@bothat-io/molenkopf 0.1.2

package/packages/proxy/src/http/local-api-retention.ts

@@ -0,0 +1,28 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { AuditStore } from "../../../core/src/manifest/audit-store.ts";
+import { RetrievalStore } from "../../../core/src/store/retrieval-store.ts";
+import type { RuntimeState } from "./runtime-state.ts";
+import { readJson, writeJson } from "./local-api-io.ts";
+
+type PurgeScope = "audit" | "retrieval" | "all";
+
+export async function purgeRetention(req: IncomingMessage, res: ServerResponse, audit: AuditStore, state: RuntimeState) {
+  const body = await readJson(req);
+  const scope = parseScope(body.scope);
+  if (!scope) return writeJson(res, 400, { error: "invalid_purge_scope" });
+  const purged = { audit: false, retrieval: false };
+  if (scope === "audit" || scope === "all") {
+    await audit.purgeAll();
+    state.latest = undefined;
+    purged.audit = true;
+  }
+  if (scope === "retrieval" || scope === "all") {
+    await new RetrievalStore(state.dataDir).purgeAll();
+    purged.retrieval = true;
+  }
+  writeJson(res, 200, { ok: true, purged });
+}
+
+function parseScope(value: unknown): PurgeScope | undefined {
+  return value === "audit" || value === "retrieval" || value === "all" ? value : undefined;
+}

package/packages/proxy/src/http/local-api-runtime-auth.ts

@@ -0,0 +1,119 @@
+import { randomBytes } from "node:crypto";
+import { rename, rm } from "node:fs/promises";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { join } from "node:path";
+import { viewRuntimeProfile, type ProviderConfig } from "../../../core/src/providers/provider-catalog.ts";
+import { defaultDataDir } from "../../../core/src/storage/local-paths.ts";
+import { ensurePrivateDir } from "../../../core/src/storage/private-state.ts";
+import type { RuntimeState } from "./runtime-state.ts";
+import { buildProviderStatus } from "./local-api-state.ts";
+import { readJson, writeJson } from "./local-api-io.ts";
+import { persistRuntimeAuthProvider, runtimeAuthProvider, writeRuntimeAuthFiles } from "./runtime-auth-registry.ts";
+import { persistRuntimeSettings } from "./runtime-settings.ts";
+import { runtimeProfileFromImport, writeRuntimeProfileFiles } from "../runtime/runtime-profile.ts";
+import { consumeRuntimeAuthProof } from "./runtime-auth-proof.ts";
+
+const ID_RE = /^[a-z0-9][a-z0-9._:-]{0,63}$/i;
+const AUTH_IMPORT_BYTES = 256 * 1024;
+
+export async function importProviderAuth(req: IncomingMessage, res: ServerResponse, state: RuntimeState) {
+  const body = await readJson(req, AUTH_IMPORT_BYTES);
+  const runtime = runtimeValue(body.runtime);
+  if (!runtime) return writeJson(res, 400, { error: "invalid_runtime" });
+  const authJson = authJsonText(body);
+  if (!authJson) return writeJson(res, 400, { error: "missing_auth_json" });
+  const parsedAuth = parseJsonObject(authJson);
+  if (!parsedAuth) return writeJson(res, 400, { error: "invalid_auth_json" });
+  const explicitId = typeof body.id === "string" ? body.id.trim() : "";
+  const id = explicitId || uniqueGeneratedId(state, `${runtime}-import-${randomSuffix()}`);
+  if (!ID_RE.test(id)) return writeJson(res, 400, { error: "invalid_provider_id" });
+  if (id.toLowerCase() === "default") return writeJson(res, 400, { error: "reserved_provider_id" });
+  if (state.providers.some((item) => item.id === id)) return writeJson(res, 409, { error: "provider_exists" });
+  let runtimeProfile;
+  try {
+    runtimeProfile = runtimeProfileFromImport(body, runtime);
+  } catch (error) {
+    return writeJson(res, 400, { error: error instanceof Error ? error.message : "invalid_runtime_profile" });
+  }
+  if (!consumeRuntimeAuthProof(state, body)) return writeJson(res, 409, { error: "invalid_runtime_auth_proof" });
+
+  const root = state.dataDir ?? defaultDataDir();
+  const authRoot = join(root, "runtime-auth");
+  const authDir = join(authRoot, id);
+  const stagingDir = join(authRoot, `.staging-${id}-${randomSuffix()}`);
+  const ref = `runtime-auth:${id}`;
