@supen-ai/cli 0.1.6

package/daemon/dist/http/routes/agents.js

@@ -0,0 +1,747 @@
+import fs from 'fs';
+import path from 'path';
+import { randomUUID } from 'crypto';
+import { ONLYOFFICE_SOURCE_BASE_URL, agentPaths, resolveSpaceKnowledgeRoot } from '../../core/config.js';
+import { spacePaths } from '../../core/storage-paths.js';
+import { logger } from '../../core/logger.js';
+import { assertSafePathSegment, isPathWithin } from '../../core/security.js';
+import { createAgent, deleteAgent, getAllAgents, getAgent, getAgentStorage, updateAgent, } from '../../core/store.js';
+import { writeJson, writeProtocolError, readJsonBody, } from '../response.js';
+import { inferMimeType } from '../utils.js';
+import { diskAllowlistForConfig, normalizeAgentSkillsConfig } from '../../skills/allowlist.js';
+import { ensureOfficePreviewPdf, ensureSpreadsheetPreviewXlsx, isOfficePreviewPath, issuePreviewToken, resolvePreviewToken, } from '../office-preview.js';
+const OS_METADATA_FILENAMES = new Set([
+    '.DS_Store',
+    'Thumbs.db',
+    'desktop.ini',
+]);
+function isOsMetadataFile(name) {
+    return OS_METADATA_FILENAMES.has(name);
+}
+const TASK_INTERNAL_ENTRIES = new Set(['.claude', '.supen', 'knowledge']);
+function isHiddenWorkspaceEntry(root, name) {
+    if (isOsMetadataFile(name))
+        return true;
+    return root === 'tasks' && TASK_INTERNAL_ENTRIES.has(name);
+}
+const WORKSPACE_ROOT_CATEGORIES = new Set([
+    'knowledge',
+    'uploads',
+    'outputs',
+    'tasks',
+    'runs',
+]);
+function parseWorkspaceRootCategory(value) {
+    if (value == null || value === '')
+        return 'knowledge';
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === 'drive')
+        return 'knowledge';
+    if (normalized === 'inbox')
+        return 'uploads';
+    if (normalized === 'artifacts')
+        return 'outputs';
+    if (WORKSPACE_ROOT_CATEGORIES.has(normalized)) {
+        return normalized;
+    }
+    return null;
+}
+function agentSpaceId(agentId) {
+    const record = getAgent(agentId);
+    const recordSpaceId = typeof record?.space_id === 'string' ? record.space_id.trim() : '';
+    return recordSpaceId || process.env.SUPEN_SPACE_ID || 'local';
+}
+function workspaceRootForAgent(agentId, root, knowledgeId) {
+    if (root === 'knowledge') {
+        if (knowledgeId) {
+            return resolveSpaceKnowledgeRoot(agentSpaceId(agentId), knowledgeId).root;
+        }
+        return agentPaths(agentId).workspace;
+    }
+    const space = spacePaths(agentSpaceId(agentId));
+    if (root === 'uploads')
+        return space.uploads;
+    if (root === 'outputs')
+        return space.outputs;
+    if (root === 'tasks')
+        return space.tasks;
+    return space.runtime;
+}
+function writeInvalidWorkspaceRoot(res) {
+    writeProtocolError(res, 400, 'input_error', 'invalid_workspace_root', 'root must be one of: knowledge, uploads, outputs, tasks.');
+}
+function buildSpaceLocalPath(req, tail) {
+    const spaceId = typeof req.headers['x-computer-id'] === 'string'
+        ? req.headers['x-computer-id'].trim()
+        : '';
+    const normalizedTail = tail.startsWith('/') ? tail : `/${tail}`;
+    return spaceId
+        ? `/api/computers/${encodeURIComponent(spaceId)}${normalizedTail}`
+        : `/api/computers/local${normalizedTail}`;
+}
+function buildRequestAbsoluteUrl(req, localPath) {
+    const configuredBaseUrl = ONLYOFFICE_SOURCE_BASE_URL.trim().replace(/\/+$/, '');
+    if (configuredBaseUrl)
+        return `${configuredBaseUrl}${localPath}`;
+    const forwardedProto = typeof req.headers['x-forwarded-proto'] === 'string'
+        ? req.headers['x-forwarded-proto'].split(',')[0]?.trim()
+        : '';
+    const proto = forwardedProto || (req.socket.encrypted ? 'https' : 'http');
+    const host = typeof req.headers['x-forwarded-host'] === 'string'
+        ? req.headers['x-forwarded-host'].split(',')[0]?.trim()
+        : req.headers.host;
+    if (!host)
+        throw new Error('Unable to build an absolute source URL for OnlyOffice conversion.');
+    return `${proto}://${host}${localPath}`;
+}
+export async function handleAgentsRoutes(req, res, url, pathname, method) {
+    const previewSessionMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/artifacts\/preview-session$/);
+    if (previewSessionMatch && method === 'POST') {
