agent-relay-server 0.32.2 → 0.32.4

package/src/routes/config.ts

@@ -0,0 +1,66 @@
+// Auto-split from routes.ts (#299). Domain: config.
+import { ValidationError } from "../db";
+import { cleanString } from "../validation";
+import { deleteConfig, getConfig, getConfigHistory, listConfig, setConfig } from "../config-store";
+import { emitConfigChanged } from "../sse";
+import { error, json, normalizeConfigPathParam, parseBody, parseQueryInt, type Handler } from "./_shared";
+import { isRecord } from "agent-relay-sdk";
+
+export const getConfigNamespace: Handler = (_req, params) => {
+  const namespace = normalizeConfigPathParam(params.namespace, "namespace");
+  return json(listConfig(namespace));
+};
+
+export const getConfigKey: Handler = (_req, params) => {
+  const namespace = normalizeConfigPathParam(params.namespace, "namespace");
+  const key = normalizeConfigPathParam(params.key, "key");
+  const entry = getConfig(namespace, key);
+  return entry ? json(entry) : error("config not found", 404);
+};
+
+export const putConfigKey: Handler = async (req, params) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    if (!isRecord(parsed.body)) throw new ValidationError("JSON object body required");
+    if (!Object.prototype.hasOwnProperty.call(parsed.body, "value")) throw new ValidationError("value required");
+    const namespace = normalizeConfigPathParam(params.namespace, "namespace");
+    const key = normalizeConfigPathParam(params.key, "key");
+    const updatedBy = cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 });
+    const entry = setConfig(namespace, key, parsed.body.value, updatedBy);
+    emitConfigChanged(entry.namespace, entry.key, entry.version);
+    return json(entry, entry.version === 1 ? 201 : 200);
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const deleteConfigKey: Handler = (req, params) => {
+  try {
+    const namespace = normalizeConfigPathParam(params.namespace, "namespace");
+    const key = normalizeConfigPathParam(params.key, "key");
+    const updatedBy = cleanString(new URL(req.url).searchParams.get("updatedBy") ?? undefined, "updatedBy", { max: 200 });
+    const existing = getConfig(namespace, key);
+    if (!existing) return error("config not found", 404);
+    deleteConfig(namespace, key, updatedBy);
+    emitConfigChanged(namespace, key, existing.version + 1);
+    return json({ ok: true });
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const getConfigKeyHistory: Handler = (req, params) => {
+  try {
+    const namespace = normalizeConfigPathParam(params.namespace, "namespace");
+    const key = normalizeConfigPathParam(params.key, "key");
+    const limitRaw = parseQueryInt(new URL(req.url).searchParams.get("limit"), { min: 1, max: 500 });
+    if (Number.isNaN(limitRaw)) return error("limit must be an integer between 1 and 500");
+    return json(getConfigHistory(namespace, key, limitRaw ?? undefined));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};

package/src/routes/connectors.ts

@@ -0,0 +1,108 @@
+// Auto-split from routes.ts (#299). Domain: connectors.
+import { ValidationError } from "../db";
+import { error, json, parseBody, type Handler } from "./_shared";
+import { getConnector, listConnectors, markConnectorUnreachable, readConnectorConfig, registerConnectorManifest, runConnectorAction, writeConnectorConfig } from "../connectors";
+import { isRecord } from "agent-relay-sdk";
+import { optionalEnum } from "../validation";
+
+const VALID_CONNECTOR_ACTIONS = ["install", "uninstall", "enable", "disable", "start", "stop", "restart", "status", "doctor"] as const;
+
+export const getConnectors: Handler = () => json(listConnectors());
+
+export const getConnectorById: Handler = (_req, params) => {
+  const connector = getConnector(params.id!);
+  return connector ? json(connector) : error("connector not found", 404);
+};
+
+export const postConnectorRegister: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    if (!isRecord(parsed.body)) throw new ValidationError("JSON object body required");
+    const manifest = isRecord(parsed.body.manifest) ? parsed.body.manifest : parsed.body;
+    const config = isRecord(parsed.body.config) ? parsed.body.config : undefined;
+    const state = isRecord(parsed.body.state) ? parsed.body.state : undefined;
+    return json(registerConnectorManifest(manifest as any, { config, state }), 201);