+  const name = importedName(body, runtime, id);
+  const provider = runtimeAuthProvider(id, name, runtime, authDir, ref, runtimeProfile.profile);
+  const snapshot = {
+    providers: [...state.providers],
+    providerWeights: { ...state.providerWeights },
+    activeProviderId: state.activeProviderId,
+    routingMode: state.routingMode,
+    providerSelectedAt: state.providerSelectedAt
+  };
+  try {
+    await ensurePrivateDir(authRoot);
+    await writeRuntimeAuthFiles(stagingDir, runtime, authJson.endsWith("\n") ? authJson : `${authJson}\n`);
+    await writeRuntimeProfileFiles(stagingDir, runtimeProfile);
+    await rename(stagingDir, authDir);
+    state.providers.push(provider);
+    state.providerWeights[id] = 1;
+    if (body.activate !== false) {
+      state.activeProviderId = id;
+      state.routingMode = "manual";
+      state.providerSelectedAt = new Date().toISOString();
+    }
+    await persistRuntimeAuthProvider(root, provider, body.activate !== false, state.routingMode);
+    await persistRuntimeSettings(state);
+  } catch (error) {
+    state.providers = snapshot.providers;
+    state.providerWeights = snapshot.providerWeights;
+    state.activeProviderId = snapshot.activeProviderId;
+    state.routingMode = snapshot.routingMode;
+    state.providerSelectedAt = snapshot.providerSelectedAt;
+    await rm(authDir, { recursive: true, force: true });
+    await rm(stagingDir, { recursive: true, force: true });
+    throw error;
+  }
+  writeJson(res, 200, { imported: { id, name, runtime, runtimeAuthConfigured: true, profile: viewRuntimeProfile(runtimeProfile.profile), active: state.activeProviderId === id }, providers: buildProviderStatus(state) });
+}
+
+function runtimeValue(value: unknown): ProviderConfig["runtime"] | undefined {
+  return value === "claude" || value === "codex" ? value : undefined;
+}
+
+function authJsonText(body: Record<string, unknown>): string {
+  if (typeof body.authJson === "string" && body.authJson.trim()) return body.authJson.trim();
+  return "";
+}
+
+function parseJsonObject(text: string): Record<string, unknown> | undefined {
+  try {
+    const parsed = JSON.parse(text);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed as Record<string, unknown> : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function randomSuffix(): string {
+  return randomBytes(3).toString("hex");
+}
+
+function uniqueGeneratedId(state: RuntimeState, base: string): string {
+  if (!state.providers.some((item) => item.id === base)) return base;
+  for (let index = 2; index < 100; index++) {
+    const id = `${base}-${index}`;
+    if (!state.providers.some((item) => item.id === id)) return id;
+  }
+  return `${base}-${Date.now().toString(36)}`;
+}
+
+function importedName(body: Record<string, unknown>, runtime: "claude" | "codex", id: string): string {
+  if (typeof body.name === "string" && body.name.trim()) return body.name.trim().slice(0, 80);
+  return `${label(runtime)} imported account ${id.slice(-6)}`;
+}
+
+function label(runtime: "claude" | "codex"): string {
+  return runtime === "codex" ? "Codex" : "Claude";
+}

package/packages/proxy/src/http/local-api-scope.ts

@@ -0,0 +1,47 @@
+import type { AuditManifest } from "../../../core/src/manifest/audit-store.ts";
+import type { RuntimeState } from "./runtime-state.ts";
+import { authRequired, canManage, type AuthUser } from "./auth-state.ts";
+
+export function filterAuditForUser(state: RuntimeState, user: AuthUser | undefined, manifests: AuditManifest[]): AuditManifest[] {
+  const allowed = auditFilterForUser(state, user);
+  return allowed ? manifests.filter(allowed) : manifests;
+}
+
+export function auditFilterForUser(state: RuntimeState, user: AuthUser | undefined): ((manifest: AuditManifest) => boolean) | undefined {
+  if (canReadAllLocal(state, user)) return undefined;
+  if (!user) return () => false;
+  const teams = readableTeamIds(state, user);
+  const keys = ownedKeyIds(state, user.id);
+  return (manifest) => manifestAllowed(manifest, user, teams, keys);
+}
+
