@hasna/mementos 0.14.17 → 0.14.18

package/dist/server/index.js

@@ -10167,6 +10167,35 @@ ALTER TABLE memories ADD COLUMN sequence_group TEXT DEFAULT NULL;
 ALTER TABLE memories ADD COLUMN sequence_order INTEGER DEFAULT NULL;
 CREATE INDEX IF NOT EXISTS idx_memories_sequence_group ON memories(sequence_group) WHERE sequence_group IS NOT NULL;
 INSERT OR IGNORE INTO _migrations (id) VALUES (32);
+`,
+    `
+ALTER TABLE machines ADD COLUMN is_primary INTEGER NOT NULL DEFAULT 0;
+CREATE INDEX IF NOT EXISTS idx_machines_primary ON machines(is_primary);
+CREATE TRIGGER IF NOT EXISTS machines_single_primary_insert
+AFTER INSERT ON machines
+WHEN NEW.is_primary = 1
+BEGIN
+  UPDATE machines
+  SET is_primary = 0,
+      last_seen_at = COALESCE(NEW.last_seen_at, datetime('now'))
+  WHERE id != NEW.id AND is_primary = 1;
+END;
+CREATE TRIGGER IF NOT EXISTS machines_single_primary_update
+AFTER UPDATE OF is_primary ON machines
+WHEN NEW.is_primary = 1
+BEGIN
+  UPDATE machines
+  SET is_primary = 0,
+      last_seen_at = COALESCE(NEW.last_seen_at, datetime('now'))
+  WHERE id != NEW.id AND is_primary = 1;
+END;
+CREATE TRIGGER IF NOT EXISTS machines_prevent_delete_primary
+BEFORE DELETE ON machines
+WHEN OLD.is_primary = 1
+BEGIN
+  SELECT RAISE(ABORT, 'Primary machine cannot be deleted');
+END;
+INSERT OR IGNORE INTO _migrations (id) VALUES (33);
 `
   ];
 });
@@ -10250,11 +10279,16 @@ function ensureDir2(filePath) {
   }
 }
 function getDatabase(dbPath) {
-  if (_db)
-    return _db;
   const path = dbPath || getDbPath3();
+  if (_db) {
+    if (_dbPath === path)
+      return _db;
+    _db.close();
+    _db = null;
+  }
+  _dbPath = path;
   ensureDir2(path);
-  _db = new SqliteAdapter(path, { create: true });
+  _db = new SqliteAdapter(path);
   _db.run("PRAGMA journal_mode = WAL");
   _db.run("PRAGMA busy_timeout = 5000");
   _db.run("PRAGMA foreign_keys = ON");
@@ -10278,13 +10312,17 @@ function runMigrations(db) {
     for (let i = currentLevel;i < MIGRATIONS.length; i++) {
       try {
         db.exec(MIGRATIONS[i]);
-      } catch {}
+      } catch (e) {
+        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
     }
   } catch {
-    for (const migration of MIGRATIONS) {
+    for (let i = 0;i < MIGRATIONS.length; i++) {
       try {
-        db.exec(migration);
-      } catch {}
+        db.exec(MIGRATIONS[i]);
+      } catch (e) {
+        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
     }
   }
 }
@@ -10307,6 +10345,9 @@ function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
 }
 function resolvePartialId(db, table, partialId) {
+  if (!ALLOWED_TABLES.has(table)) {
+    throw new Error(`Invalid table name: ${table}`);
+  }
   if (partialId.length >= 36) {
     const row = db.query(`SELECT id FROM ${table} WHERE id = ?`).get(partialId);
     return row?.id ?? null;
@@ -10317,10 +10358,25 @@ function resolvePartialId(db, table, partialId) {
   }
   return null;
 }
-var _db = null;
+var _db = null, _dbPath = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
   init_dist();
   init_migrations();
+  ALLOWED_TABLES = new Set([
+    "memories",
+    "agents",
+    "entities",
+    "projects",
+    "relations",
+    "memory_audit_log",
+    "locks",
+    "sessions",
+    "session_memory_jobs",
+    "synthesis_runs",
+    "synthesis_proposals",
+    "tool_events",
+    "webhook_hooks"
+  ]);
 });
 
 // src/lib/hooks.ts
@@ -10993,6 +11049,22 @@ function listMemories(filter, db) {
       conditions.push("session_id = ?");
       params.push(filter.session_id);
     }
+    if ("machine_id" in filter) {
+      if (filter.machine_id === null) {
+        conditions.push("machine_id IS NULL");
+      } else if (filter.machine_id) {
+        conditions.push("machine_id = ?");
+        params.push(filter.machine_id);
+      }
+    }
+    if ("visible_to_machine_id" in filter) {
+      if (filter.visible_to_machine_id === null) {
+        conditions.push("machine_id IS NULL");
+      } else if (filter.visible_to_machine_id !== undefined) {
+        conditions.push("(machine_id IS NULL OR machine_id = ?)");
+        params.push(filter.visible_to_machine_id);
+      }
+    }
     if (filter.min_importance) {
       conditions.push("importance >= ?");
       params.push(filter.min_importance);
@@ -13355,12 +13427,14 @@ async function synthesizeProfile(options) {
   const prefMemories = listMemories({
     category: "preference",
     project_id: options.project_id,
+    machine_id: null,
     status: "active",
     limit: 30
   });
   const factMemories = listMemories({
     category: "fact",
     project_id: options.project_id,
+    machine_id: null,
     status: "active",
     limit: 30
   });
@@ -13671,6 +13745,65 @@ function ensureDir(dir) {
 // src/server/index.ts
 init_database();
 
+// src/db/machines.ts
+init_database();
+import { hostname, platform as platform2 } from "os";
+function parseMachine(row) {
+  if (!row)
+    return null;
+  return {
+    ...row,
+    is_primary: Boolean(row.is_primary)
+  };
+}
+function registerMachine(name, db = getDatabase()) {
+  const host = hostname();
+  const plat = platform2();
+  const machineName = name?.trim() || host;
+  const existing = parseMachine(db.query("SELECT * FROM machines WHERE hostname = ?").get(host));
+  if (existing) {
+    db.run("UPDATE machines SET last_seen_at = ? WHERE id = ?", [now(), existing.id]);
+    return parseMachine(db.query("SELECT * FROM machines WHERE id = ?").get(existing.id));
+  }
+  let finalName = machineName;
+  let suffix = 2;
+  while (db.query("SELECT id FROM machines WHERE name = ?").get(finalName)) {
+    finalName = `${machineName}-${suffix++}`;
+  }
+  const id = uuid();
+  db.run("INSERT INTO machines (id, name, hostname, platform) VALUES (?, ?, ?, ?)", [id, finalName, host, plat]);
+  return parseMachine(db.query("SELECT * FROM machines WHERE id = ?").get(id));
+}
+function getPrimaryMachine(db = getDatabase()) {
+  return parseMachine(db.query("SELECT * FROM machines WHERE is_primary = 1 LIMIT 1").get());
+}
+function getPrimaryMachineCandidate(db = getDatabase()) {
+  if (getPrimaryMachine(db))
+    return null;
+  return parseMachine(db.query("SELECT * FROM machines ORDER BY created_at ASC, id ASC LIMIT 1").get());
+}
+function getPrimaryMachineStartupWarning(db = getDatabase()) {
+  if (getPrimaryMachine(db))
+    return null;
+  const candidate = getPrimaryMachineCandidate(db);
+  if (!candidate) {
+    return "No primary machine configured. Fallback sync target is unset because no machines are registered yet.";
+  }
+  return `No primary machine configured. Fallback sync target is unset. Candidate: ${candidate.name} (${candidate.id.slice(0, 8)} / ${candidate.hostname}). Confirm it with set_primary_machine.`;
+}
+function touchMachine(id, db = getDatabase()) {
+  db.run("UPDATE machines SET last_seen_at = ? WHERE id = ?", [now(), id]);
+}
+function getCurrentMachineId(db = getDatabase()) {
+  const host = hostname();
+  const m = db.query("SELECT id FROM machines WHERE hostname = ?").get(host);
+  if (m) {
+    touchMachine(m.id, db);
+    return m.id;
+  }
+  return registerMachine(undefined, db).id;
+}
+
 // src/lib/built-in-hooks.ts
 init_hooks();
 
