summaryrefslogblamecommitdiff
path: root/makima/src/server/handlers/mesh.rs
blob: 2d90a043b7cd889765cb5e08d7ae66c1065a8985 (plain) (tree)
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776























































































































































































































                                                                                            




















                                                                                                                          














































                                                                                 



















                                                                                                                                       

























                                                                                 

                                                              








                                                                





















                                                                                                                          


































































































































































































































































                                                                                                         

                                                                  












































                                                                                                           

                                          

      







                                             























































































































































































































































































                                                                                                         




                                                                                               













                                                                                       
                                                                                          

                                                                    

















                                                                      






































































































































































































































































































































































































































































































































































































































































































































































































                                                                                                                          
//! HTTP handlers for task and daemon mesh operations.

use axum::{
    extract::{Path, State},
    http::{HeaderMap, StatusCode},
    response::IntoResponse,
    Json,
};
use uuid::Uuid;

use crate::db::models::{
    CreateTaskRequest, DaemonDirectory, DaemonDirectoriesResponse, DaemonListResponse,
    SendMessageRequest, Task, TaskEventListResponse, TaskListResponse, TaskOutputEntry,
    TaskOutputResponse, TaskWithSubtasks, UpdateTaskRequest,
};
use crate::db::repository::{self, RepositoryError};
use crate::server::auth::Authenticated;
use crate::server::messages::ApiError;
use crate::server::state::{DaemonCommand, SharedState, TaskUpdateNotification};

// =============================================================================
// Authentication Types
// =============================================================================

/// Source of authentication for mesh endpoints.
#[derive(Debug, Clone)]
pub enum AuthSource {
    /// Authenticated via tool key (orchestrator accessing API).
    /// Contains the task ID that owns this key.
    ToolKey(Uuid),
    /// Authenticated via user token (web client).
    /// Contains the user ID. (Not implemented yet)
    #[allow(dead_code)]
    UserToken(Uuid),
    /// No authentication provided (anonymous access).
    Anonymous,
}

/// Header name for tool key authentication.
pub const TOOL_KEY_HEADER: &str = "x-makima-tool-key";

/// Extract authentication source from request headers.
///
/// Checks for:
/// 1. `X-Makima-Tool-Key` header for orchestrator tool access
/// 2. `Authorization: Bearer` header for user access (future)
/// 3. Falls back to Anonymous if no auth provided
pub fn extract_auth(state: &SharedState, headers: &HeaderMap) -> AuthSource {
    // Check for tool key header first
    if let Some(tool_key) = headers.get(TOOL_KEY_HEADER) {
        if let Ok(key_str) = tool_key.to_str() {
            if let Some(task_id) = state.validate_tool_key(key_str) {
                return AuthSource::ToolKey(task_id);
            }
            tracing::warn!("Invalid tool key provided");
        }
    }

    // Check for Authorization header (future user auth)
    if let Some(auth_header) = headers.get("authorization") {
        if let Ok(auth_str) = auth_header.to_str() {
            if auth_str.starts_with("Bearer ") {
                // Future: validate JWT and extract user ID
                tracing::debug!("Bearer token auth not yet implemented");
            }
        }
    }

    // Default to anonymous
    AuthSource::Anonymous
}

// =============================================================================
// Task Handlers
// =============================================================================

