upfynai-code 2.4.1 → 2.5.0

package/server/database/db.js

@@ -170,6 +170,63 @@ CREATE TABLE IF NOT EXISTS payments (
 CREATE INDEX IF NOT EXISTS idx_payments_user_id ON payments(user_id);
 CREATE INDEX IF NOT EXISTS idx_payments_order_id ON payments(razorpay_order_id);
 CREATE INDEX IF NOT EXISTS idx_payments_status ON payments(status);
+
+CREATE TABLE IF NOT EXISTS webhooks (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    name TEXT NOT NULL,
+    url TEXT NOT NULL,
+    method TEXT NOT NULL DEFAULT 'POST',
+    headers TEXT DEFAULT '{}',
+    description TEXT,
+    is_active BOOLEAN DEFAULT 1,
+    last_triggered DATETIME,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhooks_user_id ON webhooks(user_id);
+CREATE INDEX IF NOT EXISTS idx_webhooks_active ON webhooks(is_active);
+
+CREATE TABLE IF NOT EXISTS workflows (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    name TEXT NOT NULL,
+    description TEXT,
+    steps TEXT NOT NULL DEFAULT '[]',
+    schedule TEXT DEFAULT NULL,
+    schedule_enabled BOOLEAN DEFAULT 0,
+    schedule_timezone TEXT DEFAULT 'UTC',
+    is_active BOOLEAN DEFAULT 1,
+    last_run DATETIME,
+    next_run DATETIME,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_workflows_user_id ON workflows(user_id);
+CREATE INDEX IF NOT EXISTS idx_workflows_active ON workflows(is_active);
+
+CREATE TABLE IF NOT EXISTS workflow_runs (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    workflow_id INTEGER NOT NULL,
+    user_id INTEGER NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    steps_completed INTEGER DEFAULT 0,
+    total_steps INTEGER DEFAULT 0,
+    result TEXT,
+    error TEXT,
+    started_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    completed_at DATETIME,
+    FOREIGN KEY (workflow_id) REFERENCES workflows(id) ON DELETE CASCADE,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_workflow_runs_workflow_id ON workflow_runs(workflow_id);
+CREATE INDEX IF NOT EXISTS idx_workflow_runs_user_id ON workflow_runs(user_id);
+CREATE INDEX IF NOT EXISTS idx_workflow_runs_status ON workflow_runs(status);
 `;
 
 // ─── Migrations ─────────────────────────────────────────────────────────────────
@@ -603,4 +660,149 @@ const relayTokensDb = {
   }
 };
 
