@openenthrium/oe-runtime-sdk 1.7.5

package/src/routes/projects.js

@@ -0,0 +1,238 @@
+const router  = require("express").Router({ mergeParams: true });
+const { authenticate, requireManagerOrAdmin } = require("../middleware/auth");
+const { getLLMConfig } = require("../providers/llm");
+const engine  = require("../engine");
+const yaml    = require("js-yaml");
+
+router.use(authenticate, requireManagerOrAdmin);
+
+// ── List projects ─────────────────────────────────────────────────────────────
+router.get("/", async (req, res) => {
+  try {
+    const projects = await req.db.project.findMany({
+      where:   { workspaceId: parseInt(req.params.workspaceId) },
+      include: { _count: { select: { agents: true, runs: true } } },
+      orderBy: { createdAt: "desc" },
+    });
+    res.json({ projects });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Create project ────────────────────────────────────────────────────────────
+router.post("/", async (req, res) => {
+  try {
+    const { name, description, manifest, oeConfig, agents = [] } = req.body;
+    if (!name) return res.status(400).json({ error: "name required" });
+
+    const project = await req.db.project.create({
+      data: {
+        workspaceId:     parseInt(req.params.workspaceId),
+        name,
+        description:     description || null,
+        manifest:        manifest  ? JSON.stringify(manifest)  : null,
+        oeConfig:        oeConfig  ? JSON.stringify(oeConfig)  : null,
+        createdByUserId: req.user?.id || null,
+        agents: {
+          create: agents.map(a => ({
+            name:        a.name,
+            description: a.description || null,
+            fileName:    a.fileName    || "agent.yaml",
+            yamlContent: a.yamlContent || "",
+            isDefault:   a.isDefault   || false,
+          })),
+        },
+      },
+      include: { agents: { orderBy: { createdAt: "asc" } }, _count: { select: { agents: true, runs: true } } },
+    });
+    res.json({ project });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Get project ───────────────────────────────────────────────────────────────
+router.get("/:projectId", async (req, res) => {
+  try {
+    const project = await req.db.project.findFirst({
+      where:   { id: parseInt(req.params.projectId), workspaceId: parseInt(req.params.workspaceId) },
+      include: { agents: { orderBy: { createdAt: "asc" } } },
+    });
+    if (!project) return res.status(404).json({ error: "Project not found" });
+    res.json({ project });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Update project ────────────────────────────────────────────────────────────
+router.put("/:projectId", async (req, res) => {
+  try {
+    const { name, description, oeConfig, manifest } = req.body;
+    const project = await req.db.project.update({
+      where:   { id: parseInt(req.params.projectId) },
+      data:    {
+        ...(name        !== undefined && { name }),
+        ...(description !== undefined && { description: description || null }),
+        ...(oeConfig    !== undefined && { oeConfig: JSON.stringify(oeConfig) }),
+        ...(manifest    !== undefined && {
+          manifest: JSON.stringify(manifest),
+          ...(manifest.name        && { name:        manifest.name }),
+          ...(manifest.description !== undefined && { description: manifest.description || null }),
+        }),
+      },
+      include: { agents: { orderBy: { createdAt: "asc" } } },
+    });
+    res.json({ project });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Delete project ────────────────────────────────────────────────────────────
+router.delete("/:projectId", async (req, res) => {
+  try {
+    await req.db.project.delete({ where: { id: parseInt(req.params.projectId) } });
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Agents ────────────────────────────────────────────────────────────────────
+
+router.get("/:projectId/agents", async (req, res) => {
+  try {
+    const agents = await req.db.projectAgent.findMany({
+      where:   { projectId: parseInt(req.params.projectId) },
+      orderBy: { createdAt: "asc" },
+    });
+    res.json({ agents });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+router.post("/:projectId/agents", async (req, res) => {
+  try {
+    const { name, description, fileName, yamlContent, isDefault } = req.body;
+    if (!name) return res.status(400).json({ error: "name required" });
+    const agent = await req.db.projectAgent.create({
+      data: {
+        projectId:   parseInt(req.params.projectId),
+        name,
+        description: description || null,
+        fileName:    fileName    || "agent.yaml",
+        yamlContent: yamlContent || "",
+        isDefault:   !!isDefault,
