thepopebot 1.2.75-beta.2 → 1.2.75-beta.21

package/lib/code/code-page.js

@@ -299,6 +299,45 @@ function CodePage({ session, codeWorkspaceId }) {
             /* @__PURE__ */ jsx(SpinnerIcon, { size: 12 }),
             /* @__PURE__ */ jsx("span", { children: "Editor..." })
           ] }),
+          portForwards.length > 0 && /* @__PURE__ */ jsx("div", { className: "flex items-center gap-1", children: portForwards.map((pf) => /* @__PURE__ */ jsxs(
+            "div",
+            {
+              className: "flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium font-mono text-muted-foreground shrink-0 whitespace-nowrap rounded-t-md border border-b-0 border-emerald-500/30 bg-emerald-500/5",
+              children: [
+                /* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-emerald-500" }),
+                /* @__PURE__ */ jsxs("span", { children: [
+                  ":",
+                  pf.port
+                ] }),
+                /* @__PURE__ */ jsx(
+                  "button",
+                  {
+                    className: "hover:text-emerald-400 transition-colors",
+                    onClick: () => window.open(pf.url, "_blank"),
+                    title: `Open ${pf.url}`,
+                    children: /* @__PURE__ */ jsxs("svg", { width: "10", height: "10", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
+                      /* @__PURE__ */ jsx("path", { d: "M7 3H3v10h10V9" }),
+                      /* @__PURE__ */ jsx("path", { d: "M10 2h4v4" }),
+                      /* @__PURE__ */ jsx("path", { d: "M14 2L7 9" })
+                    ] })
+                  }
+                ),
+                /* @__PURE__ */ jsx(
+                  "button",
+                  {
+                    className: "hover:text-destructive transition-colors",
+                    onClick: () => handleStopPort(pf.port),
+                    title: "Stop forwarding",
+                    children: /* @__PURE__ */ jsxs("svg", { width: "10", height: "10", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2.5", strokeLinecap: "round", children: [
+                      /* @__PURE__ */ jsx("line", { x1: "4", y1: "4", x2: "12", y2: "12" }),
+                      /* @__PURE__ */ jsx("line", { x1: "12", y1: "4", x2: "4", y2: "12" })
+                    ] })
+                  }
+                )
+              ]
+            },
+            pf.port
+          )) }),
           /* @__PURE__ */ jsx("div", { className: "self-stretch my-1.5 mx-1 md:mx-4 w-px bg-border shrink-0" }),
           /* @__PURE__ */ jsx(
             "button",
@@ -341,46 +380,7 @@ function CodePage({ session, codeWorkspaceId }) {
               title: "Forward a port",
               children: "+ Port"
             }
-          ),
-          portForwards.length > 0 && /* @__PURE__ */ jsx("div", { className: "flex items-center gap-1 ml-auto", children: portForwards.map((pf) => /* @__PURE__ */ jsxs(
-            "div",
-            {
-              className: "flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium font-mono text-muted-foreground shrink-0 whitespace-nowrap rounded-t-md border border-b-0 border-emerald-500/30 bg-emerald-500/5",
-              children: [
-                /* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-emerald-500" }),
-                /* @__PURE__ */ jsxs("span", { children: [
-                  ":",
-                  pf.port
-                ] }),
-                /* @__PURE__ */ jsx(
-                  "button",
-                  {
-                    className: "hover:text-emerald-400 transition-colors",
-                    onClick: () => window.open(pf.url, "_blank"),
-                    title: `Open ${pf.url}`,
-                    children: /* @__PURE__ */ jsxs("svg", { width: "10", height: "10", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
-                      /* @__PURE__ */ jsx("path", { d: "M7 3H3v10h10V9" }),
-                      /* @__PURE__ */ jsx("path", { d: "M10 2h4v4" }),
-                      /* @__PURE__ */ jsx("path", { d: "M14 2L7 9" })
-                    ] })
-                  }
-                ),
-                /* @__PURE__ */ jsx(
-                  "button",
-                  {
-                    className: "hover:text-destructive transition-colors",
-                    onClick: () => handleStopPort(pf.port),
-                    title: "Stop forwarding",
-                    children: /* @__PURE__ */ jsxs("svg", { width: "10", height: "10", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2.5", strokeLinecap: "round", children: [
-                      /* @__PURE__ */ jsx("line", { x1: "4", y1: "4", x2: "12", y2: "12" }),
-                      /* @__PURE__ */ jsx("line", { x1: "12", y1: "4", x2: "4", y2: "12" })
-                    ] })
-                  }
-                )
-              ]
-            },
-            pf.port
-          )) })
+          )
         ] }),
         /* @__PURE__ */ jsxs("div", { style: { position: "relative", flex: 1, minHeight: 0, display: "flex", flexDirection: "column" }, children: [
           showDiff && /* @__PURE__ */ jsx("div", { style: { position: "absolute", inset: 0, zIndex: 20, display: "flex", flexDirection: "column" }, children: /* @__PURE__ */ jsx(DiffViewer, { workspaceId: codeWorkspaceId, diffStats, onClose: () => setShowDiff(false) }) }),

