@femtomc/mu-server 26.2.68 → 26.2.70

package/dist/server.js

@@ -1,57 +1,19 @@
-import { extname, join, resolve } from "node:path";
-import { GenerationTelemetryRecorder, getControlPlanePaths, IdentityStore, ROLE_SCOPES, } from "@femtomc/mu-control-plane";
+import { GenerationTelemetryRecorder, } from "@femtomc/mu-control-plane";
 import { currentRunId, EventLog, FsJsonlStore, getStorePaths, JsonlEventSink } from "@femtomc/mu-core/node";
 import { ForumStore } from "@femtomc/mu-forum";
 import { IssueStore } from "@femtomc/mu-issue";
 import { ControlPlaneActivitySupervisor } from "./activity_supervisor.js";
-import { eventRoutes } from "./api/events.js";
-import { forumRoutes } from "./api/forum.js";
-import { issueRoutes } from "./api/issues.js";
-import { applyMuConfigPatch, DEFAULT_MU_CONFIG, getMuConfigPath, muConfigPresence, readMuConfigFile, redactMuConfigSecrets, writeMuConfigFile, } from "./config.js";
-import { bootstrapControlPlane, } from "./control_plane.js";
-import { CronProgramRegistry } from "./cron_programs.js";
+import { DEFAULT_MU_CONFIG, readMuConfigFile, writeMuConfigFile, } from "./config.js";
+import { bootstrapControlPlane } from "./control_plane.js";
 import { ControlPlaneGenerationSupervisor } from "./generation_supervisor.js";
-import { HeartbeatProgramRegistry, } from "./heartbeat_programs.js";
 import { ActivityHeartbeatScheduler } from "./heartbeat_scheduler.js";
-const MIME_TYPES = {
-    ".html": "text/html; charset=utf-8",
-    ".js": "text/javascript; charset=utf-8",
-    ".css": "text/css; charset=utf-8",
-    ".json": "application/json",
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".svg": "image/svg+xml",
-    ".ico": "image/x-icon",
-    ".woff": "font/woff",
-    ".woff2": "font/woff2",
-};
-// Resolve public/ dir relative to this file (works in npm global installs)
-const PUBLIC_DIR = join(new URL(".", import.meta.url).pathname, "..", "public");
+import { createProcessSessionLifecycle } from "./session_lifecycle.js";
+import { createServerProgramOrchestration } from "./server_program_orchestration.js";
+import { createServerRequestHandler } from "./server_routing.js";
+import { toNonNegativeInt } from "./server_types.js";
 const DEFAULT_OPERATOR_WAKE_COALESCE_MS = 2_000;
 const DEFAULT_AUTO_RUN_HEARTBEAT_EVERY_MS = 15_000;
-const AUTO_RUN_HEARTBEAT_REASON = "auto-run-heartbeat";
-function normalizeWakeMode(value) {
-    if (typeof value !== "string") {
-        return "immediate";
-    }
-    const normalized = value.trim().toLowerCase().replaceAll("-", "_");
-    return normalized === "next_heartbeat" ? "next_heartbeat" : "immediate";
-}
-function toNonNegativeInt(value, fallback) {
-    if (typeof value === "number" && Number.isFinite(value)) {
-        return Math.max(0, Math.trunc(value));
-    }
-    if (typeof value === "string" && /^\d+$/.test(value.trim())) {
-        return Math.max(0, Number.parseInt(value, 10));
-    }
-    return Math.max(0, Math.trunc(fallback));
-}
-function shellQuoteArg(value) {
-    return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-function shellJoin(args) {
-    return args.map(shellQuoteArg).join(" ");
-}
+export { createProcessSessionLifecycle };
 function describeError(err) {
     if (err instanceof Error)
         return err.message;
@@ -67,71 +29,6 @@ function summarizeControlPlane(handle) {
         routes: handle.activeAdapters.map((adapter) => ({ name: adapter.name, route: adapter.route })),
     };
 }
-function parseCronTarget(body) {
-    const targetKind = typeof body.target_kind === "string" ? body.target_kind.trim().toLowerCase() : "";
-    if (targetKind === "run") {
-        const jobId = typeof body.run_job_id === "string" ? body.run_job_id.trim() : "";
-        const rootIssueId = typeof body.run_root_issue_id === "string" ? body.run_root_issue_id.trim() : "";
-        if (!jobId && !rootIssueId) {
-            return {
-                target: null,
-                error: "run target requires run_job_id or run_root_issue_id",
-            };
-        }
-        return {
-            target: {
-                kind: "run",
-                job_id: jobId || null,
-                root_issue_id: rootIssueId || null,
-            },
-            error: null,
-        };
-    }
-    if (targetKind === "activity") {
-        const activityId = typeof body.activity_id === "string" ? body.activity_id.trim() : "";
-        if (!activityId) {
-            return {
-                target: null,
-                error: "activity target requires activity_id",
-            };
-        }
-        return {
-            target: {
-                kind: "activity",
-                activity_id: activityId,
-            },
-            error: null,
-        };
-    }
-    return {
-        target: null,
-        error: "target_kind must be run or activity",
-    };
-}
-function hasCronScheduleInput(body) {
-    return (body.schedule != null ||
-        body.schedule_kind != null ||
-        body.at_ms != null ||
-        body.at != null ||
-        body.every_ms != null ||
-        body.anchor_ms != null ||
-        body.expr != null ||
-        body.tz != null);
-}
-function cronScheduleInputFromBody(body) {
-    if (body.schedule && typeof body.schedule === "object" && !Array.isArray(body.schedule)) {
-        return { ...body.schedule };
-    }
-    return {
-        kind: typeof body.schedule_kind === "string" ? body.schedule_kind : undefined,
-        at_ms: body.at_ms,
-        at: body.at,
-        every_ms: body.every_ms,
-        anchor_ms: body.anchor_ms,
-        expr: body.expr,
-        tz: body.tz,
-    };
-}
 export function createContext(repoRoot) {
     const paths = getStorePaths(repoRoot);
     const eventsStore = new FsJsonlStore(paths.eventsPath);
@@ -142,7 +39,7 @@ export function createContext(repoRoot) {
     const forumStore = new ForumStore(new FsJsonlStore(paths.forumPath), { events: eventLog });
     return { repoRoot, issueStore, forumStore, eventLog, eventsStore };
 }
-export function createServer(options = {}) {
+function createServer(options = {}) {
     const repoRoot = options.repoRoot || process.cwd();
     const context = createContext(repoRoot);
     const readConfig = options.configReader ?? readMuConfigFile;
@@ -170,145 +67,7 @@ export function createServer(options = {}) {
     const operatorWakeCoalesceMs = toNonNegativeInt(options.operatorWakeCoalesceMs, DEFAULT_OPERATOR_WAKE_COALESCE_MS);
     const autoRunHeartbeatEveryMs = Math.max(1_000, toNonNegativeInt(options.autoRunHeartbeatEveryMs, DEFAULT_AUTO_RUN_HEARTBEAT_EVERY_MS));
     const operatorWakeLastByKey = new Map();
-    const autoRunHeartbeatProgramByJobId = new Map();
-    let sessionMutationScheduled = null;
-    const runShellCommand = async (command) => {
-        const proc = Bun.spawn({
-            cmd: ["bash", "-lc", command],
-            cwd: repoRoot,
-            env: Bun.env,
-            stdin: "ignore",
-            stdout: "pipe",
-            stderr: "pipe",
-        });
-        const [exitCode, stdout, stderr] = await Promise.all([
-            proc.exited,
-            proc.stdout ? new Response(proc.stdout).text() : Promise.resolve(""),
-            proc.stderr ? new Response(proc.stderr).text() : Promise.resolve(""),
-        ]);
-        return {
-            exitCode: Number.isFinite(exitCode) ? Number(exitCode) : 1,
-            stdout,
-            stderr,
-        };
-    };
-    const defaultSessionMutationHooks = {
-        reload: async () => {
-            if (sessionMutationScheduled) {
-                return {
-                    ok: true,
-                    action: sessionMutationScheduled.action,
-                    message: `session ${sessionMutationScheduled.action} already scheduled`,
-                    details: { scheduled_at_ms: sessionMutationScheduled.at_ms },
-                };
-            }
-            const nowMs = Date.now();
-            const restartCommand = Bun.env.MU_RESTART_COMMAND?.trim();
-            const inferredArgs = process.argv[0] === process.execPath
-                ? [process.execPath, ...process.argv.slice(1)]
-                : [process.execPath, ...process.argv];
-            const restartShellCommand = restartCommand && restartCommand.length > 0 ? restartCommand : shellJoin(inferredArgs);
-            if (!restartShellCommand.trim()) {
