@saadnvd1/agent-os 0.3.700 → 0.3.715

package/app/api/peer/unlink/route.ts

@@ -0,0 +1,17 @@
+import { NextRequest, NextResponse } from "next/server";
+import { PEER_HEADER, TRUST_HEADER } from "@/lib/security/auth";
+import { getHost } from "@/lib/hosts";
+import { unlinkedByPeer } from "@/lib/peer/links";
+
+export const dynamic = "force-dynamic";
+
+// POST /api/peer/unlink - a linked machine unlinked this one. Reached only
+// through its signed envelope (lib/peer/rpc-server.ts), which the gate turns
+// into `peer` trust naming the host it's pinned to; nothing else may call it.
+export function POST(request: NextRequest) {
+  const hostId = request.headers.get(PEER_HEADER);
+  if (request.headers.get(TRUST_HEADER) !== "peer" || !hostId)
+    return NextResponse.json({ error: "forbidden" }, { status: 403 });
+  const name = getHost(hostId)?.name ?? "the other machine";
+  return NextResponse.json({ unlinked: unlinkedByPeer(hostId, name) });
+}

package/app/api/peers/[hostId]/audit/route.ts

@@ -0,0 +1,14 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import { peerAudit } from "@/lib/peer/audit";
+
+// GET /api/peers/:hostId/audit - every call to and from that linked machine,
+// newest first: Machines → Activity.
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ hostId: string }> }
+) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  return NextResponse.json({ rows: peerAudit((await params).hostId) });
+}

package/app/api/peers/[hostId]/route.ts

@@ -0,0 +1,20 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import { unlinkPeer } from "@/lib/peer/unlink";
+
+// DELETE /api/peers/:hostId - unlink a machine linked through Connect: its
+// pin goes here at once, and it's told to drop its side. Takes the same
+// trust as linking.
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ hostId: string }> }
+) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  try {
+    return NextResponse.json(await unlinkPeer((await params).hostId));
+  } catch (err) {
+    const error = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error }, { status: 404 });
+  }
+}

package/app/api/peers/gate.test.ts

@@ -9,6 +9,9 @@ const link = await import("./link/route");
 const cancel = await import("./link/[id]/route");
 const confirm = await import("./link/[id]/confirm/route");
 const hello = await import("../peer/hello/route");
+const unlink = await import("./[hostId]/route");
+const audit = await import("./[hostId]/audit/route");
+const hostDelete = await import("../hosts/[id]/route");
 
 const plain = mintDevice("phone").device.id;
 const approver = mintDevice("tablet", null, true).device.id;
@@ -24,7 +27,10 @@ const req = (
       ...(o.device && { "x-agentos-device": o.device }),
       "content-type": "application/json",
     },
-    body: o.body ?? JSON.stringify({ code: "123456" }),
+    body:
+      o.method === "GET"
+        ? undefined
+        : (o.body ?? JSON.stringify({ code: "123456" })),
   });
 const params = { params: Promise.resolve({ id: "nope" }) };
 
@@ -105,7 +111,64 @@ describe("linking routes", () => {
       "/api/peers/account",
       "/api/peers/link",
       "/api/peers/link/x/confirm",
+      "/api/peers/h1",
+      "/api/peers/h1/audit",
+      "/api/peer/unlink",
     ])
       expect(isPublicPath(p)).toBe(false);
   });
+
+  it("unlink and Activity take the same trust as linking", async () => {
+    const hostParams = { params: Promise.resolve({ hostId: "nope" }) };
+    for (const who of [
+      {},
+      { trust: "device", device: plain },
+      { trust: "peer" },
+      { trust: "open" },
+    ]) {
+      const del = req("/api/peers/nope", {
+        ...who,
+        method: "DELETE",
+        body: "",
+      });
+      expect((await unlink.DELETE(del, hostParams)).status).toBe(403);
+      const get = req("/api/peers/nope/audit", { ...who, method: "GET" });
+      expect((await audit.GET(get, hostParams)).status).toBe(403);
+    }
+    const asApprover = { trust: "device", device: approver };
+    expect(
+      (
+        await unlink.DELETE(
+          req("/x", { ...asApprover, method: "DELETE", body: "" }),
+          hostParams
+        )
+      ).status
+    ).toBe(404);
+    const rows = await audit.GET(
+      req("/x", { ...asApprover, method: "GET" }),
+      hostParams
+    );
+    expect(await rows.json()).toEqual({ rows: [] });
+  });
+
+  it("won't remove a Connect-linked machine without unlinking it", async () => {
+    const { createConnectHost } = await import("@/lib/hosts");
+    const { savePin, pinForHost } = await import("@/lib/peer/links");
+    const id = createConnectHost("Linked").id;
+    savePin({
+      hostId: id,
+      machineId: "f0f0f0f0",
+      hostname: "m-0000000000000000.runagentos.com",
+      signPub: "x",
+      boxPub: "y",
+    });
+    const res = await hostDelete.DELETE(
+      req("/x", { method: "DELETE", body: "" }),
+      {
+        params: Promise.resolve({ id }),
+      }
+    );
+    expect(res.status).toBe(409);
+    expect(pinForHost(id)).not.toBeNull();
+  });
 });

