@aitne/daemon 0.1.7 → 0.1.9

package/dist/api/routes/dashboard/conversations.js

@@ -0,0 +1,308 @@
+import { existsSync } from "node:fs";
+import { getSessionWorkdirPath } from "../../../core/workdir.js";
+import { DASHBOARD_CHAT_SCOPE, DOCS_QA_SCOPE } from "../../../messaging/constants.js";
+import { deleteAllChatSidebarSessions, deleteChatSession, } from "../../../core/dashboard-session-cleanup.js";
+export function registerConversationsRoutes(app, deps) {
+    const { db, config } = deps;
+    // ── Events/Logs API ──
+    /** GET /events — paginated event/action log */
+    app.get("/events", (c) => {
+        const page = Math.max(1, Number(c.req.query("page") ?? "1"));
+        const limit = Math.min(Number(c.req.query("limit") ?? "50"), 100);
+        const offset = (page - 1) * limit;
+        const type = c.req.query("type");
+        const result = c.req.query("result");
+        const days = c.req.query("days"); // "1" (today), "7", "30"
+        let whereClause = "WHERE 1=1";
+        const params = [];
+        if (type) {
+            whereClause += " AND action_type = ?";
+            params.push(type);
+        }
+        if (result) {
+            whereClause += " AND result = ?";
+            params.push(result);
+        }
+        if (days) {
+            const d = Number(days);
+            if (d > 0 && d <= 365) {
+                // datetime(started_at) normalizes mixed ISO-8601 / SQL formats — the
+                // delegated_proxy.invoke writer historically inserted ISO-with-T-and-Z
+                // strings, which sort lexicographically above same-day SQL strings.
+                whereClause += " AND datetime(started_at) > datetime('now', '-' || ? || ' days')";
+                params.push(d);
+            }
+        }
+        const total = db
+            .prepare(`SELECT COUNT(*) as cnt FROM agent_actions ${whereClause}`)
+            .get(...params);
+        params.push(limit, offset);
+        const rows = db
+            .prepare(`SELECT id, event_id, action_type, trigger, model_used, model_usage_json, cost_usd,
+                tokens_input, tokens_output,
+                cache_creation_tokens, cache_read_tokens,
+                duration_ms, num_turns,
+                result, detail, started_at, completed_at, error
+         FROM agent_actions ${whereClause}
+         ORDER BY datetime(started_at) DESC, id DESC
+         LIMIT ? OFFSET ?`)
+            .all(...params);
+        return c.json({
+            events: rows,
+            pagination: {
+                page,
+                limit,
+                total: total.cnt,
+                totalPages: Math.ceil(total.cnt / limit),
+            },
+        });
+    });
+    // ── Conversations API ──
+    /** GET /conversations — paginated conversation sessions */
+    app.get("/conversations", (c) => {
+        const page = Number(c.req.query("page") ?? "1");
+        const limit = Math.min(Number(c.req.query("limit") ?? "20"), 50);
+        const offset = (page - 1) * limit;
+        const platform = c.req.query("platform");
+        const status = c.req.query("status");
+        const scope = c.req.query("scope");
+        const scopes = scope
+            ?.split(",")
+            .map((value) => value.trim())
+            .filter((value) => value.length > 0);
+        let whereClause = "WHERE 1=1";
+        const params = [];
+        if (platform) {
+            whereClause += " AND platform = ?";
+            params.push(platform);
+        }
+        if (status) {
+            whereClause += " AND status = ?";
+            params.push(status);
+        }
+        if (scopes && scopes.length > 0) {
+            if (scopes.length === 1) {
+                whereClause += " AND scope = ?";
+                params.push(scopes[0]);
+            }
+            else {
+                whereClause += ` AND scope IN (${scopes.map(() => "?").join(", ")})`;
+                params.push(...scopes);
+            }
+        }
+        else {
+            // Default view excludes docs_qa: QA transcripts are short lookups
+            // and would drown out chat in /activity. Operators opt in with the
+            // explicit `?scope=docs_qa` filter chip.
