modular-studio 1.0.5 → 1.1.0

package/dist-server/server/routes/cost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost.d.ts","sourceRoot":"","sources":["../../../server/routes/cost.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA2GxB,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/cost.js

@@ -0,0 +1,113 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { saveCostRecord, getCostHistory, getTotalSpent, getBudgetConfig, setBudgetConfig } from '../services/sqliteStore.js';
+function classifyModel(modelName) {
+    const n = modelName.toLowerCase();
+    if (/haiku|4o-mini|mini|flash|nano/.test(n))
+        return 'haiku';
+    if (/opus|gpt-4\.5|gemini-ultra|r1/.test(n))
+        return 'opus';
+    return 'sonnet';
+}
+const router = Router();
+/* ── GET /:agentId/history ── */
+router.get('/:agentId/history', async (req, res) => {
+    const agentId = String(req.params['agentId'] ?? '');
+    const limit = Math.min(parseInt(String(req.query['limit'] ?? '50'), 10) || 50, 200);
+    try {
+        const records = await getCostHistory(agentId, limit);
+        res.json({ status: 'ok', data: records });
+    }
+    catch (err) {
+        res.status(500).json({ status: 'error', error: err instanceof Error ? err.message : String(err) });
+    }
+});
+/* ── GET /:agentId/summary ── */
+router.get('/:agentId/summary', async (req, res) => {
+    const agentId = String(req.params['agentId'] ?? '');
+    try {
+        const records = await getCostHistory(agentId, 200);
+        const totalSpent = records.reduce((s, r) => s + r.costUsd, 0);
+        const runCount = records.length;
+        const avgCostPerRun = runCount > 0 ? totalSpent / runCount : 0;
+        // Model breakdown
+        const modelBreakdown = {};
+        for (const r of records) {
+            const tier = classifyModel(r.model);
+            modelBreakdown[tier] = modelBreakdown[tier] ?? { count: 0, cost: 0 };
+            modelBreakdown[tier].count += 1;
+            modelBreakdown[tier].cost += r.costUsd;
+        }
+        // Cache hit % (cached tokens / total input tokens)
+        const totalInput = records.reduce((s, r) => s + r.inputTokens, 0);
+        const totalCached = records.reduce((s, r) => s + r.cachedTokens, 0);
+        const cacheHitPct = totalInput > 0 ? totalCached / totalInput : 0;
+        res.json({ status: 'ok', data: { totalSpent, runCount, avgCostPerRun, modelBreakdown, cacheHitPct } });
+    }
+    catch (err) {
+        res.status(500).json({ status: 'error', error: err instanceof Error ? err.message : String(err) });
+    }
+});
+/* ── GET /:agentId/budget ── */
+router.get('/:agentId/budget', async (req, res) => {
+    const agentId = String(req.params['agentId'] ?? '');
+    try {
+        const [config, totalSpent] = await Promise.all([getBudgetConfig(agentId), getTotalSpent(agentId)]);
+        res.json({ status: 'ok', data: { ...config, totalSpent } });
+    }
+    catch (err) {
+        res.status(500).json({ status: 'error', error: err instanceof Error ? err.message : String(err) });
+    }
+});
+/* ── PUT /:agentId/budget ── */
+router.put('/:agentId/budget', async (req, res) => {
+    const agentId = String(req.params['agentId'] ?? '');
+    const { budgetLimit, preferredModel, maxModel } = req.body;
+    try {
+        await setBudgetConfig(agentId, { budgetLimit, preferredModel, maxModel });
+        const config = await getBudgetConfig(agentId);
+        res.json({ status: 'ok', data: config });
+    }
+    catch (err) {
+        res.status(500).json({ status: 'error', error: err instanceof Error ? err.message : String(err) });
+    }
+});
+const recordSchema = z.object({
+    model: z.string().min(1),
+    inputTokens: z.number().int().nonnegative(),
+    outputTokens: z.number().int().nonnegative(),
+    costUsd: z.number().nonnegative(),
+    cachedTokens: z.number().int().nonnegative().optional(),
+});
+const agentIdSchema = z.string().min(1);
+/* ── POST /:agentId/record ── */
+router.post('/:agentId/record', async (req, res) => {
+    const agentIdParsed = agentIdSchema.safeParse(req.params['agentId']);
+    if (!agentIdParsed.success) {
+        res.status(400).json({ status: 'error', error: 'agentId is required' });
+        return;
+    }
+    const agentId = agentIdParsed.data;
+    const bodyParsed = recordSchema.safeParse(req.body);
+    if (!bodyParsed.success) {
+        res.status(400).json({ status: 'error', error: bodyParsed.error.issues.map(i => i.message).join(', ') });
+        return;
+    }
+    const { model, inputTokens, outputTokens, costUsd, cachedTokens } = bodyParsed.data;
+    try {
+        await saveCostRecord({
+            agentId,
+            timestamp: new Date().toISOString(),
+            model,
+            inputTokens,
+            outputTokens,
+            costUsd,
+            cachedTokens: cachedTokens ?? 0,
+        });
+        res.json({ status: 'ok' });
+    }
+    catch (err) {
+        res.status(500).json({ status: 'error', error: err instanceof Error ? err.message : String(err) });
+    }
+});
+export default router;

