@repo-os/repoos 0.5.45

package/dist/server/routes/helpers.js

@@ -0,0 +1,171 @@
+import { basename, extname, resolve, join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { existsSync, readFileSync, statSync, readdirSync } from "node:fs";
+import { STATUSES } from "../../core/types.js";
+import { readBuildMeta } from "../../core/build.js";
+export const UI_MIME = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "application/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".svg": "image/svg+xml; charset=utf-8",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".ico": "image/x-icon",
+    ".json": "application/json",
+    ".webmanifest": "application/manifest+json",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".map": "application/json",
+};
+export function serveStaticUi(res, uiDir, urlPath) {
+    const rel = decodeURIComponent(urlPath).replace(/^\/+/, "");
+    if (rel.includes(".."))
+        return false;
+    const abs = resolve(uiDir, rel || "index.html");
+    if (!abs.startsWith(resolve(uiDir)))
+        return false;
+    if (!existsSync(abs) || !statSync(abs).isFile())
+        return false;
+    const ext = extname(abs).toLowerCase();
+    const noCache = rel === "sw.js" || rel === "manifest.webmanifest";
+    res.writeHead(200, {
+        "Content-Type": UI_MIME[ext] ?? "application/octet-stream",
+        "Cache-Control": noCache ? "no-cache" : ext === ".html" ? "no-cache" : "max-age=86400",
+        "Access-Control-Allow-Origin": "*",
+    });
+    res.end(readFileSync(abs));
+    return true;
+}
+export function safeRepoFile(root, urlPath) {
+    const rel = decodeURIComponent(urlPath.replace(/^\/+/, ""));
+    if (rel.includes(".."))
+        return null;
+    const abs = resolve(root, rel);
+    if (!abs.startsWith(resolve(root)))
+        return null;
+    if (!existsSync(abs) || !statSync(abs).isFile())
+        return null;
+    if (extname(abs) !== ".md")
+        return null;
+    return abs;
+}
+export function findUiDir(root) {
+    const candidates = [join(root, "dist", "ui")];
+    const here = dirname(dirname(fileURLToPath(import.meta.url))); // src/server
+    candidates.push(join(here, "ui"), join(here, "..", "..", "dist", "ui"));
+    for (const p of candidates)
+        if (existsSync(p))
+            return p;
+    return null;
+}
+export function findPackageRoot() {
+    const here = dirname(dirname(dirname(fileURLToPath(import.meta.url)))); // project root
+    if (existsSync(join(here, "package.json")))
+        return here;
+    const parent = dirname(here);
+    if (existsSync(join(parent, "package.json")))
+        return parent;
+    return null;
+}
+export function loadBuildInfo() {
+    // Reads `.build-info.json` / `.build-stamp.json` relative to the running
+    // module — the only files that ship in a standalone (curl / `repoos upgrade`)
+    // install. The old package.json-only path left those installs at "unknown".
+    return readBuildMeta();
+}
+export function skillField(text, field) {
+    const fm = text.match(/^---\s*\n([\s\S]*?)\n---/);
+    if (!fm)
+        return null;
+    const m = fm[1].match(new RegExp(`^${field}:\\s*(.+)$`, "m"));
+    if (!m)
+        return null;
+    return m[1].trim().replace(/^["']|["']$/g, "");
+}
+export function listDocs(config) {
+    const out = [];
+    const seen = new Set();
+    const add = (abs, rel) => {
+        if (seen.has(rel) || !existsSync(abs))
+            return;
+        seen.add(rel);
+        let title = rel;
+        try {
+            const m = readFileSync(abs, "utf8").match(/^\s*#\s+(.+)$/m);
+            if (m)
+                title = m[1].trim();
+        }
+        catch {
+            /* ignore */
+        }
+        out.push({ path: rel, title });
+    };
+    for (const name of ["AGENTS.md", "CLAUDE.md", "README.md"]) {
+        add(join(config.root, name), name);
+    }
+    const docsPath = join(config.root, config.docsDir);
+    const walk = (dir) => {
+        if (!existsSync(dir))
+            return;
+        for (const e of readdirSync(dir)) {
+            if (e.startsWith("."))
+                continue;
+            const full = join(dir, e);
+            const st = statSync(full);
+            if (st.isDirectory())
+                walk(full);
+            else if (extname(e) === ".md") {
+                const rel = full
+                    .slice(config.root.length + 1)
+                    .split("\\")
+                    .join("/");
+                add(full, rel);
+            }
+        }
+    };
+    walk(docsPath);
+    return out;
+}
+export function listSkills(config) {
+    const out = [];
+    const skillsPath = join(config.root, config.skillsDir);
+    if (!existsSync(skillsPath))
+        return out;
+    for (const e of readdirSync(skillsPath)) {
+        if (e.startsWith("."))
+            continue;
+        const dir = join(skillsPath, e);
+        if (!statSync(dir).isDirectory())
+            continue;
+        const file = join(dir, "SKILL.md");
+        if (!existsSync(file))
+            continue;
+        let text = "";
+        try {
+            text = readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        out.push({
+            path: `${config.skillsDir.split("\\").join("/")}/${e}/SKILL.md`,
+            name: skillField(text, "name") ?? e,
+            description: skillField(text, "description") ?? "",
+        });
+    }
+    return out;
+}
+export function repoGuideContext(config, tasks) {
+    const counts = new Map();
+    for (const task of tasks)
+        counts.set(task.status, (counts.get(task.status) ?? 0) + 1);
+    const statusSummary = STATUSES.map((status) => `${status}: ${counts.get(status) ?? 0}`).join(", ");
+    const taskSummary = tasks
+        .map((task) => `- #${task.id} [${task.status}] ${task.title} (type: ${task.type}, priority: ${task.priority}, area: ${task.area || "unspecified"}, file: ${task.path})`)
+        .join("\n");
+    const docs = listDocs(config)
+        .map((doc) => `- ${doc.title} (${doc.path})`)
+        .join("\n");
+    return `Repository: ${basename(config.root)}\nRoot: ${config.root}\nTask counts: ${statusSummary}\n\nTasks:\n${taskSummary || "- none"}\n\nContext documents:\n${docs || "- none"}`;
+}