+            whereClause += " AND scope != ?";
+            params.push(DOCS_QA_SCOPE);
+        }
+        const total = db
+            .prepare(`SELECT COUNT(*) as cnt FROM conversation_sessions ${whereClause}`)
+            .get(...params);
+        params.push(limit, offset);
+        const rows = db
+            .prepare(`SELECT id, platform, channel_id, thread_id, scope, model, status,
+                message_count, started_at, last_message_at, is_dm, backend_session_id
+         FROM conversation_sessions ${whereClause}
+         ORDER BY last_message_at DESC
+         LIMIT ? OFFSET ?`)
+            .all(...params);
+        const sourcePlatformsStmt = db.prepare(`SELECT DISTINCT platform
+         FROM messages
+        WHERE session_id = ?
+        ORDER BY CASE platform
+          WHEN 'dashboard' THEN 0
+          WHEN 'whatsapp' THEN 1
+          WHEN 'telegram' THEN 2
+          WHEN 'slack' THEN 3
+          WHEN 'discord' THEN 4
+          ELSE 99
+        END, platform`);
+        const conversations = rows.map((row) => {
+            const sourcePlatforms = sourcePlatformsStmt.all(row.id).map((platformRow) => platformRow.platform);
+            const normalizedSourcePlatforms = sourcePlatforms.length > 0
+                ? sourcePlatforms
+                : row.platform !== "owner"
+                    ? [row.platform]
+                    : [];
+            const browserOnly = normalizedSourcePlatforms.length > 0
+                && normalizedSourcePlatforms.every((platform) => platform === "dashboard");
+            return {
+                id: row.id,
+                platform: row.platform,
+                channel_id: row.channel_id,
+                thread_id: row.thread_id,
+                model: row.model,
+                status: row.status,
+                message_count: row.message_count,
+                started_at: row.started_at,
+                last_message_at: row.last_message_at,
+                summary: null,
+                source_platforms: normalizedSourcePlatforms,
+                read_only_from_dashboard: normalizedSourcePlatforms.length === 0 ||
+                    normalizedSourcePlatforms.some((platform) => platform !== "dashboard"),
+                // A session is continuable when the dispatcher can actually
+                // execute against it — not when its stored SDK session id is
+                // non-null. `continueDashboardSession` legitimately writes
+                // `backend_session_id = NULL` on the `shouldInvalidateSdkSession`
+                // path, and the dispatcher falls back to fresh-execute + history
+                // injection for NULL backends. The real gates are: scope,
+                // browser-only provenance, and the workdir surviving on disk.
+                continue_available: row.scope === DASHBOARD_CHAT_SCOPE
+                    && browserOnly
+                    && existsSync(getSessionWorkdirPath(config.dataDir, row.id)),
+            };
+        });
+        return c.json({
+            conversations,
+            pagination: {
+                page,
+                limit,
+                total: total.cnt,
+                totalPages: Math.ceil(total.cnt / limit),
+            },
+        });
+    });
+    /**
+     * DELETE /conversations — bulk-delete every non-active sidebar session.
+     * Scope is hard-coded to `dashboard_chat` + `owner_dm` (what the chat
+     * sidebar shows); the live active session is filtered out so deleting
+     * "all past sessions" never kills the current chat.
