@swarmclawai/swarmclaw 1.4.0 → 1.4.2

package/README.md

@@ -211,79 +211,11 @@ SwarmClaw agents can join [SwarmFeed](https://swarmfeed.ai) — a social network
 
 Read the docs at [swarmclaw.ai/docs/swarmfeed](https://swarmclaw.ai/docs/swarmfeed) and visit [swarmfeed.ai](https://swarmfeed.ai) for the platform itself.
 
----
-
-## Release Notes
-
-### v1.3.9 Highlights
-
-- **SwarmFeed integration**: native social network for AI agents, accessible from the SwarmClaw sidebar. Agents can browse feeds (For You, Following, Trending), compose posts, react, follow other agents, and join topic channels.
-- **Per-agent authentication**: each agent registers on SwarmFeed with its own Ed25519 keypair and API key. Auto-registration flow on opt-in.
-- **Heartbeat integration**: agents can auto-browse feeds, post content, reply to mentions, and follow relevant agents during heartbeat cycles.
-
-### v1.3.8 Highlights
-
-- **@swarmdock/sdk 0.4.x sync**: updated package-lock.json to align with latest SwarmDock SDK.
-- **Release workflow fix**: added disk space cleanup step to prevent out-of-space failures during Docker builds in CI.
-
-### v1.3.7 Highlights
-
-- **Visual protocol builder**: drag-and-drop canvas for designing protocol templates, powered by React Flow. Includes a node palette with all step types (phase, branch, loop, parallel, join, for-each, subflow, swarm, complete), a node inspector for editing step properties, branch/loop/default edge types, a template gallery, DAG validation (orphan detection, reachability checks, branch-case coverage), undo/redo, and dagre auto-layout.
-- **A2A protocol support**: Agent-to-Agent delegation via JSON-RPC 2.0. New `POST /api/a2a` endpoint, `.well-known/agent-card` discovery, and task status polling. Protocol runs can now include `a2a_delegate` phases that call remote A2A-compatible agents with timeout, retry, and credential management. New CLI commands: `swarmclaw a2a send`, `a2a agent-card`, `a2a task-status`.
-- **Builder test alignment**: converted protocol builder test suite from vitest to the project-standard `node:test` + `node:assert/strict` runner.
-- **Lint fix**: resolved `@ts-ignore` → `@ts-expect-error` in OpenAI provider.
-
-### v1.3.6 Highlights
-
-- **Knowledge hygiene visibility fix**: exact-duplicate archival now only applies when sources share the same visibility and origin fingerprint. Same-content global and agent-scoped sources no longer collapse into a single archived record, so global knowledge stays available to unrelated agents.
-- **Release gate hardening**: the default test matrix now includes the 1.3.5 grounding/knowledge/runtime suites, and both CI and tag releases run `npm test`, `npm run type-check`, and `npm run build:ci` before publishing.
-
-### v1.3.5 Highlights
-
-- **Knowledge grounding & citations**: agent responses are now grounded against knowledge sources at retrieval time. Citations — with scores, snippets, and match rationale — are persisted on chat messages, protocol events, and run records for full auditability.
-- **Knowledge source lifecycle**: new source management system with create, sync, archive, restore, supersede, and delete operations. Sources can be manual text, files (30+ formats including code, markup, PDF), or URLs (HTML auto-parsed).
-- **Hygiene automation**: background scanner detects stale, duplicate, overlapping, and broken knowledge sources. Auto-syncs stale file/URL sources and archives exact duplicates on idle.
-- **Redesigned Knowledge page**: detail-focused layout with sidebar list, full source inspector (metadata, chunks, sync status), and inline actions. Search/browse toggle, tag filtering, and archive visibility controls.
-- **Grounding panel**: new reusable citation display component shown on chat messages, protocol artifacts, and run results — surfaces retrieval query, hit scores, snippets, and source links.
-- **7 new API endpoints**: `/knowledge/hygiene` (GET/POST), `/knowledge/sources/:id/archive`, `/restore`, `/supersede`, `/sync` for full source lifecycle management via CLI and API.
-- **Protocol citation propagation**: structured protocol runs now capture and persist citations on participant responses and emitted artifacts.
-- **Dreaming (idle-time memory consolidation)**: agents now consolidate and optimize memories during idle periods. Two-tier system: server-side deterministic operations (decay, prune, promote, dedup) plus agent-driven LLM reflection that surfaces patterns and produces consolidated insights.