@@ -14710,6 +14843,10 @@ async function _processNext() {
 
 // src/server/router.ts
 var routes = [];
+var nextRouteOrder = 0;
+function computeSpecificity(path) {
+  return path.split("/").filter(Boolean).reduce((score, segment) => score + (segment.startsWith(":") ? 1 : 10), 0);
+}
 function addRoute(method, path, handler) {
   const paramNames = [];
   const patternStr = path.replace(/:(\w+)/g, (_match, name) => {
@@ -14718,12 +14855,16 @@ function addRoute(method, path, handler) {
   });
   routes.push({
     method,
+    path,
     pattern: new RegExp(`^${patternStr}$`),
     paramNames,
+    specificity: computeSpecificity(path),
+    order: nextRouteOrder++,
     handler
   });
 }
 function matchRoute(method, pathname) {
+  let bestMatch = null;
   for (const route of routes) {
     if (route.method !== method)
       continue;
@@ -14733,10 +14874,14 @@ function matchRoute(method, pathname) {
       route.paramNames.forEach((name, i) => {
         params[name] = match[i + 1];
       });
-      return { handler: route.handler, params };
+      if (!bestMatch || route.specificity > bestMatch.route.specificity || route.specificity === bestMatch.route.specificity && route.order < bestMatch.route.order) {
+        bestMatch = { route, params };
+      }
     }
   }
-  return null;
+  if (!bestMatch)
+    return null;
+  return { handler: bestMatch.route.handler, params: bestMatch.params };
 }
 
 // src/server/helpers.ts
@@ -14744,7 +14889,7 @@ import { existsSync as existsSync6 } from "fs";
 import { dirname as dirname4, extname, join as join7 } from "path";
 import { fileURLToPath } from "url";
 var CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Origin": process.env["MEMENTOS_CORS_ORIGIN"] ?? "http://localhost:19428",
   "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
   "Access-Control-Allow-Headers": "Content-Type, Authorization",
   "Access-Control-Max-Age": "86400"
@@ -14779,6 +14924,37 @@ async function readJson(req) {
     return null;
   }
 }
+function getCorsHeaders(req) {
+  const allowedOrigin = process.env["MEMENTOS_CORS_ORIGIN"] ?? "http://localhost:19428";
+  const origin = req?.headers.get("origin");
+  const finalOrigin = origin === allowedOrigin ? origin : allowedOrigin;
+  return {
+    "Access-Control-Allow-Origin": finalOrigin,
+    "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Max-Age": "86400"
+  };
+}
+function authenticateRequest(req) {
+  const requiredKey = process.env["MEMENTOS_API_KEY"];
+  if (!requiredKey)
+    return null;
+  const authHeader = req.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return new Response(JSON.stringify({ error: "Unauthorized. Provide a Bearer token in the Authorization header." }), {
+      status: 401,
+      headers: { "Content-Type": "application/json", ...getCorsHeaders(req) }
+    });
+  }
+  const provided = authHeader.slice("Bearer ".length);
+  if (provided !== requiredKey) {
+    return new Response(JSON.stringify({ error: "Forbidden. Invalid API key." }), {
+      status: 403,
+      headers: { "Content-Type": "application/json", ...getCorsHeaders(req) }
+    });
+  }
+  return null;
+}
 function getSearchParams(url) {
   const params = {};
   url.searchParams.forEach((v, k) => {
@@ -14814,11 +14990,8 @@ function serveStaticFile(filePath) {
   });
 }
 
-// src/server/routes/memories.ts
+// src/server/routes/memories-crud.ts
 init_memories();
-init_database();
-init_search();
-init_types2();
 
 // src/lib/duration.ts
 var UNIT_MS = {
@@ -14863,10 +15036,8 @@ var FORMAT_UNITS = [
   ["s", UNIT_MS["s"]]
 ];
 
