nastech-app 1.0.0

package/sources/sync/__testdata__/trace_2.json

@@ -0,0 +1,182 @@
+[
+    {
+        "id": "cmdmg1zqt079z1s1420vm4myd",
+        "seq": 1,
+        "localId": null,
+        "content": {
+            "role": "user",
+            "content": {
+                "type": "text",
+                "text": "show me some tool callilng, use Task, but make it not too long"
+            }
+        },
+        "createdAt": 1753667003189
+    },
+    {
+        "id": "cmdmg238407a31s14287ssvw6",
+        "seq": 2,
+        "localId": null,
+        "content": {
+            "role": "agent",
+            "content": {
+                "type": "output",
+                "data": {
+                    "parentUuid": "242da0d3-f398-4280-b158-c508ea39eb2b",
+                    "isSidechain": false,
+                    "userType": "external",
+                    "cwd": "/Users/steve/Develop/nastech-ai/nastech",
+                    "sessionId": "6b5b91a5-5a00-4635-9952-76d8ab886037",
+                    "version": "1.0.61",
+                    "gitBranch": "main",
+                    "message": {
+                        "id": "msg_01TvE5n9U9FgYbrbNMWLXVa9",
+                        "type": "message",
+                        "role": "assistant",
+                        "model": "claude-opus-4-20250514",
+                        "content": [
+                            {
+                                "type": "text",
+                                "text": "I'll demonstrate tool calling with the Task tool by searching for some code patterns in your codebase."
+                            }
+                        ],
+                        "stop_reason": null,
+                        "stop_sequence": null,
+                        "usage": {
+                            "input_tokens": 4,
+                            "cache_creation_input_tokens": 21075,
+                            "cache_read_input_tokens": 0,
+                            "output_tokens": 3,
+                            "service_tier": "standard"
+                        }
+                    },
+                    "requestId": "req_011CRYZwf1PDUVshjsWPzcbr",
+                    "type": "assistant",
+                    "uuid": "05a9e32e-e808-4be1-9ecf-ae2082927231",
+                    "timestamp": "2025-07-28T01:43:27.590Z"
+                }
+            }
+        },
+        "createdAt": 1753667007700
+    },
+    {
+        "id": "cmdmg259e07a71s14ln4sfzw6",
+        "seq": 3,
+        "localId": null,
+        "content": {
+            "role": "agent",
+            "content": {
+                "type": "output",
+                "data": {
+                    "parentUuid": "05a9e32e-e808-4be1-9ecf-ae2082927231",
+                    "isSidechain": false,
+                    "userType": "external",
+                    "cwd": "/Users/steve/Develop/nastech-ai/nastech",
+                    "sessionId": "6b5b91a5-5a00-4635-9952-76d8ab886037",
+                    "version": "1.0.61",
+                    "gitBranch": "main",
+                    "message": {
+                        "id": "msg_01TvE5n9U9FgYbrbNMWLXVa9",
+                        "type": "message",
+                        "role": "assistant",
+                        "model": "claude-opus-4-20250514",
+                        "content": [
+                            {
+                                "type": "tool_use",
+                                "id": "toolu_01B3dLjLkkLqViKvxsJRwhCw",
+                                "name": "Task",
+                                "input": {
+                                    "description": "Search for socket.io usage",
+                                    "prompt": "Find all files that use socket.io or WebSocket connections in this codebase. Look for imports, socket creation, and event handling.",
+                                    "subagent_type": "general-purpose"
+                                }
+                            }
+                        ],
+                        "stop_reason": "tool_use",
+                        "stop_sequence": null,
+                        "usage": {
+                            "input_tokens": 4,
+                            "cache_creation_input_tokens": 21075,
+                            "cache_read_input_tokens": 0,
+                            "output_tokens": 145,
+                            "service_tier": "standard"
