onbuzz 5.0.2 → 5.3.0

package/src/interfaces/attachmentRoutes.js

@@ -0,0 +1,56 @@
+/**
+ * Chat attachment ingest route.
+ *
+ * POST /api/agents/:agentId/attachments
+ *   - { fileName, dataBase64, mode? } → binary-safe upload of raw bytes
+ *   - { filePath, mode?, fileName? }  → ingest a file already on the server
+ *
+ * Mounted with its OWN higher-limit JSON parser so base64 uploads aren't capped
+ * by the global 10 MB body limit (base64 inflates ~33%, so 50 MB ≈ a ~37 MB
+ * file). Extracted into a register helper so it mounts on a bare Express app
+ * for testing — same idiom as registerScheduleRoutes. The ingestion service is
+ * read through a thunk because it's wired after routes are registered at boot.
+ *
+ * NOTE: true multipart/streaming (busboy) is a future optimization for very
+ * large files; base64 ingestion is dependency-free, binary-correct, and covers
+ * the practical size range.
+ */
+import express from 'express';
+
+export function registerAttachmentRoutes(app, { getIngestionService, logger, jsonLimit = '50mb' } = {}) {
+  if (!app) return;
+  const svc = () => (typeof getIngestionService === 'function' ? getIngestionService() : null);
+  const log = logger || { error() {} };
+  const bigJson = express.json({ limit: jsonLimit });
+
+  app.post('/api/agents/:agentId/attachments', bigJson, async (req, res) => {
+    try {
+      const ingestion = svc();
+      if (!ingestion) {
+        return res.status(503).json({ success: false, error: 'Attachment ingestion not available' });
+      }
+      const { agentId } = req.params;
+      /* istanbul ignore next: bigJson always populates req.body on this route; the ||{} is a pure safety net */
+      const { fileName, dataBase64, filePath, mode, scope, conversationId } = req.body || {};
+
+      let attachment;
+      if (dataBase64) {
+        attachment = await ingestion.ingestUpload({ agentId, fileName, dataBase64, mode, scope, conversationId });
+      } else if (filePath) {
+        attachment = await ingestion.ingestServerPath({ agentId, filePath, mode, fileName, scope, conversationId });
+      } else {
+        return res.status(400).json({
+          success: false,
+          error: 'Provide dataBase64 (upload) or filePath (server file)',
+        });
+      }
+
+      res.json({ success: true, attachment });
+    } catch (error) {
+      log.error('Attachment ingest failed', { agentId: req.params.agentId, error: error.message });
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+}
+
+export default registerAttachmentRoutes;

