feat: finish master-agent prompt and memory runtime

src/app/api/v1/projects/[projectId]/agent-controls/route.ts

@@ -27,7 +27,7 @@ export async function GET(
     return NextResponse.json({ ok: false, message: "UNAUTHORIZED" }, { status: 401 });
   }
 
-  const controls = await getProjectAgentControls(projectId);
+  const controls = await getProjectAgentControls(projectId, session.account);
   return NextResponse.json({ ok: true, controls });
 }
 
@@ -44,10 +44,6 @@ export async function POST(
   if (projectId !== "master-agent") {
     return NextResponse.json({ ok: false, message: "PROJECT_NOT_FOUND" }, { status: 404 });
   }
-  if (session.role !== "highest_admin") {
-    return NextResponse.json({ ok: false, message: "FORBIDDEN" }, { status: 403 });
-  }
-
   const rawBody = await request.text().catch(() => "");
   let body: unknown;
   try {
@@ -103,6 +99,7 @@ export async function POST(
         ...(hasReasoningEffortOverride ? { reasoningEffortOverride: payload.reasoningEffortOverride } : {}),
         ...(hasPromptOverride ? { promptOverride: payload.promptOverride } : {}),
       },
+      session.account,
     );
     return NextResponse.json({ ok: true, controls: controls ?? null });
   } catch (error) {

src/app/api/v1/projects/[projectId]/memories/route.ts

@@ -39,7 +39,9 @@ export async function GET(
 
   const [globalMemories, projectMemories] = await Promise.all([
     listUserMasterMemories(session.account, { scope: "global" }),
-    listUserMasterMemories(session.account, { scope: "project", projectId }),
+    projectId === "master-agent"
+      ? listUserMasterMemories(session.account, { scope: "project" })
+      : listUserMasterMemories(session.account, { scope: "project", projectId }),
   ]);
 
   return NextResponse.json({

src/app/api/v1/projects/[projectId]/prompt-profile/route.ts

@@ -28,7 +28,7 @@ export async function GET(
   const [promptPolicy, userPrompt, projectControls] = await Promise.all([
     getMasterAgentPromptPolicy(),
     getUserMasterPrompt(session.account),
-    getProjectAgentControls(projectId),
+    getProjectAgentControls(projectId, session.account),
   ]);
 
   return NextResponse.json({
@@ -99,13 +99,13 @@ export async function POST(
     if (hasPromptOverride) {
       await updateProjectAgentControls(projectId, {
         promptOverride: payload.promptOverride,
-      });
+      }, session.account);
     }
 
     const [promptPolicy, userPrompt, projectControls] = await Promise.all([
       getMasterAgentPromptPolicy(),
       getUserMasterPrompt(session.account),
-      getProjectAgentControls(projectId),
+      getProjectAgentControls(projectId, session.account),
     ]);
 
     return NextResponse.json({

src/app/api/v1/projects/[projectId]/route.ts

@@ -13,7 +13,7 @@ export async function GET(
   }
   const { projectId } = await context.params;
   const state = await readState();
-  const detail = getProjectDetailView(state, projectId);
+  const detail = getProjectDetailView(state, projectId, session.account);
 
   if (!detail) {
     return NextResponse.json({ ok: false, message: "PROJECT_NOT_FOUND" }, { status: 404 });