@withbuddi/buddi 0.1.0-pre.40 → 0.1.0-pre.42

package/packages/gateway/dist/web/server.js

@@ -61,7 +61,7 @@ import { setDelegatesFromWeb } from './write.js';
 import { mlxhBaseUrl, probeMlxh } from '../mlxh.js';
 import { PullRefusal, createOllamaPulls, ollamaMachine } from '../ollama-local.js';
 import { OnboardingRefusal, hasOwnerAgent, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimOpeningTurn, createFirstAgent, OLLAMA_BASE_URL, probeOllama, readOnboarding, rebindBrain, updateFirstAgent, withFirstRunFacts, readFirstAgentPersona } from './onboarding.js';
-import { TakeOnRefusal, readTakeOn, startTakeOn } from './take-on.js';
+import { TakeOnRefusal, readTakeOn, readTakeOnOffers, startTakeOn } from './take-on.js';
 import { TelegramWebError, saveTelegramToken, telegramBot, telegramDevices, telegramPairing, telegramStatus, unpairTelegramDevice, } from './telegram.js';
 import { PAGE_ROUTE, sendPageFile, actOnPage, actRateLimited, listPageDescriptors, runPageQuery, } from './pages.js';
 import { listSecrets, ownerLoginKey, ownerLoginNames, ownerLoginStore, secretUses, secretsAct } from './secrets.js';
@@ -103,7 +103,7 @@ import { ownerSecretTokenStore } from './access/cloudflare-token.js';
 import { createAccessRegistry } from './access/registry.js';
 import { createIngress } from './access/ingress.js';
 import { clientKey } from './client-key.js';
-import { retryHref, sendSignedOut, wantsSignedOutPage } from './signed-out.js';
+import { appLinkFor, retryHref, sendSignedOut, wantsSignedOutPage } from './signed-out.js';
 import { extensionEndpoint } from './extension.js';
 import { REMOTE_HAND_SOCKET_PATH, RemoteHandEndpoint } from './remote-hand.js';
 import { csrfCookieName, CSRF_HEADER, sessionCookieName, requestPort, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
@@ -136,6 +136,9 @@ import { StreamBudget, frame, resumeCursor, streamConversation } from './stream.
 import { ensureWebToken, verifyTicket } from './token.js';
 import { MAX_UPLOAD_BYTES, readUpload } from './upload.js';
 import { LOCKED_BODY, LockUnavailable, allowedWhileLocked, clientOf, createLock } from './lock.js';
+import { acknowledgePassphrase, passphraseNotice } from './passphrase-notice.js';
+import { cliToolRoute } from './cli-tool.js';
+import { createTokenStore, uninstallBackupRoute, uninstallJobRoute, uninstallPlanRoute, uninstallRoute as removeBuddiRoute, withoutPassphrase } from './uninstall.js';
 import { matchApiRoute, TOKEN_REFUSALS } from './api-routes.js';
 import { QUIET_UNAVAILABLE_TEXT, pluginCommands } from './composer.js';
 import { createEngagementHooks } from '../missions/engagement.js';
@@ -345,7 +348,7 @@ export function createWebApp(deps) {
     const ollamaPulls = deps.ollamaPulls ?? createOllamaPulls({ baseUrl: OLLAMA_BASE_URL });
     const machine = deps.ollamaMachine ?? (() => ollamaMachine());
     // Home's widgets: one cache per server (web/widgets.ts).
-    const widgets = createWidgets({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now });
+    const widgets = createWidgets({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now, log });
     /*
      * The lock screen (web/lock.ts): which sessions are locked, the PIN, the
      * gate below. A session that locks has its streams closed and its remote
@@ -370,6 +373,8 @@ export function createWebApp(deps) {
         },
         recoveryActive: () => inRecovery(deps.pool),
     });
+    /** Remove buddi from this Mac: the token its plan mints (web/uninstall.ts). */
+    const uninstallTokens = createTokenStore();
     const lock = createLock({ pool: deps.pool, sessions, now: deps.now, get timezone() { return deps.timezone; }, widgets, needsYou, log });
     const openStreams = new Map();
     /*
@@ -784,6 +789,8 @@ export function createWebApp(deps) {
             tailscaleSignIn: !!setting?.enabled && tailscaleRefusal?.kind !== 'login',
             ...(tailscaleRefusal?.kind === 'login' ? { tailscaleRefusal: tailscaleRefusal.sentence } : {}),
             ...(tailscaleRefusal?.kind === 'unanswered' ? { tailscaleUnanswered: true } : {}),
+            // From the Chrome extension's popup, on this computer: offer buddi.app first.
+            ...((link) => arrived === 'local' && link ? { appLink: link } : {})(appLinkFor(search, first(req.headers['user-agent']) ?? '', req.headers.host ?? '')),
             ...locked,
         };
     };
@@ -1214,12 +1221,21 @@ export function createWebApp(deps) {
             examplesDir: EXAMPLES_AGENTS_DIR,
             reload: () => deps.catalog.reload?.(),
             registry: deps.registry,
+            offers: (opts) => readTakeOnOffers({ env: deps.env ?? process.env, log }, opts),
         });
         /** What the backup routes need: the environment, and somewhere to log. */
         const backupDeps = () => ({
             env: deps.env ?? process.env,
             log,
         });
+        /** Home's passphrase card: the backups, the words, and where "I saved it" is kept. */
+        const noticeDeps = () => ({
+            pool: deps.pool,
+            listBackups: () => listBackups(backupDeps()),
+            passphrase: () => passphraseRoute(backupDeps(), 'GET'),
+            now: deps.now,
+            log,
+        });
         /** What the plugin page routes need: the registry, and the owner's context. */
         const pagesDeps = () => ({ registry: deps.registry, ctx: deps.ctx, now: deps.now, log });
         const agentOffersDeps = () => ({
@@ -1930,8 +1946,21 @@ export function createWebApp(deps) {
                     return reply(res, await listBackups(backupDeps()));
                 case '/api/backups/schedule':
                     return reply(res, await scheduleRoute(backupDeps(), 'GET'));
-                case '/api/backups/passphrase':
+                case '/api/backups/passphrase': {
+                    // Behind the PIN when there is one: Settings → Backup reveals it with POST …/reveal.
