bazilion 0.0.0

package/apps/daemon/src/routes/misc.ts

@@ -0,0 +1,239 @@
+// Single-route resources: /api/health, /api/backup, /api/tokens.
+
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import type {
+  CreateTokenRequest,
+  CreateTokenResponse,
+  HealthReport,
+  ListTokensResponse,
+} from '@bazilion/api-types'
+import { Hono } from 'hono'
+import {
+  agentRepo,
+  discoverSkills,
+  groupRepo,
+  mergeSecretsIntoEnv,
+  parseSkillFile,
+  profileRepo,
+  resolvePaths,
+  webTokenRepo,
+} from '../core/index.ts'
+import { getCtx } from '../lib/ctx.ts'
+import { loadProviderConfigFromEnv } from '../runtime/index.ts'
+
+export const miscRouter = new Hono()
+
+// /api/health — install diagnostics. Public (auth middleware whitelists it)
+// so the doctor command and external probes can run without a token.
+miscRouter.get('/health', (c) => {
+  const paths = resolvePaths()
+
+  const pathChecks = {
+    home: existsSync(paths.home),
+    db: existsSync(paths.db),
+    auth: existsSync(paths.authFile),
+    profiles: existsSync(paths.profilesDir),
+    agents: existsSync(paths.agentsDir),
+    skills: existsSync(paths.skillsDir),
+  }
+
+  let database: HealthReport['database'] = null
+  const triggersSection: HealthReport['triggers'] = { active: 0, disabled: 0 }
+  let tokensSection: HealthReport['tokens'] = { active: 0 }
+  if (pathChecks.db) {
+    try {
+      const { db } = getCtx()
+      database = {
+        ok: true,
+        profiles: profileRepo.list(db).length,
+        activeAgents: agentRepo.list(db).length,
+        totalAgents: agentRepo.list(db, { includeArchived: true }).length,
+        groups: groupRepo.list(db, paths).length,
+      }
+      const triggerRows = db.raw
+        .query<{ enabled: number; n: number }, []>(
+          'SELECT enabled, COUNT(*) AS n FROM agent_triggers GROUP BY enabled',
+        )
+        .all()
+      for (const r of triggerRows) {
+        if (r.enabled === 1) triggersSection.active = r.n
+        else triggersSection.disabled = r.n
+      }
+      tokensSection = { active: webTokenRepo.list(db).length }
+    } catch (err) {
+      database = { ok: false, error: (err as Error).message }
+    }
+  }
+
+  const skills = discoverSkills(paths)
+  let parseErrors = 0
+  for (const s of skills) {
+    try {
+      parseSkillFile(s.skillFile)
+    } catch {
+      parseErrors++
+    }
+  }
+
+  let effectiveEnv: NodeJS.ProcessEnv = process.env
+  let oauth: { db: import('../core/index.ts').BazilionDb; authToken: string } | undefined
+  if (pathChecks.auth && pathChecks.db) {
+    try {
+      const { db, authToken } = getCtx()
+      effectiveEnv = mergeSecretsIntoEnv(db, authToken)
+      oauth = { db, authToken }
+    } catch {
+      // first-run / partially-initialized — fall through with bare env
+    }
+  }
+  const providerConfig = loadProviderConfigFromEnv(effectiveEnv, oauth)
+  const braveKey = effectiveEnv.BRAVE_API_KEY
+  const openclawSkillsDir = join(homedir(), '.openclaw', 'skills')
+
+  const CLOUD_KEYS: Array<[string, keyof typeof providerConfig]> = [
+    ['anthropic', 'anthropic'],
+    ['openai', 'openai'],
+    ['google', 'google'],
+    ['azure-openai', 'azureOpenai'],
+    ['bedrock', 'bedrock'],
+    ['google-vertex', 'googleVertex'],
+    ['mistral', 'mistral'],
+    ['groq', 'groq'],
+    ['cerebras', 'cerebras'],
+    ['xai', 'xai'],
+    ['zai', 'zai'],
+    ['huggingface', 'huggingface'],
+    ['openrouter', 'openrouter'],
+    ['vercel-ai-gateway', 'vercelAiGateway'],
+  ]
+  const providerSection: HealthReport['providers'] = {
+    configured: CLOUD_KEYS.filter(([, key]) => providerConfig[key]).map(([name]) => name),
+    lmstudio: {
+      baseURL: providerConfig.lmstudio?.baseURL ?? 'http://localhost:1234/v1',
+      hasKey: Boolean(providerConfig.lmstudio?.apiKey),
+    },
+    ollama: { baseURL: providerConfig.ollama?.baseURL ?? 'http://localhost:11434/v1' },
+  }
+
