maestro-agent 0.0.1 → 0.0.3

package/src/api/chief.ts

@@ -0,0 +1,84 @@
+import type { Router } from "../core/router";
+import { body, json } from "../core/router";
+import type { HubContext } from "../core/server";
+import { applyChiefDecision, proposeRoster, runChiefHeartbeat } from "../chief";
+
+export function registerChiefRoutes(router: Router, ctx: HubContext) {
+  router.post("/api/chief/workspaces/:id/propose-roster", (_req, params) => {
+    try {
+      return json(proposeRoster(ctx.db, params.id), 201);
+    } catch (err: any) {
+      return json({ error: err.message }, 404);
+    }
+  });
+
+  router.post("/api/chief/heartbeat", async () => {
+    const result = await runChiefHeartbeat(ctx.db);
+    const messages = ctx.db.query("SELECT * FROM inbox_message WHERE from_actor = 'chief' ORDER BY created_at DESC LIMIT 20").all() as any[];
+    return json({
+      ...result,
+      proposals: messages.filter((message) => message.kind === "proposal").length,
+      messages,
+    });
+  });
+
+  router.post("/api/chief/decisions", async (req) => {
+    const input = await req.json();
+    return json(applyChiefDecision(ctx.db, input), 201);
+  });
+
+  router.post("/api/chief/dialogue", async (req) => {
+    const input = await body(req);
+    const text = String(input.text || input.message || "");
+    const decisions = parseChiefDialogue(text, input.context || {});
+    const results = decisions.map((decision: any) => applyChiefDecision(ctx.db, decision));
+    return json({ decisions, results }, 201);
+  });
+}
+
+function parseChiefDialogue(text: string, context: Record<string, any>) {
+  const lower = text.toLowerCase();
+  const decisions: Array<{ tool: string; args: Record<string, any> }> = [];
+
+  if (lower.includes("add role") || lower.includes("create role") || lower.includes("增加角色") || lower.includes("新增角色")) {
+    const name = context.role_name || extractQuoted(text) || "Dynamic Role";
+    decisions.push({
+      tool: "create_role",
+      args: {
+        name,
+        workspace_id: context.workspace_id,
+        project_id: context.project_id,
+        capabilities: context.capabilities || [],
+        preferred_runtimes: context.preferred_runtimes || [],
+        headcount: context.headcount || 1,
+        rationale: text,
+      },
+    });
+  }
+
+  if (lower.includes("task flow") || lower.includes("workflow") || lower.includes("modify task") || lower.includes("修改任务流") || lower.includes("调整任务流")) {
+    if (context.task_id || context.parent_task_id) {
+      decisions.push({
+        tool: "update_task_flow",
+        args: {
+          mode: context.mode || (context.depends_on ? "add_dependency" : context.parent_task_id ? "spawn_followup" : "add_dependency"),
+          task_id: context.task_id,
+          parent_task_id: context.parent_task_id || context.task_id,
+          depends_on: context.depends_on || [],
+          title: context.title,
+          description: context.description,
+          required_capabilities: context.required_capabilities || [],
+          priority: context.priority,
+          rationale: text,
+        },
+      });
+    }
+  }
+
+  return decisions;
+}
+
+function extractQuoted(text: string) {
+  const match = text.match(/"([^"]+)"|'([^']+)'|“([^”]+)”/);
+  return match ? match[1] || match[2] || match[3] : "";
+}

