@intrect/openswarm 0.15.0 → 0.17.0

package/dist/support/web.js

@@ -27,6 +27,14 @@ import { ISSUE_BOARD_HTML } from '../issues/issueBoardHtml.js';
 import { createSubIssuesWithDependencies, getTaskSource } from '../automation/runnerExecution.js';
 let server = null;
 let runnerRef;
+const MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+class HttpError extends Error {
+    statusCode;
+    constructor(statusCode, message) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
 // CORS origin allowlist — hostname-strict match (no substring/prefix pitfalls)
 function isAllowedOrigin(origin) {
     let url;
@@ -61,6 +69,38 @@ function safeErrorMessage(err) {
     }
     return 'Internal error';
 }
+function isLoopbackAddress(address) {
+    return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
+}
+function extractBearerToken(header) {
+    if (!header)
+        return null;
+    // Linear-time parse (no regex): 'Bearer' + one space/tab + token. A
+    // backtracking /^Bearer\s+(.+)$/ is polynomial on adversarial whitespace runs.
+    const prefix = header.slice(0, 7).toLowerCase();
+    if (prefix !== 'bearer ' && prefix !== 'bearer\t')
+        return null;
+    return header.slice(7).trim() || null;
+}
+function isAuthorizedMutation(req) {
+    if (isLoopbackAddress(req.socket.remoteAddress))
+        return true;
+    const configuredToken = process.env.OPENSWARM_WEB_TOKEN?.trim();
+    if (!configuredToken)
+        return false;
+    const presentedToken = extractBearerToken(req.headers.authorization) ||
+        (Array.isArray(req.headers['x-openswarm-token'])
+            ? req.headers['x-openswarm-token'][0]
+            : req.headers['x-openswarm-token']);
+    return presentedToken === configuredToken;
+}
+function isMutatingApiRequest(pathname, method) {
+    return pathname.startsWith('/api/') && ['DELETE', 'PATCH', 'POST', 'PUT'].includes(method ?? '');
+}
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
 const execTasks = new Map();
 function cleanupExecTask(taskId) {
     setTimeout(() => { execTasks.delete(taskId); }, 3600000); // 1 hour
@@ -244,10 +284,34 @@ export function setWebRunner(runner) {
 }
 // Read POST body helper
 function readBody(req) {
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
         let data = '';
-        req.on('data', (chunk) => { data += chunk.toString(); });
-        req.on('end', () => resolve(data));
+        let totalBytes = 0;
+        let settled = false;
+        const fail = (statusCode, message) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new HttpError(statusCode, message));
+        };
+        req.on('data', (chunk) => {
+            if (settled)
+                return;
+            totalBytes += chunk.length;
+            if (totalBytes > MAX_REQUEST_BODY_BYTES) {
+                fail(413, 'Request body too large');
+                return;
+            }
+            data += chunk.toString('utf-8');
+        });
+        req.on('end', () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(data);
+        });
+        req.on('aborted', () => fail(400, 'Request body aborted'));
+        req.on('error', () => fail(400, 'Request body error'));
     });
 }
 // Start web server
@@ -258,890 +322,907 @@ export async function startWebServer(port = 3847) {
     }
     return new Promise((resolve, reject) => {
         server = createServer(async (req, res) => {
-            const url = req.url?.split('?')[0] || '/';
-            // CORS: allow localhost, Tauri webview, and Tailscale network
-            const origin = req.headers.origin;
-            if (origin && isAllowedOrigin(origin)) {
-                res.setHeader('Access-Control-Allow-Origin', origin);
-                res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE');
-            }
-            // ---- GraphQL API (이슈 트래커) ----
-            if (isGraphQLRequest(req.url)) {
-                await handleGraphQL(req, res);
-                // ---- Issue Board ----
-            }
-            else if (url === '/issues') {
-                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                res.end(ISSUE_BOARD_HTML);
-                // ---- Dashboard ----
-            }
-            else if (url === '/' || url === '/index.html') {
-                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                res.end(DASHBOARD_HTML);
-                // ---- SSE stream ----
-            }
-            else if (url === '/api/events') {
-                const skipReplay = req.url?.includes('skipReplay=1') ?? false;
-                res.writeHead(200, {
-                    'Content-Type': 'text/event-stream',
-                    'Cache-Control': 'no-cache',
-                    'Connection': 'keep-alive',
-                });
-                res.write(':connected\n\n');
-                addSSEClient(res, skipReplay);
-                // ---- Stats ----
-            }
-            else if (url === '/api/stats') {
-                const stats = runnerRef?.getStats();
-                const state = runnerRef?.getState();
-                const adapters = runnerRef?.getAdapterSummary();
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    runningTasks: stats?.schedulerStats?.running ?? 0,
-                    queuedTasks: stats?.schedulerStats?.queued ?? 0,
-                    completedToday: stats?.schedulerStats?.completed ?? 0,
-                    uptime: state?.startedAt ? Date.now() - state.startedAt : 0,
-                    isRunning: stats?.isRunning ?? false,
-                    sseClients: getActiveSSECount(),
-                    adapters,
-                    turboMode: stats?.turboMode ?? false,
-                    turboExpiresAt: stats?.turboExpiresAt ?? null,
-                    dailyPace: stats?.dailyPace ?? null,
-                }));
-                // ---- Tasks ----
-            }
-            else if (url === '/api/tasks') {
-                const running = runnerRef?.getRunningTasks() ?? [];
-                const queued = runnerRef?.getQueuedTasks() ?? [];
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ running, queued }));
-                // ---- Pipeline GET (detailed pipeline stages) ----
-            }
-            else if (url === '/api/pipeline') {
-                const stages = getStageBuffer();
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ stages }));
-                // ---- Rate Limiter Metrics GET ----
-            }
-            else if (url === '/api/rate-limits') {
-                const metrics = getRateLimiterMetrics();
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(metrics));
-                // ---- Projects GET (pinned + active projects) ----
-            }
-            else if (url === '/api/projects' && req.method === 'GET') {
-                const enabledPaths = new Set(runnerRef?.getEnabledProjects() ?? []);
-                const taskInfo = runnerRef?.getProjectsInfo() ?? [];
-                const byPath = new Map(taskInfo.filter(p => p.path).map(p => [p.path, p]));
-                // Fallback: match by project name (for tasks not yet executed → path not cached)
-                const byName = new Map(taskInfo.map(p => [p.name, p]));
-                // Start with pinned projects
-                const allPaths = new Set(pinnedProjects);
-                // Auto-include enabled projects and projects with active tasks
-                for (const path of enabledPaths)
-                    allPaths.add(path);
-                for (const info of taskInfo) {
-                    if (info.path && (info.running.length > 0 || info.queued.length > 0)) {
-                        allPaths.add(info.path);
-                    }
+            try {
+                const requestUrl = new URL(req.url ?? '/', 'http://localhost');
+                const url = requestUrl.pathname;
+                // CORS: allow localhost, Tauri webview, and Tailscale network
+                const origin = req.headers.origin;
+                if (origin && isAllowedOrigin(origin)) {
+                    res.setHeader('Access-Control-Allow-Origin', origin);
+                    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE');
+                    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-OpenSwarm-Token');
                 }
-                const result = await Promise.all(Array.from(allPaths).map(async (p) => {
-                    const dirName = p.split('/').pop() ?? p;
-                    const info = byPath.get(p) ?? byName.get(dirName);
-                    const gitInfo = await getProjectGitInfo(p);
-                    return {
-                        path: p,
-                        name: dirName,
-                        enabled: enabledPaths.has(p),
-                        pinned: pinnedProjects.has(p),
-                        running: info?.running ?? [],
-                        queued: info?.queued ?? [],
-                        pending: info?.pending ?? [],
-                        git: gitInfo.git,
-                        prs: gitInfo.prs,
-                    };
-                }));
-                result.sort((a, b) => {
-                    const aActive = a.running.length + a.queued.length + a.pending.length;
-                    const bActive = b.running.length + b.queued.length + b.pending.length;
-                    if (aActive !== bActive)
-                        return bActive - aActive;
-                    return a.name.localeCompare(b.name);
-                });
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(result));
-                // ---- Local projects for picker ----
-            }
-            else if (url === '/api/local-projects' && req.method === 'GET') {
-                const configPaths = runnerRef?.getAllowedProjects() ?? [];
-                const allBasePaths = [...new Set([...configPaths, ...customBasePaths])];
-                try {
-                    const locals = await scanLocalProjects(allBasePaths);
-                    const SKIP = ['/node_modules/', '/.git/', '/dist/', '/build/', '/__pycache__/', '/venv/', '/.venv/'];
