thepopebot 1.1.2 → 1.2.3

package/lib/ai/index.js

@@ -0,0 +1,274 @@
+import { HumanMessage, AIMessage } from '@langchain/core/messages';
+import { getAgent } from './agent.js';
+import { createModel } from './model.js';
+import { jobSummaryMd } from '../paths.js';
+import { render_md } from '../utils/render-md.js';
+import { getChatById, createChat, saveMessage, updateChatTitle } from '../db/chats.js';
+
+/**
+ * Ensure a chat exists in the DB and save a message.
+ * Centralized so every channel gets persistence automatically.
+ *
+ * @param {string} threadId - Chat/thread ID
+ * @param {string} role - 'user' or 'assistant'
+ * @param {string} text - Message text
+ * @param {object} [options] - { userId, chatTitle }
+ */
+function persistMessage(threadId, role, text, options = {}) {
+  try {
+    if (!getChatById(threadId)) {
+      createChat(options.userId || 'unknown', options.chatTitle || 'New Chat', threadId);
+    }
+    saveMessage(threadId, role, text);
+  } catch (err) {
+    // DB persistence is best-effort — don't break chat if DB fails
+    console.error('Failed to persist message:', err);
+  }
+}
+
+/**
+ * Process a chat message through the LangGraph agent.
+ * Saves user and assistant messages to the DB automatically.
+ *
+ * @param {string} threadId - Conversation thread ID (from channel adapter)
+ * @param {string} message - User's message text
+ * @param {Array} [attachments=[]] - Normalized attachments from adapter
+ * @param {object} [options] - { userId, chatTitle } for DB persistence
+ * @returns {Promise<string>} AI response text
+ */
+async function chat(threadId, message, attachments = [], options = {}) {
+  const agent = await getAgent();
+
+  // Save user message to DB
+  persistMessage(threadId, 'user', message || '[attachment]', options);
+
+  // Build content blocks: text + any image attachments as base64 vision
+  const content = [];
+
+  if (message) {
+    content.push({ type: 'text', text: message });
+  }
+
+  for (const att of attachments) {
+    if (att.category === 'image') {
+      content.push({
+        type: 'image_url',
+        image_url: {
+          url: `data:${att.mimeType};base64,${att.data.toString('base64')}`,
+        },
+      });
+    }
+    // Documents: future handling
+  }
+
+  // If only text and no attachments, simplify to a string
+  const messageContent = content.length === 1 && content[0].type === 'text'
+    ? content[0].text
+    : content;
+
+  const result = await agent.invoke(
+    { messages: [new HumanMessage({ content: messageContent })] },
+    { configurable: { thread_id: threadId } }
+  );
+
+  const lastMessage = result.messages[result.messages.length - 1];
+
+  // LangChain message content can be a string or an array of content blocks
+  let response;
+  if (typeof lastMessage.content === 'string') {
+    response = lastMessage.content;
+  } else {
+    response = lastMessage.content
+      .filter((block) => block.type === 'text')
+      .map((block) => block.text)
+      .join('\n');
+  }
+
+  // Save assistant response to DB
+  persistMessage(threadId, 'assistant', response, options);
+
+  // Auto-generate title for new chats
+  if (options.userId && message) {
+    autoTitle(threadId, message).catch(() => {});
+  }
+
+  return response;
+}
+
+/**
+ * Process a chat message with streaming (for channels that support it).
+ * Saves user and assistant messages to the DB automatically.
+ *
+ * @param {string} threadId - Conversation thread ID
+ * @param {string} message - User's message text
+ * @param {Array} [attachments=[]] - Image/PDF attachments: { category, mimeType, dataUrl }
+ * @param {object} [options] - { userId, chatTitle } for DB persistence
+ * @returns {AsyncIterableIterator<string>} Stream of text chunks
+ */
+async function* chatStream(threadId, message, attachments = [], options = {}) {
+  const agent = await getAgent();
+
+  // Save user message to DB
+  persistMessage(threadId, 'user', message || '[attachment]', options);
+
+  // Build content blocks: text + any image/PDF attachments as vision
+  const content = [];
+
+  if (message) {
+    content.push({ type: 'text', text: message });
+  }
+
+  for (const att of attachments) {
+    if (att.category === 'image') {
+      // Support both dataUrl (web) and Buffer (Telegram) formats
+      const url = att.dataUrl
+        ? att.dataUrl
+        : `data:${att.mimeType};base64,${att.data.toString('base64')}`;
+      content.push({
+        type: 'image_url',
+        image_url: { url },
+      });
+    }
+  }
+
