@flame0510/project-aether 1.1.9

package/app/api/agents/[id]/backup/route.ts

@@ -0,0 +1,169 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'child_process';
+import { isValidAgentId } from '@/lib/container';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+const BACKUP_VOLUME = 'rev4a-backups';
+
+/**
+ * Determine the volume name for an agent by checking if it exists.
+ */
+function agentVolumeName(agentName: string): string | null {
+  try {
+    const vols = execSync(
+      "docker volume ls --format '{{.Name}}'",
+      { encoding: 'utf-8', timeout: 5000 },
+    ).trim().split('\n').filter(Boolean);
+    const needle = `agent-${agentName}-data`;
+    return vols.includes(needle) ? needle : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Format a timestamp as YYYY-MM-DD_HHmmssSSS (ms precision avoids same-second collisions). */
+function ts(): string {
+  const d = new Date();
+  const pad = (n: number) => String(n).padStart(2, '0');
+  const ms = String(d.getMilliseconds()).padStart(3, '0');
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}_${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}${ms}`;
+}
+
+/** Convert bytes to human-readable size. */
+function fmtSize(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+
+/**
+ * POST /api/agents/[id]/backup
+ * Create a backup of the agent's persistent volume.
+ */
+export async function POST(request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const { id } = await params;
+    if (!id) return NextResponse.json({ error: 'Agent name required' }, { status: 400 });
+    if (!isValidAgentId(id)) return NextResponse.json({ error: 'Invalid agent id' }, { status: 400 });
+
+    const volume = agentVolumeName(id);
+    if (!volume) {
+      return NextResponse.json({ error: `No persistent volume found for agent '${id}'` }, { status: 404 });
+    }
+
+    const filename = `agent-${id}-${ts()}.tar.gz`;
+
+    execSync(
+      `docker run --rm ` +
+      `-v ${volume}:/source:ro ` +
+      `-v ${BACKUP_VOLUME}:/backup ` +
+      `alpine sh -c 'tar czf /backup/${filename} --exclude=.npm/_cacache -C /source . && chmod 644 /backup/${filename}'`,
+      { timeout: 60000, stdio: 'pipe' },
+    );
+
+    return NextResponse.json({ success: true, file: filename });
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}
+
+interface BackupFile {
+  name: string;
+  size: string;
+  sizeBytes: number;
+  date: string;
+  epoch: number;
+}
+
+/**
+ * GET /api/agents/[id]/backup
+ * List available backups for an agent.
+ */
+export async function GET(request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const { id } = await params;
+    if (!id) return NextResponse.json({ error: 'Agent name required' }, { status: 400 });
+    if (!isValidAgentId(id)) return NextResponse.json({ error: 'Invalid agent id' }, { status: 400 });
+
+    const prefix = `agent-${id}-`;
+
+    const raw = execSync(
+      `docker run --rm -v ${BACKUP_VOLUME}:/backup alpine sh -c 'stat -c "%s %Y %n" /backup/${prefix}*.tar.gz 2>/dev/null || true'`,
+      { timeout: 10000, encoding: 'utf-8' },
+    ).trim();
+
+    const lines = raw.split('\n').filter(Boolean);
+    const backups: BackupFile[] = [];
+
+    for (const line of lines) {
+      // Alpine stat -c "%s %Y %n" format: 12345 1711234567 /backup/agent-prometheus-2026-07-11_2151.tar.gz
+      const parts = line.split(/\s+/);
+      if (parts.length < 3) continue;
+      const sizeBytes = parseInt(parts[0], 10) || 0;
+      const epoch = parseInt(parts[1], 10) || 0;
+      const fullPath = parts.slice(2).join(' ');
+      const name = fullPath.replace(/^\/backup\//, '');
+      if (!name || !name.startsWith(prefix) || !name.endsWith('.tar.gz')) continue;
+      const d = new Date(epoch * 1000);
+      const pad = (n: number) => String(n).padStart(2, '0');
+      const date = `${pad(d.getDate())}/${pad(d.getMonth() + 1)}/${d.getFullYear()} ${pad(d.getHours())}:${pad(d.getMinutes())}`;
+      backups.push({
+        name,
+        sizeBytes,
+        size: fmtSize(sizeBytes),
+        date,
+        epoch,
+      });
+    }
+
+    // Most recent first — sort by the file's real mtime, not by filename order
+    // (backup names are not purely chronological: e.g. agent-<id>-prerecreate-<ts>).
+    backups.sort((a, b) => b.epoch - a.epoch);
+
+    return NextResponse.json({ backups });
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}
+
+/**
+ * DELETE /api/agents/[id]/backup?file=agent-xxx-2026-07-11_2115.tar.gz
+ * Remove a specific backup file.
+ */
+export async function DELETE(request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const { id } = await params;
+    if (!id) return NextResponse.json({ error: 'Agent name required' }, { status: 400 });
+    if (!isValidAgentId(id)) return NextResponse.json({ error: 'Invalid agent id' }, { status: 400 });
+
+    const url = new URL(request.url);
+    const file = url.searchParams.get('file');
+    if (!file) return NextResponse.json({ error: 'file query param required' }, { status: 400 });
+
+    // Safety: only allow deleting agent-specific files, reject path traversal
+    if (!file.startsWith(`agent-${id}-`) || !file.endsWith('.tar.gz') || file.includes('/') || file.includes('..')) {
+      return NextResponse.json({ error: 'Invalid backup file name' }, { status: 400 });
+    }
+
+    execSync(
+      `docker run --rm -v ${BACKUP_VOLUME}:/backup alpine sh -c 'rm -f /backup/${file}'`,
+      { timeout: 10000, stdio: 'pipe' },
+    );
+
+    return NextResponse.json({ success: true });
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}

