stagent 0.1.0

package/src/app/api/documents/[id]/route.ts

@@ -0,0 +1,123 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { documents, tasks, projects } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { unlink } from "fs/promises";
+import { z } from "zod/v4";
+
+const documentPatchSchema = z.object({
+  taskId: z.string().uuid().nullable().optional(),
+  projectId: z.string().uuid().nullable().optional(),
+  category: z.string().max(100).optional(),
+});
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  const [doc] = await db
+    .select({
+      id: documents.id,
+      taskId: documents.taskId,
+      projectId: documents.projectId,
+      filename: documents.filename,
+      originalName: documents.originalName,
+      mimeType: documents.mimeType,
+      size: documents.size,
+      storagePath: documents.storagePath,
+      version: documents.version,
+      direction: documents.direction,
+      category: documents.category,
+      status: documents.status,
+      extractedText: documents.extractedText,
+      processedPath: documents.processedPath,
+      processingError: documents.processingError,
+      createdAt: documents.createdAt,
+      updatedAt: documents.updatedAt,
+      taskTitle: tasks.title,
+      projectName: projects.name,
+    })
+    .from(documents)
+    .leftJoin(tasks, eq(documents.taskId, tasks.id))
+    .leftJoin(projects, eq(documents.projectId, projects.id))
+    .where(eq(documents.id, id));
+
+  if (!doc) {
+    return NextResponse.json({ error: "Document not found" }, { status: 404 });
+  }
+
+  return NextResponse.json(doc);
+}
+
+export async function PATCH(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const raw = await req.json();
+  const parsed = documentPatchSchema.safeParse(raw);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid request body", details: parsed.error.issues },
+      { status: 400 }
+    );
+  }
+
+  const body = parsed.data;
+
+  const [doc] = await db
+    .select()
+    .from(documents)
+    .where(eq(documents.id, id));
+
+  if (!doc) {
+    return NextResponse.json({ error: "Document not found" }, { status: 404 });
+  }
+
+  const updates: Record<string, unknown> = { updatedAt: new Date() };
+
+  if ("taskId" in body) updates.taskId = body.taskId;
+  if ("projectId" in body) updates.projectId = body.projectId;
+  if ("category" in body) updates.category = body.category;
+
+  await db
+    .update(documents)
+    .set(updates)
+    .where(eq(documents.id, id));
+
+  const [updated] = await db
+    .select()
+    .from(documents)
+    .where(eq(documents.id, id));
+
+  return NextResponse.json(updated);
+}
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  const [doc] = await db
+    .select()
+    .from(documents)
+    .where(eq(documents.id, id));
+
+  if (!doc) {
+    return NextResponse.json({ error: "Document not found" }, { status: 404 });
+  }
+
+  try {
+    await unlink(doc.storagePath);
+  } catch {
+    // File may already be deleted
+  }
+
+  await db.delete(documents).where(eq(documents.id, id));
+
+  return new NextResponse(null, { status: 204 });
+}