package/src/api/config.ts

@@ -0,0 +1,39 @@
+import type { Router } from "../core/router";
+import { json, body } from "../core/router";
+import type { HubContext } from "../core/server";
+import { now } from "../core/db";
+
+export function registerConfigRoutes(router: Router, ctx: HubContext) {
+  router.get("/api/config", () => {
+    const rows = ctx.db.query("SELECT key, value FROM config").all() as Array<{ key: string; value: string }>;
+    const config: Record<string, string> = {};
+    for (const row of rows) config[row.key] = row.value;
+    return json(config);
+  });
+
+  router.patch("/api/config", async (req) => {
+    const updates = await body<Record<string, string>>(req);
+    const ts = now();
+    for (const [key, value] of Object.entries(updates)) {
+      ctx.db.run(
+        "INSERT INTO config (key, value, updated_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at",
+        [key, String(value), ts]
+      );
+    }
+    const rows = ctx.db.query("SELECT key, value FROM config").all() as Array<{ key: string; value: string }>;
+    const config: Record<string, string> = {};
+    for (const row of rows) config[row.key] = row.value;
+    return json(config);
+  });
+
+  router.get("/api/config/:key", (_req, params) => {
+    const row = ctx.db.query("SELECT value FROM config WHERE key = ?").get(params.key) as any;
+    if (!row) return json({ error: "Key not found" }, 404);
+    return json({ key: params.key, value: row.value });
+  });
+}
+
+export function getConfig(ctx: HubContext, key: string, defaultValue: string = ""): string {
+  const row = ctx.db.query("SELECT value FROM config WHERE key = ?").get(key) as any;
+  return row?.value ?? defaultValue;
+}

package/src/api/gantt.ts

@@ -0,0 +1,72 @@
+import type { Router } from "../core/router";
+import { json } from "../core/router";
+import type { HubContext } from "../core/server";
+import { getTaskBlockingDetails } from "../ops/task-blocking";
+
+export function registerGanttRoutes(router: Router, ctx: HubContext) {
+  // 空间级甘特图：按 Project 分组展示所有 Task
+  router.get("/api/workspaces/:workspaceId/gantt", (req, params) => {
+    const workspaceId = params.workspaceId;
+    const url = new URL(req.url);
+    const projectFilter = url.searchParams.get("project_id");
+
+    const workspace = ctx.db.query("SELECT id FROM workspace WHERE id = ?").get(workspaceId);
+    if (!workspace) return json({ error: "Workspace not found" }, 404);
+
+    let projectSql = "SELECT id, name, status FROM project WHERE workspace_id = ?";
+    const projectParams: any[] = [workspaceId];
+    if (projectFilter) {
+      projectSql += " AND id = ?";
+      projectParams.push(projectFilter);
+    }
+    projectSql += " ORDER BY created_at";
+
+    const projects = ctx.db.query(projectSql).all(...projectParams) as any[];
+
+    const result = projects.map((project: any) => {
+      const tasks = ctx.db.query(
+        `SELECT id, title, status, priority, start_date, end_date, progress,
+                parent_task_id, assignee_agent_id, created_at
+         FROM task WHERE project_id = ? ORDER BY created_at`
+      ).all(project.id) as any[];
+
+      const taskIds = tasks.map((t: any) => t.id);
+      const blockingByTask = getTaskBlockingDetails(ctx.db, taskIds);
+      const deps: Record<string, string[]> = {};
+      if (taskIds.length > 0) {
+        const placeholders = taskIds.map(() => "?").join(",");
+        const depRows = ctx.db.query(
+          `SELECT task_id, depends_on FROM task_dependency WHERE task_id IN (${placeholders})`
+        ).all(...taskIds) as any[];
+        for (const row of depRows) {
+          if (!deps[row.task_id]) deps[row.task_id] = [];
+          deps[row.task_id].push(row.depends_on);
+        }
+      }
+
+      return {
+        id: project.id,
+        name: project.name,
+        status: project.status,
+        tasks: tasks.map((t: any) => ({
+          id: t.id,
+          title: t.title,
+          status: t.status,
+          priority: t.priority,
+          start_date: t.start_date,
+          end_date: t.end_date,
+          progress: t.progress ?? 0,
+          parent_task_id: t.parent_task_id,
+          assignee_agent_id: t.assignee_agent_id,
+          created_at: t.created_at,
+          dependencies: deps[t.id] || [],
+          dependency_details: blockingByTask[t.id]?.dependencies || [],
+          blocking_dependencies: blockingByTask[t.id]?.blocking_dependencies || [],
+          blocked_reason: blockingByTask[t.id]?.blocked_reason || null,
+        })),
+      };
+    });
+
+    return json({ projects: result });
+  });
+}

