bazilion 0.0.0 → 0.1.1

package/apps/daemon/src/routes/auth-login.ts

@@ -1,193 +0,0 @@
-// /api/auth/openai/* — ChatGPT OAuth provider connection state.
-// /api/providers/test — model smoke-test.
-// /api/login — token-based browser login (sets the bz_token cookie).
-
-import { spawn } from 'node:child_process'
-import type { ProviderTestRequest, ProviderTestResponse } from '@bazilion/api-types'
-import { Hono } from 'hono'
-import { setCookie } from 'hono/cookie'
-import { isSetupComplete, mergeSecretsIntoEnv, providerStateRepo } from '../core/index.ts'
-import { isValidToken } from '../lib/auth.ts'
-import { getCtx } from '../lib/ctx.ts'
-import {
-  clearOpenAICodexCredentials,
-  createProviderRegistry,
-  getOpenAICodexStatus,
-  loadProviderConfigFromEnv,
-  loginOpenAICodex,
-  saveOpenAICodexLoginCredentials,
-} from '../runtime/index.ts'
-
-export const authRouter = new Hono()
-
-// ─── Auth probe ──────────────────────────────────────────────────────────
-
-/**
- * Cheap session validator. Web SSR middleware calls this once per request
- * to translate "is the cookie still good?" + "has setup been finished?"
- * into JSON-status pairs that the Astro middleware turns into redirects.
- *
- * Reaching this handler at all means auth passed (the daemon's own
- * middleware-auth would have 401'd otherwise). The body just exposes the
- * setup-complete bit so the web layer can route accordingly.
- */
-authRouter.get('/auth/me', (c) => {
-  const { db } = getCtx()
-  return c.json({ authed: true, setupComplete: isSetupComplete(db) })
-})
-
-// ─── ChatGPT OAuth ───────────────────────────────────────────────────────
-
-authRouter.get('/auth/openai', (c) => {
-  const { db, authToken } = getCtx()
-  return c.json(getOpenAICodexStatus(db, authToken))
-})
-
-authRouter.put('/auth/openai', async (c) => {
-  const body = (await c.req.json().catch(() => null)) as {
-    refresh?: unknown
-    access?: unknown
-    expires?: unknown
-  } | null
-  if (
-    !body ||
-    typeof body.refresh !== 'string' ||
-    typeof body.access !== 'string' ||
-    typeof body.expires !== 'number'
-  ) {
-    return c.json(
-      { error: 'body must be { refresh: string, access: string, expires: number }' },
-      400,
-    )
-  }
-  const { db, authToken } = getCtx()
-  saveOpenAICodexLoginCredentials(db, authToken, {
-    refresh: body.refresh,
-    access: body.access,
-    expires: body.expires,
-  })
-  return c.json(getOpenAICodexStatus(db, authToken))
-})
-
-authRouter.delete('/auth/openai', (c) => {
-  const { db, authToken } = getCtx()
-  clearOpenAICodexCredentials(db, authToken)
-  return c.json({ connected: false, expiresAt: null, accountId: null })
-})
-
-authRouter.post('/auth/openai/login', async (c) => {
-  const { db, authToken } = getCtx()
-  try {
-    const creds = await loginOpenAICodex({
-      onAuth: ({ url }) => openBrowser(url),
-      onPrompt: () =>
-        Promise.reject(
-          new Error(
-            'interactive paste not supported in the web flow — cancel and try again, or use `bazilion auth openai login`',
-          ),
-        ),
-      onProgress: () => {
-        // single blocking POST keeps the UI simple
-      },
-    })
-    saveOpenAICodexLoginCredentials(db, authToken, creds)
-    return c.json(getOpenAICodexStatus(db, authToken))
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 400)
-  }
-})
-
-// ─── Provider model smoke-test ───────────────────────────────────────────
-
-authRouter.post('/providers/test', async (c) => {
-  const body = (await c.req.json().catch(() => null)) as ProviderTestRequest | null
-  if (!body || typeof body.model !== 'string' || !body.model) {
-    return c.json({ error: 'model is required' }, 400)
-  }
-  const message = typeof body.message === 'string' && body.message ? body.message : 'say hi briefly'
-  const { db, paths, authToken } = getCtx()
-  const env = mergeSecretsIntoEnv(db, authToken)
-  const reg = createProviderRegistry(loadProviderConfigFromEnv(env, { db, authToken }), {
-    enabledSet: providerStateRepo.listEnabled(db),
-  })
-  try {
-    const { provider, model } = reg.resolve(body.model)
-    const res = await provider.chat({
-      model,
-      messages: [{ role: 'user', content: message }],
-      maxTokens: 256,
-    })
-    const out: ProviderTestResponse = { content: res.content, usage: res.usage }
-    return c.json(out)
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 400)
-  }
-})
-
-// ─── Browser login ───────────────────────────────────────────────────────
-
-/**
- * Token-based login. Two body shapes accepted:
- *   - `application/json`: `{ token: "<value>" }` → returns `{ ok: true }` on
- *     success, sets the `bz_token` cookie. Used by clients (web pages, mobile)
- *     that prefer JSON.
