@kafca/agentdock 0.1.55 → 0.1.57

package/dist-electron/services/local-ai-core/src/runtime/handlers/security-handler.js

@@ -2,17 +2,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerSecurityHandlers = registerSecurityHandlers;
 const server_helpers_js_1 = require("../server-helpers.js");
+const request_validation_js_1 = require("../request-validation.js");
 function registerSecurityHandlers(map, workspaceRouter) {
     map.set('workspace-security.get', async (route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.getWorkspaceSecuritySettings(route.workspaceId));
     });
     map.set('workspace-security.update', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            permissions: 'object', allowPaths: { kind: 'array', elementKind: 'string' },
+            denyPaths: { kind: 'array', elementKind: 'string' }, updatedBy: 'string',
+        });
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.updateWorkspaceSecuritySettings(route.workspaceId, body));
     });
     map.set('security.command-risk.classify', async (_route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
-        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.classifyCommand(String(body.command || ''), String(body.workspaceId || '') || undefined));
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            command: { kind: 'string', required: true }, workspaceId: 'string',
+        });
+        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.classifyCommand(body.command, body.workspaceId));
     });
     map.set('approvals.list', async (_route, _req, res, url) => {
         const statusParam = url.searchParams.get('status') || '';
@@ -25,14 +31,21 @@ function registerSecurityHandlers(map, workspaceRouter) {
         }));
     });
     map.set('approvals.create', async (_route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            workspaceId: { kind: 'string', required: true }, taskId: 'string', threadId: 'string', runId: 'string', deviceId: 'string',
+            kind: { kind: 'string', required: true }, riskLevel: { kind: 'string', required: true }, title: { kind: 'string', required: true },
+            description: { kind: 'string', required: true }, requestedAction: { kind: 'string', required: true }, command: 'string',
+            scopes: { kind: 'array', elementKind: 'string' }, options: 'array', requestedBy: 'string', expiresAt: 'string', metadata: 'object',
+        });
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.createApprovalRequest(body));
     });
     map.set('approval.get', async (route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.getApprovalRequest(route.approvalId));
     });
     map.set('approval.resolve', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            status: { kind: 'string', required: true }, resolvedBy: 'string', resolution: 'string',
+        });
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.resolveApprovalRequest(route.approvalId, body));
     });
     map.set('audit-events.list', async (_route, _req, res, url) => {

package/dist-electron/services/local-ai-core/src/runtime/handlers/task-handler.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerTaskHandlers = registerTaskHandlers;
 const server_helpers_js_1 = require("../server-helpers.js");
+const request_validation_js_1 = require("../request-validation.js");
 function registerTaskHandlers(map, workspaceRouter) {
     map.set('tasks.list', async (_route, _req, res, url) => {
         const statusParam = url.searchParams.get('status') || '';
@@ -14,14 +15,25 @@ function registerTaskHandlers(map, workspaceRouter) {
         }));
     });
     map.set('tasks.create', async (_route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            workspaceId: { kind: 'string', required: true },
+            runtimeId: { kind: 'string', required: true },
+            threadId: 'string',
+            title: { kind: 'string', required: true },
+            prompt: 'string',
+            metadata: 'object',
+        });
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.createAgentTask(body));
     });
     map.set('task.get', async (route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.getAgentTask(route.taskId));
     });
     map.set('task.update', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            status: 'string', threadId: 'string', runId: 'string', title: 'string', summary: 'string',
+            error: { kind: 'string', nullable: true }, timelineItem: 'object', log: 'object', artifact: 'object',
+            approvalId: 'string', metadata: 'object',
+        });
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.updateAgentTask(route.taskId, body));
     });
 }

package/dist-electron/services/local-ai-core/src/runtime/handlers/thread-handler.js

