@cgh567/agent 2.4.1 → 2.4.3

package/daemon/routes/hbo.js

@@ -14,6 +14,7 @@ const { randomUUID } = crypto;
 const { HELIOS_ROOT } = require('../lib/paths');
 const { CompanyBeliefService } = require('../lib/company-belief-service');
 const { CompanyBeliefDiscovery } = require('../lib/company-belief-discovery');
+const hboStore = require('../../lib/hbo-core-store');
 
 
 const HBO_ROOT = path.resolve(__dirname, '../../skills/helios-business-operator');
@@ -31,7 +32,7 @@ function getCorsHeaders(req) {
   const allowedOrigin = origin && HBO_ALLOWED_ORIGINS.has(origin) ? origin : 'http://localhost:9093';
   return {
     'Access-Control-Allow-Origin': allowedOrigin,
-    'Access-Control-Allow-Methods': 'GET, POST, PATCH, OPTIONS',
+    'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, OPTIONS',
     'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',
     'Vary': 'Origin',
   };
@@ -430,28 +431,37 @@ async function handleTransitionBusinessTask(req, res, ctx, taskId) {
     const taskService = loadHBOService('lib/business-task-service.js');
     if (taskService && typeof taskService.transition === 'function') {
       try {
-        const task = await Promise.race([
-          taskService.transition(taskId, status, cid),
-          new Promise((_, reject) =>
-            setTimeout(() => reject(new Error('task-service timeout — falling back to direct')), 5000)
-          ),
-        ]);
-        jsonOk(res, { task });
-        return;
-      } catch (_svcErr) {
-        // service failed for any reason — fall through to direct Memgraph path below
-      }
-    }
-
-    // Fallback: update directly via ctx.mgQuery
-    const now = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
-    await mgQuery(
-      `MATCH (bt:BusinessTask {id: $id, companyId: $cid})
-       SET bt.status = $status, bt.updatedAt = datetime($now)`,
-      { id: taskId, cid, status, now }
-    );
-    _bc({ type: 'task.updated', taskId, companyId: cid, status });
-    jsonOk(res, { updated: true, taskId, status });
+        const task = await Promise.race([
+          taskService.transition(taskId, status, cid),
+          new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('task-service timeout — falling back to direct')), 5000)
+          ),
+        ]);
+        if (task !== null && task !== undefined) {
+          jsonOk(res, { task });
+          return;
+        }
+        // Service did not find a task for this company; fall through to the
+        // direct path so we can return a clear 404 instead of a silent success.
+      } catch (_svcErr) {
+        // service failed for any reason — fall through to direct Memgraph path below
+      }
+    }
+
+    // Fallback: update directly via ctx.mgQuery
+    const now = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
+    const result = await mgQuery(
+      `MATCH (bt:BusinessTask {id: $id, companyId: $cid})
+       SET bt.status = $status, bt.updatedAt = datetime($now)
+       RETURN bt.id AS id`,
+      { id: taskId, cid, status, now }
+    );
+    if (parseRows(result).length === 0) {
+      jsonErr(res, 404, `BusinessTask ${taskId} not found for company ${cid}`);
+      return;
+    }
+    _bc({ type: 'task.updated', taskId, companyId: cid, status });
+    jsonOk(res, { updated: true, taskId, status });
   } catch (e) {
     jsonErr(res, 500, `Transition BusinessTask failed: ${safeErrMsg(e)}`);
   }
@@ -461,34 +471,199 @@ async function handleTransitionBusinessTask(req, res, ctx, taskId) {
 
 async function handleGetBusinessGoals(req, res, ctx) {
   const { mgQuery, cid } = ctx;
-  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  // SQL-P1: SQLite fallback when Memgraph is unavailable — not all users have Memgraph.
+  // Try Memgraph first; on failure (no connection or query error), fall through to SQLite.
+  if (mgQuery) {
+    try {
+      // Get all BusinessGoal nodes
+      // BUG-12 fix: BusinessGoal relationships are stored as (child)-[:CHILD_OF]->(parent).
