user',
+          followupPrompt,
+          resolvedVariantModel,
+          relayMode,
+          null,
+          now,
+          resolvedVariantModel || null,
+          null,
+          String(resolvedVariantModel || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual',
+        );
+        stmts.updateConvTime.run(now, convId);
+        stmts.insertQ.run(
+          queuedMessageId,
+          convId,
+          runtimeSession?.id || null,
+          0,
+          resolvedBaseModel,
+          resolvedVariantModel,
+          resolvedReasoningEffort,
+          relayMode,
+          followupPrompt,
+          null,
+          now,
+          null,
+          null,
+          null,
+          null,
+        );
+        io.emit('user_message', {
+          conversationId: convId,
+          messageId: queuedMessageId,
+          senderClientId: clientId || null,
+          message: {
+            role: 'user',
+            text: followupPrompt,
+            model: resolvedVariantModel,
+            modelOrigin: String(resolvedVariantModel || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual',
+            mode: relayMode,
+            attachments: [],
+            timestamp: now,
+          },
+        });
+      }
+    }
+
+    const updated = formatRelayBoardRow(stmts.getBoard.get(boardId));
+    io.emit('relay_board_updated', { board: updated });
+    io.emit('relay_board_changed', { conversationId: updated?.conversationId || null, boardId });
+    return res.json({
+      ok: true,
+      board: updated,
+      queuedMessageId,
+    });
+  });
+}