Commit Graph

127 Commits

Author SHA1 Message Date
southseact-3d
d3205dafe5 Separate OpenCode and Public model management in admin panel
- Add OpenCode Models section with dropdown selection from available models
- Add Public Models section with manual model ID input
- Both sections have up/down ordering buttons for fallback chain priority
- OpenCode models used for execution fallback when rate limits/errors occur
- Public models displayed in builder dropdown for user selection
- Remove unified provider chain in favor of two separate lists
- Keep all existing functionality: Auto Model, Provider Limits, Icon Library, etc.
2026-02-18 19:49:46 +00:00
southseact-3d
f2d7b48743 Add comprehensive test coverage for chat app modules
- Add OpenCode integration tests (provider config, model discovery, streaming)
- Add Dodo Payments tests (checkout flow, webhooks, subscription lifecycle)
- Add OAuth tests (Google/GitHub flow, state management, token exchange)
- Add file operations tests (ZIP handling, uploads, image validation)
- Add external WordPress testing tests (config, SSH, test queue)
- Add blog system tests (posts, categories, caching, RSS feeds)
- Add affiliate system tests (code generation, attribution, commissions)
- Add resource management tests (memory, concurrency, rate limiting)
- Add account management tests (2FA, email/password change, sessions)

Total: 689+ tests passing, covering critical app functionality
2026-02-18 19:46:07 +00:00
Liam Hetherington
fa84b52332 Delete chat/templates/scroll to bottom.zip 2026-02-18 19:15:39 +00:00
southseact-3d
3e81b6042c Remove icon from Buy Top-up button in token limit modal 2026-02-18 19:02:15 +00:00
southseact-3d
8e35b2af95 Add comprehensive test suite for chat app
- Add userRepository.test.js: User CRUD, authentication, OAuth providers, 2FA, affiliate tracking
- Add sessionRepository.test.js: Sessions, refresh tokens, token blacklist, device fingerprinting
- Add auditRepository.test.js: Audit logging, event types, time-based queries, success/failure tracking
- Add connection.test.js: Database initialization, transactions, foreign keys, backup operations
- Add model-routing.test.js: Provider fallback, plan validation, token rates, rate limiting
- Add payments.test.js: Subscription pricing, top-ups, PAYG, discounts, webhook handling
- Add api-endpoints.test.js: Auth endpoints, user management, admin endpoints, middleware
- Update package.json with test scripts (bun test)

Tests cover: accounts, authentication, model routing, payments, subscriptions, admin panel, API endpoints
2026-02-18 18:30:41 +00:00
southseact-3d
1b3b2cdf2a Restore complete admin functionality with new model structure
- Restored original admin.js with all functionality (2692 lines)
- Accounts, affiliates, withdrawals management restored
- All form handlers and API calls preserved
- Updated state to use opencodeModels instead of providerChain
- Updated element references for new OpenCode model structure
- Maintained all existing functionality while applying model changes
2026-02-18 17:01:29 +00:00
southseact-3d
25ee088d6c test: Add comprehensive test coverage for critical modules
- Add tests for chat/encryption.js: encryption/decryption, hashing, token generation
- Add tests for chat/tokenManager.js: JWT tokens, device fingerprints, cookie handling
- Add tests for chat/prompt-sanitizer.js: security patterns, attack detection, obfuscation
- Add tests for admin panel: session management, rate limiting, user/token management
- Add tests for OpenCode write tool: file creation, overwrites, nested directories
- Add tests for OpenCode todo tools: todo CRUD operations
- Add tests for Console billing/account/provider: schemas, validation, price utilities

These tests cover previously untested critical paths including:
- Authentication and security
- Payment processing validation
- Admin functionality
- Model routing and management
- Account management
2026-02-18 16:43:10 +00:00
southseact-3d
b635c80d51 Add back sections 2, 3, 4: Auto Model, Provider Limits, and supporting functionality
- Section 2: Auto Model for Hobby/Free Plan form and handlers
- Section 3: Provider Limits & Usage with configurable rate limits
- Added state management for planSettings and providerLimits
- Added API integration for plan-settings and provider-limits endpoints
- Added populateAutoModelSelect and updateLimitModelOptions functions
- Added renderProviderUsage to display usage data
2026-02-18 16:39:08 +00:00
southseact-3d
81ff352966 feat: Add Kilo Gateway as AI provider
Add full support for Kilo Gateway AI provider across the codebase:

- Add custom loader for 'kilo' provider in provider.ts with API key detection
- Add auth CLI hint for Kilo Gateway in auth.ts
- Add Kilo to DEFAULT_PROVIDER_SEEDS in chat server.js
- Add Kilo to PLANNING_PROVIDERS for planning chain support
- Add Kilo provider configuration with baseURL and API key support
- Update admin env config to show Kilo API key status

