@saadnvd1/agent-os 0.3.698 → 0.3.715

package/app/api/claims/route.ts

@@ -0,0 +1,73 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import {
+  claimsShared,
+  claimsView,
+  liveClaims,
+  registerOutside,
+} from "@/lib/claims";
+import { outsideBody } from "@/lib/claims/types";
+import { repoKey } from "@/lib/git-remote";
+import { getDb, queries, type Session } from "@/lib/db";
+import { getProject } from "@/lib/projects";
+import { expandHome } from "@/lib/tasks/session";
+
+export const dynamic = "force-dynamic";
+
+const query = z.object({
+  session: z.string().max(100).optional(),
+  project: z.string().max(100).optional(),
+  repo: z.string().max(300).optional(),
+});
+
+// GET /api/claims - what live sessions, here and on linked machines, are
+// working on, with the pairs that overlap and when each machine was last
+// heard from. `session` or `project` narrows it to that repository.
+export async function GET(request: NextRequest) {
+  const q = query.safeParse(Object.fromEntries(request.nextUrl.searchParams));
+  if (!q.success)
+    return NextResponse.json({ error: "Bad query" }, { status: 400 });
+  let repo = q.data.repo?.toLowerCase();
+  if (q.data.session) {
+    const s = queries.getSession(getDb()).get(q.data.session) as
+      Session | undefined;
+    if (!s)
+      return NextResponse.json({ error: "No such session" }, { status: 404 });
+    repo =
+      (await repoKey(expandHome(s.worktree_path || s.working_directory))) ??
+      undefined;
+    if (!repo) return NextResponse.json(shape([]));
+  }
+  if (q.data.project) {
+    const p = getProject(q.data.project);
+    if (!p)
+      return NextResponse.json({ error: "No such project" }, { status: 404 });
+    repo = (await repoKey(expandHome(p.working_directory))) ?? undefined;
+    if (!repo) return NextResponse.json(shape([]));
+  }
+  return NextResponse.json(shape(liveClaims({ repo })));
+}
+
+// POST /api/claims - a session AgentOS didn't start registers or renews its
+// claim (`aos claim start|touch`). The CLI read git in its own folder and
+// sends the remote URL, branch and paths; nothing is run here.
+export async function POST(request: NextRequest) {
+  const body = outsideBody.safeParse(await request.json().catch(() => null));
+  if (!body.success)
+    return NextResponse.json({ error: "Bad claim" }, { status: 400 });
+  if (!claimsShared())
+    return NextResponse.json({ error: "Claims are off" }, { status: 409 });
+  const result = registerOutside(body.data);
+  if (!result)
+    return NextResponse.json(
+      { error: "No repository remote, or that id belongs to another claim" },
+      { status: 422 }
+    );
+  const claims = liveClaims({ repo: result.claim.repo });
+  const overlaps = shape(claims).overlaps.filter(
+    (o) => o.a === result.claim.id || o.b === result.claim.id
+  );
+  return NextResponse.json({ ...shape(claims), id: result.claim.id, overlaps });
+}
+
+const shape = (claims: ReturnType<typeof liveClaims>) => claimsView(claims);

package/app/api/hosts/[id]/route.ts

@@ -1,12 +1,20 @@
 import { NextRequest, NextResponse } from "next/server";
 import { deleteHost } from "@/lib/hosts";
+import { pinForHost } from "@/lib/peer/links";
 
 export async function DELETE(
   _request: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    deleteHost((await params).id);
+    const id = (await params).id;
+    // Removing it here would leave the other machine linked to this one.
+    if (pinForHost(id))
+      return NextResponse.json(
+        { error: "It's linked through Connect: unlink it first." },
+        { status: 409 }
+      );
+    deleteHost(id);
     return NextResponse.json({ success: true });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);