@@ -2,43 +2,46 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerThreadHandlers = registerThreadHandlers;
 const server_helpers_js_1 = require("../server-helpers.js");
+const request_validation_js_1 = require("../request-validation.js");
 function registerThreadHandlers(map, workspaceRouter) {
     map.set('threads.list', async (_route, _req, res, url) => {
         const workspaceId = String(url.searchParams.get('workspace_id') || '');
         (0, server_helpers_js_1.json)(res, 200, { threads: workspaceId ? await workspaceRouter.listThreads(workspaceId) : [] });
     });
     map.set('threads.create', async (_route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
-        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.createThread(String(body.workspaceId || ''), String(body.title || '') || undefined));
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            workspaceId: { kind: 'string', required: true },
+            title: 'string',
+        });
+        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.createThread(body.workspaceId, body.title || undefined));
     });
     map.set('thread.get', async (route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.getThread(route.threadId));
     });
     map.set('thread.update-knowledge-bases', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
-        const knowledgeBaseIds = Array.isArray(body.knowledgeBaseIds)
-            ? body.knowledgeBaseIds.map((value) => String(value || ''))
-            : [];
-        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.updateThreadKnowledgeBases(route.threadId, knowledgeBaseIds));
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            knowledgeBaseIds: { kind: 'array', required: true, elementKind: 'string' },
+        });
+        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.updateThreadKnowledgeBases(route.threadId, body.knowledgeBaseIds));
     });
     map.set('thread.update-mode', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
-        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.setThreadMode(route.threadId, String(body.mode || '')));
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), { mode: { kind: 'string', required: true } });
+        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.setThreadMode(route.threadId, body.mode));
     });
     map.set('thread.rename', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
-        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.renameThread(route.threadId, String(body.title || '')));
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), { title: { kind: 'string', required: true } });
+        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.renameThread(route.threadId, body.title));
     });
     map.set('thread.delete', async (route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.deleteThread(route.threadId));
     });
     map.set('thread.messages.send', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
-        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.sendThreadMessage(route.threadId, String(body.content || '')));
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), { content: { kind: 'string', required: true } });
+        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.sendThreadMessage(route.threadId, body.content));
     });
     map.set('thread.actions.send', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
-        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.sendThreadAction(route.threadId, String(body.content || '')));
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), { content: { kind: 'string', required: true } });
+        (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.sendThreadAction(route.threadId, body.content));
     });
     map.set('run.interrupt', async (route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.interruptRun(route.runId));

package/dist-electron/services/local-ai-core/src/runtime/handlers/workspace-handler.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerWorkspaceHandlers = registerWorkspaceHandlers;
 const server_helpers_js_1 = require("../server-helpers.js");
+const request_validation_js_1 = require("../request-validation.js");
 function registerWorkspaceHandlers(map, workspaceRouter) {
     map.set('workspaces.list', async (_route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, { workspaces: await workspaceRouter.listWorkspaces() });
@@ -13,14 +14,24 @@ function registerWorkspaceHandlers(map, workspaceRouter) {
         (0, server_helpers_js_1.json)(res, 200, { workspaces: await workspaceRouter.listWorkspaceRegistry() });
     });
     map.set('workspace-registry.create', async (_route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            displayName: { kind: 'string', required: true },
+            path: { kind: 'string', required: true },
+            defaultRuntimeId: 'string',
+            metadata: 'object',
+        });
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.createWorkspaceRegistryEntry(body));
     });
     map.set('workspace-registry.get', async (route, _req, res) => {
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.getWorkspaceRegistryEntry(route.workspaceId));
     });
     map.set('workspace-registry.update', async (route, req, res) => {
-        const body = await (0, server_helpers_js_1.readJsonBody)(req);
+        const body = (0, request_validation_js_1.validateBody)(await (0, server_helpers_js_1.readJsonBody)(req), {
+            displayName: 'string',
+            path: 'string',
+            defaultRuntimeId: { kind: 'string', nullable: true },
+            metadata: 'object',
+        });
         (0, server_helpers_js_1.json)(res, 200, await workspaceRouter.updateWorkspaceRegistryEntry(route.workspaceId, body));
     });
     map.set('workspace-registry.delete', async (route, _req, res) => {

