apteva 0.2.11 → 0.3.6

package/src/routes/api.ts

@@ -2,8 +2,8 @@ import { spawn } from "bun";
 import { join } from "path";
 import { homedir } from "os";
 import { mkdirSync, existsSync, rmSync } from "fs";
-import { agentProcesses, agentsStarting, BINARY_PATH, getNextPort, getBinaryStatus, BIN_DIR, telemetryBroadcaster, type TelemetryEvent } from "../server";
-import { AgentDB, McpServerDB, TelemetryDB, UserDB, ProjectDB, generateId, type Agent, type AgentFeatures, type McpServer, type Project } from "../db";
+import { agentProcesses, agentsStarting, getBinaryPathForAgent, getNextPort, getBinaryStatus, BIN_DIR, telemetryBroadcaster, type TelemetryEvent } from "../server";
+import { AgentDB, McpServerDB, TelemetryDB, UserDB, ProjectDB, SkillDB, generateId, getMultiAgentConfig, type Agent, type AgentFeatures, type McpServer, type Project, type Skill } from "../db";
 import { ProviderKeys, Onboarding, getProvidersWithStatus, PROVIDERS, type ProviderId } from "../providers";
 import { createUser, hashPassword, validatePassword } from "../auth";
 import type { AuthContext } from "../auth/middleware";
@@ -28,6 +28,7 @@ import {
 import { openApiSpec } from "../openapi";
 import { getProvider, getProviderIds, registerProvider } from "../integrations";
 import { ComposioProvider } from "../integrations/composio";
+import { SkillsmpProvider, parseSkillMd, type SkillsmpSkill } from "../integrations/skillsmp";
 
 // Register integration providers
 registerProvider(ComposioProvider);
@@ -37,6 +38,10 @@ const AGENTS_DATA_DIR = process.env.DATA_DIR
   ? join(process.env.DATA_DIR, "agents")
   : join(homedir(), ".apteva", "agents");
 
+// Meta Agent configuration
+const META_AGENT_ENABLED = process.env.META_AGENT_ENABLED === "true";
+const META_AGENT_ID = "apteva-assistant";
+
 function json(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
     status,
@@ -66,6 +71,22 @@ async function waitForAgentHealth(port: number, maxAttempts = 30, delayMs = 200)
   return false;
 }
 
+// Check if a port is free by trying to connect
+async function checkPortFree(port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const net = require("net");
+    const server = net.createServer();
+    server.once("error", () => {
+      resolve(false); // Port in use
+    });
+    server.once("listening", () => {
+      server.close();
+      resolve(true); // Port is free
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+
 // Make authenticated request to agent
 async function agentFetch(
   agentId: string,
@@ -94,6 +115,34 @@ function buildAgentConfig(agent: Agent, providerKey: string) {
   // Get MCP server details for the agent's selected servers
   const mcpServers: Array<{ name: string; type: "http"; url: string; headers: Record<string, string>; enabled: boolean }> = [];
 
+  // Get skill definitions for the agent's selected skills
+  const skillDefinitions: Array<{
+    name: string;
+    description: string;
+    instructions: string;
+    icon: string;
+    category: string;
+    tags: string[];
+    tools: string[];
+    enabled: boolean;
+  }> = [];
+
+  for (const skillId of agent.skills || []) {
+    const skill = SkillDB.findById(skillId);
+    if (!skill || !skill.enabled) continue;
+
+    skillDefinitions.push({
+      name: skill.name,
+      description: skill.description,
+      instructions: skill.content,
+      icon: "",
+      category: "",
+      tags: [],
+      tools: skill.allowed_tools || [],
+      enabled: true,
+    });
+  }
+
   for (const id of agent.mcp_servers || []) {
     const server = McpServerDB.findById(id);
     if (!server) continue;
@@ -123,6 +172,7 @@ function buildAgentConfig(agent: Agent, providerKey: string) {
     id: agent.id,
     name: agent.name,
     description: agent.system_prompt,
+    public_url: `http://localhost:${agent.port}`,
     llm: {
       provider: agent.provider,
       model: agent.model,
@@ -148,6 +198,10 @@ function buildAgentConfig(agent: Agent, providerKey: string) {
         max_concurrent: 10,
       },
       tools: [], // Clear any old tool whitelist - agent uses all registered tools
+      builtin_tools: [
+        ...(features.builtinTools?.webSearch ? [{ type: "web_search_20250305", name: "web_search" }] : []),
+        ...(features.builtinTools?.webFetch ? [{ type: "web_fetch_20250910", name: "web_fetch" }] : []),
+      ],
     },
     tasks: {
       enabled: features.tasks,
@@ -215,6 +269,23 @@ function buildAgentConfig(agent: Agent, providerKey: string) {
       flush_interval: 1, // Every 1 second
       categories: [], // Empty = all categories
     },
+    skills: {
+      enabled: skillDefinitions.length > 0,
+      definitions: skillDefinitions,
+    },
+    agents: (() => {
+      const multiAgentConfig = getMultiAgentConfig(features, agent.project_id);
+      const baseUrl = process.env.PUBLIC_URL || `http://localhost:${process.env.PORT || 4280}`;
+      return {
+        enabled: multiAgentConfig.enabled,
+        mode: multiAgentConfig.mode || "worker",
+        group: multiAgentConfig.group || agent.project_id || undefined,
+        // This agent's reachable URL for peer communication
+        url: `http://localhost:${agent.port}`,
+        // Discovery endpoint to find peer agents in the same group
+        discovery_url: `${baseUrl}/api/discovery/agents`,
+      };
+    })(),
   };
 }
 
