"use strict";
const http = require("http");
const fs = require("fs");
const net = require("net");
const crypto = require("crypto");
const PORT = Number(process.env.PORT || 7861);
const GATEWAY_PORT = Number(process.env.API_SERVER_PORT || 8642);
const DASHBOARD_PORT = Number(process.env.DASHBOARD_PORT || 9119);
const TELEGRAM_WEBHOOK_PORT = Number(process.env.TELEGRAM_WEBHOOK_PORT || 8765);
const GATEWAY_HOST = "127.0.0.1";
const startTime = Date.now();
const API_SERVER_KEY = process.env.API_SERVER_KEY || "";
const APP_BASE = "/app";
const LOGIN_PATH = "/login";
const SESSION_COOKIE = "huggingmes_session";
const SYNC_STATUS_FILE = "/tmp/huggingmes-sync-status.json";
const CLOUDFLARE_KEEPALIVE_STATUS_FILE =
"/tmp/huggingmes-cloudflare-keepalive-status.json";
function canConnect(port, host = GATEWAY_HOST, timeoutMs = 600) {
return new Promise((resolve) => {
const socket = net.createConnection({ port, host });
const done = (ok) => {
socket.removeAllListeners();
socket.destroy();
resolve(ok);
};
socket.setTimeout(timeoutMs);
socket.once("connect", () => done(true));
socket.once("timeout", () => done(false));
socket.once("error", () => done(false));
});
}
function readJson(path, fallback = null) {
try {
if (fs.existsSync(path)) return JSON.parse(fs.readFileSync(path, "utf8"));
} catch {}
return fallback;
}
function timingSafeEqualString(left, right) {
if (!left || !right) return false;
const leftBuffer = Buffer.from(left);
const rightBuffer = Buffer.from(right);
if (leftBuffer.length !== rightBuffer.length) return false;
return crypto.timingSafeEqual(leftBuffer, rightBuffer);
}
function expectedSessionValue() {
if (!API_SERVER_KEY) return "";
return crypto
.createHmac("sha256", API_SERVER_KEY)
.update("huggingmes-session-v1")
.digest("hex");
}
function parseCookies(req) {
const header = req.headers.cookie || "";
const cookies = {};
for (const item of header.split(";")) {
const separator = item.indexOf("=");
if (separator < 0) continue;
const name = item.slice(0, separator).trim();
const value = item.slice(separator + 1).trim();
if (!name) continue;
try {
cookies[name] = decodeURIComponent(value);
} catch {
cookies[name] = value;
}
}
return cookies;
}
function isHttpsRequest(req) {
return req.headers["x-forwarded-proto"] === "https";
}
function buildSessionCookie(req) {
const secure = isHttpsRequest(req) ? "; Secure" : "";
return `${SESSION_COOKIE}=${encodeURIComponent(expectedSessionValue())}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400${secure}`;
}
function getBearerToken(req) {
const value = req.headers.authorization || "";
const match = /^Bearer\s+(.+)$/i.exec(value);
return match ? match[1] : "";
}
function isAuthorized(req) {
if (!API_SERVER_KEY) return true;
return (
timingSafeEqualString(getBearerToken(req), API_SERVER_KEY) ||
timingSafeEqualString(
parseCookies(req)[SESSION_COOKIE],
expectedSessionValue(),
)
);
}
function sanitizeNext(value) {
if (!value || typeof value !== "string") return `${APP_BASE}/`;
if (!value.startsWith("/") || value.startsWith("//")) return `${APP_BASE}/`;
return value;
}
function loginUrl(nextPath) {
return `${LOGIN_PATH}?next=${encodeURIComponent(sanitizeNext(nextPath))}`;
}
function renderLoginPage(nextPath, errorMessage = "") {
const safeNext = sanitizeNext(nextPath);
const errorHtml = errorMessage
? `${escapeHtml(errorMessage)}
`
: "";
return `
HuggingMes Login
Open HuggingMes
Enter the GATEWAY_TOKEN from your Space secrets.
