thepopebot 1.2.76-beta.2 → 1.2.76-beta.21

package/lib/code/terminal-view.jsx

@@ -211,7 +211,7 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
     term.open(containerRef.current);
 
     const style = document.createElement('style');
-    style.textContent = `.xterm { padding: 5px; background-color: ${theme.background} !important; } .xterm-viewport { background-color: ${theme.background} !important; } .xterm-rows span { pointer-events: none; }`;
+    style.textContent = `.xterm { padding: 5px; background-color: ${theme.background} !important; } .xterm-viewport { background-color: ${theme.background} !important; touch-action: none; } .xterm-rows span { pointer-events: none; }`;
     containerRef.current.appendChild(style);
     styleRef.current = style;
 
@@ -227,8 +227,13 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
 
     fitAddon.fit();
 
-    // Mobile touch scroll: translate finger swipes into terminal scrollLines()
-    const screenEl = containerRef.current.querySelector('.xterm-screen');
+    // Mobile touch scroll: xterm v5's .xterm-viewport is overflow-y:scroll and its
+    // scroll event listener syncs scrollTop → buffer position. touch-action:none on
+    // the viewport (injected above) prevents the compositor from natively scrolling
+    // it, so we manually translate finger swipes into scrollLines() calls. Capture
+    // phase + stopPropagation blocks xterm's own touch handlers on .xterm from
+    // also setting viewport.scrollTop.
+    const termContainer = containerRef.current;
     let lastTouchY = null;
     let touchScrollAccum = 0;
     const LINE_HEIGHT = 15; // approximate px per line at fontSize 16
@@ -238,6 +243,7 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
         lastTouchY = ev.touches[0].clientY;
         touchScrollAccum = 0;
       }
+      ev.stopPropagation();
     };
     const onTouchMove = (ev) => {
       if (lastTouchY === null || ev.touches.length !== 1) return;
@@ -251,14 +257,13 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
         touchScrollAccum -= lines * LINE_HEIGHT;
       }
       ev.preventDefault();
+      ev.stopPropagation();
     };
     const onTouchEnd = () => { lastTouchY = null; touchScrollAccum = 0; };
 
-    if (screenEl) {
-      screenEl.addEventListener('touchstart', onTouchStart, { passive: true });
-      screenEl.addEventListener('touchmove', onTouchMove, { passive: false });
-      screenEl.addEventListener('touchend', onTouchEnd, { passive: true });
-    }
+    termContainer.addEventListener('touchstart', onTouchStart, { passive: false, capture: true });
+    termContainer.addEventListener('touchmove', onTouchMove, { passive: false, capture: true });
+    termContainer.addEventListener('touchend', onTouchEnd, { passive: true, capture: true });
 
     term.onData((data) => {
       const ws = wsRef.current;
@@ -302,11 +307,9 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
       clearTimeout(resizeTimeout);
       clearTimeout(retryTimer.current);
       window.removeEventListener('resize', handleResize);
-      if (screenEl) {
-        screenEl.removeEventListener('touchstart', onTouchStart);
-        screenEl.removeEventListener('touchmove', onTouchMove);
-        screenEl.removeEventListener('touchend', onTouchEnd);
-      }
+      termContainer.removeEventListener('touchstart', onTouchStart, { capture: true });
+      termContainer.removeEventListener('touchmove', onTouchMove, { capture: true });
+      termContainer.removeEventListener('touchend', onTouchEnd, { capture: true });
       if (wsRef.current) wsRef.current.close();
       term.dispose();
     };
@@ -839,7 +842,7 @@ export default function TerminalView({ codeWorkspaceId, wsPath, isActive = true,
   );
 }
 