@@ -238,6 +309,68 @@ async function pushConfigToAgent(agentId: string, port: number, config: any): Pr
   }
 }
 
+// Push skills to running agent via /skills endpoint (not config)
+async function pushSkillsToAgent(agentId: string, port: number, skills: Array<{
+  name: string;
+  description: string;
+  instructions: string;
+  icon?: string;
+  category?: string;
+  tags?: string[];
+  tools?: string[];
+  enabled: boolean;
+}>): Promise<{ success: boolean; error?: string }> {
+  if (skills.length === 0) {
+    return { success: true };
+  }
+
+  try {
+    // Push each skill - try PUT first (update), then POST (create) if not found
+    for (const skill of skills) {
+      // First try PUT to update existing skill
+      let res = await agentFetch(agentId, port, "/skills", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(skill),
+        signal: AbortSignal.timeout(5000),
+      });
+
+      // If skill doesn't exist (404), create it with POST
+      if (res.status === 404) {
+        res = await agentFetch(agentId, port, "/skills", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(skill),
+          signal: AbortSignal.timeout(5000),
+        });
+      }
+
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        console.error(`[pushSkillsToAgent] Failed to push skill ${skill.name}:`, data.error || res.status);
+      }
+    }
+
+    // Enable skills globally via POST /skills/status
+    const statusRes = await agentFetch(agentId, port, "/skills/status", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ enabled: true }),
+      signal: AbortSignal.timeout(5000),
+    });
+
+    if (!statusRes.ok) {
+      const data = await statusRes.json().catch(() => ({}));
+      return { success: false, error: data.error || `HTTP ${statusRes.status}` };
+    }
+
+    console.log(`[pushSkillsToAgent] Pushed ${skills.length} skill(s) to agent`);
+    return { success: true };
+  } catch (err) {
+    return { success: false, error: String(err) };
+  }
+}
+
 // Exported helper to start an agent process (used by API route and auto-restart)
 export async function startAgentProcess(
   agent: Agent,
@@ -302,13 +435,37 @@ export async function startAgentProcess(
         }
         try {
           await fetch(`http://localhost:${port}/shutdown`, { method: "POST", signal: AbortSignal.timeout(1000) });
-          await new Promise(r => setTimeout(r, 500)); // Wait for shutdown
         } catch {
           // Shutdown failed - process might not support it
         }
+        // Wait longer for port to be released
+        await new Promise(r => setTimeout(r, 1500));
       }
     } catch {
-      // Port is free - good
+      // No HTTP response - but port might still be bound by zombie process
+    }
+
+    // Double-check port is actually free by trying to connect
+    const isPortFree = await checkPortFree(port);
+    if (!isPortFree) {
+      if (!silent) {
+        console.log(`  Port ${port} still in use, trying to kill process...`);
+      }
+      // Try to kill process using the port (Linux/Mac)
+      try {
+        const { execSync } = await import("child_process");
+        execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null || true`, { stdio: "ignore" });
+        await new Promise(r => setTimeout(r, 1000));
+      } catch {
+        // Ignore errors
+      }
+
+      // Final check
+      const stillInUse = !(await checkPortFree(port));
+      if (stillInUse) {
+        agentsStarting.delete(agent.id);
+        return { success: false, error: `Port ${port} is still in use` };
+      }
     }
 
     // Handle data directory
@@ -331,19 +488,25 @@ export async function startAgentProcess(
     }
 
     // Build environment with provider key and agent API key
+    // CONFIG_PATH ensures each agent has its own config file (prevents sharing)
+    const agentConfigPath = join(agentDataDir, "agent-config.json");
     const env: Record<string, string> = {
       ...process.env as Record<string, string>,
       PORT: String(port),
       DATA_DIR: agentDataDir,
+      CONFIG_PATH: agentConfigPath,
       AGENT_API_KEY: agentApiKey,
       [providerConfig.envVar]: providerKey,
     };
 
+    // Get binary path dynamically (allows hot-reload of new binary versions)
+    const binaryPath = getBinaryPathForAgent();
+
     const proc = spawn({
-      cmd: [BINARY_PATH],
+      cmd: [binaryPath],
       env,
-      stdout: "ignore",
-      stderr: "ignore",
+      stdout: "inherit",
+      stderr: "inherit",
     });
 
     // Store process with port for tracking
@@ -379,6 +542,16 @@ export async function startAgentProcess(
       console.log(`  Configuration applied successfully`);
     }
 