+  const report: HealthReport = {
+    ok:
+      pathChecks.home &&
+      pathChecks.db &&
+      pathChecks.auth &&
+      pathChecks.profiles &&
+      pathChecks.agents &&
+      pathChecks.skills &&
+      (database === null || database.ok) &&
+      parseErrors === 0,
+    home: paths.home,
+    paths: pathChecks,
+    database,
+    skills: { installed: skills.length, parseErrors },
+    providers: providerSection,
+    webSearch: {
+      bravePreview: braveKey ? `${braveKey.slice(0, 6)}…` : null,
+      searxngUrl: effectiveEnv.SEARXNG_URL ?? null,
+    },
+    openclaw: {
+      path: openclawSkillsDir,
+      exists: existsSync(openclawSkillsDir),
+    },
+    triggers: triggersSection,
+    tokens: tokensSection,
+    scheduler: {
+      enabled: process.env.BAZILION_SCHEDULER !== 'off',
+      tickMs: Number(process.env.BAZILION_SCHEDULER_TICK_MS ?? 5_000),
+    },
+  }
+  return c.json(report)
+})
+
+// /api/backup — streams a tar.gz of $BAZILION_HOME
+miscRouter.get('/backup', (c) => {
+  const paths = resolvePaths()
+  if (!existsSync(paths.home)) {
+    return c.json({ error: `bazilion home not found at ${paths.home}` }, 404)
+  }
+
+  const proc = spawn('tar', ['-czf', '-', '-C', paths.home, '.'], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+
+  const stream = new ReadableStream({
+    start(controller) {
+      proc.stdout.on('data', (chunk: Buffer) => controller.enqueue(chunk))
+      proc.stdout.on('end', () => {
+        try {
+          controller.close()
+        } catch {}
+      })
+      proc.on('error', (err) => {
+        try {
+          controller.error(err)
+        } catch {}
+      })
+      proc.on('exit', (code) => {
+        if (code !== 0) {
+          try {
+            controller.error(new Error(`tar exited with code ${code}`))
+          } catch {}
+        }
+      })
+    },
+    cancel() {
+      proc.kill('SIGTERM')
+    },
+  })
+
+  const date = new Date().toISOString().slice(0, 10)
+  return new Response(stream, {
+    headers: {
+      'content-type': 'application/gzip',
+      'content-disposition': `attachment; filename="bazilion-backup-${date}.tar.gz"`,
+    },
+  })
+})
+
+// /api/tokens
+miscRouter.get('/tokens', (c) => {
+  const { db } = getCtx()
+  const includeRevoked = c.req.query('includeRevoked') === '1'
+  const tokens = webTokenRepo.list(db, { includeRevoked })
+  return c.json({ tokens } satisfies ListTokensResponse)
+})
+
+miscRouter.post('/tokens', async (c) => {
+  const body = (await c.req.json().catch(() => null)) as CreateTokenRequest | null
+  if (!body || typeof body.label !== 'string' || !body.label.trim()) {
+    return c.json({ error: 'label is required' }, 400)
+  }
+  const { db } = getCtx()
+  const created = webTokenRepo.create(db, body.label.trim())
+  return c.json({ token: created.token, meta: created.meta } satisfies CreateTokenResponse, 201)
+})
+
+miscRouter.delete('/tokens/:id', (c) => {
+  const { db, authToken } = getCtx()
+  const id = c.req.param('id')
+  const existing = webTokenRepo.get(db, id)
+  if (!existing) return c.json({ error: `token not found: ${id}` }, 404)
+  if (existing.revokedAt) return c.json({ error: 'token already revoked' }, 409)
+  // Refuse to revoke the bootstrap token — that's the plaintext in auth.json
+  // the local CLI uses for loopback. Revoking it would lock the operator out
+  // of their own daemon. Match by hash (label is editable, hash isn't).
+  const bootstrap = webTokenRepo.findActiveByToken(db, authToken)
+  if (bootstrap && bootstrap.id === id) {
+    return c.json(
+      {
+        error:
+          'cannot revoke the bootstrap token — it lives in ~/.bazilion/auth.json and is the local CLI loopback credential',
+      },
+      409,
+    )
+  }
+  webTokenRepo.revoke(db, id)
+  return c.body(null, 204)
+})

package/apps/daemon/src/routes/profiles.ts

@@ -0,0 +1,197 @@
+// /api/profiles/* — profile CRUD + per-profile template files.