-export { db, initializeDatabase, userDb, apiKeysDb, credentialsDb, relayTokensDb, githubTokensDb, subscriptionDb, paymentDb, PLAN_DURATIONS };
+// ─── Webhook DB ──────────────────────────────────────────────────────────────
+
+const webhookDb = {
+  getAll: async (userId) => {
+    const result = await db.execute({
+      sql: 'SELECT * FROM webhooks WHERE user_id = ? ORDER BY created_at DESC',
+      args: [userId]
+    });
+    return result.rows;
+  },
+
+  getById: async (id, userId) => {
+    const result = await db.execute({
+      sql: 'SELECT * FROM webhooks WHERE id = ? AND user_id = ?',
+      args: [id, userId]
+    });
+    return getRow(result);
+  },
+
+  create: async (userId, { name, url, method, headers, description }) => {
+    const result = await db.execute({
+      sql: 'INSERT INTO webhooks (user_id, name, url, method, headers, description) VALUES (?, ?, ?, ?, ?, ?)',
+      args: [userId, name, url, method || 'POST', headers || '{}', description || null]
+    });
+    return { id: Number(result.lastInsertRowid), name, url, method: method || 'POST' };
+  },
+
+  update: async (id, userId, { name, url, method, headers, description }) => {
+    const result = await db.execute({
+      sql: 'UPDATE webhooks SET name = ?, url = ?, method = ?, headers = ?, description = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ? AND user_id = ?',
+      args: [name, url, method, headers || '{}', description || null, id, userId]
+    });
+    return result.rowsAffected > 0;
+  },
+
+  delete: async (id, userId) => {
+    await ensureForeignKeys();
+    const result = await db.execute({
+      sql: 'DELETE FROM webhooks WHERE id = ? AND user_id = ?',
+      args: [id, userId]
+    });
+    return result.rowsAffected > 0;
+  },
+
+  updateLastTriggered: async (id) => {
+    await db.execute({
+      sql: 'UPDATE webhooks SET last_triggered = CURRENT_TIMESTAMP WHERE id = ?',
+      args: [id]
+    });
+  }
+};
+
+// ─── Workflow DB ─────────────────────────────────────────────────────────────
+
+const workflowDb = {
+  getAll: async (userId) => {
+    const result = await db.execute({
+      sql: 'SELECT * FROM workflows WHERE user_id = ? ORDER BY created_at DESC',
+      args: [userId]
+    });
+    return result.rows;
+  },
+
+  getById: async (id, userId) => {
+    const result = await db.execute({
+      sql: 'SELECT * FROM workflows WHERE id = ? AND user_id = ?',
+      args: [id, userId]
+    });
+    return getRow(result);
+  },
+
+  create: async (userId, { name, description, steps, schedule, schedule_enabled, schedule_timezone }) => {
+    const result = await db.execute({
+      sql: 'INSERT INTO workflows (user_id, name, description, steps, schedule, schedule_enabled, schedule_timezone) VALUES (?, ?, ?, ?, ?, ?, ?)',
+      args: [userId, name, description || null, JSON.stringify(steps || []), schedule || null, schedule_enabled ? 1 : 0, schedule_timezone || 'UTC']
+    });
+    return { id: Number(result.lastInsertRowid), name };
+  },
+
+  update: async (id, userId, { name, description, steps, schedule, schedule_enabled, schedule_timezone }) => {
+    const result = await db.execute({
+      sql: 'UPDATE workflows SET name = ?, description = ?, steps = ?, schedule = ?, schedule_enabled = ?, schedule_timezone = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ? AND user_id = ?',
+      args: [name, description || null, JSON.stringify(steps || []), schedule || null, schedule_enabled ? 1 : 0, schedule_timezone || 'UTC', id, userId]
+    });
+    return result.rowsAffected > 0;
+  },
+
+  delete: async (id, userId) => {
+    await ensureForeignKeys();
+    const result = await db.execute({
+      sql: 'DELETE FROM workflows WHERE id = ? AND user_id = ?',
+      args: [id, userId]
+    });
+    return result.rowsAffected > 0;
+  },
+
+  updateLastRun: async (id) => {
+    await db.execute({
+      sql: 'UPDATE workflows SET last_run = CURRENT_TIMESTAMP WHERE id = ?',
+      args: [id]
+    });
+  },
+
+  getScheduled: async () => {
+    const result = await db.execute(
+      'SELECT * FROM workflows WHERE schedule IS NOT NULL AND schedule_enabled = 1 AND is_active = 1'
+    );
+    return result.rows;
+  },
+
+  updateNextRun: async (id, nextRun) => {
+    await db.execute({
+      sql: 'UPDATE workflows SET next_run = ? WHERE id = ?',
+      args: [nextRun, id]
+    });
+  },
+
+  createRun: async (workflowId, userId, totalSteps) => {
+    const result = await db.execute({
+      sql: 'INSERT INTO workflow_runs (workflow_id, user_id, status, total_steps) VALUES (?, ?, ?, ?)',
+      args: [workflowId, userId, 'running', totalSteps]
+    });
+    return { id: Number(result.lastInsertRowid) };
+  },
+
+  updateRun: async (runId, { status, stepsCompleted, result: runResult, error }) => {
+    const sets = ['status = ?'];
+    const args = [status];
+    if (stepsCompleted !== undefined) { sets.push('steps_completed = ?'); args.push(stepsCompleted); }
+    if (runResult !== undefined) { sets.push('result = ?'); args.push(typeof runResult === 'string' ? runResult : JSON.stringify(runResult)); }
+    if (error !== undefined) { sets.push('error = ?'); args.push(error); }
+    if (status === 'completed' || status === 'failed') { sets.push('completed_at = CURRENT_TIMESTAMP'); }
+    args.push(runId);
+    await db.execute({ sql: `UPDATE workflow_runs SET ${sets.join(', ')} WHERE id = ?`, args });
+  },
+
+  getRuns: async (workflowId, userId) => {
+    const result = await db.execute({
+      sql: 'SELECT * FROM workflow_runs WHERE workflow_id = ? AND user_id = ? ORDER BY started_at DESC LIMIT 20',
+      args: [workflowId, userId]
+    });
+    return result.rows;
+  }
+};
+
+export { db, initializeDatabase, userDb, apiKeysDb, credentialsDb, relayTokensDb, githubTokensDb, subscriptionDb, paymentDb, webhookDb, workflowDb, PLAN_DURATIONS };

