@aion0/forge 0.6.1 → 0.8.0

package/app/api/browser-bridge/route.ts

@@ -0,0 +1,70 @@
+/**
+ * Browser bridge HTTP API — thin proxy from Next.js into the standalone.
+ *
+ * The standalone (lib/browser-bridge-standalone.ts) holds the WebSocket
+ * server and per-extension token state. Next.js exposes a small surface
+ * for in-Forge code paths (chat backend, settings UI):
+ *
+ *   GET  /api/browser-bridge?action=status
+ *   POST /api/browser-bridge { action: "rpc", method, params }
+ *   POST /api/browser-bridge { action: "push", topic, payload }
+ *
+ * Pairing is gone — the extension authenticates with the user's existing
+ * Forge token over the WS hello frame.
+ */
+
+import { NextResponse } from 'next/server';
+
+const BRIDGE_PORT = Number(process.env.BRIDGE_PORT) || 8407;
+const BRIDGE_URL = `http://localhost:${BRIDGE_PORT}`;
+
+async function forward(path: string, init?: RequestInit): Promise<NextResponse> {
+  try {
+    const r = await fetch(`${BRIDGE_URL}${path}`, init);
+    const text = await r.text();
+    // Pass through JSON if possible
+    try {
+      return NextResponse.json(JSON.parse(text), { status: r.status });
+    } catch {
+      return new NextResponse(text, { status: r.status });
+    }
+  } catch (e) {
+    return NextResponse.json(
+      { error: 'bridge_unreachable', detail: (e as Error).message },
+      { status: 502 },
+    );
+  }
+}
+
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const action = url.searchParams.get('action') || 'status';
+  if (action === 'status') {
+    return forward('/api/status');
+  }
+  return NextResponse.json({ error: 'unknown action' }, { status: 400 });
+}
+
+export async function POST(req: Request) {
+  const body = await req.json().catch(() => ({}));
+  const action = body?.action;
+
+  switch (action) {
+    case 'rpc':
+      return forward('/api/rpc', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ method: body.method, params: body.params }),
+      });
+
+    case 'push':
+      return forward('/api/push', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ topic: body.topic, payload: body.payload }),
+      });
+
+    default:
+      return NextResponse.json({ error: 'unknown action' }, { status: 400 });
+  }
+}

package/app/api/chat/sessions/[id]/events/route.ts

@@ -0,0 +1,17 @@
+/**
+ * GET /api/chat/sessions/<id>/events — SSE stream of agent events.
+ *
+ * Proxied to chat-standalone (port 8408). Used by surfaces that don't
+ * subscribe via the browser bridge (web /chat tab, future server-side
+ * consumers). The extension still receives events through its persistent
+ * WS to the bridge — both paths emit the same AgentEvent payloads.
+ */
+
+import { proxyToChat } from '@/lib/chat/proxy';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  return proxyToChat(req, `/api/sessions/${encodeURIComponent(id)}/events`);
+}

package/app/api/chat/sessions/[id]/fork/route.ts

@@ -0,0 +1,15 @@
+/**
+ * POST /api/chat/sessions/<id>/fork  { title?, up_to_ts? } → { session }
+ *
+ * Copy a session's messages into a brand-new (temp) session and return
+ * the fork. Used by the chat header "⑂ Fork" button to branch the main
+ * conversation without losing it. The new session is meta.kind = 'temp'
+ * so the user can delete it later from the picker.
+ */
+
+import { proxyToChat } from '@/lib/chat/proxy';
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  return proxyToChat(req, `/api/sessions/${encodeURIComponent(id)}/fork`);
+}

package/app/api/chat/sessions/[id]/messages/route.ts

@@ -0,0 +1,21 @@
+/**
+ * POST /api/chat/sessions/<id>/messages → 202 { topic }
+ *
+ * Proxied to chat-standalone (port 8408), which runs the agent loop
+ * asynchronously and fanouts events to both the browser bridge
+ * (`chat:<session_id>`) and local SSE subscribers.
+ */
+
+import { proxyToChat } from '@/lib/chat/proxy';
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  return proxyToChat(req, `/api/sessions/${encodeURIComponent(id)}/messages`);
+}
+
+// DELETE drops all messages but keeps the session row (used by the main
+// chat's "clear" button — main session can't be deleted, only cleared).
+export async function DELETE(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  return proxyToChat(req, `/api/sessions/${encodeURIComponent(id)}/messages`);
+}

