npm - smart-home-engine - Versions diffs - 0.10.4 → 0.12.0 - Mend

smart-home-engine 0.10.4 → 0.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md +1 -1
package/dist/web/assets/{index-DkhtWYJx.css → index-DZTaIKZS.css} +1 -1
package/dist/web/assets/index-G6QfHETZ.js +212 -0
package/dist/web/assets/{tsMode-THvwQw-l.js → tsMode-BU_qnlmu.js} +1 -1
package/dist/web/index.html +2 -2
package/package.json +4 -1
package/src/config.js +3 -0
package/src/index.js +9 -1
package/src/web/ai-api.js +76 -7
package/src/web/auth.js +186 -0
package/src/web/log-ws.js +9 -2
package/src/web/server.js +21 -12
package/dist/web/assets/index-Bdf2J0nm.js +0 -140

package/dist/web/assets/{tsMode-THvwQw-l.js → tsMode-BU_qnlmu.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import{gU as O}from"./monaco-langs-DZ6hB11b.js";import{t as I}from"./index-Bdf2J0nm.js";/*!-----------------------------------------------------------------------------
+import{gU as O}from"./monaco-langs-DZ6hB11b.js";import{t as I}from"./index-G6QfHETZ.js";/*!-----------------------------------------------------------------------------
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Version: 0.52.2(404545bded1df6ffa41ea0af4e8ddb219018c6c1)
  * Released under the MIT license

package/dist/web/index.html CHANGED Viewed

@@ -153,10 +153,10 @@
                 }
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-Bdf2J0nm.js"></script>
+      <script type="module" crossorigin src="/assets/index-G6QfHETZ.js"></script>
       <link rel="modulepreload" crossorigin href="/assets/monaco-langs-DZ6hB11b.js">
       <link rel="stylesheet" crossorigin href="/assets/monaco-langs-DyX1CsEw.css">
-      <link rel="stylesheet" crossorigin href="/assets/index-DkhtWYJx.css">
+      <link rel="stylesheet" crossorigin href="/assets/index-DZTaIKZS.css">
     </head>
     <body>
         <div id="app"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
     "name":  "smart-home-engine",
-    "version":  "0.10.4",
+    "version":  "0.12.0",
     "description":  "Node.js based script runner for use in MQTT based Smart Home environments",
     "main":  "src/index.js",
     "scripts":  {
@@ -26,6 +26,7 @@
     "author":  "Sebastian \u0027hobbyquaker\u0027 Raff \u003chobbyquaker@gmail.com\u003e",
     "license":  "MIT",
     "dependencies":  {
+                         "bcryptjs":  "^2.4.3",
                          "@elastic/elasticsearch":  "^9.4.2",
                          "@influxdata/influxdb-client":  "^1.35.0",
                          "@matter/main":  "^0.17.0",
@@ -84,3 +85,5 @@
              },
     "homepage":  "https://github.com/hobbyquaker/she"
 }

package/src/config.js CHANGED Viewed

@@ -45,6 +45,9 @@ const config = require('yargs')
         disableWatch: false,
         dbRetain: false,
         dbPrefix: 'she/db/',
+        auth: 'none',
+        proxyHeader: 'X-Remote-User',
+        bindAddress: '0.0.0.0',
     })
     .version()
     .help('help')

package/src/index.js CHANGED Viewed

@@ -53,9 +53,17 @@ log.info('she ' + pkg.version + ' starting');
 log.debug('loaded config: ', config);
 if (typeof config.port !== 'undefined') {
+    // Validate: password mode requires a password hash
+    if (config.auth === 'password' && !config.password) {
+        log.error('auth is set to "password" but no password is configured. Set a password via the web UI Config → Authentication section first.');
+        process.exit(1);
+    }
     require('./web/server')
         .startServer(config.port, {
-            apiKey: config.apiKey,
+            auth: config.auth,
+            password: config.password || null,
+            proxyHeader: config.proxyHeader,
+            bindAddress: config.bindAddress,
             configPath: config.config,
             scriptDir: config.dir || null,
         })

