@swarmclawai/swarmclaw 0.5.3 → 0.6.0

package/src/app/api/chatrooms/route.ts

@@ -0,0 +1,50 @@
+import { NextResponse } from 'next/server'
+import { genId } from '@/lib/id'
+import { loadChatrooms, saveChatrooms, loadAgents } from '@/lib/server/storage'
+import { notify } from '@/lib/server/ws-hub'
+import type { Chatroom, ChatroomMessage } from '@/types'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET() {
+  const chatrooms = loadChatrooms()
+  return NextResponse.json(chatrooms)
+}
+
+export async function POST(req: Request) {
+  const body = await req.json()
+  const chatrooms = loadChatrooms()
+  const id = genId()
+
+  const agentIds: string[] = Array.isArray(body.agentIds) ? body.agentIds : []
+  const now = Date.now()
+
+  // Generate join messages for initial agents
+  const agents = agentIds.length > 0 ? loadAgents() : {}
+  const joinMessages: ChatroomMessage[] = agentIds.map((agentId: string, i: number) => ({
+    id: genId(),
+    senderId: 'system',
+    senderName: 'System',
+    role: 'assistant',
+    text: `${agents[agentId]?.name || 'Unknown agent'} has joined the chat`,
+    mentions: [],
+    reactions: [],
+    time: now + i, // offset by 1ms so they sort in order
+  }))
+
+  const chatroom: Chatroom = {
+    id,
+    name: body.name || 'New Chatroom',
+    description: body.description || '',
+    agentIds,
+    messages: joinMessages,
+    createdAt: now,
+    updatedAt: now,
+  }
+
+  chatrooms[id] = chatroom
+  saveChatrooms(chatrooms)
+  notify('chatrooms')
+
+  return NextResponse.json(chatroom)
+}

package/src/app/api/credentials/route.ts

@@ -6,8 +6,8 @@ export const dynamic = 'force-dynamic'
 
 export async function GET(_req: Request) {
   const creds = loadCredentials()
-  const safe: Record<string, any> = {}
-  for (const [id, c] of Object.entries(creds) as [string, any][]) {
+  const safe: Record<string, Record<string, unknown>> = {}
+  for (const [id, c] of Object.entries(creds) as [string, Record<string, unknown>][]) {
     safe[id] = { id: c.id, provider: c.provider, name: c.name, createdAt: c.createdAt }
   }
   return NextResponse.json(safe)
@@ -28,6 +28,5 @@ export async function POST(req: Request) {
     createdAt: Date.now(),
   }
   saveCredentials(creds)
-  console.log(`[credentials] stored ${id} for ${provider}`)
   return NextResponse.json({ id, provider, name: creds[id].name, createdAt: creds[id].createdAt })
 }

package/src/app/api/knowledge/[id]/route.ts

@@ -25,7 +25,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     return NextResponse.json({ error: 'Invalid JSON body.' }, { status: 400 })
   }
 
-  const { title, content, tags } = body as Record<string, unknown>
+  const { title, content, tags, scope, agentIds } = body as Record<string, unknown>
 
   const updates: Record<string, unknown> = {}
   if (typeof title === 'string' && title.trim()) {
@@ -36,13 +36,24 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   }
 
   const existingMeta = (existing.metadata || {}) as Record<string, unknown>
+  const metaUpdates: Record<string, unknown> = { ...existingMeta }
+
   if (Array.isArray(tags)) {
     const normalizedTags = (tags as unknown[]).filter(
       (t): t is string => typeof t === 'string' && t.trim().length > 0,
     )
-    updates.metadata = { ...existingMeta, tags: normalizedTags }
+    metaUpdates.tags = normalizedTags
+  }
+
+  if (scope === 'global' || scope === 'agent') {
+    metaUpdates.scope = scope
+    metaUpdates.agentIds = scope === 'agent' && Array.isArray(agentIds)
+      ? (agentIds as unknown[]).filter((id): id is string => typeof id === 'string')
+      : []
   }
 
