stagent 0.1.0

package/src/app/api/tasks/[id]/cancel/route.ts

@@ -0,0 +1,21 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { tasks } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { cancelTaskWithRuntime } from "@/lib/agents/runtime";
+
+export async function POST(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const [task] = await db.select().from(tasks).where(eq(tasks.id, id));
+
+  if (!task) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  await cancelTaskWithRuntime(id, task.assignedAgent);
+
+  return NextResponse.json({ success: true });
+}

package/src/app/api/tasks/[id]/execute/route.ts

@@ -0,0 +1,90 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { tasks } from "@/lib/db/schema";
+import { eq, and } from "drizzle-orm";
+import { executeTaskWithAgent, classifyTaskProfile } from "@/lib/agents/router";
+import { DEFAULT_AGENT_RUNTIME } from "@/lib/agents/runtime/catalog";
+import { validateRuntimeProfileAssignment } from "@/lib/agents/profiles/assignment-validation";
+import {
+  BudgetLimitExceededError,
+  enforceTaskBudgetGuardrails,
+} from "@/lib/settings/budget-guardrails";
+
+export async function POST(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  try {
+    await enforceTaskBudgetGuardrails(id);
+  } catch (error) {
+    if (error instanceof BudgetLimitExceededError) {
+      return NextResponse.json({ error: error.message }, { status: 429 });
+    }
+    throw error;
+  }
+
+  // Atomic check-and-claim: only one request can transition queued → running
+  const claimed = db
+    .update(tasks)
+    .set({ status: "running", updatedAt: new Date() })
+    .where(and(eq(tasks.id, id), eq(tasks.status, "queued")))
+    .returning()
+    .all();
+
+  if (claimed.length === 0) {
+    // Either not found or not in queued status
+    const [task] = await db.select().from(tasks).where(eq(tasks.id, id));
+    if (!task) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+    return NextResponse.json(
+      { error: `Task must be queued to execute, current status: ${task.status}` },
+      { status: 400 }
+    );
+  }
+
+  const task = claimed[0];
+
+  // Auto-classify profile if none was set
+  if (!task.agentProfile) {
+    const autoProfile = classifyTaskProfile(
+      task.title,
+      task.description,
+      task.assignedAgent ?? DEFAULT_AGENT_RUNTIME
+    );
+    db.update(tasks)
+      .set({ agentProfile: autoProfile, updatedAt: new Date() })
+      .where(eq(tasks.id, id))
+      .run();
+  }
+
+  const compatibilityError = validateRuntimeProfileAssignment({
+    profileId: task.agentProfile ?? classifyTaskProfile(
+      task.title,
+      task.description,
+      task.assignedAgent ?? DEFAULT_AGENT_RUNTIME
+    ),
+    runtimeId: task.assignedAgent,
+    context: "Task profile",
+  });
+  if (compatibilityError) {
+    db.update(tasks)
+      .set({
+        status: "failed",
+        result: compatibilityError,
+        updatedAt: new Date(),
+      })
+      .where(eq(tasks.id, id))
+      .run();
+    return NextResponse.json({ error: compatibilityError }, { status: 400 });
+  }
+
+  // Fire-and-forget — task already marked as running
+  executeTaskWithAgent(id, task.assignedAgent ?? DEFAULT_AGENT_RUNTIME).catch(
+    (err) => console.error(`Task ${id} execution error:`, err)
+  );
+
+  return NextResponse.json({ message: "Execution started" }, { status: 202 });
+}

package/src/app/api/tasks/[id]/logs/route.ts

@@ -0,0 +1,95 @@
+import { NextRequest } from "next/server";
+import { db } from "@/lib/db";
+import { agentLogs } from "@/lib/db/schema";
+import { eq, and, gt } from "drizzle-orm";
+
+export async function GET(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id: taskId } = await params;
+
+  const encoder = new TextEncoder();
+  let lastTimestamp = new Date(0);
+  let closed = false;
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      const send = (data: string) => {
+        if (closed) return;
+        try {
+          controller.enqueue(encoder.encode(`data: ${data}\n\n`));
+        } catch {
+          closed = true;
+        }
+      };
+
+      const poll = async () => {
+        while (!closed) {
+          try {
+            const logs = await db
+              .select()
+              .from(agentLogs)
+              .where(
+                and(
+                  eq(agentLogs.taskId, taskId),
+                  gt(agentLogs.timestamp, lastTimestamp)
+                )
+              )
+              .orderBy(agentLogs.timestamp);
+
+            for (const log of logs) {
+              send(JSON.stringify(log));
+              if (log.timestamp > lastTimestamp) {
+                lastTimestamp = log.timestamp;
+              }
+            }
+          } catch (err) {
+            console.error(`[SSE /tasks/${taskId}/logs] DB poll error:`, err);
+            send(JSON.stringify({ type: "error", message: "Database query failed" }));
+            // Back off on error before retrying
+            await new Promise((resolve) => setTimeout(resolve, 2000));
+            continue;
+          }
+
+          await new Promise((resolve) => setTimeout(resolve, 500));
+        }
+      };
+
+      // Keepalive
+      const keepalive = setInterval(() => {
+        if (closed) {
+          clearInterval(keepalive);
+          return;
+        }
+        try {
+          controller.enqueue(encoder.encode(": keepalive\n\n"));
+        } catch {
+          closed = true;
+          clearInterval(keepalive);
+        }
+      }, 15_000);
+
+      // Clean up on abort
+      req.signal.addEventListener("abort", () => {
+        closed = true;
+        clearInterval(keepalive);
+        try {
+          controller.close();
+        } catch {
+          // Already closed
+        }
+      });
+
+      poll();
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    },
+  });
+}

