@swarmclawai/swarmclaw 1.3.6 → 1.4.2

package/src/app/api/chats/[id]/chat/route.test.ts

@@ -123,6 +123,70 @@ test('chat route keeps long-lived user runs alive after stream disconnect and re
   assert.ok(output.perfLabels.includes('chat-execution/llm-round-trip'))
 })
 
+test('chat route rejects malformed JSON with a 400 before queueing work', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { error?: string }
+    runCount: number
+  }>(`
+    const storageMod = await import('./src/lib/server/storage')
+    const routeMod = await import('./src/app/api/chats/[id]/chat/route')
+    const runsMod = await import('@/lib/server/runtime/session-run-manager')
+    const storage = storageMod.default || storageMod
+    const route = routeMod.default || routeMod
+    const runs = runsMod.default || runsMod
+
+    const now = Date.now()
+    storage.saveAgents({
+      agent_1: {
+        id: 'agent_1',
+        name: 'Malformed Agent',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        extensions: [],
+        createdAt: now,
+        updatedAt: now,
+      },
+    })
+    storage.saveSessions({
+      sess_1: {
+        id: 'sess_1',
+        name: 'Malformed Session',
+        cwd: process.env.WORKSPACE_DIR,
+        user: 'workbench',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        claudeSessionId: null,
+        messages: [],
+        createdAt: now,
+        lastActiveAt: now,
+        sessionType: 'human',
+        agentId: 'agent_1',
+        extensions: [],
+      },
+    })
+
+    const response = await route.POST(
+      new Request('http://local/api/chats/sess_1/chat', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{bad-json',
+      }),
+      { params: Promise.resolve({ id: 'sess_1' }) },
+    )
+
+    console.log(JSON.stringify({
+      status: response.status,
+      payload: await response.json(),
+      runCount: runs.listRuns({ sessionId: 'sess_1' }).length,
+    }))
+  `, { prefix: 'swarmclaw-chat-route-invalid-json-' })
+
+  assert.equal(output.status, 400)
+  assert.equal(output.payload.error, 'Invalid or missing request body')
+  assert.equal(output.runCount, 0)
+})
+
 test('chat route heartbeat runs stay internal and do not persist terminal ack text', () => {
   const output = runWithTempDataDir<{
     events: Array<{ t?: string; text?: string }>

package/src/app/api/chats/[id]/chat/route.ts

@@ -1,10 +1,23 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
+
 import { enqueueSessionRun, type SessionQueueMode } from '@/lib/server/runtime/session-run-manager'
 import { log } from '@/lib/server/logger'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 300
 
+const ChatRouteBodySchema = z.object({
+  message: z.string().optional().default(''),
+  imagePath: z.string().optional(),
+  imageUrl: z.string().optional(),
+  attachedFiles: z.array(z.string()).optional(),
+  internal: z.boolean().optional().default(false),
+  queueMode: z.enum(['steer', 'collect', 'followup']).optional(),
+  replyToId: z.string().optional(),
+}).passthrough()
+
 function normalizeQueueMode(raw: unknown, internal: boolean): SessionQueueMode {
   if (raw === 'steer' || raw === 'collect' || raw === 'followup') return raw
   return internal ? 'collect' : 'followup'
@@ -13,15 +26,17 @@ function normalizeQueueMode(raw: unknown, internal: boolean): SessionQueueMode {
 export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
   try {
     const { id } = await params
-    const body = await req.json().catch(() => ({}))
+    const { data: body, error } = await safeParseBody(req, ChatRouteBodySchema)
+    if (error) return error
 
