onbuzz 4.9.1 → 4.9.7

package/src/interfaces/webServer.js

@@ -2061,31 +2061,49 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
     this.app.get('/api/keys/:sessionId', async (req, res) => {
       try {
         const { sessionId } = req.params;
-        
+
         if (!this.apiKeyManager) {
           return res.status(500).json({
             success: false,
             error: 'API key manager not available'
           });
         }
-        
+
         const keys = this.apiKeyManager.getSessionKeys(sessionId);
-        
-        // Return key presence only, not actual values
+        const hasLoxiaKey = !!keys.loxiaApiKey;
+
+        // Validate the stored key against the upstream backend so
+        // `hasLoxiaKey: true` actually means "this key works", not just
+        // "a key string exists in apiKeyManager". Without this, a stale/
+        // revoked key on disk silently 401s every agent message while
+        // the front-end happily reports "platform-managed key, all good"
+        // and skips pushing the user's correct localStorage key.
+        let keyValid = null;       // null = not probed (no key to probe)
+        let keyValidReason = null; // 'ok' | 'no-key' | 'unauthorised' | 'probe-failed'
+        if (hasLoxiaKey) {
+          const probe = await this._probeLoxiaKey(keys.loxiaApiKey);
+          keyValid = probe.ok;
+          keyValidReason = probe.reason;
+        } else {
+          keyValidReason = 'no-key';
+        }
+
         res.json({
           success: true,
           sessionId,
-          hasLoxiaKey: !!keys.loxiaApiKey,
+          hasLoxiaKey,
+          keyValid,
+          keyValidReason,
           vendorKeys: Object.keys(keys.vendorKeys || {}),
           updatedAt: keys.updatedAt
         });
-        
+
       } catch (error) {
         this.logger.error('Failed to get API key status', {
           error: error.message,
           sessionId: req.params.sessionId
         });
-        
+
         res.status(500).json({
           success: false,
           error: error.message
@@ -4817,15 +4835,17 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
           try {
             const agent = await this.orchestrator.agentPool.getAgent(agentId).catch(() => null);
             if (!agent && action !== 'delete') {
-              // Allow `delete` to proceed against missing agents
-              // (idempotent cleanup); other actions need the agent loaded.
+              // `delete` flows through to agentPool.deleteAgent which
+              // handles both loaded and unloaded agents (clears
+              // persistent state in either case). Other actions need
+              // a live agent instance to mutate, so we short-circuit.
               return { agentId, success: false, error: 'Agent not found' };
             }
 
             switch (action) {
               case 'delete': {
                 const r = await this.orchestrator.processRequest({
-                  sessionId: effectiveSessionId, interface: 'WEB',
+                  sessionId: effectiveSessionId, interface: INTERFACE_TYPES.WEB,
                   action: 'delete_agent',
                   payload: { agentId },
                   projectDir,
@@ -4834,7 +4854,7 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
               }
               case 'unload': {
                 const r = await this.orchestrator.processRequest({
-                  sessionId: effectiveSessionId, interface: 'WEB',
+                  sessionId: effectiveSessionId, interface: INTERFACE_TYPES.WEB,
                   action: 'unload_agent',
                   payload: { agentId },
                   projectDir,
@@ -4843,7 +4863,7 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
               }
               case 'pause': {
                 const r = await this.orchestrator.processRequest({
-                  sessionId: effectiveSessionId, interface: 'WEB',
+                  sessionId: effectiveSessionId, interface: INTERFACE_TYPES.WEB,
                   action: 'pause_agent',
                   payload: { agentId },
                   projectDir,
@@ -4852,7 +4872,7 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
               }
               case 'resume': {
                 const r = await this.orchestrator.processRequest({
-                  sessionId: effectiveSessionId, interface: 'WEB',
+                  sessionId: effectiveSessionId, interface: INTERFACE_TYPES.WEB,
                   action: 'resume_agent',
                   payload: { agentId },
                   projectDir,
@@ -4861,7 +4881,7 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
               }
               case 'set-model': {
                 const r = await this.orchestrator.processRequest({
-                  sessionId: effectiveSessionId, interface: 'WEB',
+                  sessionId: effectiveSessionId, interface: INTERFACE_TYPES.WEB,
                   action: 'switch_model',
                   payload: { agentId, model: params.model },
                   projectDir,
@@ -4878,7 +4898,7 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
                 if (action === 'enable-tool' && i === -1) caps.push(tool);
                 if (action === 'disable-tool' && i !== -1) caps.splice(i, 1);
                 const r = await this.orchestrator.processRequest({
-                  sessionId: effectiveSessionId, interface: 'WEB',
+                  sessionId: effectiveSessionId, interface: INTERFACE_TYPES.WEB,
                   action: 'update_agent',
                   payload: { agentId, updates: { capabilities: caps } },
                   projectDir,
@@ -4894,7 +4914,7 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
                   return { agentId, success: true };
                 }
                 const r = await this.orchestrator.processRequest({
-                  sessionId: effectiveSessionId, interface: 'WEB',
+                  sessionId: effectiveSessionId, interface: INTERFACE_TYPES.WEB,
                   action: 'unload_agent',
                   payload: { agentId },
                   projectDir,
@@ -7328,6 +7348,69 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
     };
   }
 
