@swarmclawai/swarmclaw 0.2.0

package/src/app/api/sessions/[id]/messages/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from 'next/server'
+import { loadSessions } from '@/lib/server/storage'
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const sessions = loadSessions()
+  if (!sessions[id]) return new NextResponse(null, { status: 404 })
+  return NextResponse.json(sessions[id].messages)
+}

package/src/app/api/sessions/[id]/retry/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server'
+import { loadSessions, saveSessions } from '@/lib/server/storage'
+
+export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const sessions = loadSessions()
+  const session = sessions[id]
+  if (!session) return new NextResponse(null, { status: 404 })
+
+  const msgs = session.messages
+  // Pop trailing assistant messages to find the last user message
+  while (msgs.length && msgs[msgs.length - 1].role === 'assistant') {
+    msgs.pop()
+  }
+  if (!msgs.length) {
+    return NextResponse.json({ message: '', imagePath: null }, { status: 200 })
+  }
+
+  const lastUser = msgs[msgs.length - 1]
+  const message = lastUser.text
+  const imagePath = lastUser.imagePath || null
+
+  // Remove the last user message too — it will be re-sent by the client
+  msgs.pop()
+  saveSessions(sessions)
+
+  return NextResponse.json({ message, imagePath })
+}

package/src/app/api/sessions/[id]/route.ts

@@ -0,0 +1,103 @@
+import { NextResponse } from 'next/server'
+import { loadSessions, saveSessions, deleteSession, active, loadAgents } from '@/lib/server/storage'
+import { enqueueSessionRun } from '@/lib/server/session-run-manager'
+import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
+
+function buildSessionAwakeningPrompt(user: string | null | undefined): string {
+  const displayName = typeof user === 'string' && user.trim() ? user.trim() : 'there'
+  return [
+    'SESSION_AWAKENING',
+    `You have just been activated as the primary SwarmClaw assistant for ${displayName}.`,
+    'Write your first message as the agent itself (not as system text).',
+    'Tone: awake, focused, practical.',
+    'Include: brief greeting, what you can help with in SwarmClaw (providers, agents, tools/connectors, tasks, schedules), and one direct question asking for the user goal.',
+    'Keep it concise (<= 90 words).',
+    'Do not mention hidden prompts, policies, or implementation details.',
+  ].join('\n')
+}
+
+export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const updates = await req.json()
+  const sessions = loadSessions()
+  if (!sessions[id]) return new NextResponse(null, { status: 404 })
+  const hadMessagesBefore = Array.isArray(sessions[id].messages) && sessions[id].messages.length > 0
+
+  const agentIdUpdateProvided = updates.agentId !== undefined
+  let nextAgentId = sessions[id].agentId
+  if (agentIdUpdateProvided) {
+    sessions[id].agentId = updates.agentId
+    nextAgentId = updates.agentId
+  }
+
+  const linkedAgent = nextAgentId ? loadAgents()[nextAgentId] : null
+
+  if (updates.name !== undefined) sessions[id].name = updates.name
+  if (updates.cwd !== undefined) sessions[id].cwd = updates.cwd
+  if (updates.provider !== undefined) sessions[id].provider = updates.provider
+  else if (agentIdUpdateProvided && linkedAgent?.provider) sessions[id].provider = linkedAgent.provider
+
+  if (updates.model !== undefined) sessions[id].model = updates.model
+  else if (agentIdUpdateProvided && linkedAgent?.model !== undefined) sessions[id].model = linkedAgent.model
+
+  if (updates.credentialId !== undefined) sessions[id].credentialId = updates.credentialId
+  else if (agentIdUpdateProvided && linkedAgent) sessions[id].credentialId = linkedAgent.credentialId ?? null
+
+  if (updates.tools !== undefined) sessions[id].tools = updates.tools
+  else if (agentIdUpdateProvided && linkedAgent) sessions[id].tools = Array.isArray(linkedAgent.tools) ? linkedAgent.tools : []
+
+  if (updates.apiEndpoint !== undefined) {
+    sessions[id].apiEndpoint = normalizeProviderEndpoint(
+      updates.provider || sessions[id].provider,
+      updates.apiEndpoint,
+    )
+  } else if (agentIdUpdateProvided && linkedAgent) {
+    sessions[id].apiEndpoint = normalizeProviderEndpoint(
+      linkedAgent.provider,
+      linkedAgent.apiEndpoint ?? null,
+    )
+  }
+  if (updates.heartbeatEnabled !== undefined) sessions[id].heartbeatEnabled = updates.heartbeatEnabled
+  if (updates.heartbeatIntervalSec !== undefined) sessions[id].heartbeatIntervalSec = updates.heartbeatIntervalSec
+  if (updates.pinned !== undefined) sessions[id].pinned = !!updates.pinned
+  if (!Array.isArray(sessions[id].messages)) sessions[id].messages = []
+
+  const shouldKickoffAwakening = sessions[id].name === '__main__'
+    && agentIdUpdateProvided
+    && !!sessions[id].agentId
+    && !hadMessagesBefore
+    && sessions[id].messages.length === 0
+
+  saveSessions(sessions)
+
+  if (shouldKickoffAwakening) {
+    try {
+      enqueueSessionRun({
+        sessionId: id,
+        message: buildSessionAwakeningPrompt(sessions[id].user),
+        internal: true,
+        source: 'session-awakening',
+        mode: 'steer',
+        dedupeKey: `session-awakening:${id}`,
+      })
+    } catch {
+      // Best-effort kickoff only.
+    }
+  }
+
+  return NextResponse.json(sessions[id])
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const sessions = loadSessions()
+  if (sessions[id]?.name === '__main__') {
+    return new NextResponse('Cannot delete main chat session', { status: 403 })
+  }
+  if (active.has(id)) {
+    try { active.get(id).kill() } catch {}
+    active.delete(id)
+  }
+  deleteSession(id)
+  return new NextResponse('OK')
+}

