mop-agent 0.1.0

package/apps/web/lib/brain/mirror.ts

@@ -0,0 +1,80 @@
+/**
+ * Brain mirror — DB-backed. Ingests snapshots pushed by FLOW so the Brain is
+ * browsable even when the project PC is offline, and embeds each memory into
+ * sqlite-vec for recall (the "up" side of the learning loop, PRD §2.7).
+ */
+import { eq, desc } from "drizzle-orm";
+import type { SnapshotPushMessage } from "@mop/link-protocol";
+import { getDb } from "../db/client";
+import { memoryEntry, projectMirror } from "../db/schema";
+import { embedAndIndex } from "../memory/embed";
+
+export type MirrorSummary = {
+  projectId: string;
+  state: unknown;
+  artifacts: SnapshotPushMessage["artifacts"];
+  memoryCount: number;
+  updatedAt: number;
+};
+
+export async function ingestSnapshot(snap: SnapshotPushMessage): Promise<void> {
+  const db = getDb();
+
+  db.insert(projectMirror)
+    .values({
+      projectId: snap.projectId,
+      stateJson: JSON.stringify(snap.state),
+      artifactsJson: JSON.stringify(snap.artifacts),
+      updatedAt: Date.now(),
+    })
+    .onConflictDoUpdate({
+      target: projectMirror.projectId,
+      set: {
+        stateJson: JSON.stringify(snap.state),
+        artifactsJson: JSON.stringify(snap.artifacts),
+        updatedAt: Date.now(),
+      },
+    })
+    .run();
+
+  for (const m of snap.memory) {
+    db.insert(memoryEntry)
+      .values({
+        id: m.id,
+        projectId: snap.projectId,
+        kind: String(m.kind),
+        summary: m.summary,
+        body: m.body ?? null,
+        actor: m.actor ?? null,
+        at: m.at,
+        private: m.private ?? true,
+      })
+      .onConflictDoNothing()
+      .run();
+    await embedAndIndex("episodic", m.id, `${m.summary}\n${m.body ?? ""}`);
+  }
+}
+
+export function listProjectMemory(projectId: string, limit = 100): Array<typeof memoryEntry.$inferSelect> {
+  return getDb()
+    .select()
+    .from(memoryEntry)
+    .where(eq(memoryEntry.projectId, projectId))
+    .orderBy(desc(memoryEntry.at))
+    .limit(limit)
+    .all();
+}
+
+export function getMirror(projectId: string): MirrorSummary | undefined {
+  const db = getDb();
+  const [row] = db.select().from(projectMirror).where(eq(projectMirror.projectId, projectId)).all();
+  if (!row) return undefined;
+  const mem = db.select().from(memoryEntry).where(eq(memoryEntry.projectId, projectId)).all();
+  return {
+    projectId,
+    state: row.stateJson ? JSON.parse(row.stateJson) : {},
+    artifacts: row.artifactsJson ? JSON.parse(row.artifactsJson) : [],
+    memoryCount: mem.length,
+    updatedAt: row.updatedAt,
+  };
+}

package/apps/web/lib/brain/scheduler.ts

@@ -0,0 +1,30 @@
+/**
+ * Background scheduler (Fasa 3.5/5). Cron-driven jobs — currently scheduled
+ * consolidation (episodic → semantic) so the Brain grows automatically.
+ * Set MOP_AGENT_CONSOLIDATE_CRON (e.g. "0 3 * * *") to enable; off if unset.
+ */
+import { Cron } from "croner";
+import { consolidate } from "./consolidate";
+
+const g = globalThis as unknown as { __mopJobs?: Cron[] };
+
+export function startScheduler(): string[] {
+  g.__mopJobs ??= [];
+  const started: string[] = [];
+
+  const expr = process.env.MOP_AGENT_CONSOLIDATE_CRON;
+  if (expr) {
+    const job = new Cron(expr, async () => {
+      try {
+        const r = await consolidate();
+        console.log(`[cron] consolidate → ${r.notesCreated} pattern(s) from ${r.scanned} memories`);
+      } catch (e) {
+        console.error("[cron] consolidate failed:", e);
+      }
+    });
+    g.__mopJobs.push(job);
+    started.push(`consolidate@${expr}`);
+  }
+
+  return started;
+}

