thepopebot 1.2.75-beta.2 → 1.2.75-beta.4

package/templates/docs/CONFIGURATION.md

@@ -29,70 +29,51 @@ Config markdown files support includes and built-in variables (processed by the
 
 ---
 
-## Environment Variables
+## Configuration Storage
 
-Set in `.env` in your project root. These configure the **Event Handler** (web chat, Telegram, webhooks, job summaries).
+Most settings are stored in the SQLite database (encrypted for secrets, plaintext for config). The admin UI is the primary way to manage them.
+
+`.env` is only for infrastructure variables that must exist before the database is available:
 
 | Variable | Description | Required |
 |----------|-------------|----------|
 | `APP_URL` | Public URL for webhooks and Telegram | Yes |
-| `AUTH_SECRET` | NextAuth session encryption (auto-generated) | Yes |
-| `GH_TOKEN` | GitHub PAT for creating branches/files | Yes |
+| `APP_HOSTNAME` | Hostname extracted from APP_URL | Yes |
+| `AUTH_SECRET` | Session encryption + DB secret key (auto-generated) | Yes |
 | `GH_OWNER` | GitHub repository owner | Yes |
 | `GH_REPO` | GitHub repository name | Yes |
-| `TELEGRAM_BOT_TOKEN` | Telegram bot token | For Telegram |
-| `TELEGRAM_WEBHOOK_SECRET` | Telegram webhook validation secret | No |
-| `TELEGRAM_CHAT_ID` | Default chat ID for notifications | For Telegram |
-| `GH_WEBHOOK_SECRET` | GitHub Actions webhook auth | For notifications |
-| `LLM_PROVIDER` | `anthropic`, `openai`, `google`, or `custom` | No (default: `anthropic`) |
-| `LLM_MODEL` | Model name override | No |
-| `LLM_MAX_TOKENS` | Max tokens for LLM responses | No (default: 4096) |
-| `ANTHROPIC_API_KEY` | Anthropic API key | For anthropic provider |
-| `OPENAI_API_KEY` | OpenAI API key / Whisper | For openai provider |
-| `CUSTOM_OPENAI_BASE_URL` | Custom OpenAI-compatible base URL | For custom provider |
-| `GOOGLE_API_KEY` | Google API key | For google provider |
-| `CUSTOM_API_KEY` | Custom provider API key | For custom provider |
-| `AGENT_BACKEND` | Agent runner: `pi` or `claude-code` | No (default: `claude-code`) |
-| `ASSEMBLYAI_API_KEY` | API key for voice transcription | For voice input |
-| `DATABASE_PATH` | Override SQLite DB location | No |
+| `DATABASE_PATH` | Override SQLite DB location (default: `data/db/thepopebot.sqlite`) | No |
+| `LETSENCRYPT_EMAIL` | Email for Let's Encrypt HTTPS certificates | For HTTPS |
 | `COMPOSE_FILE` | Override docker-compose file | No |
 
+All other settings (API keys, LLM config, Telegram, voice, coding agents) are managed via the admin UI and stored in the database.
+
 ---
 
 ## LLM Providers
 
 thepopebot has **two independent LLM configurations**:
 
-- **Event Handler** (chat, Telegram, webhooks, summaries) — configured via `.env`
-- **Jobs** (Docker agent on GitHub Actions) — configured via GitHub repo variables
-
-You can run different models for each. For example, Claude for interactive chat and a local Ollama model for jobs.
+- **Chat** (web chat, Telegram, webhooks, summaries) — configured at Admin > Event Handler > Chat
+- **Coding Agents** (code workspaces, agent jobs) — configured at Admin > Event Handler > Coding Agents
 