+      },
+    });
+    res.json({ agent });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+router.put("/:projectId/agents/:agentId", async (req, res) => {
+  try {
+    const { name, description, fileName, yamlContent, isDefault } = req.body;
+    const agent = await req.db.projectAgent.update({
+      where: { id: parseInt(req.params.agentId) },
+      data:  {
+        ...(name        !== undefined && { name }),
+        ...(description !== undefined && { description: description || null }),
+        ...(fileName    !== undefined && { fileName }),
+        ...(yamlContent !== undefined && { yamlContent }),
+        ...(isDefault   !== undefined && { isDefault: !!isDefault }),
+      },
+    });
+    res.json({ agent });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+router.delete("/:projectId/agents/:agentId", async (req, res) => {
+  try {
+    await req.db.projectAgent.delete({ where: { id: parseInt(req.params.agentId) } });
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Run agent (SSE) ───────────────────────────────────────────────────────────
+router.post("/:projectId/agents/:agentId/run", async (req, res) => {
+  try {
+    const { input = "" } = req.body;
+    const [project, agent] = await Promise.all([
+      req.db.project.findUnique({ where: { id: parseInt(req.params.projectId) } }),
+      req.db.projectAgent.findUnique({ where: { id: parseInt(req.params.agentId) } }),
+    ]);
+    if (!project || !agent) return res.status(404).json({ error: "Not found" });
+
+    // LLM: platform config (workspace LLM settings)
+    const llmConfig = await getLLMConfig();
+
+    // Connectors: from project's oe-config.json
+    const oeConfig = (() => { try { return JSON.parse(project.oeConfig || "{}"); } catch { return {}; } })();
+    const connectors = (oeConfig.connectors || []).map((c, i) => ({
+      id:   i + 1,
+      name: c.connection_name,
+      type: c.connection_type,
+      ...c,
+    }));
+
+    // Parse YAML → agentSpec
+    const doc = (() => { try { return yaml.load(agent.yamlContent) || {}; } catch { return {}; } })();
+    const agentSpec = {
+      systemPrompt: doc.instructions || doc.system_prompt || doc.systemPrompt || "",
+      workflow:     (doc.steps || []).map(s => ({ name: s.name || "", content: s.content || "" })),
+      params:       [],
+      maxRounds:    25,
+      input,
+    };
+
+    // Filter connectors by what YAML declares (if any)
+    const refNames = (doc.connectors || []).map(c => c.connection_name);
+    const filteredConns = refNames.length ? connectors.filter(c => refNames.includes(c.name)) : connectors;
+
+    // SSE
+    res.setHeader("Content-Type",  "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection",    "keep-alive");
+
+    const run = await req.db.projectRun.create({
+      data: {
+        projectId:         project.id,
+        agentId:           agent.id,
+        triggeredByUserId: req.user?.id || null,
+        status:            "running",
+        input:             input || null,
+      },
+    });
+
+    const { executeTool } = require("../utils/tools/registry");
+
+    await engine.run(
+      agentSpec,
+      llmConfig,
+      filteredConns,
+      {
+        toolExecutor: (name, args, conns) => executeTool(name, args, conns, req.db),
+        onToolCall:   (name) => res.write(`data: ${JSON.stringify({ tool_call: name })}\n\n`),
+        checkCancel:  async () => {
+          const [r] = await req.db.$queryRaw`SELECT cancelRequested FROM ProjectRun WHERE id = ${run.id}`;
+          return r?.cancelRequested || false;
+        },
+        onDone: async (output) => {
+          await req.db.projectRun.update({ where: { id: run.id }, data: { status: "success", output, completedAt: new Date() } });
+          res.write(`data: ${JSON.stringify({ done: true, output, runId: run.id })}\n\n`);
+          res.end();
+        },
+        onError: async (err) => {
+          await req.db.projectRun.update({ where: { id: run.id }, data: { status: "error", error: err.message, completedAt: new Date() } }).catch(() => {});
+          res.write(`data: ${JSON.stringify({ error: err.message })}\n\n`);
+          res.end();
+        },
+      }
+    );
+  } catch (err) {
+    if (!res.headersSent) return res.status(500).json({ error: err.message });
+    res.write(`data: ${JSON.stringify({ error: err.message })}\n\n`);
+    res.end();
+  }
+});
+
+// ── Cancel run ────────────────────────────────────────────────────────────────
+router.post("/:projectId/runs/:runId/cancel", async (req, res) => {
+  try {
+    await req.db.$executeRaw`UPDATE ProjectRun SET cancelRequested = 1 WHERE id = ${parseInt(req.params.runId)}`;
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+module.exports = router;

