@jlongo78/agent-spaces 0.9.7 → 0.9.9

package/.next/standalone/src/app/(desktop)/terminal/page.tsx

@@ -4,7 +4,7 @@ import React, { useState, useEffect, useCallback, useRef } from 'react';
 import {
   Plus, Loader2, Terminal, Search, MessageSquare, FolderOpen,
   Clock, ChevronDown, ChevronRight, Save, FolderInput, Trash2, Pencil, Check, X,
-  Layers, Copy, Home, XCircle, ArrowLeftToLine, Globe, AlertCircle, Users, Brain, Maximize2,
+  Layers, Copy, Home, XCircle, ArrowLeftToLine, Globe, AlertCircle, Users, Brain, Maximize2, Wand2,
 } from 'lucide-react';
 import { useRouter } from 'next/navigation';
 import { TerminalPane } from '@/components/terminal/terminal-pane';
@@ -27,6 +27,9 @@ import { track } from '@/lib/telemetry';
 import { LobeSettings } from '@/components/cortex/lobe-settings';
 import { FileExplorer } from '@/components/files/file-explorer';
 import { useTier } from '@/hooks/use-tier';
+import { ProjectWizard } from '@/components/wizard/project-wizard';
+import { WorkspaceTodos } from '@/components/workspace/workspace-todos';
+import { ClaudeUsageStrip } from '@/components/claude/claude-usage-strip';
 
 function ResizablePaneGrid({ panes, renderPane }: {
   panes: PaneData[];
@@ -134,15 +137,27 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
   // SSE bus events for real-time updates
   useSSEBusEvents();
 
+  // Experimental feature toggles (read-once on mount)
+  const [todosEnabled, setTodosEnabled] = useState(false);
+  useEffect(() => {
+    fetch(api('/api/config'))
+      .then(r => r.json())
+      .then(data => setTodosEnabled(!!data.todosEnabled))
+      .catch(() => {});
+  }, []);
+
   // Workspace state
   const [workspaces, setWorkspaces] = useState<Workspace[]>([]);
   const [activeWorkspace, setActiveWorkspace] = useState<Workspace | null>(null);
   const [showWsPicker, setShowWsPicker] = useState(false);
   const [showSaveAs, setShowSaveAs] = useState(false);
+  const [showWizard, setShowWizard] = useState(false);
   const [saveAsName, setSaveAsName] = useState('');
   const [saveAsColor, setSaveAsColor] = useState('#6366f1');
   const [editingWs, setEditingWs] = useState<number | null>(null);
   const [editWsName, setEditWsName] = useState('');
+  const [colorPickerWs, setColorPickerWs] = useState<number | null>(null);
+  const colorPickerRef = useRef<HTMLDivElement>(null);
   const [lobeOpenWs, setLobeOpenWs] = useState<number | null>(null);
   const [showFiles, setShowFiles] = useState(false);
   const [browseTarget, setBrowseTarget] = useState<string | null>(null);
@@ -296,6 +311,9 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
       if (wsPickerRef.current && !wsPickerRef.current.contains(e.target as Node)) {
         setShowWsPicker(false);
       }
+      if (colorPickerRef.current && !colorPickerRef.current.contains(e.target as Node)) {
+        setColorPickerWs(null);
+      }
     }
     document.addEventListener('mousedown', handleClick);
     return () => document.removeEventListener('mousedown', handleClick);
@@ -541,6 +559,16 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
     await loadWorkspaces();
   }, [loadWorkspaces]);
 
+  const changeWorkspaceColor = useCallback(async (wsId: number, color: string) => {
+    await fetch(api(`/api/workspaces/${wsId}`), {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ color }),
+    });
+    setColorPickerWs(null);
+    await loadWorkspaces();
+  }, [loadWorkspaces]);
+
   // ─── Render ────────────────────────────────────────────────
 
   const visiblePanes = panes.filter(p => !poppedOut.has(p.id) && !minimized.has(p.id));
@@ -620,7 +648,7 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
                   ))}
                 </div>
 
