@jiangxiaosheng/digital-agent-platform 1.0.0

package/src/app/api/knowledge/[id]/upload/route.ts

@@ -0,0 +1,90 @@
+import { NextRequest, NextResponse } from "next/server";
+import { kbStore } from "@/lib/knowledge/store";
+import { chunkText } from "@/lib/knowledge/chunker";
+import { embedText } from "@/lib/knowledge/embedder";
+import { storeChunk } from "@/lib/knowledge/retriever";
+import { initSchema } from "@/lib/db/schema";
+import path from "path";
+import fs from "fs";
+import os from "os";
+
+export const dynamic = "force-dynamic";
+
+initSchema();
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id: kbId } = await params;
+
+  const kb = kbStore.getById(kbId);
+  if (!kb) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const formData = await req.formData();
+  const file = formData.get("file") as File | null;
+  if (!file) return NextResponse.json({ error: "No file" }, { status: 400 });
+
+  // Save file to disk
+  const uploadDir = path.join(os.homedir(), ".digital-agents", "uploads", kbId);
+  if (!fs.existsSync(uploadDir)) fs.mkdirSync(uploadDir, { recursive: true });
+  const filePath = path.join(uploadDir, file.name);
+  const bytes = await file.arrayBuffer();
+  fs.writeFileSync(filePath, Buffer.from(bytes));
+
+  // Register document
+  const docId = kbStore.createDocument(kbId, file.name, filePath, file.type);
+
+  // Process async (don't await — respond immediately, process in background)
+  processDocument(kbId, docId, filePath, file.name, file.type).catch((e) => {
+    kbStore.updateDocumentStatus(docId, "error", 0, String(e));
+  });
+
+  return NextResponse.json({ docId, status: "processing" }, { status: 202 });
+}
+
+async function processDocument(
+  kbId: string,
+  docId: string,
+  filePath: string,
+  filename: string,
+  mimeType: string
+) {
+  // Parse document
+  const text = await parseDocument(filePath, mimeType);
+
+  // Chunk
+  const chunks = chunkText(text, { filename });
+
+  // Embed and store
+  let stored = 0;
+  for (const chunk of chunks) {
+    const embedding = await embedText(chunk.content);
+    storeChunk(kbId, docId, chunk.content, embedding, chunk.metadata);
+    stored++;
+  }
+
+  kbStore.updateDocumentStatus(docId, "ready", stored);
+}
+
+async function parseDocument(filePath: string, mimeType: string): Promise<string> {
+  const ext = path.extname(filePath).toLowerCase();
+
+  if (ext === ".pdf") {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const pdfParse = require("pdf-parse");
+    const buffer = fs.readFileSync(filePath);
+    const data = await pdfParse(buffer);
+    return data.text as string;
+  }
+
+  if (ext === ".docx" || mimeType.includes("wordprocessingml")) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const mammoth = require("mammoth");
+    const result = await mammoth.extractRawText({ path: filePath });
+    return result.value as string;
+  }
+
+  // TXT / Markdown
+  return fs.readFileSync(filePath, "utf-8");
+}

package/src/app/api/knowledge/route.ts

@@ -0,0 +1,15 @@
+import { NextRequest, NextResponse } from "next/server";
+import { kbStore } from "@/lib/knowledge/store";
+import { initSchema } from "@/lib/db/schema";
+
+
+export async function GET() {
+  return NextResponse.json(kbStore.list());
+}
+
+export async function POST(req: NextRequest) {
+  const { name, description } = (await req.json()) as { name: string; description?: string };
+  if (!name?.trim()) return NextResponse.json({ error: "Name required" }, { status: 400 });
+  const kb = kbStore.create(name, description);
+  return NextResponse.json(kb, { status: 201 });
+}

package/src/app/api/knowledge/search/route.ts

@@ -0,0 +1,26 @@
+import { NextRequest, NextResponse } from "next/server";
+import { searchChunks } from "@/lib/knowledge/retriever";
+import { embedText } from "@/lib/knowledge/embedder";
+import { initSchema } from "@/lib/db/schema";
+
+
+export async function POST(req: NextRequest) {
+  const { kbIds, query, topK = 5 } = (await req.json()) as {
+    kbIds: string[];
+    query: string;
+    topK?: number;
+  };
+  if (!query || !kbIds?.length) return NextResponse.json([]);
+
+  const queryVec = await embedText(query);
+  const results = await searchChunks(kbIds, queryVec, topK);
+
+  return NextResponse.json(
+    results.map((r) => ({
+      content: r.chunk.content,
+      score: r.score,
+      filename: r.chunk.metadata.filename,
+      kbId: r.chunk.kbId,
+    }))
+  );
+}

