@rexvane/piweb 0.3.1

package/src/app/api/models/route.ts

@@ -0,0 +1,129 @@
+import { gzipSync } from "node:zlib";
+import { NextResponse } from "next/server";
+import {
+	answerLogin,
+	cancelLogin,
+	CustomProvidersConflictError,
+	CustomProvidersValidationError,
+	discoverModels,
+	listModels,
+	loginState,
+	providerUsage,
+	readCustomProviders,
+	removeApiKey,
+	setApiKey,
+	startLogin,
+	writeCustomProviders,
+} from "@/lib/models-service";
+
+export const dynamic = "force-dynamic";
+
+/** 1300+ 个模型的目录有 240KB～420KB；Next 的压缩层实测没有压这条响应，这里自己 gzip（浏览器透明解压） */
+function jsonMaybeGzip(req: Request, payload: unknown): Response {
+	const body = JSON.stringify(payload);
+	const accept = req.headers.get("accept-encoding") ?? "";
+	if (!/\bgzip\b/.test(accept) || body.length < 2048) {
+		return new Response(body, { headers: { "Content-Type": "application/json; charset=utf-8" } });
+	}
+	const gz = gzipSync(Buffer.from(body, "utf8"));
+	return new Response(new Uint8Array(gz), {
+		headers: { "Content-Type": "application/json; charset=utf-8", "Content-Encoding": "gzip", Vary: "Accept-Encoding", "Cache-Control": "no-store" },
+	});
+}
+
+export async function GET(req: Request) {
+	const params = new URL(req.url).searchParams;
+	const custom = params.get("custom") === "1";
+	const full = custom || params.get("full") === "1";
+	try {
+		const customProviders = custom ? await readCustomProviders() : null;
+		const data = await listModels();
+		// 页面挂载只需要选模型用的字段（1300+ 个模型带 api/baseUrl/cost/input 有 400KB）；设置页用 custom=1 拿完整版
+		const models = full
+			? data.models
+			: data.models.map((m) => ({ provider: m.provider, id: m.id, name: m.name, reasoning: m.reasoning, thinkingLevels: m.thinkingLevels, contextWindow: m.contextWindow }));
+		const providers = full
+			? data.providers
+			: data.providers.map((p) => ({ id: p.id, name: p.name, authReady: p.authReady, builtIn: p.builtIn, modelCount: p.modelCount }));
+		return jsonMaybeGzip(req, { success: true, data: { providers, models, customProviders } });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: 500 });
+	}
+}
+
+export async function POST(req: Request) {
+	try {
+		const body = (await req.json()) as {
+			action:
+				| "setKey"
+				| "removeKey"
+				| "saveCustomProviders"
+				| "discoverModels"
+				| "providerUsage"
+				| "loginStart"
+				| "loginState"
+				| "loginAnswer"
+				| "loginCancel";
+			providerId?: string;
+			apiKey?: string;
+			baseUrl?: string;
+			api?: string;
+			content?: string;
+			revision?: string;
+			text?: string;
+			force?: boolean;
+		};
+		if (body.action === "setKey") {
+			if (!body.providerId || !body.apiKey) return NextResponse.json({ success: false, error: "missing fields" }, { status: 400 });
+			await setApiKey(body.providerId, body.apiKey);
+			return NextResponse.json({ success: true });
+		}
+		if (body.action === "removeKey") {
+			if (!body.providerId) return NextResponse.json({ success: false, error: "missing providerId" }, { status: 400 });
+			await removeApiKey(body.providerId);
+			return NextResponse.json({ success: true });
+		}
+		if (body.action === "saveCustomProviders") {
+			if (typeof body.content !== "string") return NextResponse.json({ success: false, error: "missing content" }, { status: 400 });
+			if (body.revision !== undefined && (typeof body.revision !== "string" || !/^(?:missing|[a-f0-9]{64})$/.test(body.revision))) {
+				return NextResponse.json({ success: false, error: "invalid revision" }, { status: 400 });
+			}
+			await writeCustomProviders(body.content, body.revision);
+			return NextResponse.json({ success: true, data: { requiresSessionReopen: true } });
+		}
+		if (body.action === "discoverModels") {
+			if (!body.baseUrl) return NextResponse.json({ success: false, error: "missing baseUrl" }, { status: 400 });
+			const models = await discoverModels({ baseUrl: body.baseUrl, api: body.api, apiKey: body.apiKey, providerId: body.providerId });
+			return NextResponse.json({ success: true, data: { models } });
+		}
+		if (body.action === "providerUsage") {
+			if (!body.providerId) return NextResponse.json({ success: false, error: "missing providerId" }, { status: 400 });
+			const usage = await providerUsage(body.providerId, body.force === true);
+			return NextResponse.json({ success: true, data: { usage } });
+		}
+		if (body.action === "loginStart") {
+			if (!body.providerId) return NextResponse.json({ success: false, error: "missing providerId" }, { status: 400 });
+			await startLogin(body.providerId);
+			return NextResponse.json({ success: true, data: loginState(body.providerId) });
+		}
+		if (body.action === "loginState") {
+			if (!body.providerId) return NextResponse.json({ success: false, error: "missing providerId" }, { status: 400 });
+			return NextResponse.json({ success: true, data: loginState(body.providerId) });
+		}
+		if (body.action === "loginAnswer") {
+			if (!body.providerId || typeof body.text !== "string")
+				return NextResponse.json({ success: false, error: "missing fields" }, { status: 400 });
+			return NextResponse.json({ success: true, data: { delivered: answerLogin(body.providerId, body.text) } });
+		}
+		if (body.action === "loginCancel") {
+			if (!body.providerId) return NextResponse.json({ success: false, error: "missing providerId" }, { status: 400 });
+			cancelLogin(body.providerId);
+			return NextResponse.json({ success: true });
+		}
+		return NextResponse.json({ success: false, error: "unknown action" }, { status: 400 });
+	} catch (err: any) {
+		const status = err instanceof CustomProvidersConflictError ? 409
+			: err instanceof CustomProvidersValidationError || err instanceof SyntaxError ? 400 : 500;
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status });
+	}
+}

