@swarmclawai/swarmclaw 0.3.1 → 0.4.5

package/src/lib/server/session-tools/openclaw-nodes.ts

@@ -0,0 +1,112 @@
+import { z } from 'zod'
+import { tool, type StructuredToolInterface } from '@langchain/core/tools'
+import type { ToolBuildContext } from './context'
+
+export function buildOpenClawNodeTools(bctx: ToolBuildContext): StructuredToolInterface[] {
+  if (!bctx.hasTool('openclaw_nodes')) return []
+
+  const tools: StructuredToolInterface[] = []
+
+  tools.push(
+    tool(
+      async () => {
+        try {
+          const { listRunningConnectors } = await import('../connectors/manager')
+          const openclawConnectors = listRunningConnectors('openclaw')
+          if (!openclawConnectors.length) {
+            return JSON.stringify({ error: 'No running OpenClaw connector found.' })
+          }
+          const { getRunningInstance } = await import('../connectors/manager')
+          const inst = getRunningInstance(openclawConnectors[0].id)
+          if (!inst) return JSON.stringify({ error: 'OpenClaw connector instance not accessible.' })
+
+          // Proxy through RPC — use sendMessage as a workaround to invoke RPC
+          // We need direct RPC access, so check if the instance exposes it
+          // For now, return a helpful message about the integration
+          return JSON.stringify({
+            status: 'openclaw_nodes_list requires nodes.list RPC support on the gateway',
+            connectorId: openclawConnectors[0].id,
+            note: 'This feature requires the OpenClaw gateway to support nodes.* RPCs.',
+          })
+        } catch (err: any) {
+          return JSON.stringify({ error: err.message })
+        }
+      },
+      {
+        name: 'openclaw_nodes_list',
+        description: 'List connected nodes/IoT devices through the OpenClaw gateway. Requires a running OpenClaw connector with nodes.* RPC support.',
+        schema: z.object({}),
+      },
+    ),
+  )
+
+  tools.push(
+    tool(
+      async ({ nodeId, action, params }) => {
+        try {
+          const { listRunningConnectors, getRunningInstance } = await import('../connectors/manager')
+          const openclawConnectors = listRunningConnectors('openclaw')
+          if (!openclawConnectors.length) {
+            return JSON.stringify({ error: 'No running OpenClaw connector found.' })
+          }
+          const inst = getRunningInstance(openclawConnectors[0].id)
+          if (!inst) return JSON.stringify({ error: 'OpenClaw connector instance not accessible.' })
+
+          return JSON.stringify({
+            status: 'openclaw_node_invoke requires nodes.invoke RPC support on the gateway',
+            nodeId,
+            action,
+            params: params || null,
+            connectorId: openclawConnectors[0].id,
+          })
+        } catch (err: any) {
+          return JSON.stringify({ error: err.message })
+        }
+      },
+      {
+        name: 'openclaw_node_invoke',
+        description: 'Invoke an action on a connected node/IoT device through the OpenClaw gateway.',
+        schema: z.object({
+          nodeId: z.string().describe('Target node ID'),
+          action: z.string().describe('Action to invoke on the node'),
+          params: z.record(z.string(), z.unknown()).optional().describe('Optional parameters for the action'),
+        }),
+      },
+    ),
+  )
+
+  tools.push(
+    tool(
+      async ({ nodeId, message }) => {
+        try {
+          const { listRunningConnectors, getRunningInstance } = await import('../connectors/manager')
+          const openclawConnectors = listRunningConnectors('openclaw')
+          if (!openclawConnectors.length) {
+            return JSON.stringify({ error: 'No running OpenClaw connector found.' })
+          }
+          const inst = getRunningInstance(openclawConnectors[0].id)
+          if (!inst) return JSON.stringify({ error: 'OpenClaw connector instance not accessible.' })
+
+          return JSON.stringify({
+            status: 'openclaw_node_notify requires nodes.notify RPC support on the gateway',
+            nodeId,
+            message,
+            connectorId: openclawConnectors[0].id,
+          })
+        } catch (err: any) {
+          return JSON.stringify({ error: err.message })
+        }
+      },
+      {
+        name: 'openclaw_node_notify',
+        description: 'Send a notification to a connected node/IoT device through the OpenClaw gateway.',
+        schema: z.object({
+          nodeId: z.string().describe('Target node ID'),
+          message: z.string().describe('Notification message'),
+        }),
+      },
+    ),
+  )
+
+  return tools
+}