-// src/server/routes/memories.ts
-addRoute("GET", "/api/health", () => {
-  return json({ ok: true, version: "1", db: getDbPath() });
-});
+// src/server/routes/memories-crud.ts
+init_types2();
 addRoute("GET", "/api/memories", (_req, url) => {
   const q = getSearchParams(url);
   const filter = {};
@@ -14900,6 +15071,80 @@ addRoute("GET", "/api/memories", (_req, url) => {
   }
   return json({ memories, count: memories.length });
 });
+addRoute("POST", "/api/memories", async (req) => {
+  const body = await readJson(req);
+  if (!body) {
+    return errorResponse("Invalid JSON body", 400);
+  }
+  if (!body["key"] || !body["value"]) {
+    return errorResponse("Missing required fields: key, value", 400);
+  }
+  try {
+    if (body["ttl_ms"] !== undefined && typeof body["ttl_ms"] === "string") {
+      body["ttl_ms"] = parseDuration(body["ttl_ms"]);
+    }
+    const memory = createMemory(body);
+    return json(memory, 201);
+  } catch (e) {
+    if (e instanceof DuplicateMemoryError) {
+      return errorResponse(e.message, 409);
+    }
+    throw e;
+  }
+});
+addRoute("GET", "/api/memories/:id", (_req, _url, params) => {
+  const memory = getMemory(params["id"]);
+  if (!memory) {
+    return errorResponse("Memory not found", 404);
+  }
+  touchMemory(memory.id);
+  return json(memory);
+});
+addRoute("PATCH", "/api/memories/:id", async (req, _url, params) => {
+  const body = await readJson(req);
+  if (!body) {
+    return errorResponse("Invalid JSON body", 400);
+  }
+  const updateBody = { ...body };
+  if (updateBody["version"] === undefined) {
+    const existing = getMemory(params["id"]);
+    if (!existing)
+      return errorResponse("Memory not found", 404);
+    updateBody["version"] = existing.version;
+  }
+  try {
+    const memory = updateMemory(params["id"], updateBody);
+    return json(memory);
+  } catch (e) {
+    if (e instanceof MemoryNotFoundError) {
+      return errorResponse(e.message, 404);
+    }
+    if (e instanceof VersionConflictError) {
+      return errorResponse(e.message, 409, {
+        expected: e.expected,
+        actual: e.actual
+      });
+    }
+    throw e;
+  }
+});
+addRoute("GET", "/api/memories/:id/versions", (_req, _url, params) => {
+  const memory = getMemory(params["id"]);
+  if (!memory)
+    return errorResponse("Memory not found", 404);
+  const versions = getMemoryVersions(memory.id);
+  return json({ versions, count: versions.length, current_version: memory.version });
+});
+addRoute("DELETE", "/api/memories/:id", (_req, _url, params) => {
+  const deleted = deleteMemory(params["id"]);
+  if (!deleted) {
+    return errorResponse("Memory not found", 404);
+  }
+  return json({ deleted: true });
+});
+
+// src/server/routes/memories-stats.ts
+init_database();
 addRoute("GET", "/api/memories/stats", (_req) => {
   const db = getDatabase();
   const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
@@ -14975,6 +15220,8 @@ addRoute("GET", "/api/activity", (_req, url) => {
     params.push(projectId);
   }
   const where = conditions.map((c) => `AND ${c}`).join(" ");
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
+  params.push(cutoffDate);
   const rows = db.query(`
     SELECT
       date(created_at) AS date,
@@ -14984,7 +15231,7 @@ addRoute("GET", "/api/activity", (_req, url) => {
       SUM(CASE WHEN scope = 'private' THEN 1 ELSE 0 END) AS private_count,
       AVG(importance) AS avg_importance
     FROM memories
-    WHERE date(created_at) >= date('now', '-${days} days') ${where}
+    WHERE date(created_at) >= ? ${where}
     GROUP BY date(created_at)
     ORDER BY date ASC
   `).all(...params);
@@ -14997,12 +15244,13 @@ addRoute("GET", "/api/memories/stale", (_req, url) => {
   const agentId = q["agent_id"];
   const limit = Math.min(parseInt(q["limit"] || "20", 10), 100);
   const db = getDatabase();
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString();
   const conds = [
     "status = 'active'",
-    `(accessed_at IS NULL OR accessed_at < datetime('now', '-${days} days'))`,
+    "(accessed_at IS NULL OR accessed_at < ?)",
     "pinned = 0"
   ];
-  const params = [];
+  const params = [cutoffDate];
   if (projectId) {
     conds.push("project_id = ?");
     params.push(projectId);
@@ -15020,23 +15268,28 @@ addRoute("GET", "/api/report", (_req, url) => {
   const projectId = q["project_id"];
   const agentId = q["agent_id"];
   const db = getDatabase();
-  const cond = [
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
+  const scopedCond = [
     projectId ? "AND project_id = ?" : "",
     agentId ? "AND agent_id = ?" : ""
   ].filter(Boolean).join(" ");
-  const params = [...projectId ? [projectId] : [], ...agentId ? [agentId] : []];
-  const total = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' ${cond}`).get(...params).c;
-  const pinned = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1 ${cond}`).get(...params).c;
+  const scopedParams = [
+    ...projectId ? [projectId] : [],
+    ...agentId ? [agentId] : []
+  ];
+  const recentParams = [cutoffDate, ...scopedParams];
+  const total = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond}`).get(...scopedParams).c;
+  const pinned = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1 ${scopedCond}`).get(...scopedParams).c;
   const actRows = db.query(`
     SELECT date(created_at) AS date, COUNT(*) AS memories_created
-    FROM memories WHERE status = 'active' AND date(created_at) >= date('now', '-${days} days') ${cond}
+    FROM memories WHERE status = 'active' AND date(created_at) >= ? ${scopedCond}
     GROUP BY date(created_at) ORDER BY date(created_at) ASC
-  `).all(...params);
+  `).all(...recentParams);
   const recentTotal = actRows.reduce((s, r) => s + r.memories_created, 0);
-  const byScopeRows = db.query(`SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' ${cond} GROUP BY scope`).all(...params);
-  const byCatRows = db.query(`SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' ${cond} GROUP BY category`).all(...params);
-  const topMems = db.query(`SELECT id, key, value, importance, scope, category FROM memories WHERE status = 'active' ${cond} ORDER BY importance DESC, access_count DESC LIMIT 5`).all(...params);
-  const topAgents = db.query(`SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL ${cond} GROUP BY agent_id ORDER BY c DESC LIMIT 5`).all(...params);
+  const byScopeRows = db.query(`SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY scope`).all(...scopedParams);
+  const byCatRows = db.query(`SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY category`).all(...scopedParams);
+  const topMems = db.query(`SELECT id, key, value, importance, scope, category FROM memories WHERE status = 'active' ${scopedCond} ORDER BY importance DESC, access_count DESC LIMIT 5`).all(...scopedParams);
+  const topAgents = db.query(`SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL ${scopedCond} GROUP BY agent_id ORDER BY c DESC LIMIT 5`).all(...scopedParams);
   return json({
     total,
     pinned,
@@ -15048,6 +15301,9 @@ addRoute("GET", "/api/report", (_req, url) => {
     top_agents: topAgents
   });
 });
+
+// src/server/routes/memories-search.ts
+init_search();
 addRoute("POST", "/api/memories/search", async (req) => {
   const body = await readJson(req);
   if (!body || typeof body["query"] !== "string") {
@@ -15109,6 +15365,51 @@ addRoute("POST", "/api/memories/search/bm25", async (req) => {
   const results = searchWithBm25(body["query"], filter);
   return json({ results, count: results.length });
 });
+
+// src/server/routes/memories-bulk.ts
+init_memories();
+addRoute("POST", "/api/memories/bulk-forget", async (req) => {
+  const body = await readJson(req);
+  if (!body || !Array.isArray(body["ids"])) {
+    return errorResponse("Missing required field: ids (array)", 400);
+  }
+  const ids = body["ids"];
+  let deleted = 0;
+  for (const id of ids) {
+    try {
+      if (deleteMemory(id))
+        deleted++;
+    } catch {}
+  }
+  return json({ deleted, total: ids.length });
+});
+addRoute("POST", "/api/memories/bulk-update", async (req) => {
+  const body = await readJson(req);
+  if (!body || !Array.isArray(body["ids"])) {
+    return errorResponse("Missing required fields: ids (array)", 400);
+  }
+  const ids = body["ids"];
+  const { ids: _ids, ...fields } = body;
+  let updated = 0;
+  const errors = [];
+  for (const id of ids) {
+    try {
+      const memory = getMemory(id);
+      if (memory) {
+        updateMemory(id, { ...fields, version: memory.version });
+        updated++;
+      } else {
+        errors.push(`Memory not found: ${id}`);
+      }
+    } catch (e) {
+      errors.push(`Failed ${id}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  return json({ updated, errors, total: ids.length });
+});
+
+// src/server/routes/memories-io.ts
+init_memories();
 addRoute("POST", "/api/memories/export", async (req) => {
   const body = await readJson(req) || {};
   const filter = {};
@@ -15149,49 +15450,35 @@ addRoute("POST", "/api/memories/import", async (req) => {
   }
   return json({ imported, errors, total: memoriesArr.length }, 201);
 });
-addRoute("POST", "/api/memories/bulk-forget", async (req) => {
-  const body = await readJson(req);
-  if (!body || !Array.isArray(body["ids"])) {
-    return errorResponse("Missing required field: ids (array)", 400);
-  }
-  const ids = body["ids"];
-  let deleted = 0;
-  for (const id of ids) {
-    try {
-      if (deleteMemory(id))
-        deleted++;
-    } catch {}
-  }
-  return json({ deleted, total: ids.length });
-});
-addRoute("POST", "/api/memories/bulk-update", async (req) => {
-  const body = await readJson(req);
-  if (!body || !Array.isArray(body["ids"])) {
-    return errorResponse("Missing required fields: ids (array)", 400);
+
+// src/server/routes/memories-misc.ts
+init_memories();
+
+// src/lib/machine-visibility.ts
+function resolveVisibleMachineId(machineId, db) {
+  if (machineId !== undefined) {
+    return machineId;
   }
-  const ids = body["ids"];
-  const { ids: _ids, ...fields } = body;
-  let updated = 0;
-  const errors = [];
-  for (const id of ids) {
-    try {
-      const memory = getMemory(id);
-      if (memory) {
-        updateMemory(id, { ...fields, version: memory.version });
-        updated++;
-      } else {
-        errors.push(`Memory not found: ${id}`);
-      }
-    } catch (e) {
-      errors.push(`Failed ${id}: ${e instanceof Error ? e.message : String(e)}`);
-    }
+  try {
+    return getCurrentMachineId(db);
+  } catch {
+    return null;
   }
-  return json({ updated, errors, total: ids.length });
+}
+function visibleToMachineFilter(machineId, db) {
+  return {
+    visible_to_machine_id: resolveVisibleMachineId(machineId, db)
+  };
+}
+
+// src/server/routes/memories-misc.ts
+addRoute("GET", "/api/health", () => {
+  return json({ ok: true, version: "1", db: getDbPath() });
 });
 addRoute("POST", "/api/memories/extract", async (req) => {
   const body = await readJson(req);
   if (!body)
-    return errorResponse("Invalid JSON body", 400);
+    return json({ error: "Invalid JSON body" }, 400);
   const sessionId = body["session_id"];
   const agentId = body["agent_id"];
   const projectId = body["project_id"];
@@ -15259,77 +15546,6 @@ addRoute("POST", "/api/memories/clean", () => {
   const cleaned = cleanExpiredMemories();
   return json({ cleaned });
 });
-addRoute("POST", "/api/memories", async (req) => {
-  const body = await readJson(req);
-  if (!body) {
-    return errorResponse("Invalid JSON body", 400);
-  }
-  if (!body["key"] || !body["value"]) {
-    return errorResponse("Missing required fields: key, value", 400);
-  }
-  try {
-    if (body["ttl_ms"] !== undefined && typeof body["ttl_ms"] === "string") {
-      body["ttl_ms"] = parseDuration(body["ttl_ms"]);
-    }
-    const memory = createMemory(body);
-    return json(memory, 201);
-  } catch (e) {
-    if (e instanceof DuplicateMemoryError) {
-      return errorResponse(e.message, 409);
-    }
-    throw e;
-  }
-});
-addRoute("GET", "/api/memories/:id", (_req, _url, params) => {
-  const memory = getMemory(params["id"]);
-  if (!memory) {
-    return errorResponse("Memory not found", 404);
-  }
-  touchMemory(memory.id);
-  return json(memory);
-});
-addRoute("PATCH", "/api/memories/:id", async (req, _url, params) => {
-  const body = await readJson(req);
-  if (!body) {
-    return errorResponse("Invalid JSON body", 400);
-  }
-  const updateBody = { ...body };
-  if (updateBody["version"] === undefined) {
-    const existing = getMemory(params["id"]);
-    if (!existing)
-      return errorResponse("Memory not found", 404);
-    updateBody["version"] = existing.version;
-  }
-  try {
-    const memory = updateMemory(params["id"], updateBody);
-    return json(memory);
-  } catch (e) {
-    if (e instanceof MemoryNotFoundError) {
-      return errorResponse(e.message, 404);
-    }
-    if (e instanceof VersionConflictError) {
-      return errorResponse(e.message, 409, {
-        expected: e.expected,
-        actual: e.actual
-      });
-    }
-    throw e;
-  }
-});
-addRoute("GET", "/api/memories/:id/versions", (_req, _url, params) => {
-  const memory = getMemory(params["id"]);
-  if (!memory)
-    return errorResponse("Memory not found", 404);
-  const versions = getMemoryVersions(memory.id);
-  return json({ versions, count: versions.length, current_version: memory.version });
-});
-addRoute("DELETE", "/api/memories/:id", (_req, _url, params) => {
-  const deleted = deleteMemory(params["id"]);
-  if (!deleted) {
-    return errorResponse("Memory not found", 404);
-  }
-  return json({ deleted: true });
-});
 addRoute("GET", "/api/inject", (_req, url) => {
   const q = getSearchParams(url);
   const maxTokens = q["max_tokens"] ? parseInt(q["max_tokens"], 10) : 500;
@@ -15339,6 +15555,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
     "fact",
     "knowledge"
   ];
+  const visibleMachineId = resolveVisibleMachineId(q["machine_id"]);
   const allMemories = [];
   const globalMems = listMemories({
     scope: "global",
@@ -15346,6 +15563,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
     min_importance: minImportance,
     status: "active",
     project_id: q["project_id"],
+    ...visibleToMachineFilter(visibleMachineId),
     limit: 50
   });
   allMemories.push(...globalMems);
@@ -15356,6 +15574,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
       min_importance: minImportance,
       status: "active",
       project_id: q["project_id"],
+      ...visibleToMachineFilter(visibleMachineId),
       limit: 50
     });
     allMemories.push(...sharedMems);
@@ -15367,6 +15586,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
       min_importance: minImportance,
       status: "active",
       agent_id: q["agent_id"],
+      ...visibleToMachineFilter(visibleMachineId),
       limit: 50
     });
     allMemories.push(...privateMems);
@@ -16028,10 +16248,133 @@ addRoute("GET", "/api/graph/:entityId", (_req, url, params) => {
   }
 });
 
