apteva 0.4.32 → 0.4.44

package/src/routes/api/integrations.ts

@@ -111,8 +111,11 @@ export async function handleIntegrationRoutes(
 
     try {
       const body = await req.json();
-      const { appSlug, redirectUrl, credentials, project_id } = body;
-      const apiKey = ProviderKeys.getDecryptedForProject(providerId, project_id || null);
+      const { appSlug, redirectUrl, credentials } = body;
+      // Read project_id from query param (frontend sends it there), fall back to body
+      const url = new URL(req.url);
+      const projectId = url.searchParams.get("project_id") || body.project_id || null;
+      const apiKey = ProviderKeys.getDecryptedForProject(providerId, projectId);
       if (!apiKey) {
         return json({ error: `${provider.name} API key not configured` }, 401);
       }
@@ -127,7 +130,8 @@ export async function handleIntegrationRoutes(
       }
 
       // Default redirect URL back to our integrations page
-      const callbackUrl = redirectUrl || `http://localhost:${process.env.PORT || 4280}/mcp?tab=hosted&connected=${appSlug}`;
+      const origin = req.headers.get("origin") || process.env.INSTANCE_URL || `http://localhost:${process.env.PORT || 4280}`;
+      const callbackUrl = redirectUrl || `${origin}/mcp?tab=hosted&connected=${appSlug}`;
 
       const result = await provider.initiateConnection(apiKey, user.id, appSlug, callbackUrl, credentials);
       return json(result);
@@ -329,7 +333,8 @@ export async function handleIntegrationRoutes(
         : mcpUrl;
 
       // Check if already exists (match by config ID in URL)
-      const existing = McpServerDB.findAll().find(
+      // Use Light variant to skip expensive decryption of env/headers
+      const existing = McpServerDB.findAllLight().find(
         s => s.source === "composio" && s.url?.includes(configId)
       );
       if (existing) {
@@ -527,8 +532,9 @@ export async function handleIntegrationRoutes(
       console.log(`[agentdojo:add] fetched server: slug=${server.slug} name=${server.name} url=${server.url?.substring(0, 80)}`);
 
       // Check if already exists — match by slug in URL, scoped to same project
+      // Use Light variant to skip expensive decryption of env/headers
       const effectiveProjectId = projectId && projectId !== "unassigned" ? projectId : null;
-      const allServers = McpServerDB.findAll();
+      const allServers = McpServerDB.findAllLight();
       const agentdojoServers = allServers.filter(s => s.source === "agentdojo");
       console.log(`[agentdojo:add] total servers=${allServers.length} agentdojo servers=${agentdojoServers.length}`);
       const existing = agentdojoServers.find(

package/src/routes/api/mcp.ts

@@ -28,16 +28,17 @@ export async function handleMcpRoutes(
     let queryMode: string;
     if (forAgent !== null) {
       // Get servers available for an agent (global + agent's project)
-      servers = McpServerDB.findForAgent(forAgent || null);
+      // Use Light variant: skips expensive decryption of env/headers
+      servers = McpServerDB.findForAgentLight(forAgent || null);
       queryMode = `forAgent=${forAgent}`;
     } else if (projectFilter === "global") {
-      servers = McpServerDB.findGlobal();
+      servers = McpServerDB.findGlobalLight();
       queryMode = "global";
     } else if (projectFilter && projectFilter !== "all") {
-      servers = McpServerDB.findByProject(projectFilter);
+      servers = McpServerDB.findByProjectLight(projectFilter);
       queryMode = `project=${projectFilter}`;
     } else {
-      servers = McpServerDB.findAll();
+      servers = McpServerDB.findAllLight();
       queryMode = "all";
     }
     const agentdojoCount = servers.filter(s => s.source === "agentdojo").length;

package/src/routes/api/meta-agent.ts

@@ -56,6 +56,9 @@ WHAT YOU CAN DO:
 - **Skills**: List, enable/disable, and assign skills to agents
 - **Providers**: Check which LLM providers have API keys configured
 - **Communication**: Send messages to running agents
+- **Integrations**: Connect third-party apps (GitHub, Slack, etc.) via API key, create MCP servers from them, and add them locally
+- **Tests**: Create and run automated tests for agent workflows
+- **Triggers**: Subscribe agents to external events (webhooks)
 
 WORKFLOW FOR CREATING AGENTS:
 1. Use list_providers to check which providers have API keys
@@ -63,6 +66,14 @@ WORKFLOW FOR CREATING AGENTS:
 3. Optionally assign MCP servers (for tools) and skills (for behavior)
 4. Use start_agent to run it
 