package/src/app/api/pi-settings/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+import { getPiSettings, patchPiSettings, PiSettingsValidationError } from "@/lib/pi-settings";
+
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+	try {
+		return NextResponse.json({ success: true, data: await getPiSettings() });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: 500 });
+	}
+}
+
+export async function PUT(req: Request) {
+	try {
+		const body = await req.json();
+		await patchPiSettings(body);
+		return NextResponse.json({ success: true, data: await getPiSettings() });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: err instanceof PiSettingsValidationError || err instanceof SyntaxError ? 400 : 500 });
+	}
+}

package/src/app/api/plugins/route.ts

@@ -0,0 +1,79 @@
+import { NextResponse } from "next/server";
+import {
+	installPackage,
+	listLoadedExtensions,
+	listPackages,
+	reloadExtensions,
+	removePackage,
+	toggleExtension,
+	togglePackage,
+	updatePackages,
+} from "@/lib/plugins-service";
+import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: Request) {
+	try {
+		const cwd = await resolveWorkspacePath(new URL(req.url).searchParams.get("cwd") || process.cwd());
+		const [packages, extensions] = await Promise.all([listPackages(cwd), listLoadedExtensions(cwd)]);
+		return NextResponse.json({ success: true, data: { packages, extensions } });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: err instanceof BoundaryError ? 400 : 500 });
+	}
+}
+
+export async function POST(req: Request) {
+	try {
+		const body = (await req.json()) as {
+			action: "install" | "remove" | "update" | "reload" | "toggle";
+			source?: string;
+			path?: string;
+			kind?: "package" | "extension";
+			disabled?: boolean;
+			scope?: "user" | "project";
+			local?: boolean;
+			cwd?: string;
+		};
+		const cwd = await resolveWorkspacePath(body.cwd || process.cwd());
+		if (body.source && body.source.length > 4096) {
+			return NextResponse.json({ success: false, error: "package source is too long" }, { status: 400 });
+		}
+		if (body.action === "reload") {
+			const reloaded = await reloadExtensions(cwd);
+			return NextResponse.json({ success: true, data: reloaded });
+		}
+		if (body.action === "toggle") {
+			if (body.kind === "package" && body.source) {
+				await togglePackage(body.source, body.disabled === true, body.scope === "project" ? "project" : "user", cwd);
+				return NextResponse.json({ success: true });
+			}
+			if (body.kind === "extension" && body.path) {
+				await toggleExtension(body.path, body.disabled === true, cwd);
+				return NextResponse.json({ success: true });
+			}
+			return NextResponse.json({ success: false, error: "invalid toggle payload" }, { status: 400 });
+		}
+		if (body.action === "install") {
+			if (!body.source) return NextResponse.json({ success: false, error: "missing source" }, { status: 400 });
+			await installPackage(body.source, body.local === true, cwd);
+			return NextResponse.json({ success: true });
+		}
+		if (body.action === "remove") {
+			if (!body.source) return NextResponse.json({ success: false, error: "missing source" }, { status: 400 });
+			const removed = await removePackage(body.source, body.local === true, cwd);
+			if (!removed) return NextResponse.json({ success: false, error: `package not found: ${body.source}` }, { status: 404 });
+			return NextResponse.json({ success: true, data: { removed } });
+		}
+		if (body.action === "update") {
+			await updatePackages(body.source, cwd);
+			return NextResponse.json({ success: true });
+		}
+		return NextResponse.json({ success: false, error: "unknown action" }, { status: 400 });
+	} catch (error) {
+		return NextResponse.json(
+			{ success: false, error: error instanceof Error ? error.message : "request failed" },
+			{ status: error instanceof BoundaryError || error instanceof SyntaxError ? 400 : 500 },
+		);
+	}
+}