+      const result = await mgQuery(
+        `MATCH (bg:BusinessGoal {companyId: $cid})
+         OPTIONAL MATCH (child:BusinessGoal)-[:CHILD_OF]->(bg)
+         WITH bg, [x IN collect(child.id) WHERE x IS NOT NULL] AS childIds
+         RETURN bg.id AS id, bg.title AS title, bg.level AS level,
+                bg.ownerAgentId AS ownerAgentId, bg.status AS status,
+                bg.progress AS progress, childIds
+         ORDER BY bg.level ASC`,
+        { cid }
+      );
+      const rows = parseRows(result);
+      const keys = ['id', 'title', 'level', 'ownerAgentId', 'status', 'progress', 'childIds'];
+      const goals = rows.map(r => {
+        const goal = rowToObj(r, keys);
+        if (goal.level !== null && goal.level !== undefined) goal.level = String(goal.level);
+        return goal;
+      });
+      const rootGoals = goals.filter(g => !g.level || String(g.level) === 'company');
+      return jsonOk(res, { goals, rootGoals, count: goals.length });
+    } catch (e) {
+      // Memgraph query failed — fall through to SQLite fallback below
+      process.stderr.write(`[hbo] handleGetBusinessGoals Memgraph failed, falling back to SQLite: ${e.message}\n`);
+    }
+  }
+  // SQLite fallback (Memgraph unavailable or query failed)
   try {
-    // Get all BusinessGoal nodes
-    // BUG-12 fix: BusinessGoal relationships are stored as (child)-[:CHILD_OF]->(parent).
-    // The old query used (bg)-[:PARENT_OF]->(child) which matched zero edges.
-    // Migration note: run `MATCH (bg:BusinessGoal)-[:PARENT_OF]->(c:BusinessGoal)
-    //   MERGE (c)-[:CHILD_OF]->(bg) DELETE relationship` if old edges exist.
-    const result = await mgQuery(
-      `MATCH (bg:BusinessGoal {companyId: $cid})
-       OPTIONAL MATCH (child:BusinessGoal)-[:CHILD_OF]->(bg)
-       WITH bg, [x IN collect(child.id) WHERE x IS NOT NULL] AS childIds
-       RETURN bg.id AS id, bg.title AS title, bg.level AS level,
-              bg.ownerAgentId AS ownerAgentId, bg.status AS status,
-              bg.progress AS progress, childIds
-       ORDER BY bg.level ASC`,
-      { cid }
-    );
-    const rows = parseRows(result);
-    const keys = ['id', 'title', 'level', 'ownerAgentId', 'status', 'progress', 'childIds'];
-    const goals = rows.map(r => rowToObj(r, keys));
-    // Build hierarchy tree
-    const rootGoals = goals.filter(g => !g.level || g.level === 0 || g.level === 'company');
-    jsonOk(res, { goals, rootGoals, count: goals.length });
-  } catch (e) {
-    jsonErr(res, 500, `BusinessGoal query failed: ${safeErrMsg(e)}`);
+    const storeGoals = hboStore.getGoalsByCompany ? hboStore.getGoalsByCompany(cid) : [];
+    const goals = (storeGoals || []).map(g => ({
+      id: g.id ?? g.id,
+      title: g.title ?? null,
+      level: g.level ? String(g.level) : null,
+      ownerAgentId: g.ownerAgentId ?? null,
+      status: g.status ?? null,
+      progress: g.progress ?? null,
+      childIds: g.childIds ?? [],
+    }));
+    const rootGoals = goals.filter(g => !g.level || g.level === 'company');
+    return jsonOk(res, { goals, rootGoals, count: goals.length, _source: 'sqlite' });
+  } catch (storeErr) {
+    return jsonErr(res, 503, `Goals unavailable: Memgraph not connected and SQLite fallback failed: ${storeErr.message}`);
+  }
+}
+
+async function handleGetBusinessGoal(req, res, ctx, goalId) {
+  const { mgQuery, cid } = ctx;
+  if (!goalId) { jsonErr(res, 400, 'Missing goal ID'); return; }
+  // SQL-P2: SQLite fallback when Memgraph unavailable.