package/app/api/peers/pending/route.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it, vi } from "vitest";
+import { NextRequest } from "next/server";
+import { mintDevice } from "@/lib/security/devices";
+
+const seen: unknown[] = [];
+vi.mock("@/lib/peer/pairing", () => ({
+  pendingRequests: (_now: number, o: unknown) => {
+    seen.push(o);
+    return [];
+  },
+}));
+const { GET } = await import("./route");
+
+const get = (headers: Record<string, string>) =>
+  GET(new NextRequest("http://localhost/api/peers/pending", { headers }));
+
+describe("GET /api/peers/pending", () => {
+  it("hands out the second code only to a caller that could accept", async () => {
+    const plain = mintDevice("phone").device.id;
+    const approver = mintDevice("tablet", null, true).device.id;
+    for (const h of [
+      {} as Record<string, string>,
+      { "x-agentos-trust": "device", "x-agentos-device": plain },
+      { "x-agentos-trust": "peer" },
+    ])
+      expect((await get(h)).status).toBe(200);
+    await get({ "x-agentos-trust": "loopback" });
+    await get({ "x-agentos-trust": "device", "x-agentos-device": approver });
+    expect(seen).toEqual([
+      { withCodes: false },
+      { withCodes: false },
+      { withCodes: false },
+      { withCodes: true },
+      { withCodes: true },
+    ]);
+  });
+});

package/app/api/peers/pending/route.ts

@@ -1,7 +1,14 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
+import { approverOf } from "@/lib/security/approver";
 import { pendingRequests } from "@/lib/peer/pairing";
 
-// GET /api/peers/pending - machines asking to link here, waiting for the code.
-export function GET() {
-  return NextResponse.json({ requests: pendingRequests() });
+// GET /api/peers/pending - machines asking to link here, waiting for the
+// code, and accepted ones whose second code is still to be typed there. That
+// code goes only to a caller that could have accepted.
+export function GET(request: NextRequest) {
+  return NextResponse.json({
+    requests: pendingRequests(Date.now(), {
+      withCodes: approverOf(request.headers) !== null,
+    }),
+  });
 }

package/app/api/session-groups/[id]/restore/route.ts

@@ -0,0 +1,11 @@
+import { restoreGroup } from "@/lib/session-groups";
+import { run } from "@/lib/session-groups/route";
+
+// POST /api/session-groups/:id/restore - undo a delete.
+export async function POST(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  return run(() => ({ sessionGroup: restoreGroup(id) }));
+}

package/app/api/session-groups/[id]/route.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import { deleteGroup, updateGroup } from "@/lib/session-groups";
+import { groupRoute, run } from "@/lib/session-groups/route";
+
+type Ctx = { params: Promise<{ id: string }> };
+
+const patch = z.object({
+  name: z.string().optional(),
+  collapsed: z.boolean().optional(),
+});
+
+// PATCH /api/session-groups/:id { name?, collapsed? } - rename or fold.
+export async function PATCH(request: Request, { params }: Ctx) {
+  const { id } = await params;
+  return groupRoute(request, patch, (b) => ({
+    sessionGroup: updateGroup(id, b),
+  }));
+}
+
+// DELETE /api/session-groups/:id - soft delete; its sessions fall back to the
+// status shelves and restore brings them back.
+export async function DELETE(_request: Request, { params }: Ctx) {
+  const { id } = await params;
+  return run(() => ({ sessionGroup: deleteGroup(id) }));
+}

package/app/api/session-groups/order/route.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { reorderGroups } from "@/lib/session-groups";
+import { groupRoute } from "@/lib/session-groups/route";
+
+const order = z.object({
+  workspaceId: z.string().nullable(),
+  ids: z.array(z.string()),
+});
+
+// POST /api/session-groups/order { workspaceId, ids } - a workspace's order.
+export async function POST(request: Request) {
+  return groupRoute(request, order, (b) => ({
+    sessionGroups: reorderGroups(b.workspaceId, b.ids),
+  }));
+}

