@hasna/mementos 0.14.17 → 0.14.19

package/dist/server/index.js

@@ -9790,6 +9790,7 @@ CREATE TABLE IF NOT EXISTS machines (
   name TEXT NOT NULL UNIQUE,
   hostname TEXT NOT NULL,
   platform TEXT NOT NULL DEFAULT 'unknown',
+  is_primary INTEGER NOT NULL DEFAULT 0,
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   last_seen_at TEXT NOT NULL DEFAULT (datetime('now'))
 );
@@ -10167,6 +10168,46 @@ ALTER TABLE memories ADD COLUMN sequence_group TEXT DEFAULT NULL;
 ALTER TABLE memories ADD COLUMN sequence_order INTEGER DEFAULT NULL;
 CREATE INDEX IF NOT EXISTS idx_memories_sequence_group ON memories(sequence_group) WHERE sequence_group IS NOT NULL;
 INSERT OR IGNORE INTO _migrations (id) VALUES (32);
+`,
+    `
+CREATE TABLE IF NOT EXISTS tasks (
+  id TEXT PRIMARY KEY,
+  subject TEXT NOT NULL,
+  description TEXT DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'in_progress', 'completed', 'failed', 'cancelled')),
+  priority TEXT NOT NULL DEFAULT 'medium' CHECK(priority IN ('critical', 'high', 'medium', 'low')),
+  tags TEXT NOT NULL DEFAULT '[]',
+  assigned_agent_id TEXT REFERENCES agents(id) ON DELETE SET NULL,
+  project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+  session_id TEXT,
+  parent_task_id TEXT REFERENCES tasks(id) ON DELETE SET NULL,
+  metadata TEXT NOT NULL DEFAULT '{}',
+  progress REAL NOT NULL DEFAULT 0 CHECK(progress >= 0 AND progress <= 1),
+  due_at TEXT,
+  started_at TEXT,
+  completed_at TEXT,
+  failed_at TEXT,
+  error TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status);
+CREATE INDEX IF NOT EXISTS idx_tasks_priority ON tasks(priority);
+CREATE INDEX IF NOT EXISTS idx_tasks_agent ON tasks(assigned_agent_id);
+CREATE INDEX IF NOT EXISTS idx_tasks_project ON tasks(project_id);
+CREATE INDEX IF NOT EXISTS idx_tasks_session ON tasks(session_id);
+CREATE INDEX IF NOT EXISTS idx_tasks_parent ON tasks(parent_task_id);
+
+CREATE TABLE IF NOT EXISTS task_comments (
+  id TEXT PRIMARY KEY,
+  task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+  agent_id TEXT REFERENCES agents(id) ON DELETE SET NULL,
+  body TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_task_comments_task ON task_comments(task_id);
+CREATE INDEX IF NOT EXISTS idx_task_comments_agent ON task_comments(agent_id);
+INSERT OR IGNORE INTO _migrations (id) VALUES (34);
 `
   ];
 });
@@ -10250,11 +10291,16 @@ function ensureDir2(filePath) {
   }
 }
 function getDatabase(dbPath) {
-  if (_db)
-    return _db;
   const path = dbPath || getDbPath3();
+  if (_db) {
+    if (_dbPath === path)
+      return _db;
+    _db.close();
+    _db = null;
+  }
+  _dbPath = path;
   ensureDir2(path);
-  _db = new SqliteAdapter(path, { create: true });
+  _db = new SqliteAdapter(path);
   _db.run("PRAGMA journal_mode = WAL");
   _db.run("PRAGMA busy_timeout = 5000");
   _db.run("PRAGMA foreign_keys = ON");
@@ -10278,13 +10324,17 @@ function runMigrations(db) {
     for (let i = currentLevel;i < MIGRATIONS.length; i++) {
       try {
         db.exec(MIGRATIONS[i]);
-      } catch {}
+      } catch (e) {
+        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
     }
   } catch {
-    for (const migration of MIGRATIONS) {
+    for (let i = 0;i < MIGRATIONS.length; i++) {
       try {
-        db.exec(migration);
-      } catch {}
+        db.exec(MIGRATIONS[i]);
+      } catch (e) {
+        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
     }
   }
 }
@@ -10307,6 +10357,9 @@ function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
 }
 function resolvePartialId(db, table, partialId) {
+  if (!ALLOWED_TABLES.has(table)) {
+    throw new Error(`Invalid table name: ${table}`);
+  }
   if (partialId.length >= 36) {
     const row = db.query(`SELECT id FROM ${table} WHERE id = ?`).get(partialId);
     return row?.id ?? null;
@@ -10317,10 +10370,25 @@ function resolvePartialId(db, table, partialId) {
   }
   return null;
 }
-var _db = null;
+var _db = null, _dbPath = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
   init_dist();
   init_migrations();
+  ALLOWED_TABLES = new Set([
+    "memories",
+    "agents",
+    "entities",
+    "projects",
+    "relations",
+    "memory_audit_log",
+    "locks",
+    "sessions",
+    "session_memory_jobs",
+    "synthesis_runs",
+    "synthesis_proposals",
+    "tool_events",
+    "webhook_hooks"
+  ]);
 });
 
 // src/lib/hooks.ts
@@ -10830,7 +10898,7 @@ function createMemory(input, dedupeMode = "merge", db) {
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', 0, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 1, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.key,
-    input.value,
+    safeValue,
     input.category || "knowledge",
     input.scope || "private",
     input.summary || null,
@@ -10993,6 +11061,22 @@ function listMemories(filter, db) {
       conditions.push("session_id = ?");
       params.push(filter.session_id);
     }
+    if ("machine_id" in filter) {
+      if (filter.machine_id === null) {
+        conditions.push("machine_id IS NULL");
+      } else if (filter.machine_id) {
+        conditions.push("machine_id = ?");
+        params.push(filter.machine_id);
+      }
+    }
+    if ("visible_to_machine_id" in filter) {
+      if (filter.visible_to_machine_id === null) {
+        conditions.push("machine_id IS NULL");
+      } else if (filter.visible_to_machine_id !== undefined) {
+        conditions.push("(machine_id IS NULL OR machine_id = ?)");
+        params.push(filter.visible_to_machine_id);
+      }
+    }
     if (filter.min_importance) {
       conditions.push("importance >= ?");
       params.push(filter.min_importance);
@@ -11721,6 +11805,10 @@ function buildFilterConditions(filter) {
       params.push(tag);
     }
   }
+  if (filter.namespace) {
+    conditions.push("m.namespace = ?");
+    params.push(filter.namespace);
+  }
   return { conditions, params };
 }
 function searchWithFts5(d, query, queryLower, filter, graphBoostedIds) {
@@ -13355,12 +13443,14 @@ async function synthesizeProfile(options) {
   const prefMemories = listMemories({
     category: "preference",
     project_id: options.project_id,
+    machine_id: null,
     status: "active",
     limit: 30
   });
   const factMemories = listMemories({
     category: "fact",
     project_id: options.project_id,
+    machine_id: null,
     status: "active",
     limit: 30
   });
@@ -13671,6 +13761,69 @@ function ensureDir(dir) {
 // src/server/index.ts
 init_database();
 
+// src/db/machines.ts
+init_database();
+import { hostname, platform as platform2 } from "os";
+function parseMachine(row) {
+  if (!row)
+    return null;
+  return {
+    ...row,
+    is_primary: Boolean(row.is_primary)
+  };
+}
+function normalizeHostname(host) {
+  return host.replace(/\.(local|lan|home|internal)$/i, "");
+}
+function registerMachine(name, db = getDatabase()) {
+  const rawHost = hostname();
+  const host = normalizeHostname(rawHost);
+  const plat = platform2();
+  const machineName = name?.trim() || host;
+  const existing = parseMachine(db.query("SELECT * FROM machines WHERE hostname = ?").get(host));
+  if (existing) {
+    db.run("UPDATE machines SET last_seen_at = ? WHERE id = ?", [now(), existing.id]);
+    return parseMachine(db.query("SELECT * FROM machines WHERE id = ?").get(existing.id));
+  }
+  let finalName = machineName;
+  let suffix = 2;
+  while (db.query("SELECT id FROM machines WHERE name = ?").get(finalName)) {
+    finalName = `${machineName}-${suffix++}`;
+  }
+  const id = uuid();
+  db.run("INSERT INTO machines (id, name, hostname, platform) VALUES (?, ?, ?, ?)", [id, finalName, host, plat]);
+  return parseMachine(db.query("SELECT * FROM machines WHERE id = ?").get(id));
+}
+function getPrimaryMachine(db = getDatabase()) {
+  return parseMachine(db.query("SELECT * FROM machines WHERE is_primary = 1 LIMIT 1").get());
+}
+function getPrimaryMachineCandidate(db = getDatabase()) {
+  if (getPrimaryMachine(db))
+    return null;
+  return parseMachine(db.query("SELECT * FROM machines ORDER BY created_at ASC, id ASC LIMIT 1").get());
+}
+function getPrimaryMachineStartupWarning(db = getDatabase()) {
+  if (getPrimaryMachine(db))
+    return null;
+  const candidate = getPrimaryMachineCandidate(db);
+  if (!candidate) {
+    return "No primary machine configured. Fallback sync target is unset because no machines are registered yet.";
+  }
+  return `No primary machine configured. Fallback sync target is unset. Candidate: ${candidate.name} (${candidate.id.slice(0, 8)} / ${candidate.hostname}). Confirm it with set_primary_machine.`;
+}
+function touchMachine(id, db = getDatabase()) {
+  db.run("UPDATE machines SET last_seen_at = ? WHERE id = ?", [now(), id]);
+}
+function getCurrentMachineId(db = getDatabase()) {
+  const host = normalizeHostname(hostname());
+  const m = db.query("SELECT id FROM machines WHERE hostname = ?").get(host);
+  if (m) {
+    touchMachine(m.id, db);
+    return m.id;
+  }
+  return registerMachine(undefined, db).id;
+}
+
 // src/lib/built-in-hooks.ts
 init_hooks();
 