package/app/api/peer/hello/reveal/route.ts

@@ -0,0 +1,6 @@
+import { helloRoute } from "@/lib/peer/hello-route";
+import { receiveReveal } from "@/lib/peer/pairing";
+
+// POST /api/peer/hello/reveal - public: the asking machine reveals the nonce
+// its hello committed to.
+export const POST = helloRoute((body) => receiveReveal(body));

package/app/api/peer/hello/route.ts

@@ -0,0 +1,9 @@
+import { helloRoute } from "@/lib/peer/hello-route";
+import { receiveHello } from "@/lib/peer/pairing";
+import { SOURCE_HEADER } from "@/lib/security/auth";
+
+// POST /api/peer/hello - public: another machine on this Connect account
+// asks to link (lib/peer/pairing.ts).
+export const POST = helloRoute((body, request) =>
+  receiveHello(body, undefined, request.headers.get(SOURCE_HEADER) ?? "unknown")
+);

package/app/api/peer/hello/status/route.ts

@@ -0,0 +1,6 @@
+import { helloRoute } from "@/lib/peer/hello-route";
+import { receiveStatus } from "@/lib/peer/pairing";
+
+// POST /api/peer/hello/status - public: the asking machine learns, signed,
+// whether the code was typed here.
+export const POST = helloRoute((body) => receiveStatus(body));

package/app/api/peer/unlink/route.ts

@@ -0,0 +1,17 @@
+import { NextRequest, NextResponse } from "next/server";
+import { PEER_HEADER, TRUST_HEADER } from "@/lib/security/auth";
+import { getHost } from "@/lib/hosts";
+import { unlinkedByPeer } from "@/lib/peer/links";
+
+export const dynamic = "force-dynamic";
+
+// POST /api/peer/unlink - a linked machine unlinked this one. Reached only
+// through its signed envelope (lib/peer/rpc-server.ts), which the gate turns
+// into `peer` trust naming the host it's pinned to; nothing else may call it.
+export function POST(request: NextRequest) {
+  const hostId = request.headers.get(PEER_HEADER);
+  if (request.headers.get(TRUST_HEADER) !== "peer" || !hostId)
+    return NextResponse.json({ error: "forbidden" }, { status: 403 });
+  const name = getHost(hostId)?.name ?? "the other machine";
+  return NextResponse.json({ unlinked: unlinkedByPeer(hostId, name) });
+}

package/app/api/peers/[hostId]/audit/route.ts

@@ -0,0 +1,14 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import { peerAudit } from "@/lib/peer/audit";
+
+// GET /api/peers/:hostId/audit - every call to and from that linked machine,
+// newest first: Machines → Activity.
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ hostId: string }> }
+) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  return NextResponse.json({ rows: peerAudit((await params).hostId) });
+}

package/app/api/peers/[hostId]/route.ts

@@ -0,0 +1,20 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import { unlinkPeer } from "@/lib/peer/unlink";
+
+// DELETE /api/peers/:hostId - unlink a machine linked through Connect: its
+// pin goes here at once, and it's told to drop its side. Takes the same
+// trust as linking.
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ hostId: string }> }
+) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  try {
+    return NextResponse.json(await unlinkPeer((await params).hostId));
+  } catch (err) {
+    const error = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error }, { status: 404 });
+  }
+}

package/app/api/peers/account/route.ts

@@ -0,0 +1,9 @@
+import { NextRequest, NextResponse } from "next/server";
+import { accountMachines } from "@/lib/peer/machines";
+
+// GET /api/peers/account[?refresh=1] - the other machines on this Connect
+// account, whether each is linked here, and whether the plan allows linking.
+export async function GET(request: NextRequest) {
+  const refresh = request.nextUrl.searchParams.get("refresh") === "1";
+  return NextResponse.json(await accountMachines(refresh));
+}

