@0xmaxma/claude-gateway 1.0.0

package/dist/api/router.js

@@ -0,0 +1,1098 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiRouter = createApiRouter;
+const express_1 = require("express");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const fsp = __importStar(require("fs/promises"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const auth_1 = require("./auth");
+const media_store_1 = require("../history/media-store");
+const db_1 = require("../history/db");
+const MAX_MESSAGE_LENGTH = 10000;
+const DEFAULT_TIMEOUT_MS = 60000;
+const AGENT_ID_RE = /^[a-z][a-z0-9_-]{1,31}$/;
+const SAFE_FILENAME_RE = /^[a-zA-Z0-9._\-() ]+$/;
+// ---------------------------------------------------------------------------
+// In-memory rate limiter for media uploads (per API key)
+// ---------------------------------------------------------------------------
+const UPLOAD_RATE_LIMIT = 20; // max uploads
+const UPLOAD_RATE_WINDOW_MS = 60000; // per 60 seconds
+const uploadRateMap = new Map();
+function checkUploadRateLimit(apiKeyValue) {
+    const now = Date.now();
+    const entry = uploadRateMap.get(apiKeyValue);
+    if (!entry || now >= entry.resetAt) {
+        uploadRateMap.set(apiKeyValue, { count: 1, resetAt: now + UPLOAD_RATE_WINDOW_MS });
+        return true;
+    }
+    if (entry.count >= UPLOAD_RATE_LIMIT)
+        return false;
+    entry.count++;
+    return true;
+}
+// Periodically evict expired entries so uploadRateMap doesn't grow indefinitely
+setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of uploadRateMap) {
+        if (now >= entry.resetAt)
+            uploadRateMap.delete(key);
+    }
+}, UPLOAD_RATE_WINDOW_MS).unref();
+/** Derive a stable short ID from an API key value (never log the raw key). */
+function apiKeyId(key) {
+    return (0, crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 16);
+}
+function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models) {
+    const router = (0, express_1.Router)();
+    const auth = (0, auth_1.createApiAuthMiddleware)(apiKeys);
+    // Closure-scoped lock: serialises concurrent writes to config.json within this router instance.
+    let configWriteLock = Promise.resolve();
+    async function writeAgentsToConfigImpl(cfgPath, mutate, newId) {
+        const raw = await fsp.readFile(cfgPath, 'utf-8');
+        const config = JSON.parse(raw);
+        if (newId) {
+            const exists = config.agents.some((a) => a.id === newId);
+            if (exists)
+                throw Object.assign(new Error(`Agent '${newId}' already exists in config`), { code: 'DUPLICATE' });
+        }
+        mutate(config.agents);
+        const tmp = cfgPath + '.tmp.' + (0, crypto_1.randomUUID)();
+        await fsp.writeFile(tmp, JSON.stringify(config, null, 2), 'utf-8');
+        await fsp.rename(tmp, cfgPath);
+    }
+    function writeAgentsToConfig(cfgPath, mutate, newId) {
+        const next = configWriteLock.catch(() => { }).then(() => writeAgentsToConfigImpl(cfgPath, mutate, newId));
+        configWriteLock = next.catch(() => { });
+        return next;
+    }
+    /**
+     * GET /api/v1/commands
+     *
+     * Return the list of slash commands available in the chat UI. No auth required.
+     */
+    router.get('/v1/commands', (_req, res) => {
+        res.json({
+            commands: [
+                { name: '/session', description: 'Show current session info (name, message count, context %)' },
+                { name: '/clear', description: 'Clear current session history' },
+                { name: '/compact', description: 'Summarise old history and keep only recent messages' },
+                { name: '/stop', description: 'Interrupt the in-flight turn' },
+                { name: '/restart', description: 'Graceful session restart' },
+                { name: '/model', description: 'Show the current AI model' },
+            ],
+        });
+    });
+    /**
+     * POST /api/v1/agents/:agentId/messages
+     *
+     * Send a message to an agent and receive its response synchronously.
