@jlongo78/agent-spaces 0.9.7 → 0.9.9

package/.next/standalone/src/app/api/network/sessions/[id]/messages/route.ts

@@ -3,6 +3,7 @@ import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getSessionById } from '@/lib/db/queries';
 import { readMessages } from '@/lib/claude/parser';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -11,8 +12,9 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -20,17 +22,22 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
     throw e;
   }
 
-  await ensureInitialized();
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  const { searchParams } = req.nextUrl;
-  const offset = parseInt(searchParams.get('offset') || '0', 10);
-  const limit = parseInt(searchParams.get('limit') || '50', 10);
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const { searchParams } = req.nextUrl;
+    const offset = parseInt(searchParams.get('offset') || '0', 10);
+    const limit = parseInt(searchParams.get('limit') || '50', 10);
 
-  const session = getSessionById(id);
-  if (!session) {
-    return Response.json({ error: 'Session not found' }, { status: 404 });
-  }
+    const session = getSessionById(id);
+    if (!session) {
+      return Response.json({ error: 'Session not found' }, { status: 404 });
+    }
 
-  const result = await readMessages(session.fullPath, offset, limit);
-  return Response.json(result);
+    const result = await readMessages(session.fullPath, offset, limit);
+    return Response.json(result);
+  });
 }

package/.next/standalone/src/app/api/network/sessions/[id]/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getSessionById, getSessionTags, getSessionWorkspaces } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -10,8 +11,9 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -19,16 +21,21 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
     throw e;
   }
 
-  await ensureInitialized();
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  const session = getSessionById(id);
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const session = getSessionById(id);
 
-  if (!session) {
-    return Response.json({ error: 'Session not found' }, { status: 404 });
-  }
+    if (!session) {
+      return Response.json({ error: 'Session not found' }, { status: 404 });
+    }
 
-  const tags = getSessionTags(session.id);
-  const workspaces = getSessionWorkspaces(session.id);
+    const tags = getSessionTags(session.id);
+    const workspaces = getSessionWorkspaces(session.id);
 
-  return Response.json({ ...session, tagObjects: tags, workspaces });
+    return Response.json({ ...session, tagObjects: tags, workspaces });
+  });
 }

package/.next/standalone/src/app/api/network/sessions/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getSessions, getWorkspacesForSession } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -10,8 +11,9 @@ export async function GET(req: NextRequest) {
   const pro = getPro();
   if (!pro) return notAvailable();
 
+  let keyRecord;
   try {
-    pro.network.requireNetworkAuth(req);
+    keyRecord = pro.network.requireNetworkAuth(req);
   } catch (e: any) {
     if (e.name === 'NetworkAuthError') {
       return Response.json({ error: e.message }, { status: 401 });
@@ -19,25 +21,30 @@ export async function GET(req: NextRequest) {
     throw e;
   }
 
-  await ensureInitialized();
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
 
-  const { searchParams } = req.nextUrl;
-  const params = {
-    projectId: searchParams.get('projectId') || undefined,
-    projectPath: searchParams.get('projectPath') || undefined,
-    search: searchParams.get('search') || undefined,
-    sortBy: searchParams.get('sortBy') || 'modified',
-    sortDir: searchParams.get('sortDir') || 'DESC',
-    offset: parseInt(searchParams.get('offset') || '0', 10),
-    limit: parseInt(searchParams.get('limit') || '50', 10),
-  };
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
 
-  const result = getSessions(params);
+    const { searchParams } = req.nextUrl;
+    const params = {
+      projectId: searchParams.get('projectId') || undefined,
+      projectPath: searchParams.get('projectPath') || undefined,
+      search: searchParams.get('search') || undefined,
+      sortBy: searchParams.get('sortBy') || 'modified',
+      sortDir: searchParams.get('sortDir') || 'DESC',
+      offset: parseInt(searchParams.get('offset') || '0', 10),
+      limit: parseInt(searchParams.get('limit') || '50', 10),
+    };
 
-  const sessions = result.sessions.map(s => ({
-    ...s,
-    workspaces: getWorkspacesForSession(s.id),
-  }));
+    const result = getSessions(params);
 
-  return Response.json({ sessions, total: result.total });
+    const sessions = result.sessions.map(s => ({
+      ...s,
+      workspaces: getWorkspacesForSession(s.id),
+    }));
+
+    return Response.json({ sessions, total: result.total });
+  });
 }

package/.next/standalone/src/app/api/network/workspaces/[id]/route.ts

@@ -21,16 +21,15 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ id:
     throw e;
   }
 