+export function consumerAllowed(state: RuntimeState, user: AuthUser | undefined, id: string): boolean {
+  if (canReadAllLocal(state, user)) return true;
+  if (!user) return false;
+  if (id === `user:${user.id}`) return true;
+  return ownedKeyIds(state, user.id).has(id);
+}
+
+function canReadAllLocal(state: RuntimeState, user: AuthUser | undefined): boolean {
+  return !authRequired(state) || canManage(state, user);
+}
+
+function manifestAllowed(manifest: AuditManifest, user: AuthUser, teams: Set<string>, keys: Set<string>): boolean {
+  const client = manifest.client;
+  if (!client) return false;
+  if (client.userId === user.id || client.id === `user:${user.id}`) return true;
+  if (client.keyId && keys.has(client.keyId)) return true;
+  return Boolean(client.teamIds?.some((id) => teams.has(id)));
+}
+
+function readableTeamIds(state: RuntimeState, user: AuthUser): Set<string> {
+  const ids = new Set(user.teamIds);
+  for (const team of Object.values(state.identity?.data.teams ?? {})) {
+    if (team.managerIds.includes(user.id)) ids.add(team.id);
+  }
+  return ids;
+}
+
+function ownedKeyIds(state: RuntimeState, userId: string): Set<string> {
+  return new Set(Object.values(state.identity?.data.keys ?? {}).filter((key) => key.ownerUserId === userId).map((key) => key.id));
+}

package/packages/proxy/src/http/local-api-state.ts

@@ -0,0 +1,180 @@
+import { pluginCatalog, type MolenkopfPlugin } from "../../../core/src/plugins/plugin-catalog.ts";
+import { staticPluginPipeline } from "../../../core/src/plugins/static-pipeline.ts";
+import { viewProviders } from "../../../core/src/providers/provider-catalog.ts";
+import { summarizeAudit } from "../../../core/src/manifest/audit-summary.ts";
+import { weightShares } from "../../../core/src/routing/distribution.ts";
+import { activeProvider, CONTROL_PLANE_LIMITS, distributionEligible, emptyUsage, providerWeight, type RuntimeState } from "./runtime-state.ts";
+import { canManage, providerAllowed, type AuthUser } from "./auth-state.ts";
+import { listAgentDrafts } from "./agent-drafts.ts";
+import { orderIndex, redactionBeforeCompression } from "./local-api-pipeline.ts";
+import { consumerAllowed } from "./local-api-scope.ts";
+
+function hostOf(target: string): string {
+  if (target.startsWith("cli://")) return target;
+  try { return new URL(target).host; } catch { return target; }
+}
+
+const BUILT_IN_PROVIDER_IDS = new Set(["openai-env", "anthropic-env", "ollama-local", "lmstudio-local"]);
+
+export function buildStatus(state: RuntimeState) {
+  const provider = activeProvider(state);
+  return {
+    ok: true,
+    startedAt: state.startedAt,
+    target: provider.target,
+    targetHost: hostOf(provider.target),
+    activeProviderId: provider.id,
+    bindHost: state.host,
+    port: state.port,
+    requests: state.requests,
+    compressedItems: state.compressedItems,
+    latestStatusCode: state.latest?.statusCode,
+    routingMode: state.routingMode,
+    settingsLoadWarning: state.settingsLoadWarning,
+    pipeline: staticPluginPipeline,
+    remotePluginLoading: false
+  };
+}
+
+export function buildPluginStatus(state: RuntimeState) {
+  const items = pluginCatalog.map((plugin) => ({ ...pluginView(plugin, state), order: plugin.pipelineIndex !== undefined ? orderIndex(state, plugin.id) : undefined }));
+  return {
+    items,
+    staticPipeline: items.filter((item) => item.pipelineIndex !== undefined),
+    pipelineSafe: redactionBeforeCompression(state),
+    remotePlugins: { enabled: false, reason: "remote plugin loading disabled" }
+  };
+}
+
+export function buildProviderStatus(state: RuntimeState, user?: AuthUser) {
+  const views = viewProviders(state.providers, state.activeProviderId);
+  const shares = weightShares(state.providers.filter((item) => item.id !== "default" && distributionEligible(item)).map((item) => ({ id: item.id, weight: providerWeight(state, item.id) })));
+  const enriched = views
+    .filter((view) => providerAllowed(state, user, view.id))
+    .map((view) => ({
+      ...view,
