repoburg 1.3.202 → 1.3.209

package/agent-pane/backend/src/routes/skills.ts

@@ -1,70 +0,0 @@
-import type { FastifyInstance } from 'fastify';
-import { readFileSync } from 'node:fs';
-import type { Extension } from '@agentpane/shared';
-import { getSharedAppServer } from '../codex/shared-app-server.ts';
-import type { SkillsListResult, AppServerSkill } from '../codex/app-server-types.ts';
-
-/** Map an app-server skill to the shared Extension type. */
-function mapSkill(skill: AppServerSkill): Extension {
-  return {
-    id: skill.name,
-    name: skill.interface?.displayName ?? skill.name,
-    description: skill.shortDescription ?? skill.interface?.shortDescription ?? skill.description,
-    type: 'skill',
-    enabled: skill.enabled,
-    metadata: {
-      scope: skill.scope,
-      path: skill.path,
-    },
-  };
-}
-
-/** Register skill routes. */
-export async function registerSkillRoutes(fastify: FastifyInstance): Promise<void> {
-  // GET /api/skills — list all skills from the app-server
-  fastify.get<{ Querystring: { cwd?: string } }>('/api/skills', async (request) => {
-    const cwd = request.query.cwd ?? process.cwd();
-    const result = await getSharedAppServer().request<SkillsListResult>('skills/list', { cwds: [cwd] });
-
-    // Flatten all skills from all cwds in the response
-    const allSkills: Extension[] = [];
-    for (const entry of result.data) {
-      for (const skill of entry.skills) {
-        allSkills.push(mapSkill(skill));
-      }
-    }
-    return allSkills;
-  });
-
-  // GET /api/skills/:name — get full SKILL.md content
-  fastify.get<{ Params: { name: string }; Querystring: { cwd?: string } }>(
-    '/api/skills/:name',
-    async (request, reply) => {
-      const { name } = request.params;
-      const cwd = request.query.cwd ?? process.cwd();
-
-      // Fetch skills list to find the path for this skill
-      const result = await getSharedAppServer().request<SkillsListResult>('skills/list', { cwds: [cwd] });
-
-      let skillPath: string | null = null;
-      for (const entry of result.data) {
-        const skill = entry.skills.find((s) => s.name === name);
-        if (skill) {
-          skillPath = skill.path;
-          break;
-        }
-      }
-
-      if (!skillPath) {
-        return reply.code(404).send({ error: 'Skill not found' });
-      }
-
-      try {
-        const content = readFileSync(skillPath, 'utf-8');
-        return { name, content, path: skillPath };
-      } catch {
-        return reply.code(500).send({ error: 'Failed to read skill' });
-      }
-    },
-  );
-}

package/agent-pane/backend/src/routes/threads.ts

@@ -1,323 +0,0 @@
-import type { FastifyInstance } from 'fastify';
-import { v4 as uuidv4 } from 'uuid';
-import { getDb } from '../db/index.ts';
-import { getProvider } from '../providers/registry.ts';
-import { broadcast } from '../ws/index.ts';
-import type { Session, Turn, DiscussionThread } from '../db/schema.ts';
-
-/** Raw DB row for turns — token_usage is a JSON string, not parsed; no items field. */
-interface TurnRow extends Omit<Turn, 'token_usage' | 'items'> {
-  token_usage: string | null;
-}
-
-/** Raw DB row for items — data is a JSON string, not parsed. */
-interface ItemRow extends Omit<Turn['items'][number], 'data'> {
-  data: string | null;
-}
-
-export async function registerThreadRoutes(fastify: FastifyInstance): Promise<void> {
-  // POST /api/sessions/:sessionId/threads — create thread + first AI turn
-  fastify.post<{
-    Params: { sessionId: string };
-    Body: {
-      itemId: string;
-      turnId: string;
-      startOffset: number;
-      endOffset: number;
-      selectedText: string;
-      message: string;
