stagent 0.9.6 → 0.11.0

package/src/app/analytics/page.tsx

@@ -1,8 +1,6 @@
 import { Suspense } from "react";
 import { PageShell } from "@/components/shared/page-shell";
 import { AnalyticsDashboard } from "@/components/analytics/analytics-dashboard";
-import { AnalyticsGateCard } from "@/components/analytics/analytics-gate-card";
-import { licenseManager } from "@/lib/license/manager";
 import {
   getOutcomeCounts,
   getSuccessRateTrend,
@@ -14,16 +12,13 @@ import {
 export const dynamic = "force-dynamic";
 
 function AnalyticsContent() {
-  const tier = licenseManager.getTierFromDb();
-  const isAllowed = tier !== "community";
-
   const outcomes = getOutcomeCounts(30);
   const successTrend = getSuccessRateTrend(30);
   const costTrend = getCostPerOutcomeTrend(30);
   const leaderboard = getProfileLeaderboard(30);
   const hoursSaved = getEstimatedHoursSaved(30);
 
-  const dashboard = (
+  return (
     <AnalyticsDashboard
       outcomes={outcomes}
       successTrend={successTrend}
@@ -32,21 +27,6 @@ function AnalyticsContent() {
       hoursSaved={hoursSaved}
     />
   );
-
-  if (isAllowed) return dashboard;
-
-  return (
-    <div className="relative">
-      {/* Blurred dashboard preview */}
-      <div className="opacity-20 pointer-events-none select-none blur-[2px]" aria-hidden>
-        {dashboard}
-      </div>
-      {/* Upgrade CTA */}
-      <div className="absolute inset-0 flex items-start justify-center pt-16">
-        <AnalyticsGateCard />
-      </div>
-    </div>
-  );
 }
 
 export default function AnalyticsPage() {

package/src/app/api/chat/conversations/[id]/messages/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getConversation, getMessages } from "@/lib/data/chat";
 import { sendMessage } from "@/lib/chat/engine";
+import { recordTermination } from "@/lib/chat/stream-telemetry";
 
 /**
  * GET /api/chat/conversations/[id]/messages?after=xxx&limit=100
@@ -58,6 +59,7 @@ export async function POST(
 
   // Bridge the async generator to an SSE ReadableStream
   const encoder = new TextEncoder();
+  const streamStartedAt = Date.now();
   const stream = new ReadableStream({
     async start(controller) {
       const keepalive = setInterval(() => {
@@ -94,9 +96,28 @@ export async function POST(
         );
       } finally {
         clearInterval(keepalive);
-        controller.close();
+        try {
+          controller.close();
+        } catch {
+          // Stream may already be closed by peer; safe to ignore
+        }
       }
     },
+    // Fires when the client disconnects mid-stream (browser tab closed,
+    // user navigated away, AbortController.abort() fired on the fetch).
+    // The engine's own `req.signal` abort already records
+    // `stream.aborted.signal` in its catch path — this cancel callback
+    // only fires when the ReadableStream is torn down independently,
+    // so record it as a distinct `stream.aborted.client` code.
+    cancel(reason) {
+      recordTermination({
+        reason: "stream.aborted.client",
+        conversationId: id,
+        messageId: null,
+        durationMs: Date.now() - streamStartedAt,
+        error: reason ? String(reason).slice(0, 200) : undefined,
+      });
+    },
   });
 