package/src/api/hooks.ts

@@ -0,0 +1,54 @@
+import type { Router } from "../core/router";
+import { body, json } from "../core/router";
+import type { HubContext } from "../core/server";
+import { generateId, now } from "../core/db";
+import { required } from "../core/validate";
+import { executeHooksForEvent, runDueCrons } from "../scheduler";
+
+export function registerHookRoutes(router: Router, ctx: HubContext) {
+  router.get("/api/hooks", () => {
+    return json(ctx.db.query("SELECT * FROM hook_binding ORDER BY created_at DESC").all());
+  });
+
+  router.post("/api/hooks", async (req) => {
+    const input = await body(req);
+    const { scope, scope_id, event, when_expr, action } = input;
+    required({ scope, scope_id, event, action }, ["scope", "scope_id", "event", "action"]);
+    const id = generateId("hook");
+    const ts = now();
+    ctx.db.run(
+      "INSERT INTO hook_binding (id, scope, scope_id, event, when_expr, action, enabled, created_at) VALUES (?, ?, ?, ?, ?, ?, 1, ?)",
+      [id, scope, scope_id, event, when_expr || null, action, ts]
+    );
+    return json(ctx.db.query("SELECT * FROM hook_binding WHERE id = ?").get(id), 201);
+  });
+
+  router.post("/api/hooks/dispatch", async (req) => {
+    const input = await body(req);
+    const { event, payload } = input;
+    required({ event }, ["event"]);
+    return json(executeHooksForEvent(ctx.db, event, payload || {}));
+  });
+
+  router.get("/api/crons", () => {
+    return json(ctx.db.query("SELECT * FROM cron_binding ORDER BY created_at DESC").all());
+  });
+
+  router.post("/api/crons", async (req) => {
+    const input = await body(req);
+    const { scope, scope_id, cron_expr, action } = input;
+    required({ scope, scope_id, cron_expr, action }, ["scope", "scope_id", "cron_expr", "action"]);
+    const id = generateId("cron");
+    const ts = now();
+    ctx.db.run(
+      "INSERT INTO cron_binding (id, scope, scope_id, cron_expr, action, enabled, created_at) VALUES (?, ?, ?, ?, ?, 1, ?)",
+      [id, scope, scope_id, cron_expr, action, ts]
+    );
+    return json(ctx.db.query("SELECT * FROM cron_binding WHERE id = ?").get(id), 201);
+  });
+
+  router.post("/api/crons/run", async (req) => {
+    const input = await body(req).catch(() => ({}));
+    return json(runDueCrons(ctx.db, input.now || now()));
+  });
+}