package/apps/web/lib/brain/skills.ts

@@ -0,0 +1,34 @@
+/**
+ * Skills registry (Fasa 5) — procedural memory layer of the Brain. Reusable
+ * how-to that recall can surface across projects (PRD §2.1).
+ */
+import { randomUUID } from "node:crypto";
+import { getDb } from "../db/client";
+import { skill } from "../db/schema";
+import { embedAndIndex } from "../memory/embed";
+
+export async function addSkill(input: {
+  name: string;
+  description: string;
+  body: string;
+  sourceProjects?: string[];
+}): Promise<string> {
+  const id = `skill-${randomUUID().slice(0, 8)}`;
+  getDb()
+    .insert(skill)
+    .values({
+      id,
+      name: input.name,
+      description: input.description,
+      body: input.body,
+      sourceProjects: input.sourceProjects ?? [],
+      createdAt: Date.now(),
+    })
+    .run();
+  await embedAndIndex("skill", id, `${input.name}\n${input.description}\n${input.body}`);
+  return id;
+}
+
+export function listSkills(): Array<typeof skill.$inferSelect> {
+  return getDb().select().from(skill).all();
+}

package/apps/web/lib/channels/binding.ts

@@ -0,0 +1,26 @@
+/** Channel ↔ project binding (which project a chat talks to). */
+import { eq } from "drizzle-orm";
+import { getDb } from "../db/client";
+import { channelBinding } from "../db/schema";
+import { listProjects } from "../link/store";
+
+export function getBinding(channelKey: string): string | undefined {
+  const [row] = getDb().select().from(channelBinding).where(eq(channelBinding.channelKey, channelKey)).all();
+  return row?.projectId;
+}
+
+export function setBinding(channelKey: string, projectId: string): void {
+  getDb()
+    .insert(channelBinding)
+    .values({ channelKey, projectId, updatedAt: Date.now() })
+    .onConflictDoUpdate({ target: channelBinding.channelKey, set: { projectId, updatedAt: Date.now() } })
+    .run();
+}
+
+/** Resolve the project for a chat: explicit binding, else the only project, else undefined. */
+export function resolveProject(channelKey: string): string | undefined {
+  const bound = getBinding(channelKey);
+  if (bound) return bound;
+  const projects = listProjects();
+  return projects.length === 1 ? projects[0]!.id : undefined;
+}

package/apps/web/lib/channels/discord.ts

@@ -0,0 +1,28 @@
+/** Discord adapter (discord.js). Started only if DISCORD_BOT_TOKEN is set. */
+import { Client, Events, GatewayIntentBits } from "discord.js";
+import { handleIncoming } from "./handler";
+
+export function startDiscord(token: string): Client {
+  const client = new Client({
+    intents: [
+      GatewayIntentBits.Guilds,
+      GatewayIntentBits.GuildMessages,
+      GatewayIntentBits.MessageContent,
+      GatewayIntentBits.DirectMessages,
+    ],
+  });
+
+  client.on(Events.MessageCreate, async (msg) => {
+    if (msg.author.bot) return;
+    const key = `discord:${msg.channelId}`;
+    try {
+      const reply = await handleIncoming(key, msg.content);
+      if (reply) await msg.reply(reply.slice(0, 1900)); // Discord 2000-char limit
+    } catch (e) {
+      await msg.reply(`error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  });
+
+  void client.login(token);
+  return client;
+}

package/apps/web/lib/channels/handler.ts

@@ -0,0 +1,44 @@
+/**
+ * Platform-neutral channel message handler. Telegram/Discord adapters call this
+ * with a namespaced channelKey ("telegram:123", "discord:456") and the text;
+ * it handles commands and otherwise answers grounded on the bound project.
+ */
+import { listProjects } from "../link/store";
+import { groundedAnswerText } from "../brain/answer";
+import { resolveProject, setBinding } from "./binding";
+
+const HELP = [
+  "🧠 MOP-AGENT brain.",
+  "Commands:",
+  "• /projects — list linked projects",
+  "• /use <id> — bind this chat to a project",
+  "Then just ask a question.",
+].join("\n");
+
+export async function handleIncoming(channelKey: string, text: string): Promise<string> {
+  const t = (text ?? "").trim();
+  if (!t) return "";
+
+  if (t === "/help" || t === "/start") return HELP;
+
+  if (t === "/projects") {
+    const ps = listProjects();
+    return ps.length
+      ? "Projects:\n" + ps.map((p) => `• ${p.id} (${p.status})`).join("\n")
+      : "No projects linked yet.";
+  }
+
+  if (t.startsWith("/use ")) {
+    const id = t.slice(5).trim();
+    if (!listProjects().some((p) => p.id === id)) return `Unknown project: "${id}". Try /projects.`;
+    setBinding(channelKey, id);
+    return `✅ This chat is now bound to "${id}". Ask away.`;
+  }
+
+  const projectId = resolveProject(channelKey);
+  if (!projectId) return "Which project? Use /projects then /use <id>.";
+
+  const { text: answer, provider } = await groundedAnswerText(projectId, t);
+  const note = provider === "echo" ? "\n\n(echo — set ANTHROPIC_API_KEY/OPENROUTER_API_KEY for real answers)" : "";
+  return `${answer}${note}`;
+}