-                    const filtered = locals.filter(l => !SKIP.some(s => l.path.includes(s)));
+                if (req.method === 'OPTIONS') {
+                    res.writeHead(204);
+                    res.end();
+                    return;
+                }
+                if (isMutatingApiRequest(url, req.method) && !isAuthorizedMutation(req)) {
+                    writeJson(res, 403, { error: 'Forbidden' });
+                    return;
+                }
+                // ---- GraphQL API (이슈 트래커) ----
+                if (isGraphQLRequest(req.url)) {
+                    await handleGraphQL(req, res);
+                    // ---- Issue Board ----
+                }
+                else if (url === '/issues') {
+                    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(ISSUE_BOARD_HTML);
+                    // ---- Dashboard ----
+                }
+                else if (url === '/' || url === '/index.html') {
+                    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(DASHBOARD_HTML);
+                    // ---- SSE stream ----
+                }
+                else if (url === '/api/events') {
+                    const skipReplay = req.url?.includes('skipReplay=1') ?? false;
+                    res.writeHead(200, {
+                        'Content-Type': 'text/event-stream',
+                        'Cache-Control': 'no-cache',
+                        'Connection': 'keep-alive',
+                    });
+                    res.write(':connected\n\n');
+                    addSSEClient(res, skipReplay);
+                    // ---- Stats ----
+                }
+                else if (url === '/api/stats') {
+                    const stats = runnerRef?.getStats();
+                    const state = runnerRef?.getState();
+                    const adapters = runnerRef?.getAdapterSummary();
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(filtered.map(l => ({ path: l.path, name: l.name, pinned: pinnedProjects.has(l.path) }))));
+                    res.end(JSON.stringify({
+                        runningTasks: stats?.schedulerStats?.running ?? 0,
+                        queuedTasks: stats?.schedulerStats?.queued ?? 0,
+                        completedToday: stats?.schedulerStats?.completed ?? 0,
+                        uptime: state?.startedAt ? Date.now() - state.startedAt : 0,
+                        isRunning: stats?.isRunning ?? false,
+                        sseClients: getActiveSSECount(),
+                        adapters,
+                        turboMode: stats?.turboMode ?? false,
+                        turboExpiresAt: stats?.turboExpiresAt ?? null,
+                        dailyPace: stats?.dailyPace ?? null,
+                    }));
+                    // ---- Tasks ----
                 }
-                catch (e) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(e) }));
+                else if (url === '/api/tasks') {
+                    const running = runnerRef?.getRunningTasks() ?? [];
+                    const queued = runnerRef?.getQueuedTasks() ?? [];
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ running, queued }));
+                    // ---- Pipeline GET (detailed pipeline stages) ----
                 }
-                // ---- Pin project ----
-            }
-            else if (url === '/api/projects/pin' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { projectPath } = JSON.parse(body);
-                    if (typeof projectPath === 'string' && projectPath) {
-                        pinnedProjects.add(projectPath);
-                        // R6: an explicit pin is a deliberate re-enable — clear the denylist so it isn't
-                        // skipped again by setWebRunner on the next restart.
-                        removedConfigPaths.delete(projectPath);
-                        saveReposConfig();
-                        // Seed path cache so Linear project name matches immediately
-                        const name = projectPath.split('/').pop();
-                        if (name && runnerRef)
-                            runnerRef.registerProjectPath(name, projectPath);
-                    }
+                else if (url === '/api/pipeline') {
+                    const stages = getStageBuffer();
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
+                    res.end(JSON.stringify({ stages }));
+                    // ---- Rate Limiter Metrics GET ----
                 }
-                catch {
-                    res.writeHead(400).end(JSON.stringify({ error: 'Invalid JSON' }));
+                else if (url === '/api/rate-limits') {
+                    const metrics = getRateLimiterMetrics();
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(metrics));
+                    // ---- Projects GET (pinned + active projects) ----
                 }
-                // ---- Unpin project ----
-            }
-            else if (url === '/api/projects/unpin' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { projectPath } = JSON.parse(body);
-                    if (typeof projectPath === 'string') {
-                        pinnedProjects.delete(projectPath);
-                        // Also disable the project so it doesn't reappear via enabledPaths
-                        runnerRef?.disableProject(projectPath);
-                        saveReposConfig();
+                else if (url === '/api/projects' && req.method === 'GET') {
+                    const enabledPaths = new Set(runnerRef?.getEnabledProjects() ?? []);
+                    const taskInfo = runnerRef?.getProjectsInfo() ?? [];
+                    const byPath = new Map(taskInfo.filter(p => p.path).map(p => [p.path, p]));
+                    // Fallback: match by project name (for tasks not yet executed → path not cached)
+                    const byName = new Map(taskInfo.map(p => [p.name, p]));
+                    // Start with pinned projects
+                    const allPaths = new Set(pinnedProjects);
+                    // Auto-include enabled projects and projects with active tasks
+                    for (const path of enabledPaths)
+                        allPaths.add(path);
+                    for (const info of taskInfo) {
+                        if (info.path && (info.running.length > 0 || info.queued.length > 0)) {
+                            allPaths.add(info.path);
+                        }
                     }
+                    const result = await Promise.all(Array.from(allPaths).map(async (p) => {
+                        const dirName = p.split('/').pop() ?? p;
+                        const info = byPath.get(p) ?? byName.get(dirName);
+                        const gitInfo = await getProjectGitInfo(p);
+                        return {
+                            path: p,
+                            name: dirName,
+                            enabled: enabledPaths.has(p),
+                            pinned: pinnedProjects.has(p),
+                            running: info?.running ?? [],
+                            queued: info?.queued ?? [],
+                            pending: info?.pending ?? [],
+                            git: gitInfo.git,
+                            prs: gitInfo.prs,
+                        };
+                    }));
+                    result.sort((a, b) => {
+                        const aActive = a.running.length + a.queued.length + a.pending.length;
+                        const bActive = b.running.length + b.queued.length + b.pending.length;
+                        if (aActive !== bActive)
+                            return bActive - aActive;
+                        return a.name.localeCompare(b.name);
+                    });
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
+                    res.end(JSON.stringify(result));
+                    // ---- Local projects for picker ----
                 }
-                catch {
-                    res.writeHead(400).end(JSON.stringify({ error: 'Invalid JSON' }));
+                else if (url === '/api/local-projects' && req.method === 'GET') {
+                    const configPaths = runnerRef?.getAllowedProjects() ?? [];
+                    const allBasePaths = [...new Set([...configPaths, ...customBasePaths])];
+                    try {
+                        const locals = await scanLocalProjects(allBasePaths);
+                        const SKIP = ['/node_modules/', '/.git/', '/dist/', '/build/', '/__pycache__/', '/venv/', '/.venv/'];
+                        const filtered = locals.filter(l => !SKIP.some(s => l.path.includes(s)));
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(filtered.map(l => ({ path: l.path, name: l.name, pinned: pinnedProjects.has(l.path) }))));
+                    }
+                    catch (e) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(e) }));
+                    }
+                    // ---- Pin project ----
                 }
-                // ---- Projects Toggle ----
-            }
-            else if (url === '/api/projects/toggle' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { projectPath, enabled } = JSON.parse(body);
-                    if (typeof projectPath === 'string' && typeof enabled === 'boolean') {
-                        if (enabled) {
-                            removedConfigPaths.delete(projectPath); // R6: explicit enable clears the denylist
-                            runnerRef?.enableProject(projectPath);
+                else if (url === '/api/projects/pin' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { projectPath } = JSON.parse(body);
+                        if (typeof projectPath === 'string' && projectPath) {
+                            pinnedProjects.add(projectPath);
+                            // R6: an explicit pin is a deliberate re-enable — clear the denylist so it isn't
+                            // skipped again by setWebRunner on the next restart.
