daemora 1.0.0-alpha.0

package/dist/server/routes/sessions.js

@@ -0,0 +1,172 @@
+/**
+ * /api/sessions — chat session CRUD.
+ *
+ * - GET    /api/sessions          list, most-recently-updated first
+ * - GET    /api/sessions/:id      full history (oldest-first)
+ * - PATCH  /api/sessions/:id      rename
+ * - DELETE /api/sessions/:id      hard delete (cascades messages)
+ */
+import { existsSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, resolve as pathResolve, sep as pathSep } from "node:path";
+import { z } from "zod";
+import { NotFoundError, ValidationError } from "../../util/errors.js";
+const idParam = z.object({ id: z.string().min(1).max(200) });
+/**
+ * AI SDK stores assistant content as `string | ContentPart[]`.
+ * The UI expects plain strings. Normalize here so the UI never
+ * has to deal with SDK internals.
+ */
+function normalizeContent(content) {
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content)) {
+        // Extract only text parts — tool-call and tool-result are internal
+        return content
+            .map((part) => {
+            if (typeof part === "string")
+                return part;
+            const p = part;
+            if (p.type === "text" && typeof p.text === "string")
+                return p.text;
+            // Skip tool-call, tool-result — they're internal, not for display
+            return "";
+        })
+            .filter(Boolean)
+            .join("\n");
+    }
+    return String(content ?? "");
+}
+/** Check if a message is purely tool-internal (no user-visible text). */
+function isToolOnlyMessage(msg) {
+    if (msg.role === "tool")
+        return true;
+    if (!Array.isArray(msg.content))
+        return false;
+    // If ALL parts are tool-call or tool-result, hide the message
+    return msg.content.every((p) => p.type === "tool-call" || p.type === "tool-result");
+}
+const renameBody = z.object({ title: z.string().min(1).max(200) });
+/** Parse :id out of req.params — keeps exactOptionalPropertyTypes happy. */
+function readId(req) {
+    const parsed = idParam.safeParse(req.params);
+    if (!parsed.success)
+        throw new ValidationError("Invalid session id");
+    return parsed.data.id;
+}
+const createBody = z.object({
+    sessionId: z.string().min(1).max(200).optional(),
+    title: z.string().min(1).max(200).optional(),
+});
+export function mountSessionRoutes(app, deps) {
+    app.get("/api/sessions", (_req, res) => {
+        res.json({ sessions: deps.sessions.listSessions() });
+    });
+    /** Create or ensure a session exists. UI calls this with { sessionId: "main" }. */
+    app.post("/api/sessions", (req, res) => {
+        const body = createBody.safeParse(req.body);
+        if (!body.success)
+            throw new ValidationError(body.error.message);
+        const id = body.data.sessionId;
+        if (id) {
+            const existing = deps.sessions.getSession(id);
+            if (existing) {
+                res.json({ session: existing, created: false });
+                return;
+            }
+            const session = deps.sessions.createSessionWithId(id, { title: body.data.title ?? "Chat" });
+            res.json({ session, created: true });
+        }
+        else {
+            const session = deps.sessions.createSession({ title: body.data.title ?? "New chat" });
+            res.json({ session, created: true });
+        }
+    });
+    app.get("/api/sessions/:id", (req, res) => {
+        const id = readId(req);
+        const session = deps.sessions.getSession(id);
+        if (!session)
+            throw new NotFoundError(`Session not found: ${id}`);
+        const rows = deps.sessions.getHistoryRows(id, { limit: 500 });
+        // Filter out tool-internal messages and normalize content to strings.
+        // The UI should only see user messages + assistant text responses.
+        // Each row may carry an attachments sidecar (user-sent files) that
+        // we echo back so the composer thumbnails re-render on reload.
+        const normalized = rows
+            .map((r) => {
+            const content = JSON.parse(r.contentJson);
+            return { row: r, content };
+        })
+            .filter(({ content }) => !isToolOnlyMessage(content))
+            .map(({ row, content }) => {
+            const text = normalizeContent(content.content);
+            const attachments = row.attachmentsJson
+                ? JSON.parse(row.attachmentsJson)
+                : undefined;
+            const hasContent = text.trim().length > 0 || (attachments && attachments.length > 0);
+            if (!hasContent)
+                return null;
+            return {
+                role: content.role,
+                content: text,
+                timestamp: new Date(row.createdAt).toISOString(),
+                ...(attachments && attachments.length > 0 ? { attachments } : {}),
+            };
+        })
+            .filter((m) => m !== null);
+        res.json({ session, messages: normalized });
+    });
+    // ── /api/file — serve a file the UI needs to render inline ──
+    // Scoped to prevent the endpoint from being used to exfiltrate vault
+    // files, DBs, or arbitrary disk contents. Auth is already enforced by
+    // the global requireAuth middleware (loopback token via ?token= for
+    // <img src=> compatibility).
+    //
+    // Allowed paths:
+    //   - anywhere under `<dataDir>/inbox/`   — user-sent attachments
+    //   - anywhere under `<dataDir>/outputs/` — agent-generated artefacts
+    //   - tmpdir files whose basename starts with `daemora-`
+    //     (legacy path for image-gen output — still writable by the
+    //     agent via explicit outputPath, and a transitional whitelist
+    //     for PNGs already generated before the outputs/ switch)
+    app.get("/api/file", (req, res) => {
+        const raw = typeof req.query["path"] === "string" ? req.query["path"] : "";
+        if (!raw)
+            throw new ValidationError("missing path");
+        const abs = pathResolve(raw);
+        const dataDir = deps.cfg.env.dataDir;
+        const dataRoots = [
+            pathResolve(dataDir, "inbox"),
+            pathResolve(dataDir, "outputs"),
+        ];
+        const tmpRoot = pathResolve(tmpdir());
+        const underData = dataRoots.some((root) => abs === root || abs.startsWith(root + pathSep));
+        const underTmpDaemora = (abs === tmpRoot || abs.startsWith(tmpRoot + pathSep))
+            && basename(abs).startsWith("daemora-");
+        if (!underData && !underTmpDaemora) {
+            throw new ValidationError("path outside allowed roots");
+        }
+        if (!existsSync(abs) || !statSync(abs).isFile()) {
+            throw new NotFoundError("file not found");
+        }
+        res.sendFile(abs);
+    });
+    app.patch("/api/sessions/:id", (req, res) => {
+        const id = readId(req);
+        const body = renameBody.safeParse(req.body);
+        if (!body.success)
+            throw new ValidationError(body.error.message);
+        const ok = deps.sessions.renameSession(id, body.data.title);
+        if (!ok)
+            throw new NotFoundError(`Session not found: ${id}`);
+        res.json({ id, title: body.data.title });
+    });
+    app.delete("/api/sessions/:id", (req, res) => {
+        const id = readId(req);
+        const removed = deps.sessions.deleteSession(id);
+        if (!removed)
+            throw new NotFoundError(`Session not found: ${id}`);
+        res.json({ id, removed: true });
+    });
+}
+//# sourceMappingURL=sessions.js.map

