@codemem/server 0.28.0 → 0.29.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncProjectAllowedByFilters, syncVisibilityAllowed, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncProjectAllowedByFilters, syncVisibilityAllowed, updatePeerAddresses, upsertCoordinatorGroupPreference, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -9,7 +9,6 @@ import { homedir, networkInterfaces } from "node:os";
 import { and, count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { createHash, randomUUID } from "node:crypto";
-import net from "node:net";
 //#region src/middleware.ts
 var LOOPBACK_HOSTS = new Set([
 	"127.0.0.1",
@@ -188,6 +187,7 @@ var SECRET_CONFIG_KEYS = new Set([
 	"observer_headers",
 	"sync_coordinator_admin_secret"
 ]);
+var REMOVED_CONFIG_KEYS = new Set(["observer_rich_openai_use_responses"]);
 var ALLOWED_KEYS = [
 	"claude_command",
 	"observer_base_url",
@@ -198,7 +198,6 @@ var ALLOWED_KEYS = [
 	"observer_simple_temperature",
 	"observer_rich_model",
 	"observer_rich_temperature",
-	"observer_rich_openai_use_responses",
 	"observer_rich_reasoning_effort",
 	"observer_rich_reasoning_summary",
 	"observer_rich_max_output_tokens",
@@ -231,7 +230,6 @@ var DEFAULTS = {
 	observer_runtime: "api_http",
 	observer_auth_source: "auto",
 	observer_tier_routing_enabled: false,
-	observer_rich_openai_use_responses: false,
 	observer_auth_command: [],
 	observer_auth_timeout_ms: 1500,
 	observer_auth_cache_ttl_s: 300,
@@ -275,6 +273,11 @@ function readConfigFile(configPath) {
 		return {};
 	}
 }
+function withoutRemovedConfigKeys(configData) {
+	const next = { ...configData };
+	for (const key of REMOVED_CONFIG_KEYS) delete next[key];
+	return next;
+}
 function getEffectiveConfig(configData) {
 	const effective = {
 		...DEFAULTS,
@@ -406,7 +409,7 @@ function validateAndApplyUpdate(configData, key, value, providers) {
 		configData[key] = value;
 		return null;
 	}
-	if (key === "observer_tier_routing_enabled" || key === "observer_rich_openai_use_responses") {
+	if (key === "observer_tier_routing_enabled") {
 		if (typeof value !== "boolean") return `${key} must be boolean`;
 		configData[key] = value;
 		return null;
@@ -446,7 +449,7 @@ function configRoutes(opts = {}) {
 	const app = new Hono();
 	app.get("/api/config", (c) => {
 		const configPath = getConfigPath();
-		const configData = readConfigFile(configPath);
+		const configData = withoutRemovedConfigKeys(readConfigFile(configPath));
 		const effective = getEffectiveConfig(configData);
 		return c.json({
 			path: configPath,
@@ -469,7 +472,7 @@ function configRoutes(opts = {}) {
 		if ("config" in payload && payload.config != null && (typeof payload.config !== "object" || Array.isArray(payload.config))) return c.json({ error: "config must be an object" }, 400);
 		const updates = "config" in payload && payload.config != null && typeof payload.config === "object" && !Array.isArray(payload.config) ? payload.config : payload;
 		const configPath = getCodememConfigPath();
-		const beforeConfig = readCodememConfigFile();
+		const beforeConfig = withoutRemovedConfigKeys(readCodememConfigFile());
 		const { allowedUpdates, error: protectedKeyError } = partitionViewerUpdates(updates, beforeConfig);
 		if (protectedKeyError) return c.json({ error: protectedKeyError }, 403);
 		const beforeEffective = getEffectiveConfig(beforeConfig);
@@ -901,6 +904,28 @@ function memoryRoutes(getStore) {
 			return c.json({ error: msg }, 400);
 		}
 	});
+	app.post("/api/memories/project", async (c) => {
+		const store = getStore();
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid JSON" }, 400);
+		}
+		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
+		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
+		const project = String(body.project ?? "").trim();
+		if (!project) return c.json({ error: "project must be a non-empty string" }, 400);
+		try {
+			const result = store.moveMemoryProject(memoryId, project);