package/apps/web/lib/channels/index.ts

@@ -0,0 +1,18 @@
+/**
+ * Start messaging channels for which a bot token is configured. SDKs are loaded
+ * lazily (dynamic import) so they cost nothing when unused.
+ */
+export async function startChannels(): Promise<string[]> {
+  const started: string[] = [];
+  if (process.env.TELEGRAM_BOT_TOKEN) {
+    const { startTelegram } = await import("./telegram");
+    startTelegram(process.env.TELEGRAM_BOT_TOKEN);
+    started.push("telegram");
+  }
+  if (process.env.DISCORD_BOT_TOKEN) {
+    const { startDiscord } = await import("./discord");
+    startDiscord(process.env.DISCORD_BOT_TOKEN);
+    started.push("discord");
+  }
+  return started;
+}

package/apps/web/lib/channels/telegram.ts

@@ -0,0 +1,18 @@
+/** Telegram adapter (grammy). Long-polling; started only if TELEGRAM_BOT_TOKEN is set. */
+import { Bot } from "grammy";
+import { handleIncoming } from "./handler";
+
+export function startTelegram(token: string): Bot {
+  const bot = new Bot(token);
+  bot.on("message:text", async (ctx) => {
+    const key = `telegram:${ctx.chat.id}`;
+    try {
+      const reply = await handleIncoming(key, ctx.message.text);
+      if (reply) await ctx.reply(reply);
+    } catch (e) {
+      await ctx.reply(`error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  });
+  void bot.start();
+  return bot;
+}

package/apps/web/lib/crypto.ts

@@ -0,0 +1,35 @@
+/**
+ * Secret-at-rest encryption (AES-256-GCM). Key derived from MOP_AGENT_SECRET
+ * (64 hex chars = 32 bytes). Used to store provider API keys encrypted.
+ * Format: base64(iv).base64(tag).base64(ciphertext)
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+
+function key(): Buffer {
+  const secret = process.env.MOP_AGENT_SECRET;
+  if (secret && /^[0-9a-fA-F]{64}$/.test(secret)) return Buffer.from(secret, "hex");
+  // Dev fallback: derive a 32-byte key from whatever secret is present (insecure).
+  return createHash("sha256").update(secret ?? "mop-agent-dev-insecure-key").digest();
+}
+
+export function encryptSecret(plain: string): string {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key(), iv);
+  const enc = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return [iv, tag, enc].map((b) => b.toString("base64")).join(".");
+}
+
+export function decryptSecret(encoded: string): string {
+  const [ivB, tagB, dataB] = encoded.split(".");
+  if (!ivB || !tagB || !dataB) throw new Error("bad ciphertext");
+  const decipher = createDecipheriv("aes-256-gcm", key(), Buffer.from(ivB, "base64"));
+  decipher.setAuthTag(Buffer.from(tagB, "base64"));
+  return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
+}
+
+/** "sk-…last4" style hint, never the full key. */
+export function keyHint(plain: string): string {
+  if (plain.length <= 8) return "••••";
+  return `${plain.slice(0, 3)}…${plain.slice(-4)}`;
+}

package/apps/web/lib/db/client.ts

@@ -0,0 +1,34 @@
+/**
+ * Shared SQLite connection: one better-sqlite3 instance used by BOTH Drizzle
+ * (app tables) and Better Auth (its Kysely adapter). better-sqlite3 is synchronous,
+ * so a single shared connection is correct and simplest.
+ *
+ * sqlite-vec is loaded onto the connection so vector queries work everywhere.
+ */
+import Database from "better-sqlite3";
+import * as sqliteVec from "sqlite-vec";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { mkdirSync } from "node:fs";
+import { dataDir, dbPath } from "./paths";
+import * as schema from "./schema";
+
+let _sqlite: Database.Database | null = null;
+
+export function getSqlite(): Database.Database {
+  if (_sqlite) return _sqlite;
+  mkdirSync(dataDir(), { recursive: true });
+  const db = new Database(dbPath());
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  sqliteVec.load(db);
+  _sqlite = db;
+  return db;
+}
+
+let _db: ReturnType<typeof drizzle<typeof schema>> | null = null;
+
+export function getDb() {
+  if (_db) return _db;
+  _db = drizzle(getSqlite(), { schema });
+  return _db;
+}