package/dist/server/routes/index.d.ts

@@ -0,0 +1,19 @@
+export * from "./agents.js";
+export * from "./config.js";
+export * from "./docs.js";
+export * from "./inputs.js";
+export * from "./models.js";
+export * from "./model-providers.js";
+export * from "./playground.js";
+export * from "./tasks.js";
+export * from "./ui.js";
+export * from "./utils.js";
+export * from "./info.js";
+export * from "./debugger.js";
+export * from "./notify.js";
+export * from "./transcribe.js";
+export * from "./auth.js";
+export * from "./skill-registry.js";
+export { type RouteContext, type RouteHandler, type Route, type SyncResult } from "./types.js";
+export { Router } from "./router.js";
+export * from "./helpers.js";

package/dist/server/routes/index.js

@@ -0,0 +1,18 @@
+export * from "./agents.js";
+export * from "./config.js";
+export * from "./docs.js";
+export * from "./inputs.js";
+export * from "./models.js";
+export * from "./model-providers.js";
+export * from "./playground.js";
+export * from "./tasks.js";
+export * from "./ui.js";
+export * from "./utils.js";
+export * from "./info.js";
+export * from "./debugger.js";
+export * from "./notify.js";
+export * from "./transcribe.js";
+export * from "./auth.js";
+export * from "./skill-registry.js";
+export { Router } from "./router.js";
+export * from "./helpers.js";

