@gamaze/hicortex 0.20.9 → 0.21.0

package/dist/dashboard.js

@@ -1,11 +1,13 @@
 "use strict";
 /**
- * /dashboard — view-only memory analytics (#224).
+ * /dashboard — view-only memory analytics (#224) + the console's live-data
+ * endpoints (#409/#421 Phase 1: /dashboard/field, /dashboard/events).
  *
  * STRICTLY view-only: this module computes metrics, reads snapshots, writes
  * ONE snapshot row per full nightly run (the writer is here because the
  * metric SQL lives next to its definition, not in nightly.ts), and exposes
- * the pure data handler mounted at GET /dashboard/data. There are NO mutation
+ * the pure data handlers mounted at GET /dashboard/data,
+ * GET /dashboard/field and GET /dashboard/events. There are NO mutation
  * endpoints on the dashboard surface — the only write path is the nightly
  * snapshot writer + the one-time backfill, both internal.
  *
@@ -21,27 +23,44 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeDashboardMetrics = computeDashboardMetrics;
+exports.computeStageCounts = computeStageCounts;
 exports.writeSnapshot = writeSnapshot;
 exports.backfillSnapshots = backfillSnapshots;
 exports.handleDashboardData = handleDashboardData;
 exports.dashboardDataHandler = dashboardDataHandler;
 exports.accountHandler = accountHandler;
 exports.accountTokenHandler = accountTokenHandler;
+exports.handleDashboardField = handleDashboardField;
+exports.dashboardFieldHandler = dashboardFieldHandler;
+exports.handleDashboardEvents = handleDashboardEvents;
+exports.dashboardEventsHandler = dashboardEventsHandler;
+exports.handleDashboardModelGet = handleDashboardModelGet;
+exports.handleDashboardModelPut = handleDashboardModelPut;
+exports.dashboardModelGetHandler = dashboardModelGetHandler;
+exports.dashboardModelPutHandler = dashboardModelPutHandler;
+exports.handleDashboardCapturePausePut = handleDashboardCapturePausePut;
+exports.dashboardCapturePausePutHandler = dashboardCapturePausePutHandler;
+const node_zlib_1 = require("node:zlib");
 const recall_index_js_1 = require("./recall-index.js");
 const config_read_js_1 = require("./config-read.js");
 const consolidate_js_1 = require("./consolidate.js");
+const capture_health_js_1 = require("./capture-health.js");
+const capture_pause_js_1 = require("./capture-pause.js");
 const state_js_1 = require("./state.js");
+const retrieval_js_1 = require("./retrieval.js");
+const stages_js_1 = require("./stages.js");
+const calibration_js_1 = require("./calibration.js");
 // ---------------------------------------------------------------------------
 // Metric computation — one SELECT each, prepared inline. Pure: takes a db,
 // returns a value. No side effects, no I/O beyond the open db handle.
 // ---------------------------------------------------------------------------
-function countBy(db, col) {
+function countBy(db, col, nullLabel = "(unscoped)") {
     // Column name is from a fixed allowlist at the call site (never user input).
     const rows = db
-        .prepare(`SELECT COALESCE(${col}, '(unscoped)') AS k, COUNT(*) AS c
+        .prepare(`SELECT COALESCE(${col}, ?) AS k, COUNT(*) AS c
          FROM memories
         GROUP BY ${col}`)
-        .all();
+        .all(nullLabel);
     const out = {};
     for (const r of rows)
         out[r.k] = r.c;
@@ -50,10 +69,20 @@ function countBy(db, col) {
 /**
  * Compute the full corpus-shape metrics from the live DB. The same function
  * backs both the nightly snapshot writer and the live /dashboard/data
- * composition view — one definition of corpus shape.
+ * composition view — one definition of corpus shape. #422 adds the
+ * live/absorbed split (`totals.live_mem`/`absorbed`) and `stage_counts` —
+ * both derived here so every snapshot row carries them automatically.
