@jlongo78/agent-spaces 0.9.7 → 0.9.8

package/.next/standalone/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@jlongo78/agent-spaces",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@jlongo78/agent-spaces",
-      "version": "0.9.7",
+      "version": "0.9.8",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jlongo78/agent-spaces",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "Agent workspace manager for Claude, Codex, Gemini, and more",
   "bin": {
     "spaces": "./bin/spaces.js"

package/.next/standalone/src/app/(desktop)/terminal/page.tsx

@@ -4,7 +4,7 @@ import React, { useState, useEffect, useCallback, useRef } from 'react';
 import {
   Plus, Loader2, Terminal, Search, MessageSquare, FolderOpen,
   Clock, ChevronDown, ChevronRight, Save, FolderInput, Trash2, Pencil, Check, X,
-  Layers, Copy, Home, XCircle, ArrowLeftToLine, Globe, AlertCircle, Users, Brain, Maximize2,
+  Layers, Copy, Home, XCircle, ArrowLeftToLine, Globe, AlertCircle, Users, Brain, Maximize2, Wand2,
 } from 'lucide-react';
 import { useRouter } from 'next/navigation';
 import { TerminalPane } from '@/components/terminal/terminal-pane';
@@ -27,6 +27,7 @@ import { track } from '@/lib/telemetry';
 import { LobeSettings } from '@/components/cortex/lobe-settings';
 import { FileExplorer } from '@/components/files/file-explorer';
 import { useTier } from '@/hooks/use-tier';
+import { ProjectWizard } from '@/components/wizard/project-wizard';
 
 function ResizablePaneGrid({ panes, renderPane }: {
   panes: PaneData[];
@@ -139,6 +140,7 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
   const [activeWorkspace, setActiveWorkspace] = useState<Workspace | null>(null);
   const [showWsPicker, setShowWsPicker] = useState(false);
   const [showSaveAs, setShowSaveAs] = useState(false);
+  const [showWizard, setShowWizard] = useState(false);
   const [saveAsName, setSaveAsName] = useState('');
   const [saveAsColor, setSaveAsColor] = useState('#6366f1');
   const [editingWs, setEditingWs] = useState<number | null>(null);
@@ -620,7 +622,7 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
                   ))}
                 </div>
 
-                <div className="flex justify-center">
+                <div className="flex justify-center gap-3">
                   <button
                     onClick={createNewWorkspace}
                     className="flex items-center gap-2 px-4 py-2.5 text-sm border border-zinc-700 text-zinc-400 rounded-lg hover:text-white hover:border-zinc-500 transition-colors"
@@ -628,6 +630,13 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
                     <Plus className="w-4 h-4" />
                     New Workspace
                   </button>
+                  <button
+                    onClick={() => setShowWizard(true)}
+                    className="flex items-center gap-2 px-4 py-2.5 text-sm border border-dashed border-indigo-500/50 text-indigo-400 rounded-lg hover:text-indigo-300 hover:border-indigo-400 hover:bg-indigo-500/10 transition-colors"
+                  >
+                    <Wand2 className="w-4 h-4" />
+                    Plan a Project
+                  </button>
                 </div>
 