+    // Push skills via /skills endpoint (separate from config)
+    if (config.skills?.definitions?.length > 0) {
+      const skillsResult = await pushSkillsToAgent(agent.id, port, config.skills.definitions);
+      if (!skillsResult.success && !silent) {
+        console.error(`  Failed to push skills: ${skillsResult.error}`);
+      } else if (!silent) {
+        console.log(`  Skills pushed successfully (${config.skills.definitions.length} skills)`);
+      }
+    }
+
     // Update status in database (port is already set, just update status)
     AgentDB.setStatus(agent.id, "running");
 
@@ -409,6 +582,19 @@ function toApiAgent(agent: Agent) {
       type: s.type,
       status: s.status,
       port: s.port,
+      url: s.url, // Include URL for HTTP servers
+    }));
+
+  // Look up skill details
+  const skillDetails = (agent.skills || [])
+    .map(id => SkillDB.findById(id))
+    .filter((s): s is NonNullable<typeof s> => s !== null)
+    .map(s => ({
+      id: s.id,
+      name: s.name,
+      description: s.description,
+      version: s.version,
+      enabled: s.enabled,
     }));
 
   return {
@@ -422,6 +608,8 @@ function toApiAgent(agent: Agent) {
     features: agent.features,
     mcpServers: agent.mcp_servers, // Keep IDs for backwards compatibility
     mcpServerDetails, // Include full details
+    skills: agent.skills, // Skill IDs
+    skillDetails, // Include full details
     projectId: agent.project_id,
     createdAt: agent.created_at,
     updatedAt: agent.updated_at,
@@ -455,14 +643,22 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
     });
   }
 
+  // GET /api/features - Feature flags (no auth required)
+  if (path === "/api/features" && method === "GET") {
+    return json({
+      projects: process.env.PROJECTS_ENABLED === "true",
+      metaAgent: process.env.META_AGENT_ENABLED === "true",
+    });
+  }
+
   // GET /api/openapi - OpenAPI spec (no auth required)
   if (path === "/api/openapi" && method === "GET") {
     return json(openApiSpec);
   }
 
-  // GET /api/agents - List all agents
+  // GET /api/agents - List all agents (excludes meta agent)
   if (path === "/api/agents" && method === "GET") {
-    const agents = AgentDB.findAll();
+    const agents = AgentDB.findAll().filter(a => a.id !== META_AGENT_ID);
     return json({ agents: agents.map(toApiAgent) });
   }
 
@@ -487,6 +683,7 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
         system_prompt: systemPrompt || "You are a helpful assistant.",
         features: features || DEFAULT_FEATURES,
         mcp_servers: body.mcpServers || [],
+        skills: body.skills || [],
         project_id: projectId || null,
       });
 
@@ -507,6 +704,20 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
     return json({ agent: toApiAgent(agent) });
   }
 
+  // GET /api/agents/:id/api-key - Get agent API key (dev mode only)
+  const agentApiKeyMatch = path.match(/^\/api\/agents\/([^/]+)\/api-key$/);
+  if (agentApiKeyMatch && method === "GET") {
+    if (!isDev) {
+      return json({ error: "Only available in development mode" }, 403);
+    }
+    const agent = AgentDB.findById(agentApiKeyMatch[1]);
+    if (!agent) {
+      return json({ error: "Agent not found" }, 404);
+    }
+    const apiKey = AgentDB.getApiKey(agent.id);
+    return json({ apiKey });
+  }
+
   // PUT /api/agents/:id - Update an agent
   if (agentMatch && method === "PUT") {
     const agent = AgentDB.findById(agentMatch[1]);
@@ -524,11 +735,12 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
       if (body.systemPrompt !== undefined) updates.system_prompt = body.systemPrompt;
       if (body.features !== undefined) updates.features = body.features;
       if (body.mcpServers !== undefined) updates.mcp_servers = body.mcpServers;
+      if (body.skills !== undefined) updates.skills = body.skills;
       if (body.projectId !== undefined) updates.project_id = body.projectId;
 
       const updated = AgentDB.update(agentMatch[1], updates);
 
-      // If agent is running, push the new config
+      // If agent is running, push the new config and skills
       if (updated && updated.status === "running" && updated.port) {
         const providerKey = ProviderKeys.getDecrypted(updated.provider);
         if (providerKey) {
@@ -537,6 +749,13 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
           if (!configResult.success) {
             console.error(`Failed to push config to running agent: ${configResult.error}`);
           }
+          // Push skills via /skills endpoint
+          if (config.skills?.definitions?.length > 0) {
+            const skillsResult = await pushSkillsToAgent(updated.id, updated.port, config.skills.definitions);
+            if (!skillsResult.success) {
+              console.error(`Failed to push skills to running agent: ${skillsResult.error}`);
+            }
+          }
         }
       }
 
