conductor-oss 0.2.20 → 0.3.1

package/web/.next/standalone/packages/web/src/app/api/repositories/route.ts

@@ -1,419 +1,7 @@
-import { type NextRequest, NextResponse } from "next/server";
-import { readFile, writeFile } from "node:fs/promises";
-import { existsSync, readdirSync } from "node:fs";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { basename, dirname, extname, join, resolve } from "node:path";
-import { homedir } from "node:os";
-import { parse, stringify } from "yaml";
-import { normalizeProjectConfigMap, syncWorkspaceSupportFiles } from "@conductor-oss/core";
-import { getServices, invalidateServicesCache } from "@/lib/services";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
-import { normalizeRootProjectPaths, syncProjectLocalConfig } from "@/lib/projectConfigSync";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-const execFileAsync = promisify(execFile);
-
-type MutableConfig = Record<string, unknown>;
-type MutableProject = Record<string, unknown>;
-
-type RepositoryPatchBody = {
-  id?: unknown;
-  displayName?: unknown;
-  repo?: unknown;
-  path?: unknown;
-  agent?: unknown;
-  agentModel?: unknown;
-  agentReasoningEffort?: unknown;
-  defaultWorkingDirectory?: unknown;
-  defaultBranch?: unknown;
-  devServerScript?: unknown;
-  setupScript?: unknown;
-  runSetupInParallel?: unknown;
-  cleanupScript?: unknown;
-  archiveScript?: unknown;
-  copyFiles?: unknown;
-};
-
-function asNonEmptyString(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-
-function toObject(value: unknown): Record<string, unknown> {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return { ...(value as Record<string, unknown>) };
-}
-
-function toProjectMap(value: unknown): Record<string, unknown> {
-  return normalizeProjectConfigMap(value);
-}
-
-function expandHome(value: string): string {
-  if (value.startsWith("~/")) {
-    return resolve(homedir(), value.slice(2));
-  }
-  return resolve(value);
-}
-
-function normalizeScriptArray(value: unknown): string[] {
-  if (Array.isArray(value)) {
-    return value
-      .map((entry) => (typeof entry === "string" ? entry.trim() : ""))
-      .filter((entry) => entry.length > 0);
-  }
-  if (typeof value === "string") {
-    return value
-      .split("\n")
-      .map((line) => line.trim())
-      .filter((line) => line.length > 0);
-  }
-  return [];
-}
-
-function scriptArrayToText(value: unknown): string {
-  return normalizeScriptArray(value).join("\n");
-}
-
-function normalizeCopyFiles(value: unknown): string[] {
-  if (Array.isArray(value)) {
-    return value
-      .map((entry) => (typeof entry === "string" ? entry.trim() : ""))
-      .filter((entry) => entry.length > 0);
-  }
-  if (typeof value === "string") {
-    return value
-      .split(",")
-      .map((entry) => entry.trim())
-      .filter((entry) => entry.length > 0);
-  }
-  return [];
-}
-
-function copyFilesToText(value: unknown): string {
-  return normalizeCopyFiles(value).join(", ");
-}
-
-function normalizeWorkingDirectory(value: string | null): string | null {
-  if (!value) return null;
-  const normalized = value
-    .replace(/\\/g, "/")
-    .replace(/^\.?\//, "")
-    .replace(/\/+/g, "/")
-    .replace(/\/+$/g, "")
-    .trim();
-
-  if (!normalized || normalized === ".") return null;
-  if (normalized.startsWith("/") || normalized.includes("..")) {
-    throw new Error("defaultWorkingDirectory must be a relative path inside the repository");
-  }
-  return normalized;
-}
-
-function extractRepoName(repoValue?: string | null): string | null {
-  if (!repoValue || repoValue.trim().length === 0) return null;
-  const raw = repoValue.trim();
-  const sshMatch = raw.match(/^git@[^:]+:(.+)$/);
-  const candidate = sshMatch ? sshMatch[1] : raw;
-
-  try {
-    const url = new URL(candidate);