package/lib/code/code-page.jsx

@@ -356,6 +356,42 @@ export default function CodePage({ session, codeWorkspaceId }) {
                 </div>
               )}
 
+              {/* Active port forwards */}
+              {portForwards.length > 0 && (
+                <div className="flex items-center gap-1">
+                  {portForwards.map((pf) => (
+                    <div
+                      key={pf.port}
+                      className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium font-mono text-muted-foreground shrink-0 whitespace-nowrap rounded-t-md border border-b-0 border-emerald-500/30 bg-emerald-500/5"
+                    >
+                      <div className="w-1.5 h-1.5 rounded-full bg-emerald-500" />
+                      <span>:{pf.port}</span>
+                      <button
+                        className="hover:text-emerald-400 transition-colors"
+                        onClick={() => window.open(pf.url, '_blank')}
+                        title={`Open ${pf.url}`}
+                      >
+                        <svg width="10" height="10" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
+                          <path d="M7 3H3v10h10V9" />
+                          <path d="M10 2h4v4" />
+                          <path d="M14 2L7 9" />
+                        </svg>
+                      </button>
+                      <button
+                        className="hover:text-destructive transition-colors"
+                        onClick={() => handleStopPort(pf.port)}
+                        title="Stop forwarding"
+                      >
+                        <svg width="10" height="10" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="2.5" strokeLinecap="round">
+                          <line x1="4" y1="4" x2="12" y2="12" />
+                          <line x1="12" y1="4" x2="4" y2="12" />
+                        </svg>
+                      </button>
+                    </div>
+                  ))}
+                </div>
+              )}
+
               {/* Divider between real tabs and + buttons */}
               <div className="self-stretch my-1.5 mx-1 md:mx-4 w-px bg-border shrink-0" />
 
@@ -392,42 +428,6 @@ export default function CodePage({ session, codeWorkspaceId }) {
               >
                 + Port
               </button>
-
-              {/* Active port forwards */}
-              {portForwards.length > 0 && (
-                <div className="flex items-center gap-1 ml-auto">
-                  {portForwards.map((pf) => (
-                    <div
-                      key={pf.port}
-                      className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium font-mono text-muted-foreground shrink-0 whitespace-nowrap rounded-t-md border border-b-0 border-emerald-500/30 bg-emerald-500/5"
-                    >
-                      <div className="w-1.5 h-1.5 rounded-full bg-emerald-500" />
-                      <span>:{pf.port}</span>
-                      <button
-                        className="hover:text-emerald-400 transition-colors"
-                        onClick={() => window.open(pf.url, '_blank')}
-                        title={`Open ${pf.url}`}
-                      >
-                        <svg width="10" height="10" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
-                          <path d="M7 3H3v10h10V9" />
-                          <path d="M10 2h4v4" />
-                          <path d="M14 2L7 9" />
-                        </svg>
-                      </button>
-                      <button
-                        className="hover:text-destructive transition-colors"
-                        onClick={() => handleStopPort(pf.port)}
-                        title="Stop forwarding"
-                      >
-                        <svg width="10" height="10" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="2.5" strokeLinecap="round">
-                          <line x1="4" y1="4" x2="12" y2="12" />
-                          <line x1="12" y1="4" x2="4" y2="12" />
-                        </svg>
-                      </button>
-                    </div>
-                  ))}
-                </div>
-              )}
             </div>
 