package/app/api/agents/[id]/channels/pairing/route.ts

@@ -0,0 +1,69 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { getPairings, approvePairing, revokePairing } from '@/lib/channelManager';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+function getChannel(request: NextRequest): string {
+  return request.nextUrl.searchParams.get('channel') || 'telegram';
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { id } = await params;
+  const channel = getChannel(request);
+  const result = getPairings(id, channel);
+  return NextResponse.json(result);
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { id } = await params;
+  const channel = getChannel(request);
+
+  try {
+    const body = await request.json();
+
+    if (!body.code || typeof body.code !== 'string' || !body.code.trim()) {
+      return NextResponse.json({ error: 'Pairing code is required' }, { status: 400 });
+    }
+
+    const result = approvePairing(id, body.code.trim(), channel);
+
+    if (!result.success) {
+      return NextResponse.json({ error: result.error }, { status: 404 });
+    }
+
+    return NextResponse.json({ success: true });
+  } catch {
+    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 });
+  }
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { id } = await params;
+  const channel = getChannel(request);
+  const senderId = request.nextUrl.searchParams.get('senderId');
+
+  if (!senderId || !senderId.trim()) {
+    return NextResponse.json({ error: 'senderId query param is required' }, { status: 400 });
+  }
+
+  const result = revokePairing(id, senderId, channel);
+
+  if (!result.success) {
+    return NextResponse.json({ error: result.error }, { status: 404 });
+  }
+
+  return NextResponse.json({ success: true });
+}

package/app/api/agents/[id]/channels/route.ts

@@ -0,0 +1,14 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { getChannels } from '@/lib/channelManager';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { id } = await params;
+  const result = getChannels(id);
+  return NextResponse.json(result);
+}

package/app/api/agents/[id]/channels/telegram/route.ts

@@ -0,0 +1,50 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { setTelegramConfig, removeTelegram } from '@/lib/channelManager';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { id } = await params;
+
+  try {
+    const body = await request.json();
+
+    if (!body.botToken || typeof body.botToken !== 'string' || !body.botToken.trim()) {
+      return NextResponse.json({ error: 'botToken is required' }, { status: 400 });
+    }
+
+    const result = setTelegramConfig(id, {
+      botToken: body.botToken.trim(),
+      dmPolicy: body.dmPolicy,
+      allowFrom: body.allowFrom,
+    });
+
+    if (!result.success) {
+      return NextResponse.json({ error: result.error }, { status: 404 });
+    }
+
+    return NextResponse.json({ success: true });
+  } catch {
+    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 });
+  }
+}
+
+export async function DELETE(request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { id } = await params;
+
+  const result = removeTelegram(id);
+
+  if (!result.success) {
+    return NextResponse.json({ error: result.error }, { status: 404 });
+  }
+
+  return NextResponse.json({ success: true });
+}