+                            removedConfigPaths.delete(projectPath);
+                            saveReposConfig();
+                            // Seed path cache so Linear project name matches immediately
+                            const name = projectPath.split('/').pop();
+                            if (name && runnerRef)
+                                runnerRef.registerProjectPath(name, projectPath);
                         }
-                        else {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
+                    }
+                    catch {
+                        res.writeHead(400).end(JSON.stringify({ error: 'Invalid JSON' }));
+                    }
+                    // ---- Unpin project ----
+                }
+                else if (url === '/api/projects/unpin' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { projectPath } = JSON.parse(body);
+                        if (typeof projectPath === 'string') {
+                            pinnedProjects.delete(projectPath);
+                            // Also disable the project so it doesn't reappear via enabledPaths
                             runnerRef?.disableProject(projectPath);
+                            saveReposConfig();
                         }
-                        saveReposConfig();
-                        broadcastEvent({ type: 'project:toggled', data: { projectPath, enabled } });
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
                     }
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
-                }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                    catch {
+                        res.writeHead(400).end(JSON.stringify({ error: 'Invalid JSON' }));
+                    }
+                    // ---- Projects Toggle ----
                 }
-                // ---- Move Issue to Todo ----
-            }
-            else if (url === '/api/issue/move-to-todo' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { issueId } = JSON.parse(body);
-                    if (!issueId) {
+                else if (url === '/api/projects/toggle' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { projectPath, enabled } = JSON.parse(body);
+                        if (typeof projectPath === 'string' && typeof enabled === 'boolean') {
+                            if (enabled) {
+                                removedConfigPaths.delete(projectPath); // R6: explicit enable clears the denylist
+                                runnerRef?.enableProject(projectPath);
+                            }
+                            else {
+                                runnerRef?.disableProject(projectPath);
+                            }
+                            saveReposConfig();
+                            broadcastEvent({ type: 'project:toggled', data: { projectPath, enabled } });
+                        }
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
+                    }
+                    catch {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Missing issueId' }));
-                        return;
+                        res.end(JSON.stringify({ error: 'Invalid JSON' }));
                     }
-                    // Import linear dynamically to avoid circular deps
-                    const linearModule = await import('../linear/index.js');
-                    await linearModule.updateIssueState(issueId, 'Todo');
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
-                }
-                catch (error) {
-                    console.error('[Web] Failed to move issue to Todo:', error);
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                    // ---- Move Issue to Todo ----
                 }
-                // ---- Heartbeat (manual trigger) ----
-            }
-            else if (url === '/api/heartbeat' && req.method === 'POST') {
-                res.writeHead(202, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ ok: true }));
-                // Non-blocking heartbeat
-                runnerRef?.heartbeat().catch((e) => console.error('[Web] Heartbeat error:', e));
-                // ---- Provider toggle ----
-            }
-            else if (url === '/api/provider' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { provider } = JSON.parse(body);
-                    // Validate against the live adapter registry rather than a hardcoded list,
-                    // so the dashboard's provider buttons (incl. claude / codex-responses) never
-                    // drift out of sync with what's actually registered.
-                    if (!isKnownAdapter(provider)) {
-                        res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: `Invalid provider "${provider}". Valid: ${listAdapterNames().join(', ')}` }));
-                        return;
+                else if (url === '/api/issue/move-to-todo' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { issueId } = JSON.parse(body);
+                        if (!issueId) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Missing issueId' }));
+                            return;
+                        }
+                        // Import linear dynamically to avoid circular deps
+                        const linearModule = await import('../linear/index.js');
+                        await linearModule.updateIssueState(issueId, 'Todo');
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
                     }
-                    setDefaultAdapter(provider);
-                    runnerRef?.switchProvider(provider);
-                    broadcastEvent({
-                        type: 'log',
-                        data: { taskId: 'system', stage: 'provider', line: `Provider switched to ${provider}` },
-                    });
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true, provider }));
+                    catch (error) {
+                        console.error('[Web] Failed to move issue to Todo:', error);
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                    }
+                    // ---- Heartbeat (manual trigger) ----
                 }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                else if (url === '/api/heartbeat' && req.method === 'POST') {
+                    res.writeHead(202, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true }));
+                    // Non-blocking heartbeat
+                    runnerRef?.heartbeat().catch((e) => console.error('[Web] Heartbeat error:', e));
+                    // ---- Provider toggle ----
                 }
-                // ---- Turbo Mode Toggle ----
-            }
-            else if (url === '/api/turbo' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { enabled } = JSON.parse(body);
-                    if (typeof enabled !== 'boolean') {
+                else if (url === '/api/provider' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { provider } = JSON.parse(body);
+                        // Validate against the live adapter registry rather than a hardcoded list,
+                        // so the dashboard's provider buttons (incl. claude / codex-responses) never
+                        // drift out of sync with what's actually registered.
+                        if (!isKnownAdapter(provider)) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: `Invalid provider "${provider}". Valid: ${listAdapterNames().join(', ')}` }));
+                            return;
+                        }
+                        setDefaultAdapter(provider);
+                        runnerRef?.switchProvider(provider);
+                        broadcastEvent({
+                            type: 'log',
+                            data: { taskId: 'system', stage: 'provider', line: `Provider switched to ${provider}` },
+                        });
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true, provider }));
+                    }
+                    catch {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'enabled must be boolean' }));
-                        return;
+                        res.end(JSON.stringify({ error: 'Invalid JSON' }));
                     }
-                    runnerRef?.setTurboMode(enabled);
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true, turboMode: enabled }));
+                    // ---- Turbo Mode Toggle ----
                 }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                else if (url === '/api/turbo' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { enabled } = JSON.parse(body);
+                        if (typeof enabled !== 'boolean') {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'enabled must be boolean' }));
+                            return;
+                        }
+                        runnerRef?.setTurboMode(enabled);
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true, turboMode: enabled }));
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                    }
+                    // ---- PR Processor Status ----
                 }
-                // ---- PR Processor Status ----
-            }
-            else if (url === '/api/pr-processor-status' && req.method === 'GET') {
-                try {
-                    const { getPRProcessor } = await import('../core/service.js');
-                    const processor = getPRProcessor();
-                    const status = processor ? processor.getStatus() : null;
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(status));
+                else if (url === '/api/pr-processor-status' && req.method === 'GET') {
+                    try {
+                        const { getPRProcessor } = await import('../core/service.js');
+                        const processor = getPRProcessor();
+                        const status = processor ? processor.getStatus() : null;
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(status));
+                    }
+                    catch (error) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                    }
+                    // ---- Trigger PR Processor ----
                 }
-                catch (error) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                else if (url === '/api/trigger-pr-processor' && req.method === 'POST') {
+                    try {
+                        const { getPRProcessor } = await import('../core/service.js');
+                        const processor = getPRProcessor();
+                        if (!processor) {
+                            res.writeHead(404, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'PR Processor not initialized' }));
+                            return;
+                        }
+                        res.writeHead(202, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
+                        // Non-blocking PR processing
+                        processor.processPRs().catch((e) => console.error('[Web] PR Processor error:', e));
+                    }
+                    catch (error) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                    }
+                    // ---- CI Worker Status ----
                 }
-                // ---- Trigger PR Processor ----
-            }
-            else if (url === '/api/trigger-pr-processor' && req.method === 'POST') {
-                try {
-                    const { getPRProcessor } = await import('../core/service.js');
-                    const processor = getPRProcessor();
-                    if (!processor) {
-                        res.writeHead(404, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'PR Processor not initialized' }));
-                        return;
+                else if (url === '/api/ci-worker-status' && req.method === 'GET') {
+                    try {
+                        const { getCIWorkerStatus } = await import('../automation/ciWorker.js');
+                        const status = getCIWorkerStatus();
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(status));