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const postConnectorAction: Handler = async (req, params) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    if (!isRecord(parsed.body)) throw new ValidationError("JSON object body required");
+    const action = optionalEnum(parsed.body.action, "action", VALID_CONNECTOR_ACTIONS)!;
+    const result = await runConnectorAction(params.id!, action);
+    return json(result, result.ok ? 200 : 502);
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, e.message.includes("not found") ? 404 : 400);
+    throw e;
+  }
+};
+
+export const getConnectorConfig: Handler = (_req, params) => {
+  try {
+    if (!getConnector(params.id!)) return error("connector not found", 404);
+    return json(readConnectorConfig(params.id!));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const putConnectorConfig: Handler = async (req, params) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    if (!getConnector(params.id!)) return error("connector not found", 404);
+    if (!isRecord(parsed.body)) throw new ValidationError("connector config must be an object");
+    return json(writeConnectorConfig(params.id!, parsed.body));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+const PROXYABLE_CONNECTOR_CALLS = new Set(["transcribe", "utterance", "speak"]);
+
+function connectorAdvertisedEndpoint(connector: NonNullable<ReturnType<typeof getConnector>>): string | null {
+  const raw = connector.state?.raw;
+  if (isRecord(raw) && typeof raw.endpoint === "string" && raw.endpoint) return raw.endpoint;
+  const cfg = connector.config;
+  if (isRecord(cfg) && typeof cfg.endpoint === "string" && cfg.endpoint) return cfg.endpoint;
+  return null;
+}
+
+export const postConnectorCall: Handler = async (req, params) => {
+  const connector = getConnector(params.id!);
+  if (!connector) return error("connector not found", 404);
+  const name = params.name!;
+  if (!PROXYABLE_CONNECTOR_CALLS.has(name)) return error("unsupported connector call", 404);
+  const endpoint = connectorAdvertisedEndpoint(connector);
+  if (!endpoint) return error("connector is not running (no advertised endpoint)", 422);
+  try {
+    const body = await req.arrayBuffer();
+    const res = await fetch(`${endpoint.replace(/\/$/, "")}/${name}`, {
+      method: "POST",
+      headers: { "content-type": req.headers.get("content-type") || "application/octet-stream" },
+      body,
+      signal: AbortSignal.timeout(120_000),
+    });
+    return new Response(res.body, {
+      status: res.status,
+      headers: { "content-type": res.headers.get("content-type") || "application/json" },
+    });
+  } catch (e) {
+    // A connection error (refused/reset/DNS) means the advertised endpoint is
+    // genuinely down — reconcile the stale running:true so the dashboard stops
+    // claiming the connector is healthy. A timeout (AbortError) may just be a
+    // slow daemon, so leave its state alone.
+    if ((e as Error).name !== "AbortError") {
+      markConnectorUnreachable(params.id!, `endpoint unreachable: ${(e as Error).message}`);
+    }
+    return error(`failed to reach connector: ${(e as Error).message}`, 502);
+  }
+};

package/src/routes/inbox.ts

@@ -0,0 +1,142 @@
+// Auto-split from routes.ts (#299). Domain: inbox.
+import { MAX_BODY_BYTES } from "../config";
+import { ValidationError, createChatHistoryImport, deleteInboxDraft, getInboxState, listChatHistoryImports, setInboxDraft, setInboxThreadState } from "../db";
+import { authorizeRoute, error, json, parseBody, parseQueryInt, type Handler } from "./_shared";
+import { cleanNullablePositiveId, cleanOperatorId, cleanPositiveIdArray, cleanString } from "../validation";
+import { isRecord } from "agent-relay-sdk";
+
+function normalizeInboxThreadStateInput(body: unknown): {
+  operatorId: string;
+  peerId: string;
+  readCursorMessageId?: number | null;
+  archivedAtMessageId?: number | null;
+} {
+  if (!isRecord(body)) throw new ValidationError("JSON object body required");
+  const input: {
+    operatorId: string;
+    peerId: string;
+    readCursorMessageId?: number | null;
+    archivedAtMessageId?: number | null;
+  } = {
+    operatorId: cleanOperatorId(body.operatorId),
+    peerId: cleanString(body.peerId, "peerId", { required: true, max: 200 })!,
+  };
+  const readCursorMessageId = cleanNullablePositiveId(body.readCursorMessageId, "readCursorMessageId");
+  if (readCursorMessageId !== undefined) input.readCursorMessageId = readCursorMessageId;