package/app/api/session-groups/route.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import { createGroup, listGroups } from "@/lib/session-groups";
+import { groupRoute, run } from "@/lib/session-groups/route";
+
+const create = z.object({
+  name: z.string({ error: "A group needs a name" }),
+  workspaceId: z.string().nullable(),
+});
+
+// GET /api/session-groups - every live group.
+export async function GET() {
+  return run(() => ({ sessionGroups: listGroups() }));
+}
+
+// POST /api/session-groups { name, workspaceId } - create one at the bottom
+// of its workspace's order.
+export async function POST(request: Request) {
+  return groupRoute(request, create, (b) => ({
+    sessionGroup: createGroup(b.workspaceId, b.name),
+  }));
+}

package/app/api/sessions/[id]/fork/route.ts

@@ -1,3 +1,4 @@
+import { inheritGroup } from "@/lib/session-groups/assignSessions";
 import { NextRequest, NextResponse } from "next/server";
 import { randomUUID } from "crypto";
 import { getDb, queries, type Session, type Message } from "@/lib/db";
@@ -63,6 +64,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         parent.host_id
       );
 
+    inheritGroup(parentId, newId);
+
     // NOTE: We do NOT copy claude_session_id here.
     // When the forked session is first attached, it will use --fork-session flag
     // with the parent's claude_session_id to create a new branched conversation.

package/app/api/sessions/[id]/group/route.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+import { assignSessions } from "@/lib/session-groups";
+import { groupRoute } from "@/lib/session-groups/route";
+
+const body = z.object({ groupId: z.string().nullable() });
+
+// POST /api/sessions/:id/group { groupId | null } - join a group of the
+// session's workspace, or leave.
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  return groupRoute(request, body, (b) => ({
+    ok: true,
+    ...assignSessions([id], b.groupId),
+  }));
+}

package/app/api/sessions/[id]/route.ts

@@ -19,6 +19,7 @@ import { statusDetector } from "@/lib/status-detector";
 import { deleteItems } from "@/lib/chat/store";
 import { clearQueue } from "@/lib/chat/queued";
 import { recordPreviousName } from "@/lib/session-names";
+import { getProject, moveSessionToProject } from "@/lib/projects";
 import { generateBranchName, getCurrentBranch, renameBranch } from "@/lib/git";
 import { runInBackground } from "@/lib/async-operations";
 import {
@@ -206,9 +207,15 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
       updates.push("system_prompt = ?");
       values.push(body.systemPrompt);
     }
-    if (body.groupPath !== undefined) {
-      updates.push("group_path = ?");
-      values.push(body.groupPath);
+
+    let clearedGroup: string | null = null;
+    if (typeof body.projectId === "string" && !existing.role) {
+      if (!getProject(body.projectId))
+        return NextResponse.json(
+          { error: "Project not found" },
+          { status: 404 }
+        );
+      clearedGroup = moveSessionToProject(id, body.projectId).clearedGroup;
     }
 
     if (updates.length > 0) {
@@ -221,7 +228,10 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
     }
 
     const session = queries.getSession(db).get(id) as Session;
-    return NextResponse.json({ session });
+    return NextResponse.json({
+      session,
+      ...(clearedGroup && { clearedGroup }),
+    });
   } catch (error) {
     console.error("Error updating session:", error);
     return NextResponse.json(

package/app/api/sessions/[id]/summarize/route.ts

@@ -1,3 +1,4 @@
+import { inheritGroup } from "@/lib/session-groups/assignSessions";
 import { effectiveAutoApprove } from "@/lib/approvals/no-approvals";
 import { routedRun } from "@/lib/models/launch";
 import { NextRequest, NextResponse } from "next/server";
@@ -305,6 +306,7 @@ export async function POST(
         session.host_id
       );
 
+      inheritGroup(session.id, newId);
       newSession = queries.getSession(db).get(newId) as Session;
       const newTmuxSession = tmuxName;
 