+WORKFLOW FOR ADDING INTEGRATIONS:
+1. Use list_integration_providers to see available providers (agentdojo, composio)
+2. Use list_integration_apps to browse available apps/toolkits
+3. Use connect_integration_app to authenticate with an API key (for OAuth, direct user to Browse Toolkits UI)
+4. Use create_integration_config to create an MCP server from the connected app
+5. Use add_integration_config_locally to add it as a local MCP server
+6. Use assign_mcp_server_to_agent to give an agent access
+
 AGENT FEATURES (enable when creating/updating):
 - **memory**: Persistent memory across conversations (needs OpenAI key for embeddings)
 - **tasks**: Scheduling and task tracking
@@ -70,6 +81,9 @@ AGENT FEATURES (enable when creating/updating):
 - **mcp**: Required if assigning MCP servers — gives the agent tool-use capability
 - **files**: File read/write in agent workspace
 
+CRITICAL — PROJECT CONTEXT:
+Your chat context tells you the current project (name and id). **You MUST pass this project_id to EVERY tool call that accepts a project_id parameter.** API keys, integrations, MCP servers, and agents are scoped per project — calls without project_id will fail to find them. Extract the id from your context and always include it.
+
 ALWAYS use your tools proactively. When a user says "create an agent", don't explain how — just do it. Confirm what you did after.
 Be concise. Use markdown formatting.`,
         features: {
@@ -81,6 +95,10 @@ Be concise. Use markdown formatting.`,
           realtime: false,
           files: false,
           agents: false,
+          builtinTools: {
+            webSearch: providerId === "anthropic",
+            webFetch: providerId === "anthropic",
+          },
         },
         mcp_servers: [],
         skills: [],
@@ -99,6 +117,8 @@ Be concise. Use markdown formatting.`,
         port: metaAgent.port,
         provider: metaAgent.provider,
         model: metaAgent.model,
+        features: metaAgent.features,
+        systemPrompt: metaAgent.system_prompt,
       },
     });
   }
@@ -118,8 +138,24 @@ Be concise. Use markdown formatting.`,
       return json({ agent: toApiAgent(metaAgent), message: "Already running" });
     }
 
+    // Ensure builtinTools are enabled for anthropic provider
+    if (metaAgent.provider === "anthropic" && !metaAgent.features?.builtinTools?.webSearch) {
+      const updatedFeatures = {
+        ...metaAgent.features,
+        builtinTools: { webSearch: true, webFetch: true },
+      };
+      AgentDB.update(META_AGENT_ID, { features: updatedFeatures });
+      console.log(`[meta-agent] Enabled builtinTools for anthropic provider`);
+    }
+    // Always re-read to get latest features
+    const freshAgent = AgentDB.findById(META_AGENT_ID);
+    if (!freshAgent) {
+      return json({ error: "Meta agent not found after update" }, 500);
+    }
+    console.log(`[meta-agent] Starting with builtinTools:`, JSON.stringify(freshAgent.features?.builtinTools));
+
     // Start the agent using existing startAgentProcess function
-    const result = await startAgentProcess(metaAgent, { silent: true });
+    const result = await startAgentProcess(freshAgent, { silent: true });
     if (!result.success) {
       return json({ error: result.error || "Failed to start meta agent" }, 500);
     }

package/src/routes/api/projects.ts

@@ -88,9 +88,9 @@ export async function handleProjectRoutes(
       return json({ error: "Project not found" }, 404);
     }
 
-    // Stop any running agents in this project first
+    // Stop any running agents in this project first - in parallel
     const projectAgents = AgentDB.findByProject(projectMatch[1]);
-    for (const agent of projectAgents) {
+    await Promise.allSettled(projectAgents.map(async (agent) => {
       if (agent.status === "running") {
         const entry = agentProcesses.get(agent.id);
         if (entry) {
@@ -102,7 +102,7 @@ export async function handleProjectRoutes(
         }
         setAgentStatus(agent.id, "stopped", "project_deleted");
       }
-    }
+    }));
 