package/src/app/api/tasks/[id]/output/route.ts

@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { tasks } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  const [task] = await db.select().from(tasks).where(eq(tasks.id, id));
+
+  if (!task) {
+    return NextResponse.json({ error: "Task not found" }, { status: 404 });
+  }
+
+  // Detect content type from the result
+  const result = task.result ?? "";
+  let contentType: "text" | "markdown" | "code" | "json" | "unknown" = "text";
+
+  if (result.startsWith("{") || result.startsWith("[")) {
+    try {
+      JSON.parse(result);
+      contentType = "json";
+    } catch {
+      contentType = "text";
+    }
+  } else if (result.includes("```") || result.includes("# ") || result.includes("**")) {
+    contentType = "markdown";
+  } else if (
+    result.includes("function ") ||
+    result.includes("const ") ||
+    result.includes("import ") ||
+    result.includes("def ") ||
+    result.includes("class ")
+  ) {
+    contentType = "code";
+  }
+
+  return NextResponse.json({
+    taskId: id,
+    status: task.status,
+    result,
+    contentType,
+  });
+}

package/src/app/api/tasks/[id]/respond/route.ts

@@ -0,0 +1,64 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { notifications } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { z } from "zod";
+
+const respondSchema = z.object({
+  notificationId: z.string().min(1),
+  behavior: z.enum(["allow", "deny"]),
+  message: z.string().optional(),
+  updatedInput: z.unknown().optional(),
+  alwaysAllow: z.boolean().optional(),
+  permissionPattern: z.string().optional(),
+});
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const body = await req.json();
+  const parsed = respondSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "notificationId (string) and behavior ('allow' | 'deny') are required" },
+      { status: 400 }
+    );
+  }
+
+  const { notificationId, behavior, message, updatedInput, alwaysAllow, permissionPattern } = parsed.data;
+
+  const [notification] = await db
+    .select()
+    .from(notifications)
+    .where(eq(notifications.id, notificationId));
+
+  if (!notification) {
+    return NextResponse.json({ error: "Notification not found" }, { status: 404 });
+  }
+
+  if (notification.response) {
+    return NextResponse.json({ error: "Already responded" }, { status: 409 });
+  }
+
+  // Write response — the polling loop in claude-agent.ts will detect this
+  const responseData = { behavior, message, updatedInput, alwaysAllow };
+  await db
+    .update(notifications)
+    .set({
+      response: JSON.stringify(responseData),
+      respondedAt: new Date(),
+      read: true,
+    })
+    .where(eq(notifications.id, notificationId));
+
+  // Save "Always Allow" permission if requested
+  if (behavior === "allow" && alwaysAllow && permissionPattern) {
+    const { addAllowedPermission } = await import("@/lib/settings/permissions");
+    await addAllowedPermission(permissionPattern);
+  }
+
+  return NextResponse.json({ success: true });
+}