  */
 function computeDashboardMetrics(db) {
     const mem = db.prepare("SELECT COUNT(*) AS c FROM memories").get().c;
+    // LIVE = non-absorbed (the same predicate as /dashboard/field and the cap
+    // eviction stage — #317's one-definition discipline). Absorbed rows are
+    // retained evidence, invisible to recall; they must not read as "memories
+    // the brain has" in the console's headline (the field paints live only, so
+    // the band number and the field must agree).
+    const liveMem = db
+        .prepare("SELECT COUNT(*) AS c FROM memories WHERE COALESCE(status, '') != 'absorbed'")
+        .get().c;
     const lesson = db
         .prepare("SELECT COUNT(*) AS c FROM memories WHERE memory_type = 'learnings'")
         .get().c;
@@ -67,10 +96,12 @@ function computeDashboardMetrics(db) {
          FROM memories`)
         .get();
     return {
-        totals: { mem, lesson, link },
+        totals: { mem, lesson, link, live_mem: liveMem, absorbed: mem - liveMem },
+        stage_counts: computeStageCounts(db),
         by_type: countBy(db, "memory_type"),
         by_domain: countBy(db, "domain"),
         by_source_agent: countBy(db, "source_agent"),
+        by_source_machine: countBy(db, "source_machine", "(unstamped)"),
         adoption: {
             shown_sum: adoptionRow.shown,
             used_sum: adoptionRow.uses,
@@ -82,6 +113,65 @@ function computeDashboardMetrics(db) {
         },
     };
 }
+/**
+ * One grouped pass over memory_links for per-memory link counts (batch —
+ * never per-row queries); shared by the field payload and stage_counts.
+ * Counts BOTH directions (a memory's connectivity is symmetric).
+ */
+function linkCountsByMemory(db) {
+    const rows = db
+        .prepare(`SELECT id, SUM(c) AS c FROM (
+         SELECT source_id AS id, COUNT(*) AS c FROM memory_links GROUP BY source_id
+         UNION ALL
+         SELECT target_id AS id, COUNT(*) AS c FROM memory_links GROUP BY target_id
+       ) GROUP BY id`)
+        .all();
+    const linkCounts = new Map();
+    for (const r of rows)
+        linkCounts.set(r.id, r.c);
+    return linkCounts;
+}
+/**
+ * Derive one memory's {strength, stage} — the exact math of the field
+ * payload: effectiveStrength (importance = base, access + link hardening)
+ * rounded to the 1e-6 wire format, then the recency gate (days since
+ * last_accessed, falling back to created_at; unparseable → null, the gate is
+ * skipped rather than guessing "very old") and the calibrated strength bands.
+ */
+function deriveStageForRow(row, linkCount, now, nowDay) {
+    const base = row.base_strength ?? 0.5;
+    const accessCount = row.access_count ?? 0;
+    const effStr = (0, retrieval_js_1.effectiveStrength)(base, row.last_accessed, now, {
+        importance: base,
+        accessCount,
+        linkCount,
+    });
+    const strength = Math.round(effStr * 1e6) / 1e6;
+    const refDay = utcDayNumber(row.last_accessed) ?? utcDayNumber(row.created_at);
+    const daysSince = refDay === null ? null : nowDay - refDay;
+    return { strength, stage: (0, stages_js_1.deriveStage)(strength, daysSince) };
+}
+/**
+ * Count LIVE (non-absorbed) memories per derived stage — the snapshot's
+ * `stage_counts` (#422 Phase 2). Same math as the field payload via the
+ * shared deriveStageForRow; absorbed rows are excluded exactly like the
+ * field paints them (invisible evidence is not a maturity stage).
