@inetafrica/open-claudia 2.14.8 → 3.0.0

package/web.js

@@ -4,12 +4,16 @@ const path = require("path");
 const crypto = require("crypto");
 const https = require("https");
 const CONFIG_DIR = require("./config-dir");
+const { ensureConfigDir } = require("./core/config-dir");
+const { atomicWriteFileSync } = require("./core/fsutil");
 const Vault = require("./vault");
 const {
   loadUsageHistory,
   usageAlertPolicy,
   usageTrend,
 } = require("./core/usage-log");
+const webSessions = require("./core/web-sessions");
+const { inspectProviderConfiguration } = require("./core/provider-status");
 
 const ENV_FILE = path.join(CONFIG_DIR, ".env");
 const AUTH_FILE = path.join(CONFIG_DIR, "auth.json");
@@ -28,7 +32,7 @@ function getPassword() {
   }
   // Use env-provided password (from K8s secret) or generate random
   const initial = process.env.WEB_PASSWORD || crypto.randomBytes(16).toString("hex");
-  fs.writeFileSync(WEB_PASSWORD_FILE, initial);
+  atomicWriteFileSync(WEB_PASSWORD_FILE, initial, { mode: 0o600 });
   if (!process.env.WEB_PASSWORD) {
     console.log(`\n  Web UI initial password: ${initial}`);
     console.log(`  Change it in Settings after first login.\n`);
@@ -56,8 +60,8 @@ function validatePasswordComplexity(pw) {
 }
 
 function setPassword(newPassword) {
-  fs.writeFileSync(WEB_PASSWORD_FILE, newPassword);
-  fs.writeFileSync(PASSWORD_CHANGED_FILE, new Date().toISOString());
+  atomicWriteFileSync(WEB_PASSWORD_FILE, newPassword, { backup: true, mode: 0o600 });
+  atomicWriteFileSync(PASSWORD_CHANGED_FILE, new Date().toISOString(), { mode: 0o600 });
   notifyAgentSpacePasswordChanged().then((r) => {
     if (r && r.ok) {
       try { fs.writeFileSync(PASSWORD_CHANGED_NOTIFIED_FILE, new Date().toISOString()); } catch (e) {}
@@ -136,12 +140,7 @@ function checkAuth(req) {
   const cookie = (req.headers.cookie || "").split(";").find((c) => c.trim().startsWith("oc_session="));
   if (!cookie) return false;
   const token = cookie.split("=")[1]?.trim();
-  const expected = crypto.createHash("sha256").update(getPassword()).digest("hex");
-  return token === expected;
-}
-
-function authToken() {
-  return crypto.createHash("sha256").update(getPassword()).digest("hex");
+  return webSessions.valid(token);
 }
 
 // ── Config helpers ─────────────────────────────────────────────────
@@ -158,7 +157,27 @@ function loadEnv() {
 
 function saveEnv(env) {
   const content = Object.entries(env).map(([k, v]) => `${k}=${v}`).join("\n");
-  fs.writeFileSync(ENV_FILE, content);
+  atomicWriteFileSync(ENV_FILE, content, { backup: true, mode: 0o600 });
+}
+
+// GET /api/config used to return the raw .env — every bot token, model API key
+// and control-plane secret in plaintext to anyone with a dashboard session. The
+// config UI only ever edits the non-secret SAFE_KEYS, so mask any secret-looking
+// value before it leaves the server (keeping a 4-char tail so the owner can still
+// tell a value is set / which one it is). Masked values can never round-trip back
+// in: the POST handler rejects every key outside SAFE_KEYS.
+const SECRET_KEY_RE = /(TOKEN|SECRET|PASSWORD|API_?KEY|_KEY|CREDENTIAL|WEBHOOK|SESSION|PRIVATE)/i;
+function maskEnv(env) {
+  const out = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (v && SECRET_KEY_RE.test(k)) {
+      const s = String(v);
+      out[k] = s.length <= 8 ? "••••••••" : `••••${s.slice(-4)}`;
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
 }
 
 function loadAuth() {
@@ -166,7 +185,7 @@ function loadAuth() {
 }
 
 function saveAuth(auth) {
-  fs.writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2));
+  atomicWriteFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), { backup: true, mode: 0o600 });
 }
 
