botinabox 1.8.2 → 1.8.4

package/dist/channels/slack/transcribe.js

@@ -0,0 +1,106 @@
+/**
+ * Local voice transcription via whisper-node (whisper.cpp bindings).
+ *
+ * whisper-node is an optional dependency — if not installed, transcription
+ * degrades gracefully (returns null). Requires ffmpeg on the system PATH
+ * for audio format conversion.
+ *
+ * Setup:
+ *   npm install whisper-node
+ *   npx whisper-node download    # download a model (e.g. base.en)
+ *   brew install ffmpeg           # or equivalent for your platform
+ */
+import { execFileSync } from "node:child_process";
+import { writeFileSync, unlinkSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import os from "node:os";
+import { createRequire } from "node:module";
+const TEMP_DIR = join(os.tmpdir(), "botinabox-audio");
+/**
+ * Transcribe an audio buffer using whisper-node.
+ *
+ * @param audioBuffer - Raw audio data (any format ffmpeg can decode)
+ * @param filename - Original filename (used for temp file extension)
+ * @param opts - Transcription options
+ * @returns Transcribed text, or null if transcription fails or whisper-node is not installed
+ */
+export async function transcribeAudio(audioBuffer, filename, opts) {
+    // Lazy-load whisper-node (optional CJS dependency)
+    let whisper;
+    try {
+        const require = createRequire(import.meta.url);
+        const mod = require("whisper-node");
+        whisper = mod.whisper ?? mod.default ?? mod;
+    }
+    catch {
+        console.warn("[botinabox] whisper-node not installed — voice transcription unavailable. Run: npm install whisper-node && npx whisper-node download");
+        return null;
+    }
+    // Check ffmpeg availability
+    try {
+        execFileSync("ffmpeg", ["-version"], { stdio: "ignore" });
+    }
+    catch {
+        console.warn("[botinabox] ffmpeg not found — required for audio conversion. Install: brew install ffmpeg");
+        return null;
+    }
+    const id = randomUUID().slice(0, 8);
+    const ext = filename.split(".").pop() ?? "aac";
+    mkdirSync(TEMP_DIR, { recursive: true });
+    const inputPath = join(TEMP_DIR, `${id}.${ext}`);
+    const wavPath = join(TEMP_DIR, `${id}.wav`);
+    try {
+        // Write audio to temp file
+        writeFileSync(inputPath, audioBuffer);
+        // Convert to WAV 16kHz mono PCM (required by whisper.cpp)
+        execFileSync("ffmpeg", ["-y", "-i", inputPath, "-ar", "16000", "-ac", "1", "-c:a", "pcm_s16le", wavPath], {
+            stdio: "ignore",
+            timeout: 30_000,
+        });
+        // Transcribe
+        const segments = await whisper(wavPath, {
+            modelName: opts?.modelName ?? "base.en",
+            whisperOptions: {
+                language: opts?.language ?? "auto",
+            },
+        });
+        if (!segments || segments.length === 0)
+            return null;
+        return segments.map((s) => s.speech).join(" ").trim();
+    }
+    catch (err) {
+        console.error("[botinabox] Transcription failed:", err);
+        return null;
+    }
+    finally {
+        // Clean up temp files
+        try {
+            unlinkSync(inputPath);
+        }
+        catch { /* ignore */ }
+        try {
+            unlinkSync(wavPath);
+        }
+        catch { /* ignore */ }
+    }
+}
+/**
+ * Download an audio file from a URL with bearer token authentication.
+ */
+export async function downloadAudio(url, token) {
+    try {
+        const resp = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (!resp.ok) {
+            console.error(`[botinabox] Audio download failed: ${resp.status} ${resp.statusText}`);
+            return null;
+        }
+        return Buffer.from(await resp.arrayBuffer());
+    }
+    catch (err) {
+        console.error("[botinabox] Audio download error:", err);
+        return null;
+    }
+}

package/dist/channels/webhook/adapter.d.ts

@@ -0,0 +1,23 @@
+/**
+ * WebhookAdapter — ChannelAdapter implementation for webhook-based channels.
+ * Story 4.7
+ */
+import type { ChannelAdapter, ChannelCapabilities, ChannelMeta, ChannelConfig, InboundMessage, OutboundPayload, SendResult, HealthStatus } from "../../shared/index.js";
+export declare class WebhookAdapter implements ChannelAdapter {
+    readonly id = "webhook";
+    readonly meta: ChannelMeta;
+    readonly capabilities: ChannelCapabilities;
+    onMessage?: (message: InboundMessage) => Promise<void>;
+    private connected;
+    private config;
+    private webhookServer;
+    connect(config: ChannelConfig): Promise<void>;
+    disconnect(): Promise<void>;
+    healthCheck(): Promise<HealthStatus>;
+    send(target: {
+        peerId: string;
+        threadId?: string;
+    }, payload: OutboundPayload): Promise<SendResult>;
+}
+/** Factory function — default export for auto-discovery. */
+export default function createWebhookAdapter(): WebhookAdapter;

