stagent 0.10.0 → 0.11.1

package/src/app/api/chat/export/route.ts

@@ -0,0 +1,52 @@
+import { NextRequest, NextResponse } from "next/server";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import path from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+import { z } from "zod";
+import { db } from "@/lib/db";
+import { documents } from "@/lib/db/schema";
+
+const bodySchema = z.object({
+  title: z.string().min(1).max(200),
+  markdown: z.string().min(1),
+  conversationId: z.string().nullable().optional(),
+});
+
+export async function POST(req: NextRequest) {
+  const raw = await req.json().catch(() => null);
+  const parsed = bodySchema.safeParse(raw);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid body", details: parsed.error.issues },
+      { status: 400 }
+    );
+  }
+
+  const { title, markdown, conversationId } = parsed.data;
+  const id = randomUUID();
+  const safeName = title.replace(/[^a-z0-9-_\. ]/gi, "_").slice(0, 80);
+  const filename = `${Date.now()}-${safeName}.md`;
+  const dir = path.join(homedir(), ".stagent", "uploads", "chat-exports");
+  await mkdir(dir, { recursive: true });
+  const storagePath = path.join(dir, filename);
+  await writeFile(storagePath, markdown, "utf8");
+
+  const now = new Date();
+  await db.insert(documents).values({
+    id,
+    filename,
+    originalName: `${safeName}.md`,
+    mimeType: "text/markdown",
+    size: Buffer.byteLength(markdown, "utf8"),
+    storagePath,
+    direction: "output",
+    status: "ready",
+    source: "chat-export",
+    conversationId: conversationId ?? null,
+    createdAt: now,
+    updatedAt: now,
+  });
+
+  return NextResponse.json({ id, filename }, { status: 201 });
+}

package/src/app/api/chat/files/search/route.ts

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from "next/server";
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { projects } from "@/lib/db/schema";
+import { getLaunchCwd } from "@/lib/environment/workspace-context";
+import { searchFiles } from "@/lib/chat/files/search";
+
+/**
+ * GET /api/chat/files/search?q=&projectId=&limit=20
+ *
+ * Returns files under the active project's workingDirectory (if a valid
+ * projectId is supplied), else under the stagent launch cwd. The client
+ * never supplies cwd directly — that would let a hostile prompt or XSS
+ * reach arbitrary paths on disk.
+ *
+ * Results respect `.gitignore` via `git ls-files --exclude-standard`.
+ */
+export async function GET(req: NextRequest) {
+  const { searchParams } = new URL(req.url);
+  const q = searchParams.get("q") ?? "";
+
+  const limitRaw = parseInt(searchParams.get("limit") ?? "20", 10);
+  const limit = Number.isFinite(limitRaw)
+    ? Math.max(1, Math.min(50, limitRaw))
+    : 20;
+
+  const projectId = searchParams.get("projectId");
+
+  let cwd = getLaunchCwd();
+  if (projectId) {
+    const project = await db
+      .select({ workingDirectory: projects.workingDirectory })
+      .from(projects)
+      .where(eq(projects.id, projectId))
+      .get();
+    if (project?.workingDirectory) {
+      cwd = project.workingDirectory;
+    }
+  }
+
+  try {
+    const results = searchFiles(cwd, q, limit);
+    return NextResponse.json({ results });
+  } catch (e) {
+    return NextResponse.json(
+      { error: e instanceof Error ? e.message : "file search failed" },
+      { status: 500 }
+    );
+  }
+}

package/src/app/api/environment/rescan-if-stale/__tests__/route.test.ts

@@ -0,0 +1,45 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/environment/auto-scan", () => ({
+  shouldRescan: vi.fn(),
+  ensureFreshScan: vi.fn(() => ({ scannedAt: new Date() })),
+}));
+
+vi.mock("@/lib/environment/workspace-context", () => ({
+  getLaunchCwd: () => "/tmp/project",
+}));
+
+import { POST } from "../route";
+import * as autoScan from "@/lib/environment/auto-scan";
+
+describe("POST /api/environment/rescan-if-stale", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("returns scanned:true when shouldRescan=true", async () => {
+    (autoScan.shouldRescan as unknown as ReturnType<typeof vi.fn>).mockReturnValue(true);
+    const res = await POST();
+    expect(res.status).toBe(200);
+    const json = await res.json();
+    expect(json.scanned).toBe(true);
+  });
+
+  it("returns scanned:false when not stale", async () => {
+    (autoScan.shouldRescan as unknown as ReturnType<typeof vi.fn>).mockReturnValue(false);
+    const res = await POST();
+    const json = await res.json();
+    expect(json.scanned).toBe(false);
+  });
+
+  it("returns scanned:false and logs when ensureFreshScan throws", async () => {
+    (autoScan.shouldRescan as unknown as ReturnType<typeof vi.fn>).mockReturnValue(true);
+    (autoScan.ensureFreshScan as unknown as ReturnType<typeof vi.fn>).mockImplementation(() => {
+      throw new Error("fs error");
+    });
+    const res = await POST();
+    const json = await res.json();
+    // ensureFreshScan itself swallows errors — but if it re-threw we must not 500
+    expect(res.status).toBe(200);
+  });
+});