+			return c.json(result);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			if (msg.includes("not found")) return c.json({ error: msg }, 404);
+			if (msg.includes("not owned")) return c.json({ error: msg }, 403);
+			return c.json({ error: msg }, 400);
+		}
+	});
 	app.post("/api/memories/forget", async (c) => {
 		const store = getStore();
 		let body;
@@ -1319,20 +1344,31 @@ function statsRoutes(getStore) {
 			return null;
 		}
 	};
+	const RECENTLY_COMPLETED_WINDOW_MS = 12e4;
 	app.get("/api/stats", (c) => {
 		const store = getStore();
-		const activeJobs = sortActiveMaintenanceJobs$1(listMaintenanceJobs(store.db).filter((job) => job.status === "pending" || job.status === "running" || job.status === "failed")).map((job) => ({
+		const jobs = listMaintenanceJobs(store.db);
+		const now = Date.now();
+		const surfacedJobs = sortActiveMaintenanceJobs$1(jobs.filter((job) => {
+			if (job.status === "pending" || job.status === "running" || job.status === "failed") return true;
+			if (job.status === "completed" && job.finished_at) {
+				const finished = Date.parse(job.finished_at);
+				if (Number.isFinite(finished) && now - finished <= RECENTLY_COMPLETED_WINDOW_MS) return true;
+			}
+			return false;
+		})).map((job) => ({
 			kind: job.kind,
 			title: job.title,
 			status: job.status,
 			message: job.message,
 			progress: job.progress,
+			finished_at: job.finished_at,
 			error: job.error
 		}));
 		return c.json({
 			...store.stats(),
 			viewer_pid: process.pid,
-			maintenance_jobs: activeJobs
+			maintenance_jobs: surfacedJobs
 		});
 	});
 	app.get("/api/runtime", (c) => {
@@ -1418,6 +1454,60 @@ var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
 var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
 var LEGACY_SHARED_WORKSPACE_ID = "shared:legacy";
+/**
+* Attempt to decode a pasted string as a device-pairing payload.
+*
+* Returns:
+*   - `{ kind: "pair", ... }` when the payload base64-decodes to JSON with
+*     the expected pairing shape AND the fingerprint matches the public
+*     key.
+*   - `{ kind: "invalid-pair", error }` when the payload looked like a
+*     pairing payload but failed validation — the caller should 400 this
+*     rather than falling back to coordinator-invite handling.
+*   - `null` when the string is not a pairing payload at all.
+*/
+function tryParsePairingPayload(value) {
+	let parsed;
+	if (value.trimStart().startsWith("{")) try {
+		parsed = JSON.parse(value);
+	} catch {
+		return null;
+	}
+	else {
+		let decoded;
+		try {
+			decoded = Buffer.from(value, "base64").toString("utf8");
+		} catch {
+			return null;
+		}
+		if (!decoded?.trimStart().startsWith("{")) return null;
+		try {
+			parsed = JSON.parse(decoded);
+		} catch {
+			return null;
+		}
+	}
+	const deviceId = String(parsed.device_id ?? "").trim();
+	const fingerprint = String(parsed.fingerprint ?? "").trim();
+	const publicKey = String(parsed.public_key ?? "").trim();
+	if (!deviceId && !fingerprint && !publicKey) return null;
+	const addresses = (Array.isArray(parsed.addresses) ? parsed.addresses : []).filter((item) => typeof item === "string" && item.trim().length > 0).map((item) => item.trim());
+	if (!deviceId || !fingerprint || !publicKey || addresses.length === 0) return {
+		kind: "invalid-pair",
+		error: "Pairing payload missing device_id, fingerprint, public_key, or addresses"
+	};
+	if (fingerprintPublicKey(publicKey) !== fingerprint) return {
+		kind: "invalid-pair",
+		error: "Pairing payload fingerprint mismatch"
+	};
+	return {
+		kind: "pair",
+		device_id: deviceId,
+		fingerprint,
+		public_key: publicKey,
+		addresses
+	};
+}
 function coordinatorAdminStatusPayload(config = readCoordinatorSyncConfig()) {
 	const groups = config.syncCoordinatorGroups;
 	const activeGroup = groups[0] ?? null;
@@ -1874,19 +1964,31 @@ async function acceptDiscoveredPeer(store, input) {
 		detail: "This discovered device is missing its coordinator public key. Refresh sync status and try again."
