@konglx/rotom 2.21.0

package/dist/link/pending-requests.js

@@ -0,0 +1,72 @@
+/**
+ * PendingRequests —— rotom-link 端的 requestId → Promise 映射。
+ *
+ * CLI 调 POST /fed/ask 时,daemon 生成 requestId,记录到这里,调
+ * fedClient.route(requestId, ...),然后 await promise。
+ *
+ * 协调 master 把 FedReply 广播回来,handleReply 用 requestId 解对应 promise。
+ * 5min 超时(对齐 src/cli/ask.ts 的 bridge 超时)避免内存泄漏。
+ */
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+export class PendingRequests {
+    map = new Map();
+    timeoutMs;
+    constructor(timeoutMs = DEFAULT_TIMEOUT_MS) {
+        this.timeoutMs = timeoutMs;
+    }
+    register(requestId) {
+        let resolve;
+        let reject;
+        const promise = new Promise((res, rej) => {
+            resolve = res;
+            reject = rej;
+        });
+        const timer = setTimeout(() => {
+            if (this.map.has(requestId)) {
+                this.map.delete(requestId);
+                reject(new Error(`fed ask timeout after ${this.timeoutMs}ms (requestId=${requestId})`));
+            }
+        }, this.timeoutMs);
+        this.map.set(requestId, { resolve, reject, createdAt: Date.now(), timer });
+        return {
+            promise,
+            cancel: (err) => {
+                const p = this.map.get(requestId);
+                if (p) {
+                    clearTimeout(p.timer);
+                    this.map.delete(requestId);
+                    reject(err);
+                }
+            },
+        };
+    }
+    resolve(requestId, message) {
+        const p = this.map.get(requestId);
+        if (!p)
+            return false;
+        clearTimeout(p.timer);
+        this.map.delete(requestId);
+        p.resolve(message);
+        return true;
+    }
+    reject(requestId, err) {
+        const p = this.map.get(requestId);
+        if (!p)
+            return false;
+        clearTimeout(p.timer);
+        this.map.delete(requestId);
+        p.reject(err);
+        return true;
+    }
+    /** daemon 关停时拒绝所有 pending,避免 CLI hang */
+    rejectAll(err) {
+        for (const [, p] of this.map) {
+            clearTimeout(p.timer);
+            p.reject(err);
+        }
+        this.map.clear();
+    }
+    size() {
+        return this.map.size;
+    }
+}

package/dist/link/server.js

@@ -0,0 +1,233 @@
+/**
+ * rotom-link daemon —— 轻量 federation 客户端节点。
+ *
+ * 角色定位:不带本机 agent 的 member。复用 FedClient 连协调 master,
+ * 接收 FedDirectorySync 缓存可见 agent,通过 FedRouteMessage 跨机投递
+ * 消息给其他 member 上的 agent(或协调 master 自身的 agent),等 FedReply。
+ *
+ * 对外暴露 localhost HTTP:
+ *   GET  /health          → { ok, masterId, teamId, hostname, coordEndpoint, connected, pending }
+ *   GET  /fed/directory   → 可见 agent 列表
+ *   POST /fed/ask         → { to: "name@hostname", message, from?: "name" } 阻塞等 reply
+ *
+ * 配置文件 ~/.rotom/link.json: { masterId, hostname, coordEndpoint, teamId }
+ * 由 `rotom link join <coordEndpoint>` 一次性生成。
+ */
+import http from "node:http";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { URL } from "node:url";
+import { FedClient } from "../master/federation/client.js";
+import { generateMasterId } from "../master/federation/identity.js";
+import { InMemoryVisibilityStore } from "./visibility-store.js";
+import { PendingRequests } from "./pending-requests.js";
+import { parseAgentRef, formatAgentRef } from "../shared/protocol/federation.js";
+import { createLogger } from "../shared/logger.js";
+const log = createLogger("rotom-link", { stream: "stderr" });
+const DEFAULT_PORT = 28900;
+const LINK_CONFIG_FILE = "link.json";
+function rotomHome() {
+    return process.env.ROTOM_HOME || path.join(os.homedir(), ".rotom");
+}
+function linkConfigPath() {
+    return path.join(rotomHome(), LINK_CONFIG_FILE);
+}
+export function readLinkConfig() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(linkConfigPath(), "utf-8"));
+        if (raw?.masterId && raw?.coordEndpoint && raw?.teamId) {
+            return raw;
+        }
+    }
+    catch { /* not joined yet */ }
+    return null;
+}
+function writeLinkConfig(cfg) {
+    fs.mkdirSync(rotomHome(), { recursive: true });
+    fs.writeFileSync(linkConfigPath(), JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+}
+/** CLI 调:rotom link join <coordEndpoint> --hostname <name> */
+export async function linkJoin(coordEndpoint, hostname) {
+    // 1. probe coord /api/identity 拿 teamId(coord 的 masterId)