package/dist/server/routes/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/server/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,WAAW,CAAC;AAG7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAItE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAE7D;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAgB;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,mEAAmE;QACnE,OAAO,OAAO;aACX,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE;YACrB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,CAAC,GAAG,IAA+B,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YACnE,kEAAkE;YAClE,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;aACD,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,GAAuC;IAChE,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,8DAA8D;IAC9D,OAAQ,GAAG,CAAC,OAA+B,CAAC,KAAK,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAC1D,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAEnE,4EAA4E;AAC5E,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,IAAgB;IAC/D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACxD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI;aACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAuC,CAAC;YAChF,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;YACxB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,GAAG,CAAC,eAAe;gBACrC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAsB;gBACvD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrF,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAChD,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,6BAA6B;IAC7B,EAAE;IACF,iBAAiB;IACjB,kEAAkE;IAClE,sEAAsE;IACtE,yDAAyD;IACzD,gEAAgE;IAChE,kEAAkE;IAClE,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,MAAM,SAAS,GAAG;YAChB,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;YAC7B,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;SAChC,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC;QAC3F,MAAM,eAAe,GACnB,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;eACnD,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/skills.d.ts

@@ -0,0 +1,11 @@
+/**
+ * /api/skills — list, inspect, reload, view body.
+ *
+ * Skill CREATE/EDIT/DELETE for user-authored skills goes through
+ * /api/skills/custom; the agent's own `skill_manage` tool uses a
+ * different (security-scanned) path for agent-initiated writes.
+ */
+import type { Express } from "express";
+import type { ServerDeps } from "../index.js";
+export declare function mountSkillRoutes(app: Express, deps: ServerDeps): void;
+//# sourceMappingURL=skills.d.ts.map

package/dist/server/routes/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../../src/server/routes/skills.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAK1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+B9C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CA0KrE"}