+        const agentId = decodeURIComponent(previewSessionMatch[1]);
+        const body = await readJsonBody(req);
+        const relPath = typeof body?.path === 'string' ? decodeURIComponent(body.path) : '';
+        const rootCategory = parseWorkspaceRootCategory(body?.root ?? url.searchParams.get('root'));
+        const knowledgeId = typeof body?.knowledge_id === 'string' ? body.knowledge_id : url.searchParams.get('knowledge_id');
+        if (!rootCategory) {
+            writeInvalidWorkspaceRoot(res);
+            return true;
+        }
+        if (!relPath) {
+            writeProtocolError(res, 400, 'input_error', 'path_required', 'path is required.');
+            return true;
+        }
+        const normalized = path.normalize(relPath);
+        if (normalized.startsWith('..') || path.isAbsolute(normalized)) {
+            writeProtocolError(res, 400, 'input_error', 'invalid_path', 'Invalid artifact path.');
+            return true;
+        }
+        const workspace = workspaceRootForAgent(agentId, rootCategory, knowledgeId);
+        const filePath = path.join(workspace, normalized);
+        if (!isPathWithin(workspace, filePath)) {
+            writeProtocolError(res, 403, 'input_error', 'path_outside_workspace', 'Path outside workspace.');
+            return true;
+        }
+        if (!fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
+            writeProtocolError(res, 404, 'input_error', 'not_found', 'Artifact file not found.');
+            return true;
+        }
+        if (!isOfficePreviewPath(filePath)) {
+            writeProtocolError(res, 400, 'input_error', 'unsupported_preview_type', 'Only Office files can use the office preview session.');
+            return true;
+        }
+        const requestedKind = typeof body?.kind === 'string' ? body.kind : url.searchParams.get('kind');
+        const extension = path.extname(filePath).slice(1).toLowerCase();
+        try {
+            if (requestedKind === 'spreadsheet' && extension === 'xls') {
+                const xlsxPath = await ensureSpreadsheetPreviewXlsx(agentId, `${rootCategory}:${normalized}`, filePath);
+                const token = issuePreviewToken(xlsxPath);
+                writeJson(res, 200, {
+                    kind: 'xlsx',
+                    previewUrl: buildSpaceLocalPath(req, `/agents/${encodeURIComponent(agentId)}/artifacts/preview-file?token=${encodeURIComponent(token)}`),
+                });
+                return true;
+            }
+            const sourceToken = issuePreviewToken(filePath);
+            const sourceLocalPath = buildSpaceLocalPath(req, `/agents/${encodeURIComponent(agentId)}/artifacts/preview-file?token=${encodeURIComponent(sourceToken)}`);
+            const sourceUrl = buildRequestAbsoluteUrl(req, sourceLocalPath);
+            const pdfPath = await ensureOfficePreviewPdf(agentId, `${rootCategory}:${normalized}`, filePath, sourceUrl);
+            const token = issuePreviewToken(pdfPath);
+            writeJson(res, 200, {
+                kind: 'pdf',
+                previewUrl: buildSpaceLocalPath(req, `/agents/${encodeURIComponent(agentId)}/artifacts/preview-file?token=${encodeURIComponent(token)}`),
+            });
+        }
+        catch (error) {
+            writeProtocolError(res, 503, 'internal_error', 'office_preview_unavailable', error?.message || 'Office preview is unavailable.');
+        }
+        return true;
+    }
+    const previewFileMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/artifacts\/preview-file$/);
+    if (previewFileMatch && (method === 'GET' || method === 'HEAD')) {
+        const token = url.searchParams.get('token') || '';
+        const resolved = resolvePreviewToken(token);
+        if (!resolved || !fs.existsSync(resolved.filePath)) {
+            writeProtocolError(res, 404, 'input_error', 'preview_not_found', 'Preview file not found or expired.');
+            return true;
+        }
+        const stat = fs.statSync(resolved.filePath);
+        const basename = path.basename(resolved.filePath);
+        res.writeHead(200, {
+            'Content-Type': resolved.mimeType,
+            'Content-Length': stat.size,
+            'Last-Modified': stat.mtime.toUTCString(),
+            'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+            'Pragma': 'no-cache',