-    const parts = url.pathname
-      .replace(/^\/+/, "")
-      .replace(/\.git$/i, "")
-      .split("/")
-      .filter(Boolean);
-    return parts[parts.length - 1] ?? null;
-  } catch {
-    const parts = candidate
-      .replace(/\.git$/i, "")
-      .split(/[/:]/)
-      .filter(Boolean);
-    return parts[parts.length - 1] ?? null;
-  }
-}
-
-async function isGitRepository(path: string): Promise<boolean> {
-  if (!existsSync(path)) return false;
-  try {
-    await execFileAsync("git", ["-C", path, "rev-parse", "--is-inside-work-tree"], { timeout: 20_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function uniqueCandidates(candidates: string[]): string[] {
-  const seen = new Set<string>();
-  const ordered: string[] = [];
-  for (const candidate of candidates) {
-    const resolved = resolve(candidate);
-    if (seen.has(resolved)) continue;
-    seen.add(resolved);
-    ordered.push(resolved);
-  }
-  return ordered;
-}
-
-async function maybeResolveCaseInsensitive(path: string): Promise<string | null> {
-  const parent = dirname(path);
-  const target = basename(path).toLowerCase();
-  if (!existsSync(parent)) return null;
-
-  try {
-    const entries = readdirSync(parent, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory())
-      .map((entry) => join(parent, entry.name));
-
-    for (const entry of entries) {
-      if (basename(entry).toLowerCase() !== target) continue;
-      if (await isGitRepository(entry)) return entry;
-    }
-  } catch {
-    // Best effort only.
-  }
-
-  return null;
-}
-
-async function suggestRepoPath(projectPath: string, repoValue?: string | null): Promise<string | null> {
-  const expandedProjectPath = expandHome(projectPath);
-  if (await isGitRepository(expandedProjectPath)) return expandedProjectPath;
-
-  const projectPathExt = extname(expandedProjectPath).toLowerCase();
-  const repoName = extractRepoName(repoValue);
-
-  const candidates = uniqueCandidates([
-    expandedProjectPath,
-    ...(projectPathExt ? [dirname(expandedProjectPath)] : []),
-    ...(repoName ? [join(dirname(expandedProjectPath), repoName)] : []),
-    ...(repoName ? [join(homedir(), ".openclaw", "projects", repoName)] : []),
-    ...(repoName ? [join(homedir(), ".conductor", "projects", repoName)] : []),
-    expandedProjectPath.replace("/workspace/projects/", "/projects/"),
-    ...(repoName ? [join(homedir(), ".openclaw", "projects", repoName.toLowerCase())] : []),
-  ]);
-
-  for (const candidate of candidates) {
-    if (await isGitRepository(candidate)) return candidate;
-    const caseInsensitive = await maybeResolveCaseInsensitive(candidate);
-    if (caseInsensitive) return caseInsensitive;
-  }
-
-  return null;
-}
-
-async function serializeRepository(projectId: string, project: Record<string, unknown>) {
-  const path = asNonEmptyString(project["path"]) ?? "";
-  const repo = asNonEmptyString(project["repo"]) ?? "";
-  const agentConfig = toObject(project["agentConfig"]);
-  const expandedPath = path ? expandHome(path) : "";
-  const pathExists = expandedPath ? existsSync(expandedPath) : false;
-  const gitRepository = expandedPath ? await isGitRepository(expandedPath) : false;
-  const suggestedPath = path
-    ? await suggestRepoPath(path, repo || null)
-    : null;
-
-  return {
-    id: projectId,
-    displayName: asNonEmptyString(project["name"]) ?? projectId,
-    repo,
-    path,
-    agent: asNonEmptyString(project["agent"]) ?? "claude-code",
-    agentModel: asNonEmptyString(agentConfig["model"]) ?? "",
-    agentReasoningEffort: asNonEmptyString(agentConfig["reasoningEffort"]) ?? "",
-    workspaceMode: asNonEmptyString(project["workspace"]) ?? "worktree",
-    runtimeMode: asNonEmptyString(project["runtime"]) ?? "tmux",
-    scmMode: asNonEmptyString(project["scm"]) ?? "github",
