fix: handle bare repos in branch creation and checkout

- Fall back to symbolic-ref when checkout --orphan fails on bare repos\n- Fall back to symbolic-ref when checkout fails on bare repos\n- Make get_current_branch handle bare repos with unborn branches\n- Add integration tests for bare repo branch operations\n\nQuality gates: pytest integration tests (12 passed)

.gitignore

@@ -48,8 +48,3 @@ apps/web/dist/
 # OS
 .DS_Store
 Thumbs.db
-
-# Local runtime state
-.atl/
-.pi/
-swap-pane

AGENTS.md

@@ -87,6 +87,31 @@ Do not claim completion without verification evidence.
 
 ## Git workflow
 
+### Branching strategy
+
+For every spec change or new functionality:
+
+1. Create a new branch from `dev` with a proper prefix:
+   - `feat/` for new features (e.g., `feat/tool-workshop`)
+   - `fix/` for bug fixes (e.g., `fix/terminal-tty`)
+   - `refactor/` for refactors (e.g., `refactor/api-cleanup`)
+   - `docs/` for documentation (e.g., `docs/api-guide`)
+   - `chore/` for maintenance (e.g., `chore/update-deps`)
+2. Branch name should reference the OpenSpec change name when applicable.
+3. Do not commit directly to `main` or `dev`.
+
+### Completion and merge
+
+When implementation is complete and verified:
+
+1. Ensure all tests pass and quality gates are met.
+2. Stage all changes with `git add -A`.
+3. Create a commit with a proper conventional commit message (see below).
+4. Switch to `dev`: `git checkout dev`.
+5. Merge the feature branch: `git merge --no-ff <branch-name>`.
+6. Push to remote: `git push origin dev`.
+7. Delete the local feature branch if desired: `git branch -d <branch-name>`.
+
 ### Auto-commit on spec completion
 
 When an OpenSpec change is fully implemented and all tasks are complete:

CHANGELOG.md

@@ -21,7 +21,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **User Settings** - Theme selection, git identity, and preference management
 - **SSH Key Management** - Ed25519 key generation with secure storage
 - **Tool Types** - Built-in development tools (code-server, jupyter-notebook) with custom type support
-- **Config Profiles** - User-owned profile CRUD with includes, mounts, path validation, cycle detection, and default profile selection
 - **Comprehensive Documentation** - Architecture, API, deployment, and development guides
 
 ### Changed

apps/api/alembic/versions/0013_add_config_profiles.py

@@ -1,104 +0,0 @@
-"""add config profiles, includes, mounts, and tool instance profile selection
-
-Revision ID: 0013_add_config_profiles
-Revises: 0012_default_port_req
-Create Date: 2026-05-24 12:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-# revision identifiers, used by Alembic.
-revision: str = "0013_add_config_profiles"
-down_revision: Union[str, None] = "0012_default_port_req"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    # Create config_profiles table
-    op.create_table(
-        "config_profiles",
-        sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("user_id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("name", sa.String(length=255), nullable=False),
-        sa.Column("description", sa.Text(), nullable=True),
-        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
-        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
-        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
-        sa.PrimaryKeyConstraint("id"),
-        sa.UniqueConstraint("user_id", "name", name="uq_config_profiles_user_name"),
-    )
-    op.create_index("idx_config_profiles_user", "config_profiles", ["user_id"])
-
-    # Create config_includes table
-    op.create_table(
-        "config_includes",
-        sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("profile_id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("included_profile_id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("order_index", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
-        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
-        sa.ForeignKeyConstraint(["profile_id"], ["config_profiles.id"], ondelete="CASCADE"),
-        sa.ForeignKeyConstraint(["included_profile_id"], ["config_profiles.id"], ondelete="CASCADE"),
-        sa.PrimaryKeyConstraint("id"),
-        sa.UniqueConstraint("profile_id", "included_profile_id", name="uq_config_includes_pair"),
-    )
-    op.create_index("idx_config_includes_profile", "config_includes", ["profile_id"])
-    op.create_index("idx_config_includes_included", "config_includes", ["included_profile_id"])
-
-    # Create config_mounts table
-    op.create_table(
-        "config_mounts",
-        sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("profile_id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("mount_path", sa.String(length=1024), nullable=False),
-        sa.Column("content", sa.Text(), nullable=True),
-        sa.Column("source_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
-        sa.Column("order_index", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
-        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
-        sa.ForeignKeyConstraint(["profile_id"], ["config_profiles.id"], ondelete="CASCADE"),
-        sa.ForeignKeyConstraint(["source_profile_id"], ["config_profiles.id"], ondelete="SET NULL"),
-        sa.PrimaryKeyConstraint("id"),
-    )
-    op.create_index("idx_config_mounts_profile", "config_mounts", ["profile_id"])
-
-    # Add selected_profile_id to tool_instances
-    op.add_column(
-        "tool_instances",
-        sa.Column("selected_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
-    )
-    op.create_foreign_key(
-        "fk_tool_instances_selected_profile",
-        "tool_instances",
-        "config_profiles",
-        ["selected_profile_id"],
-        ["id"],
-        ondelete="SET NULL",
-    )
-    op.create_index("idx_tool_instances_selected_profile", "tool_instances", ["selected_profile_id"])
-
-
-def downgrade() -> None:
-    # Remove selected_profile_id from tool_instances
-    op.drop_index("idx_tool_instances_selected_profile", table_name="tool_instances")
-    op.drop_constraint("fk_tool_instances_selected_profile", "tool_instances", type_="foreignkey")
-    op.drop_column("tool_instances", "selected_profile_id")
-
-    # Drop config_mounts
-    op.drop_index("idx_config_mounts_profile", table_name="config_mounts")
-    op.drop_table("config_mounts")
-
-    # Drop config_includes
-    op.drop_index("idx_config_includes_included", table_name="config_includes")
-    op.drop_index("idx_config_includes_profile", table_name="config_includes")
-    op.drop_table("config_includes")
-
-    # Drop config_profiles
-    op.drop_index("idx_config_profiles_user", table_name="config_profiles")
-    op.drop_table("config_profiles")

apps/api/alembic/versions/0014_add_profile_resolver_fields.py

@@ -1,119 +0,0 @@
-"""add profile resolver fields to config profiles and mounts
-
-Revision ID: 0014_add_profile_resolver_fields
-Revises: 0013_add_config_profiles
-Create Date: 2026-05-24 14:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-# revision identifiers, used by Alembic.
-revision: str = "0014_add_profile_resolver_fields"
-down_revision: Union[str, None] = "0013_add_config_profiles"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    # Add fields to config_profiles
-    op.add_column(
-        "config_profiles",
-        sa.Column("project_id", postgresql.UUID(as_uuid=True), nullable=True),
-    )
-    op.add_column(
-        "config_profiles",
-        sa.Column("tool_type_id", postgresql.UUID(as_uuid=True), nullable=True),
-    )
-    op.add_column(
-        "config_profiles",
-        sa.Column("environment_variables", sa.JSON(), nullable=True),
-    )
-    op.add_column(
-        "config_profiles",
-        sa.Column("start_command", sa.Text(), nullable=True),
-    )
-    op.add_column(
-        "config_profiles",
-        sa.Column("working_directory", sa.Text(), nullable=True),
-    )
-    op.add_column(
-        "config_profiles",
-        sa.Column("port", sa.Integer(), nullable=True),
-    )
-    op.add_column(
-        "config_profiles",
-        sa.Column("is_default", sa.Boolean(), nullable=False, server_default="false"),
-    )
-    
-    # Add foreign keys for project and tool_type
-    op.create_foreign_key(
-        "fk_config_profiles_project",
-        "config_profiles",
-        "projects",
-        ["project_id"],
-        ["id"],
-        ondelete="CASCADE",
-    )
-    op.create_foreign_key(
-        "fk_config_profiles_tool_type",
-        "config_profiles",
-        "tool_types",
-        ["tool_type_id"],
-        ["id"],
-        ondelete="CASCADE",
-    )
-    
-    # Create indices
-    op.create_index("idx_config_profiles_project", "config_profiles", ["project_id"])
-    op.create_index("idx_config_profiles_tool_type", "config_profiles", ["tool_type_id"])
-    
-    # Alter config_mounts: rename mount_path to target_path, add mode, change content to files JSON
-    op.alter_column("config_mounts", "mount_path", new_column_name="target_path")
-    op.add_column(
-        "config_mounts",
-        sa.Column("mode", sa.String(length=10), nullable=False, server_default="rw"),
-    )
-    op.add_column(
-        "config_mounts",
-        sa.Column("files", sa.JSON(), nullable=True),
-    )
-    # Drop the source_profile foreign key if it exists
-    op.drop_constraint(
-        "config_mounts_source_profile_id_fkey",
-        "config_mounts",
-        type_="foreignkey",
-    )
-    op.drop_column("config_mounts", "content")
-    op.drop_column("config_mounts", "source_profile_id")
-
-
-def downgrade() -> None:
-    # Restore config_mounts
-    op.add_column(
-        "config_mounts",
-        sa.Column("source_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
-    )
-    op.add_column(
-        "config_mounts",
-        sa.Column("content", sa.Text(), nullable=True),
-    )
-    op.drop_column("config_mounts", "files")
-    op.drop_column("config_mounts", "mode")
-    op.alter_column("config_mounts", "target_path", new_column_name="mount_path")
-    
-    # Restore config_profiles
-    op.drop_index("idx_config_profiles_tool_type", table_name="config_profiles")
-    op.drop_index("idx_config_profiles_project", table_name="config_profiles")
-    op.drop_constraint("fk_config_profiles_tool_type", "config_profiles", type_="foreignkey")
-    op.drop_constraint("fk_config_profiles_project", "config_profiles", type_="foreignkey")
-    op.drop_column("config_profiles", "is_default")
-    op.drop_column("config_profiles", "port")
-    op.drop_column("config_profiles", "working_directory")
-    op.drop_column("config_profiles", "start_command")
-    op.drop_column("config_profiles", "environment_variables")
-    op.drop_column("config_profiles", "tool_type_id")
-    op.drop_column("config_profiles", "project_id")

apps/api/src/api/config_folders.py

@@ -4,23 +4,111 @@ import logging
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, status
-from pydantic import Field
+from pydantic import BaseModel, Field, field_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.auth.dependencies import get_current_user_id, get_db_session
 from src.models.config_folder import ConfigFolder
-from src.schemas.config_folder import (
-    ConfigFolderCreate,
-    ConfigFolderUpdate,
-    ConfigFolderResponse,
-    ProjectOverrideCreate,
-)
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/config-folders", tags=["config-folders"])
 
+MAX_FOLDER_SIZE_MB = 10
+MAX_FOLDER_SIZE_BYTES = MAX_FOLDER_SIZE_MB * 1024 * 1024
+
+
+class ConfigFolderCreate(BaseModel):
+    name: str = Field(description="Folder name (unique per user)")
+    description: str | None = Field(default=None, description="Optional description")
+    mount_path: str = Field(description="Default mount path in container")
+    files: dict = Field(default_factory=dict, description="Files as {path: content}")
+
+    @field_validator("mount_path")
+    @classmethod
+    def validate_mount_path(cls, v: str) -> str:
+        if not v.startswith("/"):
+            raise ValueError("Mount path must be absolute (start with /)")
+        return v
+
+    @field_validator("files")
+    @classmethod
+    def validate_files(cls, v: dict) -> dict:
+        total_size = 0
+        for path, content in v.items():
+            # Check for path traversal
+            if ".." in path or path.startswith("/"):
+                raise ValueError(f"Invalid file path: {path}")
+            total_size += len(content.encode("utf-8"))
+        
+        if total_size > MAX_FOLDER_SIZE_BYTES:
+            raise ValueError(f"Total folder size exceeds {MAX_FOLDER_SIZE_MB}MB limit")
+        
+        return v
+
+
+class ConfigFolderUpdate(BaseModel):
+    name: str | None = Field(default=None, description="Folder name")
+    description: str | None = Field(default=None, description="Optional description")
+    mount_path: str | None = Field(default=None, description="Default mount path")
+    files: dict | None = Field(default=None, description="Files as {path: content}")
+    is_active: bool | None = Field(default=None, description="Active/inactive toggle")
+
+    @field_validator("mount_path")
+    @classmethod
+    def validate_mount_path(cls, v: str | None) -> str | None:
+        if v is None:
+            return v
+        if not v.startswith("/"):
+            raise ValueError("Mount path must be absolute (start with /)")
+        return v
+
+    @field_validator("files")
+    @classmethod
+    def validate_files(cls, v: dict | None) -> dict | None:
+        if v is None:
+            return v
+        
+        total_size = 0
+        for path, content in v.items():
+            # Check for path traversal
+            if ".." in path or path.startswith("/"):
+                raise ValueError(f"Invalid file path: {path}")
+            total_size += len(content.encode("utf-8"))
+        
+        if total_size > MAX_FOLDER_SIZE_BYTES:
+            raise ValueError(f"Total folder size exceeds {MAX_FOLDER_SIZE_MB}MB limit")
+        
+        return v
+
+
+class ProjectOverrideCreate(BaseModel):
+    mount_path: str | None = Field(default=None, description="Override mount path")
+    files: dict = Field(default_factory=dict, description="Override files")
+
+    @field_validator("mount_path")
+    @classmethod
+    def validate_mount_path(cls, v: str | None) -> str | None:
+        if v is None:
+            return v
+        if not v.startswith("/"):
+            raise ValueError("Mount path must be absolute (start with /)")
+        return v
+
+
+class ConfigFolderResponse(BaseModel):
+    id: str
+    user_id: str
+    name: str
+    description: str | None
+    mount_path: str
+    files: dict
+    project_overrides: dict | None
+    is_active: bool
+    created_at: str
+    updated_at: str
+
 
 @router.get("", summary="List config folders", description="Get all config folders for the current user.")
 async def list_config_folders(

apps/api/src/api/config_profiles.py

@@ -1,299 +0,0 @@
-"""Config profile API endpoints."""
-
-import logging
-import uuid
-
-from fastapi import APIRouter, Depends, HTTPException, status
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import selectinload
-
-from src.auth.dependencies import get_current_user_id, get_db_session
-from src.models.config_include import ConfigInclude
-from src.models.config_mount import ConfigMount
-from src.models.config_profile import ConfigProfile
-from src.models.tool_type import ToolType
-from src.models.user_config import UserConfig
-from src.schemas.config_profile import (
-    ConfigIncludeCreate,
-    ConfigIncludeUpdate,
-    ConfigMountCreate,
-    ConfigMountUpdate,
-    ConfigProfileCreate,
-    ConfigProfileUpdate,
-    DefaultProfilesUpdate,
-)
-from src.services.config_profiles import (
-    check_duplicate_include,
-    check_duplicate_mount_path,
-    check_duplicate_name,
-    get_default_profile_for_tool_type,
-    get_default_profiles,
-    get_owned_profile,
-    include_to_dict,
-    list_includes_for_profile,
-    list_mounts_for_profile,
-    mount_to_dict,
-    profile_to_dict,
-    set_default_profiles,
-    validate_includes_no_cycle,
-)
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(prefix="/config-profiles", tags=["config-profiles"])
-
-
-
-@router.get("")
-async def list_config_profiles(
-    tool_type_id: str | None = None,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    query = select(ConfigProfile).where(ConfigProfile.user_id == user_id)
-    if tool_type_id:
-        tool_type = await session.get(ToolType, uuid.UUID(tool_type_id))
-        if tool_type is None:
-            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
-    result = await session.execute(query.order_by(ConfigProfile.name))
-    return {"profiles": [profile_to_dict(p) for p in result.scalars().all()]}
-
-
-@router.post("", status_code=status.HTTP_201_CREATED)
-async def create_config_profile(
-    data: ConfigProfileCreate,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    await check_duplicate_name(session, user_id, data.name)
-    profile = ConfigProfile(user_id=user_id, name=data.name, description=data.description)
-    session.add(profile)
-    await session.commit()
-    await session.refresh(profile)
-    return profile_to_dict(profile)
-
-
-@router.get("/defaults")
-async def get_default_profiles_endpoint(
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    return await get_default_profiles(session, user_id)
-
-
-@router.put("/defaults")
-async def set_default_profiles_endpoint(
-    data: DefaultProfilesUpdate,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    return await set_default_profiles(session, user_id, data.default_profiles)
-
-
-@router.get("/defaults/{tool_type_id}")
-async def get_default_profile_for_tool_type_endpoint(
-    tool_type_id: str,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    return await get_default_profile_for_tool_type(session, user_id, tool_type_id)
-
-
-@router.get("/{profile_id}")
-async def get_config_profile(
-    profile_id: uuid.UUID,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    profile = await session.get(
-        ConfigProfile,
-        profile_id,
-        options=[selectinload(ConfigProfile.includes), selectinload(ConfigProfile.mounts)],
-    )
-    if profile is None or profile.user_id != user_id:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config profile not found")
-    includes_data = []
-    for inc in profile.includes:
-        included_profile = await session.get(ConfigProfile, inc.included_profile_id)
-        includes_data.append(include_to_dict(inc, included_profile.name if included_profile else None))
-    return {
-        **profile_to_dict(profile),
-        "includes": includes_data,
-        "mounts": [mount_to_dict(m) for m in profile.mounts],
-    }
-
-
-@router.put("/{profile_id}")
-async def update_config_profile(
-    profile_id: uuid.UUID,
-    data: ConfigProfileUpdate,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    profile = await get_owned_profile(profile_id, user_id, session)
-    if data.name is not None:
-        await check_duplicate_name(session, user_id, data.name, exclude_id=profile_id)
-        profile.name = data.name
-    if data.description is not None:
-        profile.description = data.description
-    await session.commit()
-    await session.refresh(profile)
-    return profile_to_dict(profile)
-
-
-@router.delete("/{profile_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_config_profile(
-    profile_id: uuid.UUID,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> None:
-    profile = await get_owned_profile(profile_id, user_id, session)
-    await session.delete(profile)
-    await session.commit()
-
-
-
-@router.get("/{profile_id}/includes")
-async def list_profile_includes(
-    profile_id: uuid.UUID,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    await get_owned_profile(profile_id, user_id, session)
-    return await list_includes_for_profile(session, profile_id)
-
-
-@router.post("/{profile_id}/includes", status_code=status.HTTP_201_CREATED)
-async def add_profile_include(
-    profile_id: uuid.UUID,
-    data: ConfigIncludeCreate,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    profile = await get_owned_profile(profile_id, user_id, session)
-    included_profile_id = uuid.UUID(data.included_profile_id)
-    if included_profile_id == profile_id:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="a profile cannot include itself")
-    included_profile = await session.get(ConfigProfile, included_profile_id)
-    if included_profile is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="included profile not found")
-    if included_profile.user_id != user_id:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="included profile does not belong to user")
-    await check_duplicate_include(session, profile_id, included_profile_id)
-    await validate_includes_no_cycle(session, profile_id, included_profile_id)
-    include = ConfigInclude(
-        profile_id=profile_id,
-        included_profile_id=included_profile_id,
-        order_index=data.order_index,
-    )
-    session.add(include)
-    await session.commit()
-    await session.refresh(include)
-    return include_to_dict(include, included_profile.name)
-
-
-@router.put("/{profile_id}/includes/{include_id}")
-async def update_profile_include(
-    profile_id: uuid.UUID,
-    include_id: uuid.UUID,
-    data: ConfigIncludeUpdate,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    await get_owned_profile(profile_id, user_id, session)
-    include = await session.get(ConfigInclude, include_id)
-    if include is None or include.profile_id != profile_id:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="include not found")
-    include.order_index = data.order_index
-    await session.commit()
-    await session.refresh(include)
-    included_profile = await session.get(ConfigProfile, include.included_profile_id)
-    return include_to_dict(include, included_profile.name if included_profile else None)
-
-
-@router.delete("/{profile_id}/includes/{include_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def remove_profile_include(
-    profile_id: uuid.UUID,
-    include_id: uuid.UUID,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> None:
-    await get_owned_profile(profile_id, user_id, session)
-    include = await session.get(ConfigInclude, include_id)
-    if include is None or include.profile_id != profile_id:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="include not found")
-    await session.delete(include)
-    await session.commit()
-
-
-
-@router.get("/{profile_id}/mounts")
-async def list_profile_mounts(
-    profile_id: uuid.UUID,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    await get_owned_profile(profile_id, user_id, session)
-    return await list_mounts_for_profile(session, profile_id)
-
-
-@router.post("/{profile_id}/mounts", status_code=status.HTTP_201_CREATED)
-async def add_profile_mount(
-    profile_id: uuid.UUID,
-    data: ConfigMountCreate,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    profile = await get_owned_profile(profile_id, user_id, session)
-    await check_duplicate_mount_path(session, profile_id, data.target_path)
-    mount = ConfigMount(
-        profile_id=profile_id,
-        target_path=data.target_path,
-        mode=data.mode,
-        files=data.files,
-        order_index=data.order_index,
-    )
-    session.add(mount)
-    await session.commit()
-    await session.refresh(mount)
-    return mount_to_dict(mount)
-
-
-@router.put("/{profile_id}/mounts/{mount_id}")
-async def update_profile_mount(
-    profile_id: uuid.UUID,
-    mount_id: uuid.UUID,
-    data: ConfigMountUpdate,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> dict:
-    await get_owned_profile(profile_id, user_id, session)
-    mount = await session.get(ConfigMount, mount_id)
-    if mount is None or mount.profile_id != profile_id:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="mount not found")
-    if data.target_path is not None:
-        await check_duplicate_mount_path(session, profile_id, data.target_path, exclude_id=mount_id)
-        mount.target_path = data.target_path
-    if data.files is not None:
-        mount.files = data.files
-    if data.order_index is not None:
-        mount.order_index = data.order_index
-    await session.commit()
-    await session.refresh(mount)
-    return mount_to_dict(mount)
-
-
-@router.delete("/{profile_id}/mounts/{mount_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def remove_profile_mount(
-    profile_id: uuid.UUID,
-    mount_id: uuid.UUID,
-    user_id: uuid.UUID = Depends(get_current_user_id),
-    session: AsyncSession = Depends(get_db_session),
-) -> None:
-    await get_owned_profile(profile_id, user_id, session)
-    mount = await session.get(ConfigMount, mount_id)
-    if mount is None or mount.profile_id != profile_id:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="mount not found")
-    await session.delete(mount)
-    await session.commit()

apps/api/src/api/health.py

@@ -5,17 +5,11 @@ from datetime import datetime, timezone
 from typing import Any
 
 from fastapi import APIRouter, status
+from pydantic import BaseModel, Field
 from sqlalchemy import text
 
 from src.config import Settings
 from src.database import SessionLocal
-from src.schemas.health import (
-    DatabaseHealth,
-    DatabaseHealthResponse,
-    DiskHealth,
-    HealthChecks,
-    HealthResponse,
-)
 
 router = APIRouter()
 
@@ -23,6 +17,45 @@ router = APIRouter()
 _start_time = time.time()
 
 
+class DatabaseHealth(BaseModel):
+    """Database health check result."""
+
+    status: str = Field(description="Database health status", examples=["healthy"])
+    response_time_ms: float = Field(description="Query response time in milliseconds", examples=[5.2])
+
+
+class DiskHealth(BaseModel):
+    """Disk space health check result."""
+
+    status: str = Field(description="Disk health status", examples=["healthy"])
+    free_gb: float = Field(description="Free disk space in GB", examples=[45.2])
+    total_gb: float = Field(description="Total disk space in GB", examples=[100.0])
+
+
+class HealthChecks(BaseModel):
+    """Individual health checks."""
+
+    database: DatabaseHealth | None = None
+    disk: DiskHealth | None = None
+
+
+class HealthResponse(BaseModel):
+    """Overall health check response."""
+
+    status: str = Field(description="Overall health status", examples=["healthy"])
+    timestamp: str = Field(description="ISO 8601 timestamp", examples=["2026-05-19T12:00:00Z"])
+    version: str = Field(description="API version", examples=["0.1.0"])
+    checks: HealthChecks = Field(description="Individual health checks")
+    uptime_seconds: float = Field(description="Server uptime in seconds", examples=[3600.0])
+
+
+class DatabaseHealthResponse(BaseModel):
+    """Database-specific health check response."""
+
+    status: str = Field(description="Database health status", examples=["healthy"])
+    response_time_ms: float = Field(description="Query response time in milliseconds", examples=[5.2])
+
+
 @router.get(
     "/health",
     response_model=HealthResponse,

apps/api/src/api/projects.py

@@ -3,24 +3,50 @@ import shutil
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Response, status
+from pydantic import BaseModel, ConfigDict
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.auth.dependencies import get_current_user, get_db_session, get_owned_project
+from src.auth.dependencies import get_current_user_id, get_db_session
 from src.models.git_repository import GitRepository
 from src.models.project import Project
 from src.models.ssh_key import SSHKey
 from src.models.user import User
-from src.schemas.project import (
-    ProjectCreate,
-    ProjectUpdate,
-    ProjectResponse,
-    SetDefaultSSHKeyRequest,
-)
 
 router = APIRouter(prefix="/projects", tags=["projects"])
 
 
+async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
+    """Fetch a user by ID or raise 401 if not found."""
+    user = await session.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
+    return user
+
+
+class ProjectCreate(BaseModel):
+    name: str
+    description: str | None = None
+
+
+class ProjectUpdate(BaseModel):
+    name: str | None = None
+    description: str | None = None
+
+
+class ProjectResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    name: str
+    description: str | None
+    owner_id: uuid.UUID
+    default_ssh_key_id: uuid.UUID | None
+
+
+class SetDefaultSSHKeyRequest(BaseModel):
+    ssh_key_id: uuid.UUID
+
 
 @router.post(
     "",
@@ -31,7 +57,7 @@ router = APIRouter(prefix="/projects", tags=["projects"])
 )
 async def create_project(
     data: ProjectCreate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> Project:
     """Create a new project.
@@ -44,6 +70,7 @@ async def create_project(
     Returns:
         The newly created project.
     """
+    user = await _get_user(session, user_id)
     project = Project(
         name=data.name,
         description=data.description,
@@ -63,7 +90,7 @@ async def create_project(
     description="Retrieve all projects owned by the authenticated user.",
 )
 async def list_projects(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> list[Project]:
     """List all projects for the authenticated user.
@@ -75,6 +102,7 @@ async def list_projects(
     Returns:
         List of projects owned by the user.
     """
+    user = await _get_user(session, user_id)
     result = await session.execute(select(Project).where(Project.owner_id == user.id))
     return list(result.scalars().all())
 
@@ -87,8 +115,7 @@ async def list_projects(
 )
 async def get_project(
     project_id: uuid.UUID,
-    user: User = Depends(get_current_user),
-    project: Project = Depends(get_owned_project),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> Project:
     """Get a specific project by ID.
@@ -101,9 +128,35 @@ async def get_project(
     Returns:
         The requested project.
     """
-    return project
+    await _get_user(session, user_id)
+    return await _get_owned_project(project_id, user_id, session)
 
 
+async def _get_owned_project(
+    project_id: uuid.UUID,
+    user_id: uuid.UUID,
+    session: AsyncSession,
+) -> Project:
+    """Fetch a project and verify ownership.
+
+    Args:
+        project_id: UUID of the project.
+        user_id: ID of the authenticated user.
+        session: Database session.
+
+    Returns:
+        The project if found and owned by the user.
+
+    Raises:
+        HTTPException: If project not found or user is not the owner.
+    """
+    project = await session.get(Project, project_id)
+    if project is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="project not found")
+    if project.owner_id != user_id:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="not project owner")
+    return project
+
 
 @router.patch(
     "/{project_id}",
@@ -114,8 +167,7 @@ async def get_project(
 async def update_project(
     project_id: uuid.UUID,
     data: ProjectUpdate,
-    user: User = Depends(get_current_user),
-    project: Project = Depends(get_owned_project),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> Project:
     """Update a project.
@@ -129,6 +181,8 @@ async def update_project(
     Returns:
         The updated project.
     """
+    await _get_user(session, user_id)
+    project = await _get_owned_project(project_id, user_id, session)
 
     if data.name is not None:
         project.name = data.name
@@ -148,8 +202,7 @@ async def update_project(
 )
 async def delete_project(
     project_id: uuid.UUID,
-    user: User = Depends(get_current_user),
-    project: Project = Depends(get_owned_project),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> Response:
     """Delete a project and all its repositories.
@@ -162,6 +215,8 @@ async def delete_project(
     Returns:
         Empty response with 204 status code.
     """
+    await _get_user(session, user_id)
+    project = await _get_owned_project(project_id, user_id, session)
 
     # Delete repositories from disk and database
     result = await session.execute(select(GitRepository).where(GitRepository.project_id == project_id))
@@ -185,8 +240,7 @@ async def delete_project(
 async def set_default_ssh_key(
     project_id: uuid.UUID,
     data: SetDefaultSSHKeyRequest,
-    user: User = Depends(get_current_user),
-    project: Project = Depends(get_owned_project),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> Project:
     """Set the default SSH key for a project.
@@ -200,6 +254,8 @@ async def set_default_ssh_key(
     Returns:
         The updated project.
     """
+    user = await _get_user(session, user_id)
+    project = await _get_owned_project(project_id, user_id, session)
 
     ssh_key = await session.get(SSHKey, data.ssh_key_id)
     if ssh_key is None or ssh_key.user_id != user.id:

apps/api/src/api/ssh_keys.py

@@ -5,18 +5,25 @@ from cryptography.fernet import Fernet
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, ConfigDict
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.auth.dependencies import get_current_user, get_db_session
+from src.auth.dependencies import get_current_user_id, get_db_session
 from src.config import Settings
 from src.models.ssh_key import SSHKey
 from src.models.user import User
-from src.schemas.ssh_key import SSHKeyCreate, SSHKeyResponse
 
 router = APIRouter(prefix="/ssh-keys", tags=["ssh-keys"])
 
 
+async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
+    """Fetch a user by ID or raise 401 if not found."""
+    user = await session.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
+    return user
+
 
 def _get_fernet() -> Fernet:
     """Generate a valid Fernet key from the session secret."""
@@ -54,6 +61,19 @@ def generate_ssh_key_pair() -> tuple[str, str]:
     return private_bytes.decode("utf-8"), public_bytes.decode("utf-8")
 
 
+class SSHKeyCreate(BaseModel):
+    name: str
+
+
+class SSHKeyResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    name: str
+    public_key: str
+    created_at: datetime
+
+
 @router.post(
     "",
     response_model=SSHKeyResponse,
@@ -63,7 +83,7 @@ def generate_ssh_key_pair() -> tuple[str, str]:
 )
 async def create_ssh_key(
     data: SSHKeyCreate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> SSHKey:
     """Create a new SSH key pair.
@@ -76,6 +96,7 @@ async def create_ssh_key(
     Returns:
         The newly created SSH key with public key exposed.
     """
+    user = await _get_user(session, user_id)
     private_key, public_key = generate_ssh_key_pair()
 
     fernet = _get_fernet()
@@ -100,7 +121,7 @@ async def create_ssh_key(
     description="List all SSH keys for the authenticated user.",
 )
 async def list_ssh_keys(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> list[SSHKey]:
     """List all SSH keys for the authenticated user.
@@ -112,6 +133,7 @@ async def list_ssh_keys(
     Returns:
         List of SSH keys owned by the user.
     """
+    user = await _get_user(session, user_id)
     result = await session.execute(select(SSHKey).where(SSHKey.user_id == user.id))
     return list(result.scalars().all())
 
@@ -124,7 +146,7 @@ async def list_ssh_keys(
 )
 async def delete_ssh_key(
     key_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> None:
     """Delete an SSH key.
@@ -137,6 +159,7 @@ async def delete_ssh_key(
     Returns:
         None with 204 status code.
     """
+    user = await _get_user(session, user_id)
     ssh_key = await session.get(SSHKey, key_id)
     if ssh_key is None or ssh_key.user_id != user.id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")

apps/api/src/api/terminal.py

@@ -4,7 +4,7 @@ import asyncio
 import logging
 import uuid
 
-from fastapi import APIRouter, Depends, WebSocket
+from fastapi import APIRouter, Depends, HTTPException, WebSocket, WebSocketDisconnect, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.auth.dependencies import get_db_session
@@ -26,11 +26,6 @@ async def terminal_websocket(
     """WebSocket endpoint for terminal access to a tool instance.
 
     Provides an interactive terminal session inside a running tool instance container.
-    Supports:
-    - Auto-reconnection (client reconnects, server spawns new session)
-    - Heartbeat ping/pong
-    - Binary and text input frames
-    - Graceful session end notifications
 
     Args:
         websocket: The WebSocket connection.
@@ -39,27 +34,26 @@ async def terminal_websocket(
 
     Returns:
         None. Communicates via WebSocket messages.
-
     """
     logger.info("Terminal WebSocket connection attempt for instance %s", instance_id)
     await websocket.accept()
 
     try:
+        # Parse instance_id
         instance_uuid = uuid.UUID(instance_id)
     except ValueError:
         logger.error("Invalid instance ID: %s", instance_id)
         await websocket.close(code=4001, reason="Invalid instance ID")
         return
 
+    # Authenticate user from session cookie
     user_id = await _get_user_from_websocket(websocket, db_session)
     if user_id is None:
-        logger.warning(
-            "Unauthorized terminal access attempt for instance %s",
-            instance_id,
-        )
+        logger.warning("Unauthorized terminal access attempt for instance %s", instance_id)
         await websocket.close(code=4003, reason="Unauthorized")
         return
 
+    # Get instance and verify ownership
     instance = await db_session.get(ToolInstance, instance_uuid)
     if instance is None:
         logger.warning("Instance %s not found", instance_id)
@@ -67,65 +61,38 @@ async def terminal_websocket(
         return
 
     if instance.owner_id != user_id:
-        logger.warning(
-            "Forbidden terminal access for instance %s by user %s",
-            instance_id,
-            user_id,
-        )
+        logger.warning("Forbidden terminal access for instance %s by user %s", instance_id, user_id)
         await websocket.close(code=4003, reason="Forbidden")
         return
 
     if instance.status != "running" or not instance.container_id:
-        logger.warning(
-            "Instance %s not running (status=%s, container_id=%s)",
-            instance_id,
-            instance.status,
-            instance.container_id,
-        )
+        logger.warning("Instance %s not running (status=%s, container_id=%s)", instance_id, instance.status, instance.container_id)
         await websocket.close(code=4004, reason="Instance not running")
         return
 
-    logger.info(
-        "Creating terminal session for instance %s (container_id=%s)",
-        instance_id,
-        instance.container_id,
-    )
+    logger.info("Creating terminal session for instance %s (container_id=%s)", instance_id, instance.container_id)
+    # Create terminal session
     try:
         session = await terminal_manager.create_session(
             instance_uuid,
             instance.container_id,
             websocket,
         )
-        logger.info(
-            "Terminal session created successfully for instance %s",
-            instance_id,
-        )
+        logger.info("Terminal session created successfully for instance %s", instance_id)
 
         # Send connected status
         await websocket.send_json({"type": "status", "status": "connected"})
 
-        # Monitor session health and echo state
-        while session.is_alive() and not session.closed:
-            # Check echo state periodically
-            new_echo_state = await session.check_echo_state()
-            if new_echo_state is not None:
-                await websocket.send_json(
-                    {"type": "set_echo_state", "enabled": new_echo_state},
-                )
-            await asyncio.sleep(1.0)
+        # Keep connection alive until session ends
+        # The terminal_manager handles I/O loops, we just wait here
+        while session.is_alive() and not session._closed:
+            await asyncio.sleep(0.5)
 
-        # Session ended — determine reason and notify client
-        exit_reason = session.get_exit_reason() or "process_exit"
-        await websocket.send_json({"type": "session_ended", "reason": exit_reason})
-        await websocket.close(code=1000, reason=f"Session ended: {exit_reason}")
-
-    except Exception:
-        logger.exception(
-            "Terminal session error for instance %s",
-            instance_id,
-        )
-        await websocket.close(code=4000, reason="Terminal session error")
+    except Exception as exc:
+        logger.error("Terminal session error for instance %s: %s", instance_id, str(exc), exc_info=True)
+        await websocket.close(code=4000, reason=f"Error: {exc}")
     finally:
+        # Cleanup will be handled by the session manager
         pass
 
 
@@ -141,7 +108,6 @@ async def _get_user_from_websocket(
 
     Returns:
         The user's UUID if authenticated, None otherwise.
-
     """
     from src.auth.session import decode_session_cookie
     from src.config import Settings

apps/api/src/api/tool_configs.py

@@ -4,19 +4,128 @@ import logging
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, Field, field_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.auth.dependencies import get_current_user_id, get_db_session
 from src.models.tool_config import ToolConfig
 from src.models.tool_type import ToolType
-from src.schemas.tool_config import ToolConfigCreate, ToolConfigUpdate, ToolConfigResponse
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/tool-configs", tags=["tool-configs"])
 
 
+class ToolConfigCreate(BaseModel):
+    tool_type_id: str = Field(description="UUID of the tool type")
+    project_id: str | None = Field(default=None, description="Optional project ID for project-scoped config")
+    key: str = Field(description="Config key name")
+    value: str = Field(description="Config value")
+    config_type: str = Field(default="env", description="Type: env or file")
+    file_path: str | None = Field(default=None, description="File path for file-type configs")
+    port_override: int | None = Field(default=None, description="Port override (1-65535)")
+    start_command: str | None = Field(default=None, description="Override container start command")
+    working_directory: str | None = Field(default=None, description="Working directory inside container")
+    environment_variables: dict | None = Field(default=None, description="Environment variables as JSON object")
+    volumes: list[dict] | None = Field(default=None, description="Volume mounts as JSON array")
+
+    @field_validator("port_override")
+    @classmethod
+    def validate_port(cls, v: int | None) -> int | None:
+        if v is None:
+            return v
+        if v < 1 or v > 65535:
+            raise ValueError("Port must be between 1 and 65535")
+        return v
+
+    @field_validator("environment_variables")
+    @classmethod
+    def validate_env_vars(cls, v: dict | None) -> dict | None:
+        if v is None:
+            return v
+        if not isinstance(v, dict):
+            raise ValueError("environment_variables must be a JSON object")
+        return v
+
+    @field_validator("volumes")
+    @classmethod
+    def validate_volumes(cls, v: list | None) -> list | None:
+        if v is None:
+            return v
+        if not isinstance(v, list):
+            raise ValueError("volumes must be a JSON array")
+        for i, vol in enumerate(v):
+            if not isinstance(vol, dict):
+                raise ValueError(f"Volume at index {i} must be an object")
+            if "source" not in vol:
+                raise ValueError(f"Volume at index {i} must have 'source' field")
+            if "target" not in vol:
+                raise ValueError(f"Volume at index {i} must have 'target' field")
+        return v
+
+
+class ToolConfigUpdate(BaseModel):
+    key: str | None = Field(default=None, description="Config key name")
+    value: str | None = Field(default=None, description="Config value")
+    config_type: str | None = Field(default=None, description="Type: env or file")
+    file_path: str | None = Field(default=None, description="File path for file-type configs")
+    port_override: int | None = Field(default=None, description="Port override (1-65535)")
+    start_command: str | None = Field(default=None, description="Override container start command")
+    working_directory: str | None = Field(default=None, description="Working directory inside container")
+    environment_variables: dict | None = Field(default=None, description="Environment variables as JSON object")
+    volumes: list[dict] | None = Field(default=None, description="Volume mounts as JSON array")
+
+    @field_validator("port_override")
+    @classmethod
+    def validate_port(cls, v: int | None) -> int | None:
+        if v is None:
+            return v
+        if v < 1 or v > 65535:
+            raise ValueError("Port must be between 1 and 65535")
+        return v
+
+    @field_validator("environment_variables")
+    @classmethod
+    def validate_env_vars(cls, v: dict | None) -> dict | None:
+        if v is None:
+            return v
+        if not isinstance(v, dict):
+            raise ValueError("environment_variables must be a JSON object")
+        return v
+
+    @field_validator("volumes")
+    @classmethod
+    def validate_volumes(cls, v: list | None) -> list | None:
+        if v is None:
+            return v
+        if not isinstance(v, list):
+            raise ValueError("volumes must be a JSON array")
+        for i, vol in enumerate(v):
+            if not isinstance(vol, dict):
+                raise ValueError(f"Volume at index {i} must be an object")
+            if "source" not in vol:
+                raise ValueError(f"Volume at index {i} must have 'source' field")
+            if "target" not in vol:
+                raise ValueError(f"Volume at index {i} must have 'target' field")
+        return v
+
+
+class ToolConfigResponse(BaseModel):
+    id: str
+    tool_type_id: str
+    project_id: str | None
+    key: str
+    value: str
+    config_type: str
+    file_path: str | None
+    port_override: int | None
+    start_command: str | None
+    working_directory: str | None
+    environment_variables: dict | None
+    volumes: list[dict] | None
+
+
 @router.get("", summary="List tool configs", description="Get all tool configs for the current user.")
 async def list_configs(
     tool_type_id: str | None = None,

apps/api/src/api/tool_types.py

@@ -3,17 +3,25 @@ from datetime import datetime
 
 import yaml
 from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, ConfigDict, field_validator, model_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.auth.dependencies import get_current_user, get_db_session
+from src.auth.dependencies import get_current_user_id, get_db_session
 from src.models.tool_type import ToolType
 from src.models.user import User
-from src.schemas.tool_type import ToolTypeCreate, ToolTypeResponse, ToolTypeUpdate, ToolTypeValidateRequest
 
 router = APIRouter(prefix="/tool-types", tags=["tool-types"])
 
 
+async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
+    """Fetch a user by ID or raise 401 if not found."""
+    user = await session.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
+    return user
+
+
 async def _require_admin(user: User) -> None:
     """Check if user has admin privileges.
 
