@withbuddi/buddi 0.1.0-pre.23 → 0.1.0-pre.25

package/node_modules/@buddi/gateway/dist/web/server.js

@@ -54,7 +54,9 @@ import { ProviderAccountError } from '../provider-accounts.js';
 import { listBrowserProfiles, listInstalledApps } from './apps.js';
 import { agentSearchPath, EXAMPLES_AGENTS_DIR } from '../agents/catalog.js';
 import { setDelegatesFromWeb } from './write.js';
+import { mlxhBaseUrl, probeMlxh } from '../mlxh.js';
 import { OnboardingRefusal, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimOpeningTurn, createFirstAgent, probeOllama, readOnboarding, rebindBrain, updateFirstAgent, withFirstRunFacts, readFirstAgentPersona } from './onboarding.js';
+import { TakeOnRefusal, readTakeOn, startTakeOn } from './take-on.js';
 import { TelegramWebError, saveTelegramToken, telegramBot, telegramDevices, telegramPairing, telegramStatus, unpairTelegramDevice, } from './telegram.js';
 import { PAGE_ROUTE, sendPageFile, actOnPage, listPageDescriptors, runPageQuery, } from './pages.js';
 import { listSecrets, secretUses, secretsAct } from './secrets.js';
@@ -91,13 +93,15 @@ import { RateLimiter, SessionStore, } from './sessions.js';
 import { supervisorCall } from './service.js';
 import { backupJobRoute, createBackupRoute, discardUpload, listBackups, passphraseRoute, receiveUpload, restoreRoute, scheduleRoute, verifyBackupRoute, } from './backups.js';
 import { acceptAgentRoute, approveRoute, listPlugins, pluginJobRoute, receivePluginUpload, rejectRoute, stageRoute, toggleRoute, uninstallRoute, updateRoute, uploadRoute, } from './plugins.js';
+import { marketAssetRoute, marketRoute } from './market.js';
+import { pluginFoldersRoute } from './folders.js';
 import { tipsRoute } from '../tips/route.js';
 import { readFacts, webSettingsStore } from '../tips/facts.js';
 import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers, readTeammates } from './agent-offers.js';
 import { currentVersion, upgradeJobRoute, upgradeRoute, versionCheckRoute, versionRoute, } from './version.js';
 import { leaveRecoveryMode, readRecoveryView } from './recovery.js';
 import { readRail, setRailPageHidden } from './rail.js';
-import { BUILD_MISSING, serveAsset } from './static.js';
+import { BUILD_MISSING, serveAsset, serveShellAtRoot } from './static.js';
 import { StreamBudget, resumeCursor, streamConversation } from './stream.js';
 import { ensureWebToken, verifyTicket } from './token.js';
 import { MAX_UPLOAD_BYTES, readUpload } from './upload.js';
@@ -463,7 +467,7 @@ export function createWebApp(deps) {
          * state is checked there against the session that started the sign-in.
          */
         if ((method === 'GET' || method === 'HEAD') && url.pathname === CONNECTIONS_CALLBACK_PATH) {
-            const served = await serveAsset(res, assetsDir, '/index.html');
+            const served = await serveShellAtRoot(res, assetsDir);
             if (!served.served)
                 sendText(res, 503, BUILD_MISSING);
             return;
@@ -641,6 +645,34 @@ export function createWebApp(deps) {
             registry: deps.registry,
             ...(deps.plugins ? { engine: deps.plugins } : {}),
         });
+        /** Is a mailbox connected? The email plugin's own read, the one Home's offer asks. */
+        const mailboxSet = async () => {
+            const answer = await runPageQuery(pagesDeps(), 'email', 'triage_offer', new URLSearchParams()).catch(() => null);
+            return answer?.status === 200 && answer.body?.data?.wanted === true;
+        };
+        /** First run's chapter 3: the market, the plugin engine, the live registry, the mailbox. */
+        const takeOnDeps = () => {
+            const live = deps.registry;
+            return {
+                pool: deps.pool,
+                env: deps.env ?? process.env,
+                log,
+                ...(deps.plugins ? { engine: deps.plugins } : {}),
+                ...(live.register && live.unregister && live.manifests ? { registry: deps.registry } : {}),
+                mailboxSet,
+                agentIds: () => deps.catalog.list().map((a) => a.id),
+            };
+        };
+        /** The weather at home in one line, for the hello, when the weather plugin answers. */
+        const weatherAtHome = async () => {
+            const answer = await runPageQuery(pagesDeps(), 'weather', 'today', new URLSearchParams()).catch(() => null);
+            const data = answer?.body?.data;
+            if (answer?.status !== 200 || !data || data.setUp !== true)
+                return null;
+            const parts = [data.now, data.sky, typeof data.highLow === 'string' && data.highLow !== '' ? `high / low ${data.highLow}` : '']
+                .filter((part) => typeof part === 'string' && part !== '');
+            return parts.length === 0 ? null : `${typeof data.place === 'string' ? `${data.place}: ` : ''}${parts.join(', ')}`;
+        };
         /**
          * May this installation still be restored over from the first-run screen?
          *
@@ -1092,6 +1124,36 @@ export function createWebApp(deps) {
                  */
                 case '/api/plugins':
                     return reply(res, await listPlugins(pluginDeps()));
+                /*
+                 * The plugin list from withbuddi.com. Fetched here only when asked —
+                 * the Browse tab opening — and kept a day; never at start or on a timer.