-- **Per-agent dream configuration**: dreaming is opt-in per agent with configurable cooldown, decay age, prune threshold, and Tier 2 reflection controls.
-- **Dream cycle audit trail**: every dream cycle is tracked with status, trigger, duration, and detailed results. Viewable in the memory UI and via CLI.
-- **3 new API endpoints**: `/memory/dream` (GET/POST), `/memory/dream/:id` for dream cycle management.
-
-### v1.3.4 Highlights
-
-- **Bug fix — custom provider loading under Turbopack (#32)**: converted all CommonJS `require()` calls across the codebase to ES module imports, fixing "Unknown provider: custom-\<id\>" errors and other potential Turbopack compatibility issues. Affected modules: providers, provider health, subagent swarm, prompt builder, chat finalization, CLI utils, and OpenClaw connectors. Thanks to @psywolf85 for the initial fix.
-
-### v1.3.3 Highlights
-
-- **Bug fix — stale connector status after auto-restart (#31)**: connectors that auto-restart via the daemon health monitor now show "Starting" instead of a stale "Stopped" or "Error" status in the UI until the daemon reports runtime state. Added `starting` to the `ConnectorStatus` type and updated both the connector list and detail views.
-- **Bug fix — stale credentialId after credential rotation (#30)**: when a provider credential is deleted and re-created, connector sessions now fall back to resolving any valid credential for the same provider instead of failing with "Missing credentials."
-
-### v1.3.2 Highlights
-
-- **Custom provider fix for standalone builds**: fixed `require('@/lib/server/storage')` path alias resolution failure that caused custom providers to silently break in standalone/npm-global installs with "a is not a function" errors. All dynamic requires now use relative paths that resolve correctly at runtime.
-- **GitHub Copilot CLI provider**: new CLI provider wrapping the `copilot` binary with JSONL streaming, session continuity, system prompt injection, and multi-model support (Claude, GPT, Gemini via GitHub Copilot subscription).
-
-### v1.3.1 Highlights
-
-- **SwarmDock SDK v0.2.3**: upgraded marketplace integration with typed error handling, escrow state tracking, task invitation support for private tasks, and required example prompts for skill registration.
-- **SDK error resilience**: registration now gracefully handles already-registered agents by falling back to authentication; heartbeat catches expired tokens and re-authenticates automatically.
-- **Escrow event tracking**: new `escrow.releasing`, `escrow.refunding`, `escrow.release_failed`, and `escrow.refund_failed` SSE events are logged as activity entries, with failure events surfaced as incidents.
-- **Private task invitations**: when a SwarmDock task invites this agent directly, auto-discovery now evaluates it alongside public `task.created` events.
-- **SDK type imports**: replaced inlined SwarmDock type stubs with proper imports from `@swarmdock/shared`, eliminating type drift.
-
-### v1.3.0 Highlights
-
-- **SwarmDock SDK v0.2.0**: upgraded marketplace integration to handle the new task lifecycle — `review` and `disputed` states are now tracked on board tasks, skill registration supports `inputModes`/`outputModes`, task submission accepts `notes`, and connector config supports `paymentPrivateKey` for on-chain payment signing.
-- **Comprehensive audit logging**: activity log now covers approval decisions, settings changes, budget modifications, and credential operations, with SQL-indexed paginated queries replacing the in-memory full-collection scan.
-- **Push-based cost rollups**: agent spend fields (`spentHourlyCents`, `spentDailyCents`, `spentMonthlyCents`) update atomically on every usage event, with automatic budget warning/exceeded activity entries and window reset detection — replacing the pull-based full-scan approach.
-- **Goal hierarchy**: new goals system with organization → team → project → agent → task levels, parent-child chains, and automatic injection of the "why chain" into agent execution briefs. Full CRUD API and CLI support.
-- **Extended approval workflows**: new `agent_create`, `budget_change`, and `delegation_enable` approval categories with configurable policies in settings. When enabled, agent creation returns a pending approval instead of creating the agent directly.
-- **Shared validation schemas**: Zod schemas in `src/lib/validation/schemas.ts` are now safe for client-side import (server-only DAG validation moved to `server-schemas.ts`), enabling form-level pre-validation.
+## Releases
 
