PulseCheck OS: Mission Control + /graph 3D viewers + autonomy/realtime

.env.example

@@ -45,3 +45,249 @@ CLAWDBOT_GATEWAY_TOKEN=
 #   - LAN: 192.168.1.50
 #   - Subnet: 192.168.1.0/24
 # CLAWSUITE_ALLOWED_HOSTS=
+
+# === Postiz Cloud OAuth2 (optional) ===
+# Two ways to talk to Postiz from the dashboard:
+#
+#   1) Postiz Cloud via OAuth2 (this section). User clicks Connect on the
+#      dashboard, completes consent at platform.postiz.com, and the
+#      access_token is persisted at data/postiz-oauth.json (gitignored).
+#      Cloud mode auto-activates when the token file exists.
+#
+#   2) Self-hosted Postiz via static API key (POSTIZ_API_KEY below).
+#      Used as a fallback when no OAuth token is present.
+#
+# Register an OAuth app at: platform.postiz.com > Settings > Developers > Apps
+# Set the Redirect URL there to match POSTIZ_CLOUD_REDIRECT_URI below.
+
+POSTIZ_CLOUD_CLIENT_ID=
+POSTIZ_CLOUD_CLIENT_SECRET=
+POSTIZ_CLOUD_REDIRECT_URI=http://localhost:5173/api/postiz/oauth/callback
+POSTIZ_CLOUD_AUTHORIZE_URL=https://platform.postiz.com/oauth/authorize
+POSTIZ_CLOUD_TOKEN_URL=https://api.postiz.com/oauth/token
+
+# Override POSTIZ_API_URL if you want explicit cloud routing without OAuth,
+# or to point at a self-hosted Postiz instance. The client auto-defaults to
+# api.postiz.com when an OAuth token is present, otherwise localhost:5000.
+# POSTIZ_API_URL=https://api.postiz.com
+
+# Self-host fallback: static API key from Postiz Settings > API.
+# Leave empty if using Cloud OAuth. If both are set, OAuth wins.
+# POSTIZ_API_KEY=
+
+# ===============================================================
+# SERVER RUNTIME (Optional - production server: serve.mjs)
+# ===============================================================
+# HTTP port the production server binds to (default 3010)
+PORT=3010
+# Bind address (default 0.0.0.0; use 127.0.0.1 to restrict to localhost)
+HOST=0.0.0.0
+# Node environment. Set to "production" for prod deploys (gates secure cookies, CSP, etc.)
+NODE_ENV=production
+# CORS / WS allowlist. Comma-separated origins permitted to call the API + open WS.
+# NOTE: code reads CLAWSUITE_ALLOWED_ORIGINS (the CLAWSUITE_ALLOWED_HOSTS comment above is the legacy name).
+# CLAWSUITE_ALLOWED_ORIGINS=
+
+# ===============================================================
+# GATEWAY / OPENCLAW (Optional)
+# ===============================================================
+# OpenClaw agent id used to resolve per-agent state paths (default "main")
+CLAWDBOT_AGENT_ID=main
+# Override the .clawdbot state directory (default ~/.clawdbot)
+# CLAWDBOT_STATE_DIR=
+# OpenClaw workspace / state / skills / memory directory overrides (auto-resolved if unset)
+# OPENCLAW_WORKSPACE=
+# OPENCLAW_WORKSPACE_DIR=
+# OPENCLAW_STATE_DIR=
+# OPENCLAW_SKILLS_DIR=
+# OPENCLAW_MEMORY_DIR=
+
+# ===============================================================
+# CLAWSUITE SESSIONS / CLOUD (Optional)
+# ===============================================================
+# Persist login sessions to disk across restarts. Set to "1" to enable.
