@graphmemory/server 1.1.0 → 1.3.0

package/dist/api/index.js

@@ -37,17 +37,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMcpServer = createMcpServer;
-exports.startStdioServer = startStdioServer;
 exports.startHttpServer = startHttpServer;
 exports.startMultiProjectHttpServer = startMultiProjectHttpServer;
 const http_1 = __importDefault(require("http"));
 const crypto_1 = require("crypto");
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
-const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 const embedder_1 = require("../lib/embedder");
 const index_1 = require("../api/rest/index");
 const websocket_1 = require("../api/rest/websocket");
+const access_1 = require("../lib/access");
+const multi_config_1 = require("../lib/multi-config");
 const docs_1 = require("../graphs/docs");
 const code_1 = require("../graphs/code");
 const knowledge_1 = require("../graphs/knowledge");
@@ -148,7 +148,7 @@ function buildInstructions(ctx) {
 }
 /**
  * Creates the McpServer with all tools wired to the given graphs.
- * Pass docGraph to enable the 10 doc tools (5 base + 5 code-block tools);
+ * Pass docGraph to enable the 9 doc tools (5 base + 4 code-block) + 1 cross_references (needs codeGraph too);
  * pass codeGraph to enable the 5 code tools;
  * pass fileIndexGraph to enable the 3 file index tools.
  * cross_references requires both docGraph and codeGraph.
@@ -158,7 +158,7 @@ function buildInstructions(ctx) {
  *                 Tests typically pass a single function; CLI passes a map for per-graph models.
  * @param mutationQueue  Optional PromiseQueue to serialize mutation tool handlers.
  */
-function createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, mutationQueue, projectDir, skillGraph, sessionContext) {
+function createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, mutationQueue, projectDir, skillGraph, sessionContext, readonlyGraphs, userAccess) {
     // Backward-compat: single EmbedFn → use for both document and query
     const defaultPair = { document: (q) => (0, embedder_1.embed)(q, ''), query: (q) => (0, embedder_1.embed)(q, '') };
     const fns = typeof embedFn === 'function'
@@ -180,14 +180,37 @@ function createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, ta
         };
     // Build instructions for MCP clients (workspace/project context)
     const instructions = sessionContext ? buildInstructions(sessionContext) : undefined;
-    const server = new mcp_js_1.McpServer({ name: 'graphmemory', version: '1.1.0' }, instructions ? { instructions } : undefined);
+    const server = new mcp_js_1.McpServer({ name: 'graphmemory', version: '1.2.0' }, instructions ? { instructions } : undefined);
     // Mutation tools are registered through mutServer to serialize concurrent writes
     const mutServer = mutationQueue ? createMutationServer(server, mutationQueue) : server;
+    // Check if mutation tools should be registered for a graph:
+    // - graph must not be readonly (global setting — tools hidden for all)
+    // - user must have write access (per-user — tools hidden for this user)
+    // - if no userAccess map, all mutations are allowed (no auth configured)
+    const canMutate = (graphName) => {
+        if (readonlyGraphs?.has(graphName))
+            return false;
+        if (userAccess) {
+            const level = userAccess.get(graphName);
+            if (level && !(0, access_1.canWrite)(level))
+                return false;
+        }
+        return true;
+    };
+    // Check if a graph's tools should be registered at all (deny = no tools)
+    const canAccess = (graphName) => {
+        if (!userAccess)
+            return true;
+        const level = userAccess.get(graphName);
+        if (level && !(0, access_1.canRead)(level))
+            return false;
+        return true;
+    };
     // Context tool (always registered)
     getContext.register(server, sessionContext);
     const ext = { docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, skillGraph };
-    // Docs tools (only when docGraph is provided)
-    if (docGraph) {
+    // Docs tools (only when docGraph is provided and user has access)
+    if (docGraph && canAccess('docs')) {
         const docMgr = new docs_1.DocGraphManager(docGraph, fns.docs, ext);