-*For older release notes (v1.2.x and earlier), see [swarmclaw.ai/docs/release-notes](https://swarmclaw.ai/docs/release-notes).*
+- GitHub releases: https://github.com/swarmclawai/swarmclaw/releases
+- npm package: https://www.npmjs.com/package/@swarmclawai/swarmclaw
+- Historical release notes: https://swarmclaw.ai/docs/release-notes
 
 
 ## What SwarmClaw Focuses On
@@ -339,6 +271,7 @@ Running `swarmclaw` starts the server on `http://localhost:3456`.
 ```bash
 git clone https://github.com/swarmclawai/swarmclaw.git
 cd swarmclaw
+nvm use
 npm run quickstart
 ```
 
@@ -381,7 +314,7 @@ Then open `http://localhost:3456`.
 
 ## Requirements
 
-- Node.js 22.6+
+- Node.js 22.6+ (`nvm use` will pick up the repo's `.nvmrc`, which matches CI)
 - npm 10+ or another supported package manager
 - Docker Desktop is recommended for sandbox browser execution
 - Optional provider CLIs if you want delegated CLI backends such as Claude Code, Codex, OpenCode, or Gemini

package/next.config.ts

@@ -6,6 +6,10 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 const PROJECT_ROOT = path.dirname(fileURLToPath(import.meta.url))
+const RUNTIME_STATE_GLOBS = [
+  'data/**/*',
+  '.tmp-swarmclaw-build/**/*',
+]
 
 function getGitSha(): string {
   try {
@@ -46,10 +50,11 @@ function getAllowedDevOrigins(): string[] {
 const nextConfig: NextConfig = {
   output: 'standalone',
   outputFileTracingExcludes: {
-    '/api/**': ['data/browser-profiles/**/*', 'data/browser-profiles-regression/**/*'],
-    instrumentation: ['data/browser-profiles/**/*', 'data/browser-profiles-regression/**/*'],
-    '/instrumentation': ['data/browser-profiles/**/*', 'data/browser-profiles-regression/**/*'],
-    'next-server': ['data/browser-profiles/**/*', 'data/browser-profiles-regression/**/*'],
+    '/*': RUNTIME_STATE_GLOBS,
+    '/api/**': RUNTIME_STATE_GLOBS,
+    instrumentation: RUNTIME_STATE_GLOBS,
+    '/instrumentation': RUNTIME_STATE_GLOBS,
+    'next-server': RUNTIME_STATE_GLOBS,
   },
   turbopack: {
     // Pin workspace root to the project directory so a stale lockfile

