@withbuddi/buddi 0.1.0-pre.21 → 0.1.0-pre.23

package/node_modules/@buddi/gateway/dist/web/server.js

@@ -41,7 +41,7 @@
  * No `Access-Control-*` header is ever emitted, and `OPTIONS` is refused: a
  * page on another origin gets no preflight and no permission.
  */
-import { listNotificationsRoute, markSeenRoute, notificationSettingsRoute, presenceRoute, testChannelRoute } from './notifications.js';
+import { focusRoute, listNotificationsRoute, markSeenRoute, notificationSettingsRoute, presenceRoute, testChannelRoute } from './notifications.js';
 import { catalogSkillLookup, discardProposalFromWeb, keepProposalFromWeb, readProposals, registryChangeLookup } from './proposals.js';
 import { latestDigest, readDigestSchedule, setDigestSchedule } from '../agents/learning-digest.js';
 import { readAgentSkills, removeLearnedSkillFromWeb } from '../agents/learned-skills.js';
@@ -61,6 +61,8 @@ import { listSecrets, secretUses, secretsAct } from './secrets.js';
 import { sayRoute, transcribeRoute } from './speech.js';
 import { createServer } from 'node:http';
 import { getAction, inRecovery, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding } from '@buddi/core';
+import { connectionsOf } from '@buddi/tool-mcp';
+import { CONNECTIONS_CALLBACK_PATH, connectionsRoute } from './connections.js';
 import { browserHost } from '../browser-host.js';
 import { hostService } from '@buddi/tool-host';
 import { listToolPermissions, revokeToolPermission, getArtifact, readArtifactBytes, artifactBytesExist, discardUnreferencedUpload, listLibrary, getLibraryEntry, decodeCursor, filterKey, textPreviewable, readArtifactPrefix, FILE_FAMILIES, LIBRARY_PAGE_MAX, getOwnerProfile, setOwnerProfile, isKnownTimezone, listGroups, getGroup, createGroup, updateGroup, archiveGroup, GroupRefusal, createGroupConversation, listGroupConversations, latestGroupConversation, openGroupRequest, conversationGroup } from '@buddi/core';
@@ -84,14 +86,17 @@ import { TAILSCALE_SETTING_KEY, daemonWhois, plausibleLogin, proxiedThroughTails
 import { extensionEndpoint } from './extension.js';
 import { REMOTE_HAND_SOCKET_PATH, RemoteHandEndpoint } from './remote-hand.js';
 import { csrfCookieName, CSRF_HEADER, sessionCookieName, requestPort, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, remoteKey, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
-import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readMissions, readOverview, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
+import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readMissions, readOverview, setGlanceHidden, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
 import { RateLimiter, SessionStore, } from './sessions.js';
 import { supervisorCall } from './service.js';
 import { backupJobRoute, createBackupRoute, discardUpload, listBackups, passphraseRoute, receiveUpload, restoreRoute, scheduleRoute, verifyBackupRoute, } from './backups.js';
-import { acceptAgentRoute, approveRoute, listPlugins, pluginJobRoute, receivePluginUpload, rejectRoute, stageRoute, uninstallRoute, updateRoute, uploadRoute, } from './plugins.js';
-import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers } from './agent-offers.js';
+import { acceptAgentRoute, approveRoute, listPlugins, pluginJobRoute, receivePluginUpload, rejectRoute, stageRoute, toggleRoute, uninstallRoute, updateRoute, uploadRoute, } from './plugins.js';
+import { tipsRoute } from '../tips/route.js';
+import { readFacts, webSettingsStore } from '../tips/facts.js';
+import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers, readTeammates } from './agent-offers.js';
 import { currentVersion, upgradeJobRoute, upgradeRoute, versionCheckRoute, versionRoute, } from './version.js';
 import { leaveRecoveryMode, readRecoveryView } from './recovery.js';
+import { readRail, setRailPageHidden } from './rail.js';
 import { BUILD_MISSING, serveAsset } from './static.js';
 import { StreamBudget, resumeCursor, streamConversation } from './stream.js';
 import { ensureWebToken, verifyTicket } from './token.js';
@@ -447,6 +452,22 @@ export function createWebApp(deps) {
         // decides how long a session minted now lives, and it must keep matching
         // for as long as that session is used.
         const scope = requestScope(req);
+        /*
+         * Where a connected service's consent page sends the owner back
+         * (docs/connections.md). The page itself, before the session gate: the
+         * session cookie is SameSite=Strict and does not ride a redirect from
+         * another site, and minting a fresh session here would orphan the one
+         * the sign-in was bound to. It is the dashboard's own shell and nothing
+         * else; it hands `code` and `state` to `POST /api/connections/callback`,
+         * a same-site request that carries the cookie and the CSRF pair, and the
+         * state is checked there against the session that started the sign-in.
