@swarmclawai/swarmclaw 0.7.2 → 0.7.4

package/src/app/api/auth/route.ts

@@ -1,27 +1,96 @@
 import { NextResponse } from 'next/server'
-import { validateAccessKey, getAccessKey, isFirstTimeSetup, markSetupComplete } from '@/lib/server/storage'
+import { validateAccessKey, isFirstTimeSetup, markSetupComplete } from '@/lib/server/storage'
 import { ensureDaemonStarted } from '@/lib/server/daemon-state'
+import { AUTH_COOKIE_NAME, getCookieValue } from '@/lib/auth'
 export const dynamic = 'force-dynamic'
 
+interface AuthAttemptEntry {
+  count: number
+  lockedUntil: number
+}
 
-/** GET /api/auth — check if this is a first-time setup (returns key for initial display) */
-export async function GET(_req: Request) {
-  if (isFirstTimeSetup()) {
-    return NextResponse.json({ firstTime: true, key: getAccessKey() })
+const authRateLimitMap = (
+  (globalThis as Record<string, unknown>).__swarmclaw_auth_rate_limit__ ??= new Map()
+) as Map<string, AuthAttemptEntry>
+
+const MAX_ATTEMPTS = 5
+const LOCKOUT_MS = 15 * 60 * 1000
+
+function getClientIp(req: Request): string {
+  const forwarded = req.headers.get('x-forwarded-for')
+  if (forwarded) {
+    const first = forwarded.split(',')[0]?.trim()
+    if (first) return first
   }
-  return NextResponse.json({ firstTime: false })
+  const realIp = req.headers.get('x-real-ip')?.trim()
+  return realIp || 'unknown'
+}
+
+function clearAuthCookie(response: NextResponse): NextResponse {
+  response.cookies.set(AUTH_COOKIE_NAME, '', {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: false,
+    path: '/',
+    maxAge: 0,
+  })
+  return response
+}
+
+function setAuthCookie(response: NextResponse, req: Request, key: string): NextResponse {
+  response.cookies.set(AUTH_COOKIE_NAME, key, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: new URL(req.url).protocol === 'https:',
+    path: '/',
+    maxAge: 60 * 60 * 24 * 30,
+  })
+  return response
+}
+
+/** GET /api/auth — returns setup state and whether the auth cookie is currently valid */
+export async function GET(req: Request) {
+  const cookieKey = getCookieValue(req.headers.get('cookie'), AUTH_COOKIE_NAME)
+  return NextResponse.json({
+    firstTime: isFirstTimeSetup(),
+    authenticated: !!cookieKey && validateAccessKey(cookieKey),
+  })
 }
 
 /** POST /api/auth — validate an access key */
 export async function POST(req: Request) {
+  const clientIp = getClientIp(req)
+  const entry = authRateLimitMap.get(clientIp)
+  if (entry && entry.lockedUntil > Date.now()) {
+    const retryAfter = Math.ceil((entry.lockedUntil - Date.now()) / 1000)
+    return clearAuthCookie(NextResponse.json(
+      { error: 'Too many failed attempts. Try again later.', retryAfter },
+      { status: 429, headers: { 'Retry-After': String(retryAfter) } },
+    ))
+  }
+
   const { key } = await req.json()
   if (!key || !validateAccessKey(key)) {
-    return NextResponse.json({ error: 'Invalid access key' }, { status: 401 })
+    const current = authRateLimitMap.get(clientIp) ?? { count: 0, lockedUntil: 0 }
+    current.count += 1
+    if (current.count >= MAX_ATTEMPTS) {
+      current.lockedUntil = Date.now() + LOCKOUT_MS
+    }
+    authRateLimitMap.set(clientIp, current)
+    return clearAuthCookie(NextResponse.json(
+      { error: 'Invalid access key' },
+      {
+        status: 401,
+        headers: { 'X-RateLimit-Remaining': String(Math.max(0, MAX_ATTEMPTS - current.count)) },
+      },
+    ))
   }
+
+  authRateLimitMap.delete(clientIp)
   // If this was first-time setup, mark it as claimed
   if (isFirstTimeSetup()) {
     markSetupComplete()
   }
   ensureDaemonStarted('api/auth:post')
-  return NextResponse.json({ ok: true })
+  return setAuthCookie(NextResponse.json({ ok: true }), req, key)
 }