-const STORAGE_KEY = 'thepopebot-workspace-command';
+const STORAGE_KEY = 'thepopebot-workspace-command:code';
 
 function ToolbarCommandButton({ codeWorkspaceId, diffStats, onDiffStatsRefresh, onShowDiff }) {
   const [selectedCommand, setSelectedCommandState] = useState(() => {
@@ -849,6 +852,21 @@ function ToolbarCommandButton({ codeWorkspaceId, diffStats, onDiffStatsRefresh,
     setSelectedCommandState(cmd);
     try { localStorage.setItem(STORAGE_KEY, cmd); } catch {}
   };
+
+  // Seed from admin default if user hasn't picked anything for code mode yet.
+  useEffect(() => {
+    let stored = null;
+    try { stored = localStorage.getItem(STORAGE_KEY); } catch {}
+    if (stored) return;
+    let cancelled = false;
+    import('../chat/actions.js').then(({ getModeGitActionDefault }) => {
+      getModeGitActionDefault('code').then((val) => {
+        if (cancelled || !val) return;
+        setSelectedCommandState(val);
+      }).catch(() => {});
+    }).catch(() => {});
+    return () => { cancelled = true; };
+  }, []);
   const [commandRunning, setCommandRunning] = useState(false);
   const [dialogOpen, setDialogOpen] = useState(false);
   const [commandOutput, setCommandOutput] = useState('');
@@ -869,15 +887,6 @@ function ToolbarCommandButton({ codeWorkspaceId, diffStats, onDiffStatsRefresh,
   const handleRun = useCallback(async () => {
     if (commandRunning) return;
 
-    const fresh = await onDiffStatsRefresh?.();
-    const stats = fresh || diffStats;
-    if (!(stats?.insertions || 0) && !(stats?.deletions || 0)) {
-      setDialogOpen(true);
-      setCommandOutput('You have no changes.');
-      setCommandExitCode(1);
-      return;
-    }
-
     setCommandRunning(true);
     setDialogOpen(true);
     setCommandOutput('');

package/lib/config.js

@@ -37,7 +37,6 @@ const CONFIG_KEYS = new Set([
   'LLM_MAX_TOKENS',
   'AGENT_BACKEND',
   'CUSTOM_OPENAI_BASE_URL',
-  'TELEGRAM_CHAT_ID',
   'UPGRADE_INCLUDE_BETA',
   'CODING_AGENT',
   'CODING_AGENT_CLAUDE_CODE_ENABLED',
@@ -58,6 +57,10 @@ const CONFIG_KEYS = new Set([
   'CODING_AGENT_KIMI_CLI_ENABLED',
   'CODING_AGENT_KIMI_CLI_PROVIDER',
   'CODING_AGENT_KIMI_CLI_MODEL',
+  'AGENT_MODE_BRANCH',
+  'CODE_MODE_BRANCH',
+  'AGENT_MODE_GIT_ACTION',
+  'CODE_MODE_GIT_ACTION',
 ]);
 
 // Default values
@@ -74,6 +77,10 @@ const DEFAULTS = {
   CODING_AGENT_CODEX_CLI_AUTH: 'api-key',
   CODING_AGENT_OPENCODE_ENABLED: 'false',
   CODING_AGENT_KIMI_CLI_ENABLED: 'false',
+  AGENT_MODE_BRANCH: 'default',
+  CODE_MODE_BRANCH: 'dynamic',
+  AGENT_MODE_GIT_ACTION: 'push',
+  CODE_MODE_GIT_ACTION: 'create-pr',
 };
 
 // In-memory cache on globalThis to survive Next.js webpack chunk duplication.
@@ -120,7 +127,13 @@ export function getConfig(key) {
 
   // Infrastructure keys: fall back to .env (these live in .env, not exclusively in DB)
   if (value === undefined) {
-    const ENV_KEYS = ['GH_OWNER', 'GH_REPO', 'GH_TOKEN', 'APP_URL', 'APP_HOSTNAME'];
+    const ENV_KEYS = [
+      'GH_OWNER',
+      'GH_REPO',
+      'GH_TOKEN',
+      'APP_URL',
+      'APP_HOSTNAME',
+    ];
     if (ENV_KEYS.includes(key)) {
       value = process.env[key];
     }
@@ -147,6 +160,4 @@ export function getConfig(key) {
  */
 export function invalidateConfigCache() {
   _cache.clear();
-  // Reset agent singletons so they pick up new config
-  import('./ai/agent.js').then(({ resetAgentChats }) => resetAgentChats()).catch(() => {});
 }

package/lib/containers/CLAUDE.md

@@ -1,9 +1,19 @@
 # lib/containers/ — Container Streaming
 
-`stream.js` exports `GET(request)` — an SSE route handler for real-time Docker container monitoring.
+Two SSE endpoints — both authenticated via `auth()` session.
 
