feat(headless): Implement Phase 2 - Core API Routes & Authentication

gui_2.py

@@ -22,7 +22,9 @@ import api_hooks
 import mcp_client
 from performance_monitor import PerformanceMonitor
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Depends, HTTPException, Security
+from fastapi.security.api_key import APIKeyHeader
+from pydantic import BaseModel
 from imgui_bundle import imgui, hello_imgui, immapp
 
 CONFIG_PATH = Path("config.toml")
@@ -306,12 +308,32 @@ class App:
         
     def create_api(self) -> FastAPI:
         api = FastAPI(title="Manual Slop Headless API")
+        
+        class GenerateRequest(BaseModel):
+            prompt: str
+            auto_add_history: bool = True
+            temperature: float | None = None
+            max_tokens: int | None = None
+
+        API_KEY_NAME = "X-API-KEY"
+        api_key_header = APIKeyHeader(name=API_KEY_NAME, auto_error=False)
+
+        async def get_api_key(header_key: str = Depends(api_key_header)):
+            headless_cfg = self.config.get("headless", {})
+            config_key = headless_cfg.get("api_key", "").strip()
+            env_key = os.environ.get("SLOP_API_KEY", "").strip()
+            target_key = env_key or config_key
+            if not target_key:
+                return None
+            if header_key == target_key:
+                return header_key
+            raise HTTPException(status_code=403, detail="Could not validate API Key")
 
         @api.get("/health")
         def health():
             return {"status": "ok"}
 
-        @api.get("/status")
+        @api.get("/status", dependencies=[Depends(get_api_key)])
         def status():
             return {
                 "provider": self.current_provider,
@@ -321,6 +343,81 @@ class App:
                 "session_usage": self.session_usage
             }
 
+        @api.post("/api/v1/generate", dependencies=[Depends(get_api_key)])
+        def generate(req: GenerateRequest):
+            if not req.prompt.strip():
+                raise HTTPException(status_code=400, detail="Prompt cannot be empty")
+
+            with self._send_thread_lock:
+                start_time = time.time()
+                try:
+                    # Refresh context before sending
+                    md, path, file_items, stable_md, disc_text = self._do_generate()
+                    self.last_md = md
+                    self.last_md_path = path
+                    self.last_file_items = file_items
+                except Exception as e:
+                    raise HTTPException(status_code=500, detail=f"Context aggregation failure: {e}")
+
+                user_msg = req.prompt
+                base_dir = self.ui_files_base_dir
+                csp = filter(bool, [self.ui_global_system_prompt.strip(), self.ui_project_system_prompt.strip()])
+                ai_client.set_custom_system_prompt("\n\n".join(csp))
+
+                # Override parameters if provided in request, otherwise use GUI defaults
+                temp = req.temperature if req.temperature is not None else self.temperature
+                tokens = req.max_tokens if req.max_tokens is not None else self.max_tokens
+                ai_client.set_model_params(temp, tokens, self.history_trunc_limit)
+                ai_client.set_agent_tools(self.ui_agent_tools)
+
+                if req.auto_add_history:
+                    with self._pending_history_adds_lock:
+                        self._pending_history_adds.append({
+                            "role": "User", 
+                            "content": user_msg, 
+                            "collapsed": False, 
+                            "ts": project_manager.now_ts()
+                        })
+
+                try:
+                    resp = ai_client.send(stable_md, user_msg, base_dir, self.last_file_items, disc_text)
+
+                    if req.auto_add_history:
+                        with self._pending_history_adds_lock:
+                            self._pending_history_adds.append({
+                                "role": "AI", 
+                                "content": resp, 
+                                "collapsed": False, 
+                                "ts": project_manager.now_ts()
+                            })
+
+                    # Ensure metrics are updated for the response
+                    self._recalculate_session_usage()
+                    duration = time.time() - start_time
+
+                    return {
+                        "text": resp,
+                        "metadata": {
+                            "provider": self.current_provider,
+                            "model": self.current_model,
+                            "duration_sec": round(duration, 3),
+                            "timestamp": project_manager.now_ts()
+                        },
+                        "usage": self.session_usage
+                    }
+                except ProviderError as e:
+                    # Specific error handling for vendor issues (4xx/5xx from Gemini/Anthropic)
+                    raise HTTPException(status_code=502, detail=f"AI Provider Error: {e.ui_message()}")
+                except Exception as e:
+                    # Generic internal error
+                    raise HTTPException(status_code=500, detail=f"In-flight AI request failure: {e}")
+
+        @api.post("/api/v1/stream", dependencies=[Depends(get_api_key)])
+        async def stream(req: GenerateRequest):
+            # Streaming implementation would require ai_client to support yield-based responses.
+            # Currently added as a placeholder to satisfy spec requirements.
+            raise HTTPException(status_code=501, detail="Streaming endpoint (/api/v1/stream) is not yet supported in this version.")      
+
         return api
 
     # ---------------------------------------------------------------- project loading