 function loadSoul() {
@@ -180,12 +199,27 @@ function loadCrons() {
   try {
     const jobs = JSON.parse(fs.readFileSync(JOBS_FILE, "utf-8"));
     if (Array.isArray(jobs)) return jobs.filter((j) => j && j.kind === "cron");
+    if (jobs && Array.isArray(jobs.jobs)) return jobs.jobs.filter((j) => j && j.kind === "cron" && !j.disabled);
   } catch (e) { /* fall through to legacy */ }
   try { return JSON.parse(fs.readFileSync(CRONS_FILE, "utf-8")); } catch (e) { return []; }
 }
 
 function loadSessions() {
-  try { return JSON.parse(fs.readFileSync(SESSIONS_FILE, "utf-8")); } catch (e) { return {}; }
+  let document;
+  try { document = JSON.parse(fs.readFileSync(SESSIONS_FILE, "utf-8")); } catch (e) { return []; }
+  const rows = [];
+  if (document && document.users && typeof document.users === "object") {
+    for (const [userId, projects] of Object.entries(document.users)) {
+      for (const [project, sessions] of Object.entries(projects || {})) {
+        for (const session of Array.isArray(sessions) ? sessions : []) rows.push({ userId, project, ...session });
+      }
+    }
+    return rows;
+  }
+  for (const [project, sessions] of Object.entries(document || {})) {
+    for (const session of Array.isArray(sessions) ? sessions : []) rows.push({ userId: null, project, ...session });
+  }
+  return rows;
 }
 
 function loadLogs(lines = 100) {
@@ -200,6 +234,17 @@ function isConfigured() {
   return fs.existsSync(ENV_FILE);
 }
 
+function providerConfigurationStatus(options = {}) {
+  const env = loadEnv();
+  return inspectProviderConfiguration({
+    ...options,
+    env: { ...process.env, ...env, ...(options.env || {}) },
+    defaultProvider: options.defaultProvider === undefined
+      ? (env.DEFAULT_PROVIDER || null)
+      : options.defaultProvider,
+  });
+}
+
 // Group usage records by a key (version / model) and return per-group
 // averages so the dashboard can compare tokenomics across versions.
 function aggregateUsage(records, keyName) {
@@ -246,7 +291,7 @@ function telegramGet(token, method) {
 
 // ── API routes ─────────────────────────────────────────────────────
 
-async function handleAPI(req, res, body) {
+async function handleAPI(req, res, body, dependencies = {}) {
   const url = req.url;
 
   // Login — no auth required
@@ -255,7 +300,7 @@ async function handleAPI(req, res, body) {
     if (password === getPassword()) {
       res.writeHead(200, {
         "Content-Type": "application/json",
-        "Set-Cookie": `oc_session=${authToken()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+        "Set-Cookie": `oc_session=${webSessions.issue()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
       });
       return res.end(JSON.stringify({ ok: true, mustChangePassword: !isPasswordChanged() }));
     }
@@ -291,14 +336,16 @@ async function handleAPI(req, res, body) {
   if (url === "/api/status") {
     const env = loadEnv();
     const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf-8"));
+    const providerStatus = providerConfigurationStatus();
     res.writeHead(200, { "Content-Type": "application/json" });
     return res.end(JSON.stringify({
       configured: isConfigured(),
       version: pkg.version,
       workspace: env.WORKSPACE || "",
-      botToken: env.TELEGRAM_BOT_TOKEN ? "***" + env.TELEGRAM_BOT_TOKEN.slice(-8) : "",
+      botToken: env.TELEGRAM_BOT_TOKEN ? "***" + env.TELEGRAM_BOT_TOKEN.slice(-4) : "",
       chatId: env.TELEGRAM_CHAT_ID || "",
-      claudePath: env.CLAUDE_PATH || "",
+      providers: providerStatus.providers,
+      defaultProvider: providerStatus.defaultProvider,
       onboarded: env.ONBOARDED === "true",
     }));
   }
@@ -308,28 +355,44 @@ async function handleAPI(req, res, body) {
     const data = JSON.parse(body);
 
