@joshuaswarren/openclaw-engram 9.0.68 → 9.0.70

package/dist/index.js

@@ -3509,7 +3509,6 @@ Respond with valid JSON matching this schema:
         },
         { role: "user", content: conversation }
       ],
-      temperature: 0.3,
       ...buildChatCompletionTokenLimit(this.config.model, 4096, {
         assumeOpenAI: this.directClientUsesOpenAiTokenSemantics()
       })
@@ -3785,7 +3784,6 @@ Respond with valid JSON only, matching this schema:
           { role: "user", content: "Consolidate the new memories against existing ones." }
         ],
         ...this.config.reasoningEffort !== "none" ? { reasoning_effort: this.config.reasoningEffort } : {},
-        temperature: 0.3,
         ...buildChatCompletionTokenLimit(this.config.model, 4096, {
           assumeOpenAI: this.directClientUsesOpenAiTokenSemantics()
         })
@@ -4013,7 +4011,6 @@ Respond with valid JSON matching this schema:
           { role: "user", content: fullProfileContent }
         ],
         ...this.config.reasoningEffort !== "none" ? { reasoning_effort: this.config.reasoningEffort } : {},
-        temperature: 0.3,
         ...buildChatCompletionTokenLimit(this.config.model, 4096, {
           assumeOpenAI: this.directClientUsesOpenAiTokenSemantics()
         })
@@ -4209,7 +4206,6 @@ Respond with valid JSON matching this schema:
           { role: "user", content: fullIdentityContent }
         ],
         ...this.config.reasoningEffort !== "none" ? { reasoning_effort: this.config.reasoningEffort } : {},
-        temperature: 0.3,
         ...buildChatCompletionTokenLimit(this.config.model, 4096, {
           assumeOpenAI: this.directClientUsesOpenAiTokenSemantics()
         })
@@ -4407,7 +4403,6 @@ Respond with valid JSON matching this schema:
           { role: "system", content: systemPrompt },
           { role: "user", content: input }
         ],
-        temperature: 0.3,
         ...buildChatCompletionTokenLimit(this.config.model, 2048, {
           assumeOpenAI: this.directClientUsesOpenAiTokenSemantics()
         })
@@ -4511,7 +4506,6 @@ Respond with valid JSON matching this schema:
           { role: "system", content: systemPrompt },
           { role: "user", content: input }
         ],
-        temperature: 0.3,
         ...buildChatCompletionTokenLimit(this.config.model, 2048, {
           assumeOpenAI: this.directClientUsesOpenAiTokenSemantics()
         })
@@ -4611,7 +4605,6 @@ ${memoryList}` }
 
 ${memoryList}` }
         ],
-        temperature: 0.3,
         ...buildChatCompletionTokenLimit(this.config.model, 4096, {
           assumeOpenAI: this.directClientUsesOpenAiTokenSemantics()
         })
@@ -34222,786 +34215,812 @@ var EngramAccessService = class {
 import { createServer as createServer3 } from "http";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { existsSync as existsSync5 } from "fs";
-import { readFile as readFile38 } from "fs/promises";
+import { readFile as readFile39 } from "fs/promises";
 import path64 from "path";
 import { fileURLToPath as fileURLToPath2, URL as URL3 } from "url";
-function resolveDefaultAdminConsolePublicDir() {
-  const candidates = [
-    fileURLToPath2(new URL3("../admin-console/public", import.meta.url)),
-    fileURLToPath2(new URL3("./admin-console/public", import.meta.url))
-  ];
-  return candidates.find((candidate) => existsSync5(candidate)) ?? candidates[0];
-}
-var defaultAdminConsolePublicDir = resolveDefaultAdminConsolePublicDir();
-var WRITE_RATE_LIMIT_WINDOW_MS = 6e4;
-var WRITE_RATE_LIMIT_MAX_REQUESTS = 30;
-var HttpError = class extends Error {
-  constructor(status, message) {
-    super(message);
-    this.status = status;
-  }
-};
-function hostToUrlAuthority2(host) {
-  if (host.includes(":") && !host.startsWith("[") && !host.endsWith("]")) {
-    return `[${host}]`;
+
+// src/access-mcp.ts
+import { readFile as readFile38 } from "fs/promises";
+var MCP_PROTOCOL_VERSION = "2024-11-05";
+async function getMcpServerVersion() {
+  const envVersion = process.env.OPENCLAW_ENGRAM_VERSION?.trim() || process.env.npm_package_version?.trim();
+  if (envVersion) return envVersion;
+  try {
+    const pkgPath = new URL("../package.json", import.meta.url);
+    const raw = await readFile38(pkgPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return parsed.version?.trim() || "unknown";
+  } catch {
+    return "unknown";
   }
-  return host;
 }
-var EngramAccessHttpServer = class {
-  service;
-  host;