package/src/app/api/chatrooms/[id]/chat/route.ts

@@ -8,9 +8,12 @@ import { getProvider } from '@/lib/providers'
 import {
   resolveApiKey,
   parseMentions,
+  resolveReplyTargetAgentId,
+  resolveAgentApiEndpoint,
   compactChatroomMessages,
   buildChatroomSystemPrompt,
-  buildSyntheticSession,
+  ensureSyntheticSession,
+  appendSyntheticSessionMessage,
   buildAgentSystemPromptForChatroom,
   buildHistoryForAgent,
   isMuted,
@@ -19,6 +22,7 @@ import { filterHealthyChatroomAgents } from '@/lib/server/chatroom-health'
 import { evaluateRoutingRules } from '@/lib/server/chatroom-routing'
 import { markProviderFailure, markProviderSuccess } from '@/lib/server/provider-health'
 import { applyAgentReactionsFromText } from '@/lib/server/chatroom-orchestration'
+import { resolvePrimaryAgentRoute } from '@/lib/server/agent-runtime-config'
 import type { Chatroom, ChatroomMessage, Agent } from '@/types'
 
 export const dynamic = 'force-dynamic'
@@ -50,7 +54,8 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
 
   // Persist incoming message
   const senderName = senderId === 'user' ? 'You' : (agents[senderId]?.name || senderId)
-  let mentions = parseMentions(text, agents, chatroom.agentIds)
+  const replyTargetAgentId = resolveReplyTargetAgentId(replyToId, chatroom.messages, chatroom.agentIds)
+  let mentions = parseMentions(text, agents, chatroom.agentIds, { replyTargetAgentId })
   // Routing rules: if no explicit mentions, evaluate keyword/capability rules
   if (mentions.length === 0 && chatroom.routingRules?.length) {
     const agentList = chatroom.agentIds.map((aid) => agents[aid]).filter(Boolean)
@@ -147,15 +152,17 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
           }
 
           // Pre-flight: check if the agent's provider is usable before attempting to stream
-          const providerInfo = getProvider(agent.provider)
-          const apiKey = resolveApiKey(agent.credentialId)
+          const route = resolvePrimaryAgentRoute(agent)
+          const providerInfo = getProvider(route?.provider || agent.provider)
+          const apiKey = resolveApiKey(route?.credentialId || agent.credentialId)
+          const resolvedEndpoint = route?.apiEndpoint || resolveAgentApiEndpoint(agent)
           if (providerInfo?.requiresApiKey && !apiKey) {
             writeEvent({ t: 'cr_agent_start', agentId: agent.id, agentName: agent.name })
             writeEvent({ t: 'err', text: `${agent.name} has no API credentials configured`, agentId: agent.id, agentName: agent.name })
             writeEvent({ t: 'cr_agent_done', agentId: agent.id, agentName: agent.name })
             return []
           }
-          if (providerInfo?.requiresEndpoint && !agent.apiEndpoint) {
+          if (providerInfo?.requiresEndpoint && !resolvedEndpoint) {
             writeEvent({ t: 'cr_agent_start', agentId: agent.id, agentName: agent.name })
             writeEvent({ t: 'err', text: `${agent.name} has no endpoint configured`, agentId: agent.id, agentName: agent.name })
             writeEvent({ t: 'cr_agent_done', agentId: agent.id, agentName: agent.name })
@@ -173,7 +180,13 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
               notify(`chatroom:${id}`)
             }
 
-            const syntheticSession = buildSyntheticSession(agent, id)
+            const syntheticSession = ensureSyntheticSession(agent, id)
+            syntheticSession.provider = route?.provider || syntheticSession.provider
+            syntheticSession.model = route?.model || syntheticSession.model
+            syntheticSession.credentialId = route?.credentialId ?? syntheticSession.credentialId ?? null
+            syntheticSession.fallbackCredentialIds = route?.fallbackCredentialIds || syntheticSession.fallbackCredentialIds || []
+            syntheticSession.gatewayProfileId = route?.gatewayProfileId ?? syntheticSession.gatewayProfileId ?? null
+            syntheticSession.apiEndpoint = resolvedEndpoint
             const agentSystemPrompt = buildAgentSystemPromptForChatroom(agent)
             const chatroomContext = buildChatroomSystemPrompt(freshChatroom, agents, agent.id)
             const fullSystemPrompt = [agentSystemPrompt, chatroomContext].filter(Boolean).join('\n\n')
@@ -181,6 +194,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
 