package/dist/server/routes/skills.js

@@ -0,0 +1,214 @@
+/**
+ * /api/skills — list, inspect, reload, view body.
+ *
+ * Skill CREATE/EDIT/DELETE for user-authored skills goes through
+ * /api/skills/custom; the agent's own `skill_manage` tool uses a
+ * different (security-scanned) path for agent-initiated writes.
+ */
+import { mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+import { z } from "zod";
+import { NotFoundError, ValidationError } from "../../util/errors.js";
+import { createLogger } from "../../util/logger.js";
+const log = createLogger("skills.routes");
+const customIdSchema = z.string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9][a-z0-9_-]*$/, "id must be kebab-case (lowercase, digits, _ or -)");
+const customCreateBody = z.object({
+    id: customIdSchema,
+    body: z.string().min(1).max(200_000),
+});
+const customUpdateBody = z.object({
+    body: z.string().min(1).max(200_000),
+});
+/**
+ * Resolves the path of a custom skill's SKILL.md by id, asserting the
+ * resolved path is inside the customSkillsDir (no escape via ../).
+ */
+function customSkillFile(customDir, id) {
+    const root = resolve(customDir);
+    const target = resolve(join(root, id, "SKILL.md"));
+    if (target !== resolve(join(root, id, "SKILL.md")) || !target.startsWith(root + sep)) {
+        throw new ValidationError(`Refused to resolve outside custom skills dir: ${id}`);
+    }
+    return target;
+}
+export function mountSkillRoutes(app, deps) {
+    app.get("/api/skills", (_req, res) => {
+        res.json({
+            skills: deps.skills.list().map((s) => ({
+                id: s.meta.id,
+                name: s.meta.name,
+                description: s.meta.description,
+                triggers: s.meta.triggers,
+                requires_tools: s.meta.requires_tools,
+                requires_integrations: s.meta.requires_integrations,
+                platforms: s.meta.platforms,
+                version: s.meta.version,
+                enabled: s.meta.enabled,
+                dir: s.dir,
+                file: s.file,
+                linkedFiles: s.linkedFiles,
+            })),
+        });
+    });
+    // ── Specific paths FIRST (Express matches in declaration order) ────
+    // `/api/skills/:id` below would otherwise swallow `/api/skills/custom`
+    // and `/api/skills/reload` because `:id` is a wildcard segment.
+    /**
+     * Re-scan disk and replace the live SkillRegistry contents. Picks up
+     * new files, edits, deletions, and any custom skills written via the
+     * /api/skills/custom routes below.
+     */
+    app.post("/api/skills/reload", async (_req, res) => {
+        const { loaded, skipped } = await deps.skillLoader.loadAll();
+        deps.skills.replace(loaded);
+        deps.agent.invalidateSystemPromptCache();
+        log.info({ loaded: loaded.length, skipped: skipped.length }, "skills reloaded");
+        res.json({ loaded: loaded.length, skipped: skipped.length });
+    });
+    /**
+     * GET /api/skills/custom — list all user-authored skills (the ones
+     * stored in <dataDir>/custom-skills/).
+     */
+    app.get("/api/skills/custom", async (_req, res) => {
+        const root = resolve(deps.customSkillsDir);
+        let entries;
+        try {
+            entries = await readdir(root);
+        }
+        catch (e) {
+            const err = e;
+            if (err.code === "ENOENT")
+                return res.json({ skills: [] });
+            throw e;
+        }
+        const skills = [];
+        for (const entry of entries) {
+            if (entry.startsWith(".") || entry.startsWith("_"))
+                continue;
+            const file = join(root, entry, "SKILL.md");
+            try {
+                const s = await stat(file);
+                if (!s.isFile())
+                    continue;
+                skills.push({ id: entry, file, size: s.size, mtime: s.mtime.toISOString() });
+            }
+            catch { /* missing SKILL.md → skip */ }
+        }
+        res.json({ skills });
+    });
+    /**
+     * POST /api/skills/custom — create a new custom skill. Body:
+     *   { id: "my-skill", body: "---\nname: ...\n---\n# ..." }
+     * Writes <customDir>/<id>/SKILL.md atomically. Reloads the registry
+     * so the new skill is immediately available to the agent.
+     */
+    app.post("/api/skills/custom", async (req, res) => {