+     */
+    app.delete("/conversations", (c) => {
+        const result = deleteAllChatSidebarSessions({ db, dataDir: config.dataDir });
+        return c.json({ status: "deleted", deleted: result.deleted });
+    });
+    /** DELETE /conversations/:id — delete one non-active sidebar session. */
+    app.delete("/conversations/:id", (c) => {
+        const sessionId = Number(c.req.param("id"));
+        if (!Number.isFinite(sessionId) || sessionId <= 0) {
+            return c.json({ error: "invalid_session_id" }, 400);
+        }
+        const result = deleteChatSession({
+            db,
+            dataDir: config.dataDir,
+            sessionId,
+        });
+        if (!result.ok) {
+            return c.json({ error: "delete_failed", message: result.message }, result.status);
+        }
+        return c.json({ status: "deleted", deleted: result.deleted });
+    });
+    /** GET /conversations/:id/messages — messages for a specific conversation */
+    app.get("/conversations/:id/messages", (c) => {
+        const sessionId = Number(c.req.param("id"));
+        const limit = Math.min(Number(c.req.query("limit") ?? "50"), 200);
+        const before = c.req.query("before"); // cursor-based pagination
+        let whereClause = "WHERE session_id = ?";
+        const params = [sessionId];
+        if (before) {
+            whereClause += " AND id < ?";
+            params.push(Number(before));
+        }
+        params.push(limit);
+        const rows = db
+            .prepare(`SELECT id, role, content, platform, sender_id, timestamp
+         FROM messages ${whereClause}
+         ORDER BY id DESC
+         LIMIT ?`)
+            .all(...params);
+        // Chat-attachments Phase 1 — inline attachment refs per message so
+        // the dashboard transcript can render thumbnails/download chips
+        // alongside past messages without an extra round-trip per row.
+        // Skipped when the chat_attachments table doesn't exist (older DB
+        // snapshots / tests that don't run migrations).
+        const hasAttachments = (() => {
+            try {
+                const row = db
+                    .prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name='chat_attachments'`)
+                    .get();
+                return row !== undefined;
+            }
+            catch {
+                return false;
+            }
+        })();
+        const attachmentsByMessage = new Map();
+        if (hasAttachments && rows.length > 0) {
+            const ids = rows.map((r) => r.id);
+            const placeholders = ids.map(() => "?").join(",");
+            const attachmentRows = db
+                .prepare(`SELECT message_id, id, direction, original_filename, mime_type, size_bytes, caption
+           FROM chat_attachments
+           WHERE message_id IN (${placeholders})
+           ORDER BY created_at ASC`)
+                .all(...ids);
+            for (const a of attachmentRows) {
+                let bucket = attachmentsByMessage.get(a.message_id);
+                if (!bucket) {
+                    bucket = [];
+                    attachmentsByMessage.set(a.message_id, bucket);
+                }
+                bucket.push({
+                    id: a.id,
+                    direction: a.direction,
+                    originalFilename: a.original_filename,
+                    mimeType: a.mime_type,
+                    sizeBytes: a.size_bytes,
+                    caption: a.caption,
+                });
+            }
+        }
+        const enriched = rows.map((row) => {
+            const attachments = attachmentsByMessage.get(row.id);
+            return attachments && attachments.length > 0
+                ? { ...row, attachments }
+                : row;
+        });
+        return c.json({
+            messages: enriched.reverse(), // Return in chronological order
+            hasMore: rows.length === limit,
+        });
+    });
+    // ── Search API ──
+    /** GET /search?q= — full-text search via FTS5 */
+    app.get("/search", (c) => {
+        const q = c.req.query("q");
+        if (!q || q.length < 2)
+            return c.json({ error: "query too short" }, 400);
+        if (q.length > 200)
+            return c.json({ error: "query too long" }, 400);
+        const limit = Math.min(Number(c.req.query("limit") ?? "20"), 50);
+        // Sanitize: wrap each word in double-quotes to disable FTS5 operators (NEAR, NOT, OR, etc.)