+      weight: providerWeight(state, view.id),
+      sharePercent: shares[view.id] ?? 0,
+      usage: state.usageByProvider[view.id] ?? emptyUsage()
+    }));
+  const configured = enriched.filter((item) => item.id !== "default" && (item.enabled !== false || !BUILT_IN_PROVIDER_IDS.has(item.id)));
+  const items = enriched.slice(0, CONTROL_PLANE_LIMITS.providerItems);
+  return {
+    activeProviderId: state.activeProviderId,
+    selectedAt: state.providerSelectedAt,
+    routingMode: state.routingMode,
+    activeProvider: enriched.find((item) => item.active),
+    configuredCount: configured.length,
+    hasConfiguredProviders: configured.length > 0,
+    configuredItems: configured.slice(0, CONTROL_PLANE_LIMITS.providerItems),
+    items,
+    hasMore: enriched.length > items.length
+  };
+}
+
+export function buildAgentStatus(state: RuntimeState) {
+  return {
+    items: listAgentDrafts(state),
+    configured: state.configAgents.map((agent) => ({
+      id: agent.id,
+      providerId: agent.providerId,
+      enabled: agent.enabled !== false,
+      profileId: agent.profileId,
+      pluginPolicyId: agent.pluginPolicyId,
+      allowedModels: agent.allowedModels,
+      defaultModel: agent.defaultModel,
+      enabledPluginIds: agent.enabledPluginIds
+    })),
+    limit: CONTROL_PLANE_LIMITS.agentDrafts,
+    hasMore: state.agentDrafts.length > CONTROL_PLANE_LIMITS.agentDrafts,
+    tokenPolicy: "hash-only; raw token values rejected"
+  };
+}
+
+export function buildConsumers(state: RuntimeState, user?: AuthUser) {
+  const ids = new Set<string>([...Object.keys(state.usageByUser), ...Object.keys(state.usageByAgent), ...Object.keys(state.consumerBudgets)]);
+  const items = [...ids].filter((id) => consumerAllowed(state, user, id)).map((id) => ({
+    id,
+    label: id,
+    usage: state.usageByUser[id] ?? state.usageByAgent[id] ?? { requests: 0, inputTokens: 0, outputTokens: 0 },
+    budget: state.consumerBudgets[id]
+  })).sort((a, b) => (b.usage.inputTokens + b.usage.outputTokens) - (a.usage.inputTokens + a.usage.outputTokens));
+  return { items: items.slice(0, 100) };
+}
+
+export function buildConfig(state: RuntimeState, user?: AuthUser) {
+  if (!canManage(state, user)) return buildUserConfig(state);
+  const provider = activeProvider(state);
+  return {
+    dashboardPath: "/__molenkopf/dashboard",
+    localApi: [
+      "/__molenkopf/health", "/__molenkopf/status", "/__molenkopf/stats", "/__molenkopf/plugins",
+      "/__molenkopf/providers", "/__molenkopf/agents", "/__molenkopf/config", "/__molenkopf/events",
+      "/__molenkopf/requests", "/__molenkopf/requests/latest", "/__molenkopf/audit/summary",
+      "/__molenkopf/plugins/:id/data"
+    ],
+    target: provider.target,
+    targetHost: hostOf(provider.target),
+    bindHost: state.host,
+    port: state.port,
+    configSource: state.configSource,
+    settingsLoadWarning: state.settingsLoadWarning,
+    routing: { mode: state.routingMode, activeProfile: state.activeProviderId, profiles: viewProviders(state.providers, state.activeProviderId) },
+    agentAccess: { mode: "draft metadata", tokenStorage: "hash only; raw values rejected", providerBinding: "provider profile per agent", draftPath: "/__molenkopf/agents/draft", drafts: state.agentDrafts.length },
+    credentialPolicy: "file config uses credential refs; UI-added credentials and imported runtime auth stay local and are not displayed",
+    remotePluginLoading: false
+  };
+}
+
+function buildUserConfig(state: RuntimeState) {
+  return {
+    dashboardPath: "/__molenkopf/dashboard",
+    localApi: ["/__molenkopf/health", "/__molenkopf/me", "/__molenkopf/usage", "/__molenkopf/keys"],
+    bindHost: state.host,
+    port: state.port,
+    credentialPolicy: "credential values are not displayed",
+    remotePluginLoading: false
+  };
+}
+
+export function buildStats(state: RuntimeState) {
+  return {
+    requests: state.requests,
+    compressedItems: state.compressedItems,
+    startedAt: state.startedAt,
+    host: state.host,
+    port: state.port,