-**Endpoint**: `/stream/containers` (actual SSE streaming, stays in `/stream/`)
-**Auth**: `auth()` session check
-**Events**: `containers` (every 3s with full container list + CPU/memory stats), `ping` (keepalive every 15s)
-**Data source**: `listNetworkContainers()` + `getContainerStats()` from `lib/tools/docker.js`
-**Client**: `ContainersPage` connects via `new EventSource('/stream/containers')`
+## `stream.js` — Container Status
+
+- **Endpoint**: `/stream/containers`
+- **Events**: `containers` (every 3s with full container list + CPU/memory stats), `ping` (keepalive every 15s)
+- **Data source**: `listNetworkContainers()` + `getContainerStats()` from `lib/tools/docker.js`. Filtered to containers on the event-handler's Docker network (auto-detected at boot).
+- **Client**: `ContainersPage` connects via `new EventSource('/stream/containers')`
+
+## `logs.js` — Container Log Tail
+
+- **Endpoint**: `/stream/containers/logs?name=<containerName>`
+- **Events**: raw log lines as SSE `data:` frames
+- **Data source**: Docker `containers/{id}/logs?follow=true&stdout=1&stderr=1` via the multiplexed-stream parser in `lib/tools/docker.js`
+- **Client**: `ContainerLogsView` (used from the Containers admin page when a row's logs are expanded)
+
+Both endpoints share the same network filter and frame-decoding logic so all SSE consumers see the same view.

package/lib/db/CLAUDE.md

@@ -25,11 +25,12 @@ Key files: `schema.js` (source of truth), `drizzle/` (generated migrations), `dr
 | `users` | Admin accounts (email, bcrypt password hash, role) |
 | `chats` | Chat sessions (user_id, title, starred, chat_mode, code_workspace_id, timestamps) |
 | `messages` | Chat messages (chat_id, role, content) |
-| `code_workspaces` | Code workspace containers (user_id, container_name, repo, branch, feature_branch, title, last_interactive_commit, starred, has_changes) |
+| `code_workspaces` | Code workspace containers (user_id, container_name, repo, branch, feature_branch, title, last_interactive_commit, coding_agent, scope, starred, has_changes) |
 | `notifications` | Job completion notifications (notification text, payload, read status) |
 | `subscriptions` | Channel subscriptions (platform, channel_id) |
+| `user_channels` | Per-user channel linking (user_id, channel, channel_chat_id, code, code_expires_at, verified_at, active_thread_id) — Telegram verification + active thread |
 | `clusters` | Worker clusters (user_id, name, system_prompt, folders, enabled, starred) |
-| `cluster_roles` | Role definitions scoped to a cluster (cluster_id, role_name, role, trigger_config, max_concurrency, cleanup_worker_dir, folders) |
+| `cluster_roles` | Role definitions scoped to a cluster (cluster_id, role_name, role, trigger_config, max_concurrency, plan_mode, cleanup_worker_dir, folders) |
 | `settings` | Key-value configuration store (also stores API keys and OAuth tokens via type/key/value) |
 
 ## OAuth Token Storage
@@ -64,3 +65,5 @@ OAuth tokens for coding agent backends are stored as `config_secret` with LRU ro
 - `chats.chatMode` — `'agent'` (default) or `'code'`. Determines which agent singleton and tools are used.
 - `codeWorkspaces.featureBranch` — tracks the git feature branch for the workspace session.
 - `codeWorkspaces.hasChanges` — flag set when workspace has uncommitted changes.
+- `codeWorkspaces.codingAgent` — per-workspace coding-agent override. Falls back to global `CODING_AGENT` config, then `claude-code` (`lib/code/actions.js:410`).
+- `codeWorkspaces.scope` — subdirectory scope within the repo (e.g., `agents/gary-vee`). Resolves the agent's working directory and skills (`lib/ai/scope.js`).