-  requestedPort;
-  authToken;
-  authenticatedPrincipal;
-  maxBodyBytes;
-  adminConsoleEnabled;
-  adminConsolePublicDir;
-  writeRequestTimestamps = [];
-  server = null;
-  boundPort = 0;
-  constructor(options) {
-    this.service = options.service;
-    this.host = options.host?.trim() || "127.0.0.1";
-    this.requestedPort = Number.isFinite(options.port) ? Math.max(0, Math.floor(options.port ?? 0)) : 0;
-    this.authToken = options.authToken?.trim() || void 0;
-    this.authenticatedPrincipal = options.principal?.trim() || void 0;
-    this.maxBodyBytes = Number.isFinite(options.maxBodyBytes) ? Math.max(1, Math.floor(options.maxBodyBytes ?? 131072)) : 131072;
-    this.adminConsoleEnabled = options.adminConsoleEnabled !== false;
-    this.adminConsolePublicDir = options.adminConsolePublicDir ?? defaultAdminConsolePublicDir;
-  }
-  async start() {
-    if (!this.authToken) {
-      throw new Error("engram access HTTP requires authToken");
-    }
-    if (this.server) return this.status();
-    const server = createServer3((req, res) => {
-      void this.handle(req, res).catch((err) => {
-        log.debug(`engram access HTTP request failed: ${err}`);
-        if (err instanceof HttpError) {
-          this.respondJson(res, err.status, { error: err.message });
-          return;
+var EngramMcpServer = class {
+  constructor(service, options = {}) {
+    this.service = service;
+    this.authenticatedPrincipal = options.principal?.trim() || process.env.OPENCLAW_ENGRAM_ACCESS_PRINCIPAL?.trim() || void 0;
+    this.tools = [
+      {
+        name: "engram.recall",
+        description: "Recall Engram context for a query.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            query: { type: "string" },
+            sessionKey: { type: "string" },
+            namespace: { type: "string" },
+            topK: { type: "number" },
+            mode: { type: "string", enum: ["auto", "no_recall", "minimal", "full", "graph_mode"] },
+            includeDebug: { type: "boolean" }
+          },
+          required: ["query"],
+          additionalProperties: false
         }
-        if (err instanceof EngramAccessInputError) {
-          this.respondJson(res, 400, { error: err.message });
-          return;
+      },
+      {
+        name: "engram.recall_explain",
+        description: "Return the last recall snapshot for a session or the most recent one.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            sessionKey: { type: "string" },
+            namespace: { type: "string" }
+          },
+          additionalProperties: false
         }
-        if (res.headersSent) {
-          res.destroy(err);
-          return;
+      },
+      {
+        name: "engram.memory_get",
+        description: "Fetch one Engram memory by id.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            memoryId: { type: "string" },
+            namespace: { type: "string" }
+          },
+          required: ["memoryId"],
+          additionalProperties: false
         }
-        this.respondJson(res, 500, { error: "internal_error" });
-      });
-    });
-    try {
-      await new Promise((resolve, reject) => {
-        const onError = (err) => {
-          server.off("listening", onListening);
-          reject(err);
-        };
-        const onListening = () => {
-          server.off("error", onError);
-          resolve();
-        };
-        server.once("error", onError);
-        server.once("listening", onListening);
-        server.listen(this.requestedPort, this.host);
-      });
-    } catch (err) {
-      server.close();
-      throw err;
-    }
-    this.server = server;
-    const address = server.address();
-    this.boundPort = typeof address === "object" && address ? address.port : this.requestedPort;
-    return this.status();
-  }
-  async stop() {
-    if (!this.server) return;
-    const server = this.server;
-    this.server = null;
-    this.boundPort = 0;
-    await new Promise((resolve, reject) => {
-      server.close((err) => err ? reject(err) : resolve());
-    });
-  }
-  status() {
-    return {
-      running: this.server !== null,
-      host: this.host,
-      port: this.boundPort,
-      maxBodyBytes: this.maxBodyBytes
-    };
+      },
+      {
+        name: "engram.memory_timeline",
+        description: "Fetch one Engram memory timeline by id.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            memoryId: { type: "string" },
