@swarmclawai/swarmclaw 0.4.5 → 0.5.0

package/src/app/api/openclaw/gateway/route.ts

@@ -0,0 +1,72 @@
+import { NextResponse } from 'next/server'
+import { ensureGatewayConnected, getGateway, disconnectGateway, manualConnect } from '@/lib/server/openclaw-gateway'
+
+/** POST — proxy an RPC call or perform gateway actions */
+export async function POST(req: Request) {
+  const body = await req.json()
+  const { method, params } = body as { method?: string; params?: Record<string, unknown> }
+  if (!method || typeof method !== 'string') {
+    return NextResponse.json({ error: 'Missing RPC method' }, { status: 400 })
+  }
+
+  // Gateway control actions
+  if (method === 'gateway.connect') {
+    try {
+      const url = (params?.url as string) || undefined
+      const token = (params?.token as string) || undefined
+      const ok = await manualConnect(url, token)
+      return NextResponse.json({ ok })
+    } catch (err: unknown) {
+      return NextResponse.json({ ok: false, error: err instanceof Error ? err.message : String(err) }, { status: 502 })
+    }
+  }
+
+  if (method === 'gateway.disconnect') {
+    disconnectGateway()
+    return NextResponse.json({ ok: true })
+  }
+
+  // Reload mode get/set
+  if (method === 'gateway.reload-mode.get') {
+    const gw = await ensureGatewayConnected()
+    if (!gw) return NextResponse.json({ error: 'Not connected' }, { status: 503 })
+    try {
+      const config = await gw.rpc('config.get') as Record<string, unknown> | undefined
+      const mode = (config as Record<string, unknown>)?.reloadMode ?? 'hot'
+      return NextResponse.json({ ok: true, result: mode })
+    } catch (err: unknown) {
+      return NextResponse.json({ error: err instanceof Error ? err.message : String(err) }, { status: 502 })
+    }
+  }
+
+  if (method === 'gateway.reload-mode.set') {
+    const gw = await ensureGatewayConnected()
+    if (!gw) return NextResponse.json({ error: 'Not connected' }, { status: 503 })
+    try {
+      await gw.rpc('config.set', { reloadMode: params?.mode })
+      return NextResponse.json({ ok: true })
+    } catch (err: unknown) {
+      return NextResponse.json({ error: err instanceof Error ? err.message : String(err) }, { status: 502 })
+    }
+  }
+
+  // General RPC proxy
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'OpenClaw gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    const result = await gw.rpc(method, params)
+    return NextResponse.json({ ok: true, result })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+/** GET — check gateway connection status */
+export async function GET() {
+  const gw = getGateway()
+  return NextResponse.json({ connected: !!gw?.connected })
+}