+ */
+function computeStageCounts(db) {
+    const now = new Date();
+    const nowDay = Math.floor(now.getTime() / 86_400_000);
+    const linkCounts = linkCountsByMemory(db);
+    const rows = db
+        .prepare(`SELECT id, base_strength, last_accessed, access_count, created_at
+         FROM memories
+        WHERE COALESCE(status, '') != 'absorbed'`)
+        .all();
+    const counts = { forming: 0, belief: 0, truth: 0, fading: 0 };
+    for (const r of rows) {
+        counts[deriveStageForRow(r, linkCounts.get(r.id) ?? 0, now, nowDay).stage]++;
+    }
+    return counts;
+}
 /**
  * Write one snapshot row for `runAt` (an ISO timestamp the caller chooses —
  * nightly.ts passes `now`). OR-replace on the PRIMARY KEY is intentional: a
@@ -153,6 +243,16 @@ function writeSnapshot(db, runAt, delta, memorySoftCap) {
                 },
             }
             : {}),
+        // #427: scout counters — flat snake_case mirroring the stage report,
+        // forwarded whenever consolidation ran (zeros are real quiet-night
+        // values). Backfill rows never reach this writer with them set.
+        ...(delta.scoutScanned !== undefined ? { scout_scanned: delta.scoutScanned } : {}),
+        ...(delta.scoutCorrectionShaped !== undefined
+            ? { scout_correction_shaped: delta.scoutCorrectionShaped }
+            : {}),
+        ...(delta.scoutCandidatesFound !== undefined
+            ? { scout_candidates_found: delta.scoutCandidatesFound }
+            : {}),
     };
     if (memorySoftCap !== undefined) {
         metrics.capacity = { memory_soft_cap: memorySoftCap };
@@ -273,6 +373,9 @@ function backfillSnapshots(db) {
                 by_type: { ...byType },
                 by_domain: { ...byDomain },
                 by_source_agent: { ...byAgent },
+                // Backfilled history predates stamping by construction — every
+                // synthesized row is honestly "(unstamped)" (#421).
+                by_source_machine: { "(unstamped)": mem },
                 // new_this_run on a backfill row = the deltas DERIVED for that day
                 // (added/lesson/dedup/supersession); lessonsGenerated is undefined
                 // (it's a stage-outcome, not a row count — can't be reconstructed).
@@ -374,6 +477,10 @@ function handleDashboardData(db, query, config) {
     const tokenState = (0, state_js_1.loadState)().llmTokensThisPeriod;
     const headline = {
         total_memories: live.totals.mem,
+        // #422: the field paints live rows only, so the band number must too —
+        // this closes the "console says 574 more than the field shows" gap.
+        // `?? mem` is type-narrowing only (computeDashboardMetrics always sets it).
+        live_memories: live.totals.live_mem ?? live.totals.mem,
         uses_per_showing: live.adoption?.uses_per_showing ?? null,
         cold_count: live.adoption?.cold_count ?? 0,
         memory_soft_cap: (0, consolidate_js_1.resolveMemorySoftCap)(config?.memorySoftCap),
@@ -488,6 +595,14 @@ function handleDashboardData(db, query, config) {
                 by_type: live.by_type,
                 by_domain: live.by_domain,
                 by_source_agent: live.by_source_agent,
+                by_source_machine: live.by_source_machine,
+            },
+            capture_health: (0, capture_health_js_1.readCaptureHealth)(db),
+            // #423 phase 3: pauses + presence in one block — one source of truth
+            // for the rail's dots, toggles and the capture card's PAUSED badges.
+            fleet: {
+                pauses: (0, capture_pause_js_1.listCapturePauses)(db),
+                last_seen: (0, capture_pause_js_1.readFleetLastSeen)(db),
             },
             digest,
         },
@@ -558,3 +673,473 @@ function accountTokenHandler(getToken) {
         }
     };
 }
+/** UTC day number (days since epoch) for an ISO timestamp; null when the
+ *  string does not parse — the night-resolution clock for stage recency. */
+function utcDayNumber(iso) {
+    if (!iso)
+        return null;
+    const t = Date.parse(iso);
+    return Number.isFinite(t) ? Math.floor(t / 86_400_000) : null;
+}
+/**
+ * The pure data handler for GET /dashboard/field. Reads the whole live store
+ * (minus absorbed rows) + all link edges, derives stage + effective strength
+ * per memory, and returns the field payload. Never throws on empty stores —
+ * an empty brain is a valid field.