@@ -556,9 +775,41 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
 
     // Stop the agent if running
     const agentProc = agentProcesses.get(agentId);
+    const port = agent.port;
+
     if (agentProc) {
-      agentProc.proc.kill();
+      // Try graceful shutdown first
+      if (port) {
+        try {
+          await fetch(`http://localhost:${port}/shutdown`, {
+            method: "POST",
+            signal: AbortSignal.timeout(2000),
+          });
+          await new Promise(r => setTimeout(r, 500));
+        } catch {
+          // Graceful shutdown failed
+        }
+      }
+
+      try {
+        agentProc.proc.kill();
+      } catch {
+        // Already dead
+      }
       agentProcesses.delete(agentId);
+
+      // Ensure port is freed
+      if (port) {
+        const isFree = await checkPortFree(port);
+        if (!isFree) {
+          try {
+            const { execSync } = await import("child_process");
+            execSync(`lsof -ti :${port} | xargs -r kill -9 2>/dev/null || true`, { stdio: "ignore" });
+          } catch {
+            // Ignore
+          }
+        }
+      }
     }
 
     // Delete agent's telemetry data
@@ -645,10 +896,45 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
     }
 
     const agentProc = agentProcesses.get(agent.id);
+    const port = agent.port;
+
     if (agentProc) {
       console.log(`Stopping agent ${agent.name} (pid: ${agentProc.proc.pid})...`);
-      agentProc.proc.kill();
+
+      // Try graceful shutdown first
+      if (port) {
+        try {
+          await fetch(`http://localhost:${port}/shutdown`, {
+            method: "POST",
+            signal: AbortSignal.timeout(2000),
+          });
+          await new Promise(r => setTimeout(r, 500)); // Wait for graceful shutdown
+        } catch {
+          // Graceful shutdown failed or timed out
+        }
+      }
+
+      // Force kill if still running
+      try {
+        agentProc.proc.kill();
+      } catch {
+        // Already dead
+      }
       agentProcesses.delete(agent.id);
+
+      // Ensure port is freed
+      if (port) {
+        const isFree = await checkPortFree(port);
+        if (!isFree) {
+          // Force kill by port
+          try {
+            const { execSync } = await import("child_process");
+            execSync(`lsof -ti :${port} | xargs -r kill -9 2>/dev/null || true`, { stdio: "ignore" });
+          } catch {
+            // Ignore
+          }
+        }
+      }
     }
 
     const updated = AgentDB.setStatus(agent.id, "stopped");
@@ -1084,6 +1370,44 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
 
   // ==================== DISCOVERY/PEERS PROXY ====================
 
+  // GET /api/discovery/agents - Central discovery endpoint for agents to find peers
+  // Called by agent binaries to discover other agents in the same group
+  if (path === "/api/discovery/agents" && method === "GET") {
+    const group = url.searchParams.get("group");
+    const excludeId = url.searchParams.get("exclude") || req.headers.get("X-Agent-ID");
+
+    // Find all running agents in the same group
+    const allAgents = AgentDB.findAll();
+    const peers = allAgents
+      .filter(a => {
+        // Must be running with a port
+        if (a.status !== "running" || !a.port) return false;
+        // Exclude the requesting agent
+        if (excludeId && a.id === excludeId) return false;
+        // Must have multi-agent enabled
+        const agentConfig = getMultiAgentConfig(a.features, a.project_id);
+        if (!agentConfig.enabled) return false;
+        // If group specified, must match
+        if (group) {
+          const peerGroup = agentConfig.group || a.project_id;
+          if (peerGroup !== group) return false;
+        }
+        return true;
+      })
+      .map(a => {
+        const agentConfig = getMultiAgentConfig(a.features, a.project_id);
+        return {
+          id: a.id,
+          name: a.name,
+          url: `http://localhost:${a.port}`,
+          mode: agentConfig.mode || "worker",
+          group: agentConfig.group || a.project_id,
+        };
+      });
+
+    return json({ agents: peers });
+  }
+
   // GET /api/agents/:id/peers - Get discovered peer agents
   const peersMatch = path.match(/^\/api\/agents\/([^/]+)\/peers$/);
   if (peersMatch && method === "GET") {
@@ -1188,6 +1512,140 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
     }
   }
 