package/src/app/api/environment/rescan-if-stale/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { shouldRescan, ensureFreshScan } from "@/lib/environment/auto-scan";
+import { getLaunchCwd } from "@/lib/environment/workspace-context";
+
+/**
+ * Fire-and-forget rescan endpoint for chat session activation.
+ * - If last scan is fresh (<5min), returns `{ scanned: false }` without I/O.
+ * - Otherwise, runs a scan via `ensureFreshScan` (which catches errors and
+ *   returns null on failure), returns `{ scanned: true }`.
+ * - Never 500s; the chat UI must not be blocked by env issues.
+ */
+export async function POST() {
+  if (!shouldRescan()) {
+    return NextResponse.json({ scanned: false });
+  }
+  try {
+    ensureFreshScan(getLaunchCwd());
+  } catch (err) {
+    // ensureFreshScan itself catches internally; this is belt + suspenders.
+    console.warn("[rescan-if-stale] unexpected:", err);
+  }
+  return NextResponse.json({ scanned: true });
+}

package/src/app/api/environment/skills/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from "next/server";
+import { listSkillsEnriched } from "@/lib/environment/list-skills";
+
+export async function GET() {
+  try {
+    return NextResponse.json(listSkillsEnriched());
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "scan failed" },
+      { status: 500 }
+    );
+  }
+}

package/src/app/api/schedules/[id]/execute/route.ts

@@ -2,13 +2,13 @@ import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { schedules, tasks, usageLedger } from "@/lib/db/schema";
 import { eq } from "drizzle-orm";
-import { executeTaskWithRuntime } from "@/lib/agents/runtime";
 import { claimSlot, countRunningScheduledSlots } from "@/lib/schedules/slot-claim";
 import {
   getScheduleMaxConcurrent,
   getScheduleMaxRunDurationSec,
 } from "@/lib/schedules/config";
 import { randomUUID } from "crypto";
+import { startTaskExecution } from "@/lib/agents/task-dispatch";
 
 /**
  * Manually fire a schedule. Honors the global concurrency cap by default.
@@ -103,7 +103,7 @@ export async function POST(
 
   // Fire-and-forget: the route returns immediately with taskId; execution runs
   // in the background. Errors are logged but do not affect the 200 response.
-  executeTaskWithRuntime(taskId).catch((err) => {
+  startTaskExecution(taskId).catch((err) => {
     console.error(`[api/schedules/execute] task ${taskId} failed:`, err);
   });
 

