Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/api/admin/bots/mark-read.ts

@@ -0,0 +1,39 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import markBotRead from "@/src/functions/backend/db/bots/mark-bot-read";
+import { BotIdRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Clears a bot's unread flag when a message arrives in the conversation
+ * the user has open. Only the session user's own bots.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
+    req,
+    body,
+}) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        const { bot_id } = parseWithSchema({ schema: BotIdRequestSchema, data: body });
+
+        await markBotRead({ bot_id, user_id: user.id });
+
+        return { success: true };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/save-harness-settings.ts

@@ -0,0 +1,93 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabUserBot from "@/src/functions/backend/db/bots/grab-user-bot";
+import grabBotHarnessOverview from "@/src/functions/backend/db/harness/grab-bot-harness-overview";
+import grabHarnessSetting from "@/src/functions/backend/db/harness/grab-harness-setting";
+import saveBotHarnessSetting from "@/src/functions/backend/db/harness/save-bot-harness-setting";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SaveBotHarnessSettingsRequestSchema } from "@/src/schemas/harness-schema";
+import type { BotHarnessOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves which model each harness uses for one of the session user's
+ * worker bots. The coordinator always uses the defaults.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BotHarnessOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, settings } = parseWithSchema({
+            schema: SaveBotHarnessSettingsRequestSchema,
+            data: body,
+        });
+
+        const bot = await grabUserBot({ bot_id, user_id: user.id });
+
+        if (!bot?.id) {
+            throw new AppError(`Bot not found.`);
+        }
+
+        if (bot.kind == "coordinator") {
+            throw new AppError(
+                `The coordinator uses the default models. A super admin can change them in Settings, under Models.`,
+            );
+        }
+
+        for (const setting of settings) {
+            const existing = await grabHarnessSetting({ harness: setting.harness, bot_id: bot.id });
+            const { voice, ...options } = existing.source == "bot" ? existing.options : {};
+
+            await saveBotHarnessSetting({
+                bot_id: bot.id,
+                harness: setting.harness,
+                inherit: setting.inherit,
+                model_id: setting.model_id,
+                provider_id: setting.provider_id,
+                fallback: setting.fallback,
+                enabled: setting.enabled,
+                options: setting.voice ? { ...options, voice: setting.voice } : options,
+            });
+        }
+
+        await logEvent({
+            title: "Bot model settings changed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} changed ${bot.name}'s model settings for ${settings.map((s) => s.harness).join(", ")}.`,
+            metadata: { bot_id: bot.id, settings },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            singleRes: await grabBotHarnessOverview({ bot_id: bot.id }),
+        };
+    } catch (error: unknown) {
+        return {
+            success: false,
+            msg: safeErrorMessage({ error }),
+        };
+    }
+};

src/pages/api/admin/bots/send-message.ts

@@ -1,6 +1,10 @@
 import userAuth from "@/src/functions/backend/auth/user-auth";
 import grabUserBot from "@/src/functions/backend/db/bots/grab-user-bot";
 import insertUserMessage from "@/src/functions/backend/db/bots/insert-user-message";
+import grabAttachableMedia from "@/src/functions/backend/db/bots/grab-attachable-media";
+import enqueueBotReply from "@/src/functions/backend/db/bots-queue/enqueue-bot-reply";
+import pushBotNotice from "@/src/bots-queue/push-bot-notice";
+import wakeBotsQueue from "@/src/bots-queue/wake-bots-queue";
 import { SendBotMessageRequestSchema } from "@/src/schemas/bot-schema";
 import parseWithSchema from "@/src/utils/parse-with-schema";
 import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
@@ -12,7 +16,10 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Posts a message from the session user to one of their own bots.
+ * Posts a message from the session user to one of their own bots and
+ * queues the bot's reply, which arrives over the WebSocket. The message
+ * also goes to the user's other open tabs. Files are uploaded first
+ * (`upload-attachment`) and sent as `media_ids`.
  */
 export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
     req,
@@ -37,7 +44,7 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             throw new AppError(`This user can only read records.`);
         }
 
