thepopebot 1.2.0 → 1.2.3

package/README.md

@@ -111,7 +111,7 @@ The wizard walks you through everything:
 **Step 3** — Start using your agent:
 
 - **Telegram**: Message your bot to create jobs conversationally. Ask it to do tasks, check job status, or just chat.
-- **Webhook**: Send a POST to `/api/webhook` with your API key to create jobs programmatically.
+- **Webhook**: Send a POST to `/api/create-job` with your API key to create jobs programmatically.
 - **Cron**: Edit `config/CRONS.json` to schedule recurring jobs.
 
 ---

package/api/index.js

@@ -1,8 +1,12 @@
-const { createJob } = require('../lib/tools/create-job');
-const { setWebhook, sendMessage } = require('../lib/tools/telegram');
-const { getJobStatus } = require('../lib/tools/github');
-const { getTelegramAdapter } = require('../lib/channels');
-const { chat, summarizeJob, addToThread } = require('../lib/ai');
+import { createHash, timingSafeEqual } from 'crypto';
+import { createJob } from '../lib/tools/create-job.js';
+import { setWebhook } from '../lib/tools/telegram.js';
+import { getJobStatus } from '../lib/tools/github.js';
+import { getTelegramAdapter } from '../lib/channels/index.js';
+import { chat, summarizeJob } from '../lib/ai/index.js';
+import { createNotification } from '../lib/db/notifications.js';
+import { loadTriggers } from '../lib/triggers.js';
+import { verifyApiKey } from '../lib/db/api-keys.js';
 
 // Bot token from env, can be overridden by /telegram/register
 let telegramBotToken = null;
@@ -19,7 +23,6 @@ function getTelegramBotToken() {
 
 function getFireTriggers() {
   if (!_fireTriggers) {
-    const { loadTriggers } = require('../lib/triggers');
     const result = loadTriggers();
     _fireTriggers = result.fireTriggers;
   }
@@ -30,18 +33,39 @@ function getFireTriggers() {
 const PUBLIC_ROUTES = ['/telegram/webhook', '/github/webhook'];
 
 /**
- * Check API key authentication
+ * Timing-safe string comparison.
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeCompare(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Centralized auth gate for all API routes.
+ * Public routes pass through; everything else requires a valid API key from the database.
  * @param {string} routePath - The route path
  * @param {Request} request - The incoming request
- * @returns {Response|null} - Error response if unauthorized, null if OK
+ * @returns {Response|null} - Error response or null if authorized
  */
 function checkAuth(routePath, request) {
   if (PUBLIC_ROUTES.includes(routePath)) return null;
 
   const apiKey = request.headers.get('x-api-key');
-  if (apiKey !== process.env.API_KEY) {
+  if (!apiKey) {
+    return Response.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const record = verifyApiKey(apiKey);
+  if (!record) {
     return Response.json({ error: 'Unauthorized' }, { status: 401 });
   }
+
   return null;
 }
 
@@ -106,13 +130,19 @@ async function handleTelegramWebhook(request) {
 
 /**
  * Process a normalized message through the AI layer with channel UX.
+ * Message persistence is handled centrally by the AI layer.
  */
 async function processChannelMessage(adapter, normalized) {
   await adapter.acknowledge(normalized.metadata);
   const stopIndicator = adapter.startProcessingIndicator(normalized.metadata);
 
   try {
-    const response = await chat(normalized.threadId, normalized.text, normalized.attachments);
+    const response = await chat(
+      normalized.threadId,
+      normalized.text,
+      normalized.attachments,
+      { userId: 'telegram', chatTitle: 'Telegram' }
+    );
     await adapter.sendResponse(normalized.threadId, response, normalized.metadata);
   } catch (err) {
     console.error('Failed to process message with AI:', err);
@@ -129,13 +159,12 @@ async function processChannelMessage(adapter, normalized) {
 }
 
 async function handleGithubWebhook(request) {
-  const { GH_WEBHOOK_SECRET, TELEGRAM_CHAT_ID } = process.env;
-  const botToken = getTelegramBotToken();
+  const { GH_WEBHOOK_SECRET } = process.env;
 