package/src/app/api/sessions/[id]/stop/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from 'next/server'
+import { active } from '@/lib/server/storage'
+import { cancelSessionRuns } from '@/lib/server/session-run-manager'
+
+export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const cancel = cancelSessionRuns(id, 'Stopped by user')
+  if (active.has(id)) {
+    try { active.get(id).kill() } catch {}
+    active.delete(id)
+  }
+  return NextResponse.json({ ok: true, ...cancel })
+}

package/src/app/api/sessions/heartbeat/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server'
+import { disableAllSessionHeartbeats, loadSettings, saveSettings } from '@/lib/server/storage'
+import { cancelAllHeartbeatRuns } from '@/lib/server/session-run-manager'
+
+export async function POST(req: Request) {
+  const body = await req.json().catch(() => ({}))
+  const action = typeof body?.action === 'string' ? body.action : 'disable_all'
+  if (action !== 'disable_all') {
+    return NextResponse.json({ error: 'Unsupported action' }, { status: 400 })
+  }
+
+  const updatedSessions = disableAllSessionHeartbeats()
+  const settings = loadSettings()
+  if ((settings.heartbeatIntervalSec ?? 120) !== 0) {
+    settings.heartbeatIntervalSec = 0
+    saveSettings(settings)
+  }
+  const { cancelledQueued, abortedRunning } = cancelAllHeartbeatRuns('Heartbeat disabled via global switch')
+
+  return NextResponse.json({
+    ok: true,
+    updatedSessions,
+    cancelledQueued,
+    abortedRunning,
+  })
+}