package/lib/db/chats.js

@@ -100,23 +100,6 @@ export function deleteChat(chatId) {
   db.delete(chats).where(eq(chats.id, chatId)).run();
 }
 
-/**
- * Delete all chats and messages for a user.
- * @param {string} userId
- */
-export function deleteAllChatsByUser(userId) {
-  const db = getDb();
-  const userChats = db
-    .select({ id: chats.id })
-    .from(chats)
-    .where(eq(chats.userId, userId))
-    .all();
-
-  for (const chat of userChats) {
-    db.delete(messages).where(eq(messages.chatId, chat.id)).run();
-  }
-  db.delete(chats).where(eq(chats.userId, userId)).run();
-}
 
 /**
  * Get all messages for a chat, ordered by creation time.
@@ -146,6 +129,15 @@ export function linkChatToWorkspace(chatId, workspaceId) {
     .run();
 }
 
+/**
+ * Touch a chat's updatedAt timestamp.
+ * @param {string} chatId
+ */
+export function touchChatUpdatedAt(chatId) {
+  const db = getDb();
+  db.update(chats).set({ updatedAt: Date.now() }).where(eq(chats.id, chatId)).run();
+}
+
 /**
  * Save a message to a chat. Also updates the chat's updatedAt timestamp.
  * @param {string} chatId

package/lib/db/code-workspaces.js

@@ -14,7 +14,7 @@ import { codeWorkspaces } from './schema.js';
  * @param {string} [options.id] - Optional ID (UUID). Generated if not provided.
  * @returns {object} The created workspace
  */
-export function createCodeWorkspace(userId, { containerName = null, repo = null, branch = null, title = 'Code Workspace', id = null } = {}) {
+export function createCodeWorkspace(userId, { containerName = null, repo = null, branch = null, scope = null, title = 'Code Workspace', id = null } = {}) {
   const db = getDb();
   const now = Date.now();
   const workspace = {
@@ -23,6 +23,7 @@ export function createCodeWorkspace(userId, { containerName = null, repo = null,
     containerName,
     repo,
     branch,
+    scope,
     title,
     createdAt: now,
     updatedAt: now,
@@ -33,13 +34,17 @@ export function createCodeWorkspace(userId, { containerName = null, repo = null,
 
 /**
  * Update the container name on an existing workspace (when Docker launches).
+ * Also stores the coding agent used so recovery can recreate with the same agent.
  * @param {string} id - Workspace ID
  * @param {string} containerName - Docker container name
+ * @param {string} [codingAgent] - Coding agent identifier (e.g. 'claude-code', 'codex-cli')
  */
-export function updateContainerName(id, containerName) {
+export function updateContainerName(id, containerName, codingAgent) {
   const db = getDb();
+  const set = { containerName, updatedAt: Date.now() };
+  if (codingAgent !== undefined) set.codingAgent = codingAgent;
   db.update(codeWorkspaces)
-    .set({ containerName, updatedAt: Date.now() })
+    .set(set)
     .where(eq(codeWorkspaces.id, id))
     .run();
 }

package/lib/db/config.js

@@ -381,7 +381,6 @@ const MIGRATE_CONFIG = [
   'LLM_MAX_TOKENS',
   'AGENT_BACKEND',
   'CUSTOM_OPENAI_BASE_URL',
-  'TELEGRAM_CHAT_ID',
 ];
 
 /**

package/lib/db/index.js

@@ -50,6 +50,18 @@ export function initDatabase() {
 
   migrate(db, { migrationsFolder });
 
+  // One-shot cleanup: drop orphan LangGraph checkpoint tables left behind by
+  // @langchain/langgraph-checkpoint-sqlite. The React agent has been removed —
+  // these tables are never read or written again. Safe to run on every boot
+  // (IF EXISTS is a no-op once dropped).
+  sqlite.exec(`
+    DROP TABLE IF EXISTS checkpoints;
+    DROP TABLE IF EXISTS checkpoint_blobs;
+    DROP TABLE IF EXISTS checkpoint_writes;
+    DROP TABLE IF EXISTS writes;
+    DROP TABLE IF EXISTS checkpoint_migrations;
+  `);
+
   sqlite.close();
 
