bazilion 0.0.0 → 0.1.0

package/apps/daemon/src/core/repos/profiles.ts

@@ -1,83 +0,0 @@
-import type { Profile, SkillsMode } from '@bazilion/api-types'
-import type { BazilionDb } from '../db/client.ts'
-
-interface RawProfile {
-  id: string
-  name: string
-  dir: string
-  default_model: string
-  skills_mode: string
-  created_at: number
-  updated_at: number
-}
-
-function toProfile(r: RawProfile): Profile {
-  return {
-    id: r.id,
-    name: r.name,
-    dir: r.dir,
-    defaultModel: r.default_model,
-    skillsMode: r.skills_mode as SkillsMode,
-    createdAt: r.created_at,
-    updatedAt: r.updated_at,
-  }
-}
-
-export function insert(db: BazilionDb, p: Omit<Profile, 'createdAt' | 'updatedAt'>): Profile {
-  const now = Date.now()
-  db.raw.run(
-    `INSERT INTO profiles (id, name, dir, default_model, skills_mode, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    [p.id, p.name, p.dir, p.defaultModel, p.skillsMode, now, now],
-  )
-  return { ...p, createdAt: now, updatedAt: now }
-}
-
-export function get(db: BazilionDb, id: string): Profile | null {
-  const row = db.raw.query<RawProfile, [string]>('SELECT * FROM profiles WHERE id = ?').get(id)
-  return row ? toProfile(row) : null
-}
-
-export function list(db: BazilionDb): Profile[] {
-  return db.raw
-    .query<RawProfile, []>('SELECT * FROM profiles ORDER BY created_at ASC')
-    .all()
-    .map(toProfile)
-}
-
-export function remove(db: BazilionDb, id: string): void {
-  db.raw.run('DELETE FROM profiles WHERE id = ?', [id])
-}
-
-export function update(
-  db: BazilionDb,
-  id: string,
-  fields: { name: string; defaultModel: string; skillsMode: SkillsMode },
-): void {
-  db.raw.run(
-    `UPDATE profiles
-     SET name = ?, default_model = ?, skills_mode = ?, updated_at = ?
-     WHERE id = ?`,
-    [fields.name, fields.defaultModel, fields.skillsMode, Date.now(), id],
-  )
-}
-
-export function setDefaultSkills(db: BazilionDb, profileId: string, skills: string[]): void {
-  const tx = db.raw.transaction(() => {
-    db.raw.run('DELETE FROM profile_default_skills WHERE profile_id = ?', [profileId])
-    const stmt = db.raw.query(
-      'INSERT INTO profile_default_skills (profile_id, skill_name) VALUES (?, ?)',
-    )
-    for (const s of skills) stmt.run(profileId, s)
-  })
-  tx()
-}
-
-export function getDefaultSkills(db: BazilionDb, profileId: string): string[] {
-  return db.raw
-    .query<{ skill_name: string }, [string]>(
-      'SELECT skill_name FROM profile_default_skills WHERE profile_id = ? ORDER BY skill_name',
-    )
-    .all(profileId)
-    .map((r) => r.skill_name)
-}