+  /**
+   * Probe a Loxia API key against the upstream backend so we can
+   * report `keyValid: true | false` from /api/keys/:sessionId. Without
+   * this, the front-end's "trust the server-side key" branch fires
+   * even when the stored key is stale/revoked → every agent message
+   * 401s silently. Cached per-fingerprint for `KEY_PROBE_TTL_MS` so
+   * we don't hammer the backend on every key-status poll.
+   *
+   * @param {string} apiKey
+   * @returns {Promise<{ok: boolean, reason: 'ok'|'unauthorised'|'probe-failed'}>}
+   */
+  async _probeLoxiaKey(apiKey) {
+    if (!apiKey || typeof apiKey !== 'string') {
+      return { ok: false, reason: 'no-key' };
+    }
+    if (!this._keyProbeCache) this._keyProbeCache = new Map();
+    const KEY_PROBE_TTL_MS = 60_000;
+    const fp = apiKey.slice(0, 12);   // fingerprint, not the whole key
+    const now = Date.now();
+    const cached = this._keyProbeCache.get(fp);
+    if (cached && (now - cached.at) < KEY_PROBE_TTL_MS) {
+      return cached.result;
+    }
+
+    const baseUrl = this.config.backend?.baseUrl || 'https://loxia-api-g7hrb8bxdae8a2h7.z02.azurefd.net';
+    const probeUrl = `${baseUrl}/llm/models`;
+    let result;
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 5000);
+      const response = await fetch(probeUrl, {
+        method: 'GET',
+        headers: {
+          'Content-Type': 'application/json',
+          'Authorization': `Bearer ${apiKey}`,
+        },
+        signal: controller.signal,
+      });
+      clearTimeout(timeout);
+      if (response.ok) {
+        result = { ok: true, reason: 'ok' };
+      } else if (response.status === 401 || response.status === 403) {
+        result = { ok: false, reason: 'unauthorised' };
+      } else {
+        // 5xx, 4xx that isn't auth — treat as inconclusive (cache briefly
+        // so we don't probe on every poll, but don't lock in `false`).
+        result = { ok: false, reason: 'probe-failed' };
+      }
+    } catch (e) {
+      // Network error, timeout, etc. — inconclusive, not a key problem.
+      this.logger.debug?.('Loxia key probe failed', { error: e.message });
+      result = { ok: false, reason: 'probe-failed' };
+    }
+
+    this._keyProbeCache.set(fp, { at: now, result });
+    return result;
+  }
+
+  /** Test hook — wipe the probe cache so tests don't pollute each other. */
+  _resetKeyProbeCacheForTests() {
+    this._keyProbeCache = new Map();
+  }
+
   /**
    * Shutdown the web server
    * @returns {Promise<void>}