             {/* Tab content panels — all mounted, hidden via display */}

package/lib/code/port-forwards.js

@@ -98,7 +98,10 @@ export function clearWorkspaceForwards(workspaceId) {
 
 /**
  * Write Traefik dynamic config as YAML for all active port forwards.
- * Routes use *.localhost for local dev. No TLS on forwarded ports.
+ *
+ * When SSL_DOMAIN is set (custom compose with Let's Encrypt), routes use
+ * *.SSL_DOMAIN on the websecure entrypoint with the letsencrypt cert resolver.
+ * Otherwise, routes use *.localhost on the web entrypoint (local dev).
  *
  * MUST be YAML, not JSON — Traefik's file provider treats backticks in
  * JSON as Go template delimiters, silently breaking Host() rules.
@@ -125,14 +128,25 @@ function writeTraefikConfig() {
     return;
   }
 
+  const sslDomain = process.env.SSL_DOMAIN;
+  const entrypoint = sslDomain ? 'websecure' : 'web';
+
   const lines = ['http:', '  routers:'];
   for (const { workspaceId, port } of entries) {
     const key = `wksp-${workspaceId}-${port}`;
-    const host = `${workspaceId.slice(0, 8)}-${port}.localhost`;
+    const subdomain = `${workspaceId.slice(0, 8)}-${port}`;
+    const host = sslDomain ? `${subdomain}.${sslDomain}` : `${subdomain}.localhost`;
     lines.push(`    ${key}:`);
     lines.push('      rule: Host(`' + host + '`)');
     lines.push('      entryPoints:');
-    lines.push('        - web');
+    lines.push(`        - ${entrypoint}`);
+    if (sslDomain) {
+      lines.push('      tls:');
+      lines.push('        certResolver: letsencrypt');
+      lines.push('        domains:');
+      lines.push(`          - main: ${sslDomain}`);
+      lines.push(`            sans: "*.${sslDomain}"`);
+    }
     lines.push(`      service: ${key}`);
   }
   lines.push('  services:');