     ProjectDB.delete(projectMatch[1]);
     return json({ success: true });

package/src/routes/api/providers.ts

@@ -1,4 +1,14 @@
+import { existsSync } from "fs";
 import { json, debug } from "./helpers";
+
+// Detect if running inside a Docker container
+async function isRunningInDocker(): Promise<boolean> {
+  try {
+    return existsSync("/.dockerenv") || existsSync("/run/.containerenv");
+  } catch {
+    return false;
+  }
+}
 import { startAgentProcess, setAgentStatus } from "./agent-utils";
 import { AgentDB, UserDB } from "../../db";
 import { ProviderKeys, Onboarding, getProvidersWithStatus, PROVIDERS, type ProviderId } from "../../providers";
@@ -55,6 +65,7 @@ export async function handleProviderRoutes(
   // GET /api/providers/ollama/status - Check if Ollama is running
   if (path === "/api/providers/ollama/status" && method === "GET") {
     const ollamaUrl = ProviderKeys.getDecrypted("ollama") || "http://localhost:11434";
+    const isDocker = await isRunningInDocker();
 
     try {
       const response = await fetch(`${ollamaUrl}/api/tags`, {
@@ -68,11 +79,96 @@ export async function handleProviderRoutes(
           connected: true,
           url: ollamaUrl,
           modelCount: data.models?.length || 0,
+          isDocker,
         });
       }
-      return json({ connected: false, url: ollamaUrl, error: "Ollama not responding" });
+      return json({ connected: false, url: ollamaUrl, error: "Ollama not responding", isDocker });
     } catch {
-      return json({ connected: false, url: ollamaUrl, error: "Ollama not reachable" });
+      return json({ connected: false, url: ollamaUrl, error: "Ollama not reachable", isDocker });
+    }
+  }
+
+  // POST /api/providers/ollama/install - Install Ollama automatically
+  if (path === "/api/providers/ollama/install" && method === "POST") {
+    // Don't allow install inside Docker containers
+    if (await isRunningInDocker()) {
+      return json({ success: false, error: "Cannot install Ollama inside a Docker container. Configure an external Ollama URL instead." }, 400);
+    }
+
+    // Only supported on Linux/macOS
+    const platform = process.platform;
+    if (platform !== "linux" && platform !== "darwin") {
+      return json({ success: false, error: "Auto-install is only supported on Linux and macOS. Please download from https://ollama.com/download" }, 400);
+    }
+
+    // Check if already installed
+    try {
+      const which = Bun.spawnSync(["which", "ollama"]);
+      if (which.exitCode === 0) {
+        // Already installed, just make sure it's running
+        Bun.spawn(["ollama", "serve"], { stdout: "ignore", stderr: "ignore" });
+        // Wait a moment for it to start
+        await new Promise(r => setTimeout(r, 2000));
+        return json({ success: true, message: "Ollama is already installed", alreadyInstalled: true });
+      }
+    } catch { /* not installed */ }
+
+    // Install Ollama using official install script
+    try {
+      const proc = Bun.spawnSync(["bash", "-c", "curl -fsSL https://ollama.com/install.sh | sh"], {
+        timeout: 120_000, // 2 minute timeout
+        stderr: "pipe",
+        stdout: "pipe",
+      });
+
+      if (proc.exitCode !== 0) {
+        const stderr = proc.stderr.toString().trim();
+        return json({ success: false, error: `Installation failed: ${stderr || "Unknown error"}` }, 500);
+      }
+
+      // Start Ollama serve in background
+      Bun.spawn(["ollama", "serve"], { stdout: "ignore", stderr: "ignore" });
+
+      // Wait for it to come up
+      await new Promise(r => setTimeout(r, 3000));
+
+      // Verify it's running
+      try {
+        const check = await fetch("http://localhost:11434/api/tags", { signal: AbortSignal.timeout(3000) });
+        if (check.ok) {
+          return json({ success: true, message: "Ollama installed and running" });
+        }
+      } catch { /* may still be starting */ }
+
+      return json({ success: true, message: "Ollama installed. It may take a moment to start." });
+    } catch (err: any) {
+      return json({ success: false, error: `Installation failed: ${err.message}` }, 500);
+    }
+  }
+
+  // POST /api/providers/ollama/pull - Pull a model
+  if (path === "/api/providers/ollama/pull" && method === "POST") {
+    const body = await req.json() as { model?: string };
+    const model = body.model;
+    if (!model) {
+      return json({ error: "Model name required" }, 400);
+    }
+
+    try {
+      const ollamaUrl = ProviderKeys.getDecrypted("ollama") || "http://localhost:11434";
+      const response = await fetch(`${ollamaUrl}/api/pull`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name: model }),
+      });
+
+      if (!response.ok) {
+        return json({ success: false, error: "Failed to start model pull" }, 500);
+      }
+
+      return json({ success: true, message: `Pulling ${model}...` });
+    } catch (err: any) {
+      return json({ success: false, error: `Failed to pull model: ${err.message}` }, 500);
     }
   }
 