+                        }
+                    },
+                    "requestId": "req_011CRYZwf1PDUVshjsWPzcbr",
+                    "type": "assistant",
+                    "uuid": "a04c79f0-f303-4792-b3bf-1364b9b3bcf7",
+                    "timestamp": "2025-07-28T01:43:30.241Z"
+                }
+            }
+        },
+        "createdAt": 1753667010338
+    },
+    {
+        "id": "cmdmg2lf307a91s14mtk1srsf",
+        "seq": 4,
+        "localId": null,
+        "content": {
+            "role": "agent",
+            "content": {
+                "type": "output",
+                "data": {
+                    "parentUuid": "a04c79f0-f303-4792-b3bf-1364b9b3bcf7",
+                    "isSidechain": false,
+                    "userType": "external",
+                    "cwd": "/Users/steve/Develop/nastech-ai/nastech",
+                    "sessionId": "6b5b91a5-5a00-4635-9952-76d8ab886037",
+                    "version": "1.0.61",
+                    "gitBranch": "main",
+                    "type": "user",
+                    "message": {
+                        "role": "user",
+                        "content": [
+                            {
+                                "type": "tool_result",
+                                "content": "[Request interrupted by user for tool use]",
+                                "is_error": true,
+                                "tool_use_id": "toolu_01B3dLjLkkLqViKvxsJRwhCw"
+                            }
+                        ]
+                    },
+                    "uuid": "f5fac078-b786-420f-aa07-8d10c38064e5",
+                    "timestamp": "2025-07-28T01:43:51.187Z",
+                    "toolUseResult": "Error: [Request interrupted by user for tool use]"
+                }
+            }
+        },
+        "createdAt": 1753667031279
+    },
+    {
+        "id": "cmdmg2lfa07ab1s14m3ym9wb8",
+        "seq": 5,
+        "localId": null,
+        "content": {
+            "role": "agent",
+            "content": {
+                "type": "output",
+                "data": {
+                    "parentUuid": "f5fac078-b786-420f-aa07-8d10c38064e5",
+                    "isSidechain": false,
+                    "userType": "external",
+                    "cwd": "/Users/steve/Develop/nastech-ai/nastech",
+                    "sessionId": "6b5b91a5-5a00-4635-9952-76d8ab886037",
+                    "version": "1.0.61",
+                    "gitBranch": "main",
+                    "type": "user",
+                    "message": {
+                        "role": "user",
+                        "content": [
+                            {
+                                "type": "text",
+                                "text": "[Request interrupted by user for tool use]"
+                            }
+                        ]
+                    },
+                    "uuid": "25721d4d-1ba0-4d10-9e9d-9bed87c46790",
+                    "timestamp": "2025-07-28T01:43:51.202Z"
+                }
+            }
+        },
+        "createdAt": 1753667031286
+    }
+]

package/sources/sync/agentDefaults.ts

@@ -0,0 +1,108 @@
+import * as z from 'zod';
+
+export const agentKeys = ['claude', 'codex', 'gemini', 'openclaw'] as const;
+export type AgentKey = typeof agentKeys[number];
+
+export const AgentDefaultOverrideSchema = z.object({
+    permissionMode: z.string().optional(),
+    modelMode: z.string().optional(),
+    effortLevel: z.string().optional(),
+}).passthrough();
+
+export const AgentDefaultOverridesSchema = z.object({
+    claude: AgentDefaultOverrideSchema.optional(),
+    codex: AgentDefaultOverrideSchema.optional(),
+    gemini: AgentDefaultOverrideSchema.optional(),
+    openclaw: AgentDefaultOverrideSchema.optional(),
+}).passthrough().default({});
+
+export type AgentDefaultOverride = z.infer<typeof AgentDefaultOverrideSchema>;
+export type AgentDefaultOverrides = z.infer<typeof AgentDefaultOverridesSchema>;
+export type AgentDefaultField = keyof Pick<AgentDefaultOverride, 'permissionMode' | 'modelMode' | 'effortLevel'>;
+
+export type AgentDefaultConfig = {
+    permissionMode: string;
+    modelMode: string;
+    effortLevel: string | null;
+};
+
+const codeAgentDefaults: Record<AgentKey, AgentDefaultConfig> = {
+    // The Claude UI key for YOLO is `bypassPermissions`; the CLI also accepts
+    // `yolo` and maps it to the Claude SDK's bypass mode.