-                <div className="flex justify-center">
+                <div className="flex justify-center gap-3">
                   <button
                     onClick={createNewWorkspace}
                     className="flex items-center gap-2 px-4 py-2.5 text-sm border border-zinc-700 text-zinc-400 rounded-lg hover:text-white hover:border-zinc-500 transition-colors"
@@ -628,6 +656,13 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
                     <Plus className="w-4 h-4" />
                     New Workspace
                   </button>
+                  <button
+                    onClick={() => setShowWizard(true)}
+                    className="flex items-center gap-2 px-4 py-2.5 text-sm border border-dashed border-indigo-500/50 text-indigo-400 rounded-lg hover:text-indigo-300 hover:border-indigo-400 hover:bg-indigo-500/10 transition-colors"
+                  >
+                    <Wand2 className="w-4 h-4" />
+                    Plan a Project
+                  </button>
                 </div>
 
                 {/* Remote workspaces from network nodes */}
@@ -708,6 +743,15 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
             )}
           </div>
         </div>
+
+        <ProjectWizard
+          isOpen={showWizard}
+          onClose={() => setShowWizard(false)}
+          onLaunch={(wsId) => {
+            setShowWizard(false);
+            switchWorkspace(wsId);
+          }}
+        />
       </div>
     );
   }
@@ -774,11 +818,33 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
                         </div>
                       ) : (
                         <>
+                          <div className="relative pl-3">
+                            <button
+                              onClick={(e) => {
+                                e.stopPropagation();
+                                setColorPickerWs(colorPickerWs === ws.id ? null : ws.id);
+                              }}
+                              className="w-2.5 h-2.5 rounded-full flex-shrink-0 hover:ring-2 hover:ring-zinc-500/50 transition-all"
+                              style={{ backgroundColor: ws.color }}
+                              title="Change color"
+                            />
+                            {colorPickerWs === ws.id && (
+                              <div
+                                ref={colorPickerRef}
+                                className="absolute z-50 top-full left-0 mt-1.5 p-2 bg-zinc-800 border border-zinc-700 rounded-md shadow-xl"
+                                onClick={(e) => e.stopPropagation()}
+                              >
+                                <ColorPicker
+                                  value={ws.color}
+                                  onChange={(c) => changeWorkspaceColor(ws.id, c)}
+                                />
+                              </div>
+                            )}
+                          </div>
                           <button
                             onClick={() => switchWorkspace(ws.id)}
-                            className="flex items-center gap-2 flex-1 px-3 py-2 text-left"
+                            className="flex items-center gap-2 flex-1 py-2 pr-3 text-left"
                           >
-                            <span className="w-2.5 h-2.5 rounded-full flex-shrink-0" style={{ backgroundColor: ws.color }} />
                             <span className="text-xs text-white truncate flex-1">{ws.name}</span>
                             <span className="text-[10px] text-zinc-500">{ws.paneCount || 0} panes</span>
                             {ws.isActive && <span className="text-[10px] text-indigo-400">active</span>}
@@ -819,11 +885,17 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
                   >
                     <Plus className="w-3 h-3" /> New Empty
                   </button>
+                  <button
+                    onClick={() => { setShowWizard(true); setShowWsPicker(false); }}
+                    className="flex items-center gap-1.5 px-2.5 py-1.5 text-[11px] text-indigo-400 hover:text-indigo-300 hover:bg-indigo-500/10 rounded transition-colors flex-1"
+                  >
+                    <Wand2 className="w-3 h-3" /> Plan Project
+                  </button>
                   <button
                     onClick={() => { setShowSaveAs(true); setShowWsPicker(false); }}
                     className="flex items-center gap-1.5 px-2.5 py-1.5 text-[11px] text-zinc-400 hover:text-white hover:bg-zinc-700 rounded transition-colors flex-1"
                   >
-                    <Copy className="w-3 h-3" /> Duplicate Current
+                    <Copy className="w-3 h-3" /> Duplicate
                   </button>
                 </div>
               </div>
@@ -837,6 +909,7 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
         </div>
 