-  const { id } = await params;
   const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
 
-  const handler = async () => {
+  const { id } = await params;
+  return withUser(keyUser, async () => {
     await ensureInitialized();
     const panes = getPanesByWorkspace(parseInt(id, 10));
     return Response.json({ panes });
-  };
-
-  return keyUser ? withUser(keyUser, handler) : handler();
+  });
 }
 
 export async function PUT(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
@@ -45,11 +44,16 @@ export async function PUT(req: NextRequest, { params }: { params: Promise<{ id:
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  const body = await req.json();
-  updateWorkspace(parseInt(id, 10), body);
-  return Response.json({ success: true });
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const body = await req.json();
+    updateWorkspace(parseInt(id, 10), body);
+    return Response.json({ success: true });
+  });
 }
 
 export async function DELETE(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
@@ -64,8 +68,13 @@ export async function DELETE(req: NextRequest, { params }: { params: Promise<{ i
   }
   if (keyRecord?.permissions !== 'admin') return Response.json({ error: 'Admin permission required' }, { status: 403 });
 
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
   const { id } = await params;
-  await ensureInitialized();
-  deleteWorkspaceFull(parseInt(id, 10));
-  return Response.json({ success: true });
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    deleteWorkspaceFull(parseInt(id, 10));
+    return Response.json({ success: true });
+  });
 }

package/.next/standalone/src/app/api/network/workspaces/route.ts

@@ -3,6 +3,7 @@ import { getPro } from '@/lib/pro';
 import { ensureInitialized } from '@/lib/db/init';
 import { getDb } from '@/lib/db/schema';
 import { createWorkspace } from '@/lib/db/queries';
+import { withUser } from '@/lib/auth';
 
 const notAvailable = () =>
   Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
@@ -23,16 +24,12 @@ export async function GET(req: NextRequest) {
 
   // Scope to the API key's user so remote access sees their workspaces, not the server admin's
   const keyUser = keyRecord?.username;
-  if (keyUser) {
-    const { withUser } = await import('@/lib/auth');
-    return withUser(keyUser, async () => {
-      await ensureInitialized();
-      return buildWorkspaceResponse();
-    });
-  }
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
 
-  await ensureInitialized();
-  return buildWorkspaceResponse();
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    return buildWorkspaceResponse();
+  });
 }
 
 export async function POST(req: NextRequest) {
@@ -50,12 +47,17 @@ export async function POST(req: NextRequest) {
     return Response.json({ error: 'Admin permission required' }, { status: 403 });
   }
 
-  await ensureInitialized();
-  const body = await req.json();
-  if (!body.name) return Response.json({ error: 'name is required' }, { status: 400 });
+  const keyUser = keyRecord?.username;
+  if (!keyUser) return Response.json({ error: 'API key missing user binding' }, { status: 401 });
+
+  return withUser(keyUser, async () => {
+    await ensureInitialized();
+    const body = await req.json();
+    if (!body.name) return Response.json({ error: 'name is required' }, { status: 400 });
 
-  const workspace = createWorkspace(body.name, body.description, body.color);
-  return Response.json(workspace);
+    const workspace = createWorkspace(body.name, body.description, body.color);
+    return Response.json(workspace);
+  });
 }
 
 function buildWorkspaceResponse() {

package/.next/standalone/src/app/api/whisper/config/route.ts

@@ -1,27 +1,35 @@
 import { NextResponse } from 'next/server';
-import { readCortexConfig } from '@/lib/cortex/config';
-import { getUserPaths } from '@/lib/config';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
 
 export const dynamic = 'force-dynamic';
 
 /**
  * GET /api/whisper/config — returns Groq/OpenAI key + endpoint for direct browser calls.
- * Checks cortex config first (user settings), then falls back to env vars.
+ * Reads config.json directly (bypasses cortex addon to avoid stale require cache).
+ * Falls back to env vars.
  */
 export async function GET() {
-  // Try cortex config first (user-configured keys in settings)
   let configGroq = '';
   let configOpenai = '';
+
+  // Read config.json directly instead of going through cortex addon
   try {
-    const { configPath } = getUserPaths('admin');
-    const cortexCfg = readCortexConfig(configPath);
-    configGroq = cortexCfg.groq_api_key || '';
-    configOpenai = cortexCfg.openai_api_key || '';
+    const configPath = path.join(os.homedir(), '.spaces', 'config.json');
+    if (fs.existsSync(configPath)) {
+      const raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+      const cortex = raw.cortex || {};
+      configGroq = cortex.groq_api_key || '';
+      configOpenai = cortex.openai_api_key || '';
+    }
   } catch {}
 
   const groqKey = configGroq || process.env.GROQ_API_KEY;
   const openaiKey = configOpenai || process.env.OPENAI_API_KEY;
 