+    latest: boundLatest(state.latest),
+    pluginEnabled: state.pluginEnabled,
+    activeProviderId: state.activeProviderId,
+    settingsLoadWarning: state.settingsLoadWarning,
+    providers: buildProviderStatus(state),
+    agentDrafts: buildAgentStatus(state),
+    auditSummary: state.latest ? summarizeAudit([state.latest]) : summarizeAudit([]),
+    communicationGraph: boundGraph(state.communicationGraph)
+  };
+}
+
+export function pluginView(plugin: MolenkopfPlugin, state: RuntimeState) {
+  const enabled = state.pluginEnabled[plugin.id] ?? plugin.enabledByDefault;
+  const lifecycle = state.pluginLifecycle[plugin.id];
+  return {
+    ...plugin,
+    enabled,
+    status: enabled ? "enabled" : "disabled",
+    lifecycleStatus: lifecycle?.status ?? (enabled ? "enabled" : "disabled"),
+    lifecycleError: lifecycle?.error,
+    updatedAt: state.pluginUpdatedAt[plugin.id],
+    source: state.pluginUpdatedAt[plugin.id] ? "local" : "default"
+  };
+}
+
+function boundGraph(graph: RuntimeState["communicationGraph"]) {
+  const nodes = graph.nodes.slice(0, CONTROL_PLANE_LIMITS.graphNodes);
+  const edges = graph.edges.slice(0, CONTROL_PLANE_LIMITS.graphEdges);
+  return { nodes, edges, hasMore: nodes.length < graph.nodes.length || edges.length < graph.edges.length };
+}
+
+function boundLatest(latest: RuntimeState["latest"]) {
+  return latest ? { ...latest, retrievalIds: latest.retrievalIds.slice(0, 10), warnings: latest.warnings.slice(0, 10) } : undefined;
+}

package/packages/proxy/src/http/local-api.ts

@@ -0,0 +1,166 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { AuditCursorError, type AuditStore } from "../../../core/src/manifest/audit-store.ts";
+import type { EventBus } from "../../../core/src/events/event-bus.ts";
+import { summarizeAudit } from "../../../core/src/manifest/audit-summary.ts";
+import { loadPluginPage } from "./plugin-page-loader.ts";
+import { type RuntimeState } from "./runtime-state.ts";
+import { buildPluginData } from "./plugin-data.ts";
+import { buildAgentStatus, buildConfig, buildConsumers, buildPluginStatus, buildProviderStatus, buildStats, buildStatus } from "./local-api-state.ts";
+import { auditView, auditViews } from "./audit-view.ts";
+import { LocalApiError, writeHtml, writeJson } from "./local-api-io.ts";
+import { saveAgentDraft } from "./local-api-agent-actions.ts";
+import { setConsumerBudget } from "./local-api-consumer-actions.ts";
+import { addProvider, removeProvider, selectProvider, setProviderWeight, setProviderWeights, setRoutingMode, updateProvider } from "./local-api-provider-actions.ts";
+import { togglePlugin } from "./local-api-plugin-actions.ts";
+import { authRequired, canManage, currentUser, type AuthUser } from "./auth-state.ts";
+import { login, logout, me, setupAdmin } from "./local-api-auth.ts";
+import { reorderPlugin } from "./local-api-pipeline.ts";
+import { issueKeyHandler, listKeysHandler, revokeKeyHandler, updateKeyHandler, usageHandler } from "./local-api-keys.ts";
+import { listIdentity, putIdentityTeam, putIdentityUser, removeIdentityTeam, removeIdentityUser } from "./local-api-identity.ts";
+import { importProviderAuth } from "./local-api-runtime-auth.ts";
+import { testProvider, testRuntimeProvider } from "./provider-test.ts";
+import { checkControlPlaneWrite } from "./control-plane-guard.ts";
+import { auditFilterForUser } from "./local-api-scope.ts";
+import { purgeRetention } from "./local-api-retention.ts";
+import type { PluginHost } from "./plugin-host.ts";
+
+const DEV_REVISION_PATH = "/__molenkopf/dev/revision";
+const PUBLIC_PATHS = new Set(["/__molenkopf/health", "/__molenkopf/login", "/__molenkopf/logout", "/__molenkopf/me", "/__molenkopf/setup-admin", DEV_REVISION_PATH]);
+const BOOTSTRAP_PATHS = new Set(["/__molenkopf/health", "/__molenkopf/me", "/__molenkopf/setup-admin"]);
+const ADMIN_READ_PATHS = new Set(["/__molenkopf/status", "/__molenkopf/plugins", "/__molenkopf/providers", "/__molenkopf/agents", "/__molenkopf/stats", "/__molenkopf/events"]);
