Local-first AI Desktop Assistant

Building on v0.1's chat engine, v0.2 adds the complete Tools System:

Note: 5 tools (web_screenshot, doc_pdf, doc_docx, ocr, image_edit) return stub responses since their npm dependencies (playwright, pdf-parse, mammoth, tesseract.js, sharp) were intentionally not installed to keep the build lightweight and avoid native compilation. They are fully wired into the permission/execution/persistence pipeline and will work immediately once those packages are added.

cd bloomai

# Install dependencies once
npm install --legacy-peer-deps --ignore-scripts

# Typecheck and build the migrated root app
npm run typecheck
npm run build

# Start the local API server
npm run start:server

# In another terminal, preview the built frontend
npx vite preview --host 127.0.0.1 --port 5174
# Visit http://127.0.0.1:5174

Configure your Anthropic API key in Settings to enable chat, vision, and prompt-template skills. Configure OpenAI key to enable image_gen.

GET    /api/v1/tools                         # List all tools (with permission state)
GET    /api/v1/tools/stats                   # Global usage stats
GET    /api/v1/tools/runs                    # All tool run history
GET    /api/v1/tools/permissions             # All permission grants
POST   /api/v1/tools/permissions/:id/grant   # Grant permission {scope}
POST   /api/v1/tools/permissions/:id/revoke  # Revoke permission
GET    /api/v1/tools/:id                     # Tool detail + schema
PATCH  /api/v1/tools/:id                     # Enable/disable {is_enabled}
POST   /api/v1/tools/:id/run                 # Execute tool {input, sessionId}
GET    /api/v1/tools/:id/runs                # Tool-specific run history

GET    /api/v1/skills                        # Installed skills
GET    /api/v1/skills/market                 # Market skills (search + paginate)
POST   /api/v1/skills/install                # Install from market {id}
POST   /api/v1/skills                        # Create custom skill
GET    /api/v1/skills/:id                    # Skill detail
PATCH  /api/v1/skills/:id                    # Update custom skill
DELETE /api/v1/skills/:id                    # Uninstall/delete
POST   /api/v1/skills/:id/run                # Execute skill {input}
GET    /api/v1/skills/:id/runs               # Skill run history

• Drizzle ORM over node:sqlite: Avoids native compilation entirely — works in any sandboxed/restricted environment without node-gyp.
• Three-tier permissions: null/fs/network (soft, auto-allowed), write (needs confirmation dialog), shell (needs explicit permanent grant via /tools/permissions/shell/grant).
• vm sandbox for JS execution: Both node_runner tool and js-function skills run inside node:vm contexts with no access to require, process, or the filesystem.
• 15-second hard timeout: Every tool call races against a timeout via Promise.race, regardless of category.
• All v0.1 data persists: Sessions, messages, and personas are untouched — v0.2 is purely additive at the schema level.
• Backend dependency boundary: src/server/http/routes/** adapts HTTP only and calls src/server/services/**; Services orchestrate repositories and runtimes; src/server/db/repositories/** remains persistence-only. npm run test:architecture enforces Route → Service → Repository/Runtime boundaries across production server code. See docs/services/01-service-layer-architecture-analysis.md and docs/services/03-http-route-application-service-adr.md.