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmclawai/swarmclaw",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Self-hosted AI runtime for OpenClaw, delegation, autonomy, runtime skills, crypto wallets, and chat platform connectors.",
   "license": "MIT",
   "publishConfig": {
@@ -38,6 +38,9 @@
     "scripts/easy-update.mjs",
     "scripts/ensure-sandbox-browser-image.mjs",
     "scripts/postinstall.mjs",
+    "scripts/build-bootstrap-env.mjs",
+    "scripts/run-next-build.mjs",
+    "scripts/run-next-typegen.mjs",
     "scripts/sandbox-browser-entrypoint.sh",
     "next.config.ts",
     "tsconfig.json",
@@ -52,16 +55,15 @@
     "dev": "next dev --turbopack --hostname 0.0.0.0 -p 3456",
     "dev:webpack": "next dev --webpack --hostname 0.0.0.0 -p 3456",
     "dev:clean": "rm -rf .next && next dev --turbopack --hostname 0.0.0.0 -p 3456",
-    "build": "next build --webpack",
-    "build:ci": "NEXT_DISABLE_ESLINT=1 next build --webpack",
+    "typegen": "node ./scripts/run-next-typegen.mjs",
+    "build": "node ./scripts/run-next-build.mjs",
+    "build:ci": "NEXT_DISABLE_ESLINT=1 node ./scripts/run-next-build.mjs",
     "start": "node .next/standalone/server.js",
     "start:standalone": "node .next/standalone/server.js",
-    "smoke:browser": "node ./scripts/browser-route-smoke.mjs",
-    "smoke:browser:workbench": "node ./scripts/browser-workbench-smoke.mjs",
     "sandbox:build:browser": "docker build -f Dockerfile.sandbox-browser -t swarmclaw-sandbox-browser:bookworm-slim .",
     "benchmark:autonomy": "node ./scripts/benchmark-autonomy-harness.mjs",
     "benchmark:agent-regression": "node --import tsx ./scripts/run-agent-regression-suite.ts",
-    "type-check": "tsc --noEmit",
+    "type-check": "npm run typegen && tsc --noEmit --incremental false",
     "test": "npm run test:cli && npm run test:setup && npm run test:openclaw && npm run test:runtime && npm run test:builder",
     "format": "eslint --fix",
     "lint": "eslint",
@@ -69,10 +71,10 @@
     "lint:baseline": "node ./scripts/lint-baseline.mjs check",
     "lint:baseline:update": "node ./scripts/lint-baseline.mjs update",
     "cli": "node ./bin/swarmclaw.js",
-    "test:cli": "node --test src/cli/*.test.js bin/*.test.js scripts/postinstall.test.mjs",
+    "test:cli": "node --test src/cli/*.test.js bin/*.test.js scripts/postinstall.test.mjs scripts/run-next-build.test.mjs scripts/run-next-typegen.test.mjs",
     "test:setup": "tsx --test src/app/api/setup/check-provider/route.test.ts src/lib/server/provider-model-discovery.test.ts src/components/auth/setup-wizard/utils.test.ts src/components/auth/setup-wizard/types.test.ts src/hooks/setup-done-detection.test.ts src/lib/setup-defaults.test.ts",
     "test:openclaw": "tsx --test src/lib/openclaw/openclaw-agent-id.test.ts src/lib/openclaw/openclaw-endpoint.test.ts src/lib/server/agents/agent-runtime-config.test.ts src/lib/server/build-llm.test.ts src/lib/server/connectors/connector-routing.test.ts src/lib/server/connectors/openclaw.test.ts src/lib/server/gateway/protocol.test.ts src/lib/server/llm-response-cache.test.ts src/lib/server/mcp-conformance.test.ts src/lib/server/openclaw/agent-resolver.test.ts src/lib/server/openclaw/deploy.test.ts src/lib/server/openclaw/skills-normalize.test.ts src/lib/server/session-tools/openclaw-nodes.test.ts src/lib/server/tasks/task-quality-gate.test.ts src/lib/server/tasks/task-validation.test.ts src/lib/server/tool-capability-policy.test.ts src/lib/providers/openclaw-exports.test.ts src/app/api/openclaw/dashboard-url/route.test.ts",
-    "test:runtime": "tsx --test src/lib/server/knowledge-sources.test.ts src/lib/server/chat-execution/chat-execution-grounding.test.ts src/lib/server/protocols/protocol-service.test.ts src/lib/server/runtime/run-ledger.test.ts",
+    "test:runtime": "tsx --test src/lib/server/knowledge-sources.test.ts src/lib/server/chat-execution/chat-execution-grounding.test.ts src/lib/server/protocols/protocol-service.test.ts src/lib/server/runtime/run-ledger.test.ts src/lib/server/safe-parse-body.test.ts src/app/api/approvals/route.test.ts src/app/api/chats/chat-route.test.ts src/app/api/connectors/connector-doctor-route.test.ts src/app/api/logs/route.test.ts src/app/api/tts/route.test.ts",
     "test:builder": "tsx --test src/features/protocols/builder/utils/nodes-to-template.test.ts src/features/protocols/builder/utils/template-to-nodes.test.ts src/features/protocols/builder/validators/dag-validator.test.ts",
     "test:e2e": "tsx .workbench/browser-e2e/run.ts",
     "test:mcp:conformance": "node --import tsx ./scripts/mcp-conformance-check.ts",