package/src/web/ai-api.js CHANGED Viewed

@@ -127,7 +127,15 @@ function buildSystemPrompt(requestCtx, currentScript, store) {
         `You are SHE Assistant, an expert AI pair programmer for she (smart-home-engine).
 she is a Node.js daemon that runs user JavaScript scripts in a sandboxed VM for home automation.
 When proposing changes to a script, always output the COMPLETE new file content in a single fenced \`\`\`javascript code block. Never output partial diffs or fragments — the user applies the full file at once.
-Keep any existing header comments and the 'use strict'; directive.`,
+Keep any existing header comments and the 'use strict'; directive.
+When the user asks you to CREATE a new script (not modify the current one), place a special hint as the very first line INSIDE the code block (right after the opening \`\`\`javascript fence line), like this:
+\`\`\`javascript
+// @new-file: descriptive-name.js
+/* global she */
+'use strict';
+// ... rest of script
+\`\`\`
+Use a short kebab-case filename. Do NOT put the hint outside or before the code block. The UI will detect it and offer to save the file.`,
     ];
     if (requestCtx.apiref) {
@@ -375,6 +383,64 @@ router.get('/config', (req, res) => {
     });
 });
+// GET /she/ai/models — list available models for the configured provider
+router.get('/models', async (req, res) => {
+    const ai = readAiConfig(req.app.locals.configPath);
+    if (!ai?.provider) return res.json({ models: [] });
+    const base = (ai.baseUrl || 'http://localhost:11434').replace(/\/$/, '');
+    try {
+        if (ai.provider === 'ollama') {
+            const r = await fetch(`${base}/api/tags`);
+            if (!r.ok) throw new Error(`Ollama /api/tags returned ${r.status}`);
+            const json = await r.json();
+            const models = (json.models || []).map((m) => m.name || m.model).filter(Boolean).sort();
+            return res.json({ models });
+        } else if (ai.provider === 'anthropic') {
+            return res.json({ models: [] }); // no public list endpoint
+        } else {
+            // OpenAI / LM Studio / etc. — try /v1/models
+            const h = { 'Content-Type': 'application/json' };
+            if (ai.apiKey) h['Authorization'] = `Bearer ${ai.apiKey}`;
+            const r = await fetch(`${base}/v1/models`, { headers: h });
+            if (!r.ok) throw new Error(`/v1/models returned ${r.status}`);
+            const json = await r.json();
+            const models = (json.data || []).map((m) => m.id).filter(Boolean).sort();
+            return res.json({ models });
+        }
+    } catch (e) {
+        res.status(500).json({ error: e.message, models: [] });
+    }
+});
+// GET /she/ai/model-info — Ollama-specific: version, model details, running models
+// Query param: ?model=<name>  (defaults to configured model)
+router.get('/model-info', async (req, res) => {
+    const ai = readAiConfig(req.app.locals.configPath);
+    if (!ai?.provider || !ai?.model) return res.status(400).json({ error: 'Not configured' });
+    if (ai.provider !== 'ollama') return res.status(400).json({ error: 'Model info is only available for Ollama' });
+    const base = (ai.baseUrl || 'http://localhost:11434').replace(/\/$/, '');
+    const model = (typeof req.query.model === 'string' && req.query.model) ? req.query.model : ai.model;
+    const [versionRes, showRes, psRes] = await Promise.allSettled([
+        fetch(`${base}/api/version`).then((r) => r.json()),
+        fetch(`${base}/api/show`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ name: model, model }),
+        }).then((r) => r.json()),
+        fetch(`${base}/api/ps`).then((r) => r.json()),
+    ]);
+    res.json({
+        version: versionRes.status === 'fulfilled' ? versionRes.value.version : null,
+        details: showRes.status === 'fulfilled' ? showRes.value.details : null,
+        running: psRes.status === 'fulfilled' ? (psRes.value.models || []) : null,
+    });
+});
 // POST /she/ai/chat — non-streaming
 router.post('/chat', async (req, res) => {
     const ai = readAiConfig(req.app.locals.configPath);
@@ -382,18 +448,19 @@ router.post('/chat', async (req, res) => {
         return res.status(400).json({ error: 'AI provider not configured. Set ai.provider and ai.model in Config.' });
     }
-    const { messages = [], currentScript, context = {} } = req.body || {};
+    const { messages = [], currentScript, context = {}, modelOverride } = req.body || {};
     if (!Array.isArray(messages)) return res.status(400).json({ error: 'messages must be an array' });
+    const aiWithModel = (modelOverride && typeof modelOverride === 'string') ? { ...ai, model: modelOverride } : ai;
     const systemPrompt = buildSystemPrompt(context, currentScript ?? null, _store);
     const fullMessages = [{ role: 'system', content: systemPrompt }, ...messages];
     try {
         let result;
         if (ai.provider === 'anthropic') {
-            result = await callAnthropic(ai, fullMessages);
+            result = await callAnthropic(aiWithModel, fullMessages);
         } else {
-            result = await callOpenAICompat(ai, fullMessages);
+            result = await callOpenAICompat(aiWithModel, fullMessages);
         }
         res.json(result);
     } catch (e) {
@@ -408,9 +475,11 @@ router.post('/chat/stream', async (req, res) => {
         return res.status(400).json({ error: 'AI provider not configured. Set ai.provider and ai.model in Config.' });
     }
-    const { messages = [], currentScript, context = {} } = req.body || {};
+    const { messages = [], currentScript, context = {}, modelOverride } = req.body || {};
     if (!Array.isArray(messages)) return res.status(400).json({ error: 'messages must be an array' });
+    const aiWithModel = (modelOverride && typeof modelOverride === 'string') ? { ...ai, model: modelOverride } : ai;
     res.set({
         'Content-Type': 'text/event-stream',
         'Cache-Control': 'no-cache',
@@ -427,9 +496,9 @@ router.post('/chat/stream', async (req, res) => {
         const onToken = (t) => send({ token: t });
         if (ai.provider === 'anthropic') {
-            await streamAnthropic(ai, fullMessages, onToken);
+            await streamAnthropic(aiWithModel, fullMessages, onToken);
         } else {
-            await streamOpenAICompat(ai, fullMessages, onToken);
+            await streamOpenAICompat(aiWithModel, fullMessages, onToken);
         }
         res.write('data: [DONE]\n\n');