+        const safeQuery = q
+            .replace(/[^\w\s\u3000-\u9FFF\uF900-\uFAFF]/g, " ") // strip punctuation except CJK
+            .split(/\s+/)
+            .filter(Boolean)
+            .map((w) => `"${w}"`)
+            .join(" ");
+        if (!safeQuery)
+            return c.json({ actions: [], messages: [] });
+        let actions = [];
+        let messages = [];
+        try {
+            actions = db
+                .prepare(`SELECT a.id, a.action_type, a.started_at,
+                  highlight(fts_actions, 1, '<mark>', '</mark>') as snippet
+           FROM fts_actions JOIN agent_actions a ON a.id = fts_actions.rowid
+           WHERE fts_actions MATCH ? ORDER BY rank LIMIT ?`)
+                .all(safeQuery, limit);
+        }
+        catch {
+            // FTS table may not exist yet
+        }
+        try {
+            messages = db
+                .prepare(`SELECT m.id, m.role, m.timestamp, m.session_id,
+                  highlight(fts_messages, 0, '<mark>', '</mark>') as snippet
+           FROM fts_messages JOIN messages m ON m.id = fts_messages.rowid
+           WHERE fts_messages MATCH ? ORDER BY rank LIMIT ?`)
+                .all(safeQuery, limit);
+        }
+        catch {
+            // FTS table may not exist yet
+        }
+        return c.json({ actions, messages });
+    });
+}

package/dist/api/routes/dashboard/cost-approvals.d.ts

@@ -0,0 +1,28 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+/**
+ * Aggregate raw `byModelRows` into the `{ model, total_cost, session_count }`
+ * shape the dashboard expects, attributing cost to the actually-billed model
+ * from `model_usage_json` rather than the requested `model_used`. When a row
+ * has no usage breakdown we fall back to `model_used`. A row that touches
+ * multiple billed models contributes its split cost to each bucket and is
+ * counted once toward each model's `session_count`.
+ *
+ * Cost reconciliation: the SDK's `r.modelUsage[*].costUSD` covers LLM
+ * inference only — server-side tools (web_search, code_execution) appear in
+ * `r.total_cost_usd` (= row.cost_usd) but not in any per-model entry. If
+ * `Σ per-model cost < row.cost_usd`, the residual is credited to
+ * `model_used` (the requested model) so per-model totals add up to the
+ * dashboard's overall cost. Without this, a chart row's "billed total"
+ * silently drops tool-use spend.
+ */
+export declare function aggregateByBilledModel(rows: ReadonlyArray<{
+    model_used: string | null;
+    model_usage_json: string | null;
+    cost_usd: number;
+}>): Array<{
+    model: string;
+    total_cost: number;
+    session_count: number;
+}>;
+export declare function registerCostApprovalsRoutes(app: Hono, deps: ApiDependencies): void;

package/dist/api/routes/dashboard/cost-approvals.js

@@ -0,0 +1,258 @@
+import { getAgentDayBoundsUtc, getAgentDaySqlShiftModifier } from "@aitne/shared";
+/**
+ * Pre-defined static cost queries — no string interpolation of user input.
+ * `byModel` is computed in JS via `aggregateByBilledModel` because the SDK
+ * can route a request for one model to a sibling (e.g. opus-4-7 →
+ * opus-4-6[1m]); SQL `GROUP BY model_used` would lump cost under the
+ * requested model and produce a chart that disagrees with the per-row
+ * billed-model badge on the same page.
+ *
+ * `byPeriod` buckets by *agent day* via `date(started_at, ?)` where `?` is
+ * the timezone+dayBoundary shift modifier. Without the shift, a single
+ * agent day (e.g. 04:00 JST → 04:00 JST next day) gets split across two
+ * UTC calendar dates so the chart shows two half-height bars summing to
+ * the same Today-card total — the bug reported in the original screenshot
+ * where Today=$6.30 rendered as two flat ~$3.15 buckets.
