stagent 0.9.6 → 0.11.0

package/src/app/api/instance/upgrade/check/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+import { tick } from "@/lib/instance/upgrade-poller";
+
+/**
+ * POST /api/instance/upgrade/check
+ *
+ * Force-run the upgrade availability poller. Rate-limited to one call per
+ * ~5 minutes via the same lock file the scheduled poller uses. Returns the
+ * new UpgradeState on success, or a skipped reason if the lock was held or
+ * dev-mode was active.
+ */
+export async function POST() {
+  try {
+    const result = await tick();
+    if (result.updated) {
+      return NextResponse.json({ ok: true, state: result.updated });
+    }
+    return NextResponse.json(
+      { ok: false, skipped: result.skipped, error: result.error },
+      { status: 202 }
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/src/app/api/instance/upgrade/route.ts

@@ -0,0 +1,96 @@
+import { NextResponse } from "next/server";
+import { randomUUID } from "crypto";
+import { db } from "@/lib/db";
+import { tasks } from "@/lib/db/schema";
+import {
+  getInstanceConfig,
+  getUpgradeState,
+  setUpgradeState,
+} from "@/lib/instance/settings";
+
+/**
+ * POST /api/instance/upgrade
+ *
+ * Spawns an upgrade task with the `upgrade-assistant` agent profile. Returns
+ * 202 Accepted with the task id; the client then navigates to the upgrade
+ * session view to watch streaming progress and respond to conflict prompts.
+ *
+ * The task description includes the instance context (branch name, commits
+ * behind, data directory) as template variables that the profile's SKILL.md
+ * references. The claude-agent runtime interpolates them when building the
+ * system prompt.
+ *
+ * Fire-and-forget per TDR-001: the route returns immediately; task execution
+ * runs in the background through the existing execution-manager pipeline.
+ */
+export async function POST() {
+  try {
+    const config = getInstanceConfig();
+    if (!config) {
+      return NextResponse.json(
+        { error: "Instance not yet initialized — run POST /api/instance/init first" },
+        { status: 409 }
+      );
+    }
+
+    const upgrade = getUpgradeState();
+    if (!upgrade.upgradeAvailable) {
+      return NextResponse.json(
+        { error: "No upgrade available", upgradeState: upgrade },
+        { status: 409 }
+      );
+    }
+
+    const branchName = config.branchName;
+    const commitsBehind = upgrade.commitsBehind;
+    const dataDir = process.env.STAGENT_DATA_DIR ?? "~/.stagent";
+
+    const description = [
+      `Upgrade instance branch \`${branchName}\` with ${commitsBehind} upstream commit(s) from origin/main.`,
+      "",
+      "Context for the upgrade-assistant profile:",
+      `- INSTANCE_BRANCH=${branchName}`,
+      `- COMMITS_BEHIND=${commitsBehind}`,
+      `- DATA_DIR=${dataDir}`,
+      "",
+      "Follow the standard merge flow defined in SKILL.md. Stop and ask the user on any merge conflict. Abort and roll back on any failure. Do not push any branch.",
+    ].join("\n");
+
+    const id = randomUUID();
+    const now = new Date();
+
+    db.insert(tasks)
+      .values({
+        id,
+        title: `Upgrade ${branchName} — ${commitsBehind} upstream commit${commitsBehind === 1 ? "" : "s"}`,
+        description,
+        projectId: null,
+        priority: 1,
+        assignedAgent: null,
+        agentProfile: "upgrade-assistant",
+        sourceType: "manual",
+        status: "planned",
+        createdAt: now,
+        updatedAt: now,
+      })
+      .run();
+
+    // Record which task id owns this upgrade so the UI can deep-link to it,
+    // and optimistically clear the pending-count so the sidebar badge and
+    // settings card reflect the user's intent immediately. If the merge task
+    // fails or is cancelled, the next scheduled poll (or a manual "Check for
+    // upgrades") will restore the real count by re-running git rev-list.
+    await setUpgradeState({
+      ...upgrade,
+      lastUpgradeTaskId: id,
+      commitsBehind: 0,
+      upgradeAvailable: false,
+      lastSuccessfulUpgradeAt: Math.floor(Date.now() / 1000),
+    });
+
+    return NextResponse.json({ taskId: id }, { status: 202 });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/src/app/api/instance/upgrade/status/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from "next/server";
+import { getUpgradeState } from "@/lib/instance/settings";
+import { isDevMode } from "@/lib/instance/detect";
+
+/**
+ * GET /api/instance/upgrade/status
+ *
+ * Returns the current UpgradeState for client components that need to poll
+ * (e.g. the upgrade modal pre-flight). Server Components should read directly
+ * from settings per TDR-004 rather than calling this route.
+ *
+ * When running on the canonical dev repo, returns a synthetic state with
+ * `devMode: true` and `upgradeAvailable: false` so the sidebar upgrade
+ * button never renders on main.
+ */
+export async function GET() {
+  try {
+    if (isDevMode()) {
+      return NextResponse.json({
+        devMode: true,
+        lastPolledAt: null,
+        upgradeAvailable: false,
+        commitsBehind: 0,
+        lastSuccessfulUpgradeAt: null,
+        pollFailureCount: 0,
+        lastPollError: null,
+      });
+    }
+    const state = getUpgradeState();
+    return NextResponse.json({ devMode: false, ...state });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/src/app/api/memory/route.ts