+            'Expires': '0',
+            'Content-Disposition': `inline; filename="${basename}"`,
+        });
+        if (method === 'HEAD') {
+            res.end();
+            return true;
+        }
+        fs.createReadStream(resolved.filePath).pipe(res);
+        return true;
+    }
+    // ── Agents: List/Create ──
+    if (pathname === '/api/computer/agents' && method === 'GET') {
+        const agents = getAllAgents();
+        writeJson(res, 200, { agents });
+        return true;
+    }
+    if (pathname === '/api/computer/agents' && method === 'POST') {
+        const body = await readJsonBody(req);
+        const payload = (body && typeof body === 'object' && !Array.isArray(body) ? body : {});
+        const requestedId = typeof payload.agent_id === 'string'
+            ? payload.agent_id.trim()
+            : typeof payload.id === 'string'
+                ? payload.id.trim()
+                : '';
+        const requestedName = typeof payload.name === 'string' ? payload.name.trim() : '';
+        if (!requestedId && !requestedName) {
+            writeProtocolError(res, 400, 'input_error', 'missing_agent_id', 'Either "agent_id", "id", or "name" is required.');
+            return true;
+        }
+        let agentId = requestedId || slugifyAgentId(requestedName);
+        if (!agentId) {
+            writeProtocolError(res, 400, 'input_error', 'invalid_agent_id', 'Could not derive a valid agent_id from the provided payload.');
+            return true;
+        }
+        try {
+            agentId = ensurePathSafeAgentId(agentId);
+        }
+        catch {
+            writeProtocolError(res, 400, 'input_error', 'invalid_agent_id', 'agent_id contains invalid characters.');
+            return true;
+        }
+        const safeSpaceId = 'local';
+        const normalizedChannels = normalizeAgentChannels(payload.channels);
+        if (normalizedChannels === null) {
+            writeProtocolError(res, 400, 'input_error', 'invalid_channels', 'channels must be a mapping from channel name to boolean or string map.');
+            return true;
+        }
+        if (requestedId && getAgent(agentId)) {
+            writeProtocolError(res, 409, 'input_error', 'agent_exists', `Agent "${agentId}" already exists.`);
+            return true;
+        }
+        if (!requestedId) {
+            let suffix = 1;
+            while (getAgent(agentId)) {
+                suffix += 1;
+                try {
+                    agentId = ensurePathSafeAgentId(`${slugifyAgentId(requestedName)}-${suffix}`);
+                }
+                catch {
+                    agentId = `agent-${Date.now()}-${suffix}`;
+                }
+            }
+        }
+        const defaultSkillsConfig = normalizeAgentSkillsConfig('all', ['*']);
+        const created = createAgent({
+            agent_id: agentId,
+            space_id: safeSpaceId,
+            name: requestedName || agentId,
+            tags: Array.isArray(payload.tags)
+                ? payload.tags.filter((item) => typeof item === 'string')
+                : undefined,
+            channels: normalizedChannels,
+            skills: defaultSkillsConfig,
+        });
+        writeAgentSkillsAllowlist(agentId, diskAllowlistForConfig(defaultSkillsConfig));
+        writeJson(res, 200, { agent: created });
+        return true;
+    }
+    // ── Agents: Single Agent Operations ──
+    const agentMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)$/);
+    if (agentMatch) {
+        const agentId = decodeURIComponent(agentMatch[1]);
+        if (method === 'GET') {
+            const agent = getAgent(agentId);
+            if (!agent) {
+                writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+                return true;
+            }
+            writeJson(res, 200, { agent });
+            return true;
+        }
+        if (method === 'PATCH') {
+            const body = await readJsonBody(req);
+            const payload = (body && typeof body === 'object' && !Array.isArray(body)
+                ? body
+                : {});
+            if (Object.keys(payload).length === 0) {
+                writeProtocolError(res, 400, 'input_error', 'empty_payload', 'Payload is required for PATCH.');
+                return true;
+            }