+            namespace: { type: "string" },
+            limit: { type: "number" }
+          },
+          required: ["memoryId"],
+          additionalProperties: false
+        }
+      },
+      {
+        name: "engram.memory_store",
+        description: "Store an explicit Engram memory through the access layer.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            schemaVersion: { type: "number" },
+            idempotencyKey: { type: "string" },
+            dryRun: { type: "boolean" },
+            sessionKey: { type: "string" },
+            content: { type: "string" },
+            category: { type: "string" },
+            confidence: { type: "number" },
+            namespace: { type: "string" },
+            tags: { type: "array", items: { type: "string" } },
+            entityRef: { type: "string" },
+            ttl: { type: "string" },
+            sourceReason: { type: "string" }
+          },
+          required: ["content"],
+          additionalProperties: false
+        }
+      },
+      {
+        name: "engram.suggestion_submit",
+        description: "Queue a suggested Engram memory for review.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            schemaVersion: { type: "number" },
+            idempotencyKey: { type: "string" },
+            dryRun: { type: "boolean" },
+            sessionKey: { type: "string" },
+            content: { type: "string" },
+            category: { type: "string" },
+            confidence: { type: "number" },
+            namespace: { type: "string" },
+            tags: { type: "array", items: { type: "string" } },
+            entityRef: { type: "string" },
+            ttl: { type: "string" },
+            sourceReason: { type: "string" }
+          },
+          required: ["content"],
+          additionalProperties: false
+        }
+      },
+      {
+        name: "engram.entity_get",
+        description: "Fetch one Engram entity by name.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            namespace: { type: "string" }
+          },
+          required: ["name"],
+          additionalProperties: false
+        }
+      },
+      {
+        name: "engram.review_queue_list",
+        description: "Fetch the latest Engram review queue artifact bundle.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            runId: { type: "string" },
+            namespace: { type: "string" }
+          },
+          additionalProperties: false
+        }
+      }
+    ];
   }
-  async handle(req, res) {
-    const parsed = new URL3(req.url ?? "/", `http://${hostToUrlAuthority2(this.host)}`);
-    const pathname = parsed.pathname;
-    if (this.adminConsoleEnabled && await this.handleAdminConsole(req, res, pathname)) {
-      return;
-    }
-    if (!this.isAuthorized(req)) {
-      res.writeHead(401, {
-        "content-type": "application/json; charset=utf-8",
-        "www-authenticate": "Bearer"
-      });
-      res.end(JSON.stringify({ error: "unauthorized" }));
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/health") {
-      this.respondJson(res, 200, await this.service.health());
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/recall") {
-      const body = await this.readJsonBody(req);
-      const response = await this.service.recall({
-        query: typeof body.query === "string" ? body.query : "",
-        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
-        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
-        topK: typeof body.topK === "number" ? body.topK : void 0,
-        mode: typeof body.mode === "string" ? body.mode : void 0,
-        includeDebug: body.includeDebug === true
-      });
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/recall/explain") {
-      const body = await this.readJsonBody(req);
-      const response = await this.service.recallExplain({
-        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
-        namespace: typeof body.namespace === "string" ? body.namespace : void 0
-      });
-      this.respondJson(res, 200, response);
-      return;
+  buffer = Buffer.alloc(0);
+  flushTask = null;
+  tools;
+  authenticatedPrincipal;
+  async handleRequest(request) {
+    const id = request.id ?? null;
+    const method = request.method ?? "";
+    if (method === "notifications/initialized") return null;
+    if (method === "ping") {
+      return { jsonrpc: "2.0", id, result: {} };
