gigaclaw 1.4.0

package/LICENSE

@@ -0,0 +1,26 @@
+MIT License
+
+Copyright (c) 2026 Gignaati (https://www.gignaati.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+This project is based on the open-source agent framework by the original authors,
+also licensed under the MIT License.

package/README.md

@@ -0,0 +1,237 @@
+<div align="center">
+
+# Giga Bot
+
+### Autonomous AI Agent Platform — Powered by Gignaati
+
+[![npm version](https://img.shields.io/npm/v/gigaclaw?color=000&labelColor=000&logo=npm&label=gigaclaw)](https://www.npmjs.com/package/gigaclaw)
+[![License: MIT](https://img.shields.io/badge/License-MIT-000?labelColor=000)](LICENSE)
+[![GitHub Stars](https://img.shields.io/github/stars/gignaati/gigaclaw?color=000&labelColor=000)](https://github.com/gignaati/gigaclaw/stargazers)
+[![Made in India](https://img.shields.io/badge/Made%20in-India-FF9933?labelColor=000)](https://www.gignaati.com)
+
+**Build, deploy, and run autonomous AI agents 24/7.**  
+India-first. Edge-native. Zero vendor lock-in.
+
+[Website](https://www.gignaati.com) · [Documentation](https://github.com/gignaati/gigaclaw/wiki) · [Issues](https://github.com/gignaati/gigaclaw/issues) · [Discussions](https://github.com/gignaati/gigaclaw/discussions)
+
+</div>
+
+---
+
+## What is Giga Bot?
+
+Giga Bot is a self-hosted, autonomous AI agent platform. You deploy it to your own server or VPS, and it runs 24/7 — responding to messages, executing scheduled jobs, handling webhooks, writing code, managing files, and completing complex multi-step tasks.
+
+It is built on a two-layer architecture:
+
+- **Event Handler** — A Next.js server that handles real-time chat (web UI + Telegram), manages your agent's configuration, and creates jobs for the agent to execute.
+- **Agent Engine** — A Docker container that runs your agent jobs using GitHub Actions or a local Docker daemon. The agent can write code, run shell commands, browse the web, and interact with GitHub.
+
+Giga Bot is the only autonomous agent platform with **native PragatiGPT support** — India's indigenous Small Language Model for edge deployment, delivering 100% data privacy and zero foreign cloud dependency.
+
+---
+
+## One-Line Install
+
+### Linux / macOS
+```bash
+curl -fsSL https://raw.githubusercontent.com/gignaati/gigaclaw/main/install.sh | bash
+```
+
+### Windows (PowerShell)
+```powershell
+irm https://raw.githubusercontent.com/gignaati/gigaclaw/main/install.ps1 | iex
+```
+
+### All Platforms (npm / npx)
+```bash
+# Create a new Giga Bot project
+mkdir my-gigaclaw && cd my-gigaclaw
+npx gigaclaw@latest init
+
+# Then run the interactive setup wizard
+npm run setup
+```
+
+> **Prerequisites:** [Node.js 18+](https://nodejs.org), [Docker](https://docs.docker.com/get-docker/), [Git](https://git-scm.com)
+
+---
+
+## Quick Start (5 Steps)
+
+**Step 1 — Create a new GitHub repository** for your agent (e.g., `my-gigaclaw`).
+
+**Step 2 — Install Giga Bot** into a local folder with the same name:
+```bash
+mkdir my-gigaclaw && cd my-gigaclaw
+npx gigaclaw@latest init
+npm install
+```
+
+**Step 3 — Run the setup wizard:**
+```bash
+npm run setup
+```
+The wizard will ask for:
+- Your GitHub Personal Access Token
+- Your public URL (domain or ngrok URL)
+- Your LLM provider and API key (Claude, GPT, Gemini, PragatiGPT, or Ollama)
+
+**Step 4 — Start your agent:**
+```bash
+docker compose up -d
+```
+
+**Step 5 — Chat with your agent** at your APP_URL.