                     }
-                    res.writeHead(202, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
-                    // Non-blocking PR processing
-                    processor.processPRs().catch((e) => console.error('[Web] PR Processor error:', e));
+                    catch (error) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                    }
+                    // ---- Stuck/Failed Issues ----
                 }
-                catch (error) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                else if (url === '/api/stuck-issues' && req.method === 'GET') {
+                    try {
+                        const linearModule = await import('../linear/index.js');
+                        const result = await linearModule.getStuckIssues();
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(result));
+                    }
+                    catch (error) {
+                        console.error('[Web] Failed to fetch stuck issues:', error);
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(error) }));
+                    }
+                    // ---- Chat history ----
                 }
-                // ---- CI Worker Status ----
-            }
-            else if (url === '/api/ci-worker-status' && req.method === 'GET') {
-                try {
-                    const { getCIWorkerStatus } = await import('../automation/ciWorker.js');
-                    const status = getCIWorkerStatus();
+                else if (url === '/api/chat/history' && req.method === 'GET') {
+                    const buf = getChatBuffer();
+                    const history = buf
+                        .filter((ev) => ev.type === 'chat:user' || ev.type === 'chat:agent')
+                        .map(ev => ({
+                        role: ev.type === 'chat:user' ? 'user' : 'agent',
+                        text: ev.data.text,
+                        ts: ev.data.ts,
+                    }));
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(status));
+                    res.end(JSON.stringify(history.slice(-50)));
+                    // ---- Log buffer snapshot ----
                 }
-                catch (error) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(error) }));
-                }
-                // ---- Stuck/Failed Issues ----
-            }
-            else if (url === '/api/stuck-issues' && req.method === 'GET') {
-                try {
-                    const linearModule = await import('../linear/index.js');
-                    const result = await linearModule.getStuckIssues();
+                else if (url === '/api/logs' && req.method === 'GET') {
+                    // 성능 최적화: 최근 200개 로그만 반환 (응답 시간 단축)
+                    const allLogs = getLogBuffer();
+                    const recentLogs = allLogs.slice(-200);
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(result));
-                }
-                catch (error) {
-                    console.error('[Web] Failed to fetch stuck issues:', error);
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(error) }));
-                }
-                // ---- Chat history ----
-            }
-            else if (url === '/api/chat/history' && req.method === 'GET') {
-                const buf = getChatBuffer();
-                const history = buf
-                    .filter((ev) => ev.type === 'chat:user' || ev.type === 'chat:agent')
-                    .map(ev => ({
-                    role: ev.type === 'chat:user' ? 'user' : 'agent',
-                    text: ev.data.text,
-                    ts: ev.data.ts,
-                }));
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(history.slice(-50)));
-                // ---- Log buffer snapshot ----
-            }
-            else if (url === '/api/logs' && req.method === 'GET') {
-                // 성능 최적화: 최근 200개 로그만 반환 (응답 시간 단축)
-                const allLogs = getLogBuffer();
-                const recentLogs = allLogs.slice(-200);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(recentLogs));
-                // ---- Stage buffer snapshot ----
-            }
-            else if (url === '/api/stages' && req.method === 'GET') {
-                // 성능 최적화: 최근 100개 스테이지만 반환 (응답 시간 단축)
-                const allStages = getStageBuffer();
-                const recentStages = allStages.slice(-100);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(recentStages));
-                // ---- Chat message ----
-            }
-            else if (url === '/api/chat' && req.method === 'POST') {
-                const body = await readBody(req);
-                let message;
-                try {
-                    message = JSON.parse(body).message?.trim();
-                }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Invalid JSON' }));
-                    return;
-                }
-                if (!message) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Empty message' }));
-                    return;
+                    res.end(JSON.stringify(recentLogs));
+                    // ---- Stage buffer snapshot ----
                 }
-                broadcastEvent({ type: 'chat:user', data: { text: message, ts: Date.now() } });
-                // Build context-aware prompt (including previous conversation)
-                const stats = runnerRef?.getStats();
-                const projects = runnerRef?.getProjectsInfo() ?? [];
-                const enabled = projects.filter(p => p.enabled).length;
-                const state = runnerRef?.getState();
-                const uptimeSec = state?.startedAt ? Math.floor((Date.now() - state.startedAt) / 1000) : 0;
-                // 1. Short-term memory: recent chat buffer
-                const chatBuf = getChatBuffer()
-                    .filter((ev) => ev.type === 'chat:user' || ev.type === 'chat:agent');
-                const recentHistory = chatBuf.slice(-11, -1);
-                const historyBlock = recentHistory.length > 0
-                    ? recentHistory.map(m => (m.type === 'chat:user' ? 'User' : 'OpenSwarm') + ': ' + m.data.text).join('\n\n')
-                    : '';
-                // 2. Long-term memory: semantic search (shared with Discord)
-                const memories = await memory.searchMemory(message, {
-                    types: ['journal'],
-                    repo: 'chat', // Shared repo for both Discord and Dashboard
-                    limit: 5,
-                    minSimilarity: 0.4,
-                    minTrust: 0.5,
-                });
-                const memoryContext = memories.length > 0
-                    ? '## Relevant Past Discussions\n' + memories.map(m => `- ${m.content.replace(/^Q: |^A: /g, '')}`).join('\n')
-                    : '';
-                const provider = runnerRef?.getAdapterSummary().defaultAdapter ?? 'codex';
-                const model = runnerRef?.getAdapterSummary().worker?.model ?? getDefaultChatModel(provider);
-                const contextPrompt = [
-                    'You are OpenSwarm, an autonomous code development supervisor.',
-                    'You manage a fleet of coding agents that autonomously work on Linear issues.',
-                    `Current chat provider: ${provider}`,
-                    `Current chat model: ${model}`,
-                    '',
-                    'Current system status:',
-                    '- Running tasks: ' + (stats?.schedulerStats?.running ?? 0),
-                    '- Queued tasks: ' + (stats?.schedulerStats?.queued ?? 0),
-                    '- Completed today: ' + (stats?.schedulerStats?.completed ?? 0),
-                    '- Active repos: ' + enabled + '/' + projects.length,
-                    '- Uptime: ' + uptimeSec + 's',
-                    '',
-                    ...(historyBlock ? [
-                        'Conversation history (most recent first):',
-                        historyBlock,
-                        '',
-                    ] : []),
-                    ...(memoryContext ? [memoryContext, ''] : []),
-                    'Answer the user concisely and helpfully in the same language they use. Use the status data above if relevant.',
-                    '',
-                    'User: ' + message,
-                ].join('\n');
-                const result = await runChatCompletion({
-                    prompt: contextPrompt,
-                    provider,
-                    model,
-                    cwd: process.cwd(),
-                    timeoutMs: 180000,
-                }).catch((error) => ({
-                    response: `[Error: ${error.message}]`,
-                    provider,
-                    model,
-                    cost: undefined,
-                    tokens: undefined,
-                }));
-                const response = result.response;
-                if (result.cost !== undefined) {
-                    console.log(`[Web Chat] Cost: ${formatCost({
-                        costUsd: result.cost,
-                        inputTokens: result.tokens ?? 0,
-                        outputTokens: 0,
-                        cacheReadTokens: 0,
-                        cacheCreationTokens: 0,
-                        durationMs: 0,
-                        model: result.model,
-                    })}`);
-                }
-                broadcastEvent({ type: 'chat:agent', data: { text: response, ts: Date.now() } });
-                // 3. Save conversation to long-term memory
-                await memory.saveConversation('dashboard', // channelId (fixed for dashboard)
-                'dashboard-user', // userId
-                'User', // userName
-                message, response);
-                console.log(`[Dashboard Chat] Saved to memory (${message.length} + ${response.length} chars)`);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ ok: true, response, provider: result.provider, model: result.model }));
-                // ---- Service control: status ----
-            }
-            else if (url === '/api/service/status' && req.method === 'GET') {
-                try {
-                    const result = await new Promise((resolve) => {
-                        execFile('systemctl', ['--user', 'is-active', 'openswarm'], (_err, stdout) => {
-                            resolve(stdout.trim());
-                        });
-                    });
+                else if (url === '/api/stages' && req.method === 'GET') {
+                    // 성능 최적화: 최근 100개 스테이지만 반환 (응답 시간 단축)
+                    const allStages = getStageBuffer();
+                    const recentStages = allStages.slice(-100);
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ status: result }));
-                }
-                catch {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ status: 'unknown' }));
+                    res.end(JSON.stringify(recentStages));
+                    // ---- Chat message ----
                 }
-                // ---- Service control: stop ----
-            }
-            else if (url === '/api/service/stop' && req.method === 'POST') {
-                try {
-                    await new Promise((resolve, reject) => {
-                        execFile('systemctl', ['--user', 'stop', 'openswarm'], (err) => {
-                            if (err)
-                                reject(err);
-                            else
-                                resolve();
-                        });
+                else if (url === '/api/chat' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    let message;
+                    try {
+                        message = JSON.parse(body).message?.trim();
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                        return;
+                    }
+                    if (!message) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Empty message' }));
+                        return;
+                    }