+ */
+const COST_QUERIES = {
+    daily: {
+        byPeriod: `SELECT date(started_at, ?) as period,
+            SUM(cost_usd) as total_cost, COUNT(*) as session_count,
+            SUM(tokens_input) as total_input_tokens, SUM(tokens_output) as total_output_tokens
+     FROM agent_actions WHERE started_at > datetime('now', '-30 days') AND cost_usd IS NOT NULL
+     GROUP BY date(started_at, ?) ORDER BY period DESC`,
+        byModelRows: `SELECT model_used, model_usage_json, cost_usd
+     FROM agent_actions
+     WHERE started_at > datetime('now', '-30 days')
+       AND cost_usd IS NOT NULL
+       AND (model_used IS NOT NULL OR model_usage_json IS NOT NULL)`,
+        byEventType: `SELECT action_type as event_type, SUM(cost_usd) as total_cost, COUNT(*) as session_count
+     FROM agent_actions WHERE started_at > datetime('now', '-30 days') AND cost_usd IS NOT NULL
+     GROUP BY action_type ORDER BY total_cost DESC`,
+    },
+    weekly: {
+        byPeriod: `SELECT strftime('%Y-W%W', started_at, ?) as period,
+            SUM(cost_usd) as total_cost, COUNT(*) as session_count,
+            SUM(tokens_input) as total_input_tokens, SUM(tokens_output) as total_output_tokens
+     FROM agent_actions WHERE started_at > datetime('now', '-90 days') AND cost_usd IS NOT NULL
+     GROUP BY strftime('%Y-W%W', started_at, ?) ORDER BY period DESC`,
+        byModelRows: `SELECT model_used, model_usage_json, cost_usd
+     FROM agent_actions
+     WHERE started_at > datetime('now', '-90 days')
+       AND cost_usd IS NOT NULL
+       AND (model_used IS NOT NULL OR model_usage_json IS NOT NULL)`,
+        byEventType: `SELECT action_type as event_type, SUM(cost_usd) as total_cost, COUNT(*) as session_count
+     FROM agent_actions WHERE started_at > datetime('now', '-90 days') AND cost_usd IS NOT NULL
+     GROUP BY action_type ORDER BY total_cost DESC`,
+    },
+    monthly: {
+        byPeriod: `SELECT strftime('%Y-%m', started_at, ?) as period,
+            SUM(cost_usd) as total_cost, COUNT(*) as session_count,
+            SUM(tokens_input) as total_input_tokens, SUM(tokens_output) as total_output_tokens
+     FROM agent_actions WHERE started_at > datetime('now', '-365 days') AND cost_usd IS NOT NULL
+     GROUP BY strftime('%Y-%m', started_at, ?) ORDER BY period DESC`,
+        byModelRows: `SELECT model_used, model_usage_json, cost_usd
+     FROM agent_actions
+     WHERE started_at > datetime('now', '-365 days')
+       AND cost_usd IS NOT NULL
+       AND (model_used IS NOT NULL OR model_usage_json IS NOT NULL)`,
+        byEventType: `SELECT action_type as event_type, SUM(cost_usd) as total_cost, COUNT(*) as session_count
+     FROM agent_actions WHERE started_at > datetime('now', '-365 days') AND cost_usd IS NOT NULL
+     GROUP BY action_type ORDER BY total_cost DESC`,
+    },
+};
+/**
+ * Aggregate raw `byModelRows` into the `{ model, total_cost, session_count }`
+ * shape the dashboard expects, attributing cost to the actually-billed model
+ * from `model_usage_json` rather than the requested `model_used`. When a row
+ * has no usage breakdown we fall back to `model_used`. A row that touches
+ * multiple billed models contributes its split cost to each bucket and is
+ * counted once toward each model's `session_count`.
+ *
+ * Cost reconciliation: the SDK's `r.modelUsage[*].costUSD` covers LLM
+ * inference only — server-side tools (web_search, code_execution) appear in
+ * `r.total_cost_usd` (= row.cost_usd) but not in any per-model entry. If
+ * `Σ per-model cost < row.cost_usd`, the residual is credited to
+ * `model_used` (the requested model) so per-model totals add up to the
+ * dashboard's overall cost. Without this, a chart row's "billed total"
+ * silently drops tool-use spend.