-    };
-  }>(
-    '/api/sessions/:sessionId/threads',
-    {
-      schema: {
-        body: {
-          type: 'object',
-          required: ['itemId', 'turnId', 'startOffset', 'endOffset', 'selectedText', 'message'],
-          properties: {
-            itemId: { type: 'string' },
-            turnId: { type: 'string' },
-            startOffset: { type: 'number' },
-            endOffset: { type: 'number' },
-            selectedText: { type: 'string' },
-            message: { type: 'string', minLength: 1 },
-          },
-        },
-      },
-    },
-    async (request, reply) => {
-      const { sessionId } = request.params;
-      const { itemId, turnId, startOffset, endOffset, selectedText, message } = request.body || {};
-
-      const db = getDb();
-      const session = db.prepare('SELECT * FROM sessions WHERE id = ?').get(sessionId) as Session | undefined;
-      if (!session) {
-        return reply.code(404).send({ error: 'Session not found' });
-      }
-      if (session.is_running) {
-        return reply.code(409).send({ error: 'A turn is already running for this session' });
-      }
-
-      const threadId = uuidv4();
-      const now = new Date().toISOString();
-
-      // 1. Create the discussion thread row
-      db.prepare(
-        `INSERT INTO discussion_threads (id, session_id, item_id, turn_id, start_offset, end_offset, selected_text, status, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, 'open', ?, ?)`,
-      ).run(threadId, sessionId, itemId, turnId, startOffset, endOffset, selectedText, now, now);
-
-      // 1b. Fork the Claude session at the anchor turn so the thread has its own
-      //     isolated conversation — main session context stays unaffected.
-      const provider = getProvider(session.runtime_type);
-      if (provider.forkSession) {
-        try {
-          if (!session.external_thread_id) {
-            // No main session to fork from — the thread will start a fresh
-            // isolated session (startTurn skips the resume fallback), so the
-            // main session is never contaminated.
-            console.warn(`[threads] cannot fork for thread ${threadId}: session ${sessionId} has no external_thread_id — thread will start a fresh isolated session`);
-          } else {
-            const anchorTurn = db.prepare('SELECT * FROM turns WHERE id = ?').get(turnId) as Turn | undefined;
-            if (anchorTurn) {
-              const forkedSessionId = await provider.forkSession(session, anchorTurn);
-              if (forkedSessionId) {
-                db.prepare('UPDATE discussion_threads SET external_thread_id = ? WHERE id = ?').run(forkedSessionId, threadId);
-                console.log(`[threads] forked to ${forkedSessionId} for thread ${threadId} (session ${sessionId})`);
-              } else {
-                // forkSession returned null — thread will start a fresh isolated
-                // session in startTurn (NOT the main session), so isolation holds.
-                console.warn(`[threads] forkSession returned null for thread ${threadId} (external_thread_id=${session.external_thread_id}, upToMessageId=${anchorTurn.external_turn_id}) — thread will start a fresh isolated session`);
-              }
-            } else {
-              console.warn(`[threads] anchor turn ${turnId} not found for thread ${threadId} — cannot fork`);
-            }
-          }
-        } catch (err) {
-          console.error(`[threads] forkSession failed for thread ${threadId}:`, err);
-          // Non-fatal — thread falls back to a fresh isolated session (NOT the
-          // main session) so the main conversation is never contaminated.