+const MANAGE_PATHS = new Set([
+  "/__molenkopf/plugins/toggle", "/__molenkopf/plugins/reorder", "/__molenkopf/providers/select", "/__molenkopf/providers/weight", "/__molenkopf/providers/weights",
+  "/__molenkopf/providers/add", "/__molenkopf/providers/import-auth", "/__molenkopf/providers/test", "/__molenkopf/providers/test-runtime", "/__molenkopf/providers/update", "/__molenkopf/providers/remove",
+  "/__molenkopf/routing/mode", "/__molenkopf/consumers/budget", "/__molenkopf/agents/draft",
+  "/__molenkopf/identity/users", "/__molenkopf/identity/users/remove",
+  "/__molenkopf/identity/teams", "/__molenkopf/identity/teams/remove", "/__molenkopf/retention/purge"
+]);
+
+export async function handleLocalRequest(req: IncomingMessage, res: ServerResponse, audit: AuditStore, events: EventBus, state: RuntimeState, pluginHost: PluginHost) {
+  const url = new URL(req.url ?? "/", "http://local");
+  const path = url.pathname;
+  try {
+    const guard = checkControlPlaneWrite(req, path, state);
+    if (guard.ok === false) return writeJson(res, guard.status, { error: guard.error });
+    const open = !authRequired(state);
+    const user = open ? undefined : currentUser(state, req.headers.cookie ?? null);
+    if (open && !BOOTSTRAP_PATHS.has(path)) return writeJson(res, 401, { error: "setup_required" });
+    if (!open && !PUBLIC_PATHS.has(path) && !user) return writeJson(res, 401, { error: "unauthorized" });
+    if (!open && MANAGE_PATHS.has(path) && !canManage(state, user)) return writeJson(res, 403, { error: "forbidden" });
+    if (!open && ADMIN_READ_PATHS.has(path) && !canManage(state, user)) return writeJson(res, 403, { error: "forbidden" });
+    if (!methodAllowed(req.method ?? "GET", path)) return writeJson(res, 405, { error: "method_not_allowed" });
+    if (path === "/__molenkopf/login") return login(req, res, state);
+    if (path === "/__molenkopf/setup-admin") return setupAdmin(req, res, state);
+    if (path === "/__molenkopf/plugins/reorder") return reorderPlugin(req, res, state);
+    if (path === "/__molenkopf/logout") return logout(req, res);
+    if (path === "/__molenkopf/me") return me(req, res, state);
+    if (path === "/__molenkopf/health") return writeJson(res, 200, { ok: true });
+    if (path === DEV_REVISION_PATH) return writeDevRevision(res);
+    if (path === "/__molenkopf/status") return writeJson(res, 200, buildStatus(state));
+    if (path === "/__molenkopf/plugins") return writeJson(res, 200, buildPluginStatus(state));
+    if (path === "/__molenkopf/providers") return writeJson(res, 200, buildProviderStatus(state, user));
+    if (path === "/__molenkopf/agents") return writeJson(res, 200, buildAgentStatus(state));
+    if (path === "/__molenkopf/config") return writeJson(res, 200, buildConfig(state, user));
+    if (path === "/__molenkopf/stats") return writeJson(res, 200, buildStats(state));
+    if (path === "/__molenkopf/requests/latest") return audit.listPage({ limit: 1, newestFirst: true, filter: auditFilterForUser(state, user) }).then((page) => writeJson(res, 200, auditViews(page.items).at(0) ?? {}));
+    if (path === "/__molenkopf/requests") {
+      const cursor = url.searchParams.get("cursor") ?? undefined;
+      try {
+        const page = await audit.listPage({ limit: 200, cursor, newestFirst: true, filter: auditFilterForUser(state, user) });
+        return writeJson(res, 200, auditViews(page.items));
+      } catch (error) {
+        if (error instanceof AuditCursorError) return writeJson(res, 400, { error: "invalid_cursor" });
+        throw error;
+      }
+    }
+    if (path === "/__molenkopf/audit/summary") return audit.listPage({ limit: 1000, newestFirst: true, filter: auditFilterForUser(state, user) }).then((page) => writeJson(res, 200, summarizeAudit(auditViews(page.items))));
+    if (path === "/__molenkopf/consumers") return writeJson(res, 200, buildConsumers(state, user));
+    if (path === "/__molenkopf/events") return streamEvents(res, events);
+    if (path === "/__molenkopf/plugins/toggle") return togglePlugin(req, res, state, pluginHost);