package/dist-electron/services/local-ai-core/src/runtime/local-core-controller.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalCoreController = void 0;
 const node_events_1 = require("node:events");
-const desktop_js_1 = require("../../../../shared/desktop.js");
+const superai_contracts_1 = require("../../../../packages/contracts/src/index.js");
 const bootstrap_js_1 = require("../kernel/bootstrap.js");
 const local_core_errors_js_1 = require("../kernel/local-core-errors.js");
 const runtime_detection_service_js_1 = require("./runtime-detection-service.js");
@@ -10,6 +10,7 @@ const provider_config_migration_js_1 = require("./provider-config-migration.js")
 const channel_service_js_1 = require("./channel-service.js");
 const external_service_js_1 = require("./external-service.js");
 const deployment_diagnostics_js_1 = require("./deployment-diagnostics.js");
+const workspace_project_registry_js_1 = require("./workspace-project-registry.js");
 class LocalCoreController extends node_events_1.EventEmitter {
     userDataPath;
     store;
@@ -109,18 +110,17 @@ class LocalCoreController extends node_events_1.EventEmitter {
         const settings = this.state.getSettings();
         const workspaceIds = Array.isArray(runtimeConfig.config?.projects)
             ? runtimeConfig.config.projects
-                .map((project) => String(project?.name || '').trim())
+                .map((project) => String(project?.workspace_id || '').trim())
                 .filter(Boolean)
             : [];
-        const defaultProject = workspaceIds.includes(settings.defaultProject)
-            ? settings.defaultProject
-            : workspaceIds[0] || '';
+        const configuredDefault = runtimeConfig.config.projects?.find((project) => project.workspace_id === settings.defaultProject || project.name === settings.defaultProject)?.workspace_id;
+        const defaultProject = configuredDefault || workspaceIds[0] || '';
         return {
             mode: 'desktop',
             phase: 'api_ready',
             pendingRestart: false,
             service,
-            roles: (0, desktop_js_1.deriveDesktopRuntimeRoles)(service),
+            roles: (0, superai_contracts_1.deriveDesktopRuntimeRoles)(service),
             settings: {
                 ...settings,
                 defaultProject,
@@ -152,11 +152,19 @@ class LocalCoreController extends node_events_1.EventEmitter {
     }
     async saveRuntimeConfig(config) {
         const migrated = (0, provider_config_migration_js_1.migrateLegacyProjectProvidersToStore)(config, this.store);
-        const next = this.store.saveRuntimeConfig(migrated.config);
+        if (typeof this.store.listWorkspaceRegistry !== 'function') {
+            const next = this.store.saveRuntimeConfig(migrated.config);
+            await this.channelService.refreshBindings();
+            await this.emitRuntime();
+            return { ...next, warnings: [...(next.warnings || []), ...migrated.warnings] };
+        }
+        const projects = (0, workspace_project_registry_js_1.persistProjectsInRegistry)(this.store, migrated.config.projects || []);
+        const next = this.store.saveRuntimeConfig((0, workspace_project_registry_js_1.withoutRuntimeProjects)(migrated.config));
         await this.channelService.refreshBindings();
         await this.emitRuntime();
         return {
             ...next,
+            config: { ...next.config, projects },
             warnings: [
                 ...(next.warnings || []),
                 ...migrated.warnings,
@@ -284,7 +292,26 @@ class LocalCoreController extends node_events_1.EventEmitter {
         }
     }
     async readAndMigrateRuntimeConfig() {
-        return (0, provider_config_migration_js_1.applyLegacyProviderMigration)(this.store.readRuntimeConfig(), this.store, (config) => this.store.saveRuntimeConfig(config));
+        const current = this.store.readRuntimeConfig();
+        const migrated = (0, provider_config_migration_js_1.migrateLegacyProjectProvidersToStore)(current.config, this.store);
+        if (typeof this.store.listWorkspaceRegistry !== 'function') {
+            return { ...current, config: migrated.config, warnings: [...(current.warnings || []), ...migrated.warnings] };
+        }
+        const legacyProjects = migrated.config.projects || [];
+        let warnings = [...(current.warnings || []), ...migrated.warnings];
+        if (legacyProjects.length > 0) {
+            (0, workspace_project_registry_js_1.persistProjectsInRegistry)(this.store, legacyProjects, { preserveLegacyIds: true });
+            const saved = this.store.saveRuntimeConfig((0, workspace_project_registry_js_1.withoutRuntimeProjects)(migrated.config));
+            warnings = [...warnings, ...(saved.warnings || []), 'Migrated runtime projects into the workspace registry.'];
+        }
+        return {
+            ...this.store.readRuntimeConfig(),
+            config: {
+                ...this.store.readRuntimeConfig().config,
+                projects: (0, workspace_project_registry_js_1.listRegistryProjects)(this.store),
+            },
+            warnings: [...new Set(warnings)],
+        };
     }
 }
 exports.LocalCoreController = LocalCoreController;