   return new Response(stream, {

package/src/app/api/chat/conversations/[id]/skills/__tests__/activate.test.ts

@@ -0,0 +1,141 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { NextRequest } from "next/server";
+
+// ---------------------------------------------------------------------------
+// Mocked service module — controls return values for each test.
+// ---------------------------------------------------------------------------
+const mockActivateSkill = vi.fn();
+
+vi.mock("@/lib/chat/skill-composition", () => ({
+  activateSkill: (...args: unknown[]) => mockActivateSkill(...args),
+}));
+
+// Import the route handler AFTER the mock is set up.
+import { POST } from "../activate/route";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function makeRequest(body: unknown, conversationId = "conv-1"): [NextRequest, { params: Promise<{ id: string }> }] {
+  const req = new NextRequest("http://localhost/api/chat/conversations/conv-1/skills/activate", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  return [req, { params: Promise.resolve({ id: conversationId }) }];
+}
+
+beforeEach(() => {
+  vi.resetAllMocks();
+});
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+describe("POST /api/chat/conversations/[id]/skills/activate", () => {
+  it("returns 400 for invalid JSON", async () => {
+    const req = new NextRequest("http://localhost/...", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "not-json",
+    });
+    const res = await POST(req, { params: Promise.resolve({ id: "conv-1" }) });
+    expect(res.status).toBe(400);
+    const json = await res.json() as Record<string, unknown>;
+    expect(typeof json.error).toBe("string");
+  });
+
+  it("returns 400 when skillId is missing", async () => {
+    const [req, ctx] = makeRequest({ mode: "replace" });
+    const res = await POST(req, ctx);
+    expect(res.status).toBe(400);
+  });
+
+  it("returns 200 with activation payload on success (replace mode)", async () => {
+    mockActivateSkill.mockResolvedValueOnce({
+      kind: "ok",
+      activatedSkillId: "my-skill",
+      activeSkillIds: ["my-skill"],
+      skillName: "My Skill",
+    });
+    const [req, ctx] = makeRequest({ skillId: "my-skill" });
+    const res = await POST(req, ctx);
+    expect(res.status).toBe(200);
+    const json = await res.json() as Record<string, unknown>;
+    expect(json.activatedSkillId).toBe("my-skill");
+    expect(json.activeSkillIds).toEqual(["my-skill"]);
+    expect(json.skillName).toBe("My Skill");
+    expect(mockActivateSkill).toHaveBeenCalledWith({
+      conversationId: "conv-1",
+      skillId: "my-skill",
+      mode: "replace",
+      force: false,
+    });
+  });
+
+  it("returns 200 with requiresConfirmation when conflicts detected", async () => {
+    mockActivateSkill.mockResolvedValueOnce({
+      kind: "conflicts",
+      activeSkillIds: ["first"],
+      conflicts: [
+        { skillA: "first", skillB: "second", sharedTopic: "tests", excerptA: "Always …", excerptB: "Never …" },
+      ],
+      hint: "Re-call with force=true to add anyway",
+    });
+    const [req, ctx] = makeRequest({ skillId: "second", mode: "add" });
+    const res = await POST(req, ctx);
+    expect(res.status).toBe(200);
+    const json = await res.json() as Record<string, unknown>;
+    expect(json.requiresConfirmation).toBe(true);
+    expect(Array.isArray(json.conflicts)).toBe(true);
+    expect((json.conflicts as unknown[]).length).toBe(1);
+  });
+
+  it("returns 404 when conversation is not found", async () => {
+    mockActivateSkill.mockResolvedValueOnce({
+      kind: "error",
+      message: "Conversation not found: ghost",
+    });
+    const [req, ctx] = makeRequest({ skillId: "any-skill" }, "ghost");
+    const res = await POST(req, ctx);
+    expect(res.status).toBe(404);
+    const json = await res.json() as Record<string, unknown>;
+    expect((json.error as string)).toContain("Conversation not found");
+  });
+
+  it("returns 404 when skill is not found", async () => {
+    mockActivateSkill.mockResolvedValueOnce({
+      kind: "error",
+      message: "Skill not found: no-such-skill",
+    });
+    const [req, ctx] = makeRequest({ skillId: "no-such-skill" });
+    const res = await POST(req, ctx);
+    expect(res.status).toBe(404);
+  });
+
+  it("returns 400 for other logic errors (e.g. max skills reached)", async () => {
+    mockActivateSkill.mockResolvedValueOnce({
+      kind: "error",
+      message: "Max active skills (3) reached on 'claude-code' — deactivate one first",
+    });
+    const [req, ctx] = makeRequest({ skillId: "any", mode: "add", force: true });
+    const res = await POST(req, ctx);
+    expect(res.status).toBe(400);
+    const json = await res.json() as Record<string, unknown>;
+    expect((json.error as string)).toMatch(/max active skills/i);
+  });
+
+  it("passes force=true to the service", async () => {
+    mockActivateSkill.mockResolvedValueOnce({
+      kind: "ok",
+      activatedSkillId: "any",
+      activeSkillIds: ["first", "any"],
+      skillName: "Any",
+    });
+    const [req, ctx] = makeRequest({ skillId: "any", mode: "add", force: true });
+    await POST(req, ctx);
+    expect(mockActivateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({ force: true, mode: "add" })
+    );
+  });
+});