package/src/app/api/sessions/route.ts

@@ -0,0 +1,85 @@
+import { NextResponse } from 'next/server'
+import crypto from 'crypto'
+import os from 'os'
+import path from 'path'
+import { loadSessions, saveSessions, deleteSession, active, loadAgents } from '@/lib/server/storage'
+import { getSessionRunState } from '@/lib/server/session-run-manager'
+import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
+
+export async function GET() {
+  const sessions = loadSessions()
+  for (const id of Object.keys(sessions)) {
+    const run = getSessionRunState(id)
+    sessions[id].active = active.has(id) || !!run.runningRunId
+    sessions[id].queuedCount = run.queueLength
+    sessions[id].currentRunId = run.runningRunId || null
+  }
+  return NextResponse.json(sessions)
+}
+
+export async function DELETE(req: Request) {
+  const { ids } = await req.json() as { ids: string[] }
+  if (!Array.isArray(ids) || !ids.length) {
+    return new NextResponse('Missing ids', { status: 400 })
+  }
+  const sessions = loadSessions()
+  for (const id of ids) {
+    if (sessions[id]?.name === '__main__') continue
+    if (active.has(id)) {
+      try { active.get(id).kill() } catch {}
+      active.delete(id)
+    }
+    deleteSession(id)
+  }
+  return NextResponse.json({ deleted: ids.length })
+}
+
+export async function POST(req: Request) {
+  const body = await req.json()
+  let cwd = (body.cwd || '').trim()
+  if (cwd.startsWith('~/')) cwd = path.join(os.homedir(), cwd.slice(2))
+  else if (cwd === '~' || !cwd) cwd = os.homedir()
+
+  const id = body.id || crypto.randomBytes(4).toString('hex')
+  const sessions = loadSessions()
+  const agent = body.agentId ? loadAgents()[body.agentId] : null
+  const requestedTools = Array.isArray(body.tools) ? body.tools : null
+  const resolvedTools = requestedTools ?? (Array.isArray(agent?.tools) ? agent.tools : [])
+
+  // If session with this ID already exists, return it as-is
+  if (body.id && sessions[id]) {
+    return NextResponse.json(sessions[id])
+  }
+
+  const sessionName = body.name || 'New Session'
+
+  sessions[id] = {
+    id, name: sessionName, cwd,
+    user: body.user || 'wayde',
+    provider: body.provider || agent?.provider || 'claude-cli',
+    model: body.model || agent?.model || '',
+    credentialId: body.credentialId || agent?.credentialId || null,
+    apiEndpoint: normalizeProviderEndpoint(
+      body.provider || agent?.provider || 'claude-cli',
+      body.apiEndpoint || agent?.apiEndpoint || null,
+    ),
+    claudeSessionId: null,
+    codexThreadId: null,
+    opencodeSessionId: null,
+    delegateResumeIds: {
+      claudeCode: null,
+      codex: null,
+      opencode: null,
+    },
+    messages: Array.isArray(body.messages) ? body.messages : [],
+    createdAt: Date.now(), lastActiveAt: Date.now(),
+    sessionType: body.sessionType || 'human',
+    agentId: body.agentId || null,
+    parentSessionId: body.parentSessionId || null,
+    tools: resolvedTools,
+    heartbeatEnabled: body.heartbeatEnabled ?? null,
+    heartbeatIntervalSec: body.heartbeatIntervalSec ?? null,
+  }
+  saveSessions(sessions)
+  return NextResponse.json(sessions[id])
+}

package/src/app/api/settings/route.ts

@@ -0,0 +1,58 @@
+import { NextResponse } from 'next/server'
+import { loadSettings, saveSettings } from '@/lib/server/storage'
+
+const MEMORY_DEPTH_MIN = 0
+const MEMORY_DEPTH_MAX = 12
+const MEMORY_PER_LOOKUP_MIN = 1
+const MEMORY_PER_LOOKUP_MAX = 200
+const MEMORY_LINKED_MIN = 0
+const MEMORY_LINKED_MAX = 1000
+
+function parseIntSetting(value: unknown, fallback: number, min: number, max: number): number {
+  const parsed = typeof value === 'number'
+    ? value
+    : typeof value === 'string'
+      ? Number.parseInt(value, 10)
+      : Number.NaN
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+export async function GET() {
+  return NextResponse.json(loadSettings())
+}
+
+export async function PUT(req: Request) {
+  const body = await req.json()
+  const settings = loadSettings()
+  Object.assign(settings, body)
+
+  const nextDepth = parseIntSetting(
+    settings.memoryReferenceDepth ?? settings.memoryMaxDepth,
+    3,
+    MEMORY_DEPTH_MIN,
+    MEMORY_DEPTH_MAX,
+  )
+  const nextPerLookup = parseIntSetting(
+    settings.maxMemoriesPerLookup ?? settings.memoryMaxPerLookup,
+    20,
+    MEMORY_PER_LOOKUP_MIN,
+    MEMORY_PER_LOOKUP_MAX,
+  )
+  const nextLinked = parseIntSetting(
+    settings.maxLinkedMemoriesExpanded,
+    60,
+    MEMORY_LINKED_MIN,
+    MEMORY_LINKED_MAX,
+  )
+
+  // Keep new and legacy keys synchronized for backward compatibility.
+  settings.memoryReferenceDepth = nextDepth
+  settings.memoryMaxDepth = nextDepth
+  settings.maxMemoriesPerLookup = nextPerLookup
+  settings.memoryMaxPerLookup = nextPerLookup
+  settings.maxLinkedMemoriesExpanded = nextLinked
+
+  saveSettings(settings)
+  return NextResponse.json(settings)
+}