package/src/interfaces/memoryStatusRoutes.js

@@ -0,0 +1,78 @@
+/**
+ * memoryStatusRoutes — the live per-agent "memory path" view.
+ *
+ * Two pure-DI pieces (so they're unit-testable without standing up the full
+ * WebServer, mirroring agentContextRoutes / marketplaceRoutes):
+ *
+ *   1. registerMemoryStatusRoute(app, deps)
+ *        GET /api/agents/:agentId/memory-status → embeddingService.getMemoryStatus
+ *        The PULL path: embeddings status + per-surface index sizes + the last
+ *        auto-recall funnel. Read only when the panel is open — no hot-path cost.
+ *
+ *   2. wireMemoryActivityBroadcast({ embeddingService, broadcast, logger })
+ *        The PUSH path: subscribe to the embedding service's per-turn recall
+ *        funnel and rebroadcast it to web-ui clients over the existing
+ *        websocket as `{ type: 'memory:recall', ... }`. Returns an unsubscribe
+ *        fn. Emits only data already computed by auto-recall — no extra work.
+ */
+
+/**
+ * @param {object} app  Express-like app with `.get(path, handler)`.
+ * @param {object} deps
+ * @param {() => (object|null)} deps.getEmbeddingService  Lazy accessor (the
+ *        service handle may be attached after route registration).
+ * @param {object} [deps.logger]
+ */
+export function registerMemoryStatusRoute(app, { getEmbeddingService, logger } = {}) {
+  app.get('/api/agents/:agentId/memory-status', async (req, res) => {
+    try {
+      const svc = typeof getEmbeddingService === 'function' ? getEmbeddingService() : null;
+      if (!svc || typeof svc.getMemoryStatus !== 'function') {
+        res.json({ embeddings: { enabled: false }, surfaces: {}, lastRecall: null });
+        return;
+      }
+      res.json(await svc.getMemoryStatus(req.params.agentId));
+    } catch (err) {
+      logger?.error?.('Failed to read memory status', { error: err?.message });
+      res.status(500).json({ error: err?.message });
+    }
+  });
+}
+
+/**
+ * Subscribe to live recall telemetry and rebroadcast to web-ui clients.
+ *
+ * @param {object} opts
+ * @param {object} opts.embeddingService  Must expose `memoryActivity` (an
+ *        EventEmitter that emits 'recall' entries).
+ * @param {(message: object) => void} opts.broadcast  Sends to connected clients.
+ * @param {object} [opts.logger]
+ * @returns {() => void} unsubscribe — no-op if wiring couldn't be established.
+ */
+/** Defer work off the current call stack (Node setImmediate; setTimeout fallback). */
+const _defer = (fn) => (typeof setImmediate === 'function' ? setImmediate(fn) : setTimeout(fn, 0));
+
+export function wireMemoryActivityBroadcast({ embeddingService, broadcast, logger } = {}) {
+  const emitter = embeddingService?.memoryActivity;
+  if (!emitter || typeof emitter.on !== 'function' || typeof broadcast !== 'function') {
+    return () => {};
+  }
+  const handler = (entry) => {
+    // DEFER off the emit stack: recordRecallActivity is called during the
+    // agent's per-turn prompt build, and broadcastToSession does synchronous
+    // websocket fan-out (plus its own logging). We never want that on the
+    // turn's critical path.
+    _defer(() => {
+      try {
+        // `{ type, data }` matches the web-ui store's websocket dispatch convention.
+        broadcast({ type: 'memory:recall', data: entry });
+      } catch (err) {
+        logger?.warn?.('Failed to broadcast memory:recall', { error: err?.message });
+      }
+    });
+  };
+  emitter.on('recall', handler);
+  return () => {
+    try { emitter.off('recall', handler); } catch { /* best-effort */ }
+  };
+}