/// List all tasks for the current owner.
#[utoipa::path(
    get,
    path = "/api/v1/mesh/tasks",
    responses(
        (status = 200, description = "List of tasks", body = TaskListResponse),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn list_tasks(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    match repository::list_tasks_for_owner(pool, auth.owner_id).await {
        Ok(tasks) => {
            let total = tasks.len() as i64;
            Json(TaskListResponse { tasks, total }).into_response()
        }
        Err(e) => {
            tracing::error!("Failed to list tasks: {}", e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Get a single task by ID with its subtasks (scoped by owner).
#[utoipa::path(
    get,
    path = "/api/v1/mesh/tasks/{id}",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    responses(
        (status = 200, description = "Task details with subtasks", body = TaskWithSubtasks),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn get_task(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(task)) => {
            // Get subtasks for this task (also scoped by owner)
            match repository::list_subtasks_for_owner(pool, id, auth.owner_id).await {
                Ok(subtasks) => Json(TaskWithSubtasks { task, subtasks }).into_response(),
                Err(e) => {
                    tracing::error!("Failed to get subtasks for task {}: {}", id, e);
                    (
                        StatusCode::INTERNAL_SERVER_ERROR,
                        Json(ApiError::new("DB_ERROR", e.to_string())),
                    )
                        .into_response()
                }
            }
        }
        Ok(None) => (
            StatusCode::NOT_FOUND,
            Json(ApiError::new("NOT_FOUND", "Task not found")),
        )
            .into_response(),
        Err(e) => {
            tracing::error!("Failed to get task {}: {}", id, e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Create a new task.
#[utoipa::path(
    post,
    path = "/api/v1/mesh/tasks",
    request_body = CreateTaskRequest,
    responses(
        (status = 201, description = "Task created", body = Task),
        (status = 400, description = "Invalid request", body = ApiError),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn create_task(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Json(req): Json<CreateTaskRequest>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    match repository::create_task_for_owner(pool, auth.owner_id, req).await {
        Ok(task) => {
            // Notify supervisor of new task creation if task belongs to a contract
            if let Some(contract_id) = task.contract_id {
                if !task.is_supervisor {
                    let pool = pool.clone();
                    let state_clone = state.clone();
                    let task_clone = task.clone();
                    tokio::spawn(async move {
                        if let Ok(Some(supervisor)) = repository::get_contract_supervisor_task(&pool, contract_id).await {
                            state_clone.notify_supervisor_of_task_created(
                                supervisor.id,
                                supervisor.daemon_id,
                                task_clone.id,
                                &task_clone.name,
                            ).await;
                        }
                    });
                }
            }
            (StatusCode::CREATED, Json(task)).into_response()
        }
        Err(e) => {
            tracing::error!("Failed to create task: {}", e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Update an existing task (scoped by owner).
#[utoipa::path(
    put,
    path = "/api/v1/mesh/tasks/{id}",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    request_body = UpdateTaskRequest,
    responses(
        (status = 200, description = "Task updated", body = Task),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 409, description = "Version conflict", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn update_task(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
    Json(req): Json<UpdateTaskRequest>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Check if trying to set a supervisor task to a terminal status
    if let Some(ref new_status) = req.status {
        let terminal_statuses = ["done", "failed", "merged"];
        if terminal_statuses.contains(&new_status.as_str()) {
            // Get the task to check if it's a supervisor
            if let Ok(Some(task)) = repository::get_task_for_owner(pool, id, auth.owner_id).await {
                if task.is_supervisor {
                    return (
                        StatusCode::BAD_REQUEST,
                        Json(ApiError::new(
                            "SUPERVISOR_CANNOT_COMPLETE",
                            "Supervisor tasks cannot be marked as done, failed, or merged. They run for the lifetime of the contract.",
                        )),
                    )
                        .into_response();
                }
            }
        }
    }

    // Track which fields are being updated for the notification
    let mut updated_fields = Vec::new();
    if req.name.is_some() {
        updated_fields.push("name".to_string());
    }
    if req.description.is_some() {
        updated_fields.push("description".to_string());
    }
    if req.status.is_some() {
        updated_fields.push("status".to_string());
    }
    if req.priority.is_some() {
        updated_fields.push("priority".to_string());
    }
    if req.plan.is_some() {
        updated_fields.push("plan".to_string());
    }
    if req.progress_summary.is_some() {
        updated_fields.push("progress_summary".to_string());
    }
    if req.error_message.is_some() {
        updated_fields.push("error_message".to_string());
    }

    match repository::update_task_for_owner(pool, id, auth.owner_id, req).await {
        Ok(Some(task)) => {
            let updated_fields_clone = updated_fields.clone();

            // Broadcast task update notification
            state.broadcast_task_update(TaskUpdateNotification {
                task_id: task.id,
                owner_id: Some(auth.owner_id),
                version: task.version,
                status: task.status.clone(),
                updated_fields,
                updated_by: "user".to_string(),
            });

            // Notify supervisor of status change if task belongs to a contract
            if let Some(contract_id) = task.contract_id {
                if !task.is_supervisor && updated_fields_clone.contains(&"status".to_string()) {
                    let pool = pool.clone();
                    let state_clone = state.clone();
                    let task_clone = task.clone();
                    tokio::spawn(async move {
                        if let Ok(Some(supervisor)) = repository::get_contract_supervisor_task(&pool, contract_id).await {
                            state_clone.notify_supervisor_of_task_update(
                                supervisor.id,
                                supervisor.daemon_id,
                                task_clone.id,
                                &task_clone.name,
                                &task_clone.status,
                                &updated_fields_clone,
                            ).await;
                        }
                    });
                }
            }

            Json(task).into_response()
        }
        Ok(None) => (
            StatusCode::NOT_FOUND,
            Json(ApiError::new("NOT_FOUND", "Task not found")),
        )
            .into_response(),
        Err(RepositoryError::VersionConflict { expected, actual }) => {
            tracing::info!(
                "Version conflict on task {}: expected {}, actual {}",
                id,
                expected,
                actual
            );
            (
                StatusCode::CONFLICT,
                Json(serde_json::json!({
                    "code": "VERSION_CONFLICT",
                    "message": format!(
                        "Task was modified by another user. Expected version {}, actual version {}",
                        expected, actual
                    ),
                    "expectedVersion": expected,
                    "actualVersion": actual,
                })),
            )
                .into_response()
        }
        Err(RepositoryError::Database(e)) => {
            tracing::error!("Failed to update task {}: {}", id, e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Delete a task (scoped by owner).
#[utoipa::path(
    delete,
    path = "/api/v1/mesh/tasks/{id}",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    responses(
        (status = 204, description = "Task deleted"),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn delete_task(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Get the task first to check if it's running and needs to be stopped
    if let Ok(Some(task)) = repository::get_task_for_owner(pool, id, auth.owner_id).await {
        let is_active = matches!(
            task.status.as_str(),
            "running" | "starting" | "initializing" | "paused"
        );

