@swarmclawai/swarmclaw 0.4.0 → 0.4.5

package/README.md

@@ -36,7 +36,7 @@ Inspired by [OpenClaw](https://github.com/openclaw).
 - **Loop Runtime Controls** — Switch between bounded and ongoing loops with configurable step caps, runtime guards, heartbeat cadence, and timeout budgets
 - **Session Run Queue** — Per-session queued runs with followup/steer/collect modes, collect coalescing for bursty inputs, and run-state APIs
 - **Voice Settings** — Per-instance ElevenLabs API key + voice ID for TTS replies, plus configurable speech recognition language for chat input
-- **Chat Connectors** — Bridge agents to Discord, Slack, Telegram, and WhatsApp with media-aware inbound handling
+- **Chat Connectors** — Bridge agents to Discord, Slack, Telegram, WhatsApp, BlueBubbles (iMessage), Signal, Microsoft Teams, Google Chat, Matrix, and OpenClaw with media-aware inbound handling
 - **Skills System** — Discover local skills, import skills from URL, and load OpenClaw `SKILL.md` files (frontmatter-compatible)
 - **Execution Logging** — Structured audit trail for triggers, tool calls, file ops, commits, and errors in a dedicated `logs.db`
 - **Context Management** — Auto-compaction of conversation history when approaching context limits, with manual `context_status` and `context_summarize` tools for agents
@@ -229,6 +229,12 @@ Bridge any agent to a chat platform:
 | Slack | @slack/bolt | Bot token + app token (Socket Mode) |
 | Telegram | grammy | Bot token from @BotFather |
 | WhatsApp | baileys | QR code pairing (shown in browser) |
+| BlueBubbles | Custom webhook bridge | Server URL + password/webhook secret |
+| Signal | signal-cli | `signal-cli` binary + linked phone |
+| Microsoft Teams | botbuilder | Bot Framework credentials + webhook ingress |
+| Google Chat | googleapis | Service account + webhook ingress |
+| Matrix | matrix-bot-sdk | Homeserver URL + access token |
+| OpenClaw | gateway protocol | OpenClaw connector credentials |
 
 Connector sessions preserve attachment visibility in chat context:
 - WhatsApp media is decoded and persisted to `/api/uploads/...` when possible
@@ -237,7 +243,12 @@ Connector sessions preserve attachment visibility in chat context:
 
 Agents automatically suppress replies to simple acknowledgments ("ok", "thanks", thumbs-up, etc.) via a `NO_MESSAGE` response — conversations feel natural without a forced reply to every message. This is handled at the connector layer, so agents can return `NO_MESSAGE` as their response content and the platform won't deliver anything to the channel.
 
-For proactive outreach, `connector_message_tool` supports text plus optional `imageUrl` / `fileUrl` / `mediaPath` (local file path) payloads. All four platforms (WhatsApp, Discord, Slack, Telegram) support local file sending via `mediaPath` with auto-detected MIME types.
+For proactive outreach, `connector_message_tool` supports text plus optional `imageUrl` / `fileUrl` / `mediaPath` (local file path) payloads. WhatsApp, Discord, Slack, and Telegram support local file sending via `mediaPath` with auto-detected MIME types.
+
+Connector ingress now also supports optional pairing/allowlist policy:
+- `dmPolicy: allowlist` blocks unknown senders until approved
+- `/pair` flow lets approved admins generate and approve pairing codes
+- `/think` command can set connector thread thinking level (`low`, `medium`, `high`)
 
 ## Agent Tools
 

package/next.config.ts

@@ -30,6 +30,14 @@ const nextConfig: NextConfig = {
     '127.0.0.1',
     '0.0.0.0',
   ],
+  async rewrites() {
+    return [
+      {
+        source: '/:view(agents|schedules|memory|tasks|secrets|providers|skills|connectors|webhooks|mcp-servers|knowledge|plugins|usage|runs|logs|settings|projects)',
+        destination: '/',
+      },
+    ]
+  },
 };
 