package/src/web/auth.js ADDED Viewed

@@ -0,0 +1,186 @@
+'use strict';
+/**
+ * Authentication module for the she web server.
+ *
+ * Supports three modes (configured via config.json `auth` field):
+ *   'none'     — no auth, all /she/* routes are open (default)
+ *   'password' — single-password session auth with an HttpOnly cookie
+ *   'proxy'    — trust a header set by nginx/authentik (e.g. X-Remote-User)
+ *
+ * Public endpoints (no auth required in any mode):
+ *   GET  /she/auth/mode    — returns current mode
+ *   POST /she/auth/login   — password mode only; sets session cookie
+ *   POST /she/auth/logout  — clears session cookie
+ *
+ * Protected endpoint (auth required):
+ *   POST /she/auth/setup   — change auth mode / password / proxyHeader
+ */
+const crypto = require('crypto');
+const bcrypt = require('bcryptjs');
+const express = require('express');
+const fs = require('fs');
+const path = require('path');
+const BCRYPT_ROUNDS = 10;
+const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+// In-memory session store — intentionally cleared on restart
+const _sessions = new Map(); // token (hex64) → { createdAt: number }
+let _mode = 'none';
+let _passwordHash = null; // bcrypt hash, only used in 'password' mode
+let _proxyHeader = 'x-remote-user'; // lowercase for req.headers lookup
+let _configPath = null;
+/**
+ * Initialise auth state. Called once from startServer().
+ */
+function init({ auth = 'none', password = null, proxyHeader = 'X-Remote-User', configPath = null } = {}) {
+    _mode = auth;
+    _passwordHash = password || null;
+    _proxyHeader = proxyHeader.toLowerCase();
+    _configPath = configPath;
+}
+function getMode() {
+    return _mode;
+}
+// ── Session helpers ─────────────────────────────────────────────────────────
+function _getSessionToken(req) {
+    const cookie = req.headers.cookie || '';
+    const m = cookie.match(/(?:^|;\s*)she_session=([a-f0-9]{64})/);
+    return m ? m[1] : null;
+}
+function _validateSession(token) {
+    if (!token) return false;
+    const s = _sessions.get(token);
+    if (!s) return false;
+    if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+        _sessions.delete(token);
+        return false;
+    }
+    return true;
+}
+// ── Auth check (used by middleware and WS gate) ─────────────────────────────
+/**
+ * Returns true if the request is authenticated according to the current mode.
+ * @param {import('http').IncomingMessage} req
+ */
+function checkAuth(req) {
+    if (_mode === 'none') return true;
+    if (_mode === 'proxy') return !!req.headers[_proxyHeader];
+    if (_mode === 'password') return _validateSession(_getSessionToken(req));
+    return true;
+}
+/**
+ * Express middleware that enforces auth on /she/* routes.
+ * Mount this AFTER the public auth router so login/mode/logout bypass it.
+ */
+function authMiddleware(req, res, next) {
+    if (checkAuth(req)) return next();
+    res.status(401).json({ error: 'Unauthorized' });
+}
+// ── Auth API router ─────────────────────────────────────────────────────────
+const router = express.Router();
+/** GET /she/auth/mode — always public */
+router.get('/mode', (req, res) => {
+    res.json({ mode: _mode });
+});
+/** POST /she/auth/login — always public; only meaningful in password mode */