package/scripts/build-bootstrap-env.mjs

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+export const BUILD_BOOTSTRAP_ROOT_NAME = '.tmp-swarmclaw-build'
+
+export function resolveBuildBootstrapPaths(cwd = process.cwd()) {
+  const rootDir = path.join(cwd, BUILD_BOOTSTRAP_ROOT_NAME)
+  return {
+    rootDir,
+    dataDir: path.join(rootDir, 'data'),
+    workspaceDir: path.join(rootDir, 'workspace'),
+    browserProfilesDir: path.join(rootDir, 'browser-profiles'),
+  }
+}
+
+export function ensureBuildBootstrapPaths(cwd = process.cwd()) {
+  const paths = resolveBuildBootstrapPaths(cwd)
+  for (const dir of [paths.rootDir, paths.dataDir, paths.workspaceDir, paths.browserProfilesDir]) {
+    fs.mkdirSync(dir, { recursive: true })
+  }
+  return paths
+}

package/scripts/run-next-build.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+
+import { spawnSync } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { pathToFileURL } from 'node:url'
+
+import { ensureBuildBootstrapPaths } from './build-bootstrap-env.mjs'
+
+const require = createRequire(import.meta.url)
+
+export const DEFAULT_MAX_OLD_SPACE_SIZE_MB = '8192'
+export const TRACE_COPY_WARNING = 'Failed to copy traced files'
+
+export function mergeNodeOptions(nodeOptions = '', maxOldSpaceSizeMb = DEFAULT_MAX_OLD_SPACE_SIZE_MB) {
+  const trimmed = nodeOptions.trim()
+  if (/(^|\s)--max-old-space-size(?:=|\s|$)/.test(trimmed)) return trimmed
+  return trimmed
+    ? `${trimmed} --max-old-space-size=${maxOldSpaceSizeMb}`
+    : `--max-old-space-size=${maxOldSpaceSizeMb}`
+}
+
+export function buildNextBuildEnv(
+  env = process.env,
+  maxOldSpaceSizeMb = DEFAULT_MAX_OLD_SPACE_SIZE_MB,
+  cwd = process.cwd(),
+) {
+  const bootstrapPaths = ensureBuildBootstrapPaths(cwd)
+  return {
+    ...env,
+    DATA_DIR: bootstrapPaths.dataDir,
+    WORKSPACE_DIR: bootstrapPaths.workspaceDir,
+    BROWSER_PROFILES_DIR: bootstrapPaths.browserProfilesDir,
+    NODE_OPTIONS: mergeNodeOptions(env.NODE_OPTIONS || '', maxOldSpaceSizeMb),
+    SWARMCLAW_BUILD_MODE: env.SWARMCLAW_BUILD_MODE || '1',
+  }
+}
+
+export function hasTraceCopyWarning(output = '') {
+  return output.includes(TRACE_COPY_WARNING)
+}
+
+export function runNextBuild(args = process.argv.slice(2), env = process.env, cwd = process.cwd()) {
+  const nextBin = require.resolve('next/dist/bin/next')
+  return spawnSync(process.execPath, [nextBin, 'build', '--webpack', ...args], {
+    stdio: 'pipe',
+    encoding: 'utf-8',
+    env: buildNextBuildEnv(env, DEFAULT_MAX_OLD_SPACE_SIZE_MB, cwd),
+    cwd,
+  })
+}
+
+function main() {
+  const result = runNextBuild()
+  if (result.stdout) process.stdout.write(result.stdout)
+  if (result.stderr) process.stderr.write(result.stderr)
+  if (result.error) throw result.error
+  const combinedOutput = `${result.stdout || ''}\n${result.stderr || ''}`
+  if ((result.status ?? 1) === 0 && hasTraceCopyWarning(combinedOutput)) {
+    console.error('Build emitted standalone trace copy warnings; failing to keep CI deterministic.')
+    process.exit(1)
+  }
+  if (typeof result.status === 'number') {
+    process.exit(result.status)
+  }
+  if (result.signal) {
+    process.kill(process.pid, result.signal)
+    return
+  }
+  process.exit(1)
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  main()
+}

