feat: complete Nexus mission-control workflows

backend/Services/AgentConfigService.cs

@@ -1,3 +1,4 @@
+using System.Text.Json;
 using Nexus.Api.Helpers;
 
 namespace Nexus.Api.Services;
@@ -27,6 +28,8 @@ public sealed class AgentConfigService : IAgentConfigService
     {
         if (!PathSecurityHelper.IsValidConfigFileName(fileName))
             return null;
+        if (!AllowedFiles.Contains(fileName))
+            return null;
 
         var workspacePath = $"/mnt/workspace-{agentId}";
         if (!PathSecurityHelper.TryResolveSafePath(workspacePath, fileName, out var safePath) || !File.Exists(safePath))
@@ -37,18 +40,44 @@ public sealed class AgentConfigService : IAgentConfigService
         return new AgentConfigFileContent(fileName, content, fi.Length, fi.LastWriteTimeUtc);
     }
 
-    public async Task<AgentConfigFileSaveResult?> SaveConfigFileAsync(string agentId, string fileName, string content, CancellationToken ct = default)
+    public async Task<AgentConfigSaveAttempt> SaveConfigFileAsync(string agentId, string fileName, string content, CancellationToken ct = default)
     {
-        if (!PathSecurityHelper.IsValidConfigFileName(fileName))
-            return null;
+        var fileKind = DetermineFileKind(fileName);
+        var validation = Validate(fileName, content, fileKind);
+        var backup = new AgentConfigBackupResult("not_applicable", BackupCreated: false);
+        var reload = CreateReloadCheck();
+        if (validation.Errors.Count > 0)
+            return new AgentConfigSaveAttempt(null, new AgentConfigSaveFailure("validation_failed", validation, backup, reload));
 
         var workspacePath = $"/mnt/workspace-{agentId}";
+        if (!Directory.Exists(workspacePath))
+            return new AgentConfigSaveAttempt(
+                null,
+                new AgentConfigSaveFailure(
+                    "workspace_not_found",
+                    new AgentConfigValidationResult("failed", fileKind, ["Agent workspace is not available on this node."]),
+                    backup,
+                    reload));
+
         if (!PathSecurityHelper.TryResolveSafePath(workspacePath, fileName, out var safePath))
-            return null;
+            return new AgentConfigSaveAttempt(
+                null,
+                new AgentConfigSaveFailure(
+                    "invalid_path",
+                    new AgentConfigValidationResult("failed", fileKind, ["Invalid filename or path."]),
+                    backup,
+                    reload));
 
         var tempPath = safePath + ".tmp";
+        var backupPath = safePath + ".bak";
+        var backupCreated = false;
         try
         {
+            if (File.Exists(safePath))
+            {
+                File.Copy(safePath, backupPath, overwrite: true);
+                backupCreated = true;
+            }
             await File.WriteAllTextAsync(tempPath, content, ct);
             File.Move(tempPath, safePath!, overwrite: true);
         }
@@ -59,6 +88,60 @@ public sealed class AgentConfigService : IAgentConfigService
         }
 
         var fi = new FileInfo(safePath!);
-        return new AgentConfigFileSaveResult(fileName, fi.Length, fi.LastWriteTimeUtc);
+        return new AgentConfigSaveAttempt(
+            new AgentConfigFileSaveResult(
+                fileName,
+                fi.Length,
+                fi.LastWriteTimeUtc,
+                new AgentConfigValidationResult("passed", fileKind, []),
+                new AgentConfigBackupResult(backupCreated ? "created" : "not_applicable", backupCreated),
+                CreateReloadCheck()),
+            null);
     }
+
+    private static AgentConfigValidationResult Validate(string fileName, string content, string fileKind)
+    {
+        var errors = new List<string>();
+
+        if (!PathSecurityHelper.IsValidConfigFileName(fileName))
+            errors.Add("Filename is invalid.");
+        else if (!AllowedFiles.Contains(fileName))
+            errors.Add("File is not allowed for Mission Control editing.");
+
+        if (content.IndexOf('\0') >= 0)
+            errors.Add("Content contains null bytes.");
+
+        if (content.Length > IAgentConfigService.MaxConfigFileBytes)
+            errors.Add($"Content exceeds maximum size of {IAgentConfigService.MaxConfigFileBytes / 1024}KB.");
+
+        if (string.Equals(fileKind, "json", StringComparison.OrdinalIgnoreCase))
+        {
+            try
+            {
+                JsonDocument.Parse(content);
+            }
+            catch (JsonException ex)
+            {
+                errors.Add($"JSON validation failed: {ex.Message}");
+            }
+        }
+
+        return new AgentConfigValidationResult(errors.Count == 0 ? "passed" : "failed", fileKind, errors);
+    }
+
+    private static string DetermineFileKind(string fileName)
+    {
+        if (fileName.EndsWith(".json", StringComparison.OrdinalIgnoreCase))
+            return "json";
+
+        if (fileName.EndsWith(".md", StringComparison.OrdinalIgnoreCase))
+            return "markdown";
+
+        return "text";
+    }
+
+    private static AgentConfigReloadCheckResult CreateReloadCheck()
+        => new(
+            "not_supported",
+            "Mission Control verified the file write locally, but agent hot reload is not available for workspace config files.");
 }