package/app/api/chat/sessions/[id]/route.ts

@@ -0,0 +1,23 @@
+/**
+ * Per-session proxy to chat-standalone:
+ *   GET    /api/chat/sessions/<id>     { session, messages }
+ *   PATCH  /api/chat/sessions/<id>     partial update
+ *   DELETE /api/chat/sessions/<id>     cascade delete
+ */
+
+import { proxyToChat } from '@/lib/chat/proxy';
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  return proxyToChat(req, `/api/sessions/${encodeURIComponent(id)}`);
+}
+
+export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  return proxyToChat(req, `/api/sessions/${encodeURIComponent(id)}`);
+}
+
+export async function DELETE(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  return proxyToChat(req, `/api/sessions/${encodeURIComponent(id)}`);
+}

package/app/api/chat/sessions/route.ts

@@ -0,0 +1,12 @@
+/**
+ * Thin proxy to chat-standalone (port 8408):
+ *   GET  /api/chat/sessions   → list
+ *   POST /api/chat/sessions   → create
+ *
+ * Auth handled by middleware (session cookie OR X-Forge-Token).
+ */
+
+import { proxyToChat } from '@/lib/chat/proxy';
+
+export async function GET(req: Request)  { return proxyToChat(req, '/api/sessions'); }
+export async function POST(req: Request) { return proxyToChat(req, '/api/sessions'); }

package/app/api/chat/temper-ping/route.ts

@@ -0,0 +1,18 @@
+/**
+ * POST /api/chat/temper-ping
+ *
+ * Reachability probe for the chat memory backend. If Temper URL+key are
+ * configured, pings Temper at /v1/memory/blocks?pinned=true. Otherwise
+ * pings the LocalMemoryStore (SQLite). Returns { ok, message, pinned,
+ * backend } — `backend` is 'temper' | 'local' so the settings UI can
+ * label which one is active.
+ */
+
+import { NextResponse } from 'next/server';
+import { getMemoryStore } from '@/lib/chat/memory-store';
+
+export async function POST() {
+  const store = getMemoryStore();
+  const r = await store.ping();
+  return NextResponse.json({ ...r, backend: store.kind });
+}

package/app/api/chat-proxy/[...path]/route.ts

@@ -0,0 +1,83 @@
+/**
+ * Catch-all proxy from the Forge web app to the chat-standalone server
+ * (127.0.0.1:$CHAT_PORT, default 8408). Lets the in-app /chat page hit
+ * the same routes the browser extension uses, without exposing 8408
+ * publicly or re-implementing auth.
+ *
+ * The middleware on this server (port 8403) gates access via cookie/
+ * token; once a request reaches here it's authenticated, so we can
+ * forward to loopback without further checks.
+ *
+ * SSE pass-through: when upstream returns text/event-stream we stream
+ * the body verbatim so the /chat page gets live tokens.
+ */
+
+import { NextResponse } from 'next/server';
+
+const CHAT_BASE = `http://127.0.0.1:${process.env.CHAT_PORT || 8408}`;
+
+async function forward(
+  req: Request,
+  ctx: { params: Promise<{ path: string[] }> },
+): Promise<Response> {
+  const { path } = await ctx.params;
+  const segs = (path || []).map(encodeURIComponent).join('/');
+  const search = new URL(req.url).search;
+  const target = `${CHAT_BASE}/api/${segs}${search}`;
+
+  const headers: Record<string, string> = {};
+  const ct = req.headers.get('content-type');
+  if (ct) headers['content-type'] = ct;
+  const accept = req.headers.get('accept');
+  if (accept) headers['accept'] = accept;
+
+  const init: RequestInit = { method: req.method, headers };
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    init.body = await req.text();
+  }
+
+  let upstream: Response;
+  try {
+    upstream = await fetch(target, init);
+  } catch (err) {
+    return NextResponse.json(
+      {
+        error: 'chat backend unreachable',
+        detail: err instanceof Error ? err.message : String(err),
+        target,
+      },
+      { status: 502 },
+    );
+  }
+
+  const upstreamCt = upstream.headers.get('content-type') || '';
+  if (upstreamCt.includes('text/event-stream')) {
+    return new Response(upstream.body, {
+      status: upstream.status,
+      headers: {
+        'content-type': 'text/event-stream',
+        'cache-control': 'no-cache, no-transform',
+        connection: 'keep-alive',
+        'x-accel-buffering': 'no',
+      },
+    });
+  }
+
+  return new Response(upstream.body, {
+    status: upstream.status,
+    headers: { 'content-type': upstreamCt || 'application/json' },
+  });
+}
+
+export async function GET(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}
+export async function POST(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}
+export async function PATCH(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}
+export async function DELETE(req: Request, ctx: { params: Promise<{ path: string[] }> }) {
+  return forward(req, ctx);
+}