package/dist-server/server/routes/graph.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Context Graph API — Server Routes
+ *
+ * POST /api/graph/scan    — Full or incremental scan
+ * POST /api/graph/query   — Query → entry points → traverse → pack
+ * GET  /api/graph/status  — Graph stats
+ * GET  /api/graph/file/:id — File detail with symbols + relations
+ */
+declare const router: import("express-serve-static-core").Router;
+export default router;
+//# sourceMappingURL=graph.d.ts.map

package/dist-server/server/routes/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../server/routes/graph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,QAAA,MAAM,MAAM,4CAAW,CAAC;AAyNxB,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/graph.js

@@ -0,0 +1,213 @@
+/**
+ * Context Graph API — Server Routes
+ *
+ * POST /api/graph/scan    — Full or incremental scan
+ * POST /api/graph/query   — Query → entry points → traverse → pack
+ * GET  /api/graph/status  — Graph stats
+ * GET  /api/graph/file/:id — File detail with symbols + relations
+ */
+import { Router } from 'express';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+const router = Router();
+// Lazy-init engine (avoid circular imports at module load)
+let engine = null;
+async function getEngine() {
+    if (!engine) {
+        const { ContextGraphEngine } = await import('../../src/graph/index.js');
+        engine = new ContextGraphEngine();
+    }
+    return engine;
+}
+/**
+ * Recursively list files in a directory.
+ */
+function listFiles(dir, rootDir) {
+    const results = [];
+    const IGNORE = /node_modules|\.git|dist|build|\.next|coverage|\.cache/;
+    const MAX_FILE_SIZE = 500_000; // 500KB max per file
+    try {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const fullPath = join(dir, entry.name);
+            if (IGNORE.test(entry.name))
+                continue;
+            if (entry.isDirectory()) {
+                results.push(...listFiles(fullPath, rootDir));
+            }
+            else {
+                const ext = entry.name.split('.').pop()?.toLowerCase() ?? '';
+                if (!['ts', 'tsx', 'js', 'jsx', 'py', 'md', 'mdx', 'yml', 'yaml', 'json'].includes(ext))
+                    continue;
+                try {
+                    const stat = statSync(fullPath);
+                    if (stat.size > MAX_FILE_SIZE)
+                        continue;
+                    const content = readFileSync(fullPath, 'utf-8');
+                    results.push({
+                        path: relative(rootDir, fullPath).replace(/\\/g, '/'),
+                        content,
+                        mtime: stat.mtimeMs,
+                    });
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* skip unreadable dirs */ }
+    return results;
+}
+// POST /api/graph/scan
+router.post('/scan', async (req, res) => {
+    const { rootPath } = req.body;
+    if (!rootPath) {
+        res.status(400).json({ status: 'error', error: 'rootPath is required' });
+        return;
+    }
+    // Security: prevent scanning sensitive directories
+    const normalized = rootPath.replace(/\\/g, '/').toLowerCase();
+    if (normalized.includes('.ssh') || normalized.includes('.gnupg') || normalized.includes('.aws') ||
+        normalized.includes('/etc/') || normalized.includes('system32')) {
+        res.status(403).json({ status: 'error', error: 'Access denied: sensitive directory' });
+        return;
+    }
+    try {
+        const eng = await getEngine();
+        const files = listFiles(rootPath, rootPath);
+        const result = eng.scan(rootPath, files);
+        res.json({ status: 'ok', data: result });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        res.status(500).json({ status: 'error', error: msg });
+    }
+});
+// POST /api/graph/scan-sources — scan from pre-loaded content (any source)
+router.post('/scan-sources', async (req, res) => {
+    const { sources } = req.body;
+    if (!sources || !Array.isArray(sources) || sources.length === 0) {
+        res.status(400).json({ status: 'error', error: 'sources array is required' });
+        return;
+    }
+    try {
+        const eng = await getEngine();