 export default nextConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmclawai/swarmclaw",
-  "version": "0.4.0",
+  "version": "0.4.5",
   "description": "Self-hosted AI agent orchestration dashboard — manage LLM providers, orchestrate agent swarms, schedule tasks, and bridge agents to chat platforms.",
   "license": "MIT",
   "repository": {
@@ -69,6 +69,7 @@
     "cron-parser": "^5.5.0",
     "cronstrue": "^3.12.0",
     "discord.js": "^14.25.1",
+    "exceljs": "^4.4.0",
     "grammy": "^1.40.0",
     "highlight.js": "^11.11.1",
     "lucide-react": "^0.574.0",

package/src/app/api/agents/[id]/route.ts

@@ -1,33 +1,32 @@
 import { NextResponse } from 'next/server'
 import { loadAgents, saveAgents, deleteAgent } from '@/lib/server/storage'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
-import { notify } from '@/lib/server/ws-hub'
+import { mutateItem, deleteItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const ops: CollectionOps<any> = { load: loadAgents, save: saveAgents, deleteFn: deleteAgent, topic: 'agents' }
 
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const body = await req.json()
-  const agents = loadAgents()
-  if (!agents[id]) return new NextResponse(null, { status: 404 })
-
-  Object.assign(agents[id], body, { updatedAt: Date.now() })
-  if (body.apiEndpoint !== undefined) {
-    agents[id].apiEndpoint = normalizeProviderEndpoint(
-      body.provider || agents[id].provider,
-      body.apiEndpoint,
-    )
-  }
-  delete (agents[id] as Record<string, unknown>).id // prevent id overwrite
-  agents[id].id = id
-  saveAgents(agents)
-  notify('agents')
-  return NextResponse.json(agents[id])
+  const result = mutateItem(ops, id, (agent) => {
+    Object.assign(agent, body, { updatedAt: Date.now() })
+    if (body.apiEndpoint !== undefined) {
+      agent.apiEndpoint = normalizeProviderEndpoint(
+        body.provider || agent.provider,
+        body.apiEndpoint,
+      )
+    }
+    delete (agent as Record<string, unknown>).id
+    agent.id = id
+    return agent
+  })
+  if (!result) return notFound()
+  return NextResponse.json(result)
 }
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const agents = loadAgents()
-  if (!agents[id]) return new NextResponse(null, { status: 404 })
-  deleteAgent(id)
-  notify('agents')
-  return NextResponse.json('ok')
+  if (!deleteItem(ops, id)) return notFound()
+  return NextResponse.json({ ok: true })
 }

package/src/app/api/agents/[id]/thread/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadAgents, saveAgents, loadSessions, saveSessions } from '@/lib/server/storage'
 import { WORKSPACE_DIR } from '@/lib/server/data-dir'
 
@@ -32,7 +32,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   }
 
   // Create a new thread session
-  const sessionId = `agent-thread-${agentId}-${crypto.randomBytes(4).toString('hex')}`
+  const sessionId = `agent-thread-${agentId}-${genId()}`
   const now = Date.now()
   const session = {
     id: sessionId,

package/src/app/api/agents/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadAgents, saveAgents } from '@/lib/server/storage'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
 import { notify } from '@/lib/server/ws-hub'
@@ -12,7 +12,7 @@ export async function GET(_req: Request) {
 
 export async function POST(req: Request) {
   const body = await req.json()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
   const now = Date.now()
   const agents = loadAgents()
   agents[id] = {
@@ -28,6 +28,7 @@ export async function POST(req: Request) {
     subAgentIds: body.subAgentIds || [],
     tools: body.tools || [],
     capabilities: body.capabilities || [],
+    thinkingLevel: body.thinkingLevel || undefined,
     createdAt: now,
     updatedAt: now,
   }

package/src/app/api/clawhub/install/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadSkills, saveSkills } from '@/lib/server/storage'
 import { fetchSkillContent } from '@/lib/server/clawhub-client'
 
@@ -20,7 +20,7 @@ export async function POST(req: Request) {
   }
 
   const skills = loadSkills()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
   skills[id] = {
     id,
     name,

package/src/app/api/connectors/[id]/route.ts

@@ -1,12 +1,13 @@
 import { NextResponse } from 'next/server'
 import { loadConnectors, saveConnectors } from '@/lib/server/storage'
 import { notify } from '@/lib/server/ws-hub'
+import { notFound } from '@/lib/server/collection-helpers'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const connectors = loadConnectors()
   const connector = connectors[id]
-  if (!connector) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connector) return notFound()
 