+  if (mgQuery) {
+    try {
+      const result = await mgQuery(
+        `MATCH (g:BusinessGoal {id: $id, companyId: $cid})
+         RETURN g.id AS id, g.title AS title, g.description AS description,
+                g.level AS level, g.status AS status, g.parentId AS parentId,
+                g.ownerAgentId AS ownerAgentId, g.progress AS progress`,
+        { id: goalId, cid }
+      );
+      const rows = parseRows(result);
+      if (rows.length === 0) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+      const keys = ['id', 'title', 'description', 'level', 'status', 'parentId', 'ownerAgentId', 'progress'];
+      return jsonOk(res, { goal: rowToObj(rows[0], keys) });
+    } catch (e) {
+      process.stderr.write(`[hbo] handleGetBusinessGoal Memgraph failed, falling back to SQLite: ${e.message}\n`);
+    }
+  }
+  // SQLite fallback
+  try {
+    const g = hboStore.getGoal ? hboStore.getGoal(goalId, cid) : null;
+    if (!g) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+    return jsonOk(res, { goal: g, _source: 'sqlite' });
+  } catch (storeErr) {
+    return jsonErr(res, 503, `Goal unavailable: ${storeErr.message}`);
   }
 }
 
+async function handleCreateBusinessGoal(req, res, ctx) {
+  const { mgQuery, cid } = ctx;
+  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  // H-4 fix: reject if cid is missing or is the fallback sentinel — prevents silent writes to 'default-company'
+  if (!cid || cid === 'default-company') { jsonErr(res, 400, 'companyId is required'); return; }
+  try {
+    const body = await readBody(req);
+    if (!assertValidBody(body, res)) return;
+    const title = typeof body.title === 'string' ? body.title.trim() : '';
+    if (!title) { jsonErr(res, 400, 'title is required'); return; }
+
+    const goalId = body.id ? String(body.id) : `bg:${randomUUID()}`;
+    const description = body.description !== undefined ? String(body.description) : null;
+    const level = body.level !== undefined ? String(body.level) : 'company';
+    const parentId = body.parentId || body.parentGoalId ? String(body.parentId || body.parentGoalId) : null;
+
+    await mgQuery(
+      `CREATE (g:BusinessGoal {
+         id: $id, companyId: $cid, title: $title, description: $desc,
+         level: $level, status: 'active', parentId: $parentId,
+         parentGoalId: $parentId, createdAt: datetime(), updatedAt: datetime()
+       })`,
+      { id: goalId, cid, title, desc: description, level, parentId }
+    );
+    try {
+      hboStore.createGoal?.({ id: goalId, companyId: cid, title, description, level, status: 'active', parentId, createdAt: Date.now() });
+    } catch (storeErr) {
+      process.stderr.write(`[hbo] goal mirror failed: ${storeErr.message}\n`);
+    }
+    try { ctx._bc?.({ type: 'goal.created', companyId: cid, goalId }); } catch (_) {}
+    jsonOk(res, { goal: { id: goalId, companyId: cid, title, description, level, status: 'active', parentId } }, 201);
+  } catch (e) {
+    jsonErr(res, 500, `Create BusinessGoal failed: ${safeErrMsg(e)}`);
+  }
+}
+
+async function handleUpdateBusinessGoal(req, res, ctx, goalId) {
+  const { mgQuery, cid } = ctx;
+  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  if (!goalId) { jsonErr(res, 400, 'Missing goal ID'); return; }
+  try {
+    const body = await readBody(req);
+    if (!assertValidBody(body, res)) return;
+    const title = body.title !== undefined ? String(body.title).trim() : null;
+    const description = body.description !== undefined ? String(body.description) : null;
+    const level = body.level !== undefined ? String(body.level) : null;
+    const status = body.status !== undefined ? String(body.status) : null;
+    const parentId = body.parentId !== undefined ? (body.parentId ? String(body.parentId) : null) : undefined;
+
+    if (title === '' || (title === null && description === null && level === null && status === null && parentId === undefined)) {
+      jsonErr(res, 400, 'At least one of title, description, level, status, parentId must be provided');
+      return;
+    }
+
+    const result = await mgQuery(
+      `MATCH (g:BusinessGoal {id: $id, companyId: $cid})
+       SET g.title = COALESCE($title, g.title),
+           g.description = CASE WHEN $hasDescription THEN $description ELSE g.description END,
+           g.level = COALESCE($level, g.level),
+           g.status = COALESCE($status, g.status),
+           g.parentId = CASE WHEN $hasParentId THEN $parentId ELSE g.parentId END,
+           g.parentGoalId = CASE WHEN $hasParentId THEN $parentId ELSE g.parentGoalId END,
+           g.updatedAt = datetime()
+       RETURN g.id AS id, g.title AS title, g.description AS description,
+              g.level AS level, g.status AS status, g.parentId AS parentId`,
+      {
+        id: goalId, cid, title, description, level, status,
+        parentId: parentId === undefined ? null : parentId,
+        hasDescription: body.description !== undefined,
+        hasParentId: parentId !== undefined,
+      }
+    );
+    const rows = parseRows(result);
+    if (rows.length === 0) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+    const goal = rowToObj(rows[0], ['id', 'title', 'description', 'level', 'status', 'parentId']);
+    // H-3 fix: only pass fields that were explicitly provided in the PATCH body to updateGoal.