package/src/app/api/settings/chat/pins/route.ts

@@ -0,0 +1,94 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSetting, setSetting } from "@/lib/settings/helpers";
+import { z } from "zod";
+
+/**
+ * GET/PUT `/api/settings/chat/pins` — per-user pinned entities for chat
+ * mention popover. Storage is a single JSON blob under the
+ * `chat.pinnedEntries` key in the `settings` key-value table.
+ *
+ * Design notes:
+ *  - No server-side validation that `entityId` exists in its table.
+ *    Pins are weakly referenced; popover filter just won't match if the
+ *    entity has been deleted. Cheaper than maintaining referential integrity
+ *    via cascading deletes, and stale pins can be removed by the user on next
+ *    un-pin. Trade-off accepted.
+ *  - PUT replaces the entire list (client is source of truth). Read-modify-
+ *    write happens on the client to avoid concurrent-mutation issues, which
+ *    for single-user local usage is a non-issue.
+ */
+
+const SETTINGS_KEY = "chat.pinnedEntries";
+
+// Entity types recognized by entities/search — mirrored here to constrain
+// what can be pinned. Add new types as they become available.
+const ENTITY_TYPES = [
+  "task",
+  "project",
+  "workflow",
+  "document",
+  "schedule",
+  "table",
+  "profile",
+] as const;
+
+// We denormalize `label`, `description`, and `status` into the pin record
+// so the Pinned group renders standalone, independent of whether the item
+// appears in the current `entities/search` response window (top-20 per type).
+// Trade-off: labels may go stale if the underlying entity is renamed.
+// Acceptable for a UX affordance — selecting the pin still uses the canonical
+// id, and the user can un-pin/re-pin to refresh. Mitigation is lazy refresh
+// on next popover open (future enhancement).
+const PinnedEntrySchema = z.object({
+  id: z.string().min(1),
+  type: z.enum(ENTITY_TYPES),
+  label: z.string().min(1),
+  description: z.string().optional(),
+  status: z.string().optional(),
+  pinnedAt: z.string(), // ISO 8601
+});
+
+const PinsPayloadSchema = z.object({
+  pins: z.array(PinnedEntrySchema),
+});
+
+export type PinnedEntry = z.infer<typeof PinnedEntrySchema>;
+
+export async function GET() {
+  const raw = await getSetting(SETTINGS_KEY);
+  if (!raw) return NextResponse.json({ pins: [] });
+  try {
+    const parsed = PinsPayloadSchema.parse(JSON.parse(raw));
+    return NextResponse.json(parsed);
+  } catch {
+    // Malformed stored value (manual edit, version mismatch) — recover by
+    // returning an empty list rather than erroring. The user can re-pin.
+    return NextResponse.json({ pins: [] });
+  }
+}
+
+export async function PUT(req: NextRequest) {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "invalid JSON body" }, { status: 400 });
+  }
+
+  const result = PinsPayloadSchema.safeParse(body);
+  if (!result.success) {
+    return NextResponse.json(
+      { error: "invalid pins payload", issues: result.error.issues },
+      { status: 400 }
+    );
+  }
+
+  // De-dup by id — client may send the same pin twice on rapid clicks.
+  // Last write wins for pinnedAt.
+  const byId = new Map<string, PinnedEntry>();
+  for (const pin of result.data.pins) byId.set(pin.id, pin);
+  const deduped = Array.from(byId.values());
+
+  await setSetting(SETTINGS_KEY, JSON.stringify({ pins: deduped }));
+  return NextResponse.json({ pins: deduped });
+}

package/src/app/api/settings/chat/saved-searches/__tests__/route.test.ts

@@ -0,0 +1,119 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+vi.mock("@/lib/settings/helpers", () => {
+  const store = new Map<string, string>();
+  return {
+    getSetting: vi.fn(async (k: string) => store.get(k) ?? null),
+    setSetting: vi.fn(async (k: string, v: string) => {
+      store.set(k, v);
+    }),
+    __store: store,
+  };
+});
+
+import * as helpers from "@/lib/settings/helpers";
+import { GET, PUT } from "../route";
+import { NextRequest } from "next/server";
+
+beforeEach(() => {
+  // Reset the in-memory store between tests
+  (helpers as unknown as { __store: Map<string, string> }).__store.clear();
+});
+
+describe("saved-searches route", () => {
+  it("GET with no stored value returns empty list", async () => {
+    const res = await GET();
+    const body = await res.json();
+    expect(body).toEqual({ searches: [] });
+  });
+
+  it("PUT then GET round-trips a valid payload", async () => {
+    const payload = {
+      searches: [
+        {
+          id: "a",
+          surface: "task" as const,
+          label: "Blocked",
+          filterInput: "#status:blocked",
+          createdAt: "2026-04-14T00:00:00Z",
+        },
+      ],
+    };
+    const putRes = await PUT(
+      new NextRequest("http://x/api/settings/chat/saved-searches", {
+        method: "PUT",
+        body: JSON.stringify(payload),
+      })
+    );
+    expect(putRes.status).toBe(200);
+
+    const getBody = await (await GET()).json();
+    expect(getBody.searches).toHaveLength(1);
+    expect(getBody.searches[0].label).toBe("Blocked");
+  });
+
+  it("PUT dedupes by id — last write wins", async () => {
+    const req = new NextRequest("http://x", {
+      method: "PUT",
+      body: JSON.stringify({
+        searches: [
+          {
+            id: "a",
+            surface: "task",
+            label: "First",
+            filterInput: "#a:1",
+            createdAt: "2026-04-14T00:00:00Z",
+          },
+          {
+            id: "a",
+            surface: "task",
+            label: "Second (dup)",
+            filterInput: "#a:1",
+            createdAt: "2026-04-14T00:01:00Z",
+          },
+        ],
+      }),
+    });
+    const res = await PUT(req);
+    const body = await res.json();
+    expect(body.searches).toHaveLength(1);
+    expect(body.searches[0].label).toBe("Second (dup)");
+  });
+
+  it("PUT rejects invalid surface with 400", async () => {
+    const req = new NextRequest("http://x", {
+      method: "PUT",
+      body: JSON.stringify({
+        searches: [
+          {
+            id: "a",
+            surface: "bogus",
+            label: "x",
+            filterInput: "",
+            createdAt: "z",
+          },
+        ],
+      }),
+    });
+    const res = await PUT(req);
+    expect(res.status).toBe(400);
+  });
+
+  it("PUT rejects malformed JSON with 400", async () => {
+    const req = new NextRequest("http://x", {
+      method: "PUT",
+      body: "not json",
+    });
+    const res = await PUT(req);
+    expect(res.status).toBe(400);
+  });
+
+  it("GET recovers from malformed stored value", async () => {
+    (helpers as unknown as { __store: Map<string, string> }).__store.set(
+      "chat.savedSearches",
+      "not-json-at-all"
+    );
+    const body = await (await GET()).json();
+    expect(body).toEqual({ searches: [] });
+  });
+});