-  // Validate webhook secret
+  // Validate webhook secret (timing-safe)
   if (GH_WEBHOOK_SECRET) {
     const headerSecret = request.headers.get('x-github-webhook-secret-token');
-    if (headerSecret !== GH_WEBHOOK_SECRET) {
+    if (!safeCompare(headerSecret, GH_WEBHOOK_SECRET)) {
       return Response.json({ error: 'Unauthorized' }, { status: 401 });
     }
   }
@@ -144,11 +173,6 @@ async function handleGithubWebhook(request) {
   const jobId = payload.job_id || extractJobId(payload.branch);
   if (!jobId) return Response.json({ ok: true, skipped: true, reason: 'not a job' });
 
-  if (!TELEGRAM_CHAT_ID || !botToken) {
-    console.log(`Job ${jobId} completed but no chat ID to notify`);
-    return Response.json({ ok: true, skipped: true, reason: 'no chat to notify' });
-  }
-
   try {
     const results = {
       job: payload.job || '',
@@ -162,13 +186,9 @@ async function handleGithubWebhook(request) {
     };
 
     const message = await summarizeJob(results);
+    await createNotification(message, payload);
 
-    await sendMessage(botToken, TELEGRAM_CHAT_ID, message);
-
-    // Add the summary to chat memory so the agent has context in future conversations
-    await addToThread(TELEGRAM_CHAT_ID, message);
-
-    console.log(`Notified chat ${TELEGRAM_CHAT_ID} about job ${jobId.slice(0, 8)}`);
+    console.log(`Notification saved for job ${jobId.slice(0, 8)}`);
 
     return Response.json({ ok: true, notified: true });
   } catch (err) {
@@ -216,7 +236,7 @@ async function POST(request) {
 
   // Route to handler
   switch (routePath) {
-    case '/webhook':            return handleWebhook(request);
+    case '/create-job':          return handleWebhook(request);
     case '/telegram/webhook':   return handleTelegramWebhook(request);
     case '/telegram/register':  return handleTelegramRegister(request);
     case '/github/webhook':     return handleGithubWebhook(request);
@@ -233,10 +253,10 @@ async function GET(request) {
   if (authError) return authError;
 
   switch (routePath) {
-    case '/ping':         return Response.json({ message: 'Pong!' });
-    case '/jobs/status':  return handleJobStatus(request);
-    default:              return Response.json({ error: 'Not found' }, { status: 404 });
+    case '/ping':           return Response.json({ message: 'Pong!' });
+    case '/jobs/status':    return handleJobStatus(request);
+    default:                return Response.json({ error: 'Not found' }, { status: 404 });
   }
 }
 
-module.exports = { GET, POST };
+export { GET, POST };

package/bin/cli.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 
-const { execSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
+import { execSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
 
 const command = process.argv[2];
 const args = process.argv.slice(3);
@@ -15,6 +19,7 @@ Commands:
   init               Scaffold a new thepopebot project
   setup              Run interactive setup wizard
   setup-telegram     Reconfigure Telegram webhook
+  reset-auth         Regenerate AUTH_SECRET (invalidates all sessions)
   reset [file]       Restore a template file (or list available templates)
 `);
 }
@@ -82,17 +87,22 @@ function init() {
       name: dirName,
       private: true,
       scripts: {
-        dev: 'next dev',
+        dev: 'next dev --turbopack',
         build: 'next build',
         start: 'next start',
         setup: 'thepopebot setup',
         'setup-telegram': 'thepopebot setup-telegram',
+        'reset-auth': 'thepopebot reset-auth',
       },
       dependencies: {
         thepopebot: '^1.0.0',
-        next: '^16.0.0',
+        next: '^15.5.12',
+        'next-auth': '5.0.0-beta.30',
+        'next-themes': '^0.4.0',
         react: '^19.0.0',
         'react-dom': '^19.0.0',
+        tailwindcss: '^4.0.0',
+        '@tailwindcss/postcss': '^4.0.0',
       },
     };
     fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
@@ -102,7 +112,7 @@ function init() {
   }
 