-        }
-      }
-
-      // 2. Format prompt with quoted text for AI context
-      const formattedPrompt = `[Quoting from your previous response]:\n> ${selectedText}\n\n${message}`;
-
-      // 3. Create the turn row with thread_id
-      const newTurnId = uuidv4();
-      db.prepare(
-        `INSERT INTO turns (id, session_id, user_prompt, agent_response, thoughts, token_usage, external_turn_id, status, error, thread_id, created_at, updated_at)
-         VALUES (?, ?, ?, NULL, NULL, NULL, NULL, 'pending', NULL, ?, ?, ?)`,
-      ).run(newTurnId, sessionId, formattedPrompt, threadId, now, now);
-
-      const turn = db.prepare('SELECT * FROM turns WHERE id = ?').get(newTurnId) as Turn;
-
-      // 4. Start the AI turn (fire and forget — events stream via WS)
-      provider
-        .startTurn(session, turn)
-        .catch((err) => {
-          console.error(`[threads] Unhandled error for session ${sessionId}:`, err);
-        });
-
-      // 5. Build the thread response
-      const threadRow = db.prepare('SELECT * FROM discussion_threads WHERE id = ?').get(threadId) as DiscussionThread;
-      const thread: DiscussionThread = {
-        ...threadRow,
-        turns: [{ ...turn, items: [] }],
-      };
-
-      // 6. Broadcast thread creation
-      broadcast('thread:created', { sessionId, thread, turn });
-
-      return { thread, turn };
-    },
-  );
-
-  // POST /api/sessions/:sessionId/threads/:threadId/followup — add follow-up message to thread
-  fastify.post<{
-    Params: { sessionId: string; threadId: string };
-    Body: { message: string };
-  }>(
-    '/api/sessions/:sessionId/threads/:threadId/followup',
-    {
-      schema: {
-        body: {
-          type: 'object',
-          required: ['message'],
-          properties: {
-            message: { type: 'string', minLength: 1 },
-          },
-        },
-      },
-    },
-    async (request, reply) => {
-      const { sessionId, threadId } = request.params;
-      const { message } = request.body || {};
-
-      const db = getDb();
-      const session = db.prepare('SELECT * FROM sessions WHERE id = ?').get(sessionId) as Session | undefined;
-      if (!session) {
-        return reply.code(404).send({ error: 'Session not found' });
-      }
-      if (session.is_running) {
-        return reply.code(409).send({ error: 'A turn is already running for this session' });
-      }
-
-      const thread = db
-        .prepare('SELECT * FROM discussion_threads WHERE id = ? AND session_id = ?')
-        .get(threadId, sessionId) as DiscussionThread | undefined;
-      if (!thread) {
-        return reply.code(404).send({ error: 'Thread not found' });
-      }
-      if (thread.status !== 'open') {
-        return reply.code(409).send({ error: 'Thread is resolved — reopen it first' });
-      }
-
-      // Create new turn with same thread_id
-      const newTurnId = uuidv4();
-      const now = new Date().toISOString();
-      db.prepare(
-        `INSERT INTO turns (id, session_id, user_prompt, agent_response, thoughts, token_usage, external_turn_id, status, error, thread_id, created_at, updated_at)
-         VALUES (?, ?, ?, NULL, NULL, NULL, NULL, 'pending', NULL, ?, ?, ?)`,
-      ).run(newTurnId, sessionId, message, threadId, now, now);
-
-      const turn = db.prepare('SELECT * FROM turns WHERE id = ?').get(newTurnId) as Turn;
-
-      // Start the AI turn
-      getProvider(session.runtime_type)
-        .startTurn(session, turn)
-        .catch((err) => {
-          console.error(`[threads] followup error for session ${sessionId}:`, err);
-        });
-
-      broadcast('thread:followup', { sessionId, threadId, turn });
-
-      return { turn };
-    },
-  );
-
-  // PATCH /api/sessions/:sessionId/threads/:threadId — resolve or reopen
-  fastify.patch<{
-    Params: { sessionId: string; threadId: string };
-    Body: { status: 'resolved' | 'open' };
-  }>(
-    '/api/sessions/:sessionId/threads/:threadId',
-    {
-      schema: {
-        body: {
-          type: 'object',
-          required: ['status'],
-          properties: {
-            status: { type: 'string', enum: ['resolved', 'open'] },
-          },
-        },
-      },
-    },
-    async (request, reply) => {
-      const { sessionId, threadId } = request.params;
-      const { status } = request.body || {};
-
-      const db = getDb();
-      const thread = db
-        .prepare('SELECT * FROM discussion_threads WHERE id = ? AND session_id = ?')