package/server/index.js

@@ -1,9 +1,15 @@
 #!/usr/bin/env node
 // Load environment variables before other imports execute
 import './load-env.js';
+
+// Strip Claude Code session markers so spawned CLI processes don't fail with
+// "cannot be launched inside another Claude Code session" errors.
+delete process.env.CLAUDECODE;
+delete process.env.CLAUDE_CODE;
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
+import jwt from 'jsonwebtoken';
 import { fileURLToPath } from 'url';
 import { dirname } from 'path';
 
@@ -70,8 +76,13 @@ import cliAuthRoutes from './routes/cli-auth.js';
 import userRoutes from './routes/user.js';
 import codexRoutes from './routes/codex.js';
 import paymentRoutes from './routes/payments.js';
+import webhookRoutes from './routes/webhooks.js';
+import workflowRoutes from './routes/workflows.js';
+import voiceRoutes from './routes/voice.js';
+import dashboardRoutes from './routes/dashboard.js';
+import { initScheduler } from './services/workflowScheduler.js';
 import { initializeDatabase, relayTokensDb, subscriptionDb, credentialsDb, userDb } from './database/db.js';
-import { validateApiKey, authenticateToken, authenticateWebSocket } from './middleware/auth.js';
+import { validateApiKey, authenticateToken, authenticateWebSocket, JWT_SECRET } from './middleware/auth.js';
 import { IS_PLATFORM, IS_LOCAL } from './constants/config.js';
 import { execSync } from 'child_process';
 
@@ -353,7 +364,13 @@ app.locals.wss = wss;
 // Security headers — protect against common web attacks
 app.use((req, res, next) => {
   res.setHeader('X-Content-Type-Options', 'nosniff');
-  res.setHeader('X-Frame-Options', 'DENY');
+  // Allow framing from our own frontend domains (Vercel embeds Railway in an iframe)
+  const allowedFrameOrigins = (process.env.CORS_ORIGINS || '').split(',').map(s => s.trim()).filter(Boolean);
+  if (allowedFrameOrigins.length > 0) {
+    res.setHeader('Content-Security-Policy', `frame-ancestors 'self' ${allowedFrameOrigins.join(' ')}`);
+  } else {
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  }
   res.setHeader('X-XSS-Protection', '1; mode=block');
   res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
   if (process.env.NODE_ENV === 'production') {
@@ -499,6 +516,10 @@ app.use('/api/codex', authenticateToken, codexRoutes);
 
 // Payment & Subscription Routes (protected)
 app.use('/api/payments', authenticateToken, paymentRoutes);
+app.use('/api/webhooks', authenticateToken, webhookRoutes);
+app.use('/api/workflows', authenticateToken, workflowRoutes);
+app.use('/api/voice', authenticateToken, voiceRoutes);
+app.use('/api/dashboard', authenticateToken, dashboardRoutes);
 
