zubo 0.1.0

package/src/channels/whatsapp.ts

@@ -0,0 +1,119 @@
+import type { ChannelAdapter, InboundMessage } from "./adapter";
+import type { MessageRouter } from "./router";
+import { splitMessage } from "./utils";
+import { logger } from "../util/logger";
+import { join } from "path";
+import { paths } from "../config/paths";
+
+export function createWhatsAppAdapter(
+  allowedNumbers: string[],
+  authDir: string | undefined,
+  router: MessageRouter
+): ChannelAdapter {
+  let sock: any = null;
+  const sessionDir = authDir ?? join(paths.root, "whatsapp-auth");
+
+  return {
+    channelName: "whatsapp",
+
+    start() {
+      import("@whiskeysockets/baileys").then(async (baileys) => {
+        const { default: makeWASocket, useMultiFileAuthState, DisconnectReason } = baileys;
+        const { mkdirSync } = await import("fs");
+        mkdirSync(sessionDir, { recursive: true });
+
+        const { state, saveCreds } = await useMultiFileAuthState(sessionDir);
+
+        sock = makeWASocket({
+          auth: state,
+          printQRInTerminal: true,
+        });
+
+        sock.ev.on("creds.update", saveCreds);
+
+        sock.ev.on("connection.update", (update: any) => {
+          const { connection, lastDisconnect, qr } = update;
+          if (qr) {
+            logger.info("WhatsApp QR code displayed in terminal — scan to connect");
+          }
+          if (connection === "close") {
+            const shouldReconnect =
+              lastDisconnect?.error?.output?.statusCode !== DisconnectReason.loggedOut;
+            if (shouldReconnect) {
+              logger.info("WhatsApp reconnecting...");
+              // Re-create connection
+            }
+          } else if (connection === "open") {
+            logger.info("WhatsApp connected");
+          }
+        });
+
+        sock.ev.on("messages.upsert", async ({ messages }: any) => {
+          for (const msg of messages) {
+            if (!msg.message || msg.key.fromMe) continue;
+            const jid = msg.key.remoteJid;
+            if (!jid || jid.endsWith("@g.us")) continue; // Skip groups
+
+            const number = jid.replace("@s.whatsapp.net", "");
+
+            // Auto-pair
+            if (allowedNumbers.length === 0) {
+              allowedNumbers.push(number);
+              logger.info(`Auto-registered WhatsApp number: ${number}`);
+              await sock.sendMessage(jid, { text: "Welcome! You've been registered as the owner." });
+            }
+
+            if (allowedNumbers.length > 0 && !allowedNumbers.includes(number)) continue;
+
+            const text =
+              msg.message.conversation ||
+              msg.message.extendedTextMessage?.text ||
+              "";
+            if (!text) continue;
+
+            const sessionKey = `whatsapp:${number}`;
+            const inbound: InboundMessage = {
+              channel: "whatsapp",
+              userId: number,
+              sessionKey,
+              text,
+            };
+
+            // Show composing indicator
+            await sock.sendPresenceUpdate("composing", jid);
+
+            await router.handleMessage(inbound, async (reply) => {
+              await sock.sendPresenceUpdate("paused", jid);
+              const chunks = splitMessage(reply, 4000);
+              for (const chunk of chunks) {
+                await sock.sendMessage(jid, { text: chunk });
+              }
+            });
+          }
+        });
+      }).catch((err: any) => {
+        logger.error("Failed to start WhatsApp — install @whiskeysockets/baileys", { error: err.message });
+      });
+    },
+
+    stop() {
+      if (sock) {
+        sock.end();
+        sock = null;
+      }
+    },
+
+    async sendMessage(sessionKey: string, text: string) {
+      if (!sock) return;
+      const number = sessionKey.split(":")[1];
+      if (!number) return;
+      const jid = `${number}@s.whatsapp.net`;
+      const chunks = splitMessage(text, 4000);
+      for (const chunk of chunks) {
+        await sock.sendMessage(jid, { text: chunk }).catch((err: any) => {
+          logger.error("WhatsApp send failed", { error: err.message });
+        });
+      }
+    },
+  };
+}

