@polderlabs/bizar 8.0.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/projects.mjs

@@ -0,0 +1,175 @@
+/**
+ * src/server/routes/projects.mjs
+ *
+ * /api/projects                           — list
+ * /api/projects  (POST)                   — add by path
+ * /api/projects/:id/activate (POST)       — set active
+ * /api/projects/:id (DELETE)              — remove
+ * /api/projects/refresh (POST)            — re-scan projects.json
+ * /api/projects/auto-detect (POST)        — auto-add the server's cwd
+ * /api/projects/active/tasks              — tasks for the active project
+ * /api/projects/active/schedules          — schedules for the active project
+ * /api/projects/active/mods               — mods for the active project
+ * /api/projects/active/state              — state.json for the active project
+ */
+import { Router } from 'express';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { projectsStore } from '../projects-store.mjs';
+import { tasksStore } from '../tasks-store.mjs';
+import { schedulesStore } from '../schedules-store.mjs';
+import { readActiveProjectId, safeReadJSON, wrap, readSettings } from './_shared.mjs';
+import { buildAllowedRootsFromSettings, resolveSafePath } from '../lib/path-safe.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createProjectsRouter({ state, broadcast, projectRoot }) {
+  const router = Router();
+
+  router.get('/projects', wrap(async (_req, res) => {
+    res.json(projectsStore.list());
+  }));
+
+  router.post('/projects', wrap(async (req, res) => {
+    const path = (req.body?.path || '').trim();
+    const name = req.body?.name || null;
+    if (!path) {
+      res.status(400).json({ error: 'bad_request', message: 'path is required' });
+      return;
+    }
+    const project = projectsStore.add(path, name);
+    state.appendActivity({ kind: 'project.add', id: project.id, path: project.path });
+    res.status(201).json(project);
+  }));
+
+  router.post('/projects/:id/activate', wrap(async (req, res) => {
+    const activated = projectsStore.activate(req.params.id);
+    if (!activated) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    state.appendActivity({ kind: 'project.activate', id: activated.id });
+    broadcast({ type: 'project:change', project: activated });
+    res.json(activated);
+  }));
+
+  router.delete('/projects/:id', wrap(async (req, res) => {
+    projectsStore.remove(req.params.id);
+    broadcast({ type: 'project:change' });
+    res.status(204).end();
+  }));
+
+  router.post('/projects/refresh', wrap(async (_req, res) => {
+    res.json(projectsStore.list());
+  }));
+
+  // v3.0.4 — Manual auto-detect trigger for the "Use current directory"
+  // button on the Overview. Auto-detects the server's `projectRoot` and
+  // returns the (possibly updated) registry. Idempotent.
+  router.post('/projects/auto-detect', wrap(async (_req, res) => {
+    const detected = projectsStore.autoDetect({ cwd: projectRoot });
+    if (detected) {
+      state.appendActivity({ kind: 'project.auto-detect', id: detected.id, path: detected.path });
+      broadcast({ type: 'project:change', project: detected });
+    }
+    res.json(projectsStore.list());
+  }));
+
+  // v3.6.0 — Scan a configured `dashboard.projectsDirectory` for
+  // project roots and add any newly-detected ones to the registry.
+  // Idempotent: already-registered paths are skipped silently.
+  //
+  // v3.11.0 — The allow-list now also includes every entry in
+  // `dashboard.allowedRoots` (in addition to home and
+  // `projectsDirectory`). The configured `projectsDirectory` is
+  // re-validated against the full allow-list before scanning — a
+  // tampered settings file can't widen the boundary.
