@swarmclawai/swarmclaw 1.2.3 → 1.2.5

package/README.md

@@ -190,6 +190,26 @@ The building blocks are the same: **agents, tools, memory, delegation, schedules
 
 ## Release Notes
 
+### v1.2.5 Highlights
+
+- **Working memory hierarchy**: agents maintain structured working state (facts, plans, decisions, blockers, evidence) that persists across turns and survives context compaction.
+- **Execution brief**: each chat turn receives a concise briefing document synthesized from working state for faster, more focused agent reasoning.
+- **RunContext**: persistent structured context tracks session lineage, delegation chain, and accumulated working memory across run lifecycle.
+- **Unified message flow**: consolidated message handling and execution routing into a single coherent pipeline.
+- **Delegation advisory**: new advisory layer for structured capability analysis during delegation decisions.
+- **Real-time session sync**: session create, update, and delete events now push over WebSocket, replacing poll-only refresh for the chat list.
+- **HMR resilience**: module-level state in the WebSocket client, fallback polling, and API request dedup now survives Next.js hot-module reloads.
+- **Type safety sweep**: eliminated 16 `any` types across 7 API routes with proper narrowing and error guards.
+- **Bug fix — setup wizard crash**: replaced client-side `crypto.randomUUID()` with browser-safe alternative, fixing fresh-install failures with Ollama and other providers.
+- **Bug fix — custom provider validation**: connection-test endpoint now recognizes custom providers from storage instead of rejecting them as "Unsupported provider."
+- **Bug fix — session cwd normalization**: `updateChatSession` now expands `~` paths consistently with session creation.
+
+### v1.2.4 Highlights
+
+- **Custom providers in agent config**: agent setup and inline model switching now merge saved custom provider configs into the selectable provider list, so custom providers show up reliably even when the built-in provider feed is stale or incomplete.
+- **Custom provider save-only flow**: the Providers screen no longer forces connection tests or live model discovery for custom providers; operators can save the endpoint, linked key, and manual model list directly.
+- **Custom provider runtime routing**: saved custom-provider model lists and linked credentials now flow through the agent UI and runtime resolution paths consistently, including legacy `provider_configs` records normalized on load.
+
 ### v1.2.3 Highlights
 
 - **Standalone asset staging repair**: `swarmclaw server` now copies `.next/static` and `public/` into the Next.js standalone runtime after the first build, preventing blank UI loads and 503s for CSS, JS, and image assets.