+  // ==================== META AGENT (Apteva Assistant) ====================
+
+  // GET /api/meta-agent/status - Get meta agent status and config
+  if (path === "/api/meta-agent/status" && method === "GET") {
+    if (!META_AGENT_ENABLED) {
+      return json({ enabled: false });
+    }
+
+    // Check if onboarding is complete
+    if (!Onboarding.isComplete()) {
+      return json({ enabled: true, available: false, reason: "onboarding_incomplete" });
+    }
+
+    // Get first configured provider
+    const configuredProviders = ProviderKeys.getConfiguredProviders();
+    if (configuredProviders.length === 0) {
+      return json({ enabled: true, available: false, reason: "no_provider" });
+    }
+
+    const providerId = configuredProviders[0] as keyof typeof PROVIDERS;
+    const provider = PROVIDERS[providerId];
+    if (!provider) {
+      return json({ enabled: true, available: false, reason: "invalid_provider" });
+    }
+
+    // Check if meta agent exists, create if not
+    let metaAgent = AgentDB.findById(META_AGENT_ID);
+    if (!metaAgent) {
+      // Find a recommended model or use first one
+      const defaultModel = provider.models.find(m => m.recommended)?.value || provider.models[0]?.value;
+      if (!defaultModel) {
+        return json({ enabled: true, available: false, reason: "no_model" });
+      }
+
+      // Create the meta agent
+      metaAgent = AgentDB.create({
+        id: META_AGENT_ID,
+        name: "Apteva Assistant",
+        model: defaultModel,
+        provider: providerId,
+        system_prompt: `You are the Apteva Assistant, a helpful guide for users of the Apteva agent management platform.
+
+You can help users with:
+- Creating and configuring AI agents
+- Setting up MCP servers for tool integrations
+- Managing projects and organizing agents
+- Explaining features like Memory, Tasks, Vision, Operator, Files, and Multi-Agent
+- Troubleshooting common issues
+
+Be concise, friendly, and helpful. When users ask about creating something, guide them step by step.
+Keep responses short and actionable. Use markdown formatting when helpful.`,
+        features: {
+          memory: false,
+          tasks: false,
+          vision: false,
+          operator: false,
+          mcp: false,
+          realtime: false,
+          files: false,
+          agents: false,
+        },
+        mcp_servers: [],
+        skills: [],
+        project_id: null, // Meta agent belongs to no project
+      });
+    }
+
+    // Return status
+    return json({
+      enabled: true,
+      available: true,
+      agent: {
+        id: metaAgent.id,
+        name: metaAgent.name,
+        status: metaAgent.status,
+        port: metaAgent.port,
+        provider: metaAgent.provider,
+        model: metaAgent.model,
+      },
+    });
+  }
+
+  // POST /api/meta-agent/start - Start the meta agent
+  if (path === "/api/meta-agent/start" && method === "POST") {
+    if (!META_AGENT_ENABLED) {
+      return json({ error: "Meta agent is not enabled" }, 400);
+    }
+
+    const metaAgent = AgentDB.findById(META_AGENT_ID);
+    if (!metaAgent) {
+      return json({ error: "Meta agent not found" }, 404);
+    }
+
+    if (metaAgent.status === "running") {
+      return json({ agent: toApiAgent(metaAgent), message: "Already running" });
+    }
+
+    // Start the agent using existing startAgentProcess function
+    const result = await startAgentProcess(metaAgent, { silent: true });
+    if (!result.success) {
+      return json({ error: result.error || "Failed to start meta agent" }, 500);
+    }
+
+    const updated = AgentDB.findById(META_AGENT_ID);
+    return json({ agent: updated ? toApiAgent(updated) : null });
+  }
+
+  // POST /api/meta-agent/stop - Stop the meta agent
+  if (path === "/api/meta-agent/stop" && method === "POST") {
+    if (!META_AGENT_ENABLED) {
+      return json({ error: "Meta agent is not enabled" }, 400);
+    }
+
+    const metaAgent = AgentDB.findById(META_AGENT_ID);
+    if (!metaAgent) {
+      return json({ error: "Meta agent not found" }, 404);
+    }
+
+    if (metaAgent.status === "stopped") {
+      return json({ agent: toApiAgent(metaAgent), message: "Already stopped" });
+    }
+
+    // Stop the agent
+    const proc = agentProcesses.get(META_AGENT_ID);
+    if (proc) {
+      proc.kill();
+      agentProcesses.delete(META_AGENT_ID);
+    }
+    AgentDB.setStatus(META_AGENT_ID, "stopped");
+
+    const updated = AgentDB.findById(META_AGENT_ID);
+    return json({ agent: updated ? toApiAgent(updated) : null });
+  }
+
   // ==================== USER MANAGEMENT (Admin only) ====================
 
   // GET /api/users - List all users
@@ -1438,7 +1896,48 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
         return json({ error: result.error }, 400);
       }
 
-      return json({ success: true, message: "API key saved successfully" });
+      // Restart any running agents that use this provider (including meta agent)
+      const runningAgents = AgentDB.findAll().filter(
+        a => a.status === "running" && a.provider === providerId
+      );
+
+      const restartResults: Array<{ id: string; name: string; success: boolean; error?: string }> = [];
+      for (const agent of runningAgents) {
+        try {
+          // Stop the agent
+          const agentProc = agentProcesses.get(agent.id);
+          if (agentProc) {
+            agentProc.proc.kill();
+            agentProcesses.delete(agent.id);
+          }
+          AgentDB.setStatus(agent.id, "stopped", null);
+
+          // Wait a moment for port to be released
+          await new Promise(r => setTimeout(r, 500));
+
+          // Restart the agent with new key
+          const startResult = await startAgentProcess(agent, { silent: true });
+          restartResults.push({
+            id: agent.id,
+            name: agent.name,
+            success: startResult.success,
+            error: startResult.error,
+          });
+        } catch (e) {
+          restartResults.push({
+            id: agent.id,
+            name: agent.name,
+            success: false,
+            error: String(e),
+          });
+        }
+      }
+
+      return json({
+        success: true,
+        message: "API key saved successfully",
+        restartedAgents: restartResults.length > 0 ? restartResults : undefined,
+      });
     } catch (e) {
       return json({ error: "Invalid request body" }, 400);
     }
@@ -1709,9 +2208,23 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
 