+ */
+function handleDashboardField(db) {
+    const now = new Date();
+    const nowDay = Math.floor(now.getTime() / 86_400_000);
+    // Shared derivation inputs (one batched pass — never per-row queries).
+    const linkCounts = linkCountsByMemory(db);
+    const rows = db
+        .prepare(`SELECT id, content, base_strength, last_accessed, access_count,
+              created_at, domain, source_agent, source_machine
+         FROM memories
+        WHERE COALESCE(status, '') != 'absorbed'
+        ORDER BY created_at ASC, id ASC`)
+        .all();
+    const memories = rows.map((r) => {
+        // Shared per-row derivation — the SAME math the snapshot stage_counts
+        // uses (deriveStageForRow); the field only adds its wire fields.
+        const { strength, stage } = deriveStageForRow(r, linkCounts.get(r.id) ?? 0, now, nowDay);
+        return {
+            id: r.id,
+            title: (0, recall_index_js_1.memoryTitle)(r.content, calibration_js_1.RECALL_TITLE_CHARS),
+            domain: r.domain,
+            stage,
+            strength,
+            access_count: r.access_count ?? 0,
+            created_at: r.created_at,
+            source_agent: r.source_agent,
+            source_machine: r.source_machine ?? null,
+        };
+    });
+    const linkRows = db
+        .prepare("SELECT source_id, target_id, relationship FROM memory_links ORDER BY created_at ASC")
+        .all();
+    return {
+        status: 200,
+        body: {
+            generated_at: now.toISOString(),
+            // #426 owner semantics ruling 2026-09-13: recall grades are REMOVED —
+            // recall depends on the conversation, higher is not a target. Only the
+            // stage thresholds ride the echo (calibrated 2026-09-13), plus the two
+            // #409/#426 display keys: the search floor and the recall-level band
+            // edges (PROVISIONAL — see calibration.ts).
+            thresholds: {
+                stage: {
+                    fading_days: calibration_js_1.STAGE_FADING_DAYS,
+                    fading_strength: calibration_js_1.STAGE_FADING_STRENGTH,
+                    belief: calibration_js_1.STAGE_BELIEF_STRENGTH,
+                    truth: calibration_js_1.STAGE_TRUTH_STRENGTH,
+                },
+                recall_min_similarity: calibration_js_1.RECALL_MIN_SIMILARITY,
+                recall_uses: {
+                    low_max: calibration_js_1.RECALL_USES_LOW_MAX,
+                    normal_max: calibration_js_1.RECALL_USES_NORMAL_MAX,
+                    axis_max: calibration_js_1.RECALL_USES_AXIS_MAX,
+                },
+            },
+            memories,
+            links: linkRows.map((l) => ({ a: l.source_id, b: l.target_id, rel: l.relationship })),
+        },
+    };
+}
+/** True when the request genuinely accepts a gzip response (quality-aware —
+ *  `gzip;q=0` negotiates to no). Uses the framework's content negotiation
+ *  rather than substring-matching the header (#424 review). */
+function acceptsGzip(req) {
+    return req.acceptsEncodings("gzip") === "gzip";
+}
+/**
+ * Express adapter for GET /dashboard/field. Bearer-only by construction
+ * (mounted after createAuthMiddleware — no exemption). Gzips the payload
+ * when the client advertises Accept-Encoding: gzip: the field is one row per
+ * memory on possibly very large stores, so the wire cost is the point
+ * (minimal fields + compression, per the #409 payload-size risk note).
+ * Failures surface as a 500 {error} like the sibling adapters.