 // Agent API Routes (uses API key authentication)
 app.use('/api/agent', agentRoutes);
@@ -533,6 +554,10 @@ app.delete('/api/relay/tokens/:id', authenticateToken, async (req, res) => {
 });
 
 app.get('/api/relay/status', authenticateToken, (req, res) => {
+    // In local mode, always connected — SDK runs directly on this machine
+    if (IS_LOCAL) {
+        return res.json({ connected: true, local: true, connectedAt: Date.now() });
+    }
     const relay = relayConnections.get(Number(req.user.id));
     res.json({
         connected: !!(relay && relay.ws.readyState === 1),
@@ -1375,7 +1400,8 @@ async function handleRelayConnection(ws, token, request) {
     relayConnections.set(userId, {
         ws, user: tokenData, connectedAt: Date.now(), anthropicApiKey,
         version: relayVersion, machine: relayMachine, platform: relayPlatform, cwd: relayCwd,
-        agents: null // populated when client sends agent-capabilities
+        agents: null, // populated when client sends agent-capabilities
+        lastPong: Date.now(),
     });
 
     ws.send(JSON.stringify({
@@ -1452,6 +1478,8 @@ async function handleRelayConnection(ws, token, request) {
 
             // Heartbeat
             if (data.type === 'ping') {
+                const relay = relayConnections.get(userId);
+                if (relay) relay.lastPong = Date.now();
                 ws.send(JSON.stringify({ type: 'pong' }));
                 return;
             }
@@ -1460,7 +1488,29 @@ async function handleRelayConnection(ws, token, request) {
         }
     });
 
+    // Server-side heartbeat: ping relay client every 45s, terminate if no pong in 90s
+    const relayHeartbeat = setInterval(() => {
+        const relay = relayConnections.get(userId);
+        if (!relay || relay.ws !== ws) {
+            clearInterval(relayHeartbeat);
+            return;
+        }
+        // If no ping received from client in 90s, consider connection stale
+        if (Date.now() - relay.lastPong > 90000) {
+            clearInterval(relayHeartbeat);
+            ws.terminate();
+            return;
+        }
+        // Send server-side ping to keep connection alive through proxies
+        try {
+            if (ws.readyState === 1) {
+                ws.send(JSON.stringify({ type: 'server-ping' }));
+            }
+        } catch { /* ignore */ }
+    }, 45000);
+
     ws.on('close', () => {
+        clearInterval(relayHeartbeat);
         relayConnections.delete(userId);
         // Clean up pending requests for this user
         for (const [reqId, pending] of pendingRelayRequests) {
@@ -1470,7 +1520,6 @@ async function handleRelayConnection(ws, token, request) {
                 pendingRelayRequests.delete(reqId);
             }
         }
-        // relay disconnected
 
         // Broadcast relay status
         for (const client of connectedClients) {
@@ -1482,8 +1531,8 @@ async function handleRelayConnection(ws, token, request) {
         }
     });
 
-    ws.on('error', (err) => {
-        // relay error
+    ws.on('error', () => {
+        clearInterval(relayHeartbeat);
     });
 }
 
@@ -1602,10 +1651,14 @@ async function routeViaRelay(userId, action, data, writer, eventMap = {}) {
             viaRelay: true
         });
     } catch (error) {
+        const isRelayLost = error.message?.includes('Relay disconnected') || error.message?.includes('No relay connection') || error.message?.includes('Relay request timed out');
         writer.send({
             type: errorType,
-            error: error.message,
-            sessionId
+            error: isRelayLost
+                ? 'Your machine disconnected. Please reconnect with "uc connect" and try again.'
+                : error.message,
+            sessionId,
+            relayDisconnected: isRelayLost
         });
     }
 }
@@ -1635,6 +1688,7 @@ function handleShellConnection(ws) {
                 const provider = data.provider || 'claude';
                 const initialCommand = data.initialCommand;
                 const isPlainShell = data.isPlainShell || (!!initialCommand && !hasSession) || provider === 'plain-shell';
+                const shellType = data.shellType || null;
                 urlDetectionBuffer = '';
                 announcedAuthUrls.clear();
 