+    // rowToObj fills missing Memgraph fields with null — passing null for e.g. title would
+    // overwrite the existing SQLite title with null on a status-only update.
+    const storeUpdate: Record<string, any> = { id: goalId };
+    if (title !== null) storeUpdate.title = goal.title;
+    if (description !== null) storeUpdate.description = goal.description;
+    if (level !== null) storeUpdate.level = goal.level;
+    if (status !== null) storeUpdate.status = goal.status;
+    if (parentId !== undefined) storeUpdate.parentId = goal.parentId;
+    try { hboStore.updateGoal?.(goalId, cid, storeUpdate); } catch (storeErr) { process.stderr.write(`[hbo] goal mirror failed: ${storeErr.message}\n`); }
+    try { ctx._bc?.({ type: 'goal.updated', companyId: cid, goalId }); } catch (_) {}
+    jsonOk(res, { goal });
+  } catch (e) {
+    jsonErr(res, 500, `Update BusinessGoal failed: ${safeErrMsg(e)}`);
+  }
+}
+
+async function handleDeleteBusinessGoal(req, res, ctx, goalId) {
+  const { mgQuery, cid } = ctx;
+  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  if (!goalId) { jsonErr(res, 400, 'Missing goal ID'); return; }
+  try {
+    const result = await mgQuery(
+      `MATCH (g:BusinessGoal {id: $id, companyId: $cid})
+       WITH g, g.id AS deletedId
+       DETACH DELETE g
+       RETURN deletedId AS id`,
+      { id: goalId, cid }
+    );
+    if (parseRows(result).length === 0) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+    try { hboStore.deleteGoal?.(goalId, cid); } catch (storeErr) { process.stderr.write(`[hbo] goal mirror failed: ${storeErr.message}\n`); }
+    try { ctx._bc?.({ type: 'goal.deleted', companyId: cid, goalId }); } catch (_) {}
+    jsonOk(res, { deleted: true, goalId });
+  } catch (e) {
+    jsonErr(res, 500, `Delete BusinessGoal failed: ${safeErrMsg(e)}`);
+  }
+}
+
 // ── Warm signals handler ──────────────────────────────────────────────────────
 
 async function handleGetWarmSignals(req, res, ctx) {
@@ -648,20 +823,42 @@ async function handleGetMandala(req, res, ctx) {
     // Build the pillar MATCH differently depending on whether goalId is provided.
     // Memgraph requires extracting all properties into aliases BEFORE OPTIONAL MATCH;
     // referencing gp.property AFTER OPTIONAL MATCH causes "Unbound variable: gp."