        // If task is active and has a daemon, send interrupt command
        if is_active {
            if let Some(daemon_id) = task.daemon_id {
                let command = DaemonCommand::InterruptTask {
                    task_id: id,
                    graceful: false,
                };
                if let Err(e) = state.send_daemon_command(daemon_id, command).await {
                    tracing::warn!(
                        task_id = %id,
                        daemon_id = %daemon_id,
                        "Failed to send InterruptTask before delete: {}",
                        e
                    );
                } else {
                    tracing::info!(
                        task_id = %id,
                        daemon_id = %daemon_id,
                        "Sent InterruptTask before delete"
                    );
                }
            }
        }
    }

    match repository::delete_task_for_owner(pool, id, auth.owner_id).await {
        Ok(true) => StatusCode::NO_CONTENT.into_response(),
        Ok(false) => (
            StatusCode::NOT_FOUND,
            Json(ApiError::new("NOT_FOUND", "Task not found")),
        )
            .into_response(),
        Err(e) => {
            tracing::error!("Failed to delete task {}: {}", id, e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Start a task by sending it to an available daemon (scoped by owner).
#[utoipa::path(
    post,
    path = "/api/v1/mesh/tasks/{id}/start",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    responses(
        (status = 200, description = "Task started", body = Task),
        (status = 400, description = "Task cannot be started", body = ApiError),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured or no daemons available", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn start_task(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    headers: HeaderMap,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    // Extract authentication to log who is starting the task
    let legacy_auth = extract_auth(&state, &headers);
    match &legacy_auth {
        AuthSource::ToolKey(orchestrator_id) => {
            tracing::info!(
                task_id = %id,
                orchestrator_task_id = %orchestrator_id,
                owner_id = %auth.owner_id,
                "Orchestrator starting subtask via tool key"
            );
        }
        AuthSource::Anonymous => {
            tracing::info!(
                task_id = %id,
                owner_id = %auth.owner_id,
                "Starting task (user request)"
            );
        }
        AuthSource::UserToken(user_id) => {
            tracing::info!(
                task_id = %id,
                user_id = %user_id,
                owner_id = %auth.owner_id,
                "Starting task via user token"
            );
        }
    }

    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Get the task (scoped by owner)
    let task = match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(t)) => t,
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to get task {}: {}", id, e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    };

    // Check if task can be started (allow pending, failed, interrupted, done, or merged)
    let startable_statuses = ["pending", "failed", "interrupted", "done", "merged"];
    if !startable_statuses.contains(&task.status.as_str()) {
        return (
            StatusCode::BAD_REQUEST,
            Json(ApiError::new(
                "INVALID_STATE",
                format!("Task cannot be started from status: {}", task.status),
            )),
        )
            .into_response();
    }

    // Find an available daemon belonging to this owner
    let target_daemon_id = match state.daemon_connections
        .iter()
        .find(|d| d.value().owner_id == auth.owner_id)
    {
        Some(d) => d.value().id,
        None => {
            return (
                StatusCode::SERVICE_UNAVAILABLE,
                Json(ApiError::new(
                    "NO_DAEMON",
                    "No daemons connected for your account. Cannot start task.",
                )),
            )
                .into_response();
        }
    };

    // Check if this is an orchestrator (depth 0 with subtasks)
    let subtask_count = match repository::list_subtasks_for_owner(pool, id, auth.owner_id).await {
        Ok(subtasks) => {
            tracing::info!(
                task_id = %id,
                subtask_count = subtasks.len(),
                subtask_ids = ?subtasks.iter().map(|s| s.id.to_string()).collect::<Vec<_>>(),
                "Counted subtasks for orchestrator check"
            );
            subtasks.len()
        },
        Err(e) => {
            tracing::warn!("Failed to check subtasks for {}: {}", id, e);
            0
        }
    };
    let is_orchestrator = task.depth == 0 && subtask_count > 0;

    tracing::info!(
        task_id = %id,
        task_depth = task.depth,
        subtask_count = subtask_count,
        is_orchestrator = is_orchestrator,
        is_supervisor = task.is_supervisor,
        "Starting task with orchestrator/supervisor determination"
    );