   // Create .gitkeep files for empty dirs
-  const gitkeepDirs = ['cron', 'triggers', 'logs', 'tmp'];
+  const gitkeepDirs = ['cron', 'triggers', 'logs', 'tmp', 'data'];
   for (const dir of gitkeepDirs) {
     const gitkeep = path.join(cwd, dir, '.gitkeep');
     if (!fs.existsSync(gitkeep)) {
@@ -261,6 +271,23 @@ function setupTelegram() {
   }
 }
 
+async function resetAuth() {
+  const { randomBytes } = await import('crypto');
+  const { updateEnvVariable } = await import(path.join(__dirname, '..', 'setup', 'lib', 'auth.mjs'));
+
+  const envPath = path.join(process.cwd(), '.env');
+  if (!fs.existsSync(envPath)) {
+    console.error('\n  No .env file found. Run "npm run setup" first.\n');
+    process.exit(1);
+  }
+
+  const newSecret = randomBytes(32).toString('base64');
+  updateEnvVariable('AUTH_SECRET', newSecret);
+  console.log('\n  AUTH_SECRET regenerated.');
+  console.log('  All existing sessions have been invalidated.');
+  console.log('  Restart your server for the change to take effect.\n');
+}
+
 switch (command) {
   case 'init':
     init();
@@ -271,6 +298,9 @@ switch (command) {
   case 'setup-telegram':
     setupTelegram();
     break;
+  case 'reset-auth':
+    await resetAuth();
+    break;
   case 'reset':
     reset(args[0]);
     break;

package/bin/{dev.sh → local.sh}

@@ -2,7 +2,7 @@
 set -e
 
 PACKAGE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-DEV_DIR="${1:-/tmp/thepopebot}"
+DEV_DIR="${1:-/tmp/thepopebot.local}"
 ENV_BACKUP="/tmp/env.$(uuidgen)"
 
 HAS_ENV=false
@@ -22,6 +22,7 @@ sed -i '' "s|\"thepopebot\": \".*\"|\"thepopebot\": \"file:$PACKAGE_DIR\"|" pack
 rm -rf node_modules package-lock.json
 npm install --install-links
 
+
 if [ "$HAS_ENV" = true ]; then
   mv "$ENV_BACKUP" .env
   echo "Restored .env from previous build"

package/bin/postinstall.js

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 
-const fs = require('fs');
-const path = require('path');
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
 
 // postinstall runs from the package dir inside node_modules.
 // The user's project root is two levels up: node_modules/thepopebot/ -> project root

package/config/index.js

@@ -1,5 +1,3 @@
-const path = require('path');
-
 /**
  * Next.js config wrapper for thepopebot.
  * Enables instrumentation hook for cron scheduling on server start.
@@ -11,24 +9,12 @@ const path = require('path');
  * @param {Object} nextConfig - User's Next.js config
  * @returns {Object} Enhanced Next.js config
  */
-function withThepopebot(nextConfig = {}) {
+export function withThepopebot(nextConfig = {}) {
   return {
     ...nextConfig,
-    // Ensure server-only packages aren't bundled for client
     serverExternalPackages: [
       ...(nextConfig.serverExternalPackages || []),
-      'thepopebot',
-      'grammy',
-      '@grammyjs/parse-mode',
-      'node-cron',
-      'uuid',
-      '@langchain/langgraph',
-      '@langchain/anthropic',
-      '@langchain/core',
-      'zod',
       'better-sqlite3',
     ],
   };
 }
-
-module.exports = { withThepopebot };

package/config/instrumentation.js

@@ -11,19 +11,31 @@
 
 let initialized = false;
 
-async function register() {
+export async function register() {
   // Only run on the server, and only once
   if (typeof window !== 'undefined' || initialized) return;
   initialized = true;
 