+  console.log(`[Whisper Config] configGroq=${configGroq ? configGroq.slice(0, 8) + '...' : 'EMPTY'} configOpenai=${configOpenai ? configOpenai.slice(0, 8) + '...' : 'EMPTY'} envGroq=${process.env.GROQ_API_KEY ? 'SET' : 'UNSET'} envOpenai=${process.env.OPENAI_API_KEY ? 'SET' : 'UNSET'} → returning ${groqKey ? 'GROQ' : openaiKey ? 'OPENAI' : 'NONE'}`);
+
   if (groqKey) {
     return NextResponse.json({
       apiKey: groqKey,

package/.next/standalone/src/app/api/wizard/chart/route.ts

@@ -0,0 +1,129 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getAuthUser, withUser } from '@/lib/auth';
+import { getUserPaths } from '@/lib/config';
+
+export const dynamic = 'force-dynamic';
+
+const SYSTEM_PROMPT = `You are a data visualization assistant. Your job: help the user design a chart from their data through conversation. Ask 1-2 questions at a time. Converge toward a concrete chart spec.
+
+Supported chart types:
+- bar: Vertical or horizontal bar chart
+- line: Line chart with optional area fill
+- pie: Pie or donut chart
+- scatter: Scatter plot with optional trend line
+- heatmap: Color-coded grid/matrix
+- table: Formatted data table with highlights
+
+After each exchange, output an updated chart spec as a JSON block.
+
+For SINGLE-SERIES data (bar, pie, scatter, simple line), use this format:
+
+\`\`\`json
+{
+  "chart": { "title": "...", "type": "bar", "xAxis": "...", "yAxis": "...", "color": "#6366f1" },
+  "data": [
+    { "label": "Q1", "value": 100 },
+    { "label": "Q2", "value": 150 }
+  ],
+  "options": { "showLegend": true, "stacked": false, "fillArea": false },
+  "summary": "One-line description"
+}
+\`\`\`
+
+For MULTI-SERIES data (multiple lines, grouped comparison), use this format:
+
+\`\`\`json
+{
+  "chart": { "title": "...", "type": "line", "xAxis": "...", "yAxis": "...", "color": "#6366f1" },
+  "data": [],
+  "labels": ["Jan", "Feb", "Mar"],
+  "series": [
+    { "name": "East", "color": "#6366f1", "values": [100, 120, 140] },
+    { "name": "West", "color": "#22c55e", "values": [80, 95, 110] }
+  ],
+  "options": { "showLegend": true, "stacked": false, "fillArea": false },
+  "summary": "One-line description"
+}
+\`\`\`
+
+Available series colors: #6366f1, #22c55e, #f59e0b, #ef4444, #3b82f6, #ec4899, #14b8a6, #a855f7, #f97316
+
+Guidelines:
+- Ask about: what data they have, what story they want to tell, audience, preferred chart type
+- Suggest chart types based on the data shape (categorical → bar/pie, time series → line, correlation → scatter)
+- Use multi-series format when the user asks for multiple lines, regions, categories, or comparisons
+- Generate sample data if the user describes their data verbally
+- Keep it simple — one chart at a time
+- When the spec looks solid, suggest the user review it`;
+
+export async function POST(request: NextRequest) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    const { configPath } = getUserPaths(user);
+    let config: any = {};
+    try {
+      const { readCortexConfig } = await import('@/lib/cortex/config');
+      config = readCortexConfig(configPath);
+    } catch {}
+
+    const anthropicKey = config.anthropic_api_key || process.env.ANTHROPIC_API_KEY;
+    if (!anthropicKey) {
+      return NextResponse.json(
+        { error: 'No API key configured. Add your Anthropic key in Settings > Cortex.' },
+        { status: 400 }
+      );
+    }
+
+    const body = await request.json();
+    const { messages, currentSpec } = body;
+
+    const apiMessages = messages.map((m: any) => ({
+      role: m.role,
+      content: m.content,
+    }));
+
+    let systemPrompt = SYSTEM_PROMPT;
+    if (currentSpec) {
+      systemPrompt += `\n\nCurrent chart spec:\n\`\`\`json\n${JSON.stringify(currentSpec, null, 2)}\n\`\`\``;
+    }
+
+    try {
+      const res = await fetch('https://api.anthropic.com/v1/messages', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-api-key': anthropicKey,
+          'anthropic-version': '2023-06-01',
+        },
+        body: JSON.stringify({
+          model: 'claude-haiku-4-5-20251001',
+          max_tokens: 2048,
+          system: systemPrompt,
+          messages: apiMessages,
+        }),
+        signal: AbortSignal.timeout(30000),
+      });
+
+      if (!res.ok) {
+        return NextResponse.json({ error: `API error: ${res.status}` }, { status: 502 });
+      }
+
+      const data = await res.json();
+      const reply = data.content?.[0]?.text || '';
+
+      // Extract JSON spec from reply
+      let spec = currentSpec;
+      const jsonMatch = reply.match(/```json\s*([\s\S]*?)```/);
+      if (jsonMatch) {
+        try {
+          spec = JSON.parse(jsonMatch[1]);
+        } catch { /* keep current spec */ }
+      }
+
+      const cleanReply = reply.replace(/```json[\s\S]*?```/g, '').trim();
+      return NextResponse.json({ reply: cleanReply, spec });
+    } catch (e: any) {
+      return NextResponse.json({ error: e.message }, { status: 500 });
+    }
+  });
+}