@@ -216,38 +312,33 @@ export async function handleProviderRoutes(
         a => a.status === "running" && a.provider === providerId
       );
 
-      const restartResults: Array<{ id: string; name: string; success: boolean; error?: string }> = [];
+      // Stop all agents first
       for (const agent of runningAgents) {
-        try {
-          // Stop the agent
-          const agentProc = agentProcesses.get(agent.id);
-          if (agentProc) {
-            agentProc.proc.kill();
-            agentProcesses.delete(agent.id);
-          }
-          setAgentStatus(agent.id, "stopped", "provider_restart");
-
-          // Wait a moment for port to be released
-          await new Promise(r => setTimeout(r, 500));
-
-          // Restart the agent with new key
-          const startResult = await startAgentProcess(agent, { silent: true });
-          restartResults.push({
-            id: agent.id,
-            name: agent.name,
-            success: startResult.success,
-            error: startResult.error,
-          });
-        } catch (e) {
-          restartResults.push({
-            id: agent.id,
-            name: agent.name,
-            success: false,
-            error: String(e),
-          });
+        const agentProc = agentProcesses.get(agent.id);
+        if (agentProc) {
+          agentProc.proc.kill();
+          agentProcesses.delete(agent.id);
         }
+        setAgentStatus(agent.id, "stopped", "provider_restart");
       }
 
+      // Wait once for ports to be released
+      if (runningAgents.length > 0) {
+        await new Promise(r => setTimeout(r, 500));
+      }
+
+      // Restart all agents in parallel
+      const restartResults = await Promise.all(
+        runningAgents.map(async (agent) => {
+          try {
+            const startResult = await startAgentProcess(agent, { silent: true });
+            return { id: agent.id, name: agent.name, success: startResult.success, error: startResult.error };
+          } catch (e) {
+            return { id: agent.id, name: agent.name, success: false, error: String(e) };
+          }
+        })
+      );
+
       return json({
         success: true,
         message: "API key saved successfully",

package/src/routes/api/skills.ts

@@ -499,13 +499,12 @@ export async function handleSkillRoutes(
       const agentsWithSkill = AgentDB.findBySkill(skillMatch[1]);
       const runningAgents = agentsWithSkill.filter(a => a.status === "running" && a.port);
 
-      for (const agent of runningAgents) {
+      await Promise.allSettled(runningAgents.map(async (agent) => {
         try {
           const providerKey = ProviderKeys.getDecrypted(agent.provider);
           if (providerKey) {
             const config = buildAgentConfig(agent, providerKey);
             await pushConfigToAgent(agent.id, agent.port!, config);
-            // Push skills via /skills endpoint
             if (config.skills?.definitions?.length > 0) {
               await pushSkillsToAgent(agent.id, agent.port!, config.skills.definitions);
             }
@@ -514,7 +513,7 @@ export async function handleSkillRoutes(
         } catch (err) {
           console.error(`Failed to push skill update to agent ${agent.name}:`, err);
         }
-      }
+      }));
 
       return json({ skill: updated, agents_updated: runningAgents.length });
     } catch (err) {

package/src/routes/api/system.ts

@@ -1,5 +1,5 @@
 import { json } from "./helpers";
-import { META_AGENT_ENABLED, fetchFromAgent, startAgentProcess, setAgentStatus } from "./agent-utils";
+import { META_AGENT_ENABLED, fetchFromAgent, agentFetch, startAgentProcess, setAgentStatus } from "./agent-utils";
 import { AgentDB } from "../../db";
 import { ProviderKeys } from "../../providers";
 import { agentProcesses, getBinaryStatus, BIN_DIR } from "../../server";
@@ -44,6 +44,7 @@ export async function handleSystemRoutes(
     return json({
       projects: process.env.PROJECTS_ENABLED === "true",
       metaAgent: process.env.META_AGENT_ENABLED === "true",
+      costTracking: process.env.COST_TRACKING_ENABLED !== "false",
     });
   }
 
@@ -99,21 +100,16 @@ export async function handleSystemRoutes(
       return json({ success: false, error: result.error }, 500);
     }
 