${errorHtml}
`;
}
function escapeHtml(value) {
return String(value)
.replace(/&/g, "&")
.replace(//g, ">")
.replace(/"/g, """);
}
function readRequestBody(req, limit = 64 * 1024) {
return new Promise((resolve, reject) => {
let body = "";
req.on("data", (chunk) => {
body += chunk;
if (body.length > limit) {
reject(new Error("Request body is too large."));
req.destroy();
}
});
req.on("end", () => resolve(body));
req.on("error", reject);
});
}
function requireAuth(req, res) {
if (isAuthorized(req)) return true;
const parsed = new URL(req.url, "http://localhost");
redirect(res, loginUrl(`${parsed.pathname}${parsed.search}`));
return false;
}
function wantsHtml(req) {
const accept = String(req.headers.accept || "");
return accept.includes("text/html");
}
async function handleLogin(req, res, parsed) {
const nextPath = sanitizeNext(
parsed.searchParams.get("next") || `${APP_BASE}/`,
);
if (!API_SERVER_KEY) {
redirect(res, nextPath);
return;
}
if (req.method === "GET") {
res.writeHead(200, {
"content-type": "text/html; charset=utf-8",
"cache-control": "no-store",
});
res.end(renderLoginPage(nextPath));
return;
}
if (req.method !== "POST") {
res.writeHead(405, { allow: "GET, POST" });
res.end("Method not allowed");
return;
}
try {
const body = await readRequestBody(req);
const params = new URLSearchParams(body);
const submittedToken = params.get("token") || "";
const submittedNext = sanitizeNext(params.get("next") || nextPath);
if (!timingSafeEqualString(submittedToken, API_SERVER_KEY)) {
res.writeHead(401, {
"content-type": "text/html; charset=utf-8",
"cache-control": "no-store",
});
res.end(
renderLoginPage(
submittedNext,
"That token did not match GATEWAY_TOKEN.",
),
);
return;
}
res.writeHead(302, {
location: submittedNext,
"set-cookie": buildSessionCookie(req),
"cache-control": "no-store",
});
res.end();
} catch (error) {
res.writeHead(400, {
"content-type": "text/plain; charset=utf-8",
"cache-control": "no-store",
});
res.end(error.message || "Invalid login request.");
}
}
function proxyRequest(
req,
res,
targetPort,
rewritePath = (path) => path,
headerOverrides = {},
) {
const parsed = new URL(req.url, "http://localhost");
const targetPath = rewritePath(parsed.pathname) + parsed.search;
const headers = {
...req.headers,
...headerOverrides,
host: `${GATEWAY_HOST}:${targetPort}`,
"x-forwarded-host": req.headers.host || "",
"x-forwarded-proto": req.headers["x-forwarded-proto"] || "https",
};
const proxy = http.request(
{
hostname: GATEWAY_HOST,
port: targetPort,
method: req.method,
path: targetPath,
headers,
},
(upstream) => {
res.writeHead(upstream.statusCode || 502, upstream.headers);
upstream.pipe(res);
},
);
proxy.on("error", (error) => {
res.writeHead(502, { "content-type": "application/json" });
res.end(JSON.stringify({ error: "proxy_error", message: error.message }));
});
req.pipe(proxy);
}
function redirect(res, location, statusCode = 302) {
res.writeHead(statusCode, { location });
res.end();
}
function formatUptime(ms) {
const total = Math.floor(ms / 1000);
const days = Math.floor(total / 86400);
const hours = Math.floor((total % 86400) / 3600);
const minutes = Math.floor((total % 3600) / 60);
if (days) return `${days}d ${hours}h ${minutes}m`;
if (hours) return `${hours}h ${minutes}m`;
return `${minutes}m`;
}
async function statusPayload() {