+  // If only text and no attachments, simplify to a string
+  const messageContent = content.length === 1 && content[0].type === 'text'
+    ? content[0].text
+    : content;
+
+  try {
+    const stream = await agent.stream(
+      { messages: [new HumanMessage({ content: messageContent })] },
+      { configurable: { thread_id: threadId }, streamMode: 'messages' }
+    );
+
+    let fullText = '';
+
+    for await (const event of stream) {
+      // streamMode: 'messages' yields [message, metadata] tuples
+      const msg = Array.isArray(event) ? event[0] : event;
+      const isAI = msg._getType?.() === 'ai';
+      if (!isAI) continue;
+
+      // Content can be a string or an array of content blocks
+      let text = '';
+      if (typeof msg.content === 'string') {
+        text = msg.content;
+      } else if (Array.isArray(msg.content)) {
+        text = msg.content
+          .filter((b) => b.type === 'text' && b.text)
+          .map((b) => b.text)
+          .join('');
+      }
+
+      if (text) {
+        fullText += text;
+        yield text;
+      }
+    }
+
+    // Save assistant response to DB
+    if (fullText) {
+      persistMessage(threadId, 'assistant', fullText, options);
+    }
+
+    // Auto-generate title for new chats
+    if (options.userId && message) {
+      autoTitle(threadId, message).catch(() => {});
+    }
+  } catch (err) {
+    console.error('[chatStream] error:', err);
+    throw err;
+  }
+}
+
+/**
+ * Auto-generate a chat title from the first user message (fire-and-forget).
+ */
+async function autoTitle(threadId, firstMessage) {
+  try {
+    const chat = getChatById(threadId);
+    if (!chat || chat.title !== 'New Chat') return;
+
+    const model = await createModel({ maxTokens: 50 });
+    const response = await model.invoke([
+      ['system', 'Generate a short (3-6 word) title for this chat based on the user\'s first message. Return ONLY the title, nothing else.'],
+      ['human', firstMessage],
+    ]);
+    const title = typeof response.content === 'string'
+      ? response.content
+      : response.content.filter(b => b.type === 'text').map(b => b.text).join('');
+    const cleaned = title.replace(/^["']+|["']+$/g, '').trim();
+    if (cleaned) {
+      updateChatTitle(threadId, cleaned);
+    }
+  } catch (err) {
+    // Title generation is best-effort
+  }
+}
+
+/**
+ * One-shot summarization with a different system prompt and no memory.
+ * Used for job completion summaries sent via GitHub webhook.
+ *
+ * @param {object} results - Job results from webhook payload
+ * @returns {Promise<string>} Summary text
+ */
+async function summarizeJob(results) {
+  try {
+    const model = await createModel({ maxTokens: 1024 });
+    const systemPrompt = render_md(jobSummaryMd);
+
+    const userMessage = [
+      results.job ? `## Task\n${results.job}` : '',
+      results.commit_message ? `## Commit Message\n${results.commit_message}` : '',
+      results.changed_files?.length ? `## Changed Files\n${results.changed_files.join('\n')}` : '',
+      results.status ? `## Status\n${results.status}` : '',
+      results.merge_result ? `## Merge Result\n${results.merge_result}` : '',
+      results.pr_url ? `## PR URL\n${results.pr_url}` : '',
+      results.run_url ? `## Run URL\n${results.run_url}` : '',
+      results.log ? `## Agent Log\n${results.log}` : '',
+    ]
+      .filter(Boolean)
+      .join('\n\n');
+
+    const response = await model.invoke([
+      ['system', systemPrompt],
+      ['human', userMessage],
+    ]);
+
+    const text =
+      typeof response.content === 'string'
+        ? response.content
+        : response.content
+            .filter((block) => block.type === 'text')
+            .map((block) => block.text)
+            .join('\n');
+
+    return text.trim() || 'Job finished.';
+  } catch (err) {
+    console.error('Failed to summarize job:', err);
+    return 'Job finished.';
+  }
+}
+
+/**
+ * Inject a message into a thread's memory so the agent has context
+ * for future conversations (e.g., job completion summaries).
+ *
+ * @param {string} threadId - Conversation thread ID
+ * @param {string} text - Message text to inject as an assistant message
+ */
+async function addToThread(threadId, text) {
+  try {
+    const agent = await getAgent();
+    await agent.updateState(
+      { configurable: { thread_id: threadId } },
+      { messages: [new AIMessage(text)] }
+    );
+  } catch (err) {
+    console.error('Failed to add message to thread:', err);
+  }
+}
+
+export { chat, chatStream, summarizeJob, addToThread, persistMessage };