         listTopics.register(server, docMgr);
         getToc.register(server, docMgr);
@@ -199,13 +222,13 @@ function createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, ta
         listSnippets.register(server, docMgr);
         explainSymbol.register(server, docMgr);
         // Cross-graph tools (require both docGraph and codeGraph)
-        if (codeGraph) {
+        if (codeGraph && canAccess('code')) {
             const codeMgrForCross = new code_1.CodeGraphManager(codeGraph, fns.code, ext);
             crossReferences.register(server, docMgr, codeMgrForCross);
         }
     }
-    // Code tools (only when codeGraph is provided)
-    if (codeGraph) {
+    // Code tools (only when codeGraph is provided and user has access)
+    if (codeGraph && canAccess('code')) {
         const codeMgr = new code_1.CodeGraphManager(codeGraph, fns.code, ext);
         listFiles.register(server, codeMgr);
         getFileSymbols.register(server, codeMgr);
@@ -213,93 +236,97 @@ function createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, ta
         getSymbol.register(server, codeMgr);
         searchCodeFiles.register(server, codeMgr);
     }
-    // File index tools (always registered when fileIndexGraph is provided)
-    if (fileIndexGraph) {
+    // File index tools (when fileIndexGraph is provided and user has access)
+    if (fileIndexGraph && canAccess('files')) {
         const fileIndexMgr = new file_index_1.FileIndexGraphManager(fileIndexGraph, fns.files, ext);
         listAllFiles.register(server, fileIndexMgr);
         searchAllFiles.register(server, fileIndexMgr);
         getFileInfo.register(server, fileIndexMgr);
     }
-    // Knowledge tools (always registered)
-    // Mutations (create/update/delete) go through mutServer for queue serialization
-    if (knowledgeGraph) {
+    // Knowledge tools — read tools gated by canAccess, mutation tools gated by canMutate
+    if (knowledgeGraph && canAccess('knowledge')) {
         const ctx = projectDir ? { ...(0, manager_types_1.noopContext)(), projectDir } : (0, manager_types_1.noopContext)();
         const knowledgeMgr = new knowledge_1.KnowledgeGraphManager(knowledgeGraph, fns.knowledge, ctx, {
-            docGraph, codeGraph, fileIndexGraph, taskGraph,
+            docGraph, codeGraph, fileIndexGraph, taskGraph, skillGraph,
         });
-        createNote.register(mutServer, knowledgeMgr);
-        updateNote.register(mutServer, knowledgeMgr);
-        deleteNote.register(mutServer, knowledgeMgr);
         getNote.register(server, knowledgeMgr);
         listNotes.register(server, knowledgeMgr);
         searchNotes.register(server, knowledgeMgr);
-        createRelation.register(mutServer, knowledgeMgr);
-        deleteRelation.register(mutServer, knowledgeMgr);
         listRelations.register(server, knowledgeMgr);
         findLinkedNotes.register(server, knowledgeMgr);
-        addNoteAttachment.register(mutServer, knowledgeMgr);
-        removeNoteAttachment.register(mutServer, knowledgeMgr);
+        if (canMutate('knowledge')) {
+            createNote.register(mutServer, knowledgeMgr);
+            updateNote.register(mutServer, knowledgeMgr);
+            deleteNote.register(mutServer, knowledgeMgr);
+            createRelation.register(mutServer, knowledgeMgr);
+            deleteRelation.register(mutServer, knowledgeMgr);
+            addNoteAttachment.register(mutServer, knowledgeMgr);
+            removeNoteAttachment.register(mutServer, knowledgeMgr);
+        }
     }
-    // Task tools (always registered when taskGraph is provided)
-    // Mutations go through mutServer for queue serialization
-    if (taskGraph) {
+    // Task tools — read tools gated by canAccess, mutation tools gated by canMutate
+    if (taskGraph && canAccess('tasks')) {
         const taskCtx = projectDir ? { ...(0, manager_types_1.noopContext)(), projectDir } : (0, manager_types_1.noopContext)();
         const taskMgr = new task_1.TaskGraphManager(taskGraph, fns.tasks, taskCtx, {
-            docGraph, codeGraph, knowledgeGraph, fileIndexGraph,
+            docGraph, codeGraph, knowledgeGraph, fileIndexGraph, skillGraph,
         });