+
+---
+
+## Supported LLM Providers
+
+Giga Bot supports **6 LLM providers** — more than any other self-hosted agent platform:
+
+| Provider | Description | Data Privacy |
+|---|---|---|
+| **PragatiGPT** | Gignaati's India-first SLM — edge-native, on-premise | 100% — no foreign cloud |
+| **Ollama** | Run any open-source model locally (Llama, Mistral, Qwen, Phi) | 100% — fully local |
+| **Claude (Anthropic)** | claude-opus-4, claude-sonnet-4, claude-haiku-4 | Anthropic's servers |
+| **GPT (OpenAI)** | gpt-5.2, gpt-4o, o4-mini | OpenAI's servers |
+| **Gemini (Google)** | gemini-3.1-pro, gemini-2.5-flash | Google's servers |
+| **Custom API** | Any OpenAI-compatible endpoint (vLLM, LM Studio, Together AI) | Depends on endpoint |
+
+Set your provider in `.env`:
+```bash
+LLM_PROVIDER=pragatigpt   # India-first, edge-native
+LLM_PROVIDER=ollama       # Fully local, zero cloud
+LLM_PROVIDER=anthropic    # Claude (default)
+LLM_PROVIDER=openai       # GPT
+LLM_PROVIDER=google       # Gemini
+LLM_PROVIDER=custom       # Any OpenAI-compatible API
+```
+
+---
+
+## Features
+
+### Agent Capabilities
+- **Web Chat** — Chat with your agent at your APP_URL
+- **Telegram** — Connect a Telegram bot with `npm run setup-telegram`
+- **Scheduled Jobs** — Cron-based recurring tasks via `config/CRONS.json`
+- **Webhook Triggers** — POST to `/api/create-job` to trigger jobs programmatically
+- **Code Workspace** — Full terminal and code editor in the browser
+- **File Uploads** — Upload images, PDFs, and text files to the chat
+
+### Agent Tools
+- **Code execution** — Write and run code in any language
+- **Shell commands** — Execute terminal commands
+- **Web search** — Search the internet for up-to-date information
+- **GitHub integration** — Create PRs, manage issues, push commits
+- **File system** — Read, write, and manage files in the repository
+
+### Infrastructure
+- **Docker Compose** — One-command deployment with Traefik reverse proxy
+- **Auto SSL** — Let's Encrypt certificates via Traefik
+- **GitHub Actions** — Agent jobs run in isolated Docker containers
+- **Auto-merge** — Agent can merge its own PRs after review
+- **Hot reload** — Push to `main` triggers automatic rebuild and restart
+
+### Giga Bot Exclusive Features
+- **PragatiGPT** — India's indigenous SLM for edge deployment
+- **Ollama** — Run any open-source model with zero cloud dependency
+- **Multi-LLM routing** — Different LLMs for chat vs. agent jobs
+- **Per-job LLM override** — Specify `llm_provider` and `llm_model` per cron job
+
+---
+
+## CLI Commands
+
+```bash
+npx gigaclaw init                              # Scaffold or update project files
+npx gigaclaw setup                            # Run interactive setup wizard
+npx gigaclaw setup-telegram                   # Configure Telegram bot
+npx gigaclaw upgrade [@beta|version]          # Upgrade to latest version
+npx gigaclaw reset-auth                       # Regenerate AUTH_SECRET
+npx gigaclaw reset [file]                     # Restore a template file
+npx gigaclaw diff [file]                      # Show differences vs. templates
+npx gigaclaw set-agent-secret <KEY> [VALUE]   # Set GitHub secret (AGENT_ prefix)
+npx gigaclaw set-agent-llm-secret <KEY> [VALUE] # Set LLM secret (AGENT_LLM_ prefix)