package/src/interfaces/monitorRoutes.js

@@ -0,0 +1,93 @@
+/**
+ * monitorRoutes — the Settings → Monitor App backend.
+ *
+ * Surfaces the logger's in-memory ring buffer (logs + errors, each with
+ * timestamp, level, agent, message) to the web-ui, plus a live push of new
+ * warn/error entries. Pure-DI so it's unit-testable without the full
+ * WebServer (mirrors memoryStatusRoutes / agentContextRoutes).
+ *
+ *   registerMonitorRoutes(app, { getLogger, logger })
+ *     GET  /api/monitor/logs?level=&agentId=&category=&limit=  (PULL)
+ *     POST /api/monitor/logs/clear
+ *
+ *   wireMonitorBroadcast({ logger, broadcast })
+ *     Live PUSH of new warn/error entries over the websocket as
+ *     `{ type: 'monitor:log', data: record }`. Info/debug stay pull-only so
+ *     the socket isn't flooded with routine chatter. Returns an unsubscribe.
+ */
+
+/** Default cap so a careless `?limit=` can't ask for an unbounded payload. */
+const MAX_LIMIT = 1000;
+
+export function registerMonitorRoutes(app, { getLogger, logger } = {}) {
+  app.get('/api/monitor/logs', (req, res) => {
+    try {
+      const lg = typeof getLogger === 'function' ? getLogger() : null;
+      if (!lg || typeof lg.getRecentLogs !== 'function') {
+        res.json({ logs: [] });
+        return;
+      }
+      const { level, agentId, category } = req.query || {};
+      let limit = parseInt(req.query?.limit, 10);
+      if (!Number.isInteger(limit) || limit <= 0) limit = 200;
+      limit = Math.min(limit, MAX_LIMIT);
+      res.json({ logs: lg.getRecentLogs({ level, agentId, category, limit }) });
+    } catch (err) {
+      logger?.error?.('Failed to read monitor logs', { error: err?.message });
+      res.status(500).json({ error: err?.message });
+    }
+  });
+
+  app.post('/api/monitor/logs/clear', (req, res) => {
+    try {
+      const lg = typeof getLogger === 'function' ? getLogger() : null;
+      const cleared = lg && typeof lg.clearRecentLogs === 'function' ? lg.clearRecentLogs() : 0;
+      res.json({ success: true, cleared });
+    } catch (err) {
+      logger?.error?.('Failed to clear monitor logs', { error: err?.message });
+      res.status(500).json({ error: err?.message });
+    }
+  });
+}
+
+/** Defer work off the current call stack (Node setImmediate; setTimeout fallback). */
+const _defer = (fn) => (typeof setImmediate === 'function' ? setImmediate(fn) : setTimeout(fn, 0));
+
+export function wireMonitorBroadcast({ logger, broadcast } = {}) {
+  const emitter = logger?.logEvents;
+  if (!emitter || typeof emitter.on !== 'function' || typeof broadcast !== 'function') {
+    return () => {};
+  }
+
+  // Why this is careful: the logger emits SYNCHRONOUSLY, and the websocket
+  // broadcast itself logs (e.g. broadcastToSession warns "no connections" and
+  // info "message sent"). So a naive `broadcast()` here would (a) BLOCK the
+  // caller of logger.warn/error on websocket fan-out, and (b) INFINITELY
+  // RECURSE — the broadcast's own WARN/INFO logs re-enter this handler.
+  //
+  // Fix: DEFER the broadcast off the logging stack (non-blocking), and GUARD
+  // against re-entry while a push is in flight (breaks the feedback loop —
+  // the broadcast's own log lines are skipped; they remain in the ring buffer
+  // and are still served by the pull endpoint).
+  let inFlight = false;
+  const handler = (record) => {
+    if (record?.level !== 'ERROR' && record?.level !== 'WARN') return;
+    if (inFlight) return;
+    inFlight = true;
+    _defer(() => {
+      try {
+        broadcast({ type: 'monitor:log', data: record });
+      } catch (err) {
+        // console only — logging here would re-enter the emitter.
+        // eslint-disable-next-line no-console
+        console.error('Failed to broadcast monitor:log:', err?.message);
+      } finally {
+        inFlight = false;
+      }
+    });
+  };
+  emitter.on('entry', handler);
+  return () => {
+    try { emitter.off('entry', handler); } catch { /* best-effort */ }
+  };
+}