-        createTask.register(mutServer, taskMgr);
-        updateTask.register(mutServer, taskMgr);
-        deleteTask.register(mutServer, taskMgr);
         getTask.register(server, taskMgr);
         listTasksTool.register(server, taskMgr);
         searchTasksTool.register(server, taskMgr);
-        moveTask.register(mutServer, taskMgr);
-        linkTask.register(mutServer, taskMgr);
-        createTaskLink.register(mutServer, taskMgr);
-        deleteTaskLink.register(mutServer, taskMgr);
         findLinkedTasks.register(server, taskMgr);
-        addTaskAttachment.register(mutServer, taskMgr);
-        removeTaskAttachment.register(mutServer, taskMgr);
+        if (canMutate('tasks')) {
+            createTask.register(mutServer, taskMgr);
+            updateTask.register(mutServer, taskMgr);
+            deleteTask.register(mutServer, taskMgr);
+            moveTask.register(mutServer, taskMgr);
+            linkTask.register(mutServer, taskMgr);
+            createTaskLink.register(mutServer, taskMgr);
+            deleteTaskLink.register(mutServer, taskMgr);
+            addTaskAttachment.register(mutServer, taskMgr);
+            removeTaskAttachment.register(mutServer, taskMgr);
+        }
     }
-    // Skill tools (always registered when skillGraph is provided)
-    if (skillGraph) {
+    // Skill tools — read tools gated by canAccess, mutation tools gated by canMutate
+    if (skillGraph && canAccess('skills')) {
         const skillCtx = projectDir ? { ...(0, manager_types_1.noopContext)(), projectDir } : (0, manager_types_1.noopContext)();
         const skillMgr = new skill_1.SkillGraphManager(skillGraph, fns.skills, skillCtx, {
             docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph,
         });
-        createSkillTool.register(mutServer, skillMgr);
-        updateSkillTool.register(mutServer, skillMgr);
-        deleteSkillTool.register(mutServer, skillMgr);
         getSkillTool.register(server, skillMgr);
         listSkillsTool.register(server, skillMgr);
         searchSkillsTool.register(server, skillMgr);
-        linkSkill.register(mutServer, skillMgr);
-        createSkillLink.register(mutServer, skillMgr);
-        deleteSkillLink.register(mutServer, skillMgr);
         findLinkedSkills.register(server, skillMgr);
-        addSkillAttachment.register(mutServer, skillMgr);
-        removeSkillAttachment.register(mutServer, skillMgr);
         recallSkills.register(server, skillMgr);
-        bumpSkillUsage.register(mutServer, skillMgr);
+        if (canMutate('skills')) {
+            createSkillTool.register(mutServer, skillMgr);
+            updateSkillTool.register(mutServer, skillMgr);
+            deleteSkillTool.register(mutServer, skillMgr);
+            linkSkill.register(mutServer, skillMgr);
+            createSkillLink.register(mutServer, skillMgr);
+            deleteSkillLink.register(mutServer, skillMgr);
+            addSkillAttachment.register(mutServer, skillMgr);
+            removeSkillAttachment.register(mutServer, skillMgr);
+            bumpSkillUsage.register(mutServer, skillMgr);
+        }
     }
     return server;
 }
-async function startStdioServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, projectDir, skillGraph, sessionContext) {
-    const server = createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, undefined, projectDir, skillGraph, sessionContext);
-    const transport = new stdio_js_1.StdioServerTransport();
-    await server.connect(transport);
-    process.stderr.write('[server] MCP server running on stdio\n');
-}
 // ---------------------------------------------------------------------------
 // HTTP transport (Streamable HTTP)
 // ---------------------------------------------------------------------------
+const MAX_BODY_SIZE = 10 * 1024 * 1024; // 10 MB
 async function collectBody(req) {
     const chunks = [];
-    for await (const chunk of req)
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY_SIZE)
+            throw new Error('Request body too large');
         chunks.push(chunk);
+    }
     return JSON.parse(Buffer.concat(chunks).toString());
 }
-async function startHttpServer(host, port, sessionTimeoutMs, docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, projectDir, skillGraph, sessionContext) {