                 {/* Remote workspaces from network nodes */}
@@ -708,6 +717,15 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
             )}
           </div>
         </div>
+
+        <ProjectWizard
+          isOpen={showWizard}
+          onClose={() => setShowWizard(false)}
+          onLaunch={(wsId) => {
+            setShowWizard(false);
+            switchWorkspace(wsId);
+          }}
+        />
       </div>
     );
   }
@@ -819,11 +837,17 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
                   >
                     <Plus className="w-3 h-3" /> New Empty
                   </button>
+                  <button
+                    onClick={() => { setShowWizard(true); setShowWsPicker(false); }}
+                    className="flex items-center gap-1.5 px-2.5 py-1.5 text-[11px] text-indigo-400 hover:text-indigo-300 hover:bg-indigo-500/10 rounded transition-colors flex-1"
+                  >
+                    <Wand2 className="w-3 h-3" /> Plan Project
+                  </button>
                   <button
                     onClick={() => { setShowSaveAs(true); setShowWsPicker(false); }}
                     className="flex items-center gap-1.5 px-2.5 py-1.5 text-[11px] text-zinc-400 hover:text-white hover:bg-zinc-700 rounded transition-colors flex-1"
                   >
-                    <Copy className="w-3 h-3" /> Duplicate Current
+                    <Copy className="w-3 h-3" /> Duplicate
                   </button>
                 </div>
               </div>
@@ -1203,7 +1227,7 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
             />
           </div>
         )}
-        {visiblePanes.length === 0 && poppedOut.size === 0 ? (
+        {visiblePanes.length === 0 && poppedOut.size === 0 && minimized.size === 0 ? (
           <div className="flex-1 flex items-center justify-center">
             <div className="text-center space-y-3">
               {/* eslint-disable-next-line @next/next/no-img-element */}
@@ -1222,7 +1246,13 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
         ) : visiblePanes.length === 0 ? (
           <div className="flex-1 flex items-center justify-center">
             <div className="text-center space-y-2">
-              <p className="text-zinc-500 text-sm">All panes are popped out to separate windows.</p>
+              <p className="text-zinc-500 text-sm">
+                {minimized.size > 0 && poppedOut.size > 0
+                  ? 'All panes are minimized or popped out.'
+                  : minimized.size > 0
+                  ? `All panes are minimized. Use the toolbar to restore them.`
+                  : 'All panes are popped out to separate windows.'}
+              </p>
               <button
                 onClick={() => setShowAdd(true)}
                 className="px-3 py-1.5 text-xs text-zinc-400 hover:text-white border border-zinc-700 rounded-md hover:border-zinc-600 inline-flex items-center gap-1.5"
@@ -1286,6 +1316,15 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
           />
         )}
       </div>
+
+      <ProjectWizard
+        isOpen={showWizard}
+        onClose={() => setShowWizard(false)}
+        onLaunch={(wsId) => {
+          setShowWizard(false);
+          switchWorkspace(wsId);
+        }}
+      />
     </div>
   );
 }

package/.next/standalone/src/app/api/benchmark/run/route.ts

@@ -22,6 +22,7 @@ export async function POST(request: NextRequest) {
       categories,
       noJudge = false,
       model = 'claude-haiku-4-5',
+      concurrency,
     } = body;
 
     // Build args for the benchmark CLI
@@ -30,6 +31,10 @@ export async function POST(request: NextRequest) {
     if (categories) args.push('--category', categories);
     if (noJudge) args.push('--no-judge');
     args.push('--models', model);
+    if (concurrency != null) {
+      const clamped = Math.min(5, Math.max(1, Math.floor(Number(concurrency)) || 1));
+      args.push('--concurrency', String(clamped));
+    }
 
     // Find the cortex repo
     const cortexDir = findCortexDir();
@@ -77,14 +82,30 @@ export async function POST(request: NextRequest) {
 }
 
 function findCortexDir(): string | null {
-  const candidates = [
+  const candidates: string[] = [];
+
+  // Primary: resolve the addon's package location via NODE_PATH — this tracks
+  // however the host actually loaded @spaces/cortex at runtime (managed
+  // install under ~/.spaces/packages, symlink, global, etc.).
+  try {
+    const { createRequire } = require('module') as typeof import('module');
+    const req = createRequire(path.join(process.cwd(), 'package.json'));
+    candidates.push(path.dirname(req.resolve('@spaces/cortex/package.json')));
+  } catch { /* addon not resolvable from this process */ }
+
+  // Fallbacks: managed install location and local sibling checkouts.
+  if (process.env.HOME) {
+    candidates.push(path.join(process.env.HOME, '.spaces', 'packages', 'cortex'));
+  }
+  candidates.push(
     path.resolve(process.cwd(), '../spaces-cortex'),
     path.resolve(process.cwd(), '../../spaces-cortex'),
     'C:\\projects\\spaces-cortex',
     '/c/projects/spaces-cortex',
-  ];
+  );
+
   for (const dir of candidates) {
-    if (fs.existsSync(path.join(dir, 'tests', 'benchmark', 'index.ts'))) {
+    if (dir && fs.existsSync(path.join(dir, 'tests', 'benchmark', 'index.ts'))) {
       return dir;
     }
   }