package/bin/daemon-cmd.js

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+'use strict'
+/* eslint-disable @typescript-eslint/no-require-imports */
+
+const crypto = require('node:crypto')
+const fs = require('node:fs')
+const net = require('node:net')
+const path = require('node:path')
+const { spawn } = require('node:child_process')
+
+const {
+  BROWSER_PROFILES_DIR,
+  DATA_DIR,
+  PKG_ROOT,
+  SWARMCLAW_HOME,
+  WORKSPACE_DIR,
+  resolvePackageBuildRoot,
+} = require('./server-cmd.js')
+
+function printHelp() {
+  const help = `
+Usage: swarmclaw daemon run [options]
+
+Run the detached SwarmClaw runtime daemon outside the public web process.
+
+Options:
+  -d, --detach      Start daemon in background
+  --port <port>     Admin port to bind on localhost (default: random)
+  --token <token>   Admin bearer token (default: random)
+  -h, --help        Show this help message
+
+Other daemon controls remain available through the API-backed CLI:
+  swarmclaw daemon status
+  swarmclaw daemon start
+  swarmclaw daemon stop
+  swarmclaw daemon health-check
+`.trim()
+  console.log(help)
+}
+
+function resolveRoot() {
+  const buildRoot = process.env.SWARMCLAW_BUILD_ROOT || resolvePackageBuildRoot(PKG_ROOT)
+  if (fs.existsSync(path.join(buildRoot, 'src', 'lib', 'server', 'daemon', 'daemon-runtime.ts'))) return buildRoot
+  return PKG_ROOT
+}
+
+function resolveEntry(root) {
+  const entry = path.join(root, 'src', 'lib', 'server', 'daemon', 'daemon-runtime.ts')
+  if (!fs.existsSync(entry)) {
+    throw new Error(`Daemon runtime entry not found at ${entry}`)
+  }
+  return entry
+}
+
+function reservePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer()
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      if (!address || typeof address === 'string') {
+        server.close(() => reject(new Error('Failed to reserve daemon port.')))
+        return
+      }
+      const port = address.port
+      server.close((err) => {
+        if (err) reject(err)
+        else resolve(port)
+      })
+    })
+  })
+}
+
+function buildEnv(root, port, token) {
+  return {
+    ...process.env,
+    SWARMCLAW_HOME,
+    DATA_DIR,
+    WORKSPACE_DIR,
+    BROWSER_PROFILES_DIR,
+    SWARMCLAW_PACKAGE_ROOT: PKG_ROOT,
+    SWARMCLAW_BUILD_ROOT: root,
+    SWARMCLAW_RUNTIME_ROLE: 'daemon',
+    SWARMCLAW_DAEMON_BACKGROUND_SERVICES: '1',
+    SWARMCLAW_DAEMON_ADMIN_PORT: String(port),
+    SWARMCLAW_DAEMON_ADMIN_TOKEN: token,
+  }
+}
+
+async function runDaemon(options) {
+  const root = resolveRoot()
+  const entry = resolveEntry(root)
+  const port = options.port || await reservePort()
+  const token = options.token || crypto.randomBytes(24).toString('hex')
+  const env = buildEnv(root, port, token)
+  const args = ['--no-warnings', '--import', 'tsx', entry, '--port', String(port), '--token', token]
+
+  if (options.detach) {
+    const logPath = path.join(SWARMCLAW_HOME, 'daemon.log')
+    fs.mkdirSync(path.dirname(logPath), { recursive: true })
+    const logStream = fs.openSync(logPath, 'a')
+    const child = spawn(process.execPath, args, {
+      cwd: root,
+      detached: true,
+      env,
+      stdio: ['ignore', logStream, logStream],
+    })
+    child.unref()
+    console.log(`[swarmclaw] Daemon started in background (PID: ${child.pid})`)
+    console.log(`[swarmclaw] Admin port: ${port}`)
+    console.log(`[swarmclaw] Logs: ${logPath}`)
+    return
+  }
+
+  console.log(`[swarmclaw] Starting daemon runtime on 127.0.0.1:${port}`)
+  const child = spawn(process.execPath, args, {
+    cwd: root,
+    env,
+    stdio: 'inherit',
+  })
+  child.on('exit', (code) => {
+    process.exit(code || 0)
+  })
+  for (const signal of ['SIGINT', 'SIGTERM']) {
+    process.on(signal, () => child.kill(signal))
+  }
+}
+
+async function main(args = process.argv.slice(3)) {
+  let detach = false
+  let port = null
+  let token = ''
+  let command = 'run'
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]
+    if (arg === 'run') {
+      command = 'run'
+    } else if (arg === '-d' || arg === '--detach') {
+      detach = true
+    } else if (arg === '--port' && index + 1 < args.length) {
+      port = Number.parseInt(args[index + 1], 10)
+      index += 1
+    } else if (arg === '--token' && index + 1 < args.length) {
+      token = args[index + 1] || ''
+      index += 1
+    } else if (arg === '-h' || arg === '--help' || arg === 'help') {
+      printHelp()
+      return
+    } else {
+      throw new Error(`Unknown daemon argument: ${arg}`)
+    }
+  }
+
+  if (command !== 'run') {
+    throw new Error(`Unsupported daemon command: ${command}`)
+  }
+
+  await runDaemon({ detach, port, token })
+}
+
+if (require.main === module) {
+  void main().catch((err) => {
+    console.error(`[swarmclaw] ${err?.message || String(err)}`)
+    process.exit(1)
+  })
+}
+
+module.exports = { main }

package/bin/server-cmd.js

@@ -381,6 +381,9 @@ async function startServer(opts, { pkgRoot = PKG_ROOT } = {}) {
     DATA_DIR,
     WORKSPACE_DIR,
     BROWSER_PROFILES_DIR,
+    SWARMCLAW_PACKAGE_ROOT: pkgRoot,
+    SWARMCLAW_BUILD_ROOT: buildRoot,
+    SWARMCLAW_RUNTIME_ROLE: 'web',
     HOSTNAME: host,
     PORT: port,
     WS_PORT: wsPort,