   // Force re-creation of drizzle instance on next getDb() call

package/lib/db/schema.js

@@ -1,4 +1,4 @@
-import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
+import { sqliteTable, text, integer, uniqueIndex, index } from 'drizzle-orm/sqlite-core';
 
 export const users = sqliteTable('users', {
   id: text('id').primaryKey(),
@@ -52,6 +52,8 @@ export const codeWorkspaces = sqliteTable('code_workspaces', {
   featureBranch: text('feature_branch'),
   title: text('title').notNull().default('Code Workspace'),
   lastInteractiveCommit: text('last_interactive_commit'),
+  codingAgent: text('coding_agent'),
+  scope: text('scope'),
   starred: integer('starred').notNull().default(0),
   hasChanges: integer('has_changes').notNull().default(0),
   createdAt: integer('created_at').notNull(),
@@ -96,3 +98,24 @@ export const settings = sqliteTable('settings', {
   createdAt: integer('created_at').notNull(),
   updatedAt: integer('updated_at').notNull(),
 });
+
+export const userChannels = sqliteTable(
+  'user_channels',
+  {
+    id: text('id').primaryKey(),
+    userId: text('user_id').notNull(),
+    channel: text('channel').notNull(),
+    channelChatId: text('channel_chat_id'),
+    code: text('code'),
+    codeExpiresAt: integer('code_expires_at'),
+    verifiedAt: integer('verified_at'),
+    activeThreadId: text('active_thread_id'),
+    createdAt: integer('created_at').notNull(),
+    updatedAt: integer('updated_at').notNull(),
+  },
+  (t) => ({
+    userChannelUnique: uniqueIndex('user_channels_user_channel_unique').on(t.userId, t.channel),
+    channelChatIdUnique: uniqueIndex('user_channels_channel_chat_id_unique').on(t.channel, t.channelChatId),
+    codeLookup: index('user_channels_code_lookup').on(t.code),
+  })
+);

package/lib/db/user-channels.js

@@ -0,0 +1,129 @@
+import { randomUUID, randomBytes } from 'crypto';
+import { and, eq, isNotNull } from 'drizzle-orm';
+import { getDb } from './index.js';
+import { userChannels } from './schema.js';
+
+const CODE_TTL_MS = 10 * 60 * 1000;
+const CODE_BYTES = 4;
+
+function now() {
+  return Date.now();
+}
+
+function generateCode() {
+  return randomBytes(CODE_BYTES).toString('hex').toUpperCase();
+}
+
+export function getUserChannel(userId, channel) {
+  const db = getDb();
+  return db
+    .select()
+    .from(userChannels)
+    .where(and(eq(userChannels.userId, userId), eq(userChannels.channel, channel)))
+    .get();
+}
+
+export function getByChannelChatId(channel, channelChatId) {
+  const db = getDb();
+  return db
+    .select()
+    .from(userChannels)
+    .where(and(eq(userChannels.channel, channel), eq(userChannels.channelChatId, channelChatId)))
+    .get();
+}
+
+export function getByCode(code) {
+  const db = getDb();
+  return db.select().from(userChannels).where(eq(userChannels.code, code)).get();
+}
+
+/**
+ * Issue or re-issue a verification code for a user+channel.
+ * Creates the row if absent; overwrites the code if present and still pending.
+ * Throws if the row is already verified — caller should unlink first.
+ */
+export function issueCode(userId, channel) {
+  const db = getDb();
+  const existing = getUserChannel(userId, channel);
+  const code = generateCode();
+  const codeExpiresAt = now() + CODE_TTL_MS;
+  const timestamp = now();
+
+  if (existing) {
+    if (existing.verifiedAt) {
+      throw new Error('Channel already verified — unlink before re-issuing a code');
+    }
+    db.update(userChannels)
+      .set({ code, codeExpiresAt, updatedAt: timestamp })
+      .where(eq(userChannels.id, existing.id))
+      .run();
+    return { ...existing, code, codeExpiresAt, updatedAt: timestamp };
+  }
+
+  const row = {
+    id: randomUUID(),
+    userId,
+    channel,
+    channelChatId: null,
+    code,
+    codeExpiresAt,
+    verifiedAt: null,
+    activeThreadId: null,
+    createdAt: timestamp,
+    updatedAt: timestamp,
+  };
+  db.insert(userChannels).values(row).run();
+  return row;
+}
+
+/**
+ * Redeem a code from an incoming channel message.
+ * Returns the userId on success. Throws on expired, already-consumed, or chat-taken.
+ */
+export function redeemCode(channel, code, channelChatId) {
+  const db = getDb();
+  const row = getByCode(code);
+  if (!row || row.channel !== channel) throw new Error('Invalid code');
+  if (row.verifiedAt) throw new Error('Code already used');
+  if (row.codeExpiresAt && row.codeExpiresAt < now()) throw new Error('Code expired');
+
+  const chatTaken = getByChannelChatId(channel, channelChatId);
+  if (chatTaken && chatTaken.id !== row.id) {
+    throw new Error('This chat is already linked to another user');
+  }
+
+  const timestamp = now();
+  db.update(userChannels)
+    .set({
+      channelChatId,
+      code: null,
+      codeExpiresAt: null,
+      verifiedAt: timestamp,
+      updatedAt: timestamp,
+    })
+    .where(eq(userChannels.id, row.id))
+    .run();
+  return { userId: row.userId, rowId: row.id };
+}
+
+export function setActiveThread(userId, channel, threadId) {
+  const db = getDb();
+  const timestamp = now();
+  db.update(userChannels)
+    .set({ activeThreadId: threadId, updatedAt: timestamp })
+    .where(
+      and(
+        eq(userChannels.userId, userId),
+        eq(userChannels.channel, channel),
+        isNotNull(userChannels.verifiedAt)
+      )
+    )
+    .run();
+}
+
+export function unlink(userId, channel) {
+  const db = getDb();
+  db.delete(userChannels)
+    .where(and(eq(userChannels.userId, userId), eq(userChannels.channel, channel)))
+    .run();
+}