-    const pillarQuery = goalId
-      ? `MATCH (gp:GoalPillar {companyId: $cid, goalId: $goalId})
-         WITH gp.id AS id, gp.name AS name, gp.pillarIndex AS pillarIndex,
-              gp.goalId AS goalId, gp.description AS description, gp AS gpNode
-         OPTIONAL MATCH (gpNode)-[:HAS_CELL]->(ac:ActionCell)
-         RETURN id, name, pillarIndex, goalId, description,
-                collect({id: ac.id, action: ac.action, status: ac.status, weekIndex: ac.weekIndex}) AS cells
-         ORDER BY pillarIndex ASC LIMIT toInteger(8)`
-      : `MATCH (gp:GoalPillar {companyId: $cid})
-         WITH gp.id AS id, gp.name AS name, gp.pillarIndex AS pillarIndex,
-              gp.goalId AS goalId, gp.description AS description, gp AS gpNode
-         OPTIONAL MATCH (gpNode)-[:HAS_CELL]->(ac:ActionCell)
-         RETURN id, name, pillarIndex, goalId, description,
-                collect({id: ac.id, action: ac.action, status: ac.status, weekIndex: ac.weekIndex}) AS cells
+    const pillarQuery = goalId
+      ? `MATCH (gp:GoalPillar {companyId: $cid, goalId: $goalId})
+         WITH gp.id AS id, gp.name AS name, gp.pillarIndex AS pillarIndex,
+              gp.goalId AS goalId, gp.description AS description,
+              coalesce(gp.l2ReviewStatus, null) AS l2ReviewStatus,
+              coalesce(gp.l2Strategy, null) AS l2Strategy,
+              gp AS gpNode
+         OPTIONAL MATCH (gpNode)-[:HAS_CELL]->(ac:ActionCell)
+         OPTIONAL MATCH (gpNode)<-[:FOR_PILLAR]-(approval:Approval)
+           WHERE approval.type IN ['harada_l2_review','harada_l3_review'] AND approval.status = 'pending'
+         WITH id, name, pillarIndex, goalId, description, l2ReviewStatus, l2Strategy, gpNode,
+              collect(DISTINCT {id: ac.id, description: ac.description, status: ac.status, cellIndex: ac.cellIndex}) AS cells,
+              count(DISTINCT approval) AS openReviewCount
+         WITH id, name, pillarIndex, goalId, description, l2ReviewStatus, l2Strategy, cells, openReviewCount,
+              size(cells) AS cellCount,
+              reduce(acc = 0, c IN cells | acc + CASE WHEN c.status = 'closed' THEN 1 ELSE 0 END) AS closedCellCount
+         RETURN id, name, pillarIndex, goalId, description, l2ReviewStatus, l2Strategy,
+                cells, openReviewCount, cellCount, closedCellCount
+         ORDER BY pillarIndex ASC LIMIT toInteger(8)`
+      : `MATCH (gp:GoalPillar {companyId: $cid})
+         WITH gp.id AS id, gp.name AS name, gp.pillarIndex AS pillarIndex,
+              gp.goalId AS goalId, gp.description AS description,
+              coalesce(gp.l2ReviewStatus, null) AS l2ReviewStatus,
+              coalesce(gp.l2Strategy, null) AS l2Strategy,
+              gp AS gpNode
+         OPTIONAL MATCH (gpNode)-[:HAS_CELL]->(ac:ActionCell)
+         OPTIONAL MATCH (gpNode)<-[:FOR_PILLAR]-(approval:Approval)
+           WHERE approval.type IN ['harada_l2_review','harada_l3_review'] AND approval.status = 'pending'
+         WITH id, name, pillarIndex, goalId, description, l2ReviewStatus, l2Strategy, gpNode,
+              collect(DISTINCT {id: ac.id, description: ac.description, status: ac.status, cellIndex: ac.cellIndex}) AS cells,
+              count(DISTINCT approval) AS openReviewCount
+         WITH id, name, pillarIndex, goalId, description, l2ReviewStatus, l2Strategy, cells, openReviewCount,
+              size(cells) AS cellCount,
+              reduce(acc = 0, c IN cells | acc + CASE WHEN c.status = 'closed' THEN 1 ELSE 0 END) AS closedCellCount
+         RETURN id, name, pillarIndex, goalId, description, l2ReviewStatus, l2Strategy,
+                cells, openReviewCount, cellCount, closedCellCount
          ORDER BY pillarIndex ASC LIMIT toInteger(8)`;
 
     const saQuery = agentId
@@ -715,7 +912,20 @@ async function handleGetMandala(req, res, ctx) {
       mgQuery(deptAgentQuery, { cid }).catch(() => ({ rows: [], keys: [] })),
     ]);
 
-    const pillarKeys = ['id', 'name', 'pillarIndex', 'goalId', 'description', 'cells'];
+    // Map pillar names to department slugs — GoalPillar nodes never have a .department
+    // property written to them, so we derive the slug from the pillar's canonical name.