-        .get(threadId, sessionId) as DiscussionThread | undefined;
-      if (!thread) {
-        return reply.code(404).send({ error: 'Thread not found' });
-      }
-
-      const now = new Date().toISOString();
-      const resolvedAt = status === 'resolved' ? now : null;
-      db.prepare(
-        'UPDATE discussion_threads SET status = ?, resolved_at = ?, updated_at = ? WHERE id = ?',
-      ).run(status, resolvedAt, now, threadId);
-
-      broadcast('thread:resolved', { sessionId, threadId, status });
-
-      return { id: threadId, status, resolved_at: resolvedAt };
-    },
-  );
-
-  // DELETE /api/sessions/:sessionId/threads/:threadId — delete thread + its turns + items
-  fastify.delete<{ Params: { sessionId: string; threadId: string } }>(
-    '/api/sessions/:sessionId/threads/:threadId',
-    async (request, reply) => {
-      const { sessionId, threadId } = request.params;
-      const db = getDb();
-
-      const thread = db
-        .prepare('SELECT id FROM discussion_threads WHERE id = ? AND session_id = ?')
-        .get(threadId, sessionId);
-      if (!thread) {
-        return reply.code(404).send({ error: 'Thread not found' });
-      }
-
-      // Clean up the thread's branched session entry (Claude provider)
-      const session = db.prepare('SELECT runtime_type FROM sessions WHERE id = ?').get(sessionId) as { runtime_type: string } | undefined;
-      if (session) {
-        const provider = getProvider(session.runtime_type);
-        provider.clearThreadBranch?.(sessionId, threadId);
-      }
-
-      // Delete items belonging to turns in this thread
-      db.prepare(
-        'DELETE FROM items WHERE turn_id IN (SELECT id FROM turns WHERE thread_id = ?)',
-      ).run(threadId);
-      // Delete turns in this thread
-      db.prepare('DELETE FROM turns WHERE thread_id = ?').run(threadId);
-      // Delete the thread row
-      db.prepare('DELETE FROM discussion_threads WHERE id = ?').run(threadId);
-
-      broadcast('thread:deleted', { sessionId, threadId });
-
-      return { success: true };
-    },
-  );
-
-  // GET /api/sessions/:sessionId/threads — list all threads with their turns
-  fastify.get<{ Params: { sessionId: string } }>('/api/sessions/:sessionId/threads', async (request, reply) => {
-    const { sessionId } = request.params;
-    const db = getDb();
-
-    const session = db.prepare('SELECT id FROM sessions WHERE id = ?').get(sessionId);
-    if (!session) {
-      return reply.code(404).send({ error: 'Session not found' });
-    }
-
-    const threadRows = db
-      .prepare('SELECT * FROM discussion_threads WHERE session_id = ? ORDER BY created_at ASC')
-      .all(sessionId) as DiscussionThread[];
-
-    // Attach turns + items for each thread
-    const result: DiscussionThread[] = [];
-    for (const tr of threadRows) {
-      const turnRows = db
-        .prepare('SELECT * FROM turns WHERE thread_id = ? ORDER BY created_at ASC')
-        .all(tr.id) as TurnRow[];
-
-      const itemRows = db
-        .prepare(
-          'SELECT * FROM items WHERE turn_id IN (SELECT id FROM turns WHERE thread_id = ?) ORDER BY created_at ASC',
-        )
-        .all(tr.id) as ItemRow[];
-
-      const itemsByTurn = new Map<string, Turn['items']>();
-      for (const row of itemRows) {
-        const item = { ...row, data: row.data ? JSON.parse(row.data) : null };
-        const list = itemsByTurn.get(item.turn_id) ?? [];
-        list.push(item);
-        itemsByTurn.set(item.turn_id, list);
-      }
-
-      result.push({
-        ...tr,
-        turns: turnRows.map((row) => ({
-          ...row,
-          token_usage: row.token_usage ? JSON.parse(row.token_usage) : null,
-          items: itemsByTurn.get(row.id) ?? [],
-        })),
-      });
-    }
-
-    return result;
-  });
-}

package/agent-pane/backend/src/routes/turns.test.ts

@@ -1,196 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import Fastify, { type FastifyInstance } from 'fastify';
-import { initDb, getDb } from '../db/index.ts';
-import { registerTurnRoutes } from './turns.ts';
-
-// Mock registry to avoid spawning real provider processes
-const mocks = vi.hoisted(() => ({
-  startTurn: vi.fn().mockResolvedValue(undefined),