+                 */
+                case '/api/market':
+                    return reply(res, await marketRoute({ env: deps.env ?? process.env, log }, url));
+                /*
+                 * A listing's screenshot, fetched from withbuddi.com/plugins/ and kept
+                 * beside the list: the page asks here and never the internet itself.
+                 */
+                case '/api/market/asset': {
+                    const asset = await marketAssetRoute({ env: deps.env ?? process.env, log }, url);
+                    if (asset.bytes === undefined)
+                        return sendJson(res, asset.status, asset.body);
+                    res.statusCode = asset.status;
+                    res.setHeader('Content-Type', asset.type ?? 'application/octet-stream');
+                    res.setHeader('Content-Length', String(asset.bytes.length));
+                    res.setHeader('Cache-Control', 'private, max-age=3600');
+                    res.setHeader('X-Content-Type-Options', 'nosniff');
+                    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+                    res.setHeader('Content-Security-Policy', "default-src 'none'; sandbox");
+                    res.end(method === 'HEAD' ? undefined : asset.bytes);
+                    return;
+                }
+                /*
+                 * "A directory I built": the folders on this machine, under the
+                 * owner's home, for the picker beside the field. A read of names only.
+                 */
+                case '/api/plugins/folders':
+                    return reply(res, pluginFoldersRoute(deps.env ?? process.env, url));
                 case '/api/secrets':
                     return reply(res, await listSecrets(secretsDeps()));
                 case '/api/secrets/uses':
@@ -1110,6 +1172,12 @@ export function createWebApp(deps) {
                 }
                 case '/api/onboarding/ollama':
                     return sendJson(res, 200, await probeOllama());
+                // Is mlxh running here? The same question, asked the same way, of port 1060.
+                case '/api/onboarding/mlxh':
+                    return sendJson(res, 200, await probeMlxh({ baseUrl: mlxhBaseUrl(deps.env ?? process.env) }));
+                // Chapter 3's progress: per plugin, and what the handover card will say is waiting.
+                case '/api/onboarding/take-on':
+                    return sendJson(res, 200, await readTakeOn(takeOnDeps()));
                 case '/api/telegram':
                     return sendJson(res, 200, await telegramStatus(telegramDeps()));
                 // Settings → Notifications: which bot, and which phones talk to it.
@@ -2191,6 +2259,13 @@ export function createWebApp(deps) {
                     return sendJson(res, 400, { error: `\`${key}\` must be a string` });
                 }
             }
+            // Chapter 4 carries which of its rows were done: yes or no, nothing else.
+            const reachKeys = ['phone', 'mailbox', 'app', 'browser'];
+            if (body.reach !== undefined &&
+                (body.reach === null || typeof body.reach !== 'object' || Array.isArray(body.reach) ||
+                    Object.entries(body.reach).some(([key, value]) => !reachKeys.includes(key) || typeof value !== 'boolean'))) {
+                return sendJson(res, 400, { error: '`reach` must say yes or no for phone, mailbox, app and browser' });
+            }
             // The first step recorded is also what starts the record, with this
             // surface's name on it. Already in progress, done or skipped: unchanged.
             await beginOnboarding(deps.pool, WEB_ONBOARDING_SURFACE);
@@ -2198,9 +2273,24 @@ export function createWebApp(deps) {
             await setOnboardingDetails(deps.pool, {
                 ...(typeof body.conversationId === 'string' ? { conversationId: body.conversationId } : {}),
                 ...(typeof body.accountId === 'string' ? { accountId: body.accountId } : {}),
+                ...(body.reach !== undefined ? { reach: body.reach } : {}),
             });
             return sendJson(res, 200, await readOnboarding(onboardingDeps()));
         }
+        /*
+         * Chapter 3: what buddi takes on. Records the tiles and starts the By-buddi
+         * installs in the background; answers at once with a job per plugin.
+         */
+        if (path === '/api/onboarding/take-on') {
+            try {
+                return sendJson(res, 202, await startTakeOn(takeOnDeps(), body.tiles));
+            }
+            catch (error) {
+                if (error instanceof TakeOnRefusal)
+                    return sendJson(res, error.status, { error: error.message });
+                throw error;
+            }
+        }
         if (path === '/api/onboarding/complete' || path === '/api/onboarding/skip') {
             if (path.endsWith('/skip')) {
                 // The explicit bypass. It records that the owner declined, and it is
@@ -2632,7 +2722,14 @@ export function createWebApp(deps) {
                 agentId: decodeURIComponent(messages[1]),
                 ...(typeof body.conversationId === 'string' ? { conversationId: body.conversationId } : {}),
                 ...(typeof body.client === 'string' ? { client: body.client.trim() } : {}),
-                text: body.opening === true ? await withFirstRunFacts(onboardingDeps(), body.text) : body.text,
+                text: body.opening === true
+                    ? await withFirstRunFacts(onboardingDeps(), body.text, {
+                        weatherAtHome,
+                        mailboxSet,
+                        installed: async () => (await readTakeOn(takeOnDeps())).plugins.filter((p) => p.state === 'ready').map((p) => p.title),
+                        now: deps.now,
+                    })
+                    : body.text,
                 ...(ids ? { attachmentIds: ids } : {}),
                 ...(body.opening === true ? { opening: true } : {}),
             });