    // IMPORTANT: Update database FIRST to assign daemon_id before sending command
    // This prevents race conditions where the task starts but daemon_id is not set
    let update_req = UpdateTaskRequest {
        status: Some("starting".to_string()),
        daemon_id: Some(target_daemon_id),
        version: Some(task.version),
        ..Default::default()
    };

    let updated_task = match repository::update_task_for_owner(pool, id, auth.owner_id, update_req).await {
        Ok(Some(t)) => t,
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to update task status: {}", e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    };

    // Send SpawnTask command to daemon
    let command = DaemonCommand::SpawnTask {
        task_id: id,
        task_name: task.name.clone(),
        plan: task.plan.clone(),
        repo_url: task.repository_url.clone(),
        base_branch: task.base_branch.clone(),
        target_branch: task.target_branch.clone(),
        parent_task_id: task.parent_task_id,
        depth: task.depth,
        is_orchestrator,
        target_repo_path: task.target_repo_path.clone(),
        completion_action: task.completion_action.clone(),
        continue_from_task_id: task.continue_from_task_id,
        copy_files: task.copy_files.as_ref().and_then(|v| serde_json::from_value(v.clone()).ok()),
        contract_id: task.contract_id,
        is_supervisor: task.is_supervisor,
    };

    tracing::info!(
        task_id = %id,
        is_supervisor = task.is_supervisor,
        is_orchestrator = is_orchestrator,
        daemon_id = %target_daemon_id,
        "Sending SpawnTask command to daemon"
    );

    if let Err(e) = state.send_daemon_command(target_daemon_id, command).await {
        tracing::error!("Failed to send SpawnTask command: {}", e);
        // Rollback: clear daemon_id and reset status since command failed
        let rollback_req = UpdateTaskRequest {
            status: Some("pending".to_string()),
            clear_daemon_id: true, // Explicitly clear daemon_id
            ..Default::default()
        };
        let _ = repository::update_task_for_owner(pool, id, auth.owner_id, rollback_req).await;
        return (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(ApiError::new("DAEMON_ERROR", e)),
        )
            .into_response();
    }

    // Broadcast task update notification
    state.broadcast_task_update(TaskUpdateNotification {
        task_id: id,
        owner_id: Some(auth.owner_id),
        version: updated_task.version,
        status: "starting".to_string(),
        updated_fields: vec!["status".to_string(), "daemon_id".to_string()],
        updated_by: "system".to_string(),
    });

    Json(updated_task).into_response()
}

/// Stop a running task (scoped by owner).
#[utoipa::path(
    post,
    path = "/api/v1/mesh/tasks/{id}/stop",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    responses(
        (status = 200, description = "Task stopped", body = Task),
        (status = 400, description = "Task is not running", body = ApiError),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured or daemon not connected", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn stop_task(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Get the task (scoped by owner)
    let task = match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(t)) => t,
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to get task {}: {}", id, e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    };

    // Check if task is running/active
    let is_active = matches!(
        task.status.as_str(),
        "running" | "starting" | "initializing" | "paused"
    );
    if !is_active {
        return (
            StatusCode::BAD_REQUEST,
            Json(ApiError::new(
                "INVALID_STATE",
                format!("Task cannot be stopped from status: {}", task.status),
            )),
        )
            .into_response();
    }

    // Find the daemon running this task
    let target_daemon_id = if let Some(daemon_id) = task.daemon_id {
        daemon_id
    } else {
        // No daemon assigned, just update status directly
        let update_req = UpdateTaskRequest {
            status: Some("failed".to_string()),
            error_message: Some("Task stopped by user".to_string()),
            version: Some(task.version),
            ..Default::default()
        };

        return match repository::update_task_for_owner(pool, id, auth.owner_id, update_req).await {
            Ok(Some(updated_task)) => {
                state.broadcast_task_update(TaskUpdateNotification {
                    task_id: id,
                    owner_id: Some(auth.owner_id),
                    version: updated_task.version,
                    status: "failed".to_string(),
                    updated_fields: vec!["status".to_string(), "error_message".to_string()],
                    updated_by: "user".to_string(),
                });
                Json(updated_task).into_response()
            }
            Ok(None) => (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response(),
            Err(e) => {
                tracing::error!("Failed to update task status: {}", e);
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    Json(ApiError::new("DB_ERROR", e.to_string())),
                )
                    .into_response()
            }
        };
    };

