feat(ai-tools): install/update AI CLIs, remote catalog sync, cached favicons (#40 A2)

server/routes/ai-tools.js

@@ -3,13 +3,18 @@
  * what is known and installed, re-detect after hydrating PATH from the login
  * shell, and enable/disable a tool or make it the default. Nothing here takes
  * a command or an argument from the request — the catalog files are the only
- * source of what a lane may run. Writes sit behind the same-origin guard.
+ * source of what a lane may run, or an install/update may execute. Also: start
+ * an install/update job and read it back, npm version badges, and the
+ * server-cached icons. Writes sit behind the same-origin guard.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 const express = require("express");
 
 const aiTools = require("../lib/ai-tools");
+const jobs = require("../lib/ai-tool-jobs");
+const versions = require("../lib/ai-tool-versions");
+const { iconFor } = require("../lib/ai-tool-icons");
 const { hydrateShellPath } = require("../lib/shell-path");
 const { sameOriginGuard } = require("../lib/same-origin");
 
@@ -22,6 +27,7 @@ router.get("/", (_req, res) => {
 router.post("/refresh", sameOriginGuard, async (_req, res) => {
   await hydrateShellPath();
   aiTools.refresh();
+  versions.invalidate(); // a CLI updated by hand shows its new version after Refresh
   res.json(aiTools.view());
 });
 
@@ -47,4 +53,59 @@ router.put("/:id", sameOriginGuard, (req, res) => {
   }
 });
 
+const JOB_STATUS = {
+  ENOTOOL: 404,
+  ENOINSTALL: 400,
+  ENOUPDATE: 400,
+  ENOTHING: 400,
+  ENONPM: 409,
+  EINSTALLED: 409,
+  ENOTINSTALLED: 409,
+  ENOTNPM: 409,
+  EBUSY: 409,
+};
+
+async function startJob(res, fn) {
+  try {
+    res.status(202).json({ job: await fn() });
+  } catch (e) {
+    res
+      .status(JOB_STATUS[e.code] || 500)
+      .json({ error: { code: e.code || "EINTERNAL", message: e.message } });
+  }
+}
+
+router.post("/update-all", sameOriginGuard, (_req, res) => startJob(res, jobs.startUpdateAll));
+
+router.post("/:id/install", sameOriginGuard, (req, res) =>
+  startJob(res, () => jobs.start(req.params.id, "install"))
+);
+
+router.post("/:id/update", sameOriginGuard, (req, res) =>
+  startJob(res, () => jobs.start(req.params.id, "update"))
+);
+
+router.get("/job", (_req, res) => {
+  res.json(jobs.current());
+});
+
+router.get("/versions", async (_req, res) => {
+  res.json(await versions.versions());
+});
+
+router.get("/:id/icon", async (req, res) => {
+  if (!aiTools.has(req.params.id)) return res.status(404).end();
+  const icon = await iconFor(req.params.id);
+  // 204, not 404: a miss is a normal state, and a 404 per letter-avatar would
+  // log a console error for every such tool on every visit to Settings.
+  if (!icon) return res.status(204).end();
+  res.set({
+    "Content-Type": icon.type,
+    "X-Content-Type-Options": "nosniff",
+    "Content-Security-Policy": "sandbox",
+    "Cache-Control": "max-age=86400",
+  });
+  res.end(icon.body);
+});
+
 module.exports = router;