+        const parsed = customCreateBody.safeParse(req.body ?? {});
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.message);
+        const { id, body } = parsed.data;
+        const file = customSkillFile(deps.customSkillsDir, id);
+        try {
+            await stat(file);
+            throw new ValidationError(`Skill "${id}" already exists. Use PUT to update.`);
+        }
+        catch (e) {
+            const err = e;
+            if (err && err.code !== "ENOENT" && !(e instanceof ValidationError))
+                throw e;
+            if (e instanceof ValidationError)
+                throw e;
+        }
+        await mkdir(dirname(file), { recursive: true });
+        await writeFile(file, body, "utf-8");
+        const { loaded } = await deps.skillLoader.loadAll();
+        deps.skills.replace(loaded);
+        deps.agent.invalidateSystemPromptCache();
+        log.info({ id, file }, "custom skill created");
+        res.status(201).json({ id, file });
+    });
+    /**
+     * PUT /api/skills/custom/:id — overwrite the body of an existing
+     * custom skill. Returns 404 if it doesn't exist (agent-bundled skills
+     * can't be edited via this route — those are read-only on disk).
+     */
+    app.put("/api/skills/custom/:id", async (req, res) => {
+        const idResult = customIdSchema.safeParse(req.params.id ?? "");
+        if (!idResult.success)
+            throw new ValidationError(idResult.error.message);
+        const id = idResult.data;
+        const parsed = customUpdateBody.safeParse(req.body ?? {});
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.message);
+        const file = customSkillFile(deps.customSkillsDir, id);
+        try {
+            await stat(file);
+        }
+        catch {
+            throw new NotFoundError(`Custom skill "${id}" not found.`);
+        }
+        await writeFile(file, parsed.data.body, "utf-8");
+        const { loaded } = await deps.skillLoader.loadAll();
+        deps.skills.replace(loaded);
+        deps.agent.invalidateSystemPromptCache();
+        log.info({ id, file }, "custom skill updated");
+        res.json({ id, file });
+    });
+    /**
+     * DELETE /api/skills/custom/:id — remove a custom skill folder.
+     * Refuses if the resolved path falls outside the custom skills dir.
+     */
+    app.delete("/api/skills/custom/:id", async (req, res) => {
+        const idResult = customIdSchema.safeParse(req.params.id ?? "");
+        if (!idResult.success)
+            throw new ValidationError(idResult.error.message);
+        const id = idResult.data;
+        const root = resolve(deps.customSkillsDir);
+        const skillDir = resolve(join(root, id));
+        if (!skillDir.startsWith(root + sep)) {
+            throw new ValidationError(`Refused to delete outside custom skills dir: ${id}`);
+        }
+        try {
+            await stat(skillDir);
+        }
+        catch {
+            throw new NotFoundError(`Custom skill "${id}" not found.`);
+        }
+        await rm(skillDir, { recursive: true, force: true });
+        const { loaded } = await deps.skillLoader.loadAll();
+        deps.skills.replace(loaded);
+        deps.agent.invalidateSystemPromptCache();
+        log.info({ id, skillDir }, "custom skill deleted");
+        res.json({ id, deleted: true });
+    });
+    // ── Wildcard `:id` routes go LAST so the specific paths above win. ──
+    app.get("/api/skills/:id", async (req, res) => {
+        const id = req.params.id ?? "";
+        const skill = deps.skills.get(id);
+        if (!skill)
+            return res.status(404).json({ error: "skill not found" });
+        const body = await skill.loadBody();
+        res.json({
+            id: skill.meta.id,
+            meta: skill.meta,
+            dir: skill.dir,
+            file: skill.file,
+            linkedFiles: skill.linkedFiles,
+            body,
+        });
+    });
+    app.get("/api/skills/:id/file", async (req, res) => {
+        const id = req.params.id ?? "";
+        const path = req.query["path"] ?? "";
+        if (!path)
+            return res.status(400).json({ error: "?path= is required" });
+        const r = await deps.skills.getLinkedFile(id, path);
+        if (r.kind === "err")
+            return res.status(404).json({ error: r.reason });
+        res.json({ path: r.path, content: r.content });
+    });
+}
+//# sourceMappingURL=skills.js.map

