@jiangxiaosheng/digital-agent-platform 1.0.0

package/src/app/api/agents/[id]/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from "next/server";
+import { agentStore } from "@/lib/agents/store";
+import type { UpdateAgentInput } from "@/types/agent";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function GET(_req: NextRequest, { params }: Params) {
+  const { id } = await params;
+  const agent = agentStore.getById(id);
+  if (!agent) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json(agent);
+}
+
+export async function PUT(req: NextRequest, { params }: Params) {
+  const { id } = await params;
+  const body = (await req.json()) as UpdateAgentInput;
+  const updated = agentStore.update(id, body);
+  if (!updated) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json(updated);
+}
+
+export async function DELETE(_req: NextRequest, { params }: Params) {
+  const { id } = await params;
+  const ok = agentStore.delete(id);
+  if (!ok) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json({ success: true });
+}

package/src/app/api/agents/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from "next/server";
+import { agentStore } from "@/lib/agents/store";
+import { initSchema } from "@/lib/db/schema";
+import type { CreateAgentInput } from "@/types/agent";
+
+
+export async function GET() {
+  try {
+    const agents = agentStore.list();
+    return NextResponse.json(agents);
+  } catch (e) {
+    return NextResponse.json({ error: String(e) }, { status: 500 });
+  }
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    const body = (await req.json()) as CreateAgentInput;
+    if (!body.name?.trim()) {
+      return NextResponse.json({ error: "Name is required" }, { status: 400 });
+    }
+    const agent = agentStore.create(body);
+    return NextResponse.json(agent, { status: 201 });
+  } catch (e) {
+    return NextResponse.json({ error: String(e) }, { status: 500 });
+  }
+}

package/src/app/api/auth-config/test/route.ts

@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from "next/server";
+
+export const dynamic = "force-dynamic";
+
+const PROVIDER_TEST: Record<string, { url: string; authHeader: (key: string) => Record<string, string>; body: object }> = {
+  anthropic: {
+    url: "https://api.anthropic.com/v1/messages",
+    authHeader: (key) => ({ "x-api-key": key, "anthropic-version": "2023-06-01" }),
+    body: { model: "claude-haiku-4-5-20251001", max_tokens: 5, messages: [{ role: "user", content: "hi" }] },
+  },
+  openai: {
+    url: "https://api.openai.com/v1/chat/completions",
+    authHeader: (key) => ({ Authorization: `Bearer ${key}` }),
+    body: { model: "gpt-4o-mini", max_tokens: 5, messages: [{ role: "user", content: "hi" }] },
+  },
+  google: {
+    url: "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent",
+    authHeader: (key) => ({ "x-goog-api-key": key }),
+    body: { contents: [{ parts: [{ text: "hi" }] }] },
+  },
+  groq: {
+    url: "https://api.groq.com/openai/v1/chat/completions",
+    authHeader: (key) => ({ Authorization: `Bearer ${key}` }),
+    body: { model: "llama-3.1-8b-instant", max_tokens: 5, messages: [{ role: "user", content: "hi" }] },
+  },
+  deepseek: {
+    url: "https://api.deepseek.com/chat/completions",
+    authHeader: (key) => ({ Authorization: `Bearer ${key}` }),
+    body: { model: "deepseek-chat", max_tokens: 5, messages: [{ role: "user", content: "hi" }] },
+  },
+  xai: {
+    url: "https://api.x.ai/v1/chat/completions",
+    authHeader: (key) => ({ Authorization: `Bearer ${key}` }),
+    body: { model: "grok-2-latest", max_tokens: 5, messages: [{ role: "user", content: "hi" }] },
+  },
+  mistral: {
+    url: "https://api.mistral.ai/v1/chat/completions",
+    authHeader: (key) => ({ Authorization: `Bearer ${key}` }),
+    body: { model: "mistral-small-latest", max_tokens: 5, messages: [{ role: "user", content: "hi" }] },
+  },
+};
+
+export async function POST(req: NextRequest) {
+  const start = Date.now();
+  try {
+    const { provider, key } = await req.json() as { provider: string; key: string };
+    if (!provider || !key) return NextResponse.json({ ok: false, error: "provider and key required" }, { status: 400 });
+
+    const cfg = PROVIDER_TEST[provider];
+    if (!cfg) return NextResponse.json({ ok: true, message: "No test defined for this provider, assuming OK" });
+
+    const res = await fetch(cfg.url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...cfg.authHeader(key) },
+      body: JSON.stringify(cfg.body),
+      signal: AbortSignal.timeout(12000),
+    });
+
+    const latencyMs = Date.now() - start;
+    if (res.ok || res.status === 400) {
+      // 400 can mean bad params but auth was accepted
+      return NextResponse.json({ ok: true, latencyMs, status: res.status });
+    }
+    const errText = await res.text().catch(() => "");
+    return NextResponse.json({ ok: false, latencyMs, status: res.status, error: errText.slice(0, 200) });
+  } catch (e) {
+    return NextResponse.json({ ok: false, latencyMs: Date.now() - start, error: String(e) }, { status: 500 });
+  }
+}