-        const { bot_id, text } = parseWithSchema({
+        const { bot_id, text, media_ids } = parseWithSchema({
             schema: SendBotMessageRequestSchema,
             data: body,
         });
@@ -48,7 +55,18 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             throw new AppError(`Bot not found`);
         }
 
-        const message = await insertUserMessage({ bot_id: bot.id, text });
+        const media = await grabAttachableMedia({ user_id: Number(user.id), media_ids });
+        const message = await insertUserMessage({ bot_id: bot.id, text, media });
+
+        await enqueueBotReply({
+            user_id: user.id,
+            bot_id: bot.id,
+            message_id: message.id || 0,
+        });
+
+        wakeBotsQueue();
+
+        await pushBotNotice({ bot_id: bot.id, message });
 
         return {
             success: true,

src/pages/api/admin/bots/upload-attachment.ts

@@ -0,0 +1,86 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import { logError } from "@/src/functions/backend/logger";
+import mediaToAttachment from "@/src/functions/backend/db/bots/media-to-attachment";
+import uploadAndRecordMedia from "@/src/functions/backend/db/users/media/upload-and-record-media";
+import { AppData } from "@/src/data/app-data";
+import { UploadBotAttachmentRequestSchema } from "@/src/schemas/bot-schema";
+import type { BotMessageAttachment } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import attachmentFileKind from "@/src/utils/attachment-file-kind";
+import bufferFromBase64 from "@/src/utils/buffer-from-base-64";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Stores one file for a chat message, private to the session user, before
+ * the message is sent with its id. Images are resized; documents have
+ * their text pulled out now, so bots can read them later.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BotMessageAttachment>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { data_url, name } = parseWithSchema({
+            schema: UploadBotAttachmentRequestSchema,
+            data: body,
+        });
+
+        const mime = data_url.match(/^data:([^;,]*)/)?.[1] || "";
+        const { media_type, ext } = attachmentFileKind({ mime, name });
+        const { buffer } = await bufferFromBase64(data_url);
+
+        if (!buffer.length) {
+            throw new AppError(`${name} is empty.`);
+        }
+
+        if (buffer.length > AppData.BotAttachmentMaxBytes) {
+            throw new AppError(
+                `${name} is too big. Files can be up to ${Math.round(AppData.BotAttachmentMaxBytes / 1024 / 1024)} MB.`,
+            );
+        }
+
+        const res = await uploadAndRecordMedia({
+            data: buffer,
+            media_type,
+            media_mime_type: ext,
+            media_paradigms: ["bot-attachment"],
+            media: { title: name },
+            extract_media_text_content: media_type == "document",
+            is_private: true,
+            user: { id: Number(user.id) },
+        }).catch(async (error) => {
+            await logError({ title: `Attachment ${name} couldn't be saved`, error }).catch(() => {});
+            throw new AppError(`Couldn't save ${name}. If it's an image, try another format.`);
+        });
+
+        if (!res.singleRes?.id) {
+            throw new AppError(`Couldn't save ${name}.`);
+        }
+
+        return {
+            success: true,
+            singleRes: mediaToAttachment({ media: res.singleRes }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/envs/delete-env.ts

@@ -0,0 +1,64 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_ENVS } from "@/db/types/db";
+import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import deleteEnv from "@/src/functions/backend/db/envs/delete-env";
+import grabEnvsOverview from "@/src/functions/backend/db/envs/grab-envs-overview";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { EnvIdRequestSchema } from "@/src/schemas/env-schema";
+import type { EnvsOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admin only: removes an env.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<EnvsOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const user = await grabSuperAdminUser({ req });
+
+        if (!user?.id) {
+            throw new AppError(`Only a super admin can change the environment.`);
+        }
+
+        const { env_id } = parseWithSchema({ schema: EnvIdRequestSchema, data: body });
+
+        const env = (
+            await BunSQLite.sql<BUN_SQLITE_COBBLE_ENVS>({
+                sql: `SELECT key, paradigm FROM envs WHERE id = ? LIMIT 1`,
+                values: [env_id],
+            })
+        ).payload?.[0];
+
+        if (!env) throw new AppError(`That env no longer exists.`);
+
+        await deleteEnv({ env_id });
+
+        await logEvent({
+            title: "Env removed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} removed ${env.key} (${env.paradigm}).`,
+            metadata: { env_id, key: env.key },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Removed ${env.key}.`,
+            singleRes: await grabEnvsOverview({ user_id: Number(user.id) }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/envs/save-env.ts