- *   - `application/x-www-form-urlencoded`: `token=<value>` → 302 to `/` on
- *     success or `/login?error=1` on failure. Used by the legacy `<form>` on
- *     the Astro `/login` page; preserved for compatibility through Stage A.
- */
-authRouter.post('/login', async (c) => {
-  const ct = c.req.header('content-type') ?? ''
-  let token: string | null = null
-
-  if (ct.startsWith('application/json')) {
-    const body = (await c.req.json().catch(() => null)) as { token?: unknown } | null
-    if (body && typeof body.token === 'string') token = body.token
-  } else {
-    const form = await c.req.formData().catch(() => null)
-    const v = form?.get('token')
-    if (typeof v === 'string') token = v
-  }
-
-  if (!token || !isValidToken(token)) {
-    if (ct.startsWith('application/json')) {
-      return c.json({ error: 'invalid token' }, 401)
-    }
-    return c.redirect('/login?error=1', 302)
-  }
-
-  setCookie(c, 'bz_token', token, {
-    path: '/',
-    httpOnly: true,
-    sameSite: 'Lax',
-    maxAge: 60 * 60 * 24 * 30,
-  })
-
-  if (ct.startsWith('application/json')) {
-    return c.json({ ok: true })
-  }
-  return c.redirect('/', 302)
-})
-
-/**
- * Open `url` in the host's default browser. Only called by the OAuth flow
- * triggered from /config — the user is on the same machine as the daemon in
- * that scenario (loopback-only `bazilion serve`).
- */
-function openBrowser(url: string): void {
-  const platform = process.platform
-  const [cmd, ...args] =
-    platform === 'darwin'
-      ? ['open', url]
-      : platform === 'win32'
-        ? ['cmd', '/c', 'start', '""', url]
-        : ['xdg-open', url]
-  try {
-    const child = spawn(cmd as string, args, { stdio: 'ignore', detached: true })
-    child.unref()
-    child.on('error', () => {
-      // xdg-open missing on minimal installs — swallow so the flow still works
-    })
-  } catch {
-    // spawn failed — user will still see the URL in the progress log
-  }
-}

package/apps/daemon/src/routes/config.ts

@@ -1,267 +0,0 @@
-// /api/config/* — provider matrix, services, per-provider enabled toggle and
-// curated models, and per-field config/secret writes.
