Compare commits
1 Commits
codex/prod
...
codex/issu
| Author | SHA1 | Date | |
|---|---|---|---|
|
5b176851c8 |
10
.env.example
10
.env.example
@@ -1,4 +1,4 @@
|
||||
# Intelligence Terminal configuration
|
||||
# Intelligence Terminal / Crucix configuration
|
||||
# Copy to .env. Keep comments on separate lines; Docker env_file treats inline comments as values.
|
||||
|
||||
# Server
|
||||
@@ -6,13 +6,7 @@ PORT=3117
|
||||
REFRESH_INTERVAL_MINUTES=15
|
||||
AUTO_OPEN_BROWSER=false
|
||||
STALE_DATA_MAX_AGE_MINUTES=60
|
||||
STALE_ALERT_COOLDOWN_MINUTES=60
|
||||
DASHBOARD_URL=
|
||||
TERMINAL_ACTIONS_ENABLED=true
|
||||
SWEEP_TOKEN=
|
||||
SSE_HEARTBEAT_INTERVAL_MS=25000
|
||||
TERMINAL_ACTION_RATE_LIMIT_WINDOW_MS=60000
|
||||
TERMINAL_ACTION_RATE_LIMIT_MAX=10
|
||||
BRIEF_VERBOSITY=standard
|
||||
|
||||
# LLM layer
|
||||
@@ -41,8 +35,6 @@ ACLED_EMAIL=
|
||||
ACLED_PASSWORD=
|
||||
CLOUDFLARE_API_TOKEN=
|
||||
BLS_API_KEY=
|
||||
REDDIT_CLIENT_ID=
|
||||
REDDIT_CLIENT_SECRET=
|
||||
|
||||
# Telegram bot and alerts
|
||||
TELEGRAM_BOT_TOKEN=
|
||||
|
||||
@@ -38,12 +38,7 @@ jobs:
|
||||
run: docker compose config
|
||||
|
||||
- name: Build Docker image
|
||||
shell: bash
|
||||
run: |
|
||||
image="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}"
|
||||
build_tag="build-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_NUMBER:-0}"
|
||||
echo "BUILD_IMAGE=${image}:${build_tag}" >> "$GITHUB_ENV"
|
||||
docker build -t "${image}:${build_tag}" .
|
||||
run: docker build -t "${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}:${GITHUB_SHA}" .
|
||||
|
||||
- name: Publish Docker image
|
||||
if: ${{ env.REGISTRY_TOKEN != '' }}
|
||||
@@ -52,9 +47,8 @@ jobs:
|
||||
image="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}"
|
||||
date_tag="$(date -u +%Y%m%d)"
|
||||
echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY_HOST}" -u "${REGISTRY_USERNAME}" --password-stdin
|
||||
docker tag "${BUILD_IMAGE}" "${image}:${GITHUB_SHA}"
|
||||
docker tag "${BUILD_IMAGE}" "${image}:latest"
|
||||
docker tag "${BUILD_IMAGE}" "${image}:${date_tag}"
|
||||
docker tag "${image}:${GITHUB_SHA}" "${image}:latest"
|
||||
docker tag "${image}:${GITHUB_SHA}" "${image}:${date_tag}"
|
||||
docker push "${image}:${GITHUB_SHA}"
|
||||
docker push "${image}:latest"
|
||||
docker push "${image}:${date_tag}"
|
||||
|
||||
2
.github/CODEOWNERS
vendored
2
.github/CODEOWNERS
vendored
@@ -1 +1 @@
|
||||
* @MrSphay
|
||||
* @calesthio
|
||||
|
||||
2
.github/ISSUE_TEMPLATE/config.yml
vendored
2
.github/ISSUE_TEMPLATE/config.yml
vendored
@@ -1,5 +1,5 @@
|
||||
blank_issues_enabled: true
|
||||
contact_links:
|
||||
- name: Security report
|
||||
url: https://git.wilkensxl.de/MrSphay/intelligence-terminal
|
||||
url: mailto:celesthioailabs@gmail.com
|
||||
about: Report security issues privately instead of opening a public issue.
|
||||
|
||||
68
.github/workflows/docker-publish.yml
vendored
Normal file
68
.github/workflows/docker-publish.yml
vendored
Normal file
@@ -0,0 +1,68 @@
|
||||
name: Build & Publish Docker Image
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
tags: ['v*']
|
||||
pull_request:
|
||||
branches: [master]
|
||||
|
||||
env:
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository }}
|
||||
|
||||
jobs:
|
||||
build-and-push:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Log in to GHCR
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
if: github.event_name != 'pull_request' && vars.DOCKERHUB_ENABLED == 'true'
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
${{ vars.DOCKERHUB_ENABLED == 'true' && format('{0}/{1}', secrets.DOCKERHUB_USERNAME, 'crucix') || '' }}
|
||||
tags: |
|
||||
type=raw,value=latest,enable={{is_default_branch}}
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
type=sha,prefix=
|
||||
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: ${{ github.event_name != 'pull_request' }}
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
@@ -1,6 +1,6 @@
|
||||
# Contributing to Intelligence Terminal
|
||||
# Contributing to Crucix
|
||||
|
||||
Intelligence Terminal moves quickly, but review bandwidth is limited. The easiest way to get a change merged is to keep it small, well-scoped, and aligned with the project's private home-server deployment direction.
|
||||
Crucix moves quickly, but review bandwidth is limited. The easiest way to get a change merged is to keep it small, well-scoped, and aligned with the project's direction.
|
||||
|
||||
## What Contributions Are Most Helpful
|
||||
|
||||
|
||||
187
README.md
187
README.md
@@ -1,11 +1,13 @@
|
||||
<div align="center">
|
||||
|
||||
# Intelligence Terminal
|
||||
# Crucix
|
||||
|
||||
**Self-hosted intelligence dashboard. 27 open sources. Docker-first. No telemetry.**
|
||||
**Your own intelligence terminal. 27 sources. One command. Zero cloud.**
|
||||
|
||||
[](https://git.wilkensxl.de/MrSphay/intelligence-terminal)
|
||||
[](https://git.wilkensxl.de/MrSphay/-/packages/container/intelligence-terminal/latest)
|
||||
## [Visit The Live Site: crucix.live](https://www.crucix.live/)
|
||||
|
||||
[](https://www.crucix.live/)
|
||||
[](https://www.crucix.live/)
|
||||
|
||||
[](#quick-start)
|
||||
[](LICENSE)
|
||||
@@ -13,7 +15,12 @@
|
||||
[](#data-sources-27)
|
||||
[](#docker)
|
||||
|
||||
|
||||
**Enter The Signal Network**
|
||||
|
||||
[](https://x.com/crucixmonitor)
|
||||
[](https://discord.gg/ChVy7SF4)
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
<summary>More screenshots</summary>
|
||||
@@ -30,24 +37,22 @@
|
||||
|
||||
</div>
|
||||
|
||||
> **Supported deployment:** private home-server or lab deployment through Docker, Dockge, Pangolin, or local Node.js.
|
||||
> Runtime data stays in your configured `runs/` volume and API keys are operator-owned.
|
||||
> **Source:** [git.wilkensxl.de/MrSphay/intelligence-terminal](https://git.wilkensxl.de/MrSphay/intelligence-terminal)
|
||||
> Pull the image or clone the repository to run Intelligence Terminal on your own infrastructure.
|
||||
> **Live website:** [https://www.crucix.live/](https://www.crucix.live/)
|
||||
> Explore the public demo first, then clone the repo to run Crucix locally.
|
||||
|
||||
Intelligence Terminal pulls satellite fire detection, flight tracking, radiation monitoring, satellite constellation tracking, economic indicators, live market prices, conflict data, sanctions lists, and social sentiment from 27 open-source intelligence feeds in parallel, every 15 minutes, and renders everything on a single self-contained dashboard.
|
||||
Crucix pulls satellite fire detection, flight tracking, radiation monitoring, satellite constellation tracking, economic indicators, live market prices, conflict data, sanctions lists, and social sentiment from 27 open-source intelligence feeds — in parallel, every 15 minutes — and renders everything on a single self-contained Jarvis-style dashboard.
|
||||
|
||||
Hook it up to an LLM and it becomes a **two-way intelligence assistant**: pushing multi-tier alerts to Telegram and Discord when something meaningful changes, responding to commands like `/brief` and `/sweep` from your phone, and generating trade ideas grounded in real cross-domain data.
|
||||
Hook it up to an LLM and it becomes a **two-way intelligence assistant** — pushing multi-tier alerts to Telegram and Discord when something meaningful changes, responding to commands like `/brief` and `/sweep` from your phone, and generating actionable trade ideas grounded in real cross-domain data. Your own analyst that watches the world while you sleep.
|
||||
|
||||
Run it locally with Node.js or pull the published Docker image for a home-server deployment.
|
||||
Try the live demo first at [https://www.crucix.live/](https://www.crucix.live/), then clone the repo when you want the full local stack.
|
||||
|
||||
No cloud. No telemetry. No subscriptions. Just `node server.mjs` and you're running.
|
||||
|
||||
## Token / Asset Warning
|
||||
|
||||
> [!WARNING]
|
||||
> **Intelligence Terminal has not launched any official token, coin, NFT, airdrop, presale, or other blockchain-based asset.**
|
||||
> Any token or digital asset using the Intelligence Terminal or Crucix name, logo, or branding is not affiliated with or endorsed by this project.
|
||||
> **Crucix has not launched any official token, coin, NFT, airdrop, presale, or other blockchain-based asset.**
|
||||
> Any token or digital asset using the Crucix name, logo, or branding is not affiliated with or endorsed by Crucix.
|
||||
> Do not buy it, promote it, connect a wallet to claim it, sign transactions, or send funds based on third-party posts, DMs, or websites.
|
||||
|
||||
---
|
||||
@@ -56,7 +61,7 @@ No cloud. No telemetry. No subscriptions. Just `node server.mjs` and you're runn
|
||||
|
||||
Most of the world's real-time intelligence — satellite imagery, radiation levels, conflict events, economic indicators, flight tracking, maritime activity — is publicly available. It's just scattered across dozens of government APIs, research institutions, and open data feeds that nobody has time to check individually.
|
||||
|
||||
Intelligence Terminal brings it all into one place. Not behind a paywall, not locked in an enterprise platform, not requiring a security clearance. Just open data, aggregated and cross-correlated on your own machine, updated every 15 minutes.
|
||||
Crucix brings it all into one place. Not behind a paywall, not locked in an enterprise platform, not requiring a security clearance. Just open data, aggregated and cross-correlated on your own machine, updated every 15 minutes.
|
||||
|
||||
It was built for anyone who wants to understand what's actually happening in the world right now — researchers, journalists, traders, OSINT analysts, or just curious people who believe access to information shouldn't depend on your budget.
|
||||
|
||||
@@ -66,8 +71,8 @@ It was built for anyone who wants to understand what's actually happening in the
|
||||
|
||||
```bash
|
||||
# 1. Clone the repo
|
||||
git clone https://git.wilkensxl.de/MrSphay/intelligence-terminal.git
|
||||
cd intelligence-terminal
|
||||
git clone https://github.com/calesthio/Crucix.git
|
||||
cd Crucix
|
||||
|
||||
# 2. Install dependencies (just Express)
|
||||
npm install
|
||||
@@ -130,13 +135,7 @@ PORT=3117
|
||||
REFRESH_INTERVAL_MINUTES=15
|
||||
AUTO_OPEN_BROWSER=false
|
||||
STALE_DATA_MAX_AGE_MINUTES=60
|
||||
STALE_ALERT_COOLDOWN_MINUTES=60
|
||||
DASHBOARD_URL=https://intelligence.example.internal
|
||||
TERMINAL_ACTIONS_ENABLED=true
|
||||
SWEEP_TOKEN=
|
||||
SSE_HEARTBEAT_INTERVAL_MS=25000
|
||||
TERMINAL_ACTION_RATE_LIMIT_WINDOW_MS=60000
|
||||
TERMINAL_ACTION_RATE_LIMIT_MAX=10
|
||||
BRIEF_VERBOSITY=standard
|
||||
|
||||
LLM_PROVIDER=openrouter
|
||||
@@ -188,102 +187,6 @@ LLM_MODEL=your-model
|
||||
|
||||
For Pangolin or another reverse proxy, forward HTTP traffic to `intelligence-terminal:3117` (or the `PORT` you set). Missing API keys do not crash sweeps; affected sources are reported as degraded in `/api/health`.
|
||||
|
||||
#### Terminal Action Exposure
|
||||
|
||||
`POST /api/action` and `POST /api/sweep` can trigger operational actions such as manual sweeps. The dashboard has a **SET TOKEN** control that stores your `SWEEP_TOKEN` in browser local storage and sends it as the `x-crucix-token` header; do not put action tokens in URLs.
|
||||
|
||||
Recommended settings:
|
||||
|
||||
| Deployment | Settings |
|
||||
| --- | --- |
|
||||
| Private local machine | `NODE_ENV=development`, optional `SWEEP_TOKEN`, optional `TERMINAL_ACTIONS_ENABLED=true`. Localhost can run actions without a token for development. |
|
||||
| Private LAN / Dockge | Set a strong `SWEEP_TOKEN`, keep `TERMINAL_ACTIONS_ENABLED=true`, expose only to trusted clients. |
|
||||
| Pangolin-authenticated reverse proxy | Set a strong `SWEEP_TOKEN`, keep Pangolin auth in front, use the dashboard **SET TOKEN** flow once per browser. |
|
||||
| Public internet | Do not expose Terminal Actions directly. If exposure is unavoidable, require `SWEEP_TOKEN`, keep proxy authentication enabled, lower `TERMINAL_ACTION_RATE_LIMIT_MAX`, and monitor server audit logs. |
|
||||
|
||||
Action endpoints reject cross-origin POST origins, apply a small in-memory per-IP rate limit, and write sanitized audit lines without logging the token.
|
||||
|
||||
When data remains stale past `STALE_DATA_MAX_AGE_MINUTES`, the server sends an operator alert through configured Telegram/Discord channels after failed or degraded sweep attempts. `STALE_ALERT_COOLDOWN_MINUTES` prevents repeated stale alerts from spamming every refresh interval. Set `DASHBOARD_URL` to the Pangolin/public URL you want included in those alerts.
|
||||
|
||||
#### Memory And Prediction Loop
|
||||
|
||||
Crucix stores longitudinal memory in `runs/intelligence.db` when the current Node.js build exposes `node:sqlite`. If SQLite is unavailable, the file is created as a harmless placeholder and `/api/health` reports the memory store as unavailable instead of failing the sweep.
|
||||
|
||||
The memory layer persists:
|
||||
|
||||
| Table | Purpose |
|
||||
| --- | --- |
|
||||
| `runs` | Sweep timestamps, source health counts, and delta direction summaries. |
|
||||
| `entities` | Stable entity IDs for recurring countries, regions, and locations. |
|
||||
| `events` | Stable event IDs for conflict, OSINT, urgent news, and new delta signals across sweeps. |
|
||||
| `predictions` | Trade/intelligence hypotheses with evidence, confidence, horizon, outcome state, and latest grading. |
|
||||
|
||||
Query endpoints:
|
||||
|
||||
```text
|
||||
GET /api/memory/search?q=iran&limit=25
|
||||
GET /api/memory/predictions?state=open&limit=25
|
||||
```
|
||||
|
||||
Memory endpoints use the same operator authorization gate as Terminal Actions. The dashboard Terminal Actions panel includes a `Memory` action for a quick operator-facing view of recent events and prediction states.
|
||||
|
||||
Retention, backup, and privacy expectations:
|
||||
|
||||
- Treat `runs/intelligence.db` as operator data. It can contain source excerpts, headlines, generated hypotheses, and URLs from your configured feeds.
|
||||
- Back up `runs/` with the rest of your Dockge volume if you want longitudinal learning to survive container replacement.
|
||||
- Delete `runs/intelligence.db` to reset SQLite memory; the next sweep recreates the schema.
|
||||
- Do not commit `runs/` or `.env`. API credentials stay in `.env`; memory stores derived observations, not secrets.
|
||||
- If you expose the dashboard through a reverse proxy, protect Terminal Actions and memory queries behind your normal authentication boundary.
|
||||
|
||||
#### Reverse Proxy SSE
|
||||
|
||||
The dashboard receives live sweep updates from `GET /events` using Server-Sent Events. The server sends `retry: 10000` reconnect guidance and lightweight heartbeat comments every `SSE_HEARTBEAT_INTERVAL_MS` milliseconds so reverse proxies do not close an otherwise idle stream between 15-minute sweeps.
|
||||
|
||||
Recommended proxy settings:
|
||||
|
||||
| Proxy | Setting |
|
||||
| --- | --- |
|
||||
| Pangolin / Traefik-style frontends | Keep response streaming enabled and set idle timeouts above `SSE_HEARTBEAT_INTERVAL_MS`. |
|
||||
| Nginx | Disable proxy buffering for `/events`, keep `proxy_read_timeout` above the heartbeat interval, and preserve `Connection: keep-alive`. |
|
||||
| Cloudflare-style proxies | Keep the heartbeat below common idle cutoffs; the default 25s is intentionally conservative. |
|
||||
|
||||
If you raise the heartbeat interval, keep it shorter than the lowest idle timeout in the proxy chain.
|
||||
|
||||
`/api/metrics` includes network health grouped by host and source/provider. Source modules should use `safeFetch(url, { source: 'SourceName' })`; when omitted, the shared helper infers a stable provider bucket from the URL host instead of grouping normal source traffic under `unknown`. Raw fetch exceptions are documented in [Source Fetch Instrumentation](docs/source-fetch-instrumentation.md).
|
||||
|
||||
#### Scenario Watchlist
|
||||
|
||||
Intelligence Terminal can track operator hypotheses across sweeps with a runtime scenario file at `runs/scenarios.json`. On first run, the server creates three disabled starter examples:
|
||||
|
||||
- Middle East energy shock
|
||||
- Macro stress spillover
|
||||
- Regional escalation risk
|
||||
|
||||
Enable or add scenarios by editing `runs/scenarios.json`:
|
||||
|
||||
```json
|
||||
{
|
||||
"version": 1,
|
||||
"scenarios": [
|
||||
{
|
||||
"id": "middle-east-energy-shock",
|
||||
"enabled": true,
|
||||
"name": "Middle East energy shock",
|
||||
"description": "Energy supply risk building from regional conflict.",
|
||||
"regions": ["Middle East", "Iran", "Strait of Hormuz"],
|
||||
"categories": ["osint", "energy", "maritime"],
|
||||
"keywords": ["missile", "strike", "hormuz", "oil"],
|
||||
"thresholds": { "watching": 2, "building": 4, "confirmed": 7 },
|
||||
"invalidation": "WTI normalizes and urgent regional signals fade."
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
Malformed scenario config degrades safely: sweeps continue and the dashboard shows the watchlist as a config issue. Scenario state is persisted in `runs/scenario-state.json`; delete that file to reset state transitions without deleting definitions.
|
||||
|
||||
Scenario states are `dormant`, `watching`, `building`, and `confirmed`. The dashboard shows active scenario state, confidence, score, and recent trigger time. Briefings include a `Scenario Watchlist` section when one or more scenarios change state.
|
||||
|
||||
#### Build And Publish Your Gitea Image
|
||||
|
||||
```bash
|
||||
@@ -342,7 +245,7 @@ The server runs a sweep cycle every 15 minutes (configurable). Each cycle:
|
||||
6. Pushes update to all connected browsers via SSE
|
||||
|
||||
### Telegram Bot (Two-Way)
|
||||
Intelligence Terminal doubles as an interactive Telegram bot. Beyond sending alerts, it responds to commands directly from your chat:
|
||||
Crucix doubles as an interactive Telegram bot. Beyond sending alerts, it responds to commands directly from your chat:
|
||||
|
||||
| Command | What It Does |
|
||||
|---------|-------------|
|
||||
@@ -359,7 +262,7 @@ This requires `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID` in `.env`. The bot pol
|
||||
|
||||
### Discord Bot (Two-Way)
|
||||
|
||||
Intelligence Terminal also supports Discord as a full-featured bot with slash commands and rich embed alerts. It mirrors the Telegram bot's capabilities with Discord-native formatting.
|
||||
Crucix also supports Discord as a full-featured bot with slash commands and rich embed alerts. It mirrors the Telegram bot's capabilities with Discord-native formatting.
|
||||
|
||||
| Command | What It Does |
|
||||
|---------|-------------|
|
||||
@@ -374,7 +277,7 @@ Alerts are delivered as rich embeds with color-coded sidebars: red for FLASH, ye
|
||||
|
||||
**Webhook fallback:** If you don't want to run a full bot, set `DISCORD_WEBHOOK_URL` instead. This enables one-way alerts (no slash commands) with zero dependencies — no `discord.js` needed.
|
||||
|
||||
**Optional dependency:** The full bot requires `discord.js`. Install it with `npm install discord.js`. If it's not installed, Intelligence Terminal automatically falls back to webhook-only mode.
|
||||
**Optional dependency:** The full bot requires `discord.js`. Install it with `npm install discord.js`. If it's not installed, Crucix automatically falls back to webhook-only mode.
|
||||
|
||||
### Optional LLM Layer
|
||||
Connect cloud or local OpenAI-compatible LLM providers for enhanced analysis:
|
||||
@@ -421,12 +324,9 @@ These three unlock the most valuable economic and satellite data. Each takes abo
|
||||
|
||||
| Key | Source | How to Get |
|
||||
|-----|--------|------------|
|
||||
| `ACLED_EMAIL` + `ACLED_PASSWORD` | Armed conflict event data | [acleddata.com/register](https://acleddata.com/register/) — free, OAuth2. `ACLED_USER` / `ACLED_USERNAME` are accepted as email aliases |
|
||||
| `ACLED_EMAIL` + `ACLED_PASSWORD` | Armed conflict event data | [acleddata.com/register](https://acleddata.com/register/) — free, OAuth2 |
|
||||
| `AISSTREAM_API_KEY` | Maritime AIS vessel tracking | [aisstream.io](https://aisstream.io/) — free |
|
||||
| `ADSB_API_KEY` | Unfiltered flight tracking | [RapidAPI](https://rapidapi.com/adsbexchange/api/adsbexchange-com1) — ~$10/mo |
|
||||
| `REDDIT_CLIENT_ID` + `REDDIT_CLIENT_SECRET` | Reddit social sentiment | [reddit.com/prefs/apps](https://www.reddit.com/prefs/apps/) — create a script app |
|
||||
|
||||
Reddit is OAuth-only in this fork. If the Reddit credentials are missing or rejected, the Reddit source is reported as degraded and no unauthenticated `reddit.com/.../hot.json` fallback is used.
|
||||
|
||||
### LLM Provider (optional, for AI-enhanced ideas)
|
||||
|
||||
@@ -475,14 +375,14 @@ Alerts work with or without an LLM on both Telegram and Discord. With an LLM con
|
||||
|
||||
### Without Any Keys
|
||||
|
||||
Intelligence Terminal still works with zero API keys. 18+ sources require no authentication at all. Sources that need keys return structured errors and the rest of the sweep continues normally.
|
||||
Crucix still works with zero API keys. 18+ sources require no authentication at all. Sources that need keys return structured errors and the rest of the sweep continues normally.