+        const result = eng.scan('(mixed sources)', sources);
+        res.json({ status: 'ok', data: result });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        res.status(500).json({ status: 'error', error: msg });
+    }
+});
+// POST /api/graph/query
+router.post('/query', async (req, res) => {
+    const { query, tokenBudget, taskType } = req.body;
+    if (!query?.trim()) {
+        res.status(400).json({ status: 'error', error: 'query is required' });
+        return;
+    }
+    try {
+        const eng = await getEngine();
+        const packed = eng.query(query, tokenBudget ?? 100000, taskType);
+        const graph = eng.getGraph();
+        // Find entry points for the response
+        const { resolveEntryPoints } = await import('../../src/graph/resolver.js');
+        const entryPoints = resolveEntryPoints(query, graph);
+        res.json({
+            status: 'ok',
+            data: {
+                items: packed.items.map((it) => ({
+                    path: it.file.path,
+                    language: it.file.language,
+                    depth: it.depth,
+                    tokens: it.tokens,
+                    relevance: it.relevance,
+                    symbols: it.file.symbols.map((s) => ({ name: s.name, kind: s.kind, exported: s.isExported })),
+                })),
+                totalTokens: packed.totalTokens,
+                budgetUtilization: packed.budgetUtilization,
+                entryPoints: entryPoints.slice(0, 10).map((ep) => ({
+                    fileId: ep.fileId,
+                    symbol: ep.symbolName,
+                    confidence: ep.confidence,
+                    reason: ep.reason,
+                })),
+            },
+        });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        res.status(500).json({ status: 'error', error: msg });
+    }
+});
+// GET /api/graph/data — full graph (nodes + relations) for visualization
+router.get('/data', async (_req, res) => {
+    try {
+        const eng = await getEngine();
+        const graph = eng.getGraph();
+        const nodes = Array.from(graph.nodes.values());
+        const relations = graph.relations;
+        res.json({
+            status: 'ok',
+            data: { nodes, relations },
+        });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        res.status(500).json({ status: 'error', error: msg });
+    }
+});
+// GET /api/graph/status
+router.get('/status', async (_req, res) => {
+    try {
+        const eng = await getEngine();
+        const stats = eng.getStats();
+        res.json({ status: 'ok', data: stats });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        res.status(500).json({ status: 'error', error: msg });
+    }
+});
+// GET /api/graph/file/:id
+router.get('/file/:id', async (req, res) => {
+    try {
+        const eng = await getEngine();
+        const db = eng.getDB();
+        const node = db.getNode(req.params.id);
+        if (!node) {
+            res.status(404).json({ status: 'error', error: 'File not found' });
+            return;
+        }
+        const outgoing = db.getOutgoing(node.id);
+        const incoming = db.getIncoming(node.id);
+        res.json({
+            status: 'ok',
+            data: {
+                id: node.id,
+                path: node.path,
+                language: node.language,
+                tokens: node.tokens,
+                symbols: node.symbols,
+                outgoing: outgoing.map((r) => ({
+                    targetFile: r.targetFile,
+                    targetPath: db.getNode(r.targetFile)?.path,
+                    kind: r.kind,
+                    weight: r.weight,
+                    targetSymbol: r.targetSymbol,
+                })),
+                incoming: incoming.map((r) => ({
+                    sourceFile: r.sourceFile,
+                    sourcePath: db.getNode(r.sourceFile)?.path,
+                    kind: r.kind,
+                    weight: r.weight,
+                    sourceSymbol: r.sourceSymbol,
+                })),
+            },
+        });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        res.status(500).json({ status: 'error', error: msg });
+    }
+});
+export default router;