package/src/config/loader.ts

@@ -0,0 +1,22 @@
+import { paths, ensureDirectories } from "./paths";
+import { configSchema, type ZuboConfig } from "./schema";
+import { existsSync } from "fs";
+
+export async function loadConfig(): Promise<ZuboConfig> {
+  if (!existsSync(paths.config)) {
+    throw new Error(
+      `Config not found at ${paths.config}. Run 'zubo setup' first.`
+    );
+  }
+  const raw = await Bun.file(paths.config).json();
+  return configSchema.parse(raw);
+}
+
+export async function saveConfig(config: ZuboConfig): Promise<void> {
+  ensureDirectories();
+  await Bun.write(paths.config, JSON.stringify(config, null, 2) + "\n");
+}
+
+export function configExists(): boolean {
+  return existsSync(paths.config);
+}

package/src/config/paths.ts

@@ -0,0 +1,43 @@
+import { join } from "path";
+import { homedir } from "os";
+
+const ZUBO_HOME = join(homedir(), ".zubo");
+
+export const paths = {
+  root: ZUBO_HOME,
+  config: join(ZUBO_HOME, "config.json"),
+  db: join(ZUBO_HOME, "zubo.db"),
+  workspace: join(ZUBO_HOME, "workspace"),
+  memory: join(ZUBO_HOME, "workspace", "memory"),
+  memoryFile: join(ZUBO_HOME, "workspace", "MEMORY.md"),
+  systemPrompt: join(ZUBO_HOME, "workspace", "SYSTEM.md"),
+  sessions: join(ZUBO_HOME, "sessions"),
+  models: join(ZUBO_HOME, "models"),
+  logs: join(ZUBO_HOME, "logs"),
+  logFile: join(ZUBO_HOME, "logs", "zubo.log"),
+  skills: join(ZUBO_HOME, "workspace", "skills"),
+  agents: join(ZUBO_HOME, "workspace", "agents"),
+  workflows: join(ZUBO_HOME, "workspace", "workflows"),
+  teams: join(ZUBO_HOME, "workspace", "teams"),
+  uploads: join(ZUBO_HOME, "workspace", "uploads"),
+  pidFile: join(ZUBO_HOME, "zubo.pid"),
+};
+
+export function ensureDirectories() {
+  const dirs = [
+    paths.root,
+    paths.workspace,
+    paths.memory,
+    paths.sessions,
+    paths.models,
+    paths.logs,
+    paths.skills,
+    paths.agents,
+    paths.workflows,
+    paths.teams,
+    paths.uploads,
+  ];
+  for (const dir of dirs) {
+    Bun.spawnSync(["mkdir", "-p", dir]);
+  }
+}