     }
-    if (req.method === "POST" && pathname === "/engram/v1/memories") {
-      const body = await this.readJsonBody(req);
-      const request = {
-        schemaVersion: typeof body.schemaVersion === "number" ? body.schemaVersion : void 0,
-        idempotencyKey: typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0,
-        dryRun: body.dryRun === true,
-        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
-        authenticatedPrincipal: this.authenticatedPrincipal,
-        content: typeof body.content === "string" ? body.content : "",
-        category: typeof body.category === "string" ? body.category : void 0,
-        confidence: typeof body.confidence === "number" ? body.confidence : void 0,
-        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
-        tags: Array.isArray(body.tags) ? body.tags.filter((tag) => typeof tag === "string") : void 0,
-        entityRef: typeof body.entityRef === "string" ? body.entityRef : void 0,
-        ttl: typeof body.ttl === "string" ? body.ttl : void 0,
-        sourceReason: typeof body.sourceReason === "string" ? body.sourceReason : void 0
+    if (method === "initialize") {
+      const version = await getMcpServerVersion();
+      return {
+        jsonrpc: "2.0",
+        id,
+        result: {
+          protocolVersion: MCP_PROTOCOL_VERSION,
+          capabilities: {
+            tools: {}
+          },
+          serverInfo: {
+            name: "openclaw-engram",
+            version
+          }
+        }
       };
-      const idempotencyStatus = await this.service.peekMemoryStoreIdempotency(request);
-      if (idempotencyStatus === "miss" && request.dryRun !== true) {
-        this.ensureWriteRateLimitAvailable();
-      }
-      const response = await this.service.memoryStore(request);
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit();
-      }
-      this.respondJson(res, this.writeResponseStatus(response), response);
-      return;
     }
-    if (req.method === "POST" && pathname === "/engram/v1/suggestions") {
-      const body = await this.readJsonBody(req);
-      const request = {
-        schemaVersion: typeof body.schemaVersion === "number" ? body.schemaVersion : void 0,
-        idempotencyKey: typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0,
-        dryRun: body.dryRun === true,
-        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
-        authenticatedPrincipal: this.authenticatedPrincipal,
-        content: typeof body.content === "string" ? body.content : "",
-        category: typeof body.category === "string" ? body.category : void 0,
-        confidence: typeof body.confidence === "number" ? body.confidence : void 0,
-        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
-        tags: Array.isArray(body.tags) ? body.tags.filter((tag) => typeof tag === "string") : void 0,
-        entityRef: typeof body.entityRef === "string" ? body.entityRef : void 0,
-        ttl: typeof body.ttl === "string" ? body.ttl : void 0,
-        sourceReason: typeof body.sourceReason === "string" ? body.sourceReason : void 0
+    if (method === "tools/list") {
+      return {
+        jsonrpc: "2.0",
+        id,
+        result: {
+          tools: this.tools
+        }
       };
-      const idempotencyStatus = await this.service.peekSuggestionSubmitIdempotency(request);
-      if (idempotencyStatus === "miss" && request.dryRun !== true) {
-        this.ensureWriteRateLimitAvailable();
-      }
-      const response = await this.service.suggestionSubmit(request);
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit();
-      }
-      this.respondJson(res, this.writeResponseStatus(response), response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/memories") {
-      const limitRaw = parseInt(parsed.searchParams.get("limit") ?? "50", 10);
-      const offsetRaw = parseInt(parsed.searchParams.get("offset") ?? "0", 10);
-      const sortParam = parsed.searchParams.get("sort") ?? void 0;
-      const sort = sortParam === "updated_desc" || sortParam === "updated_asc" || sortParam === "created_desc" || sortParam === "created_asc" ? sortParam : void 0;
-      const response = await this.service.memoryBrowse({
-        query: parsed.searchParams.get("q") ?? void 0,
-        status: parsed.searchParams.get("status") ?? void 0,
-        category: parsed.searchParams.get("category") ?? void 0,
-        namespace: parsed.searchParams.get("namespace") ?? void 0,