+npx gigaclaw set-var <KEY> [VALUE]            # Set GitHub repository variable
+```
+
+---
+
+## Configuration Files
+
+These files in `config/` define your agent's personality and behavior. They are **yours to customize** — Giga Bot will never overwrite them:
+
+| File | Purpose |
+|---|---|
+| `SOUL.md` | Your agent's identity, personality, and values |
+| `JOB_PLANNING.md` | How your agent plans and breaks down jobs |
+| `JOB_AGENT.md` | Instructions for executing jobs |
+| `CRONS.json` | Scheduled recurring jobs |
+| `TRIGGERS.json` | Webhook trigger definitions |
+| `HEARTBEAT.md` | Tasks for the periodic heartbeat cron |
+
+---
+
+## Updating
+
+```bash
+npx gigaclaw upgrade          # Latest stable
+npx gigaclaw upgrade @beta    # Latest beta
+npx gigaclaw upgrade 1.2.72   # Specific version
+```
+
+---
+
+## Deployment
+
+Giga Bot runs on any Linux server with Docker. Recommended:
+
+| Provider | Spec | Monthly Cost |
+|---|---|---|
+| Hetzner CX22 | 2 vCPU, 4 GB RAM | ~€4 |
+| DigitalOcean Droplet | 2 vCPU, 4 GB RAM | ~$24 |
+| AWS EC2 t3.small | 2 vCPU, 2 GB RAM | ~$15 |
+| Your own hardware | Any Linux machine | ₹0 |
+
+For local development, use [ngrok](https://ngrok.com) to expose your machine:
+```bash
+ngrok http 80
+# Then update APP_URL: npx gigaclaw set-var APP_URL https://your-url.ngrok.io
+```
+
+---
+
+## Privacy & Legal
+
+- [Privacy Policy](https://www.gignaati.com/privacy-policy)
+- [Terms of Service](https://www.gignaati.com/terms-of-service)
+- [Security Policy](SECURITY.md)
+- [License](LICENSE) — MIT
+
+---
+
+## Contributing
+
+Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) before submitting a pull request.
+
+---
+
+## Support
+
+- **GitHub Issues:** [github.com/gignaati/gigaclaw/issues](https://github.com/gignaati/gigaclaw/issues)
+- **Discussions:** [github.com/gignaati/gigaclaw/discussions](https://github.com/gignaati/gigaclaw/discussions)
+- **Email:** support@gignaati.com
+- **Website:** [www.gignaati.com](https://www.gignaati.com)
+
+---
+
+<div align="center">
+
+**Built with care by [Gignaati](https://www.gignaati.com) — India's Edge AI Ecosystem**
+
+[Privacy Policy](https://www.gignaati.com/privacy-policy) · [Terms of Service](https://www.gignaati.com/terms-of-service) · [Security](SECURITY.md)
+
+</div>

package/api/CLAUDE.md

@@ -0,0 +1,19 @@
+# /api — External API Routes
+
+This directory contains the route handlers for all `/api/*` endpoints. These routes are for **external callers only** — GitHub Actions, Telegram, cURL, third-party webhooks.
+
+## Auth
+
+All routes (except `/telegram/webhook` and `/github/webhook`, which use their own webhook secrets) require a valid API key passed via the `x-api-key` header. API keys are stored in the SQLite database and managed through the admin UI — they are NOT environment variables.
+
+Auth flow: `x-api-key` header -> `verifyApiKey()` -> database lookup (hashed, timing-safe comparison).
+
+## Do NOT use these routes for browser UI
+
+Browser-facing features must use **Server Actions** (`'use server'` functions) with `requireAuth()` session checks — never `/api` fetch calls. The only exception is chat streaming, which has its own dedicated route at `/stream/chat` with session auth.