+ */
+export function aggregateByBilledModel(rows) {
+    const map = new Map();
+    // Per-row scratch; a single row counts toward `session_count` exactly once
+    // per model it touched, even when residual handling credits the same model
+    // twice (once from per-model breakdown, once from tool-use residual).
+    const addCost = (model, cost) => {
+        const bucket = map.get(model) ?? { total_cost: 0, session_count: 0 };
+        bucket.total_cost += cost;
+        map.set(model, bucket);
+    };
+    const incSession = (rowSeen, model) => {
+        if (rowSeen.has(model))
+            return;
+        rowSeen.add(model);
+        const bucket = map.get(model) ?? { total_cost: 0, session_count: 0 };
+        bucket.session_count += 1;
+        map.set(model, bucket);
+    };
+    // 0.0001¢ — below this, treat the residual as float-arithmetic noise and
+    // skip the bookkeeping. Real tool-use costs are always orders of magnitude
+    // above this.
+    const RESIDUAL_EPSILON_USD = 0.000001;
+    for (const row of rows) {
+        const seenForRow = new Set();
+        let parsed = null;
+        if (row.model_usage_json) {
+            try {
+                parsed = JSON.parse(row.model_usage_json);
+            }
+            catch {
+                parsed = null;
+            }
+        }
+        let perModelTotal = 0;
+        let touchedAny = false;
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            for (const [modelId, entry] of Object.entries(parsed)) {
+                if (!entry || typeof entry !== "object")
+                    continue;
+                const v = entry;
+                const cost = typeof v.costUsd === "number" ? v.costUsd : 0;
+                addCost(modelId, cost);
+                incSession(seenForRow, modelId);
+                perModelTotal += cost;
+                touchedAny = true;
+            }
+        }
+        if (!touchedAny) {
+            if (row.model_used) {
+                addCost(row.model_used, row.cost_usd);
+                incSession(seenForRow, row.model_used);
+            }
+            continue;
+        }
+        // Residual handles server-side tool cost (web_search, code execution)
+        // that the SDK adds to total_cost_usd but not to any per-model bucket.
+        const residual = row.cost_usd - perModelTotal;
+        if (residual > RESIDUAL_EPSILON_USD && row.model_used) {
+            addCost(row.model_used, residual);
+            incSession(seenForRow, row.model_used);
+        }
+    }
+    return [...map.entries()]
+        .map(([model, v]) => ({ model, ...v }))
+        .sort((a, b) => b.total_cost - a.total_cost);
+}
+// `bucketExpr` takes a single shift-modifier parameter (e.g. "+300 minutes")
+// so each query binds it explicitly — see COST_QUERIES for the rationale.
+const COST_PERIOD_SPECS = {
+    daily: {
+        bucketExpr: "date(started_at, ?)",
+        sinceExpr: "-30 days",
+    },
+    weekly: {
+        bucketExpr: "strftime('%Y-W%W', started_at, ?)",
+        sinceExpr: "-90 days",
+    },
+    monthly: {
+        bucketExpr: "strftime('%Y-%m', started_at, ?)",
+        sinceExpr: "-365 days",
+    },
+};
+export function registerCostApprovalsRoutes(app, deps) {
+    const { db, config } = deps;
+    const agentActionColumns = new Set(db.pragma("table_info(agent_actions)").map((column) => column.name));
+    const backendExpr = agentActionColumns.has("backend")
+        ? "COALESCE(backend, 'claude')"
+        : "'claude'";
+    // ── Cost API ──
+    /** GET /cost — cost analytics */
+    app.get("/cost", (c) => {
+        const period = c.req.query("period") ?? "daily"; // daily, weekly, monthly
+        const periodKey = period in COST_QUERIES
+            ? period
+            : "daily";
+        const queries = COST_QUERIES[periodKey];
+        const spec = COST_PERIOD_SPECS[periodKey];
+        const shift = getAgentDaySqlShiftModifier(config.timezone, config.dayBoundaryHour);
+        const byPeriod = db.prepare(queries.byPeriod).all(shift, shift);
+        const byModelRaw = db.prepare(queries.byModelRows).all();
+        const byModel = aggregateByBilledModel(byModelRaw);
+        const byEventType = db.prepare(queries.byEventType).all();
+        const byBackend = db
+            .prepare(`SELECT ${backendExpr} as backend,
+                SUM(cost_usd) as total_cost,
+                COUNT(*) as session_count
+           FROM agent_actions
+          WHERE started_at > datetime('now', ?)