+ */
+function dashboardFieldHandler(getDb) {
+    return (req, res) => {
+        try {
+            const { status, body } = handleDashboardField(getDb());
+            if (status !== 200) {
+                res.status(status).json(body);
+                return;
+            }
+            if (acceptsGzip(req)) {
+                const buf = (0, node_zlib_1.gzipSync)(JSON.stringify(body));
+                res
+                    .set({
+                    "Content-Type": "application/json",
+                    "Content-Encoding": "gzip",
+                    "Vary": "Accept-Encoding",
+                })
+                    .status(status)
+                    .send(buf);
+                return;
+            }
+            res.status(status).json(body);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    };
+}
+const EVENTS_DEFAULT_DAYS = 90;
+const EVENTS_MAX_DAYS = 365;
+/** Parse the ?days= param: integer 1..365, default 90. Returns null when the
+ *  value is present but invalid (→ 400); undefined when absent (→ default). */
+function parseEventsDays(raw) {
+    if (raw === undefined)
+        return undefined;
+    const first = Array.isArray(raw) ? raw[0] : raw;
+    const n = typeof first === "number" ? first : Number(first);
+    if (!Number.isInteger(n) || n < 1 || n > EVENTS_MAX_DAYS)
+        return null;
+    return n;
+}
+/**
+ * The pure data handler for GET /dashboard/events?days=N. Buckets the four
+ * event sources into UTC nights (only nights with events, ascending) within
+ * the last `days` calendar days (today inclusive).
+ */
+function handleDashboardEvents(db, query) {
+    const parsed = parseEventsDays(query.days);
+    if (parsed === null) {
+        return {
+            status: 400,
+            body: { error: `Invalid 'days' — expected an integer between 1 and ${EVENTS_MAX_DAYS}` },
+        };
+    }
+    const days = parsed ?? EVENTS_DEFAULT_DAYS;
+    // Calendar-day window: today's UTC day back through (days - 1) days ago.
+    const todayDay = Math.floor(Date.now() / 86_400_000);
+    const cutoffDay = todayDay - (days - 1);
+    const cutoffIso = new Date(cutoffDay * 86_400_000).toISOString();
+    const nights = new Map();
+    const inWindow = (iso) => {
+        const d = utcDayNumber(iso);
+        if (d === null || d < cutoffDay || d > todayDay)
+            return null;
+        return new Date(d * 86_400_000).toISOString().slice(0, 10);
+    };
+    const nightFor = (date) => {
+        let n = nights.get(date);
+        if (!n) {
+            n = { date, added: [], enriched: [], merged: [], linked: [], by_agent: {} };
+            nights.set(date, n);
+        }
+        return n;
+    };
+    const bumpAgent = (n, agent, key) => {
+        const k = agent ?? "(unknown)";
+        const rec = n.by_agent[k] ?? { learned: 0, enriched: 0, merged: 0 };
+        rec[key] += 1;
+        n.by_agent[k] = rec;
+    };
+    // added — every memory row born in the window (absorbed included: the
+    // replay needs the birth of rows a later merge folds away).
+    const addedRows = db
+        .prepare("SELECT id, source_agent, created_at FROM memories WHERE created_at >= ?")
+        .all(cutoffIso);
+    for (const r of addedRows) {
+        const date = inWindow(r.created_at);
+        if (date === null)
+            continue;
+        const n = nightFor(date);
+        n.added.push(r.id);
+        bumpAgent(n, r.source_agent, "learned");
+    }
+    // enriched — memory_history rows, DISTINCT memory per night (one rewrite of
+    // the same memory on a night is one enrichment). LEFT JOIN: the memory row
+    // can be gone (hard-deleted legacy losers); those count under "(unknown)".