+                    broadcastEvent({ type: 'chat:user', data: { text: message, ts: Date.now() } });
+                    // Build context-aware prompt (including previous conversation)
+                    const stats = runnerRef?.getStats();
+                    const projects = runnerRef?.getProjectsInfo() ?? [];
+                    const enabled = projects.filter(p => p.enabled).length;
+                    const state = runnerRef?.getState();
+                    const uptimeSec = state?.startedAt ? Math.floor((Date.now() - state.startedAt) / 1000) : 0;
+                    // 1. Short-term memory: recent chat buffer
+                    const chatBuf = getChatBuffer()
+                        .filter((ev) => ev.type === 'chat:user' || ev.type === 'chat:agent');
+                    const recentHistory = chatBuf.slice(-11, -1);
+                    const historyBlock = recentHistory.length > 0
+                        ? recentHistory.map(m => (m.type === 'chat:user' ? 'User' : 'OpenSwarm') + ': ' + m.data.text).join('\n\n')
+                        : '';
+                    // 2. Long-term memory: semantic search (shared with Discord)
+                    const memories = await memory.searchMemory(message, {
+                        types: ['journal'],
+                        repo: 'chat', // Shared repo for both Discord and Dashboard
+                        limit: 5,
+                        minSimilarity: 0.4,
+                        minTrust: 0.5,
                     });
+                    const memoryContext = memories.length > 0
+                        ? '## Relevant Past Discussions\n' + memories.map(m => `- ${m.content.replace(/^Q: |^A: /g, '')}`).join('\n')
+                        : '';
+                    const provider = runnerRef?.getAdapterSummary().defaultAdapter ?? 'codex';
+                    const model = runnerRef?.getAdapterSummary().worker?.model ?? getDefaultChatModel(provider);
+                    const contextPrompt = [
+                        'You are OpenSwarm, an autonomous code development supervisor.',
+                        'You manage a fleet of coding agents that autonomously work on Linear issues.',
+                        `Current chat provider: ${provider}`,
+                        `Current chat model: ${model}`,
+                        '',
+                        'Current system status:',
+                        '- Running tasks: ' + (stats?.schedulerStats?.running ?? 0),
+                        '- Queued tasks: ' + (stats?.schedulerStats?.queued ?? 0),
+                        '- Completed today: ' + (stats?.schedulerStats?.completed ?? 0),
+                        '- Active repos: ' + enabled + '/' + projects.length,
+                        '- Uptime: ' + uptimeSec + 's',
+                        '',
+                        ...(historyBlock ? [
+                            'Conversation history (most recent first):',
+                            historyBlock,
+                            '',
+                        ] : []),
+                        ...(memoryContext ? [memoryContext, ''] : []),
+                        'Answer the user concisely and helpfully in the same language they use. Use the status data above if relevant.',
+                        '',
+                        'User: ' + message,
+                    ].join('\n');
+                    const result = await runChatCompletion({
+                        prompt: contextPrompt,
+                        provider,
+                        model,
+                        cwd: process.cwd(),
+                        timeoutMs: 180000,
+                    }).catch((error) => ({
+                        response: `[Error: ${error.message}]`,
+                        provider,
+                        model,
+                        cost: undefined,
+                        tokens: undefined,
+                    }));
+                    const response = result.response;
+                    if (result.cost !== undefined) {
+                        console.log(`[Web Chat] Cost: ${formatCost({
+                            costUsd: result.cost,
+                            inputTokens: result.tokens ?? 0,
+                            outputTokens: 0,
+                            cacheReadTokens: 0,
+                            cacheCreationTokens: 0,
+                            durationMs: 0,
+                            model: result.model,
+                        })}`);
+                    }
+                    broadcastEvent({ type: 'chat:agent', data: { text: response, ts: Date.now() } });
+                    // 3. Save conversation to long-term memory
+                    await memory.saveConversation('dashboard', // channelId (fixed for dashboard)
+                    'dashboard-user', // userId
+                    'User', // userName
+                    message, response);
+                    console.log(`[Dashboard Chat] Saved to memory (${message.length} + ${response.length} chars)`);
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
+                    res.end(JSON.stringify({ ok: true, response, provider: result.provider, model: result.model }));
+                    // ---- Service control: status ----
                 }
-                catch (e) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(e) }));
-                }
-                // ---- Service control: restart ----
-            }
-            else if (url === '/api/service/restart' && req.method === 'POST') {
-                try {
-                    await new Promise((resolve, reject) => {
-                        execFile('systemctl', ['--user', 'restart', 'openswarm'], (err) => {
-                            if (err)
-                                reject(err);
-                            else
-                                resolve();
+                else if (url === '/api/service/status' && req.method === 'GET') {
+                    try {
+                        const result = await new Promise((resolve) => {
+                            execFile('systemctl', ['--user', 'is-active', 'openswarm'], (_err, stdout) => {
+                                resolve(stdout.trim());
+                            });
                         });
-                    });
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
-                }
-                catch (e) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(e) }));
-                }
-                // ---- Knowledge Graph: project health ----
-            }
-            else if (url.startsWith('/api/knowledge/') && req.method === 'GET') {
-                const projectSlug = url.replace('/api/knowledge/', '').split('?')[0];
-                if (!projectSlug) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Missing project slug' }));
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ status: result }));
+                    }
+                    catch {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ status: 'unknown' }));
+                    }
+                    // ---- Service control: stop ----
                 }
-                else {
+                else if (url === '/api/service/stop' && req.method === 'POST') {
                     try {
-                        const graph = await getGraph(projectSlug);
-                        if (!graph) {
-                            res.writeHead(404, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({ error: 'Graph not found. Run a scan first.' }));
-                        }
-                        else {
-                            const health = getProjectHealth(graph);
-                            res.writeHead(200, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({
-                                slug: projectSlug,
-                                scannedAt: graph.scannedAt,
-                                nodeCount: graph.nodeCount,
-                                edgeCount: graph.edgeCount,
-                                ...health,
-                            }));
-                        }
+                        await new Promise((resolve, reject) => {
+                            execFile('systemctl', ['--user', 'stop', 'openswarm'], (err) => {
+                                if (err)
+                                    reject(err);
+                                else
+                                    resolve();
+                            });
+                        });
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
                     }
                     catch (e) {
                         res.writeHead(500, { 'Content-Type': 'application/json' });
                         res.end(JSON.stringify({ error: safeErrorMessage(e) }));
                     }
+                    // ---- Service control: restart ----
                 }
-                // ---- Knowledge Graph: list all ----
-            }
-            else if (url === '/api/knowledge' && req.method === 'GET') {
-                try {
-                    const slugs = await listGraphs();
-                    const result = [];
-                    for (const slug of slugs) {
-                        const graph = await getGraph(slug);
-                        if (graph) {
-                            result.push({
-                                slug,
-                                nodeCount: graph.nodeCount,
-                                edgeCount: graph.edgeCount,
-                                scannedAt: graph.scannedAt,
-                                summary: graph.buildSummary(),
+                else if (url === '/api/service/restart' && req.method === 'POST') {
+                    try {
+                        await new Promise((resolve, reject) => {
+                            execFile('systemctl', ['--user', 'restart', 'openswarm'], (err) => {
+                                if (err)
+                                    reject(err);
+                                else
+                                    resolve();
                             });
-                        }
+                        });
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
                     }
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(result));
-                }
-                catch (e) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(e) }));
+                    catch (e) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(e) }));
+                    }
+                    // ---- Knowledge Graph: project health ----
                 }
-                // ---- Knowledge Graph: trigger scan ----
-            }
-            else if (url === '/api/knowledge/scan' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { projectPath } = JSON.parse(body);
-                    if (!projectPath) {
+                else if (url.startsWith('/api/knowledge/') && req.method === 'GET') {
+                    const projectSlug = url.replace('/api/knowledge/', '').split('?')[0];
+                    if (!projectSlug) {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Missing projectPath' }));
+                        res.end(JSON.stringify({ error: 'Missing project slug' }));
                     }
                     else {
-                        const resolvedPath = projectPath.replace('~', homedir());
-                        res.writeHead(202, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ ok: true, slug: toProjectSlug(resolvedPath) }));
-                        // Non-blocking scan
-                        scanAndCache(resolvedPath, { force: true }).catch(e => console.error('[Web] Knowledge scan error:', e));
+                        try {
+                            const graph = await getGraph(projectSlug);
+                            if (!graph) {
+                                res.writeHead(404, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: 'Graph not found. Run a scan first.' }));
+                            }
+                            else {
+                                const health = getProjectHealth(graph);