package/src/app/api/models/route.ts

@@ -0,0 +1,160 @@
+import { NextResponse } from "next/server";
+import path from "path";
+import os from "os";
+
+export const dynamic = "force-dynamic";
+
+export type ModelInfo = {
+  id: string;
+  name: string;
+  providerId: string;
+  providerName: string;
+  api: string;
+  contextWindow: number;
+  maxTokens: number;
+  supportsThinking: boolean;
+  supportsTemperature: boolean;
+  thinkingLevels: string[];
+  inputTypes: string[];
+  costInput?: number;
+  costOutput?: number;
+  isCustom?: boolean;
+};
+
+export type ProviderGroup = {
+  id: string;
+  name: string;
+  models: ModelInfo[];
+  isCustom?: boolean;
+};
+
+interface SdkModel {
+  id: string;
+  name?: string;
+  api?: string;
+  provider: string;
+  contextWindow?: number;
+  maxTokens?: number;
+  reasoning?: boolean;
+  input?: string[];
+  cost?: { input?: number; output?: number };
+  thinkingLevelMap?: Record<string, string | null>;
+  compat?: { supportsTemperature?: boolean; [k: string]: unknown };
+}
+
+function getAgentDir() {
+  return process.env.PI_AGENT_DIR ?? path.join(os.homedir(), ".pi", "agent");
+}
+
+const PRIORITY = [
+  "anthropic", "openai", "google", "mistral", "groq",
+  "deepseek", "xai", "amazon-bedrock", "google-vertex",
+];
+
+export async function GET() {
+  try {
+    const { ModelRuntime } = await import("@earendil-works/pi-coding-agent");
+
+    const agentDir = getAgentDir();
+    const modelsStorePath = path.join(agentDir, "models.json");
+    const authPath = path.join(agentDir, "auth.json");
+
+    const runtime = await ModelRuntime.create({ authPath, modelsStorePath });
+
+    const sdkProviders = runtime.getProviders();
+    const providerNameMap = new Map<string, string>(sdkProviders.map((p) => [p.id, p.name]));
+
+    const allModels = runtime.getModels() as unknown as SdkModel[];
+    const groupMap = new Map<string, ProviderGroup>();
+
+    // Read custom provider names from models.json for isCustom flag
+    const { readModelsConfig } = await import("@/lib/models-config");
+    const modelsConfig = readModelsConfig();
+    const customProviderIds = new Set(Object.keys(modelsConfig.providers));
+
+    // Read configured built-in providers from auth.json
+    const { readAuthConfig } = await import("@/lib/models-config");
+    const authConfig = readAuthConfig();
+    const configuredBuiltinIds = new Set(Object.keys(authConfig));
+
+    // A provider is "available" if it has a key in auth.json OR is a custom provider in models.json
+    const isProviderConfigured = (id: string) =>
+      customProviderIds.has(id) || configuredBuiltinIds.has(id);
+
+    for (const m of allModels) {
+      const providerId = m.provider ?? "unknown";
+
+      // Skip unconfigured built-in providers (show only configured or custom)
+      if (!isProviderConfigured(providerId)) continue;
+
+      const providerName = providerNameMap.get(providerId) ?? providerId;
+      const isCustom = customProviderIds.has(providerId);
+
+      const rawMap = m.thinkingLevelMap ?? {};
+      const thinkingLevels = Object.entries(rawMap)
+        .filter(([, v]) => v !== null)
+        .map(([k]) => k);
+
+      const supportsThinking = m.reasoning === true || thinkingLevels.length > 0;
+      const supportsTemperature = m.compat?.supportsTemperature !== false;
+
+      const info: ModelInfo = {