package/src/routes/settings.js

@@ -0,0 +1,45 @@
+const router = require("express").Router();
+const { authenticate, requireAdmin } = require("../middleware/auth");
+const { logActivity } = require("../utils/activityLog");
+
+router.use(authenticate, requireAdmin);
+
+router.get("/", async (req, res) => {
+  const settings = await req.db.setting.findMany();
+  const safe = settings.reduce((acc, s) => {
+    const isSensitive = s.key.includes("api_key") || s.key.toLowerCase().includes("secret");
+    const isEmpty = !s.value || s.value === "null" || s.value === "undefined";
+    acc[s.key] = isSensitive ? (isEmpty ? null : "********") : s.value;
+    return acc;
+  }, {});
+  res.json({ settings: safe });
+});
+
+router.put("/", async (req, res) => {
+  const { settings } = req.body;
+  const changedKeys = [];
+
+  for (const [key, value] of Object.entries(settings || {})) {
+    if (value === "********") continue;
+    const isSensitive = key.includes("api_key") || key.toLowerCase().includes("secret");
+    const isEmpty = value === null || value === undefined || value === "" || value === "null";
+    if (isEmpty && isSensitive) {
+      await req.db.setting.deleteMany({ where: { key } });
+      continue;
+    }
+    await req.db.setting.upsert({
+      where:  { key },
+      create: { key, value: String(value) },
+      update: { value: String(value) }
+    });
+    changedKeys.push(isSensitive ? `${key} (updated, value hidden)` : `${key}=${value}`);
+  }
+
+  if (changedKeys.length > 0) {
+    await logActivity(req.db, req.user, "settings.updated", { changed: changedKeys });
+  }
+
+  res.json({ success: true });
+});
+
+module.exports = router;

package/src/routes/setup.js

@@ -0,0 +1,42 @@
+const router = require("express").Router();
+const bcrypt = require("bcryptjs");
+const jwt = require("jsonwebtoken");
+
+router.get("/status", async (req, res) => {
+  const adminCount = await req.db.user.count({ where: { role: "admin" } });
+  res.json({ setupComplete: adminCount > 0 });
+});
+
+router.post("/complete", async (req, res) => {
+  const adminCount = await req.db.user.count({ where: { role: "admin" } });
+  if (adminCount > 0) return res.status(400).json({ error: "Setup already completed" });
+
+  const { name, email, password, settings = {} } = req.body;
+  if (!email || !password) return res.status(400).json({ error: "Email and password required" });
+  if (password.length < 8) return res.status(400).json({ error: "Password must be at least 8 characters" });
+
+  const hash = await bcrypt.hash(password, 12);
+  const user = await req.db.user.create({
+    data: { email: email.toLowerCase(), password: hash, name, role: "admin" }
+  });
+
+  // Save all LLM/embedding settings generically
+  for (const [key, value] of Object.entries(settings)) {
+    if (value === undefined || value === null || value === "") continue;
+    await req.db.setting.upsert({
+      where: { key },
+      create: { key, value: String(value) },
+      update: { value: String(value) }
+    });
+  }
+
+  const token = jwt.sign(
+    { id: user.id, email: user.email, role: user.role, name: user.name },
+    process.env.JWT_SECRET,
+    { expiresIn: "7d" }
+  );
+
+  res.json({ token, user: { id: user.id, email: user.email, name: user.name, role: user.role } });
+});
+
+module.exports = router;

