bazilion 0.0.0

package/apps/daemon/src/routes/auth-login.ts

@@ -0,0 +1,193 @@
+// /api/auth/openai/* — ChatGPT OAuth provider connection state.
+// /api/providers/test — model smoke-test.
+// /api/login — token-based browser login (sets the bz_token cookie).
+
+import { spawn } from 'node:child_process'
+import type { ProviderTestRequest, ProviderTestResponse } from '@bazilion/api-types'
+import { Hono } from 'hono'
+import { setCookie } from 'hono/cookie'
+import { isSetupComplete, mergeSecretsIntoEnv, providerStateRepo } from '../core/index.ts'
+import { isValidToken } from '../lib/auth.ts'
+import { getCtx } from '../lib/ctx.ts'
+import {
+  clearOpenAICodexCredentials,
+  createProviderRegistry,
+  getOpenAICodexStatus,
+  loadProviderConfigFromEnv,
+  loginOpenAICodex,
+  saveOpenAICodexLoginCredentials,
+} from '../runtime/index.ts'
+
+export const authRouter = new Hono()
+
+// ─── Auth probe ──────────────────────────────────────────────────────────
+
+/**
+ * Cheap session validator. Web SSR middleware calls this once per request
+ * to translate "is the cookie still good?" + "has setup been finished?"
+ * into JSON-status pairs that the Astro middleware turns into redirects.
+ *
+ * Reaching this handler at all means auth passed (the daemon's own
+ * middleware-auth would have 401'd otherwise). The body just exposes the
+ * setup-complete bit so the web layer can route accordingly.
+ */
+authRouter.get('/auth/me', (c) => {
+  const { db } = getCtx()
+  return c.json({ authed: true, setupComplete: isSetupComplete(db) })
+})
+
+// ─── ChatGPT OAuth ───────────────────────────────────────────────────────
+
+authRouter.get('/auth/openai', (c) => {
+  const { db, authToken } = getCtx()
+  return c.json(getOpenAICodexStatus(db, authToken))
+})
+
+authRouter.put('/auth/openai', async (c) => {
+  const body = (await c.req.json().catch(() => null)) as {
+    refresh?: unknown
+    access?: unknown
+    expires?: unknown
+  } | null
+  if (
+    !body ||
+    typeof body.refresh !== 'string' ||
+    typeof body.access !== 'string' ||
+    typeof body.expires !== 'number'
+  ) {
+    return c.json(
+      { error: 'body must be { refresh: string, access: string, expires: number }' },
+      400,
+    )
+  }
+  const { db, authToken } = getCtx()
+  saveOpenAICodexLoginCredentials(db, authToken, {
+    refresh: body.refresh,
+    access: body.access,
+    expires: body.expires,
+  })
+  return c.json(getOpenAICodexStatus(db, authToken))
+})
+
+authRouter.delete('/auth/openai', (c) => {
+  const { db, authToken } = getCtx()
+  clearOpenAICodexCredentials(db, authToken)
+  return c.json({ connected: false, expiresAt: null, accountId: null })
+})
+
+authRouter.post('/auth/openai/login', async (c) => {
+  const { db, authToken } = getCtx()
+  try {
+    const creds = await loginOpenAICodex({
+      onAuth: ({ url }) => openBrowser(url),
+      onPrompt: () =>
+        Promise.reject(
+          new Error(
+            'interactive paste not supported in the web flow — cancel and try again, or use `bazilion auth openai login`',
+          ),
+        ),
+      onProgress: () => {
+        // single blocking POST keeps the UI simple
+      },
+    })
+    saveOpenAICodexLoginCredentials(db, authToken, creds)
+    return c.json(getOpenAICodexStatus(db, authToken))
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  }
+})
+
+// ─── Provider model smoke-test ───────────────────────────────────────────
+
+authRouter.post('/providers/test', async (c) => {
+  const body = (await c.req.json().catch(() => null)) as ProviderTestRequest | null
+  if (!body || typeof body.model !== 'string' || !body.model) {
+    return c.json({ error: 'model is required' }, 400)
+  }
+  const message = typeof body.message === 'string' && body.message ? body.message : 'say hi briefly'
+  const { db, paths, authToken } = getCtx()
+  const env = mergeSecretsIntoEnv(db, authToken)
+  const reg = createProviderRegistry(loadProviderConfigFromEnv(env, { db, authToken }), {
+    enabledSet: providerStateRepo.listEnabled(db),
+  })
+  try {
+    const { provider, model } = reg.resolve(body.model)
+    const res = await provider.chat({
+      model,
+      messages: [{ role: 'user', content: message }],
+      maxTokens: 256,
+    })
+    const out: ProviderTestResponse = { content: res.content, usage: res.usage }
+    return c.json(out)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  }
+})
+
+// ─── Browser login ───────────────────────────────────────────────────────
+
+/**
+ * Token-based login. Two body shapes accepted:
+ *   - `application/json`: `{ token: "<value>" }` → returns `{ ok: true }` on
+ *     success, sets the `bz_token` cookie. Used by clients (web pages, mobile)
+ *     that prefer JSON.