-
-import type {
-  ProviderConfigEntry,
-  ProviderConfigResponse,
-  ServiceCard,
-  ServiceConfigResponse,
-  ServiceFieldState,
-  SetProviderModelsRequest,
-} from '@bazilion/api-types'
-import { Hono } from 'hono'
-import {
-  ensureSetupSeeded,
-  findFieldByEnvVar,
-  groupAvailableModels,
-  mergeSecretsIntoEnv,
-  openConfig,
-  openSecrets,
-  providerModelRepo,
-  providerStateRepo,
-  type ServiceDef,
-  servicesByCategory,
-} from '../core/index.ts'
-import { getCtx } from '../lib/ctx.ts'
-import {
-  listAllProviders,
-  listCatalogModels,
-  listCatalogModelsSync,
-  loadProviderConfigFromEnv,
-} from '../runtime/index.ts'
-
-export const configRouter = new Hono()
-
-// /api/config/providers
-configRouter.get('/providers', async (c) => {
-  const { db, paths, authToken } = getCtx()
-  const env = mergeSecretsIntoEnv(db, authToken)
-  const registryProviders = listAllProviders(loadProviderConfigFromEnv(env, { db, authToken }))
-  const registryByName = new Map(registryProviders.map((p) => [p.name, p]))
-
-  const configValues = readAll(() => openConfig(db).getAll())
-  const secretValues = readAll(() => openSecrets(db, authToken).getAll())
-
-  const providerServices = servicesByCategory('provider')
-  const enabledSet = providerStateRepo.listEnabled(db)
-
-  const entries = await Promise.all(
-    providerServices.map(async (svc): Promise<ProviderConfigEntry> => {
-      const meta = registryByName.get(svc.id)
-      const enabled = enabledSet.has(svc.id)
-      const envHint = meta?.envHint ?? ''
-      const ac = new AbortController()
-      const t = setTimeout(() => ac.abort(), 5_000)
-      try {
-        const { catalog, live } = enabled
-          ? await listCatalogModels(svc.id, env, ac.signal)
-          : { catalog: listCatalogModelsSync(svc.id), live: undefined }
-        return {
-          id: svc.id,
-          displayName: svc.displayName,
-          ...(svc.hint ? { hint: svc.hint } : {}),
-          enabled,
-          envHint,
-          fields: resolveFieldStates(svc, configValues, secretValues),
-          catalog,
-          ...(live ? { live } : {}),
-          curated: providerModelRepo.list(db, svc.id),
-        }
-      } finally {
-        clearTimeout(t)
-      }
-    }),
-  )
-
-  const body: ProviderConfigResponse = { providers: entries }
-  return c.json(body)
-})
-
-// /api/config/services — non-provider service cards (e.g. SearXNG, Brave).
-configRouter.get('/services', (c) => {
-  const { db, authToken } = getCtx()
-  const configValues = readAll(() => openConfig(db).getAll())
-  const secretValues = readAll(() => openSecrets(db, authToken).getAll())
-
-  const services: ServiceCard[] = servicesByCategory('service').map((svc) => ({
-    id: svc.id,
-    displayName: svc.displayName,
-    ...(svc.hint ? { hint: svc.hint } : {}),
-    fields: resolveFieldStates(svc, configValues, secretValues),
-  }))
-
-  const body: ServiceConfigResponse = { services }
-  return c.json(body)
-})
-
-// /api/config/providers/:name/enabled — flip the admin switch.
-configRouter.put('/providers/:name/enabled', async (c) => {
-  const name = c.req.param('name')
-  if (!knownProviderIds().has(name)) return c.json({ error: `unknown provider: ${name}` }, 404)
-
-  const body = (await c.req.json().catch(() => null)) as { enabled?: unknown } | null
-  if (!body || (typeof body.enabled !== 'boolean' && typeof body.enabled !== 'string')) {
-    return c.json({ error: 'body must be {"enabled": boolean}' }, 400)
-  }
-  const enabled =
-    typeof body.enabled === 'boolean' ? body.enabled : body.enabled.toLowerCase() === 'true'
-
-  const { db, paths } = getCtx()
-  providerStateRepo.setEnabled(db, name, enabled)
-  ensureSetupSeeded(db, paths)
-  return c.json({ name, enabled })
-})
-
-// /api/config/providers/:name/models — curated model list.