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import type {
+  CreateProfileRequest,
+  FileContentResponse,
+  ProfileFileName,
+  PutFileRequest,
+  SkillsMode,
+  UpdateProfileRequest,
+} from '@bazilion/api-types'
+import { PROFILE_FILES } from '@bazilion/api-types'
+import { Hono } from 'hono'
+import {
+  agentRepo,
+  createProfile,
+  DEFAULT_BOOTSTRAP,
+  DEFAULT_IDENTITY,
+  DEFAULT_SOUL,
+  deleteProfile,
+  loadProfile,
+  profileRepo,
+  updateProfile,
+} from '../core/index.ts'
+import { getCtx } from '../lib/ctx.ts'
+
+export const profilesRouter = new Hono()
+
+profilesRouter.get('/', (c) => {
+  const { db } = getCtx()
+  const profiles = profileRepo.list(db)
+  // Hydrate with the per-profile fields the listing UI needs (agent counts,
+  // default-skill list) so callers don't fan out to extra endpoints per row.
+  const hydrated = profiles.map((p) => ({
+    ...p,
+    agentCount: agentRepo.countByProfile(db, p.id),
+    defaultSkills: profileRepo.getDefaultSkills(db, p.id),
+  }))
+  return c.json(hydrated)
+})
+
+// /api/profiles/_/templates — built-in defaults for the SOUL/IDENTITY/BOOTSTRAP
+// markdown templates. Underscore prefix avoids clashing with the `:id` route.
+profilesRouter.get('/_/templates', (c) => {
+  return c.json({
+    soul: DEFAULT_SOUL,
+    identity: DEFAULT_IDENTITY,
+    bootstrap: DEFAULT_BOOTSTRAP,
+  })
+})
+
+profilesRouter.post('/', async (c) => {
+  const raw = (await c.req.json().catch(() => null)) as
+    | (Record<string, unknown> & Partial<CreateProfileRequest>)
+    | null
+  if (!raw) return c.json({ error: 'invalid JSON body' }, 400)
+  const id = typeof raw.id === 'string' ? raw.id : ''
+  const defaultModel =
+    typeof raw.defaultModel === 'string'
+      ? raw.defaultModel
+      : typeof raw.model === 'string'
+        ? raw.model
+        : ''
+  if (!id || !defaultModel) return c.json({ error: 'id and model are required' }, 400)
+  const name = typeof raw.name === 'string' ? raw.name : undefined
+
+  const skillsMode = toSkillsMode(raw.skillsMode) ?? 'selected'
+  const defaultSkills = csvToArray(raw.defaultSkills ?? raw.skills)
+
+  const templates: {
+    soul?: string
+    identity?: string
+    bootstrap?: string | null
+    agents?: string
+    tools?: string
+    heartbeat?: string
+  } = {}
+  if (typeof raw.soul === 'string' && raw.soul.length > 0) templates.soul = raw.soul
+  if (typeof raw.identity === 'string' && raw.identity.length > 0) templates.identity = raw.identity
+  if (raw.skipBootstrap === true || raw.bootstrap === null) templates.bootstrap = null
+  else if (typeof raw.bootstrap === 'string' && raw.bootstrap.length > 0)
+    templates.bootstrap = raw.bootstrap
+  if (typeof raw.agents === 'string' && raw.agents.length > 0) templates.agents = raw.agents
+  if (typeof raw.tools === 'string' && raw.tools.length > 0) templates.tools = raw.tools
+  if (typeof raw.heartbeat === 'string' && raw.heartbeat.length > 0)
+    templates.heartbeat = raw.heartbeat
+
+  const { db, paths } = getCtx()
+  try {
+    const profile = createProfile(db, paths, {
+      id,
+      name,
+      defaultModel,
+      skillsMode,
+      defaultSkills,
+      ...(Object.keys(templates).length > 0 ? { templates } : {}),
+    })
+    return c.json(profile, 201)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  }
+})
+
+profilesRouter.get('/:id', (c) => {
+  const { db } = getCtx()
+  try {
+    return c.json(loadProfile(db, c.req.param('id')))
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 404)
+  }
+})
+
+profilesRouter.patch('/:id', async (c) => {
+  const raw = (await c.req.json().catch(() => null)) as
+    | (UpdateProfileRequest & Record<string, unknown>)
+    | null