package/app/api/connector-tool/route.ts

@@ -0,0 +1,38 @@
+/**
+ * POST /api/connector-tool
+ *
+ * Single-tool dispatch for internal callers (pipelines, jobs, CLI). Wraps
+ * lib/chat/tool-dispatcher.dispatchTool so http/shell/browser connectors
+ * are all callable through one shape:
+ *
+ *   { "plugin_id": "teams", "tool": "send_message",
+ *     "input": { "name": "Alice", "text": "MR ready: https://..." } }
+ *
+ * Returns the tool_result shape: { content: string, is_error?: boolean }.
+ *
+ * Loopback-only — middleware skips auth for this path on 127.0.0.1 /
+ * localhost; outside-host requests fall back to the normal X-Forge-Token
+ * check.
+ */
+
+import { NextResponse } from 'next/server';
+import { dispatchTool } from '@/lib/chat/tool-dispatcher';
+
+export async function POST(req: Request) {
+  let body: any = {};
+  try { body = await req.json(); } catch {}
+  const pluginId = String(body?.plugin_id || '').trim();
+  const tool = String(body?.tool || '').trim();
+  if (!pluginId || !tool) {
+    return NextResponse.json({ error: 'plugin_id and tool are required' }, { status: 400 });
+  }
+  const name = `${pluginId}.${tool}`;
+  const result = await dispatchTool({
+    id: `internal-${Date.now()}`,
+    name,
+    input: body?.input ?? {},
+  });
+  // Always 200 — the result carries is_error if the dispatched tool failed.
+  // (Network / wiring errors throw inside dispatchTool and bubble as 500.)
+  return NextResponse.json(result);
+}