-                return {
-                    ok: false,
-                    action: "reload",
-                    message: "unable to determine restart command",
-                };
-            }
-            const exitDelayMs = 1_000;
-            const launchDelayMs = exitDelayMs + 300;
-            const delayedShellCommand = `sleep ${(launchDelayMs / 1_000).toFixed(2)}; ${restartShellCommand}`;
-            let spawnedPid = null;
-            try {
-                const proc = Bun.spawn({
-                    cmd: ["bash", "-lc", delayedShellCommand],
-                    cwd: repoRoot,
-                    env: Bun.env,
-                    stdin: "ignore",
-                    stdout: "inherit",
-                    stderr: "inherit",
-                });
-                spawnedPid = proc.pid ?? null;
-            }
-            catch (err) {
-                return {
-                    ok: false,
-                    action: "reload",
-                    message: `failed to spawn replacement process: ${describeError(err)}`,
-                };
-            }
-            sessionMutationScheduled = { action: "reload", at_ms: nowMs };
-            setTimeout(() => {
-                process.exit(0);
-            }, exitDelayMs);
-            return {
-                ok: true,
-                action: "reload",
-                message: "reload scheduled; restarting process",
-                details: {
-                    restart_command: restartShellCommand,
-                    restart_launch_command: delayedShellCommand,
-                    spawned_pid: spawnedPid,
-                    exit_delay_ms: exitDelayMs,
-                    launch_delay_ms: launchDelayMs,
-                },
-            };
-        },
-        update: async () => {
-            if (sessionMutationScheduled) {
-                return {
-                    ok: true,
-                    action: sessionMutationScheduled.action,
-                    message: `session ${sessionMutationScheduled.action} already scheduled`,
-                    details: { scheduled_at_ms: sessionMutationScheduled.at_ms },
-                };
-            }
-            const updateCommand = Bun.env.MU_UPDATE_COMMAND?.trim() || "npm install -g @femtomc/mu@latest";
-            const result = await runShellCommand(updateCommand);
-            if (result.exitCode !== 0) {
-                return {
-                    ok: false,
-                    action: "update",
-                    message: `update command failed (exit ${result.exitCode})`,
-                    details: {
-                        update_command: updateCommand,
-                        stdout: result.stdout.slice(-4_000),
-                        stderr: result.stderr.slice(-4_000),
-                    },
-                };
-            }
-            const reloadResult = await defaultSessionMutationHooks.reload?.();
-            if (!reloadResult) {
-                return {
-                    ok: false,
-                    action: "update",
-                    message: "reload hook unavailable after update",
-                };
-            }
-            if (!reloadResult.ok) {
-                return {
-                    ok: false,
-                    action: "update",
-                    message: reloadResult.message,
-                    details: {
-                        update_command: updateCommand,
-                        reload: reloadResult.details ?? null,
-                    },
-                };
-            }
-            return {
-                ok: true,
-                action: "update",
-                message: "update applied; reload scheduled",
-                details: {
-                    update_command: updateCommand,
-                    reload: reloadResult.details ?? null,
-                    update_stdout_tail: result.stdout.slice(-1_000),
-                },
-            };
-        },
-    };
-    const sessionMutationHooks = options.sessionMutationHooks ?? defaultSessionMutationHooks;
+    const sessionLifecycle = options.sessionLifecycle ?? createProcessSessionLifecycle({ repoRoot });
     const emitOperatorWake = async (opts) => {
         const dedupeKey = opts.dedupeKey.trim();
         if (!dedupeKey) {
@@ -358,7 +117,7 @@ export function createServer(options = {}) {
                 heartbeatScheduler,
                 generation,
                 telemetry: generationTelemetry,
-                sessionMutationHooks,
+                sessionLifecycle,
                 terminalEnabled: true,
             });
         });
@@ -431,246 +190,15 @@ export function createServer(options = {}) {
             await handle?.stop();
         },
     };
-    const heartbeatPrograms = new HeartbeatProgramRegistry({
+    const { heartbeatPrograms, cronPrograms, registerAutoRunHeartbeatProgram, disableAutoRunHeartbeatProgram, } = createServerProgramOrchestration({
         repoRoot,
         heartbeatScheduler,
-        runHeartbeat: async (opts) => {
-            const result = await controlPlaneProxy.heartbeatRun?.({
-                jobId: opts.jobId ?? null,
-                rootIssueId: opts.rootIssueId ?? null,
-                reason: opts.reason ?? null,
-                wakeMode: opts.wakeMode,
-            });
-            return result ?? { ok: false, reason: "not_found" };
-        },
-        activityHeartbeat: async (opts) => {
-            return activitySupervisor.heartbeat({
-                activityId: opts.activityId ?? null,
-                reason: opts.reason ?? null,
-            });
-        },
-        onTickEvent: async (event) => {
-            await context.eventLog.emit("heartbeat_program.tick", {
-                source: "mu-server.heartbeat-programs",
-                payload: {
-                    program_id: event.program_id,
-                    status: event.status,
-                    reason: event.reason,
-                    message: event.message,
-                    program: event.program,
-                },
-            });
-            await emitOperatorWake({
-                dedupeKey: `heartbeat-program:${event.program_id}`,
-                message: event.message,
-                payload: {
-                    wake_source: "heartbeat_program",
-                    program_id: event.program_id,
-                    status: event.status,
-                    reason: event.reason,
-                    wake_mode: event.program.wake_mode,
-                    target_kind: event.program.target.kind,
-                    target: event.program.target.kind === "run"
-                        ? {
-                            job_id: event.program.target.job_id,
-                            root_issue_id: event.program.target.root_issue_id,
-                        }
-                        : { activity_id: event.program.target.activity_id },
-                },
-            });
-        },
-    });
-    const cronPrograms = new CronProgramRegistry({
-        repoRoot,
-        heartbeatScheduler,
-        runHeartbeat: async (opts) => {
-            const result = await controlPlaneProxy.heartbeatRun?.({
-                jobId: opts.jobId ?? null,
-                rootIssueId: opts.rootIssueId ?? null,
-                reason: opts.reason ?? null,
-                wakeMode: opts.wakeMode,
-            });
-            return result ?? { ok: false, reason: "not_found" };
-        },
-        activityHeartbeat: async (opts) => {
-            return activitySupervisor.heartbeat({
-                activityId: opts.activityId ?? null,
-                reason: opts.reason ?? null,
-            });
-        },
-        onLifecycleEvent: async (event) => {
-            await context.eventLog.emit("cron_program.lifecycle", {
-                source: "mu-server.cron-programs",
-                payload: {
-                    action: event.action,
-                    program_id: event.program_id,
-                    message: event.message,
-                    program: event.program,
-                },
-            });
-        },
-        onTickEvent: async (event) => {
-            await context.eventLog.emit("cron_program.tick", {
-                source: "mu-server.cron-programs",
-                payload: {
-                    program_id: event.program_id,
-                    status: event.status,