@@ -14708,8 +14861,377 @@ async function _processNext() {
   }
 }
 
+// src/lib/task-runner.ts
+init_database();
+
+// src/db/tasks.ts
+init_database();
+function parseTask(row) {
+  return {
+    id: row.id,
+    subject: row.subject,
+    description: row.description ?? "",
+    status: row.status,
+    priority: row.priority,
+    tags: JSON.parse(row.tags ?? "[]"),
+    assigned_agent_id: row.assigned_agent_id ?? null,
+    project_id: row.project_id ?? null,
+    session_id: row.session_id ?? null,
+    parent_task_id: row.parent_task_id ?? null,
+    metadata: JSON.parse(row.metadata ?? "{}"),
+    progress: row.progress,
+    due_at: row.due_at ?? null,
+    started_at: row.started_at ?? null,
+    completed_at: row.completed_at ?? null,
+    failed_at: row.failed_at ?? null,
+    error: row.error ?? null,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+function createTask(db, input) {
+  const id = uuid();
+  const ts = now();
+  db.run(`INSERT INTO tasks (id, subject, description, status, priority, tags, assigned_agent_id, project_id, session_id, parent_task_id, metadata, due_at, created_at, updated_at)
+     VALUES (?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+    id,
+    input.subject,
+    input.description ?? "",
+    input.priority ?? "medium",
+    JSON.stringify(input.tags ?? []),
+    input.assigned_agent_id ?? null,
+    input.project_id ?? null,
+    input.session_id ?? null,
+    input.parent_task_id ?? null,
+    JSON.stringify(input.metadata ?? {}),
+    input.due_at ?? null,
+    ts,
+    ts
+  ]);
+  const row = db.query("SELECT * FROM tasks WHERE id = ?").get(id);
+  return parseTask(row);
+}
+function getTask(db, id) {
+  const row = db.query("SELECT * FROM tasks WHERE id = ?").get(id);
+  return row ? parseTask(row) : null;
+}
+function listTasks(db, filter) {
+  let sql = "SELECT * FROM tasks WHERE 1=1";
+  let countSql = "SELECT COUNT(*) as c FROM tasks WHERE 1=1";
+  const params = [];
+  const countParams = [];
+  if (filter?.status) {
+    sql += " AND status = ?";
+    countSql += " AND status = ?";
+    params.push(filter.status);
+    countParams.push(filter.status);
+  }
+  if (filter?.priority) {
+    sql += " AND priority = ?";
+    countSql += " AND priority = ?";
+    params.push(filter.priority);
+    countParams.push(filter.priority);
+  }
+  if (filter?.assigned_agent_id) {
+    sql += " AND assigned_agent_id = ?";
+    countSql += " AND assigned_agent_id = ?";
+    params.push(filter.assigned_agent_id);
+    countParams.push(filter.assigned_agent_id);
+  }
+  if (filter?.project_id) {
+    sql += " AND project_id = ?";
+    countSql += " AND project_id = ?";
+    params.push(filter.project_id);
+    countParams.push(filter.project_id);
+  }
+  if (filter?.session_id) {
+    sql += " AND session_id = ?";
+    countSql += " AND session_id = ?";
+    params.push(filter.session_id);
+    countParams.push(filter.session_id);
+  }
+  if (filter?.parent_task_id !== undefined) {
+    if (filter.parent_task_id === null) {
+      sql += " AND parent_task_id IS NULL";
+      countSql += " AND parent_task_id IS NULL";
+    } else {
+      sql += " AND parent_task_id = ?";
+      countSql += " AND parent_task_id = ?";
+      params.push(filter.parent_task_id);
+      countParams.push(filter.parent_task_id);
+    }
+  }
+  if (filter?.tags?.length) {
+    const placeholders = filter.tags.map(() => "?").join(", ");
+    sql += ` AND EXISTS (SELECT 1 FROM json_each(tags) WHERE value IN (${placeholders}))`;
+    countSql += ` AND EXISTS (SELECT 1 FROM json_each(tags) WHERE value IN (${placeholders}))`;
+    params.push(...filter.tags);
+    countParams.push(...filter.tags);
+  }
+  sql += " ORDER BY CASE priority WHEN 'critical' THEN 1 WHEN 'high' THEN 2 WHEN 'medium' THEN 3 WHEN 'low' THEN 4 END, created_at ASC";
+  if (filter?.limit !== undefined) {
+    sql += " LIMIT ?";
+    params.push(filter.limit);
+  }
+  if (filter?.offset !== undefined) {
+    sql += " OFFSET ?";
+    params.push(filter.offset);
+  }
+  const rows = db.query(sql).all(...params);
+  const countRow = db.query(countSql).get(...countParams);
+  return { tasks: rows.map(parseTask), count: countRow.c };
+}
+function updateTask(db, id, input) {
+  const existing = getTask(db, id);
+  if (!existing)
+    return null;
+  const updates = [];
+  const params = [];
+  const ts = now();
+  if (input.subject !== undefined) {
+    updates.push("subject = ?");
+    params.push(input.subject);
+  }
+  if (input.description !== undefined) {
+    updates.push("description = ?");
+    params.push(input.description);
+  }
+  if (input.status !== undefined) {
+    updates.push("status = ?");
+    params.push(input.status);
+    if (input.status === "in_progress" && !existing.started_at) {
+      updates.push("started_at = ?");
+      params.push(ts);
+    }
+    if (input.status === "completed") {
+      updates.push("completed_at = ?");
+      params.push(ts);
+      updates.push("progress = ?");
+      params.push(1);
+    }
+    if (input.status === "failed") {
+      updates.push("failed_at = ?");
+      params.push(ts);
+    }
+  }
+  if (input.priority !== undefined) {
+    updates.push("priority = ?");
+    params.push(input.priority);
+  }
+  if (input.tags !== undefined) {
+    updates.push("tags = ?");
+    params.push(JSON.stringify(input.tags));
+  }
+  if (input.assigned_agent_id !== undefined) {
+    updates.push("assigned_agent_id = ?");
+    params.push(input.assigned_agent_id);
+  }
+  if (input.metadata !== undefined) {
+    updates.push("metadata = ?");
+    params.push(JSON.stringify(input.metadata));
+  }
+  if (input.progress !== undefined) {
+    updates.push("progress = ?");
+    params.push(input.progress);
+  }
+  if (input.due_at !== undefined) {
+    updates.push("due_at = ?");
+    params.push(input.due_at);
+  }
+  if (input.error !== undefined) {
+    updates.push("error = ?");
+    params.push(input.error);
+  }
+  if (updates.length === 0)
+    return existing;
+  updates.push("updated_at = ?");
+  params.push(ts);
+  params.push(id);
+  db.run(`UPDATE tasks SET ${updates.join(", ")} WHERE id = ?`, ...params);
+  return getTask(db, id);
+}
+function deleteTask(db, id) {
+  const result = db.run("DELETE FROM tasks WHERE id = ?", id);
+  return result.changes > 0;
+}
+function addTaskComment(db, taskId, body, agentId) {
+  const id = uuid();
+  db.run("INSERT INTO task_comments (id, task_id, agent_id, body) VALUES (?, ?, ?, ?)", [id, taskId, agentId ?? null, body]);
+  const row = db.query("SELECT * FROM task_comments WHERE id = ?").get(id);
+  return parseTaskComment(row);
+}
+function parseTaskComment(row) {
+  return {
+    id: row.id,
+    task_id: row.task_id,
+    agent_id: row.agent_id ?? null,
+    body: row.body,
+    created_at: row.created_at
+  };
+}
+function listTaskComments(db, taskId) {
+  const rows = db.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at ASC").all(taskId);
+  return { comments: rows.map(parseTaskComment), count: rows.length };
+}
+function deleteTaskComment(db, id) {
+  const result = db.run("DELETE FROM task_comments WHERE id = ?", id);
+  return result.changes > 0;
+}
+function getTaskStats(db, filter) {
+  let where = "WHERE 1=1";
+  const params = [];
+  if (filter?.project_id) {
+    where += " AND project_id = ?";
+    params.push(filter.project_id);
+  }
+  if (filter?.agent_id) {
+    where += " AND assigned_agent_id = ?";
+    params.push(filter.agent_id);
+  }
+  const total = db.query(`SELECT COUNT(*) as c FROM tasks ${where}`).get(...params).c;
+  const byStatus = {};
+  const statusRows = db.query(`SELECT status, COUNT(*) as c FROM tasks ${where} GROUP BY status`).all(...params);
+  for (const row of statusRows)
+    byStatus[row.status] = row.c;
+  const byPriority = {};
+  const priorityRows = db.query(`SELECT priority, COUNT(*) as c FROM tasks ${where} GROUP BY priority`).all(...params);
+  for (const row of priorityRows)
+    byPriority[row.priority] = row.c;
+  const overdue = db.query(`SELECT COUNT(*) as c FROM tasks ${where} AND status != 'completed' AND status != 'cancelled' AND due_at IS NOT NULL AND due_at < datetime('now')`).get(...params).c;
+  return {
+    total,
+    by_status: {
+      pending: byStatus["pending"] ?? 0,
+      in_progress: byStatus["in_progress"] ?? 0,
+      completed: byStatus["completed"] ?? 0,
+      failed: byStatus["failed"] ?? 0,
+      cancelled: byStatus["cancelled"] ?? 0
+    },
+    by_priority: {
+      critical: byPriority["critical"] ?? 0,
+      high: byPriority["high"] ?? 0,
+      medium: byPriority["medium"] ?? 0,
+      low: byPriority["low"] ?? 0
+    },
+    overdue
+  };
+}
+
+// src/lib/task-runner.ts
+var _handlers = new Map;
+var _defaultHandler = null;
+function resolveHandler(task) {
+  for (const tag of task.tags) {
+    const h = _handlers.get(tag);
+    if (h)
+      return h;
+  }
+  const metaType = task.metadata?.["type"];
+  if (metaType) {
+    const h = _handlers.get(metaType);
+    if (h)
+      return h;
+  }
+  return _defaultHandler;
+}
+var _workerStarted2 = false;
+var _processing = false;
+var _totalProcessed = 0;
+var _pollIntervalMs = 60000;
+function startTaskRunner(intervalMs) {
+  if (_workerStarted2)
+    return;
+  _workerStarted2 = true;
+  if (intervalMs)
+    _pollIntervalMs = intervalMs;
+  console.log(`[task-runner] Started, polling every ${_pollIntervalMs / 1000}s`);
+  _tick();
+  setInterval(() => {
+    _tick();
+  }, _pollIntervalMs);
+}
+async function _tick() {
+  if (_processing)
+    return;
+  let task = null;
+  try {
+    const db = getDatabase();
+    const result = listTasks(db, { status: "pending", limit: 1 });
+    if (result.tasks.length === 0)
+      return;
+    task = result.tasks[0] ?? null;
+  } catch (e) {
+    console.error("[task-runner] Failed to list pending tasks:", e);
+    return;
+  }
+  if (!task)
+    return;
+  _processing = true;
+  try {
+    const db = getDatabase();
+    updateTask(db, task.id, { status: "in_progress" });
+    task = getTask(db, task.id);
+  } catch (e) {
+    console.error("[task-runner] Failed to claim task:", e);
+    _processing = false;
+    return;
+  }
+  const handler = resolveHandler(task);
+  if (!handler) {
+    console.warn(`[task-runner] No handler for task: ${task.subject} (tags: ${JSON.stringify(task.tags)}, meta.type: ${task.metadata?.["type"]})`);
+    try {
+      const db = getDatabase();
+      updateTask(db, task.id, {
+        status: "failed",
+        error: "No handler registered for this task type"
+      });
+    } catch {}
+    _processing = false;
+    _totalProcessed++;
+    return;
+  }
+  const taskId = task.id;
+  let progress = 0;
+  const ctx = {
+    task,
+    updateProgress: (p) => {
+      progress = Math.min(1, Math.max(0, p));
+      try {
+        const db = getDatabase();
+        updateTask(db, taskId, { progress });
+      } catch {}
+    },
+    addComment: (body, agentId) => {
+      try {
+        const db = getDatabase();
+        addTaskComment(db, taskId, body, agentId);
+      } catch {}
+    }
+  };
+  try {
+    await handler(ctx);
+    const db = getDatabase();
+    updateTask(db, taskId, { status: "completed", progress: 1 });
+    console.log(`[task-runner] Completed: ${task.subject}`);
+  } catch (e) {
+    const errorMsg = e instanceof Error ? e.message : String(e);
+    try {
+      const db = getDatabase();
+      updateTask(db, taskId, { status: "failed", error: errorMsg });
+    } catch {}
+    console.error(`[task-runner] Failed: ${task.subject} \u2014 ${errorMsg}`);
+  } finally {
+    _processing = false;
+    _totalProcessed++;
+  }
+}
+
 // src/server/router.ts
 var routes = [];
+var nextRouteOrder = 0;
+function computeSpecificity(path) {
+  return path.split("/").filter(Boolean).reduce((score, segment) => score + (segment.startsWith(":") ? 1 : 10), 0);
+}
 function addRoute(method, path, handler) {
   const paramNames = [];
   const patternStr = path.replace(/:(\w+)/g, (_match, name) => {
@@ -14718,12 +15240,16 @@ function addRoute(method, path, handler) {
   });
   routes.push({
     method,
+    path,
     pattern: new RegExp(`^${patternStr}$`),
     paramNames,
+    specificity: computeSpecificity(path),
+    order: nextRouteOrder++,
     handler
   });
 }
 function matchRoute(method, pathname) {
+  let bestMatch = null;
   for (const route of routes) {
     if (route.method !== method)
       continue;
@@ -14733,10 +15259,14 @@ function matchRoute(method, pathname) {
       route.paramNames.forEach((name, i) => {
         params[name] = match[i + 1];
       });
-      return { handler: route.handler, params };
+      if (!bestMatch || route.specificity > bestMatch.route.specificity || route.specificity === bestMatch.route.specificity && route.order < bestMatch.route.order) {
+        bestMatch = { route, params };
+      }
     }
   }
-  return null;
+  if (!bestMatch)
+    return null;
+  return { handler: bestMatch.route.handler, params: bestMatch.params };
 }
 