+    claude: { permissionMode: 'bypassPermissions', modelMode: 'opus', effortLevel: 'medium' },
+    codex: { permissionMode: 'yolo', modelMode: 'gpt-5.5', effortLevel: 'medium' },
+    gemini: { permissionMode: 'default', modelMode: 'gemini-2.5-pro', effortLevel: null },
+    openclaw: { permissionMode: 'default', modelMode: 'default', effortLevel: null },
+};
+
+export function normalizeAgentKey(flavor: string | null | undefined): AgentKey {
+    if (flavor === 'codex' || flavor === 'gemini' || flavor === 'openclaw') {
+        return flavor;
+    }
+    return 'claude';
+}
+
+export function getCodeAgentDefaults(flavor: string | null | undefined): AgentDefaultConfig {
+    return codeAgentDefaults[normalizeAgentKey(flavor)];
+}
+
+export function getAgentDefaultOverride(
+    overrides: AgentDefaultOverrides | null | undefined,
+    flavor: string | null | undefined,
+): AgentDefaultOverride {
+    return overrides?.[normalizeAgentKey(flavor)] ?? {};
+}
+
+export function resolveAgentDefaultConfig(
+    overrides: AgentDefaultOverrides | null | undefined,
+    flavor: string | null | undefined,
+): AgentDefaultConfig {
+    const codeDefaults = getCodeAgentDefaults(flavor);
+    const userOverride = getAgentDefaultOverride(overrides, flavor);
+    return {
+        permissionMode: userOverride.permissionMode ?? codeDefaults.permissionMode,
+        modelMode: userOverride.modelMode ?? codeDefaults.modelMode,
+        effortLevel: userOverride.effortLevel ?? codeDefaults.effortLevel,
+    };
+}
+
+export function hasAgentDefaultOverride(
+    overrides: AgentDefaultOverrides | null | undefined,
+    flavor: string | null | undefined,
+    field: AgentDefaultField,
+): boolean {
+    return getAgentDefaultOverride(overrides, flavor)[field] !== undefined;
+}
+
+export function getAgentDefaultOverrideValue(
+    overrides: AgentDefaultOverrides | null | undefined,
+    flavor: string | null | undefined,
+    field: AgentDefaultField,
+): string | undefined {
+    return getAgentDefaultOverride(overrides, flavor)[field];
+}
+
+export function setAgentDefaultOverride(
+    overrides: AgentDefaultOverrides | null | undefined,
+    flavor: string | null | undefined,
+    field: AgentDefaultField,
+    value: string | null | undefined,
+): AgentDefaultOverrides {
+    const key = normalizeAgentKey(flavor);
+    const next: AgentDefaultOverrides = { ...(overrides ?? {}) };
+    const current: AgentDefaultOverride = { ...(next[key] ?? {}) };
+
+    if (value === null || value === undefined) {
+        delete current[field];
+    } else {
+        current[field] = value;
+    }
+
+    if (current.permissionMode === undefined && current.modelMode === undefined && current.effortLevel === undefined) {
+        delete next[key];
+    } else {
+        next[key] = current;
+    }
+
+    return next;
+}

package/sources/sync/apiArtifacts.ts

@@ -0,0 +1,143 @@
+import { AuthCredentials } from '@/auth/tokenStorage';
+import { backoff } from '@/utils/time';
+import { getServerUrl } from './serverConfig';
+import { getNasTechClientId } from './apiSocket';
+import { Artifact, ArtifactCreateRequest, ArtifactUpdateRequest, ArtifactUpdateResponse } from './artifactTypes';
+
+/**
+ * Fetch all artifacts for the account
+ */
+export async function fetchArtifacts(credentials: AuthCredentials): Promise<Artifact[]> {
+    const API_ENDPOINT = getServerUrl();
+
+    return await backoff(async () => {
+        const response = await fetch(`${API_ENDPOINT}/v1/artifacts`, {
+            headers: {
+                'Content-Type': 'application/json',
+                'X-NasTech-Client': getNasTechClientId(),