package/app/api/agents/[id]/lifecycle/route.ts

@@ -0,0 +1,94 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'child_process';
+import { resolveAgentedContainer, isValidAgentId, isLifecycleCoolingDown, markLifecycleCooldown } from '@/lib/container';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+const ALLOWED_ACTIONS = new Set(['start', 'stop', 'restart']);
+
+/**
+ * POST /api/agents/[id]/lifecycle
+ * Start, stop, or restart a container by AGENT_ID.
+ * Body: { action: "start" | "stop" | "restart" }
+ */
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied as any;
+
+  try {
+    const { id } = await params;
+    if (!id) return NextResponse.json({ error: 'Agent ID required' }, { status: 400 });
+    if (!isValidAgentId(id)) return NextResponse.json({ error: 'Invalid agent id' }, { status: 400 });
+
+    const containerName = resolveAgentedContainer(id);
+    if (!containerName) {
+      return NextResponse.json({ error: `No container found with AGENT_ID '${id}'` }, { status: 404 });
+    }
+
+    // Parse and validate action
+    let body: { action?: string };
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 });
+    }
+
+    const action = body.action;
+    if (!action || typeof action !== 'string' || !ALLOWED_ACTIONS.has(action)) {
+      return NextResponse.json({ error: 'action must be one of: start, stop, restart' }, { status: 400 });
+    }
+
+    // Rate-limit: reject if a lifecycle op was performed < 3s ago
+    if (isLifecycleCoolingDown(id)) {
+      return NextResponse.json({ error: 'Rate limited — wait a few seconds', status: 'cooling_down' }, { status: 429 });
+    }
+    markLifecycleCooldown(id);
+
+    // Check current state to avoid unnecessary operations
+    let currentState = 'unknown';
+    try {
+      currentState = execSync(
+        `docker inspect -f '{{.State.Status}}' ${containerName}`,
+        { encoding: 'utf-8', timeout: 5000 },
+      ).trim();
+    } catch {
+      return NextResponse.json({ error: `Container ${containerName} not found` }, { status: 404 });
+    }
+
+    // No-op for redundant actions
+    if (action === 'start' && currentState === 'running') {
+      return NextResponse.json({ status: 'running', containerName, message: 'Already running' });
+    }
+    if (action === 'stop' && currentState !== 'running') {
+      return NextResponse.json({ status: 'stopped', containerName, message: 'Already stopped' });
+    }
+
+    // Execute
+    if (action === 'stop') {
+      // Gentle stop first, then force-kill if needed
+      try {
+        execSync(`docker stop -t 30 ${containerName}`, { timeout: 35000 });
+      } catch {
+        execSync(`docker kill ${containerName}`, { timeout: 10000 });
+      }
+    } else {
+      execSync(`docker ${action} ${containerName}`, { timeout: 30000 });
+    }
+
+    // Read final state
+    const newState = execSync(
+      `docker inspect -f '{{.State.Status}}' ${containerName}`,
+      { encoding: 'utf-8', timeout: 5000 },
+    ).trim();
+
+    return NextResponse.json({ status: newState, containerName });
+
+  } catch (e: unknown) {
+    const msg = (e as Error).message || String(e);
+    return NextResponse.json({ error: msg }, { status: 500 });
+  }
+}