package/dist/server/routes/info.d.ts

@@ -0,0 +1,17 @@
+import type { RouteHandler } from "./types.js";
+export declare function initInfoHandlers(hash: string, tunnelFn: (root: string, port?: number) => Promise<any>): void;
+export declare const health: RouteHandler;
+export declare const restart: RouteHandler;
+export declare const getCounts: RouteHandler;
+export declare const getIndex: RouteHandler;
+/** Lightweight board endpoint — returns only the fields TaskCard.vue needs. */
+export declare const getBoard: RouteHandler;
+export declare const getDocs: RouteHandler;
+export declare const getSkills: RouteHandler;
+export declare const getSystem: RouteHandler;
+export declare const getTunnelStatus: RouteHandler;
+export declare const getChat: RouteHandler;
+export declare const sendChatMessage: RouteHandler;
+/** Interrupt a running RepoOS guide (Ross) response. Idempotent. */
+export declare const interruptChatMessage: RouteHandler;
+export declare const getSystemLogs: RouteHandler;

package/dist/server/routes/info.js

@@ -0,0 +1,177 @@
+import { join } from "node:path";
+import { json, readBody } from "./utils.js";
+import { loadBuildInfo, listDocs, listSkills, repoGuideContext } from "./helpers.js";
+import { sampleSystem } from "../system.js";
+import { resolveRepoGuide, REPO_GUIDE_SESSION_ID } from "../agents.js";
+import { withPmWorking } from "../pm-runs.js";
+import { previewTargetOptions } from "../preview.js";
+import { CANARY_COUNTER } from "../../core/canary.js";
+// These will be passed via context in server.ts during integration
+let loadedHash;
+let tunnelReadinessFn;
+export function initInfoHandlers(hash, tunnelFn) {
+    loadedHash = hash;
+    tunnelReadinessFn = tunnelFn;
+}
+export const health = (ctx, req, res) => {
+    const { index } = ctx;
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const snap = index.snapshot();
+    const build = loadBuildInfo();
+    const secret = process.env.REPOOS_RELOAD_SECRET;
+    const handshake = typeof secret === "string" && secret !== "" && url.searchParams.get("reload") === secret;
+    // A build parked by a close-out (0143). Exposing it on /api/health gives a
+    // (re)connecting UI a reliable reconcile path that does not depend on the
+    // one-shot build.available SSE event arriving while it was connected.
+    const parked = ctx.reload?.buildAvailable ?? null;
+    return json(res, 200, {
+        ok: true,
+        root: ctx.config.root,
+        taskCount: snap.taskCount,
+        workDir: ctx.config.workDir,
+        version: build.version,
+        buildAt: build.buildAt,
+        buildHash: loadedHash,
+        buildAvailableHash: parked?.hash ?? null,
+        buildAvailableAt: parked?.buildAt ?? null,
+        // ISO start time of this serve process, derived from process.uptime(). Lets
+        // `repoos status` render uptime from /api/health when the serve lockfile is
+        // thin (missing startedAt) — the lockfile stays the primary source.
+        serverStartedAt: new Date(Date.now() - process.uptime() * 1000).toISOString(),
+        isPreviewBuild: process.env.REPOOS_PREVIEW_CHILD === "1",
+        canaryCounter: CANARY_COUNTER,
+        ...(handshake ? { reloadHandshake: true } : {}),
+    });
+};
+export const restart = (ctx, _req, res) => {
+    const reload = ctx.reload;
+    const state = reload?.requestReload("manual restart", { manual: true }) ??
+        {
+            state: "not-stale",
+            reason: "auto-reload unavailable",
+        };
+    return json(res, 200, state);
+};
+export const getCounts = (ctx, _req, res) => {
+    const { index } = ctx;
+    return json(res, 200, index.counts());
+};
+export const getIndex = async (ctx, _req, res) => {
+    const { index, reviews, indexReady } = ctx;
+    await indexReady;
+    const snapshot = index.snapshot();
+    const withReviewStatus = (t) => ({
+        ...withPmWorking(t),
+        automaticReview: {
+            running: reviews.isRunning(t.id),
+            enabled: reviews.enabled(),
+        },
+    });
+    return json(res, 200, {
+        ...snapshot,
+        tasks: snapshot.tasks.map(withReviewStatus),
+    });
+};