+            }
+        });
+
+        if (!response.ok) {
+            throw new Error(`Failed to fetch artifacts: ${response.status}`);
+        }
+
+        const data = await response.json() as Artifact[];
+        return data;
+    });
+}
+
+/**
+ * Fetch a single artifact with full body
+ */
+export async function fetchArtifact(credentials: AuthCredentials, artifactId: string): Promise<Artifact> {
+    const API_ENDPOINT = getServerUrl();
+
+    return await backoff(async () => {
+        const response = await fetch(`${API_ENDPOINT}/v1/artifacts/${artifactId}`, {
+            headers: {
+                'Content-Type': 'application/json',
+                'X-NasTech-Client': getNasTechClientId(),
+            }
+        });
+
+        if (!response.ok) {
+            if (response.status === 404) {
+                throw new Error('Artifact not found');
+            }
+            throw new Error(`Failed to fetch artifact: ${response.status}`);
+        }
+
+        const data = await response.json() as Artifact;
+        return data;
+    });
+}
+
+/**
+ * Create a new artifact
+ */
+export async function createArtifact(
+    credentials: AuthCredentials, 
+    request: ArtifactCreateRequest
+): Promise<Artifact> {
+    const API_ENDPOINT = getServerUrl();
+
+    return await backoff(async () => {
+        const response = await fetch(`${API_ENDPOINT}/v1/artifacts`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-NasTech-Client': getNasTechClientId(),
+            },
+            body: JSON.stringify(request)
+        });
+
+        if (!response.ok) {
+            if (response.status === 409) {
+                throw new Error('Artifact ID already exists');
+            }
+            throw new Error(`Failed to create artifact: ${response.status}`);
+        }
+
+        const data = await response.json() as Artifact;
+        return data;
+    });
+}
+
+/**
+ * Update an existing artifact
+ */
+export async function updateArtifact(
+    credentials: AuthCredentials,
+    artifactId: string,
+    request: ArtifactUpdateRequest
+): Promise<ArtifactUpdateResponse> {
+    const API_ENDPOINT = getServerUrl();
+
+    return await backoff(async () => {
+        const response = await fetch(`${API_ENDPOINT}/v1/artifacts/${artifactId}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-NasTech-Client': getNasTechClientId(),
+            },
+            body: JSON.stringify(request)
+        });
+
+        if (!response.ok) {
+            if (response.status === 404) {
+                throw new Error('Artifact not found');
+            }
+            throw new Error(`Failed to update artifact: ${response.status}`);
+        }
+
+        const data = await response.json() as ArtifactUpdateResponse;
+        return data;
+    });
+}
+
+/**
+ * Delete an artifact
+ */
+export async function deleteArtifact(
+    credentials: AuthCredentials,
+    artifactId: string
+): Promise<void> {
+    const API_ENDPOINT = getServerUrl();
+
+    return await backoff(async () => {
+        const response = await fetch(`${API_ENDPOINT}/v1/artifacts/${artifactId}`, {
+            method: 'DELETE',
+            headers: {
+                'X-NasTech-Client': getNasTechClientId(),
+            }
+        });
+
+        if (!response.ok) {
+            if (response.status === 404) {
+                throw new Error('Artifact not found');
+            }
+            throw new Error(`Failed to delete artifact: ${response.status}`);
+        }
+    });
+}

package/sources/sync/apiAttachments.ts

@@ -0,0 +1,217 @@
+/**
+ * Server API for image attachment upload/download.