package/src/routes/sso.js

@@ -0,0 +1,218 @@
+const router = require("express").Router();
+const jwt    = require("jsonwebtoken");
+const axios  = require("axios");
+const { authenticate, requireAdmin } = require("../middleware/auth");
+
+const FRONTEND_URL  = process.env.FRONTEND_URL        || "http://localhost:3000";
+const CALLBACK_BASE = process.env.OAUTH_CALLBACK_BASE || "http://localhost:3001";
+const CALLBACK_URL  = `${CALLBACK_BASE}/api/sso/callback`;
+
+const PROVIDERS = {
+  google: {
+    name:        "Google",
+    authUrl:     "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl:    "https://oauth2.googleapis.com/token",
+    userInfoUrl: "https://www.googleapis.com/oauth2/v3/userinfo",
+    scope:       "openid email profile",
+    getEmail:    d => d.email,
+  },
+  microsoft: {
+    name:        "Microsoft",
+    authUrl:     "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+    tokenUrl:    "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+    userInfoUrl: "https://graph.microsoft.com/v1.0/me",
+    scope:       "openid email User.Read",
+    getEmail:    d => d.mail || d.userPrincipalName,
+  },
+  github: {
+    name:        "GitHub",
+    authUrl:     "https://github.com/login/oauth/authorize",
+    tokenUrl:    "https://github.com/login/oauth/access_token",
+    userInfoUrl: "https://api.github.com/user/emails",
+    scope:       "user:email",
+    getEmail:    d => {
+      if (Array.isArray(d)) {
+        const primary = d.find(e => e.primary && e.verified);
+        return primary?.email || d[0]?.email;
+      }
+      return d.email;
+    },
+  },
+  facebook: {
+    name:        "Facebook",
+    authUrl:     "https://www.facebook.com/v18.0/dialog/oauth",
+    tokenUrl:    "https://graph.facebook.com/v18.0/oauth/access_token",
+    userInfoUrl: "https://graph.facebook.com/me?fields=email",
+    scope:       "email",
+    getEmail:    d => d.email,
+  },
+  apple: {
+    name:        "Apple",
+    authUrl:     "https://appleid.apple.com/auth/authorize",
+    tokenUrl:    "https://appleid.apple.com/auth/token",
+    userInfoUrl: null,
+    scope:       "name email",
+    getEmail:    d => d.email,
+    note:        "Apple requires a private key (p8) to generate the client secret. Contact support to enable.",
+  },
+  zoho: {
+    name:        "Zoho",
+    authUrl:     "https://accounts.zoho.com/oauth/v2/auth",
+    tokenUrl:    "https://accounts.zoho.com/oauth/v2/token",
+    userInfoUrl: "https://accounts.zoho.com/oauth/v2/userinfo",
+    scope:       "openid email",
+    getEmail:    d => d.email,
+  },
+};
+
+const SSO_ERROR_MESSAGES = {
+  not_configured:    "SSO is not configured",
+  unknown_provider:  "Unknown SSO provider",
+  no_email:          "SSO provider did not return an email address",
+  user_not_found:    "No account found for this email. Contact your administrator.",
+  account_suspended: "Your account has been suspended",
+  use_password_login: "This account must use password login",
+  apple_not_supported: "Apple SSO requires additional server-side setup",
+};
+
+function getSetting(db, key) {
+  return db.setting.findUnique({ where: { key } }).then(r => r?.value ?? null);
+}
+
+// ── Public: login page checks this on load ────────────────────────────────────
+router.get("/config", async (req, res) => {
+  res.set("Cache-Control", "no-store");
+  try {
+    const [enabled, provider, clientId] = await Promise.all([
+      getSetting(req.db, "sso.enabled"),
+      getSetting(req.db, "sso.provider"),
+      getSetting(req.db, "sso.clientId"),
+    ]);
+    const active = enabled === "true" && !!provider && !!clientId;
+    res.json({ enabled: active, provider: active ? provider : null, callbackUrl: CALLBACK_URL });
+  } catch {
+    res.json({ enabled: false, provider: null, callbackUrl: CALLBACK_URL });
+  }
+});
+
+// ── Admin: save SSO config ────────────────────────────────────────────────────
+router.put("/config", authenticate, requireAdmin, async (req, res) => {
+  const { provider, clientId, clientSecret, enabled } = req.body;
+  const upsert = (key, value) => req.db.setting.upsert({
+    where:  { key },
+    create: { key, value: String(value) },
+    update: { value: String(value) },
+  });
+  if (provider  !== undefined)                        await upsert("sso.provider",      provider);
+  if (clientId  !== undefined)                        await upsert("sso.clientId",      clientId);