 // src/server/helpers.ts
@@ -14744,7 +15274,7 @@ import { existsSync as existsSync6 } from "fs";
 import { dirname as dirname4, extname, join as join7 } from "path";
 import { fileURLToPath } from "url";
 var CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Origin": process.env["MEMENTOS_CORS_ORIGIN"] ?? "http://localhost:19428",
   "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
   "Access-Control-Allow-Headers": "Content-Type, Authorization",
   "Access-Control-Max-Age": "86400"
@@ -14772,13 +15302,49 @@ function errorResponse(message, status, details) {
     body["details"] = details;
   return json(body, status);
 }
+var MAX_BODY_BYTES = 1 * 1024 * 1024;
 async function readJson(req) {
   try {
+    const contentLength = req.headers.get("content-length");
+    if (contentLength && Number(contentLength) > MAX_BODY_BYTES) {
+      throw Object.assign(new Error("Payload too large"), { status: 413 });
+    }
     return await req.json();
   } catch {
     return null;
   }
 }
+function getCorsHeaders(req) {
+  const allowedOrigin = process.env["MEMENTOS_CORS_ORIGIN"] ?? "http://localhost:19428";
+  const origin = req?.headers.get("origin");
+  const finalOrigin = origin === allowedOrigin ? origin : allowedOrigin;
+  return {
+    "Access-Control-Allow-Origin": finalOrigin,
+    "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Max-Age": "86400"
+  };
+}
+function authenticateRequest(req) {
+  const requiredKey = process.env["MEMENTOS_API_KEY"];
+  if (!requiredKey)
+    return null;
+  const authHeader = req.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return new Response(JSON.stringify({ error: "Unauthorized. Provide a Bearer token in the Authorization header." }), {
+      status: 401,
+      headers: { "Content-Type": "application/json", ...getCorsHeaders(req) }
+    });
+  }
+  const provided = authHeader.slice("Bearer ".length);
+  if (provided !== requiredKey) {
+    return new Response(JSON.stringify({ error: "Forbidden. Invalid API key." }), {
+      status: 403,
+      headers: { "Content-Type": "application/json", ...getCorsHeaders(req) }
+    });
+  }
+  return null;
+}
 function getSearchParams(url) {
   const params = {};
   url.searchParams.forEach((v, k) => {
@@ -14814,11 +15380,8 @@ function serveStaticFile(filePath) {
   });
 }
 
-// src/server/routes/memories.ts
+// src/server/routes/memories-crud.ts
 init_memories();
-init_database();
-init_search();
-init_types2();
 
 // src/lib/duration.ts
 var UNIT_MS = {
@@ -14863,10 +15426,8 @@ var FORMAT_UNITS = [
   ["s", UNIT_MS["s"]]
 ];
 