-// src/server/routes/system.ts
+// src/server/routes/system-auto-memory.ts
 init_auto_memory();
 init_registry();
+function registerSystemAutoMemoryRoutes() {
+  addRoute("POST", "/api/auto-memory/process", async (req) => {
+    const body = await readJson(req);
+    const turn = body?.turn;
+    if (!turn)
+      return errorResponse("turn is required", 400);
+    processConversationTurn(turn, { agentId: body?.agent_id, projectId: body?.project_id, sessionId: body?.session_id });
+    const stats = getAutoMemoryStats();
+    return json({ queued: true, queue: stats }, 202);
+  });
+  addRoute("GET", "/api/auto-memory/status", () => {
+    return json({
+      queue: getAutoMemoryStats(),
+      config: providerRegistry.getConfig(),
+      providers: providerRegistry.health()
+    });
+  });
+  addRoute("GET", "/api/auto-memory/config", () => {
+    return json(providerRegistry.getConfig());
+  });
+  addRoute("PATCH", "/api/auto-memory/config", async (req) => {
+    const body = await readJson(req) ?? {};
+    const patch = {};
+    if (body.provider)
+      patch.provider = body.provider;
+    if (body.model)
+      patch.model = body.model;
+    if (body.enabled !== undefined)
+      patch.enabled = Boolean(body.enabled);
+    if (body.min_importance !== undefined)
+      patch.minImportance = Number(body.min_importance);
+    if (body.auto_entity_link !== undefined)
+      patch.autoEntityLink = Boolean(body.auto_entity_link);
+    configureAutoMemory(patch);
+    return json({ updated: true, config: providerRegistry.getConfig() });
+  });
+  addRoute("POST", "/api/auto-memory/test", async (req) => {
+    const body = await readJson(req) ?? {};
+    const { turn, provider: providerName, agent_id, project_id } = body;
+    if (!turn)
+      return errorResponse("turn is required", 400);
+    const provider = providerName ? providerRegistry.getProvider(providerName) : providerRegistry.getAvailable();
+    if (!provider)
+      return errorResponse("No LLM provider configured. Set an API key (ANTHROPIC_API_KEY, OPENAI_API_KEY, CEREBRAS_API_KEY, or XAI_API_KEY).", 503);
+    const memories = await provider.extractMemories(turn, { agentId: agent_id, projectId: project_id });
+    return json({
+      provider: provider.name,
+      model: provider.config.model,
+      extracted: memories,
+      count: memories.length,
+      note: "DRY RUN \u2014 nothing was saved"
+    });
+  });
+}
+
+// src/server/routes/system-hooks.ts
 init_hooks();
+function registerSystemHookRoutes() {
+  addRoute("GET", "/api/hooks", (_req, url) => {
+    const type = url.searchParams.get("type") ?? undefined;
+    const hooks = hookRegistry.list(type);
+    return json(hooks.map((h) => ({
+      id: h.id,
+      type: h.type,
+      blocking: h.blocking,
+      priority: h.priority,
+      builtin: h.builtin ?? false,
+      agentId: h.agentId,
+      projectId: h.projectId,
+      description: h.description
+    })));
+  });
+  addRoute("GET", "/api/hooks/stats", () => json(hookRegistry.stats()));
+  addRoute("GET", "/api/webhooks", (_req, url) => {
+    const type = url.searchParams.get("type") ?? undefined;
+    const enabledParam = url.searchParams.get("enabled");
+    const enabled = enabledParam !== null ? enabledParam === "true" : undefined;
+    return json(listWebhookHooks({
+      type,
+      enabled
+    }));
+  });
+  addRoute("POST", "/api/webhooks", async (req) => {
+    const body = await readJson(req) ?? {};
+    if (!body.type || !body.handler_url) {
+      return errorResponse("type and handler_url are required", 400);
+    }
+    const wh = createWebhookHook({
+      type: body.type,
+      handlerUrl: body.handler_url,
+      priority: body.priority,
+      blocking: body.blocking,
+      agentId: body.agent_id,
+      projectId: body.project_id,
+      description: body.description
+    });
+    reloadWebhooks();
+    return json(wh, 201);
+  });
+  addRoute("GET", "/api/webhooks/:id", (_req, _url, params) => {
+    const wh = getWebhookHook(params["id"]);
+    if (!wh)
+      return errorResponse("Webhook not found", 404);
+    return json(wh);
+  });
+  addRoute("PATCH", "/api/webhooks/:id", async (req, _url, params) => {
+    const body = await readJson(req) ?? {};
+    const updated = updateWebhookHook(params["id"], {
+      enabled: body.enabled,
+      priority: body.priority,
+      description: body.description
+    });
+    if (!updated)
+      return errorResponse("Webhook not found", 404);
+    reloadWebhooks();
+    return json(updated);
+  });
+  addRoute("DELETE", "/api/webhooks/:id", (_req, _url, params) => {
+    const deleted = deleteWebhookHook(params["id"]);
+    if (!deleted)
+      return errorResponse("Webhook not found", 404);
+    return new Response(null, { status: 204 });
+  });
+}
 