package/src/app/api/bash-output/route.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from "next/server";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+export const dynamic = "force-dynamic";
+
+const MAX_BYTES = 5 * 1024 * 1024; // 5 MB
+const BASH_FILE_RE = /^pi-bash-[A-Za-z0-9_-]+\.log$/;
+
+/** Validate path is a legitimate bash output file in tmpdir */
+function validatePath(filePath: string): { ok: true } | { ok: false; error: string; status: number } {
+  const tmpDir = os.tmpdir();
+  const resolved = path.resolve(filePath);
+  // Must live directly inside tmpdir (no subdirectories)
+  if (path.dirname(resolved) !== tmpDir) {
+    return { ok: false, error: "forbidden", status: 403 };
+  }
+  // Must match the pi-bash-*.log naming pattern
+  if (!BASH_FILE_RE.test(path.basename(resolved))) {
+    return { ok: false, error: "forbidden", status: 403 };
+  }
+  return { ok: true };
+}
+
+export async function GET(req: NextRequest) {
+  const filePath = req.nextUrl.searchParams.get("path");
+  if (!filePath) {
+    return NextResponse.json({ error: "path required" }, { status: 400 });
+  }
+
+  const check = validatePath(filePath);
+  if (!check.ok) {
+    return NextResponse.json({ error: check.error }, { status: check.status });
+  }
+
+  try {
+    const stat = fs.statSync(filePath);
+    if (!stat.isFile()) {
+      return NextResponse.json({ error: "not a file" }, { status: 404 });
+    }
+    if (stat.size > MAX_BYTES) {
+      return NextResponse.json(
+        { error: `Output too large (${stat.size} bytes, limit ${MAX_BYTES})`, truncated: true },
+        { status: 413 }
+      );
+    }
+    const output = fs.readFileSync(filePath, "utf8");
+    return NextResponse.json({ output });
+  } catch (e: unknown) {
+    const code = (e as NodeJS.ErrnoException).code;
+    if (code === "ENOENT") {
+      return NextResponse.json({ error: "file not found" }, { status: 404 });
+    }
+    return NextResponse.json({ error: String(e) }, { status: 500 });
+  }
+}