package/lib/code/terminal-view.js

@@ -54,6 +54,7 @@ function TerminalView({ codeWorkspaceId, wsPath, isActive = true, showToolbar =
   const [voiceText, setVoiceText] = useState("");
   const [partialText, setPartialText] = useState("");
   const voiceDialogRef = useRef(null);
+  const voiceTextareaRef = useRef(null);
   const volumeRef = useRef(0);
   const { voiceAvailable, isConnecting, isRecording, startRecording, stopRecording } = useVoiceInput({
     getToken: getVoiceToken,
@@ -318,6 +319,11 @@ function TerminalView({ codeWorkspaceId, wsPath, isActive = true, showToolbar =
     document.addEventListener("keydown", handler);
     return () => document.removeEventListener("keydown", handler);
   }, [voiceDialogOpen, closeVoiceDialog]);
+  useEffect(() => {
+    if (voiceTextareaRef.current) {
+      voiceTextareaRef.current.scrollTop = voiceTextareaRef.current.scrollHeight;
+    }
+  }, [voiceText, partialText]);
   const themeIcon = termTheme === "light" ? /* @__PURE__ */ jsxs("svg", { width: "14", height: "14", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "1.5", strokeLinecap: "round", children: [
     /* @__PURE__ */ jsx("circle", { cx: "8", cy: "8", r: "3" }),
     /* @__PURE__ */ jsx("line", { x1: "8", y1: "1", x2: "8", y2: "3" }),
@@ -638,6 +644,7 @@ function TerminalView({ codeWorkspaceId, wsPath, isActive = true, showToolbar =
                   /* @__PURE__ */ jsx(
                     "textarea",
                     {
+                      ref: voiceTextareaRef,
                       rows: 6,
                       value: voiceText + (partialText ? (voiceText && !voiceText.endsWith(" ") ? " " : "") + partialText : ""),
                       onChange: (e) => {
@@ -675,6 +682,15 @@ function TerminalView({ codeWorkspaceId, wsPath, isActive = true, showToolbar =
                   ] })
                 ] })
               ] }),
+              diffStats?.currentBranch && /* @__PURE__ */ jsx(
+                "button",
+                {
+                  className: "code-toolbar-btn",
+                  style: { cursor: "default", opacity: 0.7, maxWidth: 140, overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" },
+                  title: diffStats.currentBranch,
+                  children: diffStats.currentBranch
+                }
+              ),
               /* @__PURE__ */ jsx(
                 ToolbarCommandButton,
                 {

package/lib/code/terminal-view.jsx

@@ -64,6 +64,7 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
   const [voiceText, setVoiceText] = useState('');
   const [partialText, setPartialText] = useState('');
   const voiceDialogRef = useRef(null);
+  const voiceTextareaRef = useRef(null);
   const volumeRef = useRef(0);
 
   const { voiceAvailable, isConnecting, isRecording, startRecording, stopRecording } = useVoiceInput({
@@ -378,6 +379,13 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
     return () => document.removeEventListener('keydown', handler);
   }, [voiceDialogOpen, closeVoiceDialog]);
 
+  // Auto-scroll voice textarea to bottom as text grows
+  useEffect(() => {
+    if (voiceTextareaRef.current) {
+      voiceTextareaRef.current.scrollTop = voiceTextareaRef.current.scrollHeight;
+    }
+  }, [voiceText, partialText]);
+
   const themeIcon = termTheme === 'light' ? (
     <svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round">
       <circle cx="8" cy="8" r="3" />
@@ -710,6 +718,7 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
                   {voiceDialogOpen && (
                     <div className="code-voice-dialog">
                       <textarea
+                        ref={voiceTextareaRef}
                         rows={6}
                         value={voiceText + (partialText ? (voiceText && !voiceText.endsWith(' ') ? ' ' : '') + partialText : '')}
                         onChange={(e) => { setVoiceText(e.target.value); setPartialText(''); }}
@@ -741,6 +750,15 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
                   )}
                 </div>
               )}
+              {diffStats?.currentBranch && (
+                <button
+                  className="code-toolbar-btn"
+                  style={{ cursor: 'default', opacity: 0.7, maxWidth: 140, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}
+                  title={diffStats.currentBranch}
+                >
+                  {diffStats.currentBranch}
+                </button>
+              )}
               <ToolbarCommandButton
                 codeWorkspaceId={codeWorkspaceId}
                 diffStats={diffStats}

package/lib/config.js

@@ -54,6 +54,9 @@ const CONFIG_KEYS = new Set([
   'CODING_AGENT_OPENCODE_ENABLED',
   'CODING_AGENT_OPENCODE_PROVIDER',
   'CODING_AGENT_OPENCODE_MODEL',
+  'CODING_AGENT_KIMI_CLI_ENABLED',
+  'CODING_AGENT_KIMI_CLI_PROVIDER',
+  'CODING_AGENT_KIMI_CLI_MODEL',
 ]);
 
