thepopebot 1.1.2 → 1.2.3

package/README.md

@@ -111,7 +111,7 @@ The wizard walks you through everything:
 **Step 3** — Start using your agent:
 
 - **Telegram**: Message your bot to create jobs conversationally. Ask it to do tasks, check job status, or just chat.
-- **Webhook**: Send a POST to `/api/webhook` with your API key to create jobs programmatically.
+- **Webhook**: Send a POST to `/api/create-job` with your API key to create jobs programmatically.
 - **Cron**: Edit `config/CRONS.json` to schedule recurring jobs.
 
 ---

package/api/index.js

@@ -1,12 +1,12 @@
-const paths = require('../lib/paths');
-const { render_md } = require('../lib/utils/render-md');
-const { createJob } = require('../lib/tools/create-job');
-const { setWebhook, sendMessage, downloadFile, reactToMessage, startTypingIndicator } = require('../lib/tools/telegram');
-const { isWhisperEnabled, transcribeAudio } = require('../lib/tools/openai');
-const { chat, getApiKey } = require('../lib/claude');
-const { toolDefinitions, toolExecutors } = require('../lib/claude/tools');
-const { getHistory, updateHistory } = require('../lib/claude/conversation');
-const { getJobStatus } = require('../lib/tools/github');
+import { createHash, timingSafeEqual } from 'crypto';
+import { createJob } from '../lib/tools/create-job.js';
+import { setWebhook } from '../lib/tools/telegram.js';
+import { getJobStatus } from '../lib/tools/github.js';
+import { getTelegramAdapter } from '../lib/channels/index.js';
+import { chat, summarizeJob } from '../lib/ai/index.js';
+import { createNotification } from '../lib/db/notifications.js';
+import { loadTriggers } from '../lib/triggers.js';
+import { verifyApiKey } from '../lib/db/api-keys.js';
 
 // Bot token from env, can be overridden by /telegram/register
 let telegramBotToken = null;
@@ -23,7 +23,6 @@ function getTelegramBotToken() {
 
 function getFireTriggers() {
   if (!_fireTriggers) {
-    const { loadTriggers } = require('../lib/triggers');
     const result = loadTriggers();
     _fireTriggers = result.fireTriggers;
   }
@@ -34,18 +33,39 @@ function getFireTriggers() {
 const PUBLIC_ROUTES = ['/telegram/webhook', '/github/webhook'];
 
 /**
- * Check API key authentication
+ * Timing-safe string comparison.
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeCompare(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Centralized auth gate for all API routes.
+ * Public routes pass through; everything else requires a valid API key from the database.
  * @param {string} routePath - The route path
  * @param {Request} request - The incoming request
- * @returns {Response|null} - Error response if unauthorized, null if OK
+ * @returns {Response|null} - Error response or null if authorized
  */
 function checkAuth(routePath, request) {
   if (PUBLIC_ROUTES.includes(routePath)) return null;
 
   const apiKey = request.headers.get('x-api-key');
-  if (apiKey !== process.env.API_KEY) {
+  if (!apiKey) {
+    return Response.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const record = verifyApiKey(apiKey);
+  if (!record) {
     return Response.json({ error: 'Unauthorized' }, { status: 401 });
   }
+
   return null;
 }
 
@@ -57,55 +77,6 @@ function extractJobId(branchName) {
   return branchName.slice(4);
 }
 