+        id: m.id,
+        name: m.name ?? m.id,
+        providerId,
+        providerName,
+        api: m.api ?? "",
+        contextWindow: m.contextWindow ?? 200000,
+        maxTokens: m.maxTokens ?? 8192,
+        supportsThinking,
+        supportsTemperature,
+        thinkingLevels,
+        inputTypes: m.input ?? ["text"],
+        costInput: m.cost?.input,
+        costOutput: m.cost?.output,
+        isCustom,
+      };
+
+      if (!groupMap.has(providerId)) {
+        groupMap.set(providerId, { id: providerId, name: providerName, models: [], isCustom });
+      }
+      groupMap.get(providerId)!.models.push(info);
+    }
+
+    const groups = [...groupMap.values()]
+      .filter((g) => g.models.length > 0)
+      .sort((a, b) => {
+        if (a.isCustom && !b.isCustom) return -1;
+        if (!a.isCustom && b.isCustom) return 1;
+        const ai = PRIORITY.indexOf(a.id), bi = PRIORITY.indexOf(b.id);
+        if (ai !== -1 && bi !== -1) return ai - bi;
+        if (ai !== -1) return -1;
+        if (bi !== -1) return 1;
+        return a.name.localeCompare(b.name);
+      });
+
+    return NextResponse.json(groups);
+  } catch (e) {
+    console.error("ModelRuntime error:", e);
+    return NextResponse.json(getFallback());
+  }
+}
+
+function getFallback(): ProviderGroup[] {
+  return [
+    {
+      id: "anthropic", name: "Anthropic", models: [
+        { id: "claude-opus-4-8", name: "Claude Opus 4.8", providerId: "anthropic", providerName: "Anthropic", api: "anthropic-messages", contextWindow: 1000000, maxTokens: 128000, supportsThinking: true, supportsTemperature: false, thinkingLevels: ["xhigh", "max"], inputTypes: ["text", "image"], costInput: 15, costOutput: 75 },
+        { id: "claude-sonnet-5", name: "Claude Sonnet 5", providerId: "anthropic", providerName: "Anthropic", api: "anthropic-messages", contextWindow: 1000000, maxTokens: 128000, supportsThinking: true, supportsTemperature: false, thinkingLevels: ["xhigh", "max"], inputTypes: ["text", "image"], costInput: 3, costOutput: 15 },
+        { id: "claude-opus-4-5", name: "Claude Opus 4.5", providerId: "anthropic", providerName: "Anthropic", api: "anthropic-messages", contextWindow: 200000, maxTokens: 64000, supportsThinking: false, supportsTemperature: true, thinkingLevels: [], inputTypes: ["text", "image"], costInput: 5, costOutput: 25 },
+        { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5", providerId: "anthropic", providerName: "Anthropic", api: "anthropic-messages", contextWindow: 200000, maxTokens: 64000, supportsThinking: false, supportsTemperature: true, thinkingLevels: [], inputTypes: ["text", "image"], costInput: 1, costOutput: 5 },
+      ],
+    },
+    {
+      id: "openai", name: "OpenAI", models: [
+        { id: "gpt-4o", name: "GPT-4o", providerId: "openai", providerName: "OpenAI", api: "openai-responses", contextWindow: 128000, maxTokens: 16384, supportsThinking: false, supportsTemperature: true, thinkingLevels: [], inputTypes: ["text", "image"], costInput: 2.5, costOutput: 10 },
+        { id: "o3", name: "o3", providerId: "openai", providerName: "OpenAI", api: "openai-responses", contextWindow: 200000, maxTokens: 100000, supportsThinking: true, supportsTemperature: false, thinkingLevels: ["low", "medium", "high"], inputTypes: ["text", "image"], costInput: 10, costOutput: 40 },
+      ],
+    },
+  ];
+}