@@ -3,9 +3,6 @@ import { db } from "@/lib/db";
 import { agentMemory } from "@/lib/db/schema";
 import { and, eq, desc } from "drizzle-orm";
 import { randomUUID } from "crypto";
-import { checkLimit, buildLimitErrorBody } from "@/lib/license/limit-check";
-import { getMemoryCount } from "@/lib/license/limit-queries";
-import { createTierLimitNotification } from "@/lib/license/notifications";
 
 /**
  * GET /api/memory?profileId=xxx&category=fact&status=active
@@ -78,14 +75,6 @@ export async function POST(req: NextRequest) {
       );
     }
 
-    // Tier limit check — memory cap per profile
-    const currentCount = getMemoryCount(profileId);
-    const limitResult = checkLimit("agentMemories", currentCount);
-    if (!limitResult.allowed) {
-      createTierLimitNotification("agentMemories", currentCount, limitResult.limit).catch(() => {});
-      return NextResponse.json(buildLimitErrorBody("agentMemories", limitResult), { status: 402 });
-    }
-
     const now = new Date();
     const id = randomUUID();
     // Convert 0-1 confidence to 0-1000, default 700

package/src/app/api/notifications/route.ts

@@ -1,7 +1,9 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { notifications } from "@/lib/db/schema";
-import { eq, and, desc, sql, count } from "drizzle-orm";
+import { eq, and, desc, count } from "drizzle-orm";
+
+import { buildDefaultNotificationVisibilityCondition } from "@/lib/notifications/visibility";
 
 export async function GET(req: NextRequest) {
   const url = new URL(req.url);
@@ -9,7 +11,7 @@ export async function GET(req: NextRequest) {
   const type = url.searchParams.get("type");
   const countOnly = url.searchParams.get("countOnly");
 
-  const conditions = [];
+  const conditions = [buildDefaultNotificationVisibilityCondition()];
   if (unread === "true") conditions.push(eq(notifications.read, false));
   if (type) conditions.push(eq(notifications.type, type as typeof notifications.type.enumValues[number]));
 

package/src/app/api/projects/[id]/route.ts

@@ -2,36 +2,11 @@ import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import {
   projects,
-  tasks,
-  workflows,
-  documents,
-  schedules,
-  agentLogs,
-  notifications,
-  learnedContext,
-  usageLedger,
-  environmentSyncOps,
-  environmentCheckpoints,
-  environmentArtifacts,
-  environmentScans,
-  chatMessages,
-  conversations,
   projectDocumentDefaults,
-  userTables,
-  userTableColumns,
-  userTableRows,
-  userTableViews,
-  userTableImports,
-  userTableRelationships,
-  tableDocumentInputs,
-  taskTableInputs,
-  workflowTableInputs,
-  scheduleTableInputs,
-  userTableTriggers,
-  userTableRowHistory,
 } from "@/lib/db/schema";
-import { eq, inArray } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { updateProjectSchema } from "@/lib/validators/project";
+import { deleteProjectCascade } from "@/lib/data/delete-project";
 
 export async function GET(
   _req: NextRequest,
@@ -109,137 +84,12 @@ export async function DELETE(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params;
-  const [existing] = await db
-    .select()
-    .from(projects)
-    .where(eq(projects.id, id));
-
-  if (!existing) {
-    return NextResponse.json({ error: "Not found" }, { status: 404 });
-  }
 