Kilo Gateway provides access to 500+ AI models through a single
OpenAI-compatible endpoint at https://api.kilo.ai/api/gateway
2026-02-18 16:22:34 +00:00
southseact-3d
828a9dad41 Remove separate chain concept - fallback is now determined by OpenCode models order
- Removed opencodeChain variable entirely
- Removed chain form/list from admin UI
- Fallback now uses the order of models in the OpenCode models list
- Updated buildOpencodeAttemptChain to iterate through opencodeModels
- Removed chain-related API endpoints
- Simplified to just two lists: opencodeModels and publicModels
2026-02-18 16:18:31 +00:00
southseact-3d
4bb54d38ad Consolidate OpenCode Chain into OpenCode Models section
- Removed separate OpenCode Chain card
- Integrated chain functionality as subsection within OpenCode Models
- Chain form and list now appear below the models list
- Added styling to distinguish the chain subsection
2026-02-18 15:28:04 +00:00
southseact-3d
b961c6e302 Fix remaining providerChain references to opencodeChain 2026-02-18 15:23:36 +00:00
southseact-3d
3ba9fab6ab Clean up model structure: OpenCode Models, Chain, and Public Models
- Simplified to 3 clear sections:
  1. OpenCode Models: OpenCode dropdown + display name + order buttons
  2. OpenCode Chain: Fallback chain with add form + order buttons
  3. Public Models: Manual entry + order buttons (completely separate)
- New state variables: opencodeModels, opencodeChain, publicModels
- Clean API endpoints for chain operations
- Removed all confusing legacy code and naming
2026-02-18 15:11:12 +00:00
southseact-3d
cc17079988 Fix model sections: separate Provider Models and Public-Facing Models
- Provider Models section: restored OpenCode integration with dropdown
- Public-Facing Models section: completely separate manual entry
- Provider Chain section: fallback chain with up/down buttons (unchanged)
- Added separate arrays: providerModels and publicModels
- Added reorder support for both provider and public models
- Updated server to handle providerModel type and reorder by type
2026-02-18 14:38:19 +00:00
southseact-3d
7e5dc8b62d Add up/down reorder buttons and order numbers to public models
- Add order number badge (#1, #2, #3) to each public model
- Add up/down arrow buttons to reorder models in the list
- Add persistPublicModelsOrder function to save reordered list
- Add server-side /api/admin/models/reorder endpoint
- Remove automatic alphabetical sorting to preserve custom order
- First model (#1) gets green background highlighting
2026-02-18 14:08:21 +00:00
southseact-3d
0ce352ad8d feat(admin): Add token usage and remaining balance management options
Implements both Option A and B for admin token management:
- Option A (mode='remaining'): Set tokens remaining to use (calculates usage from limit)
- Option B (mode='usage'): Directly set tokens consumed
- Original mode='limit': Still sets token limit override

The admin UI now presents 3 modes via prompt dialog, and the API endpoint
handles each mode appropriately by updating the token usage bucket.
2026-02-18 10:40:10 +00:00
southseact-3d
44deabc2cf Add unified model chain system with public models and provider chain
- Add publicModels and providerChain data structures for unified fallback
- Add two separate model adding sections in admin panel (public-facing and provider models)
- Add up/down buttons to reorder provider chain order
- Update server to use unified chain for all model fallbacks
- Auto-migrate legacy data on first load
- Update admin.js to handle new model structure and forms
2026-02-18 10:37:01 +00:00
southseact-3d
ae7fdaac6f fix: use currently selected model when redoing messages
When redoing a 'proceed with build' message, the system now uses the
currently selected model from the dropdown instead of the original
message's model. This allows users to switch models before redoing.
2026-02-17 20:01:36 +00:00
southseact-3d
d46515d49a fix: ignore body opencodeSessionId when session was reset
When session.opencodeSessionId is null (indicating the session was reset
due to corruption or undo failure), ignore any opencodeSessionId sent
in the request body. This prevents the client from reusing a corrupted
session that was previously reset on the server.
2026-02-17 19:43:42 +00:00
southseact-3d
227794d463 fix: handle undo failures gracefully by resetting session
When opencode undo command fails:
1. Reset the opencode session (both IDs set to null)
2. Still remove the message from history
3. Return success instead of error