package/src/app/api/chat/[agentId]/route.ts

@@ -0,0 +1,164 @@
+import { NextRequest } from "next/server";
+import { agentStore, sessionStore } from "@/lib/agents/store";
+import { createSession, getAgentDir } from "@/lib/agent-factory";
+import { readAuthConfig } from "@/lib/models-config";
+import path from "path";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 300;
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ agentId: string }> }
+) {
+  const { agentId } = await params;
+  const body = (await req.json()) as {
+    message: string;
+    sessionFile?: string;
+    sessionId?: string;
+    overrideSkills?: string[];
+    overrideProvider?: string;
+    overrideModelId?: string;
+    images?: { data: string; mimeType: string }[];
+  };
+
+  const agent = agentStore.getById(agentId);
+  if (!agent) {
+    return new Response(
+      `data: ${JSON.stringify({ type: "error", message: "Agent not found" })}\n\n`,
+      { status: 404, headers: { "Content-Type": "text/event-stream" } }
+    );
+  }
+
+  // Apply session-level overrides
+  const effectiveAgent = {
+    ...agent,
+    ...(body.overrideSkills !== undefined && { enabledSkills: body.overrideSkills }),
+    ...(body.overrideProvider && body.overrideModelId && {
+      model: { ...agent.model, provider: body.overrideProvider, modelId: body.overrideModelId },
+    }),
+  };
+
+  const encoder = new TextEncoder();
+  let sessionFileSaved = false;
+  let sessionInstance: Awaited<ReturnType<typeof createSession>> | null = null;
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      const send = (obj: object) => {
+        try { controller.enqueue(encoder.encode(`data: ${JSON.stringify(obj)}\n\n`)); } catch { /* closed */ }
+      };
+
+      req.signal.addEventListener("abort", () => {
+        send({ type: "aborted" });
+        sessionInstance?.dispose();
+        try { controller.close(); } catch { /* already closed */ }
+      });
+
+      try {
+        sessionInstance = await createSession(effectiveAgent, body.message, body.sessionFile);
+
+        const unsub = sessionInstance.subscribe((event) => {
+          if (req.signal.aborted) { unsub(); return; }
+          try {
+            switch (event.type) {
+              case "message_update":
+                if (event.assistantMessageEvent?.type === "text_delta")
+                  send({ type: "message_update", delta: event.assistantMessageEvent.delta });
+                else if (event.assistantMessageEvent?.type === "thinking_delta")
+                  send({ type: "thinking_delta", delta: event.assistantMessageEvent.delta });
+                break;
+              case "tool_execution_start":
+                send({ type: "tool_start", toolName: event.toolName, toolCallId: event.toolCallId ?? event.toolName });
+                break;
+              case "tool_execution_update": {
+                // For bash, surface the command string directly (not raw JSON)
+                const args = (event as Record<string, unknown>).args as Record<string, unknown> | undefined;
+                const partial = (event as Record<string, unknown>).partialResult;
+                const content = typeof args?.command === "string"
+                  ? args.command
+                  : JSON.stringify(partial ?? args ?? "");
+                send({ type: "tool_update", toolCallId: event.toolCallId ?? "", content });
+                break;
+              }
+              case "tool_execution_end": {
+                // result for bash is BashToolDetails: { output, exitCode, truncated, fullOutputPath? }
+                const result = (event as Record<string, unknown>).result as Record<string, unknown> | undefined;
+                const isError = !!((event as Record<string, unknown>).isError);
+                // Inline output: bash provides result.output, other tools may return a string or object
+                const output: string | undefined = result
+                  ? (typeof result.output === "string" ? result.output
+                    : typeof result === "string" ? result
+                    : result.content !== undefined ? String(result.content)
+                    : undefined)
+                  : undefined;
+                send({
+                  type: "tool_end",
+                  toolCallId: event.toolCallId ?? "",
+                  toolName: event.toolName,
+                  isError,
+                  output,
+                  fullOutputPath: typeof result?.fullOutputPath === "string" ? result.fullOutputPath : undefined,
+                  truncated: typeof result?.truncated === "boolean" ? result.truncated : false,
+                });
+                break;
+              }
+              case "compaction_start": send({ type: "compaction_start" }); break;
+              case "compaction_end":   send({ type: "compaction_end" });   break;
+              case "agent_settled": {
+                // Send session stats
+                try {
+                  const stats = sessionInstance!.getSessionStats();
+                  send({ type: "session_stats", stats: {
+                    tokens: stats.tokens,
+                    cost: stats.cost,
+                    contextUsage: stats.contextUsage,
+                    userMessages: stats.userMessages,
+                    assistantMessages: stats.assistantMessages,
+                  }});
+                } catch { /* stats not available */ }
+
+                const sf = sessionInstance!.sessionFile;
+                if (sf && !sessionFileSaved) {
+                  sessionFileSaved = true;
+                  send({ type: "session_file", path: sf });
+                  if (!body.sessionId) sessionStore.create(agentId, sf, body.message.slice(0, 60));
+                }
+                send({ type: "done" });
+                unsub();
+                sessionInstance!.dispose();
+                sessionInstance = null;
+                try { controller.close(); } catch { /* already closed */ }
+                break;
+              }
+            }
+          } catch { /* ignore subscriber errors */ }
+        });
+
+        if (!req.signal.aborted) {
+          // Build prompt options with optional image attachments
+          const promptImages = body.images?.length
+            ? body.images.map(img => ({ type: "image" as const, data: img.data, mimeType: img.mimeType }))
+            : undefined;
+          await sessionInstance.prompt(body.message, promptImages ? { images: promptImages } : undefined);
+        }
+      } catch (e) {
+        send({ type: "error", message: String(e) });
+        try { controller.close(); } catch { /* already closed */ }
+      }
+    },
+    cancel() {
+      sessionInstance?.dispose();
+      sessionInstance = null;
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no",
+    },
+  });
+}