package/src/app/api/openclaw/history/route.ts

@@ -0,0 +1,109 @@
+import { NextResponse } from 'next/server'
+import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+import { mergeHistoryMessages, isValidSessionKey } from '@/lib/server/openclaw-history-merge'
+import { loadSessions, saveSessions } from '@/lib/server/storage'
+import { notify } from '@/lib/server/ws-hub'
+import type { GatewaySessionPreview } from '@/types'
+
+/**
+ * Extract a single session preview from the gateway response.
+ * The gateway may return:
+ *  - A map: { [sessionKey]: preview }
+ *  - An array: [preview, ...]
+ *  - A single object with sessionKey field
+ */
+function extractPreview(
+  raw: unknown,
+  sessionKey: string,
+): GatewaySessionPreview | undefined {
+  if (!raw || typeof raw !== 'object') return undefined
+
+  // Direct object with messages array
+  if ('messages' in (raw as Record<string, unknown>)) {
+    return raw as GatewaySessionPreview
+  }
+
+  // Map keyed by session key
+  const asMap = raw as Record<string, unknown>
+  if (asMap[sessionKey] && typeof asMap[sessionKey] === 'object') {
+    return asMap[sessionKey] as GatewaySessionPreview
+  }
+
+  // Array — find matching session
+  if (Array.isArray(raw)) {
+    return raw.find(
+      (p: unknown) =>
+        p && typeof p === 'object' && (p as GatewaySessionPreview).sessionKey === sessionKey,
+    ) as GatewaySessionPreview | undefined
+  }
+
+  return undefined
+}
+
+/** GET ?sessionKey=X — preview gateway session history */
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const sessionKey = searchParams.get('sessionKey')
+  if (!sessionKey || !isValidSessionKey(sessionKey)) {
+    return NextResponse.json({ error: 'Missing or invalid sessionKey' }, { status: 400 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    const raw = await gw.rpc('sessions.preview', { keys: [sessionKey], limit: 100 })
+    const preview = extractPreview(raw, sessionKey)
+    return NextResponse.json(preview ?? { sessionKey, epoch: 0, messages: [] })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+/** POST { sessionKey, epoch, localSessionId } — merge gateway history into local session */
+export async function POST(req: Request) {
+  const body = await req.json()
+  const { sessionKey, localSessionId } = body as {
+    sessionKey?: string
+    epoch?: number
+    localSessionId?: string
+  }
+  if (!sessionKey || !localSessionId) {
+    return NextResponse.json({ error: 'Missing sessionKey or localSessionId' }, { status: 400 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    const raw = await gw.rpc('sessions.preview', { keys: [sessionKey], limit: 100 })
+    const preview = extractPreview(raw, sessionKey)
+    if (!preview?.messages?.length) {
+      return NextResponse.json({ ok: true, merged: 0 })
+    }
+
+    const sessions = loadSessions()
+    const session = sessions[localSessionId]
+    if (!session) {
+      return NextResponse.json({ error: 'Local session not found' }, { status: 404 })
+    }
+
+    const merged = mergeHistoryMessages(session.messages, preview)
+    const newCount = merged.length - session.messages.length
+    session.messages = merged
+    session.lastActiveAt = Date.now()
+    sessions[localSessionId] = session
+    saveSessions(sessions)
+    notify('sessions')
+
+    return NextResponse.json({ ok: true, merged: newCount })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/openclaw/media/route.ts

@@ -0,0 +1,53 @@
+import { NextResponse } from 'next/server'
+import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+import { lookup } from 'mime-types'
+
+const MAX_SIZE = 25 * 1024 * 1024 // 25MB
+
+/** GET ?path=... — proxy agent files (images etc.) from gateway */
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const filePath = searchParams.get('path')
+  if (!filePath) {
+    return NextResponse.json({ error: 'Missing path' }, { status: 400 })
+  }
+
+  // Security: path must be under ~/.openclaw/
+  if (!filePath.includes('.openclaw') && !filePath.includes('.clawdbot')) {
+    return NextResponse.json({ error: 'Path not allowed' }, { status: 403 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    const result = await gw.rpc('files.read', { path: filePath }) as { content?: string; encoding?: string } | undefined
+    if (!result?.content) {
+      return NextResponse.json({ error: 'File not found' }, { status: 404 })
+    }
+
+    const isBase64 = result.encoding === 'base64'
+    const buf = isBase64
+      ? Buffer.from(result.content, 'base64')
+      : Buffer.from(result.content, 'utf-8')
+
+    if (buf.length > MAX_SIZE) {
+      return NextResponse.json({ error: 'File too large' }, { status: 413 })
+    }
+
+    const mimeType = lookup(filePath) || 'application/octet-stream'
+
+    return new NextResponse(buf, {
+      headers: {
+        'Content-Type': mimeType,
+        'Content-Length': String(buf.length),
+        'Cache-Control': 'public, max-age=300',
+      },
+    })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/openclaw/models/route.ts