-                    reason: event.reason,
-                    message: event.message,
-                    program: event.program,
-                },
-            });
-            await emitOperatorWake({
-                dedupeKey: `cron-program:${event.program_id}`,
-                message: event.message,
-                payload: {
-                    wake_source: "cron_program",
-                    program_id: event.program_id,
-                    status: event.status,
-                    reason: event.reason,
-                    wake_mode: event.program.wake_mode,
-                    target_kind: event.program.target.kind,
-                    target: event.program.target.kind === "run"
-                        ? {
-                            job_id: event.program.target.job_id,
-                            root_issue_id: event.program.target.root_issue_id,
-                        }
-                        : { activity_id: event.program.target.activity_id },
-                },
-            });
-        },
+        controlPlaneProxy,
+        activitySupervisor,
+        eventLog: context.eventLog,
+        autoRunHeartbeatEveryMs,
+        emitOperatorWake,
     });
-    const findAutoRunHeartbeatProgram = async (jobId) => {
-        const normalizedJobId = jobId.trim();
-        if (!normalizedJobId) {
-            return null;
-        }
-        const knownProgramId = autoRunHeartbeatProgramByJobId.get(normalizedJobId);
-        if (knownProgramId) {
-            const knownProgram = await heartbeatPrograms.get(knownProgramId);
-            if (knownProgram) {
-                return knownProgram;
-            }
-            autoRunHeartbeatProgramByJobId.delete(normalizedJobId);
-        }
-        const programs = await heartbeatPrograms.list({ targetKind: "run", limit: 500 });
-        for (const program of programs) {
-            if (program.metadata.auto_run_job_id !== normalizedJobId) {
-                continue;
-            }
-            autoRunHeartbeatProgramByJobId.set(normalizedJobId, program.program_id);
-            return program;
-        }
-        return null;
-    };
-    const registerAutoRunHeartbeatProgram = async (run) => {
-        if (run.source === "command") {
-            return;
-        }
-        const jobId = run.job_id.trim();
-        if (!jobId || run.status !== "running") {
-            return;
-        }
-        const rootIssueId = typeof run.root_issue_id === "string" ? run.root_issue_id.trim() : "";
-        const metadata = {
-            auto_run_heartbeat: true,
-            auto_run_job_id: jobId,
-            auto_run_root_issue_id: rootIssueId || null,
-            auto_disable_on_terminal: true,
-            run_mode: run.mode,
-            run_source: run.source,
-        };
-        const existing = await findAutoRunHeartbeatProgram(jobId);
-        if (existing) {
-            const result = await heartbeatPrograms.update({
-                programId: existing.program_id,
-                title: `Run heartbeat: ${rootIssueId || jobId}`,
-                target: {
-                    kind: "run",
-                    job_id: jobId,
-                    root_issue_id: rootIssueId || null,
-                },
-                enabled: true,
-                everyMs: autoRunHeartbeatEveryMs,
-                reason: AUTO_RUN_HEARTBEAT_REASON,
-                wakeMode: "next_heartbeat",
-                metadata,
-            });
-            if (result.ok && result.program) {
-                autoRunHeartbeatProgramByJobId.set(jobId, result.program.program_id);
-                await context.eventLog.emit("run.auto_heartbeat.lifecycle", {
-                    source: "mu-server.runs",
-                    payload: {
-                        action: "updated",
-                        run_job_id: jobId,
-                        run_root_issue_id: rootIssueId || null,
-                        program_id: result.program.program_id,
-                        program: result.program,
-                    },
-                });
-            }
-            return;
-        }
-        const created = await heartbeatPrograms.create({
-            title: `Run heartbeat: ${rootIssueId || jobId}`,
-            target: {
-                kind: "run",
-                job_id: jobId,
-                root_issue_id: rootIssueId || null,
-            },
-            everyMs: autoRunHeartbeatEveryMs,
-            reason: AUTO_RUN_HEARTBEAT_REASON,
-            wakeMode: "next_heartbeat",
-            metadata,
-            enabled: true,
-        });
-        autoRunHeartbeatProgramByJobId.set(jobId, created.program_id);
-        await context.eventLog.emit("run.auto_heartbeat.lifecycle", {
-            source: "mu-server.runs",
-            payload: {
-                action: "registered",
-                run_job_id: jobId,
-                run_root_issue_id: rootIssueId || null,
-                program_id: created.program_id,
-                program: created,
-            },
-        });
-    };
-    const disableAutoRunHeartbeatProgram = async (opts) => {
-        const program = await findAutoRunHeartbeatProgram(opts.jobId);
-        if (!program) {
-            return;
-        }
-        const metadata = {
-            ...program.metadata,
-            auto_disabled_from_status: opts.status,
-            auto_disabled_reason: opts.reason,
-            auto_disabled_at_ms: Date.now(),
-        };
-        const result = await heartbeatPrograms.update({
-            programId: program.program_id,
-            enabled: false,
-            everyMs: 0,
-            reason: AUTO_RUN_HEARTBEAT_REASON,
-            wakeMode: program.wake_mode,
-            metadata,
-        });
-        autoRunHeartbeatProgramByJobId.delete(opts.jobId.trim());
-        if (!result.ok || !result.program) {
-            return;
-        }
-        await context.eventLog.emit("run.auto_heartbeat.lifecycle", {
-            source: "mu-server.runs",
-            payload: {
-                action: "disabled",
-                run_job_id: opts.jobId,
-                status: opts.status,
-                reason: opts.reason,
-                program_id: result.program.program_id,
-                program: result.program,
-            },
-        });
-    };
     const loadConfigFromDisk = async () => {
         try {
             return await readConfig(context.repoRoot);
@@ -1155,1089 +683,26 @@ export function createServer(options = {}) {
         });
         return await reloadInFlight;
     };
-    const handleRequest = async (request) => {
-        const url = new URL(request.url);
-        const path = url.pathname;
-        const headers = new Headers({
-            "Access-Control-Allow-Origin": "*",
-            "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
-            "Access-Control-Allow-Headers": "Content-Type",
-        });
-        if (request.method === "OPTIONS") {
-            return new Response(null, { status: 204, headers });
-        }
-        if (path === "/healthz" || path === "/health") {
-            return new Response("ok", { status: 200, headers });
-        }
-        if (path === "/api/config") {
-            if (request.method === "GET") {
-                try {
-                    const config = await loadConfigFromDisk();
-                    return Response.json({
-                        repo_root: context.repoRoot,
-                        config_path: getMuConfigPath(context.repoRoot),
-                        config: redactMuConfigSecrets(config),
-                        presence: muConfigPresence(config),
-                    }, { headers });
-                }
-                catch (err) {
-                    return Response.json({ error: `failed to read config: ${describeError(err)}` }, { status: 500, headers });
-                }
-            }
-            if (request.method === "POST") {
-                let body;
-                try {
-                    body = (await request.json());
-                }
-                catch {
-                    return Response.json({ error: "invalid json body" }, { status: 400, headers });
-                }
-                if (!body || !("patch" in body)) {
-                    return Response.json({ error: "missing patch payload" }, { status: 400, headers });
-                }
-                try {