package/lib/llm-providers.js

@@ -17,6 +17,7 @@ export const BUILTIN_PROVIDERS = {
     ],
     models: [
       { id: 'claude-sonnet-4-6', name: 'Claude Sonnet 4.6', default: true },
+      { id: 'claude-opus-4-7', name: 'Claude Opus 4.7' },
       { id: 'claude-opus-4-6', name: 'Claude Opus 4.6' },
       { id: 'claude-haiku-4-5-20251001', name: 'Claude Haiku 4.5' },
       { id: 'claude-sonnet-4-20250514', name: 'Claude Sonnet 4' },
@@ -61,6 +62,7 @@ export const BUILTIN_PROVIDERS = {
     credentials: [
       { type: 'api_key', key: 'DEEPSEEK_API_KEY', label: 'API Key' },
     ],
+    baseUrl: 'https://api.deepseek.com/v1',
     anthropicEndpoint: 'https://api.deepseek.com/anthropic',
     models: [
       { id: 'deepseek-chat', name: 'DeepSeek V3', default: true },
@@ -72,6 +74,7 @@ export const BUILTIN_PROVIDERS = {
     credentials: [
       { type: 'api_key', key: 'MINIMAX_API_KEY', label: 'API Key' },
     ],
+    baseUrl: 'https://api.minimax.io/v1',
     anthropicEndpoint: 'https://api.minimax.io/anthropic',
     models: [
       { id: 'MiniMax-M2.7', name: 'MiniMax M2.7', default: true },
@@ -83,6 +86,7 @@ export const BUILTIN_PROVIDERS = {
   mistral: {
     name: 'Mistral',
     litellmProxy: true, litellmPrefix: 'mistral',
+    baseUrl: 'https://api.mistral.ai/v1',
     credentials: [
       { type: 'api_key', key: 'MISTRAL_API_KEY', label: 'API Key' },
     ],
@@ -97,6 +101,7 @@ export const BUILTIN_PROVIDERS = {
   xai: {
     name: 'xAI',
     litellmProxy: true, litellmPrefix: 'xai',
+    baseUrl: 'https://api.x.ai/v1',
     credentials: [
       { type: 'api_key', key: 'XAI_API_KEY', label: 'API Key' },
     ],
@@ -112,6 +117,7 @@ export const BUILTIN_PROVIDERS = {
     credentials: [
       { type: 'api_key', key: 'MOONSHOT_API_KEY', label: 'API Key' },
     ],
+    baseUrl: 'https://api.moonshot.cn/v1',
     anthropicEndpoint: 'https://api.moonshot.cn/anthropic',
     models: [
       { id: 'kimi-k2.5', name: 'Kimi K2.5', default: true },
@@ -124,12 +130,14 @@ export const BUILTIN_PROVIDERS = {
     credentials: [
       { type: 'api_key', key: 'OPENROUTER_API_KEY', label: 'API Key' },
     ],
+    baseUrl: 'https://openrouter.ai/api/v1',
     anthropicEndpoint: 'https://openrouter.ai/api',
     models: [],
   },
   nvidia: {
     name: 'NVIDIA',
     litellmProxy: true, litellmPrefix: 'nvidia_nim',
+    baseUrl: 'https://integrate.api.nvidia.com/v1',
     credentials: [
       { type: 'api_key', key: 'NVIDIA_API_KEY', label: 'API Key' },
     ],