@@ -25,6 +33,230 @@ async def _require_admin(user: User) -> None:
     pass
 
 
+class ToolTypeCreate(BaseModel):
+    name: str
+    display_name: str
+    description: str | None = None
+    default_port: int
+    definition_type: str = "compose"
+    compose_template: str | None = None
+    dockerfile_template: str | None = None
+    build_context: dict | None = None
+    readiness_probe: dict | None = None
+    required_variables: list[str] = []
+    category: str = "other"
+    interfaces: list[str] = ["web"]
+
+    @field_validator("definition_type")
+    @classmethod
+    def validate_definition_type(cls, v: str) -> str:
+        if v not in ("compose", "dockerfile"):
+            raise ValueError("definition_type must be 'compose' or 'dockerfile'")
+        return v
+
+    @field_validator("compose_template")
+    @classmethod
+    def validate_compose_template(cls, v: str | None, info) -> str | None:
+        data = info.data
+        if data.get("definition_type") != "compose":
+            return v
+        
+        if v is None:
+            raise ValueError("compose_template is required when definition_type is 'compose'")
+        
+        try:
+            parsed = yaml.safe_load(v)
+        except yaml.YAMLError as e:
+            raise ValueError(f"Invalid YAML: {e}")
+        
+        if not isinstance(parsed, dict):
+            raise ValueError("Compose template must be a YAML mapping")
+        
+        if "services" not in parsed:
+            raise ValueError("Compose template must contain 'services' key")
+        
+        if not parsed["services"]:
+            raise ValueError("Compose template must define at least one service")
+        
+        return v
+
+    @field_validator("dockerfile_template")
+    @classmethod
+    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
+        data = info.data
+        if data.get("definition_type") != "dockerfile":
+            return v
+        
+        if v is None:
+            raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
+        
+        if not v.strip().startswith("FROM"):
+            raise ValueError("Dockerfile must start with a FROM instruction")
+        
+        return v
+
+    @field_validator("default_port")
+    @classmethod
+    def validate_default_port(cls, v: int, info) -> int:
+        if v <= 0 or v > 65535:
+            raise ValueError("Port must be between 1 and 65535")
+        
+        # Get compose_template from the model data
+        data = info.data
+        if data.get("definition_type") != "compose":
+            return v
+        
+        template = data.get("compose_template")
+        if not template:
+            return v
+        
+        try:
+            parsed = yaml.safe_load(template)
+        except yaml.YAMLError:
+            return v
+        
+        # Check if the port is exposed in any service
+        port_str = str(v)
+        port_exposed = False
+        
+        if isinstance(parsed, dict) and "services" in parsed:
+            for service_name, service_config in parsed["services"].items():
+                if isinstance(service_config, dict) and "ports" in service_config:
+                    for port_mapping in service_config["ports"]:
+                        if isinstance(port_mapping, str):
+                            # Format: "8443:8443" or "8443"
+                            if port_str in port_mapping:
+                                port_exposed = True
+                                break
+                        elif isinstance(port_mapping, int) and port_mapping == v:
+                            port_exposed = True
+                            break
+                if port_exposed:
+                    break
+        
+        if not port_exposed:
+            raise ValueError(f"Port {v} is not exposed in the compose template. Add it to the 'ports' section.")
+        
+        return v
+
+    @field_validator("required_variables")
+    @classmethod
+    def validate_required_variables(cls, v: list[str], info) -> list[str]:
+        if not v:
+            return v
+        
+        data = info.data
+        if data.get("definition_type") != "compose":
+            return v
+        
+        template = data.get("compose_template")
+        if not template:
+            return v
+        
+        for var in v:
+            placeholder = f"{{{{{var}}}}}"
+            if placeholder not in template:
+                raise ValueError(f"Required variable '{var}' not found in compose template")
+        
+        return v
+
+    @model_validator(mode="after")
+    def validate_templates(self) -> "ToolTypeCreate":
+        if self.definition_type == "dockerfile" and self.dockerfile_template is None:
+            raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
+        if self.definition_type == "compose" and self.compose_template is None:
+            raise ValueError("compose_template is required when definition_type is 'compose'")
+        return self
+
+
+class ToolTypeUpdate(BaseModel):
+    display_name: str | None = None
+    description: str | None = None
+    default_port: int | None = None
+    definition_type: str | None = None
+    compose_template: str | None = None
+    dockerfile_template: str | None = None
+    build_context: dict | None = None
+    readiness_probe: dict | None = None
+    required_variables: list[str] | None = None
+    category: str | None = None
+    interfaces: list[str] | None = None
+
+    @field_validator("definition_type")
+    @classmethod
+    def validate_definition_type(cls, v: str | None) -> str | None:
+        if v is None:
+            return v
+        if v not in ("compose", "dockerfile"):
+            raise ValueError("definition_type must be 'compose' or 'dockerfile'")
+        return v
+
+    @field_validator("compose_template")
+    @classmethod
+    def validate_compose_template(cls, v: str | None, info) -> str | None:
+        if v is None:
+            return v
+        
+        data = info.data
+        definition_type = data.get("definition_type")
+        if definition_type and definition_type != "compose":
+            return v
+        
+        try:
+            parsed = yaml.safe_load(v)
+        except yaml.YAMLError as e:
+            raise ValueError(f"Invalid YAML: {e}")
+        
+        if not isinstance(parsed, dict):
+            raise ValueError("Compose template must be a YAML mapping")
+        
+        if "services" not in parsed:
+            raise ValueError("Compose template must contain 'services' key")
+        
+        if not parsed["services"]:
+            raise ValueError("Compose template must define at least one service")
+        
+        return v
+
+    @field_validator("dockerfile_template")
+    @classmethod
+    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
+        if v is None:
+            return v
+        
+        data = info.data
+        definition_type = data.get("definition_type")
+        if definition_type and definition_type != "dockerfile":
+            return v
+        
+        if not v.strip().startswith("FROM"):
+            raise ValueError("Dockerfile must start with a FROM instruction")
+        
+        return v
+
+
+class ToolTypeResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    name: str
+    display_name: str
+    description: str | None
+    category: str
+    interfaces: list[str]
+    default_port: int
+    definition_type: str
+    compose_template: str | None
+    dockerfile_template: str | None
+    build_context: dict | None
+    readiness_probe: dict | None
+    required_variables: list[str]
+    is_builtin: bool
+    created_by_id: uuid.UUID | None
+    created_at: datetime
+    updated_at: datetime
+
+
 @router.post(
     "",
     response_model=ToolTypeResponse,
@@ -34,7 +266,7 @@ async def _require_admin(user: User) -> None:
 )
 async def create_tool_type(
     data: ToolTypeCreate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> ToolType:
     """Create a new tool type.
@@ -47,6 +279,7 @@ async def create_tool_type(
     Returns:
         The newly created tool type.
     """
+    user = await _get_user(session, user_id)
     await _require_admin(user)
     
     # Check for duplicate name
@@ -83,7 +316,7 @@ async def create_tool_type(
     description="List all available tool types including built-in and custom ones.",
 )
 async def list_tool_types(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> list[ToolType]:
     """List all tool types.
@@ -95,6 +328,7 @@ async def list_tool_types(
     Returns:
         List of all tool types ordered by name.
     """
+    await _get_user(session, user_id)
     result = await session.execute(select(ToolType).order_by(ToolType.name))
     return list(result.scalars().all())
 
@@ -107,7 +341,7 @@ async def list_tool_types(
 )
 async def get_tool_type(
     tool_type_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> ToolType:
     """Get a specific tool type by ID.
@@ -120,6 +354,7 @@ async def get_tool_type(
     Returns:
         The requested tool type.
     """
+    await _get_user(session, user_id)
     tool_type = await session.get(ToolType, tool_type_id)
     if tool_type is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
@@ -135,7 +370,7 @@ async def get_tool_type(
 async def update_tool_type(
     tool_type_id: uuid.UUID,
     data: ToolTypeUpdate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> ToolType:
     """Update a tool type.
@@ -149,6 +384,7 @@ async def update_tool_type(
     Returns:
         The updated tool type.
     """
+    user = await _get_user(session, user_id)
     await _require_admin(user)
     
     tool_type = await session.get(ToolType, tool_type_id)
@@ -231,6 +467,12 @@ async def update_tool_type(
     return tool_type
 
 
+class ToolTypeValidateRequest(BaseModel):
+    definition_type: str
+    compose_template: str | None = None
+    dockerfile_template: str | None = None
+
+
 @router.post(
     "/validate",
     summary="Validate tool type template",
@@ -238,7 +480,7 @@ async def update_tool_type(
 )
 async def validate_tool_type_template(
     data: ToolTypeValidateRequest,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> dict:
     """Validate a tool type template syntax.
@@ -251,6 +493,7 @@ async def validate_tool_type_template(
     Returns:
         Validation result with success status and any errors.
     """
+    await _get_user(session, user_id)
 
     errors = []
 
@@ -291,7 +534,7 @@ async def validate_tool_type_template(
 )
 async def validate_tool_type(
     tool_type_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> dict:
     """Validate a tool type's template syntax.
@@ -304,6 +547,7 @@ async def validate_tool_type(
     Returns:
         Validation result with success status and any errors.
     """
+    await _get_user(session, user_id)
     tool_type = await session.get(ToolType, tool_type_id)
     if tool_type is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
@@ -345,7 +589,7 @@ async def validate_tool_type(
 )
 async def delete_tool_type(
     tool_type_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> None:
     """Delete a tool type.
@@ -358,6 +602,7 @@ async def delete_tool_type(
     Returns:
         None with 204 status code.
     """
+    user = await _get_user(session, user_id)
     await _require_admin(user)
     
     tool_type = await session.get(ToolType, tool_type_id)

apps/api/src/api/user_config.py

@@ -2,17 +2,26 @@ import logging
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, status
+
+logger = logging.getLogger(__name__)
+from pydantic import BaseModel, ConfigDict
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.auth.dependencies import get_current_user, get_db_session
+from src.auth.dependencies import get_current_user_id, get_db_session
 from src.models.user import User
 from src.models.user_config import UserConfig
-from src.schemas.user_config import UserConfigResponse, UserConfigUpdate
 
 router = APIRouter(prefix="/users/me", tags=["user-config"])
 
 
+async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
+    """Fetch a user by ID or raise 401 if not found."""
+    user = await session.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
+    return user
+
 
 async def _get_or_create_config(session: AsyncSession, user_id: uuid.UUID) -> UserConfig:
     """Get or create user config record.
@@ -24,16 +33,34 @@ async def _get_or_create_config(session: AsyncSession, user_id: uuid.UUID) -> Us
     Returns:
         The user's config, creating a new one if it doesn't exist.
     """
-    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user.id))
+    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
     config = result.scalar_one_or_none()
     if config is None:
-        config = UserConfig(user_id=user.id, config={})
+        config = UserConfig(user_id=user_id, config={})
         session.add(config)
         await session.commit()
         await session.refresh(config)
     return config
 
 
+class UserConfigResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    default_editor: str | None = None
+    theme: str = "system"
+    git_user_name: str | None = None
+    git_user_email: str | None = None
+    last_session_id: str | None = None
+
+
+class UserConfigUpdate(BaseModel):
+    default_editor: str | None = None
+    theme: str | None = None
+    git_user_name: str | None = None
+    git_user_email: str | None = None
+    last_session_id: str | None = None
+
+
 @router.get(
     "/config",
     response_model=UserConfigResponse,
@@ -41,7 +68,7 @@ async def _get_or_create_config(session: AsyncSession, user_id: uuid.UUID) -> Us
     description="Get the current user's configuration settings.",
 )
 async def get_user_config(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> UserConfigResponse:
     """Get the current user's configuration.
@@ -53,7 +80,8 @@ async def get_user_config(
     Returns:
         The user's configuration settings.
     """
-    config = await _get_or_create_config(session, user.id)
+    _user = await _get_user(session, user_id)
+    config = await _get_or_create_config(session, user_id)
     return UserConfigResponse.model_validate(config.config)
 
 
@@ -65,7 +93,7 @@ async def get_user_config(
 )
 async def update_user_config(
     data: UserConfigUpdate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> UserConfigResponse:
     """Update the current user's configuration.
@@ -78,11 +106,12 @@ async def update_user_config(
     Returns:
         The updated user configuration.
     """
-    config = await _get_or_create_config(session, user.id)
+    _user = await _get_user(session, user_id)
+    config = await _get_or_create_config(session, user_id)
 
     # Merge updates
     update_data = data.model_dump(exclude_unset=True)
-    logger.info("Updating user config for user %s: %s", user.id, update_data)
+    logger.info("Updating user config for user %s: %s", user_id, update_data)
     # SQLAlchemy JSON doesn't track dict mutations, so we replace the whole dict
     config.config = {**config.config, **update_data}
 

apps/api/src/api/users.py

@@ -2,14 +2,11 @@ import uuid
 from pathlib import Path
 
 from fastapi import APIRouter, Depends, HTTPException, UploadFile, status
-from sqlalchemy import select
+from pydantic import BaseModel, ConfigDict
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.auth.dependencies import get_current_user, get_db_session
-from src.models.tool_instance import ToolInstance
+from src.auth.dependencies import get_current_user_id, get_db_session
 from src.models.user import User
-from src.schemas.tool_instance import SessionItemResponse, SessionListResponse
-from src.schemas.user import UserProfileResponse, UserProfileUpdate
 
 router = APIRouter(prefix="/users", tags=["users"])
 
@@ -19,6 +16,27 @@ ALLOWED_CONTENT_TYPES = {"image/png", "image/jpeg", "image/jpg"}
 MAX_AVATAR_SIZE = 2 * 1024 * 1024  # 2MB
 
 
+async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
+    """Fetch a user by ID or raise 401 if not found."""
+    user = await session.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
+    return user
+
+
+class UserProfileResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    email: str
+    name: str
+    avatar_url: str | None
+
+
+class UserProfileUpdate(BaseModel):
+    name: str | None = None
+    email: str | None = None
+
 
 @router.get(
     "/me",
@@ -27,7 +45,7 @@ MAX_AVATAR_SIZE = 2 * 1024 * 1024  # 2MB
     description="Retrieve the profile of the currently authenticated user.",
 )
 async def get_profile(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> User:
     """Get the current user's profile.
@@ -39,7 +57,7 @@ async def get_profile(
     Returns:
         The user's profile information.
     """
-    return user
+    return await _get_user(session, user_id)
 
 
 @router.put(
@@ -50,7 +68,7 @@ async def get_profile(
 )
 async def update_profile(
     data: UserProfileUpdate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> User:
     """Update the current user's profile.
@@ -63,6 +81,7 @@ async def update_profile(
     Returns:
         The updated user profile.
     """
+    user = await _get_user(session, user_id)
 
     if data.name is not None:
         if len(data.name.strip()) == 0:
@@ -87,7 +106,7 @@ async def update_profile(
 )
 async def upload_avatar(
     file: UploadFile,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_db_session),
 ) -> User:
     """Upload a profile avatar image.
@@ -100,6 +119,7 @@ async def upload_avatar(
     Returns:
         The updated user profile with new avatar URL.
     """
+    user = await _get_user(session, user_id)
 
     if file.content_type not in ALLOWED_CONTENT_TYPES:
         raise HTTPException(
@@ -134,41 +154,3 @@ async def upload_avatar(
     await session.commit()
     await session.refresh(user)
     return user
-
-
-@router.get(
-    "/me/sessions",
-    response_model=SessionListResponse,
-    summary="Get current user sessions",
-    description="Retrieve all tool instances (sessions) for the authenticated user.",
-)
-async def get_user_sessions(
-    user: User = Depends(get_current_user),
-    session: AsyncSession = Depends(get_db_session),
-) -> SessionListResponse:
-    """Return all tool instances for the current user with related names."""
-    result = await session.execute(
-        select(ToolInstance)
-        .where(ToolInstance.owner_id == user.id)
-        .order_by(ToolInstance.created_at.desc())
-    )
-    instances = result.scalars().all()
-
-    sessions = [
-        SessionItemResponse(
-            id=str(inst.id),
-            display_name=inst.display_name,
-            tool_type_name=inst.tool_type.display_name if inst.tool_type else "Unknown",
-            tool_icon=inst.tool_type.icon if inst.tool_type else None,
-            tool_type_interfaces=inst.tool_type.interfaces if inst.tool_type else [],
-            repository_name=inst.repository.name if inst.repository else "Unknown",
-            repository_id=str(inst.repository_id),
-            project_name=inst.project.name if inst.project else "Unknown",
-            project_id=str(inst.project_id),
-            status=inst.status,
-            url=inst.url,
-        )
-        for inst in instances
-    ]
-
-    return SessionListResponse(sessions=sessions)

apps/api/src/auth/dependencies.py

@@ -7,7 +7,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from src.auth.session import decode_session_cookie
 from src.config import Settings
 from src.database import SessionLocal
-from src.models.project import Project
 from src.models.user import User
 
 
@@ -48,29 +47,3 @@ async def get_current_user(
     if user is None:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
     return user
-
-
-async def get_owned_project(
-    project_id: uuid.UUID,
-    user: User = Depends(get_current_user),
-    db_session: AsyncSession = Depends(get_db_session),
-) -> Project:
-    """Fetch a project and verify ownership.
-
-    Args:
-        project_id: UUID of the project (injected from path parameter).
-        user: The currently authenticated user.
-        db_session: Database session.
-
-    Returns:
-        The project if found and owned by the user.
-
-    Raises:
-        HTTPException: 404 if project not found, 403 if user is not the owner.
-    """
-    project = await db_session.get(Project, project_id)
-    if project is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="project not found")
-    if project.owner_id != user.id:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="not project owner")
-    return project

apps/api/src/auth/session.py

@@ -2,7 +2,7 @@ import hmac
 import hashlib
 import json
 import base64
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any
 
 from src.config import Settings
@@ -23,7 +23,7 @@ def create_session_cookie(*, settings: Settings, user_id: str) -> str:
     """Create a signed session cookie value."""
     payload = {
         "user_id": user_id,
-        "exp": int((datetime.now(timezone.utc) + timedelta(hours=settings.session_ttl_hours)).timestamp()),
+        "exp": int((datetime.now(UTC) + timedelta(hours=settings.session_ttl_hours)).timestamp()),
     }
     
     header = _base64url_encode(json.dumps({"alg": "HS256", "typ": "session"}).encode())
@@ -65,7 +65,7 @@ def decode_session_cookie(*, settings: Settings, cookie_value: str) -> dict[str,
     payload = json.loads(payload_bytes)
     
     # Check expiry
-    if payload.get("exp", 0) < int(datetime.now(timezone.utc).timestamp()):
+    if payload.get("exp", 0) < int(datetime.now(UTC).timestamp()):
         raise ValueError("session expired")
     
     return payload

apps/api/src/main.py

@@ -7,6 +7,8 @@ from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from fastapi.staticfiles import StaticFiles
+from sqlalchemy import select, text
+
 from src.api.auth import router as auth_router
 from src.api.dashboard import router as dashboard_router
 from src.api.git_repositories import router as git_repositories_router
@@ -16,7 +18,6 @@ from src.api.ssh_keys import router as ssh_keys_router
 from src.api.terminal import router as terminal_router
 from src.api.instance_proxy import router as instance_proxy_router
 from src.api.config_folders import router as config_folders_router
-from src.api.config_profiles import router as config_profiles_router
 from src.api.tool_configs import router as tool_configs_router
 from src.api.tool_instances import router as tool_instances_router
 from src.api.tool_instances import sessions_router
@@ -30,7 +31,7 @@ from src.logging_config import (
     RequestLoggingMiddleware,
     configure_logging,
 )
-from src.seeds.builtin_tool_types import seed_builtin_tool_types
+from src.models.tool_type import ToolType
 
 # Configure logging early
 log_level = os.getenv("LOG_LEVEL", "INFO").upper()
@@ -102,6 +103,155 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
     )
 
 
+async def _table_exists(session, table_name: str) -> bool:
+    """Check if a table exists in the database."""
+    try:
+        result = await session.execute(
+            text("""
+                SELECT EXISTS (
+                    SELECT FROM information_schema.tables
+                    WHERE table_schema = 'public'
+                    AND table_name = :table_name
+                )
+            """),
+            {"table_name": table_name},
+        )
+        return result.scalar() or False
+    except Exception:
+        return False
+
+
+async def seed_builtin_tool_types():
+    async with SessionLocal() as session:
+        # Check if tool_types table exists before attempting to seed
+        if not await _table_exists(session, "tool_types"):
+            logger.warning(
+                "tool_types table does not exist. Skipping seeding. "
+                "Migrations may not have run yet."
+            )
+            return
+
+        builtin_types = [
+            {
+                "name": "code-server",
+                "display_name": "VS Code Server",
+                "description": "VS Code running in the browser via code-server",
+                "category": "editor",
+                "interfaces": ["web"],
+                "compose_template": """version: "3.8"
+services:
+  code-server:
+    image: lscr.io/linuxserver/code-server:latest
+    container_name: {{TOOL_NAME}}
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/London
+    volumes:
+      - {{REPO_PATH}}:/config/workspace
+    ports:
+      - "8443:8443"
+    restart: unless-stopped""",
+                "default_port": 8443,
+                "required_variables": ["REPO_PATH", "TOOL_NAME"],
+            },
+            {
+                "name": "jupyter-notebook",
+                "display_name": "Jupyter Notebook",
+                "description": "Jupyter Lab for interactive development",
+                "category": "notebook",
+                "interfaces": ["web"],
+                "default_port": 8888,
+                "compose_template": """version: "3.8"
+services:
+  jupyter:
+    image: jupyter/scipy-notebook:latest
+    container_name: {{TOOL_NAME}}
+    environment:
+      - JUPYTER_ENABLE_LAB=yes
+    volumes:
+      - {{REPO_PATH}}:/home/jovyan/work
+    ports:
+      - "8888:8888"
+    restart: unless-stopped""",
+                "required_variables": ["REPO_PATH", "TOOL_NAME"],
+            },
+            {
+                "name": "opencode",
+                "display_name": "OpenCode",
+                "description": "AI coding assistant - run opencode in terminal",
+                "category": "ai-assistant",
+                "interfaces": ["terminal"],
+                "default_port": 3000,
+                "compose_template": """version: "3.8"
+services:
+  opencode:
+    image: node:20-slim
+    container_name: {{TOOL_NAME}}
+    working_dir: /workspace
+    environment:
+      - HOME=/tmp
+    volumes:
+      - {{REPO_PATH}}:/workspace
+      - opencode_home:/tmp
+    ports:
+      - "3000:3000"
+    command: >
+      sh -c "set -x &&
+             apt-get update && apt-get install -y git ca-certificates &&
+             echo 'Installing opencode...' &&
+             npm install -g opencode-ai 2>&1 || echo 'ERROR: npm install failed' &&
+             which opencode || echo 'ERROR: opencode not in PATH' &&
+             npm bin -g &&
+             ls -la $(npm bin -g) || echo 'ERROR: global bin dir not found' &&
+             echo 'export PATH=\"$(npm bin -g):\$PATH\"' >> /root/.bashrc &&
+             echo 'cd /workspace' >> /root/.bashrc &&
+             echo 'OpenCode installation complete' &&
+             cd /workspace &&
+             exec tail -f /dev/null"
+    stdin_open: true
+    tty: true
+    restart: unless-stopped
+
+volumes:
+  opencode_home:""",
+                "required_variables": ["REPO_PATH", "TOOL_NAME"],
+            },
+        ]
+
+        for tool_data in builtin_types:
+            existing = await session.scalar(select(ToolType).where(ToolType.name == tool_data["name"]))
+            if not existing:
+                tool_type = ToolType(
+                    name=tool_data["name"],
+                    display_name=tool_data["display_name"],
+                    description=tool_data["description"],
+                    category=tool_data["category"],
+                    interfaces=tool_data["interfaces"],
+                    definition_type="compose",
+                    compose_template=tool_data["compose_template"],
+                    required_variables=tool_data["required_variables"],
+                    default_port=tool_data.get("default_port"),
+                    is_builtin=True,
+                )
+                session.add(tool_type)
+                logger.info("Created built-in tool type: %s", tool_data["name"])
+            else:
+                # Update existing built-in tool types to reflect code changes
+                existing.display_name = tool_data["display_name"]
+                existing.description = tool_data["description"]
+                existing.category = tool_data["category"]
+                existing.interfaces = tool_data["interfaces"]
+                existing.definition_type = "compose"
+                existing.compose_template = tool_data["compose_template"]
+                existing.required_variables = tool_data["required_variables"]
+                existing.default_port = tool_data.get("default_port")
+                logger.info("Updated built-in tool type: %s", tool_data["name"])
+
+        await session.commit()
+        logger.info("Built-in tool types seeded successfully.")
+
+
 @app.on_event("startup")
 async def on_startup():
     logger.info("Starting up Headquarter API...")
@@ -127,7 +277,6 @@ app.include_router(git_repositories_router)
 app.include_router(user_config_router)
 app.include_router(tool_types_router)
 app.include_router(config_folders_router)
-app.include_router(config_profiles_router)
 app.include_router(tool_instances_router)
 app.include_router(tool_configs_router)
 app.include_router(sessions_router)

apps/api/src/models/__init__.py

@@ -1,8 +1,5 @@
 from src.models.base import Base
 from src.models.config_folder import ConfigFolder
-from src.models.config_include import ConfigInclude
-from src.models.config_mount import ConfigMount
-from src.models.config_profile import ConfigProfile
 from src.models.git_repository import GitRepository
 from src.models.project import Project
 from src.models.ssh_key import SSHKey
@@ -11,17 +8,4 @@ from src.models.tool_type import ToolType
 from src.models.user import User
 from src.models.user_config import UserConfig
 
-__all__ = [
-    "Base",
-    "ConfigFolder",
-    "ConfigInclude",
-    "ConfigMount",
-    "ConfigProfile",
-    "GitRepository",
-    "Project",
-    "SSHKey",
-    "ToolInstance",
-    "ToolType",
-    "User",
-    "UserConfig",
-]
+__all__ = ["Base", "ConfigFolder", "GitRepository", "Project", "SSHKey", "ToolInstance", "ToolType", "User", "UserConfig"]

apps/api/src/models/config_folder.py

@@ -26,8 +26,6 @@ class ConfigFolder(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     project_overrides: Mapped[dict | None] = mapped_column(
         JSON, default=dict, nullable=True
     )  # {"project_id": {"mount_path": "...", "files": {...}}}
-    # DEPRECATED: Legacy auto-mounting flag. No longer used for launch-time
-    # auto-mounting. Use ConfigProfile and ToolInstance.selected_profile_id instead.
     is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
 
     user: Mapped["User"] = relationship()

apps/api/src/models/config_include.py

@@ -1,36 +0,0 @@
-import uuid
-from typing import TYPE_CHECKING
-
-from sqlalchemy import ForeignKey, Integer, UniqueConstraint
-from sqlalchemy import Uuid as UUID
-from sqlalchemy.orm import Mapped, mapped_column, relationship
-
-from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
-
-if TYPE_CHECKING:
-    from src.models.config_profile import ConfigProfile
-
-
-class ConfigInclude(UUIDPrimaryKeyMixin, TimestampMixin, Base):
-    __tablename__ = "config_includes"
-    __table_args__ = (
-        UniqueConstraint("profile_id", "included_profile_id", name="uq_config_includes_pair"),
-    )
-
-    profile_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
-    )
-    included_profile_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
-    )
-    order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-
-    profile: Mapped["ConfigProfile"] = relationship(
-        "ConfigProfile",
-        foreign_keys=[profile_id],
-        back_populates="includes",
-    )
-    included_profile: Mapped["ConfigProfile"] = relationship(
-        "ConfigProfile",
-        foreign_keys=[included_profile_id],
-    )

apps/api/src/models/config_mount.py

@@ -1,31 +0,0 @@
-import uuid
-from typing import TYPE_CHECKING
-
-from sqlalchemy import ForeignKey, Integer, JSON, String
-from sqlalchemy import Uuid as UUID
-from sqlalchemy.orm import Mapped, mapped_column, relationship
-
-from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
-
-if TYPE_CHECKING:
-    from src.models.config_profile import ConfigProfile
-
-
-class ConfigMount(UUIDPrimaryKeyMixin, TimestampMixin, Base):
-    __tablename__ = "config_mounts"
-
-    profile_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
-    )
-    target_path: Mapped[str] = mapped_column(String(1024), nullable=False)
-    mode: Mapped[str] = mapped_column(String(10), nullable=False, default="rw")
-    files: Mapped[dict[str, str] | None] = mapped_column(
-        JSON, default=dict, nullable=True
-    )
-    order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-
-    profile: Mapped["ConfigProfile"] = relationship(
-        "ConfigProfile",
-        foreign_keys=[profile_id],
-        back_populates="mounts",
-    )

apps/api/src/models/config_profile.py

@@ -1,59 +0,0 @@
-import uuid
-from typing import TYPE_CHECKING
-
-from sqlalchemy import ForeignKey, Integer, JSON, String, Text, UniqueConstraint
-from sqlalchemy import Uuid as UUID
-from sqlalchemy.orm import Mapped, mapped_column, relationship
-
-from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
-
-if TYPE_CHECKING:
-    from src.models.config_include import ConfigInclude
-    from src.models.config_mount import ConfigMount
-    from src.models.project import Project
-    from src.models.tool_type import ToolType
-    from src.models.user import User
-
-
-class ConfigProfile(UUIDPrimaryKeyMixin, TimestampMixin, Base):
-    __tablename__ = "config_profiles"
-    __table_args__ = (
-        UniqueConstraint("user_id", "name", name="uq_config_profiles_user_name"),
-    )
-
-    user_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(), ForeignKey("users.id", ondelete="CASCADE"), nullable=False
-    )
-    project_id: Mapped[uuid.UUID | None] = mapped_column(
-        UUID(), ForeignKey("projects.id", ondelete="CASCADE"), nullable=True
-    )
-    tool_type_id: Mapped[uuid.UUID | None] = mapped_column(
-        UUID(), ForeignKey("tool_types.id", ondelete="CASCADE"), nullable=True
-    )
-    name: Mapped[str] = mapped_column(String(255), nullable=False)
-    description: Mapped[str | None] = mapped_column(Text, nullable=True)
-    environment_variables: Mapped[dict[str, str] | None] = mapped_column(
-        JSON, default=dict, nullable=True
-    )
-    start_command: Mapped[str | None] = mapped_column(Text, nullable=True)
-    working_directory: Mapped[str | None] = mapped_column(Text, nullable=True)
-    port: Mapped[int | None] = mapped_column(Integer, nullable=True)
-    is_default: Mapped[bool] = mapped_column(default=False, nullable=False)
-
-    user: Mapped["User"] = relationship()
-    project: Mapped["Project | None"] = relationship()
-    tool_type: Mapped["ToolType | None"] = relationship()
-    includes: Mapped[list["ConfigInclude"]] = relationship(
-        "ConfigInclude",
-        primaryjoin="ConfigProfile.id == ConfigInclude.profile_id",
-        back_populates="profile",
-        cascade="all, delete-orphan",
-        order_by="ConfigInclude.order_index",
-    )
-    mounts: Mapped[list["ConfigMount"]] = relationship(
-        "ConfigMount",
-        primaryjoin="ConfigProfile.id == ConfigMount.profile_id",
-        back_populates="profile",
-        cascade="all, delete-orphan",
-        order_by="ConfigMount.order_index",
-    )

apps/api/src/models/tool_instance.py

@@ -2,14 +2,13 @@ import uuid
 from datetime import datetime
 from typing import TYPE_CHECKING
 
-from sqlalchemy import DateTime, ForeignKey, Integer, String
+from sqlalchemy import DateTime, ForeignKey, Integer, JSON, String
 from sqlalchemy import Uuid as UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 
 if TYPE_CHECKING:
-    from src.models.config_profile import ConfigProfile
     from src.models.git_repository import GitRepository
     from src.models.project import Project
     from src.models.tool_type import ToolType
@@ -63,12 +62,11 @@ class ToolInstance(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     last_stopped_at: Mapped[datetime | None] = mapped_column(
         DateTime(timezone=True), nullable=True
     )
-    selected_profile_id: Mapped[uuid.UUID | None] = mapped_column(
-        UUID(), ForeignKey("config_profiles.id", ondelete="SET NULL"), nullable=True
+    probe_result: Mapped[dict | None] = mapped_column(
+        JSON, nullable=True
     )
 
     tool_type: Mapped["ToolType"] = relationship()
     repository: Mapped["GitRepository"] = relationship()
     project: Mapped["Project"] = relationship()
     owner: Mapped["User"] = relationship()
-    selected_profile: Mapped["ConfigProfile | None"] = relationship()

apps/api/src/models/user_config.py

@@ -18,23 +18,3 @@ class UserConfig(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     config: Mapped[dict[str, object]] = mapped_column(JSON, default=dict, nullable=False)
 
     user: Mapped["User"] = relationship(back_populates="user_config")
-
-    @property
-    def default_profile_id(self) -> uuid.UUID | None:
-        profile_id = self.config.get("default_profile_id")
-        return uuid.UUID(profile_id) if profile_id else None
-
-    @default_profile_id.setter
-    def default_profile_id(self, value: uuid.UUID | None) -> None:
-        if value is not None:
-            self.config["default_profile_id"] = str(value)
-        elif "default_profile_id" in self.config:
-            del self.config["default_profile_id"]
-
-    @property
-    def default_profiles(self) -> dict[str, str]:
-        return self.config.get("default_profiles", {})
-
-    @default_profiles.setter
-    def default_profiles(self, value: dict[str, str]) -> None:
-        self.config["default_profiles"] = value

apps/api/src/schemas/__init__.py

@@ -1 +0,0 @@
-"""Pydantic request/response schemas."""