   // Load .env from project root
-  require('dotenv').config();
+  const dotenv = await import('dotenv');
+  dotenv.config();
+
+  // Validate AUTH_SECRET is set (required by Auth.js for session encryption)
+  if (!process.env.AUTH_SECRET) {
+    console.error('\n  ERROR: AUTH_SECRET is not set in your .env file.');
+    console.error('  This is required for session encryption.');
+    console.error('  Run "npm run setup" to generate it automatically, or add manually:');
+    console.error('  openssl rand -base64 32\n');
+    throw new Error('AUTH_SECRET environment variable is required');
+  }
+
+  // Initialize auth database
+  const { initDatabase } = await import('../lib/db/index.js');
+  initDatabase();
 
   // Start cron scheduler
-  const { loadCrons } = require('../lib/cron');
+  const { loadCrons } = await import('../lib/cron.js');
   loadCrons();
 
   console.log('thepopebot initialized');
 }
-
-module.exports = { register };

package/lib/actions.js

@@ -1,11 +1,12 @@
-const { exec } = require('child_process');
-const { promisify } = require('util');
+import { exec } from 'child_process';
+import { promisify } from 'util';
+import { createJob } from './tools/create-job.js';
+
 const execAsync = promisify(exec);
-const { createJob } = require('./tools/create-job');
 
 /**
  * Execute a single action
- * @param {Object} action - { type, job, command, url, method, headers, vars }
+ * @param {Object} action - { type, job, command, url, method, headers, vars } (type: agent|command|webhook)
  * @param {Object} opts - { cwd, data }
  * @returns {Promise<string>} Result description for logging
  */
@@ -17,7 +18,7 @@ async function executeAction(action, opts = {}) {
     return (stdout || stderr || '').trim();
   }
 
-  if (type === 'http') {
+  if (type === 'webhook') {
     const method = (action.method || 'POST').toUpperCase();
     const headers = { 'Content-Type': 'application/json', ...action.headers };
     const fetchOpts = { method, headers };
@@ -37,4 +38,4 @@ async function executeAction(action, opts = {}) {
   return `job ${result.job_id}`;
 }
 
-module.exports = { executeAction };
+export { executeAction };

package/lib/ai/agent.js

@@ -1,9 +1,9 @@
-const { createReactAgent } = require('@langchain/langgraph/prebuilt');
-const { createModel } = require('./model');
-const { createJobTool, getJobStatusTool } = require('./tools');
-const { createCheckpointer } = require('./memory');
-const paths = require('../paths');
-const { render_md } = require('../utils/render-md');
+import { createReactAgent } from '@langchain/langgraph/prebuilt';
+import { createModel } from './model.js';
+import { createJobTool, getJobStatusTool } from './tools.js';
+import { SqliteSaver } from '@langchain/langgraph-checkpoint-sqlite';
+import { chatbotMd, thepopebotDb } from '../paths.js';
+import { render_md } from '../utils/render-md.js';
 
 let _agent = null;
 
@@ -11,12 +11,12 @@ let _agent = null;
  * Get or create the LangGraph agent singleton.
  * Uses createReactAgent which handles the tool loop automatically.
  */
-function getAgent() {
+export async function getAgent() {
   if (!_agent) {
-    const model = createModel();
+    const model = await createModel();
     const tools = [createJobTool, getJobStatusTool];
-    const checkpointer = createCheckpointer();
-    const systemPrompt = render_md(paths.chatbotMd);
+    const checkpointer = SqliteSaver.fromConnString(thepopebotDb);
+    const systemPrompt = render_md(chatbotMd);
 