package/scripts/run-next-typegen.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { pathToFileURL } from 'node:url'
+
+import { ensureBuildBootstrapPaths } from './build-bootstrap-env.mjs'
+
+const require = createRequire(import.meta.url)
+
+export const TYPEGEN_ARTIFACT_PATHS = [
+  '.next/types',
+  '.next/dev/types',
+  'tsconfig.tsbuildinfo',
+]
+
+export function cleanupTypegenArtifacts(cwd = process.cwd()) {
+  for (const relativePath of TYPEGEN_ARTIFACT_PATHS) {
+    fs.rmSync(path.join(cwd, relativePath), { recursive: true, force: true })
+  }
+}
+
+export function buildNextTypegenEnv(env = process.env, cwd = process.cwd()) {
+  const bootstrapPaths = ensureBuildBootstrapPaths(cwd)
+  return {
+    ...env,
+    DATA_DIR: bootstrapPaths.dataDir,
+    WORKSPACE_DIR: bootstrapPaths.workspaceDir,
+    BROWSER_PROFILES_DIR: bootstrapPaths.browserProfilesDir,
+    SWARMCLAW_BUILD_MODE: env.SWARMCLAW_BUILD_MODE || '1',
+  }
+}
+
+export function runNextTypegen(args = process.argv.slice(2), env = process.env, cwd = process.cwd()) {
+  cleanupTypegenArtifacts(cwd)
+  const nextBin = require.resolve('next/dist/bin/next')
+  return spawnSync(process.execPath, [nextBin, 'typegen', ...args], {
+    stdio: 'inherit',
+    env: buildNextTypegenEnv(env, cwd),
+    cwd,
+  })
+}
+
+function main() {
+  const result = runNextTypegen()
+  if (result.error) throw result.error
+  if (typeof result.status === 'number') {
+    process.exit(result.status)
+  }
+  if (result.signal) {
+    process.kill(process.pid, result.signal)
+    return
+  }
+  process.exit(1)
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  main()
+}

package/src/app/api/approvals/route.test.ts

@@ -47,7 +47,7 @@ test('GET and POST /api/approvals handle human-loop approvals only', () => {
       data: { question: 'Deploy now?' },
     })
 
-    const pendingBefore = await route.GET()
+    const pendingBefore = await route.GET(new Request('http://local/api/approvals'))
     const pendingBeforeJson = await pendingBefore.json()
 
     const approveResponse = await route.POST(new Request('http://local/api/approvals', {
@@ -57,7 +57,7 @@ test('GET and POST /api/approvals handle human-loop approvals only', () => {
     }))
     const approvePayload = await approveResponse.json()
 
-    const pendingAfter = await route.GET()
+    const pendingAfter = await route.GET(new Request('http://local/api/approvals'))
     const pendingAfterJson = await pendingAfter.json()
 
     const storedApproval = storage.loadApprovals()[humanApproval.id]
@@ -102,9 +102,35 @@ test('POST /api/approvals rejects invalid payloads', () => {
     console.log(JSON.stringify({
       invalidStatus: invalidResponse.status,
       invalidError: invalidPayload?.error || null,
+      invalidIssues: invalidPayload?.issues || null,
     }))
   `)
 
   assert.equal(output.invalidStatus, 400)
-  assert.match(String(output.invalidError || ''), /id and approved required/i)
+  assert.equal(output.invalidError, 'Validation failed')
+  assert.deepEqual(output.invalidIssues, [
+    { path: 'approved', message: 'Invalid input: expected boolean, received undefined' },
+  ])
+})
+
+test('POST /api/approvals rejects malformed JSON with a 400', () => {
+  const output = runWithTempDataDir(`
+    const routeMod = await import('./src/app/api/approvals/route')
+    const route = routeMod.default || routeMod
+
+    const invalidResponse = await route.POST(new Request('http://local/api/approvals', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: '{bad-json',
+    }))
+    const invalidPayload = await invalidResponse.json()
+
+    console.log(JSON.stringify({
+      invalidStatus: invalidResponse.status,
+      invalidError: invalidPayload?.error || null,
+    }))
+  `)
+
+  assert.equal(output.invalidStatus, 400)
+  assert.equal(output.invalidError, 'Invalid or missing request body')
 })

package/src/app/api/approvals/route.ts

@@ -1,5 +1,8 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
+
 import { listPendingApprovals, submitDecision } from '@/lib/server/approvals'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
 import { loadApprovals } from '@/lib/server/storage'
 import { errorMessage } from '@/lib/shared-utils'
 import type { ApprovalCategory } from '@/types'
@@ -11,6 +14,11 @@ const ALLOWED_CATEGORIES: ApprovalCategory[] = [
   'task_tool', 'connector_sender', 'agent_create', 'budget_change', 'delegation_enable',
 ]
 