-| Provider | Example model | API key env var |
-|----------|---------------|-----------------|
-| `anthropic` (default) | `claude-sonnet-4-20250514` | `ANTHROPIC_API_KEY` |
-| `openai` | `gpt-4o` | `OPENAI_API_KEY` |
-| `google` | `gemini-2.5-pro` | `GOOGLE_API_KEY` |
-| `custom` | Any OpenAI-compatible API | `CUSTOM_API_KEY` + `CUSTOM_OPENAI_BASE_URL` |
-
-### Setting the Event Handler Model
-
-```bash
-# In .env
-LLM_PROVIDER=anthropic
-LLM_MODEL=claude-sonnet-4-20250514
-ANTHROPIC_API_KEY=sk-ant-...
-```
+You can run different models for each. Add API keys at **Admin > Event Handler > LLMs**.
 
-Restart your server after changes.
+### Built-in Providers
 
-### Setting the Default Job Model
+| Provider | Default model | API key |
+|----------|---------------|---------|
+| `anthropic` (default) | `claude-sonnet-4-6` | `ANTHROPIC_API_KEY` |
+| `openai` | `gpt-5.4` | `OPENAI_API_KEY` |
+| `google` | `gemini-2.5-flash` | `GOOGLE_API_KEY` |
+| `deepseek` | `deepseek-chat` | `DEEPSEEK_API_KEY` |
+| `minimax` | `MiniMax-M2.7` | `MINIMAX_API_KEY` |
+| `mistral` | `mistral-large-latest` | `MISTRAL_API_KEY` |
+| `xai` | `grok-4.20-0309-non-reasoning` | `XAI_API_KEY` |
+| `kimi` | `kimi-k2.5` | `MOONSHOT_API_KEY` |
+| `openrouter` | (user-specified) | `OPENROUTER_API_KEY` |
 
-```bash
-npx thepopebot set-var LLM_PROVIDER openai
-npx thepopebot set-var LLM_MODEL gpt-4o
-# Set API keys via admin UI: Settings > Agent Jobs > Secrets
-```
+Custom OpenAI-compatible providers can be added via Admin > Event Handler > LLMs. Supports multiple models, a base URL, and an optional API key (for Ollama, Together AI, LM Studio, etc.).
 
 ### Per-Job Overrides
 
@@ -105,33 +86,19 @@ Add `llm_provider` and `llm_model` to any agent-type entry in `CRONS.json` or `T
   "type": "agent",
   "job": "Review open PRs",
   "llm_provider": "openai",
-  "llm_model": "gpt-4o"
+  "llm_model": "gpt-5.4"
 }
 ```
 
-### Using the `custom` Provider
+### Local Models (Ollama, LM Studio)
 
-Point at any OpenAI-compatible endpoint (DeepSeek, Ollama, Together AI, etc.):
-
-```bash
-# Cloud custom (DeepSeek, Together AI, etc.)
-npx thepopebot set-var LLM_PROVIDER custom
-npx thepopebot set-var LLM_MODEL deepseek-chat
-npx thepopebot set-var CUSTOM_OPENAI_BASE_URL https://api.deepseek.com/v1
-# Set CUSTOM_API_KEY via admin UI: Settings > Agent Jobs > Secrets
-
-# Local custom (Ollama, LM Studio, etc.) — needs self-hosted runner
-npx thepopebot set-var RUNS_ON self-hosted
-npx thepopebot set-var LLM_PROVIDER custom
-npx thepopebot set-var LLM_MODEL qwen3:8b
-npx thepopebot set-var CUSTOM_OPENAI_BASE_URL http://host.docker.internal:11434/v1
-```
+Add a custom provider at Admin > Event Handler > LLMs with the base URL `http://host.docker.internal:11434/v1`. Containers use Docker networking to reach the host machine.
 
 ---
 
 ## Agent Job Secrets
 
-Agent job secrets are managed through the admin UI (Settings > Agent Jobs > Secrets). They are stored encrypted in SQLite and injected as env vars into Docker containers. The agent can discover available secrets via the `get-secret` skill.
+Agent job secrets are managed at **Admin > Event Handler > Agent Jobs**. They are stored encrypted in SQLite and injected as env vars into Docker containers. The agent can discover available secrets via the `get-secret` skill.
 
 ---
 
@@ -147,7 +114,7 @@ Agent job secrets are managed through the admin UI (Settings > Agent Jobs > Secr
 | `RUNS_ON` | GitHub Actions runner label | `ubuntu-latest` |
 | `LLM_PROVIDER` | LLM provider for Docker agent | `anthropic` |
 | `LLM_MODEL` | LLM model name for Docker agent | Provider default |
-| `AGENT_BACKEND` | Agent runner: `pi` or `claude-code` | `claude-code` |
+| `AGENT_BACKEND` | Agent runner: `claude-code`, `pi`, `gemini-cli`, `codex-cli`, `opencode` | `claude-code` |
 
 ---
 
@@ -172,7 +139,6 @@ Create a fine-grained PAT scoped to your repository:
 For self-hosted deployment:
 