+ *   - `application/x-www-form-urlencoded`: `token=<value>` → 302 to `/` on
+ *     success or `/login?error=1` on failure. Used by the legacy `<form>` on
+ *     the Astro `/login` page; preserved for compatibility through Stage A.
+ */
+authRouter.post('/login', async (c) => {
+  const ct = c.req.header('content-type') ?? ''
+  let token: string | null = null
+
+  if (ct.startsWith('application/json')) {
+    const body = (await c.req.json().catch(() => null)) as { token?: unknown } | null
+    if (body && typeof body.token === 'string') token = body.token
+  } else {
+    const form = await c.req.formData().catch(() => null)
+    const v = form?.get('token')
+    if (typeof v === 'string') token = v
+  }
+
+  if (!token || !isValidToken(token)) {
+    if (ct.startsWith('application/json')) {
+      return c.json({ error: 'invalid token' }, 401)
+    }
+    return c.redirect('/login?error=1', 302)
+  }
+
+  setCookie(c, 'bz_token', token, {
+    path: '/',
+    httpOnly: true,
+    sameSite: 'Lax',
+    maxAge: 60 * 60 * 24 * 30,
+  })
+
+  if (ct.startsWith('application/json')) {
+    return c.json({ ok: true })
+  }
+  return c.redirect('/', 302)
+})
+
+/**
+ * Open `url` in the host's default browser. Only called by the OAuth flow
+ * triggered from /config — the user is on the same machine as the daemon in
+ * that scenario (loopback-only `bazilion serve`).
+ */
+function openBrowser(url: string): void {
+  const platform = process.platform
+  const [cmd, ...args] =
+    platform === 'darwin'
+      ? ['open', url]
+      : platform === 'win32'
+        ? ['cmd', '/c', 'start', '""', url]
+        : ['xdg-open', url]
+  try {
+    const child = spawn(cmd as string, args, { stdio: 'ignore', detached: true })
+    child.unref()
+    child.on('error', () => {
+      // xdg-open missing on minimal installs — swallow so the flow still works
+    })
+  } catch {
+    // spawn failed — user will still see the URL in the progress log
+  }
+}

package/apps/daemon/src/routes/config.ts

@@ -0,0 +1,267 @@
+// /api/config/* — provider matrix, services, per-provider enabled toggle and
+// curated models, and per-field config/secret writes.