package/lib/maintenance.js

@@ -4,44 +4,54 @@ import { getDb } from './db/index.js';
 import { settings } from './db/schema.js';
 
 const TWENTY_FOUR_HOURS = 24 * 60 * 60 * 1000;
+const ONE_HOUR = 60 * 60 * 1000;
 
 async function cleanExpiredAgentJobKeys() {
   try {
     const db = getDb();
-    const cutoff = Date.now() - TWENTY_FOUR_HOURS;
     const rows = db
       .select({ id: settings.id, key: settings.key, lastUsedAt: settings.lastUsedAt, createdAt: settings.createdAt })
       .from(settings)
       .where(eq(settings.type, 'agent_job_api_key'))
       .all();
 
-    // Filter to candidates not used in the last 24 hours
-    const candidates = rows.filter(r =>
-      (r.lastUsedAt !== null ? r.lastUsedAt : r.createdAt) < cutoff
-    );
+    // Split into SDK keys (no container) vs container-backed keys
+    const sdkRows = rows.filter(r => r.key.includes('sdk'));
+    const containerRows = rows.filter(r => !r.key.includes('sdk'));
 
-    if (candidates.length === 0) {
-      console.log(`[maintenance] No expired agent job keys (${rows.length} active)`);
-      return;
-    }
+    let deleted = 0;
 
-    // Check if the container still exists for each candidate
-    const { inspectContainer } = await import('./tools/docker.js');
-    const expiredIds = [];
-    for (const r of candidates) {
-      const info = await inspectContainer(r.key);
-      if (!info) {
-        expiredIds.push(r.id);
+    // SDK keys: delete any older than 1 hour (no container to inspect)
+    const sdkCutoff = Date.now() - ONE_HOUR;
+    for (const r of sdkRows) {
+      const age = r.lastUsedAt !== null ? r.lastUsedAt : r.createdAt;
+      if (age < sdkCutoff) {
+        db.delete(settings).where(eq(settings.id, r.id)).run();
+        deleted++;
       }
     }
 
-    if (expiredIds.length > 0) {
-      for (const id of expiredIds) {
-        db.delete(settings).where(eq(settings.id, id)).run();
+    // Container-backed keys: existing logic — 24h expiry + container inspect
+    const containerCutoff = Date.now() - TWENTY_FOUR_HOURS;
+    const candidates = containerRows.filter(r =>
+      (r.lastUsedAt !== null ? r.lastUsedAt : r.createdAt) < containerCutoff
+    );
+
+    if (candidates.length > 0) {
+      const { inspectContainer } = await import('./tools/docker.js');
+      for (const r of candidates) {
+        const info = await inspectContainer(r.key);
+        if (!info) {
+          db.delete(settings).where(eq(settings.id, r.id)).run();
+          deleted++;
+        }
       }
-      console.log(`[maintenance] Deleted ${expiredIds.length} orphaned agent job key(s)`);
+    }
+
+    if (deleted > 0) {
+      console.log(`[maintenance] Deleted ${deleted} expired agent job key(s)`);
     } else {
-      console.log(`[maintenance] ${candidates.length} candidate(s) checked, all containers still running`);
+      console.log(`[maintenance] No expired agent job keys (${rows.length} active)`);
     }
   } catch (err) {
     console.error('[maintenance] cleanExpiredAgentJobKeys failed:', err);

package/lib/tools/CLAUDE.md

@@ -12,7 +12,16 @@ Calls Docker Engine API directly through `/var/run/docker.sock` using Node's `ht
 