    // Send InterruptTask command to daemon
    let command = DaemonCommand::InterruptTask {
        task_id: id,
        graceful: false,
    };

    if let Err(e) = state.send_daemon_command(target_daemon_id, command).await {
        tracing::warn!("Failed to send InterruptTask command: {}", e);
        // Daemon might be disconnected - update task status directly
        let update_req = UpdateTaskRequest {
            status: Some("failed".to_string()),
            error_message: Some("Task stopped by user (daemon unavailable)".to_string()),
            version: Some(task.version),
            ..Default::default()
        };

        return match repository::update_task_for_owner(pool, id, auth.owner_id, update_req).await {
            Ok(Some(updated_task)) => {
                state.broadcast_task_update(TaskUpdateNotification {
                    task_id: id,
                    owner_id: Some(auth.owner_id),
                    version: updated_task.version,
                    status: "failed".to_string(),
                    updated_fields: vec!["status".to_string(), "error_message".to_string()],
                    updated_by: "user".to_string(),
                });
                Json(updated_task).into_response()
            }
            Ok(None) => (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response(),
            Err(e) => {
                tracing::error!("Failed to update task status: {}", e);
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    Json(ApiError::new("DB_ERROR", e.to_string())),
                )
                    .into_response()
            }
        };
    }

    // Update task status to "failed" (stopped)
    let update_req = UpdateTaskRequest {
        status: Some("failed".to_string()),
        error_message: Some("Task stopped by user".to_string()),
        version: Some(task.version),
        ..Default::default()
    };

    match repository::update_task_for_owner(pool, id, auth.owner_id, update_req).await {
        Ok(Some(updated_task)) => {
            // Broadcast task update notification
            state.broadcast_task_update(TaskUpdateNotification {
                task_id: id,
                owner_id: Some(auth.owner_id),
                version: updated_task.version,
                status: "failed".to_string(),
                updated_fields: vec!["status".to_string(), "error_message".to_string()],
                updated_by: "user".to_string(),
            });

            Json(updated_task).into_response()
        }
        Ok(None) => (
            StatusCode::NOT_FOUND,
            Json(ApiError::new("NOT_FOUND", "Task not found")),
        )
            .into_response(),
        Err(e) => {
            tracing::error!("Failed to update task status: {}", e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Send a message to a running task's stdin (scoped by owner).
///
/// This can be used to provide input to Claude Code when it's waiting for user input,
/// or to inject context/instructions into a running task.
#[utoipa::path(
    post,
    path = "/api/v1/mesh/tasks/{id}/message",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    request_body = SendMessageRequest,
    responses(
        (status = 200, description = "Message sent successfully"),
        (status = 400, description = "Task is not running", body = ApiError),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured or daemon not connected", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn send_message(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
    Json(req): Json<SendMessageRequest>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Get the task (scoped by owner)
    let task = match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(t)) => t,
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to get task {}: {}", id, e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    };

    // Check if task is running (except for AUTH_CODE messages and supervisor tasks)
    // Supervisor tasks can receive messages even when not running - daemon will respawn Claude
    let is_auth_code = req.message.starts_with("AUTH_CODE:");
    let is_supervisor = task.is_supervisor;
    if task.status != "running" && !is_auth_code && !is_supervisor {
        return (
            StatusCode::BAD_REQUEST,
            Json(ApiError::new(
                "INVALID_STATE",
                format!(
                    "Cannot send message to task in status: {}. Task must be running.",
                    task.status
                ),
            )),
        )
            .into_response();
    }

    // Find the daemon running this task
    // For supervisors, if no daemon is assigned, find any available daemon for this owner
    let target_daemon_id = if let Some(daemon_id) = task.daemon_id {
        daemon_id
    } else if is_supervisor {
        // Supervisor without daemon - find one
        match state.daemon_connections
            .iter()
            .find(|d| d.value().owner_id == auth.owner_id)
        {
            Some(entry) => entry.value().id,
            None => {
                return (
                    StatusCode::SERVICE_UNAVAILABLE,
                    Json(ApiError::new(
                        "NO_DAEMON",
                        "No daemon available. Please start a daemon.",
                    )),
                )
                    .into_response();
            }
        }
    } else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new(
                "NO_DAEMON",
                "Task has no assigned daemon. Cannot send message.",
            )),
        )
            .into_response();
    };

    // Send SendMessage command to daemon
    let command = DaemonCommand::SendMessage {
        task_id: id,
        message: req.message.clone(),
    };

    if let Err(e) = state.send_daemon_command(target_daemon_id, command).await {
        tracing::error!("Failed to send SendMessage command: {}", e);
        return (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(ApiError::new("DAEMON_ERROR", e)),
        )
            .into_response();
    }

    tracing::info!(task_id = %id, message_len = req.message.len(), "Message sent to task");

    // Return success
    (
        StatusCode::OK,
        Json(serde_json::json!({
            "success": true,
            "taskId": id,
            "messageLength": req.message.len()
        })),
    )
        .into_response()
}

/// Get task output history (scoped by owner).
///
/// Retrieves all recorded output from a task's Claude Code process.
/// This allows the frontend to fetch missed output when subscribing late
/// or reconnecting after a disconnect.
#[utoipa::path(
    get,
    path = "/api/v1/mesh/tasks/{id}/output",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    responses(
        (status = 200, description = "Task output history", body = TaskOutputResponse),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn get_task_output(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Verify task exists and belongs to owner
    match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(_)) => {}
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to get task: {}", e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    }

