feat: chat workflow agent + right-side push panel + markdown rendering

.env.example

@@ -36,11 +36,14 @@ CHAT_FRONTEND_URL=http://localhost:3003
 # Session Secret (for express-session)
 SESSION_SECRET=
 
+# Internal API Key (for backend-to-backend communication)
+INTERNAL_API_KEY=
+
 # ===================
-# GLM 4.6 (Zhipu AI) - BAML Chat API
+# Pika AI (Anthropic Proxy) - BAML Chat API
 # ===================
-GLM_API_BASE_URL=https://api.z.ai/api/paas/v4
-GLM_API_KEY=
+PIKA_BASE_URL=https://pikaai.xyz
+PIKA_API_KEY=
 
 # ============================================
 # PRODUCTION (VPS 72.62.74.47) - Copy to .env.production

docker/docker-compose.yml → docker-compose.yml

@@ -71,32 +71,6 @@ services:
       timeout: 3s
       retries: 5
 
-  backend:
-    # Image built in GitHub Actions and pushed to GHCR on every merge to main.
-    # To update on VPS: docker compose pull backend && docker compose up -d backend
-    image: ghcr.io/zen0space/kal-monorepo/kal-backend:latest
-    container_name: kal-backend
-    ports:
-      - "${BACKEND_PORT:-4000}:3000"
-    environment:
-      - NODE_ENV=production
-      - MONGODB_URI=mongodb://${MONGODB_USER}:${MONGODB_PASSWORD}@mongodb:27017/${MONGODB_DATABASE}?authSource=admin
-      - REDIS_URL=redis://redis:6379
-      - LOGTO_ENDPOINT=${LOGTO_ENDPOINT}
-      - LOGTO_APP_ID=${LOGTO_APP_ID}
-      - LOGTO_APP_SECRET=${LOGTO_APP_SECRET}
-      - SESSION_SECRET=${SESSION_SECRET}
-      - GLM_API_BASE_URL=${GLM_API_BASE_URL}
-      - GLM_API_KEY=${GLM_API_KEY}
-      - INTERNAL_API_KEY=${INTERNAL_API_KEY}
-      - FRONTEND_URL=${FRONTEND_URL}
-    depends_on:
-      - mongodb
-      - logto
-      - redis
-    networks:
-      - kal-network
-
 volumes:
   mongodb_data:
   postgres_data:

packages/kal-backend/src/index.ts

@@ -7,6 +7,7 @@
 import express from "express";
 import session from "express-session";
 import helmet from "helmet";
+import { quickChat } from "kal-baml";
 import { API_BASE_PATH } from "kal-shared";
 import swaggerUi from "swagger-ui-express";
 
@@ -26,7 +27,8 @@
   configureServerTimeouts,
 } from "./middleware/timeout.js";
 import { apiRouter } from "./routers/api.js";
+import { chatStreamRouter } from "./routes/chat-stream.js";
 import { appRouter } from "./routers/index.js";
 
 const PORT = process.env.BACKEND_PORT || 3000;
 
@@ -43,6 +45,17 @@
     console.log("⚠️  Redis not available (caching disabled)");
   }
 
+  // Verify BAML/LLM connection (Anthropic via Pika AI proxy)
+  try {
+    await quickChat("Say hi in one word.", "Respond with a single word only.");
+    console.log("✅ BAML connected (claude-haiku-4.5 via pikaai.xyz)");
+  } catch (error) {
+    console.warn(
+      "⚠️  BAML/LLM connection failed:",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+
   const app = express();
 
   // Security headers (Helmet)
@@ -95,6 +108,7 @@
 
   // Apply PRIVATE CORS to everything else (tRPC, health, auth routes)
   app.use("/trpc", cors(privateCorsOptions));
+  app.use("/api/chat", cors(privateCorsOptions));
   app.use("/health", cors(privateCorsOptions));
 
   // Request timeout middleware (scalable - uses native req.setTimeout)
@@ -285,6 +299,9 @@
     `);
   });
 
+  // Chat SSE streaming endpoint (private — requires x-logto-id header)
+  app.use("/api/chat", chatStreamRouter);
+
   // REST API routes
   app.use(API_BASE_PATH, apiRouter);