package/app/api/peers/gate.test.ts

@@ -0,0 +1,174 @@
+import { describe, expect, it } from "vitest";
+import { NextRequest } from "next/server";
+import { mintDevice } from "@/lib/security/devices";
+import { isPublicPath } from "@/lib/security/auth";
+
+const accept = await import("./pending/[id]/accept/route");
+const decline = await import("./pending/[id]/decline/route");
+const link = await import("./link/route");
+const cancel = await import("./link/[id]/route");
+const confirm = await import("./link/[id]/confirm/route");
+const hello = await import("../peer/hello/route");
+const unlink = await import("./[hostId]/route");
+const audit = await import("./[hostId]/audit/route");
+const hostDelete = await import("../hosts/[id]/route");
+
+const plain = mintDevice("phone").device.id;
+const approver = mintDevice("tablet", null, true).device.id;
+
+const req = (
+  path: string,
+  o: { trust?: string; device?: string; body?: string; method?: string } = {}
+) =>
+  new NextRequest(`http://localhost${path}`, {
+    method: o.method ?? "POST",
+    headers: {
+      ...(o.trust && { "x-agentos-trust": o.trust }),
+      ...(o.device && { "x-agentos-device": o.device }),
+      "content-type": "application/json",
+    },
+    body:
+      o.method === "GET"
+        ? undefined
+        : (o.body ?? JSON.stringify({ code: "123456" })),
+  });
+const params = { params: Promise.resolve({ id: "nope" }) };
+
+describe("linking routes", () => {
+  it("take a code only from this machine, the tailnet or a Can approve device", async () => {
+    for (const who of [
+      {},
+      { trust: "device", device: plain },
+      { trust: "device", device: "unknown" },
+      { trust: "peer" },
+      { trust: "open" },
+    ]) {
+      const r = await accept.POST(
+        req("/api/peers/pending/nope/accept", who),
+        params
+      );
+      expect(r.status).toBe(403);
+      expect((await decline.POST(req("/x", who), params)).status).toBe(403);
+      expect((await confirm.POST(req("/x", who), params)).status).toBe(403);
+      expect((await link.POST(req("/x", { ...who, body: "{}" }))).status).toBe(
+        403
+      );
+      expect(
+        (
+          await cancel.DELETE(
+            req("/x", { ...who, method: "DELETE", body: "" }),
+            params
+          )
+        ).status
+      ).toBe(403);
+    }
+    // Past the gate: there is no such request.
+    for (const who of [
+      { trust: "loopback" },
+      { trust: "tailnet" },
+      { trust: "device", device: approver },
+    ])
+      expect(
+        (await accept.POST(req("/api/peers/pending/nope/accept", who), params))
+          .status
+      ).toBe(404);
+    expect(
+      (await confirm.POST(req("/x", { trust: "loopback" }), params)).status
+    ).toBe(404);
+    expect(
+      (await link.POST(req("/x", { trust: "loopback", body: "{}" }))).status
+    ).toBe(400);
+    for (const body of ['{"code":482913}', "{", "{}"])
+      for (const route of [accept, confirm])
+        expect(
+          (await route.POST(req("/x", { trust: "loopback", body }), params))
+            .status
+        ).toBe(400);
+  });
+
+  it("caps a hello at 4 KiB and refuses junk", async () => {
+    const big = await hello.POST(
+      req("/api/peer/hello", { body: "x".repeat(5000) })
+    );
+    expect(big.status).toBe(413);
+    expect(
+      (await hello.POST(req("/api/peer/hello", { body: "{" }))).status
+    ).toBe(400);
+    expect(big.headers.get("cache-control")).toBe("no-store");
+  });
+
+  it("are public only for the three hello paths", () => {
+    for (const p of [
+      "/api/peer/hello",
+      "/api/peer/hello/reveal",
+      "/api/peer/hello/status",
+    ])
+      expect(isPublicPath(p)).toBe(true);
+    for (const p of [
+      "/api/peer/hello/x",
+      "/api/peer/hello/../../pair/start",
+      "/api/peers/pending",
+      "/api/peers/account",
+      "/api/peers/link",
+      "/api/peers/link/x/confirm",
+      "/api/peers/h1",
+      "/api/peers/h1/audit",
+      "/api/peer/unlink",
+    ])
+      expect(isPublicPath(p)).toBe(false);
+  });
+
+  it("unlink and Activity take the same trust as linking", async () => {
+    const hostParams = { params: Promise.resolve({ hostId: "nope" }) };
+    for (const who of [
+      {},
+      { trust: "device", device: plain },
+      { trust: "peer" },
+      { trust: "open" },
+    ]) {
+      const del = req("/api/peers/nope", {
+        ...who,
+        method: "DELETE",
+        body: "",
+      });
+      expect((await unlink.DELETE(del, hostParams)).status).toBe(403);
+      const get = req("/api/peers/nope/audit", { ...who, method: "GET" });
+      expect((await audit.GET(get, hostParams)).status).toBe(403);
+    }
+    const asApprover = { trust: "device", device: approver };
+    expect(
+      (
+        await unlink.DELETE(
+          req("/x", { ...asApprover, method: "DELETE", body: "" }),
+          hostParams
+        )
+      ).status
+    ).toBe(404);
+    const rows = await audit.GET(
+      req("/x", { ...asApprover, method: "GET" }),
+      hostParams
+    );
+    expect(await rows.json()).toEqual({ rows: [] });
+  });
+
+  it("won't remove a Connect-linked machine without unlinking it", async () => {
+    const { createConnectHost } = await import("@/lib/hosts");
+    const { savePin, pinForHost } = await import("@/lib/peer/links");
+    const id = createConnectHost("Linked").id;
+    savePin({
+      hostId: id,
+      machineId: "f0f0f0f0",
+      hostname: "m-0000000000000000.runagentos.com",
+      signPub: "x",
+      boxPub: "y",
+    });
+    const res = await hostDelete.DELETE(
+      req("/x", { method: "DELETE", body: "" }),
+      {
+        params: Promise.resolve({ id }),
+      }
+    );
+    expect(res.status).toBe(409);
+    expect(pinForHost(id)).not.toBeNull();
+  });
+});