-configRouter.get('/providers/:name/models', (c) => {
-  const name = c.req.param('name')
-  if (!knownProviderRegistryNames().has(name))
-    return c.json({ error: `unknown provider: ${name}` }, 404)
-  const { db } = getCtx()
-  return c.json({ models: providerModelRepo.list(db, name) })
-})
-
-configRouter.put('/providers/:name/models', async (c) => {
-  const name = c.req.param('name')
-  if (!knownProviderRegistryNames().has(name))
-    return c.json({ error: `unknown provider: ${name}` }, 404)
-  const body = (await c.req.json().catch(() => null)) as Partial<SetProviderModelsRequest> | null
-  if (!body) return c.json({ error: 'invalid JSON body' }, 400)
-
-  // Accept textarea-style newline-separated input from web forms in addition
-  // to the CLI's array shape.
-  let models: string[] = []
-  if (Array.isArray(body.models)) {
-    models = body.models.filter((m): m is string => typeof m === 'string')
-  } else if (typeof (body as Record<string, unknown>).models === 'string') {
-    models = ((body as Record<string, unknown>).models as string).split(/\r?\n/)
-  } else {
-    return c.json(
-      { error: 'models must be an array of strings or a newline-separated string' },
-      400,
-    )
-  }
-
-  const { db, paths } = getCtx()
-  providerModelRepo.replace(db, name, models)
-  ensureSetupSeeded(db, paths)
-  return c.json({ models: providerModelRepo.list(db, name) })
-})
-
-// /api/config/fields/:envVar — write-through for any envVar the registry knows.
-configRouter.put('/fields/:envVar', async (c) => {
-  const envVar = c.req.param('envVar')
-  const found = findFieldByEnvVar(envVar)
-  if (!found) return c.json({ error: `unknown envVar: ${envVar}` }, 404)
-
-  const body = (await c.req.json().catch(() => null)) as { value?: unknown } | null
-  if (!body || typeof body.value !== 'string') {
-    return c.json({ error: 'body must be {"value": "<string>"}' }, 400)
-  }
-
-  const { db, authToken } = getCtx()
-  if (found.field.kind === 'config') {
-    const store = openConfig(db)
-    if (body.value === '') store.remove(envVar)
-    else store.set(envVar, body.value)
-  } else {
-    const store = openSecrets(db, authToken)
-    if (body.value === '') store.remove(envVar)
-    else store.set(envVar, body.value)
-  }
-
-  return c.json(readFieldState(db, authToken, envVar, found.field.kind))
-})
-
-// /api/config/available-models — provider-grouped curated models. Drives
-// the model dropdowns on the profile + agent spawn pages.
-configRouter.get('/available-models', (c) => {
-  const { db } = getCtx()
-  return c.json({ groups: groupAvailableModels(db) })
-})
-
-configRouter.delete('/fields/:envVar', (c) => {
-  const envVar = c.req.param('envVar')
-  const found = findFieldByEnvVar(envVar)
-  if (!found) return c.json({ error: `unknown envVar: ${envVar}` }, 404)
-
-  const { db, authToken } = getCtx()
-  if (found.field.kind === 'config') {
-    openConfig(db).remove(envVar)
-  } else {
-    openSecrets(db, authToken).remove(envVar)
-  }
-  return c.body(null, 204)
-})
-
-// ─── helpers ─────────────────────────────────────────────────────────────
-
-function mask(value: string): string {
-  if (value.length === 0) return ''
-  return value.length > 8 ? `${value.slice(0, 6)}…` : '***'
-}
-
-function resolveFieldStates(
-  service: ServiceDef,
-  configValues: Record<string, string>,
-  secretValues: Record<string, string>,
-): ServiceFieldState[] {
-  return service.fields.map((f) => {
-    const val = (f.kind === 'config' ? configValues[f.envVar] : secretValues[f.envVar]) ?? ''
-    const state: ServiceFieldState = {
-      envVar: f.envVar,
-      kind: f.kind,