|
||||
|
||||
---
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
intelligence-terminal/
|
||||
crucix/
|
||||
├── server.mjs # Express dev server (SSE, auto-refresh, LLM, bot commands)
|
||||
├── crucix.config.mjs # Configuration with env var overrides + delta thresholds
|
||||
├── diag.mjs # Diagnostic script — run if server fails to start
|
||||
@@ -622,9 +522,6 @@ All settings are in `.env` with sensible defaults:
|
||||
|----------|---------|-------------|
|
||||
| `PORT` | `3117` | Dashboard server port |
|
||||
| `REFRESH_INTERVAL_MINUTES` | `15` | Auto-refresh interval |
|
||||
| `STALE_DATA_MAX_AGE_MINUTES` | `60` | Data age threshold for stale health state |
|
||||
| `STALE_ALERT_COOLDOWN_MINUTES` | `60` | Minimum time between repeated operator stale-data alerts |
|
||||
| `DASHBOARD_URL` | local URL | Dashboard URL included in operator alerts |
|
||||
| `LLM_PROVIDER` | disabled | `anthropic`, `openai`, `gemini`, `codex`, `openrouter`, `minimax`, `mistral`, or `grok` |
|
||||
| `LLM_API_KEY` | — | API key (not needed for codex) |
|
||||
| `LLM_MODEL` | per-provider default | Override model selection |
|
||||
@@ -674,7 +571,7 @@ This tests every import one by one, checks your Node.js version, and verifies po
|
||||
|
||||
**3. Check if port 3117 is already in use:**
|
||||
|
||||
A previous Intelligence Terminal instance may still be running in the background.
|
||||
A previous Crucix instance may still be running in the background.
|
||||
|
||||
```powershell
|
||||
# Windows PowerShell
|
||||
@@ -696,7 +593,7 @@ Then try starting again. You can also change the port by setting `PORT=3118` in
|
||||
```bash
|
||||
node --version
|
||||
```
|
||||
Intelligence Terminal requires Node.js 22 or later. If you have an older version, download the latest LTS from [nodejs.org](https://nodejs.org/).
|
||||
Crucix requires Node.js 22 or later. If you have an older version, download the latest LTS from [nodejs.org](https://nodejs.org/).
|
||||
|
||||
### Dashboard shows empty panels after first start
|
||||
|
||||
@@ -706,11 +603,11 @@ This is normal — the first sweep takes 30–60 seconds to query all 27 sources
|
||||
|
||||
Expected behavior. Sources that require API keys will return structured errors if the key isn't set. The rest of the sweep continues normally. Check the Source Integrity section in the dashboard (or the server logs) to see which sources failed and why. The 3 most impactful free keys to add are `FRED_API_KEY`, `FIRMS_MAP_KEY`, and `EIA_API_KEY`.
|
||||
|
||||
OpenSky can also return `HTTP 429` when its public hotspots are queried too aggressively. Intelligence Terminal does not try to evade that limit. Instead, it surfaces the throttle/error in source health and preserves the most recent non-empty air traffic snapshot from `runs/` so the dashboard flight layer does not suddenly go blank on a throttled sweep.
|
||||
OpenSky can also return `HTTP 429` when its public hotspots are queried too aggressively. Crucix does not try to evade that limit. Instead, it surfaces the throttle/error in source health and preserves the most recent non-empty air traffic snapshot from `runs/` so the dashboard flight layer does not suddenly go blank on a throttled sweep.
|
||||
|
||||
### Telegram bot not responding to commands
|
||||
|
||||
Make sure both `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID` are set in `.env`. The bot only responds to messages from the configured chat ID (security measure). You should see Telegram alert and bot polling startup lines in the server logs. If not, double-check your token with `curl https://api.telegram.org/bot<YOUR_TOKEN>/getMe`.
|
||||
Make sure both `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID` are set in `.env`. The bot only responds to messages from the configured chat ID (security measure). You should see `[Crucix] Telegram alerts enabled` and `[Crucix] Bot command polling started` in the server logs on startup. If not, double-check your token with `curl https://api.telegram.org/bot<YOUR_TOKEN>/getMe`.
|
||||
|
||||
### Discord bot not responding to slash commands
|
||||
|
||||
@@ -741,21 +638,29 @@ To update them: run the dashboard, wait for a sweep to complete, then use your b
|
||||
|
||||
## Contributing
|
||||
|
||||
Found a bug? Want to add a 28th source? PRs welcome. Each source is a standalone module in `apis/sources/` - just export a `briefing()` function that returns structured data and add it to the orchestrator in `apis/briefing.mjs`.
|
||||
Found a bug? Want to add a 28th source? PRs welcome. Each source is a standalone module in `apis/sources/` — just export a `briefing()` function that returns structured data and add it to the orchestrator in `apis/briefing.mjs`.
|
||||
|
||||
If you find this useful, a star on the Gitea repository helps other operators find it too.
|
||||
If you find this useful, a star helps others find it too.
|
||||
|
||||
For contribution guidelines, review expectations, and source-add rules, see `CONTRIBUTING.md`. For security reports, see `SECURITY.md`.
|
||||
|
||||
## Contact
|
||||
|
||||
For bugs, feature requests, and integration ideas, use the Gitea issue tracker so discussion stays visible and actionable:
|
||||
For partnerships, integrations, or other non-issue inquiries, you can reach me at `celesthioailabs@gmail.com`.
|
||||
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues
|
||||
For bugs and feature requests, please use GitHub Issues so discussion stays visible and actionable.
|
||||
|
||||
## Upstream And License
|
||||
---
|
||||
|
||||
Intelligence Terminal is an AGPL-3.0-only Crucix fork focused on Docker-first home-server operation, source health transparency, Gitea Registry delivery, and operator-owned deployments. Upstream project credit remains with the original Crucix project.
|
||||
## Star History
|
||||
|
||||
<a href="https://www.star-history.com/?repos=calesthio%2FCrucix&type=date&legend=top-left">
|
||||
<picture>
|
||||
<source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=calesthio/Crucix&type=date&theme=dark&legend=top-left" />
|
||||
<source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/image?repos=calesthio/Crucix&type=date&legend=top-left" />
|
||||
<img alt="Star History Chart" src="https://api.star-history.com/image?repos=calesthio/Crucix&type=date&legend=top-left" />
|
||||
</picture>
|
||||
</a>
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -2,13 +2,13 @@
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
If you discover a security issue in Intelligence Terminal, please report it privately instead of opening a public issue.
|
||||
If you discover a security issue in Crucix, please report it privately instead of opening a public GitHub issue.
|
||||
|
||||
Use the private security contact configured for this Gitea repository or contact the repository owner directly.
|
||||
Email: `celesthioailabs@gmail.com`
|
||||
|
||||
Use a subject line like:
|
||||
|
||||
`[Intelligence Terminal Security] short description`
|
||||
`[Crucix Security] short description`
|
||||
|
||||
Please include:
|
||||
|
||||
|
||||
@@ -59,8 +59,7 @@ export async function runSource(name, fn, ...args) {
|
||||
});
|
||||
const data = await Promise.race([dataPromise, timeoutPromise]);
|
||||
const hasError = Boolean(data?.error);
|
||||
const degradedStatuses = ['no_credentials', 'no_key', 'disabled', 'degraded', 'failed', 'error'];
|
||||
const isDegraded = hasError || degradedStatuses.includes(data?.status);
|
||||
const isDegraded = hasError || ['no_credentials', 'degraded', 'failed'].includes(data?.status);
|
||||
return {
|
||||
name,
|
||||
status: isDegraded ? 'degraded' : 'ok',
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
// ACLED - Armed Conflict Location & Event Data.
|
||||
// ACLED — Armed Conflict Location & Event Data
|
||||
// Auth strategy (tries in order):
|
||||
// 1. OAuth Bearer token: POST /oauth/token -> Authorization header
|
||||
// 2. Cookie-based session: POST /user/login?_format=json -> session cookie
|
||||
// Set ACLED_EMAIL and ACLED_PASSWORD in .env. ACLED_USER or ACLED_USERNAME are
|
||||
// accepted as aliases for ACLED_EMAIL.
|
||||
// 1. Cookie-based session: POST /user/login?_format=json → session cookie
|
||||
// 2. OAuth Bearer token: POST /oauth/token → Authorization header
|
||||
// Set ACLED_EMAIL and ACLED_PASSWORD in .env (your myACLED login credentials).
|
||||
// Data endpoint: GET https://acleddata.com/api/acled/read
|
||||
|
||||
import { daysAgo } from '../utils/fetch.mjs';
|
||||
import '../utils/env.mjs';
|
||||
@@ -12,135 +12,155 @@ const LOGIN_URL = 'https://acleddata.com/user/login?_format=json';
|
||||
const TOKEN_URL = 'https://acleddata.com/oauth/token';
|
||||
const API_BASE = 'https://acleddata.com/api/acled/read';
|
||||
|
||||
// Session cache
|
||||
let sessionCache = { cookies: null, token: null, method: null, expires: 0 };
|
||||
|
||||
export function resetAcledSessionCache() {
|
||||
function acledCredentials() {
|
||||
return {
|
||||
email: process.env.ACLED_EMAIL || process.env.ACLED_USER || process.env.ACLED_USERNAME,
|
||||
password: process.env.ACLED_PASSWORD,
|
||||
};
|
||||
}
|
||||
|
||||
function sanitizeAuthHeaders(headers) {
|
||||
const safe = { ...headers };
|
||||
if (safe.Authorization) safe.Authorization = 'Bearer [redacted]';
|
||||
if (safe.Cookie) safe.Cookie = '[redacted]';
|
||||
return safe;
|
||||
}
|
||||
|
||||
function classifyAuthFailure(status, body = '') {
|
||||
if (status === 401 || status === 403) return 'auth_denied';
|
||||
if (status >= 500) return 'auth_endpoint_failed';
|
||||
if (/invalid|denied|unauthorized|forbidden/i.test(body)) return 'auth_denied';
|
||||
return 'auth_endpoint_failed';
|
||||
}
|
||||
|
||||
export function resetAcledSessionForTests() {
|
||||
sessionCache = { cookies: null, token: null, method: null, expires: 0 };
|
||||
}
|
||||
|
||||
export function getAcledConfig(env = process.env) {
|
||||
const email = env.ACLED_EMAIL || env.ACLED_USER || env.ACLED_USERNAME || '';
|
||||
const password = env.ACLED_PASSWORD || '';
|
||||
const missing = [];
|
||||
if (!email) missing.push('ACLED_EMAIL');
|
||||
if (!password) missing.push('ACLED_PASSWORD');
|
||||
return { email, password, configured: missing.length === 0, missing };
|
||||
}
|
||||
|
||||
function acledError(status, error, message, extra = {}) {
|
||||
return { status, error, message, ...extra };
|
||||
}
|
||||
|
||||
function safeText(value, max = 200) {
|
||||
return String(value || '').replace(/Bearer\s+[A-Za-z0-9._-]+/gi, 'Bearer [redacted]').slice(0, max);
|
||||
}
|
||||
|
||||
async function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {
|
||||
// Strategy 1: Cookie-based session login (mirrors browser login)
|
||||
async function loginCookie(email, password) {
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
||||
const timer = setTimeout(() => controller.abort(), 15000);
|
||||
try {
|
||||
return await fetchImpl(url, { ...init, signal: controller.signal });
|
||||
} finally {
|
||||
clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
export async function loginCookie(email, password, opts = {}) {
|
||||
const fetchImpl = opts.fetchImpl || globalThis.fetch;
|
||||
try {
|
||||
const res = await fetchWithTimeout(fetchImpl, LOGIN_URL, {
|
||||
const res = await fetch(LOGIN_URL, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ name: email, pass: password }),
|
||||
redirect: 'manual',
|
||||
}, 15000);
|
||||
signal: controller.signal,
|
||||
});
|
||||
clearTimeout(timer);
|
||||
|
||||
// Collect Set-Cookie headers
|
||||
const setCookies = res.headers.getSetCookie?.() || [];
|
||||
const cookieStr = setCookies.map(c => c.split(';')[0]).join('; ');
|
||||
|
||||
if ((res.ok || (res.status >= 300 && res.status < 400)) && cookieStr) {
|
||||
return { ok: true, cookies: cookieStr };
|
||||
if (res.ok && cookieStr) {
|
||||
return { cookies: cookieStr };
|
||||
}
|
||||
|
||||
// Some Drupal sites return 303 redirect on successful login — cookies still set
|
||||
if (res.status >= 300 && res.status < 400 && cookieStr) {
|
||||
return { cookies: cookieStr };
|
||||
}
|
||||
|
||||
const errText = await res.text().catch(() => '');
|
||||
return acledError('auth_failed', `acled_cookie_http_${res.status}`, `ACLED cookie login failed with HTTP ${res.status}`, {
|
||||
detail: safeText(errText),
|
||||
});
|
||||
return {
|
||||
error: `Cookie login failed (HTTP ${res.status}): ${errText.slice(0, 200)}`,
|
||||
code: classifyAuthFailure(res.status, errText),
|
||||
};
|
||||
} catch (e) {
|
||||
return acledError('auth_failed', 'acled_cookie_request_failed', `ACLED cookie login error: ${e.message}`);
|
||||
clearTimeout(timer);
|
||||
const cause = e.cause ? ` → ${e.cause.message || e.cause.code || e.cause}` : '';
|
||||
return { error: `Cookie login error: ${e.message}${cause}`, code: 'auth_endpoint_failed' };
|
||||
}
|
||||
}
|
||||
|
||||
export async function loginOAuth(email, password, opts = {}) {
|
||||
const fetchImpl = opts.fetchImpl || globalThis.fetch;
|
||||
// Strategy 2: OAuth2 password grant
|
||||
async function loginOAuth(email, password) {
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), 15000);
|
||||
try {
|
||||
const body = new URLSearchParams({
|
||||
username: email,
|
||||
password,
|
||||
password: password,
|
||||
grant_type: 'password',
|
||||
client_id: 'acled',
|
||||
});
|
||||
|
||||
const res = await fetchWithTimeout(fetchImpl, TOKEN_URL, {
|
||||
const res = await fetch(TOKEN_URL, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||
body: body.toString(),
|
||||
}, 15000);
|
||||
signal: controller.signal,
|
||||
});
|
||||
clearTimeout(timer);
|
||||
|
||||
if (!res.ok) {
|
||||
const errText = await res.text().catch(() => '');
|
||||
return acledError('auth_failed', `acled_oauth_http_${res.status}`, `ACLED OAuth failed with HTTP ${res.status}`, {
|
||||
detail: safeText(errText),
|
||||
});
|
||||
return {
|
||||
error: `OAuth failed (HTTP ${res.status}): ${errText.slice(0, 200)}`,
|
||||
code: classifyAuthFailure(res.status, errText),
|
||||
};
|
||||
}
|
||||
|
||||
const data = await res.json();
|
||||
if (!data.access_token) {
|
||||
return acledError('auth_failed', 'acled_oauth_missing_access_token', 'ACLED OAuth response did not include access_token');
|
||||
return { error: `OAuth response missing access_token: ${JSON.stringify(data).slice(0, 200)}`, code: 'auth_endpoint_failed' };
|
||||
}
|
||||
|
||||
return { ok: true, token: data.access_token };
|
||||
return { token: data.access_token };
|
||||
} catch (e) {
|
||||
return acledError('auth_failed', 'acled_oauth_request_failed', `ACLED OAuth error: ${e.message}`);
|
||||
clearTimeout(timer);
|
||||
const cause = e.cause ? ` → ${e.cause.message || e.cause.code || e.cause}` : '';
|
||||
return { error: `OAuth error: ${e.message}${cause}`, code: 'auth_endpoint_failed' };
|
||||
}
|
||||
}
|
||||
|
||||
export async function authenticate(opts = {}) {
|
||||
const env = opts.env || process.env;
|
||||
const fetchImpl = opts.fetchImpl || globalThis.fetch;
|
||||
const config = getAcledConfig(env);
|
||||
if (!config.configured) {
|
||||
return acledError('no_credentials', 'missing_acled_credentials', 'No ACLED credentials. Set ACLED_EMAIL and ACLED_PASSWORD in .env.', {
|
||||
missing: config.missing,
|
||||
});
|
||||
// Try both auth strategies
|
||||
async function authenticate() {
|
||||
const { email, password } = acledCredentials();
|
||||
if (!email || !password) {
|
||||
return { error: 'No ACLED credentials. Set ACLED_EMAIL or ACLED_USER and ACLED_PASSWORD in .env.', code: 'no_credentials' };
|
||||
}
|
||||
|
||||
// Return cached session if still valid
|
||||
if (sessionCache.method && Date.now() < sessionCache.expires) {
|
||||
return sessionCache;
|
||||
}
|
||||
|
||||
const diagnostics = [];
|
||||
const oauthResult = await loginOAuth(config.email, config.password, { fetchImpl });
|
||||
if (oauthResult.ok) {
|
||||
const errors = [];
|
||||
const debug = process.argv.includes('--debug');
|
||||
|
||||
// Try OAuth first (official programmatic method per ACLED docs)
|
||||
const oauthResult = await loginOAuth(email, password);
|
||||
if (oauthResult.token) {
|
||||
if (debug) console.error('[ACLED DEBUG] OAuth OK');
|
||||
sessionCache = { cookies: null, token: oauthResult.token, method: 'oauth', expires: Date.now() + 23 * 60 * 60 * 1000 };
|
||||
return sessionCache;
|
||||
}
|
||||
diagnostics.push({ method: 'oauth', status: oauthResult.status, error: oauthResult.error, message: oauthResult.message });
|
||||
if (opts.debug) console.error(`[ACLED DEBUG] OAuth failed: ${oauthResult.error}`);
|
||||
errors.push(`OAuth: ${oauthResult.error}`);
|
||||
if (debug) console.error(`[ACLED DEBUG] OAuth failed: ${oauthResult.error}`);
|
||||
|
||||
const cookieResult = await loginCookie(config.email, config.password, { fetchImpl });
|
||||
if (cookieResult.ok) {
|
||||
// Fall back to cookie-based session
|
||||
const cookieResult = await loginCookie(email, password);
|
||||
if (cookieResult.cookies) {
|
||||
if (debug) console.error('[ACLED DEBUG] Cookie OK');
|
||||
sessionCache = { cookies: cookieResult.cookies, token: null, method: 'cookie', expires: Date.now() + 12 * 60 * 60 * 1000 };
|
||||
return sessionCache;
|
||||
}
|
||||
diagnostics.push({ method: 'cookie', status: cookieResult.status, error: cookieResult.error, message: cookieResult.message });
|
||||
if (opts.debug) console.error(`[ACLED DEBUG] Cookie login failed: ${cookieResult.error}`);
|
||||
errors.push(`Cookie: ${cookieResult.error}`);
|
||||
|
||||
return acledError('auth_failed', 'acled_auth_failed', 'All ACLED auth methods failed.', { diagnostics });
|
||||
const code = [oauthResult.code, cookieResult.code].includes('auth_denied') ? 'auth_denied' : 'auth_endpoint_failed';
|
||||
return { error: `All ACLED auth methods failed.\n${errors.join('\n')}`, code };
|
||||
}
|
||||
|
||||
// Build headers based on auth method
|
||||
function authHeaders(session) {
|
||||
const headers = { 'User-Agent': 'Crucix/2.0', 'Content-Type': 'application/json' };
|
||||
const headers = { 'User-Agent': 'Crucix/1.0', 'Content-Type': 'application/json' };
|
||||
if (session.method === 'cookie' && session.cookies) {
|
||||
headers['Cookie'] = session.cookies;
|
||||
} else if (session.method === 'oauth' && session.token) {
|
||||
@@ -149,6 +169,7 @@ function authHeaders(session) {
|
||||
return headers;
|
||||
}
|
||||
|
||||
// Event type constants
|
||||
export const EVENT_TYPES = [
|
||||
'Battles',
|
||||
'Explosions/Remote violence',
|
||||
@@ -158,6 +179,7 @@ export const EVENT_TYPES = [
|
||||
'Strategic developments',
|
||||
];
|
||||
|
||||
// Query conflict events with flexible filters
|
||||
export async function getEvents(opts = {}) {
|
||||
const {
|
||||
limit = 500,
|
||||
@@ -166,13 +188,10 @@ export async function getEvents(opts = {}) {
|
||||
eventType,
|
||||
country,
|
||||
region,
|
||||
env = process.env,
|
||||
fetchImpl = globalThis.fetch,
|
||||
debug = process.argv.includes('--debug'),
|
||||
} = opts;
|
||||
|
||||
const session = await authenticate({ env, fetchImpl, debug });
|
||||
if (session.error) return session;
|
||||
const session = await authenticate();
|
||||
if (session.error) return { error: session.error, code: session.code || 'auth_failed' };
|
||||
|
||||
const params = new URLSearchParams({ _format: 'json', limit: String(limit) });
|
||||
if (eventDateStart && eventDateEnd) {
|
||||
@@ -183,43 +202,62 @@ export async function getEvents(opts = {}) {
|
||||
if (country) params.set('country', country);
|
||||
if (region) params.set('region', String(region));
|
||||
|
||||
const debug = process.argv.includes('--debug');
|
||||
try {
|
||||
const url = `${API_BASE}?${params}`;
|
||||
if (debug) console.error(`[ACLED DEBUG] Data request: GET ${url}`);
|
||||
const res = await fetchWithTimeout(fetchImpl, url, { headers: authHeaders(session) }, 25000);
|
||||
const hdrs = authHeaders(session);
|
||||
if (debug) {
|
||||
console.error(`[ACLED DEBUG] Data request: GET ${url}`);
|
||||
console.error(`[ACLED DEBUG] Headers: ${JSON.stringify(sanitizeAuthHeaders(hdrs))}`);
|
||||
}
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), 25000);
|
||||
const res = await fetch(url, {
|
||||
headers: hdrs,
|
||||
signal: controller.signal,
|
||||
});
|
||||
clearTimeout(timer);
|
||||
if (debug) console.error(`[ACLED DEBUG] Data response: HTTP ${res.status}`);
|
||||
|
||||
if (!res.ok) {
|
||||
const errText = await res.text().catch(() => '');
|
||||
if (debug) console.error(`[ACLED DEBUG] Error body: ${errText.slice(0, 500)}`);
|
||||
if (res.status === 401 || res.status === 403) {
|
||||
// Clear cache and report
|
||||
sessionCache = { cookies: null, token: null, method: null, expires: 0 };
|
||||
return acledError('access_denied', `acled_data_http_${res.status}`, `ACLED data access denied with HTTP ${res.status}`, {
|
||||
authMethod: session.method,
|
||||
detail: safeText(errText, 300),
|
||||
hint: 'Accept ACLED terms, complete profile fields, and confirm API access for the account.',
|
||||
});
|
||||
const hint = res.status === 403
|
||||
? '\n→ Fix: Log in at https://acleddata.com/user/login, then:\n'
|
||||
+ ' 1. Accept Terms of Use (profile → Terms of Use button → check the box)\n'
|
||||
+ ' 2. Complete all required profile fields\n'
|
||||
+ ' 3. Ensure your account has the "API" access group\n'
|
||||
+ ' Contact access@acleddata.com if issues persist.'