@@ -0,0 +1,53 @@
+import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import grabEnvsOverview from "@/src/functions/backend/db/envs/grab-envs-overview";
+import saveEnv from "@/src/functions/backend/db/envs/save-env";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SaveEnvRequestSchema } from "@/src/schemas/env-schema";
+import type { EnvsOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admin only: adds or edits an env. Logged by key, never by value.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<EnvsOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const user = await grabSuperAdminUser({ req });
+
+        if (!user?.id) {
+            throw new AppError(`Only a super admin can change the environment.`);
+        }
+
+        const env = parseWithSchema({ schema: SaveEnvRequestSchema, data: body });
+
+        await saveEnv({ ...env, user_id: Number(user.id) });
+
+        await logEvent({
+            title: env.env_id ? "Env changed" : "Env added",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} ${env.env_id ? "changed" : "added"} ${env.key} (${env.paradigm}${env.workspace_id ? ` #${env.workspace_id}` : env.computer_id ? ` #${env.computer_id}` : ""}).`,
+            metadata: { key: env.key, paradigm: env.paradigm, workspace_id: env.workspace_id, computer_id: env.computer_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Saved ${env.key.trim()}.`,
+            singleRes: await grabEnvsOverview({ user_id: Number(user.id) }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/harness/delete-provider.ts

@@ -0,0 +1,59 @@
+import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import deleteHarnessProvider from "@/src/functions/backend/db/harness/delete-harness-provider";
+import grabHarnessOverview from "@/src/functions/backend/db/harness/grab-harness-overview";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { HarnessProviderIdRequestSchema } from "@/src/schemas/harness-schema";
+import type { HarnessOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admin only: removes a model provider and its models. Harnesses set
+ * to one of them go back to automatic.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<HarnessOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const user = await grabSuperAdminUser({ req });
+
+        if (!user?.id) {
+            throw new AppError(`Only a super admin can remove model providers.`);
+        }
+
+        const { provider_id } = parseWithSchema({
+            schema: HarnessProviderIdRequestSchema,
+            data: body,
+        });
+
+        await deleteHarnessProvider({ provider_id });
+
+        await logEvent({
+            title: "Model provider removed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} removed model provider #${provider_id}.`,
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Provider removed.`,
+            singleRes: await grabHarnessOverview(),
+        };
+    } catch (error: unknown) {
+        return {
+            success: false,
+            msg: safeErrorMessage({ error }),
+        };
+    }
+};

src/pages/api/admin/harness/save-provider.ts

@@ -0,0 +1,77 @@
+import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import grabHarnessOverview from "@/src/functions/backend/db/harness/grab-harness-overview";
+import saveHarnessProvider from "@/src/functions/backend/db/harness/save-harness-provider";
+import syncHarnessProviderModels from "@/src/functions/backend/db/harness/sync-harness-provider-models";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SaveHarnessProviderRequestSchema } from "@/src/schemas/harness-schema";
+import type { HarnessOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admin only: adds or updates a model provider, then fetches its
+ * model list. A failed fetch still saves the provider and says why.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<HarnessOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const user = await grabSuperAdminUser({ req });
+
+        if (!user?.id) {
+            throw new AppError(`Only a super admin can change model providers.`);
+        }
+
+        const request = parseWithSchema({
+            schema: SaveHarnessProviderRequestSchema,
+            data: body,
+        });
+
+        const provider = await saveHarnessProvider(request);
+
+        await logEvent({
+            title: request.provider_id
+                ? "Model provider updated"
+                : "Model provider added",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} ${request.provider_id ? "updated" : "added"} model provider #${provider.id} (${provider.kind}).`,
+            details: [
+                { label: "Key changed", value: Boolean(request.api_key || request.clear_key) },
+                { label: "Enabled", value: request.enabled },
+            ],
+            ip_address: grabRequestIP(req),
+        });
+
+        let msg = `Saved.`;
+
+        if (provider.enabled) {
+            try {
+                const count = await syncHarnessProviderModels({ provider });
+                msg = `Saved. Found ${count} model${count == 1 ? "" : "s"}.`;
+            } catch (error: unknown) {
+                msg = `Saved, but its models couldn't be listed: ${error instanceof Error ? error.message : String(error)}`;
+            }
+        }
+
+        return {
+            success: true,
+            msg,
+            singleRes: await grabHarnessOverview(),
+        };
+    } catch (error: unknown) {
+        return {
+            success: false,
+            msg: safeErrorMessage({ error }),
+        };
+    }
+};