apps/api/src/schemas/config_folder.py

@@ -1,44 +0,0 @@
-"""Config folder request/response schemas."""
-
-import uuid
-
-from pydantic import BaseModel, Field
-
-
-class ConfigFolderCreate(BaseModel):
-    name: str = Field(description="Folder name")
-    description: str | None = Field(default=None, description="Optional description")
-    mount_path: str = Field(description="Mount path in container")
-    files: dict[str, str] | None = Field(
-        default=None, description="Files as {path: content}"
-    )
-    is_active: bool = Field(default=True, description="Whether folder is active")
-
-
-class ConfigFolderUpdate(BaseModel):
-    name: str | None = None
-    description: str | None = None
-    mount_path: str | None = None
-    files: dict[str, str] | None = None
-    is_active: bool | None = None
-
-
-class ProjectOverrideCreate(BaseModel):
-    project_id: str = Field(description="Project ID to override for")
-    mount_path: str | None = Field(default=None, description="Override mount path")
-    files: dict[str, str] | None = Field(
-        default=None, description="Override files"
-    )
-    is_active: bool | None = Field(default=None, description="Override active state")
-
-
-class ConfigFolderResponse(BaseModel):
-    id: str
-    user_id: str
-    name: str
-    description: str | None
-    mount_path: str
-    files: dict[str, str] | None
-    is_active: bool
-    created_at: str
-    updated_at: str

apps/api/src/schemas/config_profile.py

@@ -1,131 +0,0 @@
-"""Config profile request/response schemas."""
-
-from typing import Any
-
-from pydantic import BaseModel, Field, field_validator
-
-MAX_MOUNT_PATH_LENGTH = 1024
-
-
-class ConfigProfileCreate(BaseModel):
-    name: str = Field(description="Profile name (unique per user)")
-    description: str | None = Field(default=None, description="Optional description")
-
-    @field_validator("name")
-    @classmethod
-    def validate_name(cls, v: str) -> str:
-        v = v.strip()
-        if not v:
-            raise ValueError("Profile name cannot be empty")
-        if len(v) > 255:
-            raise ValueError("Profile name must be 255 characters or less")
-        return v
-
-
-class ConfigProfileUpdate(BaseModel):
-    name: str | None = Field(default=None, description="Profile name")
-    description: str | None = Field(default=None, description="Optional description")
-
-    @field_validator("name")
-    @classmethod
-    def validate_name(cls, v: str | None) -> str | None:
-        if v is None:
-            return v
-        v = v.strip()
-        if not v:
-            raise ValueError("Profile name cannot be empty")
-        if len(v) > 255:
-            raise ValueError("Profile name must be 255 characters or less")
-        return v
-
-
-class ConfigProfileResponse(BaseModel):
-    id: str
-    user_id: str
-    name: str
-    description: str | None
-    created_at: str
-    updated_at: str
-
-
-class ConfigProfileDetailResponse(ConfigProfileResponse):
-    includes: list[dict[str, Any]]
-    mounts: list[dict[str, Any]]
-
-
-class ConfigIncludeCreate(BaseModel):
-    included_profile_id: str = Field(description="UUID of the profile to include")
-    order_index: int = Field(default=0, description="Order index for include resolution")
-
-
-class ConfigIncludeUpdate(BaseModel):
-    order_index: int = Field(description="Order index for include resolution")
-
-
-class ConfigIncludeResponse(BaseModel):
-    id: str
-    profile_id: str
-    included_profile_id: str
-    included_profile_name: str | None
-    order_index: int
-    created_at: str
-    updated_at: str
-
-
-class ConfigMountCreate(BaseModel):
-    target_path: str = Field(description="Absolute target path in container")
-    mode: str = Field(default="rw", description="Mount mode (rw or ro)")
-    files: dict[str, str] | None = Field(
-        default=None, description="Files as {path: content}"
-    )
-    order_index: int = Field(default=0, description="Order index for mount resolution")
-
-    @field_validator("target_path")
-    @classmethod
-    def validate_target_path(cls, v: str) -> str:
-        if not v.startswith("/"):
-            raise ValueError("Target path must be absolute (start with /)")
-        if ".." in v:
-            raise ValueError("Target path cannot contain parent directory references (..)")
-        if len(v) > MAX_MOUNT_PATH_LENGTH:
-            raise ValueError(f"Target path must be {MAX_MOUNT_PATH_LENGTH} characters or less")
-        return v
-
-
-class ConfigMountUpdate(BaseModel):
-    target_path: str | None = Field(default=None, description="Absolute target path in container")
-    mode: str | None = Field(default=None, description="Mount mode (rw or ro)")
-    files: dict[str, str] | None = Field(
-        default=None, description="Files as {path: content}"
-    )
-    order_index: int | None = Field(default=None, description="Order index for mount resolution")
-
-    @field_validator("target_path")
-    @classmethod
-    def validate_target_path(cls, v: str | None) -> str | None:
-        if v is None:
-            return v
-        if not v.startswith("/"):
-            raise ValueError("Target path must be absolute (start with /)")
-        if ".." in v:
-            raise ValueError("Target path cannot contain parent directory references (..)")
-        if len(v) > MAX_MOUNT_PATH_LENGTH:
-            raise ValueError(f"Target path must be {MAX_MOUNT_PATH_LENGTH} characters or less")
-        return v
-
-
-class ConfigMountResponse(BaseModel):
-    id: str
-    profile_id: str
-    target_path: str
-    mode: str
-    files: dict[str, str] | None
-    order_index: int
-    created_at: str
-    updated_at: str
-
-
-class DefaultProfilesUpdate(BaseModel):
-    default_profiles: dict[str, str] = Field(
-        description="Mapping of tool_type_id to profile_id"
-    )

apps/api/src/schemas/git_repository.py

@@ -1,129 +0,0 @@
-"""Git repository request/response schemas."""
-
-import uuid
-from datetime import datetime
-
-from pydantic import BaseModel, ConfigDict
-
-
-class GitRepositoryCreate(BaseModel):
-    name: str
-    remote_url: str | None = None
-    force_original_url: bool = False
-
-
-class URLParseRequest(BaseModel):
-    url: str
-
-
-class URLParseResponse(BaseModel):
-    original_url: str
-    base_url: str | None
-    is_valid_clone_url: bool
-    needs_parsing: bool
-    host: str | None
-    message: str
-    error_code: str | None
-
-
-class GitRepositoryResponse(BaseModel):
-    model_config = ConfigDict(from_attributes=True)
-
-    id: uuid.UUID
-    name: str
-    path: str
-    project_id: uuid.UUID
-    owner_id: uuid.UUID
-    is_mirror: bool
-    remote_url: str | None
-    last_push: datetime | None
-    created_at: datetime
-    updated_at: datetime
-
-
-class FileListResponse(BaseModel):
-    path: str
-    branch: str
-    entries: list[dict]
-
-
-class FileContentResponse(BaseModel):
-    path: str
-    branch: str
-    content: str
-    size: int
-    encoding: str
-    language: str | None
-    is_binary: bool
-    last_commit: dict | None
-
-
-class BranchesResponse(BaseModel):
-    branches: list[dict]
-    default_branch: str
-
-
-class FileUpdateRequest(BaseModel):
-    path: str
-    branch: str
-    content: str
-    commit_message: str
-
-
-class FileUpdateResponse(BaseModel):
-    commit_hash: str
-    message: str
-    branch: str
-
-
-class StatusResponse(BaseModel):
-    branch: str
-    modified: list[str]
-    added: list[str]
-    deleted: list[str]
-    untracked: list[str]
-    renamed: list[str]
-    ahead: int
-    behind: int
-
-
-class BranchCreateRequest(BaseModel):
-    name: str
-    base_branch: str = "HEAD"
-
-
-class CheckoutRequest(BaseModel):
-    branch: str
-
-
-class CommitRequest(BaseModel):
-    message: str
-    files: list[str] | None = None
-
-
-class CommitResponse(BaseModel):
-    commit_hash: str
-    message: str
-
-
-class FetchResponse(BaseModel):
-    message: str
-
-
-class PullResponse(BaseModel):
-    message: str
-
-
-class PushResponse(BaseModel):
-    message: str
-
-
-class MergeRequest(BaseModel):
-    source_branch: str
-    target_branch: str | None = None
-    message: str | None = None
-
-
-class MergeResponse(BaseModel):
-    commit_hash: str
-    message: str

apps/api/src/schemas/health.py

@@ -1,50 +0,0 @@
-"""Health check response schemas."""
-
-from pydantic import BaseModel, Field
-
-
-class DatabaseHealth(BaseModel):
-    """Database health check result."""
-
-    status: str = Field(description="Database health status", examples=["healthy"])
-    response_time_ms: float = Field(
-        description="Query response time in milliseconds", examples=[5.2]
-    )
-
-
-class DiskHealth(BaseModel):
-    """Disk space health check result."""
-
-    status: str = Field(description="Disk health status", examples=["healthy"])
-    free_gb: float = Field(description="Free disk space in GB", examples=[45.2])
-    total_gb: float = Field(description="Total disk space in GB", examples=[100.0])
-
-
-class HealthChecks(BaseModel):
-    """Individual health checks."""
-
-    database: DatabaseHealth | None = None
-    disk: DiskHealth | None = None
-
-
-class HealthResponse(BaseModel):
-    """Overall health check response."""
-
-    status: str = Field(description="Overall health status", examples=["healthy"])
-    timestamp: str = Field(
-        description="ISO 8601 timestamp", examples=["2026-05-19T12:00:00Z"]
-    )
-    version: str = Field(description="API version", examples=["0.1.0"])
-    checks: HealthChecks = Field(description="Individual health checks")
-    uptime_seconds: float = Field(
-        description="Server uptime in seconds", examples=[3600.0]
-    )
-
-
-class DatabaseHealthResponse(BaseModel):
-    """Database-specific health check response."""
-
-    status: str = Field(description="Database health status", examples=["healthy"])
-    response_time_ms: float = Field(
-        description="Query response time in milliseconds", examples=[5.2]
-    )

apps/api/src/schemas/project.py

@@ -1,25 +0,0 @@
-"""Project request/response schemas."""
-
-from pydantic import BaseModel
-
-
-class ProjectCreate(BaseModel):
-    name: str
-    description: str | None = None
-
-
-class ProjectUpdate(BaseModel):
-    name: str | None = None
-    description: str | None = None
-
-
-class ProjectResponse(BaseModel):
-    id: str
-    name: str
-    description: str | None
-    created_at: str
-    updated_at: str
-
-
-class SetDefaultSSHKeyRequest(BaseModel):
-    ssh_key_id: str

apps/api/src/schemas/ssh_key.py

@@ -1,16 +0,0 @@
-"""SSH key request/response schemas."""
-
-from pydantic import BaseModel
-
-
-class SSHKeyCreate(BaseModel):
-    name: str
-    public_key: str
-
-
-class SSHKeyResponse(BaseModel):
-    id: str
-    name: str
-    public_key: str
-    fingerprint: str
-    created_at: str

apps/api/src/schemas/tool_config.py

@@ -1,47 +0,0 @@
-"""Tool config request/response schemas."""
-
-from pydantic import BaseModel, Field
-
-
-class ToolConfigCreate(BaseModel):
-    tool_type_id: str = Field(description="UUID of the tool type")
-    key: str = Field(description="Configuration key")
-    value: str = Field(description="Configuration value")
-    config_type: str = Field(default="env", description="Config type: env or file")
-    file_path: str | None = Field(default=None, description="File path for file configs")
-    port_override: int | None = Field(default=None, description="Port override")
-    start_command: str | None = Field(default=None, description="Start command override")
-    working_directory: str | None = Field(default=None, description="Working directory")
-    environment_variables: dict[str, str] | None = Field(
-        default=None, description="Additional environment variables"
-    )
-    volumes: list[dict] | None = Field(default=None, description="Volume mounts")
-
-
-class ToolConfigUpdate(BaseModel):
-    value: str | None = None
-    config_type: str | None = None
-    file_path: str | None = None
-    port_override: int | None = None
-    start_command: str | None = None
-    working_directory: str | None = None
-    environment_variables: dict[str, str] | None = None
-    volumes: list[dict] | None = None
-
-
-class ToolConfigResponse(BaseModel):
-    id: str
-    tool_type_id: str
-    user_id: str
-    project_id: str | None
-    key: str
-    value: str
-    config_type: str
-    file_path: str | None
-    port_override: int | None
-    start_command: str | None
-    working_directory: str | None
-    environment_variables: dict[str, str] | None
-    volumes: list[dict] | None
-    created_at: str
-    updated_at: str

apps/api/src/schemas/tool_instance.py

@@ -1,41 +0,0 @@
-"""Tool instance request/response schemas."""
-
-from pydantic import BaseModel, Field
-
-
-class CreateInstanceRequest(BaseModel):
-    """Request body for creating a tool instance."""
-
-    model_config = {"extra": "ignore"}
-
-    tool_type_id: str = Field(description="UUID of the tool type to instantiate")
-    display_name: str | None = Field(
-        default=None, description="Optional display name for the instance"
-    )
-    config_profile_id: str | None = Field(
-        default=None, description="Optional config profile ID to apply to the instance"
-    )
-
-
-class SessionItemResponse(BaseModel):
-    """Lightweight session summary for sidebar and dashboard."""
-
-    model_config = {"extra": "ignore"}
-
-    id: str = Field(description="Session (tool instance) ID")
-    display_name: str = Field(description="Display name of the session")
-    tool_type_name: str = Field(description="Name of the tool type")
-    tool_icon: str | None = Field(default=None, description="Icon URL for the tool type")
-    tool_type_interfaces: list[str] = Field(default_factory=list, description="Supported interfaces")
-    repository_name: str = Field(description="Name of the repository")
-    repository_id: str = Field(description="Repository ID")
-    project_name: str = Field(description="Name of the project")
-    project_id: str = Field(description="Project ID")
-    status: str = Field(description="Current status")
-    url: str | None = Field(default=None, description="Access URL")
-
-
-class SessionListResponse(BaseModel):
-    """Response wrapping a list of session summaries."""
-
-    sessions: list[SessionItemResponse]

apps/api/src/schemas/tool_type.py

@@ -1,204 +0,0 @@
-"""Tool type request/response schemas."""
-
-import uuid
-from datetime import datetime
-
-import yaml
-from pydantic import BaseModel, ConfigDict, field_validator, model_validator
-
-
-class ToolTypeCreate(BaseModel):
-    name: str
-    display_name: str
-    description: str | None = None
-    default_port: int
-    definition_type: str = "compose"
-    compose_template: str | None = None
-    dockerfile_template: str | None = None
-    build_context: dict | None = None
-    readiness_probe: dict | None = None
-    required_variables: list[str] = []
-    category: str = "other"
-    interfaces: list[str] = ["web"]
-
-    @field_validator("definition_type")
-    @classmethod
-    def validate_definition_type(cls, v: str) -> str:
-        if v not in ("compose", "dockerfile"):
-            raise ValueError("definition_type must be 'compose' or 'dockerfile'")
-        return v
-
-    @field_validator("compose_template")
-    @classmethod
-    def validate_compose_template(cls, v: str | None, info) -> str | None:
-        data = info.data
-        if data.get("definition_type") != "compose":
-            return v
-        if v is None:
-            raise ValueError("compose_template is required when definition_type is 'compose'")
-        try:
-            parsed = yaml.safe_load(v)
-        except yaml.YAMLError as e:
-            raise ValueError(f"Invalid YAML: {e}")
-        if not isinstance(parsed, dict):
-            raise ValueError("Compose template must be a YAML mapping")
-        if "services" not in parsed:
-            raise ValueError("Compose template must contain 'services' key")
-        if not parsed["services"]:
-            raise ValueError("Compose template must define at least one service")
-        return v
-
-    @field_validator("dockerfile_template")
-    @classmethod
-    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
-        data = info.data
-        if data.get("definition_type") != "dockerfile":
-            return v
-        if v is None:
-            raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
-        if not v.strip().startswith("FROM"):
-            raise ValueError("Dockerfile must start with a FROM instruction")
-        return v
-
-    @field_validator("default_port")
-    @classmethod
-    def validate_default_port(cls, v: int, info) -> int:
-        if v <= 0 or v > 65535:
-            raise ValueError("Port must be between 1 and 65535")
-        data = info.data
-        if data.get("definition_type") != "compose":
-            return v
-        template = data.get("compose_template")
-        if not template:
-            return v
-        try:
-            parsed = yaml.safe_load(template)
-        except yaml.YAMLError:
-            return v
-        port_str = str(v)
-        port_exposed = False
-        if isinstance(parsed, dict) and "services" in parsed:
-            for service_config in parsed["services"].values():
-                if isinstance(service_config, dict) and "ports" in service_config:
-                    for port_mapping in service_config["ports"]:
-                        if isinstance(port_mapping, str) and port_str in port_mapping:
-                            port_exposed = True
-                            break
-                        elif isinstance(port_mapping, int) and port_mapping == v:
-                            port_exposed = True
-                            break
-                if port_exposed:
-                    break
-        if not port_exposed:
-            raise ValueError(f"Port {v} is not exposed in the compose template. Add it to the 'ports' section.")
-        return v
-
-    @field_validator("required_variables")
-    @classmethod
-    def validate_required_variables(cls, v: list[str], info) -> list[str]:
-        if not v:
-            return v
-        data = info.data
-        if data.get("definition_type") != "compose":
-            return v
-        template = data.get("compose_template")
-        if not template:
-            return v
-        for var in v:
-            placeholder = f"{{{{{var}}}}}"
-            if placeholder not in template:
-                raise ValueError(f"Required variable '{var}' not found in compose template")
-        return v
-
-    @model_validator(mode="after")
-    def validate_templates(self) -> "ToolTypeCreate":
-        if self.definition_type == "dockerfile" and self.dockerfile_template is None:
-            raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
-        if self.definition_type == "compose" and self.compose_template is None:
-            raise ValueError("compose_template is required when definition_type is 'compose'")
-        return self
-
-
-class ToolTypeUpdate(BaseModel):
-    display_name: str | None = None
-    description: str | None = None
-    default_port: int | None = None
-    definition_type: str | None = None
-    compose_template: str | None = None
-    dockerfile_template: str | None = None
-    build_context: dict | None = None
-    readiness_probe: dict | None = None
-    required_variables: list[str] | None = None
-    category: str | None = None
-    interfaces: list[str] | None = None
-
-    @field_validator("definition_type")
-    @classmethod
-    def validate_definition_type(cls, v: str | None) -> str | None:
-        if v is None:
-            return v
-        if v not in ("compose", "dockerfile"):
-            raise ValueError("definition_type must be 'compose' or 'dockerfile'")
-        return v
-
-    @field_validator("compose_template")
-    @classmethod
-    def validate_compose_template(cls, v: str | None, info) -> str | None:
-        if v is None:
-            return v
-        data = info.data
-        definition_type = data.get("definition_type")
-        if definition_type and definition_type != "compose":
-            return v
-        try:
-            parsed = yaml.safe_load(v)
-        except yaml.YAMLError as e:
-            raise ValueError(f"Invalid YAML: {e}")
-        if not isinstance(parsed, dict):
-            raise ValueError("Compose template must be a YAML mapping")
-        if "services" not in parsed:
-            raise ValueError("Compose template must contain 'services' key")
-        if not parsed["services"]:
-            raise ValueError("Compose template must define at least one service")
-        return v
-
-    @field_validator("dockerfile_template")
-    @classmethod
-    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
-        if v is None:
-            return v
-        data = info.data
-        definition_type = data.get("definition_type")
-        if definition_type and definition_type != "dockerfile":
-            return v
-        if not v.strip().startswith("FROM"):
-            raise ValueError("Dockerfile must start with a FROM instruction")
-        return v
-
-
-class ToolTypeResponse(BaseModel):
-    model_config = ConfigDict(from_attributes=True)
-
-    id: uuid.UUID
-    name: str
-    display_name: str
-    description: str | None
-    category: str
-    interfaces: list[str]
-    default_port: int
-    definition_type: str
-    compose_template: str | None
-    dockerfile_template: str | None
-    build_context: dict | None
-    readiness_probe: dict | None
-    required_variables: list[str]
-    is_builtin: bool
-    created_by_id: uuid.UUID | None
-    created_at: datetime
-    updated_at: datetime
-
-
-class ToolTypeValidateRequest(BaseModel):
-    definition_type: str
-    compose_template: str | None = None
-    dockerfile_template: str | None = None

apps/api/src/schemas/user.py

@@ -1,19 +0,0 @@
-"""User request/response schemas."""
-
-import uuid
-
-from pydantic import BaseModel, ConfigDict
-
-
-class UserProfileResponse(BaseModel):
-    model_config = ConfigDict(from_attributes=True)
-
-    id: uuid.UUID
-    email: str
-    name: str
-    avatar_url: str | None
-
-
-class UserProfileUpdate(BaseModel):
-    name: str | None = None
-    email: str | None = None

apps/api/src/schemas/user_config.py

@@ -1,21 +0,0 @@
-"""User config request/response schemas."""
-
-from pydantic import BaseModel, ConfigDict
-
-
-class UserConfigResponse(BaseModel):
-    model_config = ConfigDict(from_attributes=True)
-
-    default_editor: str | None = None
-    theme: str = "system"
-    git_user_name: str | None = None
-    git_user_email: str | None = None
-    last_session_id: str | None = None
-
-
-class UserConfigUpdate(BaseModel):
-    default_editor: str | None = None
-    theme: str | None = None
-    git_user_name: str | None = None
-    git_user_email: str | None = None
-    last_session_id: str | None = None

apps/api/src/seeds/builtin_tool_types.py

@@ -1,161 +0,0 @@
-import logging
-
-from sqlalchemy import select
-
-from src.database import SessionLocal
-from src.models.tool_type import ToolType
-
-logger = logging.getLogger(__name__)
-
-
-async def _table_exists(session, table_name: str) -> bool:
-    """Check if a table exists in the database."""
-    from sqlalchemy import text
-
-    try:
-        result = await session.execute(
-            text(
-                """
-                SELECT EXISTS (
-                    SELECT FROM information_schema.tables
-                    WHERE table_schema = 'public'
-                    AND table_name = :table_name
-                )
-            """
-            ),
-            {"table_name": table_name},
-        )
-        return result.scalar() or False
-    except Exception:
-        return False
-
-
-async def seed_builtin_tool_types():
-    async with SessionLocal() as session:
-        # Check if tool_types table exists before attempting to seed
-        if not await _table_exists(session, "tool_types"):
-            logger.warning(
-                "tool_types table does not exist. Skipping seeding. "
-                "Migrations may not have run yet."
-            )
-            return
-
-        builtin_types = [
-            {
-                "name": "code-server",
-                "display_name": "VS Code Server",
-                "description": "VS Code running in the browser via code-server",
-                "category": "editor",
-                "interfaces": ["web"],
-                "compose_template": """version: "3.8"
-services:
-  code-server:
-    image: lscr.io/linuxserver/code-server:latest
-    container_name: {{TOOL_NAME}}
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Europe/London
-    volumes:
-      - {{REPO_PATH}}:/config/workspace
-    ports:
-      - "8443:8443"
-    restart: unless-stopped""",
-                "default_port": 8443,
-                "required_variables": ["REPO_PATH", "TOOL_NAME"],
-            },
-            {
-                "name": "jupyter-notebook",
-                "display_name": "Jupyter Notebook",
-                "description": "Jupyter Lab for interactive development",
-                "category": "notebook",
-                "interfaces": ["web"],
-                "default_port": 8888,
-                "compose_template": """version: "3.8"
-services:
-  jupyter:
-    image: jupyter/scipy-notebook:latest
-    container_name: {{TOOL_NAME}}
-    environment:
-      - JUPYTER_ENABLE_LAB=yes
-    volumes:
-      - {{REPO_PATH}}:/home/jovyan/work
-    ports:
-      - "8888:8888"
-    restart: unless-stopped""",
-                "required_variables": ["REPO_PATH", "TOOL_NAME"],
-            },
-            {
-                "name": "opencode",
-                "display_name": "OpenCode",
-                "description": "AI coding assistant - run opencode in terminal",
-                "category": "ai-assistant",
-                "interfaces": ["terminal"],
-                "default_port": 3000,
-                "compose_template": """version: "3.8"
-services:
-  opencode:
-    image: node:20-slim
-    container_name: {{TOOL_NAME}}
-    working_dir: /workspace
-    environment:
-      - HOME=/tmp
-    volumes:
-      - {{REPO_PATH}}:/workspace
-      - opencode_home:/tmp
-    ports:
-      - "3000:3000"
-    command: >
-      sh -c "set -x &&
-             apt-get update && apt-get install -y git ca-certificates &&
-             echo 'Installing opencode...' &&
-             npm install -g opencode-ai 2>&1 || echo 'ERROR: npm install failed' &&
-             which opencode || echo 'ERROR: opencode not in PATH' &&
-             npm bin -g &&
-             ls -la $(npm bin -g) || echo 'ERROR: global bin dir not found' &&
-             echo 'export PATH=\"$(npm bin -g):\\$PATH\"' >> /root/.bashrc &&
-             echo 'cd /workspace' >> /root/.bashrc &&
-             echo 'OpenCode installation complete' &&
-             cd /workspace &&
-             exec tail -f /dev/null"
-    stdin_open: true
-    tty: true
-    restart: unless-stopped
-
-volumes:
-  opencode_home:""",
-                "required_variables": ["REPO_PATH", "TOOL_NAME"],
-            },
-        ]
-
-        for tool_data in builtin_types:
-            existing = await session.scalar(select(ToolType).where(ToolType.name == tool_data["name"]))
-            if not existing:
-                tool_type = ToolType(
-                    name=tool_data["name"],
-                    display_name=tool_data["display_name"],
-                    description=tool_data["description"],
-                    category=tool_data["category"],
-                    interfaces=tool_data["interfaces"],
-                    definition_type="compose",
-                    compose_template=tool_data["compose_template"],
-                    required_variables=tool_data["required_variables"],
-                    default_port=tool_data.get("default_port"),
-                    is_builtin=True,
-                )
-                session.add(tool_type)
-                logger.info("Created built-in tool type: %s", tool_data["name"])
-            else:
-                # Update existing built-in tool types to reflect code changes
-                existing.display_name = tool_data["display_name"]
-                existing.description = tool_data["description"]
-                existing.category = tool_data["category"]
-                existing.interfaces = tool_data["interfaces"]
-                existing.definition_type = "compose"
-                existing.compose_template = tool_data["compose_template"]
-                existing.required_variables = tool_data["required_variables"]
-                existing.default_port = tool_data.get("default_port")
-                logger.info("Updated built-in tool type: %s", tool_data["name"])
-
-        await session.commit()
-        logger.info("Built-in tool types seeded successfully.")

apps/api/src/services/config_profiles.py

@@ -1,299 +0,0 @@
-"""Config profile business logic."""
-
-import logging
-import uuid
-
-from fastapi import HTTPException, status
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import selectinload
-
-from src.models.config_include import ConfigInclude
-from src.models.config_mount import ConfigMount
-from src.models.config_profile import ConfigProfile
-from src.models.tool_type import ToolType
-from src.models.user_config import UserConfig
-
-logger = logging.getLogger(__name__)
-
-MAX_INCLUDES_DEPTH = 10
-
-
-async def get_owned_profile(
-    profile_id: uuid.UUID,
-    user_id: uuid.UUID,
-    session: AsyncSession,
-) -> ConfigProfile:
-    """Fetch a config profile and verify ownership."""
-    profile = await session.get(ConfigProfile, profile_id)
-    if profile is None or profile.user_id != user_id:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail="config profile not found",
-        )
-    return profile
-
-
-async def _detect_cycle(
-    session: AsyncSession,
-    profile_id: uuid.UUID,
-    visited: set[uuid.UUID] | None = None,
-    depth: int = 0,
-) -> bool:
-    """Detect cycles in profile includes using DFS.
-
-    Returns True if a cycle is detected.
-    """
-    if depth > MAX_INCLUDES_DEPTH:
-        return True
-
-    if visited is None:
-        visited = set()
-
-    if profile_id in visited:
-        return True
-
-    visited.add(profile_id)
-
-    result = await session.execute(
-        select(ConfigInclude.included_profile_id).where(
-            ConfigInclude.profile_id == profile_id
-        )
-    )
-    included_ids = result.scalars().all()
-
-    for included_id in included_ids:
-        if await _detect_cycle(session, included_id, visited.copy(), depth + 1):
-            return True
-
-    return False
-
-
-async def validate_includes_no_cycle(
-    session: AsyncSession,
-    profile_id: uuid.UUID,
-    new_included_id: uuid.UUID | None = None,
-) -> None:
-    """Validate that adding an include wouldn't create a cycle."""
-    if new_included_id and await _detect_cycle(session, new_included_id, {profile_id}):
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="adding this include would create a circular reference",
-        )
-
-
-# ---------------------------------------------------------------------------
-# Profile CRUD helpers
-# ---------------------------------------------------------------------------
-
-async def check_duplicate_name(
-    session: AsyncSession,
-    user_id: uuid.UUID,
-    name: str,
-    exclude_id: uuid.UUID | None = None,
-) -> None:
-    """Raise 409 if a profile with the given name already exists."""
-    query = select(ConfigProfile).where(
-        ConfigProfile.user_id == user_id,
-        ConfigProfile.name == name,
-    )
-    if exclude_id:
-        query = query.where(ConfigProfile.id != exclude_id)
-    existing = await session.scalar(query)
-    if existing:
-        raise HTTPException(
-            status_code=status.HTTP_409_CONFLICT,
-            detail=f"config profile with name '{name}' already exists",
-        )
-
-
-def profile_to_dict(profile: ConfigProfile) -> dict:
-    """Serialize a ConfigProfile to a dict."""
-    return {
-        "id": str(profile.id),
-        "user_id": str(profile.user_id),
-        "name": profile.name,
-        "description": profile.description,
-        "created_at": profile.created_at.isoformat() if profile.created_at else None,
-        "updated_at": profile.updated_at.isoformat() if profile.updated_at else None,
-    }
-
-
-# ---------------------------------------------------------------------------
-# Include helpers
-# ---------------------------------------------------------------------------
-
-async def check_duplicate_include(
-    session: AsyncSession,
-    profile_id: uuid.UUID,
-    included_profile_id: uuid.UUID,
-) -> None:
-    """Raise 409 if the include already exists."""
-    existing = await session.scalar(
-        select(ConfigInclude).where(
-            ConfigInclude.profile_id == profile_id,
-            ConfigInclude.included_profile_id == included_profile_id,
-        )
-    )
-    if existing:
-        raise HTTPException(
-            status_code=status.HTTP_409_CONFLICT,
-            detail="this include already exists",
-        )
-
-
-def include_to_dict(inc: ConfigInclude, included_name: str | None) -> dict:
-    """Serialize a ConfigInclude to a dict."""
-    return {
-        "id": str(inc.id),
-        "profile_id": str(inc.profile_id),
-        "included_profile_id": str(inc.included_profile_id),
-        "included_profile_name": included_name,
-        "order_index": inc.order_index,
-        "created_at": inc.created_at.isoformat() if inc.created_at else None,
-        "updated_at": inc.updated_at.isoformat() if inc.updated_at else None,
-    }
-
-
-# ---------------------------------------------------------------------------
-# Mount helpers
-# ---------------------------------------------------------------------------
-
-async def check_duplicate_mount_path(
-    session: AsyncSession,
-    profile_id: uuid.UUID,
-    target_path: str,
-    exclude_id: uuid.UUID | None = None,
-) -> None:
-    """Raise 409 if a mount with the given path already exists."""
-    query = select(ConfigMount).where(
-        ConfigMount.profile_id == profile_id,
-        ConfigMount.target_path == target_path,
-    )
-    if exclude_id:
-        query = query.where(ConfigMount.id != exclude_id)
-    existing = await session.scalar(query)
-    if existing:
-        raise HTTPException(
-            status_code=status.HTTP_409_CONFLICT,
-            detail=f"mount with path '{target_path}' already exists",
-        )
-
-
-def mount_to_dict(mount: ConfigMount) -> dict:
-    """Serialize a ConfigMount to a dict."""
-    return {
-        "id": str(mount.id),
-        "profile_id": str(mount.profile_id),
-        "target_path": mount.target_path,
-        "files": mount.files,
-        "mode": mount.mode,
-        "order_index": mount.order_index,
-        "created_at": mount.created_at.isoformat() if mount.created_at else None,
-        "updated_at": mount.updated_at.isoformat() if mount.updated_at else None,
-    }
-
-
-# ---------------------------------------------------------------------------
-# Default profile helpers
-# ---------------------------------------------------------------------------
-
-async def get_or_create_user_config(
-    session: AsyncSession,
-    user_id: uuid.UUID,
-) -> UserConfig:
-    """Get existing user config or create a new one."""
-    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
-    user_config = result.scalar_one_or_none()
-    if user_config is None:
-        user_config = UserConfig(user_id=user_id, config={})
-        session.add(user_config)
-    return user_config
-
-
-async def validate_default_profiles(
-    session: AsyncSession,
-    user_id: uuid.UUID,
-    default_profiles: dict[str, str],
-) -> None:
-    """Validate that all profile IDs in default_profiles belong to the user."""
-    for tool_type_id, profile_id_str in default_profiles.items():
-        profile = await session.get(ConfigProfile, uuid.UUID(profile_id_str))
-        if profile is None:
-            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=f"profile {profile_id_str} not found")
-        if profile.user_id != user_id:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=f"profile {profile_id_str} does not belong to user")
-
-
-async def get_default_profiles(
-    session: AsyncSession,
-    user_id: uuid.UUID,
-) -> dict:
-    """Get default profiles for a user."""
-    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
-    user_config = result.scalar_one_or_none()
-    return {"default_profiles": user_config.default_profiles if user_config else {}}
-
-
-async def set_default_profiles(
-    session: AsyncSession,
-    user_id: uuid.UUID,
-    default_profiles: dict[str, str],
-) -> dict:
-    """Set default profiles for a user."""
-    user_config = await get_or_create_user_config(session, user_id)
-    await validate_default_profiles(session, user_id, default_profiles)
-    user_config.config = {**user_config.config, "default_profiles": default_profiles}
-    await session.commit()
-    await session.refresh(user_config)
-    return {"default_profiles": user_config.default_profiles}
-
-
-async def get_default_profile_for_tool_type(
-    session: AsyncSession,
-    user_id: uuid.UUID,
-    tool_type_id: str,
-) -> dict:
-    """Get default profile for a specific tool type."""
-    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
-    user_config = result.scalar_one_or_none()
-    profile_id = user_config.default_profiles.get(tool_type_id) if user_config else None
-    return {"tool_type_id": tool_type_id, "profile_id": profile_id}
-
-
-# ---------------------------------------------------------------------------
-# Include list helper
-# ---------------------------------------------------------------------------
-
-async def list_includes_for_profile(
-    session: AsyncSession,
-    profile_id: uuid.UUID,
-) -> dict:
-    """List all includes for a profile."""
-    result = await session.execute(
-        select(ConfigInclude)
-        .where(ConfigInclude.profile_id == profile_id)
-        .order_by(ConfigInclude.order_index)
-    )
-    includes_data = []
-    for inc in result.scalars().all():
-        included_profile = await session.get(ConfigProfile, inc.included_profile_id)
-        includes_data.append(include_to_dict(inc, included_profile.name if included_profile else None))
-    return {"includes": includes_data}
-
-
-# ---------------------------------------------------------------------------
-# Mount list helper
-# ---------------------------------------------------------------------------
-
-async def list_mounts_for_profile(
-    session: AsyncSession,
-    profile_id: uuid.UUID,
-) -> dict:
-    """List all mounts for a profile."""
-    result = await session.execute(
-        select(ConfigMount)
-        .where(ConfigMount.profile_id == profile_id)
-        .order_by(ConfigMount.order_index)
-    )
-    return {"mounts": [mount_to_dict(m) for m in result.scalars().all()]}