   // Merge runtime status and QR code
   try {
@@ -26,7 +27,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   const body = await req.json()
   const connectors = loadConnectors()
   const connector = connectors[id]
-  if (!connector) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connector) return notFound()
 
   // Handle start/stop/repair actions — these modify connector state internally,
   // so re-read from storage after to avoid overwriting with stale data
@@ -68,7 +69,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const connectors = loadConnectors()
-  if (!connectors[id]) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connectors[id]) return notFound()
 
   // Stop if running
   try {
@@ -76,6 +77,12 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
     await stopConnector(id)
   } catch { /* ignore */ }
 
+  // Clear persisted pairing state when connector is deleted.
+  try {
+    const { clearConnectorPairingState } = await import('@/lib/server/connectors/pairing')
+    clearConnectorPairingState(id)
+  } catch { /* ignore */ }
+
   delete connectors[id]
   saveConnectors(connectors)
   notify('connectors')

package/src/app/api/connectors/[id]/webhook/route.ts

@@ -0,0 +1,99 @@
+import { NextResponse } from 'next/server'
+import { loadConnectors } from '@/lib/server/storage'
+
+export const dynamic = 'force-dynamic'
+
+function readSecret(req: Request): string {
+  const url = new URL(req.url)
+  return (
+    req.headers.get('x-connector-secret')
+    || url.searchParams.get('secret')
+    || ''
+  ).trim()
+}
+
+function parseWebhookBody(rawBody: string): Record<string, unknown> {
+  const trimmed = rawBody.trim()
+  if (!trimmed) return {}
+
+  try {
+    const parsed = JSON.parse(trimmed)
+    if (Array.isArray(parsed)) return { data: parsed }
+    return parsed && typeof parsed === 'object' ? parsed as Record<string, unknown> : {}
+  } catch {
+    // Fall back to URL-encoded payloads used by some webhook providers.
+    const params = new URLSearchParams(rawBody)
+    const nested = params.get('payload') || params.get('data') || params.get('message') || ''
+    if (nested) {
+      try {
+        const parsedNested = JSON.parse(nested)
+        if (Array.isArray(parsedNested)) return { data: parsedNested }
+        return parsedNested && typeof parsedNested === 'object'
+          ? parsedNested as Record<string, unknown>
+          : {}
+      } catch {
+        // Ignore malformed nested JSON and return flat map below.
+      }
+    }
+    const out: Record<string, unknown> = {}
+    for (const [key, value] of params.entries()) out[key] = value
+    return out
+  }
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const connectors = loadConnectors()
+  const connector = connectors[id]
+  if (!connector) return NextResponse.json({ error: 'Connector not found' }, { status: 404 })
+
+  const requiredSecret = String(connector.config?.webhookSecret || '').trim()
+  if (requiredSecret && readSecret(req) !== requiredSecret) {
+    return NextResponse.json({ error: 'Invalid connector webhook secret' }, { status: 401 })
+  }
+
+  const rawBody = await req.text().catch(() => '')
+  const payload = parseWebhookBody(rawBody)
+
+  try {
+    if (connector.platform === 'teams') {
+      const handlerKey = `__swarmclaw_teams_handler_${connector.id}__`
+      const handler = (globalThis as any)[handlerKey]
+      if (typeof handler !== 'function') {
+        return NextResponse.json({ error: 'Teams connector is not running or not ready' }, { status: 409 })
+      }
+      await handler(payload)
+      return NextResponse.json({ ok: true })
+    }
+
+    if (connector.platform === 'googlechat') {
+      const handlerKey = `__swarmclaw_googlechat_handler_${connector.id}__`
+      const handler = (globalThis as any)[handlerKey]
+      if (typeof handler !== 'function') {
+        return NextResponse.json({ error: 'Google Chat connector is not running or not ready' }, { status: 409 })
+      }
+      const result = await handler(payload)
+      if (result && typeof result === 'object' && Object.keys(result).length > 0) {
+        return NextResponse.json(result)
+      }
+      return NextResponse.json({})
+    }
+
+    if (connector.platform === 'bluebubbles') {
+      const handlerKey = `__swarmclaw_bluebubbles_handler_${connector.id}__`
+      const handler = (globalThis as any)[handlerKey]
+      if (typeof handler !== 'function') {
+        return NextResponse.json({ error: 'BlueBubbles connector is not running or not ready' }, { status: 409 })
+      }
+      const result = await handler(payload)
+      if (result && typeof result === 'object' && Object.keys(result).length > 0) {
+        return NextResponse.json(result)
+      }
+      return NextResponse.json({})
+    }
+
+    return NextResponse.json({ error: `Platform "${connector.platform}" does not support connector webhook ingress.` }, { status: 400 })
+  } catch (err: any) {
+    return NextResponse.json({ error: err?.message || 'Webhook processing failed' }, { status: 500 })
+  }
+}