     // Verify token
-    const botInfo = await telegramGet(data.botToken, "getMe");
+    const telegramProbe = dependencies.telegramGet || telegramGet;
+    const botInfo = await telegramProbe(data.botToken, "getMe");
     if (!botInfo.ok) {
       res.writeHead(400, { "Content-Type": "application/json" });
       return res.end(JSON.stringify({ error: "Invalid Telegram bot token" }));
     }
 
+    const existingEnv = loadEnv();
+    const requestedDefault = String(data.defaultProvider || "").trim().toLowerCase();
+    const requestedUtility = String(data.utilityProvider || "").trim().toLowerCase();
     const env = {
+      ...existingEnv,
       TELEGRAM_BOT_TOKEN: data.botToken,
       TELEGRAM_CHAT_ID: data.chatId,
       WORKSPACE: data.workspace || path.join(CONFIG_DIR, "Workspace"),
-      CLAUDE_PATH: data.claudePath || "claude",
-      ANTHROPIC_API_KEY: data.apiKey || "",
-      WHISPER_CLI: "",
-      WHISPER_MODEL: "",
-      FFMPEG: "",
+      CLAUDE_PATH: String(data.claudePath || "").trim() || existingEnv.CLAUDE_PATH || "",
+      CODEX_PATH: String(data.codexPath || "").trim() || existingEnv.CODEX_PATH || "",
+      DEFAULT_PROVIDER: new Set(["claude", "codex"]).has(requestedDefault)
+        ? requestedDefault
+        : (existingEnv.DEFAULT_PROVIDER || ""),
+      UTILITY_PROVIDER: new Set(["active", "claude", "codex"]).has(requestedUtility)
+        ? requestedUtility
+        : (existingEnv.UTILITY_PROVIDER || "active"),
+      PROVIDER_FALLBACKS: String(data.providerFallbacks || "").trim() || existingEnv.PROVIDER_FALLBACKS || "",
+      WHISPER_CLI: existingEnv.WHISPER_CLI || "",
+      WHISPER_MODEL: existingEnv.WHISPER_MODEL || "",
+      FFMPEG: existingEnv.FFMPEG || "",
       VAULT_FILE: path.join(CONFIG_DIR, "vault.enc"),
       SOUL_FILE: SOUL_FILE,
       CRONS_FILE: CRONS_FILE,
       AUTH_FILE: AUTH_FILE,
       ONBOARDED: "false",
     };
+    if (data.apiKey) env.ANTHROPIC_API_KEY = data.apiKey;
     saveEnv(env);
+    const runtimeConfig = require("./core/config");
+    Object.assign(runtimeConfig.config, env);
+    require("./core/providers").registry.defaultProvider = env.DEFAULT_PROVIDER || null;
 
     // Create workspace dir
     const wsDir = env.WORKSPACE;
@@ -357,16 +420,25 @@ async function handleAPI(req, res, body) {
   }
 
   // Get config
-  if (url === "/api/config") {
+  if (url === "/api/config" && req.method === "GET") {
     const env = loadEnv();
     res.writeHead(200, { "Content-Type": "application/json" });
-    return res.end(JSON.stringify(env));
+    return res.end(JSON.stringify(maskEnv(env)));
   }
 