package/src/lib/server/session-tools/sandbox.ts

@@ -0,0 +1,197 @@
+import { z } from 'zod'
+import { tool, type StructuredToolInterface } from '@langchain/core/tools'
+import fs from 'fs'
+import path from 'path'
+import { spawnSync } from 'child_process'
+import { UPLOAD_DIR } from '../storage'
+import { findBinaryOnPath, truncate, MAX_OUTPUT } from './context'
+import type { ToolBuildContext } from './context'
+
+function getDenoPath(): string | null {
+  return findBinaryOnPath('deno')
+}
+
+function getPythonPath(): string | null {
+  return findBinaryOnPath('python3') ?? findBinaryOnPath('python')
+}
+
+const EXT_MAP: Record<string, string> = {
+  javascript: 'js',
+  typescript: 'ts',
+  python: 'py',
+}
+
+export function buildSandboxTools(bctx: ToolBuildContext): StructuredToolInterface[] {
+  if (!bctx.hasTool('sandbox')) return []
+
+  const tools: StructuredToolInterface[] = []
+
+  tools.push(
+    tool(
+      async ({ language, code, timeoutSec }) => {
+        const timeout = Math.min(Math.max(timeoutSec ?? 60, 5), 300) * 1000
+        const ext = EXT_MAP[language]
+        const sessionId = bctx.ctx?.sessionId ?? 'unknown'
+        const sandboxDir = path.join('/tmp', `swarmclaw-sandbox-${sessionId}-${Date.now()}`)
+
+        // Check runtime availability
+        if ((language === 'javascript' || language === 'typescript') && !getDenoPath()) {
+          return JSON.stringify({ error: 'Deno is not installed. Install it with: curl -fsSL https://deno.land/install.sh | sh' })
+        }
+        if (language === 'python' && !getPythonPath()) {
+          return JSON.stringify({ error: 'Python is not installed. Install python3 to use Python sandbox.' })
+        }
+
+        try {
+          fs.mkdirSync(sandboxDir, { recursive: true })
+          const scriptFile = `script.${ext}`
+          const scriptPath = path.join(sandboxDir, scriptFile)
+          fs.writeFileSync(scriptPath, code, 'utf-8')
+
+          let result: ReturnType<typeof spawnSync>
+
+          if (language === 'javascript' || language === 'typescript') {
+            const denoPath = getDenoPath()!
+            result = spawnSync(denoPath, [
+              'run',
+              '--allow-read=.',
+              '--allow-write=.',
+              '--allow-net',
+              '--deny-env',
+              '--no-prompt',
+              scriptFile,
+            ], {
+              cwd: sandboxDir,
+              encoding: 'utf-8',
+              timeout,
+              maxBuffer: MAX_OUTPUT,
+            })
+          } else {
+            const pythonPath = getPythonPath()!
+            result = spawnSync(pythonPath, [scriptPath], {
+              cwd: sandboxDir,
+              encoding: 'utf-8',
+              timeout,
+              maxBuffer: MAX_OUTPUT,
+              env: { PATH: process.env.PATH || '/usr/bin:/bin' } as unknown as NodeJS.ProcessEnv,
+            })
+          }
+
+          const stdout = truncate((result.stdout || '').toString(), MAX_OUTPUT)
+          const stderr = truncate((result.stderr || '').toString(), MAX_OUTPUT)
+          const exitCode = result.status ?? (result.error ? 1 : 0)
+          const timedOut = result.error?.message?.includes('ETIMEDOUT') || result.signal === 'SIGTERM'
+
+          // Scan for created files (exclude the script itself)
+          const artifacts: { name: string; url: string }[] = []
+          try {
+            const files = fs.readdirSync(sandboxDir)
+            for (const file of files) {
+              if (file === scriptFile) continue
+              const src = path.join(sandboxDir, file)
+              const stat = fs.statSync(src)
+              if (!stat.isFile()) continue
+              // Copy to upload dir
+              fs.mkdirSync(UPLOAD_DIR, { recursive: true })
+              const destName = `sandbox-${Date.now()}-${file}`
+              const dest = path.join(UPLOAD_DIR, destName)