+  updates.metadata = metaUpdates
+
   const updated = db.update(id, updates)
   if (!updated) {
     return notFound()

package/src/app/api/knowledge/route.ts

@@ -25,7 +25,7 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: 'Invalid JSON body.' }, { status: 400 })
   }
 
-  const { title, content, tags } = body as Record<string, unknown>
+  const { title, content, tags, scope, agentIds } = body as Record<string, unknown>
 
   if (typeof title !== 'string' || !title.trim()) {
     return NextResponse.json({ error: 'title is required.' }, { status: 400 })
@@ -38,10 +38,17 @@ export async function POST(req: Request) {
     ? (tags as unknown[]).filter((t): t is string => typeof t === 'string' && t.trim().length > 0)
     : undefined
 
+  const normalizedScope = scope === 'agent' ? 'agent' as const : 'global' as const
+  const normalizedAgentIds = Array.isArray(agentIds)
+    ? (agentIds as unknown[]).filter((id): id is string => typeof id === 'string')
+    : []
+
   const entry = addKnowledge({
     title: title.trim(),
     content,
     tags: normalizedTags,
+    scope: normalizedScope,
+    agentIds: normalizedAgentIds,
   })
 
   return NextResponse.json(entry)

package/src/app/api/memory/route.ts

@@ -26,7 +26,13 @@ export async function GET(req: Request) {
   const requestedLimit = parseOptionalInt(searchParams.get('limit'))
   const requestedLinkedLimit = parseOptionalInt(searchParams.get('linkedLimit'))
 
+  const counts = searchParams.get('counts') === 'true'
   const db = getMemoryDb()
+
+  if (counts) {
+    return NextResponse.json(db.countsByAgent())
+  }
+
   const defaults = getMemoryLookupLimits()
   const limits = resolveLookupRequest(defaults, {
     depth: requestedDepth,
@@ -106,6 +112,8 @@ export async function POST(req: Request) {
     image: image as MemoryImage | null | undefined,
     imagePath: image && typeof image === 'object' && 'path' in image ? String((image as { path: string }).path) : null,
     linkedMemoryIds: body.linkedMemoryIds as string[] | undefined,
+    pinned: body.pinned === true,
+    sharedWith: Array.isArray(body.sharedWith) ? body.sharedWith as string[] : undefined,
   })
   return NextResponse.json(entry)
 }

package/src/app/api/notifications/route.ts

@@ -25,12 +25,16 @@ export async function GET(req: Request) {
 
 export async function POST(req: Request) {
   const body = (await req.json()) as Record<string, unknown>
+  const actionLabel = typeof body.actionLabel === 'string' ? body.actionLabel : undefined
+  const actionUrl = typeof body.actionUrl === 'string' ? body.actionUrl : undefined
   const id = genId()
   const notification: AppNotification = {
     id,
     type: (['info', 'success', 'warning', 'error'].includes(body.type as string) ? body.type : 'info') as AppNotification['type'],
     title: typeof body.title === 'string' ? body.title : 'Notification',
     message: typeof body.message === 'string' ? body.message : undefined,
+    actionLabel,
+    actionUrl,
     entityType: typeof body.entityType === 'string' ? body.entityType : undefined,
     entityId: typeof body.entityId === 'string' ? body.entityId : undefined,
     read: false,

package/src/app/api/orchestrator/run/route.ts

@@ -4,7 +4,7 @@ import { loadAgents, loadTasks, saveTasks } from '@/lib/server/storage'
 import { enqueueTask } from '@/lib/server/queue'
 
 export async function POST(req: Request) {
-  const { agentId, task } = await req.json()
+  const { agentId, task } = await req.json().catch(() => ({}))
   if (!agentId || !task) {
     return NextResponse.json({ error: 'agentId and task are required' }, { status: 400 })
   }

package/src/app/api/plugins/install/route.ts

@@ -49,9 +49,9 @@ export async function POST(req: Request) {
     fs.writeFileSync(dest, code, 'utf8')
 