+     * Body: { message: string, chat_id: string, session_id?: string }
+     */
+    router.post('/v1/agents/:agentId/messages', auth, async (req, res) => {
+        const { agentId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const body = req.body;
+        const { message, chat_id, session_id, stream, timeout_ms, media_files } = body;
+        if (!message || typeof message !== 'string' || !message.trim()) {
+            res.status(400).json({ error: 'message is required and must be a non-empty string' });
+            return;
+        }
+        if (message.length > MAX_MESSAGE_LENGTH) {
+            res.status(400).json({ error: `message too long (max ${MAX_MESSAGE_LENGTH} characters)` });
+            return;
+        }
+        if (!chat_id || typeof chat_id !== 'string' || !chat_id.trim()) {
+            res.status(400).json({ error: 'chat_id is required and must be a non-empty string' });
+            return;
+        }
+        if (!/^[a-zA-Z0-9_-]{1,64}$/.test(chat_id.trim())) {
+            res.status(400).json({ error: 'chat_id must be 1-64 alphanumeric characters, hyphens, or underscores' });
+            return;
+        }
+        if (session_id !== undefined && typeof session_id !== 'string') {
+            res.status(400).json({ error: 'session_id must be a string if provided' });
+            return;
+        }
+        // Validate media_files
+        let validatedMediaFiles;
+        if (media_files !== undefined) {
+            if (!Array.isArray(media_files) || media_files.some((f) => typeof f !== 'string')) {
+                res.status(400).json({ error: 'media_files must be an array of strings' });
+                return;
+            }
+            if (media_files.length > 5) {
+                res.status(400).json({ error: 'media_files exceeds maximum of 5 images per message' });
+                return;
+            }
+            // Validate each path is within agent media root (path traversal guard)
+            const routerAgentsBaseDir = runner.getAgentsBaseDir();
+            for (const f of media_files) {
+                try {
+                    media_store_1.MediaStore.resolvePath(routerAgentsBaseDir, agentId, f);
+                }
+                catch {
+                    res.status(400).json({ error: `Invalid media path: ${f}` });
+                    return;
+                }
+            }
+            validatedMediaFiles = media_files;
+        }
+        const requestId = (0, crypto_1.randomUUID)();
+        const sessionId = session_id ?? (0, crypto_1.randomUUID)();
+        const chatIdStr = chat_id.trim();
+        const startTime = Date.now();
+        const timeoutMs = typeof timeout_ms === 'number' && timeout_ms > 0 && timeout_ms <= 600000
+            ? timeout_ms
+            : DEFAULT_TIMEOUT_MS;
+        // Slash command dispatch — runs instead of sending to Claude
+        if (message.trim().startsWith('/')) {
+            try {
+                const result = await runner.executeApiCommand(sessionId, chatIdStr, message.trim());
+                res.json({ command: message.trim(), session_id: sessionId, result });
+            }
+            catch (err) {
+                res.status(500).json({ error: err.message ?? 'Command failed' });
+            }
+            return;
+        }
+        if (stream) {
+            // SSE streaming mode
+            let cleanup;
+            try {
+                const sseCallbacks = {
+                    onChunk: (event) => {
+                        try {
+                            res.write(`data: ${JSON.stringify(event)}\n\n`);
+                        }
+                        catch { /* client gone */ }
+                    },
+                    onDone: (fullText) => {
+                        try {
+                            res.write(`data: ${JSON.stringify({ type: 'result', text: fullText, request_id: requestId, session_id: sessionId, duration_ms: Date.now() - startTime })}\n\n`);
+                            res.write('data: [DONE]\n\n');
+                            res.end();
+                        }
+                        catch { /* client gone */ }
+                    },
+                    onError: (err) => {
+                        try {
+                            res.write(`data: ${JSON.stringify({ type: 'error', message: err.message })}\n\n`);
+                            res.end();
+                        }
+                        catch { /* client gone */ }
+                    },
+                };
+                // Preflight conflict check — return 409 JSON before SSE headers are sent
+                if (runner.hasActiveApiSession(sessionId)) {
+                    res.status(409).json({ error: 'Session already has a pending request' });
+                    return;
+                }
+                res.writeHead(200, {
+                    'Content-Type': 'text/event-stream',
+                    'Cache-Control': 'no-cache',
+                    'Connection': 'keep-alive',
+                    'X-Accel-Buffering': 'no',
+                });
+                res.flushHeaders();
+                res.socket?.setNoDelay(true);
+                const agentCfg = agentConfigs.get(agentId);
+                const allowTools = agentCfg.allow_tools ?? !!apiKey.allow_tools;
+                cleanup = await runner.sendApiMessageStream(sessionId, chatIdStr, message.trim(), sseCallbacks, { timeoutMs, allowTools, mediaFiles: validatedMediaFiles });
+                // Client disconnect -> cleanup
+                res.on('close', cleanup);
+            }
+            catch (err) {
+                const code = err.code;
+                if (!res.headersSent) {
+                    if (code === 'CONFLICT') {