+  if (clientSecret && clientSecret !== "********")    await upsert("sso.clientSecret",  clientSecret);
+  if (enabled   !== undefined)                        await upsert("sso.enabled",       String(enabled));
+  res.json({ success: true });
+});
+
+// ── Public: start OAuth flow ──────────────────────────────────────────────────
+router.get("/start", async (req, res) => {
+  try {
+    const [enabled, provider, clientId] = await Promise.all([
+      getSetting(req.db, "sso.enabled"),
+      getSetting(req.db, "sso.provider"),
+      getSetting(req.db, "sso.clientId"),
+    ]);
+    if (enabled !== "true" || !provider || !clientId)
+      return res.redirect(`${FRONTEND_URL}/login?sso_error=not_configured`);
+
+    if (provider === "apple")
+      return res.redirect(`${FRONTEND_URL}/login?sso_error=apple_not_supported`);
+
+    const p = PROVIDERS[provider];
+    if (!p) return res.redirect(`${FRONTEND_URL}/login?sso_error=unknown_provider`);
+
+    const state  = Buffer.from(JSON.stringify({ ts: Date.now() })).toString("base64url");
+    const params = new URLSearchParams({
+      client_id:     clientId,
+      redirect_uri:  CALLBACK_URL,
+      response_type: "code",
+      scope:         p.scope,
+      state,
+    });
+    res.redirect(`${p.authUrl}?${params}`);
+  } catch (err) {
+    console.error("[SSO] start error:", err.message);
+    res.redirect(`${FRONTEND_URL}/login?sso_error=${encodeURIComponent(err.message)}`);
+  }
+});
+
+// ── Public: OAuth callback ────────────────────────────────────────────────────
+router.get("/callback", async (req, res) => {
+  const { code, error } = req.query;
+  if (error) return res.redirect(`${FRONTEND_URL}/login?sso_error=${encodeURIComponent(error)}`);
+  if (!code)  return res.redirect(`${FRONTEND_URL}/login?sso_error=no_code`);
+
+  try {
+    const [provider, clientId, clientSecret] = await Promise.all([
+      getSetting(req.db, "sso.provider"),
+      getSetting(req.db, "sso.clientId"),
+      getSetting(req.db, "sso.clientSecret"),
+    ]);
+    if (!provider || !clientId || !clientSecret)
+      return res.redirect(`${FRONTEND_URL}/login?sso_error=not_configured`);
+
+    const p = PROVIDERS[provider];
+
+    // Exchange code for access token
+    const tokenHeaders = { "Content-Type": "application/x-www-form-urlencoded" };
+    if (provider === "github") tokenHeaders["Accept"] = "application/json";
+
+    const { data: tokens } = await axios.post(
+      p.tokenUrl,
+      new URLSearchParams({
+        grant_type:    "authorization_code",
+        code,
+        client_id:     clientId,
+        client_secret: clientSecret,
+        redirect_uri:  CALLBACK_URL,
+      }),
+      { headers: tokenHeaders }
+    );
+
+    const accessToken = tokens.access_token;
+    if (!accessToken) throw new Error("No access token returned");
+
+    // Get user info / email
+    const { data: userInfo } = await axios.get(p.userInfoUrl, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept:        "application/json",
+        ...(provider === "github" ? { "User-Agent": "OpenEnthrium-SSO" } : {}),
+      },
+    });
+
+    const email = p.getEmail(userInfo)?.toLowerCase();
+    if (!email) return res.redirect(`${FRONTEND_URL}/login?sso_error=no_email`);
+
+    // Block super admin from OAuth
+    const superEmail = process.env.SUPER_ADMIN_EMAIL?.toLowerCase();
+    if (superEmail && email === superEmail)
+      return res.redirect(`${FRONTEND_URL}/login?sso_error=use_password_login`);
+
+    // Look up user in DB
+    const user = await req.db.user.findUnique({ where: { email } });
+    if (!user)         return res.redirect(`${FRONTEND_URL}/login?sso_error=user_not_found`);
+    if (user.suspended) return res.redirect(`${FRONTEND_URL}/login?sso_error=account_suspended`);
+
+    // Issue JWT — same structure as password login, with sso flag
+    const token = jwt.sign(
+      { id: user.id, email: user.email, role: user.role, name: user.name, sso: true },
+      process.env.JWT_SECRET,
+      { expiresIn: "7d" }
+    );
+
+    res.redirect(`${FRONTEND_URL}/login?sso_token=${token}`);
+  } catch (err) {
+    console.error("[SSO] callback error:", err.message);
+    const msg = err.response?.data?.error_description || err.response?.data?.error || err.message;
+    res.redirect(`${FRONTEND_URL}/login?sso_error=${encodeURIComponent(msg)}`);
+  }
+});
+
+module.exports = { router, SSO_ERROR_MESSAGES };