+    const enrichRows = db
+        .prepare(`SELECT h.memory_id, h.created_at, m.source_agent AS agent
+         FROM memory_history h LEFT JOIN memories m ON m.id = h.memory_id
+        WHERE h.created_at >= ?`)
+        .all(cutoffIso);
+    const enrichedSeen = new Set(); // `${date}|${memory_id}` dedup
+    for (const r of enrichRows) {
+        const date = inWindow(r.created_at);
+        if (date === null)
+            continue;
+        const key = `${date}|${r.memory_id}`;
+        if (enrichedSeen.has(key))
+            continue;
+        enrichedSeen.add(key);
+        const n = nightFor(date);
+        n.enriched.push(r.memory_id);
+        bumpAgent(n, r.agent, "enriched");
+    }
+    // merged — dedup_log rows; agent = the LOSER's source_agent (the merge
+    // event belongs to the memory that went away).
+    const mergedRows = db
+        .prepare(`SELECT d.loser_id, d.canonical_id, d.merged_at, m.source_agent AS agent
+         FROM dedup_log d LEFT JOIN memories m ON m.id = d.loser_id
+        WHERE d.merged_at >= ?`)
+        .all(cutoffIso);
+    for (const r of mergedRows) {
+        const date = inWindow(r.merged_at);
+        if (date === null)
+            continue;
+        const n = nightFor(date);
+        n.merged.push({ loser: r.loser_id, canonical: r.canonical_id });
+        bumpAgent(n, r.agent, "merged");
+    }
+    // linked — memory_links rows born in the window.
+    const linkedRows = db
+        .prepare("SELECT source_id, target_id, created_at FROM memory_links WHERE created_at >= ?")
+        .all(cutoffIso);
+    for (const r of linkedRows) {
+        const date = inWindow(r.created_at);
+        if (date === null)
+            continue;
+        nightFor(date).linked.push({ a: r.source_id, b: r.target_id });
+    }
+    const sorted = Array.from(nights.values())
+        .filter((n) => n.added.length + n.enriched.length + n.merged.length + n.linked.length > 0)
+        .sort((x, y) => (x.date < y.date ? -1 : x.date > y.date ? 1 : 0));
+    return { status: 200, body: { nights: sorted } };
+}
+/**
+ * Express adapter for GET /dashboard/events. Bearer-only by construction
+ * (mounted after createAuthMiddleware — no exemption). The ledger is ids
+ * only (no titles), so it stays plain JSON — gzip is the /field adapter's
+ * concern. Failures surface as a 500 {error} like the sibling adapters.
+ */
+function dashboardEventsHandler(getDb) {
+    return (req, res) => {
+        try {
+            const { status, body } = handleDashboardEvents(getDb(), req.query);
+            res.status(status).json(body);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    };
+}
+/** A config value echoed as a non-blank string, else null. */
+function configString(v) {
+    return typeof v === "string" && v.trim().length > 0 ? v : null;
+}
+/**
+ * The pure GET handler: echo the CONFIG values raw (null when unset — the UI
+ * shows defaults as placeholders, so this never resolves them) + the runtime
+ * provider from the daemon's in-memory llmConfig.
+ */
+function handleDashboardModelGet(config, llmConfig) {
+    const cfg = config ?? {};
+    return {
+        status: 200,
+        body: {
+            provider: llmConfig?.provider ?? null,
+            backend: configString(cfg.llmBackend),
+            base_url: configString(cfg.llmBaseUrl),
+            model: configString(cfg.llmModel),
+            max_tokens: typeof cfg.maxTokens === "number" && Number.isFinite(cfg.maxTokens)
+                ? cfg.maxTokens
+                : null,
+            enable_thinking: typeof cfg.enableThinking === "boolean" ? cfg.enableThinking : null,
+            api_key_set: Boolean(configString(cfg.llmApiKey)),
+            applies_on_restart: true,
+        },
+    };
+}
+/** The PUT's allowlisted body keys → the config keys they write. */
+const MODEL_PUT_KEYS = {
+    backend: "llmBackend",
+    base_url: "llmBaseUrl",
+    model: "llmModel",
+    api_key: "llmApiKey",
+    max_tokens: "maxTokens",
+    enable_thinking: "enableThinking",
+};
+/** The backends init ever writes (absence of llmBackend + baseUrl+apiKey =
+ *  the openai-compat path). "" clears (the modal's "auto" option). */
+const MODEL_BACKEND_VALUES = new Set(["", "ollama", "claude-cli"]);
+/**
+ * The pure PUT handler: validate the allowlisted subset, persist via the
+ * injected writer (which THROWS on a malformed config — the adapter maps that
+ * to a 500 and the file stays untouched), answer with the fresh GET shape
+ * built from the post-write config. `null` REMOVES a config key.