   try {
-    // Cascade-delete in FK-safe order (children before parents)
-    // Follows the same pattern as clear.ts and workflow DELETE
-
-    // 1. Collect child IDs for nested FK chains
-    const taskIds = db
-      .select({ id: tasks.id })
-      .from(tasks)
-      .where(eq(tasks.projectId, id))
-      .all()
-      .map((r) => r.id);
-
-    const workflowIds = db
-      .select({ id: workflows.id })
-      .from(workflows)
-      .where(eq(workflows.projectId, id))
-      .all()
-      .map((r) => r.id);
-
-    const conversationIds = db
-      .select({ id: conversations.id })
-      .from(conversations)
-      .where(eq(conversations.projectId, id))
-      .all()
-      .map((r) => r.id);
-
-    const scanIds = db
-      .select({ id: environmentScans.id })
-      .from(environmentScans)
-      .where(eq(environmentScans.projectId, id))
-      .all()
-      .map((r) => r.id);
-
-    const checkpointIds = db
-      .select({ id: environmentCheckpoints.id })
-      .from(environmentCheckpoints)
-      .where(eq(environmentCheckpoints.projectId, id))
-      .all()
-      .map((r) => r.id);
-
-    // 2. Environment tables (deepest children first)
-    if (checkpointIds.length > 0) {
-      db.delete(environmentSyncOps)
-        .where(inArray(environmentSyncOps.checkpointId, checkpointIds))
-        .run();
-      db.delete(environmentCheckpoints)
-        .where(inArray(environmentCheckpoints.id, checkpointIds))
-        .run();
-    }
-    if (scanIds.length > 0) {
-      db.delete(environmentArtifacts)
-        .where(inArray(environmentArtifacts.scanId, scanIds))
-        .run();
-      db.delete(environmentScans)
-        .where(inArray(environmentScans.id, scanIds))
-        .run();
+    const deleted = deleteProjectCascade(id);
+    if (!deleted) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
     }
-
-    // 3. Chat tables (messages before conversations)
-    if (conversationIds.length > 0) {
-      db.delete(chatMessages)
-        .where(inArray(chatMessages.conversationId, conversationIds))
-        .run();
-      db.delete(conversations)
-        .where(inArray(conversations.id, conversationIds))
-        .run();
-    }
-
-    // 4. Usage ledger (references projectId, workflowId, taskId)
-    db.delete(usageLedger).where(eq(usageLedger.projectId, id)).run();
-
-    // 5. Task children (logs, notifications, documents, learned context)
-    if (taskIds.length > 0) {
-      db.delete(agentLogs).where(inArray(agentLogs.taskId, taskIds)).run();
-      db.delete(notifications)
-        .where(inArray(notifications.taskId, taskIds))
-        .run();
-      db.delete(documents).where(inArray(documents.taskId, taskIds)).run();
-      db.delete(learnedContext)
-        .where(inArray(learnedContext.sourceTaskId, taskIds))
-        .run();
-    }
-
-    // 6. Project document defaults (junction table)
-    db.delete(projectDocumentDefaults).where(eq(projectDocumentDefaults.projectId, id)).run();
-
-    // 6b. User-defined tables — cascade-delete children before parent
-    const tableIds = db
-      .select({ id: userTables.id })
-      .from(userTables)
-      .where(eq(userTables.projectId, id))
-      .all()
-      .map((r) => r.id);
-
-    if (tableIds.length > 0) {
-      // Junction tables first
-      db.delete(tableDocumentInputs).where(inArray(tableDocumentInputs.tableId, tableIds)).run();
-      db.delete(taskTableInputs).where(inArray(taskTableInputs.tableId, tableIds)).run();
-      db.delete(workflowTableInputs).where(inArray(workflowTableInputs.tableId, tableIds)).run();
-      db.delete(scheduleTableInputs).where(inArray(scheduleTableInputs.tableId, tableIds)).run();
-      // Children
-      db.delete(userTableRowHistory).where(inArray(userTableRowHistory.tableId, tableIds)).run();
-      db.delete(userTableTriggers).where(inArray(userTableTriggers.tableId, tableIds)).run();
-      db.delete(userTableImports).where(inArray(userTableImports.tableId, tableIds)).run();
-      db.delete(userTableViews).where(inArray(userTableViews.tableId, tableIds)).run();
-      db.delete(userTableRelationships).where(inArray(userTableRelationships.fromTableId, tableIds)).run();
-      db.delete(userTableRows).where(inArray(userTableRows.tableId, tableIds)).run();
-      db.delete(userTableColumns).where(inArray(userTableColumns.tableId, tableIds)).run();
-      db.delete(userTables).where(inArray(userTables.id, tableIds)).run();
-    }
-
-    // 7. Direct project children
-    db.delete(documents).where(eq(documents.projectId, id)).run();
-    db.delete(tasks).where(eq(tasks.projectId, id)).run();
-    if (workflowIds.length > 0) {
-      db.delete(workflows).where(inArray(workflows.id, workflowIds)).run();
-    }
-    db.delete(schedules).where(eq(schedules.projectId, id)).run();
-
-    // 7. Finally delete the project
-    db.delete(projects).where(eq(projects.id, id)).run();
-
     return NextResponse.json({ success: true });
   } catch (err) {
     console.error("Project delete failed:", err);