+
+| Caller | Mechanism | Auth |
+|--------|-----------|------|
+| External (cURL, GitHub Actions, Telegram) | `/api` route | `x-api-key` header |
+| Browser UI (data/mutations) | Server Action | `requireAuth()` session |
+| Browser UI (chat streaming) | `/stream/chat` | `auth()` session |

package/api/index.js

@@ -0,0 +1,265 @@
+import { createHash, timingSafeEqual } from 'crypto';
+import { createJob } from '../lib/tools/create-job.js';
+import { setWebhook } from '../lib/tools/telegram.js';
+import { getJobStatus, fetchJobLog } from '../lib/tools/github.js';
+import { getTelegramAdapter } from '../lib/channels/index.js';
+import { chat, summarizeJob } from '../lib/ai/index.js';
+import { createNotification } from '../lib/db/notifications.js';
+import { loadTriggers } from '../lib/triggers.js';
+import { verifyApiKey } from '../lib/db/api-keys.js';
+
+// Bot token from env, can be overridden by /telegram/register
+let telegramBotToken = null;
+
+// Cached trigger firing function (initialized on first request)
+let _fireTriggers = null;
+
+function getTelegramBotToken() {
+  if (!telegramBotToken) {
+    telegramBotToken = process.env.TELEGRAM_BOT_TOKEN || null;
+  }
+  return telegramBotToken;
+}
+
+function getFireTriggers() {
+  if (!_fireTriggers) {
+    const result = loadTriggers();
+    _fireTriggers = result.fireTriggers;
+  }
+  return _fireTriggers;
+}
+
+// Routes that have their own authentication
+const PUBLIC_ROUTES = ['/telegram/webhook', '/github/webhook', '/ping'];
+
+/**
+ * Timing-safe string comparison.
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeCompare(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Centralized auth gate for all API routes.
+ * Public routes pass through; everything else requires a valid API key from the database.
+ * @param {string} routePath - The route path
+ * @param {Request} request - The incoming request
+ * @returns {Response|null} - Error response or null if authorized
+ */
+function checkAuth(routePath, request) {
+  if (PUBLIC_ROUTES.includes(routePath)) return null;
+
+  const apiKey = request.headers.get('x-api-key');
+  if (!apiKey) {
+    return Response.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const record = verifyApiKey(apiKey);
+  if (!record) {
+    return Response.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  return null;
+}
+
+/**
+ * Extract job ID from branch name (e.g., "job/abc123" -> "abc123")
+ */
+function extractJobId(branchName) {
+  if (!branchName || !branchName.startsWith('job/')) return null;
+  return branchName.slice(4);
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Route handlers
+// ─────────────────────────────────────────────────────────────────────────────
+
+async function handleWebhook(request) {
+  const body = await request.json();
+  const { job } = body;
+  if (!job) return Response.json({ error: 'Missing job field' }, { status: 400 });
+
+  try {
+    const result = await createJob(job);
+    return Response.json(result);
+  } catch (err) {
+    console.error(err);
+    return Response.json({ error: 'Failed to create job' }, { status: 500 });
+  }
+}
+
+async function handleTelegramRegister(request) {
+  const body = await request.json();
+  const { bot_token, webhook_url } = body;
+  if (!bot_token || !webhook_url) {
+    return Response.json({ error: 'Missing bot_token or webhook_url' }, { status: 400 });
+  }
+
+  try {
+    const result = await setWebhook(bot_token, webhook_url, process.env.TELEGRAM_WEBHOOK_SECRET);
+    telegramBotToken = bot_token;
+    return Response.json({ success: true, result });
+  } catch (err) {
+    console.error(err);
+    return Response.json({ error: 'Failed to register webhook' }, { status: 500 });
+  }
+}
+
+async function handleTelegramWebhook(request) {
+  const botToken = getTelegramBotToken();
+  if (!botToken) return Response.json({ ok: true });
+
+  const adapter = getTelegramAdapter(botToken);
+  const normalized = await adapter.receive(request);
+  if (!normalized) return Response.json({ ok: true });
+
+  // Process message asynchronously (don't block the webhook response)
+  processChannelMessage(adapter, normalized).catch((err) => {
+    console.error('Failed to process message:', err);
+  });
+
+  return Response.json({ ok: true });
+}
+
+/**
+ * Process a normalized message through the AI layer with channel UX.
+ * Message persistence is handled centrally by the AI layer.