 	};
 	const groupIds = Array.isArray(match.groups) ? match.groups.map((value) => String(value ?? "").trim()).filter(Boolean) : [];
-	if (groupIds.length !== 1) return {
-		ok: false,
-		status: 409,
-		error: "ambiguous_coordinator_group",
-		detail: groupIds.length > 1 ? "This device is visible through multiple coordinator groups. Review the team setup before approving it here." : "This device is missing coordinator group context. Refresh sync status and try again."
-	};
-	const groupId = groupIds[0];
+	let groupId;
+	if (input.expectedGroupId) {
+		if (!groupIds.includes(input.expectedGroupId)) return {
+			ok: false,
+			status: 409,
+			error: "peer_not_in_group",
+			detail: "This discovered device is not visible through the specified coordinator group. Refresh sync status and try again."
+		};
+		groupId = input.expectedGroupId;
+	} else {
+		if (groupIds.length !== 1) return {
+			ok: false,
+			status: 409,
+			error: "ambiguous_coordinator_group",
+			detail: groupIds.length > 1 ? "This device is visible through multiple coordinator groups. Review the team setup before approving it here." : "This device is missing coordinator group context. Refresh sync status and try again."
+		};
+		groupId = groupIds[0];
+	}
 	const d = drizzle(store.db, { schema });
 	const existing = d.select({
 		peer_device_id: schema.syncPeers.peer_device_id,
 		pinned_fingerprint: schema.syncPeers.pinned_fingerprint,
 		public_key: schema.syncPeers.public_key,
-		addresses_json: schema.syncPeers.addresses_json
+		addresses_json: schema.syncPeers.addresses_json,
+		discovered_via_group_id: schema.syncPeers.discovered_via_group_id
 	}).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, input.peerDeviceId)).get();
 	const existingFingerprint = String(existing?.pinned_fingerprint ?? "").trim();
 	if (existing && existingFingerprint && existingFingerprint !== nextFingerprint) return {
@@ -1908,6 +2010,26 @@ async function acceptDiscoveredPeer(store, input) {
 		groupId,
 		requestedDeviceId: input.peerDeviceId
 	});
+	const coordinatorUrl = config.syncCoordinatorUrl || null;
+	let scopeInclude;
+	let scopeExclude;
+	if (!existing) {
+		let templateInclude = null;
+		let templateExclude = null;
+		if (coordinatorUrl) {
+			const prefs = getCoordinatorGroupPreference(store.db, coordinatorUrl, groupId);
+			if (prefs?.auto_seed_scope) {
+				templateInclude = prefs.projects_include ?? null;
+				templateExclude = prefs.projects_exclude ?? null;
+			}
+		}
+		const overrideInclude = input.scopeOverride?.projects_include;
+		const overrideExclude = input.scopeOverride?.projects_exclude;
+		const resolvedInclude = overrideInclude === void 0 ? templateInclude : overrideInclude;
+		const resolvedExclude = overrideExclude === void 0 ? templateExclude : overrideExclude;
+		scopeInclude = resolvedInclude ? JSON.stringify(resolvedInclude) : null;
+		scopeExclude = resolvedExclude ? JSON.stringify(resolvedExclude) : null;
+	}
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	return store.db.transaction(() => {
 		if (!existing) {
@@ -1917,15 +2039,20 @@ async function acceptDiscoveredPeer(store, input) {
 				pinned_fingerprint: nextFingerprint || null,
 				public_key: nextPublicKey,
 				addresses_json: addressesJson,
+				projects_include_json: scopeInclude ?? null,
+				projects_exclude_json: scopeExclude ?? null,
 				created_at: now,
-				last_seen_at: now
+				last_seen_at: now,
+				discovered_via_coordinator_id: coordinatorUrl,
+				discovered_via_group_id: groupId
 			}).run();
 			return {
 				ok: true,
 				peer_device_id: input.peerDeviceId,
 				created: true,
 				updated: false,
-				name: nextName
+				name: nextName,
+				group_id: groupId
 			};
 		}
 		d.update(schema.syncPeers).set({
@@ -1933,14 +2060,19 @@ async function acceptDiscoveredPeer(store, input) {
 			pinned_fingerprint: nextFingerprint || existing.pinned_fingerprint || null,
 			public_key: nextPublicKey || existing.public_key || null,
 			addresses_json: addressesJson,