+    const httpUrl = coordEndpoint
+        .replace(/^wss:/, "https:")
+        .replace(/^ws:/, "http:")
+        .replace(/\/$/, "");
+    const res = await fetch(`${httpUrl}/api/identity`);
+    if (!res.ok) {
+        throw new Error(`Failed to fetch coord identity: ${res.status} ${res.statusText}`);
+    }
+    const data = await res.json();
+    if (data.role !== "coordination") {
+        throw new Error(`Target master is not a coordination master (role=${data.role})`);
+    }
+    // 2. 生成 masterId(本地持久化)
+    const existing = readLinkConfig();
+    const masterId = existing?.masterId ?? generateMasterId();
+    const cfg = {
+        masterId,
+        hostname,
+        coordEndpoint,
+        teamId: data.id,
+        teamName: data.teamName ?? `${data.hostname} 团队`,
+    };
+    writeLinkConfig(cfg);
+    log.info(`[rotom-link] joined team ${cfg.teamId} as ${cfg.masterId}/${cfg.hostname}`);
+}
+export async function startLinkServer(opts) {
+    const { port, config } = opts;
+    // 1. 构造 in-memory db + FedClient
+    const store = new InMemoryVisibilityStore();
+    const identity = {
+        id: config.masterId,
+        hostname: config.hostname,
+        role: "member",
+        teamName: config.teamName ?? "",
+    };
+    const fedClient = new FedClient(store, {
+        identity,
+        coordEndpoints: [config.coordEndpoint],
+        teamId: config.teamId,
+        role: "member",
+    });
+    const pending = new PendingRequests();
+    fedClient.setHandlers({
+        deliverLocal: () => false, // link 无本机 agent
+        handleReply: (msg) => {
+            pending.resolve(msg.requestId, msg.payload.message);
+        },
+        handleRouteFailed: (msg) => {
+            pending.reject(msg.requestId, new Error(`route failed: ${msg.reason}`));
+        },
+    });
+    fedClient.start();
+    // 2. HTTP server
+    const server = http.createServer(async (req, res) => {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const pathname = url.pathname;
+        res.setHeader("Content-Type", "application/json");
+        if (req.method === "GET" && pathname === "/health") {
+            res.end(JSON.stringify({
+                ok: true,
+                masterId: config.masterId,
+                hostname: config.hostname,
+                teamId: config.teamId,
+                coordEndpoint: config.coordEndpoint,
+                connected: fedClient.isConnected(),
+                pending: pending.size(),
+            }));
+            return;
+        }
+        if (req.method === "GET" && pathname === "/fed/directory") {
+            res.end(JSON.stringify({ ok: true, agents: store.listForHttp(config.teamId) }));
+            return;
+        }
+        if (req.method === "POST" && pathname === "/fed/ask") {
+            try {
+                const body = await readBody(req);
+                const { to, message, from } = body;
+                if (!to || !message) {
+                    res.statusCode = 400;
+                    res.end(JSON.stringify({ ok: false, error: "to and message are required" }));
+                    return;
+                }
+                if (!fedClient.isConnected()) {
+                    res.statusCode = 503;
+                    res.end(JSON.stringify({ ok: false, error: "fed client not connected to coord" }));
+                    return;
+                }
+                const { name: toName, hostname: toHostname } = parseAgentRef(to);
+                if (!toHostname) {
+                    res.statusCode = 400;
+                    res.end(JSON.stringify({ ok: false, error: `to must be "name@hostname" (got "${to}")` }));
+                    return;
+                }
+                const toRef = { hostname: toHostname, name: toName };
+                // from 用本地 hostname + 指定 name(默认 "link-user")
+                const fromName = from ?? "link-user";
+                const fromRef = { hostname: config.hostname, name: fromName };
+                const requestId = crypto.randomUUID();
+                const { promise } = pending.register(requestId);
+                const ok = fedClient.route(requestId, fromRef, toRef, { message });
+                if (!ok) {
+                    pending.reject(requestId, new Error("fed route failed (client not connected)"));
+                    res.statusCode = 503;