package/src/app/api/models-config/route.ts

@@ -0,0 +1,41 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  readModelsConfig, writeModelsConfig,
+  readAuthConfig, writeAuthConfig,
+} from "@/lib/models-config";
+import type { ModelsConfig } from "@/lib/models-config";
+
+export const dynamic = "force-dynamic";
+
+// GET — returns { modelsConfig, auth (masked) }
+export async function GET() {
+  const modelsConfig = readModelsConfig();
+  const authRaw = readAuthConfig();
+  const auth: Record<string, string> = {};
+  for (const [k, v] of Object.entries(authRaw)) {
+    auth[k] = v.key ? "***" + v.key.slice(-4) : "";
+  }
+  return NextResponse.json({ modelsConfig, auth });
+}
+
+// PUT — body: { modelsConfig?, auth? }
+export async function PUT(req: NextRequest) {
+  try {
+    const body = await req.json() as {
+      modelsConfig?: ModelsConfig;
+      auth?: Record<string, string>;
+    };
+    if (body.modelsConfig) writeModelsConfig(body.modelsConfig);
+    if (body.auth) {
+      const current = readAuthConfig();
+      for (const [provider, key] of Object.entries(body.auth)) {
+        if (!key) delete current[provider];
+        else if (!key.startsWith("***")) current[provider] = { type: "apiKey", key };
+      }
+      writeAuthConfig(current);
+    }
+    return NextResponse.json({ success: true });
+  } catch (e) {
+    return NextResponse.json({ error: String(e) }, { status: 500 });
+  }
+}

package/src/app/api/models-config/test/route.ts

@@ -0,0 +1,84 @@
+import { NextRequest, NextResponse } from "next/server";
+import { readAuthConfig } from "@/lib/models-config";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(req: NextRequest) {
+  const start = Date.now();
+  try {
+    const { providerName, provider, model } = await req.json() as {
+      providerName: string;
+      provider: { baseUrl?: string; api?: string; apiKey?: string };
+      model: { id: string };
+    };
+
+    if (!model.id?.trim()) {
+      return NextResponse.json({ ok: false, error: "Model ID required" }, { status: 400 });
+    }
+
+    const baseUrl = provider.baseUrl?.replace(/\/$/, "") || "https://api.openai.com/v1";
+    let apiKey = provider.apiKey ?? "";
+
+    // Resolve API key: env var or shell command
+    if (apiKey.startsWith("!")) {
+      const { execSync } = await import("child_process");
+      apiKey = execSync(apiKey.slice(1)).toString().trim();
+    } else if (apiKey && !apiKey.startsWith("sk-") && !apiKey.includes(" ") && apiKey === apiKey.toUpperCase()) {
+      apiKey = process.env[apiKey] ?? apiKey;
+    }
+
+    // Also try from auth.json if no key provided
+    if (!apiKey) {
+      const auth = readAuthConfig();
+      apiKey = auth[providerName]?.key ?? "";
+    }
+
+    const api = provider.api ?? "openai-responses";
+    let status = 0;
+    let responseText = "";
+
+    if (api === "anthropic-messages") {
+      const res = await fetch(`${baseUrl}/v1/messages`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "x-api-key": apiKey,
+          "anthropic-version": "2023-06-01",
+        },
+        body: JSON.stringify({
+          model: model.id,
+          max_tokens: 10,
+          messages: [{ role: "user", content: "ping" }],
+        }),
+        signal: AbortSignal.timeout(15000),
+      });
+      status = res.status;
+      const data = await res.json();
+      if (!res.ok) return NextResponse.json({ ok: false, error: data.error?.message ?? JSON.stringify(data), latencyMs: Date.now() - start, status });
+      responseText = data.content?.[0]?.text ?? "";
+    } else {
+      // OpenAI-compatible
+      const res = await fetch(`${baseUrl}/chat/completions`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${apiKey}`,
+        },
+        body: JSON.stringify({
+          model: model.id,
+          max_tokens: 10,
+          messages: [{ role: "user", content: "ping" }],
+        }),
+        signal: AbortSignal.timeout(15000),
+      });
+      status = res.status;
+      const data = await res.json();
+      if (!res.ok) return NextResponse.json({ ok: false, error: data.error?.message ?? JSON.stringify(data), latencyMs: Date.now() - start, status });
+      responseText = data.choices?.[0]?.message?.content ?? "";
+    }
+
+    return NextResponse.json({ ok: true, latencyMs: Date.now() - start, status, responseText });
+  } catch (e) {
+    return NextResponse.json({ ok: false, error: String(e), latencyMs: Date.now() - start }, { status: 500 });
+  }
+}