-			last_seen_at: now
+			last_seen_at: now,
+			...existing.discovered_via_group_id ? {} : {
+				discovered_via_group_id: groupId,
+				discovered_via_coordinator_id: coordinatorUrl
+			}
 		}).where(eq(schema.syncPeers.peer_device_id, input.peerDeviceId)).run();
 		return {
 			ok: true,
 			peer_device_id: input.peerDeviceId,
 			created: false,
 			updated: true,
-			name: nextName
+			name: nextName,
+			group_id: groupId
 		};
 	})();
 }
@@ -1998,7 +2130,9 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer) {
 		recent_ops: {
 			in: recentOps.in,
 			out: recentOps.out
-		}
+		},
+		discovered_via_coordinator_id: typeof row.discovered_via_coordinator_id === "string" ? row.discovered_via_coordinator_id : null,
+		discovered_via_group_id: typeof row.discovered_via_group_id === "string" ? row.discovered_via_group_id : null
 	};
 }
 var SYNC_DIRECTION_WINDOW_SECONDS = 1440 * 60;
@@ -2068,23 +2202,6 @@ function readViewerBinding(dbPath) {
 	} catch {}
 	return null;
 }
-async function portOpen(host, port) {
-	return new Promise((resolve) => {
-		const socket = net.createConnection({
-			host,
-			port
-		});
-		const done = (ok) => {
-			socket.removeAllListeners();
-			socket.destroy();
-			resolve(ok);
-		};
-		socket.setTimeout(300);
-		socket.once("connect", () => done(true));
-		socket.once("timeout", () => done(false));
-		socket.once("error", () => done(false));
-	});
-}
 var PEERS_QUERY = `
 	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.addresses_json,
 	       p.last_seen_at, p.last_sync_at, p.last_error,
@@ -2335,13 +2452,13 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				retentionState = void 0;
 			}
 			const lastSyncRow = traceSync("lastSyncRow", () => d.select({ last_sync_at: max(schema.syncPeers.last_sync_at) }).from(schema.syncPeers).get());
-			const semanticIndex = traceSync("semanticIndex", () => redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(store.db, { fastCounts: !showDiag }), showDiag));
+			const semanticIndex = traceSync("semanticIndex", () => redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(store.db), showDiag));
 			const lastError = daemonState?.last_error;
 			const lastErrorAt = daemonState?.last_error_at;
 			const lastOkAt = daemonState?.last_ok_at;
 			const viewerBinding = traceSync("readViewerBinding", () => readViewerBinding(store.dbPath));
-			const daemonRunning = viewerBinding ? await portOpen(viewerBinding.host, viewerBinding.port) : false;
-			const daemonDetail = viewerBinding ? daemonRunning ? `viewer pidfile at ${viewerBinding.host}:${viewerBinding.port}` : `pidfile present but ${viewerBinding.host}:${viewerBinding.port} is unreachable` : null;
+			const daemonRunning = Boolean(viewerBinding);
+			const daemonDetail = viewerBinding ? `viewer pidfile at ${viewerBinding.host}:${viewerBinding.port}` : null;
 			let daemonStateValue = "ok";
 			if (!config.syncEnabled) daemonStateValue = "disabled";
 			else if (lastError && (!lastOkAt || String(lastOkAt) < String(lastErrorAt ?? ""))) daemonStateValue = "error";
@@ -2520,10 +2637,6 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 	app.get("/api/sync/pairing", (c) => {
 		const store = getStore();
 		{
-			if (!queryBool(c.req.query("includeDiagnostics"))) return c.json({
-				redacted: true,
-				pairing_filter_hint: PAIRING_FILTER_HINT
-			});
 			const config = readCoordinatorSyncConfig();
 			const d = drizzle(store.db, { schema });
 			const deviceRow = d.select({
@@ -2878,14 +2991,32 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		} catch {
 			return c.json({ error: "invalid json" }, 400);
 		}
-		const inviteValue = String(body.invite ?? "").trim();
-		if (!inviteValue) return c.json({ error: "invite required" }, 400);
+		const rawValue = String(body.invite ?? "").trim();
+		if (!rawValue) return c.json({ error: "invite required" }, 400);
+		const pairingResult = tryParsePairingPayload(rawValue.match(/echo\s+['"]([A-Za-z0-9+/=]+)['"]\s*\|\s*base64\s+-d\s*\|\s*codemem/)?.[1]?.trim() || rawValue);