package/dist-electron/services/local-ai-core/src/runtime/request-validation.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestValidationError = void 0;
+exports.validateBody = validateBody;
+exports.assertJsonObject = assertJsonObject;
+const local_core_errors_js_1 = require("../kernel/local-core-errors.js");
+class RequestValidationError extends local_core_errors_js_1.LocalCoreError {
+    constructor(message) {
+        super('config_invalid', message, {
+            userMessage: message,
+            retryable: false,
+        });
+        this.name = 'RequestValidationError';
+    }
+}
+exports.RequestValidationError = RequestValidationError;
+function validateBody(value, schema, label = 'Request body') {
+    if (!isRecord(value)) {
+        throw new RequestValidationError(`${label} must be a JSON object.`);
+    }
+    for (const [field, rawRule] of Object.entries(schema)) {
+        const rule = typeof rawRule === 'string' ? { kind: rawRule } : rawRule;
+        const fieldValue = value[field];
+        if (fieldValue === undefined) {
+            if (rule.required) {
+                throw new RequestValidationError(`${label}.${field} is required.`);
+            }
+            continue;
+        }
+        if (fieldValue === null && rule.nullable) {
+            continue;
+        }
+        if (!matchesKind(fieldValue, rule.kind)) {
+            throw new RequestValidationError(`${label}.${field} must be ${article(rule.kind)} ${rule.kind}.`);
+        }
+        if (rule.kind === 'string' && rule.required && !fieldValue.trim()) {
+            throw new RequestValidationError(`${label}.${field} must not be empty.`);
+        }
+        if (rule.allowedValues && !rule.allowedValues.includes(fieldValue)) {
+            throw new RequestValidationError(`${label}.${field} must be one of: ${rule.allowedValues.join(', ')}.`);
+        }
+        if (rule.kind === 'object' && rule.fields) {
+            validateBody(fieldValue, rule.fields, `${label}.${field}`);
+        }
+        if (rule.kind === 'object' && rule.valueSchema) {
+            for (const [key, item] of Object.entries(fieldValue)) {
+                validateBody(item, rule.valueSchema, `${label}.${field}.${key}`);
+            }
+        }
+        if (rule.kind === 'array' && rule.elementKind) {
+            const invalidIndex = fieldValue.findIndex((item) => !matchesKind(item, rule.elementKind));
+            if (invalidIndex >= 0) {
+                throw new RequestValidationError(`${label}.${field}[${invalidIndex}] must be ${article(rule.elementKind)} ${rule.elementKind}.`);
+            }
+        }
+    }
+    return value;
+}
+function assertJsonObject(value) {
+    if (!isRecord(value)) {
+        throw new RequestValidationError('Request body must be a JSON object.');
+    }
+    return value;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function matchesKind(value, kind) {
+    if (kind === 'array') {
+        return Array.isArray(value);
+    }
+    if (kind === 'object') {
+        return isRecord(value);
+    }
+    return typeof value === kind && (kind !== 'number' || Number.isFinite(value));
+}
+function article(kind) {
+    return kind === 'object' || kind === 'array' ? 'an' : 'a';
+}