+/** Lightweight board endpoint — returns only the fields TaskCard.vue needs. */
+export const getBoard = async (ctx, _req, res) => {
+    const { config, index, reviews, indexReady } = ctx;
+    // A reload handoff spawns the replacement with the listener already accepting
+    // connections while the full index build runs in the background (0285). Await
+    // boot readiness so a sharp reconnect can never be answered from a stale or
+    // partially-built index — the snap must reflect disk before it is served.
+    await indexReady;
+    const snapshot = index.boardSnapshot();
+    const withReviewStatus = (t) => ({
+        ...withPmWorking(t),
+        automaticReview: {
+            running: reviews.isRunning(t.id),
+            enabled: reviews.enabled(),
+        },
+        // #0379: preview target identity/multiplicity, same as GET /api/tasks/:id.
+        previewTargets: previewTargetOptions(config, t),
+    });
+    return json(res, 200, {
+        ...snapshot,
+        tasks: snapshot.tasks.map(withReviewStatus),
+    });
+};
+export const getDocs = (ctx, _req, res) => {
+    const { config } = ctx;
+    return json(res, 200, listDocs(config));
+};
+export const getSkills = (ctx, _req, res) => {
+    const { config } = ctx;
+    return json(res, 200, listSkills(config));
+};
+export const getSystem = (ctx, _req, res) => {
+    const { config, runner } = ctx;
+    const stats = sampleSystem({
+        serverPid: process.pid,
+        cacheDir: join(config.root, config.cacheDir),
+        runningAgents: runner.running(),
+        root: config.root,
+    });
+    return json(res, 200, stats);
+};
+export const getTunnelStatus = async (ctx, req, res) => {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const rawPort = url.searchParams.get("port");
+    const port = rawPort ? Number(rawPort) : undefined;
+    if (rawPort) {
+        if (port === undefined || !Number.isInteger(port) || port < 1 || port > 65535) {
+            return json(res, 400, { error: "port must be an integer from 1 to 65535" });
+        }
+    }
+    return json(res, 200, await tunnelReadinessFn(ctx.config.root, port));
+};
+export const getChat = (ctx, _req, res) => {
+    const { config, runner } = ctx;
+    const agent = resolveRepoGuide(config);
+    const session = runner.output(REPO_GUIDE_SESSION_ID);
+    return json(res, 200, {
+        ok: true,
+        agent,
+        enabled: Boolean(agent?.enabled),
+        lines: session?.lines ?? [],
+        running: runner.isRunning(REPO_GUIDE_SESSION_ID),
+        stats: runner.stats(REPO_GUIDE_SESSION_ID),
+    });
+};
+export const sendChatMessage = async (ctx, req, res) => {
+    const { config, index, runner } = ctx;
+    const agent = resolveRepoGuide(config);
+    if (!agent) {
+        return json(res, 400, {
+            error: "Ross is disabled — enable it on the Agents page to chat",
+        });
+    }
+    const body = (await readBody(req));
+    const text = typeof body?.text === "string" ? body.text.trim() : "";
+    if (!text)
+        return json(res, 400, { error: "message text is required" });
+    const context = repoGuideContext(config, index.getTasks());
+    const existing = runner.output(REPO_GUIDE_SESSION_ID);
+    const result = existing
+        ? runner.send(REPO_GUIDE_SESSION_ID, text, agent, {
+            resumePreamble: `Updated repository context:\n${context}`,
+        })
+        : runner.startChat(REPO_GUIDE_SESSION_ID, text, agent, context);
+    if (!result.ok && result.busy) {
+        return json(res, 409, { error: result.reason ?? "Ross is busy" });
+    }
+    if (!result.ok) {
+        return json(res, 400, { error: result.reason ?? "could not send message" });
+    }
+    return json(res, 200, { ok: true });
+};
+/** Interrupt a running RepoOS guide (Ross) response. Idempotent. */
+export const interruptChatMessage = (ctx, _req, res) => {
+    const result = ctx.runner.interrupt(REPO_GUIDE_SESSION_ID);
+    return json(res, 200, { ok: true, ...result });
+};
+export const getSystemLogs = (ctx, _req, res) => {
+    const { logger } = ctx;
+    const limit = 1000;
+    const logs = logger.getSystemLogs(limit);
+    return json(res, 200, { ok: true, logs });
+};