package/bin/swarmclaw.js

@@ -131,6 +131,10 @@ async function runHelp(argv) {
     await require('./server-cmd.js').main(['--help'])
     return
   }
+  if (target === 'daemon') {
+    await require('./daemon-cmd.js').main(['--help'])
+    return
+  }
   if (target === 'worker') {
     require('./worker-cmd.js').main(['--help'])
     return
@@ -188,6 +192,13 @@ async function main() {
     await require('./server-cmd.js').main(argv.slice(1))
     return
   }
+  if (top === 'daemon') {
+    const subcommand = argv[1]
+    if (!subcommand || subcommand === 'run' || subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
+      await require('./daemon-cmd.js').main(argv.slice(1))
+      return
+    }
+  }
   if (top === 'run' || top === 'start') {
     await require('./server-cmd.js').main(argv.slice(1))
     return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmclawai/swarmclaw",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "description": "Self-hosted AI runtime for OpenClaw, delegation, autonomy, runtime skills, crypto wallets, and chat platform connectors.",
   "license": "MIT",
   "publishConfig": {
@@ -81,14 +81,23 @@
     "@huggingface/transformers": "^3.8.1",
     "@langchain/anthropic": "^1.3.18",
     "@langchain/core": "^1.1.31",
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "@tailwindcss/postcss": "^4",
     "@langchain/langgraph": "^1.2.2",
     "@langchain/openai": "^1.2.8",
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "@multiavatar/multiavatar": "^1.0.7",
     "@playwright/mcp": "^0.0.68",
     "@slack/bolt": "^4.6.0",
     "@solana/web3.js": "^1.98.4",
+    "@tailwindcss/postcss": "^4",
+    "@tanstack/react-query": "^5.91.0",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/mailparser": "^3.4.6",
+    "@types/node": "^20",
+    "@types/nodemailer": "^7.0.11",
+    "@types/qrcode": "^1.5.6",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@types/ws": "^8.18.1",
     "@whiskeysockets/baileys": "^7.0.0-rc.9",
     "better-sqlite3": "^12.6.2",
     "bs58": "^5.0.0",
@@ -125,26 +134,18 @@
     "remove-markdown": "^0.6.3",
     "shadcn": "^3.8.5",
     "sonner": "^2.0.7",
-    "tailwindcss": "^4",
     "tailwind-merge": "^3.4.1",
-    "typescript": "^5",
+    "tailwindcss": "^4",
     "tw-animate-css": "^1.4.0",
+    "tsx": "^4.20.6",
+    "typescript": "^5",
     "ws": "^8.19.0",
     "zod": "^4.3.6",
-    "zustand": "^5.0.11",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/mailparser": "^3.4.6",
-    "@types/node": "^20",
-    "@types/nodemailer": "^7.0.11",
-    "@types/qrcode": "^1.5.6",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "@types/ws": "^8.18.1"
+    "zustand": "^5.0.11"
   },
   "devDependencies": {
     "eslint": "^9",
-    "eslint-config-next": "16.1.7",
-    "tsx": "^4.20.6"
+    "eslint-config-next": "16.1.7"
   },
   "optionalDependencies": {
     "botbuilder": "^4.23.3",

package/src/app/api/agents/[id]/clone/route.ts

@@ -1,40 +1,11 @@
 import { NextResponse } from 'next/server'
-import { loadAgents, saveAgents, logActivity } from '@/lib/server/storage'
-import { notify } from '@/lib/server/ws-hub'
+import { cloneAgent } from '@/lib/server/agents/agent-service'
 
 export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const agents = loadAgents({ includeTrashed: true })
-  const source = agents[id]
-  if (!source) {
+  const cloned = cloneAgent(id)
+  if (!cloned) {
     return NextResponse.json({ error: 'Agent not found' }, { status: 404 })
   }
-
-  const newId = crypto.randomUUID()
-  const now = Date.now()
-
-  // Deep-copy the source agent, then override clone-specific fields
-  const cloned = JSON.parse(JSON.stringify(source)) as typeof source
-  cloned.id = newId
-  cloned.name = `${source.name} (Copy)`
-  cloned.createdAt = now
-  cloned.updatedAt = now
-  cloned.totalCost = 0
-  cloned.lastUsedAt = undefined
-  cloned.threadSessionId = null
-  cloned.pinned = false
-  cloned.trashedAt = undefined
-
-  agents[newId] = cloned
-  saveAgents(agents)
-  logActivity({
-    entityType: 'agent',
-    entityId: newId,
-    action: 'created',
-    actor: 'user',
-    summary: `Agent cloned from "${source.name}": "${cloned.name}"`,
-  })
-  notify('agents')
-
   return NextResponse.json(cloned)
 }