package/src/api/inbox.ts

@@ -0,0 +1,125 @@
+import type { Router } from "../core/router";
+import { body, json } from "../core/router";
+import type { HubContext } from "../core/server";
+import { generateId, now } from "../core/db";
+import { required } from "../core/validate";
+import { getWorkflowForTask } from "../workflows";
+import { findProjectExecutionBlocker, isTaskAssignedToAgent } from "../ops/project-serial";
+
+export function registerInboxRoutes(router: Router, ctx: HubContext) {
+  router.get("/api/inbox", (req) => {
+    const url = new URL(req.url);
+    const to = url.searchParams.get("to");
+    const status = url.searchParams.get("status");
+    let sql = "SELECT * FROM inbox_message WHERE 1=1";
+    const params: any[] = [];
+    if (to) { sql += " AND to_actor = ?"; params.push(to); }
+    if (status) { sql += " AND status = ?"; params.push(status); }
+    sql += " ORDER BY created_at DESC";
+    return json(ctx.db.query(sql).all(...params));
+  });
+
+  // Long-poll: wait for an available task (or return immediately if one exists)
+  router.get("/api/inbox/poll", (req) => {
+    const url = new URL(req.url);
+    const agentId = url.searchParams.get("agent_id");
+    const skill = url.searchParams.get("skill") || null;
+    const timeoutMs = Math.min(Number(url.searchParams.get("timeout") || "30000"), 60000);
+
+    if (!agentId) return json({ error: "agent_id required" }, 400);
+
+    // Check immediately
+    const task = findOpenTask(ctx, agentId, skill);
+    if (task) return json(task);
+
+    // Long-poll: wait for new work or for a busy project to become available.
+    return new Promise<Response>((resolve) => {
+      const events = ["task.created", "task.transitioned", "task.complete", "task.return", "task.abandon"];
+      let settled = false;
+      const cleanup = () => {
+        settled = true;
+        for (const event of events) ctx.bus.removeListener(event, onTask);
+      };
+
+      const timer = setTimeout(() => {
+        if (settled) return;
+        cleanup();
+        resolve(new Response(null, { status: 204 }));
+      }, timeoutMs);
+
+      const onTask = () => {
+        if (settled) return;
+        const found = findOpenTask(ctx, agentId, skill);
+        if (found) {
+          clearTimeout(timer);
+          cleanup();
+          resolve(json(found));
+        }
+      };
+
+      for (const event of events) ctx.bus.on(event, onTask);
+    });
+  });
+
+  router.post("/api/inbox/messages", async (req) => {
+    const input = await body(req);
+    const { kind, from_actor, to_actor, subject, body: messageBody, ref_json } = input;
+    required({ kind, from_actor, to_actor }, ["kind", "from_actor", "to_actor"]);
+    const id = generateId("msg");
+    const ts = now();
+    ctx.db.run(
+      `INSERT INTO inbox_message (id, kind, from_actor, to_actor, subject, body, ref_json, status, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 'unread', ?)`,
+      [id, kind, from_actor, to_actor, subject || null, messageBody || null, stringifyRef(ref_json), ts]
+    );
+    return json(ctx.db.query("SELECT * FROM inbox_message WHERE id = ?").get(id), 201);
+  });
+
+  router.post("/api/inbox/messages/:id/read", (_req, params) => {
+    const ts = now();
+    ctx.db.run("UPDATE inbox_message SET status = 'read', read_at = ? WHERE id = ?", [ts, params.id]);
+    const row = ctx.db.query("SELECT * FROM inbox_message WHERE id = ?").get(params.id);
+    if (!row) return json({ error: "Not found" }, 404);
+    return json(row);
+  });
+
+  router.post("/api/inbox/messages/:id/reply", async (req, params) => {
+    const original = ctx.db.query("SELECT * FROM inbox_message WHERE id = ?").get(params.id) as any;
+    if (!original) return json({ error: "Not found" }, 404);
+    const input = await body(req);
+    const fromActor = input.from_actor || original.to_actor;
+    const id = generateId("msg");
+    const ts = now();
+    const ref = JSON.stringify({ reply_to: params.id });
+    ctx.db.run(
+      `INSERT INTO inbox_message (id, kind, from_actor, to_actor, subject, body, ref_json, status, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 'unread', ?)`,
+      [id, "reply", fromActor, original.from_actor, original.subject, input.body || null, ref, ts]
+    );
+    ctx.db.run("UPDATE inbox_message SET status = 'replied' WHERE id = ?", [params.id]);
+    return json(ctx.db.query("SELECT * FROM inbox_message WHERE id = ?").get(id), 201);
+  });
+}
+
+function findOpenTask(ctx: HubContext, agentId: string, skill: string | null): any {
+  const tasks = ctx.db.query("SELECT * FROM task ORDER BY priority DESC, created_at ASC").all() as any[];
+  return tasks.find((task) => {
+    const workflow = getWorkflowForTask(ctx.db, task.id);
+    if (task.status !== workflow.initial_status) return false;
+    if (!isTaskAssignedToAgent(task, agentId)) return false;
+    const claimAction = workflow.actions.find((action) => action.id === "claim" && action.from.includes(task.status));
+    if (findProjectExecutionBlocker(ctx.db, {
+      projectId: task.project_id,
+      excludeTaskId: task.id,
+      claimedStatus: claimAction?.to,
+    })) return false;
+    if (!skill) return true;
+    const requiredCapabilities: string[] = JSON.parse(task.required_capabilities_json || "[]");
+    return requiredCapabilities.length === 0 || requiredCapabilities.includes(skill);
+  }) || null;
+}
+
+function stringifyRef(ref: unknown): string | null {
+  if (ref === undefined || ref === null) return null;
+  return typeof ref === "string" ? ref : JSON.stringify(ref);
+}