package/src/config/schema.ts

@@ -0,0 +1,121 @@
+import { z } from "zod";
+
+const providerConfigSchema = z.object({
+  apiKey: z.string().optional(),
+  baseUrl: z.string().optional(),
+  model: z.string(),
+  streaming: z.boolean().optional(),
+  contextWindow: z.number().optional(),
+});
+
+export type ProviderConfig = z.infer<typeof providerConfigSchema>;
+
+const channelsConfigSchema = z.object({
+  telegram: z
+    .object({
+      enabled: z.boolean().default(true),
+      botToken: z.string().min(1),
+      allowedUsers: z.array(z.number()).default([]),
+    })
+    .optional(),
+  discord: z
+    .object({
+      enabled: z.boolean().default(true),
+      botToken: z.string().min(1),
+      allowedUsers: z.array(z.string()).default([]),
+    })
+    .optional(),
+  webchat: z
+    .object({
+      enabled: z.boolean().default(true),
+      port: z.number().default(0),
+    })
+    .optional(),
+  slack: z.object({
+    enabled: z.boolean().default(true),
+    botToken: z.string().min(1),
+    appToken: z.string().min(1),
+    allowedUsers: z.array(z.string()).default([]),
+  }).optional(),
+  whatsapp: z.object({
+    enabled: z.boolean().default(true),
+    authDir: z.string().optional(),
+    allowedNumbers: z.array(z.string()).default([]),
+  }).optional(),
+  signal: z.object({
+    enabled: z.boolean().default(true),
+    phoneNumber: z.string().min(1),
+    signalCliPath: z.string().optional(),
+    allowedNumbers: z.array(z.string()).default([]),
+  }).optional(),
+});
+
+export type ChannelsConfig = z.infer<typeof channelsConfigSchema>;
+
+export const configSchema = z.object({
+  // Legacy fields (still work for backward compat)
+  anthropicApiKey: z.string().optional(),
+  model: z.string().optional(),
+  telegramBotToken: z.string().optional(),
+  telegramAllowedUsers: z.array(z.number()).default([]),
+
+  // Multi-provider system
+  providers: z.record(z.string(), providerConfigSchema).optional(),
+  activeProvider: z.string().optional(),
+  failover: z.array(z.string()).optional(),
+
+  // Multi-channel system
+  channels: channelsConfigSchema.optional(),
+
+  // Voice (STT/TTS)
+  voice: z.object({
+    stt: z.object({
+      provider: z.string().default("whisper"),
+      apiKey: z.string().min(1),
+      model: z.string().optional(),
+    }).optional(),
+    tts: z.object({
+      provider: z.string().default("openai"),
+      apiKey: z.string().min(1),
+      voice: z.string().optional(),
+    }).optional(),
+  }).optional(),
+
+  // Agent
+  maxTurns: z.number().default(50),
+  heartbeatMinutes: z.number().min(1).max(1440).default(30),
+  createdAt: z.string().default(() => new Date().toISOString()),
+
+  // Rate limiting
+  rateLimit: z.object({
+    chatPerMinute: z.number().default(60),
+    uploadPerMinute: z.number().default(10),
+  }).optional(),
+
+  // API authentication
+  auth: z.object({
+    enabled: z.boolean().default(false),
+  }).optional(),
+
+  // Skill sandboxing
+  sandbox: z.object({
+    enabled: z.boolean().default(true),
+    timeoutMs: z.number().default(30_000),
+  }).optional(),
+
+  // Smart model routing
+  smartRouting: z.object({
+    enabled: z.boolean().default(false),
+    fastProvider: z.string().optional(),
+    fastModel: z.string().optional(),
+  }).optional(),
+
+  // Budget controls
+  budget: z.object({
+    dailyLimitUsd: z.number().optional(),
+    monthlyLimitUsd: z.number().optional(),
+    alertThreshold: z.number().min(0).max(1).default(0.8),
+  }).optional(),
+});
+
+export type ZuboConfig = z.infer<typeof configSchema>;

package/src/db/connection.ts

@@ -0,0 +1,20 @@
+import { Database } from "bun:sqlite";
+import { paths } from "../config/paths";
+
+let _db: Database | null = null;
+
+export function getDb(): Database {
+  if (_db) return _db;
+  _db = new Database(paths.db, { create: true });
+  _db.run("PRAGMA journal_mode = WAL");
+  _db.run("PRAGMA foreign_keys = ON");
+  _db.run("PRAGMA busy_timeout = 5000");
+  return _db;
+}
+
+export function closeDb() {
+  if (_db) {
+    _db.close();
+    _db = null;
+  }
+}