-                    const base = await loadConfigFromDisk();
-                    const next = applyMuConfigPatch(base, body.patch);
-                    const configPath = await writeConfig(context.repoRoot, next);
-                    return Response.json({
-                        ok: true,
-                        repo_root: context.repoRoot,
-                        config_path: configPath,
-                        config: redactMuConfigSecrets(next),
-                        presence: muConfigPresence(next),
-                    }, { headers });
-                }
-                catch (err) {
-                    return Response.json({ error: `failed to write config: ${describeError(err)}` }, { status: 500, headers });
-                }
-            }
-            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-        }
-        if (path === "/api/control-plane/reload") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let reason = "api_control_plane_reload";
-            try {
-                const body = (await request.json());
-                if (typeof body.reason === "string" && body.reason.trim().length > 0) {
-                    reason = body.reason.trim();
-                }
-            }
-            catch {
-                // ignore invalid body for reason
-            }
-            const result = await reloadControlPlane(reason);
-            return Response.json(result, { status: result.ok ? 200 : 500, headers });
-        }
-        if (path === "/api/control-plane/rollback") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const result = await reloadControlPlane("rollback");
-            return Response.json(result, { status: result.ok ? 200 : 500, headers });
-        }
-        if (path === "/api/status") {
-            const issues = await context.issueStore.list();
-            const openIssues = issues.filter((i) => i.status === "open");
-            const readyIssues = await context.issueStore.ready();
-            const controlPlane = {
-                ...summarizeControlPlane(controlPlaneCurrent),
-                generation: generationSupervisor.snapshot(),
-                observability: {
-                    counters: generationTelemetry.counters(),
-                },
-            };
-            return Response.json({
-                repo_root: context.repoRoot,
-                open_count: openIssues.length,
-                ready_count: readyIssues.length,
-                control_plane: controlPlane,
-            }, { headers });
-        }
-        if (path === "/api/commands/submit") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const kind = typeof body.kind === "string" ? body.kind.trim() : "";
-            if (!kind) {
-                return Response.json({ error: "kind is required" }, { status: 400, headers });
-            }
-            let commandText;
-            switch (kind) {
-                case "run_start": {
-                    const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
-                    if (!prompt) {
-                        return Response.json({ error: "prompt is required for run_start" }, { status: 400, headers });
-                    }
-                    const maxStepsSuffix = typeof body.max_steps === "number" && Number.isFinite(body.max_steps)
-                        ? ` --max-steps ${Math.max(1, Math.trunc(body.max_steps))}`
-                        : "";
-                    commandText = `mu! run start ${prompt}${maxStepsSuffix}`;
-                    break;
-                }
-                case "run_resume": {
-                    const rootId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : "";
-                    const maxSteps = typeof body.max_steps === "number" && Number.isFinite(body.max_steps)
-                        ? ` ${Math.max(1, Math.trunc(body.max_steps))}`
-                        : "";
-                    commandText = `mu! run resume${rootId ? ` ${rootId}` : ""}${maxSteps}`;
-                    break;
-                }
-                case "run_interrupt": {
-                    const rootId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : "";
-                    commandText = `mu! run interrupt${rootId ? ` ${rootId}` : ""}`;
-                    break;
-                }
-                case "reload":
-                    commandText = "/mu reload";
-                    break;
-                case "update":
-                    commandText = "/mu update";
-                    break;
-                case "status":
-                    commandText = "/mu status";
-                    break;
-                case "issue_list":
-                    commandText = "/mu issue list";
-                    break;
-                case "issue_get": {
-                    const issueId = typeof body.issue_id === "string" ? body.issue_id.trim() : "";
-                    commandText = `/mu issue get${issueId ? ` ${issueId}` : ""}`;
-                    break;
-                }
-                case "forum_read": {
-                    const topic = typeof body.topic === "string" ? body.topic.trim() : "";
-                    const limit = typeof body.limit === "number" && Number.isFinite(body.limit)
-                        ? ` ${Math.max(1, Math.trunc(body.limit))}`
-                        : "";
-                    commandText = `/mu forum read${topic ? ` ${topic}` : ""}${limit}`;
-                    break;
-                }
-                case "run_list":
-                    commandText = "/mu run list";
-                    break;
-                case "run_status": {
-                    const rootId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : "";
-                    commandText = `/mu run status${rootId ? ` ${rootId}` : ""}`;
-                    break;
-                }
-                case "ready":
-                    commandText = "/mu ready";
-                    break;
-                default:
-                    return Response.json({ error: `unknown command kind: ${kind}` }, { status: 400, headers });
-            }
-            try {
-                if (!controlPlaneProxy.submitTerminalCommand) {
-                    return Response.json({ error: "control plane not available" }, { status: 503, headers });
-                }
-                const result = await controlPlaneProxy.submitTerminalCommand({
-                    commandText,
-                    repoRoot: context.repoRoot,
-                });
-                return Response.json({ ok: true, result }, { headers });
-            }
-            catch (err) {
-                return Response.json({ error: `command failed: ${describeError(err)}` }, { status: 500, headers });
-            }
-        }
-        if (path === "/api/runs") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const status = url.searchParams.get("status")?.trim() || undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const runs = await controlPlaneProxy.listRuns?.({ status, limit });
-            return Response.json({ count: runs?.length ?? 0, runs: runs ?? [] }, { headers });
-        }
-        if (path === "/api/runs/start") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
-            if (prompt.length === 0) {
-                return Response.json({ error: "prompt is required" }, { status: 400, headers });
-            }
-            const maxSteps = typeof body.max_steps === "number" && Number.isFinite(body.max_steps)
-                ? Math.max(1, Math.trunc(body.max_steps))
-                : undefined;
-            try {
-                const run = await controlPlaneProxy.startRun?.({ prompt, maxSteps });
-                if (!run) {
-                    return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-                }
-                await registerAutoRunHeartbeatProgram(run).catch(async (error) => {
-                    await context.eventLog.emit("run.auto_heartbeat.lifecycle", {
-                        source: "mu-server.runs",
-                        payload: {
-                            action: "register_failed",
-                            run_job_id: run.job_id,
-                            error: describeError(error),
-                        },
-                    });
-                });