package/src/app/api/projects/__tests__/delete-project.test.ts

@@ -6,14 +6,14 @@ import * as schema from "@/lib/db/schema";
 /**
  * Safety-net regression tests for project cascade deletion.
  *
- * These verify that the DELETE handler in projects/[id]/route.ts
- * properly handles all FK relationships before deleting a project.
- * This prevents the "Failed to delete project" FK constraint error
- * that occurs when related records exist.
+ * These verify that the shared deleteProjectCascade function in
+ * src/lib/data/delete-project.ts properly handles all FK relationships
+ * before deleting a project. This prevents "Failed to delete project"
+ * FK constraint errors when related records exist.
  */
 describe("project DELETE cascade coverage", () => {
   const deleteRouteSource = readFileSync(
-    join(__dirname, "..", "[id]", "route.ts"),
+    join(__dirname, "..", "..", "..", "..", "lib", "data", "delete-project.ts"),
     "utf-8"
   );
 
@@ -115,7 +115,7 @@ describe("project DELETE cascade coverage", () => {
       // Find the LAST occurrence of db.delete(child) and FIRST occurrence of db.delete(parent)
       // within the DELETE function (not the import section)
       const deleteSection = deleteRouteSource.slice(
-        deleteRouteSource.indexOf("export async function DELETE")
+        deleteRouteSource.indexOf("export function deleteProjectCascade")
       );
       const childPos = deleteSection.lastIndexOf(`db.delete(${child})`);
       const parentPos = deleteSection.indexOf(`db.delete(${parent})`);
@@ -129,21 +129,12 @@ describe("project DELETE cascade coverage", () => {
     ).toEqual([]);
   });
 
-  it("wraps deletion in try/catch for error handling", () => {
+  it("checks project existence before deleting", () => {
     const deleteSection = deleteRouteSource.slice(
-      deleteRouteSource.indexOf("export async function DELETE")
+      deleteRouteSource.indexOf("export function deleteProjectCascade")
     );
-    expect(deleteSection).toContain("try {");
-    expect(deleteSection).toContain("catch");
-    expect(deleteSection).toContain("status: 500");
-  });
-
-  it("verifies project exists before attempting delete", () => {
-    const deleteSection = deleteRouteSource.slice(
-      deleteRouteSource.indexOf("export async function DELETE")
-    );
-    expect(deleteSection).toContain("Not found");
-    expect(deleteSection).toContain("status: 404");
+    // The shared function checks if the project exists and returns false if not
+    expect(deleteSection).toContain("if (!existing) return false");
   });
 