-    const message = typeof body.message === 'string' ? body.message : ''
-    const imagePath = typeof body.imagePath === 'string' ? body.imagePath : undefined
-    const imageUrl = typeof body.imageUrl === 'string' ? body.imageUrl : undefined
-    const attachedFiles = Array.isArray(body.attachedFiles) ? body.attachedFiles.filter((f: unknown) => typeof f === 'string') as string[] : undefined
-    const internal = body.internal === true
+    const message = body.message
+    const imagePath = body.imagePath
+    const imageUrl = body.imageUrl
+    const attachedFiles = body.attachedFiles
+    const internal = body.internal
     const queueMode = normalizeQueueMode(body.queueMode, internal)
-    const replyToId = typeof body.replyToId === 'string' ? body.replyToId : undefined
+    const replyToId = body.replyToId
+    const source = internal ? 'heartbeat' : 'chat'
 
     const hasFiles = !!(imagePath || imageUrl || (attachedFiles && attachedFiles.length > 0))
     if (!message.trim() && !hasFiles) {
@@ -50,7 +65,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
           imageUrl,
           attachedFiles,
           internal,
-          source: internal ? 'heartbeat' : 'chat',
+          source,
           mode: queueMode,
           onEvent: (ev) => writeEvent(ev as unknown as Record<string, unknown>),
           replyToId,
@@ -78,6 +93,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
               status: run.deduped ? 'deduped' : run.coalesced ? 'coalesced' : 'queued',
               position: run.position,
               internal,
+              source,
               mode: queueMode,
             },
           }),

package/src/app/api/chats/[id]/deploy/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import { execSync } from 'child_process'
+import { execSync, execFileSync } from 'child_process'
 import { notFound } from '@/lib/server/collection-helpers'
 import { safeParseBody } from '@/lib/server/safe-parse-body'
 import { log } from '@/lib/server/logger'
@@ -21,7 +21,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
     execSync('git add -A', opts)
     let committed = false
     try {
-      execSync(`git commit -m "${msg.replace(/"/g, '\\"')}"`, opts)
+      execFileSync('git', ['commit', '-m', msg], opts)
       committed = true
     } catch (ce: unknown) {
       const ex = ce as { stdout?: string; stderr?: string }

package/src/app/api/chats/chat-route.test.ts

@@ -0,0 +1,68 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { runWithTempDataDir } from '@/lib/server/test-utils/run-with-temp-data-dir'
+
+test('chat route rejects malformed JSON with a 400 before queueing work', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { error?: string }
+    runCount: number
+  }>(`
+    const storageMod = await import('./src/lib/server/storage')
+    const routeMod = await import('./src/app/api/chats/[id]/chat/route')
+    const runsMod = await import('@/lib/server/runtime/session-run-manager')
+    const storage = storageMod.default || storageMod
+    const route = routeMod.default || routeMod
+    const runs = runsMod.default || runsMod
+
+    const now = Date.now()
+    storage.saveAgents({
+      agent_1: {
+        id: 'agent_1',
+        name: 'Malformed Agent',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        extensions: [],
+        createdAt: now,
+        updatedAt: now,
+      },
+    })
+    storage.saveSessions({
+      sess_1: {
+        id: 'sess_1',
+        name: 'Malformed Session',
+        cwd: process.env.WORKSPACE_DIR,
+        user: 'workbench',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        claudeSessionId: null,
+        messages: [],
+        createdAt: now,
+        lastActiveAt: now,
+        sessionType: 'human',
+        agentId: 'agent_1',
+        extensions: [],
+      },
+    })
+
+    const response = await route.POST(
+      new Request('http://local/api/chats/sess_1/chat', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{bad-json',
+      }),
+      { params: Promise.resolve({ id: 'sess_1' }) },
+    )
+
+    console.log(JSON.stringify({
+      status: response.status,
+      payload: await response.json(),
+      runCount: runs.listRuns({ sessionId: 'sess_1' }).length,
+    }))
+  `, { prefix: 'swarmclaw-chat-route-invalid-json-' })
+
+  assert.equal(output.status, 400)
+  assert.equal(output.payload.error, 'Invalid or missing request body')
+  assert.equal(output.runCount, 0)
+})