-                return Response.json({ ok: true, run }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: describeError(err) }, { status: 500, headers });
-            }
-        }
-        if (path === "/api/runs/resume") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const rootIssueId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : "";
-            if (rootIssueId.length === 0) {
-                return Response.json({ error: "root_issue_id is required" }, { status: 400, headers });
-            }
-            const maxSteps = typeof body.max_steps === "number" && Number.isFinite(body.max_steps)
-                ? Math.max(1, Math.trunc(body.max_steps))
-                : undefined;
-            try {
-                const run = await controlPlaneProxy.resumeRun?.({ rootIssueId, maxSteps });
-                if (!run) {
-                    return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-                }
-                await registerAutoRunHeartbeatProgram(run).catch(async (error) => {
-                    await context.eventLog.emit("run.auto_heartbeat.lifecycle", {
-                        source: "mu-server.runs",
-                        payload: {
-                            action: "register_failed",
-                            run_job_id: run.job_id,
-                            error: describeError(error),
-                        },
-                    });
-                });
-                return Response.json({ ok: true, run }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: describeError(err) }, { status: 500, headers });
-            }
-        }
-        if (path === "/api/runs/interrupt") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const rootIssueId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : null;
-            const jobId = typeof body.job_id === "string" ? body.job_id.trim() : null;
-            const result = await controlPlaneProxy.interruptRun?.({
-                rootIssueId,
-                jobId,
-            });
-            if (!result) {
-                return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-            }
-            if (!result.ok && result.reason === "not_running" && result.run) {
-                await disableAutoRunHeartbeatProgram({
-                    jobId: result.run.job_id,
-                    status: result.run.status,
-                    reason: "interrupt_not_running",
-                }).catch(() => {
-                    // best effort cleanup only
-                });
-            }
-            return Response.json(result, { status: result.ok ? 200 : 404, headers });
-        }
-        if (path === "/api/runs/heartbeat") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const rootIssueId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : null;
-            const jobId = typeof body.job_id === "string" ? body.job_id.trim() : null;
-            const reason = typeof body.reason === "string" ? body.reason.trim() : null;
-            const wakeMode = normalizeWakeMode(body.wake_mode);
-            const result = await controlPlaneProxy.heartbeatRun?.({
-                rootIssueId,
-                jobId,
-                reason,
-                wakeMode,
-            });
-            if (!result) {
-                return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-            }
-            if (!result.ok && result.reason === "not_running" && result.run) {
-                await disableAutoRunHeartbeatProgram({
-                    jobId: result.run.job_id,
-                    status: result.run.status,
-                    reason: "run_not_running",
-                }).catch(() => {
-                    // best effort cleanup only
-                });
-            }
-            if (result.ok) {
-                return Response.json(result, { status: 200, headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
-        }
-        if (path.startsWith("/api/runs/")) {
-            const rest = path.slice("/api/runs/".length);
-            const [rawId, maybeSub] = rest.split("/");
-            const idOrRoot = decodeURIComponent(rawId ?? "").trim();
-            if (idOrRoot.length === 0) {
-                return Response.json({ error: "missing run id" }, { status: 400, headers });
-            }
-            if (maybeSub === "trace") {
-                if (request.method !== "GET") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                const limitRaw = url.searchParams.get("limit");
-                const limit = limitRaw && /^\d+$/.test(limitRaw)
-                    ? Math.max(1, Math.min(2_000, Number.parseInt(limitRaw, 10)))
-                    : undefined;
-                const trace = await controlPlaneProxy.traceRun?.({ idOrRoot, limit });
-                if (!trace) {
-                    return Response.json({ error: "run trace not found" }, { status: 404, headers });
-                }
-                return Response.json(trace, { headers });
-            }
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const run = await controlPlaneProxy.getRun?.(idOrRoot);
-            if (!run) {
-                return Response.json({ error: "run not found" }, { status: 404, headers });
-            }
-            if (run.status !== "running") {
-                await disableAutoRunHeartbeatProgram({
-                    jobId: run.job_id,
-                    status: run.status,
-                    reason: "run_terminal_snapshot",
-                }).catch(() => {
-                    // best effort cleanup only
-                });
-            }
-            return Response.json(run, { headers });
-        }
-        if (path === "/api/cron/status") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const status = await cronPrograms.status();
-            return Response.json(status, { headers });
-        }
-        if (path === "/api/cron") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const enabledRaw = url.searchParams.get("enabled")?.trim().toLowerCase();
-            const enabled = enabledRaw === "true" ? true : enabledRaw === "false" ? false : undefined;
-            const targetKindRaw = url.searchParams.get("target_kind")?.trim().toLowerCase();
-            const targetKind = targetKindRaw === "run" || targetKindRaw === "activity" ? targetKindRaw : undefined;
-            const scheduleKindRaw = url.searchParams.get("schedule_kind")?.trim().toLowerCase();
-            const scheduleKind = scheduleKindRaw === "at" || scheduleKindRaw === "every" || scheduleKindRaw === "cron"
-                ? scheduleKindRaw
-                : undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const programs = await cronPrograms.list({ enabled, targetKind, scheduleKind, limit });
-            return Response.json({ count: programs.length, programs }, { headers });
-        }
-        if (path === "/api/cron/create") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const title = typeof body.title === "string" ? body.title.trim() : "";
-            if (!title) {
-                return Response.json({ error: "title is required" }, { status: 400, headers });
-            }
-            const parsedTarget = parseCronTarget(body);
-            if (!parsedTarget.target) {
-                return Response.json({ error: parsedTarget.error ?? "invalid target" }, { status: 400, headers });
-            }
-            if (!hasCronScheduleInput(body)) {
-                return Response.json({ error: "schedule is required" }, { status: 400, headers });
-            }
-            const schedule = cronScheduleInputFromBody(body);
-            const reason = typeof body.reason === "string" ? body.reason.trim() : undefined;
-            const wakeMode = normalizeWakeMode(body.wake_mode);
-            const enabled = typeof body.enabled === "boolean" ? body.enabled : undefined;
-            try {
-                const program = await cronPrograms.create({
-                    title,
-                    target: parsedTarget.target,
-                    schedule,
-                    reason,
-                    wakeMode,
-                    enabled,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                return Response.json({ ok: true, program }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/cron/update") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            let target;