|
||||
: '';
|
||||
return {
|
||||
error: `ACLED data access denied (HTTP ${res.status}, auth method: ${session.method}). Response: ${errText.slice(0, 300)}${hint}`,
|
||||
code: 'auth_denied',
|
||||
};
|
||||
}
|
||||
return acledError('api_failed', `acled_data_http_${res.status}`, `ACLED data request failed with HTTP ${res.status}`, {
|
||||
detail: safeText(errText),
|
||||
});
|
||||
return { error: `HTTP ${res.status}: ${errText.slice(0, 200)}`, code: 'api_failed' };
|
||||
}
|
||||
|
||||
const data = await res.json();
|
||||
|
||||
// ACLED may return a 200 with an error status in the body
|
||||
if (data?.status && data.status !== 200) {
|
||||
return acledError('api_failed', `acled_api_status_${data.status}`, `ACLED API returned status ${data.status}`, {
|
||||
detail: safeText(data.message),
|
||||
});
|
||||
return { error: `ACLED API error: status ${data.status} - ${data.message || 'Unknown error'}`, code: 'api_failed' };
|
||||
}
|
||||
|
||||
return data;
|
||||
} catch (e) {
|
||||
if (e.name === 'AbortError') {
|
||||
return acledError('api_failed', 'acled_data_timeout', 'ACLED data request timed out after 25s');
|
||||
return { error: 'ACLED data request timed out (25s)', code: 'api_failed' };
|
||||
}
|
||||
return acledError('api_failed', 'acled_data_request_failed', `ACLED data error: ${e.message}`);
|
||||
const rootCause = e.cause ? `${e.cause.message || e.cause.code || e.cause}` : '';
|
||||
return { error: `ACLED data error: ${e.message}${rootCause ? ' - ' + rootCause : ''}`, code: 'api_failed' };
|
||||
}
|
||||
}
|
||||
|
||||
// Summarize events by a given field
|
||||
function groupBy(events, field) {
|
||||
const map = {};
|
||||
for (const e of events) {
|
||||
@@ -231,47 +269,35 @@ function groupBy(events, field) {
|
||||
return map;
|
||||
}
|
||||
|
||||
export async function briefing(opts = {}) {
|
||||
const env = opts.env || process.env;
|
||||
const fetchImpl = opts.fetchImpl || globalThis.fetch;
|
||||
const config = getAcledConfig(env);
|
||||
if (!config.configured) {
|
||||
// Briefing — last 7 days of global conflict events
|
||||
export async function briefing() {
|
||||
const { email, password } = acledCredentials();
|
||||
if (!email || !password) {
|
||||
return {
|
||||
source: 'ACLED',
|
||||
timestamp: new Date().toISOString(),
|
||||
status: 'no_credentials',
|
||||
error: 'missing_acled_credentials',
|
||||
missing: config.missing,
|
||||
message: 'Set ACLED_EMAIL and ACLED_PASSWORD in .env. Register at https://acleddata.com/user/register',
|
||||
message: 'Set ACLED_EMAIL or ACLED_USER and ACLED_PASSWORD in .env. Register at https://acleddata.com/user/register',
|
||||
};
|
||||
}
|
||||
|
||||
const start = daysAgo(7);
|
||||
const end = daysAgo(0);
|
||||
const end = daysAgo(0);
|
||||
|
||||
const data = await getEvents({
|
||||
eventDateStart: start,
|
||||
eventDateEnd: end,
|
||||
limit: 2000,
|
||||
env,
|
||||
fetchImpl,
|
||||
debug: opts.debug,
|
||||
});
|
||||
|
||||
if (data?.error) {
|
||||
return {
|
||||
source: 'ACLED',
|
||||
timestamp: new Date().toISOString(),
|
||||
status: data.status || 'api_failed',
|
||||
error: data.error,
|
||||
message: data.message,
|
||||
detail: data.detail,
|
||||
hint: data.hint,
|
||||
diagnostics: data.diagnostics,
|
||||
};
|
||||
const status = data.code === 'auth_denied' ? 'auth_failed' : 'api_failed';
|
||||
return { source: 'ACLED', timestamp: new Date().toISOString(), status, error: data.error };
|
||||
}
|
||||
|
||||
let events = data?.data || [];
|
||||
|
||||
// Enrich all events with numeric lat/lon
|
||||
events = events.map(e => ({
|
||||
...e,
|
||||
lat: parseFloat(e.latitude) || null,
|
||||
@@ -282,9 +308,10 @@ export async function briefing(opts = {}) {
|
||||
(sum, e) => sum + (parseInt(e.fatalities, 10) || 0), 0
|
||||
);
|
||||
|
||||
const byRegion = groupBy(events, 'region');
|
||||
const byType = groupBy(events, 'event_type');
|
||||
const byRegion = groupBy(events, 'region');
|
||||
const byType = groupBy(events, 'event_type');
|
||||
const byCountry = groupBy(events, 'country');
|
||||
|
||||
const topCountries = Object.entries(byCountry)
|
||||
.sort((a, b) => b[1].count - a[1].count)
|
||||
.slice(0, 10)
|
||||
@@ -295,21 +322,21 @@ export async function briefing(opts = {}) {
|
||||
.sort((a, b) => (parseInt(b.fatalities, 10) || 0) - (parseInt(a.fatalities, 10) || 0))
|
||||
.slice(0, 15)
|
||||
.map(e => ({
|
||||
date: e.event_date,
|
||||
type: e.event_type,
|
||||
subType: e.sub_event_type,
|
||||
country: e.country,
|
||||
location: e.location,
|
||||
date: e.event_date,
|
||||
type: e.event_type,
|
||||
subType: e.sub_event_type,
|
||||
country: e.country,
|
||||
location: e.location,
|
||||
fatalities: parseInt(e.fatalities, 10) || 0,
|
||||
lat: parseFloat(e.latitude) || null,
|
||||
lon: parseFloat(e.longitude) || null,
|
||||
notes: e.notes?.slice(0, 200),
|
||||
lat: parseFloat(e.latitude) || null,
|
||||
lon: parseFloat(e.longitude) || null,
|
||||
notes: e.notes?.slice(0, 200),
|
||||
}));
|
||||
|
||||
return {
|
||||
source: 'ACLED',
|
||||
timestamp: new Date().toISOString(),
|
||||
status: 'ok',
|
||||
status: 'live',
|
||||
period: { start, end },
|
||||
totalEvents: events.length,
|
||||
totalFatalities,
|
||||
@@ -317,6 +344,7 @@ export async function briefing(opts = {}) {
|
||||
byType,
|
||||
topCountries,
|
||||
deadliestEvents,
|
||||
message: events.length === 0 ? 'ACLED returned a valid empty event set for the requested period.' : undefined,
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
// ADS-B Exchange — Unfiltered Flight Tracking (including Military)
|
||||
// Unlike FlightRadar24/FlightAware, ADS-B Exchange does NOT filter military aircraft.
|
||||
// Public feed access varies; RapidAPI tier available for programmatic use.
|
||||
// This module reports explicit disabled/degraded state instead of making
|
||||
// unavailable aircraft data look live.
|
||||
// This module attempts the public endpoints and falls back to a documented stub.
|
||||
|
||||
import { safeFetch } from '../utils/fetch.mjs';
|
||||
|
||||
@@ -141,7 +140,6 @@ async function fetchViaRapidApi(apiKey) {
|
||||
// Get all military aircraft
|
||||
const data = await safeFetch(`${ENDPOINTS.rapidApi}/mil`, {
|
||||
timeout: 20000,
|
||||
source: 'adsb-rapidapi',
|
||||
headers: {
|
||||
'X-RapidAPI-Key': apiKey,
|
||||
'X-RapidAPI-Host': 'adsbexchange-com1.p.rapidapi.com',
|
||||
@@ -153,26 +151,21 @@ async function fetchViaRapidApi(apiKey) {
|
||||
|
||||
// Attempt to fetch from public feed
|
||||
async function fetchPublicFeed() {
|
||||
const data = await safeFetch(ENDPOINTS.publicFeed, { timeout: 15000, source: 'adsb-public' });
|
||||
const data = await safeFetch(ENDPOINTS.publicFeed, { timeout: 15000 });
|
||||
return data;
|
||||
}
|
||||
|
||||
async function getMilitaryAircraftResult(apiKey) {
|
||||
const failures = [];
|
||||
|
||||
// Get military aircraft from available sources
|
||||
export async function getMilitaryAircraft(apiKey) {
|
||||
// Try RapidAPI first if key available
|
||||
if (apiKey) {
|
||||
const data = await fetchViaRapidApi(apiKey);
|
||||
if (data && !data.error) {
|
||||
const aircraft = data.ac || data.aircraft || [];
|
||||
if (Array.isArray(aircraft)) {
|
||||
return {
|
||||
provider: 'rapidapi',
|
||||
aircraft: aircraft.map(classifyAircraft).filter(a => a.isMilitary),
|
||||
};
|
||||
return aircraft.map(classifyAircraft).filter(a => a.isMilitary);
|
||||
}
|
||||
}
|
||||
failures.push({ provider: 'rapidapi', error: data?.error || 'RapidAPI returned an unsupported payload' });
|
||||
}
|
||||
|
||||
// Try public feed
|
||||
@@ -180,21 +173,11 @@ async function getMilitaryAircraftResult(apiKey) {
|
||||
if (pubData && !pubData.error) {
|
||||
const aircraft = pubData.ac || pubData.aircraft || pubData.states || [];
|
||||
if (Array.isArray(aircraft)) {
|
||||
return {
|
||||
provider: 'public-feed',
|
||||
aircraft: aircraft.map(classifyAircraft).filter(a => a.isMilitary),
|
||||
};
|
||||
return aircraft.map(classifyAircraft).filter(a => a.isMilitary);
|
||||
}
|
||||
}
|
||||
failures.push({ provider: 'public-feed', error: pubData?.error || 'Public feed returned an unsupported payload' });
|
||||
|
||||
return { provider: null, aircraft: null, failures };
|
||||
}
|
||||
|
||||
// Get military aircraft from available sources
|
||||
export async function getMilitaryAircraft(apiKey) {
|
||||
const result = await getMilitaryAircraftResult(apiKey);
|
||||
return result.aircraft;
|
||||
return null; // all sources failed
|
||||
}
|
||||
|
||||
// Get all aircraft in a geographic bounding box via RapidAPI
|
||||
@@ -225,8 +208,7 @@ export async function getAircraftInArea(lat, lon, radiusNm = 250, apiKey) {
|
||||
// Briefing — attempt to get military flight data, document what's available
|
||||
export async function briefing() {
|
||||
const apiKey = process.env.ADSB_API_KEY || process.env.RAPIDAPI_KEY || null;
|
||||
const result = await getMilitaryAircraftResult(apiKey);
|
||||
const militaryAircraft = result.aircraft;
|
||||
const militaryAircraft = await getMilitaryAircraft(apiKey);
|
||||
|
||||
// If we got data, analyze it
|
||||
if (militaryAircraft && militaryAircraft.length > 0) {
|
||||
@@ -273,7 +255,6 @@ export async function briefing() {
|
||||
source: 'ADS-B Exchange',
|
||||
timestamp: new Date().toISOString(),
|
||||
status: 'live',
|
||||
provider: result.provider,
|
||||
totalMilitary: militaryAircraft.length,
|
||||
byCountry,
|
||||
categories: {
|
||||
@@ -288,18 +269,10 @@ export async function briefing() {
|
||||
}
|
||||
|
||||
// No data available — return stub with integration documentation
|
||||
const status = apiKey ? 'degraded' : 'disabled';
|
||||
const error = apiKey
|
||||
? 'ADS-B providers returned no usable aircraft data'
|
||||
: 'ADSB_API_KEY or RAPIDAPI_KEY is not configured';
|
||||
|
||||
return {
|
||||
source: 'ADS-B Exchange',
|
||||
timestamp: new Date().toISOString(),
|
||||
status,
|
||||
provider: result.provider,
|
||||
error,
|
||||
failures: result.failures,
|
||||
status: apiKey ? 'error' : 'no_key',
|
||||
militaryAircraft: [],
|
||||
message: apiKey
|
||||
? 'ADS-B Exchange API returned no data. The endpoint may be temporarily unavailable.'
|
||||
|
||||
@@ -1,15 +1,14 @@
|
||||
// Reddit social sentiment intelligence.
|
||||
// Reddit API access requires OAuth. Runtime sweeps intentionally do not use
|
||||
// unauthenticated reddit.com .json scraping because it is unreliable and not
|
||||
// acceptable for production operation.
|
||||
// Reddit — social sentiment intelligence
|
||||
// Reddit now requires OAuth for API access (public JSON API returns 403).
|
||||
// Gracefully degrades when not authenticated.
|
||||
// To enable: register an app at https://www.reddit.com/prefs/apps/ and set
|
||||
// REDDIT_CLIENT_ID and REDDIT_CLIENT_SECRET in .env
|
||||
|
||||
import { safeFetch } from '../utils/fetch.mjs';
|
||||
import '../utils/env.mjs';
|
||||
|
||||
function delay(ms) { return new Promise(r => setTimeout(r, ms)); }
|
||||
|
||||
const USER_AGENT = 'Crucix/2.0 intelligence-engine';
|
||||
|
||||
const SUBREDDITS = [
|
||||
'worldnews',
|
||||
'geopolitics',
|
||||
@@ -18,95 +17,48 @@ const SUBREDDITS = [
|
||||
'commodities',
|
||||
];
|
||||
|
||||
export function getRedditConfig(env = process.env) {
|
||||
const clientId = env.REDDIT_CLIENT_ID || '';
|
||||
const clientSecret = env.REDDIT_CLIENT_SECRET || '';
|
||||
const missing = [];
|
||||
if (!clientId) missing.push('REDDIT_CLIENT_ID');
|
||||
if (!clientSecret) missing.push('REDDIT_CLIENT_SECRET');
|
||||
return {
|
||||
clientId,
|
||||
clientSecret,
|
||||
configured: missing.length === 0,
|
||||
missing,
|
||||
};
|
||||
}
|
||||
|
||||
function credentialsMessage(missing) {
|
||||
return `Reddit requires OAuth. Register a script app at https://www.reddit.com/prefs/apps/ and set ${missing.join(' and ')} in .env`;
|
||||
}
|
||||
|
||||
export async function getToken({ env = process.env, fetchImpl = globalThis.fetch } = {}) {
|
||||
const config = getRedditConfig(env);
|
||||
if (!config.configured) {
|
||||
return {
|
||||
ok: false,
|
||||
status: 'no_credentials',
|
||||
missing: config.missing,
|
||||
error: 'missing_reddit_oauth_credentials',
|
||||
message: credentialsMessage(config.missing),
|
||||
};
|
||||
}
|
||||
// Get OAuth token using client credentials flow (application-only)
|
||||
async function getToken() {
|
||||
const clientId = process.env.REDDIT_CLIENT_ID;
|
||||
const clientSecret = process.env.REDDIT_CLIENT_SECRET;
|
||||
if (!clientId || !clientSecret) return null;
|
||||
|
||||
try {
|
||||
const auth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString('base64');
|
||||
const res = await fetchImpl('https://www.reddit.com/api/v1/access_token', {
|
||||
const auth = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
|
||||
const res = await fetch('https://www.reddit.com/api/v1/access_token', {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Authorization': `Basic ${auth}`,
|
||||
'Content-Type': 'application/x-www-form-urlencoded',
|
||||
'User-Agent': USER_AGENT,
|
||||
'User-Agent': 'Crucix/1.0 intelligence-engine',
|
||||
},
|
||||
body: 'grant_type=client_credentials',
|
||||
});
|
||||
if (!res.ok) {
|
||||
const body = await res.text().catch(() => '');
|
||||
return {
|
||||
ok: false,
|
||||
status: 'auth_failed',
|
||||
error: `reddit_oauth_http_${res.status}`,
|
||||
message: `Reddit OAuth token request failed with HTTP ${res.status}`,
|
||||
detail: body.slice(0, 200),
|
||||
};
|
||||
}
|
||||
|
||||
if (!res.ok) return null;
|
||||
const data = await res.json();
|
||||
if (!data.access_token) {
|
||||
return {
|
||||
ok: false,
|
||||
status: 'auth_failed',
|
||||
error: 'reddit_oauth_missing_access_token',
|
||||
message: 'Reddit OAuth token response did not include an access token',
|
||||
};
|
||||
}
|
||||
return { ok: true, status: 'ok', token: data.access_token };
|
||||
} catch (e) {
|
||||
return {
|
||||
ok: false,
|
||||
status: 'auth_failed',
|
||||
error: 'reddit_oauth_request_failed',
|
||||
message: e.message,
|
||||
};
|
||||
return data.access_token || null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
// Fetch hot posts — tries OAuth first, then falls back to public endpoint
|
||||
export async function getHot(subreddit, opts = {}) {
|
||||
const { limit = 10, token = null } = opts;
|
||||
|
||||
if (!token) {
|
||||
return {
|
||||
status: 'no_credentials',
|
||||
error: 'reddit_oauth_required',
|
||||
message: 'Reddit source requires OAuth; unauthenticated reddit.com .json scraping is disabled',
|
||||
};
|
||||
if (token) {
|
||||
// Use OAuth endpoint
|
||||
return safeFetch(`https://oauth.reddit.com/r/${subreddit}/hot?limit=${limit}&raw_json=1`, {
|
||||
headers: {
|
||||
'Authorization': `Bearer ${token}`,
|
||||
'User-Agent': 'Crucix/1.0 intelligence-engine',
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
return safeFetch(`https://oauth.reddit.com/r/${subreddit}/hot?limit=${limit}&raw_json=1`, {
|
||||
source: 'Reddit',
|
||||
headers: {
|
||||
'Authorization': `Bearer ${token}`,
|
||||
'User-Agent': USER_AGENT,
|
||||
},
|
||||
// Try public endpoint (may 403)
|
||||
return safeFetch(`https://www.reddit.com/r/${subreddit}/hot.json?limit=${limit}&raw_json=1`, {
|
||||
headers: { 'User-Agent': 'Crucix/1.0 intelligence-engine' },
|
||||
});
|
||||
}
|
||||
|
||||
@@ -122,46 +74,29 @@ function compactPost(child) {
|
||||
};
|
||||
}
|
||||
|
||||
export async function briefing(opts = {}) {
|
||||
const {
|
||||
env = process.env,
|
||||
subreddits = SUBREDDITS,
|
||||
delayMs = 1000,
|
||||
fetchImpl = globalThis.fetch,
|
||||
} = opts;
|
||||
const tokenResult = await getToken({ env, fetchImpl });
|
||||
export async function briefing() {
|
||||
const token = await getToken();
|
||||
|
||||
if (!tokenResult.ok) {
|
||||
if (!token && !process.env.REDDIT_CLIENT_ID) {
|
||||
return {
|
||||
source: 'Reddit',
|
||||
timestamp: new Date().toISOString(),
|
||||
status: tokenResult.status,
|
||||
error: tokenResult.error,
|
||||
message: tokenResult.message,
|
||||
missing: tokenResult.missing || [],
|
||||
status: 'no_key',
|
||||
message: 'Reddit requires OAuth. Register at https://www.reddit.com/prefs/apps/ (script type), set REDDIT_CLIENT_ID and REDDIT_CLIENT_SECRET in .env',
|
||||
};
|
||||
}
|
||||
|
||||
const subredditResults = {};
|
||||
const errors = [];
|
||||
for (const sub of subreddits) {
|
||||
const result = await getHot(sub, { limit: 10, token: tokenResult.token });
|
||||
if (result?.error) {
|
||||
errors.push({ subreddit: sub, error: result.error });
|
||||
subredditResults[sub] = [];
|
||||
if (delayMs > 0) await delay(delayMs);
|
||||
continue;
|
||||
}
|
||||
for (const sub of SUBREDDITS) {
|
||||
const result = await getHot(sub, { limit: 10, token });
|
||||
const children = result?.data?.children || [];
|
||||
subredditResults[sub] = children.map(compactPost).filter(Boolean);
|
||||
if (delayMs > 0) await delay(delayMs);
|
||||
await delay(token ? 1000 : 2000);
|
||||
}
|
||||
|
||||
return {
|
||||
source: 'Reddit',
|
||||
timestamp: new Date().toISOString(),
|
||||
status: errors.length > 0 ? 'degraded' : 'ok',
|
||||
...(errors.length > 0 ? { error: 'reddit_subreddit_fetch_failed', errors } : {}),
|
||||
subreddits: subredditResults,
|
||||
};
|
||||
}
|
||||
|
||||
@@ -10,44 +10,6 @@ const fetchMetrics = {
|
||||
recent: [],
|
||||
};
|
||||
|
||||
const SOURCE_BY_HOST = [
|
||||
[/api\.bls\.gov$/i, 'BLS'],
|
||||
[/api\.fred\.stlouisfed\.org$/i, 'FRED'],
|
||||
[/api\.eia\.gov$/i, 'EIA'],
|
||||
[/api\.gdeltproject\.org$/i, 'GDELT'],
|
||||
[/api\.weather\.gov$/i, 'NOAA'],
|
||||
[/api\.open-notify\.org$/i, 'OpenNotify'],
|
||||
[/opensky-network\.org$/i, 'OpenSky'],
|
||||
[/firms\.modaps\.eosdis\.nasa\.gov$/i, 'FIRMS'],
|
||||
[/api\.acleddata\.com$/i, 'ACLED'],
|
||||
[/api\.reliefweb\.int$/i, 'ReliefWeb'],
|
||||
[/receiverbook\.de$/i, 'KiwiSDR'],
|
||||
[/safecast\.org$/i, 'Safecast'],
|
||||
[/api\.patentsview\.org$/i, 'PatentsView'],
|
||||
[/api\.trade\.gov$/i, 'Comtrade'],
|
||||
[/api\.usaspending\.gov$/i, 'USASpending'],
|
||||
[/api\.telegram\.org$/i, 'Telegram'],
|
||||
[/oauth\.reddit\.com$/i, 'Reddit'],
|
||||
[/reddit\.com$/i, 'Reddit'],
|
||||
[/api\.bsky\.app$/i, 'Bluesky'],
|
||||
[/api\.yahoo\.com$/i, 'YahooFinance'],
|
||||
[/query\d?\.finance\.yahoo\.com$/i, 'YahooFinance'],
|
||||
[/api\.cloudflare\.com$/i, 'CloudflareRadar'],
|
||||
[/api\.opensanctions\.org$/i, 'OpenSanctions'],
|
||||
[/home\.treasury\.gov$/i, 'Treasury'],
|
||||
[/fiscaldata\.treasury\.gov$/i, 'Treasury'],
|
||||
[/who\.int$/i, 'WHO'],
|
||||
];
|
||||
|
||||
export function inferFetchSource(url) {
|
||||
let host = 'unknown';
|
||||
try { host = new URL(url).host.toLowerCase(); } catch { return 'unknown'; }
|
||||
for (const [pattern, source] of SOURCE_BY_HOST) {
|
||||
if (pattern.test(host)) return source;
|
||||
}
|
||||
return host;
|
||||
}
|
||||
|
||||
function metricBucket(map, key) {
|
||||
if (!map[key]) map[key] = { requests: 0, ok: 0, failed: 0, bytes: 0, lastStatus: null, lastError: null, lastMs: 0 };
|
||||
return map[key];
|
||||
@@ -76,11 +38,10 @@ export function getFetchMetrics() {
|
||||
}
|
||||
|
||||
export async function safeFetch(url, opts = {}) {
|
||||
const { timeout = 15000, retries = 1, headers = {}, source = inferFetchSource(url) } = opts;
|
||||
const { timeout = 15000, retries = 1, headers = {}, source = undefined } = opts;
|
||||
let lastError;
|
||||
for (let i = 0; i <= retries; i++) {
|
||||
const started = Date.now();
|
||||
let metricRecorded = false;
|
||||
try {
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), timeout);
|
||||
@@ -90,42 +51,34 @@ export async function safeFetch(url, opts = {}) {
|
||||
});
|
||||
clearTimeout(timer);