package/.next/standalone/src/app/api/cortex/context/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import { getAuthUser, withUser } from '@/lib/auth';
-import { getCortex, isCortexAvailable } from '@/lib/cortex';
+import { getCortex, isCortexAvailable, getCortexClient } from '@/lib/cortex';
 import { ContextEngine } from '@/lib/cortex/retrieval/context-engine';
 import { EntityResolver } from '@/lib/cortex/graph/resolver';
 import { slugify } from '@/lib/cortex/graph/types';

package/.next/standalone/src/app/api/cortex/knowledge/route.ts

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import crypto from 'crypto';
 import { getAuthUser, withUser } from '@/lib/auth';
-import { isCortexAvailable, getCortex } from '@/lib/cortex';
+import { isCortexAvailable, getCortex, getCortexClient } from '@/lib/cortex';
 import { isValidKnowledgeType, isValidLayer, getConfidenceBase } from '@/lib/cortex/knowledge/types';
 import { layerToScope, scopeToLayer, scopeToLayerKey } from '@/lib/cortex/knowledge/compat';
 

package/.next/standalone/src/app/api/cortex/search/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import { getAuthUser, withUser } from '@/lib/auth';
-import { isCortexAvailable, getCortex } from '@/lib/cortex';
+import { isCortexAvailable, getCortex, getCortexClient } from '@/lib/cortex';
 
 export async function GET(request: NextRequest) {
   const user = getAuthUser(request);
@@ -19,7 +19,7 @@ export async function GET(request: NextRequest) {
     const layer = url.searchParams.get('layer') as 'personal' | 'workspace' | 'team' | null;
     const limit = parseInt(url.searchParams.get('limit') || '5', 10);
 
-    // Browse mode: return recent knowledge without a search query
+    // Browse mode: return recent knowledge without a search query (local engine only)
     if (!query) {
       const layers = layer ? [layer] : (['personal', 'workspace', 'team'] as const);
       const results: any[] = [];
@@ -30,6 +30,18 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ results: results.slice(0, limit) });
     }
 
+    // Use client for search (fans out to all connected servers)
+    const client = await getCortexClient();
+    if (client) {
+      const results = await client.search(query, {
+        limit,
+        layers: layer ? [layer] : undefined,
+      });
+      console.log(`[Cortex Search] q="${query.slice(0, 60)}" → ${results.length} results (multi-server)`);
+      return NextResponse.json({ results });
+    }
+
+    // Fallback to direct engine search
     const [queryVector] = await cortex.embedding.embed([query]);
 
     const results = await cortex.search.search(queryVector, {

package/.next/standalone/src/app/api/folders/route.ts

@@ -1,12 +1,14 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getAuthUser } from '@/lib/auth';
 import { readConfig } from '@/lib/config';
+import { lookupShellUser, resolveHome, execAsUser } from '@/lib/shell-user';
 import fs from 'fs';
 import path from 'path';
 
 export async function GET(request: NextRequest) {
   const user = getAuthUser(request);
-  const userHome = require('os').homedir();
+  const shellUser = lookupShellUser(user);
+  const userHome = resolveHome(shellUser);
   const config = readConfig(user);
   const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
     .map(d => path.resolve(d));
@@ -52,8 +54,9 @@ export async function GET(request: NextRequest) {
 
 export async function POST(request: NextRequest) {
   const user = getAuthUser(request);
+  const shellUser = lookupShellUser(user);
+  const userHome = resolveHome(shellUser);
   const config = readConfig(user);
-  const userHome = require('os').homedir();
   const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
     .map((d: string) => path.resolve(d));
 