package/src/app/api/setup/check-provider/route.ts

@@ -0,0 +1,326 @@
+import { NextResponse } from 'next/server'
+import { WebSocket } from 'ws'
+import { randomUUID } from 'crypto'
+import { loadCredentials, decryptKey } from '@/lib/server/storage'
+import { buildOpenClawConnectParams, getDeviceId } from '@/lib/providers/openclaw'
+
+type SetupProvider =
+  | 'openai'
+  | 'anthropic'
+  | 'google'
+  | 'deepseek'
+  | 'groq'
+  | 'together'
+  | 'mistral'
+  | 'xai'
+  | 'fireworks'
+  | 'ollama'
+  | 'openclaw'
+
+const OPENAI_COMPATIBLE_PROVIDER_INFO: Record<
+  'openai' | 'google' | 'deepseek' | 'groq' | 'together' | 'mistral' | 'xai' | 'fireworks',
+  { name: string; defaultEndpoint: string }
+> = {
+  openai: { name: 'OpenAI', defaultEndpoint: 'https://api.openai.com/v1' },
+  google: { name: 'Google Gemini', defaultEndpoint: 'https://generativelanguage.googleapis.com/v1beta/openai' },
+  deepseek: { name: 'DeepSeek', defaultEndpoint: 'https://api.deepseek.com/v1' },
+  groq: { name: 'Groq', defaultEndpoint: 'https://api.groq.com/openai/v1' },
+  together: { name: 'Together AI', defaultEndpoint: 'https://api.together.xyz/v1' },
+  mistral: { name: 'Mistral AI', defaultEndpoint: 'https://api.mistral.ai/v1' },
+  xai: { name: 'xAI (Grok)', defaultEndpoint: 'https://api.x.ai/v1' },
+  fireworks: { name: 'Fireworks AI', defaultEndpoint: 'https://api.fireworks.ai/inference/v1' },
+}
+
+interface SetupCheckBody {
+  provider?: string
+  apiKey?: string
+  credentialId?: string
+  endpoint?: string
+  model?: string
+}
+
+function clean(value: unknown): string {
+  return typeof value === 'string' ? value.trim() : ''
+}
+
+function parseBody(input: unknown): SetupCheckBody {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return {}
+  return input as SetupCheckBody
+}
+
+async function parseErrorMessage(res: Response, fallback: string): Promise<string> {
+  const text = await res.text().catch(() => '')
+  if (!text) return fallback
+  try {
+    const parsed = JSON.parse(text)
+    if (typeof parsed?.error?.message === 'string' && parsed.error.message.trim()) return parsed.error.message.trim()
+    if (typeof parsed?.error === 'string' && parsed.error.trim()) return parsed.error.trim()
+    if (typeof parsed?.message === 'string' && parsed.message.trim()) return parsed.message.trim()
+    if (typeof parsed?.detail === 'string' && parsed.detail.trim()) return parsed.detail.trim()
+  } catch {
+    // Non-JSON response body.
+  }
+  return text.slice(0, 300).trim() || fallback
+}
+
+async function checkOpenAiCompatible(
+  providerName: string,
+  apiKey: string,
+  endpointRaw: string,
+  defaultEndpoint: string,
+): Promise<{ ok: boolean; message: string; normalizedEndpoint: string }> {
+  const normalizedEndpoint = (endpointRaw || defaultEndpoint).replace(/\/+$/, '')
+  const res = await fetch(`${normalizedEndpoint}/models`, {
+    headers: {
+      authorization: `Bearer ${apiKey}`,
+    },
+    signal: AbortSignal.timeout(10_000),
+    cache: 'no-store',
+  })
+  if (!res.ok) {
+    const detail = await parseErrorMessage(res, `${providerName} returned ${res.status}.`)
+    return { ok: false, message: detail, normalizedEndpoint }
+  }
+  const payload = await res.json().catch(() => ({} as any))
+  const count = Array.isArray(payload?.data) ? payload.data.length : 0
+  return {
+    ok: true,
+    message: count > 0 ? `Connected to ${providerName}. ${count} model(s) available.` : `Connected to ${providerName}.`,
+    normalizedEndpoint,
+  }
+}
+
+async function checkAnthropic(apiKey: string, modelRaw: string): Promise<{ ok: boolean; message: string }> {
+  const model = modelRaw || 'claude-sonnet-4-6'
+  const res = await fetch('https://api.anthropic.com/v1/messages', {
+    method: 'POST',
+    headers: {
+      'x-api-key': apiKey,
+      'anthropic-version': '2023-06-01',
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify({
+      model,
+      max_tokens: 12,
+      messages: [{ role: 'user', content: 'Reply with ANTHROPIC_SETUP_OK' }],
+    }),
+    signal: AbortSignal.timeout(15_000),
+    cache: 'no-store',
+  })
+  if (!res.ok) {
+    const detail = await parseErrorMessage(res, `Anthropic returned ${res.status}.`)
