stagent 0.9.6 → 0.11.0

package/src/app/api/schedules/__tests__/execute-route.test.ts

@@ -0,0 +1,118 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { db } from "@/lib/db";
+import { tasks, schedules, projects, settings, usageLedger } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { randomUUID } from "crypto";
+import { NextRequest } from "next/server";
+import { POST } from "../[id]/execute/route";
+
+vi.mock("@/lib/agents/runtime", () => ({
+  executeTaskWithRuntime: vi.fn().mockResolvedValue(undefined),
+}));
+
+function req(url: string): NextRequest {
+  return new NextRequest(new URL(url, "http://localhost"));
+}
+
+function seedSchedule(): string {
+  const pid = randomUUID();
+  const sid = randomUUID();
+  const now = new Date();
+  db.insert(projects)
+    .values({ id: pid, name: "p", status: "active", createdAt: now, updatedAt: now })
+    .run();
+  db.insert(schedules)
+    .values({
+      id: sid,
+      projectId: pid,
+      name: "manual",
+      prompt: "test",
+      cronExpression: "0 0 * * *",
+      status: "active",
+      type: "scheduled",
+      firingCount: 0,
+      suppressionCount: 0,
+      heartbeatSpentToday: 0,
+      failureStreak: 0,
+      turnBudgetBreachStreak: 0,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+  return sid;
+}
+
+describe("POST /api/schedules/:id/execute", () => {
+  beforeEach(() => {
+    db.delete(usageLedger).run();
+    db.delete(tasks).run();
+    db.delete(schedules).run();
+    db.delete(projects).run();
+    db.delete(settings).where(eq(settings.key, "schedule.maxConcurrent")).run();
+    db.insert(settings)
+      .values({ key: "schedule.maxConcurrent", value: "1", updatedAt: new Date() })
+      .run();
+  });
+
+  it("fires when capacity available, returns 200 with taskId", async () => {
+    const sid = seedSchedule();
+    const res = await POST(req(`/api/schedules/${sid}/execute`), {
+      params: Promise.resolve({ id: sid }),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.taskId).toBeDefined();
+  });
+
+  it("returns 429 when cap is full", async () => {
+    const sid1 = seedSchedule();
+    const sid2 = seedSchedule();
+
+    const res1 = await POST(req(`/api/schedules/${sid1}/execute`), {
+      params: Promise.resolve({ id: sid1 }),
+    });
+    expect(res1.status).toBe(200);
+
+    const res2 = await POST(req(`/api/schedules/${sid2}/execute`), {
+      params: Promise.resolve({ id: sid2 }),
+    });
+    expect(res2.status).toBe(429);
+    const body = await res2.json();
+    expect(body.error).toBe("capacity_full");
+    expect(body.slotEtaSec).toBeGreaterThanOrEqual(0);
+
+    const remaining = db.select().from(tasks).all();
+    expect(remaining.length).toBe(1); // only sid1's task remains; sid2's was cleaned up on refusal
+  });
+
+  it("bypasses the cap when ?force=true and writes audit-log entry", async () => {
+    const sid1 = seedSchedule();
+    const sid2 = seedSchedule();
+
+    await POST(req(`/api/schedules/${sid1}/execute`), {
+      params: Promise.resolve({ id: sid1 }),
+    });
+
+    const res2 = await POST(
+      req(`/api/schedules/${sid2}/execute?force=true`),
+      { params: Promise.resolve({ id: sid2 }) },
+    );
+    expect(res2.status).toBe(200);
+    const body2 = await res2.json();
+
+    const ledger = db
+      .select()
+      .from(usageLedger)
+      .where(eq(usageLedger.activityType, "manual_force_bypass"))
+      .all();
+    expect(ledger.length).toBe(1);
+    expect(ledger[0].taskId).toBe(body2.taskId);
+  });
+
+  it("returns 404 when the schedule does not exist", async () => {
+    const res = await POST(req("/api/schedules/nonexistent/execute"), {
+      params: Promise.resolve({ id: "nonexistent" }),
+    });
+    expect(res.status).toBe(404);
+  });
+});