+async function startHttpServer(host, port, sessionTimeoutMs, docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, projectDir, skillGraph, sessionContext, readonlyGraphs) {
     const sessions = new Map();
     // Sweep stale sessions every 60s
     const sweepInterval = setInterval(() => {
@@ -314,40 +341,46 @@ async function startHttpServer(host, port, sessionTimeoutMs, docGraph, codeGraph
     }, 60_000);
     sweepInterval.unref();
     const httpServer = http_1.default.createServer(async (req, res) => {
-        if (req.url !== '/mcp') {
-            res.writeHead(404).end();
-            return;
-        }
-        const sessionId = req.headers['mcp-session-id'];
-        // Existing session — route to its transport
-        if (sessionId && sessions.has(sessionId)) {
-            const session = sessions.get(sessionId);
-            session.lastActivity = Date.now();
-            const body = req.method === 'POST' ? await collectBody(req) : undefined;
-            await session.transport.handleRequest(req, res, body);
-            return;
+        try {
+            if (req.url !== '/mcp') {
+                res.writeHead(404).end();
+                return;
+            }
+            const sessionId = req.headers['mcp-session-id'];
+            // Existing session — route to its transport
+            if (sessionId && sessions.has(sessionId)) {
+                const session = sessions.get(sessionId);
+                session.lastActivity = Date.now();
+                const body = req.method === 'POST' ? await collectBody(req) : undefined;
+                await session.transport.handleRequest(req, res, body);
+                return;
+            }
+            // New session — only POST (initialize) can create one
+            if (req.method !== 'POST') {
+                res.writeHead(400).end('No session');
+                return;
+            }
+            const body = await collectBody(req);
+            const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
+                sessionIdGenerator: () => (0, crypto_1.randomUUID)(),
+                onsessioninitialized: (sid) => {
+                    sessions.set(sid, { server: mcpServer, transport, lastActivity: Date.now() });
+                    process.stderr.write(`[http] Session ${sid} started\n`);
+                },
+            });
+            transport.onclose = () => {
+                const sid = transport.sessionId;
+                if (sid)
+                    sessions.delete(sid);
+            };
+            const mcpServer = createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, undefined, projectDir, skillGraph, sessionContext, readonlyGraphs);
+            await mcpServer.connect(transport);
+            await transport.handleRequest(req, res, body);
         }
-        // New session — only POST (initialize) can create one
-        if (req.method !== 'POST') {
-            res.writeHead(400).end('No session');
-            return;
+        catch (err) {
+            if (!res.headersSent)
+                res.writeHead(400).end(String(err));
         }
-        const body = await collectBody(req);
-        const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
-            sessionIdGenerator: () => (0, crypto_1.randomUUID)(),
-            onsessioninitialized: (sid) => {
-                sessions.set(sid, { server: mcpServer, transport, lastActivity: Date.now() });
-                process.stderr.write(`[http] Session ${sid} started\n`);
-            },
-        });
-        transport.onclose = () => {
-            const sid = transport.sessionId;
-            if (sid)
-                sessions.delete(sid);
-        };
-        const mcpServer = createMcpServer(docGraph, codeGraph, knowledgeGraph, fileIndexGraph, taskGraph, embedFn, undefined, projectDir, skillGraph, sessionContext);
-        await mcpServer.connect(transport);
-        await transport.handleRequest(req, res, body);
     });
     return new Promise((resolve) => {
         httpServer.listen(port, host, () => {
@@ -373,100 +406,177 @@ async function startMultiProjectHttpServer(host, port, sessionTimeoutMs, project
     // Express app handles /api/* routes