   // Update config (whitelist safe keys only)
   if (url === "/api/config" && req.method === "POST") {
     const SAFE_KEYS = new Set([
-      "WORKSPACE", "CLAUDE_PATH", "WHISPER_CLI", "FFMPEG", "WHISPER_MODEL",
+      "WORKSPACE", "CLAUDE_PATH", "CODEX_PATH", "DEFAULT_PROVIDER",
+      "UTILITY_PROVIDER", "PROVIDER_FALLBACKS",
+      "DREAM_PROVIDER", "MEMORY_PROVIDER", "RECALL_PROVIDER", "ENFORCER_PROVIDER", "SUBAGENT_PROVIDER",
+      "CLAUDE_MODEL", "CODEX_MODEL",
+      "DREAM_MODEL_CLAUDE", "DREAM_MODEL_CODEX",
+      "PACK_REVIEW_MODEL_CLAUDE", "PACK_REVIEW_MODEL_CODEX",
+      "RECALL_MODEL_CLAUDE", "RECALL_MODEL_CODEX",
+      "ENFORCER_MODEL_CLAUDE", "ENFORCER_MODEL_CODEX",
+      "SUBAGENT_MODEL_CLAUDE", "SUBAGENT_MODEL_CODEX",
+      "WHISPER_CLI", "FFMPEG", "WHISPER_MODEL",
       "MEMORY_RECALL_MAX_CHARS",
       "USAGE_ALERT_CONTEXT_TOKENS", "USAGE_ALERT_RATE_MULTIPLIER",
       "USAGE_ALERT_BASELINE_TURNS", "USAGE_ALERT_MIN_BASELINE_TURNS",
@@ -379,6 +451,20 @@ async function handleAPI(req, res, body) {
         res.writeHead(403, { "Content-Type": "application/json" });
         return res.end(JSON.stringify({ error: `Cannot update key: ${key}` }));
       }
+      const normalized = String(value == null ? "" : value).trim().toLowerCase();
+      if (key === "DEFAULT_PROVIDER" && normalized && !new Set(["claude", "codex"]).has(normalized)) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ error: "DEFAULT_PROVIDER must be claude, codex, or blank" }));
+      }
+      if (["UTILITY_PROVIDER", "DREAM_PROVIDER", "MEMORY_PROVIDER", "RECALL_PROVIDER", "ENFORCER_PROVIDER", "SUBAGENT_PROVIDER"].includes(key)
+        && normalized && !new Set(["active", "claude", "codex"]).has(normalized)) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ error: `${key} must be active, claude, codex, or blank` }));
+      }
+      if (key === "PROVIDER_FALLBACKS" && normalized.split(",").filter(Boolean).some((id) => !new Set(["claude", "codex"]).has(id.trim()))) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ error: "PROVIDER_FALLBACKS accepts only claude and codex" }));
+      }
       env[key] = value;
     }
     saveEnv(env);
@@ -431,7 +517,7 @@ async function handleAPI(req, res, body) {
   }
 