package/app/api/peers/link/[id]/confirm/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireApprover } from "@/lib/security/approver";
+import { confirmLink } from "@/lib/peer/pairing-out";
+
+const bodySchema = z.object({ code: z.string().max(32) });
+
+// POST /api/peers/link/:id/confirm {code} - the code the other machine shows
+// once it took ours, typed here: only then is it pinned. Same gate as
+// starting the link.
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  const body = bodySchema.safeParse(await request.json().catch(() => null));
+  if (!body.success)
+    return NextResponse.json({ error: "code required" }, { status: 400 });
+  const result = confirmLink((await params).id, body.data.code);
+  if (!result.ok)
+    return NextResponse.json(
+      { error: result.error, attemptsLeft: result.attemptsLeft },
+      { status: result.status }
+    );
+  return NextResponse.json({ link: result.link });
+}

package/app/api/peers/link/[id]/route.ts

@@ -0,0 +1,20 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import { cancelLink, outgoingLink } from "@/lib/peer/pairing-out";
+
+type Ctx = { params: Promise<{ id: string }> };
+
+// GET /api/peers/link/:id - a link this machine started: its code and state.
+export async function GET(_request: NextRequest, { params }: Ctx) {
+  const link = outgoingLink((await params).id);
+  if (!link)
+    return NextResponse.json({ error: "No such request" }, { status: 404 });
+  return NextResponse.json({ link });
+}
+
+// DELETE /api/peers/link/:id - stop waiting for it.
+export async function DELETE(request: NextRequest, { params }: Ctx) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  return NextResponse.json({ cancelled: cancelLink((await params).id) });
+}