package/src/api/lark.ts

@@ -0,0 +1,32 @@
+import type { Router } from "../core/router";
+import { body, json } from "../core/router";
+import type { HubContext } from "../core/server";
+import { handleLarkBatchInbox, handleLarkCommand, handleLarkWebhook, sendLarkNotification, verifyLarkSignature } from "../bridges/lark";
+
+export function registerLarkRoutes(router: Router, ctx: HubContext) {
+  router.post("/api/bridges/lark/events", async (req) => {
+    const raw = await req.text();
+    const input = raw ? JSON.parse(raw) : {};
+    const secret = process.env.MAESTRO_LARK_SIGNING_SECRET;
+    if (secret) {
+      const timestamp = req.headers.get("x-lark-request-timestamp") || "";
+      const signature = req.headers.get("x-lark-signature") || "";
+      const ok = await verifyLarkSignature({ timestamp, signature, body: raw, secret });
+      if (!ok) return json({ error: "Invalid Lark signature" }, 401);
+    }
+    if (input.event || input.type) {
+      return json(await handleLarkWebhook(ctx.db, input, { verificationToken: process.env.MAESTRO_LARK_VERIFICATION_TOKEN }));
+    }
+    return json(handleLarkCommand(ctx.db, input.text || ""));
+  });
+
+  router.post("/api/bridges/lark/inbox/batch", async (req) => {
+    const input = await body(req);
+    return json(handleLarkBatchInbox(ctx.db, input));
+  });
+
+  router.post("/api/bridges/lark/notify", async (req) => {
+    const input = await body(req);
+    return json(await sendLarkNotification(input));
+  });
+}

package/src/api/memory.ts

@@ -0,0 +1,37 @@
+import type { Router } from "../core/router";
+import { body, json } from "../core/router";
+import type { HubContext } from "../core/server";
+import { generateId, now } from "../core/db";
+import { required } from "../core/validate";
+
+export function registerMemoryRoutes(router: Router, ctx: HubContext) {
+  router.get("/api/memory", (req) => {
+    const url = new URL(req.url);
+    const scope = url.searchParams.get("scope");
+    const scopeId = url.searchParams.get("scope_id");
+    const key = url.searchParams.get("key");
+    let sql = "SELECT * FROM memory WHERE 1=1";
+    const params: any[] = [];
+    if (scope) { sql += " AND scope = ?"; params.push(scope); }
+    if (scopeId) { sql += " AND scope_id = ?"; params.push(scopeId); }
+    if (key) { sql += " AND key = ?"; params.push(key); }
+    sql += " ORDER BY updated_at DESC";
+    return json(ctx.db.query(sql).all(...params));
+  });
+
+  router.post("/api/memory", async (req) => {
+    const input = await body(req);
+    const { scope, scope_id, key, value } = input;
+    required({ scope, scope_id, key }, ["scope", "scope_id", "key"]);
+    const ts = now();
+    const existing = ctx.db.query("SELECT id FROM memory WHERE scope = ? AND scope_id = ? AND key = ?").get(scope, scope_id, key) as any;
+    const id = existing?.id || generateId("mem");
+    ctx.db.run(
+      `INSERT INTO memory (id, scope, scope_id, key, value, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT(scope, scope_id, key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,
+      [id, scope, scope_id, key, value ?? null, ts]
+    );
+    return json(ctx.db.query("SELECT * FROM memory WHERE id = ?").get(id), existing ? 200 : 201);
+  });
+}