package/apps/daemon/src/core/repos/providerModels.ts

@@ -1,58 +0,0 @@
-import type { BazilionDb } from '../db/client.ts'
-
-interface RawRow {
-  provider: string
-  model: string
-  added_at: number
-}
-
-/** Curated model names for one provider, in insertion order. */
-export function list(db: BazilionDb, provider: string): string[] {
-  return db.raw
-    .query<RawRow, [string]>(
-      'SELECT * FROM provider_models WHERE provider = ? ORDER BY added_at ASC',
-    )
-    .all(provider)
-    .map((r) => r.model)
-}
-
-/** All curated models grouped by provider. Empty providers are omitted. */
-export function listAll(db: BazilionDb): Record<string, string[]> {
-  const out: Record<string, string[]> = {}
-  for (const row of db.raw
-    .query<RawRow, []>('SELECT * FROM provider_models ORDER BY provider ASC, added_at ASC')
-    .all()) {
-    const bucket = out[row.provider] ?? []
-    bucket.push(row.model)
-    out[row.provider] = bucket
-  }
-  return out
-}
-
-/**
- * Replace the curated list for one provider atomically. Empty `models` clears
- * the list. De-dupes (case-sensitive) and preserves incoming order.
- */
-export function replace(db: BazilionDb, provider: string, models: string[]): void {
-  const seen = new Set<string>()
-  const clean = models
-    .map((m) => m.trim())
-    .filter((m) => m.length > 0 && !seen.has(m) && seen.add(m))
-  db.raw.transaction(() => {
-    db.raw.run('DELETE FROM provider_models WHERE provider = ?', [provider])
-    const now = Date.now()
-    for (let i = 0; i < clean.length; i++) {
-      // Offset by index so ordering is preserved by added_at.
-      db.raw.run('INSERT INTO provider_models (provider, model, added_at) VALUES (?, ?, ?)', [
-        provider,
-        clean[i] as string,
-        now + i,
-      ])
-    }
-  })()
-}
-
-/** Remove a single curated model. No-op if not present. */
-export function remove(db: BazilionDb, provider: string, model: string): void {
-  db.raw.run('DELETE FROM provider_models WHERE provider = ? AND model = ?', [provider, model])
-}

package/apps/daemon/src/core/repos/providerState.ts

@@ -1,37 +0,0 @@
-import type { BazilionDb } from '../db/client.ts'
-
-interface RawRow {
-  provider_id: string
-  enabled: number
-  updated_at: number
-}
-
-export function isEnabled(db: BazilionDb, providerId: string): boolean {
-  const row = db.raw
-    .query<RawRow, [string]>('SELECT * FROM provider_state WHERE provider_id = ?')
-    .get(providerId)
-  return row?.enabled === 1
-}
-
-export function setEnabled(db: BazilionDb, providerId: string, enabled: boolean): void {
-  db.raw.run(
-    `INSERT INTO provider_state (provider_id, enabled, updated_at)
-     VALUES (?, ?, ?)
-     ON CONFLICT (provider_id) DO UPDATE SET
-       enabled = excluded.enabled,
-       updated_at = excluded.updated_at`,
-    [providerId, enabled ? 1 : 0, Date.now()],
-  )
-}
-
-/** Set of provider ids currently toggled on. Convenience for batch checks. */
-export function listEnabled(db: BazilionDb): Set<string> {
-  return new Set(
-    db.raw
-      .query<{ provider_id: string }, []>(
-        'SELECT provider_id FROM provider_state WHERE enabled = 1',
-      )
-      .all()
-      .map((r) => r.provider_id),
-  )
-}