     _agent = createReactAgent({
       llm: model,
@@ -31,8 +31,6 @@ function getAgent() {
 /**
  * Reset the agent singleton (e.g., when config changes).
  */
-function resetAgent() {
+export function resetAgent() {
   _agent = null;
 }
-
-module.exports = { getAgent, resetAgent };

package/lib/ai/index.js

@@ -1,19 +1,46 @@
-const { HumanMessage, AIMessage } = require('@langchain/core/messages');
-const { getAgent } = require('./agent');
-const { createModel } = require('./model');
-const paths = require('../paths');
-const { render_md } = require('../utils/render-md');
+import { HumanMessage, AIMessage } from '@langchain/core/messages';
+import { getAgent } from './agent.js';
+import { createModel } from './model.js';
+import { jobSummaryMd } from '../paths.js';
+import { render_md } from '../utils/render-md.js';
+import { getChatById, createChat, saveMessage, updateChatTitle } from '../db/chats.js';
+
+/**
+ * Ensure a chat exists in the DB and save a message.
+ * Centralized so every channel gets persistence automatically.
+ *
+ * @param {string} threadId - Chat/thread ID
+ * @param {string} role - 'user' or 'assistant'
+ * @param {string} text - Message text
+ * @param {object} [options] - { userId, chatTitle }
+ */
+function persistMessage(threadId, role, text, options = {}) {
+  try {
+    if (!getChatById(threadId)) {
+      createChat(options.userId || 'unknown', options.chatTitle || 'New Chat', threadId);
+    }
+    saveMessage(threadId, role, text);
+  } catch (err) {
+    // DB persistence is best-effort — don't break chat if DB fails
+    console.error('Failed to persist message:', err);
+  }
+}
 
 /**
  * Process a chat message through the LangGraph agent.
+ * Saves user and assistant messages to the DB automatically.
  *
  * @param {string} threadId - Conversation thread ID (from channel adapter)
  * @param {string} message - User's message text
  * @param {Array} [attachments=[]] - Normalized attachments from adapter
+ * @param {object} [options] - { userId, chatTitle } for DB persistence
  * @returns {Promise<string>} AI response text
  */
-async function chat(threadId, message, attachments = []) {
-  const agent = getAgent();
+async function chat(threadId, message, attachments = [], options = {}) {
+  const agent = await getAgent();
+
+  // Save user message to DB
+  persistMessage(threadId, 'user', message || '[attachment]', options);
 
   // Build content blocks: text + any image attachments as base64 vision
   const content = [];
@@ -47,37 +74,137 @@ async function chat(threadId, message, attachments = []) {
   const lastMessage = result.messages[result.messages.length - 1];
 
   // LangChain message content can be a string or an array of content blocks
+  let response;
   if (typeof lastMessage.content === 'string') {
-    return lastMessage.content;
+    response = lastMessage.content;
+  } else {
+    response = lastMessage.content
+      .filter((block) => block.type === 'text')
+      .map((block) => block.text)
+      .join('\n');
   }
 
-  // Extract text from content blocks
-  return lastMessage.content
-    .filter((block) => block.type === 'text')
-    .map((block) => block.text)
-    .join('\n');
+  // Save assistant response to DB
+  persistMessage(threadId, 'assistant', response, options);
+
+  // Auto-generate title for new chats
+  if (options.userId && message) {
+    autoTitle(threadId, message).catch(() => {});
+  }
+
+  return response;
 }
 
 /**
  * Process a chat message with streaming (for channels that support it).
+ * Saves user and assistant messages to the DB automatically.
  *
  * @param {string} threadId - Conversation thread ID
  * @param {string} message - User's message text
+ * @param {Array} [attachments=[]] - Image/PDF attachments: { category, mimeType, dataUrl }
+ * @param {object} [options] - { userId, chatTitle } for DB persistence
  * @returns {AsyncIterableIterator<string>} Stream of text chunks
  */
-async function* chatStream(threadId, message) {
-  const agent = getAgent();
+async function* chatStream(threadId, message, attachments = [], options = {}) {
+  const agent = await getAgent();
 
-  const stream = await agent.stream(
-    { messages: [new HumanMessage(message)] },
-    { configurable: { thread_id: threadId }, streamMode: 'messages' }
-  );
+  // Save user message to DB
+  persistMessage(threadId, 'user', message || '[attachment]', options);
 