+                        res.status(409).json({ error: 'Session already has a pending request' });
+                    }
+                    else {
+                        res.status(500).json({ error: 'Internal error' });
+                    }
+                }
+                else {
+                    try {
+                        res.write(`data: ${JSON.stringify({ type: 'error', message: 'Internal error' })}\n\n`);
+                        res.end();
+                    }
+                    catch { /* client gone */ }
+                }
+            }
+        }
+        else {
+            // Synchronous mode (existing behavior)
+            try {
+                const agentCfgSync = agentConfigs.get(agentId);
+                const allowToolsSync = agentCfgSync.allow_tools ?? !!apiKey.allow_tools;
+                const response = await runner.sendApiMessage(sessionId, chatIdStr, message.trim(), {
+                    timeoutMs,
+                    allowTools: allowToolsSync,
+                    mediaFiles: validatedMediaFiles,
+                });
+                res.json({
+                    request_id: requestId,
+                    agent_id: agentId,
+                    response,
+                    session_id: sessionId,
+                    duration_ms: Date.now() - startTime,
+                });
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === 'TIMEOUT') {
+                    res.status(504).json({ error: 'Agent response timeout' });
+                }
+                else if (code === 'CONFLICT') {
+                    res.status(409).json({ error: 'Session already has a pending request' });
+                }
+                else {
+                    res.status(500).json({ error: 'Internal error' });
+                }
+            }
+        }
+    });
+    /**
+     * GET /api/v1/models
+     *
+     * List all supported Claude models from gateway config (falls back to defaults).
+     */
+    router.get('/v1/models', auth, (_req, res) => {
+        res.json({ models: (models ?? []).map((m) => ({ id: m.id, name: m.label, alias: m.alias, contextWindow: m.contextWindow, multiplier: m.multiplier ?? 1 })) });
+    });
+    /**
+     * GET /api/v1/agents
+     *
+     * List agents scoped to the API key. Admin keys see all agents.
+     */
+    router.get('/v1/agents', auth, (req, res) => {
+        const apiKey = req.apiKey;
+        const agents = [...agentConfigs.entries()]
+            .filter(([id]) => (0, auth_1.canAccessAgent)(apiKey, id))
+            .map(([id, cfg]) => ({
+            id,
+            description: cfg.description,
+            model: cfg.claude?.model ?? null,
+            allow_tools: cfg.allow_tools ?? false,
+        }));
+        res.json({ agents });
+    });
+    /**
+     * GET /api/v1/agents/sessions
+     *
+     * List all sessions across all agents. Admin only.
+     * Queries each agent's history DB sequentially and returns a nested agents → sessions structure.
+     */
+    router.get('/v1/agents/sessions', auth, async (req, res) => {
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.isAdmin)(apiKey)) {
+            res.status(403).json({ error: 'Admin key required' });
+            return;
+        }
+        const agents = await Promise.all([...agentRunners.entries()].map(async ([agentId, runner]) => {
+            const cfg = agentConfigs.get(agentId);
+            const [sessions, nameMap] = await Promise.all([
+                Promise.resolve(runner.getHistoryDb().listSessions()),
+                runner.getAllSessionNames(),
+            ]);
+            return {
+                agentId,
+                description: cfg?.description ?? '',
+                sessions: sessions.map((s) => ({ ...s, sessionName: nameMap.get(s.sessionId) ?? null })),
+            };
+        }));
+        res.json({ agents });
+    });
+    /**
+     * POST /api/v1/agents
+     *
+     * Create a new agent entry in config.json. Requires admin key.
+     * Body: { id, description, model? }
+     */
+    router.post('/v1/agents', auth, async (req, res) => {
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.isAdmin)(apiKey)) {
+            res.status(403).json({ error: 'Admin key required to create agents' });
+            return;
+        }
+        if (!configPath) {
+            res.status(501).json({ error: 'Agent management not available (no configPath)' });
+            return;
+        }
+        const body = req.body;
+        const { id, description, model } = body;
+        if (!id || typeof id !== 'string' || !AGENT_ID_RE.test(id)) {
+            res.status(400).json({ error: 'id must match pattern [a-z][a-z0-9_-]{1,31}' });
+            return;
+        }
+        if (!description || typeof description !== 'string' || !description.trim()) {
+            res.status(400).json({ error: 'description is required' });
+            return;
+        }
+        if (agentConfigs.has(id)) {
+            res.status(409).json({ error: `Agent '${id}' already exists` });
+            return;
+        }
+        const workspace = path.join('~', '.claude-gateway', 'agents', id, 'workspace');
+        const workspaceAbs = path.join(os.homedir(), '.claude-gateway', 'agents', id, 'workspace');
+        const newAgent = {
+            id,
+            description: description.trim(),
+            workspace,
+            env: path.join('~', '.claude-gateway', 'agents', id, 'workspace', '.env'),
+            claude: {
+                model: typeof model === 'string' && model.trim() ? model.trim() : 'claude-sonnet-4-6',
+                dangerouslySkipPermissions: false,
+                extraFlags: [],
+            },
+        };
+        // Write config first — if this fails, no workspace is created (avoids orphaned directories).