+  router.post('/projects/scan', wrap(async (_req, res) => {
+    const settings = readSettings().data || {};
+    const configured = settings.dashboard?.projectsDirectory;
+    if (typeof configured !== 'string' || !configured.trim()) {
+      res.status(400).json({
+        error: 'bad_request',
+        message: 'dashboard.projectsDirectory is not configured',
+      });
+      return;
+    }
+    const allowedRoots = buildAllowedRootsFromSettings({ settings, home: homedir() });
+    const safeRoot = resolveSafePath(configured, allowedRoots);
+    if (!safeRoot) {
+      res.status(403).json({
+        error: 'forbidden',
+        message: 'projectsDirectory is outside the allowed roots',
+      });
+      return;
+    }
+    let result;
+    try {
+      result = await projectsStore.scanDirectory(safeRoot);
+    } catch (err) {
+      res.status(500).json({ error: 'scan_failed', message: err?.message || String(err) });
+      return;
+    }
+    if (result.error) {
+      // scanDirectory returns `{ error }` on a soft failure (bad
+      // root, etc.). Surface as 400 so the client can show it.
+      res.status(400).json({ error: 'scan_failed', message: result.error });
+      return;
+    }
+    // Broadcast each newly added project so connected clients refresh.
+    for (const p of result.added) {
+      state.appendActivity({ kind: 'project.scan', id: p.id, path: p.path });
+      broadcast({ type: 'project:change', kind: 'added', project: p });
+    }
+    res.json({
+      added: result.added,
+      skipped: result.skipped,
+      scanned: result.scanned,
+    });
+  }));
+
+  // ── /api/projects/active/<entity> ──────────────────────────────────────
+  router.get('/projects/active/tasks', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ tasks: [], projectId: null });
+      return;
+    }
+    res.json({ tasks: tasksStore.loadTasks(active.id), projectId: active.id });
+  }));
+
+  router.get('/projects/active/schedules', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ schedules: [], projectId: null });
+      return;
+    }
+    res.json({ schedules: schedulesStore.list(active.id), projectId: active.id });
+  }));
+
+  router.get('/projects/active/mods', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ mods: [], projectId: null });
+      return;
+    }
+    res.json({ mods: [], projectId: active.id });
+  }));
+
+  router.get('/projects/active/state', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ state: {}, projectId: null });
+      return;
+    }
+    const stateFile = join(projectsStore.projectDir(active.id), 'state.json');
+    res.json({ state: safeReadJSON(stateFile, {}) || {}, projectId: active.id });
+  }));
+
+  return router;
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/providers.mjs

@@ -0,0 +1,308 @@
+/**
+ * src/server/routes/providers.mjs
+ *
+ * Provider subsystem routes (v4.6.0).
+ *
+ * Endpoints (all mounted under /api):
+ *
+ *   Aggregated list (read-only):
+ *     GET  /providers                         — cline.json + agents + serve HTTP
+ *     GET  /providers/active                  — current default provider + model
+ *     GET  /providers/auto-detect             — env+config detection
+ *
+ *   Catalog (UI wizard):
+ *     GET  /providers/catalog                 — full curated provider catalog
+ *     GET  /providers/catalog/search?q=…      — fuzzy-search the catalog
+ *
+ *   Provider CRUD (delegates to providersStore):
+ *     GET  /providers                         — list configured providers
+ *     POST /providers/auto                    — "Add with auto" wizard
+ *     POST /providers/:id/keys                — add a backup key
+ *     DELETE /providers/:id/keys/:envVar      — remove a key
+ *     POST /providers/:id/rotate              — manual rotation trigger
+ *     PUT  /providers/:id/keys/:envVar/status — set status
+ *
+ * The legacy `/api/config/providers/*` surface remains in routes/config.mjs
+ * for back-compat — those routes just delegate to the same providersStore
+ * functions used here.