package/src/app/api/chat/conversations/[id]/skills/activate/route.ts

@@ -0,0 +1,74 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { activateSkill } from "@/lib/chat/skill-composition";
+
+const ActivateBody = z.object({
+  skillId: z.string().min(1),
+  mode: z.enum(["replace", "add"]).optional().default("replace"),
+  force: z.boolean().optional().default(false),
+});
+
+/**
+ * POST /api/chat/conversations/[id]/skills/activate
+ *
+ * Thin HTTP wrapper over the activateSkill composition service so the chat UI
+ * can reach composition logic without going through MCP.
+ *
+ * Returns:
+ *   200  { activatedSkillId, activeSkillIds, skillName }             — success
+ *   200  { requiresConfirmation: true, conflicts: [...] }            — needs confirm
+ *   400  { error: string }                                           — validation / logic error
+ *   404  { error: string }                                           — conversation not found
+ *
+ * See `features/chat-composition-ui-v1.md`.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id: conversationId } = await params;
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const parsed = ActivateBody.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: parsed.error.issues.map((i) => i.message).join("; ") },
+      { status: 400 }
+    );
+  }
+
+  const { skillId, mode, force } = parsed.data;
+  const result = await activateSkill({ conversationId, skillId, mode, force });
+
+  if (result.kind === "error") {
+    const isNotFound =
+      result.message.startsWith("Conversation not found") ||
+      result.message.startsWith("Skill not found");
+    return NextResponse.json(
+      { error: result.message },
+      { status: isNotFound ? 404 : 400 }
+    );
+  }
+
+  if (result.kind === "conflicts") {
+    return NextResponse.json({
+      requiresConfirmation: true,
+      conflicts: result.conflicts,
+      hint: result.hint,
+    });
+  }
+
+  // kind === "ok"
+  return NextResponse.json({
+    activatedSkillId: result.activatedSkillId,
+    activeSkillIds: result.activeSkillIds,
+    skillName: result.skillName,
+    ...(result.note ? { note: result.note } : {}),
+  });
+}

package/src/app/api/chat/conversations/[id]/skills/deactivate/route.ts

@@ -0,0 +1,33 @@
+import { NextRequest, NextResponse } from "next/server";
+import { deactivateSkill } from "@/lib/chat/skill-composition";
+
+/**
+ * POST /api/chat/conversations/[id]/skills/deactivate
+ *
+ * Clears both activeSkillId and activeSkillIds on the conversation row.
+ * Idempotent — safe to call when no skill is active.
+ *
+ * Returns:
+ *   200  { previousSkillId: string | null }  — success
+ *   404  { error: string }                   — conversation not found
+ *
+ * See `features/chat-composition-ui-v1.md`.
+ */
+export async function POST(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id: conversationId } = await params;
+
+  const result = await deactivateSkill({ conversationId });
+
+  if (result.kind === "error") {
+    const isNotFound = result.message.startsWith("Conversation not found");
+    return NextResponse.json(
+      { error: result.message },
+      { status: isNotFound ? 404 : 400 }
+    );
+  }
+
+  return NextResponse.json({ previousSkillId: result.previousSkillId });
+}

package/src/app/api/chat/export/route.ts

@@ -0,0 +1,52 @@
+import { NextRequest, NextResponse } from "next/server";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import path from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+import { z } from "zod";
+import { db } from "@/lib/db";
+import { documents } from "@/lib/db/schema";
+
+const bodySchema = z.object({
+  title: z.string().min(1).max(200),
+  markdown: z.string().min(1),
+  conversationId: z.string().nullable().optional(),
+});
+
+export async function POST(req: NextRequest) {
+  const raw = await req.json().catch(() => null);
+  const parsed = bodySchema.safeParse(raw);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid body", details: parsed.error.issues },
+      { status: 400 }
+    );
+  }
+
+  const { title, markdown, conversationId } = parsed.data;
+  const id = randomUUID();
+  const safeName = title.replace(/[^a-z0-9-_\. ]/gi, "_").slice(0, 80);
+  const filename = `${Date.now()}-${safeName}.md`;
+  const dir = path.join(homedir(), ".stagent", "uploads", "chat-exports");
+  await mkdir(dir, { recursive: true });
+  const storagePath = path.join(dir, filename);
+  await writeFile(storagePath, markdown, "utf8");
+
+  const now = new Date();
+  await db.insert(documents).values({
+    id,
+    filename,
+    originalName: `${safeName}.md`,
+    mimeType: "text/markdown",
+    size: Buffer.byteLength(markdown, "utf8"),
+    storagePath,
+    direction: "output",
+    status: "ready",
+    source: "chat-export",
+    conversationId: conversationId ?? null,
+    createdAt: now,
+    updatedAt: now,
+  });
+
+  return NextResponse.json({ id, filename }, { status: 201 });
+}