+                    const allowed = await lock.verify(undefined);
+                    if (!allowed.ok)
+                        return sendJson(res, 403, { error: 'Type your PIN to see the passphrase.', needsPin: true });
                     return reply(res, await passphraseRoute(backupDeps(), 'GET'));
+                }
+                /* Home's card after the first encrypted backup, until "I saved it" (web/passphrase-notice.ts). */
+                /* The words, so from this computer only, and behind the PIN when there is one (the card then reveals with POST …/reveal). */
+                case '/api/backups/passphrase/notice': {
+                    if (session.via !== 'local')
+                        return sendJson(res, 403, { error: 'The passphrase shows on the computer buddi runs on.' });
+                    const allowed = await lock.verify(undefined);
+                    return sendJson(res, 200, await passphraseNotice(noticeDeps(), { words: allowed.ok }));
+                }
                 /*
                  * Plugins: what is installed, what is staged and waiting to be read,
                  * and the trust sentence the page shows above the install field. A
@@ -1974,7 +2003,7 @@ export function createWebApp(deps) {
                 case '/api/secrets/uses':
                     return reply(res, await secretUses(secretsDeps(), url));
                 case '/api/onboarding':
-                    return sendJson(res, 200, await readOnboarding(onboardingDeps()));
+                    return sendJson(res, 200, await readOnboarding(onboardingDeps(), { withOffers: true }));
                 /*
                  * Is Ollama running on this machine? Asked from here, never from the
                  * page: the dashboard bundle reaches no host but its own, and the
@@ -2053,10 +2082,28 @@ export function createWebApp(deps) {
             }
             const upgradeJob = /^\/api\/upgrade\/jobs\/([0-9a-f-]{36})$/i.exec(path);
             if (upgradeJob)
-                return reply(res, await upgradeJobRoute(versionDeps(), upgradeJob[1]));
+                return reply(res, withoutPassphrase(await upgradeJobRoute(versionDeps(), upgradeJob[1])));
             const backupJob = /^\/api\/backups\/jobs\/([0-9a-f-]{36})$/i.exec(path);
             if (backupJob)
-                return reply(res, await backupJobRoute(backupDeps(), backupJob[1]));
+                return reply(res, withoutPassphrase(await backupJobRoute(backupDeps(), backupJob[1])));
+            /* buddi.app's command line tool: whether it is installed, from this computer only. */
+            if (path === '/api/system/cli') {
+                if (session.via !== 'local')
+                    return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+                return reply(res, await cliToolRoute(deps.env ?? process.env, 'GET'));
+            }
+            /* Remove buddi from this Mac: the plan (with its token) and the last backup's job, from this computer only. */
+            if (path === '/api/system/uninstall') {
+                if (session.via !== 'local')
+                    return sendJson(res, 403, { error: 'Remove buddi from the computer it runs on.' });
+                return reply(res, await uninstallPlanRoute({ env: deps.env ?? process.env, now: deps.now }, uninstallTokens));
+            }
+            const uninstallJob = /^\/api\/system\/uninstall\/jobs\/([0-9a-f-]{36})$/i.exec(path);
+            if (uninstallJob) {
+                if (session.via !== 'local')
+                    return sendJson(res, 403, { error: 'Remove buddi from the computer it runs on.' });
+                return reply(res, await uninstallJobRoute({ env: deps.env ?? process.env }, uninstallJob[1]));
+            }
             const catalogueJob = /^\/api\/catalogue\/jobs\/([0-9a-f-]{36})$/i.exec(path);
             if (catalogueJob)
                 return reply(res, catalogueJobRoute(catalogueJob[1]));
@@ -3353,6 +3400,27 @@ export function createWebApp(deps) {
             return reply(res, await upgradeRoute(versionDeps(), body));
         if (path === '/api/backups')
             return reply(res, await createBackupRoute(backupDeps(), body));
+        if (path === '/api/backups/passphrase/notice')
+            return sendJson(res, 200, await acknowledgePassphrase({ pool: deps.pool, now: deps.now }));
+        if (path === '/api/system/cli') {
+            if (session.via !== 'local')
+                return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+            return reply(res, await cliToolRoute(deps.env ?? process.env, 'POST'));
+        }
+        if (path === '/api/system/uninstall/backup' || path === '/api/system/uninstall') {
+            if (session.via !== 'local')
+                return sendJson(res, 403, { error: 'Remove buddi from the computer it runs on.' });
+            const uninstallDeps = { env: deps.env ?? process.env, now: deps.now };
+            return reply(res, path === '/api/system/uninstall/backup'
+                ? await uninstallBackupRoute(uninstallDeps, uninstallTokens, body)
+                : await removeBuddiRoute(uninstallDeps, uninstallTokens, body));
+        }
+        if (path === '/api/backups/passphrase/reveal') {
+            const allowed = await lock.verify(body.pin);
+            if (!allowed.ok)
+                return sendJson(res, allowed.status, allowed.body);
+            return reply(res, await passphraseRoute(backupDeps(), 'GET'));
+        }
         if (path === '/api/backups/verify')
             return reply(res, await verifyBackupRoute(backupDeps(), body));
         if (path === '/api/backups/restore') {