package/src/routes/superadmin.js

@@ -0,0 +1,51 @@
+const router = require("express").Router();
+const { authenticate } = require("../middleware/auth");
+
+function requireSuperAdmin(req, res, next) {
+  if (req.user?.id !== 0) return res.status(403).json({ error: "Super admin only" });
+  next();
+}
+
+router.use(authenticate, requireSuperAdmin);
+
+const CONFIG_KEYS = [
+  "tier.maxWorkspaces",
+  "tier.maxUsers",
+  "tier.maxConnectors",
+  "tier.maxAgentRunsPerMonth",
+  "tier.ingestionSpaceGb",
+  "storage.uploadPath",
+  "storage.maxFileSizeMb",
+  "feature.kbSharing",
+  "feature.agentSharing",
+  "feature.connectorSharing",
+];
+
+// GET /api/superadmin/config
+router.get("/config", async (req, res) => {
+  const rows = await req.db.setting.findMany({
+    where: { key: { in: CONFIG_KEYS } },
+  });
+  const config = {};
+  for (const r of rows) config[r.key] = r.value;
+  res.json({ config });
+});
+
+// PUT /api/superadmin/config
+router.put("/config", async (req, res) => {
+  const { config } = req.body;
+  if (!config || typeof config !== "object") return res.status(400).json({ error: "config object required" });
+
+  for (const [key, value] of Object.entries(config)) {
+    if (!CONFIG_KEYS.includes(key)) continue;
+    await req.db.setting.upsert({
+      where:  { key },
+      create: { key, value: String(value) },
+      update: { value: String(value) },
+    });
+  }
+
+  res.json({ success: true });
+});
+
+module.exports = router;

package/src/routes/templates.js

@@ -0,0 +1,75 @@
+const router = require("express").Router();
+const { authenticate, requireManagerOrAdmin } = require("../middleware/auth");
+const fs   = require("fs");
+const path = require("path");
+const yaml = require("js-yaml");
+
+router.use(authenticate, requireManagerOrAdmin);
+
+const SAMPLES_DIR = path.resolve(__dirname, "../../cli/samples");
+
+// ── List templates ─────────────────────────────────────────────────────────────
+router.get("/", (req, res) => {
+  try {
+    const entries = fs.readdirSync(SAMPLES_DIR, { withFileTypes: true })
+      .filter(e => e.isDirectory())
+      .map(e => {
+        const dir = path.join(SAMPLES_DIR, e.name);
+        let name    = e.name;
+        let version = "1.0.0";
+        let description = "";
+        let tags    = [];
+        let agentCount = 0;
+
+        // Prefer oe-project.json metadata
+        const projFile = path.join(dir, "oe-project.json");
+        if (fs.existsSync(projFile)) {
+          try {
+            const m = JSON.parse(fs.readFileSync(projFile, "utf8"));
+            if (m.name)        name        = m.name;
+            if (m.version)     version     = m.version;
+            if (m.description) description = m.description;
+            if (Array.isArray(m.tags)) tags = m.tags;
+            agentCount = (m.agents || []).length;
+          } catch {}
+        }
+
+        // Fallback: read name from the first YAML file
+        if (agentCount === 0) {
+          const yamls = fs.readdirSync(dir).filter(f => /\.ya?ml$/i.test(f));
+          agentCount = yamls.length;
+          if (!fs.existsSync(projFile) && yamls[0]) {
+            try {
+              const doc = yaml.load(fs.readFileSync(path.join(dir, yamls[0]), "utf8")) || {};
+              if (doc.name) name = doc.name;
+              if (doc.description) description = doc.description;
+            } catch {}
+          }
+        }
+
+        return { id: e.name, name, version, description, tags, agentCount };
+      });
+
+    res.json({ templates: entries });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Get template files ─────────────────────────────────────────────────────────
+router.get("/:templateId", (req, res) => {
+  try {
+    const dir = path.join(SAMPLES_DIR, path.basename(req.params.templateId));
+    if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory())
+      return res.status(404).json({ error: "Template not found" });
+
+    const fileMap = {};
+    for (const fname of fs.readdirSync(dir)) {
+      const fpath = path.join(dir, fname);
+      if (!fs.statSync(fpath).isFile()) continue;
+      if (fname.startsWith(".")) continue;
+      fileMap[fname] = fs.readFileSync(fpath, "utf8");
+    }
+    res.json({ fileMap });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+module.exports = router;