-    defaultWorkingDirectory: asNonEmptyString(project["defaultWorkingDirectory"]) ?? "",
-    defaultBranch: asNonEmptyString(project["defaultBranch"]) ?? "main",
-    devServerScript: asNonEmptyString(toObject(project["devServer"])["command"]) ?? "",
-    setupScript: scriptArrayToText(project["setupScript"] ?? project["postCreate"]),
-    runSetupInParallel: project["runSetupInParallel"] === true,
-    cleanupScript: scriptArrayToText(project["cleanupScript"]),
-    archiveScript: scriptArrayToText(project["archiveScript"]),
-    copyFiles: copyFilesToText(project["copyFiles"]),
-    pathHealth: {
-      exists: pathExists,
-      isGitRepository: gitRepository,
-      suggestedPath: suggestedPath && suggestedPath !== expandedPath ? suggestedPath : null,
-    },
-  };
-}
-
-export async function GET() {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  try {
-    const { config } = await getServices();
-    const repositories = await Promise.all(
-      Object.entries(config.projects).map(async ([id, project]) => {
-        return serializeRepository(id, project as unknown as Record<string, unknown>);
-      }),
-    );
-
-    repositories.sort((left, right) => left.displayName.localeCompare(right.displayName));
-
-    return NextResponse.json({ repositories });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load repositories";
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
-
-export async function PUT(request: NextRequest) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const body = (await request.json().catch(() => null)) as RepositoryPatchBody | null;
-  if (!body || typeof body !== "object") {
-    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
-  }
-
-  const id = asNonEmptyString(body.id);
-  if (!id) {
-    return NextResponse.json({ error: "id is required" }, { status: 400 });
-  }
-
-  try {
-    const { config } = await getServices();
-    const configPath = config.configPath;
-    if (!configPath) {
-      return NextResponse.json({ error: "Unable to resolve conductor config path" }, { status: 500 });
-    }
-
-    const originalConfigRaw = await readFile(configPath, "utf8");
-    const parsed = (parse(originalConfigRaw) ?? {}) as MutableConfig;
-    const nextRoot: MutableConfig =
-      parsed && typeof parsed === "object" && !Array.isArray(parsed)
-        ? { ...parsed }
-        : {};
-
-    const nextProjects = toProjectMap(nextRoot["projects"]);
-    if (!(id in nextProjects)) {
-      return NextResponse.json({ error: `Unknown repository id: ${id}` }, { status: 404 });
-    }
-
-    const existingProject = toObject(nextProjects[id]);
-    const nextProject: MutableProject = { ...existingProject };
-
-    const displayName = asNonEmptyString(body.displayName) ?? id;
-    const repo = asNonEmptyString(body.repo);
-    const path = asNonEmptyString(body.path);
-    const agent = asNonEmptyString(body.agent) ?? asNonEmptyString(existingProject["agent"]) ?? "claude-code";
-    const agentModel = asNonEmptyString(body.agentModel);
-    const agentReasoningEffort = asNonEmptyString(body.agentReasoningEffort);
-    const defaultBranch = asNonEmptyString(body.defaultBranch) ?? "main";
-    const defaultWorkingDirectory = normalizeWorkingDirectory(asNonEmptyString(body.defaultWorkingDirectory));
-
-    if (!repo) {
-      return NextResponse.json({ error: "repo is required" }, { status: 400 });
-    }
-    if (!path) {
-      return NextResponse.json({ error: "path is required" }, { status: 400 });
-    }
-
-    nextProject["name"] = displayName;
-    nextProject["repo"] = repo;
-    nextProject["path"] = expandHome(path);
-    nextProject["agent"] = agent;
-    nextProject["defaultBranch"] = defaultBranch;
-    const nextAgentConfig = toObject(nextProject["agentConfig"]);