package/app/api/sessions/claims.test.ts

@@ -0,0 +1,122 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { seedSession, seedWorkspace } from "@/lib/orchestrator/testing";
+
+const { db } = await import("@/lib/db");
+const { machineId } = await import("@/lib/claims/machine");
+const { upsertLocal, upsertRemote } = await import("@/lib/claims/store");
+const { refreshOverlapCache, resetOverlapCache } =
+  await import("@/lib/claims/overlapCache");
+const { GET } = await import("./route");
+
+const REPO = "git.example.test/team/widgets";
+
+beforeEach(() => {
+  db.prepare(`DELETE FROM work_claims`).run();
+  resetOverlapCache();
+});
+
+function localClaim(sessionId: string, files: string[]) {
+  upsertLocal(
+    { id: machineId(), name: "here" },
+    {
+      sessionId,
+      sessionName: "Tidy auth",
+      repo: REPO,
+      branch: "feature/tidy",
+      base: "main",
+      goal: "Tidy auth",
+      files,
+      filesMore: 0,
+      prUrl: null,
+    }
+  );
+}
+
+const remote = (id: string, files: string[], branch = "feature/login") =>
+  upsertRemote(machineId(), "peer-1", {
+    id,
+    origin: "box-machine",
+    origin_name: "box",
+    hops: 0,
+    source: "session",
+    session_name: "Rework login sessions",
+    repo: REPO,
+    branch,
+    base: "main",
+    goal: "Rework login sessions",
+    files,
+    files_more: 0,
+    pr_url: null,
+    ttl_s: 600,
+    age_s: 60,
+    released: null,
+  });
+
+const FILES = ["a/one.ts", "a/two.ts", "a/three.ts"];
+
+const rows = async () => {
+  const body = await (await GET()).json();
+  return body as {
+    sessions: { id: string; overlap?: Record<string, unknown> | null }[];
+    claims: { id: string; fileCount: number; files?: string[] }[];
+    claimOverlaps: { a: string; b: string; strength: string }[];
+  };
+};
+
+describe("GET /api/sessions with claims", () => {
+  it("puts a strong overlap on the session that has it, and no other", async () => {
+    const t = seedWorkspace();
+    const mine = seedSession({ projectId: t.app.id, name: "Tidy auth" });
+    const other = seedSession({ projectId: t.app.id, name: "Unrelated" });
+    localClaim(mine, FILES);
+    remote("claim-box-1", FILES);
+    refreshOverlapCache();
+    const body = await rows();
+    expect(body.sessions.find((s) => s.id === mine)?.overlap).toEqual({
+      strength: "strong",
+      machine: "box",
+      goal: "Rework login sessions",
+      shared: 3,
+      claimId: "claim-box-1",
+      mineId: `s-${mine}`,
+    });
+    expect(body.sessions.find((s) => s.id === other)?.overlap).toBeUndefined();
+  });
+
+  it("marks a small file overlap weak", async () => {
+    const t = seedWorkspace();
+    const mine = seedSession({ projectId: t.app.id, name: "Tidy auth" });
+    localClaim(mine, ["a/1.ts", "a/2.ts", "a/3.ts", "a/4.ts", "a/5.ts"]);
+    remote(
+      "claim-box-2",
+      ["a/1.ts", "a/2.ts", "b/1.ts", "b/2.ts", "b/3.ts"],
+      "feature/other"
+    );
+    refreshOverlapCache();
+    const row = (await rows()).sessions.find((s) => s.id === mine);
+    expect(row?.overlap?.strength).toBe("weak");
+  });
+
+  it("lists claims without their paths, and the overlapping pairs", async () => {
+    const t = seedWorkspace();
+    const mine = seedSession({ projectId: t.app.id, name: "Tidy auth" });
+    localClaim(mine, FILES);
+    remote("claim-box-1", FILES);
+    refreshOverlapCache();
+    const body = await rows();
+    expect(body.claims.map((c) => c.id).sort()).toEqual(
+      [`s-${mine}`, "claim-box-1"].sort()
+    );
+    expect(body.claims.every((c) => c.fileCount === 3 && !c.files)).toBe(true);
+    expect(body.claimOverlaps).toHaveLength(1);
+    expect(body.claimOverlaps[0].strength).toBe("strong");
+  });
+
+  it("serves no claims before the loop has run", async () => {
+    const t = seedWorkspace();
+    seedSession({ projectId: t.app.id, name: "Tidy auth" });
+    const body = await rows();
+    expect(body.claims).toEqual([]);
+    expect(body.sessions.every((s) => !s.overlap)).toBe(true);
+  });
+});

package/app/api/sessions/group/route.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+import { assignSessions } from "@/lib/session-groups";
+import { groupRoute } from "@/lib/session-groups/route";
+
+const body = z.object({
+  ids: z.array(z.string()).min(1).max(200),
+  groupId: z.string().nullable(),
+});
+
+// POST /api/sessions/group { ids, groupId | null } - the multi-select move.
+// All or none: one session of another workspace refuses the lot.
+export async function POST(request: Request) {
+  return groupRoute(request, body, (b) => ({
+    ok: true,
+    ...assignSessions(b.ids, b.groupId),
+  }));
+}