+         */
+        if ((method === 'GET' || method === 'HEAD') && url.pathname === CONNECTIONS_CALLBACK_PATH) {
+            const served = await serveAsset(res, assetsDir, '/index.html');
+            if (!served.served)
+                sendText(res, 503, BUILD_MISSING);
+            return;
+        }
         // The ticket exchange. Only ever on a GET, and only ever on a page URL: a ticket is handed out as a link somebody
         // opens, never as a query on an API call. So under /api/ the parameter is
         // just a parameter, and a poller that happens to use the same name cannot
@@ -611,12 +632,13 @@ export function createWebApp(deps) {
         /** Talking to buddi on the dashboard: the speech plugin's two tools, as the owner. */
         const speechDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now, agents: () => deps.catalog.list() });
         /** The same, for the version and upgrade routes. */
-        const versionDeps = () => ({ env: deps.env ?? process.env, log });
+        const versionDeps = () => ({ env: deps.env ?? process.env, log, assetsDir });
         /** The same, for the plugin routes, plus the pool migrations and a purge need. */
         const pluginDeps = () => ({
             env: deps.env ?? process.env,
             log,
             pool: deps.pool,
+            registry: deps.registry,
             ...(deps.plugins ? { engine: deps.plugins } : {}),
         });
         /**
@@ -642,6 +664,50 @@ export function createWebApp(deps) {
             env: deps.env ?? process.env,
             ...(deps.telegram ? { telegram: deps.telegram } : {}),
         });
+        // Tips on Home: one quiet card a day, the switch, the pages seen (tips/route.ts).
+        if (path === '/api/tips' || path.startsWith('/api/tips/')) {
+            let body = {};
+            if (method === 'POST' || method === 'PUT') {
+                try {
+                    const parsed = await readJsonBody(req);
+                    body = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+                }
+                catch {
+                    return sendJson(res, 400, { error: 'request body must be JSON' });
+                }
+            }
+            const answer = await tipsRoute({
+                store: webSettingsStore(deps.pool),
+                now: deps.now,
+                timezone: deps.timezone,
+                facts: () => readFacts({
+                    pool: deps.pool,
+                    now: deps.now,
+                    agents: () => deps.catalog.list(),
+                    plugins: () => deps.registry.manifests().map((m) => m.name),
+                    mailboxSet: async () => {
+                        const answer = await runPageQuery(pagesDeps(), 'email', 'triage_offer', new URLSearchParams()).catch(() => null);
+                        return answer?.status === 200 && answer.body?.data?.wanted === true;
+                    },
+                }),
+            }, { method, path, body, preview: url.searchParams.get('preview') });
+            return sendJson(res, answer.status, answer.body);
+        }
+        // Settings → Connections: every method, one module (web/connections.ts).
+        if (path === '/api/connections' || path.startsWith('/api/connections/')) {
+            let body = {};
+            if (method !== 'GET' && method !== 'HEAD' && method !== 'DELETE') {
+                try {
+                    const parsed = await readJsonBody(req);
+                    body = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+                }
+                catch {
+                    return sendJson(res, 400, { error: 'request body must be JSON' });
+                }
+            }
+            const answer = await connectionsRoute({ service: deps.connections ?? connectionsOf(deps.registry.manifests()), registry: deps.registry, catalog: deps.catalog, pool: deps.pool, ownerId: deps.ctx.ownerId }, { method, path, body, sessionId: session.id, origin: requestOrigin(req) });
+            return sendJson(res, answer.status, answer.body);
+        }
         if (method === 'GET' || method === 'HEAD') {
             /*
              * The library: what the store holds, for a person (docs/files.md). Read
@@ -913,6 +979,8 @@ export function createWebApp(deps) {
                     return reply(res, await listNotificationsRoute(deps.pool, q.get('limit')));
                 case '/api/notifications/settings':
                     return reply(res, await notificationSettingsRoute(deps.pool, 'GET'));
+                case '/api/notifications/focus':
+                    return reply(res, await focusRoute(deps.pool, { now: deps.now, timezone: deps.timezone }, 'GET'));
                 case '/api/reminders':
                     return sendJson(res, 200, {
                         reminders: await readReminders(deps.pool, boundedLimit(q.get('limit'))),
@@ -933,10 +1001,17 @@ export function createWebApp(deps) {
                  */
                 case '/api/pages':
                     return reply(res, listPageDescriptors(pagesDeps()));
+                // Which plugin rail pages the owner hid (Settings → Appearance → In the rail).