package/app/api/peers/link/route.ts

@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireApprover } from "@/lib/security/approver";
+import { LinkError, startLink } from "@/lib/peer/pairing-out";
+
+const bodySchema = z.object({ machineId: z.string().min(1).max(64) });
+
+// POST /api/peers/link {machineId} - ask an account machine to link. Once
+// linked it can run code here too, so only a trusted place may start it.
+export async function POST(request: NextRequest) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  const body = bodySchema.safeParse(await request.json().catch(() => null));
+  if (!body.success)
+    return NextResponse.json({ error: "machineId required" }, { status: 400 });
+  try {
+    return NextResponse.json({ link: await startLink(body.data.machineId) });
+  } catch (error) {
+    const status = error instanceof LinkError ? error.status : 500;
+    const message = error instanceof Error ? error.message : String(error);
+    return NextResponse.json({ error: message }, { status });
+  }
+}

package/app/api/peers/pending/[id]/accept/route.ts

@@ -0,0 +1,31 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireApprover } from "@/lib/security/approver";
+import { acceptRequest } from "@/lib/peer/pairing";
+
+const bodySchema = z.object({ code: z.string().max(32) });
+
+// POST /api/peers/pending/:id/accept {code} - the code the other machine
+// shows, typed here. Linking lets that machine run code here, so it takes
+// this machine, the tailnet or a device with Can approve.
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  const body = bodySchema.safeParse(await request.json().catch(() => null));
+  if (!body.success)
+    return NextResponse.json({ error: "code required" }, { status: 400 });
+  const result = await acceptRequest((await params).id, body.data.code);
+  if (!result.ok)
+    return NextResponse.json(
+      { error: result.error, attemptsLeft: result.attemptsLeft },
+      { status: result.status }
+    );
+  return NextResponse.json({
+    hostId: result.hostId,
+    name: result.name,
+    confirmCode: result.confirmCode,
+  });
+}

package/app/api/peers/pending/[id]/decline/route.ts

@@ -0,0 +1,13 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import { declineRequest } from "@/lib/peer/pairing";
+
+// POST /api/peers/pending/:id/decline
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  return NextResponse.json({ declined: declineRequest((await params).id) });
+}

package/app/api/peers/pending/route.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it, vi } from "vitest";
+import { NextRequest } from "next/server";
+import { mintDevice } from "@/lib/security/devices";
+
+const seen: unknown[] = [];
+vi.mock("@/lib/peer/pairing", () => ({
+  pendingRequests: (_now: number, o: unknown) => {
+    seen.push(o);
+    return [];
+  },
+}));
+const { GET } = await import("./route");
+
+const get = (headers: Record<string, string>) =>
+  GET(new NextRequest("http://localhost/api/peers/pending", { headers }));
+
+describe("GET /api/peers/pending", () => {
+  it("hands out the second code only to a caller that could accept", async () => {
+    const plain = mintDevice("phone").device.id;
+    const approver = mintDevice("tablet", null, true).device.id;
+    for (const h of [
+      {} as Record<string, string>,
+      { "x-agentos-trust": "device", "x-agentos-device": plain },
+      { "x-agentos-trust": "peer" },
+    ])
+      expect((await get(h)).status).toBe(200);
+    await get({ "x-agentos-trust": "loopback" });
+    await get({ "x-agentos-trust": "device", "x-agentos-device": approver });
+    expect(seen).toEqual([
+      { withCodes: false },
+      { withCodes: false },
+      { withCodes: false },
+      { withCodes: true },
+      { withCodes: true },
+    ]);
+  });
+});

package/app/api/peers/pending/route.ts

@@ -0,0 +1,14 @@
+import { NextRequest, NextResponse } from "next/server";
+import { approverOf } from "@/lib/security/approver";
+import { pendingRequests } from "@/lib/peer/pairing";
+
+// GET /api/peers/pending - machines asking to link here, waiting for the
+// code, and accepted ones whose second code is still to be typed there. That
+// code goes only to a caller that could have accepted.
+export function GET(request: NextRequest) {
+  return NextResponse.json({
+    requests: pendingRequests(Date.now(), {
+      withCodes: approverOf(request.headers) !== null,
+    }),
+  });
+}