package/src/tools/__tests__/officeTool.test.js

@@ -330,6 +330,97 @@ describe('officeTool — pres.* fidelity', () => {
     expect(info.success).toBe(true);
     expect(info.info.slideCount).toBe(3);
   });
+
+  // ─── Themed presentation system (string theme routes to the new builder) ──
+
+  test('pres.system lists themes, archetypes, backgrounds — no file needed', async () => {
+    const t = makeTool();
+    const r = await t.execute({ actions: [{ type: 'pres.system' }] }, context);
+    expect(r.success).toBe(true);
+    expect(r.themes.map(x => x.id)).toEqual(expect.arrayContaining(['editorial-warm', 'tech-bold', 'data-heavy']));
+    expect(r.archetypes).toEqual(expect.arrayContaining(['hero', 'agenda', 'statCallout', 'twoColChart', 'closing']));
+    expect(r.backgrounds).toEqual(expect.arrayContaining(['solid', 'gradient', 'mesh', 'noise', 'geometric', 'grid']));
+  });
+
+  test('pres.create with string theme + archetype slides routes through the themed builder', async () => {
+    const t = makeTool();
+    const target = outPath();
+    const r = await t.execute({
+      actions: [{
+        type: 'pres.create',
+        outputPath: target,
+        content: {
+          title: 'Themed Deck',
+          theme: 'editorial-warm',
+          slides: [
+            { archetype: 'hero', eyebrow: 'Q4', title: 'Hello', subtitle: 'World', author: 'Bench', date: '2026' },
+            { archetype: 'statCallout', stat: '47%', label: 'YoY growth', footnote: 'Source: bench' },
+            { archetype: 'bullets', title: 'Wins', items: ['A', 'B', 'C'] },
+            { archetype: 'closing', title: 'Thanks' },
+          ],
+        },
+      }],
+    }, context);
+    expect(r.success).toBe(true);
+    expect(r.slideCount).toBe(4);
+    expect(r.theme).toBe('editorial-warm');
+    expect(r.palette).toBe('cream-charcoal');
+    expect(r.fileSize).toBeGreaterThan(10_000);
+  }, 15000);
+
+  test('pres.read returns slide outline + tokens for an existing .pptx', async () => {
+    const t = makeTool();
+    const target = outPath();
+    // Build a template deck with {{tokens}}.
+    await t.execute({
+      actions: [{
+        type: 'pres.create',
+        outputPath: target,
+        content: {
+          title: 'Template',
+          theme: 'tech-bold',
+          slides: [
+            { archetype: 'hero', title: 'Hello {{customerName}}', subtitle: 'On {{date}}' },
+            { archetype: 'statCallout', stat: '{{metric}}', label: 'For {{customerName}}' },
+          ],
+        },
+      }],
+    }, context);
+
+    const r = await t.execute({ actions: [{ type: 'pres.read', filePath: target }] }, context);
+    expect(r.success).toBe(true);
+    expect(r.slideCount).toBe(2);
+    expect(r.tokens).toEqual(expect.arrayContaining(['customerName', 'date', 'metric']));
+  }, 15000);
+
+  test('pres.fill replaces {{tokens}} with provided values', async () => {
+    const t = makeTool();
+    const templatePath = outPath();
+    const filledPath = outPath();
+    await t.execute({
+      actions: [{
+        type: 'pres.create',
+        outputPath: templatePath,
+        content: {
+          theme: 'editorial-warm',
+          slides: [
+            { archetype: 'hero', title: 'Hi {{name}}', subtitle: '{{date}}' },
+          ],
+        },
+      }],
+    }, context);
+    const r = await t.execute({
+      actions: [{
+        type: 'pres.fill',
+        sourcePath: templatePath,
+        outputPath: filledPath,
+        values: { name: 'Acme', date: 'May 28' },
+      }],
+    }, context);
+    expect(r.success).toBe(true);
+    expect(r.replaced).toEqual({ name: 1, date: 1 });
+    expect(r.unresolved).toEqual([]);
+  }, 15000);
 });
 
 /* ------------------------------------------------------------------------ */

package/src/tools/office/officePres.js

@@ -23,6 +23,14 @@ import fs from 'fs/promises';
 import path from 'path';
 import { createRequire } from 'module';
 
+// Themed-presentation system. Opt-in via `theme: '<preset-name>'` on
+// the spec — when present we route to the new builder for stunning
+// curated decks; otherwise we keep the legacy pptxgenjs-direct path
+// below for backwards compatibility.
+import { isThemedSpec, buildThemedPres, listSystem } from './pres/index.js';
+import { readPres } from './pres/edit/read.js';
+import { fillPres } from './pres/edit/fill.js';
+
 // pptxgenjs ships dual builds (ESM + CJS). The ESM build does
 // `import JSZip from 'jszip'` which jszip (CJS-only) does not satisfy
 // cleanly under jest's experimental-vm-modules. Loading via createRequire
@@ -216,6 +224,13 @@ function placeItem(slide, item, defaults) {
 /* ------------------------------------------------------------------------ */
 
 export async function createPres(spec, outputPath) {
+  // New themed path: any spec with a string `theme` (one of the
+  // registered presets) routes to the curated archetype system, which
+  // produces decks the agent doesn't have to hand-design.
+  if (isThemedSpec(spec)) {
+    return await buildThemedPres(spec, outputPath);
+  }
+
   const Pptx = loadPptx();
   const pptx = new Pptx();
 
@@ -333,6 +348,35 @@ export async function createPres(spec, outputPath) {
   return { path: outputPath, size: stat.size, slideCount: slides.length };
 }
 
+/* ----- read / fill: outline + token replacement for existing decks ----- */
+
+/**
+ * Read the structural outline + tokens of an existing .pptx so the
+ * agent can decide what to fill. Delegates to pres/edit/read.js so the
+ * heavy XML walk lives in its own file.
+ */
+export async function readPresOutline(filePath) {
+  return await readPres(filePath);
+}
+
+/**
+ * Fill `{{token}}` placeholders in an existing .pptx with the provided
+ * `values` map. Delegates to pres/edit/fill.js. Lets the agent take a
+ * hand-made template deck and stamp customer/data specifics into it
+ * without ever touching the design.
+ */
+export async function fillPresPlaceholders(args) {
+  return await fillPres(args);
+}
+
+/**
+ * Expose the available themes / archetypes / backgrounds for the
+ * agent-facing tool docstring + the showcase verifier.
+ */
+export function listPresentationSystem() {
+  return listSystem();
+}
+
 /* ----- info (light reader via JSZip) ----- */
 
 export async function presInfo(filePath) {