@@ -83,15 +86,22 @@ export async function POST(request: NextRequest) {
 
     const newPath = path.join(resolvedParent, name);
 
-    // Check if already exists
     if (fs.existsSync(newPath)) {
       return NextResponse.json({ error: 'Folder already exists' }, { status: 409 });
     }
 
-    fs.mkdirSync(newPath, { recursive: true });
+    // Create the directory as the authenticated shell user, not as the server process user.
+    // Otherwise a mkdir inside another user's home fails with EACCES.
+    const result = execAsUser(shellUser, ['mkdir', '--', newPath]);
+    if (result.status !== 0) {
+      const msg = (result.stderr || '').trim() || 'Failed to create folder';
+      const status = /exists/i.test(msg) ? 409 : /permission|denied/i.test(msg) ? 403 : 500;
+      return NextResponse.json({ error: msg }, { status });
+    }
 
     return NextResponse.json({ path: newPath }, { status: 201 });
-  } catch {
-    return NextResponse.json({ error: 'Failed to create folder' }, { status: 500 });
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : 'Failed to create folder';
+    return NextResponse.json({ error: msg }, { status: 500 });
   }
 }

package/.next/standalone/src/app/api/network/panes/[id]/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getPaneById, updatePane, deletePane } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -17,11 +18,16 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
     throw e;
   }
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  const pane = getPaneById(id);
-  if (!pane) return Response.json({ error: 'Pane not found' }, { status: 404 });
-  return Response.json(pane);
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const pane = getPaneById(id);
+    if (!pane) return Response.json({ error: 'Pane not found' }, { status: 404 });
+    return Response.json(pane);
+  });
 }
 
 export async function PUT(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
@@ -36,11 +42,16 @@ export async function PUT(req: NextRequest, { params }: { params: Promise<{ id:
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  const body = await req.json();
-  updatePane(id, body);
-  return Response.json({ success: true });
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const body = await req.json();
+    updatePane(id, body);
+    return Response.json({ success: true });
+  });
 }
 
 export async function DELETE(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
@@ -55,8 +66,13 @@ export async function DELETE(req: NextRequest, { params }: { params: Promise<{ i
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  deletePane(id);
-  return Response.json({ success: true });
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    deletePane(id);
+    return Response.json({ success: true });
+  });
 }

package/.next/standalone/src/app/api/network/panes/route.ts

@@ -3,6 +3,7 @@ import { randomUUID } from 'crypto';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getPanesByWorkspace, getActivePanes, createPane } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -18,10 +19,15 @@ export async function GET(req: NextRequest) {
     throw e;
   }
 
-  await ensureInitialized();
-  const wsId = req.nextUrl.searchParams.get('workspace_id');
-  const panes = wsId ? getPanesByWorkspace(parseInt(wsId, 10)) : getActivePanes();
-  return Response.json({ panes });
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const wsId = req.nextUrl.searchParams.get('workspace_id');
+    const panes = wsId ? getPanesByWorkspace(parseInt(wsId, 10)) : getActivePanes();
+    return Response.json({ panes });
+  });
 }
 
 export async function POST(req: NextRequest) {
@@ -36,15 +42,20 @@ export async function POST(req: NextRequest) {
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
-  await ensureInitialized();
-  const body = await req.json();
-  const pane = createPane({
-    id: body.id || randomUUID(),
-    title: body.title || 'Terminal',
-    color: body.color || '#6366f1',
-    cwd: body.cwd || '~',
-    agentType: body.agentType || 'shell',
-    workspaceId: body.workspaceId,
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const body = await req.json();
+    const pane = createPane({
+      id: body.id || randomUUID(),
+      title: body.title || 'Terminal',
+      color: body.color || '#6366f1',
+      cwd: body.cwd || '~',
+      agentType: body.agentType || 'shell',
+      workspaceId: body.workspaceId,
+    });
+    return Response.json(pane);
   });
-  return Response.json(pane);
 }

package/.next/standalone/src/app/api/network/projects/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getAllProjects } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -10,8 +11,9 @@ export async function GET(req: NextRequest) {
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -19,7 +21,12 @@ export async function GET(req: NextRequest) {
     throw e;
   }
 