 // Default values
@@ -69,6 +72,7 @@ const DEFAULTS = {
   CODING_AGENT_CODEX_CLI_ENABLED: 'false',
   CODING_AGENT_CODEX_CLI_AUTH: 'api-key',
   CODING_AGENT_OPENCODE_ENABLED: 'false',
+  CODING_AGENT_KIMI_CLI_ENABLED: 'false',
 };
 
 // In-memory cache on globalThis to survive Next.js webpack chunk duplication.

package/lib/cron.js

@@ -1,7 +1,7 @@
 import cron from 'node-cron';
 import fs from 'fs';
 import path from 'path';
-import { cronsFile, cronDir } from './paths.js';
+import { PROJECT_ROOT } from './paths.js';
 import { executeAction } from './actions.js';
 
 function getInstalledVersion() {
@@ -231,7 +231,7 @@ function startBuiltinCrons() {
  * @returns {Array} - Array of scheduled cron tasks
  */
 function loadCrons() {
-  const cronFile = cronsFile;
+  const cronFile = path.join(PROJECT_ROOT, 'agent-job/CRONS.json');
 
   console.log('\n--- Cron Jobs ---');
 
@@ -255,7 +255,7 @@ function loadCrons() {
 
     const task = cron.schedule(schedule, async () => {
       try {
-        const result = await executeAction(cronEntry, { cwd: cronDir });
+        const result = await executeAction(cronEntry, { cwd: PROJECT_ROOT });
         console.log(`[CRON] ${name}: ${result || 'ran'}`);
         console.log(`[CRON] ${name}: completed!`);
       } catch (err) {

package/lib/db/api-keys.js

@@ -5,9 +5,6 @@ import { settings } from './schema.js';
 
 const KEY_PREFIX = 'tpb_';
 
-// In-memory cache: array of { id, keyHash } or null (not loaded)
-let _cache = null;
-
 /**
  * Generate a new API key: tpb_ + 64 hex chars (32 random bytes).
  * @returns {string}
@@ -25,44 +22,6 @@ export function hashApiKey(key) {
   return createHash('sha256').update(key).digest('hex');
 }
 
-/**
- * Lazy-load all API key hashes into the in-memory cache.
- */
-function _ensureCache() {
-  if (_cache !== null) return _cache;
-
-  const db = getDb();
-  const ONE_HOUR = 60 * 60 * 1000;
-  const cutoff = Date.now() - ONE_HOUR;
-
-  const rows = db
-    .select()
-    .from(settings)
-    .where(eq(settings.type, 'api_key'))
-    .all();
-
-  const jobKeyRows = db
-    .select()
-    .from(settings)
-    .where(eq(settings.type, 'agent_job_api_key'))
-    .all()
-    .filter(r => r.lastUsedAt !== null ? r.lastUsedAt > cutoff : r.createdAt > cutoff);
-
-  _cache = [...rows, ...jobKeyRows].map((row) => {
-    const parsed = JSON.parse(row.value);
-    return { id: row.id, keyHash: parsed.key_hash, type: row.type };
-  });
-
-  return _cache;
-}
-
-/**
- * Clear the in-memory cache (call after create/delete).
- */
-export function invalidateApiKeyCache() {
-  _cache = null;
-}
-
 /**
  * Create a new named API key.
  * @param {string} name - Human-readable name for the key
@@ -89,7 +48,6 @@ export function createApiKeyRecord(name, createdBy) {
   };
 
   db.insert(settings).values(record).run();
-  invalidateApiKeyCache();
 
   return {
     key,
@@ -143,7 +101,6 @@ export function getApiKey() {
 export function deleteApiKeyById(id) {
   const db = getDb();
   db.delete(settings).where(eq(settings.id, id)).run();
-  invalidateApiKeyCache();
 }
 
 /**
@@ -152,11 +109,11 @@ export function deleteApiKeyById(id) {
 export function deleteApiKey() {
   const db = getDb();
   db.delete(settings).where(eq(settings.type, 'api_key')).run();
-  invalidateApiKeyCache();
 }
 