package/dist-electron/services/local-ai-core/src/runtime/runtime-detection-service.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RuntimeDetectionService = void 0;
-const desktop_js_1 = require("../../../../shared/desktop.js");
+const superai_contracts_1 = require("../../../../packages/contracts/src/index.js");
 const index_js_1 = require("../agents/index.js");
 const agent_runtime_detector_js_1 = require("./agent-runtime-detector.js");
 const runtime_detection_store_js_1 = require("./runtime-detection-store.js");
@@ -122,22 +122,22 @@ class RuntimeDetectionService {
     }
     createUnknownResults() {
         const detectedAt = new Date(0).toISOString();
-        return desktop_js_1.DESKTOP_AGENT_TYPE_OPTIONS.map((agentType) => ({
+        return superai_contracts_1.DESKTOP_AGENT_TYPE_OPTIONS.map((agentType) => ({
             agentType,
             runtimeId: agentType,
             displayName: displayName(agentType),
-            status: agentType === desktop_js_1.LOCALCORE_ACP_AGENT_TYPE ? 'installed' : 'unknown',
-            installed: agentType === desktop_js_1.LOCALCORE_ACP_AGENT_TYPE,
-            readiness: agentType === desktop_js_1.LOCALCORE_ACP_AGENT_TYPE ? 'ready' : 'unknown',
+            status: agentType === superai_contracts_1.LOCALCORE_ACP_AGENT_TYPE ? 'installed' : 'unknown',
+            installed: agentType === superai_contracts_1.LOCALCORE_ACP_AGENT_TYPE,
+            readiness: agentType === superai_contracts_1.LOCALCORE_ACP_AGENT_TYPE ? 'ready' : 'unknown',
             detectedAt,
-            summary: agentType === desktop_js_1.LOCALCORE_ACP_AGENT_TYPE
+            summary: agentType === superai_contracts_1.LOCALCORE_ACP_AGENT_TYPE
                 ? `${displayName(agentType)} is built in.`
                 : `${displayName(agentType)} has not been checked yet.`,
             issues: [],
-            recommendedActions: agentType === desktop_js_1.LOCALCORE_ACP_AGENT_TYPE
+            recommendedActions: agentType === superai_contracts_1.LOCALCORE_ACP_AGENT_TYPE
                 ? []
                 : [{ label: 'Run detection', description: 'Refresh runtime detection to check this machine.' }],
-            source: agentType === desktop_js_1.LOCALCORE_ACP_AGENT_TYPE ? 'builtin' : 'path',
+            source: agentType === superai_contracts_1.LOCALCORE_ACP_AGENT_TYPE ? 'builtin' : 'path',
         }));
     }
     filter(runtimes, runtimeId) {
@@ -147,7 +147,7 @@ class RuntimeDetectionService {
         return runtimes.filter((runtime) => runtime.runtimeId === runtimeId || runtime.agentType === runtimeId);
     }
     markChecking(runtimeId) {
-        this.checkingRuntimeIds = new Set(runtimeId ? [runtimeId] : desktop_js_1.DESKTOP_AGENT_TYPE_OPTIONS);
+        this.checkingRuntimeIds = new Set(runtimeId ? [runtimeId] : superai_contracts_1.DESKTOP_AGENT_TYPE_OPTIONS);
     }
     unmarkChecking() {
         this.checkingRuntimeIds.clear();

package/dist-electron/services/local-ai-core/src/runtime/server-helpers.js

@@ -14,6 +14,7 @@ exports.sanitizeOpenAiId = sanitizeOpenAiId;
 exports.diffAccumulatedText = diffAccumulatedText;
 exports.isTerminalAgentTaskStatus = isTerminalAgentTaskStatus;
 const local_core_errors_js_1 = require("../kernel/local-core-errors.js");
+const request_validation_js_1 = require("./request-validation.js");
 function json(res, statusCode, data, ok = true, error) {
     res.statusCode = statusCode;
     res.setHeader('Content-Type', 'application/json; charset=utf-8');
@@ -44,7 +45,15 @@ async function readJsonBody(req) {
     if (!body.length) {
         return {};
     }
-    return JSON.parse(Buffer.from(body).toString('utf8'));
+    try {
+        return (0, request_validation_js_1.assertJsonObject)(JSON.parse(Buffer.from(body).toString('utf8')));
+    }
+    catch (error) {
+        if (error instanceof request_validation_js_1.RequestValidationError) {
+            throw error;
+        }
+        throw new request_validation_js_1.RequestValidationError('Request body must contain valid JSON.');
+    }
 }
 async function readRawBody(req) {
     const chunks = [];