-  await ensureInitialized();
-  const projects = getAllProjects();
-  return Response.json(projects);
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const projects = getAllProjects();
+    return Response.json(projects);
+  });
 }

package/.next/standalone/src/app/api/network/search/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { searchSessions } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -10,8 +11,9 @@ export async function GET(req: NextRequest) {
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -19,20 +21,25 @@ export async function GET(req: NextRequest) {
     throw e;
   }
 
-  await ensureInitialized();
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
 
-  const { searchParams } = req.nextUrl;
-  const query = searchParams.get('q') || '';
-  if (!query) {
-    return Response.json({ results: [], query: '' });
-  }
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+
+    const { searchParams } = req.nextUrl;
+    const query = searchParams.get('q') || '';
+    if (!query) {
+      return Response.json({ results: [], query: '' });
+    }
 
-  const params = {
-    projectId: searchParams.get('projectId') || undefined,
-    limit: parseInt(searchParams.get('limit') || '20', 10),
-    offset: parseInt(searchParams.get('offset') || '0', 10),
-  };
+    const params = {
+      projectId: searchParams.get('projectId') || undefined,
+      limit: parseInt(searchParams.get('limit') || '20', 10),
+      offset: parseInt(searchParams.get('offset') || '0', 10),
+    };
 
-  const results = searchSessions(query, params);
-  return Response.json({ results, query });
+    const results = searchSessions(query, params);
+    return Response.json({ results, query });
+  });
 }

package/.next/standalone/src/app/api/network/sessions/[id]/messages/route.ts

@@ -3,6 +3,7 @@ import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getSessionById } from '@/lib/db/queries';
 import { readMessages } from '@/lib/claude/parser';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -11,8 +12,9 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -20,17 +22,22 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
     throw e;
   }
 
-  await ensureInitialized();
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  const { searchParams } = req.nextUrl;
-  const offset = parseInt(searchParams.get('offset') || '0', 10);
-  const limit = parseInt(searchParams.get('limit') || '50', 10);
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const { searchParams } = req.nextUrl;
+    const offset = parseInt(searchParams.get('offset') || '0', 10);
+    const limit = parseInt(searchParams.get('limit') || '50', 10);
 
-  const session = getSessionById(id);
-  if (!session) {
-    return Response.json({ error: 'Session not found' }, { status: 404 });
-  }
+    const session = getSessionById(id);
+    if (!session) {
+      return Response.json({ error: 'Session not found' }, { status: 404 });
+    }
 
-  const result = await readMessages(session.fullPath, offset, limit);
-  return Response.json(result);
+    const result = await readMessages(session.fullPath, offset, limit);
+    return Response.json(result);
+  });
 }

package/.next/standalone/src/app/api/network/sessions/[id]/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getSessionById, getSessionTags, getSessionWorkspaces } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -10,8 +11,9 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -19,16 +21,21 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
     throw e;
   }
 
-  await ensureInitialized();
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  const session = getSessionById(id);
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const session = getSessionById(id);
 
-  if (!session) {
-    return Response.json({ error: 'Session not found' }, { status: 404 });
-  }
+    if (!session) {
+      return Response.json({ error: 'Session not found' }, { status: 404 });
+    }
 
-  const tags = getSessionTags(session.id);
-  const workspaces = getSessionWorkspaces(session.id);
+    const tags = getSessionTags(session.id);
+    const workspaces = getSessionWorkspaces(session.id);
 
-  return Response.json({ ...session, tagObjects: tags, workspaces });
+    return Response.json({ ...session, tagObjects: tags, workspaces });
+  });
 }