swayrouter 1.0.0

package/src/lib/oauth/utils/ui.js

@@ -0,0 +1,43 @@
+import chalk from "chalk";
+import ora from "ora";
+
+export function success(message) {
+  console.log(chalk.green(`\n✓ ${message}\n`));
+}
+
+export function error(message) {
+  console.log(chalk.red(`\n✗ ${message}\n`));
+}
+
+export function info(message) {
+  console.log(chalk.blue(`\n${message}\n`));
+}
+
+export function warn(message) {
+  console.log(chalk.yellow(`\n⚠ ${message}\n`));
+}
+
+export function gray(message) {
+  console.log(chalk.gray(message));
+}
+
+export function spinner(text) {
+  return ora(text);
+}
+
+export function printSection(title) {
+  console.log(chalk.blue(`\n${title}\n`));
+}
+
+export function printKeyValue(key, value, isSuccess = false) {
+  const color = isSuccess ? chalk.green : chalk.gray;
+  console.log(color(`  ${key}: ${value}`));
+}
+
+export function printList(items, isSuccess = false) {
+  const symbol = isSuccess ? "✓" : "✗";
+  const color = isSuccess ? chalk.green : chalk.gray;
+  items.forEach((item) => {
+    console.log(color(`  ${symbol} ${item}`));
+  });
+}

package/src/lib/providerNormalization.js

@@ -0,0 +1,40 @@
+import { AI_PROVIDERS } from "../providers/display.js";
+
+export function isXaiModel(modelId) {
+  return typeof modelId === "string" && /^grok[-_]/i.test(modelId.trim());
+}
+
+export function normalizeProviderId(provider) {
+  if (typeof provider !== "string") return provider;
+
+  const trimmed = provider.trim();
+  if (AI_PROVIDERS[trimmed]) return trimmed;
+
+  const slug = trimmed.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  if (AI_PROVIDERS[slug]) return slug;
+
+  const providerByName = Object.values(AI_PROVIDERS).find(
+    (entry) => entry.name?.toLowerCase() === trimmed.toLowerCase()
+  );
+  return providerByName?.id || trimmed;
+}
+
+export function normalizeProviderSpecificData(provider, body = {}, providerSpecificData = null) {
+  const next = providerSpecificData && typeof providerSpecificData === "object"
+    ? { ...providerSpecificData }
+    : {};
+
+  if (provider === "ollama-local") {
+    const baseUrl = (
+      next.baseUrl ||
+      body.baseUrl ||
+      body.baseURL ||
+      body.ollamaHostUrl ||
+      ""
+    ).trim();
+
+    if (baseUrl) next.baseUrl = baseUrl;
+  }
+
+  return Object.keys(next).length > 0 ? next : null;
+}

package/src/lib/qoder/constants.js

@@ -0,0 +1 @@
+export * from "../../shared/qoder/constants.js";

package/src/lib/requestDetailsDb.js

@@ -0,0 +1,3 @@
+export {
+  saveRequestDetail, getRequestDetails, getRequestDetailById, getDistinctProviders,
+} from "@/lib/db/index.js";