apps/api/src/services/docker.py

@@ -0,0 +1,563 @@
+"""Docker service for managing tool instances."""
+
+import os
+import subprocess
+from pathlib import Path
+from typing import Any
+
+
+def render_compose_template(template: str, variables: dict[str, Any]) -> str:
+    """Render a Docker Compose template with variable substitution.
+
+    Args:
+        template: The compose template string
+        variables: Dictionary of variable names to values
+
+    Returns:
+        Rendered compose file content
+    """
+    result = template
+    for key, value in variables.items():
+        placeholder = f"{{{{{key}}}}}"
+        result = result.replace(placeholder, str(value))
+    return result
+
+
+def ensure_instance_directory(instance_id: str, base_path: str | None = None) -> str:
+    """Create and return the instance directory path.
+
+    Args:
+        instance_id: Unique instance identifier
+        base_path: Base directory for all instances (defaults to Settings.instance_base_path)
+
+    Returns:
+        Absolute path to instance directory
+    """
+    if base_path is None:
+        from src.config import Settings
+        base_path = Settings().instance_base_path
+    instance_dir = Path(base_path) / instance_id
+    instance_dir.mkdir(parents=True, exist_ok=True)
+    return str(instance_dir.absolute())
+
+
+def write_compose_file(instance_dir: str, content: str) -> str:
+    """Write the rendered compose file to the instance directory.
+
+    Args:
+        instance_dir: Path to instance directory
+        content: Rendered compose content
+
+    Returns:
+        Path to the compose file
+    """
+    compose_path = Path(instance_dir) / "docker-compose.yml"
+    compose_path.write_text(content)
+    return str(compose_path)
+
+
+def write_env_file(instance_dir: str, env_vars: dict[str, str]) -> str:
+    """Write environment variables to a .env file.
+
+    Args:
+        instance_dir: Path to instance directory
+        env_vars: Dictionary of env var names to values
+
+    Returns:
+        Path to the env file
+    """
+    env_path = Path(instance_dir) / ".env"
+    lines = [f'{key}="{value}"' for key, value in env_vars.items()]
+    env_path.write_text("\n".join(lines) + "\n")
+    return str(env_path)
+
+
+def write_config_files(instance_dir: str, files: dict[str, str]) -> None:
+    """Write config files to the instance directory.
+
+    Args:
+        instance_dir: Path to instance directory
+        files: Dictionary of file paths (relative to instance dir) to content
+    """
+    instance_path = Path(instance_dir)
+    for file_path, content in files.items():
+        # Ensure the path is within the instance directory (security)
+        full_path = instance_path / file_path
+        try:
+            full_path.resolve().relative_to(instance_path.resolve())
+        except ValueError:
+            raise ValueError(f"File path '{file_path}' escapes instance directory")
+        
+        full_path.parent.mkdir(parents=True, exist_ok=True)
+        full_path.write_text(content)
+
+
+def write_config_folder_files(instance_dir: str, folders: list, project_id: str | None = None) -> list[dict]:
+    """Write config folder files to the instance directory and return volume mounts.
+
+    Args:
+        instance_dir: Path to instance directory
+        folders: List of ConfigFolder objects
+        project_id: Optional project ID for applying overrides
+
+    Returns:
+        List of volume mount dicts [{"source": "...", "target": "...", "type": "..."}]
+    """
+    instance_path = Path(instance_dir)
+    volume_mounts = []
+
+    for folder in folders:
+        # Determine mount path (with project override if applicable)
+        mount_path = folder.mount_path
+        files = folder.files.copy()
+        
+        if project_id and folder.project_overrides:
+            override = folder.project_overrides.get(str(project_id))
+            if override:
+                if override.get("mount_path"):
+                    mount_path = override["mount_path"]
+                if override.get("files"):
+                    files.update(override["files"])
+        
+        # Write files to instance directory
+        folder_dir = instance_path / "volumes" / folder.name
+        folder_dir.mkdir(parents=True, exist_ok=True)
+        
+        for file_path, content in files.items():
+            # Security: ensure path doesn't escape folder_dir
+            full_path = folder_dir / file_path
+            try:
+                full_path.resolve().relative_to(folder_dir.resolve())
+            except ValueError:
+                logger.warning("Config folder file path escapes directory: %s", file_path)
+                continue
+            
+            full_path.parent.mkdir(parents=True, exist_ok=True)
+            full_path.write_text(content)
+        
+        # Add volume mount
+        volume_mounts.append({
+            "source": str(folder_dir),
+            "target": mount_path,
+            "type": "bind",
+        })
+    
+    return volume_mounts
+
+
+def execute_compose_command(
+    compose_path: str, action: str, timeout: int = 60, env_file: str | None = None
+) -> tuple[int, str, str]:
+    """Execute a docker compose command.
+
+    Args:
+        compose_path: Path to docker-compose.yml
+        action: The compose action (up, down, start, stop, restart)
+        timeout: Command timeout in seconds
+        env_file: Optional path to .env file for environment variables
+
+    Returns:
+        Tuple of (returncode, stdout, stderr)
+    """
+    instance_dir = Path(compose_path).parent
+
+    cmd = ["docker", "compose", "-f", compose_path]
+    
+    if env_file:
+        cmd.extend(["--env-file", env_file])
+
+    if action == "up":
+        cmd.extend(["up", "-d"])
+    elif action == "down":
+        cmd.extend(["down", "-v"])
+    elif action in ("start", "stop", "restart"):
+        cmd.append(action)
+    else:
+        raise ValueError(f"Unknown compose action: {action}")
+
+    result = subprocess.run(
+        cmd,
+        cwd=str(instance_dir),
+        capture_output=True,
+        text=True,
+        timeout=timeout,
+    )
+
+    return result.returncode, result.stdout, result.stderr
+
+
+def get_container_id(instance_name: str) -> str | None:
+    """Get the container ID for a compose service.
+
+    Args:
+        instance_name: The service name in compose
+
+    Returns:
+        Container ID or None if not found
+    """
+    result = subprocess.run(
+        ["docker", "ps", "-q", "--filter", f"name={instance_name}"],
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode == 0 and result.stdout.strip():
+        return result.stdout.strip().split("\n")[0]
+    return None
+
+
+def get_container_name(instance_name: str) -> str | None:
+    """Get the full container name for a compose service.
+
+    Args:
+        instance_name: The service name in compose
+
+    Returns:
+        Container name or None if not found
+    """
+    result = subprocess.run(
+        ["docker", "ps", "--format", "{{.Names}}", "--filter", f"name={instance_name}"],
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode == 0 and result.stdout.strip():
+        return result.stdout.strip().split("\n")[0]
+    return None
+
+
+def connect_container_to_network(container_name: str, network_name: str = "backend") -> bool:
+    """Connect a Docker container to an existing network.
+
+    Args:
+        container_name: Name or ID of the container
+        network_name: Name of the Docker network (default: backend)
+
+    Returns:
+        True if successful, False otherwise
+    """
+    result = subprocess.run(
+        ["docker", "network", "connect", network_name, container_name],
+        capture_output=True,
+        text=True,
+    )
+    return result.returncode == 0
+
+
+def get_container_status(container_id: str) -> dict[str, Any]:
+    """Get the status of a Docker container.
+
+    Args:
+        container_id: Docker container ID
+
+    Returns:
+        Dict with 'status' (running, exited, restarting, not_found), 
+        'exit_code' (int or None), and 'health' (health status or None)
+    """
+    result = subprocess.run(
+        [
+            "docker", "inspect", "-f",
+            "{{.State.Status}}|{{.State.ExitCode}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}",
+            container_id,
+        ],
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode != 0:
+        return {"status": "not_found", "exit_code": None, "health": None}
+    
+    parts = result.stdout.strip().split("|")
+    status = parts[0] if parts else "unknown"
+    exit_code = int(parts[1]) if len(parts) > 1 and parts[1].isdigit() else None
+    health = parts[2] if len(parts) > 2 and parts[2] != "none" else None
+    
+    return {"status": status, "exit_code": exit_code, "health": health}
+
+
+def wait_for_container_running(
+    container_id: str, timeout: int = 30, interval: float = 2.0
+) -> dict[str, Any]:
+    """Wait for a container to reach the running state.
+
+    Polls docker inspect until the container status is "running" or timeout.
+
+    Args:
+        container_id: Docker container ID
+        timeout: Maximum seconds to wait
+        interval: Seconds between polls
+
+    Returns:
+        Dict with 'success' (bool), 'status' (str), 'exit_code' (int or None),
+        and 'waited_seconds' (float)
+    """
+    import time
+
+    start_time = time.time()
+    
+    while time.time() - start_time < timeout:
+        info = get_container_status(container_id)
+        
+        if info["status"] == "running":
+            return {
+                "success": True,
+                "status": "running",
+                "exit_code": None,
+                "waited_seconds": time.time() - start_time,
+            }
+        
+        if info["status"] == "exited":
+            return {
+                "success": False,
+                "status": "exited",
+                "exit_code": info["exit_code"],
+                "waited_seconds": time.time() - start_time,
+            }
+        
+        if info["status"] == "not_found":
+            return {
+                "success": False,
+                "status": "not_found",
+                "exit_code": None,
+                "waited_seconds": time.time() - start_time,
+            }
+        
+        time.sleep(interval)
+    
+    # Timeout reached
+    info = get_container_status(container_id)
+    return {
+        "success": False,
+        "status": info["status"],
+        "exit_code": info["exit_code"],
+        "waited_seconds": time.time() - start_time,
+    }
+
+
+def get_container_logs(container_id: str, tail: int = 100) -> str:
+    """Get the logs of a Docker container.
+
+    Args:
+        container_id: Docker container ID
+        tail: Number of lines to return
+
+    Returns:
+        Container logs
+    """
+    result = subprocess.run(
+        ["docker", "logs", "--tail", str(tail), container_id],
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode == 0:
+        return result.stdout
+    return f"Failed to get logs: {result.stderr}"
+
+
+def find_free_port(start: int = 10000, end: int = 20000) -> int:
+    """Find a free TCP port in the given range.
+
+    Args:
+        start: Start of port range
+        end: End of port range
+
+    Returns:
+        Free port number
+    """
+    import socket
+
+    for port in range(start, end):
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+            if s.connect_ex(("localhost", port)) != 0:
+                return port
+
+    raise RuntimeError(f"No free port found in range {start}-{end}")
+
+
+import subprocess
+import time
+import re
+
+
+def start_cloudflared_tunnel(
+    container_name: str, port: int, timeout: int = 30
+) -> dict[str, str]:
+    """Start a temporary Cloudflare tunnel for a container.
+
+    Uses 'cloudflared tunnel --url' to create a temporary tunnel
+    with a random trycloudflare.com URL.
+
+    Args:
+        container_name: Name of the Docker container to tunnel to
+        port: Port number the container listens on
+        timeout: Maximum seconds to wait for tunnel URL
+
+    Returns:
+        Dict with 'url' (the public tunnel URL) and 'pid' (process ID)
+    """
+    import subprocess
+    import time
+    import re
+    import logging
+
+    logger = logging.getLogger(__name__)
+
+    # First verify the container is accessible
+    logger.info("Checking connectivity to %s:%d...", container_name, port)
+    for attempt in range(10):
+        check = subprocess.run(
+            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", 
+             f"http://{container_name}:{port}"],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        logger.info("Connectivity check %d: http_code=%s", attempt + 1, check.stdout.strip())
+        if check.returncode == 0:
+            break
+        time.sleep(1)
+    else:
+        logger.warning("Container %s:%d not responding to curl checks", container_name, port)
+
+    # Run cloudflared in background, capture output
+    logger.info("Starting cloudflared tunnel to http://%s:%d", container_name, port)
+    proc = subprocess.Popen(
+        ["cloudflared", "tunnel", "--url", f"http://{container_name}:{port}"],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+    )
+
+    # Wait for the URL to appear in output
+    url_pattern = re.compile(r"https://[a-z0-9-]+\.trycloudflare\.com")
+    start_time = time.time()
+    url = None
+
+    while time.time() - start_time < timeout:
+        # Read available output
+        import select
+        readable, _, _ = select.select([proc.stdout], [], [], 1.0)
+        if readable:
+            line = proc.stdout.readline()
+            if line:
+                match = url_pattern.search(line)
+                if match:
+                    url = match.group(0)
+                    break
+
+    if not url:
+        proc.terminate()
+        proc.wait(timeout=5)
+        raise RuntimeError(
+            f"Failed to get tunnel URL within {timeout}s. "
+            f"cloudflared output may contain errors."
+        )
+
+    return {"url": url, "pid": str(proc.pid)}
+
+
+def stop_cloudflared_tunnel(pid: str) -> None:
+    """Stop a cloudflared tunnel process.
+
+    Args:
+        pid: Process ID of the cloudflared tunnel
+    """
+    import os
+    import signal
+
+    try:
+        os.kill(int(pid), signal.SIGTERM)
+    except ProcessLookupError:
+        pass  # Already stopped
+
+
+def recreate_tunnel(
+    container_name: str, port: int, old_pid: str | None = None
+) -> dict[str, str]:
+    """Recreate a temporary Cloudflare tunnel.
+
+    Stops the old tunnel (if pid provided) and starts a new one.
+
+    Args:
+        container_name: Name of the Docker container to tunnel to
+        port: Port number the container listens on
+        old_pid: Optional PID of the old tunnel process to stop
+
+    Returns:
+        Dict with 'url' and 'pid' for the new tunnel
+    """
+    if old_pid:
+        stop_cloudflared_tunnel(old_pid)
+
+    return start_cloudflared_tunnel(container_name, port)
+
+
+def check_tunnel_health(url: str, timeout: int = 10) -> dict[str, Any]:
+    """Check if a tunnel URL is healthy with smart error classification.
+
+    Args:
+        url: The tunnel URL to check
+        timeout: Request timeout in seconds
+
+    Returns:
+        Dict with 'tunnel_status' (healthy, unreachable, error_response, not_applicable),
+        'status_code' (int or None), 'healthy' (bool), and 'error' (str or None)
+    """
+    import subprocess
+
+    try:
+        result = subprocess.run(
+            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
+             "--max-time", str(timeout), url],
+            capture_output=True,
+            text=True,
+            timeout=timeout + 5,
+        )
+        status_code = int(result.stdout.strip())
+        
+        if 200 <= status_code < 400:
+            return {
+                "tunnel_status": "healthy",
+                "status_code": status_code,
+                "healthy": True,
+                "error": None,
+            }
+        elif status_code in (502, 503, 504):
+            # Application error, not tunnel error
+            return {
+                "tunnel_status": "error_response",
+                "status_code": status_code,
+                "healthy": False,
+                "error": f"Application returned HTTP {status_code}",
+            }
+        else:
+            return {
+                "tunnel_status": "error_response",
+                "status_code": status_code,
+                "healthy": False,
+                "error": f"HTTP {status_code}",
+            }
+    except subprocess.TimeoutExpired:
+        return {
+            "tunnel_status": "unreachable",
+            "status_code": None,
+            "healthy": False,
+            "error": "Tunnel request timed out",
+        }
+    except (ValueError, Exception) as e:
+        error_str = str(e).lower()
+        # Classify connection errors
+        if any(err in error_str for err in ["connection refused", "econnrefused", "could not resolve", "nodename"]):
+            return {
+                "tunnel_status": "unreachable",
+                "status_code": None,
+                "healthy": False,
+                "error": f"Tunnel unreachable: {e}",
+            }
+        return {
+            "tunnel_status": "unreachable",
+            "status_code": None,
+            "healthy": False,
+            "error": str(e),
+        }

apps/api/src/services/docker/__init__.py

@@ -1,44 +0,0 @@
-"""Docker services for container and tunnel management."""
-
-from .compose import (
-    ensure_instance_directory,
-    execute_compose_command,
-    render_compose_template,
-    write_compose_file,
-    write_env_file,
-)
-from .config_staging import write_config_files, write_config_folder_files
-from .container import (
-    connect_container_to_network,
-    find_free_port,
-    get_container_id,
-    get_container_logs,
-    get_container_name,
-    get_container_status,
-)
-from .tunnel import (
-    check_tunnel_health,
-    recreate_tunnel,
-    start_cloudflared_tunnel,
-    stop_cloudflared_tunnel,
-)
-
-__all__ = [
-    "render_compose_template",
-    "ensure_instance_directory",
-    "write_compose_file",
-    "write_env_file",
-    "execute_compose_command",
-    "write_config_files",
-    "write_config_folder_files",
-    "get_container_id",
-    "get_container_name",
-    "connect_container_to_network",
-    "get_container_status",
-    "get_container_logs",
-    "find_free_port",
-    "start_cloudflared_tunnel",
-    "stop_cloudflared_tunnel",
-    "recreate_tunnel",
-    "check_tunnel_health",
-]

apps/api/src/services/docker/compose.py

@@ -1,237 +0,0 @@
-"""Docker Compose file generation and command execution."""
-
-import re
-import subprocess
-import uuid
-from pathlib import Path
-from typing import Any
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from src.models.config_profile import ConfigProfile
-from src.models.tool_instance import ToolInstance
-from src.services.profile_resolver import resolve_profile
-
-
-def _sanitize_name(name: str) -> str:
-    """Sanitize a string for use in Docker/container names."""
-    sanitized = re.sub(r"[^a-z0-9-]", "-", name.lower())
-    sanitized = re.sub(r"-+", "-", sanitized)
-    return sanitized.strip("-")
-
-
-async def _generate_instance_name(
-    session: AsyncSession,
-    project_name: str,
-    tool_type_name: str,
-) -> str:
-    """Generate a unique instance name: project-tool-NUM."""
-    base = f"{_sanitize_name(project_name)}-{_sanitize_name(tool_type_name)}"
-    base = base.strip("-") or "instance"
-    result = await session.execute(
-        select(ToolInstance.name).where(ToolInstance.name.like(f"{base}-%"))
-    )
-    names = result.scalars().all()
-    max_num = 0
-    for name in names:
-        parts = name.rsplit("-", 1)
-        if len(parts) == 2 and parts[0] == base and parts[1].isdigit():
-            max_num = max(max_num, int(parts[1]))
-    return f"{base}-{max_num + 1:03d}"
-
-
-def _modify_compose_file(
-    compose_path: str,
-    port_override: int | None = None,
-    start_command: str | None = None,
-    working_directory: str | None = None,
-    extra_volumes: list[dict] | None = None,
-) -> None:
-    """Modify compose file with runtime overrides."""
-    import yaml
-
-    compose_file = Path(compose_path)
-    content = compose_file.read_text()
-    compose_data = yaml.safe_load(content)
-
-    if not compose_data or "services" not in compose_data:
-        return
-
-    for service_name, service_config in compose_data["services"].items():
-        if port_override and "ports" in service_config:
-            for i, port_mapping in enumerate(service_config["ports"]):
-                if isinstance(port_mapping, str) and ":" in port_mapping:
-                    _host_port, container_port = port_mapping.split(":", 1)
-                    service_config["ports"][i] = f"{port_override}:{container_port}"
-                    break
-
-        if start_command:
-            service_config["command"] = start_command
-
-        if working_directory:
-            service_config["working_dir"] = working_directory
-
-        if extra_volumes:
-            if "volumes" not in service_config:
-                service_config["volumes"] = []
-            for vol in extra_volumes:
-                source = vol.get("source", "")
-                target = vol.get("target", "")
-                vol_type = vol.get("type", "bind")
-                if vol_type == "bind":
-                    service_config["volumes"].append(f"{source}:{target}")
-                else:
-                    service_config["volumes"].append(f"{source}:{target}:{vol_type}")
-
-        break
-
-    compose_file.write_text(yaml.dump(compose_data, default_flow_style=False))
-
-
-async def _apply_resolved_profile(
-    profile: ConfigProfile,
-    instance_dir: str,
-    env_vars: dict[str, str],
-    port_override: int | None,
-    start_command: str | None,
-    working_directory: str | None,
-    extra_volumes: list[dict],
-) -> tuple[dict[str, str], int | None, str | None, str | None, list[dict]]:
-    """Resolve a profile and apply its output to instance configuration."""
-    resolved = resolve_profile(profile)
-
-    if resolved.environment_variables:
-        env_vars.update(resolved.environment_variables)
-
-    if resolved.runtime_hints.start_command is not None:
-        start_command = resolved.runtime_hints.start_command
-    if resolved.runtime_hints.working_directory is not None:
-        working_directory = resolved.runtime_hints.working_directory
-    if resolved.runtime_hints.port is not None:
-        port_override = resolved.runtime_hints.port
-
-    for target_path, mount in resolved.mounts.items():
-        safe_name = target_path.strip("/").replace("/", "_")
-        mount_dir = Path(instance_dir) / "mounts" / safe_name
-        mount_dir.mkdir(parents=True, exist_ok=True)
-
-        for rel_path, content in mount.files.items():
-            file_path = mount_dir / rel_path
-            file_path.parent.mkdir(parents=True, exist_ok=True)
-            file_path.write_text(content)
-
-        extra_volumes.append({
-            "source": str(mount_dir),
-            "target": target_path,
-            "type": mount.mode,
-        })
-
-    return env_vars, port_override, start_command, working_directory, extra_volumes
-
-
-def render_compose_template(template: str, variables: dict[str, Any]) -> str:
-    """Render a Docker Compose template with variable substitution.
-
-    Args:
-        template: The compose template string
-        variables: Dictionary of variable names to values
-
-    Returns:
-        Rendered compose file content
-    """
-    result = template
-    for key, value in variables.items():
-        placeholder = f"{{{{{key}}}}}"
-        result = result.replace(placeholder, str(value))
-    return result
-
-
-def ensure_instance_directory(instance_id: str, base_path: str | None = None) -> str:
-    """Create and return the instance directory path.
-
-    Args:
-        instance_id: Unique instance identifier
-        base_path: Base directory for all instances (defaults to Settings.instance_base_path)
-
-    Returns:
-        Absolute path to instance directory
-    """
-    if base_path is None:
-        from src.config import Settings
-        base_path = Settings().instance_base_path
-    instance_dir = Path(base_path) / instance_id
-    instance_dir.mkdir(parents=True, exist_ok=True)
-    return str(instance_dir.absolute())
-
-
-def write_compose_file(instance_dir: str, content: str) -> str:
-    """Write the rendered compose file to the instance directory.
-
-    Args:
-        instance_dir: Path to instance directory
-        content: Rendered compose content
-
-    Returns:
-        Path to the compose file
-    """
-    compose_path = Path(instance_dir) / "docker-compose.yml"
-    compose_path.write_text(content)
-    return str(compose_path)
-
-
-def write_env_file(instance_dir: str, env_vars: dict[str, str]) -> str:
-    """Write environment variables to a .env file.
-
-    Args:
-        instance_dir: Path to instance directory
-        env_vars: Dictionary of env var names to values
-
-    Returns:
-        Path to the env file
-    """
-    env_path = Path(instance_dir) / ".env"
-    lines = [f'{key}="{value}"' for key, value in env_vars.items()]
-    env_path.write_text("\n".join(lines) + "\n")
-    return str(env_path)
-
-
-def execute_compose_command(
-    compose_path: str, action: str, timeout: int = 60, env_file: str | None = None
-) -> tuple[int, str, str]:
-    """Execute a docker compose command.
-
-    Args:
-        compose_path: Path to docker-compose.yml
-        action: The compose action (up, down, start, stop, restart)
-        timeout: Command timeout in seconds
-        env_file: Optional path to .env file for environment variables
-
-    Returns:
-        Tuple of (returncode, stdout, stderr)
-    """
-    instance_dir = Path(compose_path).parent
-
-    cmd = ["docker", "compose", "-f", compose_path]
-
-    if env_file:
-        cmd.extend(["--env-file", env_file])
-
-    if action == "up":
-        cmd.extend(["up", "-d"])
-    elif action == "down":
-        cmd.extend(["down", "-v"])
-    elif action in ("start", "stop", "restart"):
-        cmd.append(action)
-    else:
-        raise ValueError(f"Unknown compose action: {action}")
-
-    result = subprocess.run(
-        cmd,
-        cwd=str(instance_dir),
-        capture_output=True,
-        text=True,
-        timeout=timeout,
-    )
-
-    return result.returncode, result.stdout, result.stderr

apps/api/src/services/docker/config_staging.py

@@ -1,79 +0,0 @@
-"""Config folder file staging for Docker instances."""
-
-import logging
-from pathlib import Path
-
-logger = logging.getLogger(__name__)
-
-
-def write_config_files(instance_dir: str, files: dict[str, str]) -> None:
-    """Write config files to the instance directory.
-
-    Args:
-        instance_dir: Path to instance directory
-        files: Dictionary of file paths (relative to instance dir) to content
-    """
-    instance_path = Path(instance_dir)
-    for file_path, content in files.items():
-        # Ensure the path is within the instance directory (security)
-        full_path = instance_path / file_path
-        try:
-            full_path.resolve().relative_to(instance_path.resolve())
-        except ValueError:
-            raise ValueError(f"File path '{file_path}' escapes instance directory")
-
-        full_path.parent.mkdir(parents=True, exist_ok=True)
-        full_path.write_text(content)
-
-
-def write_config_folder_files(instance_dir: str, folders: list, project_id: str | None = None) -> list[dict]:
-    """Write config folder files to the instance directory and return volume mounts.
-
-    Args:
-        instance_dir: Path to instance directory
-        folders: List of ConfigFolder objects
-        project_id: Optional project ID for applying overrides
-
-    Returns:
-        List of volume mount dicts [{"source": "...", "target": "...", "type": "..."}]
-    """
-    instance_path = Path(instance_dir)
-    volume_mounts = []
-
-    for folder in folders:
-        # Determine mount path (with project override if applicable)
-        mount_path = folder.mount_path
-        files = folder.files.copy()
-
-        if project_id and folder.project_overrides:
-            override = folder.project_overrides.get(str(project_id))
-            if override:
-                if override.get("mount_path"):
-                    mount_path = override["mount_path"]
-                if override.get("files"):
-                    files.update(override["files"])
-
-        # Write files to instance directory
-        folder_dir = instance_path / "volumes" / folder.name
-        folder_dir.mkdir(parents=True, exist_ok=True)
-
-        for file_path, content in files.items():
-            # Security: ensure path doesn't escape folder_dir
-            full_path = folder_dir / file_path
-            try:
-                full_path.resolve().relative_to(folder_dir.resolve())
-            except ValueError:
-                logger.warning("Config folder file path escapes directory: %s", file_path)
-                continue
-
-            full_path.parent.mkdir(parents=True, exist_ok=True)
-            full_path.write_text(content)
-
-        # Add volume mount
-        volume_mounts.append({
-            "source": str(folder_dir),
-            "target": mount_path,
-            "type": "bind",
-        })
-
-    return volume_mounts

apps/api/src/services/docker/container.py

@@ -1,121 +0,0 @@
-"""Docker container lifecycle and query operations."""
-
-import socket
-import subprocess
-
-
-def get_container_id(instance_name: str) -> str | None:
-    """Get the container ID for a compose service.
-
-    Args:
-        instance_name: The service name in compose
-
-    Returns:
-        Container ID or None if not found
-    """
-    result = subprocess.run(
-        ["docker", "ps", "-q", "--filter", f"name={instance_name}"],
-        capture_output=True,
-        text=True,
-    )
-
-    if result.returncode == 0 and result.stdout.strip():
-        return result.stdout.strip().split("\n")[0]
-    return None
-
-
-def get_container_name(instance_name: str) -> str | None:
-    """Get the full container name for a compose service.
-
-    Args:
-        instance_name: The service name in compose
-
-    Returns:
-        Container name or None if not found
-    """
-    result = subprocess.run(
-        ["docker", "ps", "--format", "{{.Names}}", "--filter", f"name={instance_name}"],
-        capture_output=True,
-        text=True,
-    )
-
-    if result.returncode == 0 and result.stdout.strip():
-        return result.stdout.strip().split("\n")[0]
-    return None
-
-
-def connect_container_to_network(container_name: str, network_name: str = "backend") -> bool:
-    """Connect a Docker container to an existing network.
-
-    Args:
-        container_name: Name or ID of the container
-        network_name: Name of the Docker network (default: backend)
-
-    Returns:
-        True if successful, False otherwise
-    """
-    result = subprocess.run(
-        ["docker", "network", "connect", network_name, container_name],
-        capture_output=True,
-        text=True,
-    )
-    return result.returncode == 0
-
-
-def get_container_status(container_id: str) -> str:
-    """Get the status of a Docker container.
-
-    Args:
-        container_id: Docker container ID
-
-    Returns:
-        Container status string (running, exited, etc.)
-    """
-    result = subprocess.run(
-        ["docker", "inspect", "-f", "{{.State.Status}}", container_id],
-        capture_output=True,
-        text=True,
-    )
-
-    if result.returncode == 0:
-        return result.stdout.strip()
-    return "unknown"
-
-
-def get_container_logs(container_id: str, tail: int = 100) -> str:
-    """Get the logs of a Docker container.
-
-    Args:
-        container_id: Docker container ID
-        tail: Number of lines to return
-
-    Returns:
-        Container logs
-    """
-    result = subprocess.run(
-        ["docker", "logs", "--tail", str(tail), container_id],
-        capture_output=True,
-        text=True,
-    )
-
-    if result.returncode == 0:
-        return result.stdout
-    return f"Failed to get logs: {result.stderr}"
-
-
-def find_free_port(start: int = 10000, end: int = 20000) -> int:
-    """Find a free TCP port in the given range.
-
-    Args:
-        start: Start of port range
-        end: End of port range
-
-    Returns:
-        Free port number
-    """
-    for port in range(start, end):
-        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-            if s.connect_ex(("localhost", port)) != 0:
-                return port
-
-    raise RuntimeError(f"No free port found in range {start}-{end}")

apps/api/src/services/docker/tunnel.py

@@ -1,146 +0,0 @@
-"""Cloudflare tunnel management for Docker instances."""
-
-import logging
-import os
-import re
-import signal
-import subprocess
-import time
-from typing import Any
-
-logger = logging.getLogger(__name__)
-
-
-def start_cloudflared_tunnel(
-    container_name: str, port: int, timeout: int = 30
-) -> dict[str, str]:
-    """Start a temporary Cloudflare tunnel for a container.
-
-    Uses 'cloudflared tunnel --url' to create a temporary tunnel
-    with a random trycloudflare.com URL.
-
-    Args:
-        container_name: Name of the Docker container to tunnel to
-        port: Port number the container listens on
-        timeout: Maximum seconds to wait for tunnel URL
-
-    Returns:
-        Dict with 'url' (the public tunnel URL) and 'pid' (process ID)
-    """
-    import select as sel
-
-    # First verify the container is accessible
-    logger.info("Checking connectivity to %s:%d...", container_name, port)
-    for attempt in range(10):
-        check = subprocess.run(
-            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
-             f"http://{container_name}:{port}"],
-            capture_output=True,
-            text=True,
-            timeout=5,
-        )
-        logger.info("Connectivity check %d: http_code=%s", attempt + 1, check.stdout.strip())
-        if check.returncode == 0:
-            break
-        time.sleep(1)
-    else:
-        logger.warning("Container %s:%d not responding to curl checks", container_name, port)
-
-    # Run cloudflared in background, capture output
-    logger.info("Starting cloudflared tunnel to http://%s:%d", container_name, port)
-    proc = subprocess.Popen(
-        ["cloudflared", "tunnel", "--url", f"http://{container_name}:{port}"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-        text=True,
-    )
-
-    # Wait for the URL to appear in output
-    url_pattern = re.compile(r"https://[a-z0-9-]+\.trycloudflare\.com")
-    start_time = time.time()
-    url = None
-
-    while time.time() - start_time < timeout:
-        # Read available output
-        readable, _, _ = sel.select([proc.stdout], [], [], 1.0)
-        if readable:
-            line = proc.stdout.readline()
-            if line:
-                match = url_pattern.search(line)
-                if match:
-                    url = match.group(0)
-                    break
-
-    if not url:
-        proc.terminate()
-        proc.wait(timeout=5)
-        raise RuntimeError(
-            f"Failed to get tunnel URL within {timeout}s. "
-            f"cloudflared output may contain errors."
-        )
-
-    return {"url": url, "pid": str(proc.pid)}
-
-
-def stop_cloudflared_tunnel(pid: str) -> None:
-    """Stop a cloudflared tunnel process.
-
-    Args:
-        pid: Process ID of the cloudflared tunnel
-    """
-    try:
-        os.kill(int(pid), signal.SIGTERM)
-    except ProcessLookupError:
-        pass  # Already stopped
-
-
-def recreate_tunnel(
-    container_name: str, port: int, old_pid: str | None = None
-) -> dict[str, str]:
-    """Recreate a temporary Cloudflare tunnel.
-
-    Stops the old tunnel (if pid provided) and starts a new one.
-
-    Args:
-        container_name: Name of the Docker container to tunnel to
-        port: Port number the container listens on
-        old_pid: Optional PID of the old tunnel process to stop
-
-    Returns:
-        Dict with 'url' and 'pid' for the new tunnel
-    """
-    if old_pid:
-        stop_cloudflared_tunnel(old_pid)
-
-    return start_cloudflared_tunnel(container_name, port)
-
-
-def check_tunnel_health(url: str, timeout: int = 10) -> dict[str, Any]:
-    """Check if a tunnel URL is healthy.
-
-    Args:
-        url: The tunnel URL to check
-        timeout: Request timeout in seconds
-
-    Returns:
-        Dict with 'healthy' (bool) and 'status_code' (int or None)
-    """
-    try:
-        result = subprocess.run(
-            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
-             "--max-time", str(timeout), url],
-            capture_output=True,
-            text=True,
-            timeout=timeout + 5,
-        )
-        status_code = int(result.stdout.strip())
-        return {
-            "healthy": 200 <= status_code < 400,
-            "status_code": status_code,
-        }
-    except (ValueError, subprocess.TimeoutExpired, Exception) as e:
-        return {
-            "healthy": False,
-            "status_code": None,
-            "error": str(e),
-        }

apps/api/src/services/git/__init__.py

@@ -1 +0,0 @@
-"""Git services package."""

apps/api/src/services/git/control.py

@@ -1,196 +0,0 @@
-"""Git control operations with repo validation."""
-
-import logging
-import os
-import uuid
-
-from fastapi import HTTPException, status
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from src.models.git_repository import GitRepository
-from src.models.user import User
-from src.schemas.git_repository import (
-    BranchCreateRequest,
-    CheckoutRequest,
-    CommitRequest,
-    FetchResponse,
-    MergeRequest,
-    MergeResponse,
-    PullResponse,
-    PushResponse,
-    StatusResponse,
-)
-from src.services.git.repository import ensure_repo_on_disk, get_repo_and_validate
-from src.utils.git_control import (
-    checkout_branch,
-    commit_changes,
-    create_branch,
-    delete_branch,
-    fetch,
-    get_status,
-    merge,
-    pull,
-    push,
-)
-
-logger = logging.getLogger(__name__)
-
-
-async def get_status_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-) -> StatusResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        result = get_status(repo.path)
-        return StatusResponse(
-            branch=result.branch,
-            modified=result.modified,
-            added=result.added,
-            deleted=result.deleted,
-            untracked=result.untracked,
-            renamed=result.renamed,
-            ahead=result.ahead,
-            behind=result.behind,
-        )
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def create_branch_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    data: BranchCreateRequest,
-) -> dict:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        create_branch(repo.path, data.name, data.base_branch)
-        return {"message": f"Branch '{data.name}' created", "branch": data.name}
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def delete_branch_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    branch_name: str,
-    force: bool = False,
-) -> dict:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        delete_branch(repo.path, branch_name, force)
-        return {"message": f"Branch '{branch_name}' deleted"}
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def checkout_branch_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    data: CheckoutRequest,
-) -> dict:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        checkout_branch(repo.path, data.branch)
-        return {"message": f"Checked out branch '{data.branch}'", "branch": data.branch}
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def commit_changes_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    data: CommitRequest,
-    user: User,
-) -> dict:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    author_name = user.name or "Unknown"
-    author_email = user.email or "unknown@example.com"
-    try:
-        commit_hash = commit_changes(
-            repo_path=repo.path,
-            message=data.message,
-            author_name=author_name,
-            author_email=author_email,
-            files=data.files,
-        )
-        return {"commit_hash": commit_hash, "message": data.message}
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def fetch_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-) -> FetchResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        fetch(repo.path)
-        return FetchResponse(message="Fetched from remote")
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def pull_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    branch: str | None = None,
-) -> PullResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        pull(repo.path, branch)
-        return PullResponse(message="Pulled from remote")
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def push_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    branch: str | None = None,
-) -> PushResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        push(repo.path, branch)
-        return PushResponse(message="Pushed to remote")
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def merge_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    data: MergeRequest,
-) -> MergeResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        commit_hash = merge(
-            repo_path=repo.path,
-            source_branch=data.source_branch,
-            target_branch=data.target_branch,
-            message=data.message,
-        )
-        return MergeResponse(
-            commit_hash=commit_hash,
-            message=data.message or f"Merge {data.source_branch}",
-        )
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))

apps/api/src/services/git/files.py

@@ -1,150 +0,0 @@
-"""Git file operations with repo validation."""
-
-import logging
-import uuid
-
-from fastapi import HTTPException, status
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from src.models.git_repository import GitRepository
-from src.models.user import User
-from src.schemas.git_repository import (
-    FileContentResponse,
-    FileListResponse,
-    FileUpdateRequest,
-    FileUpdateResponse,
-)
-from src.services.git.repository import ensure_repo_on_disk, get_repo_and_validate
-from src.utils.git_files import (
-    commit_file,
-    get_file_content,
-    list_branches,
-    list_tree,
-)
-
-logger = logging.getLogger(__name__)
-
-
-async def list_files(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    branch: str = "main",
-    path: str = "",
-) -> FileListResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        entries = list_tree(repo.path, branch=branch, path=path)
-        return FileListResponse(
-            path=path,
-            branch=branch,
-            entries=[
-                {
-                    "name": e.name,
-                    "type": e.type,
-                    "path": e.path,
-                    "size": e.size,
-                    "mode": e.mode,
-                    "last_commit": e.last_commit,
-                }
-                for e in entries
-            ],
-        )
-    except RuntimeError as e:
-        logger.error(
-            "Failed to list files for repo %s (path=%s, branch=%s): %s",
-            repo_id,
-            path,
-            branch,
-            str(e),
-            exc_info=True,
-        )
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def get_file(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    branch: str,
-    path: str,
-) -> FileContentResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        file_content = get_file_content(repo.path, branch=branch, path=path)
-        return FileContentResponse(
-            path=file_content.path,
-            branch=file_content.branch,
-            content=file_content.content,
-            size=file_content.size,
-            encoding=file_content.encoding,
-            language=file_content.language,
-            is_binary=file_content.is_binary,
-            last_commit=file_content.last_commit,
-        )
-    except FileNotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="file not found")
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def update_file(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-    data: FileUpdateRequest,
-    user: User,
-) -> FileUpdateResponse:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    author_name = user.name or "Unknown"
-    author_email = user.email or "unknown@example.com"
-    try:
-        commit_hash = commit_file(
-            repo_path=repo.path,
-            branch=data.branch,
-            path=data.path,
-            content=data.content,
-            commit_message=data.commit_message,
-            author_name=author_name,
-            author_email=author_email,
-        )
-        return FileUpdateResponse(
-            commit_hash=commit_hash,
-            message=data.commit_message,
-            branch=data.branch,
-        )
-    except RuntimeError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-async def list_branches_with_validation(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    repo_id: uuid.UUID,
-) -> dict:
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-    ensure_repo_on_disk(repo)
-    try:
-        branches, default_branch = list_branches(repo.path)
-        return {
-            "branches": [
-                {
-                    "name": b.name,
-                    "is_default": b.is_default,
-                    "last_commit": b.last_commit,
-                }
-                for b in branches
-            ],
-            "default_branch": default_branch,
-        }
-    except RuntimeError as e:
-        logger.error(
-            "Failed to list branches for repo %s: %s",
-            repo_id,
-            str(e),
-            exc_info=True,
-        )
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))