-// src/server/routes/memories.ts
-addRoute("GET", "/api/health", () => {
-  return json({ ok: true, version: "1", db: getDbPath() });
-});
+// src/server/routes/memories-crud.ts
+init_types2();
 addRoute("GET", "/api/memories", (_req, url) => {
   const q = getSearchParams(url);
   const filter = {};
@@ -14886,6 +15447,8 @@ addRoute("GET", "/api/memories", (_req, url) => {
     filter.project_id = q["project_id"];
   if (q["session_id"])
     filter.session_id = q["session_id"];
+  if (q["namespace"])
+    filter.namespace = q["namespace"];
   if (q["status"])
     filter.status = q["status"];
   if (q["limit"])
@@ -14900,40 +15463,114 @@ addRoute("GET", "/api/memories", (_req, url) => {
   }
   return json({ memories, count: memories.length });
 });
-addRoute("GET", "/api/memories/stats", (_req) => {
-  const db = getDatabase();
-  const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
-  const byScope = db.query("SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY scope").all();
-  const byCategory = db.query("SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY category").all();
-  const byStatus = db.query("SELECT status, COUNT(*) as c FROM memories GROUP BY status").all();
-  const pinnedCount = db.query("SELECT COUNT(*) as c FROM memories WHERE pinned = 1 AND status = 'active'").get().c;
-  const expiredCount = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
-  const stats = {
-    total,
-    by_scope: { global: 0, shared: 0, private: 0, working: 0 },
-    by_category: { preference: 0, fact: 0, knowledge: 0, history: 0, procedural: 0, resource: 0 },
-    by_status: { active: 0, archived: 0, expired: 0 },
-    by_agent: {},
-    pinned_count: pinnedCount,
-    expired_count: expiredCount
-  };
-  for (const row of byScope)
-    stats.by_scope[row.scope] = row.c;
-  for (const row of byCategory)
-    stats.by_category[row.category] = row.c;
-  for (const row of byStatus) {
-    if (row.status in stats.by_status) {
-      stats.by_status[row.status] = row.c;
+addRoute("POST", "/api/memories", async (req) => {
+  const body = await readJson(req);
+  if (!body) {
+    return errorResponse("Invalid JSON body", 400);
+  }
+  if (!body["key"] || !body["value"]) {
+    return errorResponse("Missing required fields: key, value", 400);
+  }
+  try {
+    if (body["ttl_ms"] !== undefined && typeof body["ttl_ms"] === "string") {
+      body["ttl_ms"] = parseDuration(body["ttl_ms"]);
+    }
+    const memory = createMemory(body);
+    return json(memory, 201);
+  } catch (e) {
+    if (e instanceof DuplicateMemoryError) {
+      return errorResponse(e.message, 409);
     }
+    throw e;
   }
-  const byAgent = db.query("SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL GROUP BY agent_id").all();
-  for (const row of byAgent)
-    stats.by_agent[row.agent_id] = row.c;
-  return json(stats);
 });
-addRoute("GET", "/api/metrics", (_req) => {
-  const db = getDatabase();
-  const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
+addRoute("GET", "/api/memories/:id", (_req, _url, params) => {
+  const memory = getMemory(params["id"]);
+  if (!memory) {
+    return errorResponse("Memory not found", 404);
+  }
+  touchMemory(memory.id);
+  return json(memory);
+});
+addRoute("PATCH", "/api/memories/:id", async (req, _url, params) => {
+  const body = await readJson(req);
+  if (!body) {
+    return errorResponse("Invalid JSON body", 400);
+  }
+  const updateBody = { ...body };
+  if (updateBody["version"] === undefined) {
+    const existing = getMemory(params["id"]);
+    if (!existing)
+      return errorResponse("Memory not found", 404);
+    updateBody["version"] = existing.version;
+  }
+  try {
+    const memory = updateMemory(params["id"], updateBody);
+    return json(memory);
+  } catch (e) {
+    if (e instanceof MemoryNotFoundError) {
+      return errorResponse(e.message, 404);
+    }
+    if (e instanceof VersionConflictError) {
+      return errorResponse(e.message, 409, {
+        expected: e.expected,
+        actual: e.actual
+      });
+    }
+    throw e;
+  }
+});
+addRoute("GET", "/api/memories/:id/versions", (_req, _url, params) => {
+  const memory = getMemory(params["id"]);
+  if (!memory)
+    return errorResponse("Memory not found", 404);
+  const versions = getMemoryVersions(memory.id);
+  return json({ versions, count: versions.length, current_version: memory.version });
+});
+addRoute("DELETE", "/api/memories/:id", (_req, _url, params) => {
+  const deleted = deleteMemory(params["id"]);
+  if (!deleted) {
+    return errorResponse("Memory not found", 404);
+  }
+  return json({ deleted: true });
+});
+
+// src/server/routes/memories-stats.ts
+init_database();
+addRoute("GET", "/api/memories/stats", (_req) => {
+  const db = getDatabase();
+  const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
+  const byScope = db.query("SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY scope").all();
+  const byCategory = db.query("SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY category").all();
+  const byStatus = db.query("SELECT status, COUNT(*) as c FROM memories GROUP BY status").all();
+  const pinnedCount = db.query("SELECT COUNT(*) as c FROM memories WHERE pinned = 1 AND status = 'active'").get().c;
+  const expiredCount = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
+  const stats = {
+    total,
+    by_scope: { global: 0, shared: 0, private: 0, working: 0 },
+    by_category: { preference: 0, fact: 0, knowledge: 0, history: 0, procedural: 0, resource: 0 },
+    by_status: { active: 0, archived: 0, expired: 0 },
+    by_agent: {},
+    pinned_count: pinnedCount,
+    expired_count: expiredCount
+  };
+  for (const row of byScope)
+    stats.by_scope[row.scope] = row.c;
+  for (const row of byCategory)
+    stats.by_category[row.category] = row.c;
+  for (const row of byStatus) {
+    if (row.status in stats.by_status) {
+      stats.by_status[row.status] = row.c;
+    }
+  }
+  const byAgent = db.query("SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL GROUP BY agent_id").all();
+  for (const row of byAgent)
+    stats.by_agent[row.agent_id] = row.c;
+  return json(stats);
+});
+addRoute("GET", "/api/metrics", (_req) => {
+  const db = getDatabase();
+  const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
   const byScope = db.query("SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY scope").all();
   const byCategory = db.query("SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY category").all();
   const last7 = db.query("SELECT COUNT(*) as c FROM memories WHERE created_at >= datetime('now', '-7 days')").get().c;
@@ -14975,6 +15612,8 @@ addRoute("GET", "/api/activity", (_req, url) => {
     params.push(projectId);
   }
   const where = conditions.map((c) => `AND ${c}`).join(" ");
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
+  params.push(cutoffDate);
   const rows = db.query(`
     SELECT
       date(created_at) AS date,
@@ -14984,7 +15623,7 @@ addRoute("GET", "/api/activity", (_req, url) => {
       SUM(CASE WHEN scope = 'private' THEN 1 ELSE 0 END) AS private_count,
       AVG(importance) AS avg_importance
     FROM memories
-    WHERE date(created_at) >= date('now', '-${days} days') ${where}
+    WHERE date(created_at) >= ? ${where}
     GROUP BY date(created_at)
     ORDER BY date ASC
   `).all(...params);
@@ -14997,12 +15636,13 @@ addRoute("GET", "/api/memories/stale", (_req, url) => {
   const agentId = q["agent_id"];
   const limit = Math.min(parseInt(q["limit"] || "20", 10), 100);
   const db = getDatabase();
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString();
   const conds = [
     "status = 'active'",
-    `(accessed_at IS NULL OR accessed_at < datetime('now', '-${days} days'))`,
+    "(accessed_at IS NULL OR accessed_at < ?)",
     "pinned = 0"
   ];
-  const params = [];
+  const params = [cutoffDate];
   if (projectId) {
     conds.push("project_id = ?");
     params.push(projectId);
@@ -15020,23 +15660,28 @@ addRoute("GET", "/api/report", (_req, url) => {
   const projectId = q["project_id"];
   const agentId = q["agent_id"];
   const db = getDatabase();
-  const cond = [
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
+  const scopedCond = [
     projectId ? "AND project_id = ?" : "",
     agentId ? "AND agent_id = ?" : ""
   ].filter(Boolean).join(" ");
-  const params = [...projectId ? [projectId] : [], ...agentId ? [agentId] : []];
-  const total = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' ${cond}`).get(...params).c;
-  const pinned = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1 ${cond}`).get(...params).c;
+  const scopedParams = [
+    ...projectId ? [projectId] : [],
+    ...agentId ? [agentId] : []
+  ];
+  const recentParams = [cutoffDate, ...scopedParams];
+  const total = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond}`).get(...scopedParams).c;
+  const pinned = db.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1 ${scopedCond}`).get(...scopedParams).c;
   const actRows = db.query(`
     SELECT date(created_at) AS date, COUNT(*) AS memories_created
-    FROM memories WHERE status = 'active' AND date(created_at) >= date('now', '-${days} days') ${cond}
+    FROM memories WHERE status = 'active' AND date(created_at) >= ? ${scopedCond}
     GROUP BY date(created_at) ORDER BY date(created_at) ASC
-  `).all(...params);
+  `).all(...recentParams);
   const recentTotal = actRows.reduce((s, r) => s + r.memories_created, 0);
-  const byScopeRows = db.query(`SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' ${cond} GROUP BY scope`).all(...params);
-  const byCatRows = db.query(`SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' ${cond} GROUP BY category`).all(...params);
-  const topMems = db.query(`SELECT id, key, value, importance, scope, category FROM memories WHERE status = 'active' ${cond} ORDER BY importance DESC, access_count DESC LIMIT 5`).all(...params);
-  const topAgents = db.query(`SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL ${cond} GROUP BY agent_id ORDER BY c DESC LIMIT 5`).all(...params);
+  const byScopeRows = db.query(`SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY scope`).all(...scopedParams);
+  const byCatRows = db.query(`SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY category`).all(...scopedParams);
+  const topMems = db.query(`SELECT id, key, value, importance, scope, category FROM memories WHERE status = 'active' ${scopedCond} ORDER BY importance DESC, access_count DESC LIMIT 5`).all(...scopedParams);
+  const topAgents = db.query(`SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL ${scopedCond} GROUP BY agent_id ORDER BY c DESC LIMIT 5`).all(...scopedParams);
   return json({
     total,
     pinned,
@@ -15048,6 +15693,9 @@ addRoute("GET", "/api/report", (_req, url) => {
     top_agents: topAgents
   });
 });
+
+// src/server/routes/memories-search.ts
+init_search();
 addRoute("POST", "/api/memories/search", async (req) => {
   const body = await readJson(req);
   if (!body || typeof body["query"] !== "string") {
@@ -15060,6 +15708,10 @@ addRoute("POST", "/api/memories/search", async (req) => {
     filter.category = body["category"];
   if (body["tags"])
     filter.tags = body["tags"];
+  if (body["session_id"])
+    filter.session_id = body["session_id"];
+  if (body["namespace"])
+    filter.namespace = body["namespace"];
   if (body["limit"])
     filter.limit = body["limit"];
   const results = searchMemories(body["query"], filter);
@@ -15081,6 +15733,10 @@ addRoute("POST", "/api/memories/search/hybrid", async (req) => {
     filter.agent_id = body["agent_id"];
   if (body["project_id"])
     filter.project_id = body["project_id"];
+  if (body["session_id"])
+    filter.session_id = body["session_id"];
+  if (body["namespace"])
+    filter.namespace = body["namespace"];
   const results = await hybridSearch(body["query"], {
     filter,
     semantic_threshold: body["semantic_threshold"] ?? undefined,
@@ -15104,11 +15760,60 @@ addRoute("POST", "/api/memories/search/bm25", async (req) => {
     filter.agent_id = body["agent_id"];
   if (body["project_id"])
     filter.project_id = body["project_id"];
+  if (body["session_id"])
+    filter.session_id = body["session_id"];
+  if (body["namespace"])
+    filter.namespace = body["namespace"];
   if (body["limit"])
     filter.limit = body["limit"];
   const results = searchWithBm25(body["query"], filter);
   return json({ results, count: results.length });
 });
+
+// src/server/routes/memories-bulk.ts
+init_memories();
+addRoute("POST", "/api/memories/bulk-forget", async (req) => {
+  const body = await readJson(req);
+  if (!body || !Array.isArray(body["ids"])) {
+    return errorResponse("Missing required field: ids (array)", 400);
+  }
+  const ids = body["ids"];
+  let deleted = 0;
+  for (const id of ids) {
+    try {
+      if (deleteMemory(id))
+        deleted++;
+    } catch {}
+  }
+  return json({ deleted, total: ids.length });
+});
+addRoute("POST", "/api/memories/bulk-update", async (req) => {
+  const body = await readJson(req);
+  if (!body || !Array.isArray(body["ids"])) {
+    return errorResponse("Missing required fields: ids (array)", 400);
+  }
+  const ids = body["ids"];
+  const { ids: _ids, ...fields } = body;
+  let updated = 0;
+  const errors = [];
+  for (const id of ids) {
+    try {
+      const memory = getMemory(id);
+      if (memory) {
+        updateMemory(id, { ...fields, version: memory.version });
+        updated++;
+      } else {
+        errors.push(`Memory not found: ${id}`);
+      }
+    } catch (e) {
+      errors.push(`Failed ${id}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  return json({ updated, errors, total: ids.length });
+});
+
+// src/server/routes/memories-io.ts
+init_memories();
 addRoute("POST", "/api/memories/export", async (req) => {
   const body = await readJson(req) || {};
   const filter = {};
@@ -15149,49 +15854,35 @@ addRoute("POST", "/api/memories/import", async (req) => {
   }
   return json({ imported, errors, total: memoriesArr.length }, 201);
 });
-addRoute("POST", "/api/memories/bulk-forget", async (req) => {
-  const body = await readJson(req);
-  if (!body || !Array.isArray(body["ids"])) {
-    return errorResponse("Missing required field: ids (array)", 400);
-  }
-  const ids = body["ids"];
-  let deleted = 0;
-  for (const id of ids) {
-    try {
-      if (deleteMemory(id))
-        deleted++;
-    } catch {}
-  }
-  return json({ deleted, total: ids.length });
-});
-addRoute("POST", "/api/memories/bulk-update", async (req) => {
-  const body = await readJson(req);
-  if (!body || !Array.isArray(body["ids"])) {
-    return errorResponse("Missing required fields: ids (array)", 400);
+
+// src/server/routes/memories-misc.ts
+init_memories();
+
+// src/lib/machine-visibility.ts
+function resolveVisibleMachineId(machineId, db) {
+  if (machineId !== undefined) {
+    return machineId;
   }
-  const ids = body["ids"];
-  const { ids: _ids, ...fields } = body;
-  let updated = 0;
-  const errors = [];
-  for (const id of ids) {
-    try {
-      const memory = getMemory(id);
-      if (memory) {
-        updateMemory(id, { ...fields, version: memory.version });
-        updated++;
-      } else {
-        errors.push(`Memory not found: ${id}`);
-      }
-    } catch (e) {
-      errors.push(`Failed ${id}: ${e instanceof Error ? e.message : String(e)}`);
-    }
+  try {
+    return getCurrentMachineId(db);
+  } catch {
+    return null;
   }
-  return json({ updated, errors, total: ids.length });
+}
+function visibleToMachineFilter(machineId, db) {
+  return {
+    visible_to_machine_id: resolveVisibleMachineId(machineId, db)
+  };
+}
+
+// src/server/routes/memories-misc.ts
+addRoute("GET", "/api/health", () => {
+  return json({ ok: true, version: "1", db: getDbPath() });
 });
 addRoute("POST", "/api/memories/extract", async (req) => {
   const body = await readJson(req);
   if (!body)
-    return errorResponse("Invalid JSON body", 400);
+    return json({ error: "Invalid JSON body" }, 400);
   const sessionId = body["session_id"];
   const agentId = body["agent_id"];
   const projectId = body["project_id"];
@@ -15259,77 +15950,6 @@ addRoute("POST", "/api/memories/clean", () => {
   const cleaned = cleanExpiredMemories();
   return json({ cleaned });
 });
-addRoute("POST", "/api/memories", async (req) => {
-  const body = await readJson(req);
-  if (!body) {
-    return errorResponse("Invalid JSON body", 400);
-  }
-  if (!body["key"] || !body["value"]) {
-    return errorResponse("Missing required fields: key, value", 400);
-  }
-  try {
-    if (body["ttl_ms"] !== undefined && typeof body["ttl_ms"] === "string") {
-      body["ttl_ms"] = parseDuration(body["ttl_ms"]);
-    }
-    const memory = createMemory(body);
-    return json(memory, 201);
-  } catch (e) {
-    if (e instanceof DuplicateMemoryError) {
-      return errorResponse(e.message, 409);
-    }
-    throw e;
-  }
-});
-addRoute("GET", "/api/memories/:id", (_req, _url, params) => {
-  const memory = getMemory(params["id"]);
-  if (!memory) {
-    return errorResponse("Memory not found", 404);
-  }
-  touchMemory(memory.id);
-  return json(memory);
-});
-addRoute("PATCH", "/api/memories/:id", async (req, _url, params) => {
-  const body = await readJson(req);
-  if (!body) {
-    return errorResponse("Invalid JSON body", 400);
-  }
-  const updateBody = { ...body };
-  if (updateBody["version"] === undefined) {
-    const existing = getMemory(params["id"]);
-    if (!existing)
-      return errorResponse("Memory not found", 404);
-    updateBody["version"] = existing.version;
-  }
-  try {
-    const memory = updateMemory(params["id"], updateBody);
-    return json(memory);
-  } catch (e) {
-    if (e instanceof MemoryNotFoundError) {
-      return errorResponse(e.message, 404);
-    }
-    if (e instanceof VersionConflictError) {
-      return errorResponse(e.message, 409, {
-        expected: e.expected,
-        actual: e.actual
-      });
-    }
-    throw e;
-  }
-});
-addRoute("GET", "/api/memories/:id/versions", (_req, _url, params) => {
-  const memory = getMemory(params["id"]);
-  if (!memory)
-    return errorResponse("Memory not found", 404);
-  const versions = getMemoryVersions(memory.id);
-  return json({ versions, count: versions.length, current_version: memory.version });
-});
-addRoute("DELETE", "/api/memories/:id", (_req, _url, params) => {
-  const deleted = deleteMemory(params["id"]);
-  if (!deleted) {
-    return errorResponse("Memory not found", 404);
-  }
-  return json({ deleted: true });
-});
 addRoute("GET", "/api/inject", (_req, url) => {
   const q = getSearchParams(url);
   const maxTokens = q["max_tokens"] ? parseInt(q["max_tokens"], 10) : 500;
@@ -15339,6 +15959,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
     "fact",
     "knowledge"
   ];
+  const visibleMachineId = resolveVisibleMachineId(q["machine_id"]);
   const allMemories = [];
   const globalMems = listMemories({
     scope: "global",
@@ -15346,6 +15967,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
     min_importance: minImportance,
     status: "active",
     project_id: q["project_id"],
+    ...visibleToMachineFilter(visibleMachineId),
     limit: 50
   });
   allMemories.push(...globalMems);
@@ -15356,6 +15978,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
       min_importance: minImportance,
       status: "active",
       project_id: q["project_id"],
+      ...visibleToMachineFilter(visibleMachineId),
       limit: 50
     });
     allMemories.push(...sharedMems);
@@ -15367,6 +15990,7 @@ addRoute("GET", "/api/inject", (_req, url) => {
       min_importance: minImportance,
       status: "active",
       agent_id: q["agent_id"],
+      ...visibleToMachineFilter(visibleMachineId),
       limit: 50
     });
     allMemories.push(...privateMems);
@@ -16028,10 +16652,212 @@ addRoute("GET", "/api/graph/:entityId", (_req, url, params) => {
   }
 });
 