+  const archivedAtMessageId = cleanNullablePositiveId(body.archivedAtMessageId, "archivedAtMessageId");
+  if (archivedAtMessageId !== undefined) input.archivedAtMessageId = archivedAtMessageId;
+  return input;
+}
+
+function normalizeInboxDraftInput(body: unknown): {
+  operatorId: string;
+  peerId: string;
+  body: string;
+  subject?: string;
+  channel?: string;
+} {
+  if (!isRecord(body)) throw new ValidationError("JSON object body required");
+  return {
+    operatorId: cleanOperatorId(body.operatorId),
+    peerId: cleanString(body.peerId, "peerId", { required: true, max: 200 })!,
+    body: cleanString(body.body, "body", { required: true, max: MAX_BODY_BYTES })!,
+    subject: cleanString(body.subject, "subject", { max: 200 }),
+    channel: cleanString(body.channel, "channel", { max: 120 }),
+  };
+}
+
+function normalizeChatHistoryImportInput(body: unknown): {
+  targetAgentId?: string;
+  targetSpawnRequestId?: string;
+  sourcePeerId: string;
+  sourceAgentId?: string;
+  sourceThreadId?: string;
+  sourceAgentLabel?: string;
+  importedBy?: string;
+  messageIds: number[];
+} {
+  if (!isRecord(body)) throw new ValidationError("JSON object body required");
+  const targetAgentId = cleanString(body.targetAgentId, "targetAgentId", { max: 200 });
+  const targetSpawnRequestId = cleanString(body.targetSpawnRequestId, "targetSpawnRequestId", { max: 160 });
+  if (!targetAgentId && !targetSpawnRequestId) throw new ValidationError("targetAgentId or targetSpawnRequestId required");
+  return {
+    targetAgentId,
+    targetSpawnRequestId,
+    sourcePeerId: cleanString(body.sourcePeerId, "sourcePeerId", { required: true, max: 200 })!,
+    sourceAgentId: cleanString(body.sourceAgentId, "sourceAgentId", { max: 200 }),
+    sourceThreadId: cleanString(body.sourceThreadId, "sourceThreadId", { max: 240 }),
+    sourceAgentLabel: cleanString(body.sourceAgentLabel, "sourceAgentLabel", { max: 240 }),
+    importedBy: cleanOperatorId(body.importedBy),
+    messageIds: cleanPositiveIdArray(body.messageIds, "messageIds"),
+  };
+}
+
+export const getInboxStateRoute: Handler = (req) => {
+  const url = new URL(req.url);
+  const operatorId = cleanOperatorId(url.searchParams.get("operatorId") ?? undefined);
+  return json(getInboxState(operatorId));
+};
+
+export const patchInboxThreadState: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json(setInboxThreadState(normalizeInboxThreadStateInput(parsed.body)));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const putInboxDraft: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json(setInboxDraft(normalizeInboxDraftInput(parsed.body)));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const deleteInboxDraftRoute: Handler = (req) => {
+  const url = new URL(req.url);
+  try {
+    const operatorId = cleanOperatorId(url.searchParams.get("operatorId") ?? undefined);
+    const peerId = cleanString(url.searchParams.get("peerId") ?? undefined, "peerId", { required: true, max: 200 })!;
+    deleteInboxDraft(operatorId, peerId);
+    return json({ ok: true });
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const getChatHistoryImportsRoute: Handler = (req) => {
+  const url = new URL(req.url);
+  try {
+    const targetAgentId = cleanString(url.searchParams.get("targetAgentId") ?? undefined, "targetAgentId", { max: 200 });
+    const targetSpawnRequestId = cleanString(url.searchParams.get("targetSpawnRequestId") ?? undefined, "targetSpawnRequestId", { max: 160 });
+    const limitRaw = parseQueryInt(url.searchParams.get("limit"), { min: 1, max: 500 });
+    if (Number.isNaN(limitRaw)) return error("limit must be an integer between 1 and 500");
+    return json(listChatHistoryImports({ targetAgentId, targetSpawnRequestId, limit: limitRaw ?? 100 }));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};
+
+export const postChatHistoryImportRoute: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    const input = normalizeChatHistoryImportInput(parsed.body);
+    const denied = authorizeRoute(req, { scope: "agent:write", resource: { agentId: input.targetAgentId, spawnRequestId: input.targetSpawnRequestId } });
+    if (denied) return denied;
+    const imported = createChatHistoryImport(input);
+    return json(imported, 201);
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    throw e;
+  }
+};

package/src/routes/index.ts

@@ -0,0 +1,293 @@
+// Auto-split from routes.ts (#299). Router: route table + matchRoute dispatch.