             // Use enriched context message for chained agents, or reply context + original text
             const messageForAgent = item.contextMessage || (replyContext + text)
+            appendSyntheticSessionMessage(syntheticSession.id, 'user', messageForAgent)
 
             let fullText = ''
             let agentError = ''
@@ -218,12 +232,14 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
 
             // Don't persist empty or error-only messages — they pollute chat history
             if (!responseText.trim() && agentError) {
+              appendSyntheticSessionMessage(syntheticSession.id, 'assistant', agentError)
               markProviderFailure(agent.provider, agentError)
               writeEvent({ t: 'cr_agent_done', agentId: agent.id, agentName: agent.name })
               return []
             }
 
             if (responseText.trim()) {
+              appendSyntheticSessionMessage(syntheticSession.id, 'assistant', responseText)
               const parsedMentions = parseMentions(responseText, agents, freshChatroom.agentIds)
               const chainedHealth = filterHealthyChatroomAgents(parsedMentions, agents)
               const newMentions = chainedHealth.healthyAgentIds

package/src/app/api/chatrooms/[id]/pins/route.ts

@@ -33,7 +33,8 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   chatroom.updatedAt = Date.now()
   chatrooms[id] = chatroom
   saveChatrooms(chatrooms)
+  notify('chatrooms')
   notify(`chatroom:${id}`)
 
-  return NextResponse.json({ ok: true, pinnedMessageIds: chatroom.pinnedMessageIds })
+  return NextResponse.json(chatroom)
 }

package/src/app/api/chatrooms/[id]/reactions/route.ts

@@ -36,7 +36,8 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   chatroom.updatedAt = Date.now()
   chatrooms[id] = chatroom
   saveChatrooms(chatrooms)
+  notify('chatrooms')
   notify(`chatroom:${id}`)
 
-  return NextResponse.json({ ok: true, reactions: message.reactions })
+  return NextResponse.json(chatroom)
 }

package/src/app/api/chatrooms/[id]/route.ts

@@ -33,6 +33,12 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
 
   // Diff agentIds and inject join/leave system messages
   if (Array.isArray(body.agentIds)) {
+    if (body.agentIds.length === 0) {
+      return NextResponse.json(
+        { error: 'Select at least one chatroom member.' },
+        { status: 400 },
+      )
+    }
     const agents = loadAgents()
     const invalidAgentIds = (body.agentIds as string[]).filter((agentId) => !agents[agentId])
     if (invalidAgentIds.length > 0) {

package/src/app/api/chats/[id]/browser/route.ts

@@ -1,9 +1,13 @@
 import { NextResponse } from 'next/server'
 import { hasActiveBrowser, cleanupSessionBrowser } from '@/lib/server/session-tools'
+import { loadBrowserSessionRecord } from '@/lib/server/browser-state'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  return NextResponse.json({ active: hasActiveBrowser(id) })
+  return NextResponse.json({
+    active: hasActiveBrowser(id),
+    state: loadBrowserSessionRecord(id),
+  })
 }
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {

package/src/app/api/chats/[id]/chat/route.ts

@@ -49,7 +49,9 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
         mode: queueMode,
         onEvent: (ev) => writeEvent(ev as unknown as Record<string, unknown>),
         replyToId,
-        callerSignal: req.signal,
+        // Keep user-initiated runs alive even if the SSE transport drops so
+        // long-lived tasks can finish and be observed later via polling/history.
+        callerSignal: internal ? req.signal : undefined,
       })
       abortRun = run.abort
 
@@ -89,8 +91,10 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
         })
     },
     cancel() {
-      // Client disconnected — abort the run so the LLM stream is cancelled.
-      abortRun?.()
+      // Client disconnected. User-facing runs continue in the background so
+      // they can persist results even when the transport drops. Explicit stop
+      // controls still cancel the run through the session run manager.
+      if (internal) abortRun?.()
     },
   })
 

package/src/app/api/chats/[id]/messages/route.ts

@@ -1,17 +1,26 @@
 import { NextResponse } from 'next/server'
-import { loadSessions, saveSessions } from '@/lib/server/storage'
+import { active, loadStoredItem, upsertStoredItem } from '@/lib/server/storage'
 import { notFound } from '@/lib/server/collection-helpers'
+import { getSessionRunState } from '@/lib/server/session-run-manager'
+import { pruneStreamingAssistantArtifacts } from '@/lib/chat-streaming-state'
 
