Verification after commit d4c02a3 found Hono matching /:id BEFORE /activity
when the bare /api/agents/activity request hit the API — Postgres returned a
500 cast error because id='activity' was not a valid UUID.
Two changes:
1. Move GET /api/agents/activity registration to BEFORE GET /:id so Hono's
matcher picks the static path before the param path.
2. Add a UUID-format guard at the top of GET /api/agents/:id — returns
404 when id is not a UUID. Defense in depth: prevents future 500s if
a similarly-shaped static route collides with /:id.
Parent: t_e1cbd87d
Continuation of the T10 test report fixes (45d0810). The prior workers
for these bugs wrote the code but died before committing. This commit
captures their work and additionally restores a GET /:id/permissions
route that the prior helper-script accidentally deleted.
- Bug #4 HIGH: GET /api/agents/_all/activity now skips the WHERE clause
when the SPA passes '_all' as the id.
- Bug #5 MED: Settings > Appearance tab now reads/writes useThemeStore
(Zustand) so theme changes are consistent with the command palette.
- Bug #6 HIGH: /projects/:id detail page now exists. Plus 4 sibling
detail pages (tasks/:id, habits/:id, notes/:id, canvas/:id) wired
into the route tree.
- Bug #8 MED: GET /api/agents/activity (bare path) now returns the
last 100 activity items instead of falling into /:id/activity with
id='activity' (which failed the UUID cast).
- Bug #10 LOW: tasks/:id, habits/:id, notes/:id, canvas/:id detail
pages are now committed (the worker that wrote them never committed).
- graph.tsx and index.tsx overlap with earlier committed fixes
(t_cc5d9887 and t_296f0121); changes are additive and don't regress.
Also restores GET /api/agents/:id/permissions which the prior helper
script accidentally removed when reformatting agents.ts.
Parent: t_e1cbd87d
Hermes