package/src/app/api/connectors/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadConnectors, saveConnectors } from '@/lib/server/storage'
 import { notify } from '@/lib/server/ws-hub'
 import type { Connector } from '@/types'
@@ -27,7 +27,7 @@ export async function GET(_req: Request) {
 export async function POST(req: Request) {
   const body = await req.json()
   const connectors = loadConnectors()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
 
   const connector: Connector = {
     id,
@@ -48,7 +48,10 @@ export async function POST(req: Request) {
   notify('connectors')
 
   // Auto-start if connector has credentials (or is WhatsApp which uses QR)
-  const hasCredentials = connector.platform === 'whatsapp' || connector.platform === 'openclaw' || !!connector.credentialId
+  const hasCredentials = connector.platform === 'whatsapp'
+    || connector.platform === 'openclaw'
+    || (connector.platform === 'bluebubbles' && (!!connector.credentialId || !!connector.config.password))
+    || !!connector.credentialId
   if (hasCredentials && body.autoStart !== false) {
     try {
       const { startConnector } = await import('@/lib/server/connectors/manager')

package/src/app/api/credentials/[id]/route.ts

@@ -1,11 +1,12 @@
 import { NextResponse } from 'next/server'
 import { loadCredentials, saveCredentials } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id: credId } = await params
   const creds = loadCredentials()
   if (!creds[credId]) {
-    return new NextResponse(null, { status: 404 })
+    return notFound()
   }
   delete creds[credId]
   saveCredentials(creds)

package/src/app/api/credentials/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadCredentials, saveCredentials, encryptKey } from '@/lib/server/storage'
 export const dynamic = 'force-dynamic'
 
@@ -18,7 +18,7 @@ export async function POST(req: Request) {
   if (!provider || !apiKey) {
     return NextResponse.json({ error: 'provider and apiKey are required' }, { status: 400 })
   }
-  const id = 'cred_' + crypto.randomBytes(6).toString('hex')
+  const id = 'cred_' + genId(6)
   const creds = loadCredentials()
   creds[id] = {
     id,

package/src/app/api/documents/route.ts

@@ -1,4 +1,4 @@
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { NextResponse } from 'next/server'
 import { loadDocuments, saveDocuments } from '@/lib/server/storage'
 
@@ -69,7 +69,7 @@ export async function POST(req: Request) {
   const body = await req.json().catch(() => ({}))
   const now = Date.now()
   const docs = loadDocuments()
-  const id = body.id || crypto.randomBytes(6).toString('hex')
+  const id = body.id || genId(6)
   const fileName = body.fileName || body.filename || ''
   const title = body.title || fileName || 'Untitled Document'
   const content = typeof body.content === 'string' ? body.content : ''

package/src/app/api/files/serve/route.ts

@@ -21,6 +21,14 @@ const MIME_MAP: Record<string, string> = {
   '.jsx': 'text/plain',
   '.py': 'text/plain',
   '.sh': 'text/plain',
+  '.pdf': 'application/pdf',
+  '.csv': 'text/csv',
+  '.xml': 'application/xml',
+  '.zip': 'application/zip',
+  '.doc': 'application/msword',
+  '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  '.xls': 'application/vnd.ms-excel',
+  '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
 }
 