package/dist/server/routes/inputs.d.ts

@@ -0,0 +1,7 @@
+import type { RouteHandler } from "./types.js";
+export declare const getInputs: RouteHandler;
+export declare const postInput: RouteHandler;
+export declare const patchInput: RouteHandler;
+export declare const postResolveInput: RouteHandler;
+export declare const uploadInputAttachment: RouteHandler;
+export declare const getInputAttachment: RouteHandler;

package/dist/server/routes/inputs.js

@@ -0,0 +1,125 @@
+import { join } from "node:path";
+import { json, readBody } from "./utils.js";
+import { createInput, enrichInput, listInputs, readInputAttachment, resolveInput, saveInputAttachment, updateInput, } from "../../core/input.js";
+import { commitTaskFile } from "../../core/git.js";
+import { resolvePmAgent, runPrompt, recordOneShotSession } from "../agents.js";
+import { getCurrentUser } from "./auth.js";
+/**
+ * Commit an input's markdown file to `main`, the same fail-soft way task
+ * files are committed (`commitTaskFile` just commits one path). Only the
+ * `.md` — attachments under `inputs/.attachments/` are gitignored and served
+ * from disk, never committed.
+ */
+function commitInput(root, input, verb) {
+    commitTaskFile(root, join(root, input.path), `inputs(${input.id}): ${verb}`);
+}
+function inputPrompt(body) {
+    return [
+        "You are the RepoOS PM agent. Classify this raw human input for triage.",
+        "Return ONLY a JSON object with exactly these string fields:",
+        '{"title":"short useful title","type":"idea|question|bug|improvement|feedback|other","area":"short product area or empty string"}',
+        "Keep the title under 80 characters. Do not invent details.",
+        "",
+        body,
+    ].join("\n");
+}
+function parseEnrichment(raw) {
+    const match = raw.match(/\{[\s\S]*\}/);
+    if (!match)
+        return {};
+    try {
+        const value = JSON.parse(match[0]);
+        return {
+            title: typeof value.title === "string" ? value.title : undefined,
+            type: typeof value.type === "string" ? value.type : undefined,
+            area: typeof value.area === "string" ? value.area : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export const getInputs = (ctx, _req, res) => json(res, 200, listInputs(ctx.config));
+export const postInput = async (ctx, req, res) => {
+    const b = (await readBody(req)), text = typeof b.text === "string" ? b.text.trim() : "";
+    if (!text)
+        return json(res, 400, { error: "text is required" });
+    const input = createInput(ctx.config, text, typeof b.type === "string" ? b.type : "other", getCurrentUser(req, ctx.config)?.email ?? (typeof b.createdBy === "string" ? b.createdBy : ""));
+    const pm = resolvePmAgent(ctx.config);
+    if (pm) {
+        try {
+            const result = await runPrompt(pm, inputPrompt(text), { cwd: ctx.config.root });
+            recordOneShotSession(ctx.config.root, pm, result, { sessionType: "pm", taskId: null });
+            if (result.ok && result.output) {
+                const enriched = enrichInput(ctx.config, input.id, parseEnrichment(result.output));
+                commitInput(ctx.config.root, enriched, "capture");
+                return json(res, 201, enriched);
+            }
+        }
+        catch {
+            /* raw input remains safe if enrichment fails */
+        }
+    }
+    commitInput(ctx.config.root, input, "capture");
+    return json(res, 201, input);
+};
+export const patchInput = async (ctx, req, res, p) => {
+    const b = (await readBody(req));
+    if (!["new", "reviewing", "processed"].includes(String(b.status)))
+        return json(res, 400, { error: "invalid status" });
+    try {
+        const updated = updateInput(ctx.config, p.param1, b.status);
+        commitInput(ctx.config.root, updated, updated.status);
+        return json(res, 200, updated);
+    }
+    catch (e) {
+        return json(res, 404, { error: e.message });
+    }
+};
+export const postResolveInput = async (ctx, req, res, p) => {
+    const b = (await readBody(req));
+    const resolution = b.resolution;
+    if (resolution !== "task" && resolution !== "none")
+        return json(res, 400, { error: "resolution must be 'task' or 'none'" });
+    const taskId = typeof b.taskId === "string" ? b.taskId.trim() : "";
+    if (resolution === "task" && !taskId)
+        return json(res, 400, { error: "taskId is required when resolving to a task" });
+    try {
+        const updated = resolveInput(ctx.config, p.param1, resolution, resolution === "task" ? taskId : "");
+        commitInput(ctx.config.root, updated, resolution === "task" ? `resolved to task #${taskId}` : "resolved: no action");
+        return json(res, 200, updated);
+    }
+    catch (e) {
+        return json(res, 404, { error: e.message });
+    }
+};
+export const uploadInputAttachment = async (ctx, req, res, p) => {
+    const b = (await readBody(req));
+    if (typeof b.name !== "string" || typeof b.data !== "string")
+        return json(res, 400, { error: "name and data are required" });
+    try {
+        return json(res, 201, {
+            ok: true,
+            attachment: saveInputAttachment(ctx.config, p.param1, b.name, b.data),
+        });
+    }
+    catch (e) {
+        return json(res, 404, { error: e.message });
+    }
+};
+export const getInputAttachment = (ctx, _req, res, p) => {
+    try {
+        const file = readInputAttachment(ctx.config, p.param1, decodeURIComponent(p.param2));
+        res.writeHead(200, {
+            "Content-Type": file.mime,
+            "Content-Length": file.data.length,
+            "Content-Disposition": `inline; filename="${decodeURIComponent(p.param2)}"`,
+            "Access-Control-Allow-Origin": "*",
+        });
+        res.end(file.data);
+    }
+    catch {
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+    }
+};