package/src/app/api/connectors/[id]/doctor/route.test.ts

@@ -0,0 +1,97 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { runWithTempDataDir } from '@/lib/server/test-utils/run-with-temp-data-dir'
+
+test('connector doctor route rejects malformed JSON with a 400', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { error?: string }
+  }>(`
+    const repoMod = await import('./src/lib/server/connectors/connector-repository')
+    const routeMod = await import('./src/app/api/connectors/[id]/doctor/route')
+    const repo = repoMod.default || repoMod
+    const route = routeMod.default || routeMod
+
+    repo.saveConnectors({
+      conn_1: {
+        id: 'conn_1',
+        name: 'Doctor Test',
+        platform: 'discord',
+        agentId: 'agent_1',
+        chatroomId: null,
+        credentialId: null,
+        config: {},
+        isEnabled: true,
+        status: 'running',
+        createdAt: 1,
+        updatedAt: 1,
+      },
+    })
+
+    const response = await route.POST(new Request('http://local/api/connectors/conn_1/doctor', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: '{bad-json',
+    }), { params: Promise.resolve({ id: 'conn_1' }) })
+
+    console.log(JSON.stringify({
+      status: response.status,
+      payload: await response.json(),
+    }))
+  `, { prefix: 'swarmclaw-connector-doctor-route-' })
+
+  assert.equal(output.status, 400)
+  assert.equal(output.payload.error, 'Invalid or missing request body')
+})
+
+test('connector doctor route returns a preview report for valid input', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { warnings?: string[]; policy?: { mode?: string } }
+  }>(`
+    const repoMod = await import('./src/lib/server/connectors/connector-repository')
+    const routeMod = await import('./src/app/api/connectors/[id]/doctor/route')
+    const repo = repoMod.default || repoMod
+    const route = routeMod.default || routeMod
+
+    repo.saveConnectors({
+      conn_1: {
+        id: 'conn_1',
+        name: 'Doctor Test',
+        platform: 'discord',
+        agentId: 'agent_1',
+        chatroomId: null,
+        credentialId: null,
+        config: {},
+        isEnabled: true,
+        status: 'running',
+        createdAt: 1,
+        updatedAt: 1,
+      },
+    })
+
+    const response = await route.POST(new Request('http://local/api/connectors/conn_1/doctor', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        sampleMsg: {
+          channelId: 'channel-1',
+          channelName: 'general',
+          senderId: 'user-1',
+          senderName: 'User',
+          text: 'hello',
+        },
+      }),
+    }), { params: Promise.resolve({ id: 'conn_1' }) })
+
+    console.log(JSON.stringify({
+      status: response.status,
+      payload: await response.json(),
+    }))
+  `, { prefix: 'swarmclaw-connector-doctor-route-' })
+
+  assert.equal(output.status, 200)
+  assert.ok(Array.isArray(output.payload.warnings))
+  assert.ok(output.payload.policy)
+})

package/src/app/api/connectors/[id]/doctor/route.ts

@@ -1,10 +1,34 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
+
 import { notFound } from '@/lib/server/collection-helpers'
 import { buildConnectorDoctorPreview, buildConnectorDoctorReport, type ConnectorDoctorPreviewInput } from '@/lib/server/connectors/doctor'
 import { loadConnectors } from '@/lib/server/connectors/connector-repository'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
 
 export const dynamic = 'force-dynamic'
 
+const ConnectorDoctorPreviewSchema: z.ZodType<ConnectorDoctorPreviewInput> = z.object({
+  id: z.unknown().optional(),
+  name: z.unknown().optional(),
+  platform: z.unknown().optional(),
+  agentId: z.unknown().optional(),
+  chatroomId: z.unknown().optional(),
+  credentialId: z.unknown().optional(),
+  config: z.record(z.string(), z.unknown()).optional(),
+  sampleMsg: z.object({
+    channelId: z.string().optional(),
+    channelName: z.string().optional(),
+    senderId: z.string().optional(),
+    senderName: z.string().optional(),
+    text: z.string().optional(),
+    isGroup: z.boolean().optional(),
+    messageId: z.string().optional(),
+    replyToMessageId: z.string().optional(),
+    threadId: z.string().optional(),
+  }).passthrough().nullable().optional(),
+}).passthrough()
+
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const connectors = loadConnectors()
@@ -20,7 +44,8 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   const baseConnector = connectors[id]
   if (!baseConnector) return notFound()
 