@@ -0,0 +1,12 @@
+import { NextResponse } from 'next/server'
+import { fetchGatewayModelPolicy, buildAllowedModelKeys } from '@/lib/server/openclaw-models'
+
+/** GET — fetch allowed models for OpenClaw agents from gateway policy */
+export async function GET() {
+  const policy = await fetchGatewayModelPolicy()
+  const models = buildAllowedModelKeys(policy)
+  return NextResponse.json({
+    models: models ?? ['default'],
+    defaultModel: policy?.defaultModel ?? 'default',
+  })
+}

package/src/app/api/openclaw/permissions/route.ts

@@ -0,0 +1,39 @@
+import { NextResponse } from 'next/server'
+import type { PermissionPreset } from '@/types'
+import { getExecConfig } from '@/lib/server/openclaw-exec-config'
+import { resolvePresetFromConfig, applyPreset } from '@/lib/server/openclaw-permission-presets'
+
+/** GET ?agentId=X — resolve current permission preset */
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const agentId = searchParams.get('agentId')
+  if (!agentId) {
+    return NextResponse.json({ error: 'Missing agentId' }, { status: 400 })
+  }
+
+  try {
+    const snap = await getExecConfig(agentId)
+    const preset = resolvePresetFromConfig(snap.file)
+    return NextResponse.json({ preset, config: snap.file })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+/** PUT { agentId, preset } — apply a permission preset */
+export async function PUT(req: Request) {
+  const body = await req.json()
+  const { agentId, preset } = body as { agentId?: string; preset?: PermissionPreset }
+  if (!agentId || !preset) {
+    return NextResponse.json({ error: 'Missing agentId or preset' }, { status: 400 })
+  }
+
+  try {
+    await applyPreset(agentId, preset)
+    return NextResponse.json({ ok: true })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/openclaw/sandbox-env/route.ts

@@ -0,0 +1,69 @@
+import { NextResponse } from 'next/server'
+import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+
+/** GET — list available and allowed env keys for sandbox */
+export async function GET() {
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    // Get available keys from dotenv
+    const available = await gw.rpc('env.keys') as string[] | undefined
+
+    // Get current config to find allowed keys
+    const config = await gw.rpc('config.get') as Record<string, unknown> | undefined
+    const agents = (config as Record<string, unknown>)?.agents as Record<string, unknown> | undefined
+    const defaults = agents?.defaults as Record<string, unknown> | undefined
+    const sandbox = defaults?.sandbox as Record<string, unknown> | undefined
+    const docker = sandbox?.docker as Record<string, unknown> | undefined
+    const envList = docker?.env as string[] | undefined
+
+    // Parse allowed keys from ${KEY} format
+    const allowed = (envList ?? [])
+      .map((entry) => {
+        const m = entry.match(/^\$\{(.+)\}$/)
+        return m ? m[1] : entry
+      })
+
+    return NextResponse.json({ available: available ?? [], allowed })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+/** PUT { allowed: string[] } — update sandbox env allowlist */
+export async function PUT(req: Request) {
+  const body = await req.json()
+  const { allowed } = body as { allowed?: string[] }
+  if (!allowed || !Array.isArray(allowed)) {
+    return NextResponse.json({ error: 'Missing allowed array' }, { status: 400 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    // Format as ${KEY} for gateway config
+    const envEntries = allowed.map((key) => `\${${key}}`)
+
+    // Fetch current config hash for conflict detection
+    const config = await gw.rpc('config.get') as Record<string, unknown> | undefined
+    const configHash = (config as Record<string, unknown>)?._hash as string | undefined
+
+    await gw.rpc('config.set', {
+      key: 'agents.defaults.sandbox.docker.env',
+      value: envEntries,
+      baseHash: configHash,
+    })
+
+    return NextResponse.json({ ok: true })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/openclaw/skills/install/route.ts

@@ -0,0 +1,32 @@
+import { NextResponse } from 'next/server'
+import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+
+/** POST { name, installId, timeoutMs? } — install a skill via gateway */
+export async function POST(req: Request) {
+  const body = await req.json()
+  const { name, installId, timeoutMs } = body as {
+    name?: string
+    installId?: string
+    timeoutMs?: number
+  }
+  if (!name) {
+    return NextResponse.json({ error: 'Missing skill name' }, { status: 400 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    const result = await gw.rpc('skills.install', {
+      name,
+      installId,
+      timeoutMs: timeoutMs ?? 120_000,
+    }, (timeoutMs ?? 120_000) + 5_000)
+    return NextResponse.json({ ok: true, result })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/openclaw/skills/remove/route.ts