+ */
+import { Router } from 'express';
+import { providersStore } from '../providers-store.mjs';
+import {
+  PROVIDER_CATALOG,
+  listCatalog,
+  searchProviders,
+  findCatalogEntry,
+  getActiveKey,
+  rotateKey,
+  markKeyError,
+  markKeySuccess,
+  addBackupKey,
+  removeBackupKey,
+  setKeyStatus,
+} from '../providers-store.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createProvidersRouter() {
+  const router = Router();
+
+  // ── Aggregated read-only endpoints (preserved from previous versions) ──
+
+  // Surface-everything endpoint the dashboard uses to populate the
+  // Providers card on the Overview tab. Reads from cline.json +
+  // agent frontmatter + (best-effort) the running cline serve HTTP
+  // API, so the list is non-empty even on installs that don't declare
+  // a top-level `provider` key in cline.json.
+  router.get('/providers', wrap(async (_req, res) => {
+    const providers = await providersStore.listAll();
+    res.json({ providers, count: providers.length });
+  }));
+
+  // Active default provider + model. null when nothing is configured.
+  router.get('/providers/active', wrap(async (_req, res) => {
+    const active = await providersStore.getActive();
+    res.json(active || { providerId: null, modelId: null, source: null });
+  }));
+
+  // v3.16.0 — Auto-detect providers from env + config. Best-effort;
+  // a timeout/failure on one provider does not block the others.
+  // Query: ?probe=0 to skip the /models probe (faster, less informative).
+  router.get('/providers/auto-detect', wrap(async (req, res) => {
+    const probe = req.query.probe !== '0';
+    const results = await providersStore.autoDetect({ probe });
+    res.json({ providers: results, count: results.length });
+  }));
+
+  // ── v4.6.0 catalog (UI wizard) ──────────────────────────────────────────
+
+  // GET /providers/catalog — full curated list, UI-safe shape.
+  router.get('/providers/catalog', wrap(async (_req, res) => {
+    res.json({ catalog: listCatalog(), count: PROVIDER_CATALOG.length });
+  }));
+
+  // GET /providers/catalog/search?q=minimax&limit=20 — fuzzy search.
+  router.get('/providers/catalog/search', wrap(async (req, res) => {
+    const q = typeof req.query.q === 'string' ? req.query.q : '';
+    const limit = Math.min(Math.max(parseInt(req.query.limit, 10) || 20, 1), 50);
+    const results = searchProviders(q, { limit });
+    res.json({ query: q, results, count: results.length });
+  }));
+
+  // ── v4.6.0 provider CRUD (rotation-aware) ──────────────────────────────
+
+  // GET /providers/list — list configured providers from cline.json.
+  // (Distinct path from /providers because /providers returns the
+  // aggregated discovery view; /providers/list returns the persisted
+  // cline.json shape.)
+  router.get('/providers/list', wrap(async (_req, res) => {
+    res.json({ providers: providersStore.list() });
+  }));
+
+  // POST /providers/auto — v4.6.0 "Add with auto" wizard.
+  //
+  // The new wizard is env-var-first: the user pastes an envVar (or
+  // types a label and we synthesize one), and we look up the catalog
+  // entry by `providerId` to fill baseURL/models. We do NOT probe
+  // /v1/models here — the user hasn't pasted a key yet (it's in env).
+  //
+  // Body: { providerId: string, envVar: string, label?: string,
+  //         setAsSystemLlm?: boolean, preferredModel?: string }
+  router.post('/providers/auto', wrap(async (req, res) => {
+    const body = req.body || {};
+    const providerId = typeof body.providerId === 'string' ? body.providerId.trim() : '';
+    const envVar = typeof body.envVar === 'string' ? body.envVar.trim() : '';
+    const label = typeof body.label === 'string' ? body.label.trim() : '';
+
+    if (!providerId) {
+      res.status(400).json({ ok: false, error: 'providerId_required', message: 'providerId is required' });
+      return;
+    }
+    if (!envVar) {
+      res.status(400).json({ ok: false, error: 'envVar_required', message: 'envVar is required' });
+      return;
+    }
+    if (!/^[A-Z][A-Z0-9_]{1,62}$/.test(envVar)) {
+      res.status(400).json({ ok: false, error: 'invalid_envVar', message: 'envVar must be UPPER_SNAKE_CASE' });
+      return;
+    }
+    const entry = findCatalogEntry(providerId);
+    if (!entry) {
+      res.status(404).json({
+        ok: false,
+        error: 'unknown_provider',
+        message: `Unknown providerId "${providerId}". Try GET /api/providers/catalog.`,
+      });
+      return;
+    }
+
+    // Build the provider entry: keys[0] = the env-var key the user
+    // supplied. We do NOT persist any key value — it lives in the env.