     return NextResponse.json({ ok: true, filename: sanitized })
-  } catch (err: any) {
+  } catch (err: unknown) {
     return NextResponse.json(
-      { error: 'Failed to install plugin', message: err.message },
+      { error: 'Failed to install plugin', message: err instanceof Error ? err.message : String(err) },
       { status: 500 },
     )
   }

package/src/app/api/search/route.ts

@@ -9,11 +9,12 @@ import {
 } from '@/lib/server/storage'
 
 interface SearchResult {
-  type: 'task' | 'agent' | 'session' | 'schedule' | 'webhook' | 'skill'
+  type: 'task' | 'agent' | 'session' | 'schedule' | 'webhook' | 'skill' | 'message'
   id: string
   title: string
   description?: string
   status?: string
+  messageIndex?: number
 }
 
 const MAX_RESULTS = 20
@@ -49,6 +50,54 @@ function searchCollection(
   return results
 }
 
+function searchMessages(
+  sessions: Record<string, Record<string, unknown>>,
+  agents: Record<string, Record<string, unknown>>,
+  needle: string,
+): SearchResult[] {
+  const results: SearchResult[] = []
+  const MAX_MSG_RESULTS = 10
+  for (const [sessionId, session] of Object.entries(sessions)) {
+    if (results.length >= MAX_MSG_RESULTS) break
+    const messages = session.messages as Array<{ role: string; text: string; time?: number }> | undefined
+    if (!messages?.length) continue
+    const agentId = session.agentId as string | undefined
+    const agentName = agentId && agents[agentId] ? (agents[agentId].name as string) : undefined
+    const sessionName = (session.name as string) || 'Untitled'
+    for (let i = 0; i < messages.length; i++) {
+      if (results.length >= MAX_MSG_RESULTS) break
+      const msg = messages[i]
+      if (!msg?.text) continue
+      const idx = msg.text.toLowerCase().indexOf(needle)
+      if (idx === -1) continue
+      // Build snippet with context around match
+      const start = Math.max(0, idx - 30)
+      const end = Math.min(msg.text.length, idx + needle.length + 50)
+      const snippet = (start > 0 ? '...' : '') + msg.text.slice(start, end).replace(/\n/g, ' ') + (end < msg.text.length ? '...' : '')
+      const timeAgo = msg.time ? formatTimeAgo(msg.time) : ''
+      results.push({
+        type: 'message',
+        id: sessionId,
+        title: snippet,
+        description: [agentName || sessionName, timeAgo].filter(Boolean).join(' · '),
+        messageIndex: i,
+      })
+    }
+  }
+  return results
+}
+
+function formatTimeAgo(ts: number): string {
+  const diff = Date.now() - ts
+  const mins = Math.floor(diff / 60000)
+  if (mins < 1) return 'just now'
+  if (mins < 60) return `${mins}m ago`
+  const hours = Math.floor(mins / 60)
+  if (hours < 24) return `${hours}h ago`
+  const days = Math.floor(hours / 24)
+  return `${days}d ago`
+}
+
 export async function GET(req: Request) {
   const { searchParams } = new URL(req.url)
   const q = (searchParams.get('q') || '').trim().toLowerCase()
@@ -71,6 +120,7 @@ export async function GET(req: Request) {
     searchCollection(schedules, 'schedule', q, 'name', 'taskPrompt', 'status'),
     searchCollection(webhooks, 'webhook', q, 'name', 'source'),
     searchCollection(skills, 'skill', q, 'name', 'description'),
+    searchMessages(sessions, agents, q),
   ]
 