+                                res.writeHead(200, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({
+                                    slug: projectSlug,
+                                    scannedAt: graph.scannedAt,
+                                    nodeCount: graph.nodeCount,
+                                    edgeCount: graph.edgeCount,
+                                    ...health,
+                                }));
+                            }
+                        }
+                        catch (e) {
+                            res.writeHead(500, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: safeErrorMessage(e) }));
+                        }
                     }
+                    // ---- Knowledge Graph: list all ----
                 }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                else if (url === '/api/knowledge' && req.method === 'GET') {
+                    try {
+                        const slugs = await listGraphs();
+                        const result = [];
+                        for (const slug of slugs) {
+                            const graph = await getGraph(slug);
+                            if (graph) {
+                                result.push({
+                                    slug,
+                                    nodeCount: graph.nodeCount,
+                                    edgeCount: graph.edgeCount,
+                                    scannedAt: graph.scannedAt,
+                                    summary: graph.buildSummary(),
+                                });
+                            }
+                        }
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(result));
+                    }
+                    catch (e) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(e) }));
+                    }
+                    // ---- Knowledge Graph: trigger scan ----
                 }
-                // ---- Pipeline history (time-ordered) ----
-            }
-            else if (url === '/api/pipeline/history' && req.method === 'GET') {
-                const limitParam = (req.url?.split('?')[1] || '').match(/limit=(\d+)/);
-                const limit = limitParam ? Math.min(Number(limitParam[1]), 100) : 50;
-                const history = runnerRef?.getPipelineHistory(limit) ?? [];
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(history));
-                // ---- Monitors: list ----
-            }
-            else if (url === '/api/monitors' && req.method === 'GET') {
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(getActiveMonitors()));
-                // ---- Monitors: register ----
-            }
-            else if (url === '/api/monitors' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const config = JSON.parse(body);
-                    if (!config.id ||
-                        !config.name ||
-                        !Array.isArray(config.checkCommand) ||
-                        config.checkCommand.length === 0 ||
-                        !config.completionCheck) {
+                else if (url === '/api/knowledge/scan' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { projectPath } = JSON.parse(body);
+                        if (!projectPath) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Missing projectPath' }));
+                        }
+                        else {
+                            const resolvedPath = projectPath.replace('~', homedir());
+                            res.writeHead(202, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ ok: true, slug: toProjectSlug(resolvedPath) }));
+                            // Non-blocking scan
+                            scanAndCache(resolvedPath, { force: true }).catch(e => console.error('[Web] Knowledge scan error:', e));
+                        }
+                    }
+                    catch {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({
-                            error: 'Missing or invalid required fields: id, name, checkCommand (string[]), completionCheck',
-                        }));
-                        return;
+                        res.end(JSON.stringify({ error: 'Invalid JSON' }));
                     }
-                    const monitor = registerMonitor(config);
-                    res.writeHead(201, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(monitor));
+                    // ---- Pipeline history (time-ordered) ----
                 }
-                catch (e) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(e) }));
-                }
-                // ---- Monitors: delete ----
-            }
-            else if (url.startsWith('/api/monitors/') && req.method === 'DELETE') {
-                const monitorId = url.replace('/api/monitors/', '');
-                const deleted = unregisterMonitor(monitorId);
-                res.writeHead(deleted ? 200 : 404, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ ok: deleted }));
-                // ---- Processes: list ----
-            }
-            else if (url === '/api/processes' && req.method === 'GET') {
-                // Spawned CLI subprocesses (PID-tracked) + in-process pipeline tasks. Native
-                // adapters (codex-responses/openrouter/local) run the worker/reviewer in-process
-                // with no child PID, so without the pipeline entries the panel looks empty even
-                // while tasks are actively running.
-                const subprocs = getAllProcesses().map((p) => ({ ...p, kind: 'subprocess', id: String(p.pid) }));
-                const pipelines = (runnerRef?.getRunningPipelines() ?? []).map((t) => ({
-                    kind: 'pipeline',
-                    id: t.id,
-                    pid: null,
-                    taskId: t.issue ?? t.title,
-                    project: t.project,
-                    stage: t.stage ?? 'running',
-                    projectPath: t.projectPath,
-                    spawnedAt: t.startedAt,
-                    lastActivityAt: t.startedAt,
-                }));
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify([...pipelines, ...subprocs]));
-                // ---- Processes: kill (PID) or cancel (pipeline task id) ----
-            }
-            else if (url.startsWith('/api/processes/') && req.method === 'DELETE') {
-                const idStr = decodeURIComponent(url.replace('/api/processes/', ''));
-                const pid = parseInt(idStr, 10);
-                if (!isNaN(pid) && String(pid) === idStr) {
-                    const killed = await killProcess(pid);
-                    res.writeHead(killed ? 200 : 404, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: killed }));
+                else if (url === '/api/pipeline/history' && req.method === 'GET') {
+                    const limitParam = (req.url?.split('?')[1] || '').match(/limit=(\d+)/);
+                    const limit = limitParam ? Math.min(Number(limitParam[1]), 100) : 50;
+                    const history = runnerRef?.getPipelineHistory(limit) ?? [];
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(history));
+                    // ---- Monitors: list ----
                 }
-                else {
-                    // Non-numeric id → in-process pipeline task: abort it (and its adapter call).
-                    const cancelled = runnerRef?.cancelTask(idStr) ?? false;
-                    res.writeHead(cancelled ? 200 : 404, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: cancelled }));
+                else if (url === '/api/monitors' && req.method === 'GET') {
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(getActiveMonitors()));
+                    // ---- Monitors: register ----
                 }
-                // ---- Scan Paths: list ----
-            }
-            else if (url === '/api/scan-paths' && req.method === 'GET') {
-                // removedConfigPaths에 있는 경로는 UI에 표시하지 않음
-                const allConfigPaths = runnerRef?.getAllowedProjects() ?? [];
-                const configPaths = allConfigPaths.filter(p => !removedConfigPaths.has(p));
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    configPaths,
-                    customPaths: Array.from(customBasePaths),
-                }));
-                // ---- Scan Paths: add ----
-            }
-            else if (url === '/api/scan-paths' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { path: newPath } = JSON.parse(body);
-                    if (typeof newPath !== 'string' || !newPath.trim()) {
-                        res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Missing path' }));
+                else if (url === '/api/monitors' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const config = JSON.parse(body);
+                        if (!config.id ||
+                            !config.name ||
+                            !Array.isArray(config.checkCommand) ||
+                            config.checkCommand.length === 0 ||
+                            !config.completionCheck) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({
+                                error: 'Missing or invalid required fields: id, name, checkCommand (string[]), completionCheck',
+                            }));
+                            return;
+                        }
+                        const monitor = registerMonitor(config);
+                        res.writeHead(201, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(monitor));
                     }
-                    else {
-                        customBasePaths.add(newPath.trim());
-                        invalidateProjectCache();
-                        // Update runner's allowedProjects with merged list
-                        const configPaths = runnerRef?.getAllowedProjects() ?? [];
-                        const merged = [...new Set([...configPaths, ...customBasePaths])];
-                        runnerRef?.updateAllowedProjects(merged);
-                        saveReposConfig();
-                        res.writeHead(200, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ ok: true }));
+                    catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(e) }));
                     }
+                    // ---- Monitors: delete ----
                 }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                else if (url.startsWith('/api/monitors/') && req.method === 'DELETE') {
+                    const monitorId = url.replace('/api/monitors/', '');
+                    const deleted = unregisterMonitor(monitorId);
+                    res.writeHead(deleted ? 200 : 404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: deleted }));
+                    // ---- Processes: list ----
                 }
-                // ---- Scan Paths: remove ----
-            }
-            else if (url.startsWith('/api/scan-paths/') && req.method === 'DELETE') {
-                const encodedPath = url.replace('/api/scan-paths/', '');
-                const decodedPath = decodeURIComponent(encodedPath);
-                // customPaths에서 제거
-                customBasePaths.delete(decodedPath);
-                // configPaths에서도 제거: removedConfigPaths에 기록하고 runner에서 즉시 반영
-                const allConfigPaths = runnerRef?.getAllowedProjects() ?? [];
-                if (allConfigPaths.includes(decodedPath)) {
-                    removedConfigPaths.add(decodedPath);
-                    runnerRef?.updateAllowedProjects(allConfigPaths.filter(p => p !== decodedPath));
+                else if (url === '/api/processes' && req.method === 'GET') {
+                    // Spawned CLI subprocesses (PID-tracked) + in-process pipeline tasks. Native
+                    // adapters (codex-responses/openrouter/local) run the worker/reviewer in-process
+                    // with no child PID, so without the pipeline entries the panel looks empty even
+                    // while tasks are actively running.