apps/api/src/services/git/repository.py

@@ -1,211 +0,0 @@
-"""Repository lifecycle and path helpers."""
-
-import logging
-import os
-import shutil
-import subprocess
-import uuid
-
-from fastapi import HTTPException, status
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from src.config import Settings
-from src.models.git_repository import GitRepository
-from src.models.project import Project
-from src.models.user import User
-from src.schemas.git_repository import GitRepositoryCreate
-from src.utils.git_url_parser import parse_git_url
-
-logger = logging.getLogger(__name__)
-
-
-def _get_repo_path(user_id: uuid.UUID, project_id: uuid.UUID, name: str) -> str:
-    """Generate the filesystem path for a repository."""
-    base = Settings().repo_base_path or "/data/repos"
-    return os.path.join(base, str(user_id), str(project_id), f"{name}.git")
-
-
-def _build_provider_clone_url(owner: str, repo: str) -> str:
-    """Build the SSH clone URL for the fixed git provider."""
-    return f"git@git.commumedia.org:{owner}/{repo}.git"
-
-
-def _preflight_remote_repository(remote_url: str) -> None:
-    """Verify a remote repository is reachable before cloning."""
-    try:
-        result = subprocess.run(
-            ["git", "ls-remote", remote_url],
-            capture_output=True,
-            text=True,
-            timeout=60,
-        )
-    except subprocess.TimeoutExpired:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="remote repository check timed out")
-    except FileNotFoundError:
-        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
-
-    if result.returncode != 0:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="repository not found or inaccessible",
-        )
-
-
-def _clone_working_repository(remote_url: str, repo_path: str) -> None:
-    try:
-        result = subprocess.run(
-            ["git", "clone", remote_url, repo_path],
-            capture_output=True,
-            text=True,
-            timeout=300,
-        )
-    except subprocess.TimeoutExpired:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="clone operation timed out")
-    except FileNotFoundError:
-        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
-
-    if result.returncode != 0:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"failed to clone repository: {result.stderr}",
-        )
-
-
-def _init_working_repository(repo_path: str) -> None:
-    try:
-        result = subprocess.run(
-            ["git", "init", "-b", "main", repo_path],
-            capture_output=True,
-            text=True,
-        )
-    except FileNotFoundError:
-        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
-
-    if result.returncode == 0:
-        return
-
-    fallback = subprocess.run(
-        ["git", "init", repo_path],
-        capture_output=True,
-        text=True,
-    )
-    if fallback.returncode != 0:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"failed to initialize repository: {fallback.stderr}",
-        )
-
-    ref_result = subprocess.run(
-        ["git", "-C", repo_path, "symbolic-ref", "HEAD", "refs/heads/main"],
-        capture_output=True,
-        text=True,
-    )
-    if ref_result.returncode != 0:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"failed to set initial branch: {ref_result.stderr}",
-        )
-
-
-async def get_repo_and_validate(
-    session: AsyncSession,
-    repo_id: uuid.UUID,
-    project_id: uuid.UUID,
-) -> GitRepository:
-    """Fetch a repository and validate ownership + disk presence."""
-    repo = await session.get(GitRepository, repo_id)
-    if repo is None or repo.project_id != project_id:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="repository not found")
-    return repo
-
-
-def ensure_repo_on_disk(repo: GitRepository) -> None:
-    """Raise 404 if the repository is not present on disk."""
-    if not os.path.exists(repo.path):
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="repository not found on disk")
-
-
-async def create_repository(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-    data: GitRepositoryCreate,
-    user: User,
-) -> GitRepository:
-    """Create a new git repository (clone or init)."""
-    # Check for duplicate name
-    existing = await session.execute(
-        select(GitRepository).where(
-            GitRepository.project_id == project_id,
-            GitRepository.name == data.name,
-        )
-    )
-    if existing.scalar_one_or_none():
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="repository name already exists")
-
-    # Validate and potentially correct the URL
-    remote_url = data.remote_url
-    if remote_url and not data.force_original_url:
-        parse_result = parse_git_url(remote_url)
-        if parse_result["needs_parsing"] and parse_result["base_url"]:
-            raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-                detail={
-                    "message": "The provided URL appears to be a browser URL, not a git clone URL",
-                    "suggested_url": parse_result["base_url"],
-                    "original_url": remote_url,
-                    "error_code": "URL_NEEDS_PARSING",
-                },
-            )
-        if parse_result["base_url"]:
-            remote_url = parse_result["base_url"]
-
-    if remote_url:
-        _preflight_remote_repository(remote_url)
-
-    repo_path = _get_repo_path(user.id, project_id, data.name)
-    os.makedirs(os.path.dirname(repo_path), exist_ok=True)
-
-    if remote_url:
-        _clone_working_repository(remote_url, repo_path)
-    else:
-        _init_working_repository(repo_path)
-
-    repo = GitRepository(
-        name=data.name,
-        path=repo_path,
-        project_id=project_id,
-        owner_id=user.id,
-        is_mirror=False,
-        remote_url=remote_url,
-    )
-    session.add(repo)
-    await session.commit()
-    await session.refresh(repo)
-    return repo
-
-
-async def delete_repository(
-    session: AsyncSession,
-    repo_id: uuid.UUID,
-    project_id: uuid.UUID,
-) -> None:
-    """Delete a repository from DB and disk."""
-    repo = await get_repo_and_validate(session, repo_id, project_id)
-
-    if os.path.exists(repo.path):
-        shutil.rmtree(repo.path)
-
-    await session.delete(repo)
-    await session.commit()
-
-
-async def list_repositories(
-    session: AsyncSession,
-    project_id: uuid.UUID,
-) -> list[GitRepository]:
-    """List all repositories in a project."""
-    result = await session.execute(
-        select(GitRepository).where(GitRepository.project_id == project_id)
-    )
-    return list(result.scalars().all())

apps/api/src/services/instance_lifecycle.py

@@ -1,420 +0,0 @@
-"""High-level tool instance lifecycle orchestration.
-
-Coordinates Docker compose, container, tunnel, and config staging services
-to create, start, stop, restart, and delete tool instances.
-"""
-
-import logging
-import os
-import shutil
-from datetime import datetime
-from typing import Any
-
-from fastapi import HTTPException, status
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from src.models.config_folder import ConfigFolder
-from src.models.config_profile import ConfigProfile
-from src.models.git_repository import GitRepository
-from src.models.project import Project
-from src.models.tool_config import ToolConfig
-from src.models.tool_instance import ToolInstance
-from src.models.tool_type import ToolType
-from src.models.user import User
-from src.services.docker import compose as compose_svc
-from src.services.docker import config_staging
-from src.services.docker import container as container_svc
-from src.services.docker import tunnel as tunnel_svc
-from src.services.docker_build import build_image
-from src.services.readiness_probe import execute_probe
-
-logger = logging.getLogger(__name__)
-
-
-async def create_new_instance(
-    session: AsyncSession,
-    project: Project,
-    repo: GitRepository,
-    tool_type: ToolType,
-    user: User,
-    display_name: str | None,
-    selected_profile: ConfigProfile | None,
-) -> ToolInstance:
-    """Create a new tool instance record and its compose file."""
-    instance_name = await compose_svc._generate_instance_name(
-        session, project.name, tool_type.name
-    )
-    instance_dir = compose_svc.ensure_instance_directory(instance_name)
-    tool_port = container_svc.find_free_port()
-
-    compose_path = await _build_or_render_compose(
-        tool_type, instance_name, instance_dir, repo, user, project.id, tool_port
-    )
-
-    instance = ToolInstance(
-        name=instance_name,
-        display_name=display_name or f"{project.name} / {repo.name} / {tool_type.display_name}",
-        tool_type_id=tool_type.id,
-        repository_id=repo.id,
-        project_id=project.id,
-        owner_id=user.id,
-        status="pending",
-        compose_path=compose_path,
-        port=tool_port,
-        selected_profile_id=selected_profile.id if selected_profile else None,
-    )
-    session.add(instance)
-    await session.commit()
-    await session.refresh(instance)
-    return instance
-
-
-async def start_existing_instance(
-    session: AsyncSession,
-    instance: ToolInstance,
-    user: User,
-    project_id: Any,
-) -> dict:
-    """Start an existing instance: stage configs, compose up, probe, tunnel."""
-    if not instance.compose_path or not os.path.exists(instance.compose_path):
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST, detail="compose file not found"
-        )
-
-    instance.status = "building"
-    await session.commit()
-
-    env_vars, config_files, port_override, start_command, working_directory, _extra_env, extra_volumes = await _fetch_tool_configs(
-        session, user.id, instance.tool_type_id, project_id
-    )
-
-    selected_profile = None
-    if instance.selected_profile_id:
-        selected_profile = await session.get(ConfigProfile, instance.selected_profile_id)
-        if selected_profile and selected_profile.user_id == user.id:
-            instance_dir = os.path.dirname(instance.compose_path)
-            env_vars, port_override, start_command, working_directory, extra_volumes = await compose_svc._apply_resolved_profile(
-                selected_profile,
-                instance_dir,
-                env_vars,
-                port_override,
-                start_command,
-                working_directory,
-                extra_volumes,
-            )
-
-    env_file_path, extra_volumes = await _stage_configs_and_folders(
-        session, user.id, project_id, os.path.dirname(instance.compose_path),
-        env_vars, config_files, extra_volumes
-    )
-
-    if port_override or start_command or working_directory or extra_volumes:
-        compose_svc._modify_compose_file(
-            instance.compose_path, port_override, start_command, working_directory, extra_volumes
-        )
-
-    returncode, _stdout, stderr = compose_svc.execute_compose_command(
-        instance.compose_path, "up", env_file=env_file_path
-    )
-    if returncode != 0:
-        instance.status = "error"
-        await session.commit()
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"failed to start instance: {stderr}",
-        )
-
-    container_id = container_svc.get_container_id(instance.name)
-    if container_id:
-        instance.container_id = container_id
-    container_name = container_svc.get_container_name(instance.name)
-    if container_name:
-        instance.container_name = container_name
-        container_svc.connect_container_to_network(container_name, "backend")
-
-    instance.status = "starting"
-    instance.last_started_at = datetime.now()
-    await session.commit()
-
-    tool_type = await session.get(ToolType, instance.tool_type_id)
-    success, probe_logs = await _run_readiness_probe(instance, tool_type)
-    if not success:
-        instance.status = "failed"
-        instance.url = None
-        instance.public_url = None
-        await session.commit()
-        return {
-            "status": "failed",
-            "error": f"Readiness probe failed: {' '.join(probe_logs)}",
-        }
-
-    instance.status = "running"
-    await session.commit()
-    await _start_tunnel_if_web(instance, tool_type)
-    await session.commit()
-
-    return {"status": instance.status, "url": instance.url}
-
-
-async def restart_existing_instance(
-    session: AsyncSession,
-    instance: ToolInstance,
-    user: User,
-    project_id: Any,
-) -> dict:
-    """Restart an instance: re-stage configs, compose restart, tunnel."""
-    if instance.tunnel_id:
-        try:
-            tunnel_svc.stop_cloudflared_tunnel(instance.tunnel_id)
-        except Exception as exc:
-            logger.warning("Failed to stop old tunnel: %s", exc)
-
-    if not instance.compose_path or not os.path.exists(instance.compose_path):
-        instance.status = "error"
-        await session.commit()
-        return {"status": instance.status}
-
-    env_vars, config_files, port_override, start_command, working_directory, _extra_env, extra_volumes = await _fetch_tool_configs(
-        session, user.id, instance.tool_type_id, project_id
-    )
-
-    stored_profile = None
-    if instance.selected_profile_id:
-        stored_profile = await session.get(ConfigProfile, instance.selected_profile_id)
-        if stored_profile and stored_profile.user_id == user.id:
-            instance_dir = os.path.dirname(instance.compose_path)
-            env_vars, port_override, start_command, working_directory, extra_volumes = await compose_svc._apply_resolved_profile(
-                stored_profile, instance_dir, env_vars, port_override, start_command, working_directory, extra_volumes
-            )
-
-    env_file_path, extra_volumes = await _stage_configs_and_folders(
-        session, user.id, project_id, os.path.dirname(instance.compose_path),
-        env_vars, config_files, extra_volumes
-    )
-
-    if port_override or start_command or working_directory or extra_volumes:
-        compose_svc._modify_compose_file(
-            instance.compose_path, port_override, start_command, working_directory, extra_volumes
-        )
-
-    returncode, _stdout, _stderr = compose_svc.execute_compose_command(
-        instance.compose_path, "restart", env_file=env_file_path
-    )
-    if returncode != 0:
-        instance.status = "error"
-        await session.commit()
-        return {"status": instance.status}
-
-    instance.status = "running"
-    instance.last_started_at = datetime.now()
-
-    tool_type = await session.get(ToolType, instance.tool_type_id)
-    await _start_tunnel_if_web(instance, tool_type)
-    await session.commit()
-
-    return {"status": instance.status, "url": instance.url}
-
-
-async def stop_existing_instance(session: AsyncSession, instance: ToolInstance) -> None:
-    """Stop an instance and its tunnel."""
-    if instance.tunnel_id:
-        try:
-            tunnel_svc.stop_cloudflared_tunnel(instance.tunnel_id)
-        except Exception as exc:
-            logger.warning("Failed to stop tunnel: %s", exc)
-
-    if instance.compose_path and os.path.exists(instance.compose_path):
-        compose_svc.execute_compose_command(instance.compose_path, "stop")
-
-    instance.status = "stopped"
-    instance.last_stopped_at = datetime.now()
-    instance.url = None
-    instance.public_url = None
-    instance.tunnel_id = None
-    await session.commit()
-
-
-async def delete_existing_instance(session: AsyncSession, instance: ToolInstance) -> None:
-    """Delete an instance, its containers, and its directory."""
-    if instance.tunnel_id:
-        try:
-            tunnel_svc.stop_cloudflared_tunnel(instance.tunnel_id)
-        except Exception as exc:
-            logger.warning("Failed to stop tunnel: %s", exc)
-
-    if instance.compose_path and os.path.exists(instance.compose_path):
-        compose_svc.execute_compose_command(instance.compose_path, "down")
-        instance_dir = os.path.dirname(instance.compose_path)
-        if os.path.exists(instance_dir):
-            shutil.rmtree(instance_dir)
-
-    await session.delete(instance)
-    await session.commit()
-
-
-# ── Internal helpers ───────────────────────────────────────────────────────
-
-async def _build_or_render_compose(
-    tool_type: ToolType,
-    instance_name: str,
-    instance_dir: str,
-    repo: GitRepository,
-    user: User,
-    project_id: Any,
-    tool_port: int,
-) -> str:
-    """Build Dockerfile or render compose template."""
-    if tool_type.definition_type == "dockerfile":
-        image_tag = f"headquarter/{instance_name}:latest"
-        if tool_type.dockerfile_template:
-            returncode, _stdout, stderr = build_image(
-                instance_dir=instance_dir,
-                dockerfile=tool_type.dockerfile_template,
-                tag=image_tag,
-                build_context=tool_type.build_context,
-            )
-            if returncode != 0:
-                logger.error("Build failed for %s: %s", instance_name, stderr)
-                raise HTTPException(
-                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                    detail=f"Failed to build Docker image: {stderr[:500]}",
-                )
-
-        compose_content = (
-            f'version: "3.8"\nservices:\n  app:\n'
-            f'    image: {image_tag}\n'
-            f'    container_name: {instance_name}\n'
-            f'    ports:\n      - "{tool_port}:{tool_type.default_port}"\n'
-            f'    volumes:\n      - {repo.path}:/workspace\n'
-            f'    restart: unless-stopped\n'
-        )
-    else:
-        variables = {
-            "REPO_PATH": repo.path,
-            "INSTANCE_NAME": instance_name,
-            "INSTANCE_ID": instance_name,
-            "TOOL_NAME": instance_name,
-            "TOOL_PORT": tool_port,
-            "USER_ID": str(user.id),
-            "PROJECT_ID": str(project_id),
-        }
-        compose_content = compose_svc.render_compose_template(
-            tool_type.compose_template, variables
-        )
-
-    compose_svc.write_compose_file(instance_dir, compose_content)
-    return os.path.join(instance_dir, "docker-compose.yml")
-
-
-async def _fetch_tool_configs(
-    session: AsyncSession,
-    user_id: Any,
-    tool_type_id: Any,
-    project_id: Any,
-) -> tuple[dict, dict, Any, Any, Any, dict, list]:
-    """Fetch tool configs and return parsed values."""
-    env_vars: dict[str, str] = {}
-    config_files: dict[str, str] = {}
-    port_override = None
-    start_command = None
-    working_directory = None
-    extra_env_vars: dict[str, str] = {}
-    extra_volumes: list[dict] = []
-
-    query = (
-        select(ToolConfig)
-        .where(ToolConfig.user_id == user_id, ToolConfig.tool_type_id == tool_type_id)
-        .where((ToolConfig.project_id == project_id) | (ToolConfig.project_id.is_(None)))
-    )
-    configs = (await session.execute(query)).scalars().all()
-
-    for cfg in configs:
-        if cfg.config_type == "env":
-            env_vars[cfg.key] = cfg.value
-        elif cfg.config_type == "file" and cfg.file_path:
-            config_files[cfg.file_path] = cfg.value
-        if cfg.port_override:
-            port_override = cfg.port_override
-        if cfg.start_command:
-            start_command = cfg.start_command
-        if cfg.working_directory:
-            working_directory = cfg.working_directory
-        if cfg.environment_variables:
-            extra_env_vars.update(cfg.environment_variables)
-        if cfg.volumes:
-            extra_volumes.extend(cfg.volumes)
-
-    env_vars.update(extra_env_vars)
-    return env_vars, config_files, port_override, start_command, working_directory, extra_env_vars, extra_volumes
-
-
-async def _stage_configs_and_folders(
-    session: AsyncSession,
-    user_id: Any,
-    project_id: Any,
-    instance_dir: str,
-    env_vars: dict[str, str],
-    config_files: dict[str, str],
-    extra_volumes: list[dict],
-) -> tuple[str | None, list[dict]]:
-    """Write env/config files and config folders."""
-    env_file_path: str | None = None
-    if env_vars:
-        env_file_path = compose_svc.write_env_file(instance_dir, env_vars)
-    if config_files:
-        config_staging.write_config_files(instance_dir, config_files)
-
-    folder_query = select(ConfigFolder).where(
-        ConfigFolder.user_id == user_id, ConfigFolder.is_active.is_(True)
-    )
-    folders = (await session.execute(folder_query)).scalars().all()
-    if folders:
-        folder_volumes = config_staging.write_config_folder_files(
-            instance_dir, folders, str(project_id)
-        )
-        extra_volumes.extend(folder_volumes)
-
-    return env_file_path, extra_volumes
-
-
-async def _start_tunnel_if_web(instance: ToolInstance, tool_type: ToolType) -> None:
-    """Create Cloudflare tunnel for web-enabled tools."""
-    if "web" not in tool_type.interfaces or not tool_type.default_port:
-        instance.url = None
-        instance.public_url = None
-        return
-
-    try:
-        tunnel_info = tunnel_svc.start_cloudflared_tunnel(
-            container_name=instance.container_name or instance.name,
-            port=tool_type.default_port,
-        )
-        instance.tunnel_id = tunnel_info["pid"]
-        instance.public_url = tunnel_info["url"]
-        instance.url = tunnel_info["url"]
-        logger.info("Created tunnel for instance %s: %s", instance.id, tunnel_info["url"])
-    except Exception as exc:
-        logger.error("Failed to create tunnel for instance %s: %s", instance.id, exc)
-        instance.status = "error"
-        instance.url = None
-
-
-async def _run_readiness_probe(
-    instance: ToolInstance, tool_type: ToolType
-) -> tuple[bool, list[str]]:
-    """Run readiness probe if configured."""
-    if not tool_type.readiness_probe or not instance.container_id:
-        return True, []
-
-    probe = tool_type.readiness_probe
-    command = probe.get("command", "")
-    if not command:
-        return True, []
-
-    return await execute_probe(
-        container_id=instance.container_id,
-        command=command,
-        timeout=probe.get("timeout", 30),
-        interval=probe.get("interval", 2),
-    )

apps/api/src/services/profile_resolver.py

@@ -1,251 +0,0 @@
-"""Profile resolver service for recursive ordered include resolution.
-
-Provides deterministic merge rules, save-independent cycle protection,
-and resolved output structures for env vars, runtime hints, mounts,
-file trees, and override metadata.
-"""
-
-from __future__ import annotations
-
-import uuid
-from dataclasses import dataclass, field
-
-from src.models.config_include import ConfigInclude
-from src.models.config_mount import ConfigMount
-from src.models.config_profile import ConfigProfile
-
-
-@dataclass
-class ResolvedMount:
-    """A resolved mount with merged file tree and final mode."""
-
-    target_path: str
-    mode: str  # "ro" or "rw"
-    files: dict[str, str] = field(default_factory=dict)
-    """Relative file paths to UTF-8 text content."""
-    overridden_files: dict[str, list[str]] = field(default_factory=dict)
-    """Map of relative file path to list of profile names that contributed
-    (latest is the winner)."""
-    mode_overridden_by: str | None = None
-    """Name of the profile that set the final mode, if different from first."""
-
-
-@dataclass
-class ResolvedRuntimeHints:
-    """Resolved runtime hints from profile layers."""
-
-    start_command: str | None = None
-    working_directory: str | None = None
-    port: int | None = None
-    overridden_hints: dict[str, str] = field(default_factory=dict)
-    """Map of hint key to profile name that provided the winning value."""
-
-
-@dataclass
-class ResolvedProfileOutput:
-    """Complete resolved output for a config profile."""
-
-    profile_id: uuid.UUID
-    profile_name: str
-    environment_variables: dict[str, str] = field(default_factory=dict)
-    """Final merged env vars (later layers win)."""
-    env_var_sources: dict[str, list[str]] = field(default_factory=dict)
-    """Map of env var key to ordered list of contributing profile names
-    (latest is the winner)."""
-    runtime_hints: ResolvedRuntimeHints = field(
-        default_factory=lambda: ResolvedRuntimeHints()
-    )
-    mounts: dict[str, ResolvedMount] = field(default_factory=dict)
-    """Map of target_path to ResolvedMount."""
-    resolution_order: list[str] = field(default_factory=list)
-    """Ordered list of profile names as they were resolved."""
-    cycle_detected: bool = False
-    cycle_path: list[str] | None = None
-
-
-class ProfileResolutionError(Exception):
-    """Raised when profile resolution fails."""
-
-    pass
-
-
-class ProfileCycleError(ProfileResolutionError):
-    """Raised when a cycle is detected during profile resolution."""
-
-    def __init__(self, cycle_path: list[str]) -> None:
-        self.cycle_path = cycle_path
-        path_str = " -> ".join(cycle_path)
-        super().__init__(f"Profile include cycle detected: {path_str}")
-
-
-def _merge_env_vars(
-    current: dict[str, str],
-    sources: dict[str, list[str]],
-    profile: ConfigProfile,
-) -> None:
-    """Merge a profile's env vars into the current dict, tracking sources."""
-    if not profile.environment_variables:
-        return
-    for key, value in profile.environment_variables.items():
-        current[key] = value
-        if key not in sources:
-            sources[key] = []
-        sources[key].append(profile.name)
-
-
-def _merge_runtime_hints(
-    hints: ResolvedRuntimeHints,
-    profile: ConfigProfile,
-) -> None:
-    """Merge a profile's runtime hints, tracking overrides."""
-    if profile.start_command is not None:
-        hints.start_command = profile.start_command
-        hints.overridden_hints["start_command"] = profile.name
-    if profile.working_directory is not None:
-        hints.working_directory = profile.working_directory
-        hints.overridden_hints["working_directory"] = profile.name
-    if profile.port is not None:
-        hints.port = profile.port
-        hints.overridden_hints["port"] = profile.name
-
-
-def _merge_mounts(
-    mounts: dict[str, ResolvedMount],
-    profile_mounts: list[ConfigMount],
-    profile: ConfigProfile,
-) -> None:
-    """Merge a profile's mounts into the current mounts dict."""
-    for mount in profile_mounts:
-        target = mount.target_path
-        if target not in mounts:
-            mounts[target] = ResolvedMount(
-                target_path=target,
-                mode=mount.mode,
-                files={},
-                overridden_files={},
-            )
-        resolved = mounts[target]
-        
-        # Mode override: later wins
-        if resolved.mode != mount.mode:
-            resolved.mode = mount.mode
-            resolved.mode_overridden_by = profile.name
-        
-        # File tree merge: later wins for same relative path
-        if mount.files:
-            for rel_path, content in mount.files.items():
-                if rel_path not in resolved.files:
-                    resolved.overridden_files[rel_path] = []
-                else:
-                    if rel_path not in resolved.overridden_files:
-                        resolved.overridden_files[rel_path] = []
-                    resolved.overridden_files[rel_path].append(profile.name)
-                resolved.files[rel_path] = content
-
-
-def _resolve_profile_recursive(
-    profile: ConfigProfile,
-    visited: set[uuid.UUID],
-    path: list[str],
-    resolution_order: list[str],
-    env_vars: dict[str, str],
-    env_var_sources: dict[str, list[str]],
-    runtime_hints: ResolvedRuntimeHints,
-    mounts: dict[str, ResolvedMount],
-) -> None:
-    """Recursively resolve a profile and its includes.
-
-    Args:
-        profile: The profile to resolve
-        visited: Set of already-resolved profile IDs to avoid duplicates
-        path: Current recursion path for cycle detection
-        resolution_order: Ordered list of profile names being resolved
-        env_vars: Accumulated environment variables
-        env_var_sources: Tracking of which profiles contributed each env var
-        runtime_hints: Accumulated runtime hints
-        mounts: Accumulated mounts
-
-    Raises:
-        ProfileCycleError: If a cycle is detected
-    """
-    if profile.name in path:
-        # Cycle detected
-        cycle_start = path.index(profile.name)
-        cycle_path = path[cycle_start:] + [profile.name]
-        raise ProfileCycleError(cycle_path)
-
-    if profile.id in visited:
-        # Already resolved in another branch (diamond graph)
-        return
-
-    visited.add(profile.id)
-    path.append(profile.name)
-    resolution_order.append(profile.name)
-
-    # Resolve includes first (in order)
-    includes: list[ConfigInclude] = list(profile.includes)
-    includes.sort(key=lambda inc: inc.order_index)
-    for include in includes:
-        included_profile = include.included_profile
-        if included_profile is not None:
-            _resolve_profile_recursive(
-                included_profile,
-                visited,
-                path,
-                resolution_order,
-                env_vars,
-                env_var_sources,
-                runtime_hints,
-                mounts,
-            )
-
-    # Apply this profile's values (later layers win)
-    _merge_env_vars(env_vars, env_var_sources, profile)
-    _merge_runtime_hints(runtime_hints, profile)
-    _merge_mounts(mounts, list(profile.mounts), profile)
-
-    path.pop()
-
-
-def resolve_profile(profile: ConfigProfile) -> ResolvedProfileOutput:
-    """Resolve a config profile with all its includes.
-
-    Processes included profiles in configured order, then applies the
-    selected profile itself. Later layers override earlier layers.
-
-    Args:
-        profile: The root profile to resolve
-
-    Returns:
-        ResolvedProfileOutput with merged env vars, runtime hints, mounts,
-        and override metadata
-
-    Raises:
-        ProfileCycleError: If a cycle is detected in the include graph
-    """
-    env_vars: dict[str, str] = {}
-    env_var_sources: dict[str, list[str]] = {}
-    runtime_hints = ResolvedRuntimeHints()
-    mounts: dict[str, ResolvedMount] = {}
-    resolution_order: list[str] = []
-
-    _resolve_profile_recursive(
-        profile,
-        set(),
-        [],
-        resolution_order,
-        env_vars,
-        env_var_sources,
-        runtime_hints,
-        mounts,
-    )
-
-    return ResolvedProfileOutput(
-        profile_id=profile.id,
-        profile_name=profile.name,
-        environment_variables=env_vars,
-        env_var_sources=env_var_sources,
-        runtime_hints=runtime_hints,
-        mounts=mounts,
-        resolution_order=resolution_order,
-    )

apps/api/src/services/terminal_manager.py

@@ -1,35 +1,19 @@
 """Terminal session manager for WebSocket connections."""
 
 import asyncio
-import contextlib
-import json
-import logging
-import time
 import uuid
-from collections.abc import Coroutine
 from typing import Any
 
 from fastapi import WebSocket
 
 from src.services.terminal_session import TerminalSession
 
-logger = logging.getLogger(__name__)
-
-_READ_BATCH_INTERVAL_S = 0.016  # 16ms max batching delay
-_READ_POLL_TIMEOUT_S = 0.005
-_READ_POLL_SLEEP_S = 0.001
-_HEARTBEAT_INTERVAL_S = 15.0
-_IDLE_TIMEOUT_S = 60.0
-
 
 class TerminalManager:
     """Manages active terminal sessions."""
 
     def __init__(self) -> None:
-        """Initialise the terminal manager."""
         self._sessions: dict[str, TerminalSession] = {}
-        self._last_client_message: dict[str, float] = {}
-        self._background_tasks: set[asyncio.Task[Any]] = set()
 
     async def create_session(
         self,
@@ -42,134 +26,55 @@ class TerminalManager:
         session = TerminalSession(session_id, instance_id, container_id)
         await session.start()
         self._sessions[session_id] = session
-        self._last_client_message[session_id] = time.monotonic()
 
         # Start background tasks for I/O streaming
-        self._start_task(self._read_loop(session, websocket))
-        self._start_task(self._write_loop(session, websocket))
-        self._start_task(self._heartbeat_loop(session, websocket))
+        asyncio.create_task(self._read_loop(session, websocket))
+        asyncio.create_task(self._write_loop(session, websocket))
 
         return session
 
-    def _start_task(self, coro: Coroutine[Any, Any, None]) -> None:
-        """Start a background task and store a reference to prevent GC."""
-        task = asyncio.create_task(coro)
-        self._background_tasks.add(task)
-        task.add_done_callback(self._background_tasks.discard)
-
-    async def _read_loop(
-        self,
-        session: TerminalSession,
-        websocket: WebSocket,
-    ) -> None:
-        """Read output from the container and send to WebSocket with batching."""
+    async def _read_loop(self, session: TerminalSession, websocket: WebSocket) -> None:
+        """Read output from the container and send to WebSocket."""
         try:
-            buffer = bytearray()
-            last_flush = time.monotonic()
-
-            while session.is_alive() and not session.closed:
-                data = await session.read_output(select_timeout=_READ_POLL_TIMEOUT_S)
+            while session.is_alive() and not session._closed:
+                data = await session.read_output()
                 if data:
-                    buffer.extend(data)
-
-                now = time.monotonic()
-                flush_due = buffer and (
-                    now - last_flush >= _READ_BATCH_INTERVAL_S or not data
-                )
-
-                if flush_due:
-                    await websocket.send_bytes(bytes(buffer))
-                    buffer.clear()
-                    last_flush = now
-                elif not data:
-                    await asyncio.sleep(_READ_POLL_SLEEP_S)
-
-            # Flush any remaining data
-            if buffer:
-                with contextlib.suppress(Exception):
-                    await websocket.send_bytes(bytes(buffer))
-
+                    await websocket.send_bytes(data)
+                else:
+                    await asyncio.sleep(0.01)
         except Exception:
-            logger.exception("Read loop error for session %s", session.session_id)
+            pass
         finally:
             await self._cleanup_session(session)
 
-    async def _write_loop(
-        self,
-        session: TerminalSession,
-        websocket: WebSocket,
-    ) -> None:
+    async def _write_loop(self, session: TerminalSession, websocket: WebSocket) -> None:
         """Read input from WebSocket and send to container."""
         try:
-            while session.is_alive() and not session.closed:
+            while session.is_alive() and not session._closed:
                 message = await websocket.receive()
-                self._last_client_message[session.session_id] = time.monotonic()
-
                 if message["type"] == "websocket.receive":
                     if "bytes" in message:
                         await session.write_input(message["bytes"])
                     elif "text" in message:
                         text = message["text"]
                         if text.startswith("{"):
+                            # Control message (JSON)
+                            import json
                             try:
                                 ctrl = json.loads(text)
-                                await self._handle_control_message(
-                                    session,
-                                    websocket,
-                                    ctrl,
-                                )
+                                if ctrl.get("type") == "resize":
+                                    await session.resize(
+                                        ctrl.get("cols", 80),
+                                        ctrl.get("rows", 24),
+                                    )
                             except json.JSONDecodeError:
-                                logger.debug("Invalid JSON control message: %s", text)
+                                pass
                         else:
                             await session.write_input(text.encode("utf-8"))
                 elif message["type"] == "websocket.disconnect":
                     break
         except Exception:
-            logger.exception("Write loop error for session %s", session.session_id)
-        finally:
-            await self._cleanup_session(session)
-
-    async def _handle_control_message(
-        self,
-        session: TerminalSession,
-        websocket: WebSocket,
-        ctrl: dict[str, Any],
-    ) -> None:
-        """Handle a JSON control message from the client."""
-        msg_type = ctrl.get("type")
-        if msg_type == "resize":
-            await session.resize(
-                ctrl.get("cols", 80),
-                ctrl.get("rows", 24),
-            )
-        elif msg_type == "ping":
-            await websocket.send_json(
-                {"type": "pong", "id": ctrl.get("id")},
-            )
-
-    async def _heartbeat_loop(
-        self,
-        session: TerminalSession,
-        websocket: WebSocket,
-    ) -> None:
-        """Monitor client activity and close idle connections."""
-        try:
-            while session.is_alive() and not session.closed:
-                await asyncio.sleep(_HEARTBEAT_INTERVAL_S)
-                last_msg = self._last_client_message.get(session.session_id, 0)
-                if time.monotonic() - last_msg > _IDLE_TIMEOUT_S:
-                    # Client has been silent for 60s — close connection
-                    with contextlib.suppress(Exception):
-                        await websocket.close(
-                            code=1000,
-                            reason="Idle timeout",
-                        )
-                    break
-        except Exception:
-            logger.exception(
-                "Heartbeat loop error for session %s",
-                session.session_id,
-            )
+            pass
         finally:
             await self._cleanup_session(session)
 
@@ -177,14 +82,12 @@ class TerminalManager:
         """Clean up a session."""
         if session.session_id in self._sessions:
             del self._sessions[session.session_id]
-        self._last_client_message.pop(session.session_id, None)
         await session.close()
 
     async def close_all(self) -> None:
         """Close all active sessions."""
         sessions = list(self._sessions.values())
         self._sessions.clear()
-        self._last_client_message.clear()
         for session in sessions:
             await session.close()
 

apps/api/src/services/terminal_session.py

@@ -1,29 +1,19 @@
 """Terminal session management for tool instances."""
 
 import asyncio
-import contextlib
-import fcntl
-import logging
 import os
 import pty
 import select
 import struct
-import termios
+import fcntl
 import uuid
-
-logger = logging.getLogger(__name__)
+from typing import Any
 
 
 class TerminalSession:
     """Manages a single terminal session connected to a docker container."""
 