+router.post('/login', async (req, res) => {
+    if (_mode !== 'password') return res.status(400).json({ error: 'Not in password mode' });
+    const { password } = req.body || {};
+    if (!password || !_passwordHash) return res.status(401).json({ error: 'Unauthorized' });
+    try {
+        const ok = await bcrypt.compare(password, _passwordHash);
+        if (!ok) return res.status(401).json({ error: 'Invalid password' });
+        const token = crypto.randomBytes(32).toString('hex');
+        _sessions.set(token, { createdAt: Date.now() });
+        res.setHeader('Set-Cookie', `she_session=${token}; HttpOnly; SameSite=Strict; Path=/`);
+        res.json({ ok: true });
+    } catch {
+        res.status(500).json({ error: 'Internal error' });
+    }
+});
+/** POST /she/auth/logout — always public; clears cookie */
+router.post('/logout', (req, res) => {
+    const token = _getSessionToken(req);
+    if (token) _sessions.delete(token);
+    res.setHeader('Set-Cookie', 'she_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0');
+    res.json({ ok: true });
+});
+/**
+ * POST /she/auth/setup — protected; change auth mode / password / proxyHeader.
+ * Body: { mode: 'none'|'password'|'proxy', password?: string, proxyHeader?: string }
+ *
+ * Self-guards when in password mode (requires valid session).
+ */
+router.post('/setup', async (req, res) => {
+    // Self-guard: in password mode the caller must be authenticated
+    if (_mode === 'password' && !_validateSession(_getSessionToken(req))) {
+        return res.status(401).json({ error: 'Unauthorized' });
+    }
+    const { mode, password, proxyHeader } = req.body || {};
+    if (!['none', 'password', 'proxy'].includes(mode)) {
+        return res.status(400).json({ error: 'Invalid auth mode. Must be none, password, or proxy.' });
+    }
+    if (mode === 'password' && !password) {
+        return res.status(400).json({ error: 'A non-empty password is required for password mode.' });
+    }
+    try {
+        // Read existing config
+        let cfg = {};
+        try {
+            cfg = JSON.parse(fs.readFileSync(_configPath, 'utf8'));
+        } catch {
+            // config file does not exist yet — start from empty
+        }
+        // Update auth fields, remove stale ones
+        cfg.auth = mode;
+        delete cfg.password;
+        delete cfg.proxyHeader;
+        if (mode === 'password') {
+            cfg.password = await bcrypt.hash(password, BCRYPT_ROUNDS);
+        }
+        if (mode === 'proxy') {
+            cfg.proxyHeader = proxyHeader || 'X-Remote-User';
+        }
+        // Write back
+        fs.mkdirSync(path.dirname(_configPath), { recursive: true });
+        fs.writeFileSync(_configPath, JSON.stringify(cfg, null, 2), 'utf8');
+        // Apply in-memory (no restart needed)
+        _mode = mode;
+        _passwordHash = cfg.password || null;
+        _proxyHeader = (cfg.proxyHeader || 'X-Remote-User').toLowerCase();
+        // Invalidate all existing sessions when switching away from password mode
+        if (mode !== 'password') _sessions.clear();
+        res.json({ ok: true });
+    } catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+module.exports = { init, authMiddleware, checkAuth, getMode, router };