package/src/app/api/schedules/route.ts

@@ -6,9 +6,7 @@ import { parseInterval, computeNextFireTime } from "@/lib/schedules/interval-par
 import { parseNaturalLanguage } from "@/lib/schedules/nlp-parser";
 import { resolveAgentRuntime } from "@/lib/agents/runtime/catalog";
 import { validateRuntimeProfileAssignment } from "@/lib/agents/profiles/assignment-validation";
-import { checkLimit, buildLimitErrorBody } from "@/lib/license/limit-check";
-import { getActiveScheduleCount } from "@/lib/license/limit-queries";
-import { createTierLimitNotification } from "@/lib/license/notifications";
+import { checkCollision } from "@/lib/schedules/collision-check";
 
 export async function GET() {
   const result = await db
@@ -130,14 +128,6 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: compatibilityError }, { status: 400 });
   }
 
-  // Tier limit check — active schedule cap
-  const activeCount = getActiveScheduleCount();
-  const limitResult = checkLimit("activeSchedules", activeCount);
-  if (!limitResult.allowed) {
-    createTierLimitNotification("activeSchedules", activeCount, limitResult.limit).catch(() => {});
-    return NextResponse.json(buildLimitErrorBody("activeSchedules", limitResult), { status: 402 });
-  }
-
   const id = crypto.randomUUID();
   const now = new Date();
   const nextFireAt = computeNextFireTime(cronExpression, now);
@@ -201,5 +191,6 @@ export async function POST(req: NextRequest) {
     .from(schedules)
     .where(eq(schedules.id, id));
 
-  return NextResponse.json(created, { status: 201 });
+  const warnings = checkCollision(cronExpression, 0, projectId ?? null, null);
+  return NextResponse.json({ schedule: created, warnings }, { status: 201 });
 }

package/src/app/api/settings/chat/pins/route.ts

@@ -0,0 +1,94 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSetting, setSetting } from "@/lib/settings/helpers";
+import { z } from "zod";
+
+/**
+ * GET/PUT `/api/settings/chat/pins` — per-user pinned entities for chat
+ * mention popover. Storage is a single JSON blob under the
+ * `chat.pinnedEntries` key in the `settings` key-value table.
+ *
+ * Design notes:
+ *  - No server-side validation that `entityId` exists in its table.
+ *    Pins are weakly referenced; popover filter just won't match if the
+ *    entity has been deleted. Cheaper than maintaining referential integrity
+ *    via cascading deletes, and stale pins can be removed by the user on next
+ *    un-pin. Trade-off accepted.
+ *  - PUT replaces the entire list (client is source of truth). Read-modify-
+ *    write happens on the client to avoid concurrent-mutation issues, which
+ *    for single-user local usage is a non-issue.
+ */
+
+const SETTINGS_KEY = "chat.pinnedEntries";
+
+// Entity types recognized by entities/search — mirrored here to constrain
+// what can be pinned. Add new types as they become available.
+const ENTITY_TYPES = [
+  "task",
+  "project",
+  "workflow",
+  "document",
+  "schedule",
+  "table",
+  "profile",
+] as const;
+
+// We denormalize `label`, `description`, and `status` into the pin record
+// so the Pinned group renders standalone, independent of whether the item
+// appears in the current `entities/search` response window (top-20 per type).
+// Trade-off: labels may go stale if the underlying entity is renamed.
+// Acceptable for a UX affordance — selecting the pin still uses the canonical
+// id, and the user can un-pin/re-pin to refresh. Mitigation is lazy refresh
+// on next popover open (future enhancement).
+const PinnedEntrySchema = z.object({
+  id: z.string().min(1),
+  type: z.enum(ENTITY_TYPES),
+  label: z.string().min(1),
+  description: z.string().optional(),
+  status: z.string().optional(),
+  pinnedAt: z.string(), // ISO 8601
+});
+
+const PinsPayloadSchema = z.object({
+  pins: z.array(PinnedEntrySchema),
+});
+
+export type PinnedEntry = z.infer<typeof PinnedEntrySchema>;
+
+export async function GET() {
+  const raw = await getSetting(SETTINGS_KEY);
+  if (!raw) return NextResponse.json({ pins: [] });
+  try {
+    const parsed = PinsPayloadSchema.parse(JSON.parse(raw));
+    return NextResponse.json(parsed);
+  } catch {
+    // Malformed stored value (manual edit, version mismatch) — recover by
+    // returning an empty list rather than erroring. The user can re-pin.
+    return NextResponse.json({ pins: [] });
+  }
+}
+
+export async function PUT(req: NextRequest) {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "invalid JSON body" }, { status: 400 });
+  }
+
+  const result = PinsPayloadSchema.safeParse(body);
+  if (!result.success) {
+    return NextResponse.json(
+      { error: "invalid pins payload", issues: result.error.issues },
+      { status: 400 }
+    );
+  }
+
+  // De-dup by id — client may send the same pin twice on rapid clicks.
+  // Last write wins for pinnedAt.
+  const byId = new Map<string, PinnedEntry>();
+  for (const pin of result.data.pins) byId.set(pin.id, pin);
+  const deduped = Array.from(byId.values());
+
+  await setSetting(SETTINGS_KEY, JSON.stringify({ pins: deduped }));
+  return NextResponse.json({ pins: deduped });
+}