+		if (pairingResult?.kind === "invalid-pair") return c.json({ error: pairingResult.error }, 400);
+		if (pairingResult?.kind === "pair") try {
+			updatePeerAddresses(store.db, pairingResult.device_id, pairingResult.addresses, {
+				pinnedFingerprint: pairingResult.fingerprint,
+				publicKey: pairingResult.public_key
+			});
+			return c.json({
+				ok: true,
+				type: "pair",
+				peer_device_id: pairingResult.device_id
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		}
 		try {
 			const result = await coordinatorImportInviteAction({
-				inviteValue,
+				inviteValue: rawValue,
 				dbPath: store.dbPath
 			});
-			return c.json(result);
+			return c.json({
+				...result,
+				type: "team_join"
+			});
 		} catch (error) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
 		}
@@ -3457,6 +3588,202 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			}, 400);
 		}
 	});
+	app.post("/api/coordinator/admin/groups/:group_id/enroll-peer", async (c) => {
+		const status = coordinatorAdminStatusPayload(readCoordinatorSyncConfig());
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		const rawGroupId = String(c.req.param("group_id") ?? "").trim();
+		if (!rawGroupId) return c.json({ error: "group_id required" }, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid_json" }, 400);
+		}
+		const rawMode = String(body.mode ?? "").trim().toLowerCase();
+		if (rawMode && rawMode !== "manual" && rawMode !== "discovered") return c.json({
+			error: "invalid_mode",
+			detail: `mode must be 'discovered' or 'manual', got ${rawMode}`
+		}, 400);
+		const mode = rawMode === "manual" ? "manual" : "discovered";
+		const normalizeOverride = (value) => {
+			if (value === void 0) return void 0;
+			if (value === null) return null;
+			if (!Array.isArray(value)) return void 0;
+			const cleaned = value.map((item) => String(item ?? "").trim()).filter((item) => item.length > 0);
+			return cleaned.length === 0 ? null : cleaned;
+		};
+		const overrideInclude = normalizeOverride(body.projects_include);
+		const overrideExclude = normalizeOverride(body.projects_exclude);
+		const scopeOverride = overrideInclude === void 0 && overrideExclude === void 0 ? void 0 : {
+			projects_include: overrideInclude,
+			projects_exclude: overrideExclude
+		};
+		const store = getStore();
+		if (mode === "manual") {
+			const peerDeviceId = String(body.peer_device_id ?? "").trim();
+			const publicKey = String(body.peer_public_key ?? "").trim();
+			const name = String(body.name ?? "").trim() || null;
+			const fingerprint = String(body.fingerprint ?? "").trim() || null;
+			const addresses = (Array.isArray(body.peer_addresses) ? body.peer_addresses : []).map((item) => String(item ?? "").trim()).filter((item) => item.length > 0);
+			if (!peerDeviceId || !publicKey) return c.json({ error: "peer_device_id_and_public_key_required" }, 400);
+			const manualInclude = overrideInclude && overrideInclude.length > 0 ? JSON.stringify(overrideInclude) : null;
+			const manualExclude = overrideExclude && overrideExclude.length > 0 ? JSON.stringify(overrideExclude) : null;
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const d = drizzle(store.db, { schema });
+			try {
+				if (!store.db.transaction(() => {
+					if (d.select({ peer_device_id: schema.syncPeers.peer_device_id }).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get()) return false;
+					d.insert(schema.syncPeers).values({
+						peer_device_id: peerDeviceId,
+						name,
+						pinned_fingerprint: fingerprint,
+						public_key: publicKey,
+						addresses_json: JSON.stringify(addresses),
+						projects_include_json: manualInclude,
+						projects_exclude_json: manualExclude,
+						created_at: now,
+						last_seen_at: now,
+						discovered_via_coordinator_id: null,
+						discovered_via_group_id: null
+					}).run();
+					return true;
+				})()) return c.json({
+					error: "peer_exists",
+					detail: "Peer is already enrolled."