+ */
+async function processChannelMessage(adapter, normalized) {
+  await adapter.acknowledge(normalized.metadata);
+  const stopIndicator = adapter.startProcessingIndicator(normalized.metadata);
+
+  try {
+    const response = await chat(
+      normalized.threadId,
+      normalized.text,
+      normalized.attachments,
+      { userId: 'telegram', chatTitle: 'Telegram' }
+    );
+    await adapter.sendResponse(normalized.threadId, response, normalized.metadata);
+  } catch (err) {
+    console.error('Failed to process message with AI:', err);
+    await adapter
+      .sendResponse(
+        normalized.threadId,
+        'Sorry, I encountered an error processing your message.',
+        normalized.metadata
+      )
+      .catch(() => {});
+  } finally {
+    stopIndicator();
+  }
+}
+
+async function handleGithubWebhook(request) {
+  const { GH_WEBHOOK_SECRET } = process.env;
+
+  // Validate webhook secret (timing-safe, required)
+  if (!GH_WEBHOOK_SECRET || !safeCompare(request.headers.get('x-github-webhook-secret-token'), GH_WEBHOOK_SECRET)) {
+    return Response.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const payload = await request.json();
+  const jobId = payload.job_id || extractJobId(payload.branch);
+  if (!jobId) return Response.json({ ok: true, skipped: true, reason: 'not a job' });
+
+  try {
+    // Fetch log from repo via API (no longer sent in payload)
+    let log = payload.log || '';
+    if (!log) {
+      log = await fetchJobLog(jobId, payload.commit_sha);
+    }
+
+    const results = {
+      job: payload.job || '',
+      pr_url: payload.pr_url || payload.run_url || '',
+      run_url: payload.run_url || '',
+      status: payload.status || '',
+      merge_result: payload.merge_result || '',
+      log,
+      changed_files: payload.changed_files || [],
+      commit_message: payload.commit_message || '',
+    };
+
+    const message = await summarizeJob(results);
+    await createNotification(message, payload);
+
+    console.log(`Notification saved for job ${jobId.slice(0, 8)}`);
+
+    return Response.json({ ok: true, notified: true });
+  } catch (err) {
+    console.error('Failed to process GitHub webhook:', err);
+    return Response.json({ error: 'Failed to process webhook' }, { status: 500 });
+  }
+}
+
+async function handleJobStatus(request) {
+  try {
+    const url = new URL(request.url);
+    const jobId = url.searchParams.get('job_id');
+    const result = await getJobStatus(jobId);
+    return Response.json(result);
+  } catch (err) {
+    console.error('Failed to get job status:', err);
+    return Response.json({ error: 'Failed to get job status' }, { status: 500 });
+  }
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Next.js Route Handlers (catch-all)
+// ─────────────────────────────────────────────────────────────────────────────
+
+async function POST(request) {
+  const url = new URL(request.url);
+  const routePath = url.pathname.replace(/^\/api/, '');
+
+  // Auth check
+  const authError = checkAuth(routePath, request);
+  if (authError) return authError;
+
+  // Fire triggers (non-blocking)
+  try {
+    const fireTriggers = getFireTriggers();
+    // Clone request to read body for triggers without consuming it for the handler
+    const clonedRequest = request.clone();
+    const body = await clonedRequest.json().catch(() => ({}));
+    const query = Object.fromEntries(url.searchParams);
+    const headers = Object.fromEntries(request.headers);
+    fireTriggers(routePath, body, query, headers);
+  } catch (e) {
+    // Trigger errors are non-fatal
+  }
+
+  // Route to handler
+  switch (routePath) {
+    case '/create-job':          return handleWebhook(request);
+    case '/telegram/webhook':   return handleTelegramWebhook(request);
+    case '/telegram/register':  return handleTelegramRegister(request);
+    case '/github/webhook':     return handleGithubWebhook(request);
+    default:                    return Response.json({ error: 'Not found' }, { status: 404 });
+  }
+}
+
+async function GET(request) {
+  const url = new URL(request.url);
+  const routePath = url.pathname.replace(/^\/api/, '');
+
+  // Auth check
+  const authError = checkAuth(routePath, request);
+  if (authError) return authError;
+
+  switch (routePath) {
+    case '/ping':           return Response.json({ message: 'Pong!' });
+    case '/jobs/status':    return handleJobStatus(request);
+    default:                return Response.json({ error: 'Not found' }, { status: 404 });
+  }
+}
+
+export { GET, POST };