|
||||
const status = res.status;
|
||||
const text = await res.text();
|
||||
if (!res.ok) {
|
||||
const error = `HTTP ${res.status}`;
|
||||
recordFetchMetric({ url, source, ok: false, status, bytes: text.length, durationMs: Date.now() - started, error });
|
||||
metricRecorded = true;
|
||||
throw new Error(`${error}: ${text.slice(0, 200)}`);
|
||||
const body = await res.text().catch(() => '');
|
||||
recordFetchMetric({ url, source, ok: false, status, bytes: body.length, durationMs: Date.now() - started, error: `HTTP ${res.status}` });
|
||||
throw new Error(`HTTP ${res.status}: ${body.slice(0, 200)}`);
|
||||
}
|
||||
const text = await res.text();
|
||||
recordFetchMetric({ url, source, ok: true, status, bytes: text.length, durationMs: Date.now() - started });
|
||||
const trimmed = text.trim();
|
||||
const contentType = res.headers.get('content-type') || '';
|
||||
if (contentType.includes('text/html') || trimmed.startsWith('<!DOCTYPE html') || trimmed.startsWith('<html')) {
|
||||
const error = `Expected JSON but received HTML from ${new URL(url).host}`;
|
||||
recordFetchMetric({ url, source, ok: false, status, bytes: text.length, durationMs: Date.now() - started, error });
|
||||
metricRecorded = true;
|
||||
throw new Error(error);
|
||||
throw new Error(`Expected JSON but received HTML from ${new URL(url).host}`);
|
||||
}
|
||||
recordFetchMetric({ url, source, ok: true, status, bytes: text.length, durationMs: Date.now() - started });
|
||||
metricRecorded = true;
|
||||
try { return JSON.parse(text); } catch { return { rawText: text.slice(0, 500) }; }
|
||||
} catch (e) {
|
||||
lastError = e;
|
||||
if (!metricRecorded) {
|
||||
recordFetchMetric({ url, source, ok: false, status: null, bytes: 0, durationMs: Date.now() - started, error: e.message });
|
||||
}
|
||||
recordFetchMetric({ url, source, ok: false, status: null, bytes: 0, durationMs: Date.now() - started, error: e.message });
|
||||
// GDELT needs 5s between requests, others are fine with shorter delays
|
||||
if (i < retries) await new Promise(r => setTimeout(r, 2000 * (i + 1)));
|
||||
}
|
||||
}
|
||||
return { error: lastError?.message || 'Unknown error', source };
|
||||
return { error: lastError?.message || 'Unknown error', source: url };
|
||||
}
|
||||
|
||||
export async function safeFetchText(url, opts = {}) {
|
||||
const { timeout = 15000, retries = 1, headers = {}, source = inferFetchSource(url) } = opts;
|
||||
const { timeout = 15000, retries = 1, headers = {}, source = undefined } = opts;
|
||||
let lastError;
|
||||
for (let i = 0; i <= retries; i++) {
|
||||
const started = Date.now();
|
||||
let metricRecorded = false;
|
||||
try {
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), timeout);
|
||||
@@ -136,14 +89,11 @@ export async function safeFetchText(url, opts = {}) {
|
||||
clearTimeout(timer);
|
||||
const text = await res.text();
|
||||
recordFetchMetric({ url, source, ok: res.ok, status: res.status, bytes: text.length, durationMs: Date.now() - started, error: res.ok ? null : `HTTP ${res.status}` });
|
||||
metricRecorded = true;
|
||||
if (!res.ok) throw new Error(`HTTP ${res.status}: ${text.slice(0, 200)}`);
|
||||
return { text, status: res.status, bytes: text.length };
|
||||
} catch (e) {
|
||||
lastError = e;
|
||||
if (!metricRecorded) {
|
||||
recordFetchMetric({ url, source, ok: false, status: null, bytes: 0, durationMs: Date.now() - started, error: e.message });
|
||||
}
|
||||
recordFetchMetric({ url, source, ok: false, status: null, bytes: 0, durationMs: Date.now() - started, error: e.message });
|
||||
if (i < retries) await new Promise(r => setTimeout(r, 2000 * (i + 1)));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -23,13 +23,7 @@ export default {
|
||||
refreshIntervalMinutes: intEnv('REFRESH_INTERVAL_MINUTES', 15),
|
||||
autoOpenBrowser: boolEnv('AUTO_OPEN_BROWSER', false),
|
||||
staleDataMaxAgeMinutes: intEnv('STALE_DATA_MAX_AGE_MINUTES', 60),
|
||||
staleAlertCooldownMinutes: intEnv('STALE_ALERT_COOLDOWN_MINUTES', 60),
|
||||
dashboardUrl: process.env.DASHBOARD_URL || null,
|
||||
sweepToken: process.env.SWEEP_TOKEN || null,
|
||||
terminalActionsEnabled: boolEnv('TERMINAL_ACTIONS_ENABLED', !!process.env.SWEEP_TOKEN || process.env.NODE_ENV !== 'production'),
|
||||
terminalActionRateLimitWindowMs: intEnv('TERMINAL_ACTION_RATE_LIMIT_WINDOW_MS', 60_000),
|
||||
terminalActionRateLimitMax: intEnv('TERMINAL_ACTION_RATE_LIMIT_MAX', 10),
|
||||
sseHeartbeatIntervalMs: intEnv('SSE_HEARTBEAT_INTERVAL_MS', 25000),
|
||||
|
||||
llm: {
|
||||
provider: process.env.LLM_PROVIDER || null, // anthropic | openai | gemini | codex | openrouter | minimax | mistral | ollama | grok
|
||||
|
||||
@@ -83,48 +83,16 @@ const geoKeywords = {
|
||||
'IMF':[38.9,-77],'World Bank':[38.9,-77],'UN':[40.7,-74],
|
||||
};
|
||||
|
||||
function escapeRegex(value) {
|
||||
return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
||||
}
|
||||
|
||||
function geoKeywordRegex(keyword) {
|
||||
const flags = keyword.length <= 3 && keyword === keyword.toUpperCase() ? 'u' : 'iu';
|
||||
return new RegExp(`(^|[^\\p{L}\\p{N}])${escapeRegex(keyword)}(?=$|[^\\p{L}\\p{N}])`, flags);
|
||||
}
|
||||
|
||||
const geoKeywordEntries = Object.entries(geoKeywords)
|
||||
.sort((a, b) => b[0].length - a[0].length)
|
||||
.map(([keyword, coords]) => ({ keyword, coords, pattern: geoKeywordRegex(keyword) }));
|
||||
|
||||
export function geoTagText(text) {
|
||||
function geoTagText(text) {
|
||||
if (!text) return null;
|
||||
for (const { keyword, coords, pattern } of geoKeywordEntries) {
|
||||
if (pattern.test(text)) {
|
||||
const [lat, lon] = coords;
|
||||
for (const [keyword, [lat, lon]] of Object.entries(geoKeywords)) {
|
||||
if (text.includes(keyword)) {
|
||||
return { lat, lon, region: keyword };
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function stableHash(value) {
|
||||
let hash = 2166136261;
|
||||
for (let i = 0; i < value.length; i++) {
|
||||
hash ^= value.charCodeAt(i);
|
||||
hash = Math.imul(hash, 16777619);
|
||||
}
|
||||
return hash >>> 0;
|
||||
}
|
||||
|
||||
export function stableGeoJitter(key, axis) {
|
||||
const bucket = stableHash(`${axis}:${key}`) / 0xffffffff;
|
||||
return (bucket - 0.5) * 2;
|
||||
}
|
||||
|
||||
function newsGeoKey(item) {
|
||||
return `${item.source || ''}|${item.title || ''}|${item.date || ''}|${item.url || ''}`;
|
||||
}
|
||||
|
||||
function sanitizeExternalUrl(raw) {
|
||||
if (!raw) return undefined;
|
||||
try {
|
||||
@@ -267,8 +235,8 @@ export async function fetchAllNews() {
|
||||
source: item.source,
|
||||
date: item.date,
|
||||
url: item.url,
|
||||
lat: geo.lat + stableGeoJitter(newsGeoKey(item), 'lat'),
|
||||
lon: geo.lon + stableGeoJitter(newsGeoKey(item), 'lon'),
|
||||
lat: geo.lat + (Math.random() - 0.5) * 2,
|
||||
lon: geo.lon + (Math.random() - 0.5) * 2,
|
||||
region: geo.region
|
||||
});
|
||||
}
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -1,489 +1,18 @@
|
||||
# Agent Handoff
|
||||
|
||||
Last updated: 2026-05-17
|
||||
## Current Release Goal
|
||||
|
||||
## Repository State
|
||||
Source branch: `codex/production-intelligence-terminal`
|
||||
|
||||
Project: Crucix fork / Intelligence Terminal
|
||||
|
||||
Local workspace:
|
||||
|
||||
```text
|
||||
C:\Users\MrSphay\Documents\Codex\Crucix\intelligence-terminal
|
||||
```
|
||||
|
||||
Remotes:
|
||||
|
||||
```text
|
||||
origin https://git.wilkensxl.de/MrSphay/intelligence-terminal.git
|
||||
upstream https://github.com/calesthio/Crucix.git
|
||||
```
|
||||
|
||||
Current branch tip:
|
||||
|
||||
```text
|
||||
Run `git rev-parse HEAD` after clone/pull. This handoff was updated by the `docs: sync issue tracker and handoff` commit after the implementation commit below.
|
||||
```
|
||||
|
||||
Latest implementation commit before issue-sync documentation:
|
||||
|
||||
```text
|
||||
53470cc701ec322080a89d220aef449b25850590
|
||||
```
|
||||
|
||||
Both pushed branches currently point to this commit:
|
||||
|
||||
```text
|
||||
origin/codex/production-intelligence-terminal
|
||||
origin/main
|
||||
```
|
||||
|
||||
Gitea repository:
|
||||
|
||||
```text
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal
|
||||
```
|
||||
|
||||
Default branch observed through the Gitea API:
|
||||
|
||||
```text
|
||||
codex/production-intelligence-terminal
|
||||
```
|
||||
|
||||
## Agent Kit Requirements Applied
|
||||
|
||||
The mandatory kit was cloned and reviewed first:
|
||||
|
||||
```text
|
||||
C:\Users\MrSphay\Documents\Codex\Crucix\agent-kit
|
||||
```
|
||||
|
||||
Rules applied from the kit:
|
||||
|
||||
- Keep agent context in source control: `AGENTS.md`, `.codex/project.md`, and this handoff file.
|
||||
- Use Gitea Ubuntu runners for heavy verification and package publishing.
|
||||
- Keep Docker/Dockge operation first-class.
|
||||
- Do not commit secrets, `.env`, private logs, tokens, or generated `runs/` data.
|
||||
- Add report-only maintenance workflows for security, dependency checks, repo cleanup, release dry runs, and template compliance.
|
||||
- Poll pushed Gitea Actions until terminal state when a token is available.
|
||||
|
||||
## What Was Implemented
|
||||
|
||||
### Docker And Runtime
|
||||
|
||||
- Docker image is Docker-first and Dockge/Pangolin suitable.
|
||||
- Browser auto-open is disabled by default through `AUTO_OPEN_BROWSER=false`.
|
||||
- Runtime health checks now work in the container without `wget` or host browser tools.
|
||||
- `runs` is persisted through a volume.
|
||||
- A later fix added `docker-entrypoint.sh` to prepare `/app/runs` before dropping privileges, so mounted volumes work with the non-root Node runtime.
|
||||
- `docker-compose.yml` uses the Gitea Registry image by default:
|
||||
Registry image:
|
||||
|
||||
```text
|
||||
git.wilkensxl.de/mrsphay/intelligence-terminal:latest
|
||||
```
|
||||
|
||||
### API And Health
|
||||
## Notes
|
||||
|
||||
Added or hardened:
|
||||
|
||||
- `GET /api/health`
|
||||
- `GET /api/data`
|
||||
- `GET /api/metrics`
|
||||
- `POST /api/sweep`
|
||||
- `POST /api/action`
|
||||
|
||||
Health now reports:
|
||||
|
||||
- `starting`
|
||||
- `healthy`
|
||||
- `degraded`
|
||||
- `stale`
|
||||
- `error`
|
||||
|
||||
It also reports:
|
||||
|
||||
- last sweep timestamps
|
||||
- stale/bootstrap state
|
||||
- data age
|
||||
- source health
|
||||
- source errors
|
||||
- LLM configuration state
|
||||
- Telegram/Discord enabled state
|
||||
- memory store state
|
||||
|
||||
### Live Data And Source Degradation
|
||||
|
||||
- Existing `runs/latest.json` is only treated as bootstrap/stale data until a real sweep completes.
|
||||
- Sweeps update `sourceHealth`, SSE/API data, and memory state.
|
||||
- RSS/news feed failures no longer silently look like fresh valid data.
|
||||
- `safeFetch` now tracks request counts, failures, bytes, source labels, hosts, and recent fetch events.
|
||||
- `safeFetch` has better timeout/retry/backoff/error behavior and reports HTML-as-API-error cases.
|
||||
- Yahoo Finance fetches are more explicit about source errors and HTML/API failures.
|
||||
- ACLED missing credentials now degrade transparently.
|
||||
- Telegram polling has quieter network-error backoff logs.
|
||||
|
||||
### LLM Integration
|
||||
|
||||
Added unified OpenAI-compatible provider layer:
|
||||
|
||||
```text
|
||||
lib/llm/openai-compatible.mjs
|
||||
```
|
||||
|
||||
Supported provider paths include:
|
||||
|
||||
- `openrouter`
|
||||
- `openai`
|
||||
- `openai-compatible`
|
||||
- `local-openai`
|
||||
- `lmstudio`
|
||||
- `lm-studio`
|
||||
- `ollama`
|
||||
|
||||
Relevant environment keys:
|
||||
|
||||
```text
|
||||
LLM_PROVIDER
|
||||
LLM_BASE_URL
|
||||
LLM_API_KEY
|
||||
LLM_MODEL
|
||||
LLM_TEMPERATURE
|
||||
LLM_MAX_TOKENS
|
||||
LLM_TIMEOUT_MS
|
||||
OPENROUTER_SITE_URL
|
||||
OPENROUTER_APP_NAME
|
||||
```
|
||||
|
||||
OpenRouter Free and local OpenAI-compatible endpoints are documented in `README.md` and `.env.example`.
|
||||
|
||||
### Memory
|
||||
|
||||
Added Phase-1 SQLite memory:
|
||||
|
||||
```text
|
||||
lib/intelligence-store.mjs
|
||||
runs/intelligence.db
|
||||
```
|
||||
|
||||
It uses `node:sqlite` when available and gracefully falls back when unavailable.
|
||||
|
||||
### Dashboard
|
||||
|
||||
Implemented:
|
||||
|
||||
- interactive Sensor Grid layer modes
|
||||
- focus/hide/normal states persisted in `localStorage`
|
||||
- Space Watch icon/orbit toggle
|
||||
- map/globe filtering consistency
|
||||
- flat map label redraw handling
|
||||
- live server-mode data loading from `/api/data` even when `jarvis.html` still contains an offline inline snapshot
|
||||
- Terminal Actions panel with `Status`, `Sweep`, and `Brief` buttons
|
||||
|
||||
Important UI markers in the final code:
|
||||
|
||||
```text
|
||||
layerModes
|
||||
spaceDisplayMode
|
||||
toggleSpaceDisplay()
|
||||
shouldShowType()
|
||||
runTerminalAction()
|
||||
```
|
||||
|
||||
### Briefings
|
||||
|
||||
Brief output now includes:
|
||||
|
||||
- Source Integrity
|
||||
- evidence links
|
||||
- event IDs
|
||||
- configurable verbosity through `BRIEF_VERBOSITY`
|
||||
|
||||
### Documentation
|
||||
|
||||
Updated:
|
||||
|
||||
- `README.md`
|
||||
- `.env.example`
|
||||
- `docs/sources/README.md`
|
||||
- `docs/sources/opensky.md`
|
||||
- `docs/sources/acled.md`
|
||||
- `docs/sources/telegram.md`
|
||||
- `docs/sources/firms.md`
|
||||
- `docs/sources/maritime.md`
|
||||
- `docs/security-review.md`
|
||||
- `docs/release-checklist.md`
|
||||
|
||||
README includes:
|
||||
|
||||
- Gitea Registry pull example
|
||||
- Dockge-compatible compose example
|
||||
- full `.env` examples
|
||||
- OpenRouter Free setup
|
||||
- LM Studio setup
|
||||
- Ollama setup
|
||||
- local OpenAI-compatible setup
|
||||
- Pangolin/reverse proxy notes
|
||||
|
||||
## Registry And Images
|
||||
|
||||
Registry image:
|
||||
|
||||
```text
|
||||
git.wilkensxl.de/mrsphay/intelligence-terminal
|
||||
```
|
||||
|
||||
Verified package tags through Gitea API:
|
||||
|
||||
```text
|
||||
latest
|
||||
20260517
|
||||
e933586b220656a2858d2215b934b22d1f08a908
|
||||
53470cc701ec322080a89d220aef449b25850590
|
||||
```
|
||||
|
||||
Successful pull test:
|
||||
|
||||
```bash
|
||||
docker pull git.wilkensxl.de/mrsphay/intelligence-terminal:latest
|
||||
```
|
||||
|
||||
Observed digest:
|
||||
|
||||
```text
|
||||
sha256:780a41413921bd9a676461eca1cd1372591f523be4b7c9513d9bc085cbe7922d
|
||||
```
|
||||
|
||||
## Gitea Actions
|
||||
|
||||
Workflows present:
|
||||
|
||||
```text
|
||||
.gitea/workflows/build.yml
|
||||
.gitea/workflows/security-scan.yml
|
||||
.gitea/workflows/repo-cleanup.yml
|
||||
.gitea/workflows/dependency-check.yml
|
||||
.gitea/workflows/release-dry-run.yml
|
||||
.gitea/workflows/template-compliance.yml
|
||||
```
|
||||
|
||||
Final runs for commit `53470cc701ec322080a89d220aef449b25850590` were polled through the Gitea API and succeeded:
|
||||
|
||||
```text
|
||||
build.yml on main: success
|
||||
build.yml on codex/production-intelligence-terminal: success
|
||||
release-dry-run.yml on main: success
|
||||
release-dry-run.yml on codex/production-intelligence-terminal: success
|
||||
template-compliance.yml on main: success
|
||||
template-compliance.yml on codex/production-intelligence-terminal: success
|
||||
```
|
||||
|
||||
Relevant run URLs:
|
||||
|
||||
```text
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/actions/runs/23
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/actions/runs/24
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/actions/runs/25
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/actions/runs/26
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/actions/runs/27
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/actions/runs/28
|
||||
```
|
||||
|
||||
Repository secret expected by the registry publish workflow:
|
||||
|
||||
```text
|
||||
REGISTRY_TOKEN
|
||||
```
|
||||
|
||||
Local token note:
|
||||
|
||||
- `GITEA_TOKEN` was visible in the final Codex process.
|
||||
- It was used only for Gitea API checks and not printed.
|
||||
|
||||
## Issue Sync
|
||||
|
||||
Open upstream GitHub issues were reviewed on 2026-05-17 from:
|
||||
|
||||
```text
|
||||
https://github.com/calesthio/Crucix/issues
|
||||
```
|
||||
|
||||
The upstream list contained 24 open issues. Issues already handled by this fork were not copied as open work, including the Docker stale-dashboard incident (#105), map label redraw (#70), Sensor Grid controls (#72), space display toggle (#51), source docs (#52), Dockge/CasaOS docs (#78), LLM timeout (#87), inject/static helper confusion (#100), network metrics (#101), Telegram polling backoff (#104), and briefing/evidence context (#75).
|
||||
|
||||
Issues not relevant to this fork were also not copied, including the Wallpaper Engine redesign (#41), the fork-inflation discussion (#107), empty/unclear placeholders (#79/#80), and the general use-case discussion (#93).
|
||||
|
||||
The following Gitea issues were created for real remaining work:
|
||||
|
||||
```text
|
||||
#1 Reddit source must stop unauthenticated .json scraping
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/1
|
||||
|
||||
#2 Send operator alerts when dashboard data remains stale
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/2
|
||||
|
||||
#3 ACLED credentialed integration needs regression test and diagnostics
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/3
|
||||
|
||||
#4 Complete memory and prediction loop beyond Phase-1 SQLite
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/4
|
||||
|
||||
#5 Remove old inline dashboard snapshot from production builds
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/5
|
||||
|
||||
#6 Harden Terminal Actions for public reverse-proxy deployments
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/6
|
||||
|
||||
#7 Replace ADS-B stub with real disabled/degraded source handling
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/7
|
||||
|
||||
#8 Clean inherited public-demo and upstream marketing references
|
||||
https://git.wilkensxl.de/MrSphay/intelligence-terminal/issues/8
|
||||
```
|
||||
|
||||
## Verification Already Performed
|
||||
|
||||
Local lightweight checks:
|
||||
|
||||
```bash
|
||||
npm run test:unit
|
||||
npm audit --omit=dev --audit-level=high
|
||||
docker compose --env-file .env.example config
|
||||
node --check server.mjs
|
||||
node --check dashboard/inject.mjs
|
||||
node --check lib/llm/openai-compatible.mjs
|
||||
git diff --check
|
||||
```
|
||||
|
||||
Unit test result:
|
||||
|
||||
```text
|
||||
21 tests passing
|
||||
0 failing
|
||||
```
|
||||
|
||||
Audit result:
|
||||
|
||||
```text
|
||||
0 high vulnerabilities
|
||||
```
|
||||
|
||||
Docker build and smoke test were performed locally earlier:
|
||||
|
||||
```bash
|
||||
docker build -t git.wilkensxl.de/mrsphay/intelligence-terminal:latest .
|
||||
docker run --rm -d --name intelligence-terminal-smoke -p 127.0.0.1::3117 -e AUTO_OPEN_BROWSER=false git.wilkensxl.de/mrsphay/intelligence-terminal:latest
|
||||
```
|
||||
|
||||
Smoke test observations:
|
||||
|
||||
- Server booted.
|
||||
- No `xdg-open` error.
|
||||
- Initial sweep completed.
|
||||
- `/api/health` moved from `starting` to `degraded` with transparent source errors.
|
||||
- Degraded state was expected without all optional API keys.
|
||||
|
||||
Additional checks after fixing the dashboard live-data bug and Terminal Actions:
|
||||
|
||||
```bash
|
||||
node --check server.mjs
|
||||
npm run test:unit
|
||||
docker compose --env-file .env.example config
|
||||
git diff --check
|
||||
```
|
||||
|
||||
The dashboard script was also syntax-checked after extracting script blocks from `dashboard/public/jarvis.html`.