package/apps/daemon/src/core/repos/secrets.ts

@@ -1,145 +0,0 @@
-// Encrypted secrets store, backed by the `secrets` table.
-//
-// Layout: one row per env-var-shaped key (`ANTHROPIC_API_KEY`,
-// `OPENAI_CODEX_OAUTH`, …). Each value is an AES-256-GCM envelope (salt +
-// iv + tag + data, hex-encoded JSON), with the key derived from the
-// bootstrap token via PBKDF2-SHA256 (100k iterations). The crypto matches
-// the previous `secrets.enc` file format byte-for-byte — only the storage
-// medium changed.
-//
-// Why encrypt at all when the password lives in `~/.bazilion/auth.json`
-// next to the DB? Same reason as before: it's defense against accidental
-// exposure (cat'd dumps, screenshares, naive backups), not against an
-// attacker with filesystem read. Anyone who can read both files wins.
-//
-// Caching: `deriveKey` runs PBKDF2 once per (password, salt) pair and the
-// salt is per-row, so a busy daemon does ~one PBKDF2 per secret read. The
-// `secretCache` keeps decrypted values in-memory keyed by row id so repeated
-// reads inside one process don't repeat the work; mutations clear the cache
-// row.
-
-import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from 'node:crypto'
-import type { BazilionDb } from '../db/client.ts'
-
-const ALGORITHM = 'aes-256-gcm'
-const KEY_LEN = 32
-const ITERATIONS = 100_000
-const DIGEST = 'sha256'
-
-interface EncryptedEnvelope {
-  salt: string
-  iv: string
-  tag: string
-  data: string
-}
-
-function deriveKey(password: string, salt: Buffer): Buffer {
-  return pbkdf2Sync(password, salt, ITERATIONS, KEY_LEN, DIGEST)
-}
-
-function encrypt(plaintext: string, password: string): EncryptedEnvelope {
-  const salt = randomBytes(16)
-  const key = deriveKey(password, salt)
-  const iv = randomBytes(12)
-  const cipher = createCipheriv(ALGORITHM, key, iv)
-  let data = cipher.update(plaintext, 'utf8', 'hex')
-  data += cipher.final('hex')
-  const tag = cipher.getAuthTag()
-  return {
-    salt: salt.toString('hex'),
-    iv: iv.toString('hex'),
-    tag: tag.toString('hex'),
-    data,
-  }
-}
-
-function decrypt(envelope: EncryptedEnvelope, password: string): string {
-  const salt = Buffer.from(envelope.salt, 'hex')
-  const key = deriveKey(password, salt)
-  const iv = Buffer.from(envelope.iv, 'hex')
-  const tag = Buffer.from(envelope.tag, 'hex')
-  const decipher = createDecipheriv(ALGORITHM, key, iv)
-  decipher.setAuthTag(tag)
-  let plaintext = decipher.update(envelope.data, 'hex', 'utf8')
-  plaintext += decipher.final('utf8')
-  return plaintext
-}
-
-interface RawRow {
-  key: string
-  envelope: string
-  updated_at: number
-}
-
-export interface SecretsStore {
-  get(key: string): string | undefined
-  set(key: string, value: string): void
-  remove(key: string): void
-  has(key: string): boolean
-  list(): { key: string; preview: string }[]
-  getAll(): Record<string, string>
-}
-
-/**
- * Open the encrypted secrets store. `password` is the bootstrap token
- * (read from `auth.json` by the caller). Throws on individual-row decrypt
- * failures only when actively reading that row — bad rows show as
- * `undefined` from `get`, the caller can `set` to overwrite.
- */
-export function openSecrets(db: BazilionDb, password: string): SecretsStore {
-  function getRow(key: string): RawRow | null {
-    return db.raw.query<RawRow, [string]>('SELECT * FROM secrets WHERE key = ?').get(key)
-  }
-
-  function listAll(): RawRow[] {
-    return db.raw.query<RawRow, []>('SELECT * FROM secrets ORDER BY key ASC').all()
-  }
-
-  function tryDecrypt(row: RawRow): string | undefined {
-    try {
-      const envelope = JSON.parse(row.envelope) as EncryptedEnvelope
-      return decrypt(envelope, password)
-    } catch {
-      return undefined
-    }
-  }
-
-  return {
-    get(key) {
-      const row = getRow(key)
-      if (!row) return undefined
-      return tryDecrypt(row)
-    },
-    set(key, value) {
-      const envelope = JSON.stringify(encrypt(value, password))
-      db.raw.run(
-        `INSERT INTO secrets (key, envelope, updated_at) VALUES (?, ?, ?)
-         ON CONFLICT(key) DO UPDATE SET envelope = excluded.envelope, updated_at = excluded.updated_at`,
-        [key, envelope, Date.now()],
-      )
-    },
-    remove(key) {
-      db.raw.run('DELETE FROM secrets WHERE key = ?', [key])
-    },
-    has(key) {
-      return getRow(key) !== null
-    },
-    list() {
-      return listAll().map((r) => {
-        const value = tryDecrypt(r)
-        return {
-          key: r.key,
-          preview: value ? (value.length > 8 ? `${value.slice(0, 6)}…` : '***') : '(unreadable)',
-        }
-      })
-    },
-    getAll() {
-      const out: Record<string, string> = {}
-      for (const r of listAll()) {
-        const v = tryDecrypt(r)
-        if (v !== undefined) out[r.key] = v
-      }
-      return out
-    },
-  }
-}