         <div className="flex items-center gap-2">
+          <ClaudeUsageStrip enabled={panes.some(p => p.agentType === 'claude' && !poppedOut.has(p.id))} />
           <button
             onClick={() => setShowFiles(!showFiles)}
             className={`flex items-center gap-1.5 px-2.5 py-1.5 text-xs rounded-md border transition-colors ${
@@ -1193,6 +1266,9 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
         </div>
       )}
 
+      {/* Workspace todos */}
+      {todosEnabled && <WorkspaceTodos workspace={activeWorkspace} />}
+
       {/* File Explorer + Terminal grid + Activity Panel */}
       <div className="flex-1 flex overflow-hidden min-h-0">
         {showFiles && (
@@ -1203,7 +1279,7 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
             />
           </div>
         )}
-        {visiblePanes.length === 0 && poppedOut.size === 0 ? (
+        {visiblePanes.length === 0 && poppedOut.size === 0 && minimized.size === 0 ? (
           <div className="flex-1 flex items-center justify-center">
             <div className="text-center space-y-3">
               {/* eslint-disable-next-line @next/next/no-img-element */}
@@ -1222,7 +1298,13 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
         ) : visiblePanes.length === 0 ? (
           <div className="flex-1 flex items-center justify-center">
             <div className="text-center space-y-2">
-              <p className="text-zinc-500 text-sm">All panes are popped out to separate windows.</p>
+              <p className="text-zinc-500 text-sm">
+                {minimized.size > 0 && poppedOut.size > 0
+                  ? 'All panes are minimized or popped out.'
+                  : minimized.size > 0
+                  ? `All panes are minimized. Use the toolbar to restore them.`
+                  : 'All panes are popped out to separate windows.'}
+              </p>
               <button
                 onClick={() => setShowAdd(true)}
                 className="px-3 py-1.5 text-xs text-zinc-400 hover:text-white border border-zinc-700 rounded-md hover:border-zinc-600 inline-flex items-center gap-1.5"
@@ -1286,6 +1368,15 @@ function TerminalPageInner({ terminalToken }: { terminalToken: string }) {
           />
         )}
       </div>
+
+      <ProjectWizard
+        isOpen={showWizard}
+        onClose={() => setShowWizard(false)}
+        onLaunch={(wsId) => {
+          setShowWizard(false);
+          switchWorkspace(wsId);
+        }}
+      />
     </div>
   );
 }

package/.next/standalone/src/app/api/benchmark/run/route.ts

@@ -22,6 +22,7 @@ export async function POST(request: NextRequest) {
       categories,
       noJudge = false,
       model = 'claude-haiku-4-5',
+      concurrency,
     } = body;
 
     // Build args for the benchmark CLI
@@ -30,6 +31,10 @@ export async function POST(request: NextRequest) {
     if (categories) args.push('--category', categories);
     if (noJudge) args.push('--no-judge');
     args.push('--models', model);
+    if (concurrency != null) {
+      const clamped = Math.min(5, Math.max(1, Math.floor(Number(concurrency)) || 1));
+      args.push('--concurrency', String(clamped));
+    }
 
     // Find the cortex repo
     const cortexDir = findCortexDir();
@@ -77,14 +82,30 @@ export async function POST(request: NextRequest) {
 }
 