+
+import type {
+  ProviderConfigEntry,
+  ProviderConfigResponse,
+  ServiceCard,
+  ServiceConfigResponse,
+  ServiceFieldState,
+  SetProviderModelsRequest,
+} from '@bazilion/api-types'
+import { Hono } from 'hono'
+import {
+  ensureSetupSeeded,
+  findFieldByEnvVar,
+  groupAvailableModels,
+  mergeSecretsIntoEnv,
+  openConfig,
+  openSecrets,
+  providerModelRepo,
+  providerStateRepo,
+  type ServiceDef,
+  servicesByCategory,
+} from '../core/index.ts'
+import { getCtx } from '../lib/ctx.ts'
+import {
+  listAllProviders,
+  listCatalogModels,
+  listCatalogModelsSync,
+  loadProviderConfigFromEnv,
+} from '../runtime/index.ts'
+
+export const configRouter = new Hono()
+
+// /api/config/providers
+configRouter.get('/providers', async (c) => {
+  const { db, paths, authToken } = getCtx()
+  const env = mergeSecretsIntoEnv(db, authToken)
+  const registryProviders = listAllProviders(loadProviderConfigFromEnv(env, { db, authToken }))
+  const registryByName = new Map(registryProviders.map((p) => [p.name, p]))
+
+  const configValues = readAll(() => openConfig(db).getAll())
+  const secretValues = readAll(() => openSecrets(db, authToken).getAll())
+
+  const providerServices = servicesByCategory('provider')
+  const enabledSet = providerStateRepo.listEnabled(db)
+
+  const entries = await Promise.all(
+    providerServices.map(async (svc): Promise<ProviderConfigEntry> => {
+      const meta = registryByName.get(svc.id)
+      const enabled = enabledSet.has(svc.id)
+      const envHint = meta?.envHint ?? ''
+      const ac = new AbortController()
+      const t = setTimeout(() => ac.abort(), 5_000)
+      try {
+        const { catalog, live } = enabled
+          ? await listCatalogModels(svc.id, env, ac.signal)
+          : { catalog: listCatalogModelsSync(svc.id), live: undefined }
+        return {
+          id: svc.id,
+          displayName: svc.displayName,
+          ...(svc.hint ? { hint: svc.hint } : {}),
+          enabled,
+          envHint,
+          fields: resolveFieldStates(svc, configValues, secretValues),
+          catalog,
+          ...(live ? { live } : {}),
+          curated: providerModelRepo.list(db, svc.id),
+        }
+      } finally {
+        clearTimeout(t)
+      }
+    }),
+  )
+
+  const body: ProviderConfigResponse = { providers: entries }
+  return c.json(body)
+})
+
+// /api/config/services — non-provider service cards (e.g. SearXNG, Brave).
+configRouter.get('/services', (c) => {
+  const { db, authToken } = getCtx()
+  const configValues = readAll(() => openConfig(db).getAll())
+  const secretValues = readAll(() => openSecrets(db, authToken).getAll())
+
+  const services: ServiceCard[] = servicesByCategory('service').map((svc) => ({
+    id: svc.id,
+    displayName: svc.displayName,
+    ...(svc.hint ? { hint: svc.hint } : {}),
+    fields: resolveFieldStates(svc, configValues, secretValues),
+  }))
+
+  const body: ServiceConfigResponse = { services }
+  return c.json(body)
+})
+
+// /api/config/providers/:name/enabled — flip the admin switch.
+configRouter.put('/providers/:name/enabled', async (c) => {
+  const name = c.req.param('name')
+  if (!knownProviderIds().has(name)) return c.json({ error: `unknown provider: ${name}` }, 404)
+
+  const body = (await c.req.json().catch(() => null)) as { enabled?: unknown } | null
+  if (!body || (typeof body.enabled !== 'boolean' && typeof body.enabled !== 'string')) {
+    return c.json({ error: 'body must be {"enabled": boolean}' }, 400)
+  }
+  const enabled =
+    typeof body.enabled === 'boolean' ? body.enabled : body.enabled.toLowerCase() === 'true'
+
+  const { db, paths } = getCtx()
+  providerStateRepo.setEnabled(db, name, enabled)
+  ensureSetupSeeded(db, paths)
+  return c.json({ name, enabled })
+})
+
+// /api/config/providers/:name/models — curated model list.