package/src/app/api/tasks/[id]/resume/route.ts

@@ -0,0 +1,76 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { tasks } from "@/lib/db/schema";
+import { eq, and, inArray } from "drizzle-orm";
+import { resumeTaskWithAgent } from "@/lib/agents/router";
+import { MAX_RESUME_COUNT } from "@/lib/constants/task-status";
+import { DEFAULT_AGENT_RUNTIME } from "@/lib/agents/runtime/catalog";
+import {
+  BudgetLimitExceededError,
+  enforceTaskBudgetGuardrails,
+} from "@/lib/settings/budget-guardrails";
+
+export async function POST(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  // Check task exists and has a session
+  const [task] = await db.select().from(tasks).where(eq(tasks.id, id));
+  if (!task) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  if (!task.sessionId) {
+    return NextResponse.json(
+      { error: "No session to resume — use Retry instead" },
+      { status: 400 }
+    );
+  }
+
+  if (task.resumeCount >= MAX_RESUME_COUNT) {
+    return NextResponse.json(
+      { error: "Resume limit reached. Re-queue for fresh start." },
+      { status: 400 }
+    );
+  }
+
+  try {
+    await enforceTaskBudgetGuardrails(id, { isResume: true });
+  } catch (error) {
+    if (error instanceof BudgetLimitExceededError) {
+      return NextResponse.json({ error: error.message }, { status: 429 });
+    }
+    throw error;
+  }
+
+  // Atomic claim: failed/cancelled → running
+  const claimed = db
+    .update(tasks)
+    .set({ status: "running", updatedAt: new Date() })
+    .where(
+      and(
+        eq(tasks.id, id),
+        inArray(tasks.status, ["failed", "cancelled"])
+      )
+    )
+    .returning()
+    .all();
+
+  if (claimed.length === 0) {
+    return NextResponse.json(
+      {
+        error: `Task must be failed or cancelled to resume, current status: ${task.status}`,
+      },
+      { status: 400 }
+    );
+  }
+
+  // Fire-and-forget
+  resumeTaskWithAgent(id, task.assignedAgent ?? DEFAULT_AGENT_RUNTIME).catch((err) =>
+    console.error(`Task ${id} resume error:`, err)
+  );
+
+  return NextResponse.json({ message: "Resume started" }, { status: 202 });
+}

package/src/app/api/tasks/[id]/route.ts

@@ -0,0 +1,77 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { tasks } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { updateTaskSchema } from "@/lib/validators/task";
+import { isValidTransition, type TaskStatus } from "@/lib/constants/task-status";
+import { validateRuntimeProfileAssignment } from "@/lib/agents/profiles/assignment-validation";
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const [task] = await db.select().from(tasks).where(eq(tasks.id, id));
+  if (!task) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json(task);
+}
+
+export async function PATCH(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const body = await req.json();
+  const parsed = updateTaskSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  const [existing] = await db.select().from(tasks).where(eq(tasks.id, id));
+  if (!existing) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const compatibilityError = validateRuntimeProfileAssignment({
+    profileId:
+      parsed.data.agentProfile !== undefined
+        ? parsed.data.agentProfile
+        : existing.agentProfile,
+    runtimeId:
+      parsed.data.assignedAgent !== undefined
+        ? parsed.data.assignedAgent
+        : existing.assignedAgent,
+    context: "Task profile",
+  });
+  if (compatibilityError) {
+    return NextResponse.json({ error: compatibilityError }, { status: 400 });
+  }
+
+  // Validate status transitions
+  if (parsed.data.status && parsed.data.status !== existing.status) {
+    if (!isValidTransition(existing.status as TaskStatus, parsed.data.status as TaskStatus)) {
+      return NextResponse.json(
+        { error: `Invalid transition from ${existing.status} to ${parsed.data.status}` },
+        { status: 400 }
+      );
+    }
+  }
+
+  await db
+    .update(tasks)
+    .set({ ...parsed.data, updatedAt: new Date() })
+    .where(eq(tasks.id, id));
+
+  const [updated] = await db.select().from(tasks).where(eq(tasks.id, id));
+  return NextResponse.json(updated);
+}
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  const [existing] = await db.select().from(tasks).where(eq(tasks.id, id));
+  if (!existing) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  await db.delete(tasks).where(eq(tasks.id, id));
+  return NextResponse.json({ success: true });
+}

package/src/app/api/tasks/assist/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from "next/server";
+import { runTaskAssistWithRuntime } from "@/lib/agents/runtime";
+import type { TaskAssistResponse } from "@/lib/agents/runtime/task-assist-types";
+import { BudgetLimitExceededError } from "@/lib/settings/budget-guardrails";
+
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const { title, description, assignedAgent } = body as {
+    title?: string;
+    description?: string;
+    assignedAgent?: string;
+  };
+
+  if (!title?.trim() && !description?.trim()) {
+    return NextResponse.json(
+      { error: "Provide at least a title or description" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const parsed: TaskAssistResponse = await runTaskAssistWithRuntime(
+      { title, description },
+      assignedAgent
+    );
+    return NextResponse.json(parsed);
+  } catch (error) {
+    if (error instanceof BudgetLimitExceededError) {
+      return NextResponse.json({ error: error.message }, { status: 429 });
+    }
+    const message =
+      error instanceof Error ? error.message : "AI assist failed";
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/src/app/api/tasks/route.ts