    // Get output history (task already verified to belong to owner)
    match repository::get_task_output(pool, id, None).await {
        Ok(events) => {
            let entries: Vec<TaskOutputEntry> = events
                .into_iter()
                .filter_map(TaskOutputEntry::from_task_event)
                .collect();
            let total = entries.len();

            Json(TaskOutputResponse {
                entries,
                total,
                task_id: id,
            })
            .into_response()
        }
        Err(e) => {
            tracing::error!("Failed to get task output: {}", e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// List subtasks for a parent task (scoped by owner).
#[utoipa::path(
    get,
    path = "/api/v1/mesh/tasks/{id}/subtasks",
    params(
        ("id" = Uuid, Path, description = "Parent task ID")
    ),
    responses(
        (status = 200, description = "List of subtasks", body = TaskListResponse),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn list_subtasks(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    match repository::list_subtasks_for_owner(pool, id, auth.owner_id).await {
        Ok(tasks) => {
            let total = tasks.len() as i64;
            Json(TaskListResponse { tasks, total }).into_response()
        }
        Err(e) => {
            tracing::error!("Failed to list subtasks for task {}: {}", id, e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// List events for a task (scoped by owner).
#[utoipa::path(
    get,
    path = "/api/v1/mesh/tasks/{id}/events",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    responses(
        (status = 200, description = "List of task events", body = TaskEventListResponse),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn list_task_events(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Verify task exists and belongs to owner
    match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(_)) => {}
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to get task: {}", e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    }

    match repository::list_task_events(pool, id, None).await {
        Ok(events) => {
            let total = events.len() as i64;
            Json(TaskEventListResponse { events, total }).into_response()
        }
        Err(e) => {
            tracing::error!("Failed to list events for task {}: {}", id, e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Retry completion action for a completed task (scoped by owner).
///
/// This allows retrying a completion action (push branch, merge, create PR)
/// after filling in the target_repo_path if it wasn't set when the task completed.
#[utoipa::path(
    post,
    path = "/api/v1/mesh/tasks/{id}/retry-completion",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    responses(
        (status = 200, description = "Completion action initiated"),
        (status = 400, description = "Invalid request (task not completed, no completion action, etc.)", body = ApiError),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured or daemon not connected", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn retry_completion_action(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Get the task (scoped by owner)
    let task = match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(t)) => t,
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to get task {}: {}", id, e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    };

    // Check if task is in a terminal state
    let terminal_statuses = ["done", "failed", "merged"];
    if !terminal_statuses.contains(&task.status.as_str()) {
        return (
            StatusCode::BAD_REQUEST,
            Json(ApiError::new(
                "INVALID_STATE",
                format!(
                    "Task must be completed to retry completion action. Current status: {}",
                    task.status
                ),
            )),
        )
            .into_response();
    }

    // Check if completion action is set
    let action = match &task.completion_action {
        Some(action) if action != "none" => action.clone(),
        _ => {
            return (
                StatusCode::BAD_REQUEST,
                Json(ApiError::new(
                    "NO_COMPLETION_ACTION",
                    "Task has no completion action configured (or is set to 'none')",
                )),
            )
                .into_response();
        }
    };

    // Check if target_repo_path is set
    let target_repo_path = match &task.target_repo_path {
        Some(path) if !path.is_empty() => path.clone(),
        _ => {
            return (
                StatusCode::BAD_REQUEST,
                Json(ApiError::new(
                    "NO_TARGET_REPO",
                    "Target repository path must be set before retrying completion action",
                )),
            )
                .into_response();
        }
    };

    // Note: We don't check overlay_path here because the server may not have it
    // The daemon will scan its worktrees directory to find the worktree by task ID

    // Find a daemon to execute the action (must belong to this owner)
    // Prefer the daemon that ran the task, but fall back to any available daemon for this owner
    let target_daemon_id = if let Some(daemon_id) = task.daemon_id {
        // Check if this daemon is still connected and belongs to this owner
        if state.daemon_connections.iter().any(|d| d.value().id == daemon_id && d.value().owner_id == auth.owner_id) {
            daemon_id
        } else {
            // Fall back to any connected daemon for this owner
            match state.daemon_connections.iter().find(|d| d.value().owner_id == auth.owner_id) {
                Some(d) => d.value().id,
                None => {
                    return (
                        StatusCode::SERVICE_UNAVAILABLE,
                        Json(ApiError::new(
                            "NO_DAEMON",
                            "No daemons connected for your account. Cannot execute completion action.",
                        )),
                    )
                        .into_response();
                }
            }
        }
    } else {
        // No daemon assigned - use any available for this owner
        match state.daemon_connections.iter().find(|d| d.value().owner_id == auth.owner_id) {
            Some(d) => d.value().id,
            None => {
                return (
                    StatusCode::SERVICE_UNAVAILABLE,
                    Json(ApiError::new(
                        "NO_DAEMON",
                        "No daemons connected for your account. Cannot execute completion action.",
                    )),
                )
                    .into_response();
            }
        }
    };