 const MAX_SIZE = 10 * 1024 * 1024 // 10MB

package/src/app/api/knowledge/[id]/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server'
+import { notFound } from '@/lib/server/collection-helpers'
 import { getMemoryDb } from '@/lib/server/memory-db'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
@@ -6,7 +7,7 @@ export async function GET(_req: Request, { params }: { params: Promise<{ id: str
   const db = getMemoryDb()
   const entry = db.get(id)
   if (!entry || entry.category !== 'knowledge') {
-    return new NextResponse(null, { status: 404 })
+    return notFound()
   }
   return NextResponse.json(entry)
 }
@@ -16,7 +17,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   const db = getMemoryDb()
   const existing = db.get(id)
   if (!existing || existing.category !== 'knowledge') {
-    return new NextResponse(null, { status: 404 })
+    return notFound()
   }
 
   const body = await req.json().catch(() => null)
@@ -44,7 +45,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
 
   const updated = db.update(id, updates)
   if (!updated) {
-    return new NextResponse(null, { status: 404 })
+    return notFound()
   }
   return NextResponse.json(updated)
 }
@@ -54,7 +55,7 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
   const db = getMemoryDb()
   const existing = db.get(id)
   if (!existing || existing.category !== 'knowledge') {
-    return new NextResponse(null, { status: 404 })
+    return notFound()
   }
   db.delete(id)
   return NextResponse.json({ deleted: id })

package/src/app/api/knowledge/upload/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server'
 import fs from 'fs'
 import path from 'path'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { UPLOAD_DIR } from '@/lib/server/storage'
 
 const TEXT_EXTS = new Set([
@@ -40,7 +40,7 @@ export async function POST(req: Request) {
 
   // Save file to uploads
   if (!fs.existsSync(UPLOAD_DIR)) fs.mkdirSync(UPLOAD_DIR, { recursive: true })
-  const safeName = crypto.randomBytes(4).toString('hex') + '-' + filename.replace(/[^a-zA-Z0-9._-]/g, '_')
+  const safeName = genId() + '-' + filename.replace(/[^a-zA-Z0-9._-]/g, '_')
   const filePath = path.join(UPLOAD_DIR, safeName)
   fs.writeFileSync(filePath, buf)
 

package/src/app/api/mcp-servers/[id]/route.ts

@@ -1,32 +1,29 @@
 import { NextResponse } from 'next/server'
 import { loadMcpServers, saveMcpServers, deleteMcpServer } from '@/lib/server/storage'
+import { mutateItem, deleteItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const ops: CollectionOps<any> = { load: loadMcpServers, save: saveMcpServers, deleteFn: deleteMcpServer }
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const servers = loadMcpServers()
-  if (!servers[id]) return new NextResponse(null, { status: 404 })
+  if (!servers[id]) return notFound()
   return NextResponse.json(servers[id])
 }
 
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const body = await req.json()
-  const servers = loadMcpServers()
-  if (!servers[id]) return new NextResponse(null, { status: 404 })
-  servers[id] = {
-    ...servers[id],
-    ...body,
-    id,
-    updatedAt: Date.now(),
-  }
-  saveMcpServers(servers)
-  return NextResponse.json(servers[id])
+  const result = mutateItem(ops, id, (server) => ({
+    ...server, ...body, id, updatedAt: Date.now(),
+  }))
+  if (!result) return notFound()
+  return NextResponse.json(result)
 }
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const servers = loadMcpServers()
-  if (!servers[id]) return new NextResponse(null, { status: 404 })
-  deleteMcpServer(id)
+  if (!deleteItem(ops, id)) return notFound()
   return NextResponse.json({ deleted: id })
 }

package/src/app/api/mcp-servers/[id]/test/route.ts

@@ -1,12 +1,13 @@
 import { NextResponse } from 'next/server'
 import { loadMcpServers } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
 import { connectMcpServer, mcpToolsToLangChain, disconnectMcpServer } from '@/lib/server/mcp-client'
 