+configRouter.get('/providers/:name/models', (c) => {
+  const name = c.req.param('name')
+  if (!knownProviderRegistryNames().has(name))
+    return c.json({ error: `unknown provider: ${name}` }, 404)
+  const { db } = getCtx()
+  return c.json({ models: providerModelRepo.list(db, name) })
+})
+
+configRouter.put('/providers/:name/models', async (c) => {
+  const name = c.req.param('name')
+  if (!knownProviderRegistryNames().has(name))
+    return c.json({ error: `unknown provider: ${name}` }, 404)
+  const body = (await c.req.json().catch(() => null)) as Partial<SetProviderModelsRequest> | null
+  if (!body) return c.json({ error: 'invalid JSON body' }, 400)
+
+  // Accept textarea-style newline-separated input from web forms in addition
+  // to the CLI's array shape.
+  let models: string[] = []
+  if (Array.isArray(body.models)) {
+    models = body.models.filter((m): m is string => typeof m === 'string')
+  } else if (typeof (body as Record<string, unknown>).models === 'string') {
+    models = ((body as Record<string, unknown>).models as string).split(/\r?\n/)
+  } else {
+    return c.json(
+      { error: 'models must be an array of strings or a newline-separated string' },
+      400,
+    )
+  }
+
+  const { db, paths } = getCtx()
+  providerModelRepo.replace(db, name, models)
+  ensureSetupSeeded(db, paths)
+  return c.json({ models: providerModelRepo.list(db, name) })
+})
+
+// /api/config/fields/:envVar — write-through for any envVar the registry knows.
+configRouter.put('/fields/:envVar', async (c) => {
+  const envVar = c.req.param('envVar')
+  const found = findFieldByEnvVar(envVar)
+  if (!found) return c.json({ error: `unknown envVar: ${envVar}` }, 404)
+
+  const body = (await c.req.json().catch(() => null)) as { value?: unknown } | null
+  if (!body || typeof body.value !== 'string') {
+    return c.json({ error: 'body must be {"value": "<string>"}' }, 400)
+  }
+
+  const { db, authToken } = getCtx()
+  if (found.field.kind === 'config') {
+    const store = openConfig(db)
+    if (body.value === '') store.remove(envVar)
+    else store.set(envVar, body.value)
+  } else {
+    const store = openSecrets(db, authToken)
+    if (body.value === '') store.remove(envVar)
+    else store.set(envVar, body.value)
+  }
+
+  return c.json(readFieldState(db, authToken, envVar, found.field.kind))
+})
+
+// /api/config/available-models — provider-grouped curated models. Drives
+// the model dropdowns on the profile + agent spawn pages.
+configRouter.get('/available-models', (c) => {
+  const { db } = getCtx()
+  return c.json({ groups: groupAvailableModels(db) })
+})
+
+configRouter.delete('/fields/:envVar', (c) => {
+  const envVar = c.req.param('envVar')
+  const found = findFieldByEnvVar(envVar)
+  if (!found) return c.json({ error: `unknown envVar: ${envVar}` }, 404)
+
+  const { db, authToken } = getCtx()
+  if (found.field.kind === 'config') {
+    openConfig(db).remove(envVar)
+  } else {
+    openSecrets(db, authToken).remove(envVar)
+  }
+  return c.body(null, 204)
+})
+
+// ─── helpers ─────────────────────────────────────────────────────────────
+
+function mask(value: string): string {
+  if (value.length === 0) return ''
+  return value.length > 8 ? `${value.slice(0, 6)}…` : '***'
+}
+
+function resolveFieldStates(
+  service: ServiceDef,
+  configValues: Record<string, string>,
+  secretValues: Record<string, string>,
+): ServiceFieldState[] {
+  return service.fields.map((f) => {
+    const val = (f.kind === 'config' ? configValues[f.envVar] : secretValues[f.envVar]) ?? ''
+    const state: ServiceFieldState = {
+      envVar: f.envVar,
+      kind: f.kind,