-      label: f.label,
-      set: val.length > 0,
-      ...(f.placeholder ? { placeholder: f.placeholder } : {}),
-      ...(f.description ? { description: f.description } : {}),
-    }
-    if (f.kind === 'config') {
-      state.value = val
-    } else if (val.length > 0) {
-      state.preview = mask(val)
-    }
-    return state
-  })
-}
-
-function readAll(read: () => Record<string, string>): Record<string, string> {
-  try {
-    return read()
-  } catch {
-    return {}
-  }
-}
-
-interface FieldState {
-  envVar: string
-  kind: 'secret' | 'config'
-  set: boolean
-  value?: string
-  preview?: string
-}
-
-function readFieldState(
-  db: import('../core/index.ts').BazilionDb,
-  authToken: string,
-  envVar: string,
-  kind: 'secret' | 'config',
-): FieldState {
-  if (kind === 'config') {
-    const v = openConfig(db).get(envVar) ?? ''
-    return { envVar, kind, set: v.length > 0, value: v }
-  }
-  const v = openSecrets(db, authToken).get(envVar) ?? ''
-  return { envVar, kind, set: v.length > 0, ...(v.length > 0 ? { preview: mask(v) } : {}) }
-}
-
-function knownProviderIds(): Set<string> {
-  return new Set(servicesByCategory('provider').map((s) => s.id))
-}
-
-function knownProviderRegistryNames(): Set<string> {
-  const { db, authToken } = getCtx()
-  return new Set(
-    listAllProviders(loadProviderConfigFromEnv(process.env, { db, authToken })).map((p) => p.name),
-  )
-}

package/apps/daemon/src/routes/groups.ts

@@ -1,133 +0,0 @@
-// /api/groups/* — group registry, per-group USER.md, per-group shared
-// memory. Memory is keyed by the group slug because the qmd index lives at
-// `<group.path>/memory/` and is shared by every agent in the group.
-
-import { join } from 'node:path'
-import type { RegisterGroupRequest, SetGroupUserMdRequest } from '@bazilion/api-types'
-import { Hono } from 'hono'
-import { deleteGroup, groupRepo, registerGroup } from '../core/index.ts'
-import { getCtx } from '../lib/ctx.ts'
-import { qmdBackend } from '../runtime/index.ts'
-
-// 12 KB cap matches OpenClaw's bootstrapMaxChars default — enough for a rich
-// USER.md, small enough that it can't silently blow out the system prompt.
-const USER_MD_MAX_BYTES = 12_000
-
-export const groupsRouter = new Hono()
-
-groupsRouter.get('/', (c) => {
-  const { db, paths } = getCtx()
-  return c.json(groupRepo.list(db, paths))
-})
-
-groupsRouter.post('/', async (c) => {
-  const body = (await c.req.json().catch(() => null)) as RegisterGroupRequest | null
-  if (!body || typeof body.id !== 'string') {
-    return c.json({ error: 'id is required' }, 400)
-  }
-  const { db, paths } = getCtx()
-  try {
-    const g = registerGroup(db, { id: body.id, name: body.name, link: body.link }, paths)
-    return c.json(g, 201)
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 400)
-  }
-})
-
-groupsRouter.get('/:id', (c) => {
-  const { db, paths } = getCtx()
-  const g = groupRepo.get(db, c.req.param('id'), paths)
-  if (!g) return c.json({ error: `group not found: ${c.req.param('id')}` }, 404)
-  return c.json(g)
-})
-
-groupsRouter.delete('/:id', (c) => {
-  const { db, paths } = getCtx()
-  try {
-    deleteGroup(db, paths, c.req.param('id'))
-    return c.body(null, 204)
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 400)
-  }
-})
-
-groupsRouter.put('/:id/user-md', async (c) => {
-  const body = (await c.req.json().catch(() => null)) as SetGroupUserMdRequest | null
-  if (!body || typeof body.userMd !== 'string') {
-    return c.json({ error: 'userMd (string) is required' }, 400)
-  }
-  if (Buffer.byteLength(body.userMd, 'utf8') > USER_MD_MAX_BYTES) {
-    return c.json({ error: `userMd exceeds ${USER_MD_MAX_BYTES}-byte cap` }, 413)