+import { deleteAgentActiveMemories, deleteAgentById, findAgents, getAgentActiveMemories, getAgentById, getAgentContextSnapshots, getAgentReplyObligations, getAgentTimelineRoute, getAgents, getMessageArtifactsRoute, getTaskArtifactsRoute, patchAgentLabel, patchAgentReady, patchAgentStatus, patchAgentTags, postHeartbeat } from "./agents";
+import { deleteAgentProfileRoute, getAgentProfileRoute, getAgentProfilesRoute, putAgentProfileRoute } from "./agent-profiles";
+import { deleteAgentTerminalSession, postAgentAction, postAgentPermissionDecision, postAgentPrompt, postAgentTerminalSession } from "./agent-sessions";
+import { deleteArtifactById, getArtifactById, getArtifactContent, getArtifacts, headArtifactContent, postArtifact } from "./artifacts";
+import { deleteAutomationById, getAutomationById, getAutomationRuns, getAutomations, patchAutomation, postAutomation, postAutomationRun } from "./automations";
+import { deleteCommandById, getProviderConfigRoute, getProviderConfigsRoute, getProvidersRoute, postProviderConfigTestRoute, putProviderConfigRoute } from "./provider-config";
+import { deleteConfigKey, getConfigKey, getConfigKeyHistory, getConfigNamespace, putConfigKey } from "./config";
+import { deleteInboxDraftRoute, getChatHistoryImportsRoute, getInboxStateRoute, patchInboxThreadState, postChatHistoryImportRoute, putInboxDraft } from "./inbox";
+import { deleteMemoryRoute, getMemories, getMemoryBrokerInfo, getMemoryById, getMemoryStats, patchMemory, postMemory, postMemoryInject, postMemorySearch } from "./memory";
+import { deleteMessageById, getCursorRoute, getMessageById, getMessageDeliveryRoute, getMessageStatusRoute, getMessageThread, getMessages, getQueuedMessagesRoute, patchMessage, postClaimMessage, postMessage, postMessageDeliveryAction, postMessageDeliveryAttempt, postMessageReaction, postRenewMessageClaim, postSystemBroadcast } from "./messages";
+import { deleteOrchestratorById, getOrchestratorById, getOrchestrators, patchOrchestratorAgents, postOrchestrator, postOrchestratorAction, postOrchestratorHeartbeat } from "./orchestrator";
+import { deleteSpawnPolicyRoute, getSpawnPoliciesHealth, getSpawnPoliciesRoute, getSpawnPolicyHealth, getSpawnPolicyRoute, getSpawnPolicyStatus, postSpawnPolicyRestart, postSpawnPolicyStart, postSpawnPolicyStop, putSpawnPolicyRoute } from "./spawn-policy";
+import { deleteTokenProfileRoute, getTokenById, getTokenProfiles, getTokens, patchTokenProfile, postIntegrationRuntimeToken, postInteractiveRunnerRuntimeToken, postMcpRuntimeToken, postOrchestratorRunnerToken, postRuntimeTokenRenew, postToken, postTokenProfile, postTokenRevoke } from "./tokens";
+import { deleteWorkspaceById, getWorkspaceById, getWorkspaceDiagnostics, getWorkspaceDiff, getWorkspaceGitState, getWorkspaceMergePreview, getWorkspaceOrphans, getWorkspaceStewards, getWorkspaces, postWorkspaceAction, postWorkspaceCleanupStale, postWorkspaceOrphanReclaim } from "./workspaces";
+import { error, type Handler } from "./_shared";
+import { getActivityEvents, postActivityEvent } from "./activity";
+import { getAnalyticsRoute, getHealthRoute, getMaintenanceJobs, getStatsRoute, postMaintenanceJobRun, postSystemReap } from "./stats";
+import { getApiDocs, getApiSpec } from "./spec";
+import { getChannelBindings, getChannels, getIntegrations, postChannelActivity, postChannelBinding, postChannelEvent, postIntegrationEvent, putIntegrationRegistryRoute } from "./integrations";
+import { getCommandById, getCommands, patchCommand, postCommand } from "./commands";
+import { getConnectorById, getConnectorConfig, getConnectors, postConnectorAction, postConnectorCall, postConnectorRegister, putConnectorConfig } from "./connectors";
+import { getEvents } from "./sse";
+import { getHostDirectories, postAgent, postAgentSpawn, postRouteAdvice } from "./agents-spawn";