package/src/app/api/settings/chat/saved-searches/route.ts

@@ -0,0 +1,79 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSetting, setSetting } from "@/lib/settings/helpers";
+import { z } from "zod";
+
+/**
+ * GET/PUT `/api/settings/chat/saved-searches` — per-user saved filter
+ * combinations for chat popovers and the ⌘K palette. Storage mirrors the
+ * pins route: a single JSON blob under `chat.savedSearches` in the
+ * settings key-value table.
+ *
+ * Design notes:
+ *  - Full-list replacement on PUT. Client is source of truth — avoids
+ *    concurrent-mutation bookkeeping for a single-user local product.
+ *  - PUT dedupes by `id` with last-write-wins on rapid double-saves.
+ *  - Malformed stored value (manual edit, schema drift) degrades to `[]`
+ *    rather than erroring — the user can re-save.
+ */
+
+const SETTINGS_KEY = "chat.savedSearches";
+
+// Surfaces map to popover tabs + list routes. Extend as new popover
+// surfaces are added (table, schedule, etc.).
+const SURFACES = [
+  "task",
+  "project",
+  "workflow",
+  "document",
+  "skill",
+  "profile",
+] as const;
+
+const SavedSearchSchema = z.object({
+  id: z.string().min(1),
+  surface: z.enum(SURFACES),
+  label: z.string().min(1).max(120),
+  filterInput: z.string().max(500),
+  createdAt: z.string(), // ISO 8601
+});
+
+const PayloadSchema = z.object({
+  searches: z.array(SavedSearchSchema),
+});
+
+export type SavedSearch = z.infer<typeof SavedSearchSchema>;
+
+export async function GET() {
+  const raw = await getSetting(SETTINGS_KEY);
+  if (!raw) return NextResponse.json({ searches: [] });
+  try {
+    const parsed = PayloadSchema.parse(JSON.parse(raw));
+    return NextResponse.json(parsed);
+  } catch {
+    return NextResponse.json({ searches: [] });
+  }
+}
+
+export async function PUT(req: NextRequest) {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "invalid JSON body" }, { status: 400 });
+  }
+
+  const result = PayloadSchema.safeParse(body);
+  if (!result.success) {
+    return NextResponse.json(
+      { error: "invalid searches payload", issues: result.error.issues },
+      { status: 400 }
+    );
+  }
+
+  const byId = new Map<string, SavedSearch>();
+  for (const s of result.data.searches) byId.set(s.id, s);
+  const deduped = Array.from(byId.values());
+
+  await setSetting(SETTINGS_KEY, JSON.stringify({ searches: deduped }));
+  return NextResponse.json({ searches: deduped });
+}