 // src/lib/synthesis/index.ts
 init_database();
@@ -16935,9 +17278,49 @@ function getSynthesisStatus(runId, projectId, db) {
   };
 }
 
-// src/server/routes/system.ts
+// src/server/routes/system-synthesis.ts
 init_synthesis();
 init_profile_synthesizer();
+function registerSystemSynthesisRoutes() {
+  addRoute("POST", "/api/synthesis/run", async (req) => {
+    const body = await readJson(req) ?? {};
+    const result = await runSynthesis({
+      projectId: body.project_id,
+      agentId: body.agent_id,
+      dryRun: body.dry_run,
+      maxProposals: body.max_proposals,
+      provider: body.provider
+    });
+    return json(result, result.dryRun ? 200 : 201);
+  });
+  addRoute("GET", "/api/synthesis/runs", (_req, url) => {
+    const projectId = url.searchParams.get("project_id") ?? undefined;
+    const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
+    const runs = listSynthesisRuns({ project_id: projectId, limit });
+    return json({ runs, count: runs.length });
+  });
+  addRoute("GET", "/api/synthesis/status", (_req, url) => {
+    const projectId = url.searchParams.get("project_id") ?? undefined;
+    const runId = url.searchParams.get("run_id") ?? undefined;
+    return json(getSynthesisStatus(runId, projectId));
+  });
+  addRoute("POST", "/api/synthesis/rollback/:run_id", async (_req, _url, params) => {
+    const result = await rollbackSynthesis(params["run_id"]);
+    return json(result);
+  });
+  addRoute("GET", "/api/profile/synthesize", async (_req, url) => {
+    const q = getSearchParams(url);
+    const result = await synthesizeProfile({
+      project_id: q["project_id"] || undefined,
+      agent_id: q["agent_id"] || undefined,
+      force_refresh: q["force_refresh"] === "true"
+    });
+    if (!result) {
+      return json({ profile: null, message: "No preference/fact memories found to synthesize" });
+    }
+    return json(result);
+  });
+}
 
 // src/lib/session-auto-resolve.ts
 function autoResolveAgentProject(metadata, db) {
@@ -17006,255 +17389,136 @@ function autoResolveAgentProject(metadata, db) {
   };
 }
 