+      label: f.label,
+      set: val.length > 0,
+      ...(f.placeholder ? { placeholder: f.placeholder } : {}),
+      ...(f.description ? { description: f.description } : {}),
+    }
+    if (f.kind === 'config') {
+      state.value = val
+    } else if (val.length > 0) {
+      state.preview = mask(val)
+    }
+    return state
+  })
+}
+
+function readAll(read: () => Record<string, string>): Record<string, string> {
+  try {
+    return read()
+  } catch {
+    return {}
+  }
+}
+
+interface FieldState {
+  envVar: string
+  kind: 'secret' | 'config'
+  set: boolean
+  value?: string
+  preview?: string
+}
+
+function readFieldState(
+  db: import('../core/index.ts').BazilionDb,
+  authToken: string,
+  envVar: string,
+  kind: 'secret' | 'config',
+): FieldState {
+  if (kind === 'config') {
+    const v = openConfig(db).get(envVar) ?? ''
+    return { envVar, kind, set: v.length > 0, value: v }
+  }
+  const v = openSecrets(db, authToken).get(envVar) ?? ''
+  return { envVar, kind, set: v.length > 0, ...(v.length > 0 ? { preview: mask(v) } : {}) }
+}
+
+function knownProviderIds(): Set<string> {
+  return new Set(servicesByCategory('provider').map((s) => s.id))
+}
+
+function knownProviderRegistryNames(): Set<string> {
+  const { db, authToken } = getCtx()
+  return new Set(
+    listAllProviders(loadProviderConfigFromEnv(process.env, { db, authToken })).map((p) => p.name),
+  )
+}

package/apps/daemon/src/routes/groups.ts

@@ -0,0 +1,133 @@
+// /api/groups/* — group registry, per-group USER.md, per-group shared
+// memory. Memory is keyed by the group slug because the qmd index lives at
+// `<group.path>/memory/` and is shared by every agent in the group.
+
+import { join } from 'node:path'
+import type { RegisterGroupRequest, SetGroupUserMdRequest } from '@bazilion/api-types'
+import { Hono } from 'hono'
+import { deleteGroup, groupRepo, registerGroup } from '../core/index.ts'
+import { getCtx } from '../lib/ctx.ts'
+import { qmdBackend } from '../runtime/index.ts'
+
+// 12 KB cap matches OpenClaw's bootstrapMaxChars default — enough for a rich
+// USER.md, small enough that it can't silently blow out the system prompt.
+const USER_MD_MAX_BYTES = 12_000
+
+export const groupsRouter = new Hono()
+
+groupsRouter.get('/', (c) => {
+  const { db, paths } = getCtx()
+  return c.json(groupRepo.list(db, paths))
+})
+
+groupsRouter.post('/', async (c) => {
+  const body = (await c.req.json().catch(() => null)) as RegisterGroupRequest | null
+  if (!body || typeof body.id !== 'string') {
+    return c.json({ error: 'id is required' }, 400)
+  }
+  const { db, paths } = getCtx()
+  try {
+    const g = registerGroup(db, { id: body.id, name: body.name, link: body.link }, paths)
+    return c.json(g, 201)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  }
+})
+
+groupsRouter.get('/:id', (c) => {
+  const { db, paths } = getCtx()
+  const g = groupRepo.get(db, c.req.param('id'), paths)
+  if (!g) return c.json({ error: `group not found: ${c.req.param('id')}` }, 404)
+  return c.json(g)
+})
+
+groupsRouter.delete('/:id', (c) => {
+  const { db, paths } = getCtx()
+  try {
+    deleteGroup(db, paths, c.req.param('id'))
+    return c.body(null, 204)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  }
+})
+
+groupsRouter.put('/:id/user-md', async (c) => {
+  const body = (await c.req.json().catch(() => null)) as SetGroupUserMdRequest | null
+  if (!body || typeof body.userMd !== 'string') {
+    return c.json({ error: 'userMd (string) is required' }, 400)
+  }
+  if (Buffer.byteLength(body.userMd, 'utf8') > USER_MD_MAX_BYTES) {
+    return c.json({ error: `userMd exceeds ${USER_MD_MAX_BYTES}-byte cap` }, 413)