   // Proportional allocation across types

package/src/app/api/sessions/[id]/chat/route.ts

@@ -17,6 +17,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   const attachedFiles = Array.isArray(body.attachedFiles) ? body.attachedFiles.filter((f: unknown) => typeof f === 'string') as string[] : undefined
   const internal = body.internal === true
   const queueMode = normalizeQueueMode(body.queueMode, internal)
+  const replyToId = typeof body.replyToId === 'string' ? body.replyToId : undefined
 
   const hasFiles = !!(imagePath || imageUrl || (attachedFiles && attachedFiles.length > 0))
   if (!message.trim() && !hasFiles) {
@@ -46,6 +47,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
         source: internal ? 'heartbeat' : 'chat',
         mode: queueMode,
         onEvent: (ev) => writeEvent(ev as unknown as Record<string, unknown>),
+        replyToId,
       })
 
       log.info('chat', `Enqueued session run ${run.runId}`, {

package/src/app/api/sessions/[id]/edit-resend/route.ts

@@ -4,7 +4,7 @@ import { notFound } from '@/lib/server/collection-helpers'
 
 export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const body = await req.json() as { messageIndex: number; newText: string }
+  const body = await req.json().catch(() => ({})) as { messageIndex: number; newText: string }
   const sessions = loadSessions()
   const session = sessions[id]
   if (!session) return notFound()

package/src/app/api/sessions/[id]/fork/route.ts

@@ -5,7 +5,7 @@ import { notFound } from '@/lib/server/collection-helpers'
 
 export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const body = await req.json() as { messageIndex: number }
+  const body = await req.json().catch(() => ({})) as { messageIndex: number }
   const sessions = loadSessions()
   const source = sessions[id]
   if (!source) return notFound()

package/src/app/api/sessions/route.ts

@@ -23,7 +23,7 @@ export async function GET(_req: Request) {
 }
 
 export async function DELETE(req: Request) {
-  const { ids } = await req.json() as { ids: string[] }
+  const { ids } = await req.json().catch(() => ({ ids: [] })) as { ids: string[] }
   if (!Array.isArray(ids) || !ids.length) {
     return new NextResponse('Missing ids', { status: 400 })
   }
@@ -43,7 +43,7 @@ export async function DELETE(req: Request) {
 }
 
 export async function POST(req: Request) {
-  const body = await req.json()
+  const body = await req.json().catch(() => ({}))
   let cwd = (body.cwd || '').trim()
   if (cwd.startsWith('~/')) cwd = path.join(os.homedir(), cwd.slice(2))
   else if (cwd === '~') cwd = os.homedir()
@@ -64,7 +64,7 @@ export async function POST(req: Request) {
 
   sessions[id] = {
     id, name: sessionName, cwd,
-    user: body.user || 'wayde',
+    user: body.user || 'user',
     provider: body.provider || agent?.provider || 'claude-cli',
     model: body.model || agent?.model || '',
     credentialId: body.credentialId || agent?.credentialId || null,

package/src/app/api/settings/route.ts

@@ -56,5 +56,14 @@ export async function PUT(req: Request) {
   settings.maxLinkedMemoriesExpanded = nextLinked
 
   saveSettings(settings)
+
+  // Restart heartbeat service when heartbeat-related settings change
+  const heartbeatKeys = ['heartbeatIntervalSec', 'heartbeatInterval', 'heartbeatPrompt', 'heartbeatEnabled', 'heartbeatActiveStart', 'heartbeatActiveEnd']
+  if (heartbeatKeys.some((k) => k in body)) {
+    import('@/lib/server/heartbeat-service').then(({ restartHeartbeatService }) => {
+      restartHeartbeatService()
+    }).catch(() => { /* heartbeat service may not be initialized yet */ })
+  }
+
   return NextResponse.json(settings)
 }

package/src/app/api/setup/check-provider/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { loadCredentials, decryptKey } from '@/lib/server/storage'
 import { getDeviceId, wsConnect } from '@/lib/providers/openclaw'
+import { OPENAI_COMPATIBLE_DEFAULTS } from '@/lib/server/provider-health'
 
 type SetupProvider =
   | 'openai'
@@ -15,20 +16,6 @@ type SetupProvider =
   | 'ollama'
   | 'openclaw'
 