package/src/app/api/env-vars/[key]/route.ts

@@ -0,0 +1,22 @@
+import { NextRequest, NextResponse } from "next/server";
+import { setEnvVar, deleteEnvVar } from "@/lib/env-vars";
+
+export const dynamic = "force-dynamic";
+
+type Params = { params: Promise<{ key: string }> };
+
+// PUT — update a single var
+export async function PUT(req: NextRequest, { params }: Params) {
+  const { key } = await params;
+  const { value } = await req.json() as { value: string };
+  setEnvVar(decodeURIComponent(key), value ?? "");
+  return NextResponse.json({ success: true });
+}
+
+// DELETE — remove a single var
+export async function DELETE(_req: NextRequest, { params }: Params) {
+  const { key } = await params;
+  const ok = deleteEnvVar(decodeURIComponent(key));
+  if (!ok) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json({ success: true });
+}

package/src/app/api/env-vars/route.ts

@@ -0,0 +1,26 @@
+import { NextRequest, NextResponse } from "next/server";
+import { readEnvVars, writeEnvVars, setEnvVar } from "@/lib/env-vars";
+
+export const dynamic = "force-dynamic";
+
+// GET — list all env vars (values masked for secrets)
+export async function GET() {
+  const vars = readEnvVars();
+  return NextResponse.json(vars);
+}
+
+// POST — add/update a var  { key, value }
+export async function POST(req: NextRequest) {
+  const { key, value } = await req.json() as { key: string; value: string };
+  if (!key?.trim()) return NextResponse.json({ error: "Key required" }, { status: 400 });
+  const validKey = /^[A-Za-z_][A-Za-z0-9_]*$/.test(key.trim());
+  if (!validKey) return NextResponse.json({ error: "Key must be a valid identifier (A-Z, a-z, 0-9, _)" }, { status: 400 });
+  setEnvVar(key.trim(), value ?? "");
+  return NextResponse.json({ success: true });
+}
+
+// DELETE — clear all vars
+export async function DELETE() {
+  writeEnvVars({});
+  return NextResponse.json({ success: true });
+}