+  }
+  const { db, paths } = getCtx()
+  const g = groupRepo.get(db, c.req.param('id'), paths)
+  if (!g) return c.json({ error: `group not found: ${c.req.param('id')}` }, 404)
+  groupRepo.setUserMd(db, c.req.param('id'), body.userMd)
+  return c.json(groupRepo.get(db, c.req.param('id'), paths))
+})
+
+// ─── Memory (per-group, shared across all member agents) ──────────────────
+
+async function openMemory(rawId: string) {
+  const { db, paths } = getCtx()
+  const group = groupRepo.get(db, rawId, paths)
+  if (!group) throw new Error(`group not found: ${rawId}`)
+  const mem = qmdBackend(join(group.path, 'memory'))
+  await mem.init()
+  return { mem, group }
+}
+
+groupsRouter.get('/:id/memory', async (c) => {
+  try {
+    const { mem } = await openMemory(c.req.param('id'))
+    return c.json(await mem.list())
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 404)
+  }
+})
+
+groupsRouter.get('/:id/memory/search', async (c) => {
+  const q = c.req.query('q')
+  if (!q) return c.json({ error: 'q is required' }, 400)
+  const limit = Number.parseInt(c.req.query('limit') ?? '10', 10)
+  try {
+    const { mem } = await openMemory(c.req.param('id'))
+    return c.json(await mem.search(q, { limit }))
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 404)
+  }
+})
+
+// `:key{.+}` matches multi-segment paths so memory keys with slashes (e.g.
+// `notes/2026-04-25.md`) survive the routing layer. Without the regex Hono
+// would only capture a single segment.
+groupsRouter.get('/:id/memory/:key{.+}', async (c) => {
+  try {
+    const { mem } = await openMemory(c.req.param('id'))
+    return c.json(await mem.read(c.req.param('key')))
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 404)
+  }
+})
+
+groupsRouter.put('/:id/memory/:key{.+}', async (c) => {
+  const body = (await c.req.json().catch(() => null)) as { content?: string } | null
+  if (!body || typeof body.content !== 'string')
+    return c.json({ error: 'content is required' }, 400)
+  try {
+    const { mem } = await openMemory(c.req.param('id'))
+    return c.json(await mem.write(c.req.param('key'), body.content))
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 500)
+  }
+})
+
+groupsRouter.delete('/:id/memory/:key{.+}', async (c) => {
+  try {
+    const { mem } = await openMemory(c.req.param('id'))
+    await mem.remove(c.req.param('key'))
+    return c.body(null, 204)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 500)
+  }
+})

package/apps/daemon/src/routes/messages.ts

@@ -0,0 +1,29 @@
+// /api/messages/:id — fetch + mark-read for a single message. (Inbox listing
+// + send is per-agent at /api/agents/:id/messages.)
+
+import type { UpdateMessageRequest } from '@bazilion/api-types'
+import { Hono } from 'hono'
+import { messageRepo } from '../core/index.ts'
+import { getCtx } from '../lib/ctx.ts'
+
+export const messagesRouter = new Hono()
+
+messagesRouter.get('/:id', (c) => {
+  const { db } = getCtx()
+  const msg = messageRepo.get(db, c.req.param('id'))
+  if (!msg) return c.json({ error: `message not found: ${c.req.param('id')}` }, 404)
+  return c.json(msg)
+})
+
+messagesRouter.patch('/:id', async (c) => {
+  const id = c.req.param('id')
+  const body = (await c.req.json().catch(() => null)) as UpdateMessageRequest | null
+  if (!body || body.read !== true) {
+    return c.json({ error: 'body must be {read: true}' }, 400)
+  }
+  const { db } = getCtx()
+  const existing = messageRepo.get(db, id)
+  if (!existing) return c.json({ error: `message not found: ${id}` }, 404)
+  messageRepo.markRead(db, id)
+  return c.json(messageRepo.get(db, id))
+})