-            if (typeof body.target_kind === "string") {
-                const parsedTarget = parseCronTarget(body);
-                if (!parsedTarget.target) {
-                    return Response.json({ error: parsedTarget.error ?? "invalid target" }, { status: 400, headers });
-                }
-                target = parsedTarget.target;
-            }
-            const schedule = hasCronScheduleInput(body) ? cronScheduleInputFromBody(body) : undefined;
-            const wakeMode = Object.hasOwn(body, "wake_mode") ? normalizeWakeMode(body.wake_mode) : undefined;
-            try {
-                const result = await cronPrograms.update({
-                    programId,
-                    title: typeof body.title === "string" ? body.title : undefined,
-                    reason: typeof body.reason === "string" ? body.reason : undefined,
-                    wakeMode,
-                    enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
-                    target,
-                    schedule,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                if (result.ok) {
-                    return Response.json(result, { headers });
-                }
-                if (result.reason === "not_found") {
-                    return Response.json(result, { status: 404, headers });
-                }
-                return Response.json(result, { status: 400, headers });
-            }
-            catch (err) {
-                return Response.json({ error: describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/cron/delete") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            const result = await cronPrograms.remove(programId);
-            return Response.json(result, { status: result.ok ? 200 : result.reason === "not_found" ? 404 : 400, headers });
-        }
-        if (path === "/api/cron/trigger") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = await cronPrograms.trigger({
-                programId: typeof body.program_id === "string" ? body.program_id : null,
-                reason: typeof body.reason === "string" ? body.reason : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_found") {
-                return Response.json(result, { status: 404, headers });
-            }
-            return Response.json(result, { status: 409, headers });
-        }
-        if (path.startsWith("/api/cron/")) {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const id = decodeURIComponent(path.slice("/api/cron/".length)).trim();
-            if (!id) {
-                return Response.json({ error: "missing program id" }, { status: 400, headers });
-            }
-            const program = await cronPrograms.get(id);
-            if (!program) {
-                return Response.json({ error: "program not found" }, { status: 404, headers });
-            }
-            return Response.json(program, { headers });
-        }
-        if (path === "/api/heartbeats") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const enabledRaw = url.searchParams.get("enabled")?.trim().toLowerCase();
-            const enabled = enabledRaw === "true" ? true : enabledRaw === "false" ? false : undefined;
-            const targetKindRaw = url.searchParams.get("target_kind")?.trim().toLowerCase();
-            const targetKind = targetKindRaw === "run" || targetKindRaw === "activity" ? targetKindRaw : undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const programs = await heartbeatPrograms.list({ enabled, targetKind, limit });
-            return Response.json({ count: programs.length, programs }, { headers });
-        }
-        if (path === "/api/heartbeats/create") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const title = typeof body.title === "string" ? body.title.trim() : "";
-            if (!title) {
-                return Response.json({ error: "title is required" }, { status: 400, headers });
-            }
-            const targetKind = typeof body.target_kind === "string" ? body.target_kind.trim().toLowerCase() : "";
-            let target = null;
-            if (targetKind === "run") {
-                const jobId = typeof body.run_job_id === "string" ? body.run_job_id.trim() : "";
-                const rootIssueId = typeof body.run_root_issue_id === "string" ? body.run_root_issue_id.trim() : "";
-                if (!jobId && !rootIssueId) {
-                    return Response.json({ error: "run target requires run_job_id or run_root_issue_id" }, { status: 400, headers });
-                }
-                target = {
-                    kind: "run",
-                    job_id: jobId || null,
-                    root_issue_id: rootIssueId || null,
-                };
-            }
-            else if (targetKind === "activity") {
-                const activityId = typeof body.activity_id === "string" ? body.activity_id.trim() : "";
-                if (!activityId) {
-                    return Response.json({ error: "activity target requires activity_id" }, { status: 400, headers });
-                }
-                target = {
-                    kind: "activity",
-                    activity_id: activityId,
-                };
-            }
-            else {
-                return Response.json({ error: "target_kind must be run or activity" }, { status: 400, headers });
-            }
-            const everyMs = typeof body.every_ms === "number" && Number.isFinite(body.every_ms)
-                ? Math.max(0, Math.trunc(body.every_ms))
-                : undefined;
-            const reason = typeof body.reason === "string" ? body.reason.trim() : undefined;
-            const wakeMode = normalizeWakeMode(body.wake_mode);
-            const enabled = typeof body.enabled === "boolean" ? body.enabled : undefined;
-            try {
-                const program = await heartbeatPrograms.create({
-                    title,
-                    target,
-                    everyMs,
-                    reason,
-                    wakeMode,
-                    enabled,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                return Response.json({ ok: true, program }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/heartbeats/update") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            let target;
-            if (typeof body.target_kind === "string") {
-                const targetKind = body.target_kind.trim().toLowerCase();
-                if (targetKind === "run") {
-                    const jobId = typeof body.run_job_id === "string" ? body.run_job_id.trim() : "";
-                    const rootIssueId = typeof body.run_root_issue_id === "string" ? body.run_root_issue_id.trim() : "";
-                    if (!jobId && !rootIssueId) {
-                        return Response.json({ error: "run target requires run_job_id or run_root_issue_id" }, { status: 400, headers });
-                    }
-                    target = {
-                        kind: "run",
-                        job_id: jobId || null,
-                        root_issue_id: rootIssueId || null,
-                    };
-                }
-                else if (targetKind === "activity") {
-                    const activityId = typeof body.activity_id === "string" ? body.activity_id.trim() : "";
-                    if (!activityId) {
-                        return Response.json({ error: "activity target requires activity_id" }, { status: 400, headers });
-                    }
-                    target = {
-                        kind: "activity",
-                        activity_id: activityId,
-                    };
-                }
-                else {
-                    return Response.json({ error: "target_kind must be run or activity" }, { status: 400, headers });
-                }
-            }
-            const wakeMode = Object.hasOwn(body, "wake_mode") ? normalizeWakeMode(body.wake_mode) : undefined;
-            try {
-                const result = await heartbeatPrograms.update({
-                    programId,
-                    title: typeof body.title === "string" ? body.title : undefined,
-                    target,
-                    everyMs: typeof body.every_ms === "number" && Number.isFinite(body.every_ms)
-                        ? Math.max(0, Math.trunc(body.every_ms))
-                        : undefined,