package/apps/web/lib/db/migrate.ts

@@ -0,0 +1,116 @@
+/**
+ * Migrations: app tables (raw SQL, idempotent) + sqlite-vec virtual table +
+ * Better Auth tables (via better-auth/db/migration). Safe to run repeatedly.
+ */
+import { getSqlite } from "./client";
+import { EMBED_DIM } from "../memory/embed";
+
+const APP_TABLES_SQL = `
+CREATE TABLE IF NOT EXISTS project (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  mop_flow_version TEXT,
+  link_token_hash TEXT NOT NULL,
+  capabilities TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'offline',
+  last_seen_at INTEGER,
+  created_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS pairing_code (
+  code TEXT PRIMARY KEY,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  created_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS project_mirror (
+  project_id TEXT PRIMARY KEY,
+  state_json TEXT,
+  artifacts_json TEXT,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS memory_entry (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  body TEXT,
+  actor TEXT,
+  at INTEGER NOT NULL,
+  private INTEGER NOT NULL DEFAULT 1
+);
+CREATE INDEX IF NOT EXISTS idx_memory_project ON memory_entry(project_id);
+
+CREATE TABLE IF NOT EXISTS semantic_note (
+  id TEXT PRIMARY KEY,
+  title TEXT NOT NULL,
+  body TEXT NOT NULL,
+  source_projects TEXT,
+  confidence INTEGER NOT NULL DEFAULT 50,
+  created_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS channel_binding (
+  channel_key TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS app_role (
+  user_id TEXT PRIMARY KEY,
+  role TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS invite (
+  email TEXT PRIMARY KEY,
+  role TEXT NOT NULL DEFAULT 'member',
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  invited_by TEXT,
+  created_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS provider_config (
+  owner_id TEXT PRIMARY KEY,
+  provider TEXT NOT NULL,
+  api_key_enc TEXT NOT NULL,
+  model TEXT,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS skill (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL,
+  body TEXT NOT NULL,
+  source_projects TEXT,
+  created_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS vec_map (
+  rowid INTEGER PRIMARY KEY,
+  ref_type TEXT NOT NULL,
+  ref_id TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_vecmap_ref ON vec_map(ref_type, ref_id);
+`;
+
+export async function runAllMigrations(): Promise<void> {
+  const sqlite = getSqlite();
+
+  // App tables
+  sqlite.exec(APP_TABLES_SQL);
+
+  // sqlite-vec virtual table (raw — Drizzle can't model vec0)
+  sqlite.exec(
+    `CREATE VIRTUAL TABLE IF NOT EXISTS vec_memory USING vec0(embedding float[${EMBED_DIM}]);`,
+  );
+
+  // Better Auth tables (user, session, account, verification)
+  const { getMigrations } = await import("better-auth/db/migration");
+  const { auth } = await import("../auth.js");
+  const { runMigrations } = await getMigrations(auth.options);
+  await runMigrations();
+}

package/apps/web/lib/db/paths.ts

@@ -0,0 +1,25 @@
+/**
+ * Cross-platform data directory resolution (Windows + Linux + macOS).
+ * Override with MOP_AGENT_DATA_DIR. Defaults to <cwd>/data in dev for easy inspection.
+ */
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+
+export function dataDir(): string {
+  if (process.env.MOP_AGENT_DATA_DIR) return process.env.MOP_AGENT_DATA_DIR;
+
+  // Production-friendly OS locations (used when not in a project checkout).
+  if (process.env.MOP_AGENT_USE_OS_DIR === "1") {
+    if (platform() === "win32") {
+      return join(process.env.APPDATA ?? join(homedir(), "AppData", "Roaming"), "mop-agent");
+    }
+    return join(process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share"), "mop-agent");
+  }
+
+  // Dev default: ./data (gitignored)
+  return join(process.cwd(), "data");
+}
+
+export function dbPath(): string {
+  return join(dataDir(), "mop-agent.db");
+}