+				}, 409);
+			} catch (error) {
+				const msg = error instanceof Error ? error.message.toLowerCase() : "";
+				if (msg.includes("unique") || msg.includes("primary key")) return c.json({
+					error: "peer_exists",
+					detail: "Peer is already enrolled."
+				}, 409);
+				throw error;
+			}
+			return c.json({
+				ok: true,
+				peer_device_id: peerDeviceId,
+				created: true,
+				updated: false,
+				name,
+				group_id: null
+			});
+		}
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const peerDeviceId = String(body.peer_device_id ?? body.discovered_device_id ?? "").trim();
+		const fingerprint = String(body.fingerprint ?? "").trim();
+		if (!peerDeviceId || !fingerprint) return c.json({ error: "peer_device_id_and_fingerprint_required" }, 400);
+		try {
+			const result = await acceptDiscoveredPeer(store, {
+				peerDeviceId,
+				fingerprint,
+				expectedGroupId: rawGroupId,
+				scopeOverride
+			});
+			if (result.ok) return c.json(result);
+			return c.json({
+				error: result.error,
+				detail: result.detail
+			}, result.status);
+		} catch (error) {
+			return c.json({
+				error: "coordinator_lookup_failed",
+				detail: error instanceof Error ? error.message : String(error)
+			}, 502);
+		}
+	});
+	app.get("/api/coordinator/admin/groups/:group_id/preferences", (c) => {
+		const status = coordinatorAdminStatusPayload(readCoordinatorSyncConfig());
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		const coordinatorId = status.coordinator_url;
+		if (!coordinatorId) return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		const existing = getCoordinatorGroupPreference(getStore().db, coordinatorId, groupId);
+		if (existing) return c.json({
+			preferences: existing,
+			status
+		});
+		return c.json({
+			preferences: {
+				coordinator_id: coordinatorId,
+				group_id: groupId,
+				projects_include: null,
+				projects_exclude: null,
+				auto_seed_scope: true,
+				updated_at: null
+			},
+			status
+		});
+	});
+	app.put("/api/coordinator/admin/groups/:group_id/preferences", async (c) => {
+		const status = coordinatorAdminStatusPayload(readCoordinatorSyncConfig());
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		const coordinatorId = status.coordinator_url;
+		if (!coordinatorId) return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid_json",
+				status
+			}, 400);
+		}
+		const normalizeList = (value) => {
+			if (value === void 0) return void 0;
+			if (value === null) return null;
+			if (!Array.isArray(value)) return void 0;
+			const cleaned = value.map((item) => String(item ?? "").trim()).filter((item) => item.length > 0);
+			return cleaned.length === 0 ? null : cleaned;
+		};
+		const autoSeed = typeof body.auto_seed_scope === "boolean" ? body.auto_seed_scope : void 0;
+		const store = getStore();
+		try {
+			const preferences = upsertCoordinatorGroupPreference(store.db, {
+				coordinator_id: coordinatorId,
+				group_id: groupId,
+				projects_include: normalizeList(body.projects_include),
+				projects_exclude: normalizeList(body.projects_exclude),
+				auto_seed_scope: autoSeed
+			});
+			return c.json({
+				preferences,
+				status
+			});
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			return c.json({
+				error: msg,
+				status
+			}, 400);
+		}
+	});
 	app.post("/api/coordinator/admin/devices/:device_id/remove", async (c) => {
 		const config = readCoordinatorSyncConfig();
 		const status = coordinatorAdminStatusPayload(config);