package/src/app/api/agents/[id]/route.ts

@@ -1,175 +1,23 @@
 import { NextResponse } from 'next/server'
-import { loadAgents, saveAgents, loadSessions, logActivity, upsertStoredItem, upsertStoredItems } from '@/lib/server/storage'
-import { normalizeProviderEndpoint } from '@/lib/openclaw/openclaw-endpoint'
-import { mutateItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
-import { ensureAgentThreadSession } from '@/lib/server/agents/agent-thread-session'
-import { suspendAgentReferences } from '@/lib/server/agents/agent-cascade'
+import { notFound } from '@/lib/server/collection-helpers'
+import { trashAgent, updateAgent } from '@/lib/server/agents/agent-service'
 import { notify } from '@/lib/server/ws-hub'
-import { normalizeAgentSandboxConfig } from '@/lib/agent-sandbox-defaults'
-import { normalizeCapabilitySelection } from '@/lib/capability-selection'
-import { normalizeOrchestratorConfig } from '@/lib/orchestrator-config'
 import { safeParseBody } from '@/lib/server/safe-parse-body'
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const ops: CollectionOps<any> = { load: () => loadAgents({ includeTrashed: true }), save: saveAgents, topic: 'agents', table: 'agents' }
-
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const { data: body, error } = await safeParseBody(req)
   if (error) return error
-  const result = mutateItem(ops, id, (agent) => {
-    Object.assign(agent, body, { updatedAt: Date.now() })
-    if (body.tools !== undefined || body.extensions !== undefined) {
-      const nextSelection = normalizeCapabilitySelection({
-        tools: Array.isArray(body.tools) ? body.tools : agent.tools,
-        extensions: Array.isArray(body.extensions) ? body.extensions : agent.extensions,
-      })
-      agent.tools = nextSelection.tools
-      agent.extensions = nextSelection.extensions
-    }
-    if (body.delegationEnabled !== undefined) {
-      agent.delegationEnabled = body.delegationEnabled === true
-    }
-    if (body.delegationTargetMode === 'all' || body.delegationTargetMode === 'selected') {
-      agent.delegationTargetMode = body.delegationTargetMode
-    }
-    if (body.delegationTargetAgentIds !== undefined) {
-      agent.delegationTargetAgentIds = Array.isArray(body.delegationTargetAgentIds)
-        ? body.delegationTargetAgentIds.filter((entry: unknown): entry is string => typeof entry === 'string' && entry.trim().length > 0)
-        : []
-    }
-    if (agent.delegationTargetMode !== 'selected') {
-      agent.delegationTargetAgentIds = []
-    }
-    if (body.apiEndpoint !== undefined) {
-      agent.apiEndpoint = normalizeProviderEndpoint(
-        body.provider || agent.provider,
-        body.apiEndpoint as string | null | undefined,
-      )
-    }
-    if (body.provider !== undefined && body.provider !== 'ollama' && body.ollamaMode === undefined) {
-      agent.ollamaMode = null
-    }
-    if (body.sandboxConfig !== undefined) {
-      agent.sandboxConfig = normalizeAgentSandboxConfig(body.sandboxConfig)
-    }
-    if (
-      body.provider !== undefined
-      || body.orchestratorEnabled !== undefined
-      || body.orchestratorMission !== undefined
-      || body.orchestratorWakeInterval !== undefined
-      || body.orchestratorGovernance !== undefined
-      || body.orchestratorMaxCyclesPerDay !== undefined
-    ) {
-      const orchestratorConfig = normalizeOrchestratorConfig({
-        provider: typeof body.provider === 'string' ? body.provider : agent.provider,
-        orchestratorEnabled: body.orchestratorEnabled ?? agent.orchestratorEnabled,
-        orchestratorMission: body.orchestratorMission ?? agent.orchestratorMission,
-        orchestratorWakeInterval: body.orchestratorWakeInterval ?? agent.orchestratorWakeInterval,
-        orchestratorGovernance: body.orchestratorGovernance ?? agent.orchestratorGovernance,
-        orchestratorMaxCyclesPerDay: body.orchestratorMaxCyclesPerDay ?? agent.orchestratorMaxCyclesPerDay,
-      })
-      agent.orchestratorEnabled = orchestratorConfig.orchestratorEnabled
-      agent.orchestratorMission = orchestratorConfig.orchestratorMission
-      agent.orchestratorWakeInterval = orchestratorConfig.orchestratorWakeInterval
-      agent.orchestratorGovernance = orchestratorConfig.orchestratorGovernance
-      agent.orchestratorMaxCyclesPerDay = orchestratorConfig.orchestratorMaxCyclesPerDay
-    }
-    if (body.preferredGatewayTags !== undefined) {
-      agent.preferredGatewayTags = Array.isArray(body.preferredGatewayTags)