package/.next/standalone/src/app/api/workspaces/[id]/todos/[todoId]/route.ts

@@ -0,0 +1,55 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getAuthUser, withUser } from '@/lib/auth';
+import { ensureInitialized } from '@/lib/db/init';
+import { updateWorkspaceTodo, deleteWorkspaceTodo } from '@/lib/db/queries';
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string; todoId: string }> }
+) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    await ensureInitialized();
+    const { id, todoId } = await params;
+    const wsId = parseInt(id, 10);
+    const tid = parseInt(todoId, 10);
+    if (!Number.isFinite(wsId) || !Number.isFinite(tid)) {
+      return NextResponse.json({ error: 'invalid workspace or todo id' }, { status: 400 });
+    }
+    const body = await request.json().catch(() => null);
+    if (!body || (body.text === undefined && body.completed === undefined)) {
+      return NextResponse.json({ error: 'text or completed required' }, { status: 400 });
+    }
+    try {
+      const updated = updateWorkspaceTodo(wsId, tid, {
+        text: typeof body.text === 'string' ? body.text : undefined,
+        completed: typeof body.completed === 'boolean' ? body.completed : undefined,
+      });
+      if (!updated) {
+        return NextResponse.json({ error: 'not found' }, { status: 404 });
+      }
+      return NextResponse.json(updated);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'update failed';
+      return NextResponse.json({ error: message }, { status: 400 });
+    }
+  });
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string; todoId: string }> }
+) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    await ensureInitialized();
+    const { id, todoId } = await params;
+    const wsId = parseInt(id, 10);
+    const tid = parseInt(todoId, 10);
+    if (!Number.isFinite(wsId) || !Number.isFinite(tid)) {
+      return NextResponse.json({ error: 'invalid workspace or todo id' }, { status: 400 });
+    }
+    deleteWorkspaceTodo(wsId, tid);
+    return NextResponse.json({ ok: true });
+  });
+}

package/.next/standalone/src/app/api/workspaces/[id]/todos/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getAuthUser, withUser } from '@/lib/auth';
+import { ensureInitialized } from '@/lib/db/init';
+import { getWorkspaceTodos, addWorkspaceTodo } from '@/lib/db/queries';
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    await ensureInitialized();
+    const { id } = await params;
+    const wsId = parseInt(id, 10);
+    if (!Number.isFinite(wsId)) {
+      return NextResponse.json({ error: 'invalid workspace id' }, { status: 400 });
+    }
+    const todos = getWorkspaceTodos(wsId);
+    return NextResponse.json(todos);
+  });
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    await ensureInitialized();
+    const { id } = await params;
+    const wsId = parseInt(id, 10);
+    if (!Number.isFinite(wsId)) {
+      return NextResponse.json({ error: 'invalid workspace id' }, { status: 400 });
+    }
+    const body = await request.json().catch(() => null);
+    const text = typeof body?.text === 'string' ? body.text : '';
+    if (!text.trim()) {
+      return NextResponse.json({ error: 'text is required' }, { status: 400 });
+    }
+    const todo = addWorkspaceTodo(wsId, text);
+    return NextResponse.json(todo, { status: 201 });
+  });
+}