package/src/app/api/settings/chat/saved-searches/__tests__/route.test.ts

@@ -0,0 +1,119 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+vi.mock("@/lib/settings/helpers", () => {
+  const store = new Map<string, string>();
+  return {
+    getSetting: vi.fn(async (k: string) => store.get(k) ?? null),
+    setSetting: vi.fn(async (k: string, v: string) => {
+      store.set(k, v);
+    }),
+    __store: store,
+  };
+});
+
+import * as helpers from "@/lib/settings/helpers";
+import { GET, PUT } from "../route";
+import { NextRequest } from "next/server";
+
+beforeEach(() => {
+  // Reset the in-memory store between tests
+  (helpers as unknown as { __store: Map<string, string> }).__store.clear();
+});
+
+describe("saved-searches route", () => {
+  it("GET with no stored value returns empty list", async () => {
+    const res = await GET();
+    const body = await res.json();
+    expect(body).toEqual({ searches: [] });
+  });
+
+  it("PUT then GET round-trips a valid payload", async () => {
+    const payload = {
+      searches: [
+        {
+          id: "a",
+          surface: "task" as const,
+          label: "Blocked",
+          filterInput: "#status:blocked",
+          createdAt: "2026-04-14T00:00:00Z",
+        },
+      ],
+    };
+    const putRes = await PUT(
+      new NextRequest("http://x/api/settings/chat/saved-searches", {
+        method: "PUT",
+        body: JSON.stringify(payload),
+      })
+    );
+    expect(putRes.status).toBe(200);
+
+    const getBody = await (await GET()).json();
+    expect(getBody.searches).toHaveLength(1);
+    expect(getBody.searches[0].label).toBe("Blocked");
+  });
+
+  it("PUT dedupes by id — last write wins", async () => {
+    const req = new NextRequest("http://x", {
+      method: "PUT",
+      body: JSON.stringify({
+        searches: [
+          {
+            id: "a",
+            surface: "task",
+            label: "First",
+            filterInput: "#a:1",
+            createdAt: "2026-04-14T00:00:00Z",
+          },
+          {
+            id: "a",
+            surface: "task",
+            label: "Second (dup)",
+            filterInput: "#a:1",
+            createdAt: "2026-04-14T00:01:00Z",
+          },
+        ],
+      }),
+    });
+    const res = await PUT(req);
+    const body = await res.json();
+    expect(body.searches).toHaveLength(1);
+    expect(body.searches[0].label).toBe("Second (dup)");
+  });
+
+  it("PUT rejects invalid surface with 400", async () => {
+    const req = new NextRequest("http://x", {
+      method: "PUT",
+      body: JSON.stringify({
+        searches: [
+          {
+            id: "a",
+            surface: "bogus",
+            label: "x",
+            filterInput: "",
+            createdAt: "z",
+          },
+        ],
+      }),
+    });
+    const res = await PUT(req);
+    expect(res.status).toBe(400);
+  });
+
+  it("PUT rejects malformed JSON with 400", async () => {
+    const req = new NextRequest("http://x", {
+      method: "PUT",
+      body: "not json",
+    });
+    const res = await PUT(req);
+    expect(res.status).toBe(400);
+  });
+
+  it("GET recovers from malformed stored value", async () => {
+    (helpers as unknown as { __store: Map<string, string> }).__store.set(
+      "chat.savedSearches",
+      "not-json-at-all"
+    );
+    const body = await (await GET()).json();
+    expect(body).toEqual({ searches: [] });
+  });
+});