 function findCortexDir(): string | null {
-  const candidates = [
+  const candidates: string[] = [];
+
+  // Primary: resolve the addon's package location via NODE_PATH — this tracks
+  // however the host actually loaded @spaces/cortex at runtime (managed
+  // install under ~/.spaces/packages, symlink, global, etc.).
+  try {
+    const { createRequire } = require('module') as typeof import('module');
+    const req = createRequire(path.join(process.cwd(), 'package.json'));
+    candidates.push(path.dirname(req.resolve('@spaces/cortex/package.json')));
+  } catch { /* addon not resolvable from this process */ }
+
+  // Fallbacks: managed install location and local sibling checkouts.
+  if (process.env.HOME) {
+    candidates.push(path.join(process.env.HOME, '.spaces', 'packages', 'cortex'));
+  }
+  candidates.push(
     path.resolve(process.cwd(), '../spaces-cortex'),
     path.resolve(process.cwd(), '../../spaces-cortex'),
     'C:\\projects\\spaces-cortex',
     '/c/projects/spaces-cortex',
-  ];
+  );
+
   for (const dir of candidates) {
-    if (fs.existsSync(path.join(dir, 'tests', 'benchmark', 'index.ts'))) {
+    if (dir && fs.existsSync(path.join(dir, 'tests', 'benchmark', 'index.ts'))) {
       return dir;
     }
   }

package/.next/standalone/src/app/api/claude/usage/route.ts

@@ -0,0 +1,33 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getAuthUser, withUser } from '@/lib/auth';
+import { ensureInitialized } from '@/lib/db/init';
+import { readClaudeAiOauthTokens, isTokenExpired } from '@/lib/claude/credentials';
+import { fetchUtilization } from '@/lib/claude/usage';
+import type { UsageResponse } from '@/types/claude';
+
+export async function GET(request: NextRequest) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    await ensureInitialized();
+
+    const tokens = await readClaudeAiOauthTokens();
+    if (!tokens) {
+      const body: UsageResponse = { status: 'unauthenticated' };
+      return NextResponse.json(body);
+    }
+
+    if (isTokenExpired(tokens)) {
+      const body: UsageResponse = { status: 'expired' };
+      return NextResponse.json(body);
+    }
+
+    const outcome = await fetchUtilization(tokens.accessToken);
+    if (!outcome.ok) {
+      const body: UsageResponse = { status: 'upstream_error' };
+      return NextResponse.json(body);
+    }
+
+    const body: UsageResponse = { status: 'ok', data: outcome.data };
+    return NextResponse.json(body);
+  });
+}

package/.next/standalone/src/app/api/config/route.ts

@@ -24,6 +24,9 @@ export async function PUT(request: NextRequest) {
         .filter((d: unknown) => typeof d === 'string' && isAbsolute(d))
         .map((d: string) => resolve(d));
     }
+    if (typeof body.todosEnabled === 'boolean') {
+      updates.todosEnabled = body.todosEnabled;
+    }
     const config = writeConfig(user, updates);
     return NextResponse.json(config);
   });

package/.next/standalone/src/app/api/cortex/context/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import { getAuthUser, withUser } from '@/lib/auth';
-import { getCortex, isCortexAvailable } from '@/lib/cortex';
+import { getCortex, isCortexAvailable, getCortexClient } from '@/lib/cortex';
 import { ContextEngine } from '@/lib/cortex/retrieval/context-engine';
 import { EntityResolver } from '@/lib/cortex/graph/resolver';
 import { slugify } from '@/lib/cortex/graph/types';

package/.next/standalone/src/app/api/cortex/knowledge/route.ts

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import crypto from 'crypto';
 import { getAuthUser, withUser } from '@/lib/auth';
-import { isCortexAvailable, getCortex } from '@/lib/cortex';
+import { isCortexAvailable, getCortex, getCortexClient } from '@/lib/cortex';
 import { isValidKnowledgeType, isValidLayer, getConfidenceBase } from '@/lib/cortex/knowledge/types';
 import { layerToScope, scopeToLayer, scopeToLayerKey } from '@/lib/cortex/knowledge/compat';
 

package/.next/standalone/src/app/api/cortex/search/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import { getAuthUser, withUser } from '@/lib/auth';
-import { isCortexAvailable, getCortex } from '@/lib/cortex';
+import { isCortexAvailable, getCortex, getCortexClient } from '@/lib/cortex';
 
 export async function GET(request: NextRequest) {
   const user = getAuthUser(request);
@@ -19,7 +19,7 @@ export async function GET(request: NextRequest) {
     const layer = url.searchParams.get('layer') as 'personal' | 'workspace' | 'team' | null;
     const limit = parseInt(url.searchParams.get('limit') || '5', 10);
 