+              fs.copyFileSync(src, dest)
+              artifacts.push({
+                name: file,
+                url: `/api/uploads/${encodeURIComponent(destName)}`,
+              })
+            }
+          } catch {
+            // ignore scan errors
+          }
+
+          return JSON.stringify({
+            exitCode,
+            timedOut,
+            stdout,
+            stderr,
+            artifacts,
+          })
+        } catch (err: unknown) {
+          return JSON.stringify({ error: err instanceof Error ? err.message : String(err) })
+        } finally {
+          try { fs.rmSync(sandboxDir, { recursive: true, force: true }) } catch { /* ignore */ }
+        }
+      },
+      {
+        name: 'sandbox_exec',
+        description:
+          'Execute code in an isolated sandbox. JS/TS runs via Deno with network access but no env vars. Python runs with a stripped environment. ' +
+          'Files created in the sandbox directory are returned as downloadable artifact URLs. Use this for data processing, API calls, calculations, and file generation.',
+        schema: z.object({
+          language: z.enum(['javascript', 'typescript', 'python']).describe('Programming language to execute'),
+          code: z.string().describe('Source code to run'),
+          timeoutSec: z.number().optional().describe('Execution timeout in seconds (default 60, max 300)'),
+        }),
+      },
+    ),
+  )
+
+  tools.push(
+    tool(
+      async () => {
+        const denoPath = getDenoPath()
+        const pythonPath = getPythonPath()
+
+        const runtimes: Record<string, { available: boolean; path: string | null; version: string | null }> = {}
+
+        for (const [name, bin] of [['deno', denoPath], ['python', pythonPath]] as const) {
+          if (bin) {
+            const ver = spawnSync(bin, ['--version'], { encoding: 'utf-8', timeout: 3000 })
+            const version = (ver.stdout || '').split('\n')[0]?.trim() || null
+            runtimes[name] = { available: true, path: bin, version }
+          } else {
+            runtimes[name] = { available: false, path: null, version: null }
+          }
+        }
+
+        return JSON.stringify(runtimes)
+      },
+      {
+        name: 'sandbox_list_runtimes',
+        description: 'List available sandbox runtimes (Deno for JS/TS, Python) and their versions. Use this to check what languages are available before running code.',
+        schema: z.object({}),
+      },
+    ),
+  )
+
+  // ---- openclaw_sandbox (CLI passthrough) -----------------------------------
+
+  const openclawSandboxPath = findBinaryOnPath('openclaw') || findBinaryOnPath('clawdbot')
+  if (openclawSandboxPath) {
+    tools.push(
+      tool(
+        async ({ code, explain }) => {
+          try {
+            const args = explain ? ['sandbox', 'explain', code] : ['sandbox', 'run', code]
+            const result = spawnSync(openclawSandboxPath, args, {
+              encoding: 'utf-8',
+              timeout: 60_000,
+              maxBuffer: MAX_OUTPUT,
+            })
+            const stdout = truncate((result.stdout || '').trim(), MAX_OUTPUT)
+            const stderr = truncate((result.stderr || '').trim(), MAX_OUTPUT)
+            return JSON.stringify({ exitCode: result.status ?? 0, stdout, stderr })
+          } catch (err: any) {
+            return JSON.stringify({ error: err.message })
+          }
+        },
+        {
+          name: 'openclaw_sandbox',
+          description: 'Execute or explain code through the OpenClaw CLI sandbox. CLI passthrough to `openclaw sandbox run|explain <code>`. Requires openclaw/clawdbot CLI on PATH.',
+          schema: z.object({
+            code: z.string().describe('Code to run or explain'),
+            explain: z.boolean().optional().describe('If true, explain the code instead of running it'),
+          }),
+        },
+      ),
+    )
+  }
+
+  return tools
+}