package/dist/server/routes/model-providers.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Model providers tab routes (0327): the Agents-page "Model providers" tab's
+ * backend. Three endpoints —
+ *
+ *   GET  /api/model-providers            static registry + per-row hasKey
+ *   GET  /api/model-providers/:id/usage  live spend/usage for a "live" row
+ *   POST /api/model-providers/:id/key    save (or clear) a provider API key
+ *
+ * Keys are stored ONLY in the gitignored `.env` via `setDotEnvSecret`, under
+ * the fixed env-var names in the registry — the same env-var-secret pattern
+ * as the auth/whisper secrets. They are never written to repoos.toml, never
+ * logged, and never echoed back in any response (rows only ever see a
+ * boolean `hasKey`).
+ */
+import type { RouteHandler } from "./types.js";
+import type { RepoOSConfig } from "../../core/types.js";
+import type { ModelProviderRow } from "../../core/providers/spend.js";
+/**
+ * The stored key for a live row, read through process.env FIRST so a save
+ * (which updates process.env in place, see `setDotEnvSecret`) is visible
+ * immediately, then the boot-time config snapshot. Empty string when unset.
+ * Exported for tests.
+ */
+export declare function readProviderKey(config: RepoOSConfig, row: ModelProviderRow): string;
+export declare const getModelProviders: RouteHandler;
+export declare const getModelProviderUsage: RouteHandler;
+export declare const setModelProviderKey: RouteHandler;