+                case '/api/rail':
+                    return sendJson(res, 200, await readRail(deps.pool));
                 case '/api/agent-offers':
                     // Agents a plugin offers on Home while nobody has them. Accepting
                     // is the Plugins page's own accept route, below.
                     return sendJson(res, 200, await readAgentOffers(agentOffersDeps()));
+                case '/api/teammates':
+                    // "Add a teammate": the starter team and the plugin teammates, each
+                    // added, addable, or greyed with why. Adding is the accept route below.
+                    return sendJson(res, 200, await readTeammates(agentOffersDeps()));
                 case '/api/chat/views':
                     // How the installed plugins want their tool output drawn. The page
                     // owns the renderers and learns the domain mapping from here, so an
@@ -1403,7 +1478,7 @@ export function createWebApp(deps) {
          * everything else.
          */
         if (method === 'PUT') {
-            const puttable = ['/api/backups/schedule', '/api/backups/passphrase', '/api/version/check', '/api/tailscale', '/api/notifications/settings'];
+            const puttable = ['/api/backups/schedule', '/api/backups/passphrase', '/api/version/check', '/api/tailscale', '/api/notifications/settings', '/api/notifications/focus'];
             if (!puttable.includes(path))
                 return sendEmpty(res, 405);
             let put;
@@ -1469,6 +1544,8 @@ export function createWebApp(deps) {
                 return reply(res, await versionCheckRoute(versionDeps(), 'PUT', put));
             if (path === '/api/notifications/settings')
                 return reply(res, await notificationSettingsRoute(deps.pool, 'PUT', put));
+            if (path === '/api/notifications/focus')
+                return reply(res, await focusRoute(deps.pool, { now: deps.now, timezone: deps.timezone }, 'PUT', put));
             return reply(res, path === '/api/backups/schedule'
                 ? await scheduleRoute(backupDeps(), 'PUT', put)
                 : await passphraseRoute(backupDeps(), 'PUT', put));
@@ -1765,6 +1842,24 @@ export function createWebApp(deps) {
             const state = await setSentinelEnabled(deps.pool, sentinelId, body.enabled, deps.now());
             return sendJson(res, 200, { sentinelId: state.sentinelId, enabled: state.enabled });
         }
+        /* One Home glance, hidden or shown again (Home's ×, Settings → Appearance). */
+        const glanceHidden = /^\/api\/home\/glances\/([^/]+)\/hidden$/.exec(path);
+        if (glanceHidden) {
+            if (typeof body.hidden !== 'boolean') {
+                return sendJson(res, 400, { error: '`hidden` must be true or false' });
+            }
+            const result = await setGlanceHidden({ pool: deps.pool, registry: deps.registry }, decodeURIComponent(glanceHidden[1]), body.hidden);
+            return sendJson(res, result.status, result.body);
+        }
+        /* One plugin rail page, hidden from the rail or shown again (Settings → Appearance). */
+        const railHidden = /^\/api\/rail\/pages\/([^/]+)\/([^/]+)\/hidden$/.exec(path);
+        if (railHidden) {
+            if (typeof body.hidden !== 'boolean') {
+                return sendJson(res, 400, { error: '`hidden` must be true or false' });
+            }
+            const result = await setRailPageHidden({ pool: deps.pool, registry: deps.registry }, decodeURIComponent(railHidden[1]), decodeURIComponent(railHidden[2]), body.hidden);
+            return sendJson(res, result.status, result.body);
+        }
         if (path === '/api/pause') {
             const paused = body.paused;
             if (typeof paused !== 'boolean') {
@@ -1886,10 +1981,14 @@ export function createWebApp(deps) {
                 },
             }, decodeURIComponent(acceptAgent[1]), decodeURIComponent(acceptAgent[2])));
         }
-        const pluginAction = /^\/api\/plugins\/([^/]+)\/(update|uninstall)$/.exec(path);
+        const pluginAction = /^\/api\/plugins\/([^/]+)\/(update|uninstall|disable|enable)$/.exec(path);
         if (pluginAction) {
             const name = decodeURIComponent(pluginAction[1]);
-            return reply(res, pluginAction[2] === 'update'
+            const verb = pluginAction[2];
+            if (verb === 'disable' || verb === 'enable') {
+                return reply(res, await toggleRoute(pluginDeps(), name, verb === 'enable'));
+            }
+            return reply(res, verb === 'update'
                 ? updateRoute(pluginDeps(), name, body)
                 : await uninstallRoute(pluginDeps(), name, body));
         }