+            AND cost_usd IS NOT NULL
+          GROUP BY 1
+          ORDER BY total_cost DESC`)
+            .all(spec.sinceExpr);
+        const byBackendPeriod = db
+            .prepare(`SELECT ${spec.bucketExpr} as period,
+                ${backendExpr} as backend,
+                SUM(cost_usd) as total_cost,
+                COUNT(*) as session_count
+           FROM agent_actions
+          WHERE started_at > datetime('now', ?)
+            AND cost_usd IS NOT NULL
+          GROUP BY 1, 2
+          ORDER BY period DESC, backend ASC`)
+            .all(shift, spec.sinceExpr);
+        // Today's total (timezone-aware agent day, executed sessions only).
+        // datetime(started_at) normalizes mixed ISO-8601 / SQL formats — same
+        // rationale as the /events ORDER BY fix above.
+        const bounds = getAgentDayBoundsUtc(config.timezone, config.dayBoundaryHour);
+        const today = db
+            .prepare(`SELECT COALESCE(SUM(cost_usd), 0) as cost,
+                COUNT(*) as sessions
+         FROM agent_actions
+         WHERE datetime(started_at) >= ? AND datetime(started_at) < ?
+           AND cost_usd IS NOT NULL`)
+            .get(bounds.start, bounds.end);
+        return c.json({
+            period,
+            today: { costUsd: today.cost, sessions: today.sessions },
+            byPeriod,
+            byModel,
+            byEventType,
+            byBackend,
+            byBackendPeriod,
+        });
+    });
+    // ── Approvals API ──
+    /** GET /approvals — list pending approval requests */
+    app.get("/approvals", (c) => {
+        const rows = db
+            .prepare(`SELECT id, scheduled_for, task_type, task_description,
+                task_context, model, status, created_at
+         FROM agent_schedule
+         WHERE status = 'pending' AND task_type = 'approval'
+         ORDER BY created_at DESC`)
+            .all();
+        return c.json({ approvals: rows });
+    });
+    /** POST /approvals/:id/approve — approve a pending request */
+    app.post("/approvals/:id/approve", (c) => {
+        const id = Number(c.req.param("id"));
+        const result = db
+            .prepare("UPDATE agent_schedule SET status = 'pending', task_type = 'approved_task' WHERE id = ? AND status = 'pending' AND task_type = 'approval'")
+            .run(id);
+        if (result.changes === 0) {
+            return c.json({ error: "approval not found or already processed" }, 404);
+        }
+        return c.json({ status: "approved", id });
+    });
+    /** POST /approvals/:id/deny — deny a pending request */
+    app.post("/approvals/:id/deny", (c) => {
+        const id = Number(c.req.param("id"));
+        const result = db
+            .prepare("UPDATE agent_schedule SET status = 'skipped' WHERE id = ? AND status = 'pending' AND task_type = 'approval'")
+            .run(id);
+        if (result.changes === 0) {
+            return c.json({ error: "approval not found or already processed" }, 404);
+        }
+        return c.json({ status: "denied", id });
+    });
+}

package/dist/api/routes/dashboard/index.d.ts

@@ -0,0 +1,26 @@
+import { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+/**
+ * Dashboard API routes — REST endpoints for the Dashboard UI.