package/src/lib/server/session-tools/search-providers.ts

@@ -0,0 +1,270 @@
+import * as cheerio from 'cheerio'
+import type { AppSettings } from '@/types'
+
+export interface SearchResult {
+  title: string
+  url: string
+  snippet: string
+}
+
+export interface WebSearchProvider {
+  id: string
+  name: string
+  search(query: string, maxResults: number): Promise<SearchResult[]>
+}
+
+const UA = 'Mozilla/5.0 (compatible; SwarmClaw/1.0)'
+
+// ---------------------------------------------------------------------------
+// DuckDuckGo
+// ---------------------------------------------------------------------------
+
+function decodeDuckDuckGoUrl(rawUrl: string): string {
+  if (!rawUrl) return rawUrl
+  try {
+    const url = rawUrl.startsWith('http')
+      ? new URL(rawUrl)
+      : new URL(rawUrl, 'https://duckduckgo.com')
+    const uddg = url.searchParams.get('uddg')
+    if (uddg) return decodeURIComponent(uddg)
+    return url.toString()
+  } catch {
+    const fromQuery = rawUrl.match(/[?&]uddg=([^&]+)/)?.[1]
+    if (fromQuery) {
+      try { return decodeURIComponent(fromQuery) } catch { /* noop */ }
+    }
+    return rawUrl
+  }
+}
+
+class DuckDuckGoProvider implements WebSearchProvider {
+  id = 'duckduckgo'
+  name = 'DuckDuckGo'
+
+  async search(query: string, maxResults: number): Promise<SearchResult[]> {
+    const url = `https://duckduckgo.com/html/?q=${encodeURIComponent(query)}`
+    const res = await fetch(url, {
+      headers: { 'User-Agent': UA },
+      signal: AbortSignal.timeout(15000),
+    })
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+    const html = await res.text()
+    const $ = cheerio.load(html)
+    const results: SearchResult[] = []
+
+    $('.result').each((_i, el) => {
+      if (results.length >= maxResults) return false
+      const link = $(el).find('a.result__a').first()
+      const rawHref = link.attr('href') || ''
+      const title = link.text().replace(/\s+/g, ' ').trim()
+      if (!rawHref || !title) return
+      const snippet = $(el).find('.result__snippet').first().text().replace(/\s+/g, ' ').trim()
+      results.push({ title, url: decodeDuckDuckGoUrl(rawHref), snippet })
+    })
+
+    if (results.length === 0) {
+      $('a.result__a').each((_i, el) => {
+        if (results.length >= maxResults) return false
+        const rawHref = $(el).attr('href') || ''
+        const title = $(el).text().replace(/\s+/g, ' ').trim()
+        if (!rawHref || !title) return
+        results.push({ title, url: decodeDuckDuckGoUrl(rawHref), snippet: '' })
+      })
+    }
+
+    return results
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Google (scraping)
+// ---------------------------------------------------------------------------
+
+class GoogleProvider implements WebSearchProvider {
+  id = 'google'
+  name = 'Google'
+
+  async search(query: string, maxResults: number): Promise<SearchResult[]> {
+    const url = `https://www.google.com/search?q=${encodeURIComponent(query)}&num=${maxResults}`
+    const res = await fetch(url, {
+      headers: { 'User-Agent': UA, 'Accept-Language': 'en-US,en;q=0.9' },
+      signal: AbortSignal.timeout(15000),
+    })
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+    const html = await res.text()
+    const $ = cheerio.load(html)
+    const results: SearchResult[] = []
+
+    $('div.g').each((_i, el) => {
+      if (results.length >= maxResults) return false
+      const anchor = $(el).find('a').first()
+      const href = anchor.attr('href') || ''
+      if (!href || href.startsWith('/search')) return
+      const title = $(el).find('h3').first().text().replace(/\s+/g, ' ').trim()
+      if (!title) return
+      // Snippet is in various containers depending on Google's layout
+      const snippet = $(el).find('[data-sncf], .VwiC3b, .st').first().text().replace(/\s+/g, ' ').trim()
+      results.push({ title, url: href, snippet })
+    })
+
+    return results
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Bing (scraping)
+// ---------------------------------------------------------------------------
+
+class BingProvider implements WebSearchProvider {
+  id = 'bing'
+  name = 'Bing'
+
+  async search(query: string, maxResults: number): Promise<SearchResult[]> {
+    const url = `https://www.bing.com/search?q=${encodeURIComponent(query)}&count=${maxResults}`
+    const res = await fetch(url, {
+      headers: { 'User-Agent': UA },
+      signal: AbortSignal.timeout(15000),
+    })
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+    const html = await res.text()
+    const $ = cheerio.load(html)
+    const results: SearchResult[] = []
+
+    $('li.b_algo').each((_i, el) => {
+      if (results.length >= maxResults) return false
+      const anchor = $(el).find('h2 a').first()
+      const href = anchor.attr('href') || ''
+      const title = anchor.text().replace(/\s+/g, ' ').trim()
+      if (!href || !title) return
+      const snippet = $(el).find('.b_caption p').first().text().replace(/\s+/g, ' ').trim()