-// src/server/routes/system.ts
-init_database();
-addRoute("POST", "/api/auto-memory/process", async (req) => {
-  const body = await readJson(req);
-  const turn = body?.turn;
-  if (!turn)
-    return errorResponse("turn is required", 400);
-  processConversationTurn(turn, { agentId: body?.agent_id, projectId: body?.project_id, sessionId: body?.session_id });
-  const stats = getAutoMemoryStats();
-  return json({ queued: true, queue: stats }, 202);
-});
-addRoute("GET", "/api/auto-memory/status", () => {
-  return json({
-    queue: getAutoMemoryStats(),
-    config: providerRegistry.getConfig(),
-    providers: providerRegistry.health()
+// src/server/routes/system-sessions.ts
+function registerSystemSessionRoutes() {
+  addRoute("POST", "/api/sessions/ingest", async (req) => {
+    const body = await readJson(req) ?? {};
+    const { transcript, session_id, agent_id, project_id, source, metadata } = body;
+    if (!transcript || typeof transcript !== "string")
+      return errorResponse("transcript is required", 400);
+    if (!session_id || typeof session_id !== "string")
+      return errorResponse("session_id is required", 400);
+    let resolvedAgentId = agent_id;
+    let resolvedProjectId = project_id;
+    if (!resolvedAgentId || !resolvedProjectId) {
+      const resolved = autoResolveAgentProject(metadata ?? {});
+      if (!resolvedAgentId && resolved.agentId)
+        resolvedAgentId = resolved.agentId;
+      if (!resolvedProjectId && resolved.projectId)
+        resolvedProjectId = resolved.projectId;
+    }
+    const job = createSessionJob({
+      session_id,
+      transcript,
+      source: source ?? "manual",
+      agent_id: resolvedAgentId,
+      project_id: resolvedProjectId,
+      metadata: metadata ?? {}
+    });
+    enqueueSessionJob(job.id);
+    return json({ job_id: job.id, status: "queued", message: "Session queued for memory extraction" }, 202);
   });
-});
-addRoute("GET", "/api/auto-memory/config", () => {
-  return json(providerRegistry.getConfig());
-});
-addRoute("PATCH", "/api/auto-memory/config", async (req) => {
-  const body = await readJson(req) ?? {};
-  const patch = {};
-  if (body.provider)
-    patch.provider = body.provider;
-  if (body.model)
-    patch.model = body.model;
-  if (body.enabled !== undefined)
-    patch.enabled = Boolean(body.enabled);
-  if (body.min_importance !== undefined)
-    patch.minImportance = Number(body.min_importance);
-  if (body.auto_entity_link !== undefined)
-    patch.autoEntityLink = Boolean(body.auto_entity_link);
-  configureAutoMemory(patch);
-  return json({ updated: true, config: providerRegistry.getConfig() });
-});
-addRoute("POST", "/api/auto-memory/test", async (req) => {
-  const body = await readJson(req) ?? {};
-  const { turn, provider: providerName, agent_id, project_id } = body;
-  if (!turn)
-    return errorResponse("turn is required", 400);
-  const provider = providerName ? providerRegistry.getProvider(providerName) : providerRegistry.getAvailable();
-  if (!provider)
-    return errorResponse("No LLM provider configured. Set an API key (ANTHROPIC_API_KEY, OPENAI_API_KEY, CEREBRAS_API_KEY, or XAI_API_KEY).", 503);
-  const memories = await provider.extractMemories(turn, { agentId: agent_id, projectId: project_id });
-  return json({
-    provider: provider.name,
-    model: provider.config.model,
-    extracted: memories,
-    count: memories.length,
-    note: "DRY RUN \u2014 nothing was saved"
+  addRoute("GET", "/api/sessions/jobs", (_req, url) => {
+    const agentId = url.searchParams.get("agent_id") ?? undefined;
+    const projectId = url.searchParams.get("project_id") ?? undefined;
+    const status = url.searchParams.get("status") ?? undefined;
+    const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
+    const jobs = listSessionJobs({ agent_id: agentId, project_id: projectId, status, limit });
+    return json({ jobs, count: jobs.length });
   });
-});
-addRoute("GET", "/api/hooks", (_req, url) => {
-  const type = url.searchParams.get("type") ?? undefined;
-  const hooks = hookRegistry.list(type);
-  return json(hooks.map((h) => ({
-    id: h.id,
-    type: h.type,
-    blocking: h.blocking,
-    priority: h.priority,
-    builtin: h.builtin ?? false,
-    agentId: h.agentId,
-    projectId: h.projectId,
-    description: h.description
-  })));
-});
-addRoute("GET", "/api/hooks/stats", () => json(hookRegistry.stats()));
-addRoute("GET", "/api/webhooks", (_req, url) => {
-  const type = url.searchParams.get("type") ?? undefined;
-  const enabledParam = url.searchParams.get("enabled");
-  const enabled = enabledParam !== null ? enabledParam === "true" : undefined;
-  return json(listWebhookHooks({
-    type,
-    enabled
-  }));
-});
-addRoute("POST", "/api/webhooks", async (req) => {
-  const body = await readJson(req) ?? {};
-  if (!body.type || !body.handler_url) {
-    return errorResponse("type and handler_url are required", 400);
-  }
-  const wh = createWebhookHook({
-    type: body.type,
-    handlerUrl: body.handler_url,
-    priority: body.priority,
-    blocking: body.blocking,
-    agentId: body.agent_id,
-    projectId: body.project_id,
-    description: body.description
+  addRoute("GET", "/api/sessions/jobs/:id", (_req, _url, params) => {
+    const job = getSessionJob(params["id"]);
+    if (!job)
+      return errorResponse("Session job not found", 404);
+    return json(job);
   });
-  reloadWebhooks();
-  return json(wh, 201);
-});
-addRoute("GET", "/api/webhooks/:id", (_req, _url, params) => {
-  const wh = getWebhookHook(params["id"]);
-  if (!wh)
-    return errorResponse("Webhook not found", 404);
-  return json(wh);
-});
-addRoute("PATCH", "/api/webhooks/:id", async (req, _url, params) => {
-  const body = await readJson(req) ?? {};
-  const updated = updateWebhookHook(params["id"], {
-    enabled: body.enabled,
-    priority: body.priority,
-    description: body.description
+  addRoute("GET", "/api/sessions/queue/stats", () => json(getSessionQueueStats()));
+}
+
+// src/server/routes/system-tools.ts
+function registerSystemToolRoutes() {
+  addRoute("POST", "/api/tool-events", async (req) => {
+    const body = await readJson(req);
+    if (!body || !body["tool_name"]) {
+      return errorResponse("Missing required field: tool_name", 400);
+    }
+    const event = saveToolEvent(body);
+    return json(event, 201);
   });
-  if (!updated)
-    return errorResponse("Webhook not found", 404);
-  reloadWebhooks();
-  return json(updated);
-});
-addRoute("DELETE", "/api/webhooks/:id", (_req, _url, params) => {
-  const deleted = deleteWebhookHook(params["id"]);
-  if (!deleted)
-    return errorResponse("Webhook not found", 404);
-  return new Response(null, { status: 204 });
-});
-addRoute("POST", "/api/synthesis/run", async (req) => {
-  const body = await readJson(req) ?? {};
-  const result = await runSynthesis({
-    projectId: body.project_id,
-    agentId: body.agent_id,
-    dryRun: body.dry_run,
-    maxProposals: body.max_proposals,
-    provider: body.provider
+  addRoute("GET", "/api/tool-events", (_req, url) => {
+    const q = getSearchParams(url);
+    const filters = {};
+    if (q["tool_name"])
+      filters.tool_name = q["tool_name"];
+    if (q["agent_id"])
+      filters.agent_id = q["agent_id"];
+    if (q["project_id"])
+      filters.project_id = q["project_id"];
+    if (q["success"] !== undefined && q["success"] !== "")
+      filters.success = q["success"] === "true";
+    if (q["from_date"])
+      filters.from_date = q["from_date"];
+    if (q["to_date"])
+      filters.to_date = q["to_date"];
+    if (q["limit"])
+      filters.limit = parseInt(q["limit"], 10);
+    if (q["offset"])
+      filters.offset = parseInt(q["offset"], 10);
+    const events = getToolEvents(filters);
+    return json({ events, count: events.length });
   });
-  return json(result, result.dryRun ? 200 : 201);
-});
-addRoute("GET", "/api/synthesis/runs", (_req, url) => {
-  const projectId = url.searchParams.get("project_id") ?? undefined;
-  const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
-  const runs = listSynthesisRuns({ project_id: projectId, limit });
-  return json({ runs, count: runs.length });
-});
-addRoute("GET", "/api/synthesis/status", (_req, url) => {
-  const projectId = url.searchParams.get("project_id") ?? undefined;
-  const runId = url.searchParams.get("run_id") ?? undefined;
-  return json(getSynthesisStatus(runId, projectId));
-});
-addRoute("POST", "/api/synthesis/rollback/:run_id", async (_req, _url, params) => {
-  const result = await rollbackSynthesis(params["run_id"]);
-  return json(result);
-});
-addRoute("POST", "/api/sessions/ingest", async (req) => {
-  const body = await readJson(req) ?? {};
-  const { transcript, session_id, agent_id, project_id, source, metadata } = body;
-  if (!transcript || typeof transcript !== "string")
-    return errorResponse("transcript is required", 400);
-  if (!session_id || typeof session_id !== "string")
-    return errorResponse("session_id is required", 400);
-  let resolvedAgentId = agent_id;
-  let resolvedProjectId = project_id;
-  if (!resolvedAgentId || !resolvedProjectId) {
-    const resolved = autoResolveAgentProject(metadata ?? {});
-    if (!resolvedAgentId && resolved.agentId)
-      resolvedAgentId = resolved.agentId;
-    if (!resolvedProjectId && resolved.projectId)
-      resolvedProjectId = resolved.projectId;
-  }
-  const job = createSessionJob({
-    session_id,
-    transcript,
-    source: source ?? "manual",
-    agent_id: resolvedAgentId,
-    project_id: resolvedProjectId,
-    metadata: metadata ?? {}
+  addRoute("GET", "/api/tool-insights/:tool_name", (_req, url, params) => {
+    const q = getSearchParams(url);
+    const toolName = decodeURIComponent(params["tool_name"]);
+    const projectId = q["project_id"];
+    const lessonsLimit = q["limit"] ? parseInt(q["limit"], 10) : 20;
+    const stats = getToolStats(toolName, projectId || undefined);
+    const lessons = getToolLessons(toolName, projectId || undefined, lessonsLimit);
+    return json({ stats, lessons });
   });
-  enqueueSessionJob(job.id);
-  return json({ job_id: job.id, status: "queued", message: "Session queued for memory extraction" }, 202);
-});
-addRoute("GET", "/api/sessions/jobs", (_req, url) => {
-  const agentId = url.searchParams.get("agent_id") ?? undefined;
-  const projectId = url.searchParams.get("project_id") ?? undefined;
-  const status = url.searchParams.get("status") ?? undefined;
-  const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
-  const jobs = listSessionJobs({ agent_id: agentId, project_id: projectId, status, limit });
-  return json({ jobs, count: jobs.length });
-});
-addRoute("GET", "/api/sessions/jobs/:id", (_req, _url, params) => {
-  const job = getSessionJob(params["id"]);
-  if (!job)
-    return errorResponse("Session job not found", 404);
-  return json(job);
-});
-addRoute("GET", "/api/sessions/queue/stats", () => json(getSessionQueueStats()));
-addRoute("POST", "/api/tool-events", async (req) => {
-  const body = await readJson(req);
-  if (!body || !body["tool_name"]) {
-    return errorResponse("Missing required field: tool_name", 400);
-  }
-  const event = saveToolEvent(body);
-  return json(event, 201);
-});
-addRoute("GET", "/api/tool-events", (_req, url) => {
-  const q = getSearchParams(url);
-  const filters = {};
-  if (q["tool_name"])
-    filters.tool_name = q["tool_name"];
-  if (q["agent_id"])
-    filters.agent_id = q["agent_id"];
-  if (q["project_id"])
-    filters.project_id = q["project_id"];
-  if (q["success"] !== undefined && q["success"] !== "")
-    filters.success = q["success"] === "true";
-  if (q["from_date"])
-    filters.from_date = q["from_date"];
-  if (q["to_date"])
-    filters.to_date = q["to_date"];
-  if (q["limit"])
-    filters.limit = parseInt(q["limit"], 10);
-  if (q["offset"])
-    filters.offset = parseInt(q["offset"], 10);
-  const events = getToolEvents(filters);
-  return json({ events, count: events.length });
-});
-addRoute("GET", "/api/tool-insights/:tool_name", (_req, url, params) => {
-  const q = getSearchParams(url);
-  const toolName = decodeURIComponent(params["tool_name"]);
-  const projectId = q["project_id"];
-  const lessonsLimit = q["limit"] ? parseInt(q["limit"], 10) : 20;
-  const stats = getToolStats(toolName, projectId || undefined);
-  const lessons = getToolLessons(toolName, projectId || undefined, lessonsLimit);
-  return json({ stats, lessons });
-});
-addRoute("GET", "/api/profile/synthesize", async (_req, url) => {
-  const q = getSearchParams(url);
-  const result = await synthesizeProfile({
-    project_id: q["project_id"] || undefined,
-    agent_id: q["agent_id"] || undefined,
-    force_refresh: q["force_refresh"] === "true"
+}
+
+// src/server/routes/system-chain.ts
+init_database();
+function registerSystemChainRoutes() {
+  addRoute("GET", "/api/chains/:sequence_group", (_req, _url, params) => {
+    const db = getDatabase();
+    const sequenceGroup = decodeURIComponent(params["sequence_group"]);
+    const rows = db.query(`SELECT * FROM memories WHERE sequence_group = ? AND status = 'active' ORDER BY sequence_order ASC`).all(sequenceGroup);
+    if (rows.length === 0) {
+      return json({ chain: [], count: 0, sequence_group: sequenceGroup });
+    }
+    return json({ chain: rows, count: rows.length, sequence_group: sequenceGroup });
   });
-  if (!result) {
-    return json({ profile: null, message: "No preference/fact memories found to synthesize" });
-  }
-  return json(result);
-});
-addRoute("GET", "/api/chains/:sequence_group", (_req, _url, params) => {
-  const db = getDatabase();
-  const sequenceGroup = decodeURIComponent(params["sequence_group"]);
-  const rows = db.query(`SELECT * FROM memories WHERE sequence_group = ? AND status = 'active' ORDER BY sequence_order ASC`).all(sequenceGroup);
-  if (rows.length === 0) {
-    return json({ chain: [], count: 0, sequence_group: sequenceGroup });
-  }
-  return json({ chain: rows, count: rows.length, sequence_group: sequenceGroup });
-});
+}
+
+// src/server/routes/system.ts
+registerSystemAutoMemoryRoutes();
+registerSystemHookRoutes();
+registerSystemSynthesisRoutes();
+registerSystemSessionRoutes();
+registerSystemToolRoutes();
+registerSystemChainRoutes();
 