package/src/app/api/chat/files/search/route.ts

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from "next/server";
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { projects } from "@/lib/db/schema";
+import { getLaunchCwd } from "@/lib/environment/workspace-context";
+import { searchFiles } from "@/lib/chat/files/search";
+
+/**
+ * GET /api/chat/files/search?q=&projectId=&limit=20
+ *
+ * Returns files under the active project's workingDirectory (if a valid
+ * projectId is supplied), else under the stagent launch cwd. The client
+ * never supplies cwd directly — that would let a hostile prompt or XSS
+ * reach arbitrary paths on disk.
+ *
+ * Results respect `.gitignore` via `git ls-files --exclude-standard`.
+ */
+export async function GET(req: NextRequest) {
+  const { searchParams } = new URL(req.url);
+  const q = searchParams.get("q") ?? "";
+
+  const limitRaw = parseInt(searchParams.get("limit") ?? "20", 10);
+  const limit = Number.isFinite(limitRaw)
+    ? Math.max(1, Math.min(50, limitRaw))
+    : 20;
+
+  const projectId = searchParams.get("projectId");
+
+  let cwd = getLaunchCwd();
+  if (projectId) {
+    const project = await db
+      .select({ workingDirectory: projects.workingDirectory })
+      .from(projects)
+      .where(eq(projects.id, projectId))
+      .get();
+    if (project?.workingDirectory) {
+      cwd = project.workingDirectory;
+    }
+  }
+
+  try {
+    const results = searchFiles(cwd, q, limit);
+    return NextResponse.json({ results });
+  } catch (e) {
+    return NextResponse.json(
+      { error: e instanceof Error ? e.message : "file search failed" },
+      { status: 500 }
+    );
+  }
+}

package/src/app/api/diagnostics/chat-streams/route.ts

@@ -0,0 +1,65 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  readTerminations,
+  countTerminations,
+} from "@/lib/chat/stream-telemetry";
+
+/**
+ * GET /api/diagnostics/chat-streams
+ *
+ * Dev-only diagnostics endpoint that reports how chat SSE streams have
+ * terminated in the current server process. Returns counts by reason code
+ * plus the most recent N events.
+ *
+ * Query params:
+ *   ?windowMinutes=N  — restrict counts to the last N minutes (default: all)
+ *   ?limit=N          — cap on recent events returned (default: 50, max: 500)
+ *
+ * Response shape:
+ *   {
+ *     windowMinutes: number | null,
+ *     totalEvents: number,
+ *     counts: Record<TerminationReason, number>,
+ *     recent: TerminationEvent[]
+ *   }
+ *
+ * Gated behind NODE_ENV !== production to match the data/clear and
+ * data/seed routes. This is for maintainer inspection, not end users.
+ *
+ * See src/lib/chat/stream-telemetry.ts for the ring buffer + reason code
+ * definitions. See features/chat-stream-resilience-telemetry.md for the
+ * motivation (verify-before-building telemetry for a mid-stream refresh
+ * bug reported by a sibling repo that doesn't reproduce here).
+ */
+export async function GET(req: NextRequest) {
+  if (process.env.NODE_ENV === "production") {
+    return NextResponse.json(
+      { error: "Diagnostics disabled in production" },
+      { status: 403 }
+    );
+  }
+
+  const { searchParams } = req.nextUrl;
+  const windowMinutesRaw = searchParams.get("windowMinutes");
+  const limitRaw = searchParams.get("limit");
+
+  const windowMinutes =
+    windowMinutesRaw !== null ? Math.max(0, parseInt(windowMinutesRaw, 10) || 0) : null;
+  const windowMs = windowMinutes !== null ? windowMinutes * 60 * 1000 : 0;
+
+  const limit = Math.min(
+    500,
+    limitRaw !== null ? Math.max(1, parseInt(limitRaw, 10) || 50) : 50
+  );
+
+  const all = readTerminations();
+  const recent = all.slice(-limit).reverse(); // newest first
+  const counts = countTerminations(windowMs);
+
+  return NextResponse.json({
+    windowMinutes,
+    totalEvents: all.length,
+    counts,
+    recent,
+  });
+}