 export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const sessions = loadSessions()
-  if (!sessions[id]) return notFound()
+  const session = loadStoredItem('sessions', id)
+  if (!session) return notFound()
+  session.messages = Array.isArray(session.messages) ? session.messages : []
+
+  const run = getSessionRunState(id)
+  const hasLiveRun = active.has(id) || !!run.runningRunId
+  if (!hasLiveRun && pruneStreamingAssistantArtifacts(session.messages)) {
+    upsertStoredItem('sessions', id, session)
+  }
 
   const url = new URL(req.url)
   const limitParam = url.searchParams.get('limit')
   const beforeParam = url.searchParams.get('before')
 
-  const allMessages = sessions[id].messages
+  const allMessages = Array.isArray(session.messages) ? session.messages : []
   const total = allMessages.length
 
   // If no limit param, return all messages (backward compatible)
@@ -41,8 +50,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   if (body.kind !== 'context-clear') {
     return NextResponse.json({ error: 'Only context-clear kind is supported' }, { status: 400 })
   }
-  const sessions = loadSessions()
-  const session = sessions[id]
+  const session = loadStoredItem('sessions', id)
   if (!session) return notFound()
 
   session.messages.push({
@@ -51,15 +59,14 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
     kind: 'context-clear',
     time: Date.now(),
   })
-  saveSessions(sessions)
+  upsertStoredItem('sessions', id, session)
   return NextResponse.json({ ok: true })
 }
 
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const body = await req.json() as { messageIndex: number; bookmarked: boolean }
-  const sessions = loadSessions()
-  const session = sessions[id]
+  const session = loadStoredItem('sessions', id)
   if (!session) return notFound()
 
   const { messageIndex, bookmarked } = body
@@ -68,15 +75,14 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   }
 
   session.messages[messageIndex].bookmarked = bookmarked
-  saveSessions(sessions)
+  upsertStoredItem('sessions', id, session)
   return NextResponse.json(session.messages[messageIndex])
 }
 
 export async function DELETE(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const body = await req.json() as { messageIndex: number }
-  const sessions = loadSessions()
-  const session = sessions[id]
+  const session = loadStoredItem('sessions', id)
   if (!session) return notFound()
 
   const { messageIndex } = body
@@ -90,6 +96,6 @@ export async function DELETE(req: Request, { params }: { params: Promise<{ id: s
   }
 
   session.messages.splice(messageIndex, 1)
-  saveSessions(sessions)
+  upsertStoredItem('sessions', id, session)
   return NextResponse.json({ ok: true })
 }

package/src/app/api/chats/[id]/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
 import { loadSessions, saveSessions, deleteSession, active, loadAgents } from '@/lib/server/storage'
 import { notFound } from '@/lib/server/collection-helpers'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
+import { resolvePrimaryAgentRoute } from '@/lib/server/agent-runtime-config'
 
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
@@ -17,6 +18,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   }
 
   const linkedAgent = nextAgentId ? loadAgents()[nextAgentId] : null
+  const linkedRoute = linkedAgent ? resolvePrimaryAgentRoute(linkedAgent) : null
 
   if (updates.name !== undefined) sessions[id].name = updates.name
   if (updates.cwd !== undefined) sessions[id].cwd = updates.cwd
@@ -24,11 +26,19 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   else if (agentIdUpdateProvided && linkedAgent?.provider) sessions[id].provider = linkedAgent.provider
 
   if (updates.model !== undefined) sessions[id].model = updates.model
+  else if (agentIdUpdateProvided && linkedRoute?.model) sessions[id].model = linkedRoute.model
   else if (agentIdUpdateProvided && linkedAgent?.model !== undefined) sessions[id].model = linkedAgent.model
 
   if (updates.credentialId !== undefined) sessions[id].credentialId = updates.credentialId
+  else if (agentIdUpdateProvided && linkedRoute) sessions[id].credentialId = linkedRoute.credentialId ?? null
   else if (agentIdUpdateProvided && linkedAgent) sessions[id].credentialId = linkedAgent.credentialId ?? null
 