-  interruptTurn: vi.fn().mockResolvedValue(true),
-  clearThread: vi.fn(),
-  clearAllThreads: vi.fn(),
-  getModels: vi.fn().mockResolvedValue([]),
-  shutdown: vi.fn().mockResolvedValue(undefined),
-}));
-
-vi.mock('../providers/registry.ts', () => ({
-  getProvider: vi.fn(() => ({
-    startTurn: mocks.startTurn,
-    interruptTurn: mocks.interruptTurn,
-    clearThread: mocks.clearThread,
-    clearAllThreads: mocks.clearAllThreads,
-    getModels: mocks.getModels,
-    shutdown: mocks.shutdown,
-  })),
-  hasProvider: vi.fn(() => true),
-}));
-
-const NOW = '2025-01-01T00:00:00Z';
-
-function insertSession(db: ReturnType<typeof getDb>, id: string, overrides: Record<string, unknown> = {}): void {
-  db.prepare(
-    `INSERT INTO sessions (id, title, runtime_type, model, model_reasoning_effort, cwd, external_thread_id, status, is_running, lifecycle, has_unreviewed, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-  ).run(
-    id,
-    null,
-    'codex',
-    null,
-    null,
-    null,
-    (overrides['external_thread_id'] as string | null) ?? null,
-    (overrides['status'] as string) ?? 'active',
-    (overrides['is_running'] as number) ?? 0,
-    'working',
-    0,
-    NOW,
-    NOW,
-  );
-}
-
-describe('Turn routes', () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    vi.clearAllMocks();
-    initDb(':memory:');
-    // Mirror the production Fastify config (index.ts) — bodyLimit must exceed the
-    // default 1 MiB so base64 image attachments fit in the JSON body.
-    app = Fastify({ bodyLimit: 50 * 1024 * 1024 });
-    await registerTurnRoutes(app);
-  });
-
-  describe('POST /api/sessions/:id/turns', () => {
-    it('returns 400 when user_prompt is missing', async () => {
-      const res = await app.inject({ method: 'POST', url: '/api/sessions/s1/turns', payload: {} });
-      expect(res.statusCode).toBe(400);
-    });
-
-    it('returns 400 when user_prompt has wrong type', async () => {
-      const res = await app.inject({
-        method: 'POST',
-        url: '/api/sessions/s1/turns',
-        payload: { user_prompt: { nested: true } },
-      });
-      expect(res.statusCode).toBe(400);
-    });
-
-    it('returns 400 when user_prompt is empty', async () => {
-      const res = await app.inject({
-        method: 'POST',
-        url: '/api/sessions/s1/turns',
-        payload: { user_prompt: '   ' },
-      });
-      expect(res.statusCode).toBe(400);
-    });
-
-    it('returns 404 for missing session', async () => {
-      const res = await app.inject({
-        method: 'POST',
-        url: '/api/sessions/nonexistent/turns',
-        payload: { user_prompt: 'hello' },
-      });
-      expect(res.statusCode).toBe(404);
-    });
-
-    it('returns 409 when session is already running', async () => {
-      const db = getDb();
-      insertSession(db, 's1', { is_running: 1 });
-      const res = await app.inject({
-        method: 'POST',
-        url: '/api/sessions/s1/turns',
-        payload: { user_prompt: 'hello' },
-      });
-      expect(res.statusCode).toBe(409);
-    });
-
-    it('creates a turn and calls startTurn', async () => {
-      const db = getDb();
-      insertSession(db, 's1');
-      mocks.startTurn.mockResolvedValue(undefined);
-      const res = await app.inject({
-        method: 'POST',
-        url: '/api/sessions/s1/turns',
-        payload: { user_prompt: 'hello' },
-      });
-      expect(res.statusCode).toBe(200);
-      const turn = res.json();
-      expect(turn.id).toBeDefined();
-      expect(turn.user_prompt).toBe('hello');
-      expect(turn.status).toBe('pending');
-
-      expect(mocks.startTurn).toHaveBeenCalledTimes(1);
-      const [sessionArg, turnArg] = mocks.startTurn.mock.calls[0];
-      expect(sessionArg.id).toBe('s1');
-      expect(turnArg.user_prompt).toBe('hello');
-    });
-
-    it('accepts a large base64 image attachment (>1 MiB) — regression for 413 Payload Too Large', async () => {
-      const db = getDb();
-      insertSession(db, 's1');
-      // ~2 MB of base64 — exceeds Fastify's default 1 MiB bodyLimit; the production
-      // server (index.ts) raises it to 50 MB so image attachments fit.