package/lib/ai/model.js

@@ -0,0 +1,67 @@
+import { ChatAnthropic } from '@langchain/anthropic';
+
+const DEFAULT_MODELS = {
+  anthropic: 'claude-sonnet-4-20250514',
+  openai: 'gpt-4o',
+  google: 'gemini-2.5-pro',
+};
+
+/**
+ * Create a LangChain chat model based on environment configuration.
+ *
+ * Config env vars:
+ *   LLM_PROVIDER    — "anthropic" (default), "openai", "google"
+ *   LLM_MODEL       — Model name override (e.g. "claude-sonnet-4-20250514")
+ *   ANTHROPIC_API_KEY — Required for anthropic provider
+ *   OPENAI_API_KEY   — Required for openai provider
+ *   GOOGLE_API_KEY   — Required for google provider
+ *
+ * @param {object} [options]
+ * @param {number} [options.maxTokens=4096] - Max tokens for the response
+ * @returns {import('@langchain/core/language_models/chat_models').BaseChatModel}
+ */
+export async function createModel(options = {}) {
+  const provider = process.env.LLM_PROVIDER || 'anthropic';
+  const modelName = process.env.LLM_MODEL || DEFAULT_MODELS[provider] || DEFAULT_MODELS.anthropic;
+  const maxTokens = options.maxTokens || 4096;
+
+  switch (provider) {
+    case 'anthropic': {
+      const apiKey = process.env.ANTHROPIC_API_KEY;
+      if (!apiKey) {
+        throw new Error('ANTHROPIC_API_KEY environment variable is required');
+      }
+      return new ChatAnthropic({
+        modelName,
+        maxTokens,
+        anthropicApiKey: apiKey,
+      });
+    }
+    case 'openai': {
+      const { ChatOpenAI } = await import('@langchain/openai');
+      const apiKey = process.env.OPENAI_API_KEY;
+      if (!apiKey) {
+        throw new Error('OPENAI_API_KEY environment variable is required');
+      }
+      return new ChatOpenAI({
+        modelName,
+        maxTokens,
+        openAIApiKey: apiKey,
+      });
+    }
+    case 'google': {
+      const { ChatGoogleGenerativeAI } = await import('@langchain/google-genai');
+      const apiKey = process.env.GOOGLE_API_KEY;
+      if (!apiKey) {
+        throw new Error('GOOGLE_API_KEY environment variable is required');
+      }
+      return new ChatGoogleGenerativeAI({
+        modelName,
+        maxOutputTokens: maxTokens,
+        apiKey,
+      });
+    }
+    default:
+      throw new Error(`Unknown LLM provider: ${provider}`);
+  }
+}