+        try {
+            await writeAgentsToConfig(configPath, (agents) => agents.push(newAgent), id);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'DUPLICATE') {
+                res.status(409).json({ error: `Agent '${id}' already exists` });
+            }
+            else {
+                res.status(500).json({ error: `Failed to write config: ${err.message}` });
+            }
+            return;
+        }
+        // Config written successfully — now create workspace directory and stub files.
+        const stubFiles = {
+            'AGENTS.md': `# Agent: ${id}\n\n${description.trim()}\n`,
+            'SOUL.md': `# Soul\n\n`,
+            'USER.md': `# User Profile\n\n`,
+            'MEMORY.md': `# Memory\n\n`,
+        };
+        try {
+            fs.mkdirSync(workspaceAbs, { recursive: true });
+            for (const [filename, stub] of Object.entries(stubFiles)) {
+                const filePath = path.join(workspaceAbs, filename);
+                if (!fs.existsSync(filePath)) {
+                    fs.writeFileSync(filePath, stub, 'utf8');
+                }
+            }
+        }
+        catch (err) {
+            // Config was already written — log the workspace failure but still return 201.
+            // The agent is valid; workspace will be auto-created on next gateway start.
+            console.error(`[api] Warning: agent '${id}' created in config but workspace setup failed: ${err.message}`);
+        }
+        res.status(201).json({ agent: { id, description: newAgent.description, model: newAgent.claude.model } });
+    });
+    /**
+     * PATCH /api/v1/agents/:agentId
+     *
+     * Update agent description and/or model. Requires write access to the agent.
+     * Body: { description?, model? }
+     */
+    router.patch('/v1/agents/:agentId', auth, async (req, res) => {
+        const apiKey = req.apiKey;
+        const { agentId } = req.params;
+        if (!(0, auth_1.canWriteAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: 'Write permission required' });
+            return;
+        }
+        if (!configPath) {
+            res.status(501).json({ error: 'Agent management not available (no configPath)' });
+            return;
+        }
+        if (!agentConfigs.has(agentId)) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const body = req.body;
+        const { description, model, allow_tools } = body;
+        if (description !== undefined && (typeof description !== 'string' || !description.trim())) {
+            res.status(400).json({ error: 'description must be a non-empty string' });
+            return;
+        }
+        if (model !== undefined && (typeof model !== 'string' || !model.trim())) {
+            res.status(400).json({ error: 'model must be a non-empty string' });
+            return;
+        }
+        if (allow_tools !== undefined && typeof allow_tools !== 'boolean') {
+            res.status(400).json({ error: 'allow_tools must be a boolean' });
+            return;
+        }
+        try {
+            await writeAgentsToConfig(configPath, (agents) => {
+                const agent = agents.find((a) => a.id === agentId);
+                if (!agent)
+                    return;
+                if (description !== undefined)
+                    agent.description = description.trim();
+                if (model !== undefined) {
+                    const claude = agent.claude;
+                    if (claude)
+                        claude.model = model.trim();
+                }
+                if (allow_tools !== undefined)
+                    agent.allow_tools = allow_tools;
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: `Failed to write config: ${err.message}` });
+            return;
+        }
+        // Sync in-memory map with what was written to disk
+        const cfg = agentConfigs.get(agentId);
+        if (description !== undefined)
+            cfg.description = description.trim();
+        if (model !== undefined && cfg.claude)
+            cfg.claude.model = model.trim();
+        if (allow_tools !== undefined)
+            cfg.allow_tools = allow_tools;
+        res.json({ agent: { id: agentId, description: cfg.description, model: cfg.claude?.model, allow_tools: cfg.allow_tools ?? false } });
+    });
+    /**
+     * DELETE /api/v1/agents/:agentId
+     *
+     * Remove agent from config.json and stop the running runner. Requires admin key.