   // ============ MCP Server API ============
 
-  // GET /api/mcp/servers - List all MCP servers
+  // GET /api/mcp/servers - List MCP servers (optionally filtered by project)
   if (path === "/api/mcp/servers" && method === "GET") {
-    const servers = McpServerDB.findAll();
+    const url = new URL(req.url);
+    const projectFilter = url.searchParams.get("project"); // "all", "global", or project ID
+    const forAgent = url.searchParams.get("forAgent"); // agent's project ID (shows global + project)
+
+    let servers;
+    if (forAgent !== null) {
+      // Get servers available for an agent (global + agent's project)
+      servers = McpServerDB.findForAgent(forAgent || null);
+    } else if (projectFilter === "global") {
+      servers = McpServerDB.findGlobal();
+    } else if (projectFilter && projectFilter !== "all") {
+      servers = McpServerDB.findByProject(projectFilter);
+    } else {
+      servers = McpServerDB.findAll();
+    }
     return json({ servers });
   }
 
@@ -2172,7 +2685,7 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
   if (path === "/api/mcp/servers" && method === "POST") {
     try {
       const body = await req.json();
-      const { name, type, package: pkg, command, args, env, url, headers, source } = body;
+      const { name, type, package: pkg, pip_module, command, args, env, url, headers, source, project_id } = body;
 
       if (!name) {
         return json({ error: "Name is required" }, 400);
@@ -2183,12 +2696,14 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
         name,
         type: type || "npm",
         package: pkg || null,
+        pip_module: pip_module || null,
         command: command || null,
         args: args || null,
         env: env || {},
         url: url || null,
         headers: headers || {},
         source: source || null,
+        project_id: project_id || null,
       });
 
       return json({ server }, 201);
@@ -2225,6 +2740,7 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
       if (body.command !== undefined) updates.command = body.command;
       if (body.args !== undefined) updates.args = body.args;
       if (body.env !== undefined) updates.env = body.env;
+      if (body.project_id !== undefined) updates.project_id = body.project_id;
 
       const updated = McpServerDB.update(mcpServerMatch[1], updates);
       return json({ server: updated });
@@ -2279,6 +2795,32 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
         const substitutedArgs = substituteEnvVars(server.args, serverEnv);
         cmd.push(...substitutedArgs.split(" "));
       }
+    } else if (server.type === "pip" && server.package) {
+      // Python pip package - install first, then run module
+      const pipPackage = server.package;
+      const pipModule = server.pip_module || server.package.split("[")[0]; // Default: package name without extras
+
+      console.log(`Installing pip package: ${pipPackage}...`);
+      const installResult = spawn({
+        cmd: ["pip", "install", "--quiet", "--break-system-packages", pipPackage],
+        env: { ...process.env as Record<string, string>, ...serverEnv },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+
+      // Wait for installation to complete
+      const exitCode = await installResult.exited;
+      if (exitCode !== 0) {
+        const stderr = await new Response(installResult.stderr).text();
+        return json({ error: `Failed to install pip package: ${stderr || "unknown error"}` }, 500);
+      }
+
+      // Now run the module
+      cmd = ["python", "-m", pipModule];
+      if (server.args) {
+        const substitutedArgs = substituteEnvVars(server.args, serverEnv);
+        cmd.push(...substitutedArgs.split(" "));
+      }
     } else if (server.package) {
       // npm package - use npx
       cmd = ["npx", "-y", server.package];
@@ -2420,6 +2962,284 @@ export async function handleApiRequest(req: Request, path: string, authContext?:
     }
   }
 