package/src/app/api/sessions/[agentId]/[sessionId]/route.ts

@@ -0,0 +1,12 @@
+import { NextResponse } from "next/server";
+import { sessionStore } from "@/lib/agents/store";
+
+type Params = { params: Promise<{ agentId: string; sessionId: string }> };
+
+// DELETE — remove a single session record (DB only, JSONL file untouched)
+export async function DELETE(_req: Request, { params }: Params) {
+  const { sessionId } = await params;
+  const ok = sessionStore.delete(sessionId);
+  if (!ok) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json({ success: true });
+}

package/src/app/api/sessions/[agentId]/route.ts

@@ -0,0 +1,19 @@
+import { NextRequest, NextResponse } from "next/server";
+import { sessionStore } from "@/lib/agents/store";
+import { initSchema } from "@/lib/db/schema";
+
+
+type Params = { params: Promise<{ agentId: string }> };
+
+// GET — list all sessions for an agent
+export async function GET(_req: NextRequest, { params }: Params) {
+  const { agentId } = await params;
+  return NextResponse.json(sessionStore.list(agentId));
+}
+
+// DELETE — clear ALL sessions for an agent
+export async function DELETE(_req: NextRequest, { params }: Params) {
+  const { agentId } = await params;
+  const count = sessionStore.deleteByAgent(agentId);
+  return NextResponse.json({ success: true, deleted: count });
+}

package/src/app/api/sessions/history/route.ts

@@ -0,0 +1,166 @@
+import { NextRequest, NextResponse } from "next/server";
+import fs from "fs";
+
+export const dynamic = "force-dynamic";
+
+interface ContentBlock {
+  type: string;
+  text?: string;
+  thinking?: string;
+  name?: string;       // tool_use: tool name
+  id?: string;         // tool_use: call id
+  input?: unknown;     // tool_use: args
+  content?: unknown;   // tool_result: result
+  is_error?: boolean;  // tool_result: error flag
+}
+
+interface JournalEntry {
+  type: string;
+  id: string;
+  parentId: string | null;
+  timestamp: string;
+  message?: {
+    role: "user" | "assistant";
+    content: string | ContentBlock[];
+    stopReason?: string;
+    errorMessage?: string;
+  };
+}
+
+interface HistoryToolCall {
+  id: string;
+  name: string;
+  input?: string;
+  output?: string;
+  isError?: boolean;
+}
+
+interface HistoryMessage {
+  id: string;
+  role: "user" | "assistant";
+  content: string;
+  thinking?: string;
+  toolCalls?: HistoryToolCall[];
+  createdAt: string;
+}
+
+/** Extract text, thinking, and tool calls from a message content block array */
+function extractContent(content: string | ContentBlock[]): {
+  text: string;
+  thinking?: string;
+  toolUses: Map<string, HistoryToolCall>;
+} {
+  if (typeof content === "string") return { text: content, toolUses: new Map() };
+
+  const textParts: string[] = [];
+  const thinkingParts: string[] = [];
+  const toolUses = new Map<string, HistoryToolCall>();
+
+  for (const block of content) {
+    if (block.type === "text" && block.text) textParts.push(block.text);
+    else if (block.type === "thinking" && block.thinking) thinkingParts.push(block.thinking);
+    else if (block.type === "tool_use" && block.id && block.name) {
+      toolUses.set(block.id, {
+        id: block.id,
+        name: block.name,
+        input: block.input !== undefined ? JSON.stringify(block.input, null, 2) : undefined,
+      });
+    }
+  }
+
+  return {
+    text: textParts.join(""),
+    thinking: thinkingParts.join("") || undefined,
+    toolUses,
+  };
+}
+
+function readSessionMessages(sessionFile: string): HistoryMessage[] {
+  if (!fs.existsSync(sessionFile)) return [];
+
+  const lines = fs.readFileSync(sessionFile, "utf8").split("\n").filter(Boolean);
+  const entries: JournalEntry[] = [];
+  for (const line of lines) {
+    try { entries.push(JSON.parse(line) as JournalEntry); } catch { /* skip */ }
+  }
+
+  // Build id → entry map and hasChild set
+  const idMap = new Map(entries.map((e) => [e.id, e]));
+  const hasChild = new Set<string>();
+  for (const e of entries) { if (e.parentId) hasChild.add(e.parentId); }
+
+  // Find latest leaf
+  const leaves = entries.filter((e) => !hasChild.has(e.id));
+  if (!leaves.length) return [];
+  const leaf = leaves[leaves.length - 1];
+
+  // Walk leaf → root
+  const path: JournalEntry[] = [];
+  let cur: JournalEntry | undefined = leaf;
+  while (cur) {
+    path.unshift(cur);
+    cur = cur.parentId ? idMap.get(cur.parentId) : undefined;
+  }
+
+  // Collect tool_result outputs keyed by tool_call_id from user messages
+  const toolResults = new Map<string, { output: string; isError: boolean }>();
+  for (const entry of path) {
+    if (entry.type !== "message" || !entry.message || entry.message.role !== "user") continue;
+    const blocks = Array.isArray(entry.message.content) ? entry.message.content : [];
+    for (const block of blocks) {
+      if (block.type === "tool_result" && block.id) {
+        const out = typeof block.content === "string"
+          ? block.content
+          : Array.isArray(block.content)
+          ? (block.content as ContentBlock[]).filter(b => b.type === "text").map(b => b.text ?? "").join("")
+          : "";
+        toolResults.set(block.id, { output: out, isError: !!block.is_error });
+      }
+    }
+  }
+
+  const messages: HistoryMessage[] = [];
+  for (const entry of path) {
+    if (entry.type !== "message" || !entry.message) continue;
+    const { role, content, stopReason, errorMessage } = entry.message;
+    if (role === "assistant" && (stopReason === "error" || errorMessage)) continue;
+
+    const { text, thinking, toolUses } = extractContent(content);
+    const visibleText = text.trim();
+    const hasToolUses = toolUses.size > 0;
+
+    if (!visibleText && !hasToolUses) continue;
+    // Skip user messages that are pure tool_result blocks
+    if (role === "user" && !visibleText && Array.isArray(content) &&
+        content.every(b => b.type === "tool_result")) continue;
+
+    // Merge tool outputs into tool calls
+    const toolCalls: HistoryToolCall[] = [];
+    for (const [id, tc] of toolUses.entries()) {
+      const result = toolResults.get(id);
+      toolCalls.push({ ...tc, output: result?.output, isError: result?.isError });
+    }
+
+    messages.push({
+      id: entry.id,
+      role,
+      content: visibleText,
+      thinking: thinking || undefined,
+      toolCalls: toolCalls.length ? toolCalls : undefined,
+      createdAt: entry.timestamp,
+    });
+  }
+
+  return messages;
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    const { sessionFile } = await req.json() as { sessionFile: string };
+    if (!sessionFile) return NextResponse.json({ error: "sessionFile required" }, { status: 400 });
+    const messages = readSessionMessages(sessionFile);
+    return NextResponse.json({ messages });
+  } catch (e) {
+    return NextResponse.json({ error: String(e) }, { status: 500 });
+  }
+}