-    def __init__(
-        self,
-        session_id: str,
-        instance_id: uuid.UUID,
-        container_id: str,
-    ) -> None:
-        """Initialize a terminal session."""
+    def __init__(self, session_id: str, instance_id: uuid.UUID, container_id: str) -> None:
         self.session_id = session_id
         self.instance_id = instance_id
         self.container_id = container_id
@@ -31,20 +21,23 @@ class TerminalSession:
         self._closed = False
         self._master_fd: int | None = None
         self._slave_fd: int | None = None
-        self._echo_enabled = True
-        self._exit_reason: str | None = None
 
     async def start(self) -> None:
         """Start the docker exec process with a shell using a PTY."""
+        # Create a pseudo-terminal on the host
         self._master_fd, self._slave_fd = pty.openpty()
+        
+        # Set the terminal size initially
         self._set_terminal_size(80, 24)
-
+        
+        # Start docker exec with the slave fd as stdin/stdout/stderr
+        # Using -it because the slave fd IS a TTY
         self.process = await asyncio.create_subprocess_exec(
             "docker",
             "exec",
             "-it",
             "-e",
-            "TERM=xterm-256color",
+            "TERM=xterm",
             self.container_id,
             "bash",
             "-il",
@@ -52,71 +45,44 @@ class TerminalSession:
             stdout=self._slave_fd,
             stderr=self._slave_fd,
         )
-
+        
+        # Close slave fd in parent process
         os.close(self._slave_fd)
         self._slave_fd = None
-        self._echo_enabled = self._detect_echo_state()
 
     def _set_terminal_size(self, cols: int, rows: int) -> None:
         """Set the terminal size using TIOCSWINSZ."""
         if self._master_fd is None:
             return
-        tiocswinsz = 0x5414
-        size = struct.pack("HHHH", rows, cols, 0, 0)
-        with contextlib.suppress(OSError):
-            fcntl.ioctl(self._master_fd, tiocswinsz, size)
-
-    def _detect_echo_state(self) -> bool:
-        """Detect whether the PTY has echo enabled via termios."""
-        if self._master_fd is None:
-            return True
+        # TIOCSWINSZ = 0x5414 on Linux
+        TIOCSWINSZ = 0x5414
+        size = struct.pack('HHHH', rows, cols, 0, 0)
         try:
-            attrs = termios.tcgetattr(self._master_fd)
-            return bool(attrs[3] & termios.ECHO)
-        except OSError:
-            return True
+            fcntl.ioctl(self._master_fd, TIOCSWINSZ, size)
+        except (OSError, IOError):
+            pass
 
-    async def check_echo_state(self) -> bool | None:
-        """Check if echo state changed. Returns new state if changed, None otherwise."""
-        current = self._detect_echo_state()
-        if current != self._echo_enabled:
-            self._echo_enabled = current
-            return current
-        return None
-
-    @property
-    def echo_enabled(self) -> bool:
-        """Return whether the PTY currently has echo enabled."""
-        return self._echo_enabled
-
-    @property
-    def closed(self) -> bool:
-        """Return whether the session has been closed."""
-        return self._closed
-
-    async def read_output(self, select_timeout: float = 0.1) -> bytes:
+    async def read_output(self) -> bytes:
         """Read output from the PTY master."""
         if self._master_fd is None or self._closed:
             return b""
         try:
-            readable, _, _ = select.select(
-                [self._master_fd],
-                [],
-                [],
-                select_timeout,
-            )
+            # Use select to check if data is available
+            readable, _, _ = select.select([self._master_fd], [], [], 0.1)
             if readable:
-                return os.read(self._master_fd, 8192)
+                return os.read(self._master_fd, 4096)
             return b""
-        except (OSError, ValueError):
+        except (OSError, IOError, ValueError):
             return b""
 
     async def write_input(self, data: bytes) -> None:
         """Write input to the PTY master."""
         if self._master_fd is None or self._closed:
             return
-        with contextlib.suppress(OSError):
+        try:
             os.write(self._master_fd, data)
+        except (OSError, IOError):
+            pass
 
     async def resize(self, cols: int, rows: int) -> None:
         """Resize the terminal."""
@@ -124,35 +90,24 @@ class TerminalSession:
             return
         self._set_terminal_size(cols, rows)
 
-    def get_exit_reason(self) -> str | None:
-        """Return the reason the session ended, if known."""
-        return self._exit_reason
-
     async def close(self) -> None:
         """Close the session and cleanup."""
         if self._closed:
             return
         self._closed = True
 
-        # Determine exit reason
-        if self.process is not None and self.process.returncode is not None:
-            if self.process.returncode == 0:
-                self._exit_reason = "process_exit"
-            else:
-                self._exit_reason = "process_exit"
-        else:
-            self._exit_reason = "timeout"
-
         if self._master_fd is not None:
-            with contextlib.suppress(OSError):
+            try:
                 os.close(self._master_fd)
+            except OSError:
+                pass
             self._master_fd = None
 
         if self.process is not None:
             try:
                 self.process.kill()
                 await asyncio.wait_for(self.process.wait(), timeout=2.0)
-            except (TimeoutError, ProcessLookupError):
+            except (asyncio.TimeoutError, ProcessLookupError):
                 pass
 
     def is_alive(self) -> bool:

apps/api/src/utils/git_control.py

@@ -124,7 +124,15 @@ def create_branch(repo_path: str, name: str, base_branch: str = "HEAD") -> None:
     try:
         _run_git_command(repo_path, "rev-parse", "--verify", "HEAD^{commit}")
     except RuntimeError:
-        _run_git_command(repo_path, "checkout", "--orphan", name)
+        # No commits yet - empty repository
+        try:
+            _run_git_command(repo_path, "checkout", "--orphan", name)
+        except RuntimeError as e:
+            if "work tree" in str(e).lower():
+                # Bare repository - use symbolic-ref instead
+                _run_git_command(repo_path, "symbolic-ref", "HEAD", f"refs/heads/{name}")
+                return
+            raise
         return
 
     _run_git_command(repo_path, "branch", name, base_branch)
@@ -155,7 +163,14 @@ def checkout_branch(repo_path: str, name: str) -> None:
     Raises:
         RuntimeError: If checkout fails
     """
-    _run_git_command(repo_path, "checkout", name)
+    try:
+        _run_git_command(repo_path, "checkout", name)
+    except RuntimeError as e:
+        if "work tree" in str(e).lower():
+            # Bare repository - use symbolic-ref instead
+            _run_git_command(repo_path, "symbolic-ref", "HEAD", f"refs/heads/{name}")
+            return
+        raise
 
 
 def commit_changes(
@@ -290,6 +305,10 @@ def get_current_branch(repo_path: str) -> str:
         Current branch name
     """
     try:
-        return _run_git_command(repo_path, "rev-parse", "--abbrev-ref", "HEAD").strip()
+        branch = _run_git_command(repo_path, "rev-parse", "--abbrev-ref", "HEAD").strip()
+        if branch != "HEAD":
+            return branch
     except RuntimeError:
-        return _run_git_command(repo_path, "symbolic-ref", "--short", "HEAD").strip()
+        pass
+
+    return _run_git_command(repo_path, "symbolic-ref", "--short", "HEAD").strip()

apps/api/src/utils/git_history.py

@@ -60,12 +60,9 @@ def get_commit_history(repo_path: str, branch: str | None = None, limit: int = 1
 
     Returns structured data including commits, branches, and graph information.
     """
-    # Get list of branches (may fail for empty repos)
-    try:
-        branches_output = _run_git_command(repo_path, ["branch", "-a", "--format=%(refname:short)"])
-        branches = [b.strip() for b in branches_output.strip().split("\n") if b.strip()]
-    except RuntimeError:
-        branches = []
+    # Get list of branches
+    branches_output = _run_git_command(repo_path, ["branch", "-a", "--format=%(refname:short)"])
+    branches = [b.strip() for b in branches_output.strip().split("\n") if b.strip()]
 
     # Build git log command - use NULL bytes as separators to avoid parsing issues
     log_args = [
@@ -79,16 +76,7 @@ def get_commit_history(repo_path: str, branch: str | None = None, limit: int = 1
     else:
         log_args.append("--all")
 
-    try:
-        log_output = _run_git_command(repo_path, log_args)
-    except RuntimeError:
-        # Empty repo or no commits
-        return {
-            "commits": [],
-            "branches": branches,
-            "total_commits": 0,
-            "graph_data": {"nodes": [], "edges": []},
-        }
+    log_output = _run_git_command(repo_path, log_args)
 
     # Get branch info for each commit
     branch_map = _get_branch_map(repo_path)
@@ -125,11 +113,8 @@ def get_commit_history(repo_path: str, branch: str | None = None, limit: int = 1
         )
 
     # Get total commit count
-    try:
-        count_output = _run_git_command(repo_path, ["rev-list", "--all", "--count"])
-        total_commits = int(count_output.strip()) if count_output.strip() else 0
-    except RuntimeError:
-        total_commits = 0
+    count_output = _run_git_command(repo_path, ["rev-list", "--all", "--count"])
+    total_commits = int(count_output.strip()) if count_output.strip() else 0
 
     # Build graph data and generate graph symbols
     graph_data = _build_graph_data(commits)

apps/api/tests/integration/test_config_profiles_api.py

@@ -1,461 +0,0 @@
-"""Integration tests for config profiles API."""
-
-import uuid
-
-import pytest
-from fastapi.testclient import TestClient
-
-
-@pytest.mark.integration
-class TestConfigProfilesAPI:
-    """Integration tests for config profiles API."""
-
-    def test_list_config_profiles_requires_authentication(self, test_client: TestClient) -> None:
-        """Test that listing config profiles requires authentication."""
-        response = test_client.get("/config-profiles")
-        assert response.status_code == 401
-
-    def test_list_config_profiles_returns_user_profiles(self, authenticated_client: TestClient) -> None:
-        """Test that authenticated users can list their profiles."""
-        response = authenticated_client.get("/config-profiles")
-        assert response.status_code == 200
-        data = response.json()
-        assert isinstance(data, dict)
-        assert "profiles" in data
-        assert isinstance(data["profiles"], list)
-
-    def test_create_config_profile_successfully(self, authenticated_client: TestClient) -> None:
-        """Test creating a config profile."""
-        response = authenticated_client.post(
-            "/config-profiles",
-            json={
-                "name": "test-profile",
-                "description": "Test profile",
-            },
-        )
-        assert response.status_code == 201
-        data = response.json()
-        assert data["name"] == "test-profile"
-        assert data["description"] == "Test profile"
-
-    def test_create_config_profile_duplicate_name(self, authenticated_client: TestClient) -> None:
-        """Test that duplicate profile names are rejected."""
-        authenticated_client.post(
-            "/config-profiles",
-            json={"name": "duplicate-profile"},
-        )
-
-        response = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "duplicate-profile"},
-        )
-        assert response.status_code == 409
-
-    def test_create_config_profile_empty_name(self, authenticated_client: TestClient) -> None:
-        """Test that empty profile names are rejected."""
-        response = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "  "},
-        )
-        assert response.status_code == 422
-
-    def test_get_config_profile_by_id(self, authenticated_client: TestClient) -> None:
-        """Test getting a config profile by ID."""
-        create_response = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "get-test"},
-        )
-        profile_id = create_response.json()["id"]
-
-        response = authenticated_client.get(f"/config-profiles/{profile_id}")
-        assert response.status_code == 200
-        data = response.json()
-        assert data["name"] == "get-test"
-        assert "includes" in data
-        assert "mounts" in data
-
-    def test_get_config_profile_not_found(self, authenticated_client: TestClient) -> None:
-        """Test getting a non-existent profile."""
-        response = authenticated_client.get(f"/config-profiles/{uuid.uuid4()}")
-        assert response.status_code == 404
-
-    def test_update_config_profile_successfully(self, authenticated_client: TestClient) -> None:
-        """Test updating a config profile."""
-        create_response = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "update-test"},
-        )
-        profile_id = create_response.json()["id"]
-
-        response = authenticated_client.put(
-            f"/config-profiles/{profile_id}",
-            json={"name": "updated-name", "description": "updated desc"},
-        )
-        assert response.status_code == 200
-        data = response.json()
-        assert data["name"] == "updated-name"
-        assert data["description"] == "updated desc"
-
-    def test_delete_config_profile_successfully(self, authenticated_client: TestClient) -> None:
-        """Test deleting a config profile."""
-        create_response = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "delete-test"},
-        )
-        profile_id = create_response.json()["id"]
-
-        response = authenticated_client.delete(f"/config-profiles/{profile_id}")
-        assert response.status_code == 204
-
-        get_response = authenticated_client.get(f"/config-profiles/{profile_id}")
-        assert get_response.status_code == 404
-
-    def test_profile_access_check(self, authenticated_client: TestClient) -> None:
-        """Test that users can only access their own profiles."""
-        # Create a profile
-        create_response = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "access-test"},
-        )
-        profile_id = create_response.json()["id"]
-
-        # The profile should be accessible
-        response = authenticated_client.get(f"/config-profiles/{profile_id}")
-        assert response.status_code == 200
-
-
-@pytest.mark.integration
-class TestConfigProfileIncludes:
-    """Integration tests for config profile includes."""
-
-    def test_add_include_successfully(self, authenticated_client: TestClient) -> None:
-        """Test adding an include to a profile."""
-        # Create two profiles
-        profile1 = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "profile-1"},
-        ).json()
-        profile2 = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "profile-2"},
-        ).json()
-
-        # Add include
-        response = authenticated_client.post(
-            f"/config-profiles/{profile1['id']}/includes",
-            json={"included_profile_id": profile2["id"], "order_index": 0},
-        )
-        assert response.status_code == 201
-        data = response.json()
-        assert data["included_profile_id"] == profile2["id"]
-        assert data["included_profile_name"] == "profile-2"
-
-    def test_add_self_include_rejected(self, authenticated_client: TestClient) -> None:
-        """Test that self-includes are rejected."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "self-include-test"},
-        ).json()
-
-        response = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/includes",
-            json={"included_profile_id": profile["id"], "order_index": 0},
-        )
-        assert response.status_code == 400
-
-    def test_add_include_cycle_rejected(self, authenticated_client: TestClient) -> None:
-        """Test that circular includes are rejected."""
-        profile1 = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "cycle-1"},
-        ).json()
-        profile2 = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "cycle-2"},
-        ).json()
-
-        # Add profile1 includes profile2
-        authenticated_client.post(
-            f"/config-profiles/{profile1['id']}/includes",
-            json={"included_profile_id": profile2["id"], "order_index": 0},
-        )
-
-        # Try to add profile2 includes profile1 (creates cycle)
-        response = authenticated_client.post(
-            f"/config-profiles/{profile2['id']}/includes",
-            json={"included_profile_id": profile1["id"], "order_index": 0},
-        )
-        assert response.status_code == 400
-
-    def test_add_deep_cycle_rejected(self, authenticated_client: TestClient) -> None:
-        """Test that deep circular includes are rejected."""
-        p1 = authenticated_client.post(
-            "/config-profiles", json={"name": "deep-1"}
-        ).json()
-        p2 = authenticated_client.post(
-            "/config-profiles", json={"name": "deep-2"}
-        ).json()
-        p3 = authenticated_client.post(
-            "/config-profiles", json={"name": "deep-3"}
-        ).json()
-
-        # p1 -> p2 -> p3
-        authenticated_client.post(
-            f"/config-profiles/{p1['id']}/includes",
-            json={"included_profile_id": p2["id"], "order_index": 0},
-        )
-        authenticated_client.post(
-            f"/config-profiles/{p2['id']}/includes",
-            json={"included_profile_id": p3["id"], "order_index": 0},
-        )
-
-        # Try p3 -> p1 (creates cycle)
-        response = authenticated_client.post(
-            f"/config-profiles/{p3['id']}/includes",
-            json={"included_profile_id": p1["id"], "order_index": 0},
-        )
-        assert response.status_code == 400
-
-    def test_add_duplicate_include_rejected(self, authenticated_client: TestClient) -> None:
-        """Test that duplicate includes are rejected."""
-        p1 = authenticated_client.post(
-            "/config-profiles", json={"name": "dup-1"}
-        ).json()
-        p2 = authenticated_client.post(
-            "/config-profiles", json={"name": "dup-2"}
-        ).json()
-
-        authenticated_client.post(
-            f"/config-profiles/{p1['id']}/includes",
-            json={"included_profile_id": p2["id"], "order_index": 0},
-        )
-
-        response = authenticated_client.post(
-            f"/config-profiles/{p1['id']}/includes",
-            json={"included_profile_id": p2["id"], "order_index": 1},
-        )
-        assert response.status_code == 409
-
-    def test_list_includes(self, authenticated_client: TestClient) -> None:
-        """Test listing includes for a profile."""
-        p1 = authenticated_client.post(
-            "/config-profiles", json={"name": "list-inc-1"}
-        ).json()
-        p2 = authenticated_client.post(
-            "/config-profiles", json={"name": "list-inc-2"}
-        ).json()
-
-        authenticated_client.post(
-            f"/config-profiles/{p1['id']}/includes",
-            json={"included_profile_id": p2["id"], "order_index": 0},
-        )
-
-        response = authenticated_client.get(f"/config-profiles/{p1['id']}/includes")
-        assert response.status_code == 200
-        data = response.json()
-        assert len(data["includes"]) == 1
-
-    def test_update_include_order(self, authenticated_client: TestClient) -> None:
-        """Test updating include order index."""
-        p1 = authenticated_client.post(
-            "/config-profiles", json={"name": "order-1"}
-        ).json()
-        p2 = authenticated_client.post(
-            "/config-profiles", json={"name": "order-2"}
-        ).json()
-
-        inc = authenticated_client.post(
-            f"/config-profiles/{p1['id']}/includes",
-            json={"included_profile_id": p2["id"], "order_index": 0},
-        ).json()
-
-        response = authenticated_client.put(
-            f"/config-profiles/{p1['id']}/includes/{inc['id']}",
-            json={"order_index": 5},
-        )
-        assert response.status_code == 200
-        assert response.json()["order_index"] == 5
-
-    def test_remove_include(self, authenticated_client: TestClient) -> None:
-        """Test removing an include."""
-        p1 = authenticated_client.post(
-            "/config-profiles", json={"name": "rem-1"}
-        ).json()
-        p2 = authenticated_client.post(
-            "/config-profiles", json={"name": "rem-2"}
-        ).json()
-
-        inc = authenticated_client.post(
-            f"/config-profiles/{p1['id']}/includes",
-            json={"included_profile_id": p2["id"], "order_index": 0},
-        ).json()
-
-        response = authenticated_client.delete(
-            f"/config-profiles/{p1['id']}/includes/{inc['id']}"
-        )
-        assert response.status_code == 204
-
-
-@pytest.mark.integration
-class TestConfigProfileMounts:
-    """Integration tests for config profile mounts."""
-
-    def test_add_mount_successfully(self, authenticated_client: TestClient) -> None:
-        """Test adding a mount to a profile."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "mount-test"},
-        ).json()
-
-        response = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
-            json={"target_path": "/etc/config", "files": {"test.txt": "hello"}, "order_index": 0},
-        )
-        assert response.status_code == 201
-        data = response.json()
-        assert data["target_path"] == "/etc/config"
-        assert data["files"] == {"test.txt": "hello"}
-
-    def test_add_mount_relative_path_rejected(self, authenticated_client: TestClient) -> None:
-        """Test that relative mount paths are rejected."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "rel-path-test"},
-        ).json()
-
-        response = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
-            json={"target_path": "etc/config", "files": {"test.txt": "hello"}},
-        )
-        assert response.status_code == 422
-
-    def test_add_target_path_traversal_rejected(self, authenticated_client: TestClient) -> None:
-        """Test that path traversal in mount paths is rejected."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "traversal-test"},
-        ).json()
-
-        response = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
-            json={"target_path": "/etc/../passwd", "files": {"test.txt": "hello"}},
-        )
-        assert response.status_code == 422
-
-    def test_add_duplicate_mount_rejected(self, authenticated_client: TestClient) -> None:
-        """Test that duplicate mount paths are rejected."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "dup-mount-test"},
-        ).json()
-
-        authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
-            json={"target_path": "/etc/config", "files": {"test.txt": "hello"}},
-        )
-
-        response = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
-            json={"target_path": "/etc/config", "files": {"test.txt": "world"}},
-        )
-        assert response.status_code == 409
-
-    def test_update_mount(self, authenticated_client: TestClient) -> None:
-        """Test updating a mount."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "update-mount-test"},
-        ).json()
-
-        mount = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
-            json={"target_path": "/old/path", "files": {"test.txt": "old"}},
-        ).json()
-
-        response = authenticated_client.put(
-            f"/config-profiles/{profile['id']}/mounts/{mount['id']}",
-            json={"target_path": "/new/path", "files": {"test.txt": "new"}, "order_index": 2},
-        )
-        assert response.status_code == 200
-        data = response.json()
-        assert data["target_path"] == "/new/path"
-        assert data["files"] == {"test.txt": "new"}
-        assert data["order_index"] == 2
-
-    def test_remove_mount(self, authenticated_client: TestClient) -> None:
-        """Test removing a mount."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "rem-mount-test"},
-        ).json()
-
-        mount = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
-            json={"target_path": "/tmp/test", "files": {"test.txt": "x"}},
-        ).json()
-
-        response = authenticated_client.delete(
-            f"/config-profiles/{profile['id']}/mounts/{mount['id']}"
-        )
-        assert response.status_code == 204
-
-
-@pytest.mark.integration
-class TestConfigProfileDefaults:
-    """Integration tests for default profile APIs."""
-
-    def test_get_default_profiles_empty(self, authenticated_client: TestClient) -> None:
-        """Test getting default profiles when none are set."""
-        response = authenticated_client.get("/config-profiles/defaults")
-        assert response.status_code == 200
-        data = response.json()
-        assert data["default_profiles"] == {}
-
-    def test_set_default_profiles(self, authenticated_client: TestClient) -> None:
-        """Test setting default profiles."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "default-test"},
-        ).json()
-
-        response = authenticated_client.put(
-            "/config-profiles/defaults",
-            json={"default_profiles": {"code-server": profile["id"]}},
-        )
-        assert response.status_code == 200
-        data = response.json()
-        assert data["default_profiles"]["code-server"] == profile["id"]
-
-    def test_set_default_profiles_invalid_profile(self, authenticated_client: TestClient) -> None:
-        """Test setting default profiles with invalid profile ID."""
-        response = authenticated_client.put(
-            "/config-profiles/defaults",
-            json={"default_profiles": {"code-server": str(uuid.uuid4())}},
-        )
-        assert response.status_code == 404
-
-    def test_get_default_profile_for_tool_type(self, authenticated_client: TestClient) -> None:
-        """Test getting default profile for a specific tool type."""
-        profile = authenticated_client.post(
-            "/config-profiles",
-            json={"name": "tool-default-test"},
-        ).json()
-
-        authenticated_client.put(
-            "/config-profiles/defaults",
-            json={"default_profiles": {"jupyter-notebook": profile["id"]}},
-        )
-
-        response = authenticated_client.get("/config-profiles/defaults/jupyter-notebook")
-        assert response.status_code == 200
-        data = response.json()
-        assert data["tool_type_id"] == "jupyter-notebook"
-        assert data["profile_id"] == profile["id"]
-
-    def test_get_default_profile_for_tool_type_not_set(self, authenticated_client: TestClient) -> None:
-        """Test getting default profile when not set."""
-        response = authenticated_client.get("/config-profiles/defaults/opencode")
-        assert response.status_code == 200
-        data = response.json()
-        assert data["tool_type_id"] == "opencode"
-        assert data["profile_id"] is None

apps/api/tests/integration/test_git_control.py

@@ -70,6 +70,20 @@ def test_get_current_branch_handles_unborn_main() -> None:
         assert get_current_branch(tmpdir) == "main"
 
 
+def test_create_branch_on_bare_repo_with_no_commits() -> None:
+    with tempfile.TemporaryDirectory() as tmpdir:
+        os.system(f"git init --bare {tmpdir}/bare.git >/dev/null 2>&1")
+        create_branch(f"{tmpdir}/bare.git", "main")
+        assert get_current_branch(f"{tmpdir}/bare.git") == "main"
+
+
+def test_checkout_branch_on_bare_repo_with_no_commits() -> None:
+    with tempfile.TemporaryDirectory() as tmpdir:
+        os.system(f"git init --bare {tmpdir}/bare.git >/dev/null 2>&1")
+        checkout_branch(f"{tmpdir}/bare.git", "main")
+        assert get_current_branch(f"{tmpdir}/bare.git") == "main"
+
+
 class TestBranchOperations:
     """Tests for branch management functions."""
 

apps/api/tests/integration/test_projects_api.py

@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 import asyncio
 
 import pytest
@@ -58,7 +58,7 @@ def _mint_token(user_id: str) -> str:
         subject=user_id,
         email="test@headquarter.local",
         name="Test User",
-        expires_at=datetime.now(timezone.utc) + timedelta(minutes=15),
+        expires_at=datetime.now(UTC) + timedelta(minutes=15),
     )
 
 

apps/api/tests/integration/test_tool_types_api.py

@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 import asyncio
 
 import pytest
@@ -59,7 +59,7 @@ def _mint_token(user_id: str) -> str:
         subject=user_id,
         email="test@headquarter.local",
         name="Test User",
-        expires_at=datetime.now(timezone.utc) + timedelta(minutes=15),
+        expires_at=datetime.now(UTC) + timedelta(minutes=15),
     )
 
 

apps/api/tests/integration/test_users_api.py

@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 import asyncio
 import io
 
@@ -83,7 +83,7 @@ def _create_auth_cookie(user_id: str) -> str:
         subject=user_id,
         email="test@headquarter.local",
         name="Test User",
-        expires_at=datetime.now(timezone.utc) + timedelta(minutes=15),
+        expires_at=datetime.now(UTC) + timedelta(minutes=15),
     )
 
 

apps/api/tests/unit/test_migration_metadata.py

@@ -39,18 +39,3 @@ def test_refresh_tokens_migration_has_expected_revision_chain() -> None:
 
     assert module.revision == "0002_refresh_tokens"
     assert module.down_revision == "0001_initial_schema"
-
-
-@pytest.mark.unit
-def test_config_profiles_migration_has_expected_revision_chain() -> None:
-    migration_path = Path(__file__).resolve().parents[2] / "alembic" / "versions" / "0013_add_config_profiles.py"
-    spec = spec_from_file_location("add_config_profiles", migration_path)
-
-    assert spec is not None
-    assert spec.loader is not None
-
-    module = module_from_spec(spec)
-    spec.loader.exec_module(module)
-
-    assert module.revision == "0013_add_config_profiles"
-    assert module.down_revision == "0012_default_port_req"

apps/api/tests/unit/test_profile_resolver.py

@@ -1,463 +0,0 @@
-"""Unit tests for the profile resolver service."""
-
-import uuid
-from unittest.mock import MagicMock
-
-import pytest
-
-from src.services.profile_resolver import (
-    ProfileCycleError,
-    ResolvedProfileOutput,
-    resolve_profile,
-)
-
-
-def _make_profile(
-    name: str,
-    env_vars: dict[str, str] | None = None,
-    start_command: str | None = None,
-    working_directory: str | None = None,
-    port: int | None = None,
-    mounts: list[MagicMock] | None = None,
-    includes: list[MagicMock] | None = None,
-) -> MagicMock:
-    """Create a mock ConfigProfile for testing."""
-    profile = MagicMock()
-    profile.id = uuid.uuid4()
-    profile.name = name
-    profile.environment_variables = env_vars or {}
-    profile.start_command = start_command
-    profile.working_directory = working_directory
-    profile.port = port
-    profile.mounts = mounts or []
-    profile.includes = includes or []
-    return profile
-
-
-def _make_include(included_profile: MagicMock, order_index: int = 0) -> MagicMock:
-    """Create a mock ConfigInclude for testing."""
-    include = MagicMock()
-    include.included_profile = included_profile
-    include.order_index = order_index
-    return include
-
-
-def _make_mount(
-    target_path: str,
-    mode: str = "rw",
-    files: dict[str, str] | None = None,
-    order_index: int = 0,
-) -> MagicMock:
-    """Create a mock ConfigMount for testing."""
-    mount = MagicMock()
-    mount.target_path = target_path
-    mount.mode = mode
-    mount.files = files or {}
-    mount.order_index = order_index
-    return mount
-
-
-class TestResolveProfileBasic:
-    """Tests for basic profile resolution without includes."""
-
-    def test_empty_profile(self) -> None:
-        """Resolving an empty profile returns empty output."""
-        profile = _make_profile("empty")
-        result = resolve_profile(profile)
-
-        assert isinstance(result, ResolvedProfileOutput)
-        assert result.profile_name == "empty"
-        assert result.environment_variables == {}
-        assert result.runtime_hints.start_command is None
-        assert result.runtime_hints.working_directory is None
-        assert result.runtime_hints.port is None
-        assert result.mounts == {}
-        assert result.resolution_order == ["empty"]
-
-    def test_env_vars_only(self) -> None:
-        """Profile with env vars resolves correctly."""
-        profile = _make_profile(
-            "env-only",
-            env_vars={"FOO": "bar", "BAZ": "qux"},
-        )
-        result = resolve_profile(profile)
-
-        assert result.environment_variables == {"FOO": "bar", "BAZ": "qux"}
-        assert result.env_var_sources == {
-            "FOO": ["env-only"],
-            "BAZ": ["env-only"],
-        }
-
-    def test_runtime_hints_only(self) -> None:
-        """Profile with runtime hints resolves correctly."""
-        profile = _make_profile(
-            "hints-only",
-            start_command="python app.py",
-            working_directory="/app",
-            port=8080,
-        )
-        result = resolve_profile(profile)
-
-        assert result.runtime_hints.start_command == "python app.py"
-        assert result.runtime_hints.working_directory == "/app"
-        assert result.runtime_hints.port == 8080
-        assert result.runtime_hints.overridden_hints == {
-            "start_command": "hints-only",
-            "working_directory": "hints-only",
-            "port": "hints-only",
-        }
-
-    def test_mounts_only(self) -> None:
-        """Profile with mounts resolves correctly."""
-        profile = _make_profile(
-            "mounts-only",
-            mounts=[
-                _make_mount(
-                    "/config",
-                    mode="ro",
-                    files={"settings.json": '{"key": "value"}'},
-                ),
-            ],
-        )
-        result = resolve_profile(profile)
-
-        assert "/config" in result.mounts
-        mount = result.mounts["/config"]
-        assert mount.target_path == "/config"
-        assert mount.mode == "ro"
-        assert mount.files == {"settings.json": '{"key": "value"}'}
-
-
-class TestResolveProfileIncludes:
-    """Tests for profile resolution with includes."""
-
-    def test_single_include(self) -> None:
-        """Profile with one include resolves in correct order."""
-        base = _make_profile("base", env_vars={"FOO": "base"})
-        derived = _make_profile(
-            "derived",
-            env_vars={"BAR": "derived"},
-            includes=[_make_include(base, order_index=0)],
-        )
-        result = resolve_profile(derived)
-
-        assert result.resolution_order == ["derived", "base"]
-        assert result.environment_variables == {
-            "FOO": "base",
-            "BAR": "derived",
-        }
-
-    def test_multiple_includes_ordered(self) -> None:
-        """Multiple includes are resolved in order_index order."""
-        first = _make_profile("first", env_vars={"KEY": "first"})
-        second = _make_profile("second", env_vars={"KEY": "second"})
-        main = _make_profile(
-            "main",
-            includes=[
-                _make_include(first, order_index=0),
-                _make_include(second, order_index=1),
-            ],
-        )
-        result = resolve_profile(main)
-
-        assert result.resolution_order == ["main", "first", "second"]
-        # second overrides first
-        assert result.environment_variables == {"KEY": "second"}
-        assert result.env_var_sources["KEY"] == ["first", "second"]
-
-    def test_include_order_matters(self) -> None:
-        """Changing include order changes resolution."""
-        a = _make_profile("a", env_vars={"KEY": "a"})
-        b = _make_profile("b", env_vars={"KEY": "b"})
-        main1 = _make_profile(
-            "main",
-            includes=[
-                _make_include(a, order_index=0),
-                _make_include(b, order_index=1),
-            ],
-        )
-        main2 = _make_profile(
-            "main",
-            includes=[
-                _make_include(b, order_index=0),
-                _make_include(a, order_index=1),
-            ],
-        )
-
-        result1 = resolve_profile(main1)
-        result2 = resolve_profile(main2)
-
-        assert result1.environment_variables["KEY"] == "b"
-        assert result2.environment_variables["KEY"] == "a"
-
-    def test_nested_includes(self) -> None:
-        """Deeply nested includes resolve recursively."""
-        deep = _make_profile("deep", env_vars={"DEEP": "value"})
-        mid = _make_profile(
-            "mid",
-            env_vars={"MID": "value"},
-            includes=[_make_include(deep, order_index=0)],
-        )
-        top = _make_profile(
-            "top",
-            env_vars={"TOP": "value"},
-            includes=[_make_include(mid, order_index=0)],
-        )
-        result = resolve_profile(top)
-
-        assert result.resolution_order == ["top", "mid", "deep"]
-        assert result.environment_variables == {
-            "TOP": "value",
-            "MID": "value",
-            "DEEP": "value",
-        }
-
-
-class TestResolveProfileOverrides:
-    """Tests for deterministic override rules."""
-
-    def test_env_var_override(self) -> None:
-        """Later layers override earlier env vars."""
-        base = _make_profile("base", env_vars={"KEY": "base"})
-        override = _make_profile("override", env_vars={"KEY": "override"})
-        main = _make_profile(
-            "main",
-            includes=[
-                _make_include(base, order_index=0),
-                _make_include(override, order_index=1),
-            ],
-        )
-        result = resolve_profile(main)
-
-        assert result.environment_variables["KEY"] == "override"
-        assert result.env_var_sources["KEY"] == ["base", "override"]
-
-    def test_main_profile_wins_over_includes(self) -> None:
-        """The main profile itself wins over all includes."""
-        base = _make_profile("base", env_vars={"KEY": "base"})
-        main = _make_profile(
-            "main",
-            env_vars={"KEY": "main"},
-            includes=[_make_include(base, order_index=0)],
-        )
-        result = resolve_profile(main)
-
-        assert result.environment_variables["KEY"] == "main"
-        assert result.env_var_sources["KEY"] == ["base", "main"]
-
-    def test_runtime_hint_override(self) -> None:
-        """Later layers override earlier runtime hints."""
-        base = _make_profile("base", start_command="python old.py")
-        override = _make_profile("override", start_command="python new.py")
-        main = _make_profile(
-            "main",
-            includes=[
-                _make_include(base, order_index=0),
-                _make_include(override, order_index=1),
-            ],
-        )
-        result = resolve_profile(main)
-
-        assert result.runtime_hints.start_command == "python new.py"
-        assert result.runtime_hints.overridden_hints["start_command"] == "override"
-
-    def test_mount_file_override(self) -> None:
-        """Later layers override earlier files in the same mount."""
-        base = _make_profile(
-            "base",
-            mounts=[
-                _make_mount(
-                    "/config",
-                    files={"app.json": '{"v": 1}'},
-                ),
-            ],
-        )
-        override = _make_profile(
-            "override",
-            mounts=[
-                _make_mount(
-                    "/config",
-                    files={"app.json": '{"v": 2}'},
-                ),
-            ],
-        )
-        main = _make_profile(
-            "main",
-            includes=[
-                _make_include(base, order_index=0),
-                _make_include(override, order_index=1),
-            ],
-        )
-        result = resolve_profile(main)
-
-        mount = result.mounts["/config"]
-        assert mount.files["app.json"] == '{"v": 2}'
-        assert mount.overridden_files["app.json"] == ["override"]
-
-    def test_mount_mode_override(self) -> None:
-        """Later layers override mount mode."""
-        base = _make_profile(
-            "base",
-            mounts=[_make_mount("/data", mode="ro")],
-        )
-        override = _make_profile(
-            "override",
-            mounts=[_make_mount("/data", mode="rw")],
-        )
-        main = _make_profile(
-            "main",
-            includes=[
-                _make_include(base, order_index=0),
-                _make_include(override, order_index=1),
-            ],
-        )
-        result = resolve_profile(main)
-
-        assert result.mounts["/data"].mode == "rw"
-        assert result.mounts["/data"].mode_overridden_by == "override"
-
-    def test_mount_file_merge(self) -> None:
-        """Different files in the same mount are merged."""
-        base = _make_profile(
-            "base",
-            mounts=[
-                _make_mount(
-                    "/config",
-                    files={"a.json": "1"},
-                ),
-            ],
-        )
-        override = _make_profile(
-            "override",
-            mounts=[
-                _make_mount(
-                    "/config",
-                    files={"b.json": "2"},
-                ),
-            ],
-        )
-        main = _make_profile(
-            "main",
-            includes=[
-                _make_include(base, order_index=0),
-                _make_include(override, order_index=1),
-            ],
-        )
-        result = resolve_profile(main)
-
-        mount = result.mounts["/config"]
-        assert mount.files == {"a.json": "1", "b.json": "2"}
-
-
-class TestResolveProfileCycles:
-    """Tests for cycle detection during resolution."""
-
-    def test_direct_cycle(self) -> None:
-        """A -> B -> A is detected."""
-        a = _make_profile("a")
-        b = _make_profile("b", includes=[_make_include(a, order_index=0)])
-        a.includes = [_make_include(b, order_index=0)]
-
-        with pytest.raises(ProfileCycleError) as exc_info:
-            resolve_profile(a)
-
-        assert "a" in exc_info.value.cycle_path
-        assert "b" in exc_info.value.cycle_path
-
-    def test_indirect_cycle(self) -> None:
-        """A -> B -> C -> A is detected."""
-        a = _make_profile("a")
-        c = _make_profile("c")
-        b = _make_profile("b", includes=[_make_include(c, order_index=0)])
-        a.includes = [_make_include(b, order_index=0)]
-        c.includes = [_make_include(a, order_index=0)]
-
-        with pytest.raises(ProfileCycleError) as exc_info:
-            resolve_profile(a)
-
-        assert "a" in exc_info.value.cycle_path
-        assert "b" in exc_info.value.cycle_path
-        assert "c" in exc_info.value.cycle_path
-
-    def test_self_cycle(self) -> None:
-        """A -> A is detected."""
-        a = _make_profile("a")
-        a.includes = [_make_include(a, order_index=0)]
-
-        with pytest.raises(ProfileCycleError) as exc_info:
-            resolve_profile(a)
-
-        assert exc_info.value.cycle_path == ["a", "a"]
-
-    def test_cycle_does_not_partially_resolve(self) -> None:
-        """Cycle detection prevents any partial resolution."""
-        a = _make_profile("a", env_vars={"A": "a"})
-        b = _make_profile("b", env_vars={"B": "b"})
-        a.includes = [_make_include(b, order_index=0)]
-        b.includes = [_make_include(a, order_index=0)]
-
-        with pytest.raises(ProfileCycleError):
-            resolve_profile(a)
-
-
-class TestResolveProfileDiamond:
-    """Tests for diamond-shaped include graphs."""
-
-    def test_diamond_resolution(self) -> None:
-        """Diamond graph resolves correctly without duplication issues."""
-        base = _make_profile("base", env_vars={"BASE": "base"})
-        left = _make_profile(
-            "left",
-            env_vars={"LEFT": "left"},
-            includes=[_make_include(base, order_index=0)],
-        )
-        right = _make_profile(
-            "right",
-            env_vars={"RIGHT": "right"},
-            includes=[_make_include(base, order_index=0)],
-        )
-        top = _make_profile(
-            "top",
-            env_vars={"TOP": "top"},
-            includes=[
-                _make_include(left, order_index=0),
-                _make_include(right, order_index=1),
-            ],
-        )
-        result = resolve_profile(top)
-
-        # base should appear once (via left, then right skips because visited)
-        assert result.resolution_order == ["top", "left", "base", "right"]
-        assert result.environment_variables == {
-            "TOP": "top",
-            "LEFT": "left",
-            "RIGHT": "right",
-            "BASE": "base",
-        }
-
-    def test_diamond_override(self) -> None:
-        """Diamond graph with conflicting overrides resolves correctly."""
-        base = _make_profile("base", env_vars={"KEY": "base"})
-        left = _make_profile(
-            "left",
-            env_vars={"KEY": "left"},
-            includes=[_make_include(base, order_index=0)],
-        )
-        right = _make_profile(
-            "right",
-            env_vars={"KEY": "right"},
-            includes=[_make_include(base, order_index=0)],
-        )
-        top = _make_profile(
-            "top",
-            includes=[
-                _make_include(left, order_index=0),
-                _make_include(right, order_index=1),
-            ],
-        )
-        result = resolve_profile(top)
-
-        # right wins because it's later
-        assert result.environment_variables["KEY"] == "right"
-        assert result.env_var_sources["KEY"] == ["base", "left", "right"]
-        # Note: base appears once because visited set skips duplicate resolution in diamond graphs