+    const PILLAR_NAME_TO_DEPT_SLUG = {
+      'Revenue & Sales':              'sales',
+      'Product & Delivery':           'engineering',
+      'Customer Success':             'customer_success',
+      'Technology & Infrastructure':  'engineering',
+      'Team & Capability':            'people',
+      'Brand & Positioning':          'marketing',
+      'Finance & Sustainability':     'finance',
+      'Operations & Process':         'operations',
+    };
+
+    const pillarKeys = ['id', 'name', 'pillarIndex', 'goalId', 'description', 'l2ReviewStatus', 'l2Strategy', 'cells', 'openReviewCount', 'cellCount', 'closedCellCount'];
     const saKeys = ['id', 'agentId', 'strengths', 'weaknesses', 'opportunities', 'createdAt'];
     const cascadeKeys = ['id', 'agentId', 'weekNumber', 'weeklyGoal', 'dailyTasks', 'completionRate'];
     const deptAgentKeys = ['id', 'role', 'departmentId', 'status', 'currentTaskId', 'currentTask', 'taskStartedAt'];
@@ -733,7 +943,13 @@ async function handleGetMandala(req, res, ctx) {
     });
 
     jsonOk(res, {
-      pillars:      parseRows(pillarResult).map(r => rowToObj(r, pillarKeys)),
+      pillars:      parseRows(pillarResult).map(r => {
+        const p = rowToObj(r, pillarKeys);
+        // Derive department slug from pillar name so the frontend can build dept nav items.
+        // GoalPillar.department is indexed in the schema but never written by any daemon path.
+        p.department = PILLAR_NAME_TO_DEPT_SLUG[p.name] || null;
+        return p;
+      }),
       selfAnalysis: parseRows(selfAnalysisResult).map(r => rowToObj(r, saKeys)),
       cascades:     parseRows(cascadeResult).map(r => rowToObj(r, cascadeKeys)),
       deptAgents,   // live BusinessAgent + Task join for DepartmentPage TeamTab
@@ -1172,13 +1388,20 @@ async function handleCreatePdsa(req, res, ctx) {
     // in every department's decisions tab regardless of which pillar they belong to.
     // Task.pillarId is set by pillar-dispatcher.js when a task is dispatched to a pillar.
     try {
-      const taskRows = await mgQuery(
-        `MATCH (t:Task {id: $taskId, companyId: $cid}) RETURN t.pillarId AS pillarId LIMIT 1`,
-        { taskId: taskId.trim(), cid }
-      );
-      const pillarId = taskRows && taskRows.rows && taskRows.rows[0]
-        ? (Array.isArray(taskRows.rows[0]) ? taskRows.rows[0][0] : taskRows.rows[0].pillarId)
-        : null;
+      // SQLite-first task read for pillarId (P2-10)
+      let pillarId = null;
+      const _storeTask = hboStore.getTask ? hboStore.getTask(taskId.trim(), cid) : null;
+      if (_storeTask) {
+        pillarId = _storeTask.pillarId ?? null;
+      } else {
+        const taskRows = await mgQuery(
+          `MATCH (t:Task {id: $taskId, companyId: $cid}) RETURN t.pillarId AS pillarId LIMIT 1`,
+          { taskId: taskId.trim(), cid }
+        );
+        pillarId = taskRows && taskRows.rows && taskRows.rows[0]
+          ? (Array.isArray(taskRows.rows[0]) ? taskRows.rows[0][0] : taskRows.rows[0].pillarId)
+          : null;
+      }
       if (pillarId && typeof pillarId === 'string' && pillarId.trim()) {
         await mgQuery(
           `MATCH (p:PDSACycle {id: $id, companyId: $cid}) SET p.pillarId = $pillarId`,
@@ -2126,6 +2349,7 @@ async function handleResolveEmailInfraApproval(req, res, ctx, approvalId) {
  */
 async function handleGetHboApprovals(req, res, ctx) {
   try {
+    if (!ctx.mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
     const url = new URL(req.url, 'http://localhost');
     const status = url.searchParams.get('status') || null;
     const type   = url.searchParams.get('type')   || null;