package/apps/web/lib/db/schema.ts

@@ -0,0 +1,105 @@
+/**
+ * Drizzle schema (app tables). Better Auth owns its own tables (user, session,
+ * account, verification) — created by Better Auth migrations on the same DB file.
+ *
+ * The sqlite-vec virtual table `vec_memory` is created via raw SQL in migrate.ts
+ * (Drizzle can't model a vec0 virtual table).
+ *
+ * Timestamps are epoch millis (number) to match @mop/link-protocol.
+ */
+import { sqliteTable, text, integer } from "drizzle-orm/sqlite-core";
+import type { Capabilities } from "@mop/link-protocol";
+
+export const project = sqliteTable("project", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  mopFlowVersion: text("mop_flow_version"),
+  linkTokenHash: text("link_token_hash").notNull(),
+  capabilities: text("capabilities", { mode: "json" }).$type<Capabilities>().notNull(),
+  status: text("status").notNull().default("offline"),
+  lastSeenAt: integer("last_seen_at"),
+  createdAt: integer("created_at").notNull(),
+});
+
+export const pairingCode = sqliteTable("pairing_code", {
+  code: text("code").primaryKey(),
+  expiresAt: integer("expires_at").notNull(),
+  usedAt: integer("used_at"),
+  createdAt: integer("created_at").notNull(),
+});
+
+export const projectMirror = sqliteTable("project_mirror", {
+  projectId: text("project_id").primaryKey(),
+  stateJson: text("state_json"),
+  artifactsJson: text("artifacts_json"),
+  updatedAt: integer("updated_at").notNull(),
+});
+
+export const memoryEntry = sqliteTable("memory_entry", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull(),
+  kind: text("kind").notNull(),
+  summary: text("summary").notNull(),
+  body: text("body"),
+  actor: text("actor"),
+  at: integer("at").notNull(),
+  private: integer("private", { mode: "boolean" }).notNull().default(true),
+});
+
+export const semanticNote = sqliteTable("semantic_note", {
+  id: text("id").primaryKey(),
+  title: text("title").notNull(),
+  body: text("body").notNull(),
+  sourceProjects: text("source_projects", { mode: "json" }).$type<string[]>(),
+  confidence: integer("confidence").notNull().default(50), // 0-100
+  createdAt: integer("created_at").notNull(),
+});
+
+/** Binds a messaging channel/chat to a project (Fasa 4.5). channelKey = "platform:chatId". */
+export const channelBinding = sqliteTable("channel_binding", {
+  channelKey: text("channel_key").primaryKey(),
+  projectId: text("project_id").notNull(),
+  updatedAt: integer("updated_at").notNull(),
+});
+
+/** App role per Better Auth user (Fasa 7 team). owner | member. */
+export const appRole = sqliteTable("app_role", {
+  userId: text("user_id").primaryKey(),
+  role: text("role").notNull(), // "owner" | "member"
+});
+
+/** Email-scoped invite — owner invites a specific email to join. */
+export const invite = sqliteTable("invite", {
+  email: text("email").primaryKey(),
+  role: text("role").notNull().default("member"),
+  expiresAt: integer("expires_at").notNull(),
+  usedAt: integer("used_at"),
+  invitedBy: text("invited_by"),
+  createdAt: integer("created_at").notNull(),
+});
+
+/** Per-owner AI provider config; apiKeyEnc is AES-256-GCM encrypted at rest. */
+export const providerConfig = sqliteTable("provider_config", {
+  ownerId: text("owner_id").primaryKey(),
+  provider: text("provider").notNull(), // "anthropic" | "openrouter"
+  apiKeyEnc: text("api_key_enc").notNull(),
+  model: text("model"),
+  updatedAt: integer("updated_at").notNull(),
+});
+
+/** Procedural memory — reusable how-to / skills (Fasa 5). Shared across projects. */
+export const skill = sqliteTable("skill", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  description: text("description").notNull(),
+  body: text("body").notNull(),
+  sourceProjects: text("source_projects", { mode: "json" }).$type<string[]>(),
+  createdAt: integer("created_at").notNull(),
+});
+
+/** Maps a sqlite-vec rowid to the memory/semantic row it embeds. */
+export const vecMap = sqliteTable("vec_map", {
+  rowid: integer("rowid").primaryKey(),
+  refType: text("ref_type").notNull(), // "episodic" | "semantic"
+  refId: text("ref_id").notNull(),
+});