+                    res.end(JSON.stringify({ ok: false, error: "fed route failed" }));
+                    return;
+                }
+                const reply = await promise;
+                res.end(JSON.stringify({ ok: true, reply, requestId }));
+            }
+            catch (e) {
+                res.statusCode = 500;
+                res.end(JSON.stringify({ ok: false, error: e.message }));
+            }
+            return;
+        }
+        res.statusCode = 404;
+        res.end(JSON.stringify({ ok: false, error: `not found: ${req.method} ${pathname}` }));
+    });
+    // 3. 启动 + 优雅关闭
+    await new Promise((resolve, reject) => {
+        server.listen(port, "127.0.0.1", () => resolve());
+        server.on("error", reject);
+    });
+    log.info(`[rotom-link] listening on http://127.0.0.1:${port} (teamId=${config.teamId})`);
+    const shutdown = (signal) => {
+        log.info(`[rotom-link] received ${signal}, shutting down...`);
+        pending.rejectAll(new Error("link daemon shutting down"));
+        fedClient.stop();
+        server.close(() => process.exit(0));
+        setTimeout(() => process.exit(0), 1000).unref();
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let buf = "";
+        req.on("data", (chunk) => { buf += chunk; });
+        req.on("end", () => {
+            if (!buf) {
+                resolve({});
+                return;
+            }
+            try {
+                resolve(JSON.parse(buf));
+            }
+            catch (e) {
+                reject(new Error(`invalid JSON body: ${e.message}`));
+            }
+        });
+        req.on("error", reject);
+    });
+}
+// ── CLI entry: `node dist/link/server.js --port N` ────────────────────────
+async function main() {
+    const args = process.argv.slice(2);
+    let port = DEFAULT_PORT;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--port" && args[i + 1]) {
+            port = parseInt(args[i + 1], 10);
+            i++;
+        }
+    }
+    const config = readLinkConfig();
+    if (!config) {
+        process.stderr.write(`[rotom-link] no ${linkConfigPath()} found. Run ` +
+            `\`rotom link join <coordEndpoint> --hostname <name>\` first.\n`);
+        process.exit(1);
+    }
+    await startLinkServer({ port, config });
+}
+// re-exports for CLI
+export { formatAgentRef };
+// run if invoked directly
+if (import.meta.url === `file://${process.argv[1]}`) {
+    main().catch((e) => {
+        process.stderr.write(`[rotom-link] fatal: ${e.message}\n`);
+        process.exit(1);
+    });
+}

package/dist/link/visibility-store.js

@@ -0,0 +1,58 @@
+/**
+ * InMemoryVisibilityStore —— rotom-link 用的内存版 agent_visibility 缓存。
+ *
+ * FedClient 在 handleDirectorySync 里只调 3 个方法:
+ *   - removeVisibleAgent(teamId, masterId, name)
+ *   - listVisibleAgents(teamId)
+ *   - upsertVisibleAgent({...})
+ *
+ * 这套结构刚好够 FedClient 缓存协调 master 广播的目录,不需要 better-sqlite3。
+ * 通过 `as unknown as MeshDb` 喂给 FedClient(FedClient 不会调其他方法)。
+ */
+export class InMemoryVisibilityStore {
+    byTeam = new Map();
+    key(masterId, name) {
+        return `${masterId}::${name}`;
+    }
+    listVisibleAgents(teamId) {
+        const map = this.byTeam.get(teamId);
+        if (!map)
+            return [];
+        return Array.from(map.values()).map((e) => ({ ...e }));
+    }
+    upsertVisibleAgent(input) {
+        let map = this.byTeam.get(input.team_id);
+        if (!map) {
+            map = new Map();
+            this.byTeam.set(input.team_id, map);
+        }
+        map.set(this.key(input.master_id, input.agent_name), {
+            team_id: input.team_id,
+            master_id: input.master_id,
+            agent_name: input.agent_name,
+            hostname: input.hostname,
+            display_name: input.display_name ?? null,
+            is_human: input.is_human ? 1 : 0,
+            online: input.online ? 1 : 0,
+            last_heartbeat: new Date().toISOString(),
+        });
+    }
+    removeVisibleAgent(teamId, masterId, agentName) {
+        const map = this.byTeam.get(teamId);
+        if (!map)
+            return false;
+        return map.delete(this.key(masterId, agentName));
+    }
+    /** 给 /fed/directory HTTP 端点用:返回所有可见 agent(简化展示字段) */
+    listForHttp(teamId) {
+        return this.listVisibleAgents(teamId).map((v) => ({
+            masterId: v.master_id,