-    const updatedAgentConfig = { ...nextAgentConfig };
-    if (agentModel) {
-      updatedAgentConfig.model = agentModel;
-    } else {
-      delete updatedAgentConfig.model;
-    }
-    if (agentReasoningEffort) {
-      updatedAgentConfig.reasoningEffort = agentReasoningEffort;
-    } else {
-      delete updatedAgentConfig.reasoningEffort;
-    }
-    if (Object.keys(updatedAgentConfig).length > 0) {
-      nextProject["agentConfig"] = updatedAgentConfig;
-    } else {
-      delete nextProject["agentConfig"];
-    }
-
-    if (defaultWorkingDirectory) {
-      nextProject["defaultWorkingDirectory"] = defaultWorkingDirectory;
-    } else {
-      delete nextProject["defaultWorkingDirectory"];
-    }
-
-    const devServerScript = asNonEmptyString(body.devServerScript);
-    if (devServerScript) {
-      const nextDevServer = toObject(nextProject["devServer"]);
-      nextProject["devServer"] = {
-        ...nextDevServer,
-        command: devServerScript,
-      };
-    } else {
-      delete nextProject["devServer"];
-    }
-
-    const setupCommands = normalizeScriptArray(body.setupScript);
-    if (setupCommands.length > 0) {
-      nextProject["setupScript"] = setupCommands;
-      // Keep legacy key in sync for backward compatibility.
-      nextProject["postCreate"] = setupCommands;
-    } else {
-      delete nextProject["setupScript"];
-      delete nextProject["postCreate"];
-    }
-
-    nextProject["runSetupInParallel"] = body.runSetupInParallel === true;
-
-    const cleanupCommands = normalizeScriptArray(body.cleanupScript);
-    if (cleanupCommands.length > 0) {
-      nextProject["cleanupScript"] = cleanupCommands;
-    } else {
-      delete nextProject["cleanupScript"];
-    }
-
-    const archiveCommands = normalizeScriptArray(body.archiveScript);
-    if (archiveCommands.length > 0) {
-      nextProject["archiveScript"] = archiveCommands;
-    } else {
-      delete nextProject["archiveScript"];
-    }
-
-    const copyFiles = normalizeCopyFiles(body.copyFiles);
-    if (copyFiles.length > 0) {
-      nextProject["copyFiles"] = copyFiles;
-    } else {
-      delete nextProject["copyFiles"];
-    }
-
-    nextProjects[id] = nextProject;
-    nextRoot["projects"] = nextProjects;
-    await normalizeRootProjectPaths(nextRoot);
-
-    const updatedYaml = stringify(nextRoot, { lineWidth: 0 });
-    await writeFile(configPath, updatedYaml, "utf8");
-
-    try {
-      invalidateServicesCache("repository settings updated");
-      const { config: refreshedConfig, registry } = await getServices();
-      await syncProjectLocalConfig(refreshedConfig as unknown as Record<string, unknown>, id);
-      syncWorkspaceSupportFiles(refreshedConfig, {
-        agentNames: registry.list("agent").map((agent) => agent.name),
-      });
-    } catch (err) {
-      await writeFile(configPath, originalConfigRaw, "utf8");
-      invalidateServicesCache("repository settings update rollback");
-      throw err;
-    }
-
-    const saved = await serializeRepository(id, nextProject);
-    return NextResponse.json({ repository: saved });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update repository";
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
+export const GET = guardedProxyRoute("/api/repositories", { role: "viewer" });
+export const DELETE = guardedProxyRoute("/api/repositories", { role: "operator", requireActionGuard: true });
+export const PUT = guardedProxyRoute("/api/repositories", { role: "operator", requireActionGuard: true });

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/actions/route.ts

@@ -1,80 +1,8 @@
-import { type NextRequest, NextResponse } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-/**
- * POST /api/sessions/[id]/actions -- one-tap session actions for mobile UX.