const gateway = await canConnect(GATEWAY_PORT);
const dashboard = await canConnect(DASHBOARD_PORT);
const telegramWebhook =
!!process.env.TELEGRAM_WEBHOOK_URL &&
(await canConnect(TELEGRAM_WEBHOOK_PORT));
const sync = readJson(
SYNC_STATUS_FILE,
process.env.HF_TOKEN
? {
status: "configured",
message: "Backup is enabled; waiting for the first sync.",
}
: { status: "disabled", message: "HF_TOKEN is not configured." },
);
return {
ok: gateway,
uptime: formatUptime(Date.now() - startTime),
startedAt: new Date(startTime).toISOString(),
gateway,
dashboard,
authConfigured: !!API_SERVER_KEY,
ports: {
public: PORT,
gateway: GATEWAY_PORT,
dashboard: DASHBOARD_PORT,
telegramWebhook: TELEGRAM_WEBHOOK_PORT,
},
telegram: {
configured: !!process.env.TELEGRAM_BOT_TOKEN,
webhook: !!process.env.TELEGRAM_WEBHOOK_URL,
webhookUrl: process.env.TELEGRAM_WEBHOOK_URL || "",
webhookListening: telegramWebhook,
proxy: process.env.CLOUDFLARE_PROXY_URL || "",
},
model:
process.env.MODEL_FOR_CONFIG ||
process.env.HERMES_MODEL ||
process.env.LLM_MODEL ||
"",
provider:
process.env.PROVIDER_FOR_CONFIG ||
process.env.HERMES_INFERENCE_PROVIDER ||
"auto",
backup: sync,
keepalive: readJson(CLOUDFLARE_KEEPALIVE_STATUS_FILE, null),
};
}
function badge(label, state) {
return `${escapeHtml(label)}`;
}
function toneBadge(label, tone = "neutral") {
return `${escapeHtml(label)}`;
}
function valueOrUnset(value, fallback = "Not set") {
return value
? escapeHtml(value)
: `${escapeHtml(fallback)}`;
}
function renderTile({
title,
value,
detail = "",
tone = "neutral",
meta = "",
}) {
return `
${escapeHtml(title)}
${value}
${detail ? `${detail}
` : ""}
${meta ? `${meta}
` : ""}
`;
}
function renderDashboard(data) {
const syncStatus = String(data.backup?.status || "unknown");
const syncTone = ["success", "restored", "synced", "configured"].includes(
syncStatus,
)
? "ok"
: syncStatus === "disabled"
? "warn"
: "neutral";
const telegramTone = data.telegram.configured
? data.telegram.webhookListening || !data.telegram.webhook
? "ok"
: "warn"
: "warn";
const keepaliveConfigured = data.keepalive?.configured === true;
const keepaliveStatus = String(
data.keepalive?.status ||
(process.env.CLOUDFLARE_WORKERS_TOKEN ? "pending" : "not configured"),
);
const keepAliveTone = keepaliveConfigured
? "ok"
: process.env.CLOUDFLARE_WORKERS_TOKEN
? "warn"
: "neutral";
const telegramDetail = data.telegram.configured
? `${data.telegram.webhook ? "Webhook" : "Polling"}${data.telegram.proxy ? " via CF proxy" : ""}`
: "Not configured";
const backupDetail = data.backup?.message
? escapeHtml(data.backup.message)
: "No status yet";
const keepAliveDetail = keepaliveConfigured
? `Pinging ${escapeHtml(data.keepalive.targetUrl || "/health")}`
: keepaliveStatus === "error" && data.keepalive?.message
? escapeHtml(data.keepalive.message)
: process.env.CLOUDFLARE_WORKERS_TOKEN
? "Worker pending or failed"
: "Not configured";
const serviceOk = data.gateway && data.dashboard;
const tiles = [
renderTile({
title: "Gateway",
value: toneBadge(
data.gateway ? "Online" : "Offline",
data.gateway ? "ok" : "off",
),
detail: data.gateway
? `API on port ${data.ports.gateway}`
: `Unreachable`,
tone: data.gateway ? "ok" : "off",
meta: data.authConfigured ? "Protected" : "Unprotected",
}),
renderTile({
title: "Model",
value: `${valueOrUnset(data.model)}`,