@@ -2149,6 +2373,17 @@ async function handleGetHboApprovals(req, res, ctx) {
         agentId: p?.agentId ?? null, taskId: p?.taskId ?? null,
         urgency: p?.urgency ?? null, humanAnswer: p?.humanAnswer ?? null,
         answeredVia: p?.answeredVia ?? null, createdAt: p?.createdAt ?? null,
+        description: p?.description ?? null,
+        question: p?.question ?? null,
+        defaultAnswer: p?.defaultAnswer ?? null,
+        ruleStrength: p?.ruleStrength ?? null,
+        sourceAgent: p?.sourceAgent ?? null,
+        pillarId: p?.pillarId ?? null,
+        expiresAt: p?.expiresAt ?? null,
+        kaizenProposalId: p?.kaizenProposalId ?? null,
+        department: p?.department ?? null,
+        templateKey: p?.templateKey ?? null,
+        inferredAnswer: p?.inferredAnswer ?? null,
       };
     });
     jsonOk(res, { approvals, count: approvals.length });
@@ -2338,14 +2573,14 @@ async function handleGetTriageSummary(req, res, ctx) {
       { cid }
     );
     const rows = parseRows(result);
-    const counts = { p0: 0, p1: 0, p2: 0, p3: 0, total: 0 };
+    const counts = { p0Count: 0, p1Count: 0, p2Count: 0, p3Count: 0, total: 0, topItems: [], generatedAt: new Date().toISOString() };
     for (const row of rows) {
       const pri = (row[0] ?? row['priority'] ?? '').toString().toUpperCase();
       const cnt = Number(row[1] ?? row['cnt'] ?? 0);
-      if (pri === 'P0') counts.p0 = cnt;
-      else if (pri === 'P1') counts.p1 = cnt;
-      else if (pri === 'P2') counts.p2 = cnt;
-      else if (pri === 'P3') counts.p3 = cnt;
+      if (pri === 'P0') counts.p0Count = cnt;
+      else if (pri === 'P1') counts.p1Count = cnt;
+      else if (pri === 'P2') counts.p2Count = cnt;
+      else if (pri === 'P3') counts.p3Count = cnt;
       counts.total += cnt;
     }
     jsonOk(res, counts);
@@ -2683,6 +2918,14 @@ module.exports = function createHBORouter(handlers) {
       return false;
     }
 
+    // H-2 fix: Handle OPTIONS preflight for all HBO routes (including DELETE /api/hbo/goals/:id).
+    // Must be BEFORE auth check — browsers never send credentials on preflight requests.
+    if (method === 'OPTIONS') {
+      res.writeHead(204, getCorsHeaders(req));
+      res.end();
+      return true;
+    }
+
     // Auth check for all HBO routes
     const authHeader = (req.headers || {})['authorization'];
     const expected = ctx.apiToken;
@@ -2773,6 +3016,30 @@ module.exports = function createHBORouter(handlers) {
       return true;
     }
 
+    // GET /api/hbo/goals/:id — must be checked before POST/PATCH/DELETE goalMatch
+    const goalIdOnlyMatch = pathname.match(/^\/api\/hbo\/goals\/([^/]+)$/);
+    if (method === 'GET' && goalIdOnlyMatch) {
+      await handleGetBusinessGoal(req, res, ctx, decodeURIComponent(goalIdOnlyMatch[1]));
+      return true;
+    }
+
+    // POST /api/hbo/goals
+    if (method === 'POST' && pathname === '/api/hbo/goals') {
+      await handleCreateBusinessGoal(req, res, ctx);
+      return true;
+    }
+
+    // PATCH/DELETE /api/hbo/goals/:id
+    const goalMatch = pathname.match(/^\/api\/hbo\/goals\/(.+)$/);
+    if (method === 'PATCH' && goalMatch) {
+      await handleUpdateBusinessGoal(req, res, ctx, decodeURIComponent(goalMatch[1]));
+      return true;
+    }
+    if (method === 'DELETE' && goalMatch) {
+      await handleDeleteBusinessGoal(req, res, ctx, decodeURIComponent(goalMatch[1]));
+      return true;
+    }
+
     // GET /api/hbo/triage-summary
     if (method === 'GET' && pathname === '/api/hbo/triage-summary') {
       await handleGetTriageSummary(req, res, ctx);