package/src/lib/resourceProfile.ts

@@ -0,0 +1,124 @@
+import os from "node:os";
+import { readFileSync } from "node:fs";
+
+const MIB = 1024 * 1024;
+const GIB = 1024 * MIB;
+
+export type ResourceProfileName = "low-memory" | "balanced" | "throughput";
+
+export interface ResourceCapacity {
+  memoryBytes: number;
+  cpuCount: number;
+}
+
+export interface ResourceProfile {
+  name: ResourceProfileName;
+  memoryBytes: number;
+  cpuCount: number;
+  initialConcurrent: number;
+  minConcurrent: number;
+  maxConcurrent: number;
+  maxConcurrentPerProvider: number;
+  maxQueue: number;
+  queueWaitMs: number;
+  bodyBudgetMb: number;
+  upstreamMaxAttempts: number;
+}
+
+function readCgroupMemoryLimit(): number | null {
+  for (const path of ["/sys/fs/cgroup/memory.max", "/sys/fs/cgroup/memory/memory.limit_in_bytes"]) {
+    try {
+      const raw = readFileSync(path, "utf8").trim();
+      if (!raw || raw === "max") continue;
+      const value = Number(raw);
+      if (Number.isFinite(value) && value >= 256 * MIB && value < 1024 * GIB) return value;
+    } catch {
+      // Not running in a cgroup with a readable memory limit.
+    }
+  }
+  return null;
+}
+
+export function detectResourceCapacity(): ResourceCapacity {
+  const memoryBytes = readCgroupMemoryLimit() ?? os.totalmem();
+  let cpuCount = 1;
+  try {
+    cpuCount = Math.max(1, Number(os.availableParallelism?.() || os.cpus().length || 1));
+  } catch {
+    cpuCount = Math.max(1, os.cpus().length || 1);
+  }
+  return { memoryBytes, cpuCount };
+}
+
+function profileNameFor(memoryBytes: number, requested: string | undefined): ResourceProfileName {
+  if (requested === "low-memory" || requested === "balanced" || requested === "throughput") {
+    return requested;
+  }
+  if (memoryBytes <= 2.5 * GIB) return "low-memory";
+  if (memoryBytes <= 8 * GIB) return "balanced";
+  return "throughput";
+}
+
+export function deriveResourceProfile(
+  capacity: ResourceCapacity = detectResourceCapacity(),
+  requestedProfile?: string,
+): ResourceProfile {
+  const name = profileNameFor(capacity.memoryBytes, requestedProfile);
+  const base = {
+    "low-memory": {
+      initialConcurrent: 24,
+      minConcurrent: 8,
+      maxConcurrent: 96,
+      maxConcurrentPerProvider: 32,
+      maxQueue: 64,
+      queueWaitMs: 15_000,
+      bodyBudgetMb: 48,
+      upstreamMaxAttempts: 3,
+    },
+    balanced: {
+      initialConcurrent: 48,
+      minConcurrent: 12,
+      maxConcurrent: 192,
+      maxConcurrentPerProvider: 64,
+      maxQueue: 128,
+      queueWaitMs: 20_000,
+      bodyBudgetMb: 96,
+      upstreamMaxAttempts: 4,
+    },
+    throughput: {
+      initialConcurrent: 96,
+      minConcurrent: 16,
+      maxConcurrent: 384,
+      maxConcurrentPerProvider: 96,
+      maxQueue: 256,
+      queueWaitMs: 30_000,
+      bodyBudgetMb: 128,
+      upstreamMaxAttempts: 5,
+    },
+  }[name];
+
+  // A single vCPU benefits from a smaller starting window, while 2+ vCPUs
+  // can use the profile defaults without making users tune concurrency.
+  const cpuScale = capacity.cpuCount <= 1 ? 0.5 : 1;
+  const initialConcurrent = Math.max(base.minConcurrent, Math.round(base.initialConcurrent * cpuScale));
+  const maxConcurrent = Math.max(initialConcurrent, Math.round(base.maxConcurrent * cpuScale));
+  const minConcurrent = Math.min(initialConcurrent, base.minConcurrent);
+  const maxConcurrentPerProvider = Math.max(
+    minConcurrent,
+    Math.round(base.maxConcurrentPerProvider * cpuScale),
+  );
+
+  return {
+    name,
+    memoryBytes: capacity.memoryBytes,
+    cpuCount: capacity.cpuCount,
+    initialConcurrent,
+    minConcurrent,
+    maxConcurrent,
+    maxConcurrentPerProvider: Math.min(maxConcurrent, maxConcurrentPerProvider),
+    maxQueue: base.maxQueue,
+    queueWaitMs: base.queueWaitMs,
+    bodyBudgetMb: base.bodyBudgetMb,
+    upstreamMaxAttempts: base.upstreamMaxAttempts,
+  };
+}