@@ -0,0 +1,24 @@
+import { NextResponse } from 'next/server'
+import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+
+/** POST { skillKey, source } — remove a skill via gateway */
+export async function POST(req: Request) {
+  const body = await req.json()
+  const { skillKey, source } = body as { skillKey?: string; source?: string }
+  if (!skillKey) {
+    return NextResponse.json({ error: 'Missing skillKey' }, { status: 400 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    await gw.rpc('skills.remove', { skillKey, source })
+    return NextResponse.json({ ok: true })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/openclaw/skills/route.ts

@@ -0,0 +1,82 @@
+import { NextResponse } from 'next/server'
+import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+import { loadAgents, saveAgents } from '@/lib/server/storage'
+import { notify } from '@/lib/server/ws-hub'
+import type { OpenClawSkillEntry, SkillAllowlistMode } from '@/types'
+
+/** GET ?agentId=X — fetch skills from gateway with eligibility */
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const agentId = searchParams.get('agentId')
+  if (!agentId) {
+    return NextResponse.json({ error: 'Missing agentId' }, { status: 400 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'OpenClaw gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    const result = await gw.rpc('skills.status', { agentId }) as OpenClawSkillEntry[] | undefined
+    return NextResponse.json(result ?? [])
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+/** PATCH { skillKey, enabled?, apiKey? } — update a skill's config on gateway */
+export async function PATCH(req: Request) {
+  const body = await req.json()
+  const { skillKey, enabled, apiKey } = body as {
+    skillKey?: string
+    enabled?: boolean
+    apiKey?: string
+  }
+  if (!skillKey) {
+    return NextResponse.json({ error: 'Missing skillKey' }, { status: 400 })
+  }
+
+  const gw = await ensureGatewayConnected()
+  if (!gw) {
+    return NextResponse.json({ error: 'Gateway not connected' }, { status: 503 })
+  }
+
+  try {
+    await gw.rpc('skills.update', { skillKey, enabled, apiKey })
+    return NextResponse.json({ ok: true })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+/** PUT { agentId, mode, allowedSkills } — save skill allowlist config to agent */
+export async function PUT(req: Request) {
+  const body = await req.json()
+  const { agentId, mode, allowedSkills } = body as {
+    agentId?: string
+    mode?: SkillAllowlistMode
+    allowedSkills?: string[]
+  }
+
+  if (!agentId || !mode) {
+    return NextResponse.json({ error: 'Missing agentId or mode' }, { status: 400 })
+  }
+
+  const agents = loadAgents({ includeTrashed: true })
+  const agent = agents[agentId]
+  if (!agent) {
+    return NextResponse.json({ error: 'Agent not found' }, { status: 404 })
+  }
+
+  agent.openclawSkillMode = mode
+  agent.openclawAllowedSkills = mode === 'selected' ? (allowedSkills ?? []) : undefined
+  agent.updatedAt = Date.now()
+  agents[agentId] = agent
+  saveAgents(agents)
+  notify('agents')
+
+  return NextResponse.json({ ok: true })
+}

package/src/app/api/openclaw/sync/route.ts

@@ -24,7 +24,8 @@ export async function POST(req: Request) {
 
     const results = await runSync({ action, types: validTypes })
     return NextResponse.json({ ok: true, results })
-  } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Sync failed' }, { status: 500 })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Sync failed'
+    return NextResponse.json({ error: message }, { status: 500 })
   }
 }

package/src/app/api/projects/[id]/route.ts

@@ -31,7 +31,7 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
   if (!deleteItem(ops, id)) return notFound()
 