package/app/api/connectors/[id]/settings/route.ts

@@ -0,0 +1,112 @@
+/**
+ * Per-user settings for a connector plugin.
+ *
+ * Browser-side connectors don't have a Forge-side executor, so "install" is
+ * really just "save your host URL + preferences". We map connector `settings`
+ * onto the existing plugin config storage to avoid a second store.
+ */
+
+import { NextResponse } from 'next/server';
+import {
+  getPlugin,
+  getInstalledPlugin,
+  installPlugin,
+  updatePluginConfig,
+  getConnectorsForPlugin,
+} from '@/lib/plugins/registry';
+import type { PluginFieldSchema } from '@/lib/plugins/types';
+
+function settingsSchemaFor(id: string): Record<string, PluginFieldSchema> {
+  const def = getPlugin(id);
+  if (!def) return {};
+  // For 1:N suites, merge settings across all entries (caller can scope by entry id).
+  const merged: Record<string, PluginFieldSchema> = {};
+  for (const c of getConnectorsForPlugin(def)) {
+    if (c.settings) Object.assign(merged, c.settings);
+  }
+  return merged;
+}
+
+function defaultsFor(id: string): Record<string, any> {
+  const schema = settingsSchemaFor(id);
+  const out: Record<string, any> = {};
+  for (const [k, v] of Object.entries(schema)) {
+    if (v.default !== undefined) out[k] = v.default;
+  }
+  return out;
+}
+
+const SECRET_MASK = '••••••••';
+
+function isSecretField(schema: PluginFieldSchema | undefined): boolean {
+  if (!schema) return false;
+  return schema.type === 'secret' || (schema.type as string) === 'password';
+}
+
+function maskSecrets(settings: Record<string, any>, schema: Record<string, PluginFieldSchema>): Record<string, any> {
+  const out: Record<string, any> = { ...settings };
+  for (const [k, v] of Object.entries(schema)) {
+    if (isSecretField(v) && typeof out[k] === 'string' && out[k]) {
+      out[k] = SECRET_MASK;
+    }
+  }
+  return out;
+}
+
+function restoreSecrets(
+  incoming: Record<string, any>,
+  existing: Record<string, any>,
+  schema: Record<string, PluginFieldSchema>,
+): Record<string, any> {
+  const out: Record<string, any> = { ...incoming };
+  for (const [k, v] of Object.entries(schema)) {
+    if (isSecretField(v) && out[k] === SECRET_MASK) {
+      if (typeof existing[k] === 'string') out[k] = existing[k];
+      else delete out[k];
+    }
+  }
+  return out;
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const def = getPlugin(id);
+  if (!def || def.category !== 'connector') {
+    return NextResponse.json({ error: 'connector not found' }, { status: 404 });
+  }
+  const inst = getInstalledPlugin(id);
+  const stored = inst?.config || {};
+  const schema = settingsSchemaFor(id);
+  const merged = { ...defaultsFor(id), ...stored };
+  return NextResponse.json({
+    settings: maskSecrets(merged, schema),
+    schema,
+    installed: !!inst,
+  });
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const def = getPlugin(id);
+  if (!def || def.category !== 'connector') {
+    return NextResponse.json({ error: 'connector not found' }, { status: 404 });
+  }
+
+  const body = await req.json().catch(() => ({}));
+  const settings = body?.settings ?? body;
+  if (typeof settings !== 'object' || settings === null) {
+    return NextResponse.json({ error: 'settings must be an object' }, { status: 400 });
+  }
+
+  const existing = getInstalledPlugin(id);
+  const schema = settingsSchemaFor(id);
+  const merged = restoreSecrets(settings, existing?.config || {}, schema);
+  const ok = existing
+    ? updatePluginConfig(id, merged)
+    : installPlugin(id, merged);
+
+  if (!ok) {
+    return NextResponse.json({ error: 'failed to persist settings' }, { status: 500 });
+  }
+  return NextResponse.json({ ok: true, settings: maskSecrets(merged, schema) });
+}