+ */
+function handleDashboardModelPut(body, persist, getLlmConfig) {
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return { status: 400, body: { error: "Body must be a JSON object of model settings" } };
+    }
+    const input = body;
+    const updates = {};
+    for (const [key, value] of Object.entries(input)) {
+        const configKey = MODEL_PUT_KEYS[key];
+        if (!configKey) {
+            return {
+                status: 400,
+                body: {
+                    error: `Unknown key '${key}' — allowed: ${Object.keys(MODEL_PUT_KEYS).join(", ")}`,
+                },
+            };
+        }
+        // Per-key validation → a SPECIFIC message (the modal surfaces it in the
+        // toast). null is valid everywhere (the clear).
+        if (value === null) {
+            updates[configKey] = null;
+            continue;
+        }
+        switch (key) {
+            case "backend":
+                if (typeof value !== "string" || !MODEL_BACKEND_VALUES.has(value)) {
+                    return {
+                        status: 400,
+                        body: { error: `Invalid 'backend' — expected null, "", "ollama" or "claude-cli" (absent + base_url + api_key = OpenAI-compatible)` },
+                    };
+                }
+                // "" (the modal's "auto / OpenAI-compatible" option) means NO named
+                // backend — normalize to the clear so config.json never carries a
+                // vestigial "" key (absence IS the openai-compat path).
+                if (value === "") {
+                    updates[configKey] = null;
+                    continue;
+                }
+                break;
+            case "base_url": {
+                if (typeof value !== "string") {
+                    return { status: 400, body: { error: "Invalid 'base_url' — expected null or an http(s) URL string" } };
+                }
+                let url;
+                try {
+                    url = new URL(value);
+                }
+                catch {
+                    return { status: 400, body: { error: `Invalid 'base_url' — "${value}" does not parse as a URL` } };
+                }
+                if (url.protocol !== "http:" && url.protocol !== "https:") {
+                    return { status: 400, body: { error: `Invalid 'base_url' — protocol must be http(s), got "${url.protocol}"` } };
+                }
+                break;
+            }
+            case "model":
+                if (typeof value !== "string" || value.trim().length === 0) {
+                    return { status: 400, body: { error: "Invalid 'model' — expected null or a non-empty string" } };
+                }
+                break;
+            case "api_key":
+                // Empty string is a 400, NOT a clear — the classic "pasted nothing"
+                // typo guard. Clearing the key entirely is null (deliberate).
+                if (typeof value !== "string" || value.length === 0) {
+                    return { status: 400, body: { error: "Invalid 'api_key' — expected null (clear) or a non-empty string" } };
+                }
+                break;
+            case "max_tokens":
+                // Strict integer ≥ 1 — floats and numeric strings are rejected so the
+                // config never carries a value the runtime would have to re-coerce.
+                if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+                    return { status: 400, body: { error: "Invalid 'max_tokens' — expected null or an integer ≥ 1" } };
+                }
+                break;
+            case "enable_thinking":
+                // Strict boolean — "false" (string) is the JSON-encoder artifact this
+                // catches; null clears back to the default.
+                if (typeof value !== "boolean") {
+                    return { status: 400, body: { error: "Invalid 'enable_thinking' — expected null or a boolean" } };
+                }
+                break;
+        }
+        updates[configKey] = value;
+    }
+    // persist THROWS on a malformed config (strict load) — propagated to the
+    // adapter → 500, file untouched. On success it returns the fresh config.