+import { getInsightsConfigRoute, getInsightsObservationsRoute, postInsightsObservationRoute, putInsightsConfigRoute } from "./insights";
+import { getOrchestratorDirectories, getOrchestratorFileRead, getOrchestratorFileStat, getOrchestratorFilesList, getOrchestratorLogs, getOrchestratorProviders, getOrchestratorSessions, getOrchestratorTerminal, getOrchestratorVersion, getOrchestratorWorkspaceProbe, postOrchestratorCreateDirectory, postOrchestratorTerminalInput, postOrchestratorTerminalResize } from "./orchestrator-proxy";
+import { getPairById, getPairs, postAcceptPair, postHangupPair, postPair, postPairMessage, postRejectPair } from "./pairs";
+import { getRecipeByName, getRecipeInstanceArtifacts, getRecipeInstanceById, getRecipeInstances, getRecipes, postRecipeInstanceArtifacts, postRecipeStart, postRecipeStop } from "./recipes";
+import { getStewardConfigRoute, getWorkspaceConfigRoute, putStewardConfigRoute, putWorkspaceConfigRoute } from "./steward";
+import { getTaskById, getTaskEvents, getTasks, patchTaskStatus, postClaimTask, postRenewTaskClaim } from "./tasks";
+import { postMcp } from "../mcp";
+import { postOrchestratorBootstrap, postOrchestratorBootstrapExchange } from "./orchestrator-bootstrap";
+
+interface Route {
+  method: string;
+  pattern: RegExp;
+  paramNames: string[];
+  handler: Handler;
+}
+
+function route(method: string, path: string, handler: Handler): Route {
+  const paramNames: string[] = [];
+  const pattern = new RegExp(
+    "^" +
+      path.replace(/:(\w+)/g, (_, name) => {
+        paramNames.push(name);
+        return "([^/]+)";
+      }) +
+      "$"
+  );
+  return { method, pattern, paramNames, handler };
+}
+
+const routes: Route[] = [
+  route("POST", "/api/artifacts", postArtifact),
+  route("GET", "/api/artifacts", getArtifacts),
+  route("GET", "/api/artifacts/:id/content", getArtifactContent),
+  route("HEAD", "/api/artifacts/:id/content", headArtifactContent),
+  route("GET", "/api/artifacts/:id", getArtifactById),
+  route("DELETE", "/api/artifacts/:id", deleteArtifactById),
+
+  route("POST", "/api/memories", postMemory),
+  route("GET", "/api/memories", getMemories),
+  route("POST", "/api/memories/inject", postMemoryInject),
+  route("POST", "/api/memories/search", postMemorySearch),
+  route("GET", "/api/memories/stats", getMemoryStats),
+  route("GET", "/api/memories/broker", getMemoryBrokerInfo),
+  route("GET", "/api/memories/:id", getMemoryById),
+  route("PATCH", "/api/memories/:id", patchMemory),
+  route("DELETE", "/api/memories/:id", deleteMemoryRoute),
+
+  route("POST", "/api/agents", postAgent),
+  route("POST", "/api/agents/spawn", postAgentSpawn),
+  route("GET", "/api/agents", getAgents),
+  route("GET", "/api/agents/find", findAgents),
+  route("POST", "/api/route", postRouteAdvice),
+  route("GET", "/api/agents/spawn/directories", getHostDirectories),
+  route("GET", "/api/agents/:id/context-snapshots", getAgentContextSnapshots),
+  route("GET", "/api/agents/:id/timeline", getAgentTimelineRoute),
+  route("GET", "/api/agents/:id/active-memories", getAgentActiveMemories),
+  route("GET", "/api/agents/:id/reply-obligations", getAgentReplyObligations),
+  route("DELETE", "/api/agents/:id/active-memories", deleteAgentActiveMemories),
+  route("GET", "/api/agents/:id", getAgentById),
+  route("PATCH", "/api/agents/:id/status", patchAgentStatus),
+  route("PATCH", "/api/agents/:id/ready", patchAgentReady),
+  route("PATCH", "/api/agents/:id/label", patchAgentLabel),
+  route("PATCH", "/api/agents/:id/tags", patchAgentTags),
+  route("POST", "/api/agents/:id/heartbeat", postHeartbeat),
+  route("POST", "/api/agents/:id/actions", postAgentAction),
+  route("POST", "/api/agents/:id/prompt", postAgentPrompt),
+  route("POST", "/api/agents/:id/permission-decision", postAgentPermissionDecision),
+  route("POST", "/api/agents/:id/terminal-session", postAgentTerminalSession),