package/apps/daemon/src/core/repos/skillMeta.ts

@@ -1,49 +0,0 @@
-import type { SkillMeta } from '@bazilion/api-types'
-import type { BazilionDb } from '../db/client.ts'
-
-interface RawMeta {
-  name: string
-  source: string | null
-  imported_at: number | null
-}
-
-function toMeta(r: RawMeta): SkillMeta {
-  return {
-    name: r.name,
-    source: r.source,
-    importedAt: r.imported_at,
-  }
-}
-
-export function get(db: BazilionDb, name: string): SkillMeta | null {
-  const row = db.raw.query<RawMeta, [string]>('SELECT * FROM skill_meta WHERE name = ?').get(name)
-  return row ? toMeta(row) : null
-}
-
-export function listAll(db: BazilionDb): SkillMeta[] {
-  return db.raw.query<RawMeta, []>('SELECT * FROM skill_meta ORDER BY name ASC').all().map(toMeta)
-}
-
-export interface UpsertInput {
-  name: string
-  source?: string | null
-  importedAt?: number | null
-}
-
-export function upsert(db: BazilionDb, input: UpsertInput): SkillMeta {
-  const existing = get(db, input.name)
-  const source = input.source !== undefined ? input.source : (existing?.source ?? null)
-  const importedAt =
-    input.importedAt !== undefined ? input.importedAt : (existing?.importedAt ?? null)
-  db.raw.run(
-    `INSERT INTO skill_meta (name, source, imported_at)
-     VALUES (?, ?, ?)
-     ON CONFLICT(name) DO UPDATE SET source = excluded.source, imported_at = excluded.imported_at`,
-    [input.name, source, importedAt],
-  )
-  return { name: input.name, source, importedAt }
-}
-
-export function remove(db: BazilionDb, name: string): void {
-  db.raw.run('DELETE FROM skill_meta WHERE name = ?', [name])
-}