|
||||
|
||||
## Important Commits
|
||||
|
||||
```text
|
||||
7e85a54 chore: apply agent kit project structure
|
||||
85f97bb feat: harden intelligence runtime and llm providers
|
||||
42b7fc2 docs: add registry dockge and dashboard operations
|
||||
d072390 ci: align gitea workflows with agent kit
|
||||
0559481 ci: fix gitea registry publish login
|
||||
f3c9331 ci: fix agent kit compliance checks
|
||||
c2d572e fix: prepare runs volume before dropping privileges
|
||||
8e096b2 ci: harden gitea workflow reruns
|
||||
e933586 merge: reconcile main with production branch
|
||||
4262c7e docs: expand agent handoff
|
||||
53470cc fix: load live dashboard data and add terminal actions
|
||||
```
|
||||
|
||||
The large implementation commit `85f97bb` and the dashboard/action fix `53470cc` are contained in both:
|
||||
|
||||
```text
|
||||
origin/codex/production-intelligence-terminal
|
||||
origin/main
|
||||
```
|
||||
|
||||
## How To Continue In A Fresh Codex Environment
|
||||
|
||||
1. Clone the Gitea repository:
|
||||
|
||||
```bash
|
||||
git clone https://git.wilkensxl.de/MrSphay/intelligence-terminal.git
|
||||
cd intelligence-terminal
|
||||
git checkout codex/production-intelligence-terminal
|
||||
```
|
||||
|
||||
2. Confirm the expected commit:
|
||||
|
||||
```bash
|
||||
git rev-parse HEAD
|
||||
```
|
||||
|
||||
Expected:
|
||||
|
||||
```text
|
||||
The branch tip should include commit 53470cc701ec322080a89d220aef449b25850590 and the later `docs: sync issue tracker and handoff` commit.
|
||||
```
|
||||
|
||||
3. Read these files first:
|
||||
|
||||
```text
|
||||
AGENTS.md
|
||||
.codex/project.md
|
||||
docs/agent-handoff.md
|
||||
README.md
|
||||
.env.example
|
||||
```
|
||||
|
||||
4. If checking Actions, use `GITEA_TOKEN` from the environment. Do not print it.
|
||||
|
||||
PowerShell check:
|
||||
|
||||
```powershell
|
||||
if ($env:GITEA_TOKEN) { "GITEA_TOKEN=set" } else { "GITEA_TOKEN=missing" }
|
||||
```
|
||||
|
||||
5. Useful commands:
|
||||
|
||||
```bash
|
||||
npm run test:unit
|
||||
docker compose --env-file .env.example config
|
||||
docker pull git.wilkensxl.de/mrsphay/intelligence-terminal:latest
|
||||
```
|
||||
|
||||
6. Start with Dockge/Pangolin using the README compose example and a `.env` based on `.env.example`.
|
||||
|
||||
## Remaining Risks And Follow-Ups
|
||||
|
||||
- Some sources will report `degraded` until optional keys are set, especially ACLED, FRED, EIA, and Cloudflare Radar.
|
||||
- OpenSky can rate-limit with HTTP 429; this is now visible in health instead of hidden.
|
||||
- GDELT/OFAC can time out under runner/network conditions; health reports this explicitly.
|
||||
- Browser-level visual verification of the full dashboard should be repeated after any future UI change.
|
||||
- The project still inherits the original Crucix broad source surface. Future work should prefer focused source-by-source tests over broad refactors.
|
||||
- If a new Codex environment sees non-fast-forward branch pushes, fetch first and preserve remote commits. Do not force-push without explicit approval.
|
||||
|
||||
## Operator Pull Command
|
||||
|
||||
For deployment:
|
||||
|
||||
```bash
|
||||
docker pull git.wilkensxl.de/mrsphay/intelligence-terminal:latest
|
||||
```
|
||||
|
||||
For a pinned deployment:
|
||||
|
||||
```bash
|
||||
docker pull git.wilkensxl.de/mrsphay/intelligence-terminal:20260517
|
||||
```
|
||||
- The repository is Docker-first and should stay suitable for Dockge/Pangolin.
|
||||
- Use `.env.example` as the operator-facing source of truth for configuration.
|
||||
- Source health and network metrics are available through `/api/health` and `/api/metrics`.
|
||||
- If Gitea Registry authentication is unavailable locally, build and push with the commands documented in `README.md`.
|
||||
|
||||
@@ -5,21 +5,12 @@
|
||||
- Shell execution: browser auto-open is gated by `AUTO_OPEN_BROWSER` and defaults to false.
|
||||
- Secrets: `.env` remains ignored; `.env.example` contains no real keys.
|
||||
- External network calls: source fetches use timeout/retry diagnostics and expose degraded state.
|
||||
- Manual actions: `/api/sweep` and `/api/action` are gated by `TERMINAL_ACTIONS_ENABLED` and local-only or `SWEEP_TOKEN` authorization.
|
||||
- Manual actions: `/api/sweep` is local-only unless `SWEEP_TOKEN` is configured.
|
||||
- File writes: runtime writes are limited to `runs/`.
|
||||
- HTML injection: dashboard data is JSON-injected only by the CLI path; server mode serves data through API/SSE.
|
||||
|
||||
## Terminal Actions
|
||||
|
||||
- `TERMINAL_ACTIONS_ENABLED=true` enables dashboard-triggered `status`, `sweep`, and `brief` actions through `POST /api/action`.
|
||||
- If `SWEEP_TOKEN` is set, callers must send the token through `x-sweep-token`, `Authorization: Bearer ...`, or the `token` request body field.
|
||||
- If `SWEEP_TOKEN` is empty, actions are accepted only from local loopback addresses.
|
||||
- For private Dockge/LAN deployments, this is intended to make the terminal operable from the browser.
|
||||
- For Pangolin or other internet-exposed deployments, set `SWEEP_TOKEN` or `TERMINAL_ACTIONS_ENABLED=false` until the public reverse-proxy hardening issue is completed.
|
||||
|
||||
## Residual Risk
|
||||
|
||||
- External feeds can return malformed, stale, or adversarial content. UI rendering should continue to sanitize titles and URLs.
|
||||
- LLM outputs are advisory only and must not be treated as financial advice.
|
||||
- `node:sqlite` availability depends on the Node 22 build; when unavailable the memory database degrades to a no-op placeholder.
|
||||
- Browser-stored sweep tokens are acceptable for a trusted home-server UI, but should not be treated as a strong auth boundary on a public endpoint.
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
# Source Fetch Instrumentation
|
||||
|
||||
`safeFetch()` and `safeFetchText()` attribute requests to `/api/metrics.fetch.bySource`.
|
||||
|
||||
Rules:
|
||||
|
||||
- Prefer passing an explicit `source` option from source modules when the call has a clear Crucix source name.
|
||||
- If `source` is omitted, the shared helper infers a stable provider name from the request host.
|
||||
- Unknown hosts fall back to the lowercase host instead of the old `unknown` bucket.
|
||||
- Raw `fetch()` calls should be limited to cases where the shared helper cannot represent the protocol cleanly.
|
||||
|
||||
Current raw-fetch exceptions:
|
||||
|
||||
| Area | Reason |
|
||||
| --- | --- |
|
||||
| OAuth/session handshakes | Token exchange calls often need custom form bodies, credential headers, or status-specific diagnostics. |
|
||||
| Bot and alert delivery | Telegram/Discord alert calls are outbound operator notifications, not intelligence source health. |
|
||||
| LLM providers | Provider clients already track model/provider status separately from source fetch health. |
|
||||
| Dashboard browser calls | Browser-side `/api/*` and asset fetches are UI behavior, not source provider health. |
|
||||
|
||||
When adding a new intelligence source, use `safeFetch(url, { source: 'SourceName' })` unless there is a documented exception.
|
||||
@@ -16,5 +16,3 @@ Source docs:
|
||||
- [Telegram](telegram.md)
|
||||
- [FIRMS](firms.md)
|
||||
- [Maritime](maritime.md)
|
||||
- [ADS-B](adsb.md)
|
||||
- [Reddit](reddit.md)
|
||||
|
||||
@@ -2,11 +2,9 @@
|
||||
|
||||
Provides conflict events, fatalities, event types, and locations.
|
||||
|
||||
- Auth: `ACLED_EMAIL` and `ACLED_PASSWORD`. `ACLED_USER` or `ACLED_USERNAME` may be used as aliases for `ACLED_EMAIL`.
|
||||
- Auth: `ACLED_EMAIL` or `ACLED_USER`, plus `ACLED_PASSWORD`.
|
||||
- Flow: OAuth password grant is tried first, then cookie session fallback.
|
||||
- Failure modes are classified as `no_credentials`, `auth_failed`, `access_denied`, or `api_failed`.
|
||||
- Behavior: missing, rejected, or unauthorized credentials produce degraded source health with a concise operator message.
|
||||
- Secret handling: debug output never prints bearer tokens, cookies, or the configured password.
|
||||
- Test: run `node --test test/acled-source.test.mjs`; with real credentials, run `node apis/sources/acled.mjs`, then check `/api/health`.
|
||||
|
||||
`access_denied` normally means the login worked but the account cannot read API data. Check that ACLED terms are accepted, required profile fields are complete, and API access is enabled for the account.
|
||||
- Failure modes: missing credentials (`no_credentials`), rejected credentials or access denied (`auth_failed`), token/API endpoint failure (`api_failed`), and valid empty event sets (`totalEvents: 0`).
|
||||
- Behavior: missing or rejected credentials produce degraded source health with the ACLED error text.
|
||||
- Debug logs redact bearer tokens and cookies.
|
||||
- Test: set credentials, run `node apis/sources/acled.mjs`, then check `/api/health`.
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
# ADS-B Source
|
||||
|
||||
ADS-B Exchange support is optional and intended for unfiltered aircraft and military-flight awareness.
|
||||
|
||||
- Source module: `apis/sources/adsb.mjs`
|
||||
- Preferred provider: ADS-B Exchange via RapidAPI
|
||||
- Credentials: `ADSB_API_KEY` or `RAPIDAPI_KEY`
|
||||
- Runtime status without credentials: `disabled`
|
||||
- Runtime status when providers fail: `degraded`
|
||||
- Runtime status with usable aircraft payloads: `live`
|
||||
|
||||
The source does not treat a missing key or unavailable public feed as normal live data. `/api/health` and `/api/metrics` surface the degraded source state through the sweep source summary.
|
||||
|
||||
Known failure modes:
|
||||
|
||||
- Missing `ADSB_API_KEY` / `RAPIDAPI_KEY`: source is disabled with operator guidance.
|
||||
- RapidAPI rejects or rate-limits the request: source is degraded and records provider failure detail.
|
||||
- Public feed is blocked, rate-limited, or changes shape: source remains degraded instead of returning stale-looking data.
|
||||
|
||||
Register for the provider documented in the README, then set:
|
||||
|
||||
```env
|
||||
ADSB_API_KEY=<rapidapi-key>
|
||||
```
|
||||
@@ -6,4 +6,4 @@ Provides public aircraft state data for regional air-activity hotspots.
|
||||
- Failure modes: timeouts, `HTTP 429`, and empty regions.
|
||||
- Behavior: source health is marked degraded on API errors. The dashboard may use the most recent non-empty air snapshot from `runs/` and marks it in `airMeta.fallback`.
|
||||
- Test: start a sweep and inspect `/api/health` plus `airMeta` from `/api/data`.
|
||||
- Operator note: Intelligence Terminal does not bypass OpenSky throttles. Increase `REFRESH_INTERVAL_MINUTES` if the source degrades repeatedly.
|
||||
- Operator note: Crucix does not bypass OpenSky throttles. Increase `REFRESH_INTERVAL_MINUTES` if the source degrades repeatedly.
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
# Reddit Source
|
||||
|
||||
Reddit is used as a social sentiment input for selected geopolitical and market subreddits.
|
||||
|
||||
## Configuration
|
||||
|
||||
Create a Reddit script app at:
|
||||
|
||||
```text
|
||||
https://www.reddit.com/prefs/apps/
|
||||
```
|
||||
|
||||
Then set:
|
||||
|
||||
```env
|
||||
REDDIT_CLIENT_ID=
|
||||
REDDIT_CLIENT_SECRET=
|
||||
```
|
||||
|
||||
## Runtime Behavior
|
||||
|
||||
- The source uses the OAuth client credentials flow and then reads `https://oauth.reddit.com`.
|
||||
- Unauthenticated `reddit.com/.../hot.json` scraping is intentionally disabled.
|
||||
- Missing credentials return `status: no_credentials` and are surfaced as source degradation.
|
||||
- OAuth failures return `status: auth_failed` without logging or returning the client secret.
|
||||
- Subreddit fetch failures return `status: degraded` with per-subreddit errors.
|
||||
|
||||
## Test
|
||||
|
||||
```bash
|
||||
node apis/sources/reddit.mjs
|
||||
npm run test:unit
|
||||
```
|
||||
@@ -2,9 +2,6 @@
|
||||
|
||||
import { existsSync, mkdirSync, writeFileSync } from 'fs';
|
||||
import { dirname, join } from 'path';
|
||||
import { createHash } from 'crypto';
|
||||
|
||||
const PREDICTION_STATES = new Set(['open', 'monitoring', 'observed', 'expired_unverified', 'invalidated']);
|
||||
|
||||
export class IntelligenceStore {
|
||||
constructor(dbPath) {
|
||||
@@ -33,24 +30,15 @@ export class IntelligenceStore {
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS predictions (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
stable_id TEXT UNIQUE,
|
||||
created_at TEXT NOT NULL,
|
||||
updated_at TEXT,
|
||||
title TEXT NOT NULL,
|
||||
type TEXT,
|
||||
hypothesis TEXT,
|
||||
evidence_json TEXT,
|
||||
confidence TEXT,
|
||||
horizon TEXT,
|
||||
outcome_state TEXT DEFAULT 'open',
|
||||
outcome_json TEXT,
|
||||
last_evaluated_at TEXT,
|
||||
source TEXT,
|
||||
payload_json TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS entities (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
stable_id TEXT UNIQUE,
|
||||
first_seen TEXT NOT NULL,
|
||||
last_seen TEXT NOT NULL,
|
||||
name TEXT NOT NULL,
|
||||
@@ -58,21 +46,7 @@ export class IntelligenceStore {
|
||||
count INTEGER DEFAULT 1,
|
||||
UNIQUE(name, kind)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS events (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
stable_id TEXT NOT NULL UNIQUE,
|
||||
first_seen TEXT NOT NULL,
|
||||
last_seen TEXT NOT NULL,
|
||||
kind TEXT NOT NULL,
|
||||
name TEXT NOT NULL,
|
||||
region TEXT,
|
||||
severity TEXT,
|
||||
source TEXT,
|
||||
evidence_json TEXT NOT NULL,
|
||||
count INTEGER DEFAULT 1
|
||||
);
|
||||
`);
|
||||
this._migrate();
|
||||
this.available = true;
|
||||
} catch (err) {
|
||||
this.available = false;
|
||||
@@ -97,139 +71,22 @@ export class IntelligenceStore {
|
||||
delta?.summary?.direction || null,
|
||||
JSON.stringify({ meta, delta: delta?.summary || null }),
|
||||
);
|
||||
this._recordEntities(data, timestamp);
|
||||
this._recordEvents(data, delta, timestamp);
|
||||
this.evaluatePredictions(data, timestamp);
|
||||
this._recordPredictions(data, timestamp);
|
||||
}
|
||||
|
||||
status() {
|
||||
return { available: this.available, path: this.dbPath, reason: this.reason };
|
||||
}
|
||||
|
||||
queryMemory({ q = '', limit = 25 } = {}) {
|
||||
if (!this.available || !this.db) return { available: false, reason: this.reason, results: [] };
|
||||
const safeLimit = Math.max(1, Math.min(100, Number(limit) || 25));
|
||||
const term = String(q || '').trim();
|
||||
const like = `%${term}%`;
|
||||
const where = term
|
||||
? 'WHERE name LIKE ? OR region LIKE ? OR source LIKE ? OR kind LIKE ?'
|
||||
: '';
|
||||
const params = term ? [like, like, like, like, safeLimit] : [safeLimit];
|
||||
const events = this.db.prepare(`
|
||||
SELECT stable_id, first_seen, last_seen, kind, name, region, severity, source, count, evidence_json
|
||||
FROM events
|
||||
${where}
|
||||
ORDER BY last_seen DESC
|
||||
LIMIT ?
|
||||
`).all(...params).map(row => ({ ...row, evidence: parseJson(row.evidence_json, {}) }));
|
||||
return { available: true, q: term, results: events };
|
||||
}
|
||||
|
||||
listPredictions({ state = null, limit = 25 } = {}) {
|
||||
if (!this.available || !this.db) return { available: false, reason: this.reason, predictions: [] };
|
||||
const safeLimit = Math.max(1, Math.min(100, Number(limit) || 25));
|
||||
const normalizedState = state && PREDICTION_STATES.has(String(state)) ? String(state) : null;
|
||||
const rows = normalizedState
|
||||
? this.db.prepare(`SELECT * FROM predictions WHERE outcome_state = ? ORDER BY created_at DESC LIMIT ?`).all(normalizedState, safeLimit)
|
||||
: this.db.prepare(`SELECT * FROM predictions ORDER BY created_at DESC LIMIT ?`).all(safeLimit);
|
||||
return {
|
||||
available: true,
|
||||
predictions: rows.map(row => ({
|
||||
stable_id: row.stable_id,
|
||||
created_at: row.created_at,
|
||||
updated_at: row.updated_at,
|
||||
title: row.title,
|
||||
type: row.type,
|
||||
hypothesis: row.hypothesis,
|
||||
confidence: row.confidence,
|
||||
horizon: row.horizon,
|
||||
outcome_state: row.outcome_state,
|
||||
last_evaluated_at: row.last_evaluated_at,
|
||||
source: row.source,
|
||||
evidence: parseJson(row.evidence_json, []),
|
||||
outcome: parseJson(row.outcome_json, null),
|
||||
})),
|
||||
};
|
||||
}
|
||||
|
||||
evaluatePredictions(data, timestamp = new Date().toISOString()) {
|
||||
if (!this.available || !this.db) return;
|
||||
const rows = this.db.prepare(`
|
||||
SELECT id, created_at, title, type, horizon, outcome_state, payload_json
|
||||
FROM predictions
|
||||
WHERE outcome_state IN ('open', 'monitoring')
|
||||
ORDER BY created_at ASC
|
||||
LIMIT 200
|
||||
`).all();
|
||||
for (const row of rows) {
|
||||
const payload = parseJson(row.payload_json, {});
|
||||
const evaluation = evaluatePredictionAgainstSweep(row, payload, data, timestamp);
|
||||
this.db.prepare(`UPDATE predictions
|
||||
SET outcome_state = ?, outcome_json = ?, last_evaluated_at = ?, updated_at = ?
|
||||
WHERE id = ?`).run(
|
||||
evaluation.state,
|
||||
JSON.stringify(evaluation),
|
||||
timestamp,
|
||||
timestamp,
|
||||
row.id,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
_migrate() {
|
||||
const columns = {
|
||||
predictions: [
|
||||
['stable_id', 'TEXT'],
|
||||
['updated_at', 'TEXT'],
|
||||
['hypothesis', 'TEXT'],
|
||||
['evidence_json', 'TEXT'],
|
||||
['horizon', 'TEXT'],
|
||||
['outcome_state', "TEXT DEFAULT 'open'"],
|
||||
['outcome_json', 'TEXT'],
|
||||
['last_evaluated_at', 'TEXT'],
|
||||
],
|
||||
entities: [
|
||||
['stable_id', 'TEXT'],
|
||||
],
|
||||
};
|
||||
for (const [table, defs] of Object.entries(columns)) {
|
||||
for (const [name, type] of defs) {
|
||||
try { this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${name} ${type}`); } catch { }
|
||||
}
|
||||
}
|
||||
try { this.db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_predictions_stable_id ON predictions(stable_id)`); } catch { }
|
||||
try { this.db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_entities_stable_id ON entities(stable_id)`); } catch { }
|
||||
}
|
||||
|
||||
_recordPredictions(data, timestamp) {
|
||||
for (const idea of data.ideas || []) {
|
||||
const title = idea.title || 'Untitled idea';
|
||||
const stableId = stableId('prediction', title, idea.type || '', idea.ticker || '', idea.horizon || '');
|
||||
const evidence = Array.isArray(idea.signals) ? idea.signals : [];
|
||||
this.db.prepare(`INSERT INTO predictions (
|
||||
stable_id, created_at, updated_at, title, type, hypothesis, evidence_json, confidence,
|
||||
horizon, outcome_state, source, payload_json
|
||||
)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'open', ?, ?)