+            if (payload.agent_id) {
+                writeProtocolError(res, 400, 'input_error', 'immutable_agent_id', 'agent_id is immutable.');
+                return true;
+            }
+            if (Object.prototype.hasOwnProperty.call(payload, 'space_id')) {
+                writeProtocolError(res, 400, 'input_error', 'immutable_space_id', 'space_id is immutable.');
+                return true;
+            }
+            const updates = {
+                ...payload,
+            };
+            if (Object.prototype.hasOwnProperty.call(payload, 'name')) {
+                if (typeof payload.name !== 'string' || !payload.name.trim()) {
+                    writeProtocolError(res, 400, 'input_error', 'invalid_agent_name', 'name must be a non-empty string.');
+                    return true;
+                }
+                updates.name = payload.name.trim();
+            }
+            if (Object.prototype.hasOwnProperty.call(payload, 'tags')) {
+                if (!Array.isArray(payload.tags) || payload.tags.some((tag) => typeof tag !== 'string')) {
+                    writeProtocolError(res, 400, 'input_error', 'invalid_tags', 'tags must be an array of strings.');
+                    return true;
+                }
+                updates.tags = payload.tags;
+            }
+            if (Object.prototype.hasOwnProperty.call(payload, 'channels')) {
+                const normalizedChannels = normalizeAgentChannels(payload.channels);
+                if (normalizedChannels === null) {
+                    writeProtocolError(res, 400, 'input_error', 'invalid_channels', 'channels must be a mapping from channel name to boolean or string map.');
+                    return true;
+                }
+                updates.channels = normalizedChannels;
+            }
+            const updated = updateAgent(agentId, updates);
+            if (!updated) {
+                writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+                return true;
+            }
+            writeJson(res, 200, { agent: updated });
+            return true;
+        }
+        if (method === 'DELETE') {
+            const removed = deleteAgent(agentId);
+            if (!removed) {
+                writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+                return true;
+            }
+            writeJson(res, 200, { ok: true, deleted: agentId });
+            return true;
+        }
+    }
+    // ── Agent Skills Assignment ──
+    const agentSkillsMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/skills$/);
+    if (agentSkillsMatch && method === 'POST') {
+        const agentId = decodeURIComponent(agentSkillsMatch[1]);
+        const existingAgent = getAgent(agentId);
+        if (!existingAgent) {
+            writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+            return true;
+        }
+        const body = await readJsonBody(req);
+        const payload = (body && typeof body === 'object' && !Array.isArray(body)
+            ? body
+            : {});
+        const modeRaw = typeof payload.mode === 'string' ? payload.mode.trim() : 'all';
+        const mode = modeRaw === 'all' || modeRaw === 'none' || modeRaw === 'custom'
+            ? modeRaw
+            : null;
+        if (!mode) {
+            writeProtocolError(res, 400, 'input_error', 'invalid_mode', 'mode must be one of: all, none, custom.');
+            return true;
+        }
+        const skillsConfig = normalizeAgentSkillsConfig(mode, payload.skills);
+        const updatedAgent = updateAgent(agentId, { skills: skillsConfig });
+        if (!updatedAgent) {
+            writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+            return true;
+        }
+        const agentBaseDir = getAgentBaseDir(agentId);
+        if (!agentBaseDir) {
+            writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+            return true;
+        }
+        writeAgentSkillsAllowlist(agentId, diskAllowlistForConfig(skillsConfig));
+        writeJson(res, 200, { ok: true, agent: updatedAgent });
+        return true;
+    }
+    const knowledgeRootsMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/workspace\/knowledge-roots$/);
+    if (knowledgeRootsMatch && method === 'GET') {
+        const agentId = decodeURIComponent(knowledgeRootsMatch[1]);