package/dist-server/server/routes/lessons.d.ts

@@ -0,0 +1,3 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;
+//# sourceMappingURL=lessons.d.ts.map

package/dist-server/server/routes/lessons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lessons.d.ts","sourceRoot":"","sources":["../../../server/routes/lessons.ts"],"names":[],"mappings":"AAQA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAiLxB,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/lessons.js

@@ -0,0 +1,160 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { readConfig } from '../config.js';
+import { detectCorrection } from '../services/correctionDetector.js';
+import { extractLesson } from '../services/lessonExtractor.js';
+import { saveInstinct, getInstincts, updateConfidence, deleteInstinct } from '../services/sqliteStore.js';
+const router = Router();
+function genId() {
+    return `lesson-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+/** GET /api/lessons/:agentId — all instincts for an agent */
+router.get('/:agentId', async (req, res) => {
+    try {
+        const instincts = await getInstincts(String(req.params['agentId'] ?? ''));
+        res.json({ instincts });
+    }
+    catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : 'Failed to fetch instincts' });
+    }
+});
+/** GET /api/lessons/:agentId/active — only instincts with confidence >= 0.5 */
+router.get('/:agentId/active', async (req, res) => {
+    try {
+        const all = await getInstincts(String(req.params['agentId'] ?? ''));
+        const active = all.filter((i) => i.confidence >= 0.5 && i.status === 'approved');
+        res.json({ instincts: active });
+    }
+    catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : 'Failed to fetch active instincts' });
+    }
+});
+/** PUT /api/lessons/:id/confidence — bump or set confidence */
+router.put('/:id/confidence', async (req, res) => {
+    const { confidence } = req.body;
+    if (typeof confidence !== 'number' || confidence < 0 || confidence > 1) {
+        res.status(400).json({ error: 'confidence must be a number 0–1' });
+        return;
+    }
+    try {
+        await updateConfidence(String(req.params['id'] ?? ''), confidence);
+        res.json({ ok: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : 'Failed to update confidence' });
+    }
+});
+/** DELETE /api/lessons/:id — delete an instinct */
+router.delete('/:id', async (req, res) => {
+    try {
+        await deleteInstinct(String(req.params['id'] ?? ''));
+        res.json({ ok: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : 'Failed to delete instinct' });
+    }
+});
+/** POST /api/lessons/sync-batch — migrate lessons from localStorage to SQLite (dedup by id) */
+router.post('/sync-batch', async (req, res) => {
+    const { lessons } = req.body;
+    if (!Array.isArray(lessons)) {
+        res.status(400).json({ error: 'lessons must be an array' });
+        return;
+    }
+    let saved = 0;
+    for (const l of lessons) {
+        if (!l.id || !l.agentId)
+            continue;
+        try {
+            const now = new Date().toISOString();
+            await saveInstinct({
+                id: l.id,
+                agentId: l.agentId,
+                trigger: (l.sourceUserMessage ?? '').slice(0, 500),
+                action: l.rule ?? '',