+     */
+    router.delete('/v1/agents/:agentId', auth, async (req, res) => {
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.isAdmin)(apiKey)) {
+            res.status(403).json({ error: 'Admin key required' });
+            return;
+        }
+        if (!configPath) {
+            res.status(501).json({ error: 'Agent management not available (no configPath)' });
+            return;
+        }
+        const { agentId } = req.params;
+        if (!agentConfigs.has(agentId)) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        try {
+            await writeAgentsToConfig(configPath, (agents) => {
+                const idx = agents.findIndex((a) => a.id === agentId);
+                if (idx !== -1)
+                    agents.splice(idx, 1);
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: `Failed to write config: ${err.message}` });
+            return;
+        }
+        // Stop and remove the running runner so the agent no longer responds after deletion.
+        const runner = agentRunners.get(agentId);
+        if (runner) {
+            try {
+                await runner.stop();
+            }
+            catch { /* ignore stop errors */ }
+            agentRunners.delete(agentId);
+            db_1.HistoryDB.evictDir(runner.getAgentDir(), agentId);
+        }
+        agentConfigs.delete(agentId);
+        res.json({ success: true, id: agentId });
+    });
+    // ─── Chat History API ─────────────────────────────────────────────────────────
+    /**
+     * GET /api/v1/agents/:agentId/chats
+     * List all chats (across all channels) for an agent from the history DB.
+     */
+    router.get('/v1/agents/:agentId/chats', auth, (req, res) => {
+        const { agentId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const chats = runner.getHistoryDb().listChats();
+        res.json({ chats });
+    });
+    /**
+     * GET /api/v1/agents/:agentId/chats/:chatId/sessions
+     * List sessions for a specific chat (delegated to SessionStore).
+     * chatId format: "telegram-{rawId}" | "discord-{rawId}"
+     */
+    router.get('/v1/agents/:agentId/chats/:chatId/sessions', auth, async (req, res) => {
+        const { agentId, chatId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const { source, rawChatId } = parseHistoryChatId(chatId);
+        if (source !== 'telegram' && source !== 'discord') {
+            res.status(400).json({ error: 'Sessions endpoint only supports telegram/discord chats' });
+            return;
+        }
+        try {
+            const index = await runner.listSessionsForChat(rawChatId, source);
+            res.json(index);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * GET /api/v1/agents/:agentId/chats/:chatId/messages
+     * Paginated message history (cursor-based).
+     * Query: limit, before (ts ms), after (ts ms), session_id
+     */
+    router.get('/v1/agents/:agentId/chats/:chatId/messages', auth, (req, res) => {
+        const { agentId, chatId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const query = req.query;
+        const limit = query['limit'] ? Math.min(parseInt(query['limit'], 10) || 50, 200) : 50;
+        const before = query['before'] ? parseInt(query['before'], 10) : undefined;
+        const after = query['after'] ? parseInt(query['after'], 10) : undefined;
+        const sessionId = query['session_id'] ?? undefined;
+        const page = runner.getHistoryDb().getMessages(chatId, { limit, before, after, sessionId });
+        res.json(page);
+    });
+    /**
+     * GET /api/v1/agents/:agentId/chats/:chatId/messages/search
+     * Full-text search using SQLite FTS5.
+     * Query: q, limit, offset
+     */
+    router.get('/v1/agents/:agentId/chats/:chatId/messages/search', auth, (req, res) => {
+        const { agentId, chatId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const query = req.query;
+        const q = (query['q'] ?? '').trim();
+        if (!q) {
+            res.status(400).json({ error: 'q is required' });
+            return;
+        }
+        const limit = query['limit'] ? Math.min(parseInt(query['limit'], 10) || 20, 100) : 20;
+        const offset = query['offset'] ? parseInt(query['offset'], 10) : 0;
+        const page = runner.getHistoryDb().searchMessages(chatId, q, { limit, offset });
+        res.json(page);
+    });
+    /**
+     * POST /api/v1/agents/:agentId/chats/:chatId/sessions/:sessionId/messages
+     * Inject a message into an existing channel session (cross-channel continuation).
+     * Streams the assistant response as SSE.