package/apps/daemon/src/core/repos/triggers.ts

@@ -1,101 +0,0 @@
-import { randomUUID } from 'node:crypto'
-import type { AgentTrigger, TriggerKind } from '@bazilion/api-types'
-import type { BazilionDb } from '../db/client.ts'
-
-interface RawTrigger {
-  id: string
-  agent_id: string
-  kind: string
-  interval_sec: number | null
-  cron_expr: string | null
-  message: string
-  enabled: number
-  last_fired_at: number | null
-  created_at: number
-}
-
-function toTrigger(r: RawTrigger): AgentTrigger {
-  return {
-    id: r.id,
-    agentId: r.agent_id,
-    kind: r.kind as TriggerKind,
-    intervalSec: r.interval_sec,
-    cronExpr: r.cron_expr,
-    message: r.message,
-    enabled: r.enabled === 1,
-    lastFiredAt: r.last_fired_at,
-    createdAt: r.created_at,
-  }
-}
-
-export interface InsertTriggerInput {
-  agentId: string
-  kind: TriggerKind
-  intervalSec: number | null
-  cronExpr: string | null
-  message: string
-  enabled?: boolean
-}
-
-export function insert(db: BazilionDb, input: InsertTriggerInput): AgentTrigger {
-  const id = randomUUID()
-  const now = Date.now()
-  const enabled = input.enabled === false ? 0 : 1
-  db.raw.run(
-    `INSERT INTO agent_triggers
-       (id, agent_id, kind, interval_sec, cron_expr, message, enabled, last_fired_at, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`,
-    [id, input.agentId, input.kind, input.intervalSec, input.cronExpr, input.message, enabled, now],
-  )
-  return {
-    id,
-    agentId: input.agentId,
-    kind: input.kind,
-    intervalSec: input.intervalSec,
-    cronExpr: input.cronExpr,
-    message: input.message,
-    enabled: enabled === 1,
-    lastFiredAt: null,
-    createdAt: now,
-  }
-}
-
-export function get(db: BazilionDb, id: string): AgentTrigger | null {
-  const row = db.raw
-    .query<RawTrigger, [string]>('SELECT * FROM agent_triggers WHERE id = ?')
-    .get(id)
-  return row ? toTrigger(row) : null
-}
-
-export function listForAgent(db: BazilionDb, agentId: string): AgentTrigger[] {
-  return db.raw
-    .query<RawTrigger, [string]>(
-      'SELECT * FROM agent_triggers WHERE agent_id = ? ORDER BY created_at ASC',
-    )
-    .all(agentId)
-    .map(toTrigger)
-}
-
-export function listEnabled(db: BazilionDb): AgentTrigger[] {
-  return db.raw
-    .query<RawTrigger, []>(
-      `SELECT t.* FROM agent_triggers t
-         JOIN agents a ON a.id = t.agent_id
-         WHERE t.enabled = 1 AND a.status != 'archived'
-         ORDER BY t.created_at ASC`,
-    )
-    .all()
-    .map(toTrigger)
-}
-
-export function setEnabled(db: BazilionDb, id: string, enabled: boolean): void {
-  db.raw.run('UPDATE agent_triggers SET enabled = ? WHERE id = ?', [enabled ? 1 : 0, id])
-}
-
-export function markFired(db: BazilionDb, id: string, when: number = Date.now()): void {
-  db.raw.run('UPDATE agent_triggers SET last_fired_at = ? WHERE id = ?', [when, id])
-}
-
-export function remove(db: BazilionDb, id: string): void {
-  db.raw.run('DELETE FROM agent_triggers WHERE id = ?', [id])
-}

package/apps/daemon/src/core/repos/webTokens.ts

@@ -1,87 +0,0 @@
-import { createHash, randomBytes, randomUUID } from 'node:crypto'
-import type { WebToken } from '@bazilion/api-types'
-import type { BazilionDb } from '../db/client.ts'
-
-interface RawToken {
-  id: string
-  label: string
-  token_hash: string
-  created_at: number
-  last_used_at: number | null
-  revoked_at: number | null
-}
-
-function toToken(r: RawToken): WebToken {
-  return {
-    id: r.id,
-    label: r.label,
-    createdAt: r.created_at,
-    lastUsedAt: r.last_used_at,
-    revokedAt: r.revoked_at,
-  }
-}
-
-export function hashToken(token: string): string {
-  return createHash('sha256').update(token).digest('hex')
-}
-
-export interface CreatedToken {
-  meta: WebToken
-  /** Plaintext token — shown exactly once, never re-queryable. */
-  token: string
-}
-
-export function create(db: BazilionDb, label: string): CreatedToken {
-  const id = randomUUID()
-  const token = randomBytes(24).toString('hex')
-  const tokenHash = hashToken(token)
-  const now = Date.now()
-  db.raw.run(
-    `INSERT INTO web_tokens (id, label, token_hash, created_at, last_used_at, revoked_at)
-     VALUES (?, ?, ?, ?, NULL, NULL)`,
-    [id, label, tokenHash, now],
-  )
-  return {
-    token,
-    meta: { id, label, createdAt: now, lastUsedAt: null, revokedAt: null },
-  }
-}
-
-export function list(db: BazilionDb, opts?: { includeRevoked?: boolean }): WebToken[] {
-  const sql = opts?.includeRevoked
-    ? 'SELECT * FROM web_tokens ORDER BY created_at ASC'
-    : 'SELECT * FROM web_tokens WHERE revoked_at IS NULL ORDER BY created_at ASC'
-  return db.raw.query<RawToken, []>(sql).all().map(toToken)
-}
-
-export function get(db: BazilionDb, id: string): WebToken | null {
-  const row = db.raw.query<RawToken, [string]>('SELECT * FROM web_tokens WHERE id = ?').get(id)
-  return row ? toToken(row) : null
-}
-
-/**
- * Returns the active token row matching the given plaintext, or null.
- * Does NOT bump last_used_at — call markUsed separately once the caller
- * has decided the request is authorized.
- */
-export function findActiveByToken(db: BazilionDb, token: string): WebToken | null {
-  const tokenHash = hashToken(token)
-  const row = db.raw
-    .query<RawToken, [string]>(
-      'SELECT * FROM web_tokens WHERE token_hash = ? AND revoked_at IS NULL',
-    )
-    .get(tokenHash)
-  return row ? toToken(row) : null
-}
-
-export function markUsed(db: BazilionDb, id: string, when: number = Date.now()): void {
-  db.raw.run('UPDATE web_tokens SET last_used_at = ? WHERE id = ?', [when, id])
-}
-
-export function revoke(db: BazilionDb, id: string, when: number = Date.now()): boolean {
-  const res = db.raw.run(
-    'UPDATE web_tokens SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL',
-    [when, id],
-  )
-  return res.changes > 0
-}