package/src/app/api/settings/environment/route.ts

@@ -0,0 +1,26 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSetting, setSetting } from "@/lib/settings/helpers";
+import { SETTINGS_KEYS } from "@/lib/constants/settings";
+
+export async function GET() {
+  const autoPromote = await getSetting(SETTINGS_KEYS.AUTO_PROMOTE_SKILLS);
+  return NextResponse.json({
+    autoPromoteSkills: autoPromote === "true",
+  });
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+
+  if (body.autoPromoteSkills !== undefined) {
+    await setSetting(
+      SETTINGS_KEYS.AUTO_PROMOTE_SKILLS,
+      body.autoPromoteSkills ? "true" : "false"
+    );
+  }
+
+  const autoPromote = await getSetting(SETTINGS_KEYS.AUTO_PROMOTE_SKILLS);
+  return NextResponse.json({
+    autoPromoteSkills: autoPromote === "true",
+  });
+}

package/src/app/api/tasks/[id]/execute/route.ts

@@ -2,14 +2,15 @@ import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { tasks, projects } from "@/lib/db/schema";
 import { eq, and } from "drizzle-orm";
-import { executeTaskWithAgent, classifyTaskProfile } from "@/lib/agents/router";
-import { DEFAULT_AGENT_RUNTIME } from "@/lib/agents/runtime/catalog";
+import { classifyTaskProfile } from "@/lib/agents/router";
 import { validateRuntimeProfileAssignment } from "@/lib/agents/profiles/assignment-validation";
 import {
   BudgetLimitExceededError,
   enforceTaskBudgetGuardrails,
 } from "@/lib/settings/budget-guardrails";
 import { ensureFreshScan } from "@/lib/environment/auto-scan";
+import { resolveTaskExecutionTarget } from "@/lib/agents/runtime/execution-target";
+import { startTaskExecution } from "@/lib/agents/task-dispatch";
 
 export async function POST(
   _req: NextRequest,
@@ -47,6 +48,7 @@ export async function POST(
   }
 
   const task = claimed[0];
+  let taskProfile = task.agentProfile;
 
   // Auto-scan environment if the task's project has a workingDirectory
   if (task.projectId) {
@@ -59,26 +61,64 @@ export async function POST(
     }
   }
 
-  // Auto-classify profile if none was set
-  if (!task.agentProfile) {
+  let executionTarget;
+  try {
+    executionTarget = await resolveTaskExecutionTarget({
+      title: task.title,
+      description: task.description,
+      requestedRuntimeId: task.assignedAgent,
+      profileId: taskProfile,
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    db.update(tasks)
+      .set({
+        status: "failed",
+        result: message,
+        updatedAt: new Date(),
+      })
+      .where(eq(tasks.id, id))
+      .run();
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+
+  // Auto-classify profile if none was set. Use the resolved runtime so the
+  // chosen profile is compatible with the runtime we will actually launch.
+  if (!taskProfile) {
     const autoProfile = classifyTaskProfile(
       task.title,
       task.description,
-      task.assignedAgent ?? DEFAULT_AGENT_RUNTIME
+      executionTarget.effectiveRuntimeId
     );
     db.update(tasks)
       .set({ agentProfile: autoProfile, updatedAt: new Date() })
       .where(eq(tasks.id, id))
       .run();
+    taskProfile = autoProfile;
+    try {
+      executionTarget = await resolveTaskExecutionTarget({
+        title: task.title,
+        description: task.description,
+        requestedRuntimeId: task.assignedAgent,
+        profileId: taskProfile,
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      db.update(tasks)
+        .set({
+          status: "failed",
+          result: message,
+          updatedAt: new Date(),
+        })
+        .where(eq(tasks.id, id))
+        .run();
+      return NextResponse.json({ error: message }, { status: 400 });
+    }
   }
 
   const compatibilityError = validateRuntimeProfileAssignment({
-    profileId: task.agentProfile ?? classifyTaskProfile(
-      task.title,
-      task.description,
-      task.assignedAgent ?? DEFAULT_AGENT_RUNTIME
-    ),
-    runtimeId: task.assignedAgent,
+    profileId: taskProfile,
+    runtimeId: executionTarget.effectiveRuntimeId,
     context: "Task profile",
   });
   if (compatibilityError) {
@@ -94,7 +134,7 @@ export async function POST(
   }
 
   // Fire-and-forget — task already marked as running
-  executeTaskWithAgent(id, task.assignedAgent ?? DEFAULT_AGENT_RUNTIME).catch(
+  startTaskExecution(id, { requestedRuntimeId: task.assignedAgent }).catch(
     (err) => console.error(`Task ${id} execution error:`, err)
   );