+        const space = spacePaths(agentSpaceId(agentId));
+        writeJson(res, 200, {
+            defaultId: space.knowledgeRoots.find((root) => root.isDefault)?.id ?? space.knowledgeRoots[0]?.id ?? null,
+            roots: space.knowledgeRoots.map((root) => ({
+                id: root.id,
+                name: root.name,
+                isDefault: root.isDefault,
+                mode: root.mode,
+                path: root.root,
+            })),
+        });
+        return true;
+    }
+    // ── Workspace file access ──
+    const workspaceV1Match = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/workspace(?:\/(.*))?$/);
+    if (workspaceV1Match && (method === 'GET' || method === 'HEAD' || method === 'PATCH' || method === 'DELETE')) {
+        const agentId = decodeURIComponent(workspaceV1Match[1]);
+        const relRaw = workspaceV1Match[2] ?? '.';
+        const relPath = decodeURIComponent(relRaw || '.') || '.';
+        const rootCategory = parseWorkspaceRootCategory(url.searchParams.get('root'));
+        const knowledgeId = url.searchParams.get('knowledge_id');
+        if (!rootCategory) {
+            writeInvalidWorkspaceRoot(res);
+            return true;
+        }
+        const normalized = path.normalize(relPath);
+        if (normalized.startsWith('..') || path.isAbsolute(normalized)) {
+            writeProtocolError(res, 400, 'input_error', 'invalid_path', 'Invalid path.');
+            return true;
+        }
+        const workspace = workspaceRootForAgent(agentId, rootCategory, knowledgeId);
+        fs.mkdirSync(workspace, { recursive: true });
+        const filePath = path.join(workspace, normalized);
+        if (!isPathWithin(workspace, filePath)) {
+            writeProtocolError(res, 403, 'input_error', 'path_outside_workspace', 'Path outside workspace.');
+            return true;
+        }
+        // Handle Deletion (PATCH with action: delete OR direct DELETE)
+        if (method === 'DELETE' || (method === 'PATCH')) {
+            const body = method === 'PATCH' ? await readJsonBody(req) : null;
+            const action = body?.action || (method === 'DELETE' ? 'delete' : null);
+            if (action === 'delete') {
+                if (!fs.existsSync(filePath)) {
+                    writeProtocolError(res, 404, 'input_error', 'not_found', 'Item not found.');
+                    return true;
+                }
+                try {
+                    fs.rmSync(filePath, { recursive: true, force: true });
+                    writeJson(res, 200, { ok: true, deleted: relPath });
+                }
+                catch (err) {
+                    writeProtocolError(res, 500, 'internal_error', 'delete_failed', err.message);
+                }
+                return true;
+            }
+            if (action === 'mkdir') {
+                try {
+                    fs.mkdirSync(filePath, { recursive: true });
+                    writeJson(res, 200, { ok: true, created: relPath });
+                }
+                catch (err) {
+                    writeProtocolError(res, 500, 'internal_error', 'mkdir_failed', err.message);
+                }
+                return true;
+            }
+            if (action === 'rename' || action === 'move') {
+                const nextName = body?.nextName;
+                if (!nextName) {
+                    writeProtocolError(res, 400, 'input_error', 'next_name_required', 'nextName is required.');
+                    return true;
+                }
+                const nextRelPath = path.normalize(nextName);
+                if (nextRelPath.startsWith('..') || path.isAbsolute(nextRelPath)) {
+                    writeProtocolError(res, 400, 'input_error', 'invalid_destination_path', 'Invalid destination path.');
+                    return true;
+                }
+                const destPath = path.join(workspace, nextRelPath);
+                if (!isPathWithin(workspace, destPath)) {
+                    writeProtocolError(res, 403, 'input_error', 'destination_outside_workspace', 'Destination outside workspace.');
+                    return true;
+                }
+                try {
+                    if (!fs.existsSync(filePath)) {
+                        writeProtocolError(res, 404, 'input_error', 'not_found', 'Source not found.');