+  if (updates.fallbackCredentialIds !== undefined) sessions[id].fallbackCredentialIds = updates.fallbackCredentialIds
+  else if (agentIdUpdateProvided && linkedRoute) sessions[id].fallbackCredentialIds = [...linkedRoute.fallbackCredentialIds]
+
+  if (updates.gatewayProfileId !== undefined) sessions[id].gatewayProfileId = updates.gatewayProfileId
+  else if (agentIdUpdateProvided && linkedRoute) sessions[id].gatewayProfileId = linkedRoute.gatewayProfileId ?? null
+
   if (updates.plugins !== undefined) sessions[id].plugins = updates.plugins
   else if (agentIdUpdateProvided && linkedAgent) sessions[id].plugins = Array.isArray(linkedAgent.plugins) ? linkedAgent.plugins : []
 
@@ -37,6 +47,8 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
       updates.provider || sessions[id].provider,
       updates.apiEndpoint,
     )
+  } else if (agentIdUpdateProvided && linkedRoute) {
+    sessions[id].apiEndpoint = linkedRoute.apiEndpoint ?? null
   } else if (agentIdUpdateProvided && linkedAgent) {
     sessions[id].apiEndpoint = normalizeProviderEndpoint(
       linkedAgent.provider,
@@ -45,6 +57,24 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   }
   if (updates.heartbeatEnabled !== undefined) sessions[id].heartbeatEnabled = updates.heartbeatEnabled
   if (updates.heartbeatIntervalSec !== undefined) sessions[id].heartbeatIntervalSec = updates.heartbeatIntervalSec
+  if (updates.sessionResetMode !== undefined) sessions[id].sessionResetMode = updates.sessionResetMode
+  if (updates.sessionIdleTimeoutSec !== undefined) sessions[id].sessionIdleTimeoutSec = updates.sessionIdleTimeoutSec
+  if (updates.sessionMaxAgeSec !== undefined) sessions[id].sessionMaxAgeSec = updates.sessionMaxAgeSec
+  if (updates.sessionDailyResetAt !== undefined) sessions[id].sessionDailyResetAt = updates.sessionDailyResetAt
+  if (updates.sessionResetTimezone !== undefined) sessions[id].sessionResetTimezone = updates.sessionResetTimezone
+  if (updates.thinkingLevel !== undefined) sessions[id].thinkingLevel = updates.thinkingLevel
+  if (updates.connectorThinkLevel !== undefined) sessions[id].connectorThinkLevel = updates.connectorThinkLevel
+  if (updates.connectorSessionScope !== undefined) sessions[id].connectorSessionScope = updates.connectorSessionScope
+  if (updates.connectorReplyMode !== undefined) sessions[id].connectorReplyMode = updates.connectorReplyMode
+  if (updates.connectorThreadBinding !== undefined) sessions[id].connectorThreadBinding = updates.connectorThreadBinding
+  if (updates.connectorGroupPolicy !== undefined) sessions[id].connectorGroupPolicy = updates.connectorGroupPolicy
+  if (updates.connectorIdleTimeoutSec !== undefined) sessions[id].connectorIdleTimeoutSec = updates.connectorIdleTimeoutSec
+  if (updates.connectorMaxAgeSec !== undefined) sessions[id].connectorMaxAgeSec = updates.connectorMaxAgeSec
+  if (updates.connectorContext !== undefined) sessions[id].connectorContext = updates.connectorContext
+  if (updates.identityState !== undefined) sessions[id].identityState = updates.identityState
+  if (updates.sessionArchiveState !== undefined) sessions[id].sessionArchiveState = updates.sessionArchiveState
+  if (updates.lastSessionResetAt !== undefined) sessions[id].lastSessionResetAt = updates.lastSessionResetAt
+  if (updates.lastSessionResetReason !== undefined) sessions[id].lastSessionResetReason = updates.lastSessionResetReason
   if (updates.pinned !== undefined) sessions[id].pinned = !!updates.pinned
   if (updates.claudeSessionId !== undefined) sessions[id].claudeSessionId = updates.claudeSessionId
   if (updates.codexThreadId !== undefined) sessions[id].codexThreadId = updates.codexThreadId

package/src/app/api/chats/[id]/stop/route.ts

@@ -1,10 +1,15 @@
 import { NextResponse } from 'next/server'
-import { active } from '@/lib/server/storage'
+import { pruneStreamingAssistantArtifacts } from '@/lib/chat-streaming-state'
+import { active, loadStoredItem, upsertStoredItem } from '@/lib/server/storage'
 import { cancelSessionRuns } from '@/lib/server/session-run-manager'
 