-  const body = await req.json().catch(() => ({})) as ConnectorDoctorPreviewInput
+  const { data: body, error } = await safeParseBody(req, ConnectorDoctorPreviewSchema)
+  if (error) return error
   const connector = buildConnectorDoctorPreview({ baseConnector, input: body, fallbackId: id })
   return NextResponse.json(buildConnectorDoctorReport(connector, body.sampleMsg, { baseConnector }))
 }

package/src/app/api/connectors/connector-doctor-route.test.ts

@@ -0,0 +1 @@
+import './[id]/doctor/route.test'

package/src/app/api/logs/route.test.ts

@@ -0,0 +1,61 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { runWithTempDataDir } from '@/lib/server/test-utils/run-with-temp-data-dir'
+
+test('logs route accepts client-side error reports and persists them', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { ok?: boolean }
+    entries: Array<{ tag?: string; message?: string; data?: string }>
+  }>(`
+    const routeMod = await import('./src/app/api/logs/route')
+    const route = routeMod.default || routeMod
+
+    const postResponse = await route.POST(new Request('http://local/api/logs', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        source: 'error-boundary',
+        message: 'Client render failed',
+        componentStack: 'at DemoComponent',
+      }),
+    }))
+
+    const getResponse = await route.GET(new Request('http://local/api/logs?lines=5&search=Client%20render%20failed'))
+
+    console.log(JSON.stringify({
+      status: postResponse.status,
+      payload: await postResponse.json(),
+      entries: (await getResponse.json()).entries,
+    }))
+  `, { prefix: 'swarmclaw-logs-route-' })
+
+  assert.equal(output.status, 200)
+  assert.equal(output.payload.ok, true)
+  assert.ok(output.entries.some((entry) => entry.tag === 'error-boundary' && entry.message === 'Client render failed'))
+})
+
+test('logs route rejects malformed client error payloads with a 400', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { error?: string }
+  }>(`
+    const routeMod = await import('./src/app/api/logs/route')
+    const route = routeMod.default || routeMod
+
+    const response = await route.POST(new Request('http://local/api/logs', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: '{bad-json',
+    }))
+
+    console.log(JSON.stringify({
+      status: response.status,
+      payload: await response.json(),
+    }))
+  `, { prefix: 'swarmclaw-logs-route-' })
+
+  assert.equal(output.status, 400)
+  assert.equal(output.payload.error, 'Invalid or missing request body')
+})

package/src/app/api/logs/route.ts

@@ -1,10 +1,25 @@
 import { NextResponse } from 'next/server'
 import fs from 'fs'
+import { z } from 'zod'
+
 import { APP_LOG_PATH } from '@/lib/server/data-dir'
+import { log } from '@/lib/server/logger'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
 
 /** Max bytes to read from the tail of the log file (256 KB). */
 const TAIL_BYTES = 256 * 1024
 
+const ClientLogSchema = z.object({
+  source: z.string().trim().min(1).max(120).optional().default('client'),
+  message: z.string().trim().min(1).max(1000),
+  stack: z.string().max(8000).optional(),
+  componentStack: z.string().max(8000).optional(),
+  digest: z.string().max(200).optional(),
+  url: z.string().max(2000).optional(),
+  pathname: z.string().max(1000).optional(),
+  userAgent: z.string().max(1000).optional(),
+})
+
 export async function GET(req: Request) {
   const { searchParams } = new URL(req.url)
   const lines = parseInt(searchParams.get('lines') || '200', 10)
@@ -76,6 +91,26 @@ export async function DELETE() {
   }
 }
 
+export async function POST(req: Request) {
+  const { data: body, error } = await safeParseBody(req, ClientLogSchema)
+  if (error) return error
+
+  try {
+    log.error(body.source, body.message, {
+      stack: body.stack,
+      componentStack: body.componentStack,
+      digest: body.digest,
+      url: body.url,
+      pathname: body.pathname,
+      userAgent: body.userAgent,
+    })
+    return NextResponse.json({ ok: true })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    return NextResponse.json({ error: message }, { status: 500 })
+  }
+}
+
 function parseLine(line: string) {
   // Format: [2026-02-19T17:06:00.000Z] [INFO] [tag] message | data
   const match = line.match(/^\[([^\]]+)\]\s+\[(\w+)\]\s+\[([^\]]+)\]\s+(.*)$/)

package/src/app/api/openclaw/sync/route.ts

@@ -4,7 +4,7 @@ import { safeParseBody } from '@/lib/server/safe-parse-body'
 export const dynamic = 'force-dynamic'
 