+     * Body: { content: string, senderName?: string }
+     */
+    router.post('/v1/agents/:agentId/chats/:chatId/sessions/:sessionId/messages', auth, async (req, res) => {
+        const { agentId, chatId, sessionId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const { source, rawChatId } = parseHistoryChatId(chatId);
+        if (source !== 'telegram' && source !== 'discord') {
+            res.status(400).json({ error: 'Cross-channel messaging only supported for telegram/discord chats' });
+            return;
+        }
+        const body = req.body;
+        const content = body.content;
+        if (!content || typeof content !== 'string' || !content.trim()) {
+            res.status(400).json({ error: 'content is required and must be a non-empty string' });
+            return;
+        }
+        if (content.length > MAX_MESSAGE_LENGTH) {
+            res.status(400).json({ error: `content too long (max ${MAX_MESSAGE_LENGTH} characters)` });
+            return;
+        }
+        const senderName = typeof body.senderName === 'string' ? body.senderName : undefined;
+        let cleanup;
+        try {
+            const sseCallbacks = {
+                onChunk: (event) => {
+                    try {
+                        res.write(`data: ${JSON.stringify(event)}\n\n`);
+                    }
+                    catch { /* client gone */ }
+                },
+                onDone: (fullText) => {
+                    try {
+                        res.write(`data: ${JSON.stringify({ type: 'result', text: fullText, session_id: sessionId })}\n\n`);
+                        res.write('data: [DONE]\n\n');
+                        res.end();
+                    }
+                    catch { /* client gone */ }
+                },
+                onError: (err) => {
+                    try {
+                        res.write(`data: ${JSON.stringify({ type: 'error', message: err.message })}\n\n`);
+                        res.end();
+                    }
+                    catch { /* client gone */ }
+                },
+            };
+            res.writeHead(200, {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                'Connection': 'keep-alive',
+                'X-Accel-Buffering': 'no',
+            });
+            res.flushHeaders();
+            res.socket?.setNoDelay(true);
+            cleanup = await runner.sendMessageToSession(rawChatId, source, sessionId, content.trim(), senderName, sseCallbacks, { timeoutMs: DEFAULT_TIMEOUT_MS });
+            res.on('close', cleanup);
+        }
+        catch (err) {
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal error' });
+            }
+            else {
+                try {
+                    res.write(`data: ${JSON.stringify({ type: 'error', message: 'Internal error' })}\n\n`);
+                    res.end();
+                }
+                catch { /* client gone */ }
+            }
+        }
+    });
+    /**
+     * POST /api/v1/agents/:agentId/media
+     * Upload a media file as raw binary body (image/* or application/pdf).
+     * Headers: Content-Type (mime type), X-Filename (optional original filename)
+     * Body: raw file bytes
+     * Returns: { mediaPath: string }  — relative path usable in message mediaFiles[]
+     */
+    router.post('/v1/agents/:agentId/media', auth, (req, res, next) => {
+        // Buffer raw body up to maxUploadBytes; express.json/urlencoded don't handle binary
+        const mimeType = (req.headers['content-type'] ?? '').split(';')[0].trim();
+        if (!media_store_1.MediaStore.isAllowedMime(mimeType)) {
+            res.status(415).json({ error: 'Unsupported file type. Allowed: image/*, application/pdf' });
+            return;
+        }
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > media_store_1.MediaStore.maxUploadBytes) {
+                if (!res.headersSent)
+                    res.status(413).json({ error: `File too large (max ${media_store_1.MediaStore.maxUploadBytes / 1024 / 1024}MB)` });
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            req.rawFileBuffer = Buffer.concat(chunks);
+            req.rawFileMime = mimeType;
+            next();
+        });
+        req.on('error', () => {
+            if (!res.headersSent)
+                res.status(500).json({ error: 'Upload stream error' });
+        });
+    }, async (req, res) => {
+        const { agentId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        // Rate limit: max 20 uploads/min per API key
+        const keyHash = (0, crypto_1.createHash)('sha256').update(apiKey.key).digest('hex').slice(0, 16);
+        if (!checkUploadRateLimit(keyHash)) {
+            res.status(429).json({ error: 'Too many uploads. Limit: 20 per minute.' });
+            return;
+        }
+        const buf = req.rawFileBuffer;
+        const mimeType = req.rawFileMime ?? '';
+        if (!buf || buf.length === 0) {
+            res.status(400).json({ error: 'No file body received' });
+            return;
+        }
+        // X-Filename: validate length, strip to basename, allow only safe characters
+        const rawFilename = req.headers['x-filename'] ?? 'upload';
+        if (rawFilename.length > 255) {
+            res.status(400).json({ error: 'X-Filename too long (max 255 chars)' });
+            return;
+        }
+        const baseName = path.basename(rawFilename).replace(/\s+/g, '_');
+        const safeBaseName = SAFE_FILENAME_RE.test(baseName) ? baseName : 'upload';
+        const rawExt = path.extname(safeBaseName).replace(/[^a-zA-Z0-9.]/g, '').slice(0, 10);
+        const ext = rawExt || (mimeType.includes('pdf') ? '.pdf' : '.bin');
+        const tmpFile = path.join(os.tmpdir(), `gw-${Date.now()}${ext}`);
+        try {
+            await fsp.writeFile(tmpFile, buf);
+            const agentsBaseDir = runner.getAgentsBaseDir();
+            // Store under ui-upload/{keyId}/ so each API key's uploads are isolated
+            const keySubdir = `ui-upload/${apiKeyId(apiKey.key)}`;
+            const mediaPath = media_store_1.MediaStore.copyToMedia(agentsBaseDir, agentId, keySubdir, tmpFile);
+            res.json({ mediaPath });
+        }
+        catch (err) {
+            res.status(500).json({ error: `Upload failed: ${err.message}` });
+        }
+        finally {
+            fsp.unlink(tmpFile).catch(() => { });
+        }
+    });
+    /**
+     * GET /api/v1/agents/:agentId/media/*filepath
+     * Serve a media file. Validates path stays within agent's media directory.