-                    reason: typeof body.reason === "string" ? body.reason : undefined,
-                    wakeMode,
-                    enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                if (result.ok) {
-                    return Response.json(result, { headers });
-                }
-                return Response.json(result, { status: result.reason === "not_found" ? 404 : 400, headers });
-            }
-            catch (err) {
-                return Response.json({ error: describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/heartbeats/delete") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            const result = await heartbeatPrograms.remove(programId);
-            return Response.json(result, { status: result.ok ? 200 : result.reason === "not_found" ? 404 : 400, headers });
-        }
-        if (path === "/api/heartbeats/trigger") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = await heartbeatPrograms.trigger({
-                programId: typeof body.program_id === "string" ? body.program_id : null,
-                reason: typeof body.reason === "string" ? body.reason : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_found") {
-                return Response.json(result, { status: 404, headers });
-            }
-            return Response.json(result, { status: 409, headers });
-        }
-        if (path.startsWith("/api/heartbeats/")) {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const id = decodeURIComponent(path.slice("/api/heartbeats/".length)).trim();
-            if (!id) {
-                return Response.json({ error: "missing program id" }, { status: 400, headers });
-            }
-            const program = await heartbeatPrograms.get(id);
-            if (!program) {
-                return Response.json({ error: "program not found" }, { status: 404, headers });
-            }
-            return Response.json(program, { headers });
-        }
-        if (path === "/api/activities") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const statusRaw = url.searchParams.get("status")?.trim().toLowerCase();
-            const status = statusRaw === "running" || statusRaw === "completed" || statusRaw === "failed" || statusRaw === "cancelled"
-                ? statusRaw
-                : undefined;
-            const kind = url.searchParams.get("kind")?.trim() || undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const activities = activitySupervisor.list({ status, kind, limit });
-            return Response.json({ count: activities.length, activities }, { headers });
-        }
-        if (path === "/api/activities/start") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const title = typeof body.title === "string" ? body.title.trim() : "";
-            if (!title) {
-                return Response.json({ error: "title is required" }, { status: 400, headers });
-            }
-            const kind = typeof body.kind === "string" ? body.kind.trim() : undefined;
-            const heartbeatEveryMs = typeof body.heartbeat_every_ms === "number" && Number.isFinite(body.heartbeat_every_ms)
-                ? Math.max(0, Math.trunc(body.heartbeat_every_ms))
-                : undefined;
-            const source = body.source === "api" || body.source === "command" || body.source === "system" ? body.source : "api";
-            try {
-                const activity = activitySupervisor.start({
-                    title,
-                    kind,
-                    heartbeatEveryMs,
-                    metadata: body.metadata ?? undefined,
-                    source,
-                });
-                return Response.json({ ok: true, activity }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/activities/progress") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = activitySupervisor.progress({
-                activityId: typeof body.activity_id === "string" ? body.activity_id : null,
-                message: typeof body.message === "string" ? body.message : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
-        }
-        if (path === "/api/activities/heartbeat") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = activitySupervisor.heartbeat({
-                activityId: typeof body.activity_id === "string" ? body.activity_id : null,
-                reason: typeof body.reason === "string" ? body.reason : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
-        }
-        if (path === "/api/activities/complete" || path === "/api/activities/fail" || path === "/api/activities/cancel") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const activityId = typeof body.activity_id === "string" ? body.activity_id : null;
-            const message = typeof body.message === "string" ? body.message : null;
-            const result = path === "/api/activities/complete"
-                ? activitySupervisor.complete({ activityId, message })
-                : path === "/api/activities/fail"
-                    ? activitySupervisor.fail({ activityId, message })
-                    : activitySupervisor.cancel({ activityId, message });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
-        }
-        if (path.startsWith("/api/activities/")) {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const rest = path.slice("/api/activities/".length);
-            const [rawId, maybeSub] = rest.split("/");
-            const activityId = decodeURIComponent(rawId ?? "").trim();
-            if (activityId.length === 0) {
-                return Response.json({ error: "missing activity id" }, { status: 400, headers });
-            }
-            if (maybeSub === "events") {
-                const limitRaw = url.searchParams.get("limit");
-                const limit = limitRaw && /^\d+$/.test(limitRaw)
-                    ? Math.max(1, Math.min(2_000, Number.parseInt(limitRaw, 10)))
-                    : undefined;
-                const events = activitySupervisor.events(activityId, { limit });
-                if (!events) {
-                    return Response.json({ error: "activity not found" }, { status: 404, headers });
-                }
-                return Response.json({ count: events.length, events }, { headers });
-            }
-            const activity = activitySupervisor.get(activityId);
-            if (!activity) {
-                return Response.json({ error: "activity not found" }, { status: 404, headers });
-            }
-            return Response.json(activity, { headers });
-        }
-        if (path === "/api/identities" || path === "/api/identities/link" || path === "/api/identities/unlink") {
-            const cpPaths = getControlPlanePaths(context.repoRoot);
-            const identityStore = new IdentityStore(cpPaths.identitiesPath);
-            await identityStore.load();
-            if (path === "/api/identities") {
-                if (request.method !== "GET") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                const includeInactive = url.searchParams.get("include_inactive")?.trim().toLowerCase() === "true";
-                const bindings = identityStore.listBindings({ includeInactive });
-                return Response.json({ count: bindings.length, bindings }, { headers });
-            }
-            if (path === "/api/identities/link") {
-                if (request.method !== "POST") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                let body;
-                try {
-                    body = (await request.json());
-                }
-                catch {
-                    return Response.json({ error: "invalid json body" }, { status: 400, headers });
-                }
-                const channel = typeof body.channel === "string" ? body.channel.trim() : "";
-                if (!channel || (channel !== "slack" && channel !== "discord" && channel !== "telegram")) {
-                    return Response.json({ error: "channel is required (slack, discord, telegram)" }, { status: 400, headers });
-                }
-                const actorId = typeof body.actor_id === "string" ? body.actor_id.trim() : "";
-                if (!actorId) {
-                    return Response.json({ error: "actor_id is required" }, { status: 400, headers });
-                }