   // Soul
-  if (url === "/api/soul") {
+  if (url === "/api/soul" && req.method === "GET") {
     res.writeHead(200, { "Content-Type": "application/json" });
     return res.end(JSON.stringify({ content: loadSoul() }));
   }
@@ -502,9 +588,12 @@ async function handleAPI(req, res, body) {
       return res.end(JSON.stringify({ error: complexityError }));
     }
     setPassword(newPassword);
+    // Changing the password invalidates every outstanding session, then we
+    // re-issue one so the caller who just changed it stays logged in.
+    webSessions.revokeAll();
     res.writeHead(200, {
       "Content-Type": "application/json",
-      "Set-Cookie": `oc_session=${authToken()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+      "Set-Cookie": `oc_session=${webSessions.issue()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
     });
     return res.end(JSON.stringify({ ok: true }));
   }
@@ -705,7 +794,8 @@ async function loadTab() {
         <div class="list-item"><span>Workspace</span><span>\${status.workspace}</span></div>
         <div class="list-item"><span>Bot Token</span><span>\${status.botToken}</span></div>
         <div class="list-item"><span>Chat ID</span><span>\${status.chatId}</span></div>
-        <div class="list-item"><span>Claude</span><span>\${status.claudePath}</span></div>
+        <div class="list-item"><span>Default provider</span><span>\${status.defaultProvider?.label || "None (model turns unavailable)"}</span></div>
+        \${(status.providers || []).map(p => '<div class="list-item"><span>' + p.label + '</span><span>' + p.availability.state + ' · ' + p.compatibility.state + ' · auth ' + p.auth.state + '</span></div>').join("")}
       </div>\`;
   }
   else if (currentTab === "usage") {
@@ -770,7 +860,7 @@ async function loadTab() {
   }
   else if (currentTab === "credentials") {
     el.innerHTML = \`
-      <div class="card" id="cred-status"><h2>Credentials</h2><p class="subtitle">Loading status…</p></div>
+      <div class="card" id="cred-status"><h2>Provider credentials</h2><p class="subtitle">Authenticate the coding-agent providers you use. Each provider keeps its own credentials.</p></div>
       <div class="card">
         <h2>Claude</h2>
         <button onclick="startClaudeAuth()">Authenticate via browser</button>
@@ -824,18 +914,14 @@ async function loadTab() {
   else if (currentTab === "sessions") {
     const sessions = await api("/api/sessions");
     if (!sessions) return;
-    const projects = Object.keys(sessions);
     el.innerHTML = \`
       <div class="card">
         <h2>Conversation History</h2>
-        \${projects.map(p => \`
-          <h2 style="font-size:14px;color:#6366f1;margin:16px 0 8px;">\${p}</h2>
-          \${sessions[p].slice().reverse().slice(0,5).map(s => \`
-            <div class="list-item">
-              <span>\${s.title}</span>
-              <span style="color:#666;font-size:12px;">\${new Date(s.lastUsed).toLocaleDateString()}</span>
-            </div>\`).join("")}
-        \`).join("") || "<p>No sessions yet.</p>"}
+        \${sessions.slice().reverse().slice(0,25).map(s => \`
+          <div class="list-item">
+            <span>\${s.title || s.id} · \${s.provider || "legacy"} · \${s.project}</span>
+            <span style="color:#666;font-size:12px;">\${s.lastUsed ? new Date(s.lastUsed).toLocaleDateString() : "unknown"}</span>
+          </div>\`).join("") || "<p>No sessions yet.</p>"}
       </div>\`;
   }
   else if (currentTab === "logs") {
@@ -871,7 +957,18 @@ async function loadTab() {
     const groups = [
       { title: "General", fields: [
         { k: "WORKSPACE", label: "Workspace folder", desc: "Root directory where the bot reads and writes project files.", ph: "/data/Workspace" },
+      ]},
+      { title: "Providers", fields: [
         { k: "CLAUDE_PATH", label: "Claude CLI path", desc: "Path or command name for the Claude Code CLI.", ph: "claude" },
+        { k: "CODEX_PATH", label: "Codex CLI path", desc: "Path or command name for the OpenAI Codex CLI.", ph: "codex" },
+        { k: "DEFAULT_PROVIDER", label: "Default provider", desc: "claude or codex; blank chooses the first compatible provider deterministically.", ph: "claude" },
+        { k: "UTILITY_PROVIDER", label: "Utility provider", desc: "active, claude, or codex for background intelligence.", ph: "active" },
+        { k: "PROVIDER_FALLBACKS", label: "Utility fallbacks", desc: "Ordered comma-separated fallback providers. Foreground turns never use this list.", ph: "codex,claude" },
+        { k: "DREAM_PROVIDER", label: "Dream provider", desc: "Optional per-purpose override.", ph: "codex" },
+        { k: "MEMORY_PROVIDER", label: "Memory-review provider", desc: "Optional per-purpose override.", ph: "active" },
+        { k: "RECALL_PROVIDER", label: "Recall provider", desc: "Optional per-purpose override.", ph: "active" },
+        { k: "ENFORCER_PROVIDER", label: "Guard provider", desc: "Optional fail-closed relationship-guard provider.", ph: "claude" },
+        { k: "SUBAGENT_PROVIDER", label: "Sub-agent provider", desc: "Optional /agent provider override.", ph: "active" },
       ]},
       { title: "Voice transcription", fields: [
         { k: "WHISPER_CLI", label: "Whisper CLI", desc: "Path to the whisper binary for transcribing voice notes. Leave blank to disable voice.", ph: "whisper" },
@@ -975,7 +1072,7 @@ async function loadCredStatus() {
   const s = await api("/api/auth/status");
   if (!s) return;
   const yn = (b) => b ? "<span style='color:#22c55e'>yes</span>" : "<span style='color:#dc2626'>no</span>";
-  $("#cred-status").innerHTML = \`<h2>Credentials</h2>
+  $("#cred-status").innerHTML = \`<h2>Provider credentials</h2>
     <div class="list-item"><span>Claude OAuth token saved</span><span>\${yn(s.claude.configured)}</span></div>
     <div class="list-item"><span>Claude logged in</span><span>\${yn(s.claude.loggedIn)}</span></div>
     <div class="list-item"><span>Codex CLI present</span><span>\${yn(s.codex.cliFound)}</span></div>
@@ -1076,16 +1173,25 @@ async function saveConfig() {
 }
 