@@ -1716,11 +1770,17 @@ function handleShellConnection(ws) {
                     // Prepare the shell command adapted to the platform and provider
                     let shellCommand;
                     if (isPlainShell) {
-                        // Plain shell mode - just run the initial command in the project directory
-                        if (os.platform() === 'win32') {
-                            shellCommand = `Set-Location -Path "${projectPath}"; ${initialCommand}`;
+                        // Plain shell mode - run initial command or open interactive shell
+                        const usesPowerShell = !shellType || shellType === 'powershell';
+                        if (initialCommand) {
+                            if (usesPowerShell) {
+                                shellCommand = `Set-Location -Path "${projectPath}"; ${initialCommand}`;
+                            } else {
+                                shellCommand = `cd "${projectPath}" && ${initialCommand}`;
+                            }
                         } else {
-                            shellCommand = `cd "${projectPath}" && ${initialCommand}`;
+                            // Interactive shell tab — spawn shell directly (no command wrapper)
+                            shellCommand = null;
                         }
                     } else if (provider === 'cursor') {
                         // Use cursor-agent command
@@ -1758,9 +1818,19 @@ function handleShellConnection(ws) {
 
                     console.log('🔧 Executing shell command:', shellCommand);
 
-                    // Use appropriate shell based on platform
-                    const shell = os.platform() === 'win32' ? 'powershell.exe' : 'bash';
-                    const shellArgs = os.platform() === 'win32' ? ['-Command', shellCommand] : ['-c', shellCommand];
+                    // Use appropriate shell based on platform and requested shellType
+                    const shellMap = {
+                        'powershell': { cmd: 'powershell.exe', args: ['-Command'] },
+                        'cmd': { cmd: 'cmd.exe', args: ['/c'] },
+                        'bash': { cmd: 'bash', args: ['-c'] },
+                    };
+                    const defaultShell = os.platform() === 'win32'
+                        ? { cmd: 'powershell.exe', args: ['-Command'] }
+                        : { cmd: 'bash', args: ['-c'] };
+                    const selectedShell = (shellType && shellMap[shellType]) || defaultShell;
+                    const shell = selectedShell.cmd;
+                    // If shellCommand is null, spawn an interactive shell with no args
+                    const shellArgs = shellCommand ? [...selectedShell.args, shellCommand] : [];
 
                     // Use terminal dimensions from client if provided, otherwise use defaults
                     const termCols = data.cols || 80;
@@ -1771,7 +1841,7 @@ function handleShellConnection(ws) {
                         name: 'xterm-256color',
                         cols: termCols,
                         rows: termRows,
-                        cwd: os.homedir(),
+                        cwd: shellCommand ? os.homedir() : projectPath,
                         env: {
                             ...process.env,
                             TERM: 'xterm-256color',
@@ -2360,9 +2430,29 @@ app.get('*', (req, res) => {
     return res.status(404).send('Not found');
   }
 
+  // If a JWT token is in the query param and no session cookie exists,
+  // set the cookie now so the client-side AuthContext can authenticate on subsequent API calls.
+  if (req.query?.token && !req.cookies?.session) {
+    try {
+      const decoded = jwt.verify(req.query.token, JWT_SECRET);
+      if (decoded?.userId) {
+        const isSecure = process.env.NODE_ENV === 'production' || !!process.env.RAILWAY_ENVIRONMENT;
+        res.cookie('session', req.query.token, {
+          httpOnly: true,
+          secure: isSecure,
+          sameSite: isSecure ? 'none' : 'strict',
+          maxAge: 30 * 24 * 60 * 60 * 1000,
+          path: '/',
+        });
+      }
+    } catch (e) {
+      // Invalid token — just serve the page without setting cookie
+    }
+  }
+
   // Only serve index.html for HTML routes, not for static assets
   // Static assets should already be handled by express.static middleware above
-  const indexPath = path.join(__dirname, '../dist/index.html');
+  const indexPath = path.join(__dirname, '../client/dist/index.html');
 