+                confidence: typeof l.confidence === 'number' ? l.confidence : 0.30,
+                domain: l.domain ?? 'general',
+                scope: 'agent',
+                evidence: Array.isArray(l.evidence) ? JSON.stringify(l.evidence) : '[]',
+                status: l.status ?? 'pending',
+                createdAt: l.createdAt ? new Date(l.createdAt).toISOString() : now,
+                lastSeenAt: l.lastSeenAt ?? now,
+            });
+            saved++;
+        }
+        catch { /* skip individual failures */ }
+    }
+    res.json({ ok: true, saved });
+});
+const extractSchema = z.object({
+    userMessage: z.string().min(1),
+    previousAssistant: z.string().optional(),
+    providerId: z.string().min(1),
+    model: z.string().min(1),
+    agentId: z.string().optional(),
+});
+/** POST /api/lessons/extract — extract lesson from correction, save to SQLite */
+router.post('/extract', async (req, res) => {
+    const parsed = extractSchema.safeParse(req.body);
+    if (!parsed.success) {
+        res.status(400).json({ error: parsed.error.issues.map(i => i.message).join(', ') });
+        return;
+    }
+    const { userMessage, previousAssistant, providerId, model, agentId } = parsed.data;
+    const correction = detectCorrection(userMessage, previousAssistant ?? '');
+    if (!correction) {
+        res.json({ lesson: null });
+        return;
+    }
+    const config = readConfig();
+    const provider = config.providers.find((p) => p.id === providerId);
+    if (!provider) {
+        res.json({ lesson: null });
+        return;
+    }
+    try {
+        const extracted = await extractLesson(correction, { type: provider.type, baseUrl: provider.baseUrl, apiKey: provider.apiKey }, model);
+        if (!extracted) {
+            res.json({ lesson: null });
+            return;
+        }
+        const now = new Date().toISOString();
+        const id = genId();
+        const effectiveAgentId = agentId ?? '';
+        // Save to SQLite
+        await saveInstinct({
+            id,
+            agentId: effectiveAgentId,
+            trigger: userMessage.slice(0, 500),
+            action: extracted.rule,
+            confidence: extracted.confidence ?? 0.30,
+            domain: extracted.domain ?? 'general',
+            scope: 'agent',
+            evidence: JSON.stringify([{ type: 'correction', timestamp: now, description: 'Extracted from user correction' }]),
+            status: 'pending',
+            createdAt: now,
+            lastSeenAt: now,
+        });
+        const lesson = {
+            id,
+            rule: extracted.rule,
+            category: extracted.category,
+            domain: extracted.domain ?? 'general',
+            confidence: extracted.confidence ?? 0.30,
+            agentId: effectiveAgentId,
+            sourceUserMessage: userMessage,
+            sourcePreviousAssistant: previousAssistant ?? '',
+            createdAt: Date.now(),
+            appliedCount: 0,
+            status: 'pending',
+            evidence: [{ type: 'correction', timestamp: now, description: 'Extracted from user correction' }],
+            lastSeenAt: now,
+        };
+        res.json({ lesson });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Extraction failed';
+        res.status(500).json({ error: message });
+    }
+});
+export default router;