    // Send RetryCompletionAction command to daemon
    let command = DaemonCommand::RetryCompletionAction {
        task_id: id,
        task_name: task.name.clone(),
        action: action.clone(),
        target_repo_path: target_repo_path.clone(),
        target_branch: task.target_branch.clone(),
    };

    if let Err(e) = state.send_daemon_command(target_daemon_id, command).await {
        tracing::error!("Failed to send RetryCompletionAction command: {}", e);
        return (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(ApiError::new("DAEMON_ERROR", e)),
        )
            .into_response();
    }

    tracing::info!(
        task_id = %id,
        action = %action,
        target_repo = %target_repo_path,
        "Retry completion action initiated"
    );

    (
        StatusCode::OK,
        Json(serde_json::json!({
            "success": true,
            "taskId": id,
            "action": action,
            "targetRepoPath": target_repo_path,
            "message": "Completion action initiated. Check task output for results."
        })),
    )
        .into_response()
}

// =============================================================================
// Daemon Handlers
// =============================================================================

/// List all connected daemons (requires authentication).
#[utoipa::path(
    get,
    path = "/api/v1/mesh/daemons",
    responses(
        (status = 200, description = "List of daemons", body = DaemonListResponse),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn list_daemons(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Only list daemons belonging to this owner
    match repository::list_daemons_for_owner(pool, auth.owner_id).await {
        Ok(daemons) => {
            let total = daemons.len() as i64;
            Json(DaemonListResponse { daemons, total }).into_response()
        }
        Err(e) => {
            tracing::error!("Failed to list daemons: {}", e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Get a single daemon by ID (requires authentication).
#[utoipa::path(
    get,
    path = "/api/v1/mesh/daemons/{id}",
    params(
        ("id" = Uuid, Path, description = "Daemon ID")
    ),
    responses(
        (status = 200, description = "Daemon details", body = crate::db::models::Daemon),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Daemon not found", body = ApiError),
        (status = 503, description = "Database not configured", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn get_daemon(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Only get daemon if it belongs to this owner
    match repository::get_daemon_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(daemon)) => Json(daemon).into_response(),
        Ok(None) => (
            StatusCode::NOT_FOUND,
            Json(ApiError::new("NOT_FOUND", "Daemon not found")),
        )
            .into_response(),
        Err(e) => {
            tracing::error!("Failed to get daemon {}: {}", id, e);
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response()
        }
    }
}

/// Get suggested directories from connected daemons (requires authentication).
///
/// Returns directories that can be used as target_repo_path for completion actions.
#[utoipa::path(
    get,
    path = "/api/v1/mesh/daemons/directories",
    responses(
        (status = 200, description = "List of suggested directories", body = DaemonDirectoriesResponse),
        (status = 401, description = "Unauthorized", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn get_daemon_directories(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
) -> impl IntoResponse {
    let mut directories = Vec::new();

    // Iterate over connected daemons belonging to this owner and collect their directories
    for entry in state.daemon_connections.iter() {
        let daemon = entry.value();

        // Only include daemons belonging to this owner
        if daemon.owner_id != auth.owner_id {
            continue;
        }

        // Add working directory if available
        if let Some(ref working_dir) = daemon.working_directory {
            directories.push(DaemonDirectory {
                path: working_dir.clone(),
                label: "Working Directory".to_string(),
                directory_type: "working".to_string(),
                hostname: daemon.hostname.clone(),
                exists: None,
            });
        }

        // Add home directory if available (for cloning completed work)
        if let Some(ref home_dir) = daemon.home_directory {
            directories.push(DaemonDirectory {
                path: home_dir.clone(),
                label: "Makima Home".to_string(),
                directory_type: "home".to_string(),
                hostname: daemon.hostname.clone(),
                exists: None,
            });
        }
    }

    Json(DaemonDirectoriesResponse { directories })
}

/// Request to clone a worktree to a target directory.
#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
#[serde(rename_all = "camelCase")]
pub struct CloneWorktreeRequest {
    /// Path to the target directory.
    pub target_dir: String,
}

/// Clone a task's worktree to a target directory (scoped by owner).
#[utoipa::path(
    post,
    path = "/api/v1/mesh/tasks/{id}/clone",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    request_body = CloneWorktreeRequest,
    responses(
        (status = 200, description = "Clone command sent"),
        (status = 400, description = "Invalid request or task not completed", body = ApiError),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 404, description = "Task not found", body = ApiError),
        (status = 503, description = "Database not configured or daemon not connected", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn clone_worktree(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
    Json(body): Json<CloneWorktreeRequest>,
) -> impl IntoResponse {
    let Some(ref pool) = state.db_pool else {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(ApiError::new("DB_UNAVAILABLE", "Database not configured")),
        )
            .into_response();
    };