+  if (!raw) return c.json({ error: 'invalid JSON body' }, 400)
+
+  const input: UpdateProfileRequest = {}
+  if (typeof raw.name === 'string') input.name = raw.name
+  if (typeof raw.defaultModel === 'string' && raw.defaultModel.length > 0)
+    input.defaultModel = raw.defaultModel
+  if (raw.skillsMode === 'all' || raw.skillsMode === 'selected') {
+    input.skillsMode = raw.skillsMode
+  }
+  const rawSkills: unknown = raw.defaultSkills
+  if (Array.isArray(rawSkills)) {
+    input.defaultSkills = rawSkills.filter((s): s is string => typeof s === 'string')
+  } else if (typeof rawSkills === 'string') {
+    input.defaultSkills = rawSkills
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean)
+  }
+  const { db, paths } = getCtx()
+  try {
+    return c.json(updateProfile(db, paths, c.req.param('id'), input))
+  } catch (err) {
+    const msg = (err as Error).message
+    return c.json({ error: msg }, msg.startsWith('profile not found') ? 404 : 400)
+  }
+})
+
+profilesRouter.delete('/:id', (c) => {
+  const { db } = getCtx()
+  try {
+    deleteProfile(db, c.req.param('id'))
+    return c.body(null, 204)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  }
+})
+
+profilesRouter.get('/:id/files/:file', (c) => {
+  const { db, paths } = getCtx()
+  if (!profileRepo.get(db, c.req.param('id')))
+    return c.json({ error: `profile not found: ${c.req.param('id')}` }, 404)
+  const path = resolveFilePath(paths.profilesDir, c.req.param('id'), c.req.param('file'))
+  if (!path) return c.json({ error: `unsupported file: ${c.req.param('file')}` }, 400)
+  if (!existsSync(path)) return c.json({ error: `file not present: ${c.req.param('file')}` }, 404)
+  const body: FileContentResponse = { content: readFileSync(path, 'utf8') }
+  return c.json(body)
+})
+
+profilesRouter.put('/:id/files/:file', async (c) => {
+  const body = (await c.req.json().catch(() => null)) as PutFileRequest | null
+  if (!body || typeof body.content !== 'string')
+    return c.json({ error: 'content is required' }, 400)
+  const { db, paths } = getCtx()
+  if (!profileRepo.get(db, c.req.param('id')))
+    return c.json({ error: `profile not found: ${c.req.param('id')}` }, 404)
+  const path = resolveFilePath(paths.profilesDir, c.req.param('id'), c.req.param('file'))
+  if (!path) return c.json({ error: `unsupported file: ${c.req.param('file')}` }, 400)
+  writeFileSync(path, body.content)
+  return c.body(null, 204)
+})
+
+function resolveFilePath(profilesDir: string, id: string, file: string): string | null {
+  if (!(PROFILE_FILES as readonly string[]).includes(file)) return null
+  return join(profilesDir, id, file as ProfileFileName)
+}
+
+function csvToArray(v: unknown): string[] | undefined {
+  if (Array.isArray(v)) return v.filter((s): s is string => typeof s === 'string')
+  if (typeof v === 'string' && v.length > 0) {
+    return v
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean)
+  }
+  return undefined
+}
+
+function toSkillsMode(v: unknown): SkillsMode | undefined {
+  return v === 'all' || v === 'selected' ? v : undefined
+}

package/apps/daemon/src/routes/skills.ts

@@ -0,0 +1,123 @@
+// /api/skills/* — skill discovery, removal, and import (file-path or zip upload).
+
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { homedir, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { ImportSkillsRequest, ImportSkillsResponse, SkillInfo } from '@bazilion/api-types'
+import { Hono } from 'hono'
+import { discoverSkills, importSkills, parseSkillFile, skillMetaRepo } from '../core/index.ts'
+import { getCtx } from '../lib/ctx.ts'
+
+// 50 MiB cap — generous headroom for a bundle of skills, tight enough to
+// reject obviously-malicious payloads without needing a streaming upload.