-// src/server/routes/system.ts
+// src/server/routes/tasks.ts
+init_database();
+addRoute("POST", "/api/tasks", async (req, _url) => {
+  const body = await readJson(req);
+  if (!body)
+    return errorResponse("Invalid JSON body", 400);
+  if (!body.subject)
+    return errorResponse("subject is required", 400);
+  const task = createTask(getDatabase(), body);
+  return json(task, 201);
+});
+addRoute("GET", "/api/tasks", async (_req, url) => {
+  const q = getSearchParams(url);
+  const filter = {};
+  for (const key of ["status", "priority", "assigned_agent_id", "project_id", "session_id", "parent_task_id"]) {
+    if (q[key])
+      filter[key] = q[key];
+  }
+  if (q["tags"])
+    filter.tags = q["tags"].split(",");
+  if (q["limit"])
+    filter.limit = parseInt(q["limit"]);
+  if (q["offset"])
+    filter.offset = parseInt(q["offset"]);
+  return json(listTasks(getDatabase(), filter));
+});
+addRoute("GET", "/api/tasks/stats", async (_req, url) => {
+  const q = getSearchParams(url);
+  const filter = {};
+  if (q["project_id"])
+    filter.project_id = q["project_id"];
+  if (q["agent_id"])
+    filter.agent_id = q["agent_id"];
+  return json(getTaskStats(getDatabase(), filter));
+});
+addRoute("GET", "/api/tasks/:id", async (_req, _url, params) => {
+  const task = getTask(getDatabase(), params.id);
+  if (!task)
+    return errorResponse("Task not found", 404);
+  return json(task);
+});
+addRoute("PATCH", "/api/tasks/:id", async (req, _url, params) => {
+  const body = await readJson(req);
+  if (!body)
+    return errorResponse("Invalid JSON body", 400);
+  const task = updateTask(getDatabase(), params.id, body);
+  if (!task)
+    return errorResponse("Task not found", 404);
+  return json(task);
+});
+addRoute("DELETE", "/api/tasks/:id", async (_req, _url, params) => {
+  const deleted = deleteTask(getDatabase(), params.id);
+  if (!deleted)
+    return errorResponse("Task not found", 404);
+  return json({ deleted: true });
+});
+addRoute("GET", "/api/tasks/:id/comments", async (_req, _url, params) => {
+  return json(listTaskComments(getDatabase(), params.id));
+});
+addRoute("POST", "/api/tasks/:id/comments", async (req, _url, params) => {
+  const body = await readJson(req);
+  if (!body)
+    return errorResponse("Invalid JSON body", 400);
+  if (!body.body)
+    return errorResponse("body is required", 400);
+  const comment = addTaskComment(getDatabase(), params.id, body.body, body.agent_id);
+  return json(comment, 201);
+});
+addRoute("DELETE", "/api/tasks/:id/comments/:commentId", async (_req, _url, params) => {
+  const deleted = deleteTaskComment(getDatabase(), params.commentId);
+  if (!deleted)
+    return errorResponse("Comment not found", 404);
+  return json({ deleted: true });
+});
+
+// src/server/routes/system-auto-memory.ts
 init_auto_memory();
 init_registry();
+function registerSystemAutoMemoryRoutes() {
+  addRoute("POST", "/api/auto-memory/process", async (req) => {
+    const body = await readJson(req);
+    const turn = body?.turn;
+    if (!turn)
+      return errorResponse("turn is required", 400);
+    processConversationTurn(turn, { agentId: body?.agent_id, projectId: body?.project_id, sessionId: body?.session_id });
+    const stats = getAutoMemoryStats();
+    return json({ queued: true, queue: stats }, 202);
+  });
+  addRoute("GET", "/api/auto-memory/status", () => {
+    return json({
+      queue: getAutoMemoryStats(),
+      config: providerRegistry.getConfig(),
+      providers: providerRegistry.health()
+    });
+  });
+  addRoute("GET", "/api/auto-memory/config", () => {
+    return json(providerRegistry.getConfig());
+  });
+  addRoute("PATCH", "/api/auto-memory/config", async (req) => {
+    const body = await readJson(req) ?? {};
+    const patch = {};
+    if (body.provider)
+      patch.provider = body.provider;
+    if (body.model)
+      patch.model = body.model;
+    if (body.enabled !== undefined)
+      patch.enabled = Boolean(body.enabled);
+    if (body.min_importance !== undefined)
+      patch.minImportance = Number(body.min_importance);
+    if (body.auto_entity_link !== undefined)
+      patch.autoEntityLink = Boolean(body.auto_entity_link);
+    configureAutoMemory(patch);
+    return json({ updated: true, config: providerRegistry.getConfig() });
+  });
+  addRoute("POST", "/api/auto-memory/test", async (req) => {
+    const body = await readJson(req) ?? {};
+    const { turn, provider: providerName, agent_id, project_id } = body;
+    if (!turn)
+      return errorResponse("turn is required", 400);
+    const provider = providerName ? providerRegistry.getProvider(providerName) : providerRegistry.getAvailable();
+    if (!provider)
+      return errorResponse("No LLM provider configured. Set an API key (ANTHROPIC_API_KEY, OPENAI_API_KEY, CEREBRAS_API_KEY, or XAI_API_KEY).", 503);
+    try {
+      const memories = await provider.extractMemories(turn, { agentId: agent_id, projectId: project_id });
+      return json({
+        provider: provider.name,
+        model: provider.config.model,
+        extracted: memories,
+        count: memories.length,
+        note: "DRY RUN \u2014 nothing was saved"
+      });
+    } catch (e) {
+      return json({ error: e instanceof Error ? e.message : String(e) }, 500);
+    }
+  });
+}
+
+// src/server/routes/system-hooks.ts
 init_hooks();
+function registerSystemHookRoutes() {
+  addRoute("GET", "/api/hooks", (_req, url) => {
+    const type = url.searchParams.get("type") ?? undefined;
+    const hooks = hookRegistry.list(type);
+    return json(hooks.map((h) => ({
+      id: h.id,
+      type: h.type,
+      blocking: h.blocking,
+      priority: h.priority,
+      builtin: h.builtin ?? false,
+      agentId: h.agentId,
+      projectId: h.projectId,
+      description: h.description
+    })));
+  });
+  addRoute("GET", "/api/hooks/stats", () => json(hookRegistry.stats()));
+  addRoute("GET", "/api/webhooks", (_req, url) => {
+    const type = url.searchParams.get("type") ?? undefined;
+    const enabledParam = url.searchParams.get("enabled");
+    const enabled = enabledParam !== null ? enabledParam === "true" : undefined;
+    return json(listWebhookHooks({
+      type,
+      enabled
+    }));
+  });
+  addRoute("POST", "/api/webhooks", async (req) => {
+    const body = await readJson(req) ?? {};
+    if (!body.type || !body.handler_url) {
+      return errorResponse("type and handler_url are required", 400);
+    }
+    const wh = createWebhookHook({
+      type: body.type,
+      handlerUrl: body.handler_url,
+      priority: body.priority,
+      blocking: body.blocking,
+      agentId: body.agent_id,
+      projectId: body.project_id,
+      description: body.description
+    });
+    reloadWebhooks();
+    return json(wh, 201);
+  });
+  addRoute("GET", "/api/webhooks/:id", (_req, _url, params) => {
+    const wh = getWebhookHook(params["id"]);
+    if (!wh)
+      return errorResponse("Webhook not found", 404);
+    return json(wh);
+  });
+  addRoute("PATCH", "/api/webhooks/:id", async (req, _url, params) => {
+    const body = await readJson(req) ?? {};
+    const updated = updateWebhookHook(params["id"], {
+      enabled: body.enabled,
+      priority: body.priority,
+      description: body.description
+    });
+    if (!updated)
+      return errorResponse("Webhook not found", 404);
+    reloadWebhooks();
+    return json(updated);
+  });
+  addRoute("DELETE", "/api/webhooks/:id", (_req, _url, params) => {
+    const deleted = deleteWebhookHook(params["id"]);
+    if (!deleted)
+      return errorResponse("Webhook not found", 404);
+    return new Response(null, { status: 204 });
+  });
+}
 