-      const bigBase64 = 'A'.repeat(2 * 1024 * 1024);
-      const res = await app.inject({
-        method: 'POST',
-        url: '/api/sessions/s1/turns',
-        payload: {
-          user_prompt: 'look at this',
-          attachments: [{ name: 'shot.png', media_type: 'image/png', data: bigBase64 }],
-        },
-      });
-      expect(res.statusCode).toBe(200);
-      const turn = res.json();
-      expect(turn.attachments).toEqual([{ name: 'shot.png', media_type: 'image/png', data: bigBase64 }]);
-      const [, turnArg] = mocks.startTurn.mock.calls[0];
-      // startTurn receives the raw DB row — attachments is still a JSON string there.
-      expect(typeof turnArg.attachments).toBe('string');
-      expect(JSON.parse(turnArg.attachments)).toEqual([{ name: 'shot.png', media_type: 'image/png', data: bigBase64 }]);
-    });
-
-    it('returns 413 on the default 1 MiB bodyLimit — documents why index.ts raises it', async () => {
-      const db = getDb();
-      insertSession(db, 's1');
-      const defaultApp = Fastify(); // default bodyLimit = 1 MiB
-      await registerTurnRoutes(defaultApp);
-      const bigBase64 = 'A'.repeat(2 * 1024 * 1024);
-      const res = await defaultApp.inject({
-        method: 'POST',
-        url: '/api/sessions/s1/turns',
-        payload: {
-          user_prompt: 'look at this',
-          attachments: [{ name: 'shot.png', media_type: 'image/png', data: bigBase64 }],
-        },
-      });
-      expect(res.statusCode).toBe(413);
-      expect(mocks.startTurn).not.toHaveBeenCalled();
-      await defaultApp.close();
-    });
-  });
-
-  describe('POST /api/sessions/:id/cancel', () => {
-    it('returns 404 for missing session', async () => {
-      const res = await app.inject({ method: 'POST', url: '/api/sessions/nonexistent/cancel' });
-      expect(res.statusCode).toBe(404);
-    });
-
-    it('returns 409 when no running turn', async () => {
-      const db = getDb();
-      insertSession(db, 's1');
-      mocks.interruptTurn.mockResolvedValue(false);
-      const res = await app.inject({ method: 'POST', url: '/api/sessions/s1/cancel' });
-      expect(res.statusCode).toBe(409);
-      expect(res.json().error).toBe('No running turn to cancel');
-    });
-
-    it('returns success when turn is cancelled', async () => {
-      const db = getDb();
-      insertSession(db, 's1');
-      mocks.interruptTurn.mockResolvedValue(true);
-      const res = await app.inject({ method: 'POST', url: '/api/sessions/s1/cancel' });
-      expect(res.statusCode).toBe(200);
-      expect(res.json()).toEqual({ success: true });
-      expect(mocks.interruptTurn).toHaveBeenCalledWith('s1');
-    });
-  });
-});

package/agent-pane/backend/src/routes/turns.ts

@@ -1,103 +0,0 @@
-import type { FastifyInstance } from 'fastify';
-import { v4 as uuidv4 } from 'uuid';
-import { getDb } from '../db/index.ts';
-import { getProvider } from '../providers/registry.ts';
-import type { Session, Turn, Attachment } from '../db/schema.ts';
-
-export async function registerTurnRoutes(fastify: FastifyInstance): Promise<void> {
-  // POST /api/sessions/:id/turns — submit prompt, starts a turn
-  fastify.post<{
-    Params: { id: string };
-    Body: { user_prompt: string; attachments?: Attachment[] };
-  }>(
-    '/api/sessions/:id/turns',
-    {
-      schema: {