+# CLAWSUITE_PERSIST_SESSIONS=
+# File path for persisted sessions (used when CLAWSUITE_PERSIST_SESSIONS=1)
+# CLAWSUITE_SESSION_FILE=
+# Cloud provisioning API base (default https://cloud.clawsuite.io)
+# CLAWSUITE_CLOUD_API=https://cloud.clawsuite.io
+
+# ===============================================================
+# SUPABASE / MULTI-USER AUTH (Optional - required only when multi-user auth is on)
+# ===============================================================
+# Supabase project URL. REQUIRED for Supabase-backed features (intel, margin,
+# integrations, multi-user auth, LinkedIn token store). A canonical prod URL is
+# compiled in as a default; override per environment.
+# SUPABASE_URL=https://<project-ref>.supabase.co
+# Service-role / secret key for server-side Supabase access. SUPABASE_SECRET_KEYS
+# is preferred and falls back to SUPABASE_SERVICE_ROLE_KEY. Keep server-side only.
+SUPABASE_SECRET_KEYS=
+SUPABASE_SERVICE_ROLE_KEY=
+# Enable multi-user auth. "1" turns it on; requires a Supabase service-role key set above.
+# MULTIUSER_AUTH=
+# Default org id used for outreach + voice-engine context.
+# REQUIRED in prod for LinkedIn outreach (fail-loud: throws if unset when that path runs).
+# PULSECHECK_DEFAULT_ORG_ID=
+
+# ===============================================================
+# AI / LLM PROVIDERS (Optional - fail-loud per feature when the key is missing)
+# ===============================================================
+# Anthropic + OpenAI keys power the LinkedIn/Postiz coach and debug analyzer.
+ANTHROPIC_API_KEY=
+OPENAI_API_KEY=
+# Groq key - REQUIRED for the voice-engine AI Customizer / scenario suggestions (503 if missing).
+GROQ_API_KEY=
+# OpenRouter key - used by provider-usage reporting.
+OPENROUTER_API_KEY=
+# Exa key - optional; enables person resolution in LinkedIn outreach (graceful fallback if unset).
+EXA_API_KEY=
+
+# ===============================================================
+# LOCAL LLM / INTEL PIPELINE (Optional - all have defaults)
+# ===============================================================
+# Ollama base URL (default http://localhost:11434)
+OLLAMA_BASE_URL=http://localhost:11434
+# LM Studio base URL (default http://localhost:1234)
+LMSTUDIO_BASE_URL=http://localhost:1234
+# Intel embedding model (default nomic-embed-text)
+INTEL_EMBED_MODEL=nomic-embed-text
+# Intel generation model (default empty = generation skipped)
+# INTEL_GEN_MODEL=
+# Intel interest-profile prompt override (has a built-in default)
+# INTEL_INTEREST_PROFILE=
+
+# ===============================================================
+# LIGHTRAG KNOWLEDGE GRAPH (Optional - has defaults)
+# ===============================================================
+# WS/proxy target used by serve.mjs (default http://127.0.0.1:9622)
+LIGHTRAG_URL=http://127.0.0.1:9622
+# API base used by the intel knowledge client (default http://localhost:9621)
+LIGHTRAG_BASE_URL=http://localhost:9621
+# LightRAG API key (default empty)
+LIGHTRAG_API_KEY=
+
+# ===============================================================
+# VOICE ENGINE / VOICE HUB (Optional - has defaults)
+# ===============================================================
+# Voice-engine FastAPI base (default http://127.0.0.1:8130). Browser must NOT call this directly.
+VOICE_ENGINE_URL=http://127.0.0.1:8130
+# Org id sent as X-Org-Id to the voice engine (falls back to PULSECHECK_DEFAULT_ORG_ID context)
+# VOICE_HUB_ORG_ID=
+# HMAC shared secret sent as X-Webhook-Token to the voice engine. Server-side only.
+VOICE_HUB_HMAC_SECRET=
+# Shared bearer secret the dashboard uses to mint Hume/Grok voice tokens.