-        ? body.preferredGatewayTags.filter((tag: unknown): tag is string => typeof tag === 'string' && tag.trim().length > 0)
-        : []
-    }
-    if (body.preferredGatewayUseCase !== undefined) {
-      agent.preferredGatewayUseCase = typeof body.preferredGatewayUseCase === 'string' && body.preferredGatewayUseCase.trim()
-        ? body.preferredGatewayUseCase.trim()
-        : null
-    }
-    if (body.routingTargets !== undefined && Array.isArray(body.routingTargets)) {
-      agent.routingTargets = body.routingTargets.map((target: Record<string, unknown>, index: number) => ({
-        id: typeof target.id === 'string' && target.id.trim() ? target.id.trim() : `route-${index + 1}`,
-        label: typeof target.label === 'string' ? target.label : undefined,
-        role: target.role,
-        provider: (typeof target.provider === 'string' && target.provider.trim() ? target.provider : agent.provider),
-        model: typeof target.model === 'string' ? target.model : '',
-        ollamaMode: (typeof target.provider === 'string' ? target.provider : agent.provider) === 'ollama'
-          ? (target.ollamaMode === 'cloud' ? 'cloud' : 'local')
-          : null,
-        credentialId: target.credentialId ?? null,
-        fallbackCredentialIds: Array.isArray(target.fallbackCredentialIds) ? target.fallbackCredentialIds : [],
-        apiEndpoint: normalizeProviderEndpoint(
-          typeof target.provider === 'string' ? target.provider : agent.provider,
-          typeof target.apiEndpoint === 'string' ? target.apiEndpoint : null,
-        ),
-        gatewayProfileId: target.gatewayProfileId ?? null,
-        preferredGatewayTags: Array.isArray(target.preferredGatewayTags)
-          ? target.preferredGatewayTags.filter((tag: unknown): tag is string => typeof tag === 'string' && tag.trim().length > 0)
-          : [],
-        preferredGatewayUseCase: typeof target.preferredGatewayUseCase === 'string' && target.preferredGatewayUseCase.trim()
-          ? target.preferredGatewayUseCase.trim()
-          : null,
-        priority: typeof target.priority === 'number' ? target.priority : index + 1,
-      }))
-    }
-    delete (agent as Record<string, unknown>).platformAssignScope
-    delete (agent as Record<string, unknown>).subAgentIds
-    delete (agent as Record<string, unknown>).id
-    agent.id = id
-    return agent
-  })
+  const result = updateAgent(id, body as Record<string, unknown>)
   if (!result) return notFound()
-
-  if (result.threadSessionId) {
-    ensureAgentThreadSession(id)
-  }
-
-  if (result.threadSessionId) {
-    const sessions = loadSessions()
-    const shortcut = sessions[result.threadSessionId]
-    if (shortcut) {
-      let changed = false
-      if (shortcut.name !== result.name) {
-        shortcut.name = result.name
-        changed = true
-      }
-      if (shortcut.shortcutForAgentId !== id) {
-        shortcut.shortcutForAgentId = id
-        changed = true
-      }
-      if (changed) upsertStoredItem('sessions', shortcut.id, shortcut)
-    }
-  }
-
-  logActivity({ entityType: 'agent', entityId: id, action: 'updated', actor: 'user', summary: `Agent updated: "${result.name}"` })
   return NextResponse.json(result)
 }
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  // Soft delete — set trashedAt instead of removing the record
-  const result = mutateItem(ops, id, (agent) => {
-    agent.trashedAt = Date.now()
-    return agent
-  })
-  if (!result) return notFound()
-  logActivity({ entityType: 'agent', entityId: id, action: 'deleted', actor: 'user', summary: `Agent trashed: "${result.name}"` })
-
-  // Detach sessions from the trashed agent
-  const sessions = loadSessions()
-  const detached: Array<[string, unknown]> = []
-  for (const session of Object.values(sessions)) {
-    if (!session || session.agentId !== id) continue
-    session.agentId = null
-    session.heartbeatEnabled = false
-    detached.push([session.id, session])
-  }
-  if (detached.length > 0) {
-    upsertStoredItems('sessions', detached)
-  }
-  const detachedSessions = detached.length
-
-  // Cascade: suspend tasks, schedules, watch jobs, connectors, webhooks, chatrooms
-  const cascade = suspendAgentReferences(id)
+  const result = trashAgent(id)
+  if (!result.ok) return notFound()
+  const { detachedSessions, cascade } = result
   if (cascade.tasks) notify('tasks')
   if (cascade.schedules) notify('schedules')
   if (cascade.connectors) notify('connectors')