package/app/api/agents/[id]/recreate/route.ts

@@ -0,0 +1,199 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { resolveAgentedContainer, isValidAgentId } from '@/lib/container';
+import { buildRev4aProviderConfig } from '@/app/api/gateway/sync';
+import { getMountFlags, applyRuntimeConfig } from '@/lib/agent-setup';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+export const maxDuration = 180; // docker run (60s) + health check (60s) + config patch (60s)
+
+const BACKUP_VOLUME = 'rev4a-backups';
+
+/** Timestamp YYYY-MM-DD_HHmmssSSS (ms precision avoids same-second collisions). */
+function ts(): string {
+  const d = new Date();
+  const pad = (n: number) => String(n).padStart(2, '0');
+  const ms = String(d.getMilliseconds()).padStart(3, '0');
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}_${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}${ms}`;
+}
+
+/**
+ * Wait for the container gateway to respond on port 3000.
+ */
+function waitForContainerReady(name: string, timeoutMs = 60000): boolean {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    try {
+      execSync(
+        `docker exec ${name} sh -c 'curl -sf http://127.0.0.1:3000/health >/dev/null 2>&1 || wget -qO- http://127.0.0.1:3000/health >/dev/null 2>&1'`,
+        { timeout: 5000 },
+      );
+      return true;
+    } catch { /* not ready */ }
+    execSync('sleep 2', { timeout: 3000 });
+  }
+  return false;
+}
+
+/**
+ * POST /api/agents/[id]/recreate
+ * Stop -> backup -> rm -> run with same params + shared volumes.
+ * Workspace data and state are preserved in the persistent volume.
+ * Shared volumes (skills, repos) are always mounted.
+ * After the container is up, guarantee extraDirs + provider config.
+ */
+export async function POST(request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const { id } = await params;
+    if (!id) return NextResponse.json({ error: 'Agent name required' }, { status: 400 });
+    if (!isValidAgentId(id)) return NextResponse.json({ error: 'Invalid agent id' }, { status: 400 });
+
+    // Resolve the actual container name via AGENT_ID label
+    const containerName = resolveAgentedContainer(id);
+    if (!containerName) {
+      return NextResponse.json({ error: `No container found with AGENT_ID '${id}'` }, { status: 404 });
+    }
+
+    // Inspect the existing container to capture its parameters
+    let inspect: string;
+    try {
+      inspect = execSync(
+        `docker inspect ${containerName}`,
+        { timeout: 10000, encoding: 'utf-8' },
+      ).trim();
+    } catch {
+      return NextResponse.json({ error: `Container '${containerName}' not found` }, { status: 404 });
+    }
+
+    const info = JSON.parse(inspect);
+    const [container] = info;
+
+    const image = container.Config?.Image || 'openclaw-agent-base:latest';
+    const env: string[] = container.Config?.Env || [];
+
+    // Filter and reformat env vars (skip system vars, keep AGENT_*, MODEL_*, OPENCLAW_*, TZ)
+    const keepPrefixes = ['AGENT_', 'MODEL_', 'OPENCLAW_', 'TZ='];
+    const envOpts = env
+      .filter((e: string) => keepPrefixes.some((p) => e.startsWith(p)))
+      .map((e: string) => `-e ${shellQuote(e)}`)
+      .join(' ');
+
+    // Extract labels (keep AGENT_ID, traefik.*, description, maintainer)
+    const labels = container.Config?.Labels || {};
+    const keepLabelKeys = ['AGENT_ID', 'traefik.', 'description', 'maintainer'];
+    const labelOpts = Object.entries(labels)
+      .filter(([k]) => keepLabelKeys.some((p) => k === p || k.startsWith(p)))
+      .map(([k, v]) => `-l ${shellQuote(`${k}=${v}`)}`)
+      .join(' ');
+
+    // Determine network (must exist on the container)
+    const networks = container.NetworkSettings?.Networks || {};
+    const network = Object.keys(networks)[0];
+    if (!network) {
+      return NextResponse.json({ error: 'Cannot determine network — container may have no networks attached' }, { status: 500 });
+    }
+
+    // Determine if there was a custom port mapping
+    const portMappings = (container.HostConfig?.PortBindings || {}) as Record<string, { HostPort: string }[]>;
+    const portOpts = Object.entries(portMappings)
+      .map(([containerPort, bindings]) => {
+        const hostPort = bindings[0]?.HostPort;
+        if (!hostPort) return '';