-        body: {
-          type: 'object',
-          required: ['user_prompt'],
-          properties: {
-            user_prompt: { type: 'string', minLength: 1 },
-            attachments: {
-              type: 'array',
-              items: {
-                type: 'object',
-                required: ['name', 'media_type', 'data'],
-                properties: {
-                  name: { type: 'string' },
-                  media_type: { type: 'string' },
-                  data: { type: 'string' },
-                },
-              },
-            },
-          },
-        },
-      },
-    },
-    async (request, reply) => {
-      const { id } = request.params;
-      const { user_prompt, attachments } = request.body || {};
-
-      if (!user_prompt || !user_prompt.trim()) {
-        return reply.code(400).send({ error: 'user_prompt is required' });
-      }
-
-      const db = getDb();
-      const session = db.prepare('SELECT * FROM sessions WHERE id = ?').get(id) as Session | undefined;
-      if (!session) {
-        return reply.code(404).send({ error: 'Session not found' });
-      }
-
-      if (session.is_running) {
-        return reply.code(409).send({ error: 'A turn is already running for this session' });
-      }
-
-      // Create turn in DB — store attachments as JSON if provided
-      const turnId = uuidv4();
-      const now = new Date().toISOString();
-      const attachmentsJson = attachments && attachments.length > 0 ? JSON.stringify(attachments) : null;
-      db.prepare(
-        `INSERT INTO turns (id, session_id, user_prompt, agent_response, thoughts, token_usage, external_turn_id, status, error, attachments, created_at, updated_at)
-         VALUES (?, ?, ?, NULL, NULL, NULL, NULL, 'pending', NULL, ?, ?, ?)`,
-      ).run(turnId, id, user_prompt, attachmentsJson, now, now);
-
-      const turn = db.prepare('SELECT * FROM turns WHERE id = ?').get(turnId) as Turn;
-
-      // Parse attachments from JSON string (DB stores as TEXT) before returning to frontend
-      const rawTurn = turn as Turn & { attachments: string | null };
-      const parsedTurn: Turn = {
-        ...turn,
-        attachments: rawTurn.attachments ? (JSON.parse(rawTurn.attachments) as Attachment[]) : null,
-      };
-
-      // Fire and forget — events stream via WebSocket
-      getProvider(session.runtime_type)
-        .startTurn(session, rawTurn)
-        .catch((err) => {
-          console.error(`[provider] Unhandled error for session ${id}:`, err);
-        });
-
-      return parsedTurn;
-    },
-  );
-
-  // POST /api/sessions/:id/cancel — cancel running turn
-  fastify.post<{ Params: { id: string } }>('/api/sessions/:id/cancel', async (request, reply) => {
-    const { id } = request.params;
-    const db = getDb();
-
-    // Look up session to get runtime_type for provider dispatch
-    const session = db.prepare('SELECT runtime_type FROM sessions WHERE id = ?').get(id) as
-      | { runtime_type: string }
-      | undefined;
-    if (!session) {
-      return reply.code(404).send({ error: 'Session not found' });
-    }
-
-    const cancelled = await getProvider(session.runtime_type).interruptTurn(id);
-    if (!cancelled) {
-      return reply.code(409).send({ error: 'No running turn to cancel' });
-    }
-    return { success: true };
-  });
-}