-/**
- * Summarize a completed job using Claude
- * @param {Object} results - Job results from webhook payload
- * @returns {Promise<string>} The message to send to Telegram
- */
-async function summarizeJob(results) {
-  try {
-    const apiKey = getApiKey();
-
-    // System prompt from JOB_SUMMARY.md (supports {{includes}})
-    const systemPrompt = render_md(paths.jobSummaryMd);
-
-    // User message: structured job results
-    const userMessage = [
-      results.job ? `## Task\n${results.job}` : '',
-      results.commit_message ? `## Commit Message\n${results.commit_message}` : '',
-      results.changed_files?.length ? `## Changed Files\n${results.changed_files.join('\n')}` : '',
-      results.status ? `## Status\n${results.status}` : '',
-      results.merge_result ? `## Merge Result\n${results.merge_result}` : '',
-      results.pr_url ? `## PR URL\n${results.pr_url}` : '',
-      results.run_url ? `## Run URL\n${results.run_url}` : '',
-      results.log ? `## Agent Log\n${results.log}` : '',
-    ].filter(Boolean).join('\n\n');
-
-    const response = await fetch('https://api.anthropic.com/v1/messages', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'x-api-key': apiKey,
-        'anthropic-version': '2023-06-01',
-      },
-      body: JSON.stringify({
-        model: process.env.EVENT_HANDLER_MODEL || 'claude-sonnet-4-20250514',
-        max_tokens: 1024,
-        system: systemPrompt,
-        messages: [{ role: 'user', content: userMessage }],
-      }),
-    });
-
-    if (!response.ok) throw new Error(`Claude API error: ${response.status}`);
-
-    const result = await response.json();
-    return (result.content?.[0]?.text || '').trim() || 'Job finished.';
-  } catch (err) {
-    console.error('Failed to summarize job:', err);
-    return 'Job finished.';
-  }
-}
-
 // ─────────────────────────────────────────────────────────────────────────────
 // Route handlers
 // ─────────────────────────────────────────────────────────────────────────────
@@ -142,111 +113,58 @@ async function handleTelegramRegister(request) {
 }
 
 async function handleTelegramWebhook(request) {
-  const { TELEGRAM_WEBHOOK_SECRET, TELEGRAM_CHAT_ID, TELEGRAM_VERIFICATION } = process.env;
   const botToken = getTelegramBotToken();
+  if (!botToken) return Response.json({ ok: true });
 
-  // Validate secret token if configured
-  // Always return 200 to prevent Telegram retry loops on mismatch
-  if (TELEGRAM_WEBHOOK_SECRET) {
-    const headerSecret = request.headers.get('x-telegram-bot-api-secret-token');
-    if (headerSecret !== TELEGRAM_WEBHOOK_SECRET) {
-      return Response.json({ ok: true });
-    }
-  }
-
-  const update = await request.json();
-  const message = update.message || update.edited_message;
+  const adapter = getTelegramAdapter(botToken);
+  const normalized = await adapter.receive(request);
+  if (!normalized) return Response.json({ ok: true });
 
-  if (message && message.chat && botToken) {
-    const chatId = String(message.chat.id);
-
-    let messageText = null;
-
-    if (message.text) {
-      messageText = message.text;
-    }
-
-    // Check for verification code - this works even before TELEGRAM_CHAT_ID is set
-    if (TELEGRAM_VERIFICATION && messageText === TELEGRAM_VERIFICATION) {
-      await sendMessage(botToken, chatId, `Your chat ID:\n<code>${chatId}</code>`);
-      return Response.json({ ok: true });
-    }
-
-    // Security: if no TELEGRAM_CHAT_ID configured, ignore all messages (except verification above)
-    if (!TELEGRAM_CHAT_ID) {
-      return Response.json({ ok: true });
-    }
-
-    // Security: only accept messages from configured chat
-    if (chatId !== TELEGRAM_CHAT_ID) {
-      return Response.json({ ok: true });
-    }
-
-    // Acknowledge receipt with a thumbs up (await so it completes before typing indicator starts)
-    await reactToMessage(botToken, chatId, message.message_id).catch(() => {});
-
-    if (message.voice) {
-      // Handle voice messages
-      if (!isWhisperEnabled()) {
-        await sendMessage(botToken, chatId, 'Voice messages are not supported. Please set OPENAI_API_KEY to enable transcription.');
-        return Response.json({ ok: true });
-      }
-
-      try {
-        const { buffer, filename } = await downloadFile(botToken, message.voice.file_id);
-        messageText = await transcribeAudio(buffer, filename);
-      } catch (err) {
-        console.error('Failed to transcribe voice:', err);
-        await sendMessage(botToken, chatId, 'Sorry, I could not transcribe your voice message.');
-        return Response.json({ ok: true });
-      }
-    }
-
-    if (messageText) {
-      // Process message asynchronously (don't block the response)
-      processMessage(botToken, chatId, messageText).catch(err => {
-        console.error('Failed to process message:', err);
-      });
-    }
-  }
+  // Process message asynchronously (don't block the webhook response)
+  processChannelMessage(adapter, normalized).catch((err) => {
+    console.error('Failed to process message:', err);
+  });
 