src/pages/api/admin/harness/save-settings.ts

@@ -0,0 +1,72 @@
+import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import grabHarnessOverview from "@/src/functions/backend/db/harness/grab-harness-overview";
+import grabHarnessSetting from "@/src/functions/backend/db/harness/grab-harness-setting";
+import saveHarnessSetting from "@/src/functions/backend/db/harness/save-harness-setting";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SaveHarnessSettingsRequestSchema } from "@/src/schemas/harness-schema";
+import type { HarnessOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admin only: saves which model each harness uses.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<HarnessOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const user = await grabSuperAdminUser({ req });
+
+        if (!user?.id) {
+            throw new AppError(`Only a super admin can change model settings.`);
+        }
+
+        const { settings } = parseWithSchema({
+            schema: SaveHarnessSettingsRequestSchema,
+            data: body,
+        });
+
+        for (const setting of settings) {
+            const existing = await grabHarnessSetting({ harness: setting.harness });
+            const { voice, ...options } = existing.options;
+
+            await saveHarnessSetting({
+                harness: setting.harness,
+                model_id: setting.model_id,
+                provider_id: setting.provider_id,
+                fallback: setting.fallback,
+                enabled: setting.enabled,
+                options: setting.voice ? { ...options, voice: setting.voice } : options,
+            });
+        }
+
+        await logEvent({
+            title: "Model settings changed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} changed the model settings for ${settings.map((s) => s.harness).join(", ")}.`,
+            metadata: { settings },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            singleRes: await grabHarnessOverview(),
+        };
+    } catch (error: unknown) {
+        return {
+            success: false,
+            msg: safeErrorMessage({ error }),
+        };
+    }
+};

src/pages/api/admin/harness/sync-provider.ts

@@ -0,0 +1,66 @@
+import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import grabHarnessOverview from "@/src/functions/backend/db/harness/grab-harness-overview";
+import grabHarnessProviders from "@/src/functions/backend/db/harness/grab-harness-providers";
+import syncHarnessProviderModels from "@/src/functions/backend/db/harness/sync-harness-provider-models";
+import { HarnessProviderIdRequestSchema } from "@/src/schemas/harness-schema";
+import type { HarnessOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admin only: fetches one provider's model list now, instead of
+ * waiting for the hourly sync.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<HarnessOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const user = await grabSuperAdminUser({ req });
+
+        if (!user?.id) {
+            throw new AppError(`Only a super admin can sync model providers.`);
+        }
+
+        const { provider_id } = parseWithSchema({
+            schema: HarnessProviderIdRequestSchema,
+            data: body,
+        });
+
+        const provider = (await grabHarnessProviders({ provider_id }))[0];
+
+        if (!provider) {
+            throw new AppError(`Provider not found.`);
+        }
+
+        let success = true;
+        let msg: string;
+
+        try {
+            const count = await syncHarnessProviderModels({ provider });
+            msg = `Found ${count} model${count == 1 ? "" : "s"}.`;
+        } catch (error: unknown) {
+            success = false;
+            msg = `Couldn't list its models: ${error instanceof Error ? error.message : String(error)}`;
+        }
+
+        return {
+            success,
+            msg,
+            singleRes: await grabHarnessOverview(),
+        };
+    } catch (error: unknown) {
+        return {
+            success: false,
+            msg: safeErrorMessage({ error }),
+        };
+    }
+};