chore: merge dev → master

.env.example

@@ -4,7 +4,19 @@
 # AI API Key
 AI_API_KEY=your_api_key_here
 
+# Optional Database URL
+# Default when empty: sqlite:///data/zeroichi.db
+# Example PostgreSQL:
+# DATABASE_URL=postgresql://user:password@localhost:5432/zeroichi
+DATABASE_URL=
+
 # Dashboard Authentication
-# Default: admin / admin
-DASHBOARD_USERNAME=admin
-DASHBOARD_PASSWORD=admin
+# Required when dashboard.enabled=true
+DASHBOARD_USERNAME=change_me
+DASHBOARD_PASSWORD=change_me_too
+
+# Optional Dashboard CORS origins (comma-separated)
+# DASHBOARD_CORS_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
+
+# Optional WebSocket token TTL in seconds
+# DASHBOARD_WS_TOKEN_TTL_SECONDS=300

.github/workflows/ci.yml

@@ -27,3 +27,6 @@ jobs:
 
       - name: Lint
         run: uv run ruff check .
+
+      - name: Run Tests
+        run: uv run pytest -q

README.md

@@ -20,6 +20,8 @@ Because life is too short for boring bots.
 - **Universal Downloader**: Grab videos from YouTube, TikTok, Instagram, and 1000+ other sites. Yes, even that one.
 - **Mod Toolkit**: Keep your groups clean with anti-link, anti-delete, warnings, reports, and blacklists.
 - **Time Travel**: Okay, not really, but our **Scheduler** lets you send messages in the future (cron supported!).
+- **Webhooks**: Stream bot events into your own apps, Discord, CI, or alerting stack.
+- **Database-Backed State**: SQLite out of the box, PostgreSQL when you need it.
 - **Polyglot**: Speaks English and Indonesian fluently. Add your own language if you're feeling adventurous.
 - **Shiny Dashboard**: A web interface to manage everything because terminals are scary sometimes.
 
@@ -57,6 +59,17 @@ cp .env.example .env
 uv run zero-ichi
 ```
 
+Common CLI options:
+
+```bash
+uv run zero-ichi --debug --auto-reload
+uv run zero-ichi --qr
+uv run zero-ichi --phone 6281234567890
+uv run zero-ichi --dashboard
+uv run zero-ichi --session my_session
+uv run zero-ichi update
+```
+
 Scan the QR code and you're in business.
 
 ---

config.schema.json

@@ -35,7 +35,7 @@
                 "phone_number": {
                     "type": "string",
                     "description": "Phone number in international format without '+' (e.g., '628xxxx'). Used for PAIR_CODE login method",
-                    "pattern": "^[0-9]+$"
+                    "pattern": "^$|^[0-9]+$"
                 },
                 "owner_jid": {
                     "type": "string",
@@ -293,6 +293,36 @@
                 }
             }
         },
+        "rate_limit": {
+            "type": "object",
+            "description": "Command rate limiter settings",
+            "properties": {
+                "enabled": {
+                    "type": "boolean",
+                    "default": true
+                },
+                "user_cooldown": {
+                    "type": "number",
+                    "minimum": 0,
+                    "default": 3.0
+                },
+                "command_cooldown": {
+                    "type": "number",
+                    "minimum": 0,
+                    "default": 2.0
+                },
+                "burst_limit": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "default": 5
+                },
+                "burst_window": {
+                    "type": "number",
+                    "minimum": 1,
+                    "default": 10.0
+                }
+            }
+        },
         "downloader": {
             "type": "object",
             "description": "Downloader settings for /dl, /audio, and /video commands",
@@ -452,6 +482,17 @@
                     "type": "boolean",
                     "description": "Enable the Dashboard API server",
                     "default": false
+                },
+                "cors_origins": {
+                    "type": "array",
+                    "description": "Allowed CORS origins for dashboard API",
+                    "items": {
+                        "type": "string"
+                    },
+                    "default": [
+                        "http://localhost:3000",
+                        "http://127.0.0.1:3000"
+                    ]
                 }
             }
         }

dashboard/README.md

@@ -30,7 +30,7 @@ The dashboard provides a web-based interface for managing and monitoring the Zer
 
 ### Prerequisites
 
-- Node.js 20+
+- Bun 1.2+
 - The bot API running on `http://localhost:8000`
 
 ### Installation
@@ -39,21 +39,15 @@ The dashboard provides a web-based interface for managing and monitoring the Zer
 # Navigate to dashboard directory
 cd dashboard
 
-# Install dependencies (using Bun)
+# Install dependencies
 bun install
-
-# Or using npm
-npm install
 ```
 
 ### Development
 
 ```bash
 # Start development server
 bun dev
-
-# Or using npm
-npm run dev
 ```
 
 Open [http://localhost:3000](http://localhost:3000) in your browser.
@@ -100,12 +94,13 @@ dashboard/
 | Configuration   | Modify bot settings via UI         |
 | Task Scheduler  | View and manage scheduled tasks    |
 | Logs Viewer     | Browse recent bot activity         |
+| Webhooks        | Configure outbound event webhooks  |
 
 ---
 
 ## API Connection
 
-The dashboard expects the bot API to be running at `http://localhost:8000`. The API is started automatically when running the bot via `uv run main.py`.
+The dashboard expects the bot API to be running at `http://localhost:8000`. The API is started automatically when running the bot via `uv run zero-ichi`.
 
 | Endpoint            | Description             |
 | ------------------- | ----------------------- |

dashboard/src/app/login/page.tsx

@@ -34,9 +34,23 @@ export default function LoginPage() {
                 localStorage.setItem("dashboard_auth", auth);
                 window.location.href = "/";
             } else {
-                setError("Invalid username or password");
+                let detail = "";
+                try {
+                    const data = (await res.json()) as { detail?: string };
+                    detail = data?.detail || "";
+                } catch {
+                    detail = "";
+                }
+
+                if (res.status === 503 && detail) {
+                    setError(detail);
+                } else if (res.status === 401) {
+                    setError("Invalid username or password");
+                } else {
+                    setError(detail || `Login failed (HTTP ${res.status})`);
+                }
             }
-        } catch (err) {
+        } catch {
             setError("Failed to connect to API server");
         } finally {
             setLoading(false);
@@ -122,6 +136,9 @@ export default function LoginPage() {
                     Credentials can be set in your{" "}
                     <span className="font-mono text-neutral-500">.env</span> file
                 </p>
+                <p className="mt-2 text-center text-xs text-neutral-600">
+                    Use non-default credentials. <span className="font-mono text-neutral-500">admin/admin</span> is blocked.
+                </p>
             </motion.div>
         </div>
     );