package/src/lib/runtimeSecrets.ts

@@ -0,0 +1,130 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const APP_DATA_DIR = ".swayrouter";
+const SECRET_DIRECTORY = "auth";
+
+const SECRET_SPECS = {
+  JWT_SECRET: { file: "jwt-secret", bytes: 48 },
+  API_KEY_SECRET: { file: "api-key-secret", bytes: 48 },
+  MACHINE_ID_SALT: { file: "machine-id-salt", bytes: 32 },
+} as const;
+
+type RuntimeSecretName = keyof typeof SECRET_SPECS;
+type EnvironmentSource = Record<string, string | undefined>;
+
+function defaultDataDir(source: EnvironmentSource): string {
+  const base = process.platform === "win32"
+    ? (source.APPDATA || path.join(os.homedir(), "AppData", "Roaming"))
+    : os.homedir();
+  return path.join(base, APP_DATA_DIR);
+}
+
+function configuredDataDir(source: EnvironmentSource): string {
+  const configured = String(source.DATA_DIR || "").trim();
+  if (!configured) return defaultDataDir(source);
+  if (process.platform === "win32" && /^\//.test(configured)) {
+    return defaultDataDir(source);
+  }
+  return path.resolve(configured);
+}
+
+function prepareSecretDirectory(source: EnvironmentSource, override?: string): string {
+  const preferred = override ? path.resolve(override) : configuredDataDir(source);
+  const fallback = defaultDataDir(source);
+
+  try {
+    const directory = path.join(preferred, SECRET_DIRECTORY);
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32") fs.chmodSync(directory, 0o700);
+    return directory;
+  } catch (error) {
+    if (preferred === fallback || !["EACCES", "EPERM", "EROFS"].includes(String((error as NodeJS.ErrnoException)?.code))) {
+      throw error;
+    }
+    const directory = path.join(fallback, SECRET_DIRECTORY);
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32") fs.chmodSync(directory, 0o700);
+    return directory;
+  }
+}
+
+function readPersistedSecret(file: string): string | null {
+  try {
+    const value = fs.readFileSync(file, "utf8").trim();
+    if (value.length < 32) {
+      throw new Error(`Runtime secret file is invalid: ${file}`);
+    }
+    return value;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException)?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function writeNewSecret(file: string, value: string): string {
+  let descriptor: number | null = null;
+  let created = false;
+  try {
+    descriptor = fs.openSync(file, "wx", 0o600);
+    created = true;
+    fs.writeFileSync(descriptor, `${value}\n`, "utf8");
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = null;
+    if (process.platform !== "win32") fs.chmodSync(file, 0o600);
+    return value;
+  } catch (error) {
+    if (descriptor !== null) {
+      try { fs.closeSync(descriptor); } catch {}
+    }
+    if ((error as NodeJS.ErrnoException)?.code === "EEXIST") {
+      const existing = readPersistedSecret(file);
+      if (existing) return existing;
+    }
+    if (created) {
+      try { fs.unlinkSync(file); } catch {}
+    }
+    throw error;
+  }
+}
+
+function loadOrCreateSecret(directory: string, name: RuntimeSecretName): string {
+  const spec = SECRET_SPECS[name];
+  const file = path.join(directory, spec.file);
+  const existing = readPersistedSecret(file);
+  if (existing) return existing;
+
+  if (name === "JWT_SECRET") {
+    const legacy = readPersistedSecret(path.join(path.dirname(directory), "jwt-secret"));
+    if (legacy) return writeNewSecret(file, legacy);
+  }
+
+  return writeNewSecret(file, crypto.randomBytes(spec.bytes).toString("base64url"));
+}
+
+export function ensureRuntimeSecrets(
+  source: EnvironmentSource = process.env,
+  options: { dataDir?: string } = {},
+): EnvironmentSource {
+  const resolved = { ...source };
+  const missing = (Object.keys(SECRET_SPECS) as RuntimeSecretName[])
+    .filter((name) => !String(source[name] || "").trim());
+  if (missing.length === 0) return resolved;
+
+  const directory = prepareSecretDirectory(source, options.dataDir);
+  for (const name of missing) {
+    resolved[name] = loadOrCreateSecret(directory, name);
+  }
+  return resolved;
+}
+
+export function installRuntimeSecrets(source: EnvironmentSource = process.env): EnvironmentSource {
+  const resolved = ensureRuntimeSecrets(source);
+  for (const name of Object.keys(SECRET_SPECS) as RuntimeSecretName[]) {
+    if (!String(source[name] || "").trim()) source[name] = resolved[name];
+  }
+  return source;
+}