|
||||
ON CONFLICT(stable_id) DO UPDATE SET
|
||||
updated_at=excluded.updated_at,
|
||||
confidence=excluded.confidence,
|
||||
evidence_json=excluded.evidence_json,
|
||||
payload_json=excluded.payload_json`).run(
|
||||
stableId,
|
||||
this.db.prepare(`INSERT INTO predictions (created_at, title, type, confidence, source, payload_json)
|
||||
VALUES (?, ?, ?, ?, ?, ?)`).run(
|
||||
timestamp,
|
||||
timestamp,
|
||||
title,
|
||||
idea.title || 'Untitled idea',
|
||||
idea.type || null,
|
||||
idea.rationale || idea.text || title,
|
||||
JSON.stringify(evidence),
|
||||
idea.confidence || null,
|
||||
idea.horizon || null,
|
||||
idea.source || data.ideasSource || null,
|
||||
JSON.stringify(idea),
|
||||
);
|
||||
}
|
||||
this._recordEntities(data, timestamp);
|
||||
}
|
||||
|
||||
status() {
|
||||
return { available: this.available, path: this.dbPath, reason: this.reason };
|
||||
}
|
||||
|
||||
_recordEntities(data, timestamp) {
|
||||
@@ -242,154 +99,14 @@ export class IntelligenceStore {
|
||||
if (item.region) names.push([item.region, 'region']);
|
||||
}
|
||||
for (const [name, kind] of names.slice(0, 200)) {
|
||||
const cleanName = String(name).slice(0, 160);
|
||||
this.db.prepare(`INSERT INTO entities (stable_id, first_seen, last_seen, name, kind, count)
|
||||
VALUES (?, ?, ?, ?, ?, 1)
|
||||
this.db.prepare(`INSERT INTO entities (first_seen, last_seen, name, kind, count)
|
||||
VALUES (?, ?, ?, ?, 1)
|
||||
ON CONFLICT(name, kind) DO UPDATE SET last_seen=excluded.last_seen, count=count+1`).run(
|
||||
stableId('entity', kind, cleanName),
|
||||
timestamp,
|
||||
timestamp,
|
||||
cleanName,
|
||||
String(name).slice(0, 160),
|
||||
kind,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
_recordEvents(data, delta, timestamp) {
|
||||
const events = extractEvents(data, delta);
|
||||
for (const event of events.slice(0, 300)) {
|
||||
this.db.prepare(`INSERT INTO events (
|
||||
stable_id, first_seen, last_seen, kind, name, region, severity, source, evidence_json, count
|
||||
)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1)
|
||||
ON CONFLICT(stable_id) DO UPDATE SET
|
||||
last_seen=excluded.last_seen,
|
||||
severity=COALESCE(excluded.severity, severity),
|
||||
evidence_json=excluded.evidence_json,
|
||||
count=count+1`).run(
|
||||
event.stable_id,
|
||||
timestamp,
|
||||
timestamp,
|
||||
event.kind,
|
||||
event.name,
|
||||
event.region || null,
|
||||
event.severity || null,
|
||||
event.source || null,
|
||||
JSON.stringify(event.evidence || {}),
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function stableId(...parts) {
|
||||
const input = parts.map(part => String(part || '').trim().toLowerCase()).join('|');
|
||||
return createHash('sha256').update(input).digest('hex').slice(0, 24);
|
||||
}
|
||||
|
||||
function parseJson(value, fallback) {
|
||||
try { return value ? JSON.parse(value) : fallback; } catch { return fallback; }
|
||||
}
|
||||
|
||||
function extractEvents(data, delta) {
|
||||
const events = [];
|
||||
const push = ({ kind, name, region, severity, source, evidence }) => {
|
||||
if (!kind || !name) return;
|
||||
events.push({
|
||||
stable_id: stableId('event', kind, name, region || source || ''),
|
||||
kind,
|
||||
name: String(name).slice(0, 240),
|
||||
region: region ? String(region).slice(0, 120) : null,
|
||||
severity: severity || null,
|
||||
source: source || null,
|
||||
evidence: evidence || {},
|
||||
});
|
||||
};
|
||||
|
||||
for (const item of data.acled?.deadliestEvents || []) {
|
||||
push({
|
||||
kind: 'conflict',
|
||||
name: item.event_type || item.sub_event_type || item.location || item.country,
|
||||
region: item.country || item.location,
|
||||
severity: Number(item.fatalities || 0) > 0 ? 'high' : 'medium',
|
||||
source: 'ACLED',
|
||||
evidence: item,
|
||||
});
|
||||
}
|
||||
for (const item of data.tg?.urgent || []) {
|
||||
push({
|
||||
kind: 'osint',
|
||||
name: (item.text || '').slice(0, 120),
|
||||
region: item.region || 'OSINT',
|
||||
severity: 'high',
|
||||
source: item.channel || item.chat || 'telegram',
|
||||
evidence: item,
|
||||
});
|
||||
}
|
||||
for (const item of data.newsFeed || data.news || []) {
|
||||
if (!item.urgent) continue;
|
||||
push({
|
||||
kind: 'news',
|
||||
name: item.headline || item.title,
|
||||
region: item.region,
|
||||
severity: 'medium',
|
||||
source: item.source,
|
||||
evidence: item,
|
||||
});
|
||||
}
|
||||
for (const signal of delta?.signals?.new || []) {
|
||||
push({
|
||||
kind: 'delta',
|
||||
name: signal.label || signal.reason || signal.key,
|
||||
region: signal.region,
|
||||
severity: signal.severity || 'medium',
|
||||
source: 'delta',
|
||||
evidence: signal,
|
||||
});
|
||||
}
|
||||
return events;
|
||||
}
|
||||
|
||||
function evaluatePredictionAgainstSweep(row, payload, data, timestamp) {
|
||||
const terms = [
|
||||
row.title,
|
||||
payload.ticker,
|
||||
...(Array.isArray(payload.signals) ? payload.signals : []),
|
||||
].filter(Boolean).map(v => String(v).toLowerCase());
|
||||
const evidenceText = [
|
||||
...(data.tSignals || []),
|
||||
...(data.newsFeed || []).slice(0, 40).map(n => `${n.source || ''} ${n.headline || n.title || ''}`),
|
||||
...(data.tg?.urgent || []).slice(0, 20).map(p => p.text || ''),
|
||||
].join('\n').toLowerCase();
|
||||
const matched = terms.filter(term => term.length >= 4 && evidenceText.includes(term.slice(0, 60)));
|
||||
const expired = predictionExpired(row.created_at, row.horizon, timestamp);
|
||||
const state = matched.length
|
||||
? 'observed'
|
||||
: expired
|
||||
? 'expired_unverified'
|
||||
: 'monitoring';
|
||||
return {
|
||||
state,
|
||||
evaluated_at: timestamp,
|
||||
matched_terms: matched.slice(0, 10),
|
||||
expired,
|
||||
reason: matched.length
|
||||
? 'Current sweep contains matching evidence terms.'
|
||||
: expired
|
||||
? 'Prediction horizon elapsed without matching evidence.'
|
||||
: 'Prediction remains open for future sweeps.',
|
||||
};
|
||||
}
|
||||
|
||||
function predictionExpired(createdAt, horizon, nowIso) {
|
||||
const created = new Date(createdAt).getTime();
|
||||
const now = new Date(nowIso).getTime();
|
||||
if (!Number.isFinite(created) || !Number.isFinite(now)) return false;
|
||||
const text = String(horizon || '').toLowerCase();
|
||||
const days = text.includes('intraday') ? 1
|
||||
: text.includes('day') ? 7
|
||||
: text.includes('week') ? 45
|
||||
: text.includes('month') ? 180
|
||||
: text.includes('strategic') ? 365
|
||||
: 30;
|
||||
return now - created > days * 24 * 60 * 60 * 1000;
|
||||
}
|
||||
|
||||
@@ -1,212 +0,0 @@
|
||||
import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
|
||||
import { join } from 'path';
|
||||
|
||||
const DEFAULT_SCENARIOS = [
|
||||
{
|
||||
id: 'middle-east-energy-shock',
|
||||
enabled: false,
|
||||
name: 'Middle East energy shock',
|
||||
description: 'Energy supply risk building from Middle East conflict or chokepoint pressure.',
|
||||
regions: ['Middle East', 'Iran', 'Israel', 'Strait of Hormuz'],
|
||||
categories: ['osint', 'energy', 'maritime'],
|
||||
keywords: ['missile', 'strike', 'hormuz', 'oil', 'energy', 'blockade'],
|
||||
thresholds: { watching: 2, building: 4, confirmed: 7 },
|
||||
invalidation: 'WTI normalizes and regional urgent signals fade for several sweeps.',
|
||||
},
|
||||
{
|
||||
id: 'macro-stress-spillover',
|
||||
enabled: false,
|
||||
name: 'Macro stress spillover',
|
||||
description: 'Market stress spreads from volatility into credit, rates, or commodities.',
|
||||
regions: ['US', 'Global'],
|
||||
categories: ['macro', 'markets'],
|
||||
keywords: ['vix', 'spread', 'credit', 'yield', 'inflation', 'gold'],
|
||||
thresholds: { watching: 2, building: 4, confirmed: 6 },
|
||||
invalidation: 'VIX and credit stress both normalize while source health remains stable.',
|
||||
},
|
||||
{
|
||||
id: 'regional-escalation-risk',
|
||||
enabled: false,
|
||||
name: 'Regional escalation risk',
|
||||
description: 'Local conflict signals broaden across adjacent regions or source categories.',
|
||||
regions: ['Ukraine', 'Taiwan', 'Africa', 'Middle East'],
|
||||
categories: ['conflict', 'thermal', 'osint', 'air'],
|
||||
keywords: ['mobilization', 'intercept', 'drone', 'ballistic', 'fatalities', 'border'],
|
||||
thresholds: { watching: 2, building: 5, confirmed: 8 },
|
||||
invalidation: 'No fresh cross-source escalation signals appear inside the configured horizon.',
|
||||
},
|
||||
];
|
||||
|
||||
export function evaluateScenarios(data, delta, runsDir) {
|
||||
const loaded = loadScenarioDefinitions(runsDir);
|
||||
if (!loaded.ok) {
|
||||
return { available: false, error: loaded.error, items: [], changed: [] };
|
||||
}
|
||||
|
||||
const statePath = join(runsDir, 'scenario-state.json');
|
||||
const previous = readJson(statePath, {});
|
||||
const evaluatedAt = data.meta?.timestamp || new Date().toISOString();
|
||||
const corpus = buildCorpus(data, delta);
|
||||
const items = loaded.scenarios.map(def => evaluateScenario(def, corpus, previous[def.id], evaluatedAt));
|
||||
const changed = items.filter(item => item.changed);
|
||||
|
||||
writeJson(statePath, Object.fromEntries(items.map(item => [item.id, {
|
||||
state: item.state,
|
||||
score: item.score,
|
||||
confidence: item.confidence,
|
||||
lastTriggerTime: item.lastTriggerTime,
|
||||
updatedAt: evaluatedAt,
|
||||
}])));
|
||||
|
||||
return {
|
||||
available: true,
|
||||
path: loaded.path,
|
||||
items,
|
||||
changed,
|
||||
};
|
||||
}
|
||||
|
||||
export function loadScenarioDefinitions(runsDir) {
|
||||
const path = join(runsDir, 'scenarios.json');
|
||||
try {
|
||||
if (!existsSync(runsDir)) mkdirSync(runsDir, { recursive: true });
|
||||
if (!existsSync(path)) {
|
||||
writeJson(path, {
|
||||
version: 1,
|
||||
scenarios: DEFAULT_SCENARIOS,
|
||||
});
|
||||
}
|
||||
const raw = JSON.parse(readFileSync(path, 'utf8'));
|
||||
if (!raw || !Array.isArray(raw.scenarios)) throw new Error('scenarios must be an array');
|
||||
const scenarios = raw.scenarios
|
||||
.map(normalizeScenario)
|
||||
.filter(Boolean);
|
||||
return { ok: true, path, scenarios };
|
||||
} catch (err) {
|
||||
return { ok: false, path, error: err.message };
|
||||
}
|
||||
}
|
||||
|
||||
function normalizeScenario(input) {
|
||||
if (!input || typeof input !== 'object') return null;
|
||||
const id = String(input.id || input.name || '').trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
|
||||
const name = String(input.name || input.id || '').trim();
|
||||
if (!id || !name) return null;
|
||||
const thresholds = input.thresholds || {};
|
||||
return {
|
||||
id,
|
||||
enabled: input.enabled === true,
|
||||
name,
|
||||
description: String(input.description || ''),
|
||||
regions: arrayOfStrings(input.regions),
|
||||
categories: arrayOfStrings(input.categories),
|
||||
keywords: arrayOfStrings(input.keywords).map(s => s.toLowerCase()),
|
||||
thresholds: {
|
||||
watching: Number(thresholds.watching || 2),
|
||||
building: Number(thresholds.building || 4),
|
||||
confirmed: Number(thresholds.confirmed || 7),
|
||||
},
|
||||
invalidation: String(input.invalidation || ''),
|
||||
};
|
||||
}
|
||||
|
||||
function evaluateScenario(def, corpus, previous, evaluatedAt) {
|
||||
if (!def.enabled) {
|
||||
return {
|
||||
...publicScenario(def),
|
||||
state: 'dormant',
|
||||
score: 0,
|
||||
confidence: 0,
|
||||
evidence: [],
|
||||
changed: previous?.state && previous.state !== 'dormant',
|
||||
lastTriggerTime: previous?.lastTriggerTime || null,
|
||||
};
|
||||
}
|
||||
|
||||
const evidence = [];
|
||||
let score = 0;
|
||||
for (const keyword of def.keywords) {
|
||||
const hit = corpus.entries.find(entry => entry.text.includes(keyword));
|
||||
if (hit) {
|
||||
score += 1;
|
||||
evidence.push({ type: 'keyword', label: keyword, source: hit.source, text: hit.original.slice(0, 180) });
|
||||
}
|
||||
}
|
||||
for (const region of def.regions) {
|
||||
const needle = region.toLowerCase();
|
||||
const hit = corpus.entries.find(entry => entry.text.includes(needle));
|
||||
if (hit) {
|
||||
score += 1;
|
||||
evidence.push({ type: 'region', label: region, source: hit.source, text: hit.original.slice(0, 180) });
|
||||
}
|
||||
}
|
||||
for (const category of def.categories) {
|
||||
if (corpus.categories.has(category.toLowerCase())) {
|
||||
score += 1;
|
||||
evidence.push({ type: 'category', label: category, source: 'sweep', text: `${category} category active` });
|
||||
}
|
||||
}
|
||||
|
||||
const state = score >= def.thresholds.confirmed ? 'confirmed'
|
||||
: score >= def.thresholds.building ? 'building'
|
||||
: score >= def.thresholds.watching ? 'watching'
|
||||
: 'dormant';
|
||||
const confidence = Math.min(100, Math.round((score / Math.max(1, def.thresholds.confirmed)) * 100));
|
||||
const changed = previous?.state ? previous.state !== state : state !== 'dormant';
|
||||
return {
|
||||
...publicScenario(def),
|
||||
state,
|
||||
score,
|
||||
confidence,
|
||||
evidence: evidence.slice(0, 6),
|
||||
changed,
|
||||
lastTriggerTime: state === 'dormant' ? (previous?.lastTriggerTime || null) : evaluatedAt,
|
||||
};
|
||||
}
|
||||
|
||||
function publicScenario(def) {
|
||||
return {
|
||||
id: def.id,
|
||||
name: def.name,
|
||||
description: def.description,
|
||||
enabled: def.enabled,
|
||||
invalidation: def.invalidation,
|
||||
};
|
||||
}
|
||||
|
||||
function buildCorpus(data, delta) {
|
||||
const entries = [];
|
||||
const categories = new Set();
|
||||
const push = (source, text, category) => {
|
||||
if (!text) return;
|
||||
entries.push({ source, original: String(text), text: String(text).toLowerCase() });
|
||||
if (category) categories.add(category);
|
||||
};
|
||||
|
||||
for (const signal of data.tSignals || []) push('thermal', signal, 'thermal');
|
||||
for (const post of data.tg?.urgent || []) push(post.channel || 'telegram', post.text, 'osint');
|
||||
for (const item of data.newsFeed || []) push(item.source || 'news', item.headline || item.title, 'news');
|
||||
for (const item of data.news || []) push(item.source || 'news', item.headline || item.title, 'news');
|
||||
for (const item of data.acled?.deadliestEvents || []) push('ACLED', `${item.country || ''} ${item.location || ''} ${item.event_type || ''} ${item.fatalities || ''}`, 'conflict');
|
||||
for (const item of data.air || []) push('OpenSky', `${item.region} ${item.total} aircraft`, 'air');
|
||||
for (const item of data.chokepoints || []) push('Maritime', `${item.label} ${item.note}`, 'maritime');
|
||||
if (data.energy?.wti || data.energy?.brent) push('energy', `WTI ${data.energy.wti} Brent ${data.energy.brent}`, 'energy');
|
||||
if (data.markets?.vix || data.fred?.some(f => f.id === 'VIXCLS')) push('markets', 'VIX volatility market stress', 'markets');
|
||||
if (delta?.summary) push('delta', `${delta.summary.direction} ${delta.summary.totalChanges} changes ${delta.summary.criticalChanges} critical`, 'delta');
|
||||
for (const signal of delta?.signals?.new || []) push('delta', signal.label || signal.reason || signal.key, 'delta');
|
||||
for (const signal of delta?.signals?.escalated || []) push('delta', signal.label || signal.reason || signal.key, 'delta');
|
||||
|
||||
return { entries, categories };
|
||||
}
|
||||
|
||||
function arrayOfStrings(value) {
|
||||
return Array.isArray(value) ? value.map(v => String(v).trim()).filter(Boolean) : [];
|
||||
}
|
||||
|
||||
function readJson(path, fallback) {
|
||||
try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
|
||||
}
|
||||
|
||||
function writeJson(path, value) {
|
||||
writeFileSync(path, JSON.stringify(value, null, 2));
|
||||
}
|
||||
@@ -1,52 +0,0 @@
|
||||
const DEFAULT_COOLDOWN_MS = 60 * 60 * 1000;
|
||||
|
||||
export function shouldSendStaleAlert(health, state = {}, opts = {}) {
|
||||
const now = opts.now ?? Date.now();
|
||||
const cooldownMs = opts.cooldownMs ?? DEFAULT_COOLDOWN_MS;
|
||||
if (!health?.stale) {
|
||||
state.lastStaleAlertKey = null;
|
||||
return { send: false, reason: 'not_stale' };
|
||||
}
|
||||
|
||||
const key = [
|
||||
health.lastSuccessfulSweep || 'never',
|
||||
health.lastSweepError || 'no-error',
|
||||
health.sourcesFailed || 0,
|
||||
health.sourcesDegraded || 0,
|
||||
].join('|');
|
||||
|
||||
if (state.lastStaleAlertKey === key && now - (state.lastStaleAlertAt || 0) < cooldownMs) {
|
||||
return { send: false, reason: 'cooldown', key };
|
||||
}
|
||||
|
||||
state.lastStaleAlertKey = key;
|
||||
state.lastStaleAlertAt = now;
|
||||
return { send: true, reason: 'stale', key };
|
||||
}
|
||||
|
||||
export function formatStaleAlert(health, opts = {}) {
|
||||
const dashboardUrl = opts.dashboardUrl || 'http://localhost:3117';
|
||||
const context = opts.context || 'scheduled sweep';
|
||||
const ageMinutes = health.dataAgeSeconds == null ? 'unknown' : Math.floor(health.dataAgeSeconds / 60);
|
||||
const affected = (health.sourceHealth || [])
|
||||
.filter(s => (s.status && s.status !== 'ok') || s.error)
|
||||
.slice(0, 6)
|
||||
.map(s => `- ${s.name || s.n || 'source'}: ${s.status || 'degraded'}${s.error ? ` (${String(s.error).slice(0, 100)})` : ''}`);
|
||||
|
||||
return [
|
||||
'*CRUCIX STALE DATA ALERT*',
|
||||
'',
|
||||
`Context: ${context}`,
|
||||
`Status: ${health.status || 'unknown'}`,
|
||||
`Data age: ${ageMinutes} minutes`,
|
||||
`Last successful sweep: ${health.lastSuccessfulSweep || 'never'}`,
|
||||
`Last attempted sweep: ${health.lastSweep || 'never'}`,
|
||||
`Last error: ${health.lastSweepError || 'none'}`,
|
||||
`Sources: ${health.sourcesOk || 0} OK / ${health.sourcesDegraded || 0} degraded / ${health.sourcesFailed || 0} failed`,
|
||||
'',
|
||||
'*Affected sources*',
|
||||
affected.length ? affected.join('\n') : '- No per-source errors available',
|
||||
'',
|
||||
`Dashboard: ${dashboardUrl}`,
|
||||
].join('\n');
|
||||
}
|
||||
4
package-lock.json
generated
4
package-lock.json
generated
@@ -1,11 +1,11 @@
|
||||
{
|
||||
"name": "intelligence-terminal",
|
||||
"name": "crucix",
|
||||
"version": "2.0.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "intelligence-terminal",
|
||||
"name": "crucix",
|
||||
"version": "2.0.0",
|
||||
"license": "AGPL-3.0-only",
|
||||
"dependencies": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "intelligence-terminal",
|
||||
"name": "crucix",
|
||||
"version": "2.0.0",
|
||||
"description": "Docker-first local intelligence terminal with 27 OSINT sources, live dashboard, source health, auto-refresh, and optional LLM layer.",
|
||||
"description": "Local intelligence engine - 27 OSINT sources, live dashboard, public demo at crucix.live, auto-refresh, optional LLM layer.",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"start": "node server.mjs",
|
||||
@@ -12,7 +12,7 @@
|
||||
"brief:save": "node apis/save-briefing.mjs",
|
||||
"diag": "node diag.mjs",
|
||||
"test": "npm run test:unit",
|
||||
"test:unit": "node --test test/llm-openrouter.test.mjs test/llm-ollama.test.mjs test/llm-openai-compatible.test.mjs test/fetch-utils.test.mjs test/reddit-source.test.mjs test/acled-source.test.mjs test/mojibake-text.test.mjs test/adsb.test.mjs test/dashboard-geotagging.test.mjs",
|
||||
"test:unit": "node --test test/llm-openrouter.test.mjs test/llm-ollama.test.mjs test/llm-openai-compatible.test.mjs test/fetch-utils.test.mjs",
|
||||
"compose:config": "docker compose config",
|
||||
"clean": "node scripts/clean.mjs",
|
||||
"fresh-start": "npm run clean && npm start"
|
||||
@@ -23,7 +23,7 @@
|
||||
"dashboard",
|
||||
"geopolitical"
|
||||
],
|
||||
"author": "Intelligence Terminal contributors",
|
||||
"author": "Crucix",
|
||||
"license": "AGPL-3.0-only",
|
||||
"engines": {
|
||||
"node": ">=22",
|
||||
|
||||
228
server.mjs
228
server.mjs
@@ -18,8 +18,6 @@ import { TelegramAlerter } from './lib/alerts/telegram.mjs';
|
||||
import { DiscordAlerter } from './lib/alerts/discord.mjs';
|
||||
import { getFetchMetrics } from './apis/utils/fetch.mjs';
|
||||
import { IntelligenceStore } from './lib/intelligence-store.mjs';
|
||||
import { formatStaleAlert, shouldSendStaleAlert } from './lib/stale-alerts.mjs';
|
||||
import { evaluateScenarios } from './lib/scenarios.mjs';
|
||||
|
||||
const __dirname = dirname(fileURLToPath(import.meta.url));
|
||||
const ROOT = __dirname;
|
||||
@@ -41,8 +39,6 @@ let sweepStartedAt = null; // Timestamp when current/last sweep started
|
||||
let sweepInProgress = false;
|
||||
const startTime = Date.now();
|
||||
const sseClients = new Set();
|
||||
const terminalActionBuckets = new Map();
|
||||
const staleAlertState = {};
|
||||
|
||||
// === Delta/Memory ===
|
||||
const memory = new MemoryManager(RUNS_DIR);
|
||||
@@ -292,67 +288,15 @@ app.get('/api/metrics', (req, res) => {
|
||||
});
|
||||
});
|
||||
|
||||
app.get('/api/memory/search', (req, res) => {
|
||||
const guard = authorizeTerminalAction(req, res, 'memory:search');
|
||||
if (!guard.ok) return;
|
||||
auditTerminalAction(req, 'memory:search', 'ok');
|
||||
res.json(intelligenceStore.queryMemory({
|
||||
q: req.query.q || '',
|
||||
limit: req.query.limit || 25,
|
||||
}));
|
||||
});
|
||||
|
||||
app.get('/api/memory/predictions', (req, res) => {
|
||||
const guard = authorizeTerminalAction(req, res, 'memory:predictions');
|
||||
if (!guard.ok) return;
|
||||
auditTerminalAction(req, 'memory:predictions', 'ok');
|
||||
res.json(intelligenceStore.listPredictions({
|
||||
state: req.query.state || null,
|
||||
limit: req.query.limit || 25,
|
||||
}));
|
||||
});
|
||||
|
||||
app.post('/api/sweep', express.json(), (req, res) => {
|
||||
const guard = authorizeTerminalAction(req, res, 'sweep');
|
||||
if (!guard.ok) return;
|
||||
triggerSweepAction(req, res, 'sweep');
|
||||
});
|
||||
|
||||
app.post('/api/action', express.json(), (req, res) => {
|
||||
const action = String(req.body?.action || req.body?.command || '').trim().toLowerCase();
|
||||
const guard = authorizeTerminalAction(req, res, action || 'unknown');
|
||||
if (!guard.ok) return;
|
||||
|
||||
if (action === 'status') {
|
||||
auditTerminalAction(req, 'status', 'ok');
|
||||
return res.json({ ok: true, action, status: 'ok', health: buildHealth() });
|
||||
}
|
||||
|
||||
if (action === 'brief') {
|
||||
if (!currentData) {
|
||||
auditTerminalAction(req, 'brief', 'rejected', 'no_data');
|
||||
return res.status(503).json({ ok: false, action, error: 'No data yet - first sweep in progress' });
|
||||
}
|
||||
auditTerminalAction(req, 'brief', 'ok');
|
||||
const brief = buildBrief(currentData);
|
||||
return res.json({ ok: true, action, status: 'ok', brief, text: brief });
|
||||
}
|
||||
|
||||
if (action === 'memory') {
|
||||
auditTerminalAction(req, 'memory', 'ok');
|
||||
return res.json({
|
||||
ok: true,
|
||||
action,
|
||||
memory: intelligenceStore.status(),
|
||||
recentEvents: intelligenceStore.queryMemory({ q: req.body?.q || '', limit: 8 }).results,
|
||||
predictions: intelligenceStore.listPredictions({ limit: 8 }).predictions,
|
||||
});
|
||||
}
|
||||
|
||||
if (action === 'sweep') return triggerSweepAction(req, res, 'action:sweep');
|
||||
|
||||
auditTerminalAction(req, action || 'unknown', 'rejected', 'unknown_action');
|
||||
return res.status(400).json({ ok: false, error: 'Unknown action', allowed: ['status', 'brief', 'memory', 'sweep'], actions: ['status', 'brief', 'memory', 'sweep'] });
|
||||
const remote = req.ip || '';
|
||||
const local = remote.includes('127.0.0.1') || remote === '::1' || remote === '::ffff:127.0.0.1';
|
||||
const token = req.get('x-crucix-token') || req.query.token || req.body?.token;
|
||||
if (config.sweepToken && token !== config.sweepToken) return res.status(401).json({ error: 'Invalid sweep token' });
|
||||
if (!config.sweepToken && !local) return res.status(403).json({ error: 'Manual sweep is local-only unless SWEEP_TOKEN is set' });
|
||||
if (sweepInProgress) return res.status(409).json({ status: 'already_running', sweepStartedAt });
|
||||
runSweepCycle().catch(err => console.error('[Crucix] API-triggered sweep failed:', err.message));
|
||||
res.status(202).json({ status: 'accepted' });
|
||||
});
|
||||
|
||||
// API: available locales
|
||||
@@ -370,24 +314,10 @@ app.get('/events', (req, res) => {
|
||||
'Cache-Control': 'no-cache',
|
||||
'Connection': 'keep-alive',
|
||||
'Access-Control-Allow-Origin': '*',
|
||||
'X-Accel-Buffering': 'no',
|
||||
});
|
||||
res.write('retry: 10000\n');
|
||||
res.write('data: {"type":"connected"}\n\n');
|
||||
const heartbeatMs = Math.max(5000, config.sseHeartbeatIntervalMs || 25000);
|
||||
const heartbeat = setInterval(() => {
|
||||
try {
|
||||
res.write(`: heartbeat ${new Date().toISOString()}\n\n`);
|
||||
} catch {
|
||||
clearInterval(heartbeat);
|
||||
sseClients.delete(res);
|
||||
}
|
||||
}, heartbeatMs);
|
||||
sseClients.add(res);
|
||||
req.on('close', () => {
|
||||
clearInterval(heartbeat);
|
||||
sseClients.delete(res);
|
||||
});
|
||||
req.on('close', () => sseClients.delete(res));
|
||||
});
|
||||
|
||||
function broadcast(data) {
|
||||
@@ -397,108 +327,6 @@ function broadcast(data) {
|
||||
}
|
||||
}
|
||||
|
||||
function requestIp(req) {
|
||||
return req.ip || req.socket?.remoteAddress || 'unknown';
|
||||
}
|
||||
|
||||
function isLocalRequest(req) {
|
||||
const remote = requestIp(req);
|
||||
return remote === '::1'
|
||||
|| remote === '127.0.0.1'
|
||||
|| remote === '::ffff:127.0.0.1'
|
||||
|| remote.startsWith('127.')