package/apps/daemon/src/core/secrets.ts

@@ -1,65 +0,0 @@
-// Auth / secrets entry points keyed off the bootstrap `auth.json` file.
-//
-// `auth.json` carries one mandatory field — `token` — written by the daemon's
-// first-run bootstrap. The daemon uses it as the PBKDF2 seed for the `secrets`
-// table; the CLI uses it as the bearer for loopback HTTP. CLI-side `remote`
-// overrides (set by `bazilion login`) coexist in the same file.
-
-import { existsSync, readFileSync } from 'node:fs'
-import type { BazilionDb } from './db/client.ts'
-import { openConfig } from './repos/config.ts'
-import { openSecrets } from './repos/secrets.ts'
-
-export interface AuthFile {
-  token: string
-  remote?: { server: string; token: string } | null
-}
-
-/**
- * Read `auth.json` and return the parsed contents. Throws when missing or
- * malformed — callers should treat that as "bazilion not initialized."
- */
-export function readAuthFile(authFile: string): AuthFile {
-  if (!existsSync(authFile)) {
-    throw new Error(`${authFile} not found. Start the daemon (\`bazilion serve\`) — it auto-bootstraps on first run.`)
-  }
-  const raw = readFileSync(authFile, 'utf8')
-  const parsed = JSON.parse(raw) as Partial<AuthFile>
-  if (typeof parsed.token !== 'string' || !parsed.token) {
-    throw new Error(`${authFile} is missing the "token" field`)
-  }
-  return {
-    token: parsed.token,
-    remote: parsed.remote ?? null,
-  }
-}
-
-/**
- * Merge plaintext config + decrypted secrets + process env into a single
- * env-shaped record. Precedence (low → high): config → secrets → env. The
- * caller supplies the bootstrap `password` (typically `readAuthFile().token`)
- * because the secrets table is encrypted with it.
- *
- * Either layer may fail to read (corrupt row, wrong key, table absent at
- * fixture-bootstrap time); failures are swallowed per-layer so a single bad
- * value never blocks the merge.
- */
-export function mergeSecretsIntoEnv(
-  db: BazilionDb,
-  password: string,
-  env: NodeJS.ProcessEnv = process.env,
-): NodeJS.ProcessEnv {
-  let configValues: Record<string, string> = {}
-  let secretValues: Record<string, string> = {}
-  try {
-    configValues = openConfig(db).getAll()
-  } catch {
-    // table missing or unreadable — continue without the layer
-  }
-  try {
-    secretValues = openSecrets(db, password).getAll()
-  } catch {
-    // table missing or wrong password — continue without the layer
-  }
-  return { ...configValues, ...secretValues, ...env }
-}