package/app/api/session-groups/[id]/restore/route.ts

@@ -0,0 +1,11 @@
+import { restoreGroup } from "@/lib/session-groups";
+import { run } from "@/lib/session-groups/route";
+
+// POST /api/session-groups/:id/restore - undo a delete.
+export async function POST(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  return run(() => ({ sessionGroup: restoreGroup(id) }));
+}

package/app/api/session-groups/[id]/route.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import { deleteGroup, updateGroup } from "@/lib/session-groups";
+import { groupRoute, run } from "@/lib/session-groups/route";
+
+type Ctx = { params: Promise<{ id: string }> };
+
+const patch = z.object({
+  name: z.string().optional(),
+  collapsed: z.boolean().optional(),
+});
+
+// PATCH /api/session-groups/:id { name?, collapsed? } - rename or fold.
+export async function PATCH(request: Request, { params }: Ctx) {
+  const { id } = await params;
+  return groupRoute(request, patch, (b) => ({
+    sessionGroup: updateGroup(id, b),
+  }));
+}
+
+// DELETE /api/session-groups/:id - soft delete; its sessions fall back to the
+// status shelves and restore brings them back.
+export async function DELETE(_request: Request, { params }: Ctx) {
+  const { id } = await params;
+  return run(() => ({ sessionGroup: deleteGroup(id) }));
+}

package/app/api/session-groups/order/route.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { reorderGroups } from "@/lib/session-groups";
+import { groupRoute } from "@/lib/session-groups/route";
+
+const order = z.object({
+  workspaceId: z.string().nullable(),
+  ids: z.array(z.string()),
+});
+
+// POST /api/session-groups/order { workspaceId, ids } - a workspace's order.
+export async function POST(request: Request) {
+  return groupRoute(request, order, (b) => ({
+    sessionGroups: reorderGroups(b.workspaceId, b.ids),
+  }));
+}

package/app/api/session-groups/route.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import { createGroup, listGroups } from "@/lib/session-groups";
+import { groupRoute, run } from "@/lib/session-groups/route";
+
+const create = z.object({
+  name: z.string({ error: "A group needs a name" }),
+  workspaceId: z.string().nullable(),
+});
+
+// GET /api/session-groups - every live group.
+export async function GET() {
+  return run(() => ({ sessionGroups: listGroups() }));
+}
+
+// POST /api/session-groups { name, workspaceId } - create one at the bottom
+// of its workspace's order.
+export async function POST(request: Request) {
+  return groupRoute(request, create, (b) => ({
+    sessionGroup: createGroup(b.workspaceId, b.name),
+  }));
+}

package/app/api/sessions/[id]/fork/route.ts

@@ -1,3 +1,4 @@
+import { inheritGroup } from "@/lib/session-groups/assignSessions";
 import { NextRequest, NextResponse } from "next/server";
 import { randomUUID } from "crypto";
 import { getDb, queries, type Session, type Message } from "@/lib/db";
@@ -63,6 +64,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         parent.host_id
       );
 
+    inheritGroup(parentId, newId);
+
     // NOTE: We do NOT copy claude_session_id here.
     // When the forked session is first attached, it will use --fork-session flag
     // with the parent's claude_session_id to create a new branched conversation.

package/app/api/sessions/[id]/group/route.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+import { assignSessions } from "@/lib/session-groups";
+import { groupRoute } from "@/lib/session-groups/route";
+
+const body = z.object({ groupId: z.string().nullable() });
+
+// POST /api/sessions/:id/group { groupId | null } - join a group of the
+// session's workspace, or leave.
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  return groupRoute(request, body, (b) => ({
+    ok: true,
+    ...assignSessions([id], b.groupId),
+  }));
+}