|
||||
|| remote === 'localhost';
|
||||
}
|
||||
|
||||
function sameOriginPost(req) {
|
||||
const origin = req.get('origin');
|
||||
if (!origin) return true;
|
||||
try {
|
||||
const originUrl = new URL(origin);
|
||||
const host = req.get('host');
|
||||
return host && originUrl.host === host;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function actionToken(req) {
|
||||
return req.get('x-crucix-token') || req.body?.token || null;
|
||||
}
|
||||
|
||||
function auditTerminalAction(req, action, outcome, detail = null) {
|
||||
const suffix = detail ? ` detail=${detail}` : '';
|
||||
console.log(`[Crucix][audit] terminal_action action=${action || 'unknown'} outcome=${outcome} ip=${requestIp(req)}${suffix}`);
|
||||
}
|
||||
|
||||
function rateLimitTerminalAction(req, action) {
|
||||
const now = Date.now();
|
||||
const windowMs = Math.max(1000, config.terminalActionRateLimitWindowMs || 60_000);
|
||||
const max = Math.max(1, config.terminalActionRateLimitMax || 10);
|
||||
const key = `${requestIp(req)}:${action}`;
|
||||
const bucket = terminalActionBuckets.get(key);
|
||||
if (!bucket || now > bucket.resetAt) {
|
||||
terminalActionBuckets.set(key, { count: 1, resetAt: now + windowMs });
|
||||
return { ok: true };
|
||||
}
|
||||
bucket.count += 1;
|
||||
if (bucket.count > max) {
|
||||
return { ok: false, retryAfterSeconds: Math.ceil((bucket.resetAt - now) / 1000) };
|
||||
}
|
||||
return { ok: true };
|
||||
}
|
||||
|
||||
function authorizeTerminalAction(req, res, action) {
|
||||
const rate = rateLimitTerminalAction(req, action);
|
||||
if (!rate.ok) {
|
||||
auditTerminalAction(req, action, 'rejected', 'rate_limited');
|
||||
res.set('Retry-After', String(rate.retryAfterSeconds));
|
||||
res.status(429).json({ error: 'Too many terminal actions', retryAfterSeconds: rate.retryAfterSeconds });
|
||||
return { ok: false };
|
||||
}
|
||||
|
||||
if (!sameOriginPost(req)) {
|
||||
auditTerminalAction(req, action, 'rejected', 'csrf_origin');
|
||||
res.status(403).json({ error: 'Origin mismatch' });
|
||||
return { ok: false };
|
||||
}
|
||||
|
||||
const local = isLocalRequest(req);
|
||||
const token = actionToken(req);
|
||||
if (!config.terminalActionsEnabled) {
|
||||
auditTerminalAction(req, action, 'rejected', 'disabled');
|
||||
res.status(403).json({ error: 'Terminal actions are disabled' });
|
||||
return { ok: false };
|
||||
}
|
||||
|
||||
if (config.sweepToken) {
|
||||
if (token !== config.sweepToken) {
|
||||
auditTerminalAction(req, action, 'rejected', 'invalid_token');
|
||||
res.status(401).json({ error: 'Invalid terminal action token' });
|
||||
return { ok: false };
|
||||
}
|
||||
return { ok: true };
|
||||
}
|
||||
|
||||
if (!local) {
|
||||
auditTerminalAction(req, action, 'rejected', 'missing_token');
|
||||
res.status(403).json({ error: 'Terminal actions are local-only unless SWEEP_TOKEN is set' });
|
||||
return { ok: false };
|
||||
}
|
||||
|
||||
return { ok: true };
|
||||
}
|
||||
|
||||
function triggerSweepAction(req, res, auditAction) {
|
||||
if (sweepInProgress) {
|
||||
auditTerminalAction(req, auditAction, 'rejected', 'already_running');
|
||||
return res.status(409).json({ ok: true, status: 'already_running', sweepStartedAt });
|
||||
}
|
||||
auditTerminalAction(req, auditAction, 'accepted');
|
||||
runSweepCycle().catch(err => console.error('[Crucix] API-triggered sweep failed:', err.message));
|
||||
return res.status(202).json({ ok: true, status: 'accepted' });
|
||||
}
|
||||
|
||||
function dataAgeMs() {
|
||||
const ts = currentData?.meta?.timestamp || lastSuccessfulSweepTime || lastSweepTime;
|
||||
const ms = ts ? Date.now() - new Date(ts).getTime() : null;
|
||||
@@ -548,39 +376,12 @@ function buildHealth() {
|
||||
llm: getLLMStatus(),
|
||||
telegramEnabled: !!(config.telegram.botToken && config.telegram.chatId),
|
||||
discordEnabled: !!(config.discord?.botToken || config.discord?.webhookUrl),
|
||||
terminalActionsEnabled: config.terminalActionsEnabled,
|
||||
terminalActionsTokenRequired: !!config.sweepToken,
|
||||
refreshIntervalMinutes: config.refreshIntervalMinutes,
|
||||
language: currentLanguage,
|
||||
memory: intelligenceStore.status(),
|
||||
};
|
||||
}
|
||||
|
||||
async function notifyIfDataStale(context = 'scheduled sweep') {
|
||||
const health = buildHealth();
|
||||
const decision = shouldSendStaleAlert(health, staleAlertState, {
|
||||
cooldownMs: config.staleAlertCooldownMinutes * 60 * 1000,
|
||||
});
|
||||
if (!decision.send) return false;
|
||||
|
||||
const dashboardUrl = config.dashboardUrl || `http://localhost:${config.port}`;
|
||||
const message = formatStaleAlert(health, { dashboardUrl, context });
|
||||
const sends = [];
|
||||
if (telegramAlerter.isConfigured) sends.push(telegramAlerter.sendMessage(message));
|
||||
if (discordAlerter.isConfigured) sends.push(discordAlerter.sendAlert(message));
|
||||
|
||||
if (sends.length === 0) {
|
||||
console.warn('[Crucix] Data is stale but no operator alert channel is configured');
|
||||
return false;
|
||||
}
|
||||
|
||||
const results = await Promise.allSettled(sends);
|
||||
const sent = results.some(r => r.status === 'fulfilled' && (r.value === true || r.value?.ok === true));
|
||||
if (sent) console.warn('[Crucix] Operator stale-data alert sent');
|
||||
else console.warn('[Crucix] Operator stale-data alert attempted but no channel accepted it');
|
||||
return sent;
|
||||
}
|
||||
|
||||
function buildBrief(data) {
|
||||
const verbosity = config.telegram.briefVerbosity || 'standard';
|
||||
const delta = memory.getLastDelta();
|
||||
@@ -617,13 +418,6 @@ function buildBrief(data) {
|
||||
lines.push('', '*Why This Matters*');
|
||||
for (const idea of ideas) lines.push(`- ${idea.title}: ${(idea.rationale || idea.text || '').slice(0, 140)}`);
|
||||
}
|
||||
const scenarioChanges = data.scenarios?.changed || [];
|
||||
if (scenarioChanges.length) {
|
||||
lines.push('', '*Scenario Watchlist*');
|
||||
for (const scenario of scenarioChanges.slice(0, 4)) {
|
||||
lines.push(`- ${scenario.name}: ${scenario.state.toUpperCase()} (${scenario.confidence}% confidence)`);
|
||||
}
|
||||
}
|
||||
lines.push('', '*What To Do Next*', '- Open the dashboard, verify the evidence links, and compare source health before acting.');
|
||||
return lines.join('\n');
|
||||
}
|
||||
@@ -670,7 +464,6 @@ async function runSweepCycle() {
|
||||
// 4. Delta computation + memory
|
||||
const delta = memory.addRun(synthesized);
|
||||
synthesized.delta = delta;
|
||||
synthesized.scenarios = evaluateScenarios(synthesized, delta, RUNS_DIR);
|
||||
|
||||
// 5. LLM-powered trade ideas (LLM-only feature) — isolated so failures don't kill sweep
|
||||
if (llmProvider?.isConfigured) {
|
||||
@@ -731,9 +524,6 @@ async function runSweepCycle() {
|
||||
broadcast({ type: 'sweep_error', error: err.message });
|
||||
} finally {
|
||||
sweepInProgress = false;
|
||||
await notifyIfDataStale(lastSweepError ? 'failed sweep' : 'completed sweep').catch(err => {
|
||||
console.error('[Crucix] Stale-data operator alert failed:', err.message);
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,95 +0,0 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { authenticate, briefing, resetAcledSessionCache } from '../apis/sources/acled.mjs';
|
||||
|
||||
function jsonResponse(status, body, ok = status >= 200 && status < 300) {
|
||||
return {
|
||||
ok,
|
||||
status,
|
||||
headers: { getSetCookie: () => [] },
|
||||
json: async () => body,
|
||||
text: async () => JSON.stringify(body),
|
||||
};
|
||||
}
|
||||
|
||||
test('ACLED reports missing credentials without network access', async () => {
|
||||
resetAcledSessionCache();
|
||||
let calls = 0;
|
||||
const data = await briefing({
|
||||
env: {},
|
||||
fetchImpl: async () => {
|
||||
calls++;
|
||||
throw new Error('unexpected network access');
|
||||
},
|
||||
});
|
||||
|
||||
assert.equal(calls, 0);
|
||||
assert.equal(data.status, 'no_credentials');
|
||||
assert.equal(data.error, 'missing_acled_credentials');
|
||||
assert.deepEqual(data.missing, ['ACLED_EMAIL', 'ACLED_PASSWORD']);
|
||||
});
|
||||
|
||||
test('ACLED accepts ACLED_USER as email alias and returns empty valid result', async () => {
|
||||
resetAcledSessionCache();
|
||||
const urls = [];
|
||||
const data = await briefing({
|
||||
env: { ACLED_USER: 'analyst@example.test', ACLED_PASSWORD: 'secret' },
|
||||
fetchImpl: async url => {
|
||||
urls.push(String(url));
|
||||
if (String(url).includes('/oauth/token')) {
|
||||
return jsonResponse(200, { access_token: 'token' });
|
||||
}
|
||||
return jsonResponse(200, { status: 200, data: [] });
|
||||
},
|
||||
});
|
||||
|
||||
assert.equal(data.status, 'ok');
|
||||
assert.equal(data.totalEvents, 0);
|
||||
assert.ok(urls.some(url => url.includes('/oauth/token')));
|
||||
assert.ok(urls.some(url => url.includes('/api/acled/read')));
|
||||
});
|
||||
|
||||
test('ACLED classifies auth failure without exposing credentials', async () => {
|
||||
resetAcledSessionCache();
|
||||
const result = await authenticate({
|
||||
env: { ACLED_EMAIL: 'analyst@example.test', ACLED_PASSWORD: 'super-secret' },
|
||||
fetchImpl: async url => {
|
||||
if (String(url).includes('/oauth/token')) {
|
||||
return jsonResponse(401, { error: 'invalid_grant' }, false);
|
||||
}
|
||||
return {
|
||||
ok: false,
|
||||
status: 403,
|
||||
headers: { getSetCookie: () => [] },
|
||||
text: async () => 'forbidden',
|
||||
};
|
||||
},
|
||||
});
|
||||
|
||||
assert.equal(result.status, 'auth_failed');
|
||||
assert.equal(result.error, 'acled_auth_failed');
|
||||
assert.equal(result.diagnostics.length, 2);
|
||||
assert.doesNotMatch(JSON.stringify(result), /super-secret/);
|
||||
});
|
||||
|
||||
test('ACLED classifies data access denied distinctly from auth failure', async () => {
|
||||
resetAcledSessionCache();
|
||||
const data = await briefing({
|
||||
env: { ACLED_EMAIL: 'analyst@example.test', ACLED_PASSWORD: 'secret' },
|
||||
fetchImpl: async url => {
|
||||
if (String(url).includes('/oauth/token')) {
|
||||
return jsonResponse(200, { access_token: 'token' });
|
||||
}
|
||||
return {
|
||||
ok: false,
|
||||
status: 403,
|
||||
headers: { getSetCookie: () => [] },
|
||||
text: async () => 'terms not accepted',
|
||||
};
|
||||
},
|
||||
});
|
||||
|
||||
assert.equal(data.status, 'access_denied');
|
||||
assert.equal(data.error, 'acled_data_http_403');
|
||||
assert.match(data.hint, /Accept ACLED terms/);
|
||||
});
|
||||
@@ -1,82 +0,0 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
|
||||
async function withFetch(mockFetch, fn) {
|
||||
const originalFetch = globalThis.fetch;
|
||||
const originalAdsbKey = process.env.ADSB_API_KEY;
|
||||
const originalRapidKey = process.env.RAPIDAPI_KEY;
|
||||
globalThis.fetch = mockFetch;
|
||||
delete process.env.ADSB_API_KEY;
|
||||
delete process.env.RAPIDAPI_KEY;
|
||||
try {
|
||||
return await fn();
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
if (originalAdsbKey === undefined) delete process.env.ADSB_API_KEY;
|
||||
else process.env.ADSB_API_KEY = originalAdsbKey;
|
||||
if (originalRapidKey === undefined) delete process.env.RAPIDAPI_KEY;
|
||||
else process.env.RAPIDAPI_KEY = originalRapidKey;
|
||||
}
|
||||
}
|
||||
|
||||
function jsonResponse(payload, ok = true, status = 200) {
|
||||
return {
|
||||
ok,
|
||||
status,
|
||||
headers: { get: () => 'application/json' },
|
||||
text: async () => JSON.stringify(payload),
|
||||
};
|
||||
}
|
||||
|
||||
test('ADS-B reports disabled when no key is configured and public feed fails', async () => {
|
||||
await withFetch(async () => jsonResponse({ error: 'blocked' }, false, 403), async () => {
|
||||
const { briefing } = await import('../apis/sources/adsb.mjs');
|
||||
const data = await briefing();
|
||||
|
||||
assert.equal(data.status, 'disabled');
|
||||
assert.match(data.error, /ADSB_API_KEY|RAPIDAPI_KEY/);
|
||||
assert.equal(data.militaryAircraft.length, 0);
|
||||
});
|
||||
});
|
||||
|
||||
test('ADS-B reports degraded when RapidAPI and public feed fail', async () => {
|
||||
await withFetch(async () => jsonResponse({ error: 'unavailable' }, false, 503), async () => {
|
||||
process.env.ADSB_API_KEY = 'test-key';
|
||||
const { briefing } = await import('../apis/sources/adsb.mjs');
|
||||
const data = await briefing();
|
||||
|
||||
assert.equal(data.status, 'degraded');
|
||||
assert.match(data.error, /providers returned no usable/);
|
||||
assert.equal(data.failures.length, 2);
|
||||
});
|
||||
});
|
||||
|
||||
test('ADS-B returns live RapidAPI military aircraft payloads', async () => {
|
||||
await withFetch(async () => jsonResponse({
|
||||
ac: [{
|
||||
hex: 'AE1234',
|
||||
flight: 'RCH123',
|
||||
t: 'KC135',
|
||||
lat: 50,
|
||||
lon: 8,
|
||||
mil: true,
|
||||
}],
|
||||
}), async () => {
|
||||
process.env.ADSB_API_KEY = 'test-key';
|
||||
const { briefing } = await import('../apis/sources/adsb.mjs');
|
||||
const data = await briefing();
|
||||
|
||||
assert.equal(data.status, 'live');
|
||||
assert.equal(data.provider, 'rapidapi');
|
||||
assert.equal(data.totalMilitary, 1);
|
||||
assert.equal(data.militaryAircraft[0].callsign, 'RCH123');
|
||||
});
|
||||
});
|
||||
|
||||
test('runSource treats disabled source status as degraded health', async () => {
|
||||
const { runSource } = await import('../apis/briefing.mjs');
|
||||
const result = await runSource('ADS-B', async () => ({ status: 'disabled', message: 'missing key' }));
|
||||
|
||||
assert.equal(result.status, 'degraded');
|
||||
assert.equal(result.error, null);
|
||||
});
|
||||
@@ -1,47 +0,0 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { geoTagText, stableGeoJitter } from '../dashboard/inject.mjs';
|
||||
|
||||
test('geoTagText matches headlines case-insensitively', () => {
|
||||
assert.deepEqual(geoTagText('ukraine reports new air defense activity'), {
|
||||
lat: 49,
|
||||
lon: 32,
|
||||
region: 'Ukraine',
|
||||
});
|
||||
|
||||
assert.deepEqual(geoTagText('flooding disrupts são paulo transport'), {
|
||||
lat: -23.5,
|
||||
lon: -46.6,
|
||||
region: 'São Paulo',
|
||||
});
|
||||
});
|
||||
|
||||
test('geoTagText prefers longer place names before broad countries', () => {
|
||||
assert.deepEqual(geoTagText('New York markets react before wider US session'), {
|
||||
lat: 40.7,
|
||||
lon: -74,
|
||||
region: 'New York',
|
||||
});
|
||||
});
|
||||
|
||||
test('geoTagText uses word boundaries to reduce false positives', () => {
|
||||
assert.equal(geoTagText('A music festival announces its lineup'), null);
|
||||
assert.equal(geoTagText('Officials discuss a new focus for aid'), null);
|
||||
assert.deepEqual(geoTagText('US officials discuss a new aid package'), {
|
||||
lat: 39,
|
||||
lon: -98,
|
||||
region: 'US',
|
||||
});
|
||||
});
|
||||
|
||||
test('stableGeoJitter is deterministic and bounded', () => {
|
||||
const key = 'BBC|lower-case ukraine headline|Sun, 17 May 2026 12:00:00 GMT|https://example.test/a';
|
||||
const latA = stableGeoJitter(key, 'lat');
|
||||
const latB = stableGeoJitter(key, 'lat');
|
||||
const lon = stableGeoJitter(key, 'lon');
|
||||
|
||||
assert.equal(latA, latB);
|
||||
assert.notEqual(latA, lon);
|
||||
assert.ok(latA >= -1 && latA <= 1);
|
||||
assert.ok(lon >= -1 && lon <= 1);
|
||||
});
|
||||
@@ -1,12 +1,9 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { readFileSync } from 'node:fs';
|
||||
import { safeFetch, safeFetchText, getFetchMetrics, inferFetchSource } from '../apis/utils/fetch.mjs';
|
||||
import { formatStaleAlert, shouldSendStaleAlert } from '../lib/stale-alerts.mjs';
|
||||
import { safeFetch, safeFetchText, getFetchMetrics } from '../apis/utils/fetch.mjs';
|
||||
|
||||
test('safeFetch reports HTML as degraded JSON response', async () => {
|
||||
const originalFetch = globalThis.fetch;
|
||||
const source = 'unit-html-once';
|
||||
globalThis.fetch = async () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
@@ -14,72 +11,9 @@ test('safeFetch reports HTML as degraded JSON response', async () => {
|
||||
text: async () => '<html>not json</html>',
|
||||
});
|
||||
try {
|
||||
const data = await safeFetch('https://example.test/json', { retries: 0, source });
|
||||
const data = await safeFetch('https://example.test/json', { retries: 0, source: 'unit' });
|
||||
assert.match(data.error, /Expected JSON/);
|
||||
const bucket = getFetchMetrics().bySource[source];
|
||||
assert.equal(bucket.requests, 1);
|
||||
assert.equal(bucket.ok, 0);
|
||||
assert.equal(bucket.failed, 1);
|
||||
assert.equal(bucket.lastStatus, 200);
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test('safeFetch records HTTP failure once with status and bytes', async () => {
|
||||
const originalFetch = globalThis.fetch;
|
||||
const source = 'unit-http-failure-once';
|
||||
globalThis.fetch = async () => ({
|
||||
ok: false,
|
||||
status: 503,
|
||||
headers: { get: () => 'application/json' },
|
||||
text: async () => 'service unavailable',
|
||||
});
|
||||
try {
|
||||
const data = await safeFetch('https://example.test/fail', { retries: 0, source });
|
||||
assert.match(data.error, /HTTP 503/);
|
||||
const bucket = getFetchMetrics().bySource[source];
|
||||
assert.equal(bucket.requests, 1);
|
||||
assert.equal(bucket.ok, 0);
|
||||
assert.equal(bucket.failed, 1);
|
||||
assert.equal(bucket.lastStatus, 503);
|
||||
assert.equal(bucket.bytes, 'service unavailable'.length);
|
||||
assert.match(bucket.lastError, /HTTP 503/);
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test('safeFetch retry metrics count one record per attempt', async () => {
|
||||
const originalFetch = globalThis.fetch;
|
||||
const source = 'unit-retry-attempts';
|
||||
let calls = 0;
|
||||
globalThis.fetch = async () => {
|
||||
calls += 1;
|
||||
if (calls === 1) {
|
||||
return {
|
||||
ok: false,
|
||||
status: 502,
|
||||
headers: { get: () => 'application/json' },
|
||||
text: async () => 'bad gateway',
|
||||
};
|
||||
}
|
||||
return {
|
||||
ok: true,
|
||||
status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
text: async () => '{"ok":true}',
|
||||
};
|
||||
};
|
||||
try {
|
||||
const data = await safeFetch('https://example.test/retry', { retries: 1, source });
|
||||
assert.equal(data.ok, true);
|
||||
assert.equal(calls, 2);
|
||||
const bucket = getFetchMetrics().bySource[source];
|
||||
assert.equal(bucket.requests, 2);
|
||||
assert.equal(bucket.ok, 1);
|
||||
assert.equal(bucket.failed, 1);
|
||||
assert.equal(bucket.lastStatus, 200);
|
||||
assert.ok(getFetchMetrics().bySource.unit.requests >= 1);
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