package/src/app/api/environment/rescan-if-stale/__tests__/route.test.ts

@@ -0,0 +1,45 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/environment/auto-scan", () => ({
+  shouldRescan: vi.fn(),
+  ensureFreshScan: vi.fn(() => ({ scannedAt: new Date() })),
+}));
+
+vi.mock("@/lib/environment/workspace-context", () => ({
+  getLaunchCwd: () => "/tmp/project",
+}));
+
+import { POST } from "../route";
+import * as autoScan from "@/lib/environment/auto-scan";
+
+describe("POST /api/environment/rescan-if-stale", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("returns scanned:true when shouldRescan=true", async () => {
+    (autoScan.shouldRescan as unknown as ReturnType<typeof vi.fn>).mockReturnValue(true);
+    const res = await POST();
+    expect(res.status).toBe(200);
+    const json = await res.json();
+    expect(json.scanned).toBe(true);
+  });
+
+  it("returns scanned:false when not stale", async () => {
+    (autoScan.shouldRescan as unknown as ReturnType<typeof vi.fn>).mockReturnValue(false);
+    const res = await POST();
+    const json = await res.json();
+    expect(json.scanned).toBe(false);
+  });
+
+  it("returns scanned:false and logs when ensureFreshScan throws", async () => {
+    (autoScan.shouldRescan as unknown as ReturnType<typeof vi.fn>).mockReturnValue(true);
+    (autoScan.ensureFreshScan as unknown as ReturnType<typeof vi.fn>).mockImplementation(() => {
+      throw new Error("fs error");
+    });
+    const res = await POST();
+    const json = await res.json();
+    // ensureFreshScan itself swallows errors — but if it re-threw we must not 500
+    expect(res.status).toBe(200);
+  });
+});

package/src/app/api/environment/rescan-if-stale/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { shouldRescan, ensureFreshScan } from "@/lib/environment/auto-scan";
+import { getLaunchCwd } from "@/lib/environment/workspace-context";
+
+/**
+ * Fire-and-forget rescan endpoint for chat session activation.
+ * - If last scan is fresh (<5min), returns `{ scanned: false }` without I/O.
+ * - Otherwise, runs a scan via `ensureFreshScan` (which catches errors and
+ *   returns null on failure), returns `{ scanned: true }`.
+ * - Never 500s; the chat UI must not be blocked by env issues.
+ */
+export async function POST() {
+  if (!shouldRescan()) {
+    return NextResponse.json({ scanned: false });
+  }
+  try {
+    ensureFreshScan(getLaunchCwd());
+  } catch (err) {
+    // ensureFreshScan itself catches internally; this is belt + suspenders.
+    console.warn("[rescan-if-stale] unexpected:", err);
+  }
+  return NextResponse.json({ scanned: true });
+}

package/src/app/api/environment/skills/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from "next/server";
+import { listSkillsEnriched } from "@/lib/environment/list-skills";
+
+export async function GET() {
+  try {
+    return NextResponse.json(listSkillsEnriched());
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "scan failed" },
+      { status: 500 }
+    );
+  }
+}

package/src/app/api/instance/config/route.ts

@@ -0,0 +1,41 @@
+import { NextResponse } from "next/server";
+import {
+  getInstanceConfig,
+  getGuardrails,
+  getUpgradeState,
+} from "@/lib/instance/settings";
+import { isDevMode } from "@/lib/instance/detect";
+
+/**
+ * GET /api/instance/config
+ *
+ * Returns the full instance state: config, guardrails, and upgrade state
+ * in a single response. Used by the Settings → Instance section and by
+ * the upgrade pre-flight modal.
+ *
+ * When running on the canonical dev repo (STAGENT_DEV_MODE=true or the
+ * .git/stagent-dev-mode sentinel), returns `{ devMode: true }` with null
+ * payloads. This prevents stale instance rows written during prior testing
+ * from surfacing in the UI as if the dev repo were a real instance.
+ */
+export async function GET() {
+  try {
+    if (isDevMode()) {
+      return NextResponse.json({
+        devMode: true,
+        config: null,
+        guardrails: null,
+        upgrade: null,
+      });
+    }
+    return NextResponse.json({
+      devMode: false,
+      config: getInstanceConfig(),
+      guardrails: getGuardrails(),
+      upgrade: getUpgradeState(),
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/src/app/api/instance/init/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from "next/server";
+import { ensureInstance } from "@/lib/instance/bootstrap";
+import {
+  getInstanceConfig,
+  getGuardrails,
+  getUpgradeState,
+} from "@/lib/instance/settings";
+
+/**
+ * POST /api/instance/init
+ *
+ * Idempotent manual re-run of the instance bootstrap. Useful when the
+ * initial boot-time run failed (permission error, git not installed),
+ * or when the user wants to re-apply guardrails after changing consent
+ * via the Settings → Instance UI.
+ *
+ * Returns the current instance config + guardrails + upgrade state after
+ * the re-run so the Settings → Instance section can refresh its display
+ * without a second request.
+ */
+export async function POST() {
+  try {
+    const result = await ensureInstance();
+    return NextResponse.json({
+      ensureResult: result,
+      config: getInstanceConfig(),
+      guardrails: getGuardrails(),
+      upgrade: getUpgradeState(),
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}