 **Image pull on demand**: Checks if image exists locally before pulling. Avoids pre-pulling at startup.
 
-**`buildAgentAuthEnv(agent)`**: Resolves coding agent type → auth environment variables from the settings DB. Handles OAuth vs API key auth modes, multi-provider resolution (builtin + custom), and model overrides. Each agent type (claude-code, pi, gemini-cli, codex-cli, opencode) has its own credential resolution path. OAuth tokens use LRU rotation via `getNextOAuthToken()`. All credentials come from the DB, not `.env` or GitHub secrets.
+**`buildAgentAuthEnv(agent)`**: Resolves coding agent type → auth environment variables from the settings DB. All credentials come from the DB (`getConfig`, `getCustomProvider`), never `.env` or GitHub secrets. Returns `{ env: string[], backendApi: string }`.
+
+Per-agent resolution paths:
+
+- **`claude-code`** — `CODING_AGENT_CLAUDE_CODE_BACKEND` selects backend. If `anthropic`, picks OAuth (`CLAUDE_CODE_OAUTH_TOKEN` via LRU rotation) or API key (`ANTHROPIC_API_KEY`). For Anthropic-compatible third parties (DeepSeek, MiniMax, Kimi, OpenRouter) sets `ANTHROPIC_AUTH_TOKEN` + `ANTHROPIC_BASE_URL` to the provider's `anthropicEndpoint`. For OpenAI-only builtins or custom providers, routes through the LiteLLM sidecar at `http://litellm:4000` and prefixes the model with the provider key.
+- **`pi-coding-agent`, `opencode`, `kimi-cli`** — share a multi-provider pattern. `CODING_AGENT_{AGENT}_PROVIDER` picks anthropic/openai/google/deepseek/minimax/mistral/xai/openrouter/nvidia or a custom provider. Sets the matching `*_API_KEY` (or `CUSTOM_OPENAI_BASE_URL` + `CUSTOM_API_KEY` for custom).
+- **`gemini-cli`** — `GOOGLE_API_KEY` only. Backend is always `google`.
+- **`codex-cli`** — OAuth (`CODEX_OAUTH_TOKEN`) or API key (`OPENAI_API_KEY`). Backend always `openai`.
+
+OAuth tokens use LRU rotation via `getNextOAuthToken()` (in `lib/db/oauth-tokens.js`) — distributes load across multiple stored tokens and updates `lastUsedAt` on each pick. Refresh-token rotation is handled at retrieval time in `/api/get-agent-job-secret` (under a per-token lock).
 
 ## create-agent-job.js — Agent Job Creation
 
@@ -36,6 +45,6 @@ Calls Docker Engine API directly through `/var/run/docker.sock` using Node's `ht
 
 **Typing indicator with jitter**: Re-sends typing action at 5.5–8s random intervals (Telegram expires indicators after 5s). Returns a stop function.
 
-## openai.js — Whisper Transcription
+## assemblyai.js — Voice Transcription
 
-**Feature flag via API key**: `isWhisperEnabled()` checks if `OPENAI_API_KEY` is set. Used by the Telegram adapter to conditionally offer voice transcription. `transcribeAudio()` sends binary audio via FormData to `/v1/audio/transcriptions`.
+**Feature flag via API key**: `isAssemblyAIEnabled()` checks if `ASSEMBLYAI_API_KEY` is set. Used by the Telegram adapter to conditionally offer voice transcription. `transcribeAudio(buffer)` uses the official `assemblyai` SDK (`client.transcripts.transcribe`), which handles upload + polling internally. Throws when the transcript status is `'error'`.