 // src/server/index.ts
+async function findFreePort(start) {
+  const net = await import("net");
+  return new Promise((resolve4) => {
+    const server = net.createServer();
+    server.unref();
+    server.on("error", () => {
+      resolve4(findFreePort(start + 1));
+    });
+    server.listen(start, () => {
+      const address = server.address();
+      if (address && typeof address === "object") {
+        server.close(() => resolve4(address.port));
+      } else {
+        resolve4(start);
+      }
+    });
+  });
+}
 var DEFAULT_PORT = 19428;
 function hasFlag(...flags) {
   return process.argv.some((arg) => flags.includes(arg));
@@ -17302,115 +17566,142 @@ function parsePort() {
   }
   return DEFAULT_PORT;
 }
-async function findFreePort(start) {
-  for (let port = start;port < start + 100; port++) {
-    try {
-      const server = Bun.serve({ port, fetch: () => new Response("") });
-      server.stop(true);
-      return port;
-    } catch {}
-  }
-  return start;
+var _serverInitialized = false;
+function warnIfPrimaryMachineUnset() {
+  try {
+    const warning = getPrimaryMachineStartupWarning(getDatabase());
+    if (warning) {
+      console.warn(`[mementos-serve] ${warning}`);
+    }
+  } catch {}
 }
-function startServer(port) {
+function initServer() {
+  if (_serverInitialized)
+    return;
+  _serverInitialized = true;
+  warnIfPrimaryMachineUnset();
   loadWebhooksFromDb();
   startSessionQueueWorker();
-  const hostname = process.env["MEMENTOS_HOST"] ?? "127.0.0.1";
-  Bun.serve({
-    port,
-    hostname,
-    async fetch(req) {
-      const url = new URL(req.url);
-      const { pathname } = url;
-      if (req.method === "OPTIONS") {
-        return new Response(null, { status: 204, headers: CORS_HEADERS });
-      }
-      if (pathname === "/api/health" || pathname === "/health") {
-        const profile = getActiveProfile();
-        const { createRequire: createRequire2 } = await import("module");
-        const req2 = createRequire2(import.meta.url);
-        const pkg = req2("../../package.json");
-        const db = getDatabase();
-        const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
-        const expired = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
-        const pinned = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1").get().c;
-        const agents = db.query("SELECT COUNT(*) as c FROM agents").get().c;
-        const projects = db.query("SELECT COUNT(*) as c FROM projects").get().c;
-        const status = expired > 50 ? "warn" : "ok";
-        return json({ status, version: pkg.version, profile: profile ?? "default", db_path: getDbPath(), hostname, memories: { total, expired, pinned }, agents, projects });
-      }
-      if (pathname === "/api/profile" && req.method === "GET") {
-        const profile = getActiveProfile();
-        return json({ active: profile ?? null, profiles: listProfiles(), db_path: getDbPath() });
-      }
-      if (pathname === "/api/memories/stream" && req.method === "GET") {
-        const stream = new ReadableStream({
-          start(controller) {
-            const encoder = new TextEncoder;
-            let lastSeen = new Date().toISOString();
-            const send = (data) => {
-              controller.enqueue(encoder.encode(`data: ${JSON.stringify(data)}
+}
+function startServer(port, attempt = 0) {
+  const maxRetries = 100;
+  initServer();
+  const hostname2 = process.env["MEMENTOS_HOST"] ?? "127.0.0.1";
+  try {
+    Bun.serve({
+      port,
+      hostname: hostname2,
+      async fetch(req) {
+        const url = new URL(req.url);
+        const { pathname } = url;
+        if (req.method === "OPTIONS") {
+          const origin = req.headers.get("origin");
+          const allowedOrigin = process.env["MEMENTOS_CORS_ORIGIN"] ?? "http://localhost:19428";
+          if (origin && origin !== allowedOrigin) {
+            return new Response(null, { status: 403 });
+          }
+          return new Response(null, { status: 204, headers: getCorsHeaders(req) });
+        }
+        if (pathname === "/api/health" || pathname === "/health") {
+          const profile = getActiveProfile();
+          const { createRequire: createRequire2 } = await import("module");
+          const req2 = createRequire2(import.meta.url);
+          const pkg = req2("../../package.json");
+          const db = getDatabase();
+          const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
+          const expired = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
+          const pinned = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1").get().c;
+          const agents = db.query("SELECT COUNT(*) as c FROM agents").get().c;
+          const projects = db.query("SELECT COUNT(*) as c FROM projects").get().c;
+          const status = expired > 50 ? "warn" : "ok";
+          return json({ status, version: pkg.version, profile: profile ?? "default", db_path: getDbPath(), hostname: hostname2, memories: { total, expired, pinned }, agents, projects });
+        }
+        if (pathname.startsWith("/api/") && pathname !== "/api/health") {
+          const authError = authenticateRequest(req);
+          if (authError)
+            return authError;
+        }
+        if (pathname === "/api/profile" && req.method === "GET") {
+          const profile = getActiveProfile();
+          return json({ active: profile ?? null, profiles: listProfiles(), db_path: getDbPath() });
+        }
+        if (pathname === "/api/memories/stream" && req.method === "GET") {
+          const stream = new ReadableStream({
+            start(controller) {
+              const encoder = new TextEncoder;
+              let lastSeen = new Date().toISOString();
+              const send = (data) => {
+                controller.enqueue(encoder.encode(`data: ${JSON.stringify(data)}
 
