kandev/apps/web/app/actions/agents.ts

"use server";

import { getBackendConfig } from "@/lib/config";
import type {
  Agent,
  AgentProfile,
  AgentProfileMcpConfig,
  CLIFlag,
  ProfileEnvVar,
  McpServerDef,
  ListAgentsResponse,
  ListAgentDiscoveryResponse,
} from "@/lib/types/http";
import type { PermissionKey } from "@/lib/agent-permissions";
import { normalizeAgentProfile } from "@/lib/api/domains/agent-profile-normalize";

type ProfilePermissions = Record<PermissionKey, boolean>;

const { apiBaseUrl } = getBackendConfig();

function normalizeAgentInPlace(agent: Agent): Agent {
  return {
    ...agent,
    profiles: (agent.profiles ?? []).map((profile) => normalizeAgentProfile(profile)),
  };
}

async function fetchJson<T>(url: string, options?: RequestInit): Promise<T> {
  // Pin the URL origin to the configured backend so a tainted path segment
  // (agent ID from a form, profile ID from a route param) cannot redirect
  // the request to a different host. Closes the CodeQL SSRF finding.
  const parsed = new URL(url);
  const allowed = new URL(apiBaseUrl);
  if (parsed.origin !== allowed.origin) {
    throw new Error(`Refusing to fetch outside configured backend origin: ${parsed.origin}`);
  }
  const response = await fetch(parsed.toString(), {
    ...options,
    cache: "no-store",
    headers: {
      "Content-Type": "application/json",
      ...(options?.headers ?? {}),
    },
  });
  if (!response.ok) {
    throw new Error(`Request failed: ${response.status} ${response.statusText}`);
  }
  if (response.status === 204) {
    return undefined as T;
  }
  const text = await response.text();
  if (!text) {
    return undefined as T;
  }
  return JSON.parse(text) as T;
}

export async function listAgentDiscoveryAction(): Promise<ListAgentDiscoveryResponse> {
  return fetchJson<ListAgentDiscoveryResponse>(`${apiBaseUrl}/api/v1/agents/discovery`);
}

export async function listAgentsAction(): Promise<ListAgentsResponse> {
  const res = await fetchJson<ListAgentsResponse>(`${apiBaseUrl}/api/v1/agents`);
  return { ...res, agents: (res.agents ?? []).map(normalizeAgentInPlace) };
}

export async function createAgentAction(payload: {
  name: string;
  workspace_id?: string | null;
  profiles?: Array<
    {
      name: string;
      model: string;
      mode?: string;
      cli_passthrough: boolean;
      cli_flags?: CLIFlag[];
      env_vars?: ProfileEnvVar[];
    } & ProfilePermissions
  >;
}): Promise<Agent> {
  const res = await fetchJson<Agent>(`${apiBaseUrl}/api/v1/agents`, {
    method: "POST",
    body: JSON.stringify(payload),
  });
  return normalizeAgentInPlace(res);
}

export async function updateAgentAction(
  id: string,
  payload: {
    workspace_id?: string | null;
    supports_mcp?: boolean;
    mcp_config_path?: string | null;
  },
): Promise<Agent> {
  const res = await fetchJson<Agent>(`${apiBaseUrl}/api/v1/agents/${id}`, {
    method: "PATCH",
    body: JSON.stringify(payload),
  });
  return normalizeAgentInPlace(res);
}

export async function deleteAgentAction(id: string) {
  await fetchJson<void>(`${apiBaseUrl}/api/v1/agents/${id}`, { method: "DELETE" });
}

export async function createAgentProfileAction(
  agentId: string,
  payload: {
    name: string;
    model: string;
    mode?: string;
    cli_passthrough: boolean;
    cli_flags?: CLIFlag[];
    env_vars?: ProfileEnvVar[];
  } & ProfilePermissions,
): Promise<AgentProfile> {
  const raw = await fetchJson<unknown>(`${apiBaseUrl}/api/v1/agents/${agentId}/profiles`, {
    method: "POST",
    body: JSON.stringify(payload),
  });
  return normalizeAgentProfile(raw);
}

export async function updateAgentProfileAction(
  id: string,
  payload: {
    name?: string;
    model?: string;
    mode?: string;
    allow_indexing?: boolean;
    auto_approve?: boolean;
    cli_passthrough?: boolean;
    cli_flags?: CLIFlag[];
    env_vars?: ProfileEnvVar[];
  },
): Promise<AgentProfile> {
  const raw = await fetchJson<unknown>(`${apiBaseUrl}/api/v1/agent-profiles/${id}`, {
    method: "PATCH",
    body: JSON.stringify(payload),
  });
  return normalizeAgentProfile(raw);
}

import type { ActiveSessionInfo, WatcherReference } from "@/lib/types/agent-profile-errors";

export type DeleteProfileResult =
  | { status: "ok" }
  | {
      status: "conflict";
      activeSessions: ActiveSessionInfo[];
      watchers: WatcherReference[];
    }
  | { status: "error"; message: string };

export async function deleteAgentProfileAction(
  id: string,
  force?: boolean,
): Promise<DeleteProfileResult> {
  const url = `${apiBaseUrl}/api/v1/agent-profiles/${id}${force ? "?force=true" : ""}`;
  const response = await fetch(url, {
    method: "DELETE",
    cache: "no-store",
    headers: { "Content-Type": "application/json" },
  });
  if (!response.ok) {
    const body = await response.json().catch(() => ({}));
    // A 409 is either active-sessions, referencing watchers, or both.
    // Treat any non-empty list as the conflict signal — a watcher-only
    // conflict (the new self-heal path) must still pop the dialog.
    if (response.status === 409 && (body.active_sessions || body.watchers)) {
      return {
        status: "conflict",
        activeSessions: body.active_sessions ?? [],
        watchers: body.watchers ?? [],
      };
    }
    return {
      status: "error",
      message: body?.error || `Request failed: ${response.status} ${response.statusText}`,
    };
  }
  return { status: "ok" };
}

export async function getAgentProfileMcpConfigAction(
  profileId: string,
): Promise<AgentProfileMcpConfig> {
  return fetchJson<AgentProfileMcpConfig>(
    `${apiBaseUrl}/api/v1/agent-profiles/${profileId}/mcp-config`,
  );
}

export async function updateAgentProfileMcpConfigAction(
  profileId: string,
  payload: {
    enabled: boolean;
    mcpServers: Record<string, McpServerDef>;
    meta?: Record<string, unknown>;
  },
): Promise<AgentProfileMcpConfig> {
  return fetchJson<AgentProfileMcpConfig>(
    `${apiBaseUrl}/api/v1/agent-profiles/${profileId}/mcp-config`,
    {
      method: "POST",
      body: JSON.stringify(payload),
    },
  );
}

export type CommandPreviewRequest = {
  model: string;
  permission_settings: Record<string, boolean>;
  cli_passthrough: boolean;
  cli_flags: CLIFlag[];
};

export type CommandPreviewResponse = {
  supported: boolean;
  command: string[];
  command_string: string;
};

export async function previewAgentCommandAction(
  agentName: string,
  payload: CommandPreviewRequest,
): Promise<CommandPreviewResponse> {
  return fetchJson<CommandPreviewResponse>(
    `${apiBaseUrl}/api/v1/agent-command-preview/${agentName}`,
    {
      method: "POST",
      body: JSON.stringify(payload),
    },
  );
}