package/src/db/export.ts

@@ -0,0 +1,148 @@
+import { Database } from "bun:sqlite";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, statSync } from "fs";
+import { join, dirname } from "path";
+
+/**
+ * Database export/import/backup utilities.
+ */
+
+interface ExportData {
+  version: 1;
+  exportedAt: string;
+  tables: Record<string, any[]>;
+}
+
+function quoteId(name: string): string {
+  return '"' + name.replace(/"/g, '""') + '"';
+}
+
+// Tables to include in export (skip FTS virtual tables and internal sqlite tables)
+// Tables to include in export — secrets and api_keys are excluded by default
+// to prevent accidental credential exposure
+const EXPORT_TABLES = [
+  "sessions",
+  "messages",
+  "memory_chunks",
+  "cron_jobs",
+  "cron_logs",
+  "usage",
+  "agents",
+  "workflows",
+  "workflow_executions",
+  "proactive_triggers",
+  "uploads",
+  "tool_metrics",
+  "perf_snapshots",
+];
+
+export function exportDatabase(db: Database, outputPath: string): void {
+  const data: ExportData = {
+    version: 1,
+    exportedAt: new Date().toISOString(),
+    tables: {},
+  };
+
+  for (const table of EXPORT_TABLES) {
+    try {
+      const rows = db.query(`SELECT * FROM ${quoteId(table)}`).all();
+      if (rows.length > 0) {
+        data.tables[table] = rows;
+      }
+    } catch {
+      // Table may not exist yet — skip
+    }
+  }
+
+  mkdirSync(dirname(outputPath), { recursive: true });
+  writeFileSync(outputPath, JSON.stringify(data, null, 2));
+}
+
+export function importDatabase(db: Database, inputPath: string): { imported: number; skipped: number } {
+  const raw = readFileSync(inputPath, "utf-8");
+  const data = JSON.parse(raw) as ExportData;
+
+  if (data.version !== 1) {
+    throw new Error(`Unsupported export version: ${data.version}`);
+  }
+
+  let imported = 0;
+  let skipped = 0;
+
+  for (const [table, rows] of Object.entries(data.tables)) {
+    if (!EXPORT_TABLES.includes(table)) continue;
+    if (!/^[a-z_]+$/.test(table)) { skipped += (rows as any[]).length; continue; }
+
+    // Verify table exists
+    const tableCheck = db
+      .query("SELECT name FROM sqlite_master WHERE type='table' AND name=?")
+      .get(table) as any;
+    if (!tableCheck) continue;
+
+    // Validate column names against actual table schema to prevent SQL injection
+    const tableInfo = db.query(`PRAGMA table_info(${quoteId(table)})`).all() as { name: string }[];
+    const validColumns = new Set(tableInfo.map((c) => c.name));
+
+    for (const row of rows) {
+      const columns = Object.keys(row).filter((c) => validColumns.has(c));
+      if (columns.length === 0) { skipped++; continue; }
+      const placeholders = columns.map(() => "?").join(", ");
+      const values = columns.map((c) => row[c]);
+      try {
+        db.prepare(
+          `INSERT OR IGNORE INTO ${quoteId(table)} (${columns.map(quoteId).join(", ")}) VALUES (${placeholders})`
+        ).run(...values);
+        imported++;
+      } catch {
+        skipped++;
+      }
+    }
+  }
+
+  return { imported, skipped };
+}
+
+export function backupDatabase(dbPath: string, backupDir: string): string {
+  mkdirSync(backupDir, { recursive: true });
+  const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const backupPath = join(backupDir, `zubo-backup-${timestamp}.db`);
+
+  // Validate backup path doesn't escape the target directory
+  const resolvedBackup = require("path").resolve(backupPath);
+  const resolvedDir = require("path").resolve(backupDir);
+  if (!resolvedBackup.startsWith(resolvedDir + "/") && resolvedBackup !== resolvedDir) {
+    throw new Error("Invalid backup path");
+  }
+
+  // Use SQLite VACUUM INTO for atomic backup — path is validated above
+  const db = new Database(dbPath, { readonly: true });
+  try {
+    db.run(`VACUUM INTO '${backupPath.replace(/'/g, "''")}'`);
+  } finally {
+    db.close();
+  }
+
+  return backupPath;
+}
+
+export function getDbStats(db: Database): { tables: Record<string, number>; sizeBytes?: number } {
+  const stats: Record<string, number> = {};
+
+  for (const table of EXPORT_TABLES) {
+    try {
+      const row = db.query(`SELECT COUNT(*) as c FROM ${quoteId(table)}`).get() as any;
+      stats[table] = row?.c ?? 0;
+    } catch {
+      // Table doesn't exist
+    }
+  }
+
+  return { tables: stats };
+}
+
+export function getDbSizeBytes(dbPath: string): number {
+  try {
+    return statSync(dbPath).size;
+  } catch {
+    return 0;
+  }
+}

package/src/db/migrations.ts

@@ -0,0 +1,42 @@
+import { Database } from "bun:sqlite";
+import { readdirSync, readFileSync } from "fs";
+import { join } from "path";
+import { logger } from "../util/logger";
+
+const MIGRATIONS_DIR = join(import.meta.dir, "../../migrations");
+
+export function runMigrations(db: Database) {
+  // Create migrations tracking table
+  db.run(`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      name TEXT NOT NULL UNIQUE,
+      applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )
+  `);
+
+  // Get already applied migrations
+  const applied = new Set(
+    db
+      .query("SELECT name FROM _migrations")
+      .all()
+      .map((row: any) => row.name)
+  );
+
+  // Read and sort migration files
+  const files = readdirSync(MIGRATIONS_DIR)
+    .filter((f) => f.endsWith(".sql"))
+    .sort();
+
+  for (const file of files) {
+    if (applied.has(file)) continue;
+
+    const sql = readFileSync(join(MIGRATIONS_DIR, file), "utf-8");
+    logger.info(`Running migration: ${file}`);
+
+    db.transaction(() => {
+      db.run(sql);
+      db.prepare("INSERT INTO _migrations (name) VALUES (?)").run(file);
+    })();
+  }
+}