package/src/interfaces/scheduleRoutes.js

@@ -0,0 +1,128 @@
+/**
+ * Scheduled-tasks HTTP API.
+ *
+ * Extracted from webServer.setupRoutes so the whole /api/schedules surface
+ * (list, presets, create, read, update, delete, trigger, toggle) can be
+ * mounted on a bare Express app and tested without standing up the full
+ * server — same pattern as registerSchedulerRoutes.
+ *
+ * scheduleService is read through a thunk (getScheduleService) because the
+ * orchestrator wires it in AFTER routes are registered at boot; a handler
+ * that captured a null reference at registration time would 400/404 forever.
+ *
+ * Behavior (status codes + response shapes) mirrors the original inline
+ * handlers exactly — see scheduleRoutes.test.js for the locked contract.
+ */
+
+export function registerScheduleRoutes(app, { getScheduleService, logger } = {}) {
+  if (!app) return;
+  const svc = () => (typeof getScheduleService === 'function' ? getScheduleService() : null);
+  const log = logger || { error() {}, warn() {}, info() {} };
+
+  // List all schedules — degrades to an empty list when the service is absent.
+  app.get('/api/schedules', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.json({ success: true, schedules: [] });
+      res.json({ success: true, schedules: s.listSchedules() });
+    } catch (error) {
+      log.error('Failed to list schedules', { error: error.message });
+      res.status(500).json({ success: false, error: error.message });
+    }
+  });
+
+  // Cron presets — registered BEFORE /:id so "presets" isn't captured as an id.
+  app.get('/api/schedules/presets', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.json({ success: true, presets: {} });
+      res.json({ success: true, presets: s.getPresets() });
+    } catch (error) {
+      res.status(500).json({ success: false, error: error.message });
+    }
+  });
+
+  // Create
+  app.post('/api/schedules', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.status(400).json({ success: false, error: 'Schedule service not available' });
+      const schedule = await s.createSchedule(req.body);
+      res.json({ success: true, schedule });
+    } catch (error) {
+      log.error('Failed to create schedule', { error: error.message });
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+
+  // Read one
+  app.get('/api/schedules/:id', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.status(404).json({ success: false, error: 'Schedule service not available' });
+      const schedule = s.getSchedule(req.params.id);
+      if (!schedule) return res.status(404).json({ success: false, error: 'Schedule not found' });
+      res.json({ success: true, schedule });
+    } catch (error) {
+      res.status(500).json({ success: false, error: error.message });
+    }
+  });
+
+  // Update
+  app.put('/api/schedules/:id', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.status(400).json({ success: false, error: 'Schedule service not available' });
+      const schedule = await s.updateSchedule(req.params.id, req.body);
+      res.json({ success: true, schedule });
+    } catch (error) {
+      log.error('Failed to update schedule', { error: error.message });
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+
+  // Delete
+  app.delete('/api/schedules/:id', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.status(400).json({ success: false, error: 'Schedule service not available' });
+      await s.deleteSchedule(req.params.id);
+      res.json({ success: true });
+    } catch (error) {
+      log.error('Failed to delete schedule', { error: error.message });
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+
+  // Force-trigger immediately (used by the Run-now button + CLI trigger-schedule)
+  app.post('/api/schedules/:id/trigger', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.status(400).json({ success: false, error: 'Schedule service not available' });
+      if (!s.getSchedule(req.params.id)) {
+        return res.status(404).json({ success: false, error: 'Schedule not found' });
+      }
+      const schedule = await s.triggerSchedule(req.params.id);
+      res.json({ success: true, scheduleName: schedule.name, lastRunStatus: schedule.lastRunStatus });
+    } catch (error) {
+      log.error('Failed to trigger schedule', { error: error.message });
+      res.status(500).json({ success: false, error: error.message });
+    }
+  });
+
+  // Toggle enabled/disabled
+  app.post('/api/schedules/:id/toggle', async (req, res) => {
+    try {
+      const s = svc();
+      if (!s) return res.status(400).json({ success: false, error: 'Schedule service not available' });
+      const current = s.getSchedule(req.params.id);
+      if (!current) return res.status(404).json({ success: false, error: 'Schedule not found' });
+      const schedule = await s.updateSchedule(req.params.id, { enabled: !current.enabled });
+      res.json({ success: true, schedule });
+    } catch (error) {
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+}
+
+export default registerScheduleRoutes;