+  // ============ Skills Endpoints ============
+
+  // GET /api/skills - List skills (optionally filtered by project)
+  if (path === "/api/skills" && method === "GET") {
+    const url = new URL(req.url);
+    const projectFilter = url.searchParams.get("project"); // "all", "global", or project ID
+    const forAgent = url.searchParams.get("forAgent"); // agent's project ID (shows global + project)
+
+    let skills;
+    if (forAgent !== null) {
+      // Get skills available for an agent (global + agent's project)
+      skills = SkillDB.findForAgent(forAgent || null);
+    } else if (projectFilter === "global") {
+      skills = SkillDB.findGlobal();
+    } else if (projectFilter && projectFilter !== "all") {
+      skills = SkillDB.findByProject(projectFilter);
+    } else {
+      skills = SkillDB.findAll();
+    }
+    return json({ skills });
+  }
+
+  // POST /api/skills - Create a new skill
+  if (path === "/api/skills" && method === "POST") {
+    try {
+      const body = await req.json();
+      const { name, description, content, version, license, compatibility, metadata, allowed_tools, source, source_url, enabled, project_id } = body;
+
+      if (!name || !description || !content) {
+        return json({ error: "name, description, and content are required" }, 400);
+      }
+
+      // Validate name format (lowercase, hyphens only)
+      if (!/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z]$/.test(name)) {
+        return json({ error: "name must be lowercase letters, numbers, and hyphens only" }, 400);
+      }
+
+      if (SkillDB.exists(name)) {
+        return json({ error: "A skill with this name already exists" }, 400);
+      }
+
+      const skill = SkillDB.create({
+        name,
+        description,
+        content,
+        version: version || "1.0.0",
+        license: license || null,
+        compatibility: compatibility || null,
+        metadata: metadata || {},
+        allowed_tools: allowed_tools || [],
+        source: source || "local",
+        source_url: source_url || null,
+        enabled: enabled !== false,
+        project_id: project_id || null,
+      });
+
+      return json({ skill }, 201);
+    } catch (err) {
+      console.error("Failed to create skill:", err);
+      return json({ error: `Failed to create skill: ${err}` }, 500);
+    }
+  }
+
+  // GET /api/skills/:id - Get a skill
+  const skillMatch = path.match(/^\/api\/skills\/([^/]+)$/);
+  if (skillMatch && method === "GET") {
+    const skill = SkillDB.findById(skillMatch[1]);
+    if (!skill) {
+      return json({ error: "Skill not found" }, 404);
+    }
+    return json({ skill });
+  }
+
+  // PUT /api/skills/:id - Update a skill
+  if (skillMatch && method === "PUT") {
+    const skill = SkillDB.findById(skillMatch[1]);
+    if (!skill) {
+      return json({ error: "Skill not found" }, 404);
+    }
+
+    try {
+      const body = await req.json();
+      const updates: Partial<Skill> = {};
+
+      if (body.name !== undefined) updates.name = body.name;
+      if (body.description !== undefined) updates.description = body.description;
+      if (body.content !== undefined) updates.content = body.content;
+      if (body.license !== undefined) updates.license = body.license;
+      if (body.compatibility !== undefined) updates.compatibility = body.compatibility;
+      if (body.metadata !== undefined) updates.metadata = body.metadata;
+      if (body.allowed_tools !== undefined) updates.allowed_tools = body.allowed_tools;
+      if (body.enabled !== undefined) updates.enabled = body.enabled;
+      if (body.project_id !== undefined) updates.project_id = body.project_id;
+
+      // Auto-increment version if content changed
+      if (body.content !== undefined && body.content !== skill.content) {
+        const [major, minor, patch] = (skill.version || "1.0.0").split(".").map(Number);
+        updates.version = `${major}.${minor}.${patch + 1}`;
+      } else if (body.version !== undefined) {
+        updates.version = body.version;
+      }
+
+      const updated = SkillDB.update(skillMatch[1], updates);
+
+      // Push updated skill to all running agents that have it
+      const agentsWithSkill = AgentDB.findBySkill(skillMatch[1]);
+      const runningAgents = agentsWithSkill.filter(a => a.status === "running" && a.port);
+
+      for (const agent of runningAgents) {
+        try {
+          const providerKey = ProviderKeys.getDecrypted(agent.provider);
+          if (providerKey) {
+            const config = buildAgentConfig(agent, providerKey);
+            await pushConfigToAgent(agent.id, agent.port!, config);
+            // Push skills via /skills endpoint
+            if (config.skills?.definitions?.length > 0) {
+              await pushSkillsToAgent(agent.id, agent.port!, config.skills.definitions);
+            }
+            console.log(`Pushed skill update to agent ${agent.name}`);
+          }
+        } catch (err) {
+          console.error(`Failed to push skill update to agent ${agent.name}:`, err);
+        }
+      }
+
+      return json({ skill: updated, agents_updated: runningAgents.length });
+    } catch (err) {
+      console.error("Failed to update skill:", err);
+      return json({ error: `Failed to update skill: ${err}` }, 500);
+    }
+  }
+
+  // DELETE /api/skills/:id - Delete a skill
+  if (skillMatch && method === "DELETE") {
+    const skill = SkillDB.findById(skillMatch[1]);