   /**

package/src/app/api/schedules/[id]/execute/route.ts

@@ -0,0 +1,111 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { schedules, tasks, usageLedger } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { claimSlot, countRunningScheduledSlots } from "@/lib/schedules/slot-claim";
+import {
+  getScheduleMaxConcurrent,
+  getScheduleMaxRunDurationSec,
+} from "@/lib/schedules/config";
+import { randomUUID } from "crypto";
+import { startTaskExecution } from "@/lib/agents/task-dispatch";
+
+/**
+ * Manually fire a schedule. Honors the global concurrency cap by default.
+ * Use `?force=true` to bypass the cap (logged to usage_ledger as
+ * "manual_force_bypass" for audit).
+ *
+ * Security note: force bypass is audit-logged synchronously before task
+ * execution begins, so every bypass leaves a permanent record regardless of
+ * task outcome.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { id: scheduleId } = await params;
+  const force = req.nextUrl.searchParams.get("force") === "true";
+
+  const [schedule] = db
+    .select()
+    .from(schedules)
+    .where(eq(schedules.id, scheduleId))
+    .all();
+  if (!schedule) {
+    return NextResponse.json({ error: "schedule_not_found" }, { status: 404 });
+  }
+
+  const taskId = randomUUID();
+  const firingNumber = schedule.firingCount + 1;
+  const now = new Date();
+
+  db.insert(tasks)
+    .values({
+      id: taskId,
+      projectId: schedule.projectId,
+      workflowId: null,
+      scheduleId: schedule.id,
+      title: `${schedule.name} — manual firing #${firingNumber}`,
+      description: schedule.prompt,
+      status: "queued",
+      assignedAgent: schedule.assignedAgent,
+      agentProfile: schedule.agentProfile,
+      priority: 2,
+      sourceType: "scheduled",
+      maxTurns: schedule.maxTurns,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+
+  const cap = getScheduleMaxConcurrent();
+  const leaseSec = schedule.maxRunDurationSec ?? getScheduleMaxRunDurationSec();
+
+  // When force=true, pass an effectively infinite cap so the subquery COUNT
+  // can never exceed it. This lets `claimSlot` atomically transition the task
+  // to "running" even when the real cap is full.
+  const effectiveCap = force ? Number.MAX_SAFE_INTEGER : cap;
+  const { claimed } = claimSlot(taskId, effectiveCap, leaseSec);
+
+  if (!claimed) {
+    db.delete(tasks).where(eq(tasks.id, taskId)).run();
+    const slotEtaSec = 60;
+    return NextResponse.json(
+      {
+        error: "capacity_full",
+        message: `Swarm at capacity (${countRunningScheduledSlots()}/${cap}). Retry in ~${slotEtaSec}s or add ?force=true to bypass.`,
+        slotEtaSec,
+      },
+      { status: 429 },
+    );
+  }
+
+  // Audit log written synchronously before task execution so that a force
+  // bypass is always recorded even if the task itself fails immediately.
+  if (force) {
+    const nowTs = new Date();
+    db.insert(usageLedger)
+      .values({
+        id: randomUUID(),
+        taskId,
+        scheduleId: schedule.id,
+        projectId: schedule.projectId,
+        activityType: "manual_force_bypass",
+        runtimeId: "manual",
+        providerId: "manual",
+        status: "completed",
+        costMicros: 0,
+        startedAt: nowTs,
+        finishedAt: nowTs,
+      })
+      .run();
+  }
+
+  // Fire-and-forget: the route returns immediately with taskId; execution runs
+  // in the background. Errors are logged but do not affect the 200 response.
+  startTaskExecution(taskId).catch((err) => {
+    console.error(`[api/schedules/execute] task ${taskId} failed:`, err);
+  });
+
+  return NextResponse.json({ taskId, forced: force });
+}

package/src/app/api/schedules/[id]/route.ts

@@ -4,6 +4,7 @@ import { schedules, tasks } from "@/lib/db/schema";
 import { eq, like } from "drizzle-orm";
 import { parseInterval, computeNextFireTime } from "@/lib/schedules/interval-parser";
 import { parseNaturalLanguage } from "@/lib/schedules/nlp-parser";
+import { checkCollision } from "@/lib/schedules/collision-check";
 import { resolveAgentRuntime } from "@/lib/agents/runtime/catalog";
 import { validateRuntimeProfileAssignment } from "@/lib/agents/profiles/assignment-validation";
 
@@ -199,7 +200,14 @@ export async function PATCH(
     .from(schedules)
     .where(eq(schedules.id, id));
 
-  return NextResponse.json(updated);
+  const effectiveCron = (updates.cronExpression as string | undefined) ?? schedule.cronExpression;
+  const warnings = checkCollision(
+    effectiveCron,
+    schedule.avgTurnsPerFiring ?? 0,
+    schedule.projectId ?? null,
+    schedule.id,
+  );
+  return NextResponse.json({ schedule: updated, warnings });
 }
 
 export async function DELETE(