+            hostname: v.hostname,
+            name: v.agent_name,
+            displayName: v.display_name ?? undefined,
+            isHuman: v.is_human !== 0,
+            online: v.online !== 0,
+            ref: `${v.agent_name}@${v.hostname}`,
+        }));
+    }
+}

package/dist/master/api/agents.js

@@ -0,0 +1,333 @@
+import { randomUUID } from "node:crypto";
+import os from "node:os";
+import fs from "node:fs";
+import path from "node:path";
+import { hashToken } from "../auth.js";
+import { DEFAULT_MASTER_PORT } from "../../shared/constants.js";
+import { createLogger } from "../../shared/logger.js";
+const log = createLogger("mesh-api");
+// avatars 持久化到 ROTOM_HOME 下,避免 /tmp 被清空后 DB 里的 avatar_url 失效。
+const AVATAR_DIR = path.join(process.env.ROTOM_HOME || path.join(os.homedir(), ".rotom"), "avatars");
+const LEGACY_AVATAR_DIR = "/tmp/rotom-avatars";
+// 启动时一次性把 /tmp/rotom-avatars/ 里的旧文件迁到 AVATAR_DIR,避免老数据 404。
+(function migrateLegacyAvatars() {
+    try {
+        if (!fs.existsSync(LEGACY_AVATAR_DIR))
+            return;
+        fs.mkdirSync(AVATAR_DIR, { recursive: true });
+        for (const name of fs.readdirSync(LEGACY_AVATAR_DIR)) {
+            const src = path.join(LEGACY_AVATAR_DIR, name);
+            const dst = path.join(AVATAR_DIR, name);
+            if (fs.existsSync(dst))
+                continue;
+            try {
+                fs.copyFileSync(src, dst);
+                log.info(`avatar migrated: ${name}`);
+            }
+            catch (e) {
+                log.warn(`avatar migration failed for ${name}: ${e?.message ?? "unknown"}`);
+            }
+        }
+    }
+    catch (e) {
+        log.warn(`avatar migration scan failed: ${e?.message ?? "unknown"}`);
+    }
+})();
+function parseProfile(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Return the first non-loopback IPv4 address, or "localhost" as fallback. */
+function getLocalIp() {
+    const ifaces = os.networkInterfaces();
+    for (const entries of Object.values(ifaces)) {
+        if (!entries)
+            continue;
+        for (const entry of entries) {
+            if (entry.family === "IPv4" && !entry.internal)
+                return entry.address;
+        }
+    }
+    return "localhost";
+}
+export function registerAgentRoutes(apiRouter, db, auth, hub, serverPort) {
+    apiRouter.get("/agents", (_req, res) => {
+        const agents = db.listAgents();
+        const statsByName = new Map();
+        for (const row of db.agentMessageStats()) {
+            const name = row.name;
+            if (name)
+                statsByName.set(name, row);
+        }
+        // cliTool 不在 DB(那是 worker 运行时属性),从 hub.connections 查 online agent。
+        const cliToolByName = hub ? hub.onlineCliTools() : new Map();
+        const safe = agents.map((a) => ({
+            id: a.id,
+            name: a.name,
+            description: a.description,
+            domain: a.domain,
+            status: a.status,
+            hostname: a.hostname,
+            cliTool: cliToolByName.get(a.name) ?? null,
+            enabled: a.enabled !== 0,
+            lastHeartbeat: a.last_heartbeat,
+            connectedAt: a.connected_at,
+            registeredAt: a.registered_at,
+            profile: parseProfile(a.profile),
+            message_stats: (() => {
+                const s = statsByName.get(a.name);
+                if (!s)
+                    return undefined;
+                return {
+                    sent: Number(s.sent) || 0,
+                    received: Number(s.received) || 0,
+                    replied: Number(s.replied) || 0,
+                    failed: Number(s.failed) || 0,
+                    avg_latency_ms: s.avg_latency_ms == null ? 0 : Number(s.avg_latency_ms),
+                };
+            })(),
+            avatar_url: a.avatar_url,
+        }));
+        res.json(safe);
+    });
+    apiRouter.get("/agents/online", (_req, res) => {
+        const agents = db.listAgents({ status: "online" });
+        const safe = agents.map((a) => ({
+            name: a.name,
+            domain: a.domain,
+            status: a.status,
+        }));
+        res.json(safe);
+    });
+    apiRouter.post("/agents", (req, res) => {
+        const { name, description, domain, profile } = req.body;
+        if (!name || typeof name !== "string") {