 /**
- * Verify a raw API key against all cached hashes.
+ * Verify a raw API key against stored hashes.
+ * Queries the database directly on each call (SQLite is in-process, no caching needed).
  * @param {string} rawKey - Raw API key from request header
  * @returns {object|null} Record if valid, null otherwise
  */
@@ -164,27 +121,32 @@ export function verifyApiKey(rawKey) {
   if (!rawKey || !rawKey.startsWith(KEY_PREFIX)) return null;
 
   const keyHash = hashApiKey(rawKey);
-  const cached = _ensureCache();
+  const db = getDb();
 
-  if (!cached || cached.length === 0) return null;
+  const rows = [
+    ...db.select().from(settings).where(eq(settings.type, 'api_key')).all(),
+    ...db.select().from(settings).where(eq(settings.type, 'agent_job_api_key')).all(),
+  ];
+
+  if (rows.length === 0) return null;
 
   const b = Buffer.from(keyHash, 'hex');
 
-  for (const entry of cached) {
-    const a = Buffer.from(entry.keyHash, 'hex');
+  for (const row of rows) {
+    const parsed = JSON.parse(row.value);
+    const a = Buffer.from(parsed.key_hash, 'hex');
     if (a.length === b.length && timingSafeEqual(a, b)) {
-      // Update last_used_at column directly (non-blocking)
+      // Update last_used_at
       try {
-        const db = getDb();
         const now = Date.now();
         db.update(settings)
           .set({ lastUsedAt: now, updatedAt: now })
-          .where(eq(settings.id, entry.id))
+          .where(eq(settings.id, row.id))
           .run();
-      } catch {
-        // Non-fatal: last_used_at is informational
+      } catch (err) {
+        console.error('[api-keys] Failed to update last_used_at:', err.message);
       }
-      return entry;
+      return { id: row.id, keyHash: parsed.key_hash, type: row.type };
     }
   }
 
@@ -192,12 +154,12 @@ export function verifyApiKey(rawKey) {
 }
 
 /**
- * Create a per-job API key for an agent job container.
- * Stored as type 'agent_job_api_key'. Valid for 1 hour since last use.
- * @param {string} jobId - Agent job ID (stored as key column for traceability)
+ * Create a per-container API key for agent secret access.
+ * Stored as type 'agent_job_api_key' with the container name in the key column.
+ * @param {string} containerName - Docker container name (used for cleanup)
  * @returns {{ key: string }} The raw API key to inject into the container
  */
-export function createAgentJobApiKey(jobId) {
+export function createAgentJobApiKey(containerName) {
   const db = getDb();
   const key = generateApiKey();
   const keyHash = hashApiKey(key);
@@ -205,12 +167,11 @@ export function createAgentJobApiKey(jobId) {
   db.insert(settings).values({
     id: randomUUID(),
     type: 'agent_job_api_key',
-    key: jobId,
+    key: containerName,
     value: JSON.stringify({ key_hash: keyHash }),
     createdAt: now,
     updatedAt: now,
   }).run();
-  invalidateApiKeyCache();
   return { key };
 }
 

package/lib/db/config.js

@@ -254,6 +254,29 @@ export function setAgentJobSecret(key, value, userId) {
     .run();
 }
 
+/**
+ * Get OAuth credentials stored with an agent job secret.
+ * Returns { clientId, clientSecret, tokenUrl } if the secret is oauth2, null otherwise.
+ * @param {string} key
+ */
+export function getAgentJobSecretOAuthCredentials(key) {
+  const db = getDb();
+  const row = db
+    .select({ value: settings.value })
+    .from(settings)
+    .where(and(eq(settings.type, 'agent_job_secret'), eq(settings.key, key)))
+    .get();
+  if (!row) return null;
+  try {
+    const decrypted = decrypt(JSON.parse(row.value));
+    const parsed = JSON.parse(decrypted);
+    if (parsed.type === 'oauth2' && parsed.clientId && parsed.clientSecret) {
+      return { clientId: parsed.clientId, clientSecret: parsed.clientSecret, tokenUrl: parsed.tokenUrl };
+    }
+  } catch {}
+  return null;
+}
+
 /**
  * Delete an agent job secret.
  * @param {string} key