-const OPENAI_COMPATIBLE_PROVIDER_INFO: Record<
-  'openai' | 'google' | 'deepseek' | 'groq' | 'together' | 'mistral' | 'xai' | 'fireworks',
-  { name: string; defaultEndpoint: string }
-> = {
-  openai: { name: 'OpenAI', defaultEndpoint: 'https://api.openai.com/v1' },
-  google: { name: 'Google Gemini', defaultEndpoint: 'https://generativelanguage.googleapis.com/v1beta/openai' },
-  deepseek: { name: 'DeepSeek', defaultEndpoint: 'https://api.deepseek.com/v1' },
-  groq: { name: 'Groq', defaultEndpoint: 'https://api.groq.com/openai/v1' },
-  together: { name: 'Together AI', defaultEndpoint: 'https://api.together.xyz/v1' },
-  mistral: { name: 'Mistral AI', defaultEndpoint: 'https://api.mistral.ai/v1' },
-  xai: { name: 'xAI (Grok)', defaultEndpoint: 'https://api.x.ai/v1' },
-  fireworks: { name: 'Fireworks AI', defaultEndpoint: 'https://api.fireworks.ai/inference/v1' },
-}
-
 interface SetupCheckBody {
   provider?: string
   apiKey?: string
@@ -196,7 +183,7 @@ export async function POST(req: Request) {
     switch (provider) {
       case 'openai': {
         if (!apiKey) return NextResponse.json({ ok: false, message: 'OpenAI API key is required.' })
-        const info = OPENAI_COMPATIBLE_PROVIDER_INFO.openai
+        const info = OPENAI_COMPATIBLE_DEFAULTS.openai
         const result = await checkOpenAiCompatible(info.name, apiKey, endpoint, info.defaultEndpoint)
         return NextResponse.json(result)
       }
@@ -212,7 +199,7 @@ export async function POST(req: Request) {
       case 'mistral':
       case 'xai':
       case 'fireworks': {
-        const info = OPENAI_COMPATIBLE_PROVIDER_INFO[provider]
+        const info = OPENAI_COMPATIBLE_DEFAULTS[provider]
         if (!apiKey) return NextResponse.json({ ok: false, message: `${info.name} API key is required.` })
         const result = await checkOpenAiCompatible(info.name, apiKey, endpoint, info.defaultEndpoint)
         return NextResponse.json(result)

package/src/app/api/skills/[id]/route.ts

@@ -18,6 +18,10 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   const body = await req.json()
   const result = mutateItem(ops, id, (skill) => {
     const normalized = normalizeSkillPayload({ ...skill, ...body })
+    const updatedScope = body.scope === 'agent' ? 'agent' as const : body.scope === 'global' ? 'global' as const : skill.scope
+    const updatedAgentIds = updatedScope === 'agent' && Array.isArray(body.agentIds)
+      ? (body.agentIds as unknown[]).filter((aid): aid is string => typeof aid === 'string')
+      : updatedScope === 'agent' ? (skill.agentIds || []) : []
     return {
       ...skill,
       ...body,
@@ -27,6 +31,8 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
       content: normalized.content,
       sourceUrl: normalized.sourceUrl,
       sourceFormat: normalized.sourceFormat,
+      scope: updatedScope,
+      agentIds: updatedAgentIds,
       id,
       updatedAt: Date.now(),
     }

package/src/app/api/skills/route.ts

@@ -14,6 +14,10 @@ export async function POST(req: Request) {
   const skills = loadSkills()
   const id = genId()
   const normalized = normalizeSkillPayload(body)
+  const scope = body.scope === 'agent' ? 'agent' as const : 'global' as const
+  const agentIds = scope === 'agent' && Array.isArray(body.agentIds)
+    ? (body.agentIds as unknown[]).filter((id): id is string => typeof id === 'string')
+    : []
   skills[id] = {
     id,
     name: normalized.name,
@@ -22,6 +26,8 @@ export async function POST(req: Request) {
     description: normalized.description || '',
     sourceUrl: normalized.sourceUrl,
     sourceFormat: normalized.sourceFormat,
+    scope,
+    agentIds,
     createdAt: Date.now(),
     updatedAt: Date.now(),
   }