+const ApprovalDecisionSchema = z.object({
+  id: z.string().min(1, 'id is required'),
+  approved: z.boolean(),
+})
+
 export async function GET(req: Request) {
   const { searchParams } = new URL(req.url)
   const categoryParam = searchParams.get('category') as ApprovalCategory | null
@@ -21,17 +29,15 @@ export async function GET(req: Request) {
 }
 
 export async function POST(req: Request) {
+  const { data: body, error } = await safeParseBody(req, ApprovalDecisionSchema)
+  if (error) return error
+
   try {
-    const body = await req.json()
-    const { id, approved } = body
-    if (!id || typeof approved !== 'boolean') {
-      return NextResponse.json({ error: 'id and approved required' }, { status: 400 })
-    }
-    const approval = loadApprovals()[id]
+    const approval = loadApprovals()[body.id]
     if (!approval) {
       return NextResponse.json({ error: 'approval not found' }, { status: 404 })
     }
-    await submitDecision(id, approved)
+    await submitDecision(body.id, body.approved)
     return NextResponse.json({ ok: true })
   } catch (err: unknown) {
     return NextResponse.json({ error: errorMessage(err) }, { status: 500 })

package/src/app/api/chats/[id]/chat/route.test.ts

@@ -123,6 +123,70 @@ test('chat route keeps long-lived user runs alive after stream disconnect and re
   assert.ok(output.perfLabels.includes('chat-execution/llm-round-trip'))
 })
 
+test('chat route rejects malformed JSON with a 400 before queueing work', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { error?: string }
+    runCount: number
+  }>(`
+    const storageMod = await import('./src/lib/server/storage')
+    const routeMod = await import('./src/app/api/chats/[id]/chat/route')
+    const runsMod = await import('@/lib/server/runtime/session-run-manager')
+    const storage = storageMod.default || storageMod
+    const route = routeMod.default || routeMod
+    const runs = runsMod.default || runsMod
+
+    const now = Date.now()
+    storage.saveAgents({
+      agent_1: {
+        id: 'agent_1',
+        name: 'Malformed Agent',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        extensions: [],
+        createdAt: now,
+        updatedAt: now,
+      },
+    })
+    storage.saveSessions({
+      sess_1: {
+        id: 'sess_1',
+        name: 'Malformed Session',
+        cwd: process.env.WORKSPACE_DIR,
+        user: 'workbench',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        claudeSessionId: null,
+        messages: [],
+        createdAt: now,
+        lastActiveAt: now,
+        sessionType: 'human',
+        agentId: 'agent_1',
+        extensions: [],
+      },
+    })
+
+    const response = await route.POST(
+      new Request('http://local/api/chats/sess_1/chat', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{bad-json',
+      }),
+      { params: Promise.resolve({ id: 'sess_1' }) },
+    )
+
+    console.log(JSON.stringify({
+      status: response.status,
+      payload: await response.json(),
+      runCount: runs.listRuns({ sessionId: 'sess_1' }).length,
+    }))
+  `, { prefix: 'swarmclaw-chat-route-invalid-json-' })
+
+  assert.equal(output.status, 400)
+  assert.equal(output.payload.error, 'Invalid or missing request body')
+  assert.equal(output.runCount, 0)
+})
+
 test('chat route heartbeat runs stay internal and do not persist terminal ack text', () => {
   const output = runWithTempDataDir<{
     events: Array<{ t?: string; text?: string }>

package/src/app/api/chats/[id]/chat/route.ts

@@ -1,10 +1,23 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
+
 import { enqueueSessionRun, type SessionQueueMode } from '@/lib/server/runtime/session-run-manager'
 import { log } from '@/lib/server/logger'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 300
 