+    if (!skill) {
+      return json({ error: "Skill not found" }, 404);
+    }
+
+    SkillDB.delete(skillMatch[1]);
+    return json({ success: true });
+  }
+
+  // POST /api/skills/:id/toggle - Toggle skill enabled/disabled
+  const skillToggleMatch = path.match(/^\/api\/skills\/([^/]+)\/toggle$/);
+  if (skillToggleMatch && method === "POST") {
+    const skill = SkillDB.findById(skillToggleMatch[1]);
+    if (!skill) {
+      return json({ error: "Skill not found" }, 404);
+    }
+
+    const updated = SkillDB.setEnabled(skillToggleMatch[1], !skill.enabled);
+    return json({ skill: updated });
+  }
+
+  // POST /api/skills/import - Import a skill from SKILL.md content
+  if (path === "/api/skills/import" && method === "POST") {
+    try {
+      const body = await req.json();
+      const { content, source, source_url } = body;
+
+      if (!content) {
+        return json({ error: "content is required" }, 400);
+      }
+
+      const parsed = parseSkillMd(content);
+      if (!parsed) {
+        return json({ error: "Invalid SKILL.md format. Must have YAML frontmatter with name and description." }, 400);
+      }
+
+      if (SkillDB.exists(parsed.name)) {
+        return json({ error: `A skill named "${parsed.name}" already exists` }, 400);
+      }
+
+      const skill = SkillDB.create({
+        name: parsed.name,
+        description: parsed.description,
+        content: content, // Store full content including frontmatter
+        license: parsed.license || null,
+        compatibility: parsed.compatibility || null,
+        metadata: parsed.metadata || {},
+        allowed_tools: parsed.allowedTools || [],
+        source: source || "import",
+        source_url: source_url || null,
+        enabled: true,
+      });
+
+      return json({ skill }, 201);
+    } catch (err) {
+      console.error("Failed to import skill:", err);
+      return json({ error: `Failed to import skill: ${err}` }, 500);
+    }
+  }
+
+  // GET /api/skills/:id/export - Export a skill as SKILL.md
+  const skillExportMatch = path.match(/^\/api\/skills\/([^/]+)\/export$/);
+  if (skillExportMatch && method === "GET") {
+    const skill = SkillDB.findById(skillExportMatch[1]);
+    if (!skill) {
+      return json({ error: "Skill not found" }, 404);
+    }
+
+    // Return the raw content
+    return new Response(skill.content, {
+      headers: {
+        "Content-Type": "text/markdown",
+        "Content-Disposition": `attachment; filename="${skill.name}-SKILL.md"`,
+      },
+    });
+  }
+
+  // ============ SkillsMP Marketplace Endpoints ============
+
+  // GET /api/skills/marketplace/search - Search skills marketplace
+  if (path === "/api/skills/marketplace/search" && method === "GET") {
+    const url = new URL(req.url);
+    const query = url.searchParams.get("q") || "";
+    const page = parseInt(url.searchParams.get("page") || "1", 10);
+
+    // Get SkillsMP API key if configured
+    const skillsmpKey = ProviderKeys.getDecrypted("skillsmp");
+
+    const result = await SkillsmpProvider.search(skillsmpKey || "", query, page);
+    return json(result);
+  }
+
+  // GET /api/skills/marketplace/featured - Get featured skills
+  if (path === "/api/skills/marketplace/featured" && method === "GET") {
+    const skillsmpKey = ProviderKeys.getDecrypted("skillsmp");
+    const skills = await SkillsmpProvider.getFeatured(skillsmpKey || "");
+    return json({ skills });
+  }
+
+  // GET /api/skills/marketplace/:id - Get skill details from marketplace
+  const marketplaceSkillMatch = path.match(/^\/api\/skills\/marketplace\/([^/]+)$/);
+  if (marketplaceSkillMatch && method === "GET") {
+    const skillsmpKey = ProviderKeys.getDecrypted("skillsmp");
+    const skill = await SkillsmpProvider.getSkill(skillsmpKey || "", marketplaceSkillMatch[1]);
+    if (!skill) {
+      return json({ error: "Skill not found in marketplace" }, 404);
+    }
+    return json({ skill });
+  }
+
+  // POST /api/skills/marketplace/:id/install - Install a skill from marketplace
+  const marketplaceInstallMatch = path.match(/^\/api\/skills\/marketplace\/([^/]+)\/install$/);
+  if (marketplaceInstallMatch && method === "POST") {
+    const skillsmpKey = ProviderKeys.getDecrypted("skillsmp");
+    const marketplaceSkill = await SkillsmpProvider.getSkill(skillsmpKey || "", marketplaceInstallMatch[1]);
+
+    if (!marketplaceSkill) {
+      return json({ error: "Skill not found in marketplace" }, 404);
+    }
+
+    if (SkillDB.exists(marketplaceSkill.name)) {
+      return json({ error: `A skill named "${marketplaceSkill.name}" already exists` }, 400);
+    }
+
+    const skill = SkillDB.create({
+      name: marketplaceSkill.name,
+      description: marketplaceSkill.description,
+      content: marketplaceSkill.content,
+      license: marketplaceSkill.license,
+      compatibility: marketplaceSkill.compatibility,
+      metadata: {
+        author: marketplaceSkill.author,
+        version: marketplaceSkill.version,
+        ...(marketplaceSkill.repository ? { repository: marketplaceSkill.repository } : {}),
+      },
+      allowed_tools: [],
+      source: "skillsmp",
+      source_url: marketplaceSkill.repository || `https://skillsmp.com/skills/${marketplaceSkill.id}`,
+      enabled: true,
+    });
+
+    return json({ skill }, 201);
+  }
+
   // ============ Telemetry Endpoints ============
 
   // POST /api/telemetry - Receive telemetry events from agents