package/src/app/api/tasks/[id]/route.ts

@@ -8,6 +8,8 @@ import { formatValidationFailure, validateTaskCompletion } from '@/lib/server/ta
 import { pushMainLoopEventToMainSessions } from '@/lib/server/main-agent-loop'
 import { notify } from '@/lib/server/ws-hub'
 import { createNotification } from '@/lib/server/create-notification'
+import { enqueueSystemEvent } from '@/lib/server/system-events'
+import { requestHeartbeatNow } from '@/lib/server/heartbeat-wake'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   // Keep completed queue integrity even if daemon is not running.
@@ -34,6 +36,8 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     tasks[id].updatedAt = Date.now()
   } else {
     Object.assign(tasks[id], body, { updatedAt: Date.now() })
+    // Explicitly clear nullable fields when sent as null (Object.assign copies null but not undefined)
+    if (body.projectId === null) delete tasks[id].projectId
   }
   tasks[id].id = id // prevent id overwrite
 
@@ -84,6 +88,14 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
       entityType: 'task',
       entityId: id,
     })
+
+    // Enqueue system event + heartbeat wake
+    if (tasks[id].sessionId) {
+      enqueueSystemEvent(tasks[id].sessionId, `Task ${tasks[id].status}: ${tasks[id].title}`)
+    }
+    if (tasks[id].agentId) {
+      requestHeartbeatNow({ agentId: tasks[id].agentId, reason: 'task-completed' })
+    }
   }
 
   // Dependency check: cannot queue a task if any blocker is incomplete

package/src/app/api/tasks/bulk/route.ts

@@ -0,0 +1,100 @@
+import { NextResponse } from 'next/server'
+import { loadTasks, saveTasks, logActivity } from '@/lib/server/storage'
+import { enqueueTask, disableSessionHeartbeat } from '@/lib/server/queue'
+import { pushMainLoopEventToMainSessions } from '@/lib/server/main-agent-loop'
+import { notify } from '@/lib/server/ws-hub'
+import { createNotification } from '@/lib/server/create-notification'
+import type { BoardTaskStatus } from '@/types'
+
+const VALID_STATUSES: BoardTaskStatus[] = ['backlog', 'queued', 'running', 'completed', 'failed', 'archived']
+
+/**
+ * Bulk update tasks — batch status changes, agent/project reassignment, or archive/delete.
+ *
+ * POST body:
+ *   ids: string[]                — required, task IDs to update
+ *   status?: BoardTaskStatus     — move all to this status
+ *   agentId?: string | null      — reassign agent (null to clear)
+ *   projectId?: string | null    — reassign project (null to clear)
+ */
+export async function POST(req: Request) {
+  const body = await req.json()
+  const ids: unknown = body.ids
+  if (!Array.isArray(ids) || ids.length === 0) {
+    return NextResponse.json({ error: 'ids must be a non-empty array' }, { status: 400 })
+  }
+
+  const taskIds = ids.filter((id): id is string => typeof id === 'string')
+  if (taskIds.length === 0) {
+    return NextResponse.json({ error: 'No valid task IDs provided' }, { status: 400 })
+  }
+
+  const tasks = loadTasks()
+  let updated = 0
+  const results: string[] = []
+
+  for (const id of taskIds) {
+    if (!tasks[id]) continue
+    const prevStatus = tasks[id].status
+
+    if (typeof body.status === 'string' && VALID_STATUSES.includes(body.status as BoardTaskStatus)) {
+      tasks[id].status = body.status as BoardTaskStatus
+      if (body.status === 'archived' && prevStatus !== 'archived') {
+        tasks[id].archivedAt = Date.now()
+      }
+    }
+
+    if ('agentId' in body) {
+      tasks[id].agentId = body.agentId === null ? '' : String(body.agentId)
+    }
+
+    if ('projectId' in body) {
+      if (body.projectId === null) {
+        delete tasks[id].projectId
+      } else {
+        tasks[id].projectId = String(body.projectId)
+      }
+    }
+
+    tasks[id].updatedAt = Date.now()
+    updated++
+    results.push(id)
+
+    // Side-effects for status transitions
+    if (prevStatus !== tasks[id].status) {
+      logActivity({
+        entityType: 'task',
+        entityId: id,
+        action: 'updated',
+        actor: 'user',
+        summary: `Bulk update: "${tasks[id].title}" (${prevStatus} → ${tasks[id].status})`,
+      })
+      pushMainLoopEventToMainSessions({
+        type: 'task_status_changed',
+        text: `Task "${tasks[id].title}" (${id}) moved ${prevStatus} → ${tasks[id].status}.`,
+      })
+      if (tasks[id].status === 'completed' || tasks[id].status === 'failed') {
+        disableSessionHeartbeat(tasks[id].sessionId)
+      }
+      if (prevStatus !== 'queued' && tasks[id].status === 'queued') {
+        enqueueTask(id)
+      }
+    }
+  }
+
+  saveTasks(tasks)
+
+  if (updated > 0) {
+    const action = body.status
+      ? `moved ${updated} task(s) to ${body.status}`
+      : `updated ${updated} task(s)`
+    createNotification({
+      type: 'success',
+      title: `Bulk update: ${action}`,
+      entityType: 'task',
+    })
+  }
+
+  notify('tasks')
+  return NextResponse.json({ updated, ids: results })
+}