+const ChatRouteBodySchema = z.object({
+  message: z.string().optional().default(''),
+  imagePath: z.string().optional(),
+  imageUrl: z.string().optional(),
+  attachedFiles: z.array(z.string()).optional(),
+  internal: z.boolean().optional().default(false),
+  queueMode: z.enum(['steer', 'collect', 'followup']).optional(),
+  replyToId: z.string().optional(),
+}).passthrough()
+
 function normalizeQueueMode(raw: unknown, internal: boolean): SessionQueueMode {
   if (raw === 'steer' || raw === 'collect' || raw === 'followup') return raw
   return internal ? 'collect' : 'followup'
@@ -13,15 +26,17 @@ function normalizeQueueMode(raw: unknown, internal: boolean): SessionQueueMode {
 export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
   try {
     const { id } = await params
-    const body = await req.json().catch(() => ({}))
+    const { data: body, error } = await safeParseBody(req, ChatRouteBodySchema)
+    if (error) return error
 
-    const message = typeof body.message === 'string' ? body.message : ''
-    const imagePath = typeof body.imagePath === 'string' ? body.imagePath : undefined
-    const imageUrl = typeof body.imageUrl === 'string' ? body.imageUrl : undefined
-    const attachedFiles = Array.isArray(body.attachedFiles) ? body.attachedFiles.filter((f: unknown) => typeof f === 'string') as string[] : undefined
-    const internal = body.internal === true
+    const message = body.message
+    const imagePath = body.imagePath
+    const imageUrl = body.imageUrl
+    const attachedFiles = body.attachedFiles
+    const internal = body.internal
     const queueMode = normalizeQueueMode(body.queueMode, internal)
-    const replyToId = typeof body.replyToId === 'string' ? body.replyToId : undefined
+    const replyToId = body.replyToId
+    const source = internal ? 'heartbeat' : 'chat'
 
     const hasFiles = !!(imagePath || imageUrl || (attachedFiles && attachedFiles.length > 0))
     if (!message.trim() && !hasFiles) {
@@ -50,7 +65,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
           imageUrl,
           attachedFiles,
           internal,
-          source: internal ? 'heartbeat' : 'chat',
+          source,
           mode: queueMode,
           onEvent: (ev) => writeEvent(ev as unknown as Record<string, unknown>),
           replyToId,
@@ -78,6 +93,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
               status: run.deduped ? 'deduped' : run.coalesced ? 'coalesced' : 'queued',
               position: run.position,
               internal,
+              source,
               mode: queueMode,
             },
           }),

package/src/app/api/chats/chat-route.test.ts

@@ -0,0 +1,68 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { runWithTempDataDir } from '@/lib/server/test-utils/run-with-temp-data-dir'
+
+test('chat route rejects malformed JSON with a 400 before queueing work', () => {
+  const output = runWithTempDataDir<{
+    status: number
+    payload: { error?: string }
+    runCount: number
+  }>(`
+    const storageMod = await import('./src/lib/server/storage')
+    const routeMod = await import('./src/app/api/chats/[id]/chat/route')
+    const runsMod = await import('@/lib/server/runtime/session-run-manager')
+    const storage = storageMod.default || storageMod
+    const route = routeMod.default || routeMod
+    const runs = runsMod.default || runsMod
+
+    const now = Date.now()
+    storage.saveAgents({
+      agent_1: {
+        id: 'agent_1',
+        name: 'Malformed Agent',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        extensions: [],
+        createdAt: now,
+        updatedAt: now,
+      },
+    })
+    storage.saveSessions({
+      sess_1: {
+        id: 'sess_1',
+        name: 'Malformed Session',
+        cwd: process.env.WORKSPACE_DIR,
+        user: 'workbench',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        claudeSessionId: null,
+        messages: [],
+        createdAt: now,
+        lastActiveAt: now,
+        sessionType: 'human',
+        agentId: 'agent_1',
+        extensions: [],
+      },
+    })
+
+    const response = await route.POST(
+      new Request('http://local/api/chats/sess_1/chat', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{bad-json',
+      }),
+      { params: Promise.resolve({ id: 'sess_1' }) },
+    )
+
+    console.log(JSON.stringify({
+      status: response.status,
+      payload: await response.json(),
+      runCount: runs.listRuns({ sessionId: 'sess_1' }).length,
+    }))
+  `, { prefix: 'swarmclaw-chat-route-invalid-json-' })
+
+  assert.equal(output.status, 400)
+  assert.equal(output.payload.error, 'Invalid or missing request body')
+  assert.equal(output.runCount, 0)
+})