-  for await (const [message, metadata] of stream) {
-    if (message.content && typeof message.content === 'string') {
-      yield message.content;
+  // Build content blocks: text + any image/PDF attachments as vision
+  const content = [];
+
+  if (message) {
+    content.push({ type: 'text', text: message });
+  }
+
+  for (const att of attachments) {
+    if (att.category === 'image') {
+      // Support both dataUrl (web) and Buffer (Telegram) formats
+      const url = att.dataUrl
+        ? att.dataUrl
+        : `data:${att.mimeType};base64,${att.data.toString('base64')}`;
+      content.push({
+        type: 'image_url',
+        image_url: { url },
+      });
     }
   }
+
+  // If only text and no attachments, simplify to a string
+  const messageContent = content.length === 1 && content[0].type === 'text'
+    ? content[0].text
+    : content;
+
+  try {
+    const stream = await agent.stream(
+      { messages: [new HumanMessage({ content: messageContent })] },
+      { configurable: { thread_id: threadId }, streamMode: 'messages' }
+    );
+
+    let fullText = '';
+
+    for await (const event of stream) {
+      // streamMode: 'messages' yields [message, metadata] tuples
+      const msg = Array.isArray(event) ? event[0] : event;
+      const isAI = msg._getType?.() === 'ai';
+      if (!isAI) continue;
+
+      // Content can be a string or an array of content blocks
+      let text = '';
+      if (typeof msg.content === 'string') {
+        text = msg.content;
+      } else if (Array.isArray(msg.content)) {
+        text = msg.content
+          .filter((b) => b.type === 'text' && b.text)
+          .map((b) => b.text)
+          .join('');
+      }
+
+      if (text) {
+        fullText += text;
+        yield text;
+      }
+    }
+
+    // Save assistant response to DB
+    if (fullText) {
+      persistMessage(threadId, 'assistant', fullText, options);
+    }
+
+    // Auto-generate title for new chats
+    if (options.userId && message) {
+      autoTitle(threadId, message).catch(() => {});
+    }
+  } catch (err) {
+    console.error('[chatStream] error:', err);
+    throw err;
+  }
+}
+
+/**
+ * Auto-generate a chat title from the first user message (fire-and-forget).
+ */
+async function autoTitle(threadId, firstMessage) {
+  try {
+    const chat = getChatById(threadId);
+    if (!chat || chat.title !== 'New Chat') return;
+
+    const model = await createModel({ maxTokens: 50 });
+    const response = await model.invoke([
+      ['system', 'Generate a short (3-6 word) title for this chat based on the user\'s first message. Return ONLY the title, nothing else.'],
+      ['human', firstMessage],
+    ]);
+    const title = typeof response.content === 'string'
+      ? response.content
+      : response.content.filter(b => b.type === 'text').map(b => b.text).join('');
+    const cleaned = title.replace(/^["']+|["']+$/g, '').trim();
+    if (cleaned) {
+      updateChatTitle(threadId, cleaned);
+    }
+  } catch (err) {
+    // Title generation is best-effort
+  }
 }
 
 /**
@@ -89,8 +216,8 @@ async function* chatStream(threadId, message) {
  */
 async function summarizeJob(results) {
   try {
-    const model = createModel({ maxTokens: 1024 });
-    const systemPrompt = render_md(paths.jobSummaryMd);
+    const model = await createModel({ maxTokens: 1024 });
+    const systemPrompt = render_md(jobSummaryMd);
 
     const userMessage = [
       results.job ? `## Task\n${results.job}` : '',
@@ -134,7 +261,7 @@ async function summarizeJob(results) {
  */
 async function addToThread(threadId, text) {
   try {
-    const agent = getAgent();
+    const agent = await getAgent();
     await agent.updateState(
       { configurable: { thread_id: threadId } },
       { messages: [new AIMessage(text)] }
@@ -144,4 +271,4 @@ async function addToThread(threadId, text) {
   }
 }
 
-module.exports = { chat, chatStream, summarizeJob, addToThread };
+export { chat, chatStream, summarizeJob, addToThread, persistMessage };