package/dist/server/routes/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../../src/server/routes/skills.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE1C,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE;KAC9B,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;AAEvF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;CACrC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,eAAe,CAAC,SAAiB,EAAE,EAAU;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,eAAe,CAAC,iDAAiD,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,IAAgB;IAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;gBACb,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;gBAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACzB,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB;gBACnD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS;gBAC3B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;gBACvB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;gBACvB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,uEAAuE;IACvE,gEAAgE;IAEhE;;;;OAIG;IACH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAA0B,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,MAAM,GAAgE,EAAE,CAAC;QAC/E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;QAC3C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAA0B,CAAC;YACvC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,eAAe,CAAC;gBAAE,MAAM,CAAC,CAAC;YAC7E,IAAI,CAAC,YAAY,eAAe;gBAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAErC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QAEzC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAErE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACzB,MAAM,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;QAAC,CAAC;QACrE,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QAEzC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QAEzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CAAC,gDAAgD,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAC7B,MAAM,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;QAAC,CAAC;QACrE,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QAEzC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/tasks.d.ts

@@ -0,0 +1,10 @@
+/**
+ * /api/tasks — task history (read-only), with tool-call detail.
+ *
+ * Tasks are created by `TaskRunner.run()` (not by this route). Read
+ * endpoints are used by the Logs / TaskDetail UI pages + cancel.
+ */
+import type { Express } from "express";
+import type { ServerDeps } from "../index.js";
+export declare function mountTaskRoutes(app: Express, deps: ServerDeps): void;
+//# sourceMappingURL=tasks.d.ts.map

package/dist/server/routes/tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../../src/server/routes/tasks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CA+BpE"}

package/dist/server/routes/tasks.js

@@ -0,0 +1,38 @@
+/**
+ * /api/tasks — task history (read-only), with tool-call detail.
+ *
+ * Tasks are created by `TaskRunner.run()` (not by this route). Read
+ * endpoints are used by the Logs / TaskDetail UI pages + cancel.
+ */
+export function mountTaskRoutes(app, deps) {
+    app.get("/api/tasks", (req, res) => {
+        const limit = Math.min(Number(req.query["limit"] ?? 100), 500);
+        res.json({ tasks: deps.tasks.list(limit) });
+    });
+    app.get("/api/tasks/:id", (req, res) => {
+        const id = req.params.id ?? "";
+        const task = deps.tasks.get(id);
+        if (!task)
+            return res.status(404).json({ error: "task not found" });
+        const toolCalls = deps.tasks.getToolCalls(id);
+        res.json({ task, toolCalls });
+    });
+    app.delete("/api/tasks/:id", (req, res) => {
+        const id = req.params.id ?? "";
+        const ok = deps.tasks.delete(id);
+        if (!ok)
+            return res.status(404).json({ error: "task not found" });
+        res.status(204).end();
+    });
+    app.post("/api/tasks/:id/cancel", (req, res) => {
+        const id = req.params.id ?? "";
+        const cancelled = deps.runner.cancel(id, "cancelled via api");
+        if (!cancelled)
+            return res.status(404).json({ error: "task not running" });
+        res.json({ ok: true });
+    });
+    app.get("/api/tasks/:id/inflight", (_req, res) => {
+        res.json({ taskIds: deps.runner.inflightTaskIds() });
+    });
+}
+//# sourceMappingURL=tasks.js.map

package/dist/server/routes/tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../../../src/server/routes/tasks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,IAAgB;IAC5D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/teams.d.ts

@@ -0,0 +1,7 @@
+/**
+ * /api/teams — team + worker CRUD.
+ */
+import type { Express } from "express";
+import type { ServerDeps } from "../index.js";
+export declare function mountTeamRoutes(app: Express, deps: ServerDeps): void;
+//# sourceMappingURL=teams.d.ts.map

package/dist/server/routes/teams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.d.ts","sourceRoot":"","sources":["../../../src/server/routes/teams.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAI1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiB9C,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CAyCpE"}