package/src/lib/security/payloadCapture.js

@@ -0,0 +1,87 @@
+import { getSettings } from "@/lib/db/repos/settingsRepo.js";
+
+export const CAPTURE_MODES = ["none", "bounded", "sample", "error", "raw"];
+const DEFAULT_MODE = "none";
+const DEFAULT_SAMPLE_RATE = 0.01;
+
+function resolveMode(settings) {
+  const envMode = (process.env.SWAY_PAYLOAD_CAPTURE || "").toLowerCase();
+  if (CAPTURE_MODES.includes(envMode)) return envMode;
+
+  if (process.env.NODE_ENV === "production") {
+    return settings?.payloadCaptureEnabled === true ? "error" : "none";
+  }
+  if (settings && typeof settings.payloadCaptureEnabled === "boolean") {
+    return settings.payloadCaptureEnabled ? "raw" : "none";
+  }
+  return DEFAULT_MODE;
+}
+
+let cached = { mode: DEFAULT_MODE, sampleRate: DEFAULT_SAMPLE_RATE, ts: 0 };
+const CACHE_TTL_MS = 5000;
+
+export async function getCapturePolicy() {
+  const now = Date.now();
+  if (cached.ts && now - cached.ts < CACHE_TTL_MS) return cached;
+  let mode = DEFAULT_MODE;
+  let sampleRate = DEFAULT_SAMPLE_RATE;
+  try {
+    const s = await getSettings();
+    mode = resolveMode(s);
+    const sr = Number(s.payloadSampleRate);
+    if (Number.isFinite(sr) && sr >= 0 && sr <= 1) sampleRate = sr;
+    const envRate = parseFloat(process.env.SWAY_PAYLOAD_SAMPLE_RATE || "");
+    if (Number.isFinite(envRate) && envRate >= 0 && envRate <= 1) sampleRate = envRate;
+  } catch {
+
+    mode = DEFAULT_MODE;
+    sampleRate = DEFAULT_SAMPLE_RATE;
+  }
+  cached = { mode, sampleRate, ts: now };
+  return cached;
+}
+
+export function fnv1a(str) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < str.length; i++) {
+    h ^= str.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return h >>> 0;
+}
+
+export async function shouldCaptureBody(status, traceId) {
+  const policy = await getCapturePolicy();
+  return decideWithPolicy(policy, status, traceId);
+}
+
+export function decideWithPolicy({ mode, sampleRate } = {}, status, traceId) {
+  if (mode === "raw") return "raw";
+  if (mode === "bounded") return "keep";
+  if (mode === "error") return status && status !== "success" ? "keep" : "drop";
+  if (mode === "sample") {
+    if (sampleRate <= 0) return "drop";
+    if (sampleRate >= 1) return "keep";
+    const seed = traceId || "no-trace";
+
+    return fnv1a(seed) / 0x100000000 < sampleRate ? "keep" : "drop";
+  }
+
+  return "drop";
+}
+
+export const BODY_FIELDS = ["request", "providerRequest", "providerResponse", "response"];
+
+export function applyCaptureDecision(detail, decision) {
+  if (decision === "keep" || decision === "raw") return detail;
+  for (const f of BODY_FIELDS) {
+    if (detail[f] != null) {
+      detail[f] = { _redacted: "payload_capture_mode=none_or_miss", _field: f };
+    }
+  }
+  return detail;
+}
+
+export function __resetPayloadCaptureForTests() {
+  cached = { mode: DEFAULT_MODE, sampleRate: DEFAULT_SAMPLE_RATE, ts: 0 };
+}