package/src/api/ops.ts

@@ -0,0 +1,89 @@
+import type { Router } from "../core/router";
+import { body, json } from "../core/router";
+import type { HubContext } from "../core/server";
+import { closeDb, getDb, initSchema } from "../core/db";
+import { createBackup, latestSoakEvidence, opsStats, restoreBackup, smokeRuntimes, soakRuntimes } from "../ops";
+import { gcAll, gcArtifacts, gcDryRun, gcFull, gcOrphans } from "../ops/gc";
+import { createTaskWorkDir, ensureTaskWorkDir, removeTaskWorkDir } from "../ops/task-workspace";
+
+export function registerOpsRoutes(router: Router, ctx: HubContext) {
+  router.get("/api/ops/stats", () => {
+    return json(opsStats(ctx.db));
+  });
+
+  router.get("/api/ops/evidence/soak/latest", () => {
+    const evidence = latestSoakEvidence(ctx.hubDir);
+    if (!evidence) return json({ error: "No soak evidence" }, 404);
+    return json(evidence);
+  });
+
+  router.post("/api/ops/backup", () => {
+    return json(createBackup(ctx.hubDir), 201);
+  });
+
+  router.post("/api/ops/restore", async (req) => {
+    const input = await body<{ path: string }>(req);
+    closeDb(ctx.hubDir);
+    const result = restoreBackup(ctx.hubDir, input.path);
+    ctx.db = getDb(ctx.hubDir);
+    initSchema(ctx.db, ctx.hubDir);
+    ctx.bus.setDb(ctx.db);
+    return json(result);
+  });
+
+  router.post("/api/ops/smoke/runtimes", async (req) => {
+    const input = await body<{ runtimes: any[] }>(req);
+    return json(await smokeRuntimes(ctx.db, input.runtimes || []), 201);
+  });
+
+  router.post("/api/ops/soak/runtimes", async (req) => {
+    const input = await body<{ runtimes: any[]; duration_ms?: number; fast_forward?: boolean }>(req);
+    return json(await soakRuntimes(ctx.hubDir, ctx.db, input), 201);
+  });
+
+  // --- Task Workspace ---
+
+  router.post("/api/ops/tasks/:taskId/workdir", (req, params) => {
+    const dir = createTaskWorkDir(ctx.db, ctx.hubDir, params.taskId);
+    return json({ taskId: params.taskId, workDir: dir }, 201);
+  });
+
+  router.get("/api/ops/tasks/:taskId/workdir", (req, params) => {
+    const dir = ensureTaskWorkDir(ctx.db, ctx.hubDir, params.taskId);
+    return json({ taskId: params.taskId, workDir: dir });
+  });
+
+  router.delete("/api/ops/tasks/:taskId/workdir", (req, params) => {
+    const removed = removeTaskWorkDir(ctx.db, params.taskId);
+    return json({ taskId: params.taskId, removed });
+  });
+
+  // --- GC ---
+
+  router.get("/api/ops/gc/dry-run", async (req) => {
+    const url = new URL(req.url);
+    const retentionDays = Number(url.searchParams.get("retention_days") || 7);
+    const result = gcDryRun(ctx.db, ctx.hubDir, { retentionDays });
+    return json(result);
+  });
+
+  router.post("/api/ops/gc", async (req) => {
+    const input = await body<{ level?: string; retention_days?: number }>(req);
+    const config = { retentionDays: input.retention_days ?? 7 };
+    let result;
+    switch (input.level) {
+      case "artifact":
+        result = gcArtifacts(ctx.db, ctx.hubDir, config);
+        break;
+      case "full":
+        result = gcFull(ctx.db, ctx.hubDir, config);
+        break;
+      case "orphan":
+        result = gcOrphans(ctx.db, ctx.hubDir);
+        break;
+      default:
+        result = gcAll(ctx.db, ctx.hubDir, config);
+    }
+    return json(result);
+  });
+}