apps/api/tests/unit/test_terminal_manager.py

@@ -1,112 +0,0 @@
-"""Unit tests for TerminalManager."""
-
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import pytest
-
-from src.services.terminal_manager import TerminalManager
-from src.services.terminal_session import TerminalSession
-
-
-@pytest.fixture
-def manager():
-    return TerminalManager()
-
-
-@pytest.fixture
-def mock_websocket():
-    ws = AsyncMock()
-    ws.send_bytes = AsyncMock()
-    ws.send_json = AsyncMock()
-    ws.close = AsyncMock()
-    ws.receive = AsyncMock()
-    return ws
-
-
-@pytest.fixture
-def mock_session():
-    session = MagicMock(spec=TerminalSession)
-    session.session_id = "sess-123"
-    session.is_alive.return_value = True
-    session._closed = False
-    session.read_output = AsyncMock(return_value=b"")
-    session.write_input = AsyncMock()
-    session.resize = AsyncMock()
-    session.close = AsyncMock()
-    session.get_exit_reason.return_value = None
-    return session
-
-
-class TestCreateSession:
-    @patch("src.services.terminal_manager.asyncio.create_task")
-    @patch("src.services.terminal_manager.uuid.uuid4", return_value="sess-123")
-    async def test_create_session_registers_and_starts_loops(
-        self, mock_uuid, mock_create_task, manager, mock_websocket
-    ):
-        instance_id = __import__("uuid").uuid4()
-        mock_sess = MagicMock()
-        mock_sess.session_id = "sess-123"
-        mock_sess.is_alive.return_value = True
-        mock_sess._closed = False
-        mock_sess.start = AsyncMock()
-        mock_sess.read_output = AsyncMock(return_value=b"")
-        mock_sess.write_input = AsyncMock()
-        mock_sess.resize = AsyncMock()
-        mock_sess.close = AsyncMock()
-        mock_sess.get_exit_reason.return_value = None
-
-        with (
-            patch.object(manager, "_read_loop", new=AsyncMock()),
-            patch.object(manager, "_write_loop", new=AsyncMock()),
-            patch.object(manager, "_heartbeat_loop", new=AsyncMock()),
-            patch(
-                "src.services.terminal_manager.TerminalSession",
-                return_value=mock_sess,
-            ),
-        ):
-            session = await manager.create_session(
-                instance_id, "container-abc", mock_websocket
-            )
-            assert session.session_id == "sess-123"
-            assert "sess-123" in manager._sessions
-            assert "sess-123" in manager._last_client_message
-
-
-class TestHandleControlMessage:
-    async def test_handle_resize(self, manager, mock_session, mock_websocket):
-        ctrl = {"type": "resize", "cols": 120, "rows": 40}
-        await manager._handle_control_message(mock_session, mock_websocket, ctrl)
-        mock_session.resize.assert_awaited_once_with(120, 40)
-
-    async def test_handle_ping(self, manager, mock_session, mock_websocket):
-        ctrl = {"type": "ping", "id": 42}
-        await manager._handle_control_message(mock_session, mock_websocket, ctrl)
-        mock_websocket.send_json.assert_awaited_once_with({"type": "pong", "id": 42})
-
-    async def test_handle_unknown_type(self, manager, mock_session, mock_websocket):
-        ctrl = {"type": "unknown", "data": "test"}
-        await manager._handle_control_message(mock_session, mock_websocket, ctrl)
-        mock_websocket.send_json.assert_not_awaited()
-        mock_session.resize.assert_not_awaited()
-
-
-class TestCleanupSession:
-    async def test_cleanup_removes_session(self, manager, mock_session):
-        manager._sessions["sess-123"] = mock_session
-        manager._last_client_message["sess-123"] = 123.0
-
-        await manager._cleanup_session(mock_session)
-        assert "sess-123" not in manager._sessions
-        assert "sess-123" not in manager._last_client_message
-        mock_session.close.assert_awaited_once()
-
-
-class TestCloseAll:
-    async def test_close_all_clears_sessions(self, manager, mock_session):
-        manager._sessions["sess-123"] = mock_session
-        manager._last_client_message["sess-123"] = 123.0
-
-        await manager.close_all()
-        assert len(manager._sessions) == 0
-        assert len(manager._last_client_message) == 0
-        mock_session.close.assert_awaited_once()

apps/api/tests/unit/test_terminal_session.py

@@ -1,168 +0,0 @@
-"""Unit tests for TerminalSession."""
-
-import asyncio
-from unittest.mock import MagicMock, patch
-
-import pytest
-
-from src.services.terminal_session import TerminalSession
-
-
-@pytest.fixture
-def mock_pty():
-    """Mock pty.openpty to return predictable fds."""
-    master_fd = 10
-    slave_fd = 11
-    with (
-        patch(
-            "src.services.terminal_session.pty.openpty",
-            return_value=(master_fd, slave_fd),
-        ),
-        patch("src.services.terminal_session.os.close") as mock_close,
-    ):
-        yield master_fd, slave_fd, mock_close
-
-
-class TestTerminalSessionStart:
-    def test_init_state(self, mock_pty):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-
-        assert session.session_id == "sess-1"
-        assert session.container_id == "container-abc"
-        assert session._echo_enabled is True
-        assert session._exit_reason is None
-
-
-class TestTerminalSessionEchoDetection:
-    @patch("src.services.terminal_session.termios.tcgetattr")
-    def test_detect_echo_state_enabled(self, mock_tcgetattr):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = 10
-
-        # termios.ECHO flag set
-        attrs = [[], [], [], __import__("termios").ECHO, [], [], []]
-        mock_tcgetattr.return_value = attrs
-
-        result = session._detect_echo_state()
-        assert result is True
-
-    @patch("src.services.terminal_session.termios.tcgetattr")
-    def test_detect_echo_state_disabled(self, mock_tcgetattr):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = 10
-
-        # termios.ECHO flag NOT set
-        attrs = [[], [], [], 0, [], [], []]
-        mock_tcgetattr.return_value = attrs
-
-        result = session._detect_echo_state()
-        assert result is False
-
-    def test_detect_echo_state_no_master_fd(self):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = None
-
-        result = session._detect_echo_state()
-        assert result is True  # default
-
-
-class TestTerminalSessionResize:
-    @patch("src.services.terminal_session.fcntl.ioctl")
-    def test_resize_sets_size(self, mock_ioctl):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = 10
-
-        # Should not raise
-        asyncio.run(session.resize(120, 40))
-        mock_ioctl.assert_called_once()
-
-    def test_resize_when_closed(self):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._closed = True
-
-        # Should not raise
-        asyncio.run(session.resize(120, 40))
-
-
-class TestTerminalSessionWriteInput:
-    @patch("src.services.terminal_session.os.write")
-    def test_write_input(self, mock_write):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = 10
-
-        asyncio.run(session.write_input(b"hello"))
-        mock_write.assert_called_once_with(10, b"hello")
-
-    def test_write_input_when_closed(self):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._closed = True
-
-        # Should not raise
-        asyncio.run(session.write_input(b"hello"))
-
-
-class TestTerminalSessionReadOutput:
-    @patch("src.services.terminal_session.select.select")
-    @patch("src.services.terminal_session.os.read")
-    def test_read_output_with_data(self, mock_read, mock_select):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = 10
-
-        mock_select.return_value = ([10], [], [])
-        mock_read.return_value = b"output"
-
-        result = asyncio.run(session.read_output())
-        assert result == b"output"
-
-    @patch("src.services.terminal_session.select.select")
-    def test_read_output_no_data(self, mock_select):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = 10
-
-        mock_select.return_value = ([], [], [])
-
-        result = asyncio.run(session.read_output())
-        assert result == b""
-
-
-class TestTerminalSessionClose:
-    @patch("src.services.terminal_session.os.close")
-    @patch("src.services.terminal_session.asyncio.wait_for")
-    async def test_close_sets_exit_reason(self, mock_wait_for, mock_close):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._master_fd = 10
-        session.process = MagicMock()
-        session.process.returncode = 0
-
-        await session.close()
-        assert session._exit_reason == "process_exit"
-        assert session._closed is True
-
-    async def test_close_idempotent(self):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session._closed = True
-
-        # Should not raise
-        await session.close()
-
-
-class TestTerminalSessionIsAlive:
-    def test_is_alive_with_running_process(self):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session.process = MagicMock()
-        session.process.returncode = None
-
-        assert session.is_alive() is True
-
-    def test_is_alive_with_exited_process(self):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session.process = MagicMock()
-        session.process.returncode = 0
-
-        assert session.is_alive() is False
-
-    def test_is_alive_no_process(self):
-        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
-        session.process = None
-
-        assert session.is_alive() is False

apps/web/package-lock.json

@@ -19,7 +19,6 @@
         "tailwindcss": "^3.3.0",
         "xterm": "^5.3.0",
         "xterm-addon-fit": "^0.8.0",
-        "xterm-addon-serialize": "^0.11.0",
         "xterm-addon-web-links": "^0.9.0"
       },
       "devDependencies": {
@@ -6373,16 +6372,6 @@
         "xterm": "^5.0.0"
       }
     },
-    "node_modules/xterm-addon-serialize": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/xterm-addon-serialize/-/xterm-addon-serialize-0.11.0.tgz",
-      "integrity": "sha512-2CNDnmLdLkNWfsxNFkGsI5FE9W/BbsMzeOrbu59yNqH9L6k1gmL+Ab6VXxEp2NQUJSzaiqi6t0nFR5k5EDkVIg==",
-      "deprecated": "This package is now deprecated. Move to @xterm/addon-serialize instead.",
-      "license": "MIT",
-      "peerDependencies": {
-        "xterm": "^5.0.0"
-      }
-    },
     "node_modules/xterm-addon-web-links": {
       "version": "0.9.0",
       "resolved": "https://registry.npmjs.org/xterm-addon-web-links/-/xterm-addon-web-links-0.9.0.tgz",

apps/web/package.json

@@ -22,7 +22,6 @@
     "tailwindcss": "^3.3.0",
     "xterm": "^5.3.0",
     "xterm-addon-fit": "^0.8.0",
-    "xterm-addon-serialize": "^0.11.0",
     "xterm-addon-web-links": "^0.9.0"
   },
   "devDependencies": {

apps/web/scripts/check-structure.js

@@ -1,83 +0,0 @@
-#!/usr/bin/env node
-/* eslint-disable */
-/**
- * Verifies repository structure conventions.
- * Run with: node scripts/check-structure.js
- */
-
-import fs from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const SRC_DIR = path.join(__dirname, "..", "src");
-
-let errors = 0;
-let warnings = 0;
-
-// Known acceptable deviations — documented in naming.md
-const OVERSIZE_ALLOWLIST = [
-	// Form-heavy admin tabs: 15+ fields each, splitting would create micro-components
-	"components/features/tool-workshop/ToolTypesTab.tsx",
-	"components/features/tool-workshop/ToolConfigsTab.tsx",
-	// Complex terminal hook: WS lifecycle + ping-pong + echo + resize debouncing
-	"hooks/use-terminal-connection.ts",
-	// Terminal component: xterm lifecycle + resize observer + overlay UI
-	"components/features/terminal/TerminalComponent.tsx",
-	// Instance list with health polling + inline confirmations
-	"components/features/session/InstanceList.tsx",
-	// Dialog with form validation + SSH key handling
-	"components/features/project/RepositoryCreateDialog.tsx",
-	// Test files: complex test coverage
-	"hooks/use-terminal-connection.test.ts",
-	"pages/ToolWorkshopPage.test.tsx",
-	// Global utility CSS: will be further split in future iteration
-	"styles/utilities.css",
-];
-
-function checkFileSize(filePath, maxLines = 300) {
-	const content = fs.readFileSync(filePath, "utf-8");
-	const lines = content.split("\n").length;
-	const relative = path.relative(SRC_DIR, filePath);
-	if (lines > maxLines) {
-		if (OVERSIZE_ALLOWLIST.includes(relative)) {
-			console.warn(`⚠️  OVERSIZED (${lines} lines, allowlisted): ${relative}`);
-			warnings++;
-		} else {
-			console.error(`❌ OVERSIZED (${lines} lines): ${relative}`);
-			errors++;
-		}
-	}
-}
-
-function walk(dir, callback) {
-	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-		const fullPath = path.join(dir, entry.name);
-		if (entry.isDirectory()) {
-			if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-			walk(fullPath, callback);
-		} else {
-			callback(fullPath);
-		}
-	}
-}
-
-console.log("Checking file sizes...\n");
-walk(SRC_DIR, (filePath) => {
-	const ext = path.extname(filePath);
-	if ([".ts", ".tsx", ".py", ".css"].includes(ext)) {
-		checkFileSize(filePath);
-	}
-});
-
-console.log("\n---");
-if (errors === 0 && warnings === 0) {
-	console.log("✅ All checks passed!");
-	process.exit(0);
-} else if (errors === 0) {
-	console.log(`✅ All checks passed with ${warnings} warning(s)`);
-	process.exit(0);
-} else {
-	console.log(`❌ ${errors} error(s), ${warnings} warning(s)`);
-	process.exit(1);
-}

apps/web/src/api/config-folders.ts

@@ -1,77 +0,0 @@
-import { apiClient } from "./client";
-import type {
-	ConfigFolder,
-	CreateConfigFolderRequest,
-	UpdateConfigFolderRequest,
-	ProjectOverrideRequest,
-} from "../types/config-folder";
-
-export type {
-	ConfigFolder,
-	CreateConfigFolderRequest,
-	UpdateConfigFolderRequest,
-	ProjectOverrideRequest,
-} from "../types/config-folder";
-
-export const listConfigFolders = async (): Promise<ConfigFolder[]> => {
-	const response = await apiClient.get<ConfigFolder[]>("/config-folders");
-	return response.data;
-};
-
-export const getConfigFolder = async (id: string): Promise<ConfigFolder> => {
-	const response = await apiClient.get<ConfigFolder>(`/config-folders/${id}`);
-	return response.data;
-};
-
-export const createConfigFolder = async (
-	data: CreateConfigFolderRequest,
-): Promise<ConfigFolder> => {
-	const response = await apiClient.post<ConfigFolder>("/config-folders", data);
-	return response.data;
-};
-
-export const updateConfigFolder = async (
-	id: string,
-	data: UpdateConfigFolderRequest,
-): Promise<ConfigFolder> => {
-	const response = await apiClient.put<ConfigFolder>(
-		`/config-folders/${id}`,
-		data,
-	);
-	return response.data;
-};
-
-export const deleteConfigFolder = async (id: string): Promise<void> => {
-	await apiClient.delete(`/config-folders/${id}`);
-};
-
-export const addProjectOverride = async (
-	id: string,
-	projectId: string,
-	data: ProjectOverrideRequest,
-): Promise<ConfigFolder> => {
-	const response = await apiClient.post<ConfigFolder>(
-		`/config-folders/${id}/overrides/${projectId}`,
-		data,
-	);
-	return response.data;
-};
-
-export const updateProjectOverride = async (
-	id: string,
-	projectId: string,
-	data: ProjectOverrideRequest,
-): Promise<ConfigFolder> => {
-	const response = await apiClient.put<ConfigFolder>(
-		`/config-folders/${id}/overrides/${projectId}`,
-		data,
-	);
-	return response.data;
-};
-
-export const deleteProjectOverride = async (
-	id: string,
-	projectId: string,
-): Promise<void> => {
-	await apiClient.delete(`/config-folders/${id}/overrides/${projectId}`);
-};

apps/web/src/api/config_folders.test.ts

@@ -5,7 +5,7 @@ import {
   deleteConfigFolder,
   listConfigFolders,
   updateConfigFolder,
-} from "../api/config-folders";
+} from "../api/config_folders";
 
 const mockGet = vi.fn();
 const mockPost = vi.fn();

apps/web/src/api/config_folders.ts

@@ -0,0 +1,95 @@
+import { apiClient } from "./client";
+
+export interface ConfigFolder {
+  id: string;
+  user_id: string;
+  name: string;
+  description: string | null;
+  mount_path: string;
+  files: Record<string, string>;
+  project_overrides: Record<string, { mount_path?: string; files?: Record<string, string> }> | null;
+  is_active: boolean;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface CreateConfigFolderRequest {
+  name: string;
+  description?: string;
+  mount_path: string;
+  files?: Record<string, string>;
+  is_active?: boolean;
+}
+
+export interface UpdateConfigFolderRequest {
+  name?: string;
+  description?: string;
+  mount_path?: string;
+  files?: Record<string, string>;
+  is_active?: boolean;
+}
+
+export interface ProjectOverrideRequest {
+  mount_path?: string;
+  files?: Record<string, string>;
+}
+
+export const listConfigFolders = async (): Promise<ConfigFolder[]> => {
+  const response = await apiClient.get<ConfigFolder[]>("/config-folders");
+  return response.data;
+};
+
+export const getConfigFolder = async (id: string): Promise<ConfigFolder> => {
+  const response = await apiClient.get<ConfigFolder>(`/config-folders/${id}`);
+  return response.data;
+};
+
+export const createConfigFolder = async (
+  data: CreateConfigFolderRequest
+): Promise<ConfigFolder> => {
+  const response = await apiClient.post<ConfigFolder>("/config-folders", data);
+  return response.data;
+};
+
+export const updateConfigFolder = async (
+  id: string,
+  data: UpdateConfigFolderRequest
+): Promise<ConfigFolder> => {
+  const response = await apiClient.put<ConfigFolder>(`/config-folders/${id}`, data);
+  return response.data;
+};
+
+export const deleteConfigFolder = async (id: string): Promise<void> => {
+  await apiClient.delete(`/config-folders/${id}`);
+};
+
+export const addProjectOverride = async (
+  id: string,
+  projectId: string,
+  data: ProjectOverrideRequest
+): Promise<ConfigFolder> => {
+  const response = await apiClient.post<ConfigFolder>(
+    `/config-folders/${id}/overrides/${projectId}`,
+    data
+  );
+  return response.data;
+};
+
+export const updateProjectOverride = async (
+  id: string,
+  projectId: string,
+  data: ProjectOverrideRequest
+): Promise<ConfigFolder> => {
+  const response = await apiClient.put<ConfigFolder>(
+    `/config-folders/${id}/overrides/${projectId}`,
+    data
+  );
+  return response.data;
+};
+
+export const deleteProjectOverride = async (
+  id: string,
+  projectId: string
+): Promise<void> => {
+  await apiClient.delete(`/config-folders/${id}/overrides/${projectId}`);
+};

apps/web/src/api/git-repositories.ts

@@ -1,191 +0,0 @@
-import { apiClient } from "./client";
-import type {
-	CommitDetail,
-	CommitHistoryResponse,
-	CommitResponse,
-	GitRepository,
-	GitRepositoryCreate,
-	GitStatus,
-	MergeResponse,
-	URLParseResult,
-} from "../types/git-repository";
-
-export type {
-	CommitDetail,
-	CommitHistoryEntry,
-	CommitHistoryResponse,
-	CommitResponse,
-	GitRepository,
-	GitRepositoryCreate,
-	GitStatus,
-	MergeResponse,
-	URLParseResult,
-} from "../types/git-repository";
-
-export async function parseGitUrl(url: string): Promise<URLParseResult> {
-	const response = await apiClient.post("/projects/repositories/parse-url", {
-		url,
-	});
-	return response.data;
-}
-
-export async function listRepositories(
-	projectId: string,
-): Promise<GitRepository[]> {
-	const response = await apiClient.get(`/projects/${projectId}/repositories`);
-	return response.data;
-}
-
-export async function createRepository(
-	projectId: string,
-	data: GitRepositoryCreate,
-): Promise<GitRepository> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories`,
-		data,
-	);
-	return response.data;
-}
-
-export async function deleteRepository(
-	projectId: string,
-	repoId: string,
-): Promise<void> {
-	await apiClient.delete(`/projects/${projectId}/repositories/${repoId}`);
-}
-
-export async function getRepositoryHistory(
-	projectId: string,
-	repoId: string,
-	branch?: string,
-	limit?: number,
-): Promise<CommitHistoryResponse> {
-	const searchParams = new URLSearchParams();
-	if (branch) searchParams.set("branch", branch);
-	if (limit) searchParams.set("limit", String(limit));
-	const queryString = searchParams.toString();
-	const params = queryString ? `?${queryString}` : "";
-	const response = await apiClient.get(
-		`/projects/${projectId}/repositories/${repoId}/history${params}`,
-	);
-	return response.data;
-}
-
-export async function getCommitDetail(
-	projectId: string,
-	repoId: string,
-	commitHash: string,
-): Promise<CommitDetail> {
-	const response = await apiClient.get(
-		`/projects/${projectId}/repositories/${repoId}/commits/${commitHash}`,
-	);
-	return response.data;
-}
-
-export async function getRepositoryStatus(
-	projectId: string,
-	repoId: string,
-): Promise<GitStatus> {
-	const response = await apiClient.get(
-		`/projects/${projectId}/repositories/${repoId}/status`,
-	);
-	return response.data;
-}
-
-export async function createBranch(
-	projectId: string,
-	repoId: string,
-	name: string,
-	baseBranch: string = "HEAD",
-): Promise<{ message: string; branch: string }> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/branches`,
-		{ name, base_branch: baseBranch },
-	);
-	return response.data;
-}
-
-export async function deleteBranch(
-	projectId: string,
-	repoId: string,
-	branchName: string,
-	force: boolean = false,
-): Promise<{ message: string }> {
-	const response = await apiClient.delete(
-		`/projects/${projectId}/repositories/${repoId}/branches/${branchName}?force=${force}`,
-	);
-	return response.data;
-}
-
-export async function checkoutBranch(
-	projectId: string,
-	repoId: string,
-	branch: string,
-): Promise<{ message: string; branch: string }> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/checkout`,
-		{ branch },
-	);
-	return response.data;
-}
-
-export async function commitChanges(
-	projectId: string,
-	repoId: string,
-	message: string,
-	files?: string[],
-): Promise<CommitResponse> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/commit`,
-		{ message, files },
-	);
-	return response.data;
-}
-
-export async function fetchRepository(
-	projectId: string,
-	repoId: string,
-): Promise<{ message: string }> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/fetch`,
-	);
-	return response.data;
-}
-
-export async function pullRepository(
-	projectId: string,
-	repoId: string,
-	branch?: string,
-): Promise<{ message: string }> {
-	const params = branch ? `?branch=${branch}` : "";
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/pull${params}`,
-	);
-	return response.data;
-}
-
-export async function pushRepository(
-	projectId: string,
-	repoId: string,
-	branch?: string,
-): Promise<{ message: string }> {
-	const params = branch ? `?branch=${branch}` : "";
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/push${params}`,
-	);
-	return response.data;
-}
-
-export async function mergeBranches(
-	projectId: string,
-	repoId: string,
-	sourceBranch: string,
-	targetBranch?: string,
-	message?: string,
-): Promise<MergeResponse> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/merge`,
-		{ source_branch: sourceBranch, target_branch: targetBranch, message },
-	);
-	return response.data;
-}

apps/web/src/api/git_repositories.ts

@@ -0,0 +1,245 @@
+import { apiClient } from "./client";
+
+export interface GitRepository {
+  id: string;
+  name: string;
+  path: string;
+  project_id: string;
+  owner_id: string;
+  is_mirror: boolean;
+  remote_url: string | null;
+  last_push: string | null;
+  created_at: string | null;
+}
+
+export interface GitRepositoryCreate {
+  name: string;
+  remote_url?: string;
+  force_original_url?: boolean;
+}
+
+export interface URLParseResult {
+  original_url: string;
+  base_url: string | null;
+  is_valid_clone_url: boolean;
+  needs_parsing: boolean;
+  host: string | null;
+  message: string;
+  error_code: string | null;
+}
+
+export async function parseGitUrl(url: string): Promise<URLParseResult> {
+  const response = await apiClient.post("/projects/repositories/parse-url", { url });
+  return response.data;
+}
+
+export async function listRepositories(projectId: string): Promise<GitRepository[]> {
+  const response = await apiClient.get(`/projects/${projectId}/repositories`);
+  return response.data;
+}
+
+export async function createRepository(
+  projectId: string,
+  data: GitRepositoryCreate
+): Promise<GitRepository> {
+  const response = await apiClient.post(`/projects/${projectId}/repositories`, data);
+  return response.data;
+}
+
+export async function deleteRepository(projectId: string, repoId: string): Promise<void> {
+  await apiClient.delete(`/projects/${projectId}/repositories/${repoId}`);
+}
+
+export interface CommitHistoryEntry {
+  hash: string;
+  short_hash: string;
+  message: string;
+  author_name: string;
+  author_email: string;
+  author_date: string;
+  refs: string[];
+  graph_symbol: string;
+  graph_depth: number;
+}
+
+export interface CommitHistoryResponse {
+  commits: CommitHistoryEntry[];
+  branches: string[];
+  tags: string[];
+}
+
+export async function getRepositoryHistory(
+  projectId: string,
+  repoId: string,
+  branch?: string,
+  limit?: number
+): Promise<CommitHistoryResponse> {
+  const searchParams = new URLSearchParams();
+  if (branch) searchParams.set("branch", branch);
+  if (limit) searchParams.set("limit", String(limit));
+  const queryString = searchParams.toString();
+  const params = queryString ? `?${queryString}` : "";
+  const response = await apiClient.get(`/projects/${projectId}/repositories/${repoId}/history${params}`);
+  return response.data;
+}
+
+export interface CommitDetail {
+  hash: string;
+  short_hash: string;
+  message: string;
+  author_name: string;
+  author_email: string;
+  author_date: string;
+  committer_name: string;
+  committer_email: string;
+  committer_date: string;
+  stats: {
+    additions: number;
+    deletions: number;
+    files_changed: number;
+  };
+  diff: string;
+  parents: string[];
+}
+
+export async function getCommitDetail(
+  projectId: string,
+  repoId: string,
+  commitHash: string
+): Promise<CommitDetail> {
+  const response = await apiClient.get(
+    `/projects/${projectId}/repositories/${repoId}/commits/${commitHash}`
+  );
+  return response.data;
+}
+
+// Git Control API
+
+export interface GitStatus {
+  branch: string;
+  modified: string[];
+  added: string[];
+  deleted: string[];
+  untracked: string[];
+  renamed: string[];
+  ahead: number;
+  behind: number;
+}
+
+export async function getRepositoryStatus(
+  projectId: string,
+  repoId: string
+): Promise<GitStatus> {
+  const response = await apiClient.get(
+    `/projects/${projectId}/repositories/${repoId}/status`
+  );
+  return response.data;
+}
+
+export async function createBranch(
+  projectId: string,
+  repoId: string,
+  name: string,
+  baseBranch: string = "HEAD"
+): Promise<{ message: string; branch: string }> {
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/branches`,
+    { name, base_branch: baseBranch }
+  );
+  return response.data;
+}
+
+export async function deleteBranch(
+  projectId: string,
+  repoId: string,
+  branchName: string,
+  force: boolean = false
+): Promise<{ message: string }> {
+  const response = await apiClient.delete(
+    `/projects/${projectId}/repositories/${repoId}/branches/${branchName}?force=${force}`
+  );
+  return response.data;
+}
+
+export async function checkoutBranch(
+  projectId: string,
+  repoId: string,
+  branch: string
+): Promise<{ message: string; branch: string }> {
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/checkout`,
+    { branch }
+  );
+  return response.data;
+}
+
+export interface CommitResponse {
+  commit_hash: string;
+  message: string;
+}
+
+export async function commitChanges(
+  projectId: string,
+  repoId: string,
+  message: string,
+  files?: string[]
+): Promise<CommitResponse> {
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/commit`,
+    { message, files }
+  );
+  return response.data;
+}
+
+export async function fetchRepository(
+  projectId: string,
+  repoId: string
+): Promise<{ message: string }> {
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/fetch`
+  );
+  return response.data;
+}
+
+export async function pullRepository(
+  projectId: string,
+  repoId: string,
+  branch?: string
+): Promise<{ message: string }> {
+  const params = branch ? `?branch=${branch}` : "";
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/pull${params}`
+  );
+  return response.data;
+}
+
+export async function pushRepository(
+  projectId: string,
+  repoId: string,
+  branch?: string
+): Promise<{ message: string }> {
+  const params = branch ? `?branch=${branch}` : "";
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/push${params}`
+  );
+  return response.data;
+}
+
+export interface MergeResponse {
+  commit_hash: string;
+  message: string;
+}
+
+export async function mergeBranches(
+  projectId: string,
+  repoId: string,
+  sourceBranch: string,
+  targetBranch?: string,
+  message?: string
+): Promise<MergeResponse> {
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/merge`,
+    { source_branch: sourceBranch, target_branch: targetBranch, message }
+  );
+  return response.data;
+}

apps/web/src/api/sessions.ts

@@ -1,102 +1,138 @@
 import { apiClient } from "./client";
-import type { Session } from "../types/session";
-import type { ToolInstance } from "../types/tool-instance";
 
-export type { Session } from "../types/session";
-export type { ToolInstance } from "../types/tool-instance";
+export interface ToolInstance {
+  id: string;
+  name: string;
+  display_name: string;
+  tool_type_id: string;
+  tool_type_name: string;
+  tool_type_interfaces: string[];
+  status: string;
+  url: string | null;
+  port: number | null;
+  created_at: string;
+}
+
+export interface Session {
+  id: string;
+  display_name: string;
+  tool_type_name: string;
+  tool_icon: string;
+  tool_type_interfaces: string[];
+  repository_name: string;
+  repository_id: string;
+  project_name: string;
+  project_id: string;
+  status: string;
+  url: string | null;
+  container_status?: string;
+  probe_status?: string;
+}
 
 export async function listInstances(
-	projectId: string,
-	repoId: string,
+  projectId: string,
+  repoId: string
 ): Promise<ToolInstance[]> {
-	const response = await apiClient.get(
-		`/projects/${projectId}/repositories/${repoId}/instances`,
-	);
-	return response.data.instances;
+  const response = await apiClient.get(
+    `/projects/${projectId}/repositories/${repoId}/instances`
+  );
+  return response.data.instances;
 }
 
 export async function createInstance(
-	projectId: string,
-	repoId: string,
-	toolTypeId: string,
-	displayName?: string,
+  projectId: string,
+  repoId: string,
+  toolTypeId: string,
+  displayName?: string
 ): Promise<ToolInstance> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/instances`,
-		{
-			tool_type_id: toolTypeId,
-			display_name: displayName,
-		},
-	);
-	return response.data;
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/instances`,
+    {
+      tool_type_id: toolTypeId,
+      display_name: displayName,
+    }
+  );
+  return response.data;
 }
 
 export async function startInstance(
-	projectId: string,
-	repoId: string,
-	instanceId: string,
+  projectId: string,
+  repoId: string,
+  instanceId: string
 ): Promise<{ status: string; url?: string }> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/start`,
-	);
-	return response.data;
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/start`
+  );
+  return response.data;
 }
 
 export async function stopInstance(
-	projectId: string,
-	repoId: string,
-	instanceId: string,
+  projectId: string,
+  repoId: string,
+  instanceId: string
 ): Promise<{ status: string }> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/stop`,
-	);
-	return response.data;
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/stop`
+  );
+  return response.data;
 }
 
 export async function restartInstance(
-	projectId: string,
-	repoId: string,
-	instanceId: string,
+  projectId: string,
+  repoId: string,
+  instanceId: string
 ): Promise<{ status: string; url?: string }> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/restart`,
-	);
-	return response.data;
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/restart`
+  );
+  return response.data;
 }
 
 export async function deleteInstance(
-	projectId: string,
-	repoId: string,
-	instanceId: string,
+  projectId: string,
+  repoId: string,
+  instanceId: string
 ): Promise<void> {
-	await apiClient.delete(
-		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}`,
-	);
+  await apiClient.delete(
+    `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}`
+  );
 }
 
 export async function getUserSessions(): Promise<Session[]> {
-	const response = await apiClient.get("/users/me/sessions");
-	return response.data.sessions;
+  const response = await apiClient.get("/users/me/sessions");
+  return response.data.sessions;
+}
+
+export interface InstanceHealth {
+  healthy: boolean;
+  container_status: string;
+  container_health: string | null;
+  container_exit_code: number | null;
+  tunnel_status: string;
+  tunnel_status_code: number | null;
+  probe_status: string;
+  last_probe_output: string | null;
+  error: string | null;
 }
 
 export async function checkInstanceHealth(
-	projectId: string,
-	repoId: string,
-	instanceId: string,
-): Promise<{ healthy: boolean; status_code: number | null; error?: string }> {
-	const response = await apiClient.get(
-		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/health`,
-	);
-	return response.data;
+  projectId: string,
+  repoId: string,
+  instanceId: string
+): Promise<InstanceHealth> {
+  const response = await apiClient.get(
+    `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/health`
+  );
+  return response.data;
 }
 
 export async function recreateInstanceTunnel(
-	projectId: string,
-	repoId: string,
-	instanceId: string,
+  projectId: string,
+  repoId: string,
+  instanceId: string
 ): Promise<{ status: string; url?: string }> {
-	const response = await apiClient.post(
-		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/recreate-tunnel`,
-	);
-	return response.data;
+  const response = await apiClient.post(
+    `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/recreate-tunnel`
+  );
+  return response.data;
 }

apps/web/src/api/tool-configs.ts

@@ -1,52 +0,0 @@
-import { apiClient } from "./client";
-import type { ToolConfig, CreateToolConfigRequest } from "../types/tool-config";
-
-export type { ToolConfig, CreateToolConfigRequest } from "../types/tool-config";
-
-export const listToolConfigs = async (
-	tool_type_id?: string,
-	project_id?: string,
-): Promise<ToolConfig[]> => {
-	const params = new URLSearchParams();
-	if (tool_type_id) params.append("tool_type_id", tool_type_id);
-	if (project_id) params.append("project_id", project_id);
-
-	const response = await apiClient.get<{ configs: ToolConfig[] }>(
-		`/tool-configs?${params.toString()}`,
-	);
-	return response.data.configs;
-};
-
-export const createToolConfig = async (
-	data: CreateToolConfigRequest,
-): Promise<ToolConfig> => {
-	const response = await apiClient.post<{ configs: ToolConfig[] }>(
-		"/tool-configs",
-		data,
-	);
-	return response.data.configs[0];
-};
-
-export const updateToolConfig = async (
-	id: string,
-	data: CreateToolConfigRequest,
-): Promise<ToolConfig> => {
-	const response = await apiClient.put<{ configs: ToolConfig[] }>(
-		`/tool-configs/${id}`,
-		data,
-	);
-	return response.data.configs[0];
-};
-
-export const deleteToolConfig = async (id: string): Promise<void> => {
-	await apiClient.delete(`/tool-configs/${id}`);
-};
-
-export const getToolConfigDefaults = async (
-	toolTypeId: string,
-): Promise<ToolConfig> => {
-	const response = await apiClient.get<ToolConfig>(
-		`/tool-configs/defaults/${toolTypeId}`,
-	);
-	return response.data;
-};

apps/web/src/api/tool-types.ts

@@ -1,51 +0,0 @@
-import { apiClient } from "./client";
-import type {
-	ToolType,
-	CreateToolTypeRequest,
-	UpdateToolTypeRequest,
-} from "../types/tool-type";
-
-export type {
-	ReadinessProbe,
-	ToolType,
-	CreateToolTypeRequest,
-	UpdateToolTypeRequest,
-} from "../types/tool-type";
-
-export const listToolTypes = async (): Promise<ToolType[]> => {
-	const response = await apiClient.get<ToolType[]>("/tool-types");
-	return response.data;
-};
-
-export const getToolType = async (id: string): Promise<ToolType> => {
-	const response = await apiClient.get<ToolType>(`/tool-types/${id}`);
-	return response.data;
-};
-
-export const createToolType = async (
-	data: CreateToolTypeRequest,
-): Promise<ToolType> => {
-	const response = await apiClient.post<ToolType>("/tool-types", data);
-	return response.data;
-};
-
-export const updateToolType = async (
-	id: string,
-	data: UpdateToolTypeRequest,
-): Promise<ToolType> => {
-	const response = await apiClient.put<ToolType>(`/tool-types/${id}`, data);
-	return response.data;
-};
-
-export const deleteToolType = async (id: string): Promise<void> => {
-	await apiClient.delete(`/tool-types/${id}`);
-};
-
-export const validateToolType = async (
-	id: string,
-): Promise<{ valid: boolean; errors?: string[] }> => {
-	const response = await apiClient.get<{ valid: boolean; errors?: string[] }>(
-		`/tool-types/${id}/validate`,
-	);
-	return response.data;
-};

apps/web/src/api/tool_configs.ts

@@ -0,0 +1,75 @@
+import { apiClient } from "./client";
+
+export interface ToolConfig {
+  id: string;
+  tool_type_id: string;
+  project_id: string | null;
+  key: string;
+  value: string;
+  config_type: string;
+  file_path: string | null;
+  port_override: number | null;
+  start_command: string | null;
+  working_directory: string | null;
+  environment_variables: Record<string, string> | null;
+  volumes: Array<{ source: string; target: string; type?: string }> | null;
+}
+
+export interface CreateToolConfigRequest {
+  tool_type_id: string;
+  project_id?: string;
+  key: string;
+  value: string;
+  config_type?: string;
+  file_path?: string;
+  port_override?: number;
+  start_command?: string;
+  working_directory?: string;
+  environment_variables?: Record<string, string>;
+  volumes?: Array<{ source: string; target: string; type?: string }>;
+}
+
+export const listToolConfigs = async (
+  tool_type_id?: string,
+  project_id?: string
+): Promise<ToolConfig[]> => {
+  const params = new URLSearchParams();
+  if (tool_type_id) params.append("tool_type_id", tool_type_id);
+  if (project_id) params.append("project_id", project_id);
+  
+  const response = await apiClient.get<{ configs: ToolConfig[] }>(
+    `/tool-configs?${params.toString()}`
+  );
+  return response.data.configs;
+};
+
+export const createToolConfig = async (
+  data: CreateToolConfigRequest
+): Promise<ToolConfig> => {
+  const response = await apiClient.post<{ configs: ToolConfig[] }>("/tool-configs", data);
+  return response.data.configs[0];
+};
+
+export const updateToolConfig = async (
+  id: string,
+  data: CreateToolConfigRequest
+): Promise<ToolConfig> => {
+  const response = await apiClient.put<{ configs: ToolConfig[] }>(
+    `/tool-configs/${id}`,
+    data
+  );
+  return response.data.configs[0];
+};
+
+export const deleteToolConfig = async (id: string): Promise<void> => {
+  await apiClient.delete(`/tool-configs/${id}`);
+};
+
+export const getToolConfigDefaults = async (
+  toolTypeId: string
+): Promise<ToolConfig> => {
+  const response = await apiClient.get<ToolConfig>(
+    `/tool-configs/defaults/${toolTypeId}`
+  );
+  return response.data;
+};

apps/web/src/api/tool_types.test.ts

@@ -6,7 +6,7 @@ import {
   listToolTypes,
   updateToolType,
   validateToolType,
-} from "../api/tool-types";
+} from "../api/tool_types";
 
 const mockGet = vi.fn();
 const mockPost = vi.fn();