package/src/app/api/settings/chat/saved-searches/route.ts

@@ -0,0 +1,79 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSetting, setSetting } from "@/lib/settings/helpers";
+import { z } from "zod";
+
+/**
+ * GET/PUT `/api/settings/chat/saved-searches` — per-user saved filter
+ * combinations for chat popovers and the ⌘K palette. Storage mirrors the
+ * pins route: a single JSON blob under `chat.savedSearches` in the
+ * settings key-value table.
+ *
+ * Design notes:
+ *  - Full-list replacement on PUT. Client is source of truth — avoids
+ *    concurrent-mutation bookkeeping for a single-user local product.
+ *  - PUT dedupes by `id` with last-write-wins on rapid double-saves.
+ *  - Malformed stored value (manual edit, schema drift) degrades to `[]`
+ *    rather than erroring — the user can re-save.
+ */
+
+const SETTINGS_KEY = "chat.savedSearches";
+
+// Surfaces map to popover tabs + list routes. Extend as new popover
+// surfaces are added (table, schedule, etc.).
+const SURFACES = [
+  "task",
+  "project",
+  "workflow",
+  "document",
+  "skill",
+  "profile",
+] as const;
+
+const SavedSearchSchema = z.object({
+  id: z.string().min(1),
+  surface: z.enum(SURFACES),
+  label: z.string().min(1).max(120),
+  filterInput: z.string().max(500),
+  createdAt: z.string(), // ISO 8601
+});
+
+const PayloadSchema = z.object({
+  searches: z.array(SavedSearchSchema),
+});
+
+export type SavedSearch = z.infer<typeof SavedSearchSchema>;
+
+export async function GET() {
+  const raw = await getSetting(SETTINGS_KEY);
+  if (!raw) return NextResponse.json({ searches: [] });
+  try {
+    const parsed = PayloadSchema.parse(JSON.parse(raw));
+    return NextResponse.json(parsed);
+  } catch {
+    return NextResponse.json({ searches: [] });
+  }
+}
+
+export async function PUT(req: NextRequest) {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "invalid JSON body" }, { status: 400 });
+  }
+
+  const result = PayloadSchema.safeParse(body);
+  if (!result.success) {
+    return NextResponse.json(
+      { error: "invalid searches payload", issues: result.error.issues },
+      { status: 400 }
+    );
+  }
+
+  const byId = new Map<string, SavedSearch>();
+  for (const s of result.data.searches) byId.set(s.id, s);
+  const deduped = Array.from(byId.values());
+
+  await setSetting(SETTINGS_KEY, JSON.stringify({ searches: deduped }));
+  return NextResponse.json({ searches: deduped });
+}

package/src/app/api/settings/environment/route.ts

@@ -0,0 +1,26 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSetting, setSetting } from "@/lib/settings/helpers";
+import { SETTINGS_KEYS } from "@/lib/constants/settings";
+
+export async function GET() {
+  const autoPromote = await getSetting(SETTINGS_KEYS.AUTO_PROMOTE_SKILLS);
+  return NextResponse.json({
+    autoPromoteSkills: autoPromote === "true",
+  });
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+
+  if (body.autoPromoteSkills !== undefined) {
+    await setSetting(
+      SETTINGS_KEYS.AUTO_PROMOTE_SKILLS,
+      body.autoPromoteSkills ? "true" : "false"
+    );
+  }
+
+  const autoPromote = await getSetting(SETTINGS_KEYS.AUTO_PROMOTE_SKILLS);
+  return NextResponse.json({
+    autoPromoteSkills: autoPromote === "true",
+  });
+}

package/src/app/api/settings/openai/login/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+import {
+  cancelOpenAIChatGPTLogin,
+  getOpenAILoginState,
+  startOpenAIChatGPTLogin,
+} from "@/lib/settings/openai-login-manager";
+import { setOpenAIAuthSettings } from "@/lib/settings/openai-auth";
+
+export async function GET() {
+  return NextResponse.json(getOpenAILoginState());
+}
+
+export async function POST() {
+  await setOpenAIAuthSettings({ method: "oauth" });
+  const state = await startOpenAIChatGPTLogin();
+  return NextResponse.json(state);
+}
+
+export async function DELETE() {
+  const state = await cancelOpenAIChatGPTLogin();
+  return NextResponse.json(state);
+}