package/lib/db/index.js

@@ -3,10 +3,12 @@ import path from 'path';
 import Database from 'better-sqlite3';
 import { drizzle } from 'drizzle-orm/better-sqlite3';
 import { migrate } from 'drizzle-orm/better-sqlite3/migrator';
-import { thepopebotDb, PROJECT_ROOT } from '../paths.js';
+import { PROJECT_ROOT } from '../paths.js';
 import * as schema from './schema.js';
 import { backfillLastUsedAt } from './api-keys.js';
 
+const thepopebotDb = process.env.DATABASE_PATH || path.join(PROJECT_ROOT, 'data/db/thepopebot.sqlite');
+
 let _db = null;
 
 /**

package/lib/maintenance.js

@@ -2,34 +2,57 @@ import cron from 'node-cron';
 import { eq } from 'drizzle-orm';
 import { getDb } from './db/index.js';
 import { settings } from './db/schema.js';
-import { invalidateApiKeyCache } from './db/api-keys.js';
 
-const ONE_HOUR = 60 * 60 * 1000;
+const TWENTY_FOUR_HOURS = 24 * 60 * 60 * 1000;
 
-function cleanExpiredAgentJobKeys() {
+async function cleanExpiredAgentJobKeys() {
   try {
     const db = getDb();
-    const cutoff = Date.now() - ONE_HOUR;
+    const cutoff = Date.now() - TWENTY_FOUR_HOURS;
     const rows = db
-      .select({ id: settings.id, lastUsedAt: settings.lastUsedAt, createdAt: settings.createdAt })
+      .select({ id: settings.id, key: settings.key, lastUsedAt: settings.lastUsedAt, createdAt: settings.createdAt })
       .from(settings)
       .where(eq(settings.type, 'agent_job_api_key'))
       .all();
-    const expiredIds = rows
-      .filter(r => r.lastUsedAt !== null ? r.lastUsedAt < cutoff : r.createdAt < cutoff)
-      .map(r => r.id);
+
+    // Filter to candidates not used in the last 24 hours
+    const candidates = rows.filter(r =>
+      (r.lastUsedAt !== null ? r.lastUsedAt : r.createdAt) < cutoff
+    );
+
+    if (candidates.length === 0) {
+      console.log(`[maintenance] No expired agent job keys (${rows.length} active)`);
+      return;
+    }
+
+    // Check if the container still exists for each candidate
+    const { inspectContainer } = await import('./tools/docker.js');
+    const expiredIds = [];
+    for (const r of candidates) {
+      const info = await inspectContainer(r.key);
+      if (!info) {
+        expiredIds.push(r.id);
+      }
+    }
+
     if (expiredIds.length > 0) {
       for (const id of expiredIds) {
         db.delete(settings).where(eq(settings.id, id)).run();
       }
-      invalidateApiKeyCache();
-      console.log(`[maintenance] Deleted ${expiredIds.length} expired agent job key(s)`);
+      console.log(`[maintenance] Deleted ${expiredIds.length} orphaned agent job key(s)`);
+    } else {
+      console.log(`[maintenance] ${candidates.length} candidate(s) checked, all containers still running`);
     }
   } catch (err) {
     console.error('[maintenance] cleanExpiredAgentJobKeys failed:', err);
   }
 }
 
+async function runMaintenance() {
+  console.log('[maintenance] Running maintenance...');
+  await cleanExpiredAgentJobKeys();
+}
+
 export function startMaintenanceCron() {
-  cron.schedule('0 * * * *', cleanExpiredAgentJobKeys);
+  cron.schedule('0 * * * *', runMaintenance);
 }