apps/web/src/api/tool_types.ts

@@ -0,0 +1,85 @@
+import { apiClient } from "./client";
+
+export interface ReadinessProbe {
+  command: string;
+  timeout: number;
+  interval: number;
+}
+
+export interface ToolType {
+  id: string;
+  name: string;
+  display_name: string;
+  description: string | null;
+  category: string;
+  interfaces: string[];
+  default_port: number | null;
+  definition_type: 'compose' | 'dockerfile';
+  compose_template: string | null;
+  dockerfile_template: string | null;
+  build_context: Record<string, string> | null;
+  readiness_probe: ReadinessProbe | null;
+  required_variables: string[];
+  is_builtin: boolean;
+  created_by_id: string | null;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface CreateToolTypeRequest {
+  name: string;
+  display_name: string;
+  description?: string;
+  category?: string;
+  interfaces?: string[];
+  default_port: number;
+  definition_type?: 'compose' | 'dockerfile';
+  compose_template?: string;
+  dockerfile_template?: string;
+  build_context?: Record<string, string>;
+  readiness_probe?: ReadinessProbe;
+  required_variables: string[];
+}
+
+export interface UpdateToolTypeRequest {
+  display_name?: string;
+  description?: string;
+  category?: string;
+  interfaces?: string[];
+  default_port?: number;
+  definition_type?: 'compose' | 'dockerfile';
+  compose_template?: string;
+  dockerfile_template?: string;
+  build_context?: Record<string, string>;
+  readiness_probe?: ReadinessProbe;
+  required_variables?: string[];
+}
+
+export const listToolTypes = async (): Promise<ToolType[]> => {
+  const response = await apiClient.get<ToolType[]>("/tool-types");
+  return response.data;
+};
+
+export const getToolType = async (id: string): Promise<ToolType> => {
+  const response = await apiClient.get<ToolType>(`/tool-types/${id}`);
+  return response.data;
+};
+
+export const createToolType = async (data: CreateToolTypeRequest): Promise<ToolType> => {
+  const response = await apiClient.post<ToolType>("/tool-types", data);
+  return response.data;
+};
+
+export const updateToolType = async (id: string, data: UpdateToolTypeRequest): Promise<ToolType> => {
+  const response = await apiClient.put<ToolType>(`/tool-types/${id}`, data);
+  return response.data;
+};
+
+export const deleteToolType = async (id: string): Promise<void> => {
+  await apiClient.delete(`/tool-types/${id}`);
+};
+
+export const validateToolType = async (id: string): Promise<{ valid: boolean; errors?: string[] }> => {
+  const response = await apiClient.get<{ valid: boolean; errors?: string[] }>(`/tool-types/${id}/validate`);
+  return response.data;
+};

apps/web/src/components/app-shell.tsx

@@ -0,0 +1,121 @@
+import { useCallback, useEffect } from "react";
+import { Link, NavLink, Outlet } from "react-router-dom";
+
+import { getUserSessions } from "../api/sessions";
+import type { Session } from "../api/sessions";
+import { useTheme } from "../hooks/use-theme";
+import { useAuth } from "../state/auth";
+import { useSessions } from "../state/sessions";
+import { Icon } from "./icon";
+import type { IconName } from "../utils/icons";
+
+const NAV_ITEMS: { to: string; label: string; icon: IconName }[] = [
+  { to: "/", label: "Home", icon: "dashboard" },
+  { to: "/projects", label: "Projects", icon: "projects" },
+  { to: "/tool-workshop", label: "Tool Workshop", icon: "settings" },
+  { to: "/settings", label: "Settings", icon: "settings" }
+];
+
+const SessionItem = ({ session }: { session: Session }) => {
+  const isRunning = session.status === "running";
+
+  return (
+    <a
+      href={session.url ?? `/projects/${session.project_id}`}
+      target={session.url ? "_blank" : undefined}
+      rel={session.url ? "noopener noreferrer" : undefined}
+      className="nav-item session-item"
+      title={`${session.display_name} (${session.status})`}
+    >
+      <span className={`session-status ${isRunning ? "running" : ""}`} />
+      <Icon name={session.tool_icon as IconName} size="sm" />
+      <span className="session-name">{session.display_name}</span>
+    </a>
+  );
+};
+
+export const AppShell = () => {
+  useTheme();
+  const { user, logout } = useAuth();
+  const { sessions, setAllSessions } = useSessions();
+
+  const loadSessions = useCallback(async () => {
+    try {
+      const data = await getUserSessions();
+      setAllSessions(data);
+    } catch {
+      // Silently fail - sessions are optional
+    }
+  }, [setAllSessions]);
+
+  useEffect(() => {
+    void loadSessions();
+    // Poll every 10 seconds
+    const interval = setInterval(() => {
+      void loadSessions();
+    }, 10000);
+    return () => clearInterval(interval);
+  }, [loadSessions]);
+
+  return (
+    <div className="shell">
+      <header className="shell-header">
+        <Link className="brand" to="/">
+          Headquarter
+        </Link>
+        <div className="header-actions">
+          <Link className="user-chip" to="/profile">
+            {user?.name ?? "User"}
+          </Link>
+          <button
+            className="ghost-button"
+            onClick={() => {
+              void logout();
+            }}
+            type="button"
+          >
+            <Icon name="logout" size="sm" />
+            Logout
+          </button>
+        </div>
+      </header>
+
+      <div className="shell-body">
+        <aside className="shell-nav" aria-label="Primary navigation">
+          {NAV_ITEMS.map((item) => {
+            const isHome = item.to === "/";
+            const activeCount = sessions.filter((s) => s.status === "running").length;
+            return (
+              <NavLink
+                key={item.to}
+                to={item.to}
+                className={({ isActive }) => (isActive ? "nav-item nav-item-active" : "nav-item")}
+                end={item.to === "/"}
+              >
+                <Icon name={item.icon} size="sm" />
+                {item.label}
+                {isHome && activeCount > 0 && (
+                  <span className="nav-badge">{activeCount}</span>
+                )}
+              </NavLink>
+            );
+          })}
+          
+          {sessions.length > 0 && (
+            <>
+              <div className="nav-divider" />
+              <div className="nav-section-title">Live sessions</div>
+              {sessions.map((session) => (
+                <SessionItem key={session.id} session={session} />
+              ))}
+            </>
+          )}
+        </aside>
+
+        <main className="shell-content">
+          <Outlet />
+        </main>
+      </div>
+    </div>
+  );
+};

apps/web/src/components/code-editor.tsx

@@ -1,6 +1,6 @@
 import React, { useEffect } from "react";
 import Editor from "react-simple-code-editor";
-import { highlightCode, loadLanguage } from "../../utils/language";
+import { highlightCode, loadLanguage } from "../utils/language";
 
 interface CodeEditorProps {
   value: string;

apps/web/src/components/commit-dialog.tsx

@@ -1,7 +1,6 @@
-import styles from "./CommitDialog.module.css";
 import React, { useState } from "react";
 
-import { Icon } from "../../ui/Icon";
+import { Icon } from "./icon";
 
 interface CommitDialogProps {
   isOpen: boolean;
@@ -72,40 +71,40 @@ export const CommitDialog: React.FC<CommitDialogProps> = ({
   const hasChanges = diff.some((d) => d.type !== "same");
 
   return (
-    <div className={styles.dialogOverlay}>
-      <div className={styles.commitDialog}>
-        <div className={styles.dialogHeader}>
+    <div className="dialog-overlay">
+      <div className="commit-dialog">
+        <div className="dialog-header">
           <h3>Commit Changes</h3>
-          <button className={styles.dialogClose} onClick={onCancel} type="button">
+          <button className="dialog-close" onClick={onCancel} type="button">
             ×
           </button>
         </div>
 
-        <div className={styles.dialogBody}>
-          <p className={styles.fileInfo}>
+        <div className="dialog-body">
+          <p className="file-info">
             Editing: <strong>{filePath}</strong>
           </p>
 
           {!hasChanges && (
-            <div className={styles.warningMessage}>No changes to commit</div>
+            <div className="warning-message">No changes to commit</div>
           )}
 
           {hasChanges && (
-            <div className={styles.diffPreview}>
+            <div className="diff-preview">
               <h4>Changes</h4>
-              <div className={styles.diffContent}>
+              <div className="diff-content">
                 {diff.map((line, i) => (
                   <div
                     key={i}
-                    className={`${styles.diffLine} ${line.type === "added" ? styles.diffAdded : line.type === "removed" ? styles.diffRemoved : styles.diffSame}`}
+                    className={`diff-line diff-${line.type}`}
                   >
-                    <span className={styles.diffLineNumber}>{line.lineNum}</span>
-                    <span className={styles.diffMarker}>
+                    <span className="diff-line-number">{line.lineNum}</span>
+                    <span className="diff-marker">
                       {line.type === "added" && "+"}
                       {line.type === "removed" && "-"}
                       {line.type === "same" && " "}
                     </span>
-                    <span className={styles.diffLineContent}>{line.line}</span>
+                    <span className="diff-line-content">{line.line}</span>
                   </div>
                 ))}
               </div>
@@ -126,7 +125,7 @@ export const CommitDialog: React.FC<CommitDialogProps> = ({
           {error && <div className="error-message">{error}</div>}
         </div>
 
-        <div className={styles.dialogFooter}>
+        <div className="dialog-footer">
           <button
             className="btn-secondary"
             onClick={onCancel}

apps/web/src/components/commit-panel.tsx

@@ -0,0 +1,102 @@
+import { useState } from "react";
+
+import { commitChanges } from "../api/git_repositories";
+
+interface CommitPanelProps {
+  projectId: string;
+  repoId: string;
+  modified: string[];
+  added: string[];
+  deleted: string[];
+  untracked: string[];
+  onCommit: () => void;
+}
+
+export const CommitPanel = ({
+  projectId,
+  repoId,
+  modified,
+  added,
+  deleted,
+  untracked,
+  onCommit,
+}: CommitPanelProps) => {
+  const [message, setMessage] = useState("");
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const allFiles = [...modified, ...added, ...deleted, ...untracked];
+  const hasChanges = allFiles.length > 0;
+
+  const handleCommit = async () => {
+    if (!message.trim()) {
+      setError("Please enter a commit message");
+      return;
+    }
+    setLoading(true);
+    setError(null);
+    try {
+      await commitChanges(projectId, repoId, message);
+      setMessage("");
+      onCommit();
+    } catch {
+      setError("Commit failed. Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  if (!hasChanges) return null;
+
+  return (
+    <div className="commit-panel">
+      <h4>Changes</h4>
+      
+      <div className="file-list">
+        {modified.map((file) => (
+          <div key={file} className="file-item modified">
+            <span className="file-status">M</span>
+            <span className="file-name">{file}</span>
+          </div>
+        ))}
+        {added.map((file) => (
+          <div key={file} className="file-item added">
+            <span className="file-status">A</span>
+            <span className="file-name">{file}</span>
+          </div>
+        ))}
+        {deleted.map((file) => (
+          <div key={file} className="file-item deleted">
+            <span className="file-status">D</span>
+            <span className="file-name">{file}</span>
+          </div>
+        ))}
+        {untracked.map((file) => (
+          <div key={file} className="file-item untracked">
+            <span className="file-status">?</span>
+            <span className="file-name">{file}</span>
+          </div>
+        ))}
+      </div>
+
+      <div className="commit-form">
+        <textarea
+          placeholder="Commit message"
+          value={message}
+          onChange={(e) => setMessage(e.target.value)}
+          rows={2}
+          className="commit-message-input"
+        />
+        {error && <div className="commit-error">{error}</div>}
+        <button
+          onClick={handleCommit}
+          disabled={loading || !message.trim()}
+          className="commit-button"
+          type="button"
+        >
+          {loading ? "Committing..." : "Commit"}
+        </button>
+      </div>
+    </div>
+  );
+};

apps/web/src/components/features/dashboard/ActiveSessionsList.tsx

@@ -1,86 +0,0 @@
-import type { Session } from "../../../types/session";
-import { Icon } from "../../ui/Icon";
-
-interface ActiveSessionsListProps {
-	sessions: Session[];
-	actionBusy: string | null;
-	onOpen: (session: Session) => void;
-	onStop: (session: Session) => void;
-	onDelete: (session: Session) => void;
-	onRecreateTunnel: (session: Session) => void;
-}
-
-export const ActiveSessionsList = ({
-	sessions,
-	actionBusy,
-	onOpen,
-	onStop,
-	onDelete,
-	onRecreateTunnel,
-}: ActiveSessionsListProps) => {
-	if (sessions.length === 0) {
-		return <p className="muted">No active sessions right now.</p>;
-	}
-
-	return (
-		<div className="home-session-grid">
-			{sessions.map((session) => (
-				<article className="card session-card" key={session.id}>
-					<div className="stack-sm">
-						<div className="row row-tight">
-							<h3>
-								{session.display_name ||
-									session.tool_type_name ||
-									"Unnamed Session"}
-							</h3>
-							<span className={`status-badge ${session.status}`}>
-								{session.status}
-							</span>
-						</div>
-						<p className="muted">
-							{session.project_name} · {session.repository_name}
-						</p>
-						<p className="muted">{session.tool_type_name}</p>
-					</div>
-					<div className="session-actions">
-						<button
-							className="secondary-button small"
-							type="button"
-							onClick={() => onOpen(session)}
-						>
-							<Icon name="external" size="sm" />
-							Open
-						</button>
-						<button
-							className="ghost-button small"
-							type="button"
-							onClick={() => void onRecreateTunnel(session)}
-							disabled={actionBusy === session.id}
-						>
-							<Icon name="refresh" size="sm" />
-							Tunnel
-						</button>
-						<button
-							className="ghost-button small"
-							type="button"
-							onClick={() => void onStop(session)}
-							disabled={actionBusy === session.id}
-						>
-							<Icon name="stop" size="sm" />
-							Stop
-						</button>
-						<button
-							className="ghost-button small danger-text"
-							type="button"
-							onClick={() => void onDelete(session)}
-							disabled={actionBusy === session.id}
-						>
-							<Icon name="delete" size="sm" />
-							Delete
-						</button>
-					</div>
-				</article>
-			))}
-		</div>
-	);
-};

apps/web/src/components/features/dashboard/DashboardSummary.tsx

@@ -1,34 +0,0 @@
-import type { DashboardSummary as DashboardSummaryType } from "../../../api/dashboard";
-
-interface DashboardSummaryProps {
-	summary: DashboardSummaryType;
-	activeSessionsCount: number;
-}
-
-const summaryCards = [
-	{ label: "Open sessions", key: "openSessions" },
-	{ label: "Projects", key: "projects" },
-	{ label: "Repositories", key: "repositories" },
-] as const;
-
-export const DashboardSummary = ({
-	summary,
-	activeSessionsCount,
-}: DashboardSummaryProps) => {
-	return (
-		<div className="home-summary-grid">
-			{summaryCards.map((card) => (
-				<article className="card home-summary-card" key={card.label}>
-					<p className="card-label">{card.label}</p>
-					<p className="card-value">
-						{card.key === "openSessions"
-							? activeSessionsCount
-							: card.key === "projects"
-								? summary.projects
-								: summary.repositories}
-					</p>
-				</article>
-			))}
-		</div>
-	);
-};

apps/web/src/components/features/dashboard/ProjectsSection.tsx

@@ -1,40 +0,0 @@
-import type { Project } from "../../../types/project";
-
-interface ProjectsSectionProps {
-	projects: Project[];
-	onOpenProject: (projectId: string) => void;
-}
-
-export const ProjectsSection = ({
-	projects,
-	onOpenProject,
-}: ProjectsSectionProps) => {
-	if (projects.length === 0) {
-		return <p className="muted">No projects yet.</p>;
-	}
-
-	return (
-		<div className="home-project-grid">
-			{projects.map((project) => (
-				<article
-					className="card project-card home-project-card"
-					key={project.id}
-				>
-					<div className="stack-sm">
-						<h3>{project.name}</h3>
-						{project.description && (
-							<p className="muted">{project.description}</p>
-						)}
-					</div>
-					<button
-						className="ghost-button small"
-						type="button"
-						onClick={() => onOpenProject(project.id)}
-					>
-						Open Workspace
-					</button>
-				</article>
-			))}
-		</div>
-	);
-};

apps/web/src/components/features/dashboard/QuickCreateForm.tsx

@@ -1,129 +0,0 @@
-import { useState } from "react";
-import type { Project } from "../../../types/project";
-import type { GitRepository } from "../../../types/git-repository";
-import type { ToolType } from "../../../types/tool-type";
-import { Icon } from "../../ui/Icon";
-
-interface QuickCreateFormProps {
-	projects: Project[];
-	repositories: GitRepository[];
-	toolTypes: ToolType[];
-	saveState: "idle" | "saving" | "error";
-	onSubmit: (data: {
-		projectId: string;
-		repoId: string;
-		toolTypeId: string;
-		displayName: string;
-	}) => void;
-	onProjectChange: (projectId: string) => void;
-}
-
-export const QuickCreateForm = ({
-	projects,
-	repositories,
-	toolTypes,
-	saveState,
-	onSubmit,
-	onProjectChange,
-}: QuickCreateFormProps) => {
-	const [selectedProject, setSelectedProject] = useState("");
-	const [selectedRepo, setSelectedRepo] = useState("");
-	const [selectedToolType, setSelectedToolType] = useState("");
-	const [displayName, setDisplayName] = useState("");
-
-	const handleProjectChange = (projectId: string) => {
-		setSelectedProject(projectId);
-		setSelectedRepo("");
-		onProjectChange(projectId);
-	};
-
-	const handleSubmit = (event: React.FormEvent) => {
-		event.preventDefault();
-		if (!selectedProject || !selectedRepo || !selectedToolType) return;
-		onSubmit({
-			projectId: selectedProject,
-			repoId: selectedRepo,
-			toolTypeId: selectedToolType,
-			displayName,
-		});
-	};
-
-	return (
-		<form className="stack create-session-form" onSubmit={handleSubmit}>
-			<div className="form-row">
-				<label className="form-field">
-					Project
-					<select
-						value={selectedProject}
-						onChange={(event) => handleProjectChange(event.target.value)}
-					>
-						<option value="">Select project...</option>
-						{projects.map((project) => (
-							<option key={project.id} value={project.id}>
-								{project.name}
-							</option>
-						))}
-					</select>
-				</label>
-				<label className="form-field">
-					Repository
-					<select
-						value={selectedRepo}
-						onChange={(event) => setSelectedRepo(event.target.value)}
-						disabled={!selectedProject}
-					>
-						<option value="">Select repository...</option>
-						{repositories.map((repo) => (
-							<option key={repo.id} value={repo.id}>
-								{repo.name}
-							</option>
-						))}
-					</select>
-				</label>
-				<label className="form-field">
-					Tool type
-					<select
-						value={selectedToolType}
-						onChange={(event) => setSelectedToolType(event.target.value)}
-					>
-						<option value="">Select tool...</option>
-						{toolTypes.map((tool) => (
-							<option key={tool.id} value={tool.id}>
-								{tool.display_name}
-							</option>
-						))}
-					</select>
-				</label>
-			</div>
-			<label className="form-field">
-				Display name
-				<input
-					type="text"
-					value={displayName}
-					onChange={(event) => setDisplayName(event.target.value)}
-					placeholder="My Development Environment"
-				/>
-			</label>
-			<div className="form-actions">
-				<button
-					className="primary-button"
-					type="submit"
-					disabled={saveState === "saving"}
-				>
-					{saveState === "saving" ? (
-						<>
-							<Icon name="loading" size="sm" /> Creating...
-						</>
-					) : (
-						<>
-							<Icon name="add" size="sm" /> Create Session
-						</>
-					)}
-				</button>
-				{saveState === "error" && (
-					<span className="error-text">Failed to create session</span>
-				)}
-			</div>
-		</form>
-	);
-};

apps/web/src/components/features/dashboard/RecentSessionsSection.tsx

@@ -1,47 +0,0 @@
-import type { Session } from "../../../types/session";
-
-interface RecentSessionsSectionProps {
-	sessions: Session[];
-	onOpen: (session: Session) => void;
-}
-
-export const RecentSessionsSection = ({
-	sessions,
-	onOpen,
-}: RecentSessionsSectionProps) => {
-	if (sessions.length === 0) return null;
-
-	return (
-		<section className="card stack home-section">
-			<div className="page-header">
-				<div>
-					<p className="eyebrow">Recent sessions</p>
-					<h2>{sessions.length}</h2>
-				</div>
-			</div>
-			<div className="recent-sessions-list">
-				{sessions.map((session) => (
-					<article className="recent-session-item" key={session.id}>
-						<div className="recent-session-info">
-							<span className="recent-session-name">
-								{session.display_name ||
-									session.tool_type_name ||
-									"Unnamed Session"}
-							</span>
-							<span className="muted">
-								{session.project_name} · {session.tool_type_name}
-							</span>
-						</div>
-						<button
-							className="ghost-button small"
-							type="button"
-							onClick={() => onOpen(session)}
-						>
-							Open
-						</button>
-					</article>
-				))}
-			</div>
-		</section>
-	);
-};

apps/web/src/components/features/dashboard/index.ts

@@ -1,5 +0,0 @@
-export { DashboardSummary } from "./DashboardSummary";
-export { ActiveSessionsList } from "./ActiveSessionsList";
-export { ProjectsSection } from "./ProjectsSection";
-export { QuickCreateForm } from "./QuickCreateForm";
-export { RecentSessionsSection } from "./RecentSessionsSection";

apps/web/src/components/features/git/CommitDialog.module.css

@@ -1,130 +0,0 @@
-.commitDialog {
-  background: var(--panel);
-  border-radius: 14px;
-  width: 100%;
-  max-width: 600px;
-  max-height: 90vh;
-  overflow: auto;
-  box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.1);
-}
-
-.dialogHeader {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  padding: 1rem 1.5rem;
-  border-bottom: 1px solid var(--border);
-}
-
-.dialogHeader h3 {
-  margin: 0;
-  font-size: 1.1rem;
-}
-
-.dialogClose {
-  background: none;
-  border: none;
-  font-size: 1.5rem;
-  cursor: pointer;
-  color: var(--muted);
-  padding: 0;
-  width: 2rem;
-  height: 2rem;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  border-radius: 6px;
-}
-
-.dialogClose:hover {
-  background: var(--bg);
-  color: var(--ink);
-}
-
-.dialogBody {
-  padding: 1.5rem;
-}
-
-.fileInfo {
-  margin: 0 0 1rem;
-  color: var(--muted);
-}
-
-.diffPreview {
-  margin-bottom: 1.5rem;
-}
-
-.diffPreview h4 {
-  margin: 0 0 0.75rem;
-  font-size: 0.9rem;
-  color: var(--muted);
-}
-
-.diffContent {
-  background: var(--bg);
-  border: 1px solid var(--border);
-  border-radius: 8px;
-  overflow: auto;
-  max-height: 300px;
-  font-family: 'Fira Code', 'Monaco', 'Courier New', monospace;
-  font-size: 13px;
-}
-
-.diffLine {
-  display: flex;
-  padding: 0.15rem 0.5rem;
-  gap: 0.5rem;
-}
-
-.diffLineNumber {
-  color: var(--muted);
-  min-width: 2rem;
-  text-align: right;
-  user-select: none;
-}
-
-.diffMarker {
-  width: 1rem;
-  text-align: center;
-  font-weight: bold;
-}
-
-.diffAdded {
-  background: rgba(16, 185, 129, 0.1);
-}
-
-.diffAdded .diffMarker {
-  color: #059669;
-}
-
-.diffRemoved {
-  background: rgba(239, 68, 68, 0.1);
-}
-
-.diffRemoved .diffMarker {
-  color: #dc2626;
-}
-
-.diffSame {
-  background: transparent;
-}
-
-.diffLineContent {
-  flex: 1;
-}
-
-.warningMessage {
-  padding: 0.75rem;
-  background: rgba(245, 158, 11, 0.1);
-  color: #d97706;
-  border-radius: 8px;
-  margin-bottom: 1rem;
-}
-
-.dialogFooter {
-  display: flex;
-  justify-content: flex-end;
-  gap: 0.75rem;
-  padding: 1rem 1.5rem;
-  border-top: 1px solid var(--border);
-}

apps/web/src/components/features/git/CommitPanel.module.css

@@ -1,84 +0,0 @@
-.commitPanel {
-	padding: 1rem;
-	border-top: 1px solid var(--border);
-	background: var(--panel);
-}
-
-.commitPanel h4 {
-	margin: 0 0 0.5rem 0;
-	font-size: 0.875rem;
-	font-weight: 600;
-}
-
-.fileList {
-	max-height: 150px;
-	overflow: auto;
-	margin-bottom: 0.75rem;
-}
-
-.fileItem {
-	display: flex;
-	align-items: center;
-	gap: 0.5rem;
-	padding: 0.25rem 0;
-	font-size: 0.8125rem;
-}
-
-.fileStatus {
-	font-weight: bold;
-	font-size: 0.75rem;
-	width: 1rem;
-	text-align: center;
-}
-
-.fileItem.modified .fileStatus {
-	color: #f59e0b;
-}
-.fileItem.added .fileStatus {
-	color: #10b981;
-}
-.fileItem.deleted .fileStatus {
-	color: #ef4444;
-}
-.fileItem.untracked .fileStatus {
-	color: #6b7280;
-}
-
-.commitForm {
-	display: flex;
-	flex-direction: column;
-	gap: 0.5rem;
-}
-
-.commitMessageInput {
-	width: 100%;
-	padding: 0.5rem;
-	border: 1px solid var(--border);
-	border-radius: 4px;
-	background: var(--bg);
-	color: var(--ink);
-	font-family: inherit;
-	font-size: 0.875rem;
-	resize: vertical;
-}
-
-.commitButton {
-	padding: 0.5rem 1rem;
-	background: var(--primary);
-	color: white;
-	border: none;
-	border-radius: 4px;
-	cursor: pointer;
-	font-size: 0.875rem;
-	font-weight: 500;
-}
-
-.commitButton:disabled {
-	opacity: 0.5;
-	cursor: not-allowed;
-}
-
-.commitError {
-	color: #ef4444;
-	font-size: 0.8125rem;
-}

apps/web/src/components/features/git/CommitPanel.tsx

@@ -1,103 +0,0 @@
-import { useState } from "react";
-
-import { commitChanges } from "../../../api/git-repositories";
-import styles from "./CommitPanel.module.css";
-
-interface CommitPanelProps {
-	projectId: string;
-	repoId: string;
-	modified: string[];
-	added: string[];
-	deleted: string[];
-	untracked: string[];
-	onCommit: () => void;
-}
-
-export const CommitPanel = ({
-	projectId,
-	repoId,
-	modified,
-	added,
-	deleted,
-	untracked,
-	onCommit,
-}: CommitPanelProps) => {
-	const [message, setMessage] = useState("");
-	const [loading, setLoading] = useState(false);
-	const [error, setError] = useState<string | null>(null);
-
-	const allFiles = [...modified, ...added, ...deleted, ...untracked];
-	const hasChanges = allFiles.length > 0;
-
-	const handleCommit = async () => {
-		if (!message.trim()) {
-			setError("Please enter a commit message");
-			return;
-		}
-		setLoading(true);
-		setError(null);
-		try {
-			await commitChanges(projectId, repoId, message);
-			setMessage("");
-			onCommit();
-		} catch {
-			setError("Commit failed. Please try again.");
-		} finally {
-			setLoading(false);
-		}
-	};
-
-	if (!hasChanges) return null;
-
-	return (
-		<div className={styles.commitPanel}>
-			<h4>Changes</h4>
-
-			<div className={styles.fileList}>
-				{modified.map((file) => (
-					<div key={file} className={`${styles.fileItem} modified`}>
-						<span className={styles.fileStatus}>M</span>
-						<span>{file}</span>
-					</div>
-				))}
-				{added.map((file) => (
-					<div key={file} className={`${styles.fileItem} added`}>
-						<span className={styles.fileStatus}>A</span>
-						<span>{file}</span>
-					</div>
-				))}
-				{deleted.map((file) => (
-					<div key={file} className={`${styles.fileItem} deleted`}>
-						<span className={styles.fileStatus}>D</span>
-						<span>{file}</span>
-					</div>
-				))}
-				{untracked.map((file) => (
-					<div key={file} className={`${styles.fileItem} untracked`}>
-						<span className={styles.fileStatus}>?</span>
-						<span>{file}</span>
-					</div>
-				))}
-			</div>
-
-			<div className={styles.commitForm}>
-				<textarea
-					placeholder="Commit message"
-					value={message}
-					onChange={(e) => setMessage(e.target.value)}
-					rows={2}
-					className={styles.commitMessageInput}
-				/>
-				{error && <div className={styles.commitError}>{error}</div>}
-				<button
-					onClick={handleCommit}
-					disabled={loading || !message.trim()}
-					className={styles.commitButton}
-					type="button"
-				>
-					{loading ? "Committing..." : "Commit"}
-				</button>
-			</div>
-		</div>
-	);
-};

apps/web/src/components/features/git/FileBrowser.module.css

@@ -1,63 +0,0 @@
-.fileTree {
-  flex: 1;
-  overflow: auto;
-  padding: 0.5rem;
-}
-
-.treeEntry {
-  display: block;
-  width: 100%;
-  padding: 0.375rem 0.5rem;
-  border: none;
-  background: none;
-  color: var(--ink);
-  text-align: left;
-  cursor: pointer;
-  border-radius: 4px;
-  font-size: 0.875rem;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.treeEntry:hover {
-  background: var(--bg);
-}
-
-.treeDirectory {
-  font-weight: 500;
-}
-
-.treeUp {
-  color: var(--muted);
-  font-style: italic;
-}
-
-.fileStatusIndicator {
-  float: right;
-  font-size: 0.75rem;
-  font-weight: bold;
-  padding: 0 0.375rem;
-  border-radius: 3px;
-  margin-left: 0.5rem;
-}
-
-.fileStatusIndicator.modified {
-  color: #f59e0b;
-  background: rgba(245, 158, 11, 0.1);
-}
-
-.fileStatusIndicator.added {
-  color: #10b981;
-  background: rgba(16, 185, 129, 0.1);
-}
-
-.fileStatusIndicator.deleted {
-  color: #ef4444;
-  background: rgba(239, 68, 68, 0.1);
-}
-
-.fileStatusIndicator.untracked {
-  color: #6b7280;
-  background: rgba(107, 114, 128, 0.1);
-}

apps/web/src/components/features/git/FileBrowser.test.tsx

@@ -1,62 +0,0 @@
-import { render, screen, waitFor } from "@testing-library/react";
-import { describe, it, expect, vi } from "vitest";
-import { MemoryRouter } from "react-router-dom";
-import { FileBrowser } from "./FileBrowser";
-
-// Mock apiClient
-vi.mock("../../../api/client", () => ({
-	apiClient: {
-		get: vi.fn(),
-	},
-}));
-
-import { apiClient } from "../../../api/client";
-
-describe("FileBrowser", () => {
-	it("renders loading state initially", () => {
-		render(
-			<MemoryRouter>
-				<FileBrowser projectId="p1" repoId="r1" gitStatus={null} />
-			</MemoryRouter>,
-		);
-		expect(screen.getByText(/loading files/i)).toBeInTheDocument();
-	});
-
-	it("renders file entries after loading", async () => {
-		const mockedGet = apiClient.get as ReturnType<typeof vi.fn>;
-		mockedGet.mockResolvedValueOnce({
-			data: {
-				entries: [
-					{ name: "src", type: "directory", path: "src" },
-					{ name: "README.md", type: "file", path: "README.md" },
-				],
-			},
-		});
-
-		render(
-			<MemoryRouter>
-				<FileBrowser projectId="p1" repoId="r1" gitStatus={null} />
-			</MemoryRouter>,
-		);
-
-		await waitFor(() => {
-			expect(screen.getByText("src")).toBeInTheDocument();
-		});
-		expect(screen.getByText("README.md")).toBeInTheDocument();
-	});
-
-	it("renders error state on failure", async () => {
-		const mockedGet = apiClient.get as ReturnType<typeof vi.fn>;
-		mockedGet.mockRejectedValueOnce(new Error("Network error"));
-
-		render(
-			<MemoryRouter>
-				<FileBrowser projectId="p1" repoId="r1" gitStatus={null} />
-			</MemoryRouter>,
-		);
-
-		await waitFor(() => {
-			expect(screen.getByText(/failed to load files/i)).toBeInTheDocument();
-		});
-	});
-});

apps/web/src/components/features/git/FileBrowser.tsx

@@ -1,150 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { useSearchParams } from "react-router-dom";
-import { Icon } from "../../ui/Icon";
-import { apiClient } from "../../../api/client";
-import type { GitStatus } from "../../../types/git-repository";
-
-interface FileTreeEntry {
-	name: string;
-	type: "file" | "directory";
-	path: string;
-	size?: number;
-	mode?: string;
-	last_commit?: {
-		hash: string;
-		message: string;
-		author: string;
-		date: string;
-	} | null;
-}
-
-interface FileBrowserProps {
-	projectId: string;
-	repoId: string;
-	gitStatus: GitStatus | null;
-}
-
-export const FileBrowser: React.FC<FileBrowserProps> = ({
-	projectId,
-	repoId,
-	gitStatus,
-}) => {
-	const [searchParams, setSearchParams] = useSearchParams();
-	const [entries, setEntries] = useState<FileTreeEntry[]>([]);
-	const [loading, setLoading] = useState(true);
-	const [error, setError] = useState<string | null>(null);
-
-	const branch = searchParams.get("branch") || "main";
-	const path = searchParams.get("path") || "";
-
-	const loadFiles = useCallback(async () => {
-		setLoading(true);
-		setError(null);
-		try {
-			const response = await apiClient.get(
-				`/projects/${projectId}/repositories/${repoId}/files`,
-				{
-					params: {
-						branch,
-						path,
-					},
-				},
-			);
-			setEntries(response.data.entries || []);
-		} catch {
-			setError("Failed to load files");
-		} finally {
-			setLoading(false);
-		}
-	}, [projectId, repoId, branch, path]);
-
-	useEffect(() => {
-		void loadFiles();
-	}, [loadFiles]);
-
-	// Listen for refresh events
-	useEffect(() => {
-		const handleRefresh = () => void loadFiles();
-		window.addEventListener("refresh-file-tree", handleRefresh);
-		return () => window.removeEventListener("refresh-file-tree", handleRefresh);
-	}, [loadFiles]);
-
-	const handleEntryClick = (entry: FileTreeEntry) => {
-		if (entry.type === "directory") {
-			const newParams = new URLSearchParams(searchParams);
-			newParams.set("path", entry.path);
-			setSearchParams(newParams);
-		} else {
-			const newParams = new URLSearchParams(searchParams);
-			newParams.set("file", entry.path);
-			setSearchParams(newParams);
-		}
-	};
-
-	const navigateUp = () => {
-		if (!path) return;
-		const parentPath = path.split("/").slice(0, -1).join("/");
-		const newParams = new URLSearchParams(searchParams);
-		if (parentPath) {
-			newParams.set("path", parentPath);
-		} else {
-			newParams.delete("path");
-		}
-		setSearchParams(newParams);
-	};
-
-	const getFileStatus = (filePath: string): string | null => {
-		if (!gitStatus) return null;
-		if (gitStatus.modified.includes(filePath)) return "modified";
-		if (gitStatus.added.includes(filePath)) return "added";
-		if (gitStatus.deleted.includes(filePath)) return "deleted";
-		if (gitStatus.untracked.includes(filePath)) return "untracked";
-		return null;
-	};
-
-	if (loading) return <p className="muted">Loading files...</p>;
-	if (error) return <p className="error-text">{error}</p>;
-
-	return (
-		<div className="file-tree">
-			{path && (
-				<button
-					className="tree-entry tree-up"
-					onClick={navigateUp}
-					type="button"
-				>
-					<Icon name="folder" size="sm" /> ..
-				</button>
-			)}
-			{entries.length === 0 && (
-				<p className="muted">No files in this repository yet.</p>
-			)}
-			{entries.map((entry) => {
-				const fileStatus =
-					entry.type === "file" ? getFileStatus(entry.path) : null;
-				return (
-					<button
-						key={entry.path}
-						className={`tree-entry ${entry.type === "directory" ? "tree-directory" : "tree-file"} ${fileStatus || ""}`}
-						onClick={() => handleEntryClick(entry)}
-						type="button"
-					>
-						<Icon
-							name={entry.type === "directory" ? "folder" : "file"}
-							size="sm"
-						/>{" "}
-						{entry.name}
-						{fileStatus && (
-							<span className={`file-status-indicator ${fileStatus}`}>
-								{fileStatus === "modified" && "M"}
-								{fileStatus === "added" && "A"}
-								{fileStatus === "deleted" && "D"}
-								{fileStatus === "untracked" && "?"}
-							</span>
-						)}
-					</button>
-				);
-			})}
-		</div>
-	);
-};

apps/web/src/components/features/git/FileEditor.module.css

@@ -1,28 +0,0 @@
-.fileEditor {
-  display: flex;
-  flex-direction: column;
-  height: 100%;
-  overflow: hidden;
-}
-
-.fileEditorToolbar {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  padding: 0.75rem 1rem;
-  background: var(--panel);
-  border-bottom: 1px solid var(--border);
-}
-
-.fileActions {
-  display: flex;
-  gap: 0.5rem;
-}
-
-.fileEditorContent {
-  flex: 1;
-  overflow: hidden;
-  background: var(--bg);
-  display: flex;
-  flex-direction: column;
-}

apps/web/src/components/features/git/FileViewer.module.css

@@ -1,45 +0,0 @@
-.fileViewer {
-	background: var(--panel);
-	border: 1px solid var(--border);
-	border-radius: 8px;
-	overflow: hidden;
-}
-
-.fileViewerHeader {
-	padding: 0.75rem 1rem;
-	border-bottom: 1px solid var(--border);
-	background: var(--bg);
-}
-
-.fileBreadcrumbs {
-	font-size: 0.875rem;
-	font-family: monospace;
-}
-
-.breadcrumbSep {
-	color: var(--muted);
-	margin: 0 0.25rem;
-}
-
-.fileContent {
-	padding: 1rem;
-	overflow: auto;
-	max-height: calc(100vh - 200px);
-}
-
-.fileContent pre {
-	margin: 0;
-	font-family: "IBM Plex Mono", monospace;
-	font-size: 0.875rem;
-	line-height: 1.5;
-	white-space: pre-wrap;
-	word-wrap: break-word;
-}
-
-.fileViewerEmpty {
-	display: flex;
-	align-items: center;
-	justify-content: center;
-	height: 100%;
-	min-height: 300px;
-}