package/app/api/sessions/route.ts

@@ -1,13 +1,15 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getDb, queries, type Session, type Group } from "@/lib/db";
+import { getDb, queries, type Session } from "@/lib/db";
+import { listGroups } from "@/lib/session-groups";
 import { isValidAgentType } from "@/lib/providers";
 import { clientSend } from "@/lib/chat/client-send";
 import { CHAT_ACCESS } from "@/lib/chat/events";
 import { launchSession } from "@/lib/sessions/launch";
 import { namesLine, waitBadges } from "@/lib/bus/waits/store";
+import { claimsSnapshot } from "@/lib/claims";
 import { isProjectRef } from "@/lib/tasks/project-ref";
 
-// GET /api/sessions - List all sessions and groups
+// GET /api/sessions - List the sidebar's sessions and the user's groups
 export async function GET() {
   try {
     const db = getDb();
@@ -15,12 +17,15 @@ export async function GET() {
     // tasks live in the Tasks panel, a moved one on the machine it moved to,
     // and archived sessions in the Archived view: none is in the sidebar.
     const badges = waitBadges();
+    const claims = claimsSnapshot();
     const sessions = (queries.getSidebarSessions(db).all() as Session[]).map(
       (s) => {
         const b = badges.get(s.id);
+        const overlap = claims.bySession.get(s.id);
+        const row = overlap ? { ...s, overlap } : s;
         return b
           ? {
-              ...s,
+              ...row,
               waiting_on: b.on.length
                 ? namesLine(b.on.map((w) => w.name))
                 : null,
@@ -28,18 +33,15 @@ export async function GET() {
                 ? namesLine(b.by.map((w) => w.name))
                 : null,
             }
-          : s;
+          : row;
       }
     );
-    const groups = queries.getAllGroups(db).all() as Group[];
-
-    // Convert expanded from 0/1 to boolean
-    const formattedGroups = groups.map((g) => ({
-      ...g,
-      expanded: Boolean(g.expanded),
-    }));
-
-    return NextResponse.json({ sessions, groups: formattedGroups });
+    return NextResponse.json({
+      sessions,
+      sessionGroups: listGroups(),
+      claims: claims.claims,
+      claimOverlaps: claims.overlaps,
+    });
   } catch (error) {
     console.error("Error fetching sessions:", error);
     return NextResponse.json(
@@ -95,7 +97,6 @@ export async function POST(request: NextRequest) {
       name: str(body.name),
       view: body.view === "terminal" ? "terminal" : undefined,
       parentSessionId: str(body.parentSessionId),
-      groupPath: str(body.groupPath) ?? undefined,
       systemPrompt: str(body.systemPrompt),
     });
     const db = getDb();

package/app/page.tsx

@@ -122,6 +122,10 @@ const LumifyHubDialogs = dynamic(
     ),
   { ssr: false }
 );
+const ClaimsSheet = dynamic(
+  () => import("@/components/Claims/ClaimsSheet").then((m) => m.ClaimsSheet),
+  { ssr: false }
+);
 const UsageDialog = dynamic(
   () => import("@/components/Usage/UsageDialog").then((m) => m.UsageDialog),
   { ssr: false }
@@ -159,6 +163,7 @@ const AppDialogs = memo(function AppDialogs({
       <CleanupDialog />
       <LumifyHubDialogs />
       <UsageDialog />
+      <ClaimsSheet />
       <MoveDialog />
       <ShareDialog />
       <AwayReport />

package/components/Claims/ClaimFiles.tsx

@@ -0,0 +1,38 @@
+"use client";
+
+import { cn } from "@/lib/utils";
+
+// The paths a claim touches, the ones another claim also touches marked.
+export function ClaimFiles({
+  files,
+  more,
+  shared,
+}: {
+  files: string[];
+  more: number;
+  shared: ReadonlySet<string>;
+}) {
+  return (
+    <ul className="bg-muted/40 mt-1 max-h-48 overflow-y-auto rounded-lg p-2 font-mono text-[11px] leading-5">
+      {files.map((f) => (
+        <li
+          key={f}
+          className={cn(
+            "break-all",
+            shared.has(f)
+              ? "text-amber-700 dark:text-amber-400"
+              : "text-muted-foreground"
+          )}
+        >
+          {f}
+        </li>
+      ))}
+      {more > 0 && (
+        <li className="text-muted-foreground pt-1">and {more} more</li>
+      )}
+      {files.length === 0 && more === 0 && (
+        <li className="text-muted-foreground">No changed files yet</li>
+      )}
+    </ul>
+  );
+}