 export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const servers = loadMcpServers()
   const server = servers[id]
-  if (!server) return new NextResponse(null, { status: 404 })
+  if (!server) return notFound()
 
   try {
     const { client, transport } = await connectMcpServer(server)

package/src/app/api/mcp-servers/[id]/tools/route.ts

@@ -1,12 +1,13 @@
 import { NextResponse } from 'next/server'
 import { loadMcpServers } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
 import { connectMcpServer, disconnectMcpServer } from '@/lib/server/mcp-client'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const servers = loadMcpServers()
   const config = servers[id]
-  if (!config) return new NextResponse(null, { status: 404 })
+  if (!config) return notFound()
 
   let client: any
   let transport: any

package/src/app/api/mcp-servers/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadMcpServers, saveMcpServers } from '@/lib/server/storage'
 export const dynamic = 'force-dynamic'
 
@@ -11,7 +11,7 @@ export async function GET(_req: Request) {
 export async function POST(req: Request) {
   const body = await req.json()
   const servers = loadMcpServers()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
   servers[id] = {
     id,
     name: body.name,

package/src/app/api/memory/[id]/route.ts

@@ -1,6 +1,7 @@
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import fs from 'fs'
 import { NextResponse } from 'next/server'
+import { notFound } from '@/lib/server/collection-helpers'
 import { getMemoryDb, getMemoryLookupLimits, storeMemoryImageAsset, storeMemoryImageFromDataUrl } from '@/lib/server/memory-db'
 import { resolveLookupRequest } from '@/lib/server/memory-graph'
 import type { MemoryImage } from '@/types'
@@ -42,7 +43,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
 
   if (limits.maxDepth <= 0) {
     const entry = db.get(id)
-    if (!entry) return new NextResponse(null, { status: 404 })
+    if (!entry) return notFound()
     if (envelope) {
       return NextResponse.json({
         entries: [entry],
@@ -55,7 +56,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
   }
 
   const result = db.getWithLinked(id, limits.maxDepth, limits.maxPerLookup, limits.maxLinkedExpansion)
-  if (!result) return new NextResponse(null, { status: 404 })
+  if (!result) return notFound()
   if (envelope) return NextResponse.json(result)
   return NextResponse.json(result.entries)
 }
@@ -78,7 +79,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     const updated = linkAction === 'link'
       ? db.link(id, targetIds, true)
       : db.unlink(id, targetIds, true)
-    if (!updated) return new NextResponse(null, { status: 404 })
+    if (!updated) return notFound()
     return NextResponse.json(updated)
   }
 
@@ -90,7 +91,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     image = null
   } else if (inputImageDataUrl) {
     try {
-      image = await storeMemoryImageFromDataUrl(inputImageDataUrl, `${id}-${crypto.randomBytes(2).toString('hex')}`)
+      image = await storeMemoryImageFromDataUrl(inputImageDataUrl, `${id}-${genId(2)}`)
     } catch (err) {
       return NextResponse.json({ error: err instanceof Error ? err.message : 'Invalid image data URL' }, { status: 400 })
     }
@@ -99,7 +100,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
       return NextResponse.json({ error: `Image file not found: ${inputImagePath}` }, { status: 400 })
     }
     try {
-      image = await storeMemoryImageAsset(inputImagePath, `${id}-${crypto.randomBytes(2).toString('hex')}`)
+      image = await storeMemoryImageAsset(inputImagePath, `${id}-${genId(2)}`)
     } catch (err) {
       return NextResponse.json({ error: err instanceof Error ? err.message : 'Failed to store memory image' }, { status: 400 })
     }
@@ -114,7 +115,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
         ? String((image as { path: string }).path)
         : (typeof body.imagePath === 'string' ? body.imagePath : undefined),
   })
-  if (!entry) return new NextResponse(null, { status: 404 })
+  if (!entry) return notFound()
   return NextResponse.json(entry)
 }
 
@@ -122,5 +123,5 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
   const { id } = await params
   const db = getMemoryDb()
   db.delete(id)
-  return NextResponse.json('ok')
+  return NextResponse.json({ ok: true })
 }