+  route("DELETE", "/api/agents/:id/terminal-session/:session", deleteAgentTerminalSession),
+  route("DELETE", "/api/agents/:id", deleteAgentById),
+
+  route("POST", "/api/orchestrators", postOrchestrator),
+  route("POST", "/api/orchestrators/bootstrap", postOrchestratorBootstrap),
+  route("POST", "/api/orchestrators/bootstrap/exchange", postOrchestratorBootstrapExchange),
+  route("GET", "/api/orchestrators", getOrchestrators),
+  route("GET", "/api/orchestrators/:id", getOrchestratorById),
+  route("POST", "/api/orchestrators/:id/heartbeat", postOrchestratorHeartbeat),
+  route("PATCH", "/api/orchestrators/:id/agents", patchOrchestratorAgents),
+  route("POST", "/api/orchestrators/:id/runner-token", postOrchestratorRunnerToken),
+  route("POST", "/api/orchestrators/:id/actions", postOrchestratorAction),
+  route("GET", "/api/orchestrators/:id/directories", getOrchestratorDirectories),
+  route("POST", "/api/orchestrators/:id/directories", postOrchestratorCreateDirectory),
+  route("GET", "/api/orchestrators/:id/files/list", getOrchestratorFilesList),
+  route("GET", "/api/orchestrators/:id/files/read", getOrchestratorFileRead),
+  route("GET", "/api/orchestrators/:id/files/stat", getOrchestratorFileStat),
+  route("GET", "/api/orchestrators/:id/workspace/probe", getOrchestratorWorkspaceProbe),
+  route("GET", "/api/orchestrators/:id/providers", getOrchestratorProviders),
+  route("GET", "/api/orchestrators/:id/sessions", getOrchestratorSessions),
+  route("GET", "/api/orchestrators/:id/version", getOrchestratorVersion),
+  route("GET", "/api/orchestrators/:id/logs/:session", getOrchestratorLogs),
+  route("GET", "/api/orchestrators/:id/terminal/:session", getOrchestratorTerminal),
+  route("POST", "/api/orchestrators/:id/terminal/:session/input", postOrchestratorTerminalInput),
+  route("POST", "/api/orchestrators/:id/terminal/:session/resize", postOrchestratorTerminalResize),
+  route("DELETE", "/api/orchestrators/:id", deleteOrchestratorById),
+
+  route("GET", "/api/workspaces", getWorkspaces),
+  // Static segments before :id so "/workspaces/orphans" isn't captured as an id.
+  route("GET", "/api/workspaces/orphans", getWorkspaceOrphans),
+  route("POST", "/api/workspaces/orphans/reclaim", postWorkspaceOrphanReclaim),
+  route("GET", "/api/workspaces/stewards", getWorkspaceStewards),
+  route("POST", "/api/workspaces/actions/cleanup-stale", postWorkspaceCleanupStale),
+  route("GET", "/api/workspaces/:id", getWorkspaceById),
+  route("GET", "/api/workspaces/:id/git-state", getWorkspaceGitState),
+  route("GET", "/api/workspaces/:id/merge-preview", getWorkspaceMergePreview),
+  route("GET", "/api/workspaces/:id/diagnostics", getWorkspaceDiagnostics),
+  route("GET", "/api/workspaces/:id/diff", getWorkspaceDiff),
+  route("POST", "/api/workspaces/:id/actions", postWorkspaceAction),
+  route("DELETE", "/api/workspaces/:id", deleteWorkspaceById),
+
+  route("POST", "/api/system/broadcast", postSystemBroadcast),
+  route("GET", "/api/recipes", getRecipes),
+  route("POST", "/api/recipes/start", postRecipeStart),
+  route("GET", "/api/recipes/instances", getRecipeInstances),
+  route("GET", "/api/recipes/instances/:id", getRecipeInstanceById),
+  route("GET", "/api/recipes/instances/:id/artifacts", getRecipeInstanceArtifacts),
+  route("POST", "/api/recipes/instances/:id/artifacts", postRecipeInstanceArtifacts),
+  route("POST", "/api/recipes/instances/:id/stop", postRecipeStop),
+  route("GET", "/api/recipes/:name", getRecipeByName),
+  route("GET", "/api/tokens", getTokens),
+  route("POST", "/api/tokens", postToken),
+  route("POST", "/api/runtime-tokens/renew", postRuntimeTokenRenew),
+  route("POST", "/api/runtime-tokens/interactive-runner", postInteractiveRunnerRuntimeToken),
+  route("POST", "/api/runtime-tokens/mcp-client", postMcpRuntimeToken),