   // Check if dist/index.html exists (production build available)
   if (fs.existsSync(indexPath)) {
@@ -2482,7 +2572,7 @@ async function startServer() {
         }
 
         // Check if running in production mode (dist folder exists OR NODE_ENV/RAILWAY set)
-        const distIndexPath = path.join(__dirname, '../dist/index.html');
+        const distIndexPath = path.join(__dirname, '../client/dist/index.html');
         const isProduction = fs.existsSync(distIndexPath) || process.env.NODE_ENV === 'production' || !!process.env.RAILWAY_ENVIRONMENT;
 
         // Log Claude implementation mode
@@ -2505,6 +2595,9 @@ async function startServer() {
             console.log(`${c.info('[INFO]')} MCP Server:  ${c.bright('http://0.0.0.0:' + PORT + '/mcp')}`);
             console.log(`${c.info('[INFO]')} Installed at: ${c.dim(appInstallPath)}`);
             console.log(`${c.tip('[TIP]')}  Run "uc status" for full configuration details`);
+
+            // Start workflow cron scheduler
+            initScheduler().catch(err => console.warn('[Scheduler]', err.message));
             console.log('');
 
             // Start watching the projects folder for changes (skip on Vercel)

package/server/middleware/auth.js

@@ -33,10 +33,8 @@ const extractToken = (req) => {
   const authHeader = req.headers['authorization'];
   if (authHeader?.startsWith('Bearer ')) return authHeader.slice(7);
 
-  // 3. Query param — ONLY for SSE EventSource (which cannot set custom headers)
-  // Restricted to GET requests with Accept: text/event-stream to minimize exposure
-  if (req.query?.token && req.method === 'GET' &&
-      (req.headers.accept || '').includes('text/event-stream')) {
+  // 3. Query param — for GET requests (SSE EventSource + iframe embedding)
+  if (req.query?.token && req.method === 'GET') {
     return req.query.token;
   }
 
@@ -68,6 +66,10 @@ const authenticateToken = async (req, res, next) => {
     const user = await userDb.getUserById(decoded.userId);
     if (!user) return res.status(401).json({ error: 'Invalid token. User not found.' });
     req.user = user;
+    // If token came from query param, set session cookie for subsequent requests (iframe auto-auth)
+    if (req.query?.token && !req.cookies?.session) {
+      res.cookie('session', token, COOKIE_OPTIONS);
+    }
     next();
   } catch (error) {
     return res.status(403).json({ error: 'Invalid or expired token' });
@@ -85,10 +87,13 @@ const generateToken = (user) => {
 
 // Cookie config for httpOnly session
 // Works for both self-hosted (same origin) and split deploy (Vercel proxy → Railway)
+const isSecureEnv = process.env.NODE_ENV === 'production' || !!process.env.VERCEL || !!process.env.RAILWAY_ENVIRONMENT;
 const COOKIE_OPTIONS = {
   httpOnly: true,
-  secure: process.env.NODE_ENV === 'production' || !!process.env.VERCEL || !!process.env.RAILWAY_ENVIRONMENT,
-  sameSite: 'strict',
+  secure: isSecureEnv,
+  // 'none' required for cross-origin iframe embedding (Vercel frontend → Railway backend)
+  // 'strict' used in local/dev mode where everything is same-origin
+  sameSite: isSecureEnv ? 'none' : 'strict',
   maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
   path: '/',
 };