package/src/app/api/documents/route.ts

@@ -0,0 +1,59 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { documents, tasks, projects } from "@/lib/db/schema";
+import { eq, and, like, or, desc, sql } from "drizzle-orm";
+
+export async function GET(req: NextRequest) {
+  const url = new URL(req.url);
+  const taskId = url.searchParams.get("taskId");
+  const projectId = url.searchParams.get("projectId");
+  const status = url.searchParams.get("status");
+  const direction = url.searchParams.get("direction");
+  const search = url.searchParams.get("search");
+
+  const conditions = [];
+
+  if (taskId) conditions.push(eq(documents.taskId, taskId));
+  if (projectId) conditions.push(eq(documents.projectId, projectId));
+  if (status) conditions.push(eq(documents.status, status as "uploaded" | "processing" | "ready" | "error"));
+  if (direction) conditions.push(eq(documents.direction, direction as "input" | "output"));
+
+  if (search) {
+    conditions.push(
+      or(
+        like(documents.originalName, `%${search}%`),
+        like(documents.extractedText, `%${search}%`)
+      )
+    );
+  }
+
+  const result = await db
+    .select({
+      id: documents.id,
+      taskId: documents.taskId,
+      projectId: documents.projectId,
+      filename: documents.filename,
+      originalName: documents.originalName,
+      mimeType: documents.mimeType,
+      size: documents.size,
+      storagePath: documents.storagePath,
+      version: documents.version,
+      direction: documents.direction,
+      category: documents.category,
+      status: documents.status,
+      extractedText: documents.extractedText,
+      processedPath: documents.processedPath,
+      processingError: documents.processingError,
+      createdAt: documents.createdAt,
+      updatedAt: documents.updatedAt,
+      taskTitle: tasks.title,
+      projectName: projects.name,
+    })
+    .from(documents)
+    .leftJoin(tasks, eq(documents.taskId, tasks.id))
+    .leftJoin(projects, eq(documents.projectId, projects.id))
+    .where(conditions.length > 0 ? and(...conditions) : undefined)
+    .orderBy(desc(documents.createdAt));
+
+  return NextResponse.json(result);
+}

package/src/app/api/logs/stream/route.ts

@@ -0,0 +1,101 @@
+import { NextRequest } from "next/server";
+import { db } from "@/lib/db";
+import { agentLogs } from "@/lib/db/schema";
+import { eq, and, gt, desc } from "drizzle-orm";
+
+export async function GET(req: NextRequest) {
+  const url = new URL(req.url);
+  const taskId = url.searchParams.get("taskId");
+  const eventType = url.searchParams.get("eventType");
+
+  const encoder = new TextEncoder();
+  let lastTimestamp = new Date(0);
+  let closed = false;
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      const send = (data: string) => {
+        if (closed) return;
+        try {
+          controller.enqueue(encoder.encode(`data: ${data}\n\n`));
+        } catch {
+          closed = true;
+        }
+      };
+
+      const poll = async () => {
+        while (!closed) {
+          try {
+            const conditions = [gt(agentLogs.timestamp, lastTimestamp)];
+            if (taskId) conditions.push(eq(agentLogs.taskId, taskId));
+            if (eventType) conditions.push(eq(agentLogs.event, eventType));
+
+            const logs = await db
+              .select()
+              .from(agentLogs)
+              .where(and(...conditions))
+              .orderBy(agentLogs.timestamp)
+              .limit(50);
+
+            for (const log of logs) {
+              send(JSON.stringify(log));
+              if (log.timestamp > lastTimestamp) {
+                lastTimestamp = log.timestamp;
+              }
+            }
+          } catch (err) {
+            console.error("[SSE /logs/stream] DB poll error:", err);
+            send(JSON.stringify({ type: "error", message: "Database query failed" }));
+            // Back off on error before retrying
+            await new Promise((resolve) => setTimeout(resolve, 2000));
+            continue;
+          }
+
+          await new Promise((resolve) => setTimeout(resolve, 500));
+        }
+      };
+
+      const keepalive = setInterval(() => {
+        if (closed) {
+          clearInterval(keepalive);
+          return;
+        }
+        try {
+          controller.enqueue(encoder.encode(": keepalive\n\n"));
+        } catch {
+          closed = true;
+          clearInterval(keepalive);
+        }
+      }, 15_000);
+
+      req.signal.addEventListener("abort", () => {
+        closed = true;
+        clearInterval(keepalive);
+        try {
+          controller.close();
+        } catch {
+          // Already closed
+        }
+      });
+
+      poll().catch((err) => {
+        console.error("[SSE /logs/stream] poll loop error:", err);
+        closed = true;
+        clearInterval(keepalive);
+        try {
+          controller.close();
+        } catch {
+          // Already closed
+        }
+      });
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    },
+  });
+}