   return Response.json({ ok: true });
 }
 
 /**
- * Process a Telegram message with Claude (async, non-blocking)
+ * Process a normalized message through the AI layer with channel UX.
+ * Message persistence is handled centrally by the AI layer.
  */
-async function processMessage(botToken, chatId, messageText) {
-  const stopTyping = startTypingIndicator(botToken, chatId);
+async function processChannelMessage(adapter, normalized) {
+  await adapter.acknowledge(normalized.metadata);
+  const stopIndicator = adapter.startProcessingIndicator(normalized.metadata);
+
   try {
-    // Get conversation history and process with Claude
-    const history = getHistory(chatId);
-    const { response, history: newHistory } = await chat(
-      messageText,
-      history,
-      toolDefinitions,
-      toolExecutors
+    const response = await chat(
+      normalized.threadId,
+      normalized.text,
+      normalized.attachments,
+      { userId: 'telegram', chatTitle: 'Telegram' }
     );
-    updateHistory(chatId, newHistory);
-
-    // Send response (auto-splits if needed)
-    await sendMessage(botToken, chatId, response);
+    await adapter.sendResponse(normalized.threadId, response, normalized.metadata);
   } catch (err) {
-    console.error('Failed to process message with Claude:', err);
-    await sendMessage(botToken, chatId, 'Sorry, I encountered an error processing your message.').catch(() => {});
+    console.error('Failed to process message with AI:', err);
+    await adapter
+      .sendResponse(
+        normalized.threadId,
+        'Sorry, I encountered an error processing your message.',
+        normalized.metadata
+      )
+      .catch(() => {});
   } finally {
-    stopTyping();
+    stopIndicator();
   }
 }
 
 async function handleGithubWebhook(request) {
-  const { GH_WEBHOOK_SECRET, TELEGRAM_CHAT_ID } = process.env;
-  const botToken = getTelegramBotToken();
+  const { GH_WEBHOOK_SECRET } = process.env;
 
-  // Validate webhook secret
+  // Validate webhook secret (timing-safe)
   if (GH_WEBHOOK_SECRET) {
     const headerSecret = request.headers.get('x-github-webhook-secret-token');
-    if (headerSecret !== GH_WEBHOOK_SECRET) {
+    if (!safeCompare(headerSecret, GH_WEBHOOK_SECRET)) {
       return Response.json({ error: 'Unauthorized' }, { status: 401 });
     }
   }
@@ -255,11 +173,6 @@ async function handleGithubWebhook(request) {
   const jobId = payload.job_id || extractJobId(payload.branch);
   if (!jobId) return Response.json({ ok: true, skipped: true, reason: 'not a job' });
 
-  if (!TELEGRAM_CHAT_ID || !botToken) {
-    console.log(`Job ${jobId} completed but no chat ID to notify`);
-    return Response.json({ ok: true, skipped: true, reason: 'no chat to notify' });
-  }
-
   try {
     const results = {
       job: payload.job || '',
@@ -273,15 +186,9 @@ async function handleGithubWebhook(request) {
     };
 
     const message = await summarizeJob(results);
+    await createNotification(message, payload);
 
-    await sendMessage(botToken, TELEGRAM_CHAT_ID, message);
-
-    // Add the summary to chat memory so Claude has context in future conversations
-    const history = getHistory(TELEGRAM_CHAT_ID);
-    history.push({ role: 'assistant', content: message });
-    updateHistory(TELEGRAM_CHAT_ID, history);
-
-    console.log(`Notified chat ${TELEGRAM_CHAT_ID} about job ${jobId.slice(0, 8)}`);
+    console.log(`Notification saved for job ${jobId.slice(0, 8)}`);
 
     return Response.json({ ok: true, notified: true });
   } catch (err) {
@@ -329,7 +236,7 @@ async function POST(request) {
 
   // Route to handler
   switch (routePath) {
-    case '/webhook':            return handleWebhook(request);
+    case '/create-job':          return handleWebhook(request);
     case '/telegram/webhook':   return handleTelegramWebhook(request);
     case '/telegram/register':  return handleTelegramRegister(request);
     case '/github/webhook':     return handleGithubWebhook(request);
@@ -346,10 +253,10 @@ async function GET(request) {
   if (authError) return authError;
 
   switch (routePath) {
-    case '/ping':         return Response.json({ message: 'Pong!' });
-    case '/jobs/status':  return handleJobStatus(request);
-    default:              return Response.json({ error: 'Not found' }, { status: 404 });
+    case '/ping':           return Response.json({ message: 'Pong!' });
+    case '/jobs/status':    return handleJobStatus(request);
+    default:                return Response.json({ error: 'Not found' }, { status: 404 });
   }
 }
 