- *
- * Body: { action: "retry" | "kill" | "send", message?: string }
- *
- * Consolidates multiple endpoints into a single mobile-friendly action router.
- */
-export async function POST(
-  request: NextRequest,
-  { params }: { params: Promise<{ id: string }> },
-): Promise<NextResponse> {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-
-  const { id } = await params;
-
-  try {
-    const body = (await request.json()) as { action?: string; message?: string };
-    const action = body.action;
-
-    if (!action) {
-      return NextResponse.json({ error: "Missing 'action' field" }, { status: 400 });
-    }
-
-    const { sessionManager } = await getServices();
-
-    switch (action) {
-      case "retry":
-      case "restore": {
-        const session = await sessionManager.restore(id);
-        return NextResponse.json({
-          ok: true,
-          action: "restore",
-          sessionId: id,
-          status: session?.status ?? "restored",
-        });
-      }
-
-      case "kill":
-      case "terminate": {
-        await sessionManager.kill(id);
-        return NextResponse.json({
-          ok: true,
-          action: "kill",
-          sessionId: id,
-        });
-      }
-
-      case "send": {
-        const message = body.message;
-        if (!message) {
-          return NextResponse.json({ error: "Missing 'message' for send action" }, { status: 400 });
-        }
-        await sessionManager.send(id, message);
-        return NextResponse.json({
-          ok: true,
-          action: "send",
-          sessionId: id,
-        });
-      }
-
-      default:
-        return NextResponse.json(
-          { error: `Unknown action: ${action}. Valid: retry, kill, send` },
-          { status: 400 },
-        );
-    }
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Action failed" },
-      { status: 500 },
-    );
-  }
-}
+export const POST = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/actions`,
+  { role: "operator", requireActionGuard: true },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/archive/route.ts

@@ -0,0 +1,8 @@
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const POST = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/archive`,
+  { role: "operator", requireActionGuard: true },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/checks/route.ts

@@ -1,175 +1,8 @@
-import type { NextRequest } from "next/server";
-import { NextResponse } from "next/server";
-import type { CIStatus, PRInfo, SCM, CICheck } from "@conductor-oss/core/types";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-interface SessionChecksResponse {
-  sessionId: string;
-  source: string;
-  ciStatus: CIStatus;
-  checks: Array<{
-    name: string;
-    status: "pending" | "running" | "passed" | "failed" | "skipped";
-    url?: string;
-  }>;
-  generatedAt: string;
-}
-
-function getPrDetails(
-  session: {
-    pr?: {
-      number: number;
-      url: string;
-      title?: string | null;
-      owner?: string;
-      repo?: string;
-      branch?: string | null;
-      baseBranch?: string;
-      isDraft?: boolean;
-    } | null;
-    branch?: string | null;
-  },
-  fallbackRepo?: string,
-): PRInfo | null {
-  const parseRepoString = (value: string | undefined | null): { owner?: string; repo?: string } => {
-    if (!value) return {};
-    const trimmed = value.replace(/^https?:\/\/github\.com\//, "").split("/").filter(Boolean);
-    if (trimmed.length < 2) return {};
-    return { owner: trimmed[0], repo: trimmed[1] };
-  };
-
-  const parsePrNumber = (value: string | undefined | null): number | null => {
-    if (!value) return null;
-    const match = /\/pull\/(\d+)/.exec(value);
-    if (!match?.[1]) return null;
-    const parsed = Number.parseInt(match[1], 10);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
-  };
-
-  if (!session.pr) return null;
-