package/dist/server/routes/teams.js

@@ -0,0 +1,61 @@
+/**
+ * /api/teams — team + worker CRUD.
+ */
+import { z } from "zod";
+import { ValidationError } from "../../util/errors.js";
+const workerSchema = z.object({
+    name: z.string().min(1).max(64),
+    profile: z.string().max(64).optional(),
+    crew: z.string().max(64).optional(),
+    task: z.string().min(1).max(4000),
+    blockedByWorkers: z.array(z.string()).default([]),
+});
+const createSchema = z.object({
+    name: z.string().min(1).max(120),
+    task: z.string().min(1).max(4000),
+    project: z.string().max(120).optional(),
+    workers: z.array(workerSchema).min(1).max(32),
+});
+export function mountTeamRoutes(app, deps) {
+    app.get("/api/teams", (_req, res) => {
+        const teams = deps.teamStore.listTeams().map((t) => ({
+            ...t,
+            workers: deps.teamStore.getWorkers(t.id),
+        }));
+        res.json({ teams });
+    });
+    app.get("/api/teams/:id", (req, res) => {
+        const id = req.params.id ?? "";
+        const team = deps.teamStore.getTeam(id);
+        if (!team)
+            return res.status(404).json({ error: "team not found" });
+        res.json({ team, workers: deps.teamStore.getWorkers(id) });
+    });
+    app.post("/api/teams", (req, res) => {
+        const parsed = createSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.message);
+        const opts = {
+            name: parsed.data.name,
+            task: parsed.data.task,
+            workers: parsed.data.workers.map((w) => ({
+                name: w.name,
+                task: w.task,
+                blockedByWorkers: w.blockedByWorkers,
+                ...(w.profile ? { profile: w.profile } : {}),
+                ...(w.crew ? { crew: w.crew } : {}),
+            })),
+            ...(parsed.data.project ? { project: parsed.data.project } : {}),
+        };
+        const team = deps.teamStore.createTeam(opts);
+        res.status(201).json({ team, workers: deps.teamStore.getWorkers(team.id) });
+    });
+    app.delete("/api/teams/:id", (req, res) => {
+        const id = req.params.id ?? "";
+        if (!deps.teamStore.getTeam(id))
+            return res.status(404).json({ error: "team not found" });
+        deps.teamStore.deleteTeam(id);
+        res.status(204).end();
+    });
+}
+//# sourceMappingURL=teams.js.map

package/dist/server/routes/teams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.js","sourceRoot":"","sources":["../../../src/server/routes/teams.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,IAAgB;IAC5D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,GAAG,CAAC;YACJ,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/tunnel.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Tunnel status endpoint for the UI.
+ *
+ *   GET /api/tunnel → { url, kind }
+ *
+ * Read-only surface so the Settings / Watchers page can show the user
+ * the currently active public URL and what provider sourced it.
+ */
+import type { Express } from "express";
+import type { TunnelManager } from "../../tunnels/TunnelManager.js";
+export declare function mountTunnelRoutes(app: Express, tunnel: TunnelManager, getPublicUrl: () => string): void;
+//# sourceMappingURL=tunnel.d.ts.map

package/dist/server/routes/tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../../src/server/routes/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAQvG"}

package/dist/server/routes/tunnel.js

@@ -0,0 +1,18 @@
+/**
+ * Tunnel status endpoint for the UI.
+ *
+ *   GET /api/tunnel → { url, kind }
+ *
+ * Read-only surface so the Settings / Watchers page can show the user
+ * the currently active public URL and what provider sourced it.
+ */
+export function mountTunnelRoutes(app, tunnel, getPublicUrl) {
+    app.get("/api/tunnel", (_req, res) => {
+        const current = tunnel.current();
+        res.json({
+            url: getPublicUrl(),
+            kind: current.kind,
+        });
+    });
+}
+//# sourceMappingURL=tunnel.js.map

package/dist/server/routes/tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../../src/server/routes/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,MAAqB,EAAE,YAA0B;IAC/F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,YAAY,EAAE;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/vault.d.ts

@@ -0,0 +1,15 @@
+/**
+ * /api/vault — secret writes + unlock/lock.
+ *
+ * The vault NEVER returns secret values. Reads return only
+ * existence flags + length hints (last 4 chars).
+ *
+ * Hard rules enforced here:
+ *   - You can only set a key declared in the schema as a secret.
+ *   - Pattern (e.g. /^sk-/ for OpenAI) is validated before storage.
+ *   - Locked vault → 403 with the lock-prompt hint, never 500.
+ */
+import type { Express } from "express";
+import type { ServerDeps } from "../index.js";
+export declare function mountVaultRoutes(app: Express, deps: ServerDeps): void;
+//# sourceMappingURL=vault.d.ts.map

package/dist/server/routes/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/server/routes/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAK1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsB9C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CAoDrE"}