package/lib/ai/tools.js

@@ -0,0 +1,49 @@
+import { tool } from '@langchain/core/tools';
+import { z } from 'zod';
+import { createJob } from '../tools/create-job.js';
+import { getJobStatus } from '../tools/github.js';
+
+const createJobTool = tool(
+  async ({ job_description }) => {
+    const result = await createJob(job_description);
+    return JSON.stringify({
+      success: true,
+      job_id: result.job_id,
+      branch: result.branch,
+    });
+  },
+  {
+    name: 'create_job',
+    description:
+      'Create an autonomous job for thepopebot to execute. Use this tool liberally - if the user asks for ANY task to be done, create a job. Jobs can handle code changes, file updates, research tasks, web scraping, data analysis, or anything requiring autonomous work. When the user explicitly asks for a job, ALWAYS use this tool. Returns the job ID and branch name.',
+    schema: z.object({
+      job_description: z
+        .string()
+        .describe(
+          'Detailed job description including context and requirements. Be specific about what needs to be done.'
+        ),
+    }),
+  }
+);
+
+const getJobStatusTool = tool(
+  async ({ job_id }) => {
+    const result = await getJobStatus(job_id);
+    return JSON.stringify(result);
+  },
+  {
+    name: 'get_job_status',
+    description:
+      'Check status of running jobs. Returns list of active workflow runs with timing and current step. Use when user asks about job progress, running jobs, or job status.',
+    schema: z.object({
+      job_id: z
+        .string()
+        .optional()
+        .describe(
+          'Optional: specific job ID to check. If omitted, returns all running jobs.'
+        ),
+    }),
+  }
+);
+
+export { createJobTool, getJobStatusTool };

package/lib/auth/actions.js

@@ -0,0 +1,28 @@
+'use server';
+
+import { createFirstUser } from '../db/users.js';
+
+/**
+ * Create the first admin user (setup action).
+ * Uses atomic createFirstUser() to prevent race conditions.
+ * No session/token is created — the admin must log in through the normal auth flow.
+ *
+ * @param {string} email
+ * @param {string} password
+ * @returns {Promise<{ success?: boolean, error?: string }>}
+ */
+export async function setupAdmin(email, password) {
+  if (!email || !password) {
+    return { error: 'Email and password are required.' };
+  }
+  if (password.length < 8) {
+    return { error: 'Password must be at least 8 characters.' };
+  }
+
+  const created = createFirstUser(email, password);
+  if (!created) {
+    return { error: 'Setup already completed.' };
+  }
+
+  return { success: true };
+}

package/lib/auth/config.js

@@ -0,0 +1,45 @@
+import NextAuth from 'next-auth';
+import Credentials from 'next-auth/providers/credentials';
+
+// DB imports are dynamic inside authorize() so they don't get pulled in
+// at module level — middleware runs on Edge which has no fs/better-sqlite3.
+
+export const { handlers, signIn, signOut, auth } = NextAuth({
+  providers: [
+    Credentials({
+      credentials: {
+        email: { label: 'Email', type: 'email' },
+        password: { label: 'Password', type: 'password' },
+      },
+      async authorize(credentials) {
+        if (!credentials?.email || !credentials?.password) return null;
+
+        const { getUserByEmail, verifyPassword } = await import('../db/users.js');
+        const user = getUserByEmail(credentials.email);
+        if (!user) return null;
+
+        const valid = await verifyPassword(user, credentials.password);
+        if (!valid) return null;
+
+        return { id: user.id, email: user.email, role: user.role };
+      },
+    }),
+  ],
+  session: { strategy: 'jwt' },
+  pages: { signIn: '/login' },
+  callbacks: {
+    jwt({ token, user }) {
+      if (user) {
+        token.role = user.role;
+      }
+      return token;
+    },
+    session({ session, token }) {
+      if (session.user) {
+        session.user.id = token.sub;
+        session.user.role = token.role;
+      }
+      return session;
+    },
+  },
+});

package/lib/auth/index.js

@@ -0,0 +1,27 @@
+import { handlers, auth } from './config.js';
+
+// Re-export Auth.js route handlers (GET + POST for [...nextauth])
+export const { GET, POST } = handlers;
+
+// Re-export auth for session checking
+export { auth };
+
+/**
+ * Get the auth state for the main page (server component).
+ * Returns both the session and whether setup is needed, in one call.
+ * DB import is dynamic so it doesn't get pulled in at module level.
+ *
+ * @returns {Promise<{ session: object|null, needsSetup: boolean }>}
+ */
+export async function getPageAuthState() {
+  const { getUserCount } = await import('../db/users.js');
+  const [session, userCount] = await Promise.all([
+    auth(),
+    Promise.resolve(getUserCount()),
+  ]);
+
+  return {
+    session,
+    needsSetup: userCount === 0,
+  };
+}