package/src/app/api/security/route.ts

@@ -0,0 +1,41 @@
+import { NextResponse } from "next/server";
+import type { ProjectTrust } from "@/lib/security-service";
+import { getSecurity, setProjectTrust } from "@/lib/security-service";
+import { reloadLoader, setProjectTrust as setProjectTrustDecision } from "@/lib/pi";
+import { reloadSessionsForCwd } from "@/lib/agent-manager";
+import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
+
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+	try {
+		return NextResponse.json({ success: true, data: await getSecurity() });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: 500 });
+	}
+}
+
+export async function PUT(req: Request) {
+	try {
+		const body = (await req.json()) as { defaultProjectTrust?: ProjectTrust; projectTrust?: { cwd?: unknown; decision?: unknown } };
+		// 按目录记住信任决定（写 ~/.pi/agent/trust.json，与 pi 终端共用）
+		if (body.projectTrust) {
+			const cwd = await resolveWorkspacePath(body.projectTrust.cwd);
+			const decision = body.projectTrust.decision;
+			if (decision !== true && decision !== false && decision !== null)
+				return NextResponse.json({ success: false, error: "decision must be true / false / null" }, { status: 400 });
+			const state = setProjectTrustDecision(cwd, decision);
+			// 让该目录的加载器按新信任态重新发现资源，活跃会话重建扩展运行时，页面拿到新清单
+			await reloadLoader(cwd);
+			await reloadSessionsForCwd(cwd);
+			return NextResponse.json({ success: true, data: state });
+		}
+		const v = body.defaultProjectTrust;
+		if (v !== "ask" && v !== "always" && v !== "never")
+			return NextResponse.json({ success: false, error: "bad value" }, { status: 400 });
+		await setProjectTrust(v);
+		return NextResponse.json({ success: true });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: err instanceof BoundaryError ? 400 : 500 });
+	}
+}

package/src/app/api/sessions/[id]/export/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { exportSession, getManaged } from "@/lib/agent-manager";
+import { BoundaryError, resolveSessionPath } from "@/lib/path-security";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+	const { id } = await params;
+	const format = new URL(req.url).searchParams.get("format") === "html" ? "html" : "jsonl";
+	try {
+		const m = getManaged(await resolveSessionPath(id));
+		const { filename, content, contentType } = await exportSession(m, format);
+		return new Response(content, {
+			headers: {
+				"Content-Type": `${contentType}; charset=utf-8`,
+				"Content-Disposition": `attachment; filename="${encodeURIComponent(filename)}"`,
+			},
+		});
+	} catch (error) {
+		return NextResponse.json(
+			{ success: false, error: error instanceof Error ? error.message : "request failed" },
+			{ status: error instanceof BoundaryError ? 400 : 500 },
+		);
+	}
+}

package/src/app/api/sessions/[id]/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from "next/server";
+import { deleteSession, readSession } from "@/lib/session-reader";
+import { disposeSessionPath } from "@/lib/agent-manager";
+import { BoundaryError, resolveSessionPath } from "@/lib/path-security";
+import { forgetSession } from "@/lib/workspace-store";
+
+export const dynamic = "force-dynamic";
+
+/** 冷读取（不启动 agent） */
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+	const { id } = await params;
+	try {
+		const data = await readSession(await resolveSessionPath(id));
+		return NextResponse.json({ success: true, data });
+	} catch (error) {
+		return NextResponse.json(
+			{ success: false, error: error instanceof Error ? error.message : "request failed" },
+			{ status: error instanceof BoundaryError ? 400 : 500 },
+		);
+	}
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+	const { id } = await params;
+	try {
+		const sessionPath = await resolveSessionPath(id, { allowPending: true });
+		await disposeSessionPath(sessionPath);
+		await deleteSession(sessionPath);
+		await forgetSession(sessionPath);
+		return NextResponse.json({ success: true });
+	} catch (error) {
+		return NextResponse.json(
+			{ success: false, error: error instanceof Error ? error.message : "request failed" },
+			{ status: error instanceof BoundaryError ? 400 : 500 },
+		);
+	}
+}