-    // Restart agents that were running
-    const restartResults: { id: string; name: string; success: boolean; error?: string }[] = [];
-    for (const agentId of agentsToRestart) {
-      const agent = AgentDB.findById(agentId);
-      if (agent) {
+    // Restart agents that were running - in parallel
+    const restartResults = await Promise.all(
+      agentsToRestart.map(async (agentId) => {
+        const agent = AgentDB.findById(agentId);
+        if (!agent) return null;
         console.log(`Restarting agent ${agent.name} after update...`);
         const startResult = await startAgentProcess(agent);
-        restartResults.push({
-          id: agent.id,
-          name: agent.name,
-          success: startResult.success,
-          error: startResult.error,
-        });
-      }
-    }
+        return { id: agent.id, name: agent.name, success: startResult.success, error: startResult.error };
+      })
+    ).then(r => r.filter(Boolean));
 
     return json({
       success: true,
@@ -185,6 +181,94 @@ export async function handleSystemRoutes(
     return json({ task: { ...data, agentId: agent.id, agentName: agent.name } });
   }
 
+  // POST /api/tasks/:agentId/:taskId/execute - Execute a task immediately
+  const executeTaskMatch = path.match(/^\/api\/tasks\/([^/]+)\/([^/]+)\/execute$/);
+  if (executeTaskMatch && method === "POST") {
+    const [, agentId, taskId] = executeTaskMatch;
+    const agent = AgentDB.findById(agentId);
+    if (!agent) return json({ error: "Agent not found" }, 404);
+    if (agent.status !== "running" || !agent.port) return json({ error: "Agent is not running" }, 400);
+
+    try {
+      const res = await agentFetch(agentId, agent.port, `/tasks/${taskId}/execute`, {
+        method: "POST",
+        signal: AbortSignal.timeout(5000),
+      });
+      const data = await res.json();
+      if (!res.ok) return json({ error: data.error || `HTTP ${res.status}` }, res.status);
+      return json(data);
+    } catch (err) {
+      return json({ error: `Failed to execute task: ${err}` }, 500);
+    }
+  }
+
+  // POST /api/tasks/:agentId - Create a task on an agent
+  const createTaskMatch = path.match(/^\/api\/tasks\/([^/]+)$/);
+  if (createTaskMatch && method === "POST") {
+    const agentId = createTaskMatch[1];
+    const agent = AgentDB.findById(agentId);
+    if (!agent) return json({ error: "Agent not found" }, 404);
+    if (agent.status !== "running" || !agent.port) return json({ error: "Agent is not running" }, 400);
+
+    try {
+      const body = await req.json();
+      const res = await agentFetch(agentId, agent.port, "/tasks", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(5000),
+      });
+      const data = await res.json();
+      if (!res.ok) return json({ error: data.error || `HTTP ${res.status}` }, res.status);
+      return json(data, 201);
+    } catch (err) {
+      return json({ error: `Failed to create task: ${err}` }, 500);
+    }
+  }
+
+  // PUT /api/tasks/:agentId/:taskId - Update a task on an agent
+  if (singleTaskMatch && method === "PUT") {
+    const [, agentId, taskId] = singleTaskMatch;
+    const agent = AgentDB.findById(agentId);
+    if (!agent) return json({ error: "Agent not found" }, 404);
+    if (agent.status !== "running" || !agent.port) return json({ error: "Agent is not running" }, 400);
+
+    try {
+      const body = await req.json();
+      const res = await agentFetch(agentId, agent.port, `/tasks/${taskId}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(5000),
+      });
+      const data = await res.json();
+      if (!res.ok) return json({ error: data.error || `HTTP ${res.status}` }, res.status);
+      return json(data);
+    } catch (err) {
+      return json({ error: `Failed to update task: ${err}` }, 500);
+    }
+  }
+
+  // DELETE /api/tasks/:agentId/:taskId - Delete a task on an agent
+  if (singleTaskMatch && method === "DELETE") {
+    const [, agentId, taskId] = singleTaskMatch;
+    const agent = AgentDB.findById(agentId);
+    if (!agent) return json({ error: "Agent not found" }, 404);
+    if (agent.status !== "running" || !agent.port) return json({ error: "Agent is not running" }, 400);
+
+    try {
+      const res = await agentFetch(agentId, agent.port, `/tasks/${taskId}`, {
+        method: "DELETE",
+        signal: AbortSignal.timeout(5000),
+      });
+      const data = await res.json();
+      if (!res.ok) return json({ error: data.error || `HTTP ${res.status}` }, res.status);
+      return json(data);
+    } catch (err) {
+      return json({ error: `Failed to delete task: ${err}` }, 500);
+    }
+  }
+
   // GET /api/dashboard - Get dashboard statistics
   if (path === "/api/dashboard" && method === "GET") {
     const url = new URL(req.url);

package/src/routes/api/telemetry.ts

@@ -1,5 +1,6 @@
 import { json } from "./helpers";
-import { TelemetryDB } from "../../db";
+import { TelemetryDB, AgentDB } from "../../db";
+import { getModelCost } from "../../providers";
 import { telemetryBroadcaster, type TelemetryEvent } from "../../server";
 
 export async function handleTelemetryRoutes(
@@ -35,6 +36,23 @@ export async function handleTelemetryRoutes(
 