package/dist-electron/services/local-ai-core/src/runtime/server.js

@@ -18,6 +18,7 @@ const provider_handler_js_1 = require("./handlers/provider-handler.js");
 const channel_handler_js_1 = require("./handlers/channel-handler.js");
 const external_handler_js_1 = require("./handlers/external-handler.js");
 const openai_handler_js_1 = require("./handlers/openai-handler.js");
+const request_validation_js_1 = require("./request-validation.js");
 class LocalAiCoreServer {
     bindings;
     host;
@@ -179,7 +180,7 @@ class LocalAiCoreServer {
             (0, server_helpers_js_1.jsonError)(res, 404, new Error(`Unknown route: ${path}`));
         }
         catch (error) {
-            (0, server_helpers_js_1.jsonError)(res, 500, error);
+            (0, server_helpers_js_1.jsonError)(res, error instanceof request_validation_js_1.RequestValidationError ? 400 : 500, error);
         }
     }
     attachSseClient(res) {

package/dist-electron/services/local-ai-core/src/runtime/workspace-project-registry.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectWorkspaceId = projectWorkspaceId;
+exports.workspacePathFromProject = workspacePathFromProject;
+exports.listRegistryProjects = listRegistryProjects;
+exports.persistProjectsInRegistry = persistProjectsInRegistry;
+exports.withoutRuntimeProjects = withoutRuntimeProjects;
+const PROJECT_SOURCE = 'runtime-project';
+function projectWorkspaceId(project) {
+    return String(project.workspace_id || '').trim();
+}
+function workspacePathFromProject(project) {
+    const options = project.agent?.options || {};
+    for (const key of ['work_dir', 'workDir', 'cwd', 'path', 'workspacePath', 'root']) {
+        const value = options[key];
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return '';
+}
+function listRegistryProjects(store) {
+    return store.listWorkspaceRegistry()
+        .map(projectFromEntry)
+        .filter((project) => Boolean(project));
+}
+function persistProjectsInRegistry(store, projects, options = {}) {
+    const existing = store.listWorkspaceRegistry();
+    const managed = existing.filter((entry) => entry.metadata?.source === PROJECT_SOURCE);
+    const byDisplayName = new Map(managed.map((entry) => [entry.displayName, entry]));
+    const retainedIds = new Set();
+    const normalized = projects.map((project) => {
+        const existingByName = byDisplayName.get(project.name);
+        const workspaceId = projectWorkspaceId(project)
+            || existingByName?.workspaceId
+            || project.name;
+        const nextProject = { ...project, workspace_id: workspaceId };
+        const previous = existing.find((entry) => entry.workspaceId === workspaceId);
+        const path = workspacePathFromProject(nextProject);
+        retainedIds.add(workspaceId);
+        store.upsertWorkspaceRegistryEntry({
+            workspaceId,
+            displayName: nextProject.name,
+            path,
+            deviceId: previous?.deviceId || 'local',
+            defaultRuntimeId: nextProject.agent?.type,
+            git: previous?.git,
+            health: previous?.health,
+            metadata: {
+                ...(previous?.metadata || {}),
+                source: PROJECT_SOURCE,
+                project: nextProject,
+            },
+        });
+        return nextProject;
+    });
+    for (const entry of managed) {
+        if (!retainedIds.has(entry.workspaceId))
+            store.deleteWorkspaceRegistryEntry(entry.workspaceId);
+    }
+    return normalized;
+}
+function withoutRuntimeProjects(config) {
+    const next = { ...config };
+    delete next.projects;
+    return next;
+}
+function projectFromEntry(entry) {
+    const project = entry.metadata?.project;
+    if (!project?.agent)
+        return null;
+    return {
+        ...project,
+        workspace_id: entry.workspaceId,
+        name: entry.displayName,
+    };
+}