package/src/app/api/env-vars/scan/route.ts

@@ -0,0 +1,66 @@
+import { NextResponse } from "next/server";
+import { readEnvVars } from "@/lib/env-vars";
+import { listInstalledSkills, getSkillsDir } from "@/lib/skills";
+import path from "path";
+import fs from "fs";
+
+export const dynamic = "force-dynamic";
+
+/** Extract $VAR and ${VAR} references from skill content, skipping common shell vars */
+const SKIP_VARS = new Set([
+  "HOME","PATH","USER","SHELL","PWD","TERM","TMPDIR","LANG",
+  "LOGNAME","SHLVL","IFS","MANPATH","OLDPWD","RESPONSE",
+]);
+
+function extractEnvRefs(content: string): string[] {
+  // Match $VAR and ${VAR} usage patterns
+  const usageMatches = content.match(/\$\{?([A-Z_][A-Z0-9_]+)\}?/g) ?? [];
+  const usageVars = usageMatches.map(m => m.replace(/[${}]/g, ""));
+
+  // Also match `export VAR=` and `VAR=` assignment patterns (left side, no $)
+  const assignMatches = content.match(/(?:^|\n)\s*(?:export\s+)?([A-Z_][A-Z0-9_]+)=/gm) ?? [];
+  const assignVars = assignMatches.map(m => m.replace(/.*?([A-Z_][A-Z0-9_]+)=.*/, "$1").trim());
+
+  return [...new Set([...usageVars, ...assignVars].filter(v => !SKIP_VARS.has(v)))].sort();
+}
+
+export async function GET() {
+  const stored = readEnvVars();
+  const skills = listInstalledSkills();
+  const skillsDir = getSkillsDir();
+
+  const results: {
+    skillName: string;
+    vars: { name: string; stored: boolean }[];
+  }[] = [];
+
+  for (const skill of skills) {
+    const mdPath = fs.statSync(skill.filePath).isDirectory()
+      ? path.join(skill.filePath, "SKILL.md")
+      : skill.filePath;
+    if (!fs.existsSync(mdPath)) continue;
+    const content = fs.readFileSync(mdPath, "utf8");
+    const refs = extractEnvRefs(content);
+    if (refs.length === 0) continue;
+    results.push({
+      skillName: skill.name,
+      vars: refs.map(name => ({ name, stored: name in stored })),
+    });
+  }
+
+  // Summary: all vars referenced across all skills
+  const allVars = new Map<string, { skills: string[]; stored: boolean }>();
+  for (const { skillName, vars } of results) {
+    for (const { name, stored } of vars) {
+      if (!allVars.has(name)) allVars.set(name, { skills: [], stored });
+      allVars.get(name)!.skills.push(skillName);
+    }
+  }
+
+  return NextResponse.json({
+    bySkill: results,
+    summary: [...allVars.entries()].map(([name, { skills, stored }]) => ({
+      name, skills, stored,
+    })).sort((a, b) => (a.stored ? 1 : 0) - (b.stored ? 1 : 0) || a.name.localeCompare(b.name)),
+  });
+}

package/src/app/api/file-serve/route.ts

@@ -0,0 +1,58 @@
+import { NextRequest, NextResponse } from "next/server";
+import fs from "fs";
+import path from "path";
+import os from "os";
+
+export const dynamic = "force-dynamic";
+
+const MIME_MAP: Record<string, string> = {
+  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg",
+  gif: "image/gif", webp: "image/webp", svg: "image/svg+xml",
+  mp4: "video/mp4", webm: "video/webm", mov: "video/quicktime",
+  mp3: "audio/mpeg", wav: "audio/wav",
+};
+
+const ALLOWED_EXTS = new Set(Object.keys(MIME_MAP));
+
+// Block access outside home directory or to sensitive paths
+const BLOCKED_PREFIXES = ["/etc", "/usr", "/System", "/bin", "/sbin", "/var/log"];
+
+function isSafePath(filePath: string): boolean {
+  const resolved = path.resolve(filePath.replace(/^~/, os.homedir()));
+  if (BLOCKED_PREFIXES.some(p => resolved.startsWith(p))) return false;
+  // Must be within home directory
+  if (!resolved.startsWith(os.homedir())) return false;
+  return true;
+}
+
+export async function GET(req: NextRequest) {
+  const rawPath = req.nextUrl.searchParams.get("path");
+  if (!rawPath) return NextResponse.json({ error: "path required" }, { status: 400 });
+
+  const filePath = rawPath.replace(/^~/, os.homedir());
+  const ext = path.extname(filePath).slice(1).toLowerCase();
+
+  if (!ALLOWED_EXTS.has(ext)) {
+    return NextResponse.json({ error: "file type not allowed" }, { status: 403 });
+  }
+  if (!isSafePath(filePath)) {
+    return NextResponse.json({ error: "access denied" }, { status: 403 });
+  }
+
+  try {
+    if (!fs.existsSync(filePath) || !fs.statSync(filePath).isFile()) {
+      return NextResponse.json({ error: "file not found" }, { status: 404 });
+    }
+    const buffer = fs.readFileSync(filePath);
+    const mime = MIME_MAP[ext] ?? "application/octet-stream";
+    return new NextResponse(buffer, {
+      headers: {
+        "Content-Type": mime,
+        "Cache-Control": "public, max-age=3600",
+        "Content-Disposition": `inline; filename="${path.basename(filePath)}"`,
+      },
+    });
+  } catch {
+    return NextResponse.json({ error: "read failed" }, { status: 500 });
+  }
+}