-module.exports = { GET, POST };
+export { GET, POST };

package/bin/cli.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 
-const { execSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
+import { execSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
 
 const command = process.argv[2];
 const args = process.argv.slice(3);
@@ -15,6 +19,7 @@ Commands:
   init               Scaffold a new thepopebot project
   setup              Run interactive setup wizard
   setup-telegram     Reconfigure Telegram webhook
+  reset-auth         Regenerate AUTH_SECRET (invalidates all sessions)
   reset [file]       Restore a template file (or list available templates)
 `);
 }
@@ -82,17 +87,22 @@ function init() {
       name: dirName,
       private: true,
       scripts: {
-        dev: 'next dev',
+        dev: 'next dev --turbopack',
         build: 'next build',
         start: 'next start',
         setup: 'thepopebot setup',
         'setup-telegram': 'thepopebot setup-telegram',
+        'reset-auth': 'thepopebot reset-auth',
       },
       dependencies: {
         thepopebot: '^1.0.0',
-        next: '^16.0.0',
+        next: '^15.5.12',
+        'next-auth': '5.0.0-beta.30',
+        'next-themes': '^0.4.0',
         react: '^19.0.0',
         'react-dom': '^19.0.0',
+        tailwindcss: '^4.0.0',
+        '@tailwindcss/postcss': '^4.0.0',
       },
     };
     fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
@@ -102,7 +112,7 @@ function init() {
   }
 
   // Create .gitkeep files for empty dirs
-  const gitkeepDirs = ['cron', 'triggers', 'logs', 'tmp'];
+  const gitkeepDirs = ['cron', 'triggers', 'logs', 'tmp', 'data'];
   for (const dir of gitkeepDirs) {
     const gitkeep = path.join(cwd, dir, '.gitkeep');
     if (!fs.existsSync(gitkeep)) {
@@ -261,6 +271,23 @@ function setupTelegram() {
   }
 }
 
+async function resetAuth() {
+  const { randomBytes } = await import('crypto');
+  const { updateEnvVariable } = await import(path.join(__dirname, '..', 'setup', 'lib', 'auth.mjs'));
+
+  const envPath = path.join(process.cwd(), '.env');
+  if (!fs.existsSync(envPath)) {
+    console.error('\n  No .env file found. Run "npm run setup" first.\n');
+    process.exit(1);
+  }
+
+  const newSecret = randomBytes(32).toString('base64');
+  updateEnvVariable('AUTH_SECRET', newSecret);
+  console.log('\n  AUTH_SECRET regenerated.');
+  console.log('  All existing sessions have been invalidated.');
+  console.log('  Restart your server for the change to take effect.\n');
+}
+
 switch (command) {
   case 'init':
     init();
@@ -271,6 +298,9 @@ switch (command) {
   case 'setup-telegram':
     setupTelegram();
     break;
+  case 'reset-auth':
+    await resetAuth();
+    break;
   case 'reset':
     reset(args[0]);
     break;

package/bin/local.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+set -e
+
+PACKAGE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+DEV_DIR="${1:-/tmp/thepopebot.local}"
+ENV_BACKUP="/tmp/env.$(uuidgen)"
+
+HAS_ENV=false
+if [ -f "$DEV_DIR/.env" ]; then
+  mv "$DEV_DIR/.env" "$ENV_BACKUP"
+  HAS_ENV=true
+fi
+
+rm -rf "$DEV_DIR"
+mkdir -p "$DEV_DIR"
+cd "$DEV_DIR"
+
+node "$PACKAGE_DIR/bin/cli.js" init
+
+sed -i '' "s|\"thepopebot\": \".*\"|\"thepopebot\": \"file:$PACKAGE_DIR\"|" package.json
+
+rm -rf node_modules package-lock.json
+npm install --install-links
+
+
+if [ "$HAS_ENV" = true ]; then
+  mv "$ENV_BACKUP" .env
+  echo "Restored .env from previous build"
+else
+  npm run setup
+fi

package/bin/postinstall.js

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 
-const fs = require('fs');
-const path = require('path');
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
 