+                        return true;
+                    }
+                    // Ensure directory exists for destination if moving
+                    fs.mkdirSync(path.dirname(destPath), { recursive: true });
+                    fs.renameSync(filePath, destPath);
+                    writeJson(res, 200, { ok: true, from: relPath, to: nextRelPath });
+                }
+                catch (err) {
+                    writeProtocolError(res, 500, 'internal_error', 'rename_failed', err.message);
+                }
+                return true;
+            }
+            if (method === 'PATCH') {
+                writeProtocolError(res, 400, 'input_error', 'invalid_action', `Unknown action: ${action}`);
+                return true;
+            }
+        }
+        if (!fs.existsSync(filePath)) {
+            writeProtocolError(res, 404, 'input_error', 'not_found', 'File not found.');
+            return true;
+        }
+        const stat = fs.statSync(filePath);
+        if (stat.isDirectory()) {
+            const entries = fs.readdirSync(filePath)
+                .filter((name) => !isHiddenWorkspaceEntry(rootCategory, name))
+                .map((name) => {
+                const entryPath = path.join(filePath, name);
+                const entryStat = fs.statSync(entryPath);
+                return {
+                    name,
+                    type: entryStat.isDirectory() ? 'directory' : 'file',
+                    size: entryStat.isDirectory() ? undefined : entryStat.size,
+                    modified: entryStat.mtime.toISOString(),
+                };
+            });
+            writeJson(res, 200, { path: relPath, root: rootCategory, entries });
+            return true;
+        }
+        const mime = inferMimeType(filePath);
+        const basename = path.basename(filePath);
+        const asciiName = basename.replace(/[^\x20-\x7E]/g, '_');
+        const encodedName = encodeURIComponent(basename).replace(/'/g, '%27');
+        const disposition = mime === 'application/octet-stream'
+            ? `attachment; filename="${asciiName}"; filename*=UTF-8''${encodedName}`
+            : 'inline';
+        res.writeHead(200, {
+            'Content-Type': mime,
+            'Content-Length': stat.size,
+            'Last-Modified': stat.mtime.toUTCString(),
+            'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+            'Pragma': 'no-cache',
+            'Expires': '0',
+            'Content-Disposition': disposition,
+        });
+        if (method === 'HEAD') {
+            res.end();
+            return true;
+        }
+        fs.createReadStream(filePath).pipe(res);
+        return true;
+    }
+    // ── Workspace file upload ──
+    const uploadV1Match = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/workspace\/upload$/);
+    if (uploadV1Match && method === 'POST') {
+        const agentId = decodeURIComponent(uploadV1Match[1]);
+        const reqBody = await readJsonBody(req);
+        if (!reqBody?.files || !Array.isArray(reqBody.files)) {
+            writeProtocolError(res, 400, 'input_error', 'files_required', 'Request body must contain files array.');
+            return true;
+        }
+        const rootCategory = parseWorkspaceRootCategory(reqBody?.root ?? url.searchParams.get('root'));
+        const knowledgeId = typeof reqBody?.knowledge_id === 'string' ? reqBody.knowledge_id : url.searchParams.get('knowledge_id');
+        if (!rootCategory) {
+            writeInvalidWorkspaceRoot(res);
+            return true;
+        }
+        const workspace = workspaceRootForAgent(agentId, rootCategory, knowledgeId);
+        const targetPath = reqBody.path ? path.normalize(reqBody.path) : '';
+        if (targetPath.startsWith('..') || path.isAbsolute(targetPath)) {
+            writeProtocolError(res, 400, 'input_error', 'invalid_upload_path', 'Invalid upload path.');
+            return true;
+        }
+        const uploadDir = path.join(workspace, targetPath || '.uploads');
+        const resolvedWorkspace = path.resolve(workspace);
+        const resolvedUploadDir = path.resolve(uploadDir);
+        if (resolvedUploadDir !== resolvedWorkspace && !resolvedUploadDir.startsWith(`${resolvedWorkspace}${path.sep}`)) {
+            writeProtocolError(res, 403, 'input_error', 'upload_path_outside_workspace', 'Upload path outside workspace.');