       // Filter out debug events - too noisy
       const filteredEvents = body.events.filter(e => e.level !== "debug");
+
+      // Compute cost per LLM event if cost tracking is enabled
+      const costTrackingEnabled = process.env.COST_TRACKING_ENABLED !== "false";
+      if (costTrackingEnabled) {
+        const agent = AgentDB.findById(body.agent_id);
+        if (agent) {
+          const pricing = getModelCost(agent.provider, agent.model);
+          for (const event of filteredEvents) {
+            if (event.category === "LLM" && event.data) {
+              const inputTokens = (event.data.input_tokens as number) || 0;
+              const outputTokens = (event.data.output_tokens as number) || 0;
+              (event as any).cost = (inputTokens * pricing.input_cost + outputTokens * pricing.output_cost) / 1_000_000;
+            }
+          }
+        }
+      }
+
       const inserted = TelemetryDB.insertBatch(body.agent_id, filteredEvents);
 
       // Broadcast to SSE clients

package/src/routes/share.ts

@@ -0,0 +1,85 @@
+import { createHash } from "crypto";
+import { AgentDB, type Agent } from "../db";
+import { agentFetch } from "./api/agent-utils";
+
+function deriveShareToken(apiKey: string, agentId: string): string {
+  return createHash("sha256")
+    .update(apiKey + ":" + agentId + ":share")
+    .digest("hex")
+    .substring(0, 32);
+}
+
+function findAgentByShareToken(token: string): Agent | null {
+  const agents = AgentDB.findAll();
+  for (const agent of agents) {
+    const apiKey = AgentDB.getApiKey(agent.id);
+    if (!apiKey) continue;
+    if (deriveShareToken(apiKey, agent.id) === token) return agent;
+  }
+  return null;
+}
+
+/** Get the share token for an agent (used by API route for the UI) */
+export function getShareToken(agentId: string): string | null {
+  const apiKey = AgentDB.getApiKey(agentId);
+  if (!apiKey) return null;
+  return deriveShareToken(apiKey, agentId);
+}
+
+export async function handleShareRequest(req: Request, path: string): Promise<Response | null> {
+  // Match /share/<32 hex chars> sub-paths for API calls
+  const infoMatch = path.match(/^\/share\/([a-f0-9]{32})\/info$/);
+  const chatMatch = path.match(/^\/share\/([a-f0-9]{32})\/chat$/);
+
+  if (!infoMatch && !chatMatch) return null;
+
+  const token = (infoMatch || chatMatch)![1];
+  const agent = findAgentByShareToken(token);
+
+  // Intentionally vague 404 — don't reveal whether token exists
+  if (!agent) {
+    return new Response("Not found", { status: 404 });
+  }
+
+  // GET /share/:token/info — agent info (no secrets)
+  if (infoMatch && req.method === "GET") {
+    return Response.json({
+      name: agent.name,
+      status: agent.status,
+    });
+  }
+
+  // POST /share/:token/chat — proxy to agent
+  if (chatMatch && req.method === "POST") {
+    if (agent.status !== "running" || !agent.port) {
+      return Response.json({ error: "Agent is currently offline" }, { status: 503 });
+    }
+
+    try {
+      const body = await req.json();
+      const response = await agentFetch(agent.id, agent.port, "/chat", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+
+      if (!response.ok) {
+        const errorText = await response.text();
+        return Response.json({ error: `Agent error: ${errorText}` }, { status: response.status });
+      }
+
+      return new Response(response.body, {
+        status: 200,
+        headers: {
+          "Content-Type": response.headers.get("Content-Type") || "text/event-stream",
+          "Cache-Control": "no-cache",
+          "Connection": "keep-alive",
+        },
+      });
+    } catch (err) {
+      return Response.json({ error: "Failed to connect to agent" }, { status: 500 });
+    }
+  }
+
+  return null;
+}