    // Get the task (scoped by owner)
    let task = match repository::get_task_for_owner(pool, id, auth.owner_id).await {
        Ok(Some(t)) => t,
        Ok(None) => {
            return (
                StatusCode::NOT_FOUND,
                Json(ApiError::new("NOT_FOUND", "Task not found")),
            )
                .into_response();
        }
        Err(e) => {
            tracing::error!("Failed to get task {}: {}", id, e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(ApiError::new("DB_ERROR", e.to_string())),
            )
                .into_response();
        }
    };

    // Verify task is in a completed state
    let is_completed = matches!(task.status.as_str(), "done" | "failed" | "merged");
    if !is_completed {
        return (
            StatusCode::BAD_REQUEST,
            Json(ApiError::new(
                "INVALID_STATE",
                format!("Task must be completed to clone (current status: {})", task.status),
            )),
        )
            .into_response();
    }

    // Find a connected daemon belonging to this owner to send the command
    let daemon_entry = state.daemon_connections.iter().find(|d| d.value().owner_id == auth.owner_id);
    let daemon_id = match daemon_entry {
        Some(entry) => entry.value().id,
        None => {
            return (
                StatusCode::SERVICE_UNAVAILABLE,
                Json(ApiError::new("NO_DAEMON", "No daemon connected for your account")),
            )
                .into_response();
        }
    };

    // Send CloneWorktree command to daemon
    let command = DaemonCommand::CloneWorktree {
        task_id: id,
        target_dir: body.target_dir.clone(),
    };

    if let Err(e) = state.send_daemon_command(daemon_id, command).await {
        tracing::error!("Failed to send CloneWorktree command: {}", e);
        return (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(ApiError::new("DAEMON_ERROR", e)),
        )
            .into_response();
    }

    Json(serde_json::json!({
        "status": "cloning",
        "taskId": id.to_string(),
        "targetDir": body.target_dir,
    }))
    .into_response()
}

/// Request to check if a target directory exists.
#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
#[serde(rename_all = "camelCase")]
pub struct CheckTargetExistsRequest {
    /// Path to check.
    pub target_dir: String,
}

/// Response for check target exists.
#[derive(Debug, serde::Serialize, utoipa::ToSchema)]
#[serde(rename_all = "camelCase")]
pub struct CheckTargetExistsResponse {
    /// Whether the target directory exists.
    pub exists: bool,
    /// The path that was checked (expanded).
    pub target_dir: String,
}

/// Check if a target directory exists (for clone validation, requires authentication).
#[utoipa::path(
    post,
    path = "/api/v1/mesh/tasks/{id}/check-target",
    params(
        ("id" = Uuid, Path, description = "Task ID")
    ),
    request_body = CheckTargetExistsRequest,
    responses(
        (status = 200, description = "Check result", body = CheckTargetExistsResponse),
        (status = 401, description = "Unauthorized", body = ApiError),
        (status = 503, description = "No daemon connected", body = ApiError),
        (status = 500, description = "Internal server error", body = ApiError),
    ),
    security(
        ("bearer_auth" = []),
        ("api_key" = [])
    ),
    tag = "Mesh"
)]
pub async fn check_target_exists(
    State(state): State<SharedState>,
    Authenticated(auth): Authenticated,
    Path(id): Path<Uuid>,
    Json(body): Json<CheckTargetExistsRequest>,
) -> impl IntoResponse {
    // Find a connected daemon belonging to this owner to send the command
    let daemon_entry = state.daemon_connections.iter().find(|d| d.value().owner_id == auth.owner_id);
    let daemon_id = match daemon_entry {
        Some(entry) => entry.value().id,
        None => {
            return (
                StatusCode::SERVICE_UNAVAILABLE,
                Json(ApiError::new("NO_DAEMON", "No daemon connected for your account")),
            )
                .into_response();
        }
    };

    // Send CheckTargetExists command to daemon
    let command = DaemonCommand::CheckTargetExists {
        task_id: id,
        target_dir: body.target_dir.clone(),
    };

    if let Err(e) = state.send_daemon_command(daemon_id, command).await {
        tracing::error!("Failed to send CheckTargetExists command: {}", e);
        return (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(ApiError::new("DAEMON_ERROR", e)),
        )
            .into_response();
    }

    // The actual result will be sent back via WebSocket
    // For now, just acknowledge the request was sent
    Json(serde_json::json!({
        "status": "checking",
        "taskId": id.to_string(),
        "targetDir": body.target_dir,
    }))
    .into_response()
}