+        const proto = containerPort.includes('/udp') ? '/udp' : '';
+        return `-p ${hostPort}:${containerPort.replace(/\/.*$/, '')}${proto}`;
+      })
+      .filter(Boolean)
+      .join(' ');
+
+    const volumeName = `agent-${id}-data`;
+
+    // Auto-backup the volume BEFORE destroying the container
+    const backupFile = `agent-${id}-prerecreate-${ts()}.tar.gz`;
+    try {
+      execSync(
+        `docker run --rm ` +
+        `-v ${volumeName}:/source:ro ` +
+        `-v ${BACKUP_VOLUME}:/backup ` +
+        `alpine sh -c 'tar czf /backup/${backupFile} --exclude=.npm/_cacache -C /source . && chmod 644 /backup/${backupFile}'`,
+        { timeout: 60000, stdio: 'pipe' },
+      );
+    } catch (backupErr) {
+      return NextResponse.json(
+        { error: `Pre-recreate backup failed, aborting: ${(backupErr as Error).message}` },
+        { status: 500 },
+      );
+    }
+
+    // Stop & remove the old container. If removal fails (Docker daemon
+    // overloaded, container stuck in "removal in progress"), abort — we
+    // can't run a new container with a conflicting name.
+    try {
+      execSync(`docker rm -f ${containerName}`, { timeout: 15000 });
+    } catch (rmErr) {
+      return NextResponse.json(
+        { error: `Failed to remove old container '${containerName}': ${(rmErr as Error).message}. The original container may still be running.` },
+        { status: 500 },
+      );
+    }
+
+    // Run the new container with all mounts (persistent volume + shared skills + shared repos + rev4a rules)
+    const cmd = [
+      `docker run -d`,
+      `--name "${id}"`,
+      `--network "${network}"`,
+      `--restart unless-stopped`,
+      `--add-host host.docker.internal:host-gateway`,
+      `-v ${volumeName}:/root`,
+      ...getMountFlags(),
+      labelOpts,
+      envOpts,
+      portOpts,
+      `"${image}"`,
+    ].filter(Boolean).join(' \\\n  ');
+
+    execSync(cmd, { timeout: 60000, encoding: 'utf-8' });
+
+    // Wait for the new container to be healthy
+    const ready = waitForContainerReady(id);
+    if (!ready) {
+      return NextResponse.json(
+        { success: false, error: 'Container started but gateway did not become healthy within 60s.' },
+        { status: 500 },
+      );
+    }
+
+    // Guarantee Rev4a runtime config (hooks, shared-skills, provider).
+    // Uses config patch (deep-merge) — idempotent, preserves user customizations.
+    try {
+      applyRuntimeConfig(id);
+
+      // Also guarantee models.providers.rev4a (host-dependent, not in base image)
+      const providerConfig = buildRev4aProviderConfig();
+      const providerJson = JSON.stringify({ models: { providers: { rev4a: providerConfig } } });
+      execSync(
+        `docker exec -i ${id} sh -c 'openclaw config patch --stdin'`,
+        { timeout: 15000, stdio: 'pipe', input: providerJson },
+      );
+
+      try {
+        execSync(`docker exec ${id} openclaw gateway restart`, { timeout: 15000 });
+      } catch { /* non-fatal */ }
+    } catch {
+      // config patch is best-effort on recreate
+    }
+
+    return NextResponse.json({ success: true, name: id, image, network, backup: backupFile });
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/app/api/agents/[id]/restart/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'child_process';
+import { resolveAgentedContainer, isValidAgentId } from '@/lib/container';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * POST /api/agents/[id]/restart
+ * Restart a container (docker restart) after verifying it has a matching AGENT_ID label.
+ */
+export async function POST(request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  try {
+    const { id } = await params;
+    if (!id) return NextResponse.json({ error: 'Agent name required' }, { status: 400 });
+    if (!isValidAgentId(id)) return NextResponse.json({ error: 'Invalid agent id' }, { status: 400 });
+
+    const containerName = resolveAgentedContainer(id);
+    if (!containerName) {
+      return NextResponse.json({ error: `No container found with AGENT_ID '${id}'` }, { status: 404 });
+    }
+
+    execSync(`docker restart ${containerName}`, { timeout: 30000 });
+
+    return NextResponse.json({ success: true });
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}
+