 ```bash
-npm run build
 docker compose up -d
 ```
 

package/templates/docs/GETTING_STARTED.md

@@ -27,7 +27,7 @@ curl -X POST https://your-app-url/api/create-agent-job \
   -d '{"job": "Update the README with installation instructions"}'
 ```
 
-Generate API keys from **Settings > Secrets** in the web UI.
+Generate API keys at **Admin > Event Handler > Webhooks** in the web UI.
 
 ## Connect Telegram (Optional)
 

package/templates/docs/SECURITY.md

@@ -11,7 +11,7 @@ thepopebot includes these security measures by default:
 - **WebSocket authentication** — Code workspace WebSocket connections validate the session cookie.
 - **Secret filtering in Docker agent** — The `env-sanitizer` filters `AGENT_*` secrets from the LLM's bash subprocess.
 - **Auto-merge path restrictions** — `auto-merge.yml` only merges PRs where all changed files fall within `ALLOWED_PATHS` (default: `/logs`).
-- **Server Actions with session checks** — All browser-to-server mutations use `requireAuth()` session validation.
+- **Authenticated fetch route handlers** — All browser-to-server calls use `auth()` session validation.
 
 ---
 
@@ -27,7 +27,7 @@ thepopebot includes these security measures by default:
 
 ### Agent Job Secrets
 
-Agent job secrets are managed through the admin UI (Settings > Agent Jobs > Secrets). They are stored encrypted in SQLite and injected as env vars into Docker containers. The agent can discover available secrets via the `get-secret` skill.
+Agent job secrets are managed at **Admin > Event Handler > Agent Jobs**. They are stored encrypted in SQLite and injected as env vars into Docker containers. The agent can discover available secrets via the `get-secret` skill.
 
 ---
 
@@ -41,7 +41,7 @@ Keep `ALLOWED_PATHS` restrictive. Only widen it after reviewing what your agent
 
 ## API Keys
 
-Database-backed API keys are generated through the web UI (**Settings > Secrets**). Format: `tpb_` prefix + 64 hex characters. Keys are SHA-256 hashed in the database.
+Database-backed API keys are generated at **Admin > Event Handler > Webhooks**. Format: `tpb_` prefix + 64 hex characters. Keys are SHA-256 hashed in the database.
 
 ---
 

package/templates/docs/SKILLS.md

@@ -30,6 +30,7 @@ These ship with the package but must be activated manually:
 | Skill | Description |
 |-------|-------------|
 | `brave-search` | Web search and content extraction via Brave Search API |
+| `browser-tools` | Browser automation via Puppeteer (screenshots, navigation, interaction) |
 | `google-docs` | Create and manage Google Docs on a shared drive |
 | `google-drive` | Google Drive operations (list, upload, download, delete) |
 | `kie-ai` | AI image and video generation via kie.ai API |
@@ -102,7 +103,7 @@ If bash + curl isn't sufficient, use Node.js with a `package.json`. Dependencies
 
 ## Credential Setup
 
-If a skill needs an API key, add it via the admin UI (Settings > Agent Jobs > Secrets). The secret will be injected as an env var into Docker containers. The agent can discover available secrets via the `get-secret` skill.
+If a skill needs an API key, add it at **Admin > Event Handler > Agent Jobs**. The secret will be injected as an env var into Docker containers. The agent can discover available secrets via the `get-secret` skill.
 