 const VALID_ACTIONS = new Set(['push', 'pull', 'both'])
-const VALID_TYPES: SyncType[] = ['memory', 'workspace', 'schedules', 'credentials', 'plugins']
+const VALID_TYPES: SyncType[] = ['memory', 'workspace', 'schedules', 'credentials', 'extensions']
 
 export async function POST(req: Request) {
   try {

package/src/app/api/swarmfeed/channels/route.ts

@@ -0,0 +1,14 @@
+import { NextResponse } from 'next/server'
+import { getChannels } from '@/lib/swarmfeed-client'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET() {
+  try {
+    const channels = await getChannels()
+    return NextResponse.json({ channels })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to fetch channels'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/swarmfeed/posts/route.ts

@@ -0,0 +1,60 @@
+import { NextResponse } from 'next/server'
+import { createPost, getFeed } from '@/lib/swarmfeed-client'
+import { getAgent } from '@/lib/server/agents/agent-repository'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
+import type { Agent } from '@/types'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const cursor = searchParams.get('cursor') || undefined
+  const limitStr = searchParams.get('limit')
+  const limit = limitStr ? Math.max(1, Math.min(100, Number(limitStr) || 20)) : undefined
+
+  try {
+    const result = await getFeed('for_you', { cursor, limit })
+    return NextResponse.json(result)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to fetch posts'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+export async function POST(req: Request) {
+  const { data: body, error } = await safeParseBody<{
+    agentId?: string
+    content?: string
+    channelId?: string
+    parentId?: string
+  }>(req)
+  if (error) return error
+
+  if (!body?.agentId || typeof body.agentId !== 'string') {
+    return NextResponse.json({ error: 'agentId is required' }, { status: 400 })
+  }
+  if (!body.content || typeof body.content !== 'string' || !body.content.trim()) {
+    return NextResponse.json({ error: 'content is required' }, { status: 400 })
+  }
+
+  // Look up the agent's SwarmFeed API key
+  const agent = getAgent(body.agentId) as Agent | undefined
+  if (!agent?.swarmfeedApiKey) {
+    return NextResponse.json(
+      { error: 'Agent not registered on SwarmFeed. Enable SwarmFeed in agent settings first.' },
+      { status: 400 },
+    )
+  }
+
+  try {
+    const post = await createPost(agent.swarmfeedApiKey, {
+      content: body.content.trim(),
+      channelId: typeof body.channelId === 'string' ? body.channelId : undefined,
+      parentId: typeof body.parentId === 'string' ? body.parentId : undefined,
+    })
+    return NextResponse.json(post)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to create post'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/swarmfeed/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from 'next/server'
+import { getFeed } from '@/lib/swarmfeed-client'
+import { loadAgents } from '@/lib/server/storage'
+import type { FeedType } from '@/types/swarmfeed'
+import type { Agent } from '@/types'
+
+export const dynamic = 'force-dynamic'
+
+const VALID_FEED_TYPES = new Set<FeedType>(['for_you', 'following', 'channel', 'trending'])
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const type = (searchParams.get('type') || 'for_you') as FeedType
+  if (!VALID_FEED_TYPES.has(type)) {
+    return NextResponse.json({ error: 'Invalid feed type' }, { status: 400 })
+  }
+  const channelId = searchParams.get('channelId') || undefined
+  const cursor = searchParams.get('cursor') || undefined
+  const limitStr = searchParams.get('limit')
+  const limit = limitStr ? Math.max(1, Math.min(100, Number(limitStr) || 20)) : undefined
+
+  // For authenticated feeds (following), find the first enabled agent's API key
+  let agentApiKey: string | undefined
+  if (type === 'following') {
+    const agents = Object.values(loadAgents()) as Agent[]
+    const feedAgent = agents.find((a) => a.swarmfeedEnabled && a.swarmfeedApiKey)
+    agentApiKey = feedAgent?.swarmfeedApiKey ?? undefined
+  }
+
+  try {
+    const result = await getFeed(type, { channelId, cursor, limit }, agentApiKey)
+    return NextResponse.json(result)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to fetch feed'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}