package/dist/channels/webhook/adapter.js

@@ -0,0 +1,86 @@
+/**
+ * WebhookAdapter — ChannelAdapter implementation for webhook-based channels.
+ * Story 4.7
+ */
+import { WebhookServer } from "./server.js";
+export class WebhookAdapter {
+    id = "webhook";
+    meta = {
+        displayName: "Webhook",
+        homepage: "https://example.com",
+    };
+    capabilities = {
+        chatTypes: ["direct"],
+        threads: false,
+        reactions: false,
+        editing: false,
+        media: false,
+        polls: false,
+        maxTextLength: 65535,
+        formattingMode: "plain",
+    };
+    onMessage;
+    connected = false;
+    config = null;
+    webhookServer = null;
+    async connect(config) {
+        this.config = config;
+        this.connected = true;
+        // Start webhook HTTP server if port is specified
+        if (this.config.port) {
+            this.webhookServer = new WebhookServer({
+                port: this.config.port,
+                secret: this.config.secret,
+                onMessage: async (msg) => {
+                    if (this.onMessage)
+                        await this.onMessage(msg);
+                },
+            });
+            await this.webhookServer.start();
+        }
+    }
+    async disconnect() {
+        if (this.webhookServer) {
+            await this.webhookServer.stop();
+            this.webhookServer = null;
+        }
+        this.connected = false;
+        this.config = null;
+    }
+    async healthCheck() {
+        return { ok: this.connected };
+    }
+    async send(target, payload) {
+        if (!this.connected) {
+            return { success: false, error: "Not connected" };
+        }
+        const callbackUrl = this.config?.callbackUrl;
+        if (!callbackUrl) {
+            // No callback URL configured — accept silently (fire-and-forget style)
+            return { success: true };
+        }
+        try {
+            const body = JSON.stringify({
+                to: target.peerId,
+                threadId: target.threadId,
+                text: payload.text,
+            });
+            const response = await fetch(callbackUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body,
+            });
+            if (response.ok) {
+                return { success: true };
+            }
+            return { success: false, error: `HTTP ${response.status}` };
+        }
+        catch (err) {
+            return { success: false, error: String(err) };
+        }
+    }
+}
+/** Factory function — default export for auto-discovery. */
+export default function createWebhookAdapter() {
+    return new WebhookAdapter();
+}

package/dist/channels/webhook/hmac.d.ts

@@ -0,0 +1,13 @@
+/**
+ * HMAC signature verification for webhook payloads.
+ * Story 4.7
+ */
+/**
+ * Verify that the HMAC-SHA256 signature of body matches the provided signature.
+ * Uses timing-safe comparison to prevent timing attacks.
+ *
+ * @param body      - The raw request body string
+ * @param secret    - The shared HMAC secret
+ * @param signature - The signature to verify (hex string, possibly prefixed with "sha256=")
+ */
+export declare function verifyHmac(body: string, secret: string, signature: string): boolean;

package/dist/channels/webhook/hmac.js

@@ -0,0 +1,26 @@
+/**
+ * HMAC signature verification for webhook payloads.
+ * Story 4.7
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Verify that the HMAC-SHA256 signature of body matches the provided signature.
+ * Uses timing-safe comparison to prevent timing attacks.
+ *
+ * @param body      - The raw request body string
+ * @param secret    - The shared HMAC secret
+ * @param signature - The signature to verify (hex string, possibly prefixed with "sha256=")
+ */
+export function verifyHmac(body, secret, signature) {
+    const expected = createHmac("sha256", secret).update(body, "utf8").digest("hex");
+    // Strip optional "sha256=" prefix
+    const provided = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+    if (expected.length !== provided.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(provided, "hex"));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/channels/webhook/models.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Webhook channel configuration types.
+ * Story 4.7
+ */
+export interface WebhookConfig {
+    callbackUrl?: string;
+    secret?: string;
+    port?: number;
+}

package/dist/channels/webhook/models.js

@@ -0,0 +1,5 @@
+/**
+ * Webhook channel configuration types.
+ * Story 4.7
+ */
+export {};

package/dist/channels/webhook/server.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal HTTP server for webhook inbound messages.
+ * Story 4.7
+ */
+import type { InboundMessage } from "../../shared/index.js";
+export interface WebhookServerOpts {
+    port?: number;
+    secret?: string;
+    onMessage: (msg: InboundMessage) => Promise<void>;
+}
+export declare class WebhookServer {
+    private server;
+    private readonly port;
+    private readonly secret;
+    private readonly onMessage;
+    constructor(opts: WebhookServerOpts);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private handleRequest;
+}