 ---
 

package/templates/docker-compose.litellm.yml

@@ -1,82 +0,0 @@
-# Docker Compose configuration with LiteLLM proxy
-# To activate: set COMPOSE_FILE=docker-compose.litellm.yml in .env
-
-services:
-  traefik:
-    image: traefik:v3
-    command:
-      - --providers.docker=true
-      - --providers.docker.exposedByDefault=false
-      - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      ## Uncomment the following lines to enable TLS via Let's Encrypt
-      ## (requires LETSENCRYPT_EMAIL in .env):
-      # - --entrypoints.web.http.redirections.entrypoint.to=websecure
-      # - --entrypoints.web.http.redirections.entrypoint.scheme=https
-      # - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
-      # - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
-      # - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - traefik_certs:/letsencrypt
-    restart: unless-stopped
-
-  event-handler:
-    container_name: thepopebot-event-handler
-    image: ${EVENT_HANDLER_IMAGE_URL:-stephengpope/thepopebot:event-handler-${THEPOPEBOT_VERSION:-latest}}
-    volumes:
-      - .:/project
-      - ./config:/app/config
-      - ./skills:/app/skills
-      - ./.env:/app/.env
-      - ./data:/app/data
-      - ./logs:/app/logs
-      - ./cron:/app/cron
-      - ./triggers:/app/triggers
-      - ./CLAUDE.md:/app/CLAUDE.md
-      - /var/run/docker.sock:/var/run/docker.sock
-    labels:
-      - traefik.enable=true
-      # Set APP_HOSTNAME in .env to the domain from APP_URL (e.g., mybot.example.com)
-      - traefik.http.routers.event-handler.rule=Host(`${APP_HOSTNAME}`)
-      - traefik.http.routers.event-handler.entrypoints=web
-      - traefik.http.services.event-handler.loadbalancer.server.port=80
-      ## Uncomment the following lines to enable TLS via Let's Encrypt:
-      # - traefik.http.routers.event-handler.entrypoints=websecure
-      # - traefik.http.routers.event-handler.tls.certresolver=letsencrypt
-    stop_grace_period: 120s
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:80/api/ping"]
-      interval: 10s
-      timeout: 3s
-      retries: 3
-      start_period: 30s
-    restart: unless-stopped
-
-  runner:
-    image: myoung34/github-runner:latest
-    deploy:
-      replicas: ${RUNNER_REPLICAS:-1}
-    environment:
-      REPO_URL: https://github.com/${GH_OWNER}/${GH_REPO}
-      ACCESS_TOKEN: ${GH_TOKEN}
-      RUNNER_SCOPE: repo
-      LABELS: self-hosted
-      EPHEMERAL: "1"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - .:/project
-    restart: unless-stopped
-
-  litellm:
-    image: ghcr.io/berriai/litellm:main-latest
-    command: --config /litellm/main.yaml --port 4000
-    volumes:
-      - ./config/litellm:/litellm:ro
-    restart: unless-stopped
-
-volumes:
-  traefik_certs:

package/templates/traefik-dynamic.yml.example

@@ -1,7 +0,0 @@
-# Traefik dynamic config for Tailscale TLS
-# Copy this file to traefik-dynamic.yml and replace YOUR_HOSTNAME
-# with your full Tailscale machine name (e.g. mybot.taila1b2c3.ts.net)
-tls:
-  certificates:
-    - certFile: /certs/YOUR_HOSTNAME.crt
-      keyFile: /certs/YOUR_HOSTNAME.key