 function renderSetup() {
+  const providerRows = (status.providers || []).map(p =>
+    '<div class="list-item"><span>' + p.label + '</span><span>' + p.availability.state + ' · ' + p.compatibility.state + ' · auth ' + p.auth.state + '</span></div>' +
+    (p.recovery ? '<div style="color:#888;font-size:11px;margin:-8px 0 10px;">' + p.recovery.split("\\n")[0] + '</div>' : "")
+  ).join("");
   $("#app").innerHTML = \`
     <div class="container">
       <h1>${botName} Setup</h1>
-      <p class="subtitle">Configure your AI coding assistant</p>
+      <p class="subtitle">Configure channels and coding-agent providers</p>
       <div id="setup-msg"></div>
+      <div class="card"><h2>Provider status</h2>\${providerRows || "<p>No provider detected. You can still complete setup and configure one later.</p>"}</div>
       <div class="card">
         <div class="form-group"><label>Telegram Bot Token (from @BotFather)</label><input id="s-token" placeholder="123456:ABC-DEF..."></div>
         <div class="form-group"><label>Your Telegram Chat ID</label><input id="s-chatid" placeholder="e.g. 6251055967"></div>
         <div class="form-group"><label>Anthropic API Key (or leave blank if Claude CLI is authed)</label><input id="s-apikey" type="password" placeholder="sk-ant-..."></div>
-        <div class="form-group"><label>Claude CLI Path (auto-detected if on PATH)</label><input id="s-claude" placeholder="claude" value="claude"></div>
+        <div class="form-group"><label>Claude CLI Path (optional; blank uses PATH discovery)</label><input id="s-claude" placeholder="claude"></div>
+        <div class="form-group"><label>Codex CLI Path (optional; blank uses PATH discovery)</label><input id="s-codex" placeholder="codex"></div>
+        <div class="form-group"><label>Default Provider (optional)</label><select id="s-default"><option value="">Auto-detect</option><option value="claude">Claude Code</option><option value="codex">OpenAI Codex</option></select></div>
+        <div class="form-group"><label>Utility Provider</label><select id="s-utility"><option value="active">Active provider</option><option value="claude">Claude Code</option><option value="codex">OpenAI Codex</option></select></div>
+        <div class="form-group"><label>Utility Fallbacks (optional)</label><input id="s-fallbacks" placeholder="codex,claude"></div>
         <div class="form-group"><label>Workspace Path</label><input id="s-workspace" placeholder="Leave blank for default"></div>
         <button onclick="doSetup()" style="width:100%">Complete Setup</button>
       </div>
@@ -1098,6 +1204,10 @@ async function doSetup() {
     chatId: $("#s-chatid").value,
     apiKey: $("#s-apikey").value,
     claudePath: $("#s-claude").value,
+    codexPath: $("#s-codex").value,
+    defaultProvider: $("#s-default").value,
+    utilityProvider: $("#s-utility").value,
+    providerFallbacks: $("#s-fallbacks").value,
     workspace: $("#s-workspace").value,
   }});
   if (r?.ok) {
@@ -1119,8 +1229,9 @@ init();
 
 let webServer = null;
 
-function startWebServer() {
+function startWebServer(options = {}) {
   if (webServer) return webServer;
+  ensureConfigDir(CONFIG_DIR);
 
   const server = http.createServer(async (req, res) => {
     // CORS for local dev
@@ -1137,7 +1248,7 @@ function startWebServer() {
       if (consume(token)) {
         res.writeHead(302, {
           "Location": "/",
-          "Set-Cookie": `oc_session=${authToken()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+          "Set-Cookie": `oc_session=${webSessions.issue()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
         });
         return res.end();
       }
@@ -1148,7 +1259,7 @@ function startWebServer() {
     if (req.url.startsWith("/api/")) {
       let body = "";
       req.on("data", (d) => { body += d; });
-      req.on("end", () => handleAPI(req, res, body));
+      req.on("end", () => handleAPI(req, res, body, options));
       return;
     }
 
@@ -1162,9 +1273,12 @@ function startWebServer() {
     console.log("Admin password configured.");
     reconcileGrandfatheredPasswordChange();
   });
+  server.once("close", () => {
+    if (webServer === server) webServer = null;
+  });
 
   webServer = server;
   return server;
 }
 
-module.exports = { startWebServer, isConfigured };
+module.exports = { startWebServer, isConfigured, providerConfigurationStatus, handleAPI };