 `));
-            };
-            send({ type: "connected", timestamp: lastSeen });
-            const interval = setInterval(() => {
-              try {
-                const db = getDatabase();
-                const rows = db.query("SELECT * FROM memories WHERE updated_at > ? OR created_at > ? ORDER BY updated_at DESC LIMIT 50").all(lastSeen, lastSeen);
-                if (rows.length > 0) {
-                  lastSeen = new Date().toISOString();
-                  send({ type: "memories", data: rows, count: rows.length });
-                }
-              } catch {}
-            }, 1000);
-            req.signal.addEventListener("abort", () => {
-              clearInterval(interval);
-              controller.close();
-            });
+              };
+              send({ type: "connected", timestamp: lastSeen });
+              const interval = setInterval(() => {
+                try {
+                  const db = getDatabase();
+                  const rows = db.query("SELECT * FROM memories WHERE updated_at > ? OR created_at > ? ORDER BY updated_at DESC LIMIT 50").all(lastSeen, lastSeen);
+                  if (rows.length > 0) {
+                    lastSeen = new Date().toISOString();
+                    send({ type: "memories", data: rows, count: rows.length });
+                  }
+                } catch {}
+              }, 1000);
+              req.signal.addEventListener("abort", () => {
+                clearInterval(interval);
+                controller.close();
+              });
+            }
+          });
+          return new Response(stream, {
+            headers: {
+              "Content-Type": "text/event-stream",
+              "Cache-Control": "no-cache",
+              Connection: "keep-alive",
+              ...CORS_HEADERS
+            }
+          });
+        }
+        const matched = matchRoute(req.method, pathname);
+        if (!matched) {
+          if (pathname.startsWith("/api/")) {
+            return errorResponse("Not found", 404);
           }
-        });
-        return new Response(stream, {
-          headers: {
-            "Content-Type": "text/event-stream",
-            "Cache-Control": "no-cache",
-            Connection: "keep-alive",
-            ...CORS_HEADERS
+          const dashDir = resolveDashboardDir();
+          if (existsSync7(dashDir) && (req.method === "GET" || req.method === "HEAD")) {
+            if (pathname !== "/") {
+              const resolvedDash = resolve3(dashDir) + sep;
+              const requestedPath = resolve3(join8(dashDir, pathname));
+              if (requestedPath.startsWith(resolvedDash)) {
+                const staticRes = serveStaticFile(requestedPath);
+                if (staticRes)
+                  return staticRes;
+              }
+            }
+            const indexRes = serveStaticFile(join8(dashDir, "index.html"));
+            if (indexRes)
+              return indexRes;
           }
-        });
-      }
-      const matched = matchRoute(req.method, pathname);
-      if (!matched) {
-        if (pathname.startsWith("/api/")) {
           return errorResponse("Not found", 404);
         }
-        const dashDir = resolveDashboardDir();
-        if (existsSync7(dashDir) && (req.method === "GET" || req.method === "HEAD")) {
-          if (pathname !== "/") {
-            const resolvedDash = resolve3(dashDir) + sep;
-            const requestedPath = resolve3(join8(dashDir, pathname));
-            if (requestedPath.startsWith(resolvedDash)) {
-              const staticRes = serveStaticFile(requestedPath);
-              if (staticRes)
-                return staticRes;
-            }
-          }
-          const indexRes = serveStaticFile(join8(dashDir, "index.html"));
-          if (indexRes)
-            return indexRes;
+        try {
+          return await matched.handler(req, url, matched.params);
+        } catch (e) {
+          console.error(`[mementos-serve] ${req.method} ${pathname}:`, e);
+          return errorResponse("Internal server error", 500);
         }
-        return errorResponse("Not found", 404);
-      }
-      try {
-        return await matched.handler(req, url, matched.params);
-      } catch (e) {
-        console.error(`[mementos-serve] ${req.method} ${pathname}:`, e);
-        const message = e instanceof Error ? e.message : "Internal server error";
-        return errorResponse(message, 500);
       }
+    });
+    console.log(`Mementos server listening on http://${hostname2}:${port}`);
+  } catch (e) {
+    const err = e;
+    if (err.code === "EADDRINUSE" && attempt < maxRetries) {
+      const nextPort = port + attempt + 1;
+      console.log(`Port ${port} in use, trying ${nextPort}`);
+      startServer(nextPort, attempt + 1);
+    } else {
+      throw e;
     }
-  });
-  console.log(`Mementos server listening on http://${hostname}:${port}`);
+  }
 }
 async function main() {
   if (hasFlag("--help", "-h")) {