+            res.status(400).json({ error: "name is required" });
+            return;
+        }
+        if (!domain || typeof domain !== "string") {
+            res.status(400).json({ error: "domain is required" });
+            return;
+        }
+        const domainRow = db.getDomainByName(domain);
+        if (!domainRow) {
+            res.status(400).json({ error: `Domain "${domain}" does not exist. Create it first.` });
+            return;
+        }
+        const existing = db.getAgentByName(name);
+        if (existing) {
+            res.status(409).json({ error: `Agent "${name}" already exists` });
+            return;
+        }
+        const id = randomUUID();
+        const token = auth.generateToken();
+        db.insertAgent({
+            id,
+            name,
+            description,
+            domain,
+            tokenHash: hashToken(token),
+            token,
+            profile: profile && typeof profile === "object" ? JSON.stringify(profile) : undefined,
+        });
+        log.info(`Agent registered: "${name}" (domain=${domain})`);
+        const port = serverPort ?? DEFAULT_MASTER_PORT;
+        const ip = getLocalIp();
+        const masterProto = req.secure ? "wss" : "ws";
+        res.status(201).json({
+            id,
+            name,
+            token,
+            configTemplate: {
+                channels: {
+                    "a2a-gateway": {
+                        master: `${masterProto}://${ip}:${port}`,
+                        name,
+                        token,
+                    },
+                },
+            },
+            guide: [
+                "1. 复制上方 channels 配置到 openclaw.json",
+                "2. 启动 OpenClaw Gateway",
+                "3. 节点将自动连接 Master",
+            ],
+        });
+    });
+    apiRouter.get("/agents/:id", (req, res) => {
+        const agent = db.getAgentById(req.params.id);
+        if (!agent) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        res.json({
+            id: agent.id,
+            name: agent.name,
+            description: agent.description,
+            domain: agent.domain,
+            status: agent.status,
+            hostname: agent.hostname,
+            instanceId: agent.instance_id,
+            platform: agent.platform,
+            endpoint: agent.endpoint,
+            enabled: agent.enabled !== 0,
+            lastHeartbeat: agent.last_heartbeat,
+            connectedAt: agent.connected_at,
+            registeredAt: agent.registered_at,
+            profile: parseProfile(agent.profile),
+            avatar_url: agent.avatar_url,
+            token: agent.token,
+        });
+    });
+    apiRouter.post("/agents/:id/refresh-token", (req, res) => {
+        const agent = db.getAgentById(req.params.id);
+        if (!agent) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        const newToken = auth.generateToken();
+        db.updateAgentToken(agent.id, hashToken(newToken), newToken);
+        log.warn(`Token refreshed for agent "${agent.name}" (id=${agent.id})`);
+        res.json({ token: newToken });
+    });
+    apiRouter.put("/agents/:id", (req, res) => {
+        const agent = db.getAgentById(req.params.id);
+        if (!agent) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        const { name, description, domain, enabled, profile, avatar_url } = req.body;
+        if (name !== undefined) {
+            if (!name || typeof name !== "string" || !name.trim()) {
+                res.status(400).json({ error: "name cannot be empty" });
+                return;
+            }
+            const existing = db.getAgentByName(name.trim());
+            if (existing && existing.id !== agent.id) {
+                res.status(409).json({ error: `Name "${name}" is already taken` });
+                return;
+            }
+            db.updateAgentName(agent.id, name.trim());
+        }
+        if (domain !== undefined) {
+            if (!domain || typeof domain !== "string") {
+                res.status(400).json({ error: "domain cannot be empty" });
+                return;
+            }
+            const domainRow = db.getDomainByName(domain);
+            if (!domainRow) {
+                res.status(400).json({ error: `Domain "${domain}" does not exist` });
+                return;
+            }
+        }