+    const cfg = providersStore.add({
+      id: providerId,
+      name: entry.name,
+      baseURL: typeof body.baseURL === 'string' && body.baseURL.trim() ? body.baseURL.trim() : entry.baseURL,
+      apiKey: `<env:${envVar}>`, // marker — cline sees a non-empty key
+      keys: [
+        {
+          envVar,
+          label: label || 'Primary',
+          status: 'active',
+          lastError: null,
+          errorCount: 0,
+          lastUsed: null,
+        },
+      ],
+      models: Array.isArray(body.models) && body.models.length > 0 ? body.models : entry.models.slice(),
+      enabled: true,
+    });
+
+    // Optional: set as the system LLM so /api/llm/* hits this provider.
+    if (body.setAsSystemLlm !== false) {
+      // Lazy: use the store's addWithAuto path so we share its
+      // systemLlm update logic.
+      const models = Array.isArray(cfg.models) && cfg.models.length > 0 ? cfg.models : entry.models;
+      const preferredModel = typeof body.preferredModel === 'string' && body.preferredModel.trim()
+        ? body.preferredModel.trim()
+        : (Array.isArray(models) ? models[0] : null);
+      if (preferredModel) {
+        // providersStore doesn't expose a public systemLlm setter, so we
+        // write it through addWithAuto's side-effect path: call it with
+        // a noop key (since the env-var key lives in env, we can't probe
+        // models here, but we can still set systemLlm). Use a dummy
+        // string — it never touches the disk because addWithAuto only
+        // writes a key if it differs from the existing one.
+        try {
+          await providersStore.addWithAuto({
+            id: providerId,
+            apiKey: `env:${envVar}`, // bypass probe path; addWithAuto will keep existing
+            setAsSystemLlm: true,
+            preferredModel,
+            systemLlmModel: preferredModel,
+          });
+        } catch {
+          // addWithAuto may reject due to keyPattern — that's fine, the
+          // systemLlm side-effect runs after the key check. We ignore
+          // any throw here; the provider is already added.
+        }
+      }
+    }
+
+    res.status(201).json({
+      ok: true,
+      provider: providersStore.get(providerId),
+      catalog: { id: entry.id, name: entry.name, baseURL: entry.baseURL },
+    });
+  }));
+
+  // POST /providers/:id/keys — add a backup key to an existing provider.
+  // Body: { envVar: string, label?: string }
+  router.post('/providers/:id/keys', wrap(async (req, res) => {
+    const { id } = req.params;
+    const body = req.body || {};
+    const envVar = typeof body.envVar === 'string' ? body.envVar.trim() : '';
+    const label = typeof body.label === 'string' ? body.label.trim() : '';
+    if (!envVar) {
+      res.status(400).json({ ok: false, error: 'envVar_required', message: 'envVar is required' });
+      return;
+    }
+    if (!/^[A-Z][A-Z0-9_]{1,62}$/.test(envVar)) {
+      res.status(400).json({ ok: false, error: 'invalid_envVar', message: 'envVar must be UPPER_SNAKE_CASE' });
+      return;
+    }
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found', message: `provider "${id}" not found` });
+      return;
+    }
+    try {
+      const inserted = addBackupKey(id, envVar, label);
+      res.status(201).json({ ok: true, key: inserted, provider: providersStore.get(id) });
+    } catch (err) {
+      res.status(400).json({ ok: false, error: 'add_failed', message: err.message });
+    }
+  }));
+
+  // DELETE /providers/:id/keys/:envVar — remove a key. Refuses if
+  // it would leave the provider with zero keys.