+            return true;
+        }
+        fs.mkdirSync(uploadDir, { recursive: true });
+        const uploadedFiles = [];
+        for (const file of reqBody.files) {
+            if (!file.name || !file.data)
+                continue;
+            const originalName = path.basename(file.name);
+            const content = Buffer.from(file.data, 'base64');
+            if (content.length > 50 * 1024 * 1024)
+                continue;
+            // If uploading to .uploads, we still use the UUID prefix to prevent collisions
+            // If uploading to a specific path, we might want to overwrite or prevent collision
+            // For now, let's keep consistency for .uploads, and use original name for custom paths
+            const destName = targetPath ? originalName : `${randomUUID().slice(0, 8)}-${originalName}`;
+            const destPath = path.join(uploadDir, destName);
+            fs.writeFileSync(destPath, content);
+            const supenPath = targetPath ? path.join(targetPath, destName) : `.uploads/${destName}`;
+            uploadedFiles.push({
+                name: originalName,
+                path: supenPath,
+                supenUrl: rootCategory === 'knowledge'
+                    ? `supen://workspace/${agentId}/${supenPath.replace(/\\/g, '/')}`
+                    : `supen://workspace/${agentId}/${rootCategory}/${supenPath.replace(/\\/g, '/')}`,
+                size: content.length,
+            });
+            logger.info({ agentId, root: rootCategory, destName, targetPath }, 'File uploaded to workspace');
+        }
+        writeJson(res, 200, { files: uploadedFiles });
+        return true;
+    }
+    // ── Mind Files ──
+    const mindFilesMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/mind$/);
+    if (mindFilesMatch && method === 'GET') {
+        const agentId = decodeURIComponent(mindFilesMatch[1]);
+        const baseDir = getAgentBaseDir(agentId);
+        if (!baseDir) {
+            writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+            return true;
+        }
+        const MIND_FILES = ['SOUL.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md'];
+        const files = {};
+        for (const name of MIND_FILES) {
+            const filePath = path.join(baseDir, name);
+            if (fs.existsSync(filePath)) {
+                files[name] = {
+                    content: fs.readFileSync(filePath, 'utf-8'),
+                    mtimeMs: fs.statSync(filePath).mtimeMs,
+                };
+            }
+        }
+        writeJson(res, 200, { files });
+        return true;
+    }
+    // ── Memory Roll ──
+    const memoryMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/memory$/);
+    if (memoryMatch && method === 'GET') {
+        const agentId = decodeURIComponent(memoryMatch[1]);
+        const baseDir = getAgentBaseDir(agentId);
+        if (!baseDir) {
+            writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+            return true;
+        }
+        const memoryPath = path.join(baseDir, 'MEMORY.md');
+        const memoryDir = path.join(baseDir, 'memory');
+        const coreMemory = fs.existsSync(memoryPath)
+            ? {
+                content: fs.readFileSync(memoryPath, 'utf-8'),
+                mtimeMs: fs.statSync(memoryPath).mtimeMs,
+            }
+            : null;
+        const roll = fs.existsSync(memoryDir)
+            ? fs
+                .readdirSync(memoryDir)
+                .filter((name) => name.endsWith('.md'))
+                .sort((a, b) => b.localeCompare(a))
+                .map((name) => {
+                const filePath = path.join(memoryDir, name);
+                const stat = fs.statSync(filePath);
+                return {
+                    id: name.slice(0, -3),
+                    content: fs.readFileSync(filePath, 'utf-8'),
+                    mtimeMs: stat.mtimeMs,
+                };
+            })
+            : [];
+        writeJson(res, 200, { core_memory: coreMemory, roll });
+        return true;
+    }
+    const memoryEntryMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/memory\/([^/]+)$/);
+    if (memoryEntryMatch && method === 'PUT') {
+        const agentId = decodeURIComponent(memoryEntryMatch[1]);