package/src/app/api/agents/[id]/status/route.ts

@@ -1,13 +1,12 @@
 import { NextResponse } from 'next/server'
-import { loadAgents } from '@/lib/server/storage'
+import { getAgentStatus } from '@/lib/server/agents/agent-service'
 import { getMainLoopStateForSession } from '@/lib/server/agents/main-agent-loop'
 
 export const dynamic = 'force-dynamic'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const agents = loadAgents()
-  const agent = agents[id]
+  const agent = getAgentStatus(id)
   if (!agent) return NextResponse.json(null, { status: 404 })
 
   const sessionId = agent.threadSessionId

package/src/app/api/agents/[id]/thread/route.ts

@@ -1,23 +1,10 @@
 import { NextResponse } from 'next/server'
-import { buildAgentDisabledMessage, isAgentDisabled } from '@/lib/server/agents/agent-availability'
-import { ensureAgentThreadSession } from '@/lib/server/agents/agent-thread-session'
-import type { Agent } from '@/types'
-import { loadAgents } from '@/lib/server/storage'
+import { getAgentThreadSession } from '@/lib/server/agents/agent-service'
 
 export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id: agentId } = await params
   const body = await req.json().catch(() => ({}))
-  const user = body.user || 'default'
-  const agent = loadAgents()[agentId]
-  if (!agent) {
-    return NextResponse.json({ error: 'Agent not found' }, { status: 404 })
-  }
-  const session = ensureAgentThreadSession(agentId, user, agent as Agent)
-  if (!session) {
-    if (isAgentDisabled(agent)) {
-      return NextResponse.json({ error: buildAgentDisabledMessage(agent, 'start new chats') }, { status: 409 })
-    }
-    return NextResponse.json({ error: 'Agent not found' }, { status: 404 })
-  }
-  return NextResponse.json(session)
+  const result = getAgentThreadSession(agentId, typeof body.user === 'string' ? body.user : 'default')
+  if (!result.ok) return NextResponse.json(result.payload, { status: result.status })
+  return NextResponse.json(result.payload)
 }

package/src/app/api/agents/bulk/route.ts

@@ -1,55 +1,13 @@
 import { NextResponse } from 'next/server'
 import { safeParseBody } from '@/lib/server/safe-parse-body'
-import { patchAgent } from '@/lib/server/storage'
-import { logActivity } from '@/lib/server/storage'
-import { notify } from '@/lib/server/ws-hub'
+import { bulkPatchAgents } from '@/lib/server/agents/agent-service'
 
 export async function PATCH(req: Request) {
   const { data: body, error } = await safeParseBody<Record<string, unknown>>(req)
   if (error) return error
-
-  const patches = body.patches
-  if (!Array.isArray(patches) || patches.length === 0) {
-    return NextResponse.json({ error: 'patches must be a non-empty array' }, { status: 400 })
+  const result = bulkPatchAgents(body.patches)
+  if (result.updated === 0 && result.errors.length === 1 && result.errors[0] === 'patches must be a non-empty array') {
+    return NextResponse.json({ error: result.errors[0] }, { status: 400 })
   }
-
-  let updated = 0
-  const errors: string[] = []
-
-  for (const entry of patches) {
-    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
-      errors.push('Invalid patch entry (not an object)')
-      continue
-    }
-    const { id, patch } = entry as { id?: unknown; patch?: unknown }
-    if (typeof id !== 'string' || !id.trim()) {
-      errors.push('Patch entry missing valid id')
-      continue
-    }
-    if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
-      errors.push(`Patch for ${id} is not a valid object`)
-      continue
-    }
-
-    const result = patchAgent(id, (current) => {
-      if (!current) return null
-      return { ...current, ...(patch as Record<string, unknown>), updatedAt: Date.now() }
-    })
-
-    if (result) {
-      updated++
-      logActivity({
-        entityType: 'agent',
-        entityId: id,
-        action: 'updated',
-        actor: 'user',
-        summary: `Bulk patch: updated agent "${result.name || id}"`,
-      })
-    } else {
-      errors.push(`Agent ${id} not found`)
-    }
-  }
-
-  if (updated > 0) notify('agents')
-  return NextResponse.json({ updated, errors })
+  return NextResponse.json(result)
 }