package/src/app/api/tasks/route.ts

@@ -70,6 +70,7 @@ export async function POST(req: Request) {
     description: body.description || '',
     status: body.status || 'backlog',
     agentId: body.agentId || '',
+    projectId: typeof body.projectId === 'string' && body.projectId ? body.projectId : null,
     goalContract: body.goalContract || null,
     cwd: typeof body.cwd === 'string' ? body.cwd : null,
     file: typeof body.file === 'string' ? body.file : null,

package/src/app/api/webhooks/[id]/route.ts

@@ -1,8 +1,11 @@
 import { genId } from '@/lib/id'
+import { timingSafeEqual } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { loadAgents, loadSessions, loadWebhooks, saveSessions, saveWebhooks, appendWebhookLog, upsertWebhookRetry } from '@/lib/server/storage'
 import { WORKSPACE_DIR } from '@/lib/server/data-dir'
 import { enqueueSessionRun } from '@/lib/server/session-run-manager'
+import { enqueueSystemEvent } from '@/lib/server/system-events'
+import { requestHeartbeatNow } from '@/lib/server/heartbeat-wake'
 import { mutateItem, deleteItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
 import type { WebhookRetryEntry } from '@/types'
 
@@ -71,7 +74,12 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   if (secret) {
     const url = new URL(req.url)
     const provided = req.headers.get('x-webhook-secret') || url.searchParams.get('secret') || ''
-    if (provided !== secret) {
+    const secretBuf = Buffer.from(secret)
+    const providedBuf = Buffer.from(provided)
+    // timingSafeEqual requires equal lengths; compare against secretBuf if lengths differ
+    const compareBuf = providedBuf.length === secretBuf.length ? providedBuf : secretBuf
+    const isInvalid = providedBuf.length !== secretBuf.length || !timingSafeEqual(secretBuf, compareBuf)
+    if (isInvalid) {
       appendWebhookLog(genId(8), {
         id: genId(8), webhookId: id, event: 'unknown',
         payload: '', status: 'error', error: 'Invalid webhook secret', timestamp: Date.now(),
@@ -193,6 +201,12 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
       mode: 'followup',
     })
 
+    // Enqueue system event + heartbeat wake
+    enqueueSystemEvent(sid, `Webhook received: ${webhook.name || id} (${incomingEvent})`)
+    if (webhook.agentId) {
+      requestHeartbeatNow({ agentId: webhook.agentId, reason: 'webhook' })
+    }
+
     appendWebhookLog(genId(8), {
       id: genId(8), webhookId: id, event: incomingEvent,
       payload: (rawBody || '').slice(0, 2000), status: 'success',