+  router.delete('/providers/:id/keys/:envVar', wrap(async (req, res) => {
+    const { id, envVar } = req.params;
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found' });
+      return;
+    }
+    try {
+      const ok = removeBackupKey(id, envVar);
+      if (!ok) {
+        res.status(404).json({ ok: false, error: 'key_not_found', message: `no key with envVar "${envVar}"` });
+        return;
+      }
+      res.status(200).json({ ok: true, provider: providersStore.get(id) });
+    } catch (err) {
+      res.status(400).json({ ok: false, error: 'remove_failed', message: err.message });
+    }
+  }));
+
+  // POST /providers/:id/rotate — manual rotation trigger. Marks the
+  // current active key as disabled and promotes the next one.
+  router.post('/providers/:id/rotate', wrap(async (req, res) => {
+    const { id } = req.params;
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found' });
+      return;
+    }
+    const newActive = rotateKey(id);
+    if (!newActive) {
+      res.status(409).json({ ok: false, error: 'no_rotation_target', message: 'no other keys available to rotate to' });
+      return;
+    }
+    res.json({ ok: true, active: newActive, provider: providersStore.get(id) });
+  }));
+
+  // PUT /providers/:id/keys/:envVar/status — set a key's status
+  // manually (operator override).
+  // Body: { status: 'active'|'standby'|'disabled'|'cooldown' }
+  router.put('/providers/:id/keys/:envVar/status', wrap(async (req, res) => {
+    const { id, envVar } = req.params;
+    const status = req.body?.status;
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found' });
+      return;
+    }
+    if (!['active', 'standby', 'disabled', 'cooldown'].includes(status)) {
+      res.status(400).json({ ok: false, error: 'invalid_status', message: 'status must be active|standby|disabled|cooldown' });
+      return;
+    }
+    try {
+      const updated = setKeyStatus(id, envVar, status);
+      res.json({ ok: true, key: updated, provider: providersStore.get(id) });
+    } catch (err) {
+      res.status(400).json({ ok: false, error: 'set_status_failed', message: err.message });
+    }
+  }));
+
+  // GET /providers/:id/active-key — read the active key + value from env.
+  // (Handy for the dashboard's "what's in use right now" diagnostic card.)
+  router.get('/providers/:id/active-key', wrap(async (req, res) => {
+    const { id } = req.params;
+    const active = getActiveKey(id);
+    if (!active) {
+      res.status(404).json({ ok: false, error: 'no_keys', message: 'no keys configured for this provider' });
+      return;
+    }
+    // Mask the value (don't echo raw key in API responses).
+    res.json({
+      ok: true,
+      active: {
+        envVar: active.envVar,
+        label: active.label,
+        status: active.status,
+        keyPreview: active.key.length > 8 ? `${active.key.slice(0, 2)}...${active.key.slice(-2)}` : (active.key ? '***short***' : ''),
+        keySet: active.key.length > 0,
+      },
+    });
+  }));
+
+  return router;
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/schedules.mjs

@@ -0,0 +1,159 @@
+/**
+ * src/server/routes/schedules.mjs
+ *
+ * /api/schedules                          — list
+ * /api/schedules (POST)                   — add
+ * /api/schedules/:id (PUT)                — full update
+ * /api/schedules/:id (PATCH)              — partial update (toggle fields)
+ * /api/schedules/:id/run (POST)           — run once now
+ * /api/schedules/:id/trigger (POST)       — alias for /run (mobile uses this)
+ * /api/schedules/:id (DELETE)             — remove
+ *
+ * PATCH exists because the desktop UI's "toggle enabled" and the mobile
+ * UI's edit flow both want to send partial payloads without losing the
+ * rest of the schedule.