 // postinstall runs from the package dir inside node_modules.
 // The user's project root is two levels up: node_modules/thepopebot/ -> project root

package/config/index.js

@@ -1,5 +1,3 @@
-const path = require('path');
-
 /**
  * Next.js config wrapper for thepopebot.
  * Enables instrumentation hook for cron scheduling on server start.
@@ -11,19 +9,12 @@ const path = require('path');
  * @param {Object} nextConfig - User's Next.js config
  * @returns {Object} Enhanced Next.js config
  */
-function withThepopebot(nextConfig = {}) {
+export function withThepopebot(nextConfig = {}) {
   return {
     ...nextConfig,
-    // Ensure server-only packages aren't bundled for client
     serverExternalPackages: [
       ...(nextConfig.serverExternalPackages || []),
-      'thepopebot',
-      'grammy',
-      '@grammyjs/parse-mode',
-      'node-cron',
-      'uuid',
+      'better-sqlite3',
     ],
   };
 }
-
-module.exports = { withThepopebot };

package/config/instrumentation.js

@@ -11,19 +11,31 @@
 
 let initialized = false;
 
-async function register() {
+export async function register() {
   // Only run on the server, and only once
   if (typeof window !== 'undefined' || initialized) return;
   initialized = true;
 
   // Load .env from project root
-  require('dotenv').config();
+  const dotenv = await import('dotenv');
+  dotenv.config();
+
+  // Validate AUTH_SECRET is set (required by Auth.js for session encryption)
+  if (!process.env.AUTH_SECRET) {
+    console.error('\n  ERROR: AUTH_SECRET is not set in your .env file.');
+    console.error('  This is required for session encryption.');
+    console.error('  Run "npm run setup" to generate it automatically, or add manually:');
+    console.error('  openssl rand -base64 32\n');
+    throw new Error('AUTH_SECRET environment variable is required');
+  }
+
+  // Initialize auth database
+  const { initDatabase } = await import('../lib/db/index.js');
+  initDatabase();
 
   // Start cron scheduler
-  const { loadCrons } = require('../lib/cron');
+  const { loadCrons } = await import('../lib/cron.js');
   loadCrons();
 
   console.log('thepopebot initialized');
 }
-
-module.exports = { register };

package/lib/actions.js

@@ -1,11 +1,12 @@
-const { exec } = require('child_process');
-const { promisify } = require('util');
+import { exec } from 'child_process';
+import { promisify } from 'util';
+import { createJob } from './tools/create-job.js';
+
 const execAsync = promisify(exec);
-const { createJob } = require('./tools/create-job');
 
 /**
  * Execute a single action
- * @param {Object} action - { type, job, command, url, method, headers, vars }
+ * @param {Object} action - { type, job, command, url, method, headers, vars } (type: agent|command|webhook)
  * @param {Object} opts - { cwd, data }
  * @returns {Promise<string>} Result description for logging
  */
@@ -17,7 +18,7 @@ async function executeAction(action, opts = {}) {
     return (stdout || stderr || '').trim();
   }
 
-  if (type === 'http') {
+  if (type === 'webhook') {
     const method = (action.method || 'POST').toUpperCase();
     const headers = { 'Content-Type': 'application/json', ...action.headers };
     const fetchOpts = { method, headers };
@@ -37,4 +38,4 @@ async function executeAction(action, opts = {}) {
   return `job ${result.job_id}`;
 }
 
-module.exports = { executeAction };
+export { executeAction };

package/lib/ai/agent.js

@@ -0,0 +1,36 @@
+import { createReactAgent } from '@langchain/langgraph/prebuilt';
+import { createModel } from './model.js';
+import { createJobTool, getJobStatusTool } from './tools.js';
+import { SqliteSaver } from '@langchain/langgraph-checkpoint-sqlite';
+import { chatbotMd, thepopebotDb } from '../paths.js';
+import { render_md } from '../utils/render-md.js';
+
+let _agent = null;
+
+/**
+ * Get or create the LangGraph agent singleton.
+ * Uses createReactAgent which handles the tool loop automatically.
+ */
+export async function getAgent() {
+  if (!_agent) {
+    const model = await createModel();
+    const tools = [createJobTool, getJobStatusTool];
+    const checkpointer = SqliteSaver.fromConnString(thepopebotDb);
+    const systemPrompt = render_md(chatbotMd);
+
+    _agent = createReactAgent({
+      llm: model,
+      tools,
+      checkpointSaver: checkpointer,
+      prompt: systemPrompt,
+    });
+  }
+  return _agent;
+}
+
+/**
+ * Reset the agent singleton (e.g., when config changes).
+ */
+export function resetAgent() {
+  _agent = null;
+}