+DASHBOARD_AUTH_SECRET=
+# Hume voice token server (default http://127.0.0.1:8210)
+HUME_TOKEN_SERVER_URL=http://127.0.0.1:8210
+# Grok/xAI voice token server (default http://127.0.0.1:8220)
+XAI_TOKEN_SERVER_URL=http://127.0.0.1:8220
+# Hume phone relay used by the Twilio<->Hume bridge (default http://127.0.0.1:8211)
+HUME_PHONE_RELAY_URL=http://127.0.0.1:8211
+# Portable TTS server for voice previews (default http://127.0.0.1:8100)
+PORTABLE_TTS_URL=http://127.0.0.1:8100
+
+# ===============================================================
+# TWILIO (Optional)
+# ===============================================================
+# Twilio auth token - used to validate inbound webhook signatures.
+TWILIO_AUTH_TOKEN=
+# Set to "true" to skip Twilio signature validation (DEV ONLY - never in prod).
+# SKIP_TWILIO_VALIDATION=
+# Public base URL of this dashboard, used to build Twilio callback URLs.
+# Falls back to the request host when unset.
+# PUBLIC_DASHBOARD_URL=
+
+# ===============================================================
+# OCTOGENT / RENDER / MEDIA (Optional - has defaults)
+# ===============================================================
+# Octogent service base (default http://127.0.0.1:8787; ws ws://127.0.0.1:8787)
+OCTOGENT_URL=http://127.0.0.1:8787
+# Render server base (default http://127.0.0.1:8140; ws derived)
+RENDER_SERVER_URL=http://127.0.0.1:8140
+# Override the render output directory (auto-resolved if unset)
+# RENDER_OUTPUT_DIR=
+# Wan2GP video adapter base (default http://127.0.0.1:7861)
+WAN2GP_BASE_URL=http://127.0.0.1:7861
+# Wan2GP API key (default empty)
+WAN2GP_API_KEY=
+
+# ===============================================================
+# RSS / AUTONOMY (Optional - has defaults)
+# ===============================================================
+# RSSHub base used by the RSS cockpit (default http://localhost:1200)
+RSSHUB_URL=http://localhost:1200
+# Override path to the RSS autopost config file (defaults to a path under the data dir)
+# RSS_AUTOPOST_CONFIG_PATH=
+# Self URL the RSS autoposter calls back into (falls back to the request host)
+# PULSEOS_SELF_URL=
+# Autonomy loop: disabled by default. Set to "true" or "1" to enable.
+# PULSEOS_AUTONOMY_LOOP_ENABLED=
+# Autonomy loop tick interval in ms (default 60000)
+# PULSEOS_AUTONOMY_INTERVAL_MS=60000
+
+# ===============================================================
+# POSTIZ (self-host fallback + OAuth token path) (Optional)
+# ===============================================================
+# Override path for the persisted Postiz OAuth token file (default data/postiz-oauth.json)
+# POSTIZ_OAUTH_TOKEN_PATH=
+# CSRF state-signing secret for Postiz OAuth. Falls back to CLAWSUITE_PASSWORD when unset.
+# POSTIZ_CLOUD_STATE_SECRET=
+
+# ===============================================================
+# GMAIL OAUTH (Optional - required to use the Gmail integration)
+# ===============================================================
+# REQUIRED to connect Gmail (fail-loud if missing when the OAuth flow runs):
+GMAIL_CLIENT_ID=
+GMAIL_CLIENT_SECRET=
+# REQUIRED - must match the Google app redirect URI
+GMAIL_REDIRECT_URI=
+# CSRF state-signing secret (falls back to CLAWSUITE_PASSWORD when unset)
+# GMAIL_STATE_SECRET=
+# Optional OAuth endpoint + scope overrides (Google defaults built in)
+GMAIL_AUTHORIZE_URL=https://accounts.google.com/o/oauth2/v2/auth
+GMAIL_TOKEN_URL=https://oauth2.googleapis.com/token
+GMAIL_SCOPE=https://www.googleapis.com/auth/gmail.readonly
+
+# ===============================================================
+# HUBSPOT (OAuth + static-key fallback) (Optional)
+# ===============================================================
+# OAuth app credentials. REQUIRED to use the OAuth connect flow (fail-loud if missing).