     const restApp = (0, index_1.createRestApp)(projectManager, restOptions);
     const httpServer = http_1.default.createServer(async (req, res) => {
-        // Route /api/* to Express
-        if (req.url?.startsWith('/api/')) {
-            restApp(req, res);
-            return;
-        }
-        // Route: /mcp/{workspaceId}/{projectId} or /mcp/{projectId}
-        const wsMatch = req.url?.match(/^\/mcp\/([^/?]+)\/([^/?]+)/);
-        const projMatch = !wsMatch ? req.url?.match(/^\/mcp\/([^/?]+)/) : null;
-        if (!wsMatch && !projMatch) {
-            // Everything else (UI static files, SPA fallback) goes through Express
-            restApp(req, res);
-            return;
-        }
-        // Resolve project and optional workspace from URL
-        let projectId;
-        let workspaceId;
-        if (wsMatch) {
-            const maybeWs = decodeURIComponent(wsMatch[1]);
-            const maybeProjId = decodeURIComponent(wsMatch[2]);
-            const ws = projectManager.getWorkspace(maybeWs);
-            if (ws) {
-                // Valid workspace route
-                if (!ws.config.projects.includes(maybeProjId)) {
-                    res.writeHead(404).end(JSON.stringify({ error: `Project "${maybeProjId}" is not part of workspace "${maybeWs}"` }));
-                    return;
+        try {
+            // Route /api/* to Express
+            if (req.url?.startsWith('/api/')) {
+                restApp(req, res);
+                return;
+            }
+            // Route: /mcp/{workspaceId}/{projectId} or /mcp/{projectId}
+            const wsMatch = req.url?.match(/^\/mcp\/([^/?]+)\/([^/?]+)/);
+            const projMatch = !wsMatch ? req.url?.match(/^\/mcp\/([^/?]+)/) : null;
+            if (!wsMatch && !projMatch) {
+                // Everything else (UI static files, SPA fallback) goes through Express
+                restApp(req, res);
+                return;
+            }
+            // Resolve project and optional workspace from URL
+            let projectId;
+            let workspaceId;
+            if (wsMatch) {
+                const maybeWs = decodeURIComponent(wsMatch[1]);
+                const maybeProjId = decodeURIComponent(wsMatch[2]);
+                const ws = projectManager.getWorkspace(maybeWs);
+                if (ws) {
+                    // Valid workspace route
+                    if (!ws.config.projects.includes(maybeProjId)) {
+                        res.writeHead(404).end(JSON.stringify({ error: `Project "${maybeProjId}" is not part of workspace "${maybeWs}"` }));
+                        return;
+                    }
+                    workspaceId = maybeWs;
+                    projectId = maybeProjId;
+                }
+                else {
+                    // Not a workspace — treat first segment as projectId (fallback)
+                    projectId = maybeWs;
                 }
-                workspaceId = maybeWs;
-                projectId = maybeProjId;
             }
             else {
-                // Not a workspace — treat first segment as projectId (fallback)
-                projectId = maybeWs;
+                projectId = decodeURIComponent(projMatch[1]);
             }
-        }
-        else {
-            projectId = decodeURIComponent(projMatch[1]);
-        }
-        const sessionId = req.headers['mcp-session-id'];
-        // Existing session — route to its transport
-        if (sessionId && sessions.has(sessionId)) {
-            const session = sessions.get(sessionId);
-            if (session.projectId !== projectId) {
-                res.writeHead(400).end('Session belongs to a different project');
+            const sessionId = req.headers['mcp-session-id'];
+            // Existing session — route to its transport
+            if (sessionId && sessions.has(sessionId)) {
+                const session = sessions.get(sessionId);
+                if (session.projectId !== projectId) {
+                    res.writeHead(400).end('Session belongs to a different project');
+                    return;
+                }
+                session.lastActivity = Date.now();
+                const body = req.method === 'POST' ? await collectBody(req) : undefined;