+    if (path === "/__molenkopf/providers/select") return selectProvider(req, res, state);
+    if (path === "/__molenkopf/providers/weight") return setProviderWeight(req, res, state);
+    if (path === "/__molenkopf/providers/weights") return setProviderWeights(req, res, state);
+    if (path === "/__molenkopf/providers/add") return addProvider(req, res, state);
+    if (path === "/__molenkopf/providers/import-auth") return importProviderAuth(req, res, state);
+    if (path === "/__molenkopf/providers/test") return testProvider(req, res, state);
+    if (path === "/__molenkopf/providers/test-runtime") return testRuntimeProvider(req, res, state);
+    if (path === "/__molenkopf/providers/update") return updateProvider(req, res, state);
+    if (path === "/__molenkopf/providers/remove") return removeProvider(req, res, state);
+    if (path === "/__molenkopf/routing/mode") return setRoutingMode(req, res, state);
+    if (path === "/__molenkopf/consumers/budget") return setConsumerBudget(req, res, state);
+    if (path === "/__molenkopf/agents/draft") return saveAgentDraft(req, res, state);
+    if (path === "/__molenkopf/keys") return req.method === "POST" ? issueKeyHandler(req, res, state, user) : listKeysHandler(req, res, state, user);
+    if (path === "/__molenkopf/keys/update") return updateKeyHandler(req, res, state, user);
+    if (path === "/__molenkopf/keys/revoke") return revokeKeyHandler(req, res, state, user);
+    if (path === "/__molenkopf/usage") return usageHandler(req, res, state, user);
+    if (path === "/__molenkopf/identity") {
+      if (!open && !canManage(state, user)) return writeJson(res, 403, { error: "forbidden" });
+      return listIdentity(req, res, state);
+    }
+    if (path === "/__molenkopf/identity/users") return putIdentityUser(req, res, state);
+    if (path === "/__molenkopf/identity/users/remove") return removeIdentityUser(req, res, state);
+    if (path === "/__molenkopf/identity/teams") return putIdentityTeam(req, res, state);
+    if (path === "/__molenkopf/identity/teams/remove") return removeIdentityTeam(req, res, state);
+    if (path === "/__molenkopf/retention/purge") return purgeRetention(req, res, audit, state);
+    const pluginData = path.match(/^\/__molenkopf\/plugins\/([^/]+)\/data$/);
+    if (pluginData && !canManage(state, user)) return writeJson(res, 403, { error: "forbidden" });
+    if (pluginData) return writePluginData(res, pluginData[1], audit, state, user, pluginHost);
+    const pluginPage = path.match(/^\/__molenkopf\/plugins\/([^/]+)\/page$/);
+    if (pluginPage && !canManage(state, user)) return writeJson(res, 403, { error: "forbidden" });
+    if (pluginPage) return writePluginPage(res, pluginPage[1]);
+    writeJson(res, 404, { error: "not_found" });
+  } catch (error) {
+    if (error instanceof LocalApiError) return writeJson(res, error.status, { error: error.code });
+    throw error;
+  }
+}
+
+const GET_ONLY = new Set([
+  "/__molenkopf/health", "/__molenkopf/me", DEV_REVISION_PATH, "/__molenkopf/status", "/__molenkopf/plugins", "/__molenkopf/providers", "/__molenkopf/agents",
+  "/__molenkopf/config", "/__molenkopf/stats", "/__molenkopf/requests/latest", "/__molenkopf/requests", "/__molenkopf/audit/summary", "/__molenkopf/consumers",
+  "/__molenkopf/events", "/__molenkopf/usage", "/__molenkopf/identity"
+]);
+const POST_ONLY = new Set([
+  "/__molenkopf/login", "/__molenkopf/logout", "/__molenkopf/setup-admin", "/__molenkopf/plugins/reorder", "/__molenkopf/plugins/toggle",
+  "/__molenkopf/providers/select", "/__molenkopf/providers/weight", "/__molenkopf/providers/weights", "/__molenkopf/providers/add",
+  "/__molenkopf/providers/import-auth", "/__molenkopf/providers/test", "/__molenkopf/providers/test-runtime", "/__molenkopf/providers/update",
+  "/__molenkopf/providers/remove", "/__molenkopf/routing/mode", "/__molenkopf/consumers/budget", "/__molenkopf/agents/draft", "/__molenkopf/keys/update",