package/app/api/connectors/route.ts

@@ -0,0 +1,108 @@
+/**
+ * Connectors API — discovery surface for the Forge browser extension.
+ *
+ * The extension hits this endpoint to learn what connector plugins are
+ * installed and what tools they advertise. The new declarative-script
+ * design (see docs/Connector-DeclarativeExtract-Spec.md) means each tool
+ * carries its own `page` (where to navigate) and `script` (function body
+ * to run in the user's tab). Forge expands {base_url} / {settings.*}
+ * tokens here using the user's saved settings; {args.*} is left literal
+ * for the extension's runner to expand at execution time.
+ */
+
+import { NextResponse } from 'next/server';
+import {
+  listPlugins,
+  getPlugin,
+  getInstalledPlugin,
+  getConnectorsForPlugin,
+} from '@/lib/plugins/registry';
+import { expandSettingsTokens } from '@/lib/plugins/templates';
+import type { Connector, ConnectorTool, PluginDefinition } from '@/lib/plugins/types';
+
+// Auth is handled by middleware (session cookie OR X-Forge-Token).
+
+function expandTool(tool: ConnectorTool, settings: Record<string, any> | undefined): ConnectorTool {
+  if (!tool.page && !tool.script) return tool;
+  const page = tool.page
+    ? {
+        url: expandSettingsTokens(tool.page.url, settings),
+        ...(tool.page.on_target
+          ? { on_target: expandSettingsTokens(tool.page.on_target, settings) }
+          : {}),
+      }
+    : undefined;
+  return { ...tool, ...(page ? { page } : {}) };
+}
+
+function expandConnector(entry: Connector, settings: Record<string, any> | undefined): Connector {
+  const out: Connector = {
+    ...entry,
+    tools: Object.fromEntries(
+      Object.entries(entry.tools).map(([name, t]) => [name, expandTool(t, settings)]),
+    ),
+  };
+  if (entry.host_match) out.host_match = expandSettingsTokens(entry.host_match, settings);
+  if (entry.login_redirect) out.login_redirect = expandSettingsTokens(entry.login_redirect, settings);
+  return out;
+}
+
+function toConnectorPayload(def: PluginDefinition) {
+  const inst = getInstalledPlugin(def.id);
+  const settings = inst?.config;
+  const entries = getConnectorsForPlugin(def).map(e => expandConnector(e, settings));
+
+  // Hoist host_match / login_redirect to plugin level for 1:1 cases — the
+  // common case (and what the spec example shows). Pull from the first entry
+  // when those came from the top-level plugin fields.
+  const hostMatch = def.host_match
+    ? expandSettingsTokens(def.host_match, settings)
+    : entries[0]?.host_match;
+  const loginRedirect = def.login_redirect
+    ? expandSettingsTokens(def.login_redirect, settings)
+    : entries[0]?.login_redirect;
+  // Default to 'main' so existing connectors (Mantis, GitLab) keep their
+  // current execution path. Plugins on strict-CSP sites opt into 'isolated'.
+  const runner = def.runner || entries[0]?.runner || 'main';
+
+  return {
+    plugin_id: def.id,
+    name: def.name,
+    icon: def.icon,
+    version: def.version,
+    author: def.author || 'forge',
+    description: def.description || '',
+    mode: def.mode || 'browser-side',
+    installed: !!inst,
+    ...(hostMatch ? { host_match: hostMatch } : {}),
+    ...(loginRedirect ? { login_redirect: loginRedirect } : {}),
+    runner,
+    entries,
+  };
+}
+
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const id = url.searchParams.get('id');
+
+  // Single-connector detail
+  if (id) {
+    const def = getPlugin(id);
+    if (!def || def.category !== 'connector') {
+      return NextResponse.json({ error: 'connector not found' }, { status: 404 });
+    }
+    return NextResponse.json({ connector: toConnectorPayload(def) });
+  }
+
+  // List all connectors (installed or not — extension surfaces both for marketplace)
+  const onlyInstalled = url.searchParams.get('installed') === 'true';
+  const sources = listPlugins().filter(s => s.category === 'connector');
+
+  const connectors = sources
+    .map(s => getPlugin(s.id))
+    .filter((d): d is PluginDefinition => !!d)
+    .filter(d => !onlyInstalled || !!getInstalledPlugin(d.id))
+    .map(toConnectorPayload);
+
+  return NextResponse.json({ connectors });
+}

package/app/api/health/tools/route.ts

@@ -0,0 +1,14 @@
+/**
+ * GET /api/health/tools — array of external-tool checks (glab, gh, git, jq).
+ *
+ * Used by the Pipelines view to show a banner when something needed by a
+ * built-in workflow is missing, with install instructions inline. See
+ * lib/health.ts for the catalog and `[tools]` startup log lines.
+ */
+
+import { NextResponse } from 'next/server';
+import { checkTools } from '@/lib/health';
+
+export async function GET() {
+  return NextResponse.json({ tools: checkTools() });
+}