+                await session.transport.handleRequest(req, res, body);
                 return;
             }
-            session.lastActivity = Date.now();
-            const body = req.method === 'POST' ? await collectBody(req) : undefined;
-            await session.transport.handleRequest(req, res, body);
-            return;
-        }
-        // New session — only POST (initialize) can create one
-        if (req.method !== 'POST') {
-            res.writeHead(400).end('No session');
-            return;
+            // New session — only POST (initialize) can create one
+            if (req.method !== 'POST') {
+                res.writeHead(400).end('No session');
+                return;
+            }
+            // Validate project exists
+            const project = projectManager.getProject(projectId);
+            if (!project) {
+                res.writeHead(404).end(JSON.stringify({ error: `Project "${projectId}" not found` }));
+                return;
+            }
+            // Auth: if users configured, require valid API key
+            const users = restOptions?.users ?? {};
+            const hasUsers = Object.keys(users).length > 0;
+            let userId;
+            if (hasUsers) {
+                const auth = req.headers.authorization;
+                if (!auth?.startsWith('Bearer ') || auth.length <= 7) {
+                    res.writeHead(401).end(JSON.stringify({ error: 'API key required' }));
+                    return;
+                }
+                const result = (0, access_1.resolveUserFromApiKey)(auth.slice(7), users);
+                if (!result) {
+                    res.writeHead(401).end(JSON.stringify({ error: 'Invalid API key' }));
+                    return;
+                }
+                userId = result.userId;
+            }
+            // Build session context (auto-detect workspace if not in URL)
+            const ws = workspaceId
+                ? projectManager.getWorkspace(workspaceId)
+                : projectManager.getProjectWorkspace(projectId);
+            const sessionCtx = {
+                projectId,
+                workspaceId: ws?.id,
+                workspaceProjects: ws?.config.projects,
+                userId,
+            };
+            // Build readonly set from config + workspace overrides
+            const mcpReadonlyGraphs = new Set();
+            for (const gn of multi_config_1.GRAPH_NAMES) {
+                if (project.config.graphConfigs[gn].readonly)
+                    mcpReadonlyGraphs.add(gn);
+            }
+            if (project.workspaceId) {
+                const wsInst = projectManager.getWorkspace(project.workspaceId);
+                if (wsInst) {
+                    for (const gn of ['knowledge', 'tasks', 'skills']) {
+                        if (wsInst.config.graphConfigs[gn].readonly)
+                            mcpReadonlyGraphs.add(gn);
+                    }
+                }
+            }
+            // Build per-user access map
+            let mcpUserAccess;
+            if (userId && restOptions?.serverConfig) {
+                mcpUserAccess = new Map();
+                for (const gn of multi_config_1.GRAPH_NAMES) {
+                    const level = (0, access_1.resolveAccess)(userId, gn, project.config, restOptions.serverConfig, ws?.config);
+                    mcpUserAccess.set(gn, level);
+                }
+            }
+            const body = await collectBody(req);
+            const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
+                sessionIdGenerator: () => (0, crypto_1.randomUUID)(),
+                onsessioninitialized: (sid) => {
+                    sessions.set(sid, { projectId, workspaceId: ws?.id, userId, server: mcpServer, transport, lastActivity: Date.now() });
+                    process.stderr.write(`[http] Session ${sid} started (project: ${projectId}${ws ? `, workspace: ${ws.id}` : ''}${userId ? `, user: ${userId}` : ''})\n`);
+                },
+            });
+            transport.onclose = () => {
+                const sid = transport.sessionId;
+                if (sid)
+                    sessions.delete(sid);
+            };