+                    const subprocs = getAllProcesses().map((p) => ({ ...p, kind: 'subprocess', id: String(p.pid) }));
+                    const pipelines = (runnerRef?.getRunningPipelines() ?? []).map((t) => ({
+                        kind: 'pipeline',
+                        id: t.id,
+                        pid: null,
+                        taskId: t.issue ?? t.title,
+                        project: t.project,
+                        stage: t.stage ?? 'running',
+                        projectPath: t.projectPath,
+                        spawnedAt: t.startedAt,
+                        lastActivityAt: t.startedAt,
+                    }));
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify([...pipelines, ...subprocs]));
+                    // ---- Processes: kill (PID) or cancel (pipeline task id) ----
                 }
-                invalidateProjectCache();
-                saveReposConfig();
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ ok: true }));
-                // ---- Filesystem browse (folder picker) ----
-                // GET /api/fs/list?path=<absolute or ~/...>
-                // Returns: { path, parent, entries: [{name, isDir}] } — dotfiles excluded, dirs first.
-            }
-            else if (url.startsWith('/api/fs/list') && req.method === 'GET') {
-                try {
-                    const qs = url.split('?')[1] ?? '';
-                    const params = new URLSearchParams(qs);
-                    const requested = params.get('path')?.trim();
-                    const startPath = requested && requested.length > 0
-                        ? requested
-                        : homedir();
-                    const expanded = startPath.startsWith('~')
-                        ? join(homedir(), startPath.slice(1))
-                        : startPath;
-                    const absolute = resolvePath(expanded);
-                    const st = await stat(absolute);
-                    if (!st.isDirectory()) {
-                        res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Not a directory', path: absolute }));
-                        return;
+                else if (url.startsWith('/api/processes/') && req.method === 'DELETE') {
+                    const idStr = decodeURIComponent(url.replace('/api/processes/', ''));
+                    const pid = parseInt(idStr, 10);
+                    if (!isNaN(pid) && String(pid) === idStr) {
+                        const killed = await killProcess(pid);
+                        res.writeHead(killed ? 200 : 404, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: killed }));
                     }
-                    const raw = await readdir(absolute, { withFileTypes: true });
-                    const entries = raw
-                        .filter((d) => !d.name.startsWith('.'))
-                        .map((d) => ({ name: d.name, isDir: d.isDirectory() }))
-                        .sort((a, b) => {
-                        if (a.isDir !== b.isDir)
-                            return a.isDir ? -1 : 1;
-                        return a.name.localeCompare(b.name);
-                    });
-                    const parent = dirname(absolute);
+                    else {
+                        // Non-numeric id → in-process pipeline task: abort it (and its adapter call).
+                        const cancelled = runnerRef?.cancelTask(idStr) ?? false;
+                        res.writeHead(cancelled ? 200 : 404, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: cancelled }));
+                    }
+                    // ---- Scan Paths: list ----
+                }
+                else if (url === '/api/scan-paths' && req.method === 'GET') {
+                    // removedConfigPaths에 있는 경로는 UI에 표시하지 않음
+                    const allConfigPaths = runnerRef?.getAllowedProjects() ?? [];
+                    const configPaths = allConfigPaths.filter(p => !removedConfigPaths.has(p));
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({
-                        path: absolute,
-                        parent: parent === absolute ? null : parent,
-                        name: basename(absolute) || absolute,
-                        entries,
+                        configPaths,
+                        customPaths: Array.from(customBasePaths),
                     }));
+                    // ---- Scan Paths: add ----
                 }
-                catch (e) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: safeErrorMessage(e) }));
-                }
-                // ---- Discord history (legacy) ----
-            }
-            else if (url === '/api/history') {
-                const history = await getChatHistory();
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(history));
-                // ---- Exec: submit task ----
-            }
-            else if (url === '/api/exec' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { prompt, projectPath, pipeline, workerOnly, model } = JSON.parse(body);
-                    if (!prompt?.trim()) {
+                else if (url === '/api/scan-paths' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { path: newPath } = JSON.parse(body);
+                        if (typeof newPath !== 'string' || !newPath.trim()) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Missing path' }));
+                        }
+                        else {
+                            customBasePaths.add(newPath.trim());
+                            invalidateProjectCache();
+                            // Update runner's allowedProjects with merged list
+                            const configPaths = runnerRef?.getAllowedProjects() ?? [];
+                            const merged = [...new Set([...configPaths, ...customBasePaths])];
+                            runnerRef?.updateAllowedProjects(merged);
+                            saveReposConfig();
+                            res.writeHead(200, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ ok: true }));
+                        }
+                    }
+                    catch {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Missing prompt' }));
-                        return;
+                        res.end(JSON.stringify({ error: 'Invalid JSON' }));
                     }
-                    const taskId = startExecTask(prompt, { projectPath, pipeline, workerOnly, model });
-                    res.writeHead(202, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ taskId, status: 'queued' }));
+                    // ---- Scan Paths: remove ----
                 }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                else if (url.startsWith('/api/scan-paths/') && req.method === 'DELETE') {
+                    const encodedPath = url.replace('/api/scan-paths/', '');
+                    const decodedPath = decodeURIComponent(encodedPath);
+                    // customPaths에서 제거
+                    customBasePaths.delete(decodedPath);
+                    // configPaths에서도 제거: removedConfigPaths에 기록하고 runner에서 즉시 반영
+                    const allConfigPaths = runnerRef?.getAllowedProjects() ?? [];
+                    if (allConfigPaths.includes(decodedPath)) {
+                        removedConfigPaths.add(decodedPath);
+                        runnerRef?.updateAllowedProjects(allConfigPaths.filter(p => p !== decodedPath));
+                    }
+                    invalidateProjectCache();
+                    saveReposConfig();
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true }));
+                    // ---- Filesystem browse (folder picker) ----
+                    // GET /api/fs/list?path=<absolute or ~/...>
+                    // Returns: { path, parent, entries: [{name, isDir}] } — dotfiles excluded, dirs first.
                 }
-                // ---- Plan dispatch: TUI /plan cockpit → daemon loop ----
-            }
-            else if (url === '/api/plan/dispatch' && req.method === 'POST') {
-                const body = await readBody(req);
-                try {
-                    const { goal, projectPath, subTasks } = JSON.parse(body);
-                    if (!goal?.trim()) {
+                else if (url.startsWith('/api/fs/list') && req.method === 'GET') {
+                    try {
+                        const requested = requestUrl.searchParams.get('path')?.trim();
+                        const startPath = requested && requested.length > 0
+                            ? requested
+                            : homedir();
+                        const expanded = startPath.startsWith('~')
+                            ? join(homedir(), startPath.slice(1))
+                            : startPath;
+                        const absolute = resolvePath(expanded);
+                        const st = await stat(absolute);
+                        if (!st.isDirectory()) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Not a directory', path: absolute }));
+                            return;
+                        }
+                        const raw = await readdir(absolute, { withFileTypes: true });
+                        const entries = raw
+                            .filter((d) => !d.name.startsWith('.'))