-                const tenantId = typeof body.tenant_id === "string" ? body.tenant_id.trim() : "";
-                if (!tenantId) {
-                    return Response.json({ error: "tenant_id is required" }, { status: 400, headers });
-                }
-                const roleKey = typeof body.role === "string" ? body.role.trim() : "operator";
-                const roleScopes = ROLE_SCOPES[roleKey];
-                if (!roleScopes) {
-                    return Response.json({ error: `invalid role: ${roleKey} (operator, contributor, viewer)` }, { status: 400, headers });
-                }
-                const bindingId = typeof body.binding_id === "string" && body.binding_id.trim().length > 0
-                    ? body.binding_id.trim()
-                    : `bind-${crypto.randomUUID()}`;
-                const operatorId = typeof body.operator_id === "string" && body.operator_id.trim().length > 0
-                    ? body.operator_id.trim()
-                    : "default";
-                const decision = await identityStore.link({
-                    bindingId,
-                    operatorId,
-                    channel: channel,
-                    channelTenantId: tenantId,
-                    channelActorId: actorId,
-                    scopes: [...roleScopes],
-                });
-                switch (decision.kind) {
-                    case "linked":
-                        return Response.json({ ok: true, kind: "linked", binding: decision.binding }, { status: 201, headers });
-                    case "binding_exists":
-                        return Response.json({ ok: false, kind: "binding_exists", binding: decision.binding }, { status: 409, headers });
-                    case "principal_already_linked":
-                        return Response.json({ ok: false, kind: "principal_already_linked", binding: decision.binding }, { status: 409, headers });
-                }
-            }
-            if (path === "/api/identities/unlink") {
-                if (request.method !== "POST") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                let body;
-                try {
-                    body = (await request.json());
-                }
-                catch {
-                    return Response.json({ error: "invalid json body" }, { status: 400, headers });
-                }
-                const bindingId = typeof body.binding_id === "string" ? body.binding_id.trim() : "";
-                if (!bindingId) {
-                    return Response.json({ error: "binding_id is required" }, { status: 400, headers });
-                }
-                const actorBindingId = typeof body.actor_binding_id === "string" ? body.actor_binding_id.trim() : "";
-                if (!actorBindingId) {
-                    return Response.json({ error: "actor_binding_id is required" }, { status: 400, headers });
-                }
-                const reason = typeof body.reason === "string" ? body.reason.trim() : null;
-                const decision = await identityStore.unlinkSelf({
-                    bindingId,
-                    actorBindingId,
-                    reason: reason || null,
-                });
-                switch (decision.kind) {
-                    case "unlinked":
-                        return Response.json({ ok: true, kind: "unlinked", binding: decision.binding }, { headers });
-                    case "not_found":
-                        return Response.json({ ok: false, kind: "not_found" }, { status: 404, headers });
-                    case "invalid_actor":
-                        return Response.json({ ok: false, kind: "invalid_actor" }, { status: 403, headers });
-                    case "already_inactive":
-                        return Response.json({ ok: false, kind: "already_inactive", binding: decision.binding }, { status: 409, headers });
-                }
-            }
-        }
-        if (path.startsWith("/api/issues")) {
-            const response = await issueRoutes(request, context);
-            headers.forEach((value, key) => {
-                response.headers.set(key, value);
-            });
-            return response;
-        }
-        if (path.startsWith("/api/forum")) {
-            const response = await forumRoutes(request, context);
-            headers.forEach((value, key) => {
-                response.headers.set(key, value);
-            });
-            return response;
-        }
-        if (path.startsWith("/api/events")) {
-            const response = await eventRoutes(request, context);
-            headers.forEach((value, key) => {
-                response.headers.set(key, value);
-            });
-            return response;
-        }
-        if (path.startsWith("/webhooks/")) {
-            const response = await controlPlaneProxy.handleWebhook(path, request);
-            if (response) {
-                headers.forEach((value, key) => {
-                    response.headers.set(key, value);
-                });
-                return response;
-            }
-        }
-        const filePath = resolve(PUBLIC_DIR, `.${path === "/" ? "/index.html" : path}`);
-        if (!filePath.startsWith(PUBLIC_DIR)) {
-            return new Response("Forbidden", { status: 403, headers });
-        }
-        const file = Bun.file(filePath);
-        if (await file.exists()) {
-            const ext = extname(filePath);
-            const mime = MIME_TYPES[ext] ?? "application/octet-stream";
-            headers.set("Content-Type", mime);
-            return new Response(await file.arrayBuffer(), { status: 200, headers });
-        }
-        const indexPath = join(PUBLIC_DIR, "index.html");
-        const indexFile = Bun.file(indexPath);
-        if (await indexFile.exists()) {
-            headers.set("Content-Type", "text/html; charset=utf-8");
-            return new Response(await indexFile.arrayBuffer(), { status: 200, headers });
-        }
-        return new Response("Not Found", { status: 404, headers });
-    };
+    const handleRequest = createServerRequestHandler({
+        context,
+        controlPlaneProxy,
+        activitySupervisor,
+        heartbeatPrograms,
+        cronPrograms,
+        loadConfigFromDisk,
+        writeConfig,
+        reloadControlPlane,
+        getControlPlaneStatus: () => ({
+            ...summarizeControlPlane(controlPlaneCurrent),
+            generation: generationSupervisor.snapshot(),
+            observability: {
+                counters: generationTelemetry.counters(),
+            },
+        }),
+        registerAutoRunHeartbeatProgram,
+        disableAutoRunHeartbeatProgram,
+        describeError,
+    });
     const server = {
         port: options.port || 3000,
         fetch: handleRequest,
@@ -2249,32 +714,15 @@ export function createServer(options = {}) {
     };
     return server;
 }
-export async function createServerAsync(options = {}) {
-    const repoRoot = options.repoRoot || process.cwd();
-    const config = options.config ?? (await readMuConfigFile(repoRoot));
-    const heartbeatScheduler = options.heartbeatScheduler ?? new ActivityHeartbeatScheduler();
-    const generationTelemetry = options.generationTelemetry ?? new GenerationTelemetryRecorder();
-    const controlPlane = await bootstrapControlPlane({
-        repoRoot,
-        config: config.control_plane,
-        heartbeatScheduler,
-        generation: {
-            generation_id: "control-plane-gen-0",
-            generation_seq: 0,
-        },
-        telemetry: generationTelemetry,
-        sessionMutationHooks: options.sessionMutationHooks,
-        terminalEnabled: true,
-    });
-    const serverConfig = createServer({
+export { composeServerRuntime } from "./server_runtime.js";
+export function createServerFromRuntime(runtime, options = {}) {
+    return createServer({
         ...options,
-        heartbeatScheduler,
-        controlPlane,
-        config,
-        generationTelemetry,
+        repoRoot: runtime.repoRoot,
+        config: runtime.config,
+        heartbeatScheduler: runtime.heartbeatScheduler,
+        generationTelemetry: runtime.generationTelemetry,
+        sessionLifecycle: runtime.sessionLifecycle,
+        controlPlane: runtime.controlPlane,
     });
-    return {
-        serverConfig,
-        controlPlane: serverConfig.controlPlane,
-    };
 }