+  "/__molenkopf/keys/revoke", "/__molenkopf/identity/users", "/__molenkopf/identity/users/remove", "/__molenkopf/identity/teams",
+  "/__molenkopf/identity/teams/remove", "/__molenkopf/retention/purge"
+]);
+
+function methodAllowed(method: string, path: string): boolean {
+  const upper = method.toUpperCase();
+  if (path === "/__molenkopf/keys") return upper === "GET" || upper === "POST";
+  if (GET_ONLY.has(path)) return upper === "GET";
+  if (POST_ONLY.has(path)) return upper === "POST";
+  if (/^\/__molenkopf\/plugins\/[^/]+\/(?:data|page)$/.test(path)) return upper === "GET";
+  return true;
+}
+
+function writeDevRevision(res: ServerResponse) {
+  if (process.env.MOLENKOPF_PROFILE !== "dev") return writeJson(res, 404, { error: "not_found" });
+  return writeJson(res, 200, { revision: process.env.MOLENKOPF_DEV_REVISION || "dev" });
+}
+
+function writePluginPage(res: ServerResponse, id: string) {
+  const html = loadPluginPage(id);
+  if (!html) return writeJson(res, 404, { error: "plugin_page_not_found" });
+  writeHtml(res, html);
+}
+
+async function writePluginData(res: ServerResponse, id: string, audit: AuditStore, state: RuntimeState, user: AuthUser | undefined, pluginHost: PluginHost) {
+  const result = await buildPluginData(id, audit, state, user, pluginHost);
+  writeJson(res, result.status, result.payload);
+}
+
+function streamEvents(res: ServerResponse, events: EventBus) {
+  res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+  res.write(": connected\n\n");
+  const heartbeat = setInterval(() => res.write(": heartbeat\n\n"), 25000);
+  const unsubscribe = events.subscribe((event) => res.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`));
+  res.on("close", () => {
+    clearInterval(heartbeat);
+    unsubscribe();
+  });
+}

package/packages/proxy/src/http/password-policy.ts

@@ -0,0 +1,5 @@
+export const MIN_PASSWORD_LENGTH = 10;
+
+export function isWeakPassword(value: unknown): boolean {
+  return typeof value === "string" && value.length > 0 && value.length < MIN_PASSWORD_LENGTH;
+}

package/packages/proxy/src/http/plugin-data.ts

@@ -0,0 +1,38 @@
+import type { AuditStore, AuditManifest } from "../../../core/src/manifest/audit-store.ts";
+import { findPlugin } from "../../../core/src/plugins/plugin-catalog.ts";
+import { pluginView } from "./local-api-state.ts";
+import { type RuntimeState } from "./runtime-state.ts";
+import { auditViews } from "./audit-view.ts";
+import { auditFilterForUser } from "./local-api-scope.ts";
+import { canManage, type AuthUser } from "./auth-state.ts";
+import { auditPath } from "./request-path.ts";
+import type { PluginHost } from "./plugin-host.ts";
+
+type PluginDataResult = { status: number; payload: unknown };
+
+export async function buildPluginData(id: string, audit: AuditStore, state: RuntimeState, user: AuthUser | undefined, host: PluginHost): Promise<PluginDataResult> {
+  const plugin = findPlugin(id);
+  if (!plugin) return { status: 404, payload: { error: "unknown_plugin" } };
+  if (!plugin.dataPath) return { status: 404, payload: { error: "plugin_data_not_found" } };
+  const result = await host.data(id, {
+    canManage: canManage(state, user),
+    userId: user?.id,
+    teamIds: user?.teamIds ?? [],
+    scope: "data",
+    plugin: pluginView(plugin, state) as unknown as Record<string, unknown>,
+    scopes: plugin.dataScopes ?? [],
+    manifests: await scopedManifests(audit, state, user),
+    memoryGraph: state.memoryGraph
+  });
+  return result.ok === true ? { status: 200, payload: result.payload } : { status: result.status, payload: { error: result.error } };
+}
+
+async function scopedManifests(audit: AuditStore, state: RuntimeState, user?: AuthUser): Promise<AuditManifest[]> {
+  const page = await audit.listPage({ limit: 200, newestFirst: true, filter: auditFilterForUser(state, user) });
+  return auditViews(page.items).filter(isAgentTraffic);
+}
+
+function isAgentTraffic(manifest: AuditManifest): boolean {
+  const path = auditPath(manifest.path);
+  return !path.startsWith("/.well-known/appspecific/") && path !== "/favicon.ico";
+}