package/dist-server/server/routes/llm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../../server/routes/llm.ts"],"names":[],"mappings":"AAKA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAiSxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../../server/routes/llm.ts"],"names":[],"mappings":"AAMA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA2VxB,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/llm.js

@@ -1,7 +1,55 @@
 import { Router } from 'express';
+import { z } from 'zod';
 import { readConfig } from '../config.js';
 const router = Router();
 const MAX_TOKENS_LIMIT = 32768; // Server-side cap to prevent cost attacks
+// ── SSRF protection ──────────────────────────────────────────────────────────
+function isPrivateHost(hostname) {
+    const h = hostname.toLowerCase();
+    // Loopback and well-known local hostnames
+    if (h === 'localhost' || h === '0.0.0.0')
+        return true;
+    // IPv6 loopback / unique-local (fc00::/7) / link-local (fe80::/10)
+    if (h === '::1' || h === '::' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb'))
+        return true;
+    // IPv4 private/reserved ranges
+    const parts = h.split('.');
+    if (parts.length === 4) {
+        const [a, b] = parts.map(Number);
+        if (isNaN(a) || isNaN(b))
+            return false;
+        if (a === 127)
+            return true; // 127.0.0.0/8 loopback
+        if (a === 10)
+            return true; // 10.0.0.0/8 private
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // 172.16.0.0/12 private
+        if (a === 192 && b === 168)
+            return true; // 192.168.0.0/16 private
+        if (a === 169 && b === 254)
+            return true; // 169.254.0.0/16 link-local
+        if (a === 0)
+            return true; // 0.0.0.0/8 reserved
+    }
+    return false;
+}
+/** Returns an error string if the URL is invalid/blocked, null if allowed. */
+function validateBaseUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return `Invalid URL format: "${url}"`;
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        return `Blocked URL scheme "${parsed.protocol}" — only http/https allowed`;
+    }
+    if (isPrivateHost(parsed.hostname)) {
+        return `Blocked: provider baseUrl "${parsed.hostname}" resolves to a private/reserved address (SSRF prevention)`;
+    }
+    return null;
+}
 function normalizeBaseUrl(providerId, baseUrl) {
     const trimmed = (baseUrl || '').trim().replace(/\/+$/, '');
     if (!trimmed)
@@ -31,6 +79,12 @@ function resolveProvider(providerId, res) {
         res.status(400).json(resp);
         return null;
     }
+    const ssrfError = validateBaseUrl(baseUrl);
+    if (ssrfError) {
+        const resp = { status: 'error', error: ssrfError };
+        res.status(400).json(resp);
+        return null;
+    }
     // Infer provider type from id/baseUrl when type is missing or stale
     const inferredType = provider.type === 'anthropic' ||
         providerId.includes('anthropic') ||
@@ -92,19 +146,25 @@ function buildRequest(resolved, model, messages, opts) {
         }),
     };
 }
+// ── POST /chat — streaming SSE ──
+const chatSchema = z.object({
+    provider: z.string().min(1),
+    model: z.string().min(1),
+    messages: z.array(z.object({ role: z.string(), content: z.unknown() })),
+    temperature: z.number().optional(),
+    maxTokens: z.number().int().positive().optional(),
+});
 router.post('/chat', async (req, res) => {
-    const { provider: providerId, model, messages, temperature, maxTokens: rawMaxTokens, } = req.body;
-    const maxTokens = rawMaxTokens
-        ? Math.min(rawMaxTokens, MAX_TOKENS_LIMIT)
-        : undefined;
-    if (!providerId || !model || !messages) {
-        const resp = {
-            status: 'error',
-            error: 'Missing required fields: provider, model, messages',
-        };
+    const parsed = chatSchema.safeParse(req.body);
+    if (!parsed.success) {
+        const resp = { status: 'error', error: parsed.error.issues.map(i => i.message).join(', ') };
         res.status(400).json(resp);
         return;
     }
+    const { provider: providerId, model, messages, temperature, maxTokens: rawMaxTokens, } = parsed.data;
+    const maxTokens = rawMaxTokens
+        ? Math.min(rawMaxTokens, MAX_TOKENS_LIMIT)
+        : undefined;
     const resolved = resolveProvider(providerId, res);
     if (!resolved)
         return;
@@ -157,19 +217,26 @@ router.post('/chat', async (req, res) => {
         }
     }
 });
+// ── POST /chat-tools — non-streaming JSON (tool loop) ──
+const chatToolsSchema = z.object({
+    provider: z.string().min(1),
+    model: z.string().min(1),
+    messages: z.array(z.unknown()),
+    tools: z.array(z.unknown()).optional(),
+    temperature: z.number().optional(),
+    maxTokens: z.number().int().positive().optional(),
+});
 router.post('/chat-tools', async (req, res) => {
-    const { provider: providerId, model, messages, tools, temperature, maxTokens: rawMaxTokens, } = req.body;
-    const maxTokens = rawMaxTokens
-        ? Math.min(rawMaxTokens, MAX_TOKENS_LIMIT)
-        : undefined;
-    if (!providerId || !model || !messages) {
-        const resp = {
-            status: 'error',
-            error: 'Missing required fields: provider, model, messages',
-        };
+    const parsed = chatToolsSchema.safeParse(req.body);
+    if (!parsed.success) {
+        const resp = { status: 'error', error: parsed.error.issues.map(i => i.message).join(', ') };
         res.status(400).json(resp);
         return;
     }
+    const { provider: providerId, model, messages, tools, temperature, maxTokens: rawMaxTokens, } = parsed.data;
+    const maxTokens = rawMaxTokens
+        ? Math.min(rawMaxTokens, MAX_TOKENS_LIMIT)
+        : undefined;
     const resolved = resolveProvider(providerId, res);
     if (!resolved)
         return;

package/dist-server/server/routes/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../server/routes/memory.ts"],"names":[],"mappings":"AASA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAmSxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../server/routes/memory.ts"],"names":[],"mappings":"AAUA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA8TxB,eAAe,MAAM,CAAC"}