package/src/interfaces/transcribeProxy.js

@@ -0,0 +1,72 @@
+/**
+ * Speech-to-text proxy logic for the web-ui mic / dictation.
+ *
+ * Why this exists: the browser's webkitSpeechRecognition has NO working backend
+ * inside Electron (Chromium's speech service is provisioned only for official
+ * Chrome builds), so dictation silently fails in the desktop binary. The fix is
+ * to record audio in the renderer (MediaRecorder works in Electron) and POST it
+ * here; the local server attaches the platform key and forwards to the remote
+ * Loxia `/llm/transcribe` (Azure AI Foundry STT) — the same endpoint the
+ * Telegram voice-note path uses.
+ *
+ * Kept as a pure, fetch-injectable function so it's fully unit-testable without
+ * standing up the whole web server. Returns { status, body } for the route to
+ * relay verbatim.
+ */
+
+const DEFAULT_BACKEND = 'https://loxia-api-g7hrb8bxdae8a2h7.z02.azurefd.net';
+
+export async function proxyTranscribe({
+  audioBase64,
+  mimeType,
+  filename,
+  durationSeconds,
+  apiKey,
+  backendBaseUrl,
+  fetchImpl = (typeof fetch !== 'undefined' ? fetch : null),
+  logger,
+} = {}) {
+  if (!audioBase64 || typeof audioBase64 !== 'string') {
+    return { status: 400, body: { error: 'audioBase64 (string) is required' } };
+  }
+  if (!apiKey) {
+    return { status: 401, body: { error: 'No API key configured. Please configure your Loxia API key in Settings.' } };
+  }
+  if (typeof fetchImpl !== 'function') {
+    return { status: 500, body: { error: 'No fetch implementation available' } };
+  }
+
+  const base = backendBaseUrl || DEFAULT_BACKEND;
+  let response;
+  try {
+    response = await fetchImpl(`${base}/llm/transcribe`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        audioBase64,
+        mimeType: mimeType || 'audio/webm',
+        filename: filename || 'dictation.webm',
+        ...(typeof durationSeconds === 'number' && { durationSeconds }),
+      }),
+    });
+  } catch (err) {
+    logger?.error?.('[transcribe] backend request failed', { error: err.message });
+    return { status: 502, body: { error: 'Transcription request failed: ' + err.message } };
+  }
+
+  if (response.status === 503) {
+    return { status: 503, body: { error: 'Voice transcription is not configured on the backend.' } };
+  }
+  if (!response.ok) {
+    let detail = '';
+    try { detail = await response.text(); } catch { /* ignore */ }
+    logger?.warn?.('[transcribe] backend non-OK', { status: response.status });
+    return { status: response.status, body: { error: `Transcription failed (${response.status})`, details: String(detail).slice(0, 300) } };
+  }
+
+  let data = {};
+  try { data = await response.json(); } catch { /* tolerate empty/non-JSON */ }
+  return { status: 200, body: { text: (data?.text || '').trim() } };
+}
+
+export default { proxyTranscribe };

package/src/interfaces/transcribeRoute.js

@@ -0,0 +1,45 @@
+/**
+ * Speech-to-text proxy route (POST /api/llm/transcribe).
+ *
+ * Extracted from webServer.setupRoutes so the API-key resolution ladder
+ * (Bearer header → apiKeyManager → config/env) and the status relay are
+ * unit-testable without standing up the full server. The heavy lifting —
+ * audio validation, backend dispatch, error mapping — lives in
+ * proxyTranscribe (already fully covered); this layer only resolves the key
+ * and forwards.
+ *
+ * apiKeyManager is read through a thunk (getApiKeyManager) because it is
+ * attached after routes are registered at boot.
+ */
+import { proxyTranscribe } from './transcribeProxy.js';
+
+/** Resolve the platform API key for a transcribe request (pure, testable). */
+export function resolveTranscribeApiKey({ authHeader, apiKeyManager, sessionId, config }) {
+  if (authHeader && authHeader.startsWith('Bearer ')) return authHeader.substring(7);
+  if (apiKeyManager) {
+    const keys = apiKeyManager.getKeysForRequest?.(sessionId || null, { platformProvided: true });
+    if (keys?.loxiaApiKey) return keys.loxiaApiKey;
+  }
+  return config?.loxiaApiKey || process.env.LOXIA_API_KEY || null;
+}
+
+export function registerTranscribeRoute(app, { getApiKeyManager, config, logger, proxyImpl = proxyTranscribe } = {}) {
+  if (!app) return;
+  app.post('/api/llm/transcribe', async (req, res) => {
+    const { audioBase64, mimeType, filename, durationSeconds, sessionId } = req.body || {};
+    const apiKeyManager = typeof getApiKeyManager === 'function' ? getApiKeyManager() : null;
+    const apiKey = resolveTranscribeApiKey({
+      authHeader: req.headers.authorization,
+      apiKeyManager, sessionId, config,
+    });
+
+    const result = await proxyImpl({
+      audioBase64, mimeType, filename, durationSeconds, apiKey,
+      backendBaseUrl: config?.backend?.baseUrl,
+      logger,
+    });
+    res.status(result.status).json(result.body);
+  });
+}
+
+export default registerTranscribeRoute;