package/src/app/api/sessions/route.ts

@@ -0,0 +1,23 @@
+import { createHash } from "node:crypto";
+import { NextResponse } from "next/server";
+import { listSessions } from "@/lib/session-reader";
+import { activeStatus } from "@/lib/agent-manager";
+import { getWorkspaceRegistry, registerCwds } from "@/lib/workspace-store";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: Request) {
+	try {
+		const q = new URL(req.url).searchParams.get("q") ?? undefined;
+		const sessions = await listSessions(q);
+		await registerCwds(sessions.map((session) => session.cwd));
+		const workspaceRegistry = await getWorkspaceRegistry();
+		// 侧栏每 3 秒轮询：内容没变就 304，浏览器复用缓存体（no-cache = 每次都回源校验，不会用陈旧数据）
+		const body = JSON.stringify({ success: true, data: { sessions, running: activeStatus(), workspaceRegistry } });
+		const etag = `"${createHash("sha1").update(body).digest("base64url")}"`;
+		if (req.headers.get("if-none-match") === etag) return new Response(null, { status: 304, headers: { ETag: etag, "Cache-Control": "no-cache" } });
+		return new Response(body, { headers: { "Content-Type": "application/json; charset=utf-8", ETag: etag, "Cache-Control": "no-cache" } });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: 500 });
+	}
+}

package/src/app/api/skills/route.ts

@@ -0,0 +1,39 @@
+import { NextResponse } from "next/server";
+import { listSkills, readSkillFile, setSkillDisabled } from "@/lib/skills-service";
+import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: Request) {
+	try {
+		const rawCwd = new URL(req.url).searchParams.get("cwd");
+		const cwd = await resolveWorkspacePath(rawCwd || process.cwd());
+		const skills = await listSkills(cwd);
+		return NextResponse.json({ success: true, data: { skills } });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: err instanceof BoundaryError ? 400 : 500 });
+	}
+}
+
+export async function POST(req: Request) {
+	try {
+		const body = (await req.json()) as { action: "toggle" | "read"; filePath?: string; disabled?: boolean; cwd?: string };
+		const cwd = await resolveWorkspacePath(body.cwd || process.cwd());
+		if (body.action === "toggle") {
+			if (!body.filePath || typeof body.disabled !== "boolean")
+				return NextResponse.json({ success: false, error: "missing fields" }, { status: 400 });
+			const r = await setSkillDisabled(body.filePath, body.disabled, cwd);
+			return NextResponse.json({ success: true, data: r });
+		}
+		if (body.action === "read") {
+			if (!body.filePath) return NextResponse.json({ success: false, error: "missing filePath" }, { status: 400 });
+			return NextResponse.json({ success: true, data: { content: await readSkillFile(body.filePath, cwd) } });
+		}
+		return NextResponse.json({ success: false, error: "unknown action" }, { status: 400 });
+	} catch (error) {
+		return NextResponse.json(
+			{ success: false, error: error instanceof Error ? error.message : "request failed" },
+			{ status: error instanceof BoundaryError ? 400 : 500 },
+		);
+	}
+}

package/src/app/api/update/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { checkForUpdate, runUpdate, UpdateBusyError, type UpdateTarget } from "@/lib/update-service";
+import { activeStatus } from "@/lib/agent-manager";
+
+export const dynamic = "force-dynamic";
+
+/** Fixed targets/actions only. Runtime authorization and origin checks live in proxy. */
+export async function POST(req: Request) {
+	let body: unknown;
+	try { body = await req.json(); }
+	catch { return NextResponse.json({ success: false, error: "invalid JSON body" }, { status: 400 }); }
+	if (!body || typeof body !== "object" || Array.isArray(body)) {
+		return NextResponse.json({ success: false, error: "expected an object body" }, { status: 400 });
+	}
+	const { target, action } = body as { target?: UpdateTarget; action?: string };
+	if (target !== "piweb" && target !== "pi") return NextResponse.json({ success: false, error: "unknown target" }, { status: 400 });
+	if (action !== "check" && action !== "update") return NextResponse.json({ success: false, error: "unknown action" }, { status: 400 });
+	try {
+		if (action === "check") return NextResponse.json({ success: true, data: await checkForUpdate(target) });
+		const assertIdle = async () => {
+			if (Object.values(activeStatus()).some((session) => session.streaming)) {
+				throw new UpdateBusyError("An agent session is running. Wait for it to finish and update in a maintenance window; do not start new sessions until the release is ready.");
+			}
+		};
+		// Check before even taking a release lock; rechecked before each mutating step.
+		await assertIdle();
+		return NextResponse.json({ success: true, data: await runUpdate(target, { assertIdle }) });
+	} catch (error) {
+		return NextResponse.json({ success: false, error: error instanceof Error ? error.message : String(error) }, {
+			status: error instanceof UpdateBusyError ? 409 : 500,
+		});
+	}
+}