 export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const cancel = cancelSessionRuns(id, 'Stopped by user')
+  const session = loadStoredItem('sessions', id)
+  if (session && Array.isArray(session.messages) && pruneStreamingAssistantArtifacts(session.messages)) {
+    upsertStoredItem('sessions', id, session)
+  }
   if (active.has(id)) {
     try { active.get(id).kill() } catch {}
     active.delete(id)

package/src/app/api/chats/heartbeat/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server'
+import { DEFAULT_HEARTBEAT_INTERVAL_SEC } from '@/lib/heartbeat-defaults'
 import { disableAllSessionHeartbeats, loadSettings, saveSettings } from '@/lib/server/storage'
 import { cancelAllHeartbeatRuns } from '@/lib/server/session-run-manager'
 
@@ -11,7 +12,7 @@ export async function POST(req: Request) {
 
   const updatedSessions = disableAllSessionHeartbeats()
   const settings = loadSettings()
-  if ((settings.heartbeatIntervalSec ?? 120) !== 0) {
+  if ((settings.heartbeatIntervalSec ?? DEFAULT_HEARTBEAT_INTERVAL_SEC) !== 0) {
     settings.heartbeatIntervalSec = 0
     saveSettings(settings)
   }

package/src/app/api/chats/route.ts

@@ -7,6 +7,7 @@ import { WORKSPACE_DIR } from '@/lib/server/data-dir'
 import { notify } from '@/lib/server/ws-hub'
 import { getSessionRunState } from '@/lib/server/session-run-manager'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
+import { applyResolvedRoute, resolvePrimaryAgentRoute } from '@/lib/server/agent-runtime-config'
 export const dynamic = 'force-dynamic'
 
 
@@ -60,6 +61,7 @@ export async function POST(req: Request) {
   const id = body.id || genId()
   const sessions = loadSessions()
   const agent = body.agentId ? loadAgents()[body.agentId] : null
+  const resolvedRoute = agent ? resolvePrimaryAgentRoute(agent) : null
   const requestedPlugins = Array.isArray(body.plugins) ? body.plugins : (Array.isArray(body.tools) ? body.tools : null)
   const resolvedPlugins = requestedPlugins ?? (Array.isArray(agent?.plugins) ? agent.plugins : (Array.isArray(agent?.tools) ? agent.tools : []))
 
@@ -70,12 +72,13 @@ export async function POST(req: Request) {
 
   const sessionName = body.name || 'New Chat'
 
-  sessions[id] = {
+  const nextSession = {
     id, name: sessionName, cwd,
     user: body.user || 'user',
     provider: body.provider || agent?.provider || 'claude-cli',
     model: body.model || agent?.model || '',
     credentialId: body.credentialId || agent?.credentialId || null,
+    fallbackCredentialIds: body.fallbackCredentialIds || agent?.fallbackCredentialIds || [],
     apiEndpoint: normalizeProviderEndpoint(
       body.provider || agent?.provider || 'claude-cli',
       body.apiEndpoint || agent?.apiEndpoint || null,
@@ -96,7 +99,26 @@ export async function POST(req: Request) {
     plugins: resolvedPlugins,
     heartbeatEnabled: body.heartbeatEnabled ?? null,
     heartbeatIntervalSec: body.heartbeatIntervalSec ?? null,
+    sessionResetMode: body.sessionResetMode ?? agent?.sessionResetMode ?? null,
+    sessionIdleTimeoutSec: body.sessionIdleTimeoutSec ?? agent?.sessionIdleTimeoutSec ?? null,
+    sessionMaxAgeSec: body.sessionMaxAgeSec ?? agent?.sessionMaxAgeSec ?? null,
+    sessionDailyResetAt: body.sessionDailyResetAt ?? agent?.sessionDailyResetAt ?? null,
+    sessionResetTimezone: body.sessionResetTimezone ?? agent?.sessionResetTimezone ?? null,
+    thinkingLevel: body.thinkingLevel ?? null,
+    connectorThinkLevel: body.connectorThinkLevel ?? null,
+    connectorSessionScope: body.connectorSessionScope ?? null,
+    connectorReplyMode: body.connectorReplyMode ?? null,
+    connectorThreadBinding: body.connectorThreadBinding ?? null,
+    connectorGroupPolicy: body.connectorGroupPolicy ?? null,
+    connectorIdleTimeoutSec: body.connectorIdleTimeoutSec ?? null,
+    connectorMaxAgeSec: body.connectorMaxAgeSec ?? null,
+    connectorContext: body.connectorContext ?? null,
+    identityState: body.identityState ?? agent?.identityState ?? null,
+    sessionArchiveState: body.sessionArchiveState ?? null,
   }
+  sessions[id] = (body.provider || body.model || body.credentialId || body.apiEndpoint)
+    ? nextSession
+    : applyResolvedRoute(nextSession, resolvedRoute)
   saveSessions(sessions)
   notify('sessions')
   return NextResponse.json(sessions[id])