package/dist/channels/webhook/server.js

@@ -0,0 +1,91 @@
+/**
+ * Minimal HTTP server for webhook inbound messages.
+ * Story 4.7
+ */
+import { createServer } from "node:http";
+import { verifyHmac } from "./hmac.js";
+export class WebhookServer {
+    server = null;
+    port;
+    secret;
+    onMessage;
+    constructor(opts) {
+        this.port = opts.port ?? 3200;
+        this.secret = opts.secret;
+        this.onMessage = opts.onMessage;
+    }
+    start() {
+        return new Promise((resolve) => {
+            this.server = createServer((req, res) => {
+                void this.handleRequest(req, res);
+            });
+            this.server.listen(this.port, () => resolve());
+        });
+    }
+    stop() {
+        return new Promise((resolve, reject) => {
+            if (!this.server) {
+                resolve();
+                return;
+            }
+            this.server.close((err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async handleRequest(req, res) {
+        const url = req.url ?? "/";
+        const method = req.method ?? "GET";
+        if (method !== "POST" || url !== "/webhook/inbound") {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Not found" }));
+            return;
+        }
+        // Read body
+        let body = "";
+        for await (const chunk of req) {
+            body += chunk;
+        }
+        // Verify HMAC if secret is configured
+        if (this.secret) {
+            const sig = req.headers["x-webhook-signature"];
+            if (!sig || !verifyHmac(body, this.secret, sig)) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid signature" }));
+                return;
+            }
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Invalid JSON" }));
+            return;
+        }
+        // Build InboundMessage from payload
+        const msg = {
+            id: parsed["id"] ?? `webhook-${Date.now()}`,
+            channel: "webhook",
+            from: parsed["from"] ?? "unknown",
+            body: parsed["text"] ?? "",
+            threadId: parsed["threadId"],
+            receivedAt: new Date().toISOString(),
+            raw: parsed,
+        };
+        try {
+            await this.onMessage(msg);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true }));
+        }
+        catch (err) {
+            console.error('[webhook] Error:', err);
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+    }
+}

package/dist/cli/templates/config.yml.d.ts

@@ -0,0 +1,7 @@
+export interface ConfigTemplateOptions {
+    name: string;
+    channel?: string;
+    provider?: string;
+    typescript?: boolean;
+}
+export declare function configYmlTemplate(opts: ConfigTemplateOptions): string;

package/dist/cli/templates/config.yml.js

@@ -0,0 +1,61 @@
+export function configYmlTemplate(opts) {
+    const { name, channel = 'slack', provider = 'anthropic' } = opts;
+    const channelSection = channel === 'slack'
+        ? `  slack:
+    enabled: true
+    token: \${SLACK_BOT_TOKEN}
+    appToken: \${SLACK_APP_TOKEN}
+    signingSecret: \${SLACK_SIGNING_SECRET}`
+        : channel === 'discord'
+            ? `  discord:
+    enabled: true
+    token: \${DISCORD_BOT_TOKEN}`
+            : `  ${channel}:
+    enabled: true`;
+    const providerSection = provider === 'anthropic'
+        ? `  anthropic:
+    enabled: true
+    apiKey: \${ANTHROPIC_API_KEY}`
+        : provider === 'openai'
+            ? `  openai:
+    enabled: true
+    apiKey: \${OPENAI_API_KEY}`
+            : `  ${provider}:
+    enabled: true`;
+    return `name: ${name}
+version: "1.0.0"
+
+data:
+  path: ./data/bot.db
+  walMode: true
+
+channels:
+${channelSection}
+
+providers:
+${providerSection}
+
+agents: []
+
+models:
+  default: claude-3-5-sonnet-20241022
+  aliases: {}
+  routing: {}
+  fallbackChain: []
+
+entities: {}
+
+security: {}
+
+render:
+  outputDir: ./generated
+  watchIntervalMs: 1000
+
+updates:
+  policy: notify
+  checkIntervalMs: 3600000
+
+budget:
+  warnPercent: 80
+`;
+}

package/dist/cli/templates/env.d.ts

@@ -0,0 +1 @@
+export declare function envTemplate(channel?: string, provider?: string): string;