package/src/app/api/notifications/[id]/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { notifications } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+
+export async function PATCH(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const body = await req.json();
+
+  await db
+    .update(notifications)
+    .set({ read: body.read ?? true })
+    .where(eq(notifications.id, id));
+
+  const [updated] = await db
+    .select()
+    .from(notifications)
+    .where(eq(notifications.id, id));
+
+  if (!updated) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  return NextResponse.json(updated);
+}
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  await db.delete(notifications).where(eq(notifications.id, id));
+  return NextResponse.json({ success: true });
+}

package/src/app/api/notifications/mark-all-read/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { notifications } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+
+export async function PATCH() {
+  await db
+    .update(notifications)
+    .set({ read: true })
+    .where(eq(notifications.read, false));
+
+  return NextResponse.json({ success: true });
+}

package/src/app/api/notifications/pending-approvals/route.ts

@@ -0,0 +1,10 @@
+import { NextResponse } from "next/server";
+
+import { listPendingApprovalPayloads } from "@/lib/notifications/actionable";
+
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+  const approvals = await listPendingApprovalPayloads();
+  return NextResponse.json(approvals);
+}

package/src/app/api/notifications/pending-approvals/stream/route.ts

@@ -0,0 +1,101 @@
+import { NextRequest } from "next/server";
+
+import { listPendingApprovalPayloads } from "@/lib/notifications/actionable";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: NextRequest) {
+  const encoder = new TextEncoder();
+  let closed = false;
+  let previousSignature = "";
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      const send = (payload: string) => {
+        if (closed) return;
+
+        try {
+          controller.enqueue(encoder.encode(`data: ${payload}\n\n`));
+        } catch {
+          closed = true;
+        }
+      };
+
+      const poll = async () => {
+        while (!closed) {
+          try {
+            const approvals = await listPendingApprovalPayloads();
+            const signature = JSON.stringify(
+              approvals.map((approval) => [
+                approval.notificationId,
+                approval.createdAt,
+              ])
+            );
+
+            if (signature !== previousSignature) {
+              previousSignature = signature;
+              send(JSON.stringify(approvals));
+            }
+          } catch (error) {
+            console.error(
+              "[SSE /api/notifications/pending-approvals/stream] DB poll error:",
+              error
+            );
+            await new Promise((resolve) => setTimeout(resolve, 2000));
+            continue;
+          }
+
+          await new Promise((resolve) => setTimeout(resolve, 750));
+        }
+      };
+
+      const keepalive = setInterval(() => {
+        if (closed) {
+          clearInterval(keepalive);
+          return;
+        }
+
+        try {
+          controller.enqueue(encoder.encode(": keepalive\n\n"));
+        } catch {
+          closed = true;
+          clearInterval(keepalive);
+        }
+      }, 15_000);
+
+      req.signal.addEventListener("abort", () => {
+        closed = true;
+        clearInterval(keepalive);
+
+        try {
+          controller.close();
+        } catch {
+          // Stream already closed.
+        }
+      });
+
+      poll().catch((error) => {
+        console.error(
+          "[SSE /api/notifications/pending-approvals/stream] poll loop error:",
+          error
+        );
+        closed = true;
+        clearInterval(keepalive);
+
+        try {
+          controller.close();
+        } catch {
+          // Stream already closed.
+        }
+      });
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    },
+  });
+}

package/src/app/api/notifications/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { notifications } from "@/lib/db/schema";
+import { eq, and, desc, sql, count } from "drizzle-orm";
+
+export async function GET(req: NextRequest) {
+  const url = new URL(req.url);
+  const unread = url.searchParams.get("unread");
+  const type = url.searchParams.get("type");
+  const countOnly = url.searchParams.get("countOnly");
+
+  const conditions = [];
+  if (unread === "true") conditions.push(eq(notifications.read, false));
+  if (type) conditions.push(eq(notifications.type, type as typeof notifications.type.enumValues[number]));
+
+  if (countOnly === "true") {
+    const [result] = await db
+      .select({ count: count() })
+      .from(notifications)
+      .where(
+        conditions.length > 0 ? and(...conditions) : eq(notifications.read, false)
+      );
+    return NextResponse.json({ count: result?.count ?? 0 });
+  }
+
+  const result = await db
+    .select()
+    .from(notifications)
+    .where(conditions.length > 0 ? and(...conditions) : undefined)
+    .orderBy(desc(notifications.createdAt))
+    .limit(100);
+
+  return NextResponse.json(result);
+}