-    // Browse mode: return recent knowledge without a search query
+    // Browse mode: return recent knowledge without a search query (local engine only)
     if (!query) {
       const layers = layer ? [layer] : (['personal', 'workspace', 'team'] as const);
       const results: any[] = [];
@@ -30,6 +30,18 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ results: results.slice(0, limit) });
     }
 
+    // Use client for search (fans out to all connected servers)
+    const client = await getCortexClient();
+    if (client) {
+      const results = await client.search(query, {
+        limit,
+        layers: layer ? [layer] : undefined,
+      });
+      console.log(`[Cortex Search] q="${query.slice(0, 60)}" → ${results.length} results (multi-server)`);
+      return NextResponse.json({ results });
+    }
+
+    // Fallback to direct engine search
     const [queryVector] = await cortex.embedding.embed([query]);
 
     const results = await cortex.search.search(queryVector, {

package/.next/standalone/src/app/api/folders/route.ts

@@ -1,12 +1,14 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getAuthUser } from '@/lib/auth';
 import { readConfig } from '@/lib/config';
+import { lookupShellUser, resolveHome, execAsUser } from '@/lib/shell-user';
 import fs from 'fs';
 import path from 'path';
 
 export async function GET(request: NextRequest) {
   const user = getAuthUser(request);
-  const userHome = require('os').homedir();
+  const shellUser = lookupShellUser(user);
+  const userHome = resolveHome(shellUser);
   const config = readConfig(user);
   const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
     .map(d => path.resolve(d));
@@ -52,8 +54,9 @@ export async function GET(request: NextRequest) {
 
 export async function POST(request: NextRequest) {
   const user = getAuthUser(request);
+  const shellUser = lookupShellUser(user);
+  const userHome = resolveHome(shellUser);
   const config = readConfig(user);
-  const userHome = require('os').homedir();
   const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
     .map((d: string) => path.resolve(d));
 
@@ -83,15 +86,22 @@ export async function POST(request: NextRequest) {
 
     const newPath = path.join(resolvedParent, name);
 
-    // Check if already exists
     if (fs.existsSync(newPath)) {
       return NextResponse.json({ error: 'Folder already exists' }, { status: 409 });
     }
 
-    fs.mkdirSync(newPath, { recursive: true });
+    // Create the directory as the authenticated shell user, not as the server process user.
+    // Otherwise a mkdir inside another user's home fails with EACCES.
+    const result = execAsUser(shellUser, ['mkdir', '--', newPath]);
+    if (result.status !== 0) {
+      const msg = (result.stderr || '').trim() || 'Failed to create folder';
+      const status = /exists/i.test(msg) ? 409 : /permission|denied/i.test(msg) ? 403 : 500;
+      return NextResponse.json({ error: msg }, { status });
+    }
 
     return NextResponse.json({ path: newPath }, { status: 201 });
-  } catch {
-    return NextResponse.json({ error: 'Failed to create folder' }, { status: 500 });
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : 'Failed to create folder';
+    return NextResponse.json({ error: msg }, { status: 500 });
   }
 }

package/.next/standalone/src/app/api/network/panes/[id]/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getPaneById, updatePane, deletePane } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -17,11 +18,16 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
     throw e;
   }
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  const pane = getPaneById(id);
-  if (!pane) return Response.json({ error: 'Pane not found' }, { status: 404 });
-  return Response.json(pane);
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const pane = getPaneById(id);
+    if (!pane) return Response.json({ error: 'Pane not found' }, { status: 404 });
+    return Response.json(pane);
+  });
 }
 