+ *
+ * Provides:
+ * - Config management (GET/PATCH /api/config)
+ * - Event/action logs (GET /api/events)
+ * - Conversation history (GET /api/conversations)
+ * - Cost analytics (GET /api/cost)
+ * - Approval queue (GET/POST /api/approvals)
+ *
+ * Split into sibling sub-files behind a single `Hono` app — see
+ * docs/design/appendices/api-route-decomposition.md PR 2 for the layout.
+ * Sub-file registration order is a topical regroup, not a byte-identical
+ * replay of the pre-split source: `/notifications`, `/dashboard/{next-check,
+ * dm-freshness}`, and `/config/reset-safety` move into their topical sibling
+ * (notifications.ts / config.ts) and therefore land earlier than they did
+ * in the monolithic file. The split is safe because the affected paths
+ * are unique strings (no params, no wildcards), so Hono match precedence
+ * is unaffected by their reordering. The only ordering invariants that
+ * still matter — `/conversations/:id` before `/conversations/:id/messages`,
+ * `/snapshots/content/:id` before `/snapshots/*` — are honored inside the
+ * `conversations.ts` and `snapshots.ts` sub-files respectively.
+ */
+export declare function createDashboardRoutes(deps: ApiDependencies): Hono;

package/dist/api/routes/dashboard/index.js

@@ -0,0 +1,46 @@
+import { Hono } from "hono";
+import { registerConfigRoutes } from "./config.js";
+import { registerSecretsRoutes } from "./secrets.js";
+import { registerOauthGoogleRoutes } from "./oauth-google.js";
+import { registerMessagingRoutes } from "./messaging.js";
+import { registerConversationsRoutes } from "./conversations.js";
+import { registerCostApprovalsRoutes } from "./cost-approvals.js";
+import { registerScheduleReadonlyRoutes } from "./schedule-readonly.js";
+import { registerSnapshotsRoutes } from "./snapshots.js";
+import { registerNotificationsRoutes } from "./notifications.js";
+/**
+ * Dashboard API routes — REST endpoints for the Dashboard UI.
+ *
+ * Provides:
+ * - Config management (GET/PATCH /api/config)
+ * - Event/action logs (GET /api/events)
+ * - Conversation history (GET /api/conversations)
+ * - Cost analytics (GET /api/cost)
+ * - Approval queue (GET/POST /api/approvals)
+ *
+ * Split into sibling sub-files behind a single `Hono` app — see
+ * docs/design/appendices/api-route-decomposition.md PR 2 for the layout.
+ * Sub-file registration order is a topical regroup, not a byte-identical
+ * replay of the pre-split source: `/notifications`, `/dashboard/{next-check,
+ * dm-freshness}`, and `/config/reset-safety` move into their topical sibling
+ * (notifications.ts / config.ts) and therefore land earlier than they did
+ * in the monolithic file. The split is safe because the affected paths
+ * are unique strings (no params, no wildcards), so Hono match precedence
+ * is unaffected by their reordering. The only ordering invariants that
+ * still matter — `/conversations/:id` before `/conversations/:id/messages`,
+ * `/snapshots/content/:id` before `/snapshots/*` — are honored inside the
+ * `conversations.ts` and `snapshots.ts` sub-files respectively.
+ */
+export function createDashboardRoutes(deps) {
+    const app = new Hono();
+    registerConfigRoutes(app, deps);
+    registerSecretsRoutes(app, deps);
+    registerNotificationsRoutes(app, deps);
+    registerMessagingRoutes(app, deps);
+    registerOauthGoogleRoutes(app, deps);
+    registerConversationsRoutes(app, deps);
+    registerCostApprovalsRoutes(app, deps);
+    registerScheduleReadonlyRoutes(app, deps);
+    registerSnapshotsRoutes(app, deps);
+    return app;
+}

package/dist/api/routes/dashboard/messaging.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+export declare function registerMessagingRoutes(app: Hono, deps: ApiDependencies): void;