+ *
+ * Two storage modes are transparent to the client:
+ * - Local: uploadUrl points to the server itself (PUT endpoint)
+ * - S3: uploadUrl is a presigned PUT URL
+ *
+ * The client always follows the same flow:
+ *   1. POST request-upload → get { ref, uploadUrl }
+ *   2. PUT encrypted blob to uploadUrl
+ *   3. Embed ref in the file event sent to the CLI
+ */
+import { AuthCredentials } from '@/auth/tokenStorage';
+import { getServerUrl } from './serverConfig';
+import { appendFormFile } from './uploadFormFile';
+
+const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
+
+/**
+ * If a self-hosted server's request-upload / request-download response points
+ * at loopback (e.g. PUBLIC_URL not set so it returned http://localhost:3005)
+ * the phone can't reach it — that's the server's own loopback. Rewrite the
+ * host to whatever the client actually used to talk to the server, since
+ * that address is by definition reachable from here. No-op for any non-
+ * loopback URL (presigned S3 GET URLs, properly configured PUBLIC_URL, etc.).
+ */
+function rewriteLoopbackHost(url: string): string {
+    try {
+        const target = new URL(url);
+        if (target.hostname !== 'localhost' && target.hostname !== '127.0.0.1' && target.hostname !== '::1') {
+            return url;
+        }
+        const reachable = new URL(getServerUrl());
+        target.protocol = reachable.protocol;
+        target.host = reachable.host; // includes port
+        return target.toString();
+    } catch {
+        return url;
+    }
+}
+
+export type RequestUploadResult = {
+    ref: string;
+    uploadUrl: string;
+    method: 'PUT' | 'POST';
+    /** Required form fields when method is POST (S3 presigned POST policy). */
+    formFields?: Record<string, string>;
+};
+
+/**
+ * Request a presigned (or server-hosted) upload URL for an attachment.
+ * Returns the ref (storage path) and uploadUrl to PUT the encrypted blob.
+ */
+export async function requestAttachmentUpload(
+    credentials: AuthCredentials,
+    sessionId: string,
+    filename: string,
+    size: number,
+): Promise<RequestUploadResult> {
+    const API_ENDPOINT = getServerUrl();
+
+    const response = await fetch(`${API_ENDPOINT}/v1/sessions/${sessionId}/attachments/request-upload`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ filename, size }),
+    });
+
+    if (!response.ok) {
+        if (response.status === 413) {
+            throw new Error(`Attachment too large (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`);
+        }
+        if (response.status === 404) {
+            throw new Error('Session not found');
+        }
+        throw new Error(`request-upload failed: ${response.status}`);
+    }
+
+    const result = await response.json() as RequestUploadResult;
+    return { ...result, uploadUrl: rewriteLoopbackHost(result.uploadUrl) };
+}
+
+/**
+ * Upload an encrypted blob to the URL returned by requestAttachmentUpload.
+ *
+ * Two transport modes are supported, picked by the server:
+ * - PUT: local-storage mode (our own server) — raw octet-stream body with
+ *   Bearer auth so the server can verify session membership before writing.
+ * - POST: S3-presigned POST policy — multipart/form-data with the policy's
+ *   formFields plus the file. S3 enforces the content-length-range from the
+ *   policy, so the client cannot upload more than the agreed limit.
+ */
+export async function uploadEncryptedBlob(
+    upload: { uploadUrl: string; method: 'PUT' | 'POST'; formFields?: Record<string, string> },
+    encryptedData: Uint8Array,
+    credentials: AuthCredentials,
+): Promise<void> {
+    if (upload.method === 'POST') {
+        const formData = new FormData();
+        if (upload.formFields) {
+            for (const [k, v] of Object.entries(upload.formFields)) {
+                formData.append(k, v);
+            }
+        }
+        // S3's content-type rule on presigned POST is satisfied by the
+        // policy's Content-Type form field; the per-part type just needs
+        // to be something multipart-valid. Filename is cosmetic.