 export async function PUT(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
@@ -36,11 +42,16 @@ export async function PUT(req: NextRequest, { params }: { params: Promise<{ id:
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  const body = await req.json();
-  updatePane(id, body);
-  return Response.json({ success: true });
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const body = await req.json();
+    updatePane(id, body);
+    return Response.json({ success: true });
+  });
 }
 
 export async function DELETE(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
@@ -55,8 +66,13 @@ export async function DELETE(req: NextRequest, { params }: { params: Promise<{ i
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  deletePane(id);
-  return Response.json({ success: true });
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    deletePane(id);
+    return Response.json({ success: true });
+  });
 }

package/.next/standalone/src/app/api/network/panes/route.ts

@@ -3,6 +3,7 @@ import { randomUUID } from 'crypto';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getPanesByWorkspace, getActivePanes, createPane } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -18,10 +19,15 @@ export async function GET(req: NextRequest) {
     throw e;
   }
 
-  await ensureInitialized();
-  const wsId = req.nextUrl.searchParams.get('workspace_id');
-  const panes = wsId ? getPanesByWorkspace(parseInt(wsId, 10)) : getActivePanes();
-  return Response.json({ panes });
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const wsId = req.nextUrl.searchParams.get('workspace_id');
+    const panes = wsId ? getPanesByWorkspace(parseInt(wsId, 10)) : getActivePanes();
+    return Response.json({ panes });
+  });
 }
 
 export async function POST(req: NextRequest) {
@@ -36,15 +42,20 @@ export async function POST(req: NextRequest) {
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
-  await ensureInitialized();
-  const body = await req.json();
-  const pane = createPane({
-    id: body.id || randomUUID(),
-    title: body.title || 'Terminal',
-    color: body.color || '#6366f1',
-    cwd: body.cwd || '~',
-    agentType: body.agentType || 'shell',
-    workspaceId: body.workspaceId,
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const body = await req.json();
+    const pane = createPane({
+      id: body.id || randomUUID(),
+      title: body.title || 'Terminal',
+      color: body.color || '#6366f1',
+      cwd: body.cwd || '~',
+      agentType: body.agentType || 'shell',
+      workspaceId: body.workspaceId,
+    });
+    return Response.json(pane);
   });
-  return Response.json(pane);
 }

package/.next/standalone/src/app/api/network/projects/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getAllProjects } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -10,8 +11,9 @@ export async function GET(req: NextRequest) {
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -19,7 +21,12 @@ export async function GET(req: NextRequest) {
     throw e;
   }
 
-  await ensureInitialized();
-  const projects = getAllProjects();
-  return Response.json(projects);
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const projects = getAllProjects();
+    return Response.json(projects);
+  });
 }

package/.next/standalone/src/app/api/network/search/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { searchSessions } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -10,8 +11,9 @@ export async function GET(req: NextRequest) {
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -19,20 +21,25 @@ export async function GET(req: NextRequest) {
     throw e;
   }
 
-  await ensureInitialized();
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
 
-  const { searchParams } = req.nextUrl;
-  const query = searchParams.get('q') || '';
-  if (!query) {
-    return Response.json({ results: [], query: '' });
-  }
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+
+    const { searchParams } = req.nextUrl;
+    const query = searchParams.get('q') || '';
+    if (!query) {
+      return Response.json({ results: [], query: '' });
+    }
 
-  const params = {
-    projectId: searchParams.get('projectId') || undefined,
-    limit: parseInt(searchParams.get('limit') || '20', 10),
-    offset: parseInt(searchParams.get('offset') || '0', 10),
-  };
+    const params = {
+      projectId: searchParams.get('projectId') || undefined,
+      limit: parseInt(searchParams.get('limit') || '20', 10),
+      offset: parseInt(searchParams.get('offset') || '0', 10),
+    };
 
-  const results = searchSessions(query, params);
-  return Response.json({ results, query });
+    const results = searchSessions(query, params);
+    return Response.json({ results, query });
+  });
 }