+    return { ok: false, message: detail }
+  }
+  const payload = await res.json().catch(() => ({} as any))
+  const text = typeof payload?.content?.[0]?.text === 'string' ? payload.content[0].text : ''
+  return { ok: true, message: text ? `Connected to Anthropic. Sample: ${text.slice(0, 120)}` : 'Connected to Anthropic.' }
+}
+
+async function checkOllama(endpointRaw: string): Promise<{ ok: boolean; message: string; normalizedEndpoint: string; recommendedModel?: string }> {
+  const normalizedEndpoint = (endpointRaw || 'http://localhost:11434').replace(/\/+$/, '')
+  const res = await fetch(`${normalizedEndpoint}/api/tags`, {
+    signal: AbortSignal.timeout(8_000),
+    cache: 'no-store',
+  })
+  if (!res.ok) {
+    const detail = await parseErrorMessage(res, `Ollama returned ${res.status}.`)
+    return { ok: false, message: detail, normalizedEndpoint }
+  }
+  const payload = await res.json().catch(() => ({} as any))
+  const models = Array.isArray(payload?.models) ? payload.models : []
+  const firstModel = typeof models[0]?.name === 'string'
+    ? String(models[0].name).replace(/:latest$/, '')
+    : undefined
+  if (models.length === 0) {
+    return {
+      ok: true,
+      message: 'Connected to Ollama, but no models are installed yet. Run `ollama pull <model>` to add one.',
+      normalizedEndpoint,
+    }
+  }
+  return {
+    ok: true,
+    message: `Connected to Ollama. ${models.length} model(s) available.`,
+    normalizedEndpoint,
+    recommendedModel: firstModel,
+  }
+}
+
+function normalizeOpenClawUrl(raw: string): { httpUrl: string; wsUrl: string } {
+  let url = (raw || 'http://localhost:18789').replace(/\/+$/, '')
+  if (!/^(https?|wss?):\/\//i.test(url)) url = `http://${url}`
+  const httpUrl = url.replace(/^ws:/i, 'http:').replace(/^wss:/i, 'https:')
+  const wsUrl = httpUrl.replace(/^http:/i, 'ws:').replace(/^https:/i, 'wss:')
+  return { httpUrl, wsUrl }
+}
+
+async function checkOpenClaw(apiKey: string, endpointRaw: string): Promise<{ ok: boolean; message: string; normalizedEndpoint: string; deviceId?: string; errorCode?: string }> {
+  const { httpUrl: normalizedEndpoint, wsUrl } = normalizeOpenClawUrl(endpointRaw)
+  const token = apiKey || undefined
+  const deviceId = getDeviceId()
+
+  // Always connect with device auth — the gateway may accept token-only for
+  // the connect handshake but still require device identity for agent ops.
+  const result = await attemptOpenClawConnect(wsUrl, token, true)
+  if (result.ok) {
+    return { ok: true, message: 'Connected to OpenClaw gateway.', normalizedEndpoint, deviceId }
+  }
+  if (result.errorCode === 'PAIRING_REQUIRED') {
+    return {
+      ok: false,
+      errorCode: 'PAIRING_REQUIRED',
+      message: 'Device needs approval on your gateway.',
+      normalizedEndpoint,
+      deviceId,
+    }
+  }
+  if (result.errorCode === 'DEVICE_AUTH_INVALID') {
+    return {
+      ok: false,
+      errorCode: 'DEVICE_AUTH_INVALID',
+      message: 'Device signature rejected. Your gateway may be running a different protocol version.',
+      normalizedEndpoint,
+      deviceId,
+    }
+  }
+  return { ok: false, message: result.message, normalizedEndpoint, deviceId, errorCode: result.errorCode }
+}
+
+function attemptOpenClawConnect(
+  wsUrl: string,
+  token: string | undefined,
+  useDeviceAuth: boolean,
+): Promise<{ ok: boolean; message: string; errorCode?: string }> {
+  return new Promise((resolve) => {
+    let settled = false
+    const done = (result: { ok: boolean; message: string; errorCode?: string }) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      try { ws.close() } catch {}
+      resolve(result)
+    }
+
+    const timer = setTimeout(() => {
+      done({ ok: false, message: 'Connection timed out. Verify the gateway URL and network access.' })
+    }, 10_000)
+
+    const ws = new WebSocket(wsUrl)
+    let connectId: string | null = null
+
+    ws.on('message', (data) => {
+      try {
+        const msg = JSON.parse(data.toString())
+        if (msg.event === 'connect.challenge') {
+          connectId = randomUUID()
+          ws.send(JSON.stringify({
+            type: 'req',
+            id: connectId,