package/src/app/api/permissions/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  getAllowedPermissions,
+  addAllowedPermission,
+  removeAllowedPermission,
+} from "@/lib/settings/permissions";
+import { z } from "zod";
+
+const patternSchema = z.object({
+  pattern: z.string().min(1),
+});
+
+export async function GET() {
+  const permissions = await getAllowedPermissions();
+  return NextResponse.json({ permissions });
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const parsed = patternSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "pattern (string) is required" },
+      { status: 400 }
+    );
+  }
+
+  await addAllowedPermission(parsed.data.pattern);
+  return NextResponse.json({ success: true });
+}
+
+export async function DELETE(req: NextRequest) {
+  const body = await req.json();
+  const parsed = patternSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "pattern (string) is required" },
+      { status: 400 }
+    );
+  }
+
+  await removeAllowedPermission(parsed.data.pattern);
+  return NextResponse.json({ success: true });
+}

package/src/app/api/profiles/[id]/route.ts

@@ -0,0 +1,79 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  getProfile,
+  updateProfile,
+  deleteProfile,
+  isBuiltin,
+} from "@/lib/agents/profiles/registry";
+import { ProfileConfigSchema } from "@/lib/validators/profile";
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const profile = getProfile(id);
+  if (!profile) {
+    return NextResponse.json({ error: "Profile not found" }, { status: 404 });
+  }
+
+  return NextResponse.json({
+    ...profile,
+    isBuiltin: isBuiltin(id),
+  });
+}
+
+export async function PUT(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  if (isBuiltin(id)) {
+    return NextResponse.json(
+      { error: "Cannot modify built-in profiles" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const body = await req.json();
+    const { skillMd, ...configFields } = body;
+
+    const result = ProfileConfigSchema.safeParse(configFields);
+    if (!result.success) {
+      return NextResponse.json(
+        { error: result.error.issues.map((i) => i.message).join(", ") },
+        { status: 400 }
+      );
+    }
+
+    updateProfile(id, result.data, skillMd ?? "");
+    return NextResponse.json({ ok: true });
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : "Failed to update profile";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  if (isBuiltin(id)) {
+    return NextResponse.json(
+      { error: "Cannot delete built-in profiles" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    deleteProfile(id);
+    return NextResponse.json({ ok: true });
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : "Failed to delete profile";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/src/app/api/profiles/[id]/test/route.ts

@@ -0,0 +1,42 @@
+import { NextRequest, NextResponse } from "next/server";
+import { runProfileTests } from "@/lib/agents/profiles/test-runner";
+import { BudgetLimitExceededError } from "@/lib/settings/budget-guardrails";
+import {
+  DEFAULT_AGENT_RUNTIME,
+  resolveAgentRuntime,
+} from "@/lib/agents/runtime/catalog";
+
+/**
+ * POST /api/profiles/[id]/test
+ *
+ * Run behavioral smoke tests for a profile. Returns test results
+ * with pass/fail per test case and keyword match details.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const body = await req.json().catch(() => ({}));
+  let runtimeId = DEFAULT_AGENT_RUNTIME;
+
+  try {
+    runtimeId = resolveAgentRuntime(body?.runtimeId ?? DEFAULT_AGENT_RUNTIME);
+  } catch (error) {
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : String(error) },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const report = await runProfileTests(id, runtimeId);
+    return NextResponse.json(report);
+  } catch (err: unknown) {
+    if (err instanceof BudgetLimitExceededError) {
+      return NextResponse.json({ error: err.message }, { status: 429 });
+    }
+    const message = err instanceof Error ? err.message : "Test execution failed";
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}