package/dist/server/routes/model-providers.js

@@ -0,0 +1,94 @@
+import { json, readBody } from "./utils.js";
+import { setDotEnvSecret } from "../../core/config.js";
+import { MODEL_PROVIDERS, modelProviderById, fetchOpenRouterSpend, fetchOpenCodeGoUsage, } from "../../core/providers/spend.js";
+/** Cap on pasted key length — real provider keys are far shorter. */
+const MAX_KEY_LEN = 500;
+/**
+ * The stored key for a live row, read through process.env FIRST so a save
+ * (which updates process.env in place, see `setDotEnvSecret`) is visible
+ * immediately, then the boot-time config snapshot. Empty string when unset.
+ * Exported for tests.
+ */
+export function readProviderKey(config, row) {
+    const fromEnv = row.envVar ? process.env[row.envVar] : undefined;
+    if (fromEnv)
+        return fromEnv;
+    if (row.configKey)
+        return config.modelProviders?.[row.configKey] ?? "";
+    return "";
+}
+export const getModelProviders = async (ctx, _req, res) => {
+    const providers = MODEL_PROVIDERS.map((p) => ({
+        id: p.id,
+        label: p.label,
+        kind: p.kind,
+        dashboardUrl: p.dashboardUrl,
+        note: p.note,
+        hasKey: readProviderKey(ctx.config, p).length > 0,
+    }));
+    return json(res, 200, { providers, at: new Date().toISOString() });
+};
+export const getModelProviderUsage = async (ctx, _req, res, params) => {
+    const row = modelProviderById(params.param1 ?? "");
+    if (!row)
+        return json(res, 404, { error: "Unknown model provider." });
+    if (row.kind !== "live") {
+        return json(res, 400, {
+            error: `${row.label} has no live usage API — it renders as a dashboard link-out.`,
+        });
+    }
+    const apiKey = readProviderKey(ctx.config, row);
+    if (!apiKey) {
+        return json(res, 400, {
+            error: `No ${row.label} API key saved yet — paste one on its row first.`,
+        });
+    }
+    try {
+        if (row.id === "openrouter") {
+            const spend = await fetchOpenRouterSpend(apiKey);
+            if (!spend.credits && !spend.key) {
+                return json(res, 502, {
+                    error: spend.creditsError ?? spend.keyError ?? "OpenRouter request failed.",
+                });
+            }
+            return json(res, 200, { kind: row.id, ...spend, at: new Date().toISOString() });
+        }
+        if (row.id === "opencode-go") {
+            const usage = await fetchOpenCodeGoUsage(apiKey);
+            return json(res, 200, { kind: row.id, ...usage, at: new Date().toISOString() });
+        }
+        return json(res, 400, { error: "Unknown model provider." });
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return json(res, 502, { error: reason });
+    }
+};
+export const setModelProviderKey = async (ctx, req, res, params) => {
+    const row = modelProviderById(params.param1 ?? "");
+    if (!row)
+        return json(res, 404, { error: "Unknown model provider." });
+    if (row.kind !== "live" || !row.envVar) {
+        return json(res, 400, {
+            error: `${row.label} needs no API key — it renders as a dashboard link-out.`,
+        });
+    }
+    const body = (await readBody(req));
+    if (typeof body.key !== "string") {
+        return json(res, 400, { error: "key must be a string." });
+    }
+    const key = body.key.trim();
+    if (key.length > MAX_KEY_LEN) {
+        return json(res, 400, { error: "That API key is too long to be valid." });
+    }
+    try {
+        setDotEnvSecret(ctx.config.root, row.envVar, key);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return json(res, 400, { error: `Could not save the key: ${reason}` });
+    }
+    // Deliberately no logging anywhere in this handler, and no echo of the
+    // value — the response carries only the resulting hasKey boolean.
+    return json(res, 200, { ok: true, hasKey: key.length > 0 });
+};

package/dist/server/routes/models.d.ts

@@ -0,0 +1,3 @@
+import type { RouteHandler } from "./types.js";
+export declare const listModels: RouteHandler;
+export declare const testModel: RouteHandler;