package/app/api/issue-scanner-gitlab/route.ts

@@ -0,0 +1,95 @@
+import { NextResponse } from 'next/server';
+import {
+  getConfig, saveConfig, listConfigs, scanAndTrigger,
+  startScanner, getProcessedIssues, resetProcessedIssue,
+  type GitLabAutofixConfig,
+} from '@/lib/issue-scanner-gitlab';
+import { startPipeline } from '@/lib/pipeline';
+
+// GET /api/issue-scanner-gitlab?project=PATH
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url);
+  const projectPath = searchParams.get('project');
+  if (projectPath) {
+    return NextResponse.json({
+      config: getConfig(projectPath),
+      processed: getProcessedIssues(projectPath),
+    });
+  }
+  return NextResponse.json({ configs: listConfigs() });
+}
+
+// POST /api/issue-scanner-gitlab
+export async function POST(req: Request) {
+  const body = await req.json();
+
+  if (body.action === 'save-config') {
+    const c: GitLabAutofixConfig = {
+      projectPath: body.projectPath,
+      projectName: body.projectName,
+      enabled: !!body.enabled,
+      interval: body.interval || 30,
+      labels: body.labels || [],
+      baseBranch: body.baseBranch || '',
+      baseBranchRule: body.baseBranchRule || 'milestone',
+      mrTitleTemplate: body.mrTitleTemplate || '',
+      mrBodyTemplate: body.mrBodyTemplate || '',
+      assigneeFilter: body.assigneeFilter ?? 'me',
+    };
+    saveConfig(c);
+    startScanner();
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'scan') {
+    const c = getConfig(body.projectPath);
+    if (!c) return NextResponse.json({ error: 'Not configured' }, { status: 400 });
+    return NextResponse.json(scanAndTrigger(c));
+  }
+
+  if (body.action === 'trigger') {
+    const c = getConfig(body.projectPath);
+    const projectName = c?.projectName || body.projectName;
+    try {
+      const pipeline = startPipeline('gitlab-issue-fix-and-review', {
+        issue_id: String(body.issueId),
+        project: projectName,
+        base_branch: body.baseBranch || c?.baseBranch || 'auto',
+        base_branch_rule: c?.baseBranchRule || 'milestone',
+        mr_title_template: c?.mrTitleTemplate || '',
+        mr_body_template: c?.mrBodyTemplate || '',
+        extra_context: body.context || '',
+      });
+      return NextResponse.json({ ok: true, pipelineId: pipeline.id });
+    } catch (e) {
+      return NextResponse.json({ ok: false, error: String(e) }, { status: 500 });
+    }
+  }
+
+  if (body.action === 'reset') {
+    resetProcessedIssue(body.projectPath, body.issueId);
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'retry') {
+    resetProcessedIssue(body.projectPath, body.issueId);
+    const c = getConfig(body.projectPath);
+    const projectName = c?.projectName || body.projectName;
+    try {
+      const pipeline = startPipeline('gitlab-issue-fix-and-review', {
+        issue_id: String(body.issueId),
+        project: projectName,
+        base_branch: c?.baseBranch || 'auto',
+        base_branch_rule: c?.baseBranchRule || 'milestone',
+        mr_title_template: c?.mrTitleTemplate || '',
+        mr_body_template: c?.mrBodyTemplate || '',
+        extra_context: body.context || '',
+      });
+      return NextResponse.json({ ok: true, pipelineId: pipeline.id });
+    } catch (e) {
+      return NextResponse.json({ ok: false, error: String(e) }, { status: 500 });
+    }
+  }
+
+  return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+}

package/app/api/jobs/[id]/reset_dedup/route.ts

@@ -0,0 +1,15 @@
+/**
+ * POST /api/jobs/<id>/reset_dedup — wipe job_seen for this job so the
+ * next tick re-dispatches every item it finds.
+ */
+
+import { NextResponse } from 'next/server';
+import { getJob, resetDedup } from '@/lib/jobs/store';
+
+export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const job = getJob(id);
+  if (!job) return NextResponse.json({ error: 'job not found' }, { status: 404 });
+  const removed = resetDedup(id);
+  return NextResponse.json({ ok: true, removed });
+}