 // src/lib/synthesis/index.ts
 init_database();
@@ -16935,9 +17761,61 @@ function getSynthesisStatus(runId, projectId, db) {
   };
 }
 
-// src/server/routes/system.ts
+// src/server/routes/system-synthesis.ts
 init_synthesis();
 init_profile_synthesizer();
+function registerSystemSynthesisRoutes() {
+  addRoute("POST", "/api/synthesis/run", async (req) => {
+    const body = await readJson(req) ?? {};
+    try {
+      const result = await runSynthesis({
+        projectId: body.project_id,
+        agentId: body.agent_id,
+        dryRun: body.dry_run,
+        maxProposals: body.max_proposals,
+        provider: body.provider
+      });
+      return json(result, result.dryRun ? 200 : 201);
+    } catch (e) {
+      return json({ error: e instanceof Error ? e.message : String(e) }, 500);
+    }
+  });
+  addRoute("GET", "/api/synthesis/runs", (_req, url) => {
+    const projectId = url.searchParams.get("project_id") ?? undefined;
+    const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
+    const runs = listSynthesisRuns({ project_id: projectId, limit });
+    return json({ runs, count: runs.length });
+  });
+  addRoute("GET", "/api/synthesis/status", (_req, url) => {
+    const projectId = url.searchParams.get("project_id") ?? undefined;
+    const runId = url.searchParams.get("run_id") ?? undefined;
+    return json(getSynthesisStatus(runId, projectId));
+  });
+  addRoute("POST", "/api/synthesis/rollback/:run_id", async (_req, _url, params) => {
+    try {
+      const result = await rollbackSynthesis(params["run_id"]);
+      return json(result);
+    } catch (e) {
+      return json({ error: e instanceof Error ? e.message : String(e) }, 500);
+    }
+  });
+  addRoute("GET", "/api/profile/synthesize", async (_req, url) => {
+    const q = getSearchParams(url);
+    try {
+      const result = await synthesizeProfile({
+        project_id: q["project_id"] || undefined,
+        agent_id: q["agent_id"] || undefined,
+        force_refresh: q["force_refresh"] === "true"
+      });
+      if (!result) {
+        return json({ profile: null, message: "No preference/fact memories found to synthesize" });
+      }
+      return json(result);
+    } catch (e) {
+      return json({ error: e instanceof Error ? e.message : String(e) }, 500);
+    }
+  });
+}
 
 // src/lib/session-auto-resolve.ts
 function autoResolveAgentProject(metadata, db) {
@@ -17006,255 +17884,136 @@ function autoResolveAgentProject(metadata, db) {
   };
 }
 