+            method: 'connect',
+            params: buildOpenClawConnectParams(token, msg.payload?.nonce, { useDeviceAuth }),
+          }))
+          return
+        }
+        if (msg.type === 'res' && msg.id === connectId) {
+          if (msg.ok) {
+            done({ ok: true, message: 'Connected.' })
+          } else {
+            const message = msg.error?.message || 'Gateway rejected the connection.'
+            // Extract error code from structured field or infer from message text
+            let errorCode = (msg.error?.details?.code ?? msg.error?.code) as string | undefined
+            if (!errorCode) {
+              const m = message.toLowerCase()
+              if (m.includes('pairing') || m.includes('not paired') || m.includes('pending approval')) errorCode = 'PAIRING_REQUIRED'
+              else if (m.includes('signature') || m.includes('device') || m.includes('identity')) errorCode = 'DEVICE_AUTH_INVALID'
+            }
+            done({ ok: false, message, errorCode })
+          }
+          return
+        }
+      } catch {
+        done({ ok: false, message: 'Unexpected response from gateway.' })
+      }
+    })
+
+    ws.on('error', (err) => {
+      done({ ok: false, message: `Connection failed: ${err.message}` })
+    })
+
+    ws.on('close', (code, reason) => {
+      if (code === 1008) {
+        done({ ok: false, message: `Unauthorized: ${reason?.toString() || 'invalid token'}` })
+      } else {
+        done({ ok: false, message: `Connection closed (${code})` })
+      }
+    })
+  })
+}
+
+export async function POST(req: Request) {
+  const body = parseBody(await req.json().catch(() => ({})))
+  const provider = clean(body.provider) as SetupProvider
+  let apiKey = clean(body.apiKey)
+  const credentialId = clean(body.credentialId)
+  const endpoint = clean(body.endpoint)
+  const model = clean(body.model)
+
+  // Resolve credentialId to an API key if no raw key was provided
+  if (!apiKey && credentialId) {
+    try {
+      const creds = loadCredentials()
+      const cred = creds[credentialId]
+      if (cred?.encryptedKey) {
+        apiKey = decryptKey(cred.encryptedKey)
+      }
+    } catch {
+      return NextResponse.json({ ok: false, message: 'Failed to decrypt credential.' }, { status: 500 })
+    }
+  }
+
+  if (!provider) {
+    return NextResponse.json({ ok: false, message: 'Provider is required.' }, { status: 400 })
+  }
+
+  try {
+    switch (provider) {
+      case 'openai': {
+        if (!apiKey) return NextResponse.json({ ok: false, message: 'OpenAI API key is required.' })
+        const info = OPENAI_COMPATIBLE_PROVIDER_INFO.openai
+        const result = await checkOpenAiCompatible(info.name, apiKey, endpoint, info.defaultEndpoint)
+        return NextResponse.json(result)
+      }
+      case 'anthropic': {
+        if (!apiKey) return NextResponse.json({ ok: false, message: 'Anthropic API key is required.' })
+        const result = await checkAnthropic(apiKey, model)
+        return NextResponse.json(result)
+      }
+      case 'google':
+      case 'deepseek':
+      case 'groq':
+      case 'together':
+      case 'mistral':
+      case 'xai':
+      case 'fireworks': {
+        const info = OPENAI_COMPATIBLE_PROVIDER_INFO[provider]
+        if (!apiKey) return NextResponse.json({ ok: false, message: `${info.name} API key is required.` })
+        const result = await checkOpenAiCompatible(info.name, apiKey, endpoint, info.defaultEndpoint)
+        return NextResponse.json(result)
+      }
+      case 'ollama': {
+        const result = await checkOllama(endpoint)
+        return NextResponse.json(result)
+      }
+      case 'openclaw': {
+        const result = await checkOpenClaw(apiKey, endpoint)
+        return NextResponse.json(result)
+      }
+      default:
+        return NextResponse.json({ ok: false, message: `Unsupported provider: ${provider}` }, { status: 400 })
+    }
+  } catch (err: any) {
+    const message = err?.name === 'TimeoutError'
+      ? 'Connection check timed out. Verify endpoint/network and try again.'
+      : (err?.message || 'Failed to validate provider setup.')
+    return NextResponse.json({ ok: false, message }, { status: 500 })
+  }
+}