-  }
-  const { db, paths } = getCtx()
-  const g = groupRepo.get(db, c.req.param('id'), paths)
-  if (!g) return c.json({ error: `group not found: ${c.req.param('id')}` }, 404)
-  groupRepo.setUserMd(db, c.req.param('id'), body.userMd)
-  return c.json(groupRepo.get(db, c.req.param('id'), paths))
-})
-
-// ─── Memory (per-group, shared across all member agents) ──────────────────
-
-async function openMemory(rawId: string) {
-  const { db, paths } = getCtx()
-  const group = groupRepo.get(db, rawId, paths)
-  if (!group) throw new Error(`group not found: ${rawId}`)
-  const mem = qmdBackend(join(group.path, 'memory'))
-  await mem.init()
-  return { mem, group }
-}
-
-groupsRouter.get('/:id/memory', async (c) => {
-  try {
-    const { mem } = await openMemory(c.req.param('id'))
-    return c.json(await mem.list())
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 404)
-  }
-})
-
-groupsRouter.get('/:id/memory/search', async (c) => {
-  const q = c.req.query('q')
-  if (!q) return c.json({ error: 'q is required' }, 400)
-  const limit = Number.parseInt(c.req.query('limit') ?? '10', 10)
-  try {
-    const { mem } = await openMemory(c.req.param('id'))
-    return c.json(await mem.search(q, { limit }))
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 404)
-  }
-})
-
-// `:key{.+}` matches multi-segment paths so memory keys with slashes (e.g.
-// `notes/2026-04-25.md`) survive the routing layer. Without the regex Hono
-// would only capture a single segment.
-groupsRouter.get('/:id/memory/:key{.+}', async (c) => {
-  try {
-    const { mem } = await openMemory(c.req.param('id'))
-    return c.json(await mem.read(c.req.param('key')))
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 404)
-  }
-})
-
-groupsRouter.put('/:id/memory/:key{.+}', async (c) => {
-  const body = (await c.req.json().catch(() => null)) as { content?: string } | null
-  if (!body || typeof body.content !== 'string')
-    return c.json({ error: 'content is required' }, 400)
-  try {
-    const { mem } = await openMemory(c.req.param('id'))
-    return c.json(await mem.write(c.req.param('key'), body.content))
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 500)
-  }
-})
-
-groupsRouter.delete('/:id/memory/:key{.+}', async (c) => {
-  try {
-    const { mem } = await openMemory(c.req.param('id'))
-    await mem.remove(c.req.param('key'))
-    return c.body(null, 204)
-  } catch (err) {
-    return c.json({ error: (err as Error).message }, 500)
-  }
-})

package/apps/daemon/src/routes/messages.ts

@@ -1,29 +0,0 @@
-// /api/messages/:id — fetch + mark-read for a single message. (Inbox listing
-// + send is per-agent at /api/agents/:id/messages.)
-
-import type { UpdateMessageRequest } from '@bazilion/api-types'
-import { Hono } from 'hono'
-import { messageRepo } from '../core/index.ts'
-import { getCtx } from '../lib/ctx.ts'
-
-export const messagesRouter = new Hono()
-
-messagesRouter.get('/:id', (c) => {
-  const { db } = getCtx()
-  const msg = messageRepo.get(db, c.req.param('id'))
-  if (!msg) return c.json({ error: `message not found: ${c.req.param('id')}` }, 404)
-  return c.json(msg)
-})
-
-messagesRouter.patch('/:id', async (c) => {
-  const id = c.req.param('id')
-  const body = (await c.req.json().catch(() => null)) as UpdateMessageRequest | null
-  if (!body || body.read !== true) {
-    return c.json({ error: 'body must be {read: true}' }, 400)
-  }
-  const { db } = getCtx()
-  const existing = messageRepo.get(db, id)
-  if (!existing) return c.json({ error: `message not found: ${id}` }, 404)
-  messageRepo.markRead(db, id)
-  return c.json(messageRepo.get(db, id))
-})