feat: production API stack with security and observability

.env.example

@@ -1 +1,25 @@
-# placeholder
+# Environment Configuration
+NODE_ENV=production
+
+# Service Ports
+AGENT_TOOLS_PORT=3000
+AGENT_DASHBOARD_PORT=3001
+AGENT_SCHEDULER_PORT=3002
+
+# Agent Tools Configuration
+AGENT_TOOLS_API_KEY=your-secure-api-key-here-change-in-production
+
+# Rate Limiting (agent-tools)
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX_REQUESTS=100
+
+# CORS Configuration (agent-tools)
+# Comma-separated list of allowed origins
+CORS_ALLOWED_ORIGINS=http://localhost:3001,http://agent-dashboard:3001
+
+# Service URLs (for inter-service communication)
+AGENT_TOOLS_URL=http://agent-tools:3000
+AGENT_SCHEDULER_URL=http://agent-scheduler:3002
+
+# Logging
+LOG_LEVEL=info

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+    branches: ['**']
+
+jobs:
+  test:
+    name: Test ${{ matrix.project }}
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        project:
+          - agent-tools
+          - agent-dashboard
+          - agent-scheduler
+      fail-fast: false
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v3
+        with:
+          path: projects/${{ matrix.project }}/node_modules
+          key: ${{ runner.os }}-node-${{ matrix.project }}-${{ hashFiles('projects/${{ matrix.project }}/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-${{ matrix.project }}-
+
+      - name: Install dependencies
+        working-directory: projects/${{ matrix.project }}
+        run: npm install
+
+      - name: Security audit
+        working-directory: projects/${{ matrix.project }}
+        run: npm audit --audit-level=high
+
+      - name: Run tests
+        working-directory: projects/${{ matrix.project }}
+        run: npm test
+
+      - name: Build project
+        working-directory: projects/${{ matrix.project }}
+        run: npm run build

.github/workflows/docker-build.yml

@@ -0,0 +1,36 @@
+name: Docker Build
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    name: Build ${{ matrix.project }}
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        project:
+          - agent-tools
+          - agent-dashboard
+          - agent-scheduler
+      fail-fast: false
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./projects/${{ matrix.project }}
+          file: ./projects/${{ matrix.project }}/Dockerfile
+          push: false
+          tags: ${{ matrix.project }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/security.yml

@@ -0,0 +1,73 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run weekly on Mondays at 00:00 UTC
+    - cron: '0 0 * * 1'
+
+jobs:
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      matrix:
+        project:
+          - agent-tools
+          - agent-dashboard
+          - agent-scheduler
+      fail-fast: false
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          queries: security-extended
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        working-directory: projects/${{ matrix.project }}
+        run: npm install
+
+      - name: Build project
+        working-directory: projects/${{ matrix.project }}
+        run: npm run build
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:javascript-typescript/${{ matrix.project }}"
+
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: always

MIGRATION_GUIDE.md

@@ -0,0 +1,136 @@
+# Agent Migration Guide
+
+Your autonomous agent infrastructure is ready to move to your PC. Two files are needed:
+
+## Files to Download
+
+1. **agent-repo.bundle** (8.8 MB) - Complete git history & all branches
+2. **agent-files.tar.gz** (1.1 MB) - All project files, config, memory
+
+Both are in the current directory.
+
+---
+
+## Setup on New PC
+
+### Step 1: Create Project Directory
+```bash
+cd your-workspace
+mkdir agent-workspace
+cd agent-workspace
+```
+
+### Step 2: Restore Git Repository
+```bash
+# Create empty repo
+git init
+
+# Add bundle as remote (temporary)
+git remote add bundle /path/to/agent-repo.bundle
+
+# Fetch all branches and history
+git fetch bundle '*:*'
+
+# Remove temporary remote
+git remote remove bundle
+
+# Set upstream to origin (or your GitHub if you have one)
+# git remote add origin https://github.com/your-username/agent
+```
+
+### Step 3: Restore Project Files
+```bash
+# Extract files
+tar -xzf /path/to/agent-files.tar.gz -C .
+
+# Check out the main branch
+git checkout main
+
+# Check out the active development branch
+git checkout claude/serene-lamarr
+```
+
+### Step 4: Install Dependencies
+```bash
+npm install
+npm run build
+npm test
+```
+
+### Step 5: Configure Environment
+Create `.env` file:
+```bash
+TELEGRAM_BOT_TOKEN=your_token_here
+TELEGRAM_GROUP_ID=your_group_id
+TELEGRAM_USER_ID=your_user_id
+GITHUB_TOKEN=your_github_token
+GITHUB_USERNAME=your_username
+```
+
+⚠️ **CRITICAL**: Never commit `.env` files
+
+### Step 6: Start Agent
+```bash
+node scripts/agent.js
+```
+
+Dashboard will be available at: `http://localhost:3000/?token=agent`
+
+---
+
+## What's Included
+
+✅ All source code (projects/, scripts/, tests/)
+✅ Configuration (.claude/, .mcp.json, CLAUDE.md)
+✅ Memory system (memory/ with patterns, daily notes, projects)
+✅ Git history (all branches, commits, tags)
+✅ Project threads mapping (memory/project-threads.json)
+✅ Usage tracking (memory/usage-log.jsonl)
+
+❌ **NOT included** (for security):
+- node_modules/ (rebuilt via npm install)
+- .env files (create fresh on new PC)
+- .git/ folder (restored from bundle)
+
+---
+
+## Verify Everything Works
+
+After setup:
+```bash
+npm test              # All tests should pass
+npm run build         # Should compile without errors
+node scripts/agent.js # Should boot and connect to Telegram
+```
+
+---
+
+## Quick Steps Summary
+
+```bash
+# On new PC:
+cd workspace
+mkdir agent && cd agent
+git init
+git remote add bundle /path/to/agent-repo.bundle
+git fetch bundle '*:*'
+git remote remove bundle
+tar -xzf /path/to/agent-files.tar.gz -C .
+git checkout claude/serene-lamarr
+npm install
+# Create .env with your tokens
+node scripts/agent.js
+```
+
+---
+
+## Using GitHub Instead (Optional)
+
+If you want to use GitHub:
+1. Create private repo on GitHub
+2. Push from this machine: `git push -u origin main claude/serene-lamarr`
+3. On new PC: `git clone <repo-url>`
+4. Follow Step 4-6 above
+
+This way you don't need to copy files manually.
+