+      results.push({ title, url: href, snippet })
+    })
+
+    return results
+  }
+}
+
+// ---------------------------------------------------------------------------
+// SearXNG (JSON API)
+// ---------------------------------------------------------------------------
+
+class SearXNGProvider implements WebSearchProvider {
+  id = 'searxng'
+  name = 'SearXNG'
+
+  constructor(private baseUrl: string) {}
+
+  async search(query: string, maxResults: number): Promise<SearchResult[]> {
+    const url = `${this.baseUrl.replace(/\/+$/, '')}/search?q=${encodeURIComponent(query)}&format=json`
+    const res = await fetch(url, {
+      headers: { 'User-Agent': UA },
+      signal: AbortSignal.timeout(15000),
+    })
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+    const data = await res.json()
+    const rawResults = Array.isArray(data.results) ? data.results : []
+    return rawResults.slice(0, maxResults).map((r: any) => ({
+      title: r.title || '',
+      url: r.url || '',
+      snippet: r.content || '',
+    }))
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Tavily (API key required — from secrets)
+// ---------------------------------------------------------------------------
+
+class TavilyProvider implements WebSearchProvider {
+  id = 'tavily'
+  name = 'Tavily'
+
+  constructor(private apiKey: string) {}
+
+  async search(query: string, maxResults: number): Promise<SearchResult[]> {
+    const res = await fetch('https://api.tavily.com/search', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        api_key: this.apiKey,
+        query,
+        max_results: maxResults,
+      }),
+      signal: AbortSignal.timeout(15000),
+    })
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+    const data = await res.json()
+    const rawResults = Array.isArray(data.results) ? data.results : []
+    return rawResults.slice(0, maxResults).map((r: any) => ({
+      title: r.title || '',
+      url: r.url || '',
+      snippet: r.content || '',
+    }))
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Brave Search (API key required — from secrets)
+// ---------------------------------------------------------------------------
+
+class BraveProvider implements WebSearchProvider {
+  id = 'brave'
+  name = 'Brave Search'
+
+  constructor(private apiKey: string) {}
+
+  async search(query: string, maxResults: number): Promise<SearchResult[]> {
+    const res = await fetch(
+      `https://api.search.brave.com/res/v1/web/search?q=${encodeURIComponent(query)}&count=${maxResults}`,
+      {
+        headers: {
+          'Accept': 'application/json',
+          'Accept-Encoding': 'gzip',
+          'X-Subscription-Token': this.apiKey,
+        },
+        signal: AbortSignal.timeout(15000),
+      },
+    )
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+    const data = await res.json()
+    const rawResults = Array.isArray(data.web?.results) ? data.web.results : []
+    return rawResults.slice(0, maxResults).map((r: any) => ({
+      title: r.title || '',
+      url: r.url || '',
+      snippet: r.description || '',
+    }))
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+
+export async function getSearchProvider(settings: Partial<AppSettings>): Promise<WebSearchProvider> {
+  const providerId = settings.webSearchProvider || 'duckduckgo'
+
+  switch (providerId) {
+    case 'google':
+      return new GoogleProvider()
+    case 'bing':
+      return new BingProvider()
+    case 'searxng': {
+      const url = settings.searxngUrl || 'http://localhost:8080'
+      return new SearXNGProvider(url)
+    }
+    case 'tavily': {
+      const { getSecret } = await import('../storage')
+      const secret = await getSecret('tavily')
+      if (!secret?.value) throw new Error('Tavily requires an API key. Add a secret named "tavily" in Secrets.')
+      return new TavilyProvider(secret.value)
+    }
+    case 'brave': {
+      const { getSecret } = await import('../storage')
+      const secret = await getSecret('brave')
+      if (!secret?.value) throw new Error('Brave Search requires an API key. Add a secret named "brave" in Secrets.')
+      return new BraveProvider(secret.value)
+    }
+    default:
+      return new DuckDuckGoProvider()
+  }
+}

package/src/lib/server/session-tools/session-info.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod'
 import { tool, type StructuredToolInterface } from '@langchain/core/tools'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadSessions, saveSessions, loadAgents } from '../storage'
 import type { ToolBuildContext } from './context'
 
@@ -165,7 +165,7 @@ export function buildSessionInfoTools(bctx: ToolBuildContext): StructuredToolInt
               const sourceSession = ctx?.sessionId ? sessions[ctx.sessionId] : null
               const ownerUser = sourceSession?.user || 'system'
 
-              const id = crypto.randomBytes(4).toString('hex')
+              const id = genId()
               const now = Date.now()
               const entry = {
                 id,