+  route("POST", "/api/runtime-tokens/integration", postIntegrationRuntimeToken),
+  route("GET", "/api/token-profiles", getTokenProfiles),
+  route("POST", "/api/token-profiles", postTokenProfile),
+  route("PATCH", "/api/token-profiles/:id", patchTokenProfile),
+  route("DELETE", "/api/token-profiles/:id", deleteTokenProfileRoute),
+  route("GET", "/api/tokens/:jti", getTokenById),
+  route("POST", "/api/tokens/:jti/revoke", postTokenRevoke),
+  route("POST", "/api/commands", postCommand),
+  route("GET", "/api/commands", getCommands),
+  route("GET", "/api/commands/:id", getCommandById),
+  route("PATCH", "/api/commands/:id", patchCommand),
+  route("DELETE", "/api/commands/:id", deleteCommandById),
+  route("GET", "/api/agent-profiles", getAgentProfilesRoute),
+  route("GET", "/api/agent-profiles/:name", getAgentProfileRoute),
+  route("PUT", "/api/agent-profiles/:name", putAgentProfileRoute),
+  route("DELETE", "/api/agent-profiles/:name", deleteAgentProfileRoute),
+  route("GET", "/api/steward-config", getStewardConfigRoute),
+  route("PUT", "/api/steward-config", putStewardConfigRoute),
+  route("GET", "/api/workspace-config", getWorkspaceConfigRoute),
+  route("PUT", "/api/workspace-config", putWorkspaceConfigRoute),
+  route("GET", "/api/insights/config", getInsightsConfigRoute),
+  route("PUT", "/api/insights/config", putInsightsConfigRoute),
+  route("GET", "/api/insights/observations", getInsightsObservationsRoute),
+  route("POST", "/api/insights/observations", postInsightsObservationRoute),
+  route("GET", "/api/config/:namespace", getConfigNamespace),
+  route("GET", "/api/config/:namespace/:key/history", getConfigKeyHistory),
+  route("GET", "/api/config/:namespace/:key", getConfigKey),
+  route("PUT", "/api/config/:namespace/:key", putConfigKey),
+  route("DELETE", "/api/config/:namespace/:key", deleteConfigKey),
+  route("GET", "/api/spawn-policies", getSpawnPoliciesRoute),
+  route("GET", "/api/spawn-policy/:name", getSpawnPolicyRoute),
+  route("PUT", "/api/spawn-policy/:name", putSpawnPolicyRoute),
+  route("DELETE", "/api/spawn-policy/:name", deleteSpawnPolicyRoute),
+  route("POST", "/api/spawn-policy/:name/start", postSpawnPolicyStart),
+  route("POST", "/api/spawn-policy/:name/stop", postSpawnPolicyStop),
+  route("POST", "/api/spawn-policy/:name/restart", postSpawnPolicyRestart),
+  route("GET", "/api/spawn-policies/health", getSpawnPoliciesHealth),
+  route("GET", "/api/spawn-policy/:name/status", getSpawnPolicyStatus),
+  route("GET", "/api/spawn-policy/:name/health", getSpawnPolicyHealth),
+  route("GET", "/api/providers", getProvidersRoute),
+  route("GET", "/api/providers/config", getProviderConfigsRoute),
+  route("GET", "/api/providers/:provider/config", getProviderConfigRoute),
+  route("PUT", "/api/providers/:provider/config", putProviderConfigRoute),
+  route("POST", "/api/providers/:provider/config/test", postProviderConfigTestRoute),
+
+  route("POST", "/api/mcp", postMcp),
+
+  route("POST", "/api/messages", postMessage),
+  route("GET", "/api/messages", getMessages),
+  route("GET", "/api/messages/queued", getQueuedMessagesRoute),
+  route("GET", "/api/messages/cursor", getCursorRoute),
+  route("GET", "/api/messages/:id/status", getMessageStatusRoute),
+  route("GET", "/api/messages/:id/delivery", getMessageDeliveryRoute),
+  route("GET", "/api/messages/:id/artifacts", getMessageArtifactsRoute),
+  route("POST", "/api/messages/:id/delivery/attempts", postMessageDeliveryAttempt),
+  route("POST", "/api/messages/:id/delivery/actions", postMessageDeliveryAction),
+  route("GET", "/api/messages/:id", getMessageById),
+  route("GET", "/api/messages/:id/thread", getMessageThread),
+  route("POST", "/api/messages/:id/reactions", postMessageReaction),
+  route("POST", "/api/messages/:id/claim", postClaimMessage),
+  route("POST", "/api/messages/:id/claim/renew", postRenewMessageClaim),