+     */
+    router.get('/v1/agents/:agentId/media/*', auth, (req, res) => {
+        const { agentId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const wildcardParam = req.params['0'] ?? '';
+        const agentsBaseDir = runner.getAgentsBaseDir();
+        let absPath;
+        try {
+            absPath = media_store_1.MediaStore.resolvePath(agentsBaseDir, agentId, wildcardParam);
+        }
+        catch {
+            res.status(400).json({ error: 'Invalid path' });
+            return;
+        }
+        if (!fs.existsSync(absPath)) {
+            res.status(404).json({ error: 'Not found' });
+            return;
+        }
+        // Cache media files for 7 days — content is immutable once written
+        res.setHeader('Cache-Control', 'private, max-age=604800, immutable');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('X-Frame-Options', 'DENY');
+        res.sendFile(absPath);
+    });
+    // Schedule hourly cleanup of stale staging uploads (files older than 24h)
+    setInterval(() => {
+        const firstRunner = agentRunners.values().next().value;
+        if (firstRunner) {
+            try {
+                media_store_1.MediaStore.cleanupStaging(firstRunner.getAgentsBaseDir());
+            }
+            catch { /* non-critical */ }
+        }
+    }, 60 * 60 * 1000).unref(); // unref so cleanup timer doesn't keep process alive
+    // ──────────────────────────────────────────────────────────────
+    // Model management
+    // ──────────────────────────────────────────────────────────────
+    /**
+     * PUT /api/v1/agents/:agentId/model
+     *
+     * Set the active model for an agent. Persists to config.json.
+     */
+    router.put('/v1/agents/:agentId/model', auth, async (req, res) => {
+        const { agentId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.isAdmin)(apiKey)) {
+            res.status(403).json({ error: 'Admin key required' });
+            return;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return;
+        }
+        const body = req.body;
+        const { model: newModel } = body;
+        if (!newModel || typeof newModel !== 'string') {
+            res.status(400).json({ error: 'model is required' });
+            return;
+        }
+        try {
+            await runner.setModel(newModel);
+            res.json({ model: newModel });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'UNKNOWN_MODEL') {
+                res.status(400).json({ error: `Unknown model: ${newModel}` });
+            }
+            else {
+                res.status(500).json({ error: 'Failed to set model' });
+            }
+        }
+    });
+    // ──────────────────────────────────────────────────────────────
+    // API Session management  (/v1/agents/:agentId/sessions/...)
+    // ──────────────────────────────────────────────────────────────
+    function resolveApiSession(req, res) {
+        const { agentId } = req.params;
+        const apiKey = req.apiKey;
+        if (!(0, auth_1.canAccessAgent)(apiKey, agentId)) {
+            res.status(403).json({ error: `API key has no access to agent '${agentId}'` });
+            return null;
+        }
+        const runner = agentRunners.get(agentId);
+        if (!runner) {
+            res.status(404).json({ error: `Agent '${agentId}' not found` });
+            return null;
+        }
+        const chatId = (req.query['chat_id'] ?? req.body?.['chat_id']);
+        if (!chatId || typeof chatId !== 'string' || !chatId.trim()) {
+            res.status(400).json({ error: 'chat_id is required' });
+            return null;
+        }
+        if (!/^[a-zA-Z0-9_-]{1,64}$/.test(chatId.trim())) {
+            res.status(400).json({ error: 'chat_id must be 1-64 alphanumeric characters, hyphens, or underscores' });
+            return null;
+        }
+        return { runner, agentId, chatId: chatId.trim() };
+    }
+    /**
+     * GET /api/v1/agents/:agentId/sessions
+     * List API sessions for a chat_id.