package/src/app/api/version/route.ts

@@ -0,0 +1,8 @@
+import { NextResponse } from "next/server";
+import { getRuntimeVersions } from "@/lib/version";
+
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+	return NextResponse.json({ success: true, data: { ...await getRuntimeVersions(), node: process.version } }, { headers: { "Cache-Control": "no-store" } });
+}

package/src/app/api/web-auth/route.ts

@@ -0,0 +1,80 @@
+/**
+ * 网页认证：GET 状态 / POST 登录（写会话 Cookie）/ DELETE 登出（清 Cookie）。
+ * 无密码配置时整体关闭（GET 返回 enabled:false，POST 404）。
+ */
+import { NextResponse } from "next/server";
+import { isSafeHost, isSafeOrigin, validBasicAuthorization } from "@/lib/auth";
+import { SESSION_COOKIE, clearedCookieOptions, createSessionToken, readCookieHeader, safeNextPath, sessionCookieOptions, validPassword, validSessionToken } from "@/lib/web-auth";
+
+export const dynamic = "force-dynamic";
+
+function untrusted(request: Request): NextResponse | null {
+	const password = process.env.PI_WEB_PASSWORD;
+	if (!isSafeHost(request, Boolean(password))) {
+		return NextResponse.json({ success: false, error: "untrusted host" }, { status: 403 });
+	}
+	if (request.method !== "GET" && request.method !== "HEAD" && !isSafeOrigin(request)) {
+		return NextResponse.json({ success: false, error: "cross-origin request rejected" }, { status: 403 });
+	}
+	return null;
+}
+
+export async function GET(request: Request) {
+	const blocked = untrusted(request);
+	if (blocked) return blocked;
+	const password = process.env.PI_WEB_PASSWORD;
+	const enabled = Boolean(password);
+	const authenticated = !enabled
+		|| validBasicAuthorization(request.headers.get("authorization"), password!)
+		|| validSessionToken(readCookieHeader(request.headers.get("cookie"), SESSION_COOKIE), password!);
+	return NextResponse.json({ success: true, data: { enabled, authenticated } }, { headers: { "Cache-Control": "no-store" } });
+}
+
+export async function POST(request: Request) {
+	const blocked = untrusted(request);
+	if (blocked) return blocked;
+	const password = process.env.PI_WEB_PASSWORD;
+	if (!password) return NextResponse.json({ success: false, error: "password authentication is disabled" }, { status: 404 });
+	if (!(request.headers.get("content-type") ?? "").includes("application/json")) {
+		return NextResponse.json({ success: false, error: "Content-Type must be application/json" }, { status: 415 });
+	}
+	let body: { password?: unknown; next?: unknown };
+	try {
+		const reader = request.body?.getReader();
+		if (!reader) return NextResponse.json({ success: false, error: "missing login payload" }, { status: 400 });
+		const chunks: Uint8Array[] = [];
+		let size = 0;
+		try {
+			for (;;) {
+				const { value, done } = await reader.read();
+				if (done) break;
+				size += value.byteLength;
+				if (size > 16 * 1024) return NextResponse.json({ success: false, error: "login payload too large" }, { status: 413 });
+				chunks.push(value);
+			}
+		} finally {
+			await reader.cancel().catch(() => undefined);
+			reader.releaseLock();
+		}
+		body = JSON.parse(Buffer.concat(chunks).toString("utf8")) as { password?: unknown; next?: unknown };
+	} catch {
+		return NextResponse.json({ success: false, error: "invalid JSON body" }, { status: 400 });
+	}
+	if (!body || typeof body !== "object" || Array.isArray(body)) {
+		return NextResponse.json({ success: false, error: "invalid login payload" }, { status: 400 });
+	}
+	if (typeof body.password !== "string" || !validPassword(body.password, password)) {
+		return NextResponse.json({ success: false, error: "invalid password" }, { status: 401 });
+	}
+	const response = NextResponse.json({ success: true, data: { next: safeNextPath(typeof body.next === "string" ? body.next : null) } }, { headers: { "Cache-Control": "no-store" } });
+	response.cookies.set(SESSION_COOKIE, createSessionToken(password), sessionCookieOptions(request));
+	return response;
+}
+
+export async function DELETE(request: Request) {
+	const blocked = untrusted(request);
+	if (blocked) return blocked;
+	const response = NextResponse.json({ success: true }, { headers: { "Cache-Control": "no-store" } });
+	response.cookies.set(SESSION_COOKIE, "", clearedCookieOptions(request));
+	return response;
+}