package/src/web/log-ws.js CHANGED Viewed

@@ -12,11 +12,18 @@ const _clients = new Set();
  *   - { type: 'ping' }               — keepalive every 30 s
  *
  * @param {import('http').Server} httpServer
+ * @param {(req: import('http').IncomingMessage) => boolean} [authCheck]
+ *   Optional function that receives the upgrade request and returns true if
+ *   the connection should be allowed. Defaults to always-allow.
  */
-function attachWss(httpServer) {
+function attachWss(httpServer, authCheck = () => true) {
     _wss = new WebSocketServer({ server: httpServer, path: '/she/ws' });
-    _wss.on('connection', (ws) => {
+    _wss.on('connection', (ws, req) => {
+        if (!authCheck(req)) {
+            ws.close(1008, 'Unauthorized');
+            return;
+        }
         _clients.add(ws);
         ws.on('close', () => _clients.delete(ws));
         ws.on('error', () => _clients.delete(ws));

package/src/web/server.js CHANGED Viewed

@@ -11,18 +11,21 @@ const { router: depsRouter } = require('./deps-api');
 const { router: gitRouter } = require('./git-api');
 const { router: aiRouter } = require('./ai-api');
 const { attachWss, closeWss } = require('./log-ws');
+const { init: initAuth, authMiddleware, checkAuth, router: authRouter } = require('./auth');
 const app = express();
 app.use(express.json());
-// Lazy auth check — _apiKey is populated by startServer(); null = auth disabled.
-// Covers both /she/* (internal system routes) and /api/* (user-script routes).
-let _apiKey = null;
-app.use(['/she', '/api'], (req, res, next) => {
-    if (!_apiKey) return next();
-    const auth = req.headers['authorization'];
-    if (auth === `Bearer ${_apiKey}`) return next();
-    res.status(401).json({ error: 'Unauthorized' });
+// Public auth routes — always accessible regardless of auth mode.
+// Must be mounted BEFORE the auth middleware.
+app.use('/she/auth', authRouter);
+// Auth middleware for all /she/* routes except the public auth endpoints above.
+// /api/* is intentionally excluded — user scripts control their own auth.
+const OPEN_SHE_PATHS = new Set(['/she/auth/mode', '/she/auth/login', '/she/auth/logout']);
+app.use('/she', (req, res, next) => {
+    if (OPEN_SHE_PATHS.has(req.originalUrl.split('?')[0])) return next();
+    authMiddleware(req, res, next);
 });
 // Config REST endpoints: GET /she/config and PUT /she/config
@@ -90,20 +93,26 @@ let httpServer = null;
 /**
  * Start listening. Resolves with the actual port (useful when port 0 is given).
  * @param {number} port
- * @param {{ apiKey?: string, configPath?: string, scriptDir?: string }} [options]
+ * @param {{ auth?: string, password?: string, proxyHeader?: string, bindAddress?: string, configPath?: string, scriptDir?: string }} [options]
  * @returns {Promise<number>}
  */
 function startServer(port, options = {}) {
-    _apiKey = options.apiKey || null;
+    initAuth({
+        auth: options.auth || 'none',
+        password: options.password || null,
+        proxyHeader: options.proxyHeader || 'X-Remote-User',
+        configPath: options.configPath || null,
+    });
     if (options.configPath) {
         app.locals.configPath = options.configPath;
     }
     if (options.scriptDir) {
         app.locals.scriptDir = options.scriptDir;
     }
+    const host = options.bindAddress || '0.0.0.0';
     return new Promise((resolve, reject) => {
-        httpServer = app.listen(port, () => {
-            attachWss(httpServer);
+        httpServer = app.listen(port, host, () => {
+            attachWss(httpServer, checkAuth);
             resolve(httpServer.address().port);
         });
         httpServer.on('error', reject);