+        if (description !== undefined || domain !== undefined || profile !== undefined || avatar_url !== undefined) {
+            db.updateAgentMeta(agent.id, {
+                description,
+                domain,
+                profile: profile !== undefined ? JSON.stringify(profile) : undefined,
+                avatar_url,
+            });
+        }
+        if (enabled !== undefined) {
+            db.updateAgentEnabled(agent.id, !!enabled);
+        }
+        if (hub) {
+            if (domain !== undefined || enabled !== undefined) {
+                hub.pushConfigUpdate(agent.id, {
+                    domain: domain ?? agent.domain ?? undefined,
+                    enabled: enabled !== undefined ? !!enabled : agent.enabled !== 0,
+                });
+            }
+            hub.broadcastAgentUpdate(agent.id);
+        }
+        res.json({ ok: true });
+    });
+    apiRouter.post("/agents/avatar", (req, res) => {
+        const { agentId, dataBase64, mimeType } = req.body || {};
+        if (typeof agentId !== "string" || !agentId.trim()) {
+            res.status(400).json({ error: "agentId is required" });
+            return;
+        }
+        const agent = db.getAgentById(agentId);
+        if (!agent) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        if (typeof dataBase64 !== "string" || !dataBase64) {
+            res.status(400).json({ error: "dataBase64 is required" });
+            return;
+        }
+        let buf;
+        try {
+            buf = Buffer.from(dataBase64, "base64");
+        }
+        catch (e) {
+            res.status(400).json({ error: `base64 decode failed: ${e?.message ?? "unknown"}` });
+            return;
+        }
+        if (buf.length > 2 * 1024 * 1024) {
+            res.status(400).json({ error: "avatar too large: max 2MB" });
+            return;
+        }
+        const allowedMimes = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+        const actualMime = mimeType && allowedMimes.includes(mimeType) ? mimeType : "image/png";
+        const ext = actualMime.includes("png") ? "png"
+            : actualMime.includes("gif") ? "gif"
+                : actualMime.includes("webp") ? "webp" : "jpg";
+        const rand = randomUUID().replace(/-/g, "").slice(0, 6);
+        fs.mkdirSync(AVATAR_DIR, { recursive: true });
+        const stamp = Date.now();
+        const storedName = `${agentId}-${stamp}-${rand}.${ext}`;
+        const absPath = path.join(AVATAR_DIR, storedName);
+        fs.writeFileSync(absPath, buf);
+        const url = `/api/avatars/${storedName}`;
+        db.updateAgentMeta(agent.id, { avatar_url: url });
+        log.info(`avatar saved for agent ${agent.name}: ${url}`);
+        res.status(201).json({ url });
+    });
+    apiRouter.get("/avatars/:filename", (req, res) => {
+        const { filename } = req.params;
+        if (!filename || filename.includes("/") || filename.includes("\\")) {
+            res.status(404).json({ error: "not found" });
+            return;
+        }
+        const ext = filename.split(".").pop()?.toLowerCase() ?? "";
+        const mimeMap = { png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp" };
+        const tryServe = (dir) => {
+            const abs = path.resolve(dir, filename);
+            if (!abs.startsWith(path.resolve(dir) + path.sep))
+                return false;
+            if (!fs.existsSync(abs))
+                return false;
+            res.setHeader("Content-Type", mimeMap[ext] ?? "application/octet-stream");
+            res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+            fs.createReadStream(abs).pipe(res);
+            return true;
+        };
+        if (tryServe(AVATAR_DIR))
+            return;
+        if (tryServe(LEGACY_AVATAR_DIR))
+            return;
+        res.status(404).json({ error: "not found" });
+    });
+    apiRouter.delete("/agents/:id", (req, res) => {
+        const agent = db.getAgentById(req.params.id);
+        if (!agent) {
+            res.status(404).json({ error: "Agent not found" });
+            return;
+        }
+        if (agent.status === "online") {
+            res.status(400).json({ error: "Cannot delete an online agent. Disconnect it first." });
+            return;
+        }
+        db.deleteAgent(agent.id);
+        log.warn(`Agent deleted: "${agent.name}" (id=${agent.id})`);
+        res.json({ ok: true });
+    });
+}