+                            .map((d) => ({ name: d.name, isDir: d.isDirectory() }))
+                            .sort((a, b) => {
+                            if (a.isDir !== b.isDir)
+                                return a.isDir ? -1 : 1;
+                            return a.name.localeCompare(b.name);
+                        });
+                        const parent = dirname(absolute);
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            path: absolute,
+                            parent: parent === absolute ? null : parent,
+                            name: basename(absolute) || absolute,
+                            entries,
+                        }));
+                    }
+                    catch (e) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: safeErrorMessage(e) }));
+                    }
+                    // ---- Discord history (legacy) ----
+                }
+                else if (url === '/api/history') {
+                    const history = await getChatHistory();
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(history));
+                    // ---- Exec: submit task ----
+                }
+                else if (url === '/api/exec' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { prompt, projectPath, pipeline, workerOnly, model } = JSON.parse(body);
+                        if (!prompt?.trim()) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Missing prompt' }));
+                            return;
+                        }
+                        const taskId = startExecTask(prompt, { projectPath, pipeline, workerOnly, model });
+                        res.writeHead(202, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ taskId, status: 'queued' }));
+                    }
+                    catch {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Missing goal' }));
-                        return;
+                        res.end(JSON.stringify({ error: 'Invalid JSON' }));
                     }
-                    const resolvedPath = projectPath ?? process.cwd();
-                    const tasks = Array.isArray(subTasks) ? subTasks : [];
-                    const triggerHeartbeat = () => {
-                        runnerRef?.heartbeat().catch((e) => console.error('[Web] plan heartbeat error:', e));
-                    };
-                    // Path A — a task source is registered (Linear OR local SQLite): create a
-                    // parent issue + dependency-wired sub-issues (reusing the autonomous
-                    // engine, which routes through the same source), then heartbeat.
-                    const source = getTaskSource();
-                    if (source) {
-                        const parent = await source.createTask(goal, `Planned via the \`/plan\` cockpit.\n\n${tasks.length} sub-task(s) dispatched.`);
-                        if ('error' in parent) {
-                            res.writeHead(502, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({ error: `Task source: ${parent.error}` }));
+                    // ---- Plan dispatch: TUI /plan cockpit → daemon loop ----
+                }
+                else if (url === '/api/plan/dispatch' && req.method === 'POST') {
+                    const body = await readBody(req);
+                    try {
+                        const { goal, projectPath, subTasks } = JSON.parse(body);
+                        if (!goal?.trim()) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Missing goal' }));
                             return;
                         }
-                        if (tasks.length === 0) {
-                            // Planner saw no decomposition — run the goal itself as one task.
-                            await source.updateState(parent.id, 'Todo').catch(() => { });
-                            triggerHeartbeat();
+                        const resolvedPath = projectPath ?? process.cwd();
+                        const tasks = Array.isArray(subTasks) ? subTasks : [];
+                        const triggerHeartbeat = () => {
+                            runnerRef?.heartbeat().catch((e) => console.error('[Web] plan heartbeat error:', e));
+                        };
+                        // Path A — a task source is registered (Linear OR local SQLite): create a
+                        // parent issue + dependency-wired sub-issues (reusing the autonomous
+                        // engine, which routes through the same source), then heartbeat.
+                        const source = getTaskSource();
+                        if (source) {
+                            const parent = await source.createTask(goal, `Planned via the \`/plan\` cockpit.\n\n${tasks.length} sub-task(s) dispatched.`);
+                            if ('error' in parent) {
+                                res.writeHead(502, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: `Task source: ${parent.error}` }));
+                                return;
+                            }
+                            if (tasks.length === 0) {
+                                // Planner saw no decomposition — run the goal itself as one task.
+                                await source.updateState(parent.id, 'Todo').catch(() => { });
+                                triggerHeartbeat();
+                                res.writeHead(200, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({
+                                    mode: source.kind,
+                                    parentIssue: { id: parent.id, identifier: parent.identifier },
+                                    subIssues: [],
+                                }));
+                                return;
+                            }
+                            const totalMinutes = tasks.reduce((sum, t) => sum + (t.estimatedMinutes || 0), 0);
+                            await createSubIssuesWithDependencies(parent.id, { title: goal }, tasks, totalMinutes, { reportToDiscord: () => { }, scheduleNextHeartbeat: triggerHeartbeat }, parent.id, 20);
                             res.writeHead(200, { 'Content-Type': 'application/json' });
                             res.end(JSON.stringify({
                                 mode: source.kind,
                                 parentIssue: { id: parent.id, identifier: parent.identifier },
-                                subIssues: [],
                             }));
                             return;
                         }
-                        const totalMinutes = tasks.reduce((sum, t) => sum + (t.estimatedMinutes || 0), 0);
-                        await createSubIssuesWithDependencies(parent.id, { title: goal }, tasks, totalMinutes, { reportToDiscord: () => { }, scheduleNextHeartbeat: triggerHeartbeat }, parent.id, 20);
+                        // Path B (fallback) — no Linear: run each sub-task via the exec pipeline.
+                        const items = tasks.length > 0
+                            ? tasks
+                            : [{ title: goal, description: goal, estimatedMinutes: 0, priority: 3 }];
+                        const taskIds = items.map((st) => startExecTask(`${st.title}\n\n${st.description ?? ''}`.trim(), {
+                            projectPath: resolvedPath,
+                            pipeline: true,
+                        }));
+                        res.writeHead(202, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ mode: 'exec', taskIds }));
+                    }
+                    catch (err) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: err instanceof Error ? err.message : 'Invalid JSON' }));
+                    }
+                    // ---- Exec: task status ----
+                }
+                else if (url.startsWith('/api/exec/') && req.method === 'GET') {
+                    const taskId = url.replace('/api/exec/', '');
+                    const entry = execTasks.get(taskId);
+                    if (!entry) {
+                        res.writeHead(404, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Task not found' }));
+                    }
+                    else {
                         res.writeHead(200, { 'Content-Type': 'application/json' });
                         res.end(JSON.stringify({
-                            mode: source.kind,
-                            parentIssue: { id: parent.id, identifier: parent.identifier },
+                            taskId: entry.taskId,
+                            status: entry.status,
+                            currentStage: entry.currentStage,
+                            result: entry.result,
+                            error: entry.error,
                         }));
-                        return;
                     }
-                    // Path B (fallback) — no Linear: run each sub-task via the exec pipeline.
-                    const items = tasks.length > 0
-                        ? tasks
-                        : [{ title: goal, description: goal, estimatedMinutes: 0, priority: 3 }];
-                    const taskIds = items.map((st) => startExecTask(`${st.title}\n\n${st.description ?? ''}`.trim(), {
-                        projectPath: resolvedPath,
-                        pipeline: true,
-                    }));
-                    res.writeHead(202, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ mode: 'exec', taskIds }));
-                }
-                catch (err) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: err instanceof Error ? err.message : 'Invalid JSON' }));
-                }
-                // ---- Exec: task status ----
-            }
-            else if (url.startsWith('/api/exec/') && req.method === 'GET') {
-                const taskId = url.replace('/api/exec/', '');
-                const entry = execTasks.get(taskId);
-                if (!entry) {
-                    res.writeHead(404, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Task not found' }));
                 }
                 else {
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        taskId: entry.taskId,
-                        status: entry.status,
-                        currentStage: entry.currentStage,
-                        result: entry.result,
-                        error: entry.error,
-                    }));
+                    res.writeHead(404);
+                    res.end('Not Found');
                 }
             }
-            else {
-                res.writeHead(404);
-                res.end('Not Found');
+            catch (err) {
+                const statusCode = err instanceof HttpError ? err.statusCode : 500;
+                writeJson(res, statusCode, {
+                    error: err instanceof HttpError ? err.message : safeErrorMessage(err),
+                });
             }
         });
         server.on('error', (err) => {