@@ -0,0 +1,82 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { tasks, documents } from "@/lib/db/schema";
+import { eq, and, desc } from "drizzle-orm";
+import { createTaskSchema } from "@/lib/validators/task";
+import { processDocument } from "@/lib/documents/processor";
+import { validateRuntimeProfileAssignment } from "@/lib/agents/profiles/assignment-validation";
+
+export async function GET(req: NextRequest) {
+  const url = new URL(req.url);
+  const projectId = url.searchParams.get("projectId");
+  const status = url.searchParams.get("status");
+
+  const conditions = [];
+  if (projectId) conditions.push(eq(tasks.projectId, projectId));
+  if (status) conditions.push(eq(tasks.status, status as typeof tasks.status.enumValues[number]));
+
+  const result = await db
+    .select()
+    .from(tasks)
+    .where(conditions.length > 0 ? and(...conditions) : undefined)
+    .orderBy(tasks.priority, desc(tasks.createdAt));
+
+  return NextResponse.json(result);
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const parsed = createTaskSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  const compatibilityError = validateRuntimeProfileAssignment({
+    profileId: parsed.data.agentProfile,
+    runtimeId: parsed.data.assignedAgent,
+    context: "Task profile",
+  });
+  if (compatibilityError) {
+    return NextResponse.json({ error: compatibilityError }, { status: 400 });
+  }
+
+  const now = new Date();
+  const id = crypto.randomUUID();
+
+  await db.insert(tasks).values({
+    id,
+    title: parsed.data.title,
+    description: parsed.data.description ?? null,
+    projectId: parsed.data.projectId ?? null,
+    priority: parsed.data.priority,
+    assignedAgent: parsed.data.assignedAgent ?? null,
+    agentProfile: parsed.data.agentProfile ?? null,
+    status: "planned",
+    createdAt: now,
+    updatedAt: now,
+  });
+
+  // Link already-uploaded documents to this task
+  if (parsed.data.fileIds && parsed.data.fileIds.length > 0) {
+    try {
+      for (const fileId of parsed.data.fileIds) {
+        // Update existing document record (created by /api/uploads) to link to this task
+        await db.update(documents)
+          .set({
+            taskId: id,
+            projectId: parsed.data.projectId ?? null,
+            updatedAt: now,
+          })
+          .where(eq(documents.id, fileId));
+
+        // Trigger processing if not already done (fire-and-forget)
+        processDocument(fileId).catch(() => {});
+      }
+    } catch {
+      // File association is best-effort — don't fail task creation
+    }
+  }
+
+  const [task] = await db.select().from(tasks).where(eq(tasks.id, id));
+  return NextResponse.json(task, { status: 201 });
+}

package/src/app/api/uploads/[id]/route.ts

@@ -0,0 +1,81 @@
+import { NextRequest, NextResponse } from "next/server";
+import { readFile, readdir, unlink } from "fs/promises";
+import { join } from "path";
+import { db } from "@/lib/db";
+import { documents } from "@/lib/db/schema";
+import { getStagentUploadsDir } from "@/lib/utils/stagent-paths";
+import { eq } from "drizzle-orm";
+
+const UPLOAD_DIR = getStagentUploadsDir();
+
+const MIME_TYPES: Record<string, string> = {
+  txt: "text/plain",
+  md: "text/markdown",
+  json: "application/json",
+  js: "text/javascript",
+  ts: "text/typescript",
+  py: "text/x-python",
+  html: "text/html",
+  css: "text/css",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  svg: "image/svg+xml",
+  pdf: "application/pdf",
+};
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  try {
+    const files = await readdir(UPLOAD_DIR);
+    const match = files.find((f) => f.startsWith(id));
+    if (!match) {
+      return NextResponse.json({ error: "File not found" }, { status: 404 });
+    }
+
+    const filepath = join(UPLOAD_DIR, match);
+    const data = await readFile(filepath);
+    const ext = match.split(".").pop()?.toLowerCase() ?? "";
+    const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
+
+    // Force download for all files to prevent stored XSS via inline rendering
+    // of attacker-controlled HTML/SVG/JS content
+    return new NextResponse(data, {
+      headers: {
+        "Content-Type": contentType,
+        "Content-Disposition": `attachment; filename="${match}"`,
+        "X-Content-Type-Options": "nosniff",
+      },
+    });
+  } catch {
+    return NextResponse.json({ error: "File not found" }, { status: 404 });
+  }
+}
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+
+  try {
+    const files = await readdir(UPLOAD_DIR);
+    const match = files.find((f) => f.startsWith(id));
+    if (!match) {
+      return NextResponse.json({ error: "File not found" }, { status: 404 });
+    }
+
+    const filepath = join(UPLOAD_DIR, match);
+    await unlink(filepath);
+    await db.delete(documents).where(eq(documents.id, id));
+
+    return new NextResponse(null, { status: 204 });
+  } catch {
+    return NextResponse.json({ error: "Failed to delete file" }, { status: 500 });
+  }
+}

package/src/app/api/uploads/cleanup/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from "next/server";
+import { cleanupOrphanedUploads } from "@/lib/documents/cleanup";
+
+export async function POST() {
+  const result = await cleanupOrphanedUploads();
+  return NextResponse.json(result);
+}