-// src/server/routes/system.ts
-init_database();
-addRoute("POST", "/api/auto-memory/process", async (req) => {
-  const body = await readJson(req);
-  const turn = body?.turn;
-  if (!turn)
-    return errorResponse("turn is required", 400);
-  processConversationTurn(turn, { agentId: body?.agent_id, projectId: body?.project_id, sessionId: body?.session_id });
-  const stats = getAutoMemoryStats();
-  return json({ queued: true, queue: stats }, 202);
-});
-addRoute("GET", "/api/auto-memory/status", () => {
-  return json({
-    queue: getAutoMemoryStats(),
-    config: providerRegistry.getConfig(),
-    providers: providerRegistry.health()
+// src/server/routes/system-sessions.ts
+function registerSystemSessionRoutes() {
+  addRoute("POST", "/api/sessions/ingest", async (req) => {
+    const body = await readJson(req) ?? {};
+    const { transcript, session_id, agent_id, project_id, source, metadata } = body;
+    if (!transcript || typeof transcript !== "string")
+      return errorResponse("transcript is required", 400);
+    if (!session_id || typeof session_id !== "string")
+      return errorResponse("session_id is required", 400);
+    let resolvedAgentId = agent_id;
+    let resolvedProjectId = project_id;
+    if (!resolvedAgentId || !resolvedProjectId) {
+      const resolved = autoResolveAgentProject(metadata ?? {});
+      if (!resolvedAgentId && resolved.agentId)
+        resolvedAgentId = resolved.agentId;
+      if (!resolvedProjectId && resolved.projectId)
+        resolvedProjectId = resolved.projectId;
+    }
+    const job = createSessionJob({
+      session_id,
+      transcript,
+      source: source ?? "manual",
+      agent_id: resolvedAgentId,
+      project_id: resolvedProjectId,
+      metadata: metadata ?? {}
+    });
+    enqueueSessionJob(job.id);
+    return json({ job_id: job.id, status: "queued", message: "Session queued for memory extraction" }, 202);
   });
-});
-addRoute("GET", "/api/auto-memory/config", () => {
-  return json(providerRegistry.getConfig());
-});
-addRoute("PATCH", "/api/auto-memory/config", async (req) => {
-  const body = await readJson(req) ?? {};
-  const patch = {};
-  if (body.provider)
-    patch.provider = body.provider;
-  if (body.model)
-    patch.model = body.model;
-  if (body.enabled !== undefined)
-    patch.enabled = Boolean(body.enabled);
-  if (body.min_importance !== undefined)
-    patch.minImportance = Number(body.min_importance);
-  if (body.auto_entity_link !== undefined)
-    patch.autoEntityLink = Boolean(body.auto_entity_link);
-  configureAutoMemory(patch);
-  return json({ updated: true, config: providerRegistry.getConfig() });
-});
-addRoute("POST", "/api/auto-memory/test", async (req) => {
-  const body = await readJson(req) ?? {};
-  const { turn, provider: providerName, agent_id, project_id } = body;
-  if (!turn)
-    return errorResponse("turn is required", 400);
-  const provider = providerName ? providerRegistry.getProvider(providerName) : providerRegistry.getAvailable();
-  if (!provider)
-    return errorResponse("No LLM provider configured. Set an API key (ANTHROPIC_API_KEY, OPENAI_API_KEY, CEREBRAS_API_KEY, or XAI_API_KEY).", 503);
-  const memories = await provider.extractMemories(turn, { agentId: agent_id, projectId: project_id });
-  return json({
-    provider: provider.name,
-    model: provider.config.model,
-    extracted: memories,
-    count: memories.length,
-    note: "DRY RUN \u2014 nothing was saved"
+  addRoute("GET", "/api/sessions/jobs", (_req, url) => {
+    const agentId = url.searchParams.get("agent_id") ?? undefined;
+    const projectId = url.searchParams.get("project_id") ?? undefined;
+    const status = url.searchParams.get("status") ?? undefined;
+    const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
+    const jobs = listSessionJobs({ agent_id: agentId, project_id: projectId, status, limit });
+    return json({ jobs, count: jobs.length });
   });
-});
-addRoute("GET", "/api/hooks", (_req, url) => {
-  const type = url.searchParams.get("type") ?? undefined;
-  const hooks = hookRegistry.list(type);
-  return json(hooks.map((h) => ({
-    id: h.id,
-    type: h.type,
-    blocking: h.blocking,
-    priority: h.priority,
-    builtin: h.builtin ?? false,
-    agentId: h.agentId,
-    projectId: h.projectId,
-    description: h.description
-  })));
-});
-addRoute("GET", "/api/hooks/stats", () => json(hookRegistry.stats()));
-addRoute("GET", "/api/webhooks", (_req, url) => {
-  const type = url.searchParams.get("type") ?? undefined;
-  const enabledParam = url.searchParams.get("enabled");
-  const enabled = enabledParam !== null ? enabledParam === "true" : undefined;
-  return json(listWebhookHooks({
-    type,
-    enabled
-  }));
-});
-addRoute("POST", "/api/webhooks", async (req) => {
-  const body = await readJson(req) ?? {};
-  if (!body.type || !body.handler_url) {
-    return errorResponse("type and handler_url are required", 400);
-  }
-  const wh = createWebhookHook({
-    type: body.type,
-    handlerUrl: body.handler_url,
-    priority: body.priority,
-    blocking: body.blocking,
-    agentId: body.agent_id,
-    projectId: body.project_id,
-    description: body.description
+  addRoute("GET", "/api/sessions/jobs/:id", (_req, _url, params) => {
+    const job = getSessionJob(params["id"]);
+    if (!job)
+      return errorResponse("Session job not found", 404);
+    return json(job);
   });
-  reloadWebhooks();
-  return json(wh, 201);
-});
-addRoute("GET", "/api/webhooks/:id", (_req, _url, params) => {
-  const wh = getWebhookHook(params["id"]);
-  if (!wh)
-    return errorResponse("Webhook not found", 404);
-  return json(wh);
-});
-addRoute("PATCH", "/api/webhooks/:id", async (req, _url, params) => {
-  const body = await readJson(req) ?? {};
-  const updated = updateWebhookHook(params["id"], {
-    enabled: body.enabled,
-    priority: body.priority,
-    description: body.description
+  addRoute("GET", "/api/sessions/queue/stats", () => json(getSessionQueueStats()));
+}
+
+// src/server/routes/system-tools.ts
+function registerSystemToolRoutes() {
+  addRoute("POST", "/api/tool-events", async (req) => {
+    const body = await readJson(req);
+    if (!body || !body["tool_name"]) {
+      return errorResponse("Missing required field: tool_name", 400);
+    }
+    const event = saveToolEvent(body);
+    return json(event, 201);
   });
-  if (!updated)
-    return errorResponse("Webhook not found", 404);
-  reloadWebhooks();
-  return json(updated);
-});
-addRoute("DELETE", "/api/webhooks/:id", (_req, _url, params) => {
-  const deleted = deleteWebhookHook(params["id"]);
-  if (!deleted)
-    return errorResponse("Webhook not found", 404);
-  return new Response(null, { status: 204 });
-});
-addRoute("POST", "/api/synthesis/run", async (req) => {
-  const body = await readJson(req) ?? {};
-  const result = await runSynthesis({
-    projectId: body.project_id,
-    agentId: body.agent_id,
-    dryRun: body.dry_run,
-    maxProposals: body.max_proposals,
-    provider: body.provider
+  addRoute("GET", "/api/tool-events", (_req, url) => {
+    const q = getSearchParams(url);
+    const filters = {};
+    if (q["tool_name"])
+      filters.tool_name = q["tool_name"];
+    if (q["agent_id"])
+      filters.agent_id = q["agent_id"];
+    if (q["project_id"])
+      filters.project_id = q["project_id"];
+    if (q["success"] !== undefined && q["success"] !== "")
+      filters.success = q["success"] === "true";
+    if (q["from_date"])
+      filters.from_date = q["from_date"];
+    if (q["to_date"])
+      filters.to_date = q["to_date"];
+    if (q["limit"])
+      filters.limit = parseInt(q["limit"], 10);
+    if (q["offset"])
+      filters.offset = parseInt(q["offset"], 10);
+    const events = getToolEvents(filters);
+    return json({ events, count: events.length });
   });
-  return json(result, result.dryRun ? 200 : 201);
-});
-addRoute("GET", "/api/synthesis/runs", (_req, url) => {
-  const projectId = url.searchParams.get("project_id") ?? undefined;
-  const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
-  const runs = listSynthesisRuns({ project_id: projectId, limit });
-  return json({ runs, count: runs.length });
-});
-addRoute("GET", "/api/synthesis/status", (_req, url) => {
-  const projectId = url.searchParams.get("project_id") ?? undefined;
-  const runId = url.searchParams.get("run_id") ?? undefined;
-  return json(getSynthesisStatus(runId, projectId));
-});
-addRoute("POST", "/api/synthesis/rollback/:run_id", async (_req, _url, params) => {
-  const result = await rollbackSynthesis(params["run_id"]);
-  return json(result);
-});
-addRoute("POST", "/api/sessions/ingest", async (req) => {
-  const body = await readJson(req) ?? {};
-  const { transcript, session_id, agent_id, project_id, source, metadata } = body;
-  if (!transcript || typeof transcript !== "string")
-    return errorResponse("transcript is required", 400);
-  if (!session_id || typeof session_id !== "string")
-    return errorResponse("session_id is required", 400);
-  let resolvedAgentId = agent_id;
-  let resolvedProjectId = project_id;
-  if (!resolvedAgentId || !resolvedProjectId) {
-    const resolved = autoResolveAgentProject(metadata ?? {});
-    if (!resolvedAgentId && resolved.agentId)
-      resolvedAgentId = resolved.agentId;
-    if (!resolvedProjectId && resolved.projectId)
-      resolvedProjectId = resolved.projectId;
-  }
-  const job = createSessionJob({
-    session_id,
-    transcript,
-    source: source ?? "manual",
-    agent_id: resolvedAgentId,
-    project_id: resolvedProjectId,
-    metadata: metadata ?? {}
+  addRoute("GET", "/api/tool-insights/:tool_name", (_req, url, params) => {
+    const q = getSearchParams(url);
+    const toolName = decodeURIComponent(params["tool_name"]);
+    const projectId = q["project_id"];
+    const lessonsLimit = q["limit"] ? parseInt(q["limit"], 10) : 20;
+    const stats = getToolStats(toolName, projectId || undefined);
+    const lessons = getToolLessons(toolName, projectId || undefined, lessonsLimit);
+    return json({ stats, lessons });
   });
-  enqueueSessionJob(job.id);
-  return json({ job_id: job.id, status: "queued", message: "Session queued for memory extraction" }, 202);
-});
-addRoute("GET", "/api/sessions/jobs", (_req, url) => {
-  const agentId = url.searchParams.get("agent_id") ?? undefined;
-  const projectId = url.searchParams.get("project_id") ?? undefined;
-  const status = url.searchParams.get("status") ?? undefined;
-  const limit = url.searchParams.get("limit") ? parseInt(url.searchParams.get("limit")) : 20;
-  const jobs = listSessionJobs({ agent_id: agentId, project_id: projectId, status, limit });
-  return json({ jobs, count: jobs.length });
-});
-addRoute("GET", "/api/sessions/jobs/:id", (_req, _url, params) => {
-  const job = getSessionJob(params["id"]);
-  if (!job)
-    return errorResponse("Session job not found", 404);
-  return json(job);
-});
-addRoute("GET", "/api/sessions/queue/stats", () => json(getSessionQueueStats()));
-addRoute("POST", "/api/tool-events", async (req) => {
-  const body = await readJson(req);
-  if (!body || !body["tool_name"]) {
-    return errorResponse("Missing required field: tool_name", 400);
-  }
-  const event = saveToolEvent(body);
-  return json(event, 201);
-});
-addRoute("GET", "/api/tool-events", (_req, url) => {
-  const q = getSearchParams(url);
-  const filters = {};
-  if (q["tool_name"])
-    filters.tool_name = q["tool_name"];
-  if (q["agent_id"])
-    filters.agent_id = q["agent_id"];
-  if (q["project_id"])
-    filters.project_id = q["project_id"];
-  if (q["success"] !== undefined && q["success"] !== "")
-    filters.success = q["success"] === "true";
-  if (q["from_date"])
-    filters.from_date = q["from_date"];
-  if (q["to_date"])
-    filters.to_date = q["to_date"];
-  if (q["limit"])
-    filters.limit = parseInt(q["limit"], 10);
-  if (q["offset"])
-    filters.offset = parseInt(q["offset"], 10);
-  const events = getToolEvents(filters);
-  return json({ events, count: events.length });
-});
-addRoute("GET", "/api/tool-insights/:tool_name", (_req, url, params) => {
-  const q = getSearchParams(url);
-  const toolName = decodeURIComponent(params["tool_name"]);
-  const projectId = q["project_id"];
-  const lessonsLimit = q["limit"] ? parseInt(q["limit"], 10) : 20;
-  const stats = getToolStats(toolName, projectId || undefined);
-  const lessons = getToolLessons(toolName, projectId || undefined, lessonsLimit);
-  return json({ stats, lessons });
-});
-addRoute("GET", "/api/profile/synthesize", async (_req, url) => {
-  const q = getSearchParams(url);
-  const result = await synthesizeProfile({
-    project_id: q["project_id"] || undefined,
-    agent_id: q["agent_id"] || undefined,
-    force_refresh: q["force_refresh"] === "true"
+}
+
+// src/server/routes/system-chain.ts
+init_database();
+function registerSystemChainRoutes() {
+  addRoute("GET", "/api/chains/:sequence_group", (_req, _url, params) => {
+    const db = getDatabase();
+    const sequenceGroup = decodeURIComponent(params["sequence_group"]);
+    const rows = db.query(`SELECT * FROM memories WHERE sequence_group = ? AND status = 'active' ORDER BY sequence_order ASC`).all(sequenceGroup);
+    if (rows.length === 0) {
+      return json({ chain: [], count: 0, sequence_group: sequenceGroup });
+    }
+    return json({ chain: rows, count: rows.length, sequence_group: sequenceGroup });
   });
-  if (!result) {
-    return json({ profile: null, message: "No preference/fact memories found to synthesize" });
-  }
-  return json(result);
-});
-addRoute("GET", "/api/chains/:sequence_group", (_req, _url, params) => {
-  const db = getDatabase();
-  const sequenceGroup = decodeURIComponent(params["sequence_group"]);
-  const rows = db.query(`SELECT * FROM memories WHERE sequence_group = ? AND status = 'active' ORDER BY sequence_order ASC`).all(sequenceGroup);
-  if (rows.length === 0) {
-    return json({ chain: [], count: 0, sequence_group: sequenceGroup });
-  }
-  return json({ chain: rows, count: rows.length, sequence_group: sequenceGroup });
-});
+}
+
+// src/server/routes/system.ts
+registerSystemAutoMemoryRoutes();
+registerSystemHookRoutes();
+registerSystemSynthesisRoutes();
+registerSystemSessionRoutes();
+registerSystemToolRoutes();
+registerSystemChainRoutes();
 