package/src/app/api/settings/route.ts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSettings, saveSettings } from "@/lib/settings";
+import { initSchema } from "@/lib/db/schema";
+import type { AppSettings } from "@/types/settings";
+
+
+export async function GET() {
+  const settings = getSettings();
+  // Mask API keys in response
+  const masked = {
+    ...settings,
+    apiKeys: Object.fromEntries(
+      Object.entries(settings.apiKeys).map(([k, v]) => [
+        k,
+        v ? "***" + v.slice(-4) : "",
+      ])
+    ),
+  };
+  return NextResponse.json(masked);
+}
+
+export async function PUT(req: NextRequest) {
+  try {
+    const body = (await req.json()) as Partial<AppSettings>;
+    const current = getSettings();
+    // Merge — if API key value starts with ***, keep existing
+    const apiKeys = { ...current.apiKeys };
+    if (body.apiKeys) {
+      for (const [provider, val] of Object.entries(body.apiKeys)) {
+        if (val && !val.startsWith("***")) {
+          (apiKeys as Record<string, string>)[provider] = val;
+        }
+      }
+    }
+    const merged: AppSettings = {
+      ...current,
+      ...body,
+      apiKeys,
+    };
+    saveSettings(merged);
+    return NextResponse.json({ success: true });
+  } catch (e) {
+    return NextResponse.json({ error: String(e) }, { status: 500 });
+  }
+}