+  route("PATCH", "/api/messages/:id", patchMessage),
+  route("DELETE", "/api/messages/:id", deleteMessageById),
+
+  route("GET", "/api/inbox/state", getInboxStateRoute),
+  route("PATCH", "/api/inbox/threads", patchInboxThreadState),
+  route("PUT", "/api/inbox/drafts", putInboxDraft),
+  route("DELETE", "/api/inbox/drafts", deleteInboxDraftRoute),
+  route("GET", "/api/chat/history-imports", getChatHistoryImportsRoute),
+  route("POST", "/api/chat/history-imports", postChatHistoryImportRoute),
+
+  route("GET", "/api/activity", getActivityEvents),
+  route("POST", "/api/activity", postActivityEvent),
+
+  route("GET", "/api/connectors", getConnectors),
+  route("POST", "/api/connectors", postConnectorRegister),
+  route("GET", "/api/connectors/:id", getConnectorById),
+  route("POST", "/api/connectors/:id/actions", postConnectorAction),
+  route("GET", "/api/connectors/:id/config", getConnectorConfig),
+  route("PUT", "/api/connectors/:id/config", putConnectorConfig),
+  route("POST", "/api/connectors/:id/call/:name", postConnectorCall),
+
+  route("GET", "/api/channels", getChannels),
+  route("POST", "/api/channels/:id/events", postChannelEvent),
+  route("POST", "/api/channels/:id/activities", postChannelActivity),
+  route("GET", "/api/channel-bindings", getChannelBindings),
+  route("POST", "/api/channel-bindings", postChannelBinding),
+  route("GET", "/api/integrations", getIntegrations),
+  route("PUT", "/api/integrations/:name", putIntegrationRegistryRoute),
+  route("POST", "/api/integrations/events", postIntegrationEvent),
+  route("GET", "/api/automations", getAutomations),
+  route("POST", "/api/automations", postAutomation),
+  route("GET", "/api/automation-runs", getAutomationRuns),
+  route("GET", "/api/automations/:id", getAutomationById),
+  route("PATCH", "/api/automations/:id", patchAutomation),
+  route("DELETE", "/api/automations/:id", deleteAutomationById),
+  route("POST", "/api/automations/:id/run", postAutomationRun),
+  route("GET", "/api/tasks", getTasks),
+  route("GET", "/api/tasks/:id", getTaskById),
+  route("GET", "/api/tasks/:id/artifacts", getTaskArtifactsRoute),
+  route("GET", "/api/tasks/:id/events", getTaskEvents),
+  route("POST", "/api/tasks/:id/claim", postClaimTask),
+  route("POST", "/api/tasks/:id/claim/renew", postRenewTaskClaim),
+  route("PATCH", "/api/tasks/:id/status", patchTaskStatus),
+
+  route("POST", "/api/pairs", postPair),
+  route("GET", "/api/pairs", getPairs),
+  route("GET", "/api/pairs/:id", getPairById),
+  route("POST", "/api/pairs/:id/accept", postAcceptPair),
+  route("POST", "/api/pairs/:id/reject", postRejectPair),
+  route("POST", "/api/pairs/:id/hangup", postHangupPair),
+  route("POST", "/api/pairs/:id/messages", postPairMessage),
+
+  route("GET", "/api/spec", getApiSpec),
+  route("GET", "/api/docs", getApiDocs),
+
+  route("GET", "/api/events", getEvents),
+  route("GET", "/api/stats", getStatsRoute),
+  route("GET", "/api/stats/analytics", getAnalyticsRoute),
+  route("GET", "/api/health", getHealthRoute),
+  route("GET", "/api/maintenance/jobs", getMaintenanceJobs),
+  route("POST", "/api/maintenance/jobs/:id/run", postMaintenanceJobRun),
+  route("POST", "/api/system/reap", postSystemReap),
+];
+
+export function matchRoute(
+  method: string,
+  pathname: string
+): { handler: Handler; params: Record<string, string> } | null {
+  for (const r of routes) {
+    if (r.method !== method) continue;
+    const match = pathname.match(r.pattern);
+    if (!match) continue;
+
+    const params: Record<string, string> = {};
+    try {
+      r.paramNames.forEach((name, i) => {
+        params[name] = decodeURIComponent(match[i + 1]!);
+      });
+    } catch {
+      return { handler: () => error("invalid url encoding"), params: {} };
+    }
+    return { handler: r.handler, params };
+  }
+  return null;
+}