}
|
||||
@@ -101,168 +35,128 @@ test('safeFetchText returns text and byte count', async () => {
|
||||
}
|
||||
});
|
||||
|
||||
test('safeFetch attributes unlabelled requests to a stable provider source', async () => {
|
||||
function jsonResponse(payload, ok = true, status = 200) {
|
||||
return {
|
||||
ok,
|
||||
status,
|
||||
headers: { getSetCookie: () => [], get: () => 'application/json' },
|
||||
text: async () => JSON.stringify(payload),
|
||||
json: async () => payload,
|
||||
};
|
||||
}
|
||||
|
||||
function textResponse(text, ok = false, status = 500) {
|
||||
return {
|
||||
ok,
|
||||
status,
|
||||
headers: { getSetCookie: () => [], get: () => 'text/plain' },
|
||||
text: async () => text,
|
||||
json: async () => JSON.parse(text),
|
||||
};
|
||||
}
|
||||
|
||||
async function withAcledEnv(mockFetch, fn) {
|
||||
const originalFetch = globalThis.fetch;
|
||||
globalThis.fetch = async () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
text: async () => '{"observations":[]}',
|
||||
});
|
||||
const saved = {
|
||||
ACLED_EMAIL: process.env.ACLED_EMAIL,
|
||||
ACLED_USER: process.env.ACLED_USER,
|
||||
ACLED_USERNAME: process.env.ACLED_USERNAME,
|
||||
ACLED_PASSWORD: process.env.ACLED_PASSWORD,
|
||||
};
|
||||
globalThis.fetch = mockFetch;
|
||||
delete process.env.ACLED_EMAIL;
|
||||
delete process.env.ACLED_USER;
|
||||
delete process.env.ACLED_USERNAME;
|
||||
delete process.env.ACLED_PASSWORD;
|
||||
const acled = await import('../apis/sources/acled.mjs');
|
||||
acled.resetAcledSessionForTests();
|
||||
try {
|
||||
const data = await safeFetch('https://api.fred.stlouisfed.org/fred/series/observations?series_id=VIXCLS', { retries: 0 });
|
||||
assert.deepEqual(data, { observations: [] });
|
||||
const bucket = getFetchMetrics().bySource.FRED;
|
||||
assert.ok(bucket.requests >= 1);
|
||||
assert.equal(bucket.lastStatus, 200);
|
||||
return await fn(acled);
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
for (const [key, value] of Object.entries(saved)) {
|
||||
if (value === undefined) delete process.env[key];
|
||||
else process.env[key] = value;
|
||||
}
|
||||
acled.resetAcledSessionForTests();
|
||||
}
|
||||
}
|
||||
|
||||
test('ACLED credentialed OAuth success returns live events and supports ACLED_USER', async () => {
|
||||
const responses = [
|
||||
jsonResponse({ access_token: 'secret-token' }),
|
||||
jsonResponse({
|
||||
status: 200,
|
||||
data: [{
|
||||
event_date: '2026-05-17',
|
||||
event_type: 'Protests',
|
||||
sub_event_type: 'Peaceful protest',
|
||||
country: 'Example',
|
||||
region: 'Example Region',
|
||||
location: 'Example City',
|
||||
fatalities: '0',
|
||||
latitude: '1.23',
|
||||
longitude: '4.56',
|
||||
}],
|
||||
}),
|
||||
];
|
||||
|
||||
await withAcledEnv(async () => responses.shift(), async ({ briefing }) => {
|
||||
process.env.ACLED_USER = 'operator@example.test';
|
||||
process.env.ACLED_PASSWORD = 'password';
|
||||
const data = await briefing();
|
||||
|
||||
assert.equal(data.status, 'live');
|
||||
assert.equal(data.totalEvents, 1);
|
||||
assert.equal(data.topCountries.Example.count, 1);
|
||||
});
|
||||
});
|
||||
|
||||
test('inferFetchSource returns provider names and host fallback', () => {
|
||||
assert.equal(inferFetchSource('https://api.bls.gov/publicAPI/v2/timeseries/data/CPI'), 'BLS');
|
||||
assert.equal(inferFetchSource('https://query1.finance.yahoo.com/v8/finance/chart/%5EGSPC'), 'YahooFinance');
|
||||
assert.equal(inferFetchSource('https://unknown.example.test/path'), 'unknown.example.test');
|
||||
test('ACLED rejected credentials return auth_failed diagnostics', async () => {
|
||||
const responses = [
|
||||
textResponse('invalid credentials', false, 401),
|
||||
textResponse('forbidden', false, 403),
|
||||
];
|
||||
|
||||
await withAcledEnv(async () => responses.shift(), async ({ briefing }) => {
|
||||
process.env.ACLED_EMAIL = 'operator@example.test';
|
||||
process.env.ACLED_PASSWORD = 'wrong-password';
|
||||
const data = await briefing();
|
||||
|
||||
assert.equal(data.status, 'auth_failed');
|
||||
assert.match(data.error, /All ACLED auth methods failed/);
|
||||
});
|
||||
});
|
||||
|
||||
test('SSE endpoint sends reconnect guidance and clears heartbeat timer', () => {
|
||||
const server = readFileSync(new URL('../server.mjs', import.meta.url), 'utf8');
|
||||
const config = readFileSync(new URL('../crucix.config.mjs', import.meta.url), 'utf8');
|
||||
assert.match(config, /sseHeartbeatIntervalMs/);
|
||||
assert.match(server, /retry: 10000\\n/);
|
||||
assert.match(server, /setInterval\(\(\) =>/);
|
||||
assert.match(server, /: heartbeat/);
|
||||
assert.match(server, /clearInterval\(heartbeat\)/);
|
||||
assert.match(server, /X-Accel-Buffering/);
|
||||
test('ACLED token endpoint failure returns api_failed diagnostics', async () => {
|
||||
const responses = [
|
||||
textResponse('temporary outage', false, 503),
|
||||
textResponse('temporary outage', false, 503),
|
||||
];
|
||||
|
||||
await withAcledEnv(async () => responses.shift(), async ({ briefing }) => {
|
||||
process.env.ACLED_EMAIL = 'operator@example.test';
|
||||
process.env.ACLED_PASSWORD = 'password';
|
||||
const data = await briefing();
|
||||
|
||||
assert.equal(data.status, 'api_failed');
|
||||
assert.match(data.error, /All ACLED auth methods failed/);
|
||||
});
|
||||
});
|
||||
|
||||
test('intelligence store defines durable memory and prediction lifecycle tables', () => {
|
||||
const store = readFileSync(new URL('../lib/intelligence-store.mjs', import.meta.url), 'utf8');
|
||||
assert.match(store, /CREATE TABLE IF NOT EXISTS events/);
|
||||
assert.match(store, /stable_id TEXT NOT NULL UNIQUE/);
|
||||
assert.match(store, /hypothesis TEXT/);
|
||||
assert.match(store, /evidence_json TEXT/);
|
||||
assert.match(store, /outcome_state TEXT DEFAULT 'open'/);
|
||||
assert.match(store, /evaluatePredictions/);
|
||||
assert.match(store, /queryMemory/);
|
||||
assert.match(store, /listPredictions/);
|
||||
});
|
||||
|
||||
test('server exposes memory-backed query APIs and dashboard memory action', () => {
|
||||
const server = readFileSync(new URL('../server.mjs', import.meta.url), 'utf8');
|
||||
const html = readFileSync(new URL('../dashboard/public/jarvis.html', import.meta.url), 'utf8');
|
||||
assert.match(server, /\/api\/memory\/search/);
|
||||
assert.match(server, /\/api\/memory\/predictions/);
|
||||
assert.match(server, /action === 'memory'/);
|
||||
assert.match(html, /runTerminalAction\('memory'\)/);
|
||||
});
|
||||
|
||||
test('terminal action endpoints avoid URL tokens and include hardening gates', () => {
|
||||
const server = readFileSync(new URL('../server.mjs', import.meta.url), 'utf8');
|
||||
assert.match(server, /app\.post\('\/api\/action'/);
|
||||
assert.match(server, /app\.post\('\/api\/sweep'/);
|
||||
assert.match(server, /x-crucix-token/);
|
||||
assert.match(server, /sameOriginPost/);
|
||||
assert.match(server, /rateLimitTerminalAction/);
|
||||
assert.match(server, /auditTerminalAction/);
|
||||
assert.doesNotMatch(server, /req\.query\.token/);
|
||||
});
|
||||
|
||||
test('dashboard exposes token configuration flow without devtools edits', () => {
|
||||
const html = readFileSync(new URL('../dashboard/public/jarvis.html', import.meta.url), 'utf8');
|
||||
assert.match(html, /configureTerminalActionToken/);
|
||||
assert.match(html, /crucix_sweep_token/);
|
||||
assert.match(html, /x-crucix-token/);
|
||||
assert.match(html, /SET TOKEN/);
|
||||
});
|
||||
|
||||
test('server dashboard shell does not embed an operational snapshot', () => {
|
||||
const html = readFileSync(new URL('../dashboard/public/jarvis.html', import.meta.url), 'utf8');
|
||||
assert.match(html, /let D = createDashboardShellData\(\);/);
|
||||
assert.doesNotMatch(html, /2026-04-03T16:18:10\.188Z/);
|
||||
assert.doesNotMatch(html, /Trump announced new strikes on Iran/);
|
||||
});
|
||||
|
||||
test('server dashboard fetches api data before initialization', () => {
|
||||
const html = readFileSync(new URL('../dashboard/public/jarvis.html', import.meta.url), 'utf8');
|
||||
const serverMode = html.indexOf('if (canProbeApi)');
|
||||
const apiFetch = html.indexOf("fetch('/api/data')");
|
||||
const firstInitAfterServerMode = html.indexOf('init();', serverMode);
|
||||
|
||||
assert.ok(serverMode > -1);
|
||||
assert.ok(apiFetch > serverMode);
|
||||
assert.ok(firstInitAfterServerMode > apiFetch);
|
||||
});
|
||||
|
||||
test('stale alert is skipped for fresh health and resets active key', () => {
|
||||
const state = { lastStaleAlertKey: 'old', lastStaleAlertAt: 100 };
|
||||
const decision = shouldSendStaleAlert({ stale: false }, state, { now: 200 });
|
||||
assert.equal(decision.send, false);
|
||||
assert.equal(decision.reason, 'not_stale');
|
||||
assert.equal(state.lastStaleAlertKey, null);
|
||||
});
|
||||
|
||||
test('stale alert sends once and deduplicates during cooldown', () => {
|
||||
const state = {};
|
||||
const health = {
|
||||
stale: true,
|
||||
lastSuccessfulSweep: '2026-05-17T08:00:00.000Z',
|
||||
lastSweepError: 'network timeout',
|
||||
sourcesFailed: 2,
|
||||
sourcesDegraded: 1,
|
||||
};
|
||||
|
||||
const first = shouldSendStaleAlert(health, state, { now: 1_000, cooldownMs: 60_000 });
|
||||
const second = shouldSendStaleAlert(health, state, { now: 2_000, cooldownMs: 60_000 });
|
||||
|
||||
assert.equal(first.send, true);
|
||||
assert.equal(second.send, false);
|
||||
assert.equal(second.reason, 'cooldown');
|
||||
});
|
||||
|
||||
test('stale alert repeats after cooldown', () => {
|
||||
const state = {};
|
||||
const health = { stale: true, lastSuccessfulSweep: 'a', lastSweepError: 'timeout', sourcesFailed: 1 };
|
||||
|
||||
assert.equal(shouldSendStaleAlert(health, state, { now: 1_000, cooldownMs: 60_000 }).send, true);
|
||||
assert.equal(shouldSendStaleAlert(health, state, { now: 62_000, cooldownMs: 60_000 }).send, true);
|
||||
});
|
||||
|
||||
test('stale alert message includes operator context and affected sources', () => {
|
||||
const message = formatStaleAlert({
|
||||
status: 'stale',
|
||||
stale: true,
|
||||
dataAgeSeconds: 7200,
|
||||
lastSuccessfulSweep: '2026-05-17T08:00:00.000Z',
|
||||
lastSweep: '2026-05-17T10:00:00.000Z',
|
||||
lastSweepError: 'GDELT timeout',
|
||||
sourcesOk: 20,
|
||||
sourcesDegraded: 3,
|
||||
sourcesFailed: 2,
|
||||
sourceHealth: [
|
||||
{ name: 'GDELT', status: 'degraded', error: 'timeout' },
|
||||
{ name: 'Reddit', status: 'no_credentials' },
|
||||
],
|
||||
}, { dashboardUrl: 'https://terminal.example.test', context: 'failed sweep' });
|
||||
|
||||
assert.match(message, /CRUCIX STALE DATA ALERT/);
|
||||
assert.match(message, /Data age: 120 minutes/);
|
||||
assert.match(message, /GDELT: degraded \(timeout\)/);
|
||||
assert.match(message, /Dashboard: https:\/\/terminal\.example\.test/);
|
||||
});
|
||||
|
||||
test('scenario watchlist feature is wired into sweep, briefing, and dashboard', () => {
|
||||
const scenarios = readFileSync(new URL('../lib/scenarios.mjs', import.meta.url), 'utf8');
|
||||
const server = readFileSync(new URL('../server.mjs', import.meta.url), 'utf8');
|
||||
const html = readFileSync(new URL('../dashboard/public/jarvis.html', import.meta.url), 'utf8');
|
||||
const readme = readFileSync(new URL('../README.md', import.meta.url), 'utf8');
|
||||
assert.match(scenarios, /DEFAULT_SCENARIOS/);
|
||||
assert.match(scenarios, /runsDir, 'scenarios\.json'/);
|
||||
assert.match(scenarios, /scenario-state\.json/);
|
||||
assert.match(scenarios, /watching.*building.*confirmed/s);
|
||||
assert.match(server, /evaluateScenarios\(synthesized, delta, RUNS_DIR\)/);
|
||||
assert.match(server, /\*Scenario Watchlist\*/);
|
||||
assert.match(html, /Scenario Watchlist/);
|
||||
assert.match(readme, /runs\/scenarios\.json/);
|
||||
test('ACLED valid empty response is live with zero events', async () => {
|
||||
const responses = [
|
||||
jsonResponse({ access_token: 'secret-token' }),
|
||||
jsonResponse({ status: 200, data: [] }),
|
||||
];
|
||||
|
||||
await withAcledEnv(async () => responses.shift(), async ({ briefing }) => {
|
||||
process.env.ACLED_EMAIL = 'operator@example.test';
|
||||
process.env.ACLED_PASSWORD = 'password';
|
||||
const data = await briefing();
|
||||
|
||||
assert.equal(data.status, 'live');
|
||||
assert.equal(data.totalEvents, 0);
|
||||
assert.match(data.message, /valid empty/);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,65 +0,0 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { readdirSync, readFileSync, statSync } from 'node:fs';
|
||||
import { join } from 'node:path';
|
||||
|
||||
const TEXT_ROOTS = ['locales'];
|
||||
|
||||
const TEXT_FILES = [];
|
||||
|
||||
const EXTENSIONS = new Set(['.json', '.html', '.mjs']);
|
||||
|
||||
const MOJIBAKE_PATTERNS = [
|
||||
{ name: 'latin1-accent', pattern: /\u00c3./g },
|
||||
{ name: 'stray-cp1252-prefix', pattern: /\u00c2./g },
|
||||
{ name: 'emoji-mojibake', pattern: /\u00f0\u0178/g },
|
||||
{
|
||||
name: 'punctuation-mojibake',
|
||||
pattern: /\u00e2[\u0080-\u009f\u20ac\u0153\u2018\u2019\u201c\u201d\u2013\u2014\u2022\u2026\u201e\u2021\u02c6\u2030\u2039\u203a\u0152\u017d]/g,
|
||||
},
|
||||
{ name: 'variation-selector-mojibake', pattern: /\u00ef\u00b8/g },
|
||||
{ name: 'ligature-mojibake', pattern: /\u00c5[\u0080-\u017f]/g },
|
||||
{ name: 'replacement-character', pattern: /\ufffd/g },
|
||||
];
|
||||
|
||||
function collectFiles(root) {
|
||||
const out = [];
|
||||
for (const entry of readdirSync(root, { withFileTypes: true })) {
|
||||
const path = join(root, entry.name);
|
||||
if (entry.isDirectory()) {
|
||||
out.push(...collectFiles(path));
|
||||
} else if (EXTENSIONS.has(path.slice(path.lastIndexOf('.')))) {
|
||||
out.push(path);
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
function textFiles() {
|
||||
const discovered = TEXT_ROOTS.flatMap(root => collectFiles(root));
|
||||
const explicit = TEXT_FILES.filter(path => statSync(path, { throwIfNoEntry: false })?.isFile());
|
||||
return [...new Set([...discovered, ...explicit])].sort();
|
||||
}
|
||||
|
||||
test('locale JSON files are valid UTF-8 JSON', () => {
|
||||
for (const file of collectFiles('locales')) {
|
||||
assert.doesNotThrow(() => JSON.parse(readFileSync(file, 'utf8')), `${file} must parse as JSON`);
|
||||
}
|
||||
});
|
||||
|
||||
test('locale text does not contain known mojibake sequences', () => {
|
||||
const failures = [];
|
||||
|
||||
for (const file of textFiles()) {
|
||||
const text = readFileSync(file, 'utf8');
|
||||
for (const { name, pattern } of MOJIBAKE_PATTERNS) {
|
||||
for (const match of text.matchAll(pattern)) {
|
||||
const start = Math.max(0, match.index - 30);
|
||||
const end = Math.min(text.length, match.index + 50);
|
||||
failures.push(`${file}: ${name}: ${JSON.stringify(text.slice(start, end))}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
assert.deepEqual(failures, []);
|
||||
});
|
||||
@@ -1,109 +0,0 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { briefing, getHot, getRedditConfig, getToken } from '../apis/sources/reddit.mjs';
|
||||
|
||||
test('Reddit reports missing OAuth credentials without network access', async () => {
|
||||
let calls = 0;
|
||||
const data = await briefing({
|
||||
env: {},
|
||||
delayMs: 0,
|
||||
fetchImpl: async () => {
|
||||
calls++;
|
||||
throw new Error('unexpected network access');
|
||||
},
|
||||
});
|
||||
|
||||
assert.equal(calls, 0);
|
||||
assert.equal(data.status, 'no_credentials');
|
||||
assert.equal(data.error, 'missing_reddit_oauth_credentials');
|
||||
assert.deepEqual(data.missing, ['REDDIT_CLIENT_ID', 'REDDIT_CLIENT_SECRET']);
|
||||
});
|
||||
|
||||
test('Reddit hot posts require OAuth token and never use public JSON fallback', async () => {
|
||||
const originalFetch = globalThis.fetch;
|
||||
let calledUrl = null;
|
||||
globalThis.fetch = async url => {
|
||||
calledUrl = url;
|
||||
throw new Error('unexpected public fallback');
|
||||
};
|
||||
|
||||
try {
|
||||
const data = await getHot('worldnews');
|
||||
assert.equal(calledUrl, null);
|
||||
assert.equal(data.status, 'no_credentials');
|
||||
assert.equal(data.error, 'reddit_oauth_required');
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test('Reddit classifies OAuth HTTP failure without exposing secrets', async () => {
|
||||
const result = await getToken({
|
||||
env: { REDDIT_CLIENT_ID: 'client-id', REDDIT_CLIENT_SECRET: 'client-secret' },
|
||||
fetchImpl: async () => ({
|
||||
ok: false,
|
||||
status: 401,
|
||||
text: async () => 'invalid client',
|
||||
}),
|
||||
});
|
||||
|
||||
assert.equal(result.ok, false);
|
||||
assert.equal(result.status, 'auth_failed');
|
||||
assert.equal(result.error, 'reddit_oauth_http_401');
|
||||
assert.doesNotMatch(JSON.stringify(result), /client-secret/);
|
||||
});
|
||||
|
||||
test('Reddit fetches hot posts through oauth.reddit.com when configured', async () => {
|
||||
const originalFetch = globalThis.fetch;
|
||||
const urls = [];
|
||||
globalThis.fetch = async url => {
|
||||
urls.push(String(url));
|
||||
if (String(url).includes('/api/v1/access_token')) {
|
||||
return {
|
||||
ok: true,
|
||||
status: 200,
|
||||
json: async () => ({ access_token: 'test-token' }),
|
||||
};
|
||||
}
|
||||
return {
|
||||
ok: true,
|
||||
status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
text: async () => JSON.stringify({
|
||||
data: {
|
||||
children: [
|
||||
{
|
||||
data: {
|
||||
title: 'Market stress headline',
|
||||
score: 42,
|
||||
num_comments: 7,
|
||||
url: 'https://example.test/post',
|
||||
created_utc: 1700000000,
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
}),
|
||||
};
|
||||
};
|
||||
|
||||
try {
|
||||
const data = await briefing({
|
||||
env: { REDDIT_CLIENT_ID: 'client-id', REDDIT_CLIENT_SECRET: 'client-secret' },
|
||||
subreddits: ['worldnews'],
|
||||
delayMs: 0,
|
||||
});
|
||||
|
||||
assert.equal(data.status, 'ok');
|
||||
assert.equal(data.subreddits.worldnews[0].title, 'Market stress headline');
|
||||
assert.ok(urls.some(url => url === 'https://www.reddit.com/api/v1/access_token'));
|
||||
assert.ok(urls.some(url => url.startsWith('https://oauth.reddit.com/r/worldnews/hot')));
|
||||
assert.equal(urls.some(url => url.includes('hot.json')), false);
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test('Reddit config reports partial credential state', () => {
|
||||
assert.deepEqual(getRedditConfig({ REDDIT_CLIENT_ID: 'id' }).missing, ['REDDIT_CLIENT_SECRET']);
|
||||
});
|
||||
Reference in New Issue
Block a user