package/src/app/api/connectors/[id]/doctor/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server'
+import { loadConnectors } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
+import { buildConnectorDoctorPreview, buildConnectorDoctorReport, type ConnectorDoctorPreviewInput } from '@/lib/server/connectors/doctor'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const connectors = loadConnectors()
+  const connector = connectors[id]
+  if (!connector) return notFound()
+
+  return NextResponse.json(buildConnectorDoctorReport(connector, null, { baseConnector: connector }))
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const connectors = loadConnectors()
+  const baseConnector = connectors[id]
+  if (!baseConnector) return notFound()
+
+  const body = await req.json().catch(() => ({})) as ConnectorDoctorPreviewInput
+  const connector = buildConnectorDoctorPreview({ baseConnector, input: body, fallbackId: id })
+  return NextResponse.json(buildConnectorDoctorReport(connector, body.sampleMsg, { baseConnector }))
+}

package/src/app/api/connectors/doctor/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from 'next/server'
+import { buildConnectorDoctorPreview, buildConnectorDoctorReport, type ConnectorDoctorPreviewInput } from '@/lib/server/connectors/doctor'
+import { loadConnectors } from '@/lib/server/storage'
+
+export const dynamic = 'force-dynamic'
+
+export async function POST(req: Request) {
+  const body = await req.json().catch(() => ({})) as ConnectorDoctorPreviewInput
+  const connectors = loadConnectors()
+  const baseConnector = typeof body.id === 'string' ? connectors[body.id] : null
+  const connector = buildConnectorDoctorPreview({ baseConnector, input: body })
+  return NextResponse.json(buildConnectorDoctorReport(connector, body.sampleMsg, { baseConnector }))
+}

package/src/app/api/external-agents/[id]/heartbeat/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from 'next/server'
+import { loadExternalAgents, saveExternalAgents } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
+import { notify } from '@/lib/server/ws-hub'
+export const dynamic = 'force-dynamic'
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const body = await req.json().catch(() => ({}))
+  const items = loadExternalAgents()
+  const runtime = items[id]
+  if (!runtime) return notFound()
+  const now = Date.now()
+  runtime.lastHeartbeatAt = now
+  runtime.lastSeenAt = now
+  runtime.updatedAt = now
+  runtime.status = body.status || 'online'
+  if (body.tokenStats && typeof body.tokenStats === 'object') {
+    runtime.tokenStats = {
+      ...(runtime.tokenStats || {}),
+      ...body.tokenStats,
+    }
+  }
+  if (body.metadata && typeof body.metadata === 'object') {
+    runtime.metadata = {
+      ...(runtime.metadata || {}),
+      ...body.metadata,
+    }
+  }
+  saveExternalAgents(items)
+  notify('external_agents')
+  return NextResponse.json({ ok: true, id, lastHeartbeatAt: now })
+}

package/src/app/api/external-agents/[id]/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from 'next/server'
+import { loadExternalAgents, saveExternalAgents } from '@/lib/server/storage'
+import { mutateItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
+import { notify } from '@/lib/server/ws-hub'
+export const dynamic = 'force-dynamic'
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const ops: CollectionOps<any> = { load: loadExternalAgents, save: saveExternalAgents, topic: 'external_agents' }
+
+export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const body = await req.json().catch(() => ({}))
+  const result = mutateItem(ops, id, (runtime) => ({
+    ...runtime,
+    ...body,
+    id,
+    updatedAt: Date.now(),
+  }))
+  if (!result) return notFound()
+  return NextResponse.json(result)
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const items = loadExternalAgents()
+  if (!items[id]) return notFound()
+  delete items[id]
+  saveExternalAgents(items)
+  notify('external_agents')
+  return NextResponse.json({ ok: true })
+}

package/src/app/api/external-agents/register/route.ts

@@ -0,0 +1,3 @@
+import { POST } from '../route'
+export const dynamic = 'force-dynamic'
+export { POST }