 // src/server/index.ts
+async function findFreePort(start) {
+  const net = await import("net");
+  return new Promise((resolve4) => {
+    const server = net.createServer();
+    server.unref();
+    server.on("error", () => {
+      resolve4(findFreePort(start + 1));
+    });
+    server.listen(start, () => {
+      const address = server.address();
+      if (address && typeof address === "object") {
+        server.close(() => resolve4(address.port));
+      } else {
+        resolve4(start);
+      }
+    });
+  });
+}
 var DEFAULT_PORT = 19428;
 function hasFlag(...flags) {
   return process.argv.some((arg) => flags.includes(arg));
@@ -17302,28 +18061,41 @@ function parsePort() {
   }
   return DEFAULT_PORT;
 }
-async function findFreePort(start) {
-  for (let port = start;port < start + 100; port++) {
-    try {
-      const server = Bun.serve({ port, fetch: () => new Response("") });
-      server.stop(true);
-      return port;
-    } catch {}
-  }
-  return start;
+var _serverInitialized = false;
+function warnIfPrimaryMachineUnset() {
+  try {
+    const warning = getPrimaryMachineStartupWarning(getDatabase());
+    if (warning) {
+      console.warn(`[mementos-serve] ${warning}`);
+    }
+  } catch {}
 }
-function startServer(port) {
+function initServer() {
+  if (_serverInitialized)
+    return;
+  _serverInitialized = true;
+  warnIfPrimaryMachineUnset();
   loadWebhooksFromDb();
   startSessionQueueWorker();
-  const hostname = process.env["MEMENTOS_HOST"] ?? "127.0.0.1";
+  startTaskRunner();
+}
+function startServer(port) {
+  initServer();
+  const hostname2 = process.env["MEMENTOS_HOST"] ?? "127.0.0.1";
   Bun.serve({
     port,
-    hostname,
+    hostname: hostname2,
+    maxRequestBodySize: 1048576,
     async fetch(req) {
       const url = new URL(req.url);
       const { pathname } = url;
       if (req.method === "OPTIONS") {
-        return new Response(null, { status: 204, headers: CORS_HEADERS });
+        const origin = req.headers.get("origin");
+        const allowedOrigin = process.env["MEMENTOS_CORS_ORIGIN"] ?? "http://localhost:19428";
+        if (origin && origin !== allowedOrigin) {
+          return new Response(null, { status: 403 });
+        }
+        return new Response(null, { status: 204, headers: getCorsHeaders(req) });
       }
       if (pathname === "/api/health" || pathname === "/health") {
         const profile = getActiveProfile();
@@ -17337,7 +18109,12 @@ function startServer(port) {
         const agents = db.query("SELECT COUNT(*) as c FROM agents").get().c;
         const projects = db.query("SELECT COUNT(*) as c FROM projects").get().c;
         const status = expired > 50 ? "warn" : "ok";
-        return json({ status, version: pkg.version, profile: profile ?? "default", db_path: getDbPath(), hostname, memories: { total, expired, pinned }, agents, projects });
+        return json({ status, version: pkg.version, profile: profile ?? "default", db_path: getDbPath(), hostname: hostname2, memories: { total, expired, pinned }, agents, projects });
+      }
+      if (pathname.startsWith("/api/") && pathname !== "/api/health") {
+        const authError = authenticateRequest(req);
+        if (authError)
+          return authError;
       }
       if (pathname === "/api/profile" && req.method === "GET") {
         const profile = getActiveProfile();
@@ -17405,12 +18182,11 @@ function startServer(port) {
         return await matched.handler(req, url, matched.params);
       } catch (e) {
         console.error(`[mementos-serve] ${req.method} ${pathname}:`, e);
-        const message = e instanceof Error ? e.message : "Internal server error";
-        return errorResponse(message, 500);
+        return errorResponse("Internal server error", 500);
       }
     }
   });
-  console.log(`Mementos server listening on http://${hostname}:${port}`);
+  console.log(`Mementos server listening on http://${hostname2}:${port}`);
 }
 async function main() {
   if (hasFlag("--help", "-h")) {