package/src/app/api/fs/browse/route.ts

@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from "next/server";
+import fs from "fs";
+import path from "path";
+import os from "os";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: NextRequest) {
+  const rawPath = req.nextUrl.searchParams.get("path") || os.homedir();
+  // Expand ~ to home
+  const target = rawPath.replace(/^~/, os.homedir());
+
+  try {
+    const stat = fs.statSync(target);
+    if (!stat.isDirectory()) {
+      return NextResponse.json({ error: "Not a directory" }, { status: 400 });
+    }
+
+    const entries = fs.readdirSync(target, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && !e.name.startsWith("."))
+      .map((e) => ({
+        name: e.name,
+        path: path.join(target, e.name),
+      }))
+      .sort((a, b) => a.name.localeCompare(b.name));
+
+    // Build breadcrumb
+    const parts = target.replace(os.homedir(), "~").split(path.sep).filter(Boolean);
+    const breadcrumb = parts.map((p, i) => ({
+      label: p,
+      path: i === 0 && p === "~"
+        ? os.homedir()
+        : parts.slice(0, i + 1).join(path.sep).replace(/^~/, os.homedir()),
+    }));
+
+    return NextResponse.json({
+      current: target,
+      display: target.replace(os.homedir(), "~"),
+      breadcrumb,
+      entries,
+      canGoUp: target !== "/" && target !== os.homedir(),
+      parent: path.dirname(target),
+    });
+  } catch (e) {
+    return NextResponse.json({ error: String(e) }, { status: 500 });
+  }
+}

package/src/app/api/knowledge/[id]/documents/[docId]/route.ts

@@ -0,0 +1,22 @@
+import { NextRequest, NextResponse } from "next/server";
+import { kbStore } from "@/lib/knowledge/store";
+import { deleteChunksByDoc } from "@/lib/knowledge/retriever";
+import { initSchema } from "@/lib/db/schema";
+import fs from "fs";
+
+initSchema();
+
+type Params = { params: Promise<{ id: string; docId: string }> };
+
+export async function DELETE(_req: NextRequest, { params }: Params) {
+  const { docId } = await params;
+  const docs = kbStore.listDocuments((await params).id);
+  const doc = docs.find((d) => d.id === docId);
+  if (doc?.filePath) {
+    try { fs.unlinkSync(doc.filePath); } catch { /* ignore */ }
+  }
+  deleteChunksByDoc(docId);
+  const ok = kbStore.deleteDocument(docId);
+  if (!ok) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json({ success: true });
+}

package/src/app/api/knowledge/[id]/route.ts

@@ -0,0 +1,21 @@
+import { NextRequest, NextResponse } from "next/server";
+import { kbStore } from "@/lib/knowledge/store";
+import { deleteChunksByKb } from "@/lib/knowledge/retriever";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function GET(_req: NextRequest, { params }: Params) {
+  const { id } = await params;
+  const kb = kbStore.getById(id);
+  if (!kb) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  const docs = kbStore.listDocuments(id);
+  return NextResponse.json({ ...kb, documents: docs });
+}
+
+export async function DELETE(_req: NextRequest, { params }: Params) {
+  const { id } = await params;
+  deleteChunksByKb(id);
+  const ok = kbStore.delete(id);
+  if (!ok) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json({ success: true });
+}