   // Clear projectId from referencing entities
-  const clearProjectId = (load: () => Record<string, any>, save: (d: Record<string, any>) => void, topic: string) => {
+  const clearProjectId = (load: () => Record<string, Record<string, unknown>>, save: (d: Record<string, Record<string, unknown>>) => void, topic: string) => {
     const items = load()
     let changed = false
     for (const item of Object.values(items)) {

package/src/app/api/projects/route.ts

@@ -4,7 +4,7 @@ import { loadProjects, saveProjects } from '@/lib/server/storage'
 import { notify } from '@/lib/server/ws-hub'
 export const dynamic = 'force-dynamic'
 
-export async function GET(_req: Request) {
+export async function GET() {
   return NextResponse.json(loadProjects())
 }
 

package/src/app/api/secrets/[id]/route.ts

@@ -23,6 +23,6 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     return secret
   })
   if (!result) return notFound()
-  const { encryptedValue, ...safe } = result as Record<string, any>
+  const { encryptedValue, ...safe } = result as Record<string, unknown>
   return NextResponse.json(safe)
 }

package/src/app/api/sessions/[id]/edit-resend/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from 'next/server'
+import { loadSessions, saveSessions } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const body = await req.json() as { messageIndex: number; newText: string }
+  const sessions = loadSessions()
+  const session = sessions[id]
+  if (!session) return notFound()
+
+  const { messageIndex, newText } = body
+  if (typeof messageIndex !== 'number' || messageIndex < 0 || messageIndex >= session.messages.length) {
+    return NextResponse.json({ error: 'Invalid message index' }, { status: 400 })
+  }
+
+  // Truncate messages to messageIndex (discard that msg + everything after)
+  session.messages = session.messages.slice(0, messageIndex)
+  saveSessions(sessions)
+
+  return NextResponse.json({ message: newText })
+}

package/src/app/api/sessions/[id]/fork/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from 'next/server'
+import { randomUUID } from 'node:crypto'
+import { loadSessions, saveSessions } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const body = await req.json() as { messageIndex: number }
+  const sessions = loadSessions()
+  const source = sessions[id]
+  if (!source) return notFound()
+
+  const { messageIndex } = body
+  if (typeof messageIndex !== 'number' || messageIndex < 0 || messageIndex >= source.messages.length) {
+    return NextResponse.json({ error: 'Invalid message index' }, { status: 400 })
+  }
+
+  const now = Date.now()
+  const newId = randomUUID()
+  const forked = {
+    id: newId,
+    name: `Fork of ${source.name}`,
+    cwd: source.cwd,
+    user: source.user,
+    provider: source.provider,
+    model: source.model,
+    credentialId: source.credentialId ?? null,
+    fallbackCredentialIds: source.fallbackCredentialIds,
+    apiEndpoint: source.apiEndpoint ?? null,
+    claudeSessionId: null,
+    messages: source.messages.slice(0, messageIndex + 1),
+    createdAt: now,
+    lastActiveAt: now,
+    agentId: source.agentId ?? null,
+    parentSessionId: id,
+    tools: source.tools,
+    conversationTone: source.conversationTone,
+  }
+
+  sessions[newId] = forked
+  saveSessions(sessions)
+
+  return NextResponse.json(forked)
+}

package/src/app/api/sessions/[id]/messages/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import { loadSessions } from '@/lib/server/storage'
+import { loadSessions, saveSessions } from '@/lib/server/storage'
 import { notFound } from '@/lib/server/collection-helpers'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
@@ -8,3 +8,20 @@ export async function GET(_req: Request, { params }: { params: Promise<{ id: str
   if (!sessions[id]) return notFound()
   return NextResponse.json(sessions[id].messages)
 }
+
+export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const body = await req.json() as { messageIndex: number; bookmarked: boolean }
+  const sessions = loadSessions()
+  const session = sessions[id]
+  if (!session) return notFound()
+
+  const { messageIndex, bookmarked } = body
+  if (typeof messageIndex !== 'number' || messageIndex < 0 || messageIndex >= session.messages.length) {
+    return NextResponse.json({ error: 'Invalid message index' }, { status: 400 })
+  }
+
+  session.messages[messageIndex].bookmarked = bookmarked
+  saveSessions(sessions)
+  return NextResponse.json(session.messages[messageIndex])
+}