+        const cleanup = await appendFormFile(formData, encryptedData, 'file', 'blob', 'application/octet-stream');
+        let response: Response;
+        try {
+            response = await fetch(upload.uploadUrl, {
+                method: 'POST',
+                body: formData,
+            });
+        } catch (err) {
+            await cleanup();
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`Blob upload (POST) network error to ${upload.uploadUrl}: ${message}`);
+        }
+        await cleanup();
+        if (!response.ok) {
+            throw new Error(`Blob upload (POST) failed: ${response.status} ${response.statusText} at ${upload.uploadUrl}`);
+        }
+        return;
+    }
+
+    // PUT (local-storage mode): direct upload to our server.
+    const serverUrl = getServerUrl();
+    const isServerUrl = upload.uploadUrl.startsWith(serverUrl);
+    const headers: Record<string, string> = {
+        'Content-Type': 'application/octet-stream',
+    };
+    if (isServerUrl) {
+    }
+
+    // Build a standalone ArrayBuffer of exactly encryptedData.length bytes.
+    // RN's iOS Blob polyfill rejects Uint8Array/ArrayBuffer constructors
+    // ("Creating blobs from 'ArrayBuffer' and 'ArrayBufferView' are not
+    // supported"), so we can't use a Blob body cross-platform — and
+    // sending `encryptedData.buffer` raw is unsafe if the Uint8Array is
+    // a view onto a larger parent ArrayBuffer (we'd upload the parent's
+    // trailing bytes too, padding the ciphertext into something the
+    // receiver can't decrypt). new Uint8Array(...) copies into a fresh
+    // 32-byte-aligned buffer of exactly the right length, and .buffer
+    // is then guaranteed safe to send directly.
+    const standalone = new Uint8Array(encryptedData);
+    const body = standalone.buffer;
+
+    let response: Response;
+    try {
+        response = await fetch(upload.uploadUrl, {
+            method: 'PUT',
+            headers,
+            body,
+        });
+    } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        // Surface the URL we actually tried to hit — without this, a generic
+        // "Network request failed" gives no hint whether the server returned
+        // a localhost URL the phone can't resolve, an HTTP URL that ATS
+        // blocked, or a real connectivity issue.
+        throw new Error(`Blob upload (PUT) network error to ${upload.uploadUrl}: ${message}`);
+    }
+
+    if (!response.ok) {
+        throw new Error(`Blob upload (PUT) failed: ${response.status} ${response.statusText} at ${upload.uploadUrl}`);
+    }
+}
+
+/**
+ * Download an encrypted attachment blob.
+ *
+ * Two-step protocol mirroring the design spec:
+ *   1. POST /request-download with the ref → server returns a downloadUrl
+ *      (server-relative URL with auth in local mode; presigned S3 GET
+ *      otherwise).
+ *   2. GET that URL — local mode requires the Bearer header, S3 presigned
+ *      URLs reject extra headers.
+ */
+export async function downloadEncryptedAttachment(
+    credentials: AuthCredentials,
+    sessionId: string,
+    ref: string,
+): Promise<Uint8Array> {
+    const API_ENDPOINT = getServerUrl();
+
+    const requestRes = await fetch(`${API_ENDPOINT}/v1/sessions/${sessionId}/attachments/request-download`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ ref }),
+    });
+    if (!requestRes.ok) {
+        throw new Error(`request-download failed: ${requestRes.status}`);
+    }
+    const { downloadUrl: rawDownloadUrl } = await requestRes.json() as { downloadUrl: string };
+    const downloadUrl = rewriteLoopbackHost(rawDownloadUrl);
+
+    const isServerUrl = downloadUrl.startsWith(API_ENDPOINT);
+    const headers: Record<string, string> = {};
+    if (isServerUrl) {
+    }
+    let blobRes: Response;
+    try {
+        blobRes = await fetch(downloadUrl, { headers });
+    } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Attachment download network error from ${downloadUrl}: ${message}`);
+    }
+    if (!blobRes.ok) {
+        throw new Error(`Attachment download failed: ${blobRes.status} ${blobRes.statusText} from ${downloadUrl}`);
+    }
+    const buffer = await blobRes.arrayBuffer();
+    return new Uint8Array(buffer);
+}