package/dist-electron/services/local-ai-core/src/sandbox/sandbox-config.js

@@ -15,7 +15,7 @@ exports.sanitizePathSegment = sanitizePathSegment;
 exports.resolveHostPathFromConfigDir = resolveHostPathFromConfigDir;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
-const index_js_1 = require("../../../../packages/contracts/src/index.js");
+const superai_contracts_1 = require("../../../../packages/contracts/src/index.js");
 exports.DEFAULT_OPENSANDBOX_SERVER_URL = 'http://127.0.0.1:8080';
 exports.DEFAULT_OPENSANDBOX_SERVER_URL_ENV = 'AGENTDOCK_OPENSANDBOX_SERVER_URL';
 exports.DEFAULT_OPENSANDBOX_API_KEY_ENV = 'OPEN_SANDBOX_API_KEY';
@@ -46,7 +46,7 @@ function normalizeSandboxLaunchConfig(input) {
     const agentType = input.launchConfig.agentType || String(input.project.agent?.type || '').trim().toLowerCase() || 'agent';
     const desktopConfig = input.configState.config || {};
     const deploymentProfileId = String(raw.deployment_profile || desktopConfig.deployment_profile || process.env.AGENTDOCK_DEPLOYMENT_PROFILE || '').trim();
-    const profile = (0, index_js_1.getDesktopDeploymentProfile)(deploymentProfileId);
+    const profile = (0, superai_contracts_1.getDesktopDeploymentProfile)(deploymentProfileId);
     const sandboxProvider = resolveSandboxProvider(desktopConfig.sandbox_providers, raw, profile.id);
     const runtimeImage = resolveSandboxRuntimeImage(desktopConfig.sandbox_runtime_images, raw, agentType);
     const stateScope = normalizeStateScope(raw.state_scope);
@@ -107,14 +107,14 @@ function resolveSandboxProvider(providers, raw, profileId) {
     const providerId = String(raw.provider_id || '').trim();
     const selected = Array.isArray(providers)
         ? providers.find((provider) => provider.id === providerId)
-            || providers.find((provider) => provider.id === index_js_1.DEFAULT_SANDBOX_PROVIDER_ID)
+            || providers.find((provider) => provider.id === superai_contracts_1.DEFAULT_SANDBOX_PROVIDER_ID)
         : undefined;
     if (selected) {
         return selected;
     }
     if (raw.server_url || raw.api_key_env || raw.provider) {
         return {
-            id: providerId || index_js_1.DEFAULT_SANDBOX_PROVIDER_ID,
+            id: providerId || superai_contracts_1.DEFAULT_SANDBOX_PROVIDER_ID,
             type: raw.provider || 'opensandbox',
             name: 'OpenSandbox',
             server_url: raw.server_url || defaultOpenSandboxServerUrl(),
@@ -122,7 +122,7 @@ function resolveSandboxProvider(providers, raw, profileId) {
         };
     }
     return {
-        ...(0, index_js_1.defaultSandboxProviderForProfile)(profileId),
+        ...(0, superai_contracts_1.defaultSandboxProviderForProfile)(profileId),
         server_url: defaultOpenSandboxServerUrl(),
     };
 }
@@ -133,14 +133,14 @@ function resolveSandboxRuntimeImage(images, raw, agentType) {
             || images.find((image) => image.agent_type === agentType)
         : undefined;
     if (selected) {
-        const fallback = (0, index_js_1.defaultSandboxRuntimeImage)(agentType);
+        const fallback = (0, superai_contracts_1.defaultSandboxRuntimeImage)(agentType);
         return {
             ...selected,
             transport: normalizeSandboxTransport(selected.transport || fallback.transport),
         };
     }
     if (raw.image || raw.transport || raw.acp_port || raw.entrypoint || raw.workspace_mount_path || raw.state_mount_path) {
-        const fallback = (0, index_js_1.defaultSandboxRuntimeImage)(agentType);
+        const fallback = (0, superai_contracts_1.defaultSandboxRuntimeImage)(agentType);
         return {
             id: runtimeImageId || fallback.id,
             agent_type: agentType,
@@ -152,7 +152,7 @@ function resolveSandboxRuntimeImage(images, raw, agentType) {
             state_mount_path: raw.state_mount_path || fallback.state_mount_path,
         };
     }
-    return (0, index_js_1.defaultSandboxRuntimeImage)(agentType);
+    return (0, superai_contracts_1.defaultSandboxRuntimeImage)(agentType);
 }
 function resolveSandboxStateHostPath(config, threadId, runId) {
     if (!config.stateHostPath) {