+const MAX_ZIP_BYTES = 50 * 1024 * 1024
+
+export const skillsRouter = new Hono()
+
+skillsRouter.get('/', (c) => {
+  const { db, paths } = getCtx()
+  const out: SkillInfo[] = []
+  for (const s of discoverSkills(paths)) {
+    const meta = skillMetaRepo.get(db, s.name)
+    const entry: SkillInfo = {
+      name: s.name,
+      description: '',
+      source: meta?.source ?? null,
+      importedAt: meta?.importedAt ?? null,
+    }
+    try {
+      const parsed = parseSkillFile(s.skillFile)
+      entry.description = parsed.frontmatter.description
+    } catch (err) {
+      entry.parseError = (err as Error).message
+    }
+    out.push(entry)
+  }
+  return c.json(out)
+})
+
+skillsRouter.delete('/:name', (c) => {
+  const { db, paths } = getCtx()
+  const name = c.req.param('name')
+  const dir = paths.skillDir(name)
+  if (!existsSync(dir)) return c.json({ error: `skill not found: ${name}` }, 404)
+  rmSync(dir, { recursive: true, force: true })
+  skillMetaRepo.remove(db, name)
+  return c.body(null, 204)
+})
+
+skillsRouter.post('/import', async (c) => {
+  let input: ParsedImportInput
+  try {
+    input = await parseImportInput(c.req.raw)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  }
+
+  const { db, paths } = getCtx()
+  try {
+    const result = importSkills(paths, { source: input.source, force: input.force })
+    const now = Date.now()
+    for (const name of result.imported) {
+      skillMetaRepo.upsert(db, { name, source: input.sourceLabel, importedAt: now })
+    }
+    const res: ImportSkillsResponse = { imported: result.imported, skipped: result.skipped }
+    return c.json(res)
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400)
+  } finally {
+    if (input.tempZipPath) rmSync(input.tempZipPath, { recursive: true, force: true })
+  }
+})
+
+interface ParsedImportInput {
+  source: string
+  force: boolean
+  /** when set, a temp zip was written and should be rm'd after import */
+  tempZipPath: string | null
+  /** label stored in skill_meta.source (e.g. "uploaded:foo.zip" for uploads) */
+  sourceLabel: string
+}
+
+async function parseImportInput(request: Request): Promise<ParsedImportInput> {
+  const contentType = request.headers.get('content-type') ?? ''
+  if (contentType.startsWith('multipart/form-data')) {
+    const form = await request.formData()
+    const file = form.get('file')
+    if (!(file instanceof File) || file.size === 0) {
+      throw new Error('multipart upload missing "file" field')
+    }
+    if (file.size > MAX_ZIP_BYTES) {
+      throw new Error(`zip too large: ${file.size} bytes (max ${MAX_ZIP_BYTES})`)
+    }
+    const filename = file.name || 'upload.zip'
+    if (!filename.toLowerCase().endsWith('.zip')) {
+      throw new Error('uploaded file must be a .zip archive')
+    }
+    const tmpDir = mkdtempSync(join(tmpdir(), 'bazilion-skill-upload-'))
+    const zipPath = join(tmpDir, filename.replace(/[^\w.-]+/g, '_'))
+    const buf = Buffer.from(await file.arrayBuffer())
+    writeFileSync(zipPath, buf)
+    const forceField = form.get('force')
+    return {
+      source: zipPath,
+      force: forceField === 'true' || forceField === 'on' || forceField === '1',
+      tempZipPath: tmpDir,
+      sourceLabel: `uploaded:${filename}`,
+    }
+  }
+
+  const body = (await request.json().catch(() => null)) as
+    | (Partial<ImportSkillsRequest> & { from?: string })
+    | null
+  if (!body) throw new Error('invalid JSON body')
+  const from = body.source ?? body.from
+  if (typeof from !== 'string' || !from) throw new Error('source is required')
+  const source = from === 'openclaw' ? join(homedir(), '.openclaw', 'skills') : from
+  return {
+    source,
+    force: Boolean(body.force),
+    tempZipPath: null,
+    sourceLabel: from,
+  }
+}

package/apps/daemon/src/routes/triggers.ts

@@ -0,0 +1,29 @@
+// /api/triggers/:id — enable/disable + delete. (Listing is per-agent at
+// /api/agents/:id/triggers; creation is also per-agent.)
+
+import type { UpdateTriggerRequest } from '@bazilion/api-types'
+import { Hono } from 'hono'
+import { triggerRepo } from '../core/index.ts'
+import { getCtx } from '../lib/ctx.ts'
+
+export const triggersRouter = new Hono()
+
+triggersRouter.delete('/:id', (c) => {
+  const { db } = getCtx()
+  const id = c.req.param('id')
+  if (!triggerRepo.get(db, id)) return c.json({ error: `trigger not found: ${id}` }, 404)
+  triggerRepo.remove(db, id)
+  return c.body(null, 204)
+})
+
+triggersRouter.patch('/:id', async (c) => {
+  const id = c.req.param('id')
+  const body = (await c.req.json().catch(() => null)) as UpdateTriggerRequest | null
+  if (!body) return c.json({ error: 'invalid JSON body' }, 400)
+  const { db } = getCtx()
+  if (!triggerRepo.get(db, id)) return c.json({ error: `trigger not found: ${id}` }, 404)
+  if (typeof body.enabled === 'boolean') {
+    triggerRepo.setEnabled(db, id, body.enabled)
+  }
+  return c.json({ trigger: triggerRepo.get(db, id) })
+})