+    const fresh = persist(updates);
+    return handleDashboardModelGet(fresh, getLlmConfig());
+}
+/**
+ * Express adapter for GET /dashboard/model. Bearer-only by construction
+ * (mounted after createAuthMiddleware — NO exemption, unlike the page shells:
+ * this carries install config). Failures surface as a 500 {error}.
+ */
+function dashboardModelGetHandler(getConfig, getLlmConfig) {
+    return (_req, res) => {
+        try {
+            const { status, body } = handleDashboardModelGet(getConfig(), getLlmConfig());
+            res.status(status).json(body);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    };
+}
+/**
+ * Express adapter for PUT /dashboard/model. Same auth posture as the GET.
+ * The injected persist closure owns the config path (the server passes
+ * init.ts persistConfigUpdates over stateDir/config.json); its load/persist
+ * failures (malformed config, unwritable file) map to a 500 {error} with the
+ * file left untouched — never a silent partial write.
+ */
+function dashboardModelPutHandler(persist, getLlmConfig) {
+    return (req, res) => {
+        try {
+            const { status, body } = handleDashboardModelPut(req.body ?? null, persist, getLlmConfig);
+            res.status(status).json(body);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    };
+}
+// ---------------------------------------------------------------------------
+// PUT /dashboard/capture-pause — the console's pause/resume toggle (#423
+// phase 3, D3). Same layering as the model PUT: a pure validation handler +
+// an injected setter closure (the live adapter wires setCapturePause over
+// the daemon's db), so the route stays thin and the logic is unit-testable.
+// ---------------------------------------------------------------------------
+/** The PUT's body: {machine?: string|null, harness: string, paused: boolean}. */
+function handleDashboardCapturePausePut(body, setPause) {
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return { status: 400, body: { error: "Body must be a JSON object {harness, paused, machine?}" } };
+    }
+    const { machine, harness, paused } = body;
+    // harness: the bundle's harness half, as the /distill pause key derives it.
+    // Not trimmed — the key must match the traffic byte-for-byte; the console
+    // derives it from already-normalized ids.
+    if (typeof harness !== "string" || harness.length === 0 || harness.length > 128) {
+        return { status: 400, body: { error: "Invalid 'harness' — expected a non-empty string of at most 128 chars" } };
+    }
+    // machine: null/undefined/"" → the unstamped bundle (''); any other value
+    // must be a non-empty string ≤128 (never a number/object from a bad caller).
+    let machineKey;
+    if (machine === null || machine === undefined || machine === "") {
+        machineKey = "";
+    }
+    else if (typeof machine === "string" && machine.length > 0 && machine.length <= 128) {
+        machineKey = machine;
+    }
+    else {
+        return { status: 400, body: { error: "Invalid 'machine' — expected null, \"\", or a non-empty string of at most 128 chars" } };
+    }
+    // Strict boolean — "false" (string) is the JSON-encoder artifact this
+    // catches; there is no clear/null form of a two-state toggle.
+    if (typeof paused !== "boolean") {
+        return { status: 400, body: { error: "Invalid 'paused' — expected a boolean" } };
+    }
+    const pausedAt = setPause(machineKey, harness, paused);
+    return { status: 200, body: { machine: machineKey, harness, paused, paused_at: pausedAt } };
+}
+/**
+ * Express adapter for PUT /dashboard/capture-pause. Bearer-only by
+ * construction (mounted after createAuthMiddleware, no shell exemption).
+ * The effect is immediate — no restart: the /distill handler reads the
+ * pause table on every post, so the very next capture POST from the bundle
+ * is skipped (200) or captured as before.
+ */
+function dashboardCapturePausePutHandler(getDb) {
+    return (req, res) => {
+        try {
+            const { status, body } = handleDashboardCapturePausePut(req.body ?? null, (machine, harness, paused) => (0, capture_pause_js_1.setCapturePause)(getDb(), machine, harness, paused));
+            res.status(status).json(body);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    };
+}