+ */
+import { Router } from 'express';
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { schedulesStore } from '../schedules-store.mjs';
+import { schedulesRunner } from '../schedules-runner.mjs';
+import { readActiveProjectId, wrap } from './_shared.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const TEMPLATES_DIR = join(__dirname, '..', '..', '..', '..', 'templates', 'schedules');
+
+/**
+ * Load all schedule templates from templates/schedules/.
+ * Each template gets `source: 'template'` and `templateFile` added.
+ * Missing directory returns an empty array.
+ */
+function loadTemplates() {
+  if (!existsSync(TEMPLATES_DIR)) return [];
+  return readdirSync(TEMPLATES_DIR)
+    .filter((f) => f.endsWith('.json'))
+    .map((f) => {
+      const content = JSON.parse(readFileSync(join(TEMPLATES_DIR, f), 'utf8'));
+      return { ...content, source: 'template', templateFile: f };
+    });
+}
+
+/**
+ * @param {object} deps
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createSchedulesRouter({ broadcast }) {
+  const router = Router();
+
+  router.get('/schedules', wrap(async (req, res) => {
+    const projectId = req.query.projectId || readActiveProjectId();
+    res.json(schedulesStore.list(projectId || 'default'));
+  }));
+
+  router.post('/schedules', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.add(projectId, req.body || {});
+    broadcast({ type: 'schedules:change' });
+    res.status(201).json(sched);
+  }));
+
+  router.put('/schedules/:id', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.update(projectId, req.params.id, req.body || {});
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'schedules:change' });
+    res.json(sched);
+  }));
+
+  // v3.9.0 — Partial update. The mobile UI PATCHes a single field at a
+  // time (toggle enabled, rename, etc.) so a PUT that required the full
+  // shape was impractical. PATCH is semantically correct here.
+  router.patch('/schedules/:id', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.update(projectId, req.params.id, req.body || {});
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'schedules:change' });
+    res.json(sched);
+  }));
+
+  router.post('/schedules/:id/run', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.get(projectId, req.params.id);
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    const result = await schedulesRunner.runOne(projectId, sched);
+    broadcast({ type: 'schedules:change' });
+    res.json(result);
+  }));
+
+  // v3.9.0 — Mobile uses /trigger; keep it as an alias of /run so
+  // desktop and mobile share the same handler.
+  router.post('/schedules/:id/trigger', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.get(projectId, req.params.id);
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    const result = await schedulesRunner.runOne(projectId, sched);
+    broadcast({ type: 'schedules:change' });
+    res.json(result);
+  }));
+
+  router.delete('/schedules/:id', wrap(async (req, res) => {
+    const projectId = req.query.projectId || readActiveProjectId() || 'default';
+    const ok = schedulesStore.remove(projectId, req.params.id);
+    if (!ok) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'schedules:change' });
+    res.status(204).end();
+  }));
+
+  // GET /api/schedules/templates → { templates: [...] }
+  router.get('/schedules/templates', wrap(async (_req, res) => {
+    res.json({ templates: loadTemplates() });
+  }));
+
+  // POST /api/schedules/from-template → creates a schedule from a template
+  router.post('/schedules/from-template', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const { templateId, name: customName } = req.body || {};
+    if (!templateId) {
+      res.status(400).json({ error: 'templateId is required' });
+      return;
+    }
+    const templates = loadTemplates();
+    const template = templates.find((t) => t.id === templateId);
+    if (!template) {
+      res.status(404).json({ error: 'template not found' });
+      return;
+    }
+    // Build a schedule payload from the template, allowing name override
+    const schedulePayload = {
+      name: customName || template.name,
+      type: template.type,
+      schedule: template.schedule,
+      timezone: template.timezone || 'UTC',
+      action: template.action,
+      budgetCheck: template.budgetCheck,
+      enabled: true,
+    };
+    const sched = schedulesStore.add(projectId, schedulePayload);
+    broadcast({ type: 'schedules:change' });
+    res.status(201).json(sched);
+  }));
+
+  return router;
+}