detail: `Provider: ${valueOrUnset(data.provider || "auto")}`,
tone: data.model ? "ok" : "warn",
}),
renderTile({
title: "Runtime",
value: escapeHtml(data.uptime),
detail: `Port ${data.ports.public}`,
tone: "neutral",
}),
renderTile({
title: "Telegram",
value: toneBadge(
data.telegram.configured ? "Configured" : "Disabled",
telegramTone,
),
detail: telegramDetail,
tone: telegramTone,
}),
renderTile({
title: "Backup",
value: toneBadge(syncStatus.toUpperCase(), syncTone),
detail: backupDetail,
tone: syncTone,
meta: data.backup?.timestamp
? ``
: "",
}),
renderTile({
title: "Keep Awake",
value: toneBadge(
keepaliveConfigured ? "CF Cron" : keepaliveStatus.toUpperCase(),
keepAliveTone,
),
detail: keepAliveDetail,
tone: keepAliveTone,
}),
].join("");
return `
HuggingMes
Open Hermes Agent ->
`;
}
const server = http.createServer(async (req, res) => {
const parsed = new URL(req.url, "http://localhost");
const path = parsed.pathname;
if (path === LOGIN_PATH) {
await handleLogin(req, res, parsed);
return;
}
if (path === "/health" || path === `${APP_BASE}/health`) {
const data = await statusPayload();
res.writeHead(data.ok ? 200 : 503, { "content-type": "application/json" });
res.end(
JSON.stringify({
ok: data.ok,
gateway: data.gateway,
uptime: data.uptime,
}),
);
return;
}
if (path === "/status" || path === `${APP_BASE}/status`) {
const data = await statusPayload();
res.writeHead(200, { "content-type": "application/json" });
res.end(JSON.stringify(data, null, 2));
return;
}
if (path === "/") {
const data = await statusPayload();
res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
res.end(renderDashboard(data));
return;
}
if (path === "/dashboard" || path === "/dashboard/") {
redirect(res, `${APP_BASE}/${parsed.search}`);
return;
}
if (path === "/telegram" || path.startsWith("/telegram/")) {
proxyRequest(req, res, TELEGRAM_WEBHOOK_PORT);
return;
}
if (path === APP_BASE || path.startsWith(`${APP_BASE}/`)) {
if (!requireAuth(req, res)) return;
proxyRequest(
req,
res,
DASHBOARD_PORT,
(p) => p.replace(/^\/app/, "") || "/",
);
return;
}
if (
path === "/favicon.ico" ||
path.startsWith("/assets/") ||
path.startsWith("/api/") ||
path.startsWith("/dashboard-plugins/") ||
path.startsWith("/ds-assets/")
) {
if (!requireAuth(req, res)) return;
proxyRequest(req, res, DASHBOARD_PORT);
return;
}
if (
[
"/analytics",
"/chat",
"/config",
"/cron",
"/docs",
"/env",
"/logs",
"/models",
"/plugins",
"/profiles",
"/sessions",
"/skills",
].some((route) => path === route || path.startsWith(`${route}/`))
) {
redirect(res, `${APP_BASE}${path}${parsed.search}`);
return;
}
if (path === "/v1" || path.startsWith("/v1/")) {
if (!isAuthorized(req)) {
if (wantsHtml(req)) {
redirect(res, loginUrl(`${path}${parsed.search}`));
return;
}
res.writeHead(401, {
"content-type": "application/json",
"cache-control": "no-store",
});
res.end(
JSON.stringify({
error: "unauthorized",
message: "Use Authorization: Bearer .",
}),
);
return;
}
const upstreamHeaders =
getBearerToken(req) || !API_SERVER_KEY
? {}
: { authorization: `Bearer ${API_SERVER_KEY}` };
proxyRequest(req, res, GATEWAY_PORT, (p) => p, upstreamHeaders);
return;
}
res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
res.end("Not found");
});
server.listen(PORT, "0.0.0.0", () => {
console.log(`HuggingMes dashboard listening on 0.0.0.0:${PORT}`);
});