+HUBSPOT_CLIENT_ID=
+HUBSPOT_CLIENT_SECRET=
+HUBSPOT_REDIRECT_URI=
+# CSRF state-signing secret (falls back to CLAWSUITE_PASSWORD when unset)
+# HUBSPOT_STATE_SECRET=
+# Static private-app token fallback (used when no OAuth token is stored)
+# HUBSPOT_API_KEY=
+# Optional OAuth endpoint + scope overrides (HubSpot defaults built in)
+HUBSPOT_AUTHORIZE_URL=https://app.hubspot.com/oauth/authorize
+HUBSPOT_TOKEN_URL=https://api.hubapi.com/oauth/v1/token
+HUBSPOT_SCOPE=oauth crm.objects.contacts.read crm.objects.deals.read
+
+# ===============================================================
+# LINKEDIN (Optional)
+# ===============================================================
+# LinkedIn MCP server URL (default http://127.0.0.1:8120/mcp)
+LINKEDIN_MCP_URL=http://127.0.0.1:8120/mcp
+# OAuth client secret. REQUIRED to verify LinkedIn webhooks (HMAC key; fail-loud if missing).
+LINKEDIN_CLIENT_SECRET=
+# Ads-permission OAuth token. REQUIRED for the conversions API (fail-loud if missing).
+LINKEDIN_ADS_ACCESS_TOKEN=
+# LinkedIn API version header (default 202508)
+LINKEDIN_API_VERSION=202508
+# Token-at-rest encryption key. REQUIRED for the LinkedIn token store (throws if unset when used).
+LINKEDIN_TOKEN_ENC_KEY=
+# Active key version (default v1)
+LINKEDIN_TOKEN_ENC_KEY_VERSION=v1
+# Historical keys for decryption after rotation: LINKEDIN_TOKEN_ENC_KEY_<version>, e.g.:
+# LINKEDIN_TOKEN_ENC_KEY_v1=
+
+# ===============================================================
+# BILLING / MISC (Optional)
+# ===============================================================
+# Polar webhook signing secret (validates inbound cloud billing webhooks)
+POLAR_WEBHOOK_SECRET=
+# App version string surfaced to clients (default 3.1.0)
+NEXT_PUBLIC_APP_VERSION=3.1.0
+# Public ping/health URL used by the active-users client (optional)
+# NEXT_PUBLIC_PING_URL=

.gitignore

@@ -29,6 +29,29 @@ lerna-debug.log*
 .DS_Store
 Thumbs.db
 
+# Ephemeral Playwright / audit screenshots from ad-hoc probe runs at repo root
+audit*.png
+audit-shots_*.png
+audit*_*.png
+clawsuite-*.png
+dashboard-*.png
+debug-*.png
+debug-full*.png
+files-*.png
+settings-*.png
+settings-appearance*.png
+skills-*.png
+tracker*.png
+usage-*.png
+dash-bg-check.png
+
+# Background dev-server log written by `npm run dev > autonomy-dev.log`
+autonomy-dev.log
+
+# Ad-hoc audit output directories
+audit-shots/
+audit[0-9]*/
+
 # Editor directories
 .vscode/*
 !.vscode/extensions.json
@@ -135,3 +158,14 @@ docs/specs/
 docs/CLAWSUITE-ROADMAP.md
 release/
 electron/server-bundle.mjs
+
+# Secret / env backups — NEVER commit (e.g. .env.bak-pre-supabase-propagation-*)
+.env.bak*
+*.env.bak*
+# Local scratch / verification dumps
+env-verify.txt
+_tc_rss.txt
+# TypeScript incremental build cache
+*.tsbuildinfo
+# claude-flow tool scratch (root + nested)
+.claude-flow/