+     */
+    router.get('/v1/agents/:agentId/sessions', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, agentId, chatId } = ctx;
+        try {
+            const index = await runner.listApiSessions(chatId);
+            res.json(index);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * POST /api/v1/agents/:agentId/sessions
+     * Create a new API session. Optionally auto-names from a prompt.
+     */
+    router.post('/v1/agents/:agentId/sessions', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, agentId, chatId } = ctx;
+        const body = req.body;
+        const promptText = typeof body.prompt === 'string' ? body.prompt.trim() : undefined;
+        const explicitName = typeof body.name === 'string' ? body.name.trim() : undefined;
+        try {
+            const meta = await runner.createApiSession(chatId, promptText, explicitName);
+            res.status(201).json({ sessionId: meta.id, sessionName: meta.name, createdAt: meta.createdAt });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * GET /api/v1/agents/:agentId/sessions/:sessionId/info
+     */
+    router.get('/v1/agents/:agentId/sessions/:sessionId/info', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, chatId } = ctx;
+        const { sessionId } = req.params;
+        try {
+            const info = await runner.getApiSessionInfo(chatId, sessionId);
+            if (!info) {
+                res.status(404).json({ error: 'Session not found' });
+                return;
+            }
+            res.json(info);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * PATCH /api/v1/agents/:agentId/sessions/:sessionId
+     * Rename a session.
+     */
+    router.patch('/v1/agents/:agentId/sessions/:sessionId', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, chatId } = ctx;
+        const { sessionId } = req.params;
+        const body = req.body;
+        const sessionName = typeof body.sessionName === 'string' ? body.sessionName.trim() : undefined;
+        if (!sessionName) {
+            res.status(400).json({ error: 'sessionName is required' });
+            return;
+        }
+        try {
+            await runner.renameApiSession(chatId, sessionId, sessionName);
+            res.json({ sessionId, sessionName });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * DELETE /api/v1/agents/:agentId/sessions/:sessionId
+     */
+    router.delete('/v1/agents/:agentId/sessions/:sessionId', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, chatId } = ctx;
+        const { sessionId } = req.params;
+        try {
+            await runner.deleteApiSession(chatId, sessionId);
+            res.status(204).send();
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * POST /api/v1/agents/:agentId/sessions/:sessionId/clear
+     */
+    router.post('/v1/agents/:agentId/sessions/:sessionId/clear', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, chatId } = ctx;
+        const { sessionId } = req.params;
+        try {
+            const result = await runner.executeApiCommand(sessionId, chatId, '/clear');
+            res.json(result);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * POST /api/v1/agents/:agentId/sessions/:sessionId/compact
+     */
+    router.post('/v1/agents/:agentId/sessions/:sessionId/compact', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, chatId } = ctx;
+        const { sessionId } = req.params;
+        try {
+            const result = await runner.executeApiCommand(sessionId, chatId, '/compact');
+            res.json(result);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * POST /api/v1/agents/:agentId/sessions/:sessionId/stop
+     */
+    router.post('/v1/agents/:agentId/sessions/:sessionId/stop', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, chatId } = ctx;
+        const { sessionId } = req.params;
+        try {
+            const result = await runner.executeApiCommand(sessionId, chatId, '/stop');
+            res.json(result);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    /**
+     * POST /api/v1/agents/:agentId/sessions/:sessionId/restart
+     */
+    router.post('/v1/agents/:agentId/sessions/:sessionId/restart', auth, async (req, res) => {
+        const ctx = resolveApiSession(req, res);
+        if (!ctx)
+            return;
+        const { runner, chatId } = ctx;
+        const { sessionId } = req.params;
+        try {
+            const result = await runner.executeApiCommand(sessionId, chatId, '/restart');
+            res.json(result);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    return router;
+}
+function parseHistoryChatId(fullChatId) {
+    if (fullChatId.startsWith('telegram-'))
+        return { source: 'telegram', rawChatId: fullChatId.slice(9) };
+    if (fullChatId.startsWith('discord-'))
+        return { source: 'discord', rawChatId: fullChatId.slice(8) };
+    return { source: 'api', rawChatId: fullChatId };
+}
+//# sourceMappingURL=router.js.map