package/lib/auth/middleware.js

@@ -0,0 +1,30 @@
+import { auth } from './config.js';
+import { NextResponse } from 'next/server';
+
+export const middleware = auth((req) => {
+  const { pathname } = req.nextUrl;
+
+  // API routes use their own centralized auth (checkAuth in api/index.js)
+  if (pathname.startsWith('/api')) return;
+
+  // Static assets from public/ — skip auth for common file extensions
+  if (/\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|woff2?|ttf|eot|mp4|webm)$/i.test(pathname)) {
+    return;
+  }
+
+  // /login is the only unprotected page (login + first-user setup)
+  if (pathname === '/login') {
+    if (req.auth) return NextResponse.redirect(new URL('/', req.url));
+    return;
+  }
+
+  // Everything else requires auth
+  if (!req.auth) {
+    return NextResponse.redirect(new URL('/login', req.url));
+  }
+});
+
+export const config = {
+  // Exclude all _next internal paths (static chunks, HMR, images, Turbopack dev assets)
+  matcher: ['/((?!_next|favicon.ico).*)'],
+};

package/lib/channels/base.js

@@ -0,0 +1,56 @@
+/**
+ * Base channel adapter interface.
+ * Every chat channel (Telegram, Slack, web, etc.) implements this contract.
+ */
+class ChannelAdapter {
+  /**
+   * Handle an incoming webhook request from this channel.
+   * Returns normalized message data or null if no action needed.
+   *
+   * @param {Request} request - Incoming HTTP request
+   * @returns {Promise<{ threadId: string, text: string, attachments: Array, metadata: object } | null>}
+   *
+   * Attachments array (may be empty) — only non-text content that the LLM needs to see:
+   *   { category: "image", mimeType: "image/png", data: Buffer }  — send to LLM as vision
+   *   { category: "document", mimeType: "application/pdf", data: Buffer } — future: extract/attach
+   *
+   * The adapter downloads authenticated files and normalizes them.
+   * Voice/audio messages are fully resolved by the adapter — transcribed to text
+   * and included in the `text` field. They are NOT passed as attachments.
+   */
+  async receive(request) {
+    throw new Error('Not implemented');
+  }
+
+  /**
+   * Called when message is received — adapter shows acknowledgment.
+   * Telegram: thumbs up reaction. Slack: emoji reaction. Web: no-op.
+   */
+  async acknowledge(metadata) {}
+
+  /**
+   * Called while AI is processing — adapter shows activity.
+   * Telegram: typing indicator. Slack: typing indicator. Web: no-op (streaming handles this).
+   * Returns a stop function.
+   */
+  startProcessingIndicator(metadata) {
+    return () => {};
+  }
+
+  /**
+   * Send a complete (non-streaming) response back to the channel.
+   */
+  async sendResponse(threadId, text, metadata) {
+    throw new Error('Not implemented');
+  }
+
+  /**
+   * Whether this channel supports real streaming (e.g., web chat via Vercel AI SDK).
+   * If true, the AI layer provides a stream instead of a complete response.
+   */
+  get supportsStreaming() {
+    return false;
+  }
+}
+
+export { ChannelAdapter };

package/lib/channels/index.js

@@ -0,0 +1,15 @@
+import { TelegramAdapter } from './telegram.js';
+
+let _telegramAdapter = null;
+
+/**
+ * Get the Telegram channel adapter (lazy singleton).
+ * @param {string} botToken - Telegram bot token
+ * @returns {TelegramAdapter}
+ */
+export function getTelegramAdapter(botToken) {
+  if (!_telegramAdapter || _telegramAdapter.botToken !== botToken) {
+    _telegramAdapter = new TelegramAdapter(botToken);
+  }
+  return _telegramAdapter;
+}