package/src/app/api/workspaces/route.ts

@@ -0,0 +1,78 @@
+import { NextResponse } from "next/server";
+import {
+	addWorkspace,
+	archiveSession,
+	forgetSession,
+	getRemovedWorkspaces,
+	getWorkspaceRegistry,
+	pickFolderNative,
+	registerCwds,
+	removeWorkspace,
+	setAlias,
+} from "@/lib/workspace-store";
+import { encodeSessionId } from "@/lib/pi";
+import { BoundaryError, resolveSessionPath, resolveWorkspacePath } from "@/lib/path-security";
+
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+	try {
+		return NextResponse.json({ success: true, data: await getWorkspaceRegistry() });
+	} catch (err: any) {
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: 500 });
+	}
+}
+
+export async function POST(req: Request) {
+	try {
+		const body = (await req.json()) as {
+			action: "add" | "remove" | "pick" | "rename" | "archiveSession" | "forgetSession" | "registerCwds";
+			path?: string;
+			name?: string;
+			cwds?: string[];
+		};
+		if (body.action === "pick") {
+			const r = await pickFolderNative();
+			const registry = r.path ? await addWorkspace(await resolveWorkspacePath(r.path)) : null;
+			return NextResponse.json({ success: true, data: { ...r, ...(registry ?? {}) } });
+		}
+		if (body.action === "add") {
+			if (!body.path) return NextResponse.json({ success: false, error: "missing path" }, { status: 400 });
+			return NextResponse.json({ success: true, data: await addWorkspace(await resolveWorkspacePath(body.path)) });
+		}
+		if (body.action === "remove") {
+			if (!body.path) return NextResponse.json({ success: false, error: "missing path" }, { status: 400 });
+			const r = await removeWorkspace(body.path);
+			return NextResponse.json({ success: true, data: r });
+		}
+		if (body.action === "rename") {
+			if (!body.path) return NextResponse.json({ success: false, error: "missing path" }, { status: 400 });
+			const aliases = await setAlias(body.path, body.name ?? "");
+			return NextResponse.json({ success: true, data: { aliases } });
+		}
+		if (body.action === "archiveSession") {
+			if (!body.path) return NextResponse.json({ success: false, error: "missing path" }, { status: 400 });
+			const sessionPath = await resolveSessionPath(encodeSessionId(body.path), { allowPending: true });
+			const archivedSessions = await archiveSession(sessionPath);
+			return NextResponse.json({ success: true, data: { archivedSessions } });
+		}
+		if (body.action === "forgetSession") {
+			if (!body.path) return NextResponse.json({ success: false, error: "missing path" }, { status: 400 });
+			const sessionPath = await resolveSessionPath(encodeSessionId(body.path), { allowPending: true });
+			const archivedSessions = await forgetSession(sessionPath);
+			return NextResponse.json({ success: true, data: { archivedSessions } });
+		}
+		if (body.action === "registerCwds") {
+			if (!Array.isArray(body.cwds)) return NextResponse.json({ success: false, error: "missing cwds" }, { status: 400 });
+			const workspaces = await registerCwds(body.cwds);
+			const removedWorkspaces = await getRemovedWorkspaces();
+			return NextResponse.json({ success: true, data: { workspaces, removedWorkspaces } });
+		}
+		return NextResponse.json({ success: false, error: "unknown action" }, { status: 400 });
+	} catch (err: any) {
+		return NextResponse.json(
+			{ success: false, error: String(err?.message ?? err) },
+			{ status: err instanceof BoundaryError ? 400 : 500 },
+		);
+	}
+}