package/dist/cli/templates/env.js

@@ -0,0 +1,30 @@
+export function envTemplate(channel, provider) {
+    const lines = [
+        '# Bot environment variables',
+        '# Copy this file to .env and fill in the values',
+        '',
+    ];
+    if (provider === 'anthropic' || !provider) {
+        lines.push('ANTHROPIC_API_KEY=your_anthropic_api_key_here');
+    }
+    else if (provider === 'openai') {
+        lines.push('OPENAI_API_KEY=your_openai_api_key_here');
+    }
+    else {
+        lines.push(`${provider.toUpperCase()}_API_KEY=your_api_key_here`);
+    }
+    lines.push('');
+    if (channel === 'slack' || !channel) {
+        lines.push('SLACK_BOT_TOKEN=xoxb-your-slack-bot-token');
+        lines.push('SLACK_APP_TOKEN=xapp-your-slack-app-token');
+        lines.push('SLACK_SIGNING_SECRET=your_slack_signing_secret');
+    }
+    else if (channel === 'discord') {
+        lines.push('DISCORD_BOT_TOKEN=your_discord_bot_token');
+    }
+    else {
+        lines.push(`${channel.toUpperCase()}_TOKEN=your_token_here`);
+    }
+    lines.push('');
+    return lines.join('\n');
+}

package/dist/cli/templates/index.ts.d.ts

@@ -0,0 +1,2 @@
+export declare function indexTsTemplate(name: string): string;
+export declare function indexJsTemplate(name: string): string;

package/dist/cli/templates/index.ts.js

@@ -0,0 +1,30 @@
+export function indexTsTemplate(name) {
+    return `import { DataStore } from 'botinabox';
+import { readFileSync } from 'fs';
+
+// Load config
+const config = JSON.parse(readFileSync('./config.yml', 'utf-8'));
+
+async function main(): Promise<void> {
+  console.log('Starting ${name}...');
+  // Initialize your bot here
+}
+
+main().catch(console.error);
+`;
+}
+export function indexJsTemplate(name) {
+    return `import { DataStore } from 'botinabox';
+import { readFileSync } from 'fs';
+
+// Load config
+const config = JSON.parse(readFileSync('./config.yml', 'utf-8'));
+
+async function main() {
+  console.log('Starting ${name}...');
+  // Initialize your bot here
+}
+
+main().catch(console.error);
+`;
+}

package/dist/cli/templates/package.json.d.ts

@@ -0,0 +1,5 @@
+export interface PackageJsonTemplateOptions {
+    name: string;
+    typescript?: boolean;
+}
+export declare function packageJsonTemplate(opts: PackageJsonTemplateOptions): string;

package/dist/cli/templates/package.json.js

@@ -0,0 +1,28 @@
+export function packageJsonTemplate(opts) {
+    const { name, typescript = false } = opts;
+    const scripts = typescript
+        ? {
+            build: 'tsc',
+            start: 'node dist/index.js',
+            dev: 'ts-node src/index.ts',
+        }
+        : {
+            start: 'node index.js',
+        };
+    const devDeps = typescript
+        ? {
+            typescript: '^5.7.2',
+            '@types/node': '^22.10.0',
+        }
+        : {};
+    return JSON.stringify({
+        name,
+        version: '0.1.0',
+        type: 'module',
+        scripts,
+        dependencies: {
+            'botinabox': 'latest',
+        },
+        devDependencies: devDeps,
+    }, null, 2);
+}

package/dist/connectors/google/calendar-connector.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Google Calendar connector — pulls calendar events.
+ *
+ * Produces `CalendarEventRecord` objects. Does NOT write to any database
+ * table; the consuming application decides how to store records.
+ */
+import type { Connector, ConnectorMeta, AuthResult, SyncOptions, SyncResult } from '../../shared/types/connector.js';
+import type { CalendarEventRecord, GoogleConnectorConfig } from './types.js';
+export interface CalendarConnectorOpts {
+    /** Load persisted tokens for a given account key (OAuth2 flow only). */
+    tokenLoader?: (key: string) => Promise<string | null>;
+    /** Persist tokens for a given account key (OAuth2 flow only). */
+    tokenSaver?: (key: string, value: string) => Promise<void>;
+}
+export declare class GoogleCalendarConnector implements Connector<CalendarEventRecord> {
+    readonly id = "google-calendar";
+    readonly meta: ConnectorMeta;
+    private tokenLoader?;
+    private tokenSaver?;
+    private client;
+    private config;
+    private tokens;
+    private calendar;
+    constructor(opts?: CalendarConnectorOpts);
+    connect(config: GoogleConnectorConfig): Promise<void>;
+    disconnect(): Promise<void>;
+    healthCheck(): Promise<{
+        ok: boolean;
+        account?: string;
+        error?: string;
+    }>;
+    authenticate(codeProvider: (authUrl: string) => Promise<string>): Promise<AuthResult>;
+    sync(options?: SyncOptions): Promise<SyncResult<CalendarEventRecord>>;
+    /** Incremental sync using Calendar syncToken. */
+    private syncIncremental;
+    /** Full sync using timeMin. */
+    private syncFull;
+    private ensureConnected;
+    private mapEvent;
+}