This prevents corrupted sessions from blocking subsequent operations.
2026-02-17 19:24:12 +00:00
southseact-3d
86bd6ff332 fix: reset opencode session when undoing failed messages
When a message fails with zero output and error status, undoing it now
resets the opencode session to ensure the next message starts fresh.
This prevents corrupted session reuse that was causing subsequent failures.
2026-02-17 19:14:05 +00:00
southseact-3d
d4232d487d fix: skip opencode undo when message has zero output
Prevents error when undoing messages that produced no output.
Checks for reply, partialOutput, or done status before sending
/undo command to opencode.
2026-02-17 19:03:27 +00:00
southseact-3d
0e6d3eddb6 Fix: add missing getOpencodeSessionTokenUsage function to resolve redo button error 2026-02-17 18:44:30 +00:00
southseact-3d
0c954449d3 Fix Android app connectivity issues and add detailed logging
- Add CORS headers to backend server to allow mobile app requests
- Implement request timeout (10s) in capacitor-bridge.js to prevent hanging
- Add comprehensive logging throughout authentication flow
- Add detailed error reporting in initApp for better debugging
- Log all API requests with request IDs for traceability

This fixes the 'Loading Plugin Compass...' infinite loop issue caused by
missing CORS headers and unhandled network timeouts.
2026-02-17 10:20:11 +00:00
southseact-3d
103951eb3c fix: skip undo in redo flow when no previous output exists
When clicking redo on a message, the system would fail with 'Command exited with code 1'
if there were previous opencode messages but none of them produced any output. Now we
check if previous messages actually had output (reply or partialOutput) before
attempting to undo, preventing the error when there's nothing to undo.

Fixes issue where redo button fails when previous messages had no output.
2026-02-17 10:13:12 +00:00
Developer
3f6e649965 fix: skip undo for first build message to avoid exit code 1 error
When clicking redo on the first build message, the system would fail with
'Command exited with code 1' because there was nothing to undo. Now we
detect if this is the first opencode message and skip the undo step,
proceeding directly to rebuilding.

Fixes issue where redo button fails on first message in builder.
2026-02-16 21:11:10 +00:00
southseact-3d
49983fbc3c Build OpenCode from source in Docker and remove broken session token queries
- Dockerfile: Build OpenCode CLI from source during Docker build instead of downloading from GitHub releases
- Disabled GitHub Actions workflow that was failing to create releases
- Removed getOpencodeSessionTokenUsage function that tried non-existent CLI commands (session info/usage/show)
- Token tracking now relies on 3 layers: result extraction, streaming capture, and estimation
2026-02-16 16:38:22 +00:00
southseact-3d
c2e5980a8b added scroll to bottom template 2026-02-16 13:42:05 +00:00
Developer
14f59c2f56 Fix builder plan message display and error handling
- Strip double stars (**) and double hashtags (##) from plan message displayContent in both client and server
- Fix server restart error replacing plan message by skipping error state for plan messages
- Fix rate limiting regex pattern to use proper global flag
2026-02-16 08:40:58 +00:00
southseact-3d
dafd3c796d Add admin token override feature for user accounts
- Add tokenOverride field to token usage bucket
- Create POST /api/admin/accounts/tokens endpoint for setting manual token limits
- Update admin accounts page to display token usage and override status
- Add 'Set Tokens' button to manually override user token limits for the month
- Override takes precedence over plan-based limits when set
2026-02-15 16:19:06 +00:00
southseact-3d
9973c3511c fix: remove message status chip for plan messages
Hide the status indicator (queued, running, done, etc.) from user messages
in the builder UI when the message is a plan message (OpenRouter/non-OpenCode
messages). Regular build messages still show their status as before.
2026-02-15 13:58:50 +00:00
Developer
04780632e8 fix: show undo/redo buttons when server restart error occurs 2026-02-15 12:50:56 +00:00
Developer
6bcdb2b739 Migrate test checkout page to inline Dodo Payments checkout with theme customization
- Replace modal-based checkout with true inline checkout embedded in page layout
- Implement split layout: payment form on left, package selection + order summary on right
- Add real-time order summary sync via checkout.breakdown events
- Apply comprehensive theme customization matching app design (Shopify green, proper colors)
- Add loading states and empty state for better UX
- Use ES modules with proper DodoPayments SDK import
2026-02-15 10:58:15 +00:00
Developer
cea30dc84c Fix admin test checkout email validation - ensure valid email format is sent to Dodo Payments 2026-02-14 21:36:55 +00:00
Developer
a6a5d8f7a0 Fix ReferenceError: handleAdminTopupOptions is not defined
- Added missing closing brace for handleTopupConfirm function
- Removed extra closing brace after handleAdminMe function
- Admin functions (handleAdminTopupOptions, handleAdminTopupCheckout, handleAdminTopupConfirm) were incorrectly nested inside handleTopupConfirm scope, making them inaccessible to the router
2026-02-14 20:38:22 +00:00
Developer
4fa0a1b737 Fix ReferenceError: handleAdminTopupOptions is not defined by removing unnecessary await 2026-02-13 19:43:11 +00:00
Developer
180990bea5 fix: standardize contact email to info@plugincompass.com and add await to topup handlers 2026-02-13 15:02:31 +00:00
southseact-3d
af30843f05 fix: add missing Map declarations (loginAttempts, adminLoginAttempts, apiRateLimit, csrfTokens)
Fixed ReferenceError: apiRateLimit is not defined that was causing
internal server errors on all pages. Added 4 missing Map variable
declarations that are used throughout the codebase for rate limiting
and CSRF protection.
2026-02-13 11:13:07 +00:00
southseact-3d
098e971151 Fix syntax error: remove orphan object definition after sendEmail function 2026-02-13 09:18:11 +00:00
southseact-3d
df3a8cdf43 mailpilot sending 2026-02-12 19:35:55 +00:00
southseact-3d
6c09b70317 fix: improve plan change UX with card charge confirmation and fix paid-to-free downgrade 2026-02-12 19:06:17 +00:00
southseact-3d
16f620cccb added internal mcp for the wp verify scripts 2026-02-12 17:01:18 +00:00
southseact-3d
49747d08db fix: prevent duplicate Dodo customers and handle multiple subscriptions per email
Comprehensive fixes to prevent customer ID mismatches:

1. **Checkout creation now passes customer_id** (lines 13669, 13064, 13503):
   - All checkouts (subscription, topup, PAYG) now call ensureDodoCustomer() first
   - Pass existing customer_id to checkout body to prevent Dodo from creating duplicates
   - Added customerId to metadata for tracking

2. **Subscription confirmation validates customer consistency** (line 13843):
   - Logs warning when checkout returns different customer_id than stored
   - Tracks which customer_id was used in checkout metadata
   - Prevents silent customer ID overwrites

3. **ensureDodoCustomer handles multiple customers per email** (line 6774):
   - Logs warning when multiple customers found for same email
   - Checks ALL customers for active subscriptions
   - Selects customer with active subscriptions if multiple exist
   - Returns first customer only if no active subscriptions found

4. **Added missing return statements** (lines 12417, 12448):
   - Prevents double response errors after successful plan changes

This ensures that:
- New subscriptions use existing customers instead of creating duplicates
- Plan changes work correctly even with multiple subscriptions
- Customer ID mismatches are detected and logged
- The correct customer (one with active subscriptions) is always used
2026-02-12 12:06:49 +00:00
southseact-3d
d61fa3d621 fix: add return statements after successful plan changes to prevent double response
- Added return statement after successful paid-to-free cancellation (line 12417)
- Added return statement after successful paid-to-paid plan change (line 12448)
- Prevents 'Cannot write headers after they are sent' error
- Each plan change now returns immediately with the updated account data
2026-02-12 11:58:35 +00:00
southseact-3d
1e30e07ed5 fix: remove hardcoded subscription ID and rely on API queries
- Removed hardcoded subscription ID from code
- Rely on API queries to find subscriptions by customer or through fallback search
- Added proper logging to diagnose customer/subscription mismatches
2026-02-12 11:51:51 +00:00
southseact-3d
8e937a6ff4 debug: try fetching subscription directly by ID to check customer mismatch
- Add direct API call to fetch subscription sub_0NYKZRvba3g5KJfp8R5jp
- Log customer ID comparison to detect mismatches
- Update user record if subscription belongs to different customer
- This will help identify if duplicate customers exist in Dodo
2026-02-12 11:50:14 +00:00
southseact-3d
2268a0e649 debug: log full API response to diagnose empty subscription results 2026-02-12 11:48:58 +00:00
southseact-3d
001993d0bc fix: query all subscriptions without status filter for customers with multiple subs
- Query ALL subscriptions for customer without status filter first
- This handles customers with multiple subscriptions across different statuses
- Returns first active subscription found, or most recent if none active
- Added detailed logging to show all subscription IDs and statuses found
- Fallback to check individual statuses including cancelled/expired
2026-02-12 11:45:53 +00:00
southseact-3d
2a603549f4 debug: add detailed logging for customer and subscription lookup
Add comprehensive DEBUG logs to trace through:
- Customer lookup by email (request and response details)
- Subscription lookup by customer ID (for each status)
- Entry point when plan change is initiated

This will help identify exactly where the lookup is failing.
2026-02-12 11:36:52 +00:00
southseact-3d
d82dcfd5e4 fix: improve customer lookup to prevent duplicate customers in Dodo
- Modified ensureDodoCustomer() to query existing customers by email before creating new ones
- This prevents duplicate customer records when dodoCustomerId is missing from database
- Added logging for both found existing customers and new customer creation
- Updated subscription lookup to check multiple statuses (active, pending, on_hold)
- Should resolve paid-to-paid and paid-to-free plan change issues for users missing subscription IDs
2026-02-12 11:30:52 +00:00