+        const entryId = assertSafePathSegment(decodeURIComponent(memoryEntryMatch[2]), 'memory_id');
+        const body = await readJsonBody(req);
+        const payload = (body && typeof body === 'object' && !Array.isArray(body)
+            ? body
+            : {});
+        const content = typeof payload.content === 'string' ? payload.content : null;
+        if (content === null) {
+            writeProtocolError(res, 400, 'input_error', 'invalid_content', 'content must be a string.');
+            return true;
+        }
+        const baseDir = getAgentBaseDir(agentId);
+        if (!baseDir) {
+            writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+            return true;
+        }
+        const targetPath = entryId === 'core'
+            ? path.join(baseDir, 'MEMORY.md')
+            : path.join(baseDir, 'memory', `${entryId}.md`);
+        fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+        fs.writeFileSync(targetPath, content, 'utf-8');
+        const stat = fs.statSync(targetPath);
+        writeJson(res, 200, {
+            ok: true,
+            entry: {
+                id: entryId,
+                content,
+                mtimeMs: stat.mtimeMs,
+            },
+        });
+        return true;
+    }
+    // ── Artifacts ──
+    const artifactsMatch = pathname.match(/^\/api\/computer\/agents\/([^/]+)\/artifacts$/);
+    if (artifactsMatch && method === 'GET') {
+        const agentId = decodeURIComponent(artifactsMatch[1]);
+        const baseDir = getAgentBaseDir(agentId);
+        if (!baseDir) {
+            writeProtocolError(res, 404, 'input_error', 'agent_not_found', `Agent "${agentId}" was not found.`);
+            return true;
+        }
+        const artifacts = {};
+        const walk = (dir) => {
+            if (!fs.existsSync(dir))
+                return;
+            for (const item of fs.readdirSync(dir)) {
+                if (isOsMetadataFile(item))
+                    continue;
+                const fp = path.join(dir, item);
+                if (fs.statSync(fp).isDirectory()) {
+                    if (item !== '.git' && item !== 'node_modules')
+                        walk(fp);
+                }
+                else {
+                    const rel = path.relative(baseDir, fp);
+                    const s = fs.statSync(fp);
+                    artifacts[rel] = { mime_type: inferMimeType(fp), size: s.size, mtimeMs: s.mtimeMs };
+                }
+            }
+        };
+        walk(baseDir);
+        writeJson(res, 200, { artifacts });
+        return true;
+    }
+    return false;
+}
+function ensurePathSafeAgentId(agentId) {
+    return assertSafePathSegment(agentId, 'agent_id');
+}
+function getAgentBaseDir(agentId) {
+    const storage = getAgentStorage(agentId);
+    if (!storage)
+        return null;
+    return storage.baseDir;
+}
+function slugifyAgentId(name) {
+    const slug = name
+        .trim()
+        .toLowerCase()
+        .replace(/\s+/g, '-')
+        .replace(/[^a-z0-9._-]+/g, '-')
+        .replace(/[-._]{2,}/g, '-')
+        .replace(/^[-._]+|[-._]+$/g, '');
+    return slug || 'agent';
+}
+function normalizeAgentChannels(input) {
+    if (input === undefined)
+        return undefined;
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const result = {};
+    for (const [channel, cfg] of Object.entries(input)) {
+        if (typeof channel !== 'string' || !channel.trim())
+            return null;
+        if (typeof cfg === 'boolean') {
+            result[channel] = cfg;
+            continue;
+        }
+        if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg))
+            return null;
+        const nested = {};
+        for (const [k, v] of Object.entries(cfg)) {
+            if (typeof v === 'string' || typeof v === 'boolean') {
+                nested[k] = v;
+            }
+        }
+        result[channel] = nested;
+    }
+    return result;
+}
+function writeAgentSkillsAllowlist(agentId, diskSkills) {
+    const agentBaseDir = getAgentBaseDir(agentId);
+    if (!agentBaseDir)
+        return;
+    const skillsPath = path.join(agentBaseDir, 'skills.json');
+    fs.mkdirSync(path.dirname(skillsPath), { recursive: true });
+    fs.writeFileSync(skillsPath, `${JSON.stringify(diskSkills, null, 2)}\n`, 'utf-8');
+}
+//# sourceMappingURL=agents.js.map