-  let owner = session.pr.owner;
-  let repo = session.pr.repo;
-  const parsedNumber = parsePrNumber(session.pr.url);
-  const number = Number.isFinite(session.pr.number) ? session.pr.number : parsedNumber;
-  if (number == null) {
-    return null;
-  }
-
-  if ((!owner || !repo) && session.pr.url) {
-    const parsedFromUrl = parseRepoString(session.pr.url);
-    owner = owner ?? parsedFromUrl.owner;
-    repo = repo ?? parsedFromUrl.repo;
-  }
-
-  if ((!owner || !repo) && fallbackRepo) {
-    const parsedFromConfig = parseRepoString(fallbackRepo);
-    owner = owner ?? parsedFromConfig.owner;
-    repo = repo ?? parsedFromConfig.repo;
-  }
-
-  if (!owner || !repo) return null;
-
-  return {
-    number,
-    url: session.pr.url || `https://github.com/${owner}/${repo}/pull/${number}`,
-    title: session.pr.title ?? "",
-    owner,
-    repo,
-    branch: session.pr.branch ?? session.branch ?? "",
-    baseBranch: session.pr.baseBranch ?? "",
-    isDraft: session.pr.isDraft ?? false,
-  };
-}
-
-function getCheckSortValue(
-  status: "pending" | "running" | "passed" | "failed" | "skipped",
-): number {
-  if (status === "failed") return 0;
-  if (status === "pending" || status === "running") return 1;
-  if (status === "skipped") return 2;
-  return 3;
-}
-
-export async function GET(
-  _request: NextRequest,
-  context: { params: Promise<{ id: string }> },
-) {
-  const denied = await guardApiAccess(undefined, "viewer");
-  const { id } = await context.params;
-  if (denied) return denied;
-
-  const sessionId = decodeURIComponent(id ?? "").trim();
-  if (!sessionId) {
-    return NextResponse.json({ error: "Session id is required" }, { status: 400 });
-  }
-
-  try {
-    const { sessionManager, registry, config } = await getServices();
-    const session = await sessionManager.get(sessionId);
-    if (!session) {
-      return NextResponse.json({ error: `Session ${sessionId} not found` }, { status: 404 });
-    }
-
-    const project = config.projects[session.projectId];
-    const pr = getPrDetails(session, project?.repo);
-    if (!pr) {
-      return NextResponse.json(
-        { error: "Session does not currently expose a PR URL to evaluate checks" },
-        { status: 404 },
-      );
-    }
-
-    const scmPluginName = project?.scm?.plugin ?? "github";
-    const scmPlugin = registry.get<SCM>("scm", scmPluginName);
-    if (!scmPlugin) {
-      return NextResponse.json(
-        { error: `SCM plugin '${scmPluginName}' is not configured` },
-        { status: 500 },
-      );
-    }
-
-    const ciStatus = await scmPlugin.getCISummary(pr).catch((): CIStatus => "pending" as CIStatus);
-
-    let checks: Array<CICheck> = [];
-    try {
-      checks = await scmPlugin.getCIChecks(pr);
-    } catch (err) {
-      console.error("Failed to load CI checks", {
-        sessionId,
-        prNumber: pr.number,
-        error: err instanceof Error ? err.message : `${err}`,
-      });
-    }
-
-    const sorted = [...checks].sort((left, right) => {
-      const leftScore = getCheckSortValue(left.status);
-      const rightScore = getCheckSortValue(right.status);
-      if (leftScore !== rightScore) return leftScore - rightScore;
-      return left.name.localeCompare(right.name);
-    });
-
-    const payload: SessionChecksResponse = {
-      sessionId,
-      source: `${scmPluginName}:${scmPlugin.name}`,
-      ciStatus,
-      checks: sorted.map((check) => ({
-        name: check.name,
-        status: check.status,
-        url: check.url,
-      })),
-      generatedAt: new Date().toISOString(),
-    };
-
-    return NextResponse.json(payload);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load CI checks";
-    return NextResponse.json(
-      { error: message },
-      { status: 500 },
-    );
-  }
-}
+export const GET = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/checks`,
+  { role: "viewer" },
+);