+            const mcpServer = createMcpServer(project.docGraph, project.codeGraph, project.knowledgeGraph, project.fileIndexGraph, project.taskGraph, project.embedFns, project.mutationQueue, project.config.projectDir, project.skillGraph, sessionCtx, mcpReadonlyGraphs, mcpUserAccess);
+            await mcpServer.connect(transport);
+            await transport.handleRequest(req, res, body);
         }
-        // Validate project exists
-        const project = projectManager.getProject(projectId);
-        if (!project) {
-            res.writeHead(404).end(JSON.stringify({ error: `Project "${projectId}" not found` }));
-            return;
+        catch (err) {
+            if (!res.headersSent)
+                res.writeHead(400).end(String(err));
         }
-        // Build session context (auto-detect workspace if not in URL)
-        const ws = workspaceId
-            ? projectManager.getWorkspace(workspaceId)
-            : projectManager.getProjectWorkspace(projectId);
-        const sessionCtx = {
-            projectId,
-            workspaceId: ws?.id,
-            workspaceProjects: ws?.config.projects,
-        };
-        const body = await collectBody(req);
-        const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
-            sessionIdGenerator: () => (0, crypto_1.randomUUID)(),
-            onsessioninitialized: (sid) => {
-                sessions.set(sid, { projectId, workspaceId: ws?.id, server: mcpServer, transport, lastActivity: Date.now() });
-                process.stderr.write(`[http] Session ${sid} started (project: ${projectId}${ws ? `, workspace: ${ws.id}` : ''})\n`);
-            },
-        });
-        transport.onclose = () => {
-            const sid = transport.sessionId;
-            if (sid)
-                sessions.delete(sid);
-        };
-        const mcpServer = createMcpServer(project.docGraph, project.codeGraph, project.knowledgeGraph, project.fileIndexGraph, project.taskGraph, project.embedFns, project.mutationQueue, project.config.projectDir, project.skillGraph, sessionCtx);
-        await mcpServer.connect(transport);
-        await transport.handleRequest(req, res, body);
     });
     // Attach WebSocket server for real-time events
-    (0, websocket_1.attachWebSocket)(httpServer, projectManager);
+    (0, websocket_1.attachWebSocket)(httpServer, projectManager, {
+        jwtSecret: restOptions?.serverConfig?.jwtSecret,
+        users: restOptions?.users,
+    });
     return new Promise((resolve) => {
         httpServer.listen(port, host, () => {
-            process.stderr.write(`[server] MCP endpoints: http://${host}:${port}/mcp/{projectId} and /mcp/{workspaceId}/{projectId}\n`);
-            process.stderr.write(`[server] REST API at http://${host}:${port}/api/\n`);
-            process.stderr.write(`[server] WebSocket at ws://${host}:${port}/api/ws\n`);
+            const base = `http://${host}:${port}`;
+            const projects = projectManager.listProjects();
+            const workspaces = projectManager.listWorkspaces();
+            const lines = [
+                '',
+                '  ╔══════════════════════════════════════════════╗',
+                '  ║         Graph Memory Server Ready            ║',
+                '  ╚══════════════════════════════════════════════╝',
+                '',
+                `  UI        ${base}/ui/`,
+                `  REST API  ${base}/api/`,
+                `  WebSocket ws://${host}:${port}/api/ws`,
+                '',
+                '  MCP endpoints:',
+            ];
+            for (const id of projects) {
+                const ws = projectManager.getProjectWorkspace(id);
+                const wsLabel = ws ? ` (${ws.id})` : '';
+                lines.push(`    ${id}${wsLabel}  ${base}/mcp/${id}`);
+            }
+            if (projects.length === 0) {
+                lines.push('    (no projects configured)');
+            }
+            if (workspaces.length > 0) {
+                lines.push('');
+                lines.push(`  Workspaces: ${workspaces.join(', ')}`);
+            }
+            lines.push('');
+            process.stderr.write(lines.join('\n') + '\n');
             resolve(httpServer);
         });
     });