package/src/app/api/settings/openai/logout/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from "next/server";
+import { logoutStagentCodexAuth } from "@/lib/agents/runtime/openai-codex-auth";
+
+export async function POST() {
+  await logoutStagentCodexAuth();
+  return NextResponse.json({ success: true });
+}

package/src/app/api/settings/openai/route.ts

@@ -3,11 +3,31 @@ import {
   getOpenAIAuthSettings,
   setOpenAIAuthSettings,
 } from "@/lib/settings/openai-auth";
+import { readStagentCodexAuthState } from "@/lib/agents/runtime/openai-codex-auth";
 import { updateOpenAISettingsSchema } from "@/lib/validators/settings";
 
 export async function GET() {
   const settings = await getOpenAIAuthSettings();
-  return NextResponse.json(settings);
+  if (settings.method !== "oauth") {
+    return NextResponse.json(settings);
+  }
+
+  try {
+    const current = await readStagentCodexAuthState({ refreshToken: true });
+    return NextResponse.json({
+      ...settings,
+      oauthConnected: current.connected,
+      account: current.account,
+      rateLimits: current.rateLimits,
+    });
+  } catch {
+    return NextResponse.json({
+      ...settings,
+      oauthConnected: false,
+      account: null,
+      rateLimits: null,
+    });
+  }
 }
 
 export async function POST(req: NextRequest) {

package/src/app/api/settings/providers/route.ts

@@ -1,17 +1,39 @@
 import { NextResponse } from "next/server";
+import { readStagentCodexAuthState } from "@/lib/agents/runtime/openai-codex-auth";
 import { getRuntimeSetupStates } from "@/lib/settings/runtime-setup";
 import { getRoutingPreference } from "@/lib/settings/routing";
 import { getAuthSettings } from "@/lib/settings/auth";
 import { getOpenAIAuthSettings } from "@/lib/settings/openai-auth";
+import { getOpenAILoginState } from "@/lib/settings/openai-login-manager";
 
 export async function GET() {
-  const [runtimeStates, routingPreference, anthropicAuth, openaiAuth] =
-    await Promise.all([
-      getRuntimeSetupStates(),
-      getRoutingPreference(),
-      getAuthSettings(),
-      getOpenAIAuthSettings(),
-    ]);
+  const [routingPreference, anthropicAuth, initialOpenaiAuth] = await Promise.all([
+    getRoutingPreference(),
+    getAuthSettings(),
+    getOpenAIAuthSettings(),
+  ]);
+
+  let openaiAuth = initialOpenaiAuth;
+  if (openaiAuth.method === "oauth") {
+    try {
+      const current = await readStagentCodexAuthState({ refreshToken: true });
+      openaiAuth = {
+        ...openaiAuth,
+        oauthConnected: current.connected,
+        account: current.account,
+        rateLimits: current.rateLimits,
+      };
+    } catch {
+      openaiAuth = {
+        ...openaiAuth,
+        oauthConnected: false,
+        account: null,
+        rateLimits: null,
+      };
+    }
+  }
+
+  const runtimeStates = await getRuntimeSetupStates();
 
   const anthropicConfigured =
     runtimeStates["claude-code"].configured ||
@@ -42,9 +64,14 @@ export async function GET() {
       },
       openai: {
         configured: openaiConfigured,
+        authMethod: openaiAuth.method,
         hasKey: openaiAuth.hasKey,
         apiKeySource: openaiAuth.apiKeySource,
-        dualBilling: false,
+        oauthConnected: openaiAuth.oauthConnected,
+        account: openaiAuth.account,
+        rateLimits: openaiAuth.rateLimits,
+        login: getOpenAILoginState(),
+        dualBilling: openaiAuth.oauthConnected && openaiAuth.hasKey,
         runtimes: [
           runtimeStates["openai-codex-app-server"],
           runtimeStates["openai-direct"],