package/src/api/projects.ts

@@ -0,0 +1,105 @@
+import type { Router } from "../core/router";
+import { json, body } from "../core/router";
+import type { HubContext } from "../core/server";
+import { generateId, now } from "../core/db";
+import { required } from "../core/validate";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+
+export function registerProjectRoutes(router: Router, ctx: HubContext) {
+  router.get("/api/projects", () => {
+    const rows = ctx.db.query(`
+      SELECT project.*, workspace.name AS workspace_name
+      FROM project
+      LEFT JOIN workspace ON workspace.id = project.workspace_id
+      ORDER BY project.created_at DESC
+    `).all();
+    return json(rows);
+  });
+
+  router.post("/api/workspaces/:wid/projects", async (req, params) => {
+    const workspace = ctx.db.query("SELECT * FROM workspace WHERE id = ?").get(params.wid) as any;
+    if (!workspace) return json({ error: "Workspace not found" }, 404);
+    const { name, charter_template, rationale, created_by, auto_kickoff, workdir } = await body(req);
+    required({ name }, ["name"]);
+    const id = generateId("proj");
+    const ts = now();
+    ctx.db.run(
+      "INSERT INTO project (id, workspace_id, name, workdir, charter_template, status, rationale, created_by, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, ?)",
+      [id, params.wid, name, normalizeWorkdir(workdir), charter_template || null, rationale || null, created_by || "user", ts, ts]
+    );
+    ctx.bus.publish("project.created", { id, workspace_id: params.wid, name });
+
+    let initial_tasks: any[] | undefined;
+    if (auto_kickoff) {
+      initial_tasks = [];
+      const templatePath = join(import.meta.dir, "../../templates/kickoff-tasks.json");
+      if (existsSync(templatePath)) {
+        try {
+          const tasks = JSON.parse(readFileSync(templatePath, "utf-8")) as any[];
+          for (const t of tasks) {
+            const taskId = generateId("task");
+            ctx.db.run(
+              `INSERT INTO task (id, project_id, title, description, status, required_capabilities_json, priority, lineage_depth, created_by, created_at, updated_at)
+               VALUES (?, ?, ?, ?, 'open', ?, ?, 0, 'template', ?, ?)`,
+              [taskId, id, t.title, t.description || null, JSON.stringify(t.skill ? [t.skill] : []), t.priority || 0, ts, ts]
+            );
+            initial_tasks.push({ id: taskId, title: t.title, status: "open", priority: t.priority || 0 });
+            ctx.bus.publish("task.created", { id: taskId, project_id: id, title: t.title });
+          }
+        } catch {}
+      }
+    }
+
+    const response: any = { id, workspace_id: params.wid, name, workdir: normalizeWorkdir(workdir), status: "active", created_at: ts };
+    if (initial_tasks) response.initial_tasks = initial_tasks;
+    return json(response, 201);
+  });
+
+  router.get("/api/projects/:id", (_req, params) => {
+    const row = ctx.db.query("SELECT * FROM project WHERE id = ?").get(params.id);
+    if (!row) return json({ error: "Not found" }, 404);
+    return json(row);
+  });
+
+  router.patch("/api/projects/:id", async (req, params) => {
+    const updates = await body(req);
+    const fields: string[] = [];
+    const values: any[] = [];
+    for (const key of ["name", "workdir", "charter_template", "status"]) {
+      if (updates[key] !== undefined) {
+        fields.push(`${key} = ?`);
+        values.push(key === "workdir" ? normalizeWorkdir(updates[key]) : updates[key]);
+      }
+    }
+    if (fields.length === 0) return json({ error: "No fields to update" }, 400);
+    fields.push("updated_at = ?");
+    values.push(now());
+    values.push(params.id);
+    ctx.db.run(`UPDATE project SET ${fields.join(", ")} WHERE id = ?`, values);
+    const row = ctx.db.query("SELECT * FROM project WHERE id = ?").get(params.id);
+    return json(row);
+  });
+
+  router.post("/api/projects/:id/archive", (_req, params) => {
+    const project = ctx.db.query("SELECT * FROM project WHERE id = ?").get(params.id) as any;
+    if (!project) return json({ error: "Not found" }, 404);
+    if (project.status !== "active") return json({ error: "Only active projects can be archived" }, 409);
+    const ts = now();
+    ctx.db.run("UPDATE project SET status = 'archived', updated_at = ? WHERE id = ?", [ts, params.id]);
+    ctx.bus.publish("project.archived", { id: params.id, workspace_id: project.workspace_id });
+    const row = ctx.db.query("SELECT * FROM project WHERE id = ?").get(params.id);
+    return json(row);
+  });
+
+  router.get("/api/workspaces/:wid/projects", (_req, params) => {
+    const rows = ctx.db.query("SELECT * FROM project WHERE workspace_id = ? ORDER BY created_at DESC").all(params.wid);
+    return json(rows);
+  });
+}
+
+function normalizeWorkdir(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}