-        sort,
-        limit: Number.isFinite(limitRaw) ? limitRaw : 50,
-        offset: Number.isFinite(offsetRaw) ? offsetRaw : 0
-      });
-      this.respondJson(res, 200, response);
-      return;
-    }
-    const memoryMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)$/);
-    if (req.method === "GET" && memoryMatch) {
-      const memoryId = decodeURIComponent(memoryMatch[1] ?? "");
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
-      const response = await this.service.memoryGet(memoryId, namespace);
-      this.respondJson(res, response.found ? 200 : 404, response);
-      return;
-    }
-    const timelineMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)\/timeline$/);
-    if (req.method === "GET" && timelineMatch) {
-      const memoryId = decodeURIComponent(timelineMatch[1] ?? "");
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
-      const limitRaw = parseInt(parsed.searchParams.get("limit") ?? "200", 10);
-      const limit = Number.isFinite(limitRaw) ? limitRaw : 200;
-      const response = await this.service.memoryTimeline(memoryId, namespace, limit);
-      this.respondJson(res, response.found ? 200 : 404, response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/entities") {
-      const limitRaw = parseInt(parsed.searchParams.get("limit") ?? "50", 10);
-      const offsetRaw = parseInt(parsed.searchParams.get("offset") ?? "0", 10);
-      const response = await this.service.entityList({
-        namespace: parsed.searchParams.get("namespace") ?? void 0,
-        query: parsed.searchParams.get("q") ?? void 0,
-        limit: Number.isFinite(limitRaw) ? limitRaw : 50,
-        offset: Number.isFinite(offsetRaw) ? offsetRaw : 0
-      });
-      this.respondJson(res, 200, response);
-      return;
     }
-    const entityMatch = pathname.match(/^\/engram\/v1\/entities\/([^/]+)$/);
-    if (req.method === "GET" && entityMatch) {
-      const entityName = decodeURIComponent(entityMatch[1] ?? "");
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
-      const response = await this.service.entityGet(entityName, namespace);
-      this.respondJson(res, response.found ? 200 : 404, response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/review-queue") {
-      const response = await this.service.reviewQueue(
-        parsed.searchParams.get("runId") ?? void 0,
-        parsed.searchParams.get("namespace") ?? void 0
-      );
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/maintenance") {
-      this.respondJson(res, 200, await this.service.maintenance(parsed.searchParams.get("namespace") ?? void 0));
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/quality") {
-      this.respondJson(res, 200, await this.service.quality(parsed.searchParams.get("namespace") ?? void 0));
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/review-disposition") {
-      const body = await this.readJsonBody(req);
-      const status = typeof body.status === "string" ? body.status : "";
-      if (status !== "active" && status !== "pending_review" && status !== "quarantined" && status !== "rejected" && status !== "superseded" && status !== "archived") {
-        throw new HttpError(400, "invalid_review_status");
-      }
-      this.ensureWriteRateLimitAvailable();
-      const response = await this.service.reviewDisposition({
-        memoryId: typeof body.memoryId === "string" ? body.memoryId : "",
-        status,
-        reasonCode: typeof body.reasonCode === "string" ? body.reasonCode : "",
-        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
-        authenticatedPrincipal: this.authenticatedPrincipal
-      });
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit();
+    if (method === "tools/call") {
+      const params = request.params ?? {};
+      const name = typeof params.name === "string" ? params.name : "";
+      const argumentsObject = params.arguments && typeof params.arguments === "object" && !Array.isArray(params.arguments) ? params.arguments : {};
+      try {
+        const result = await this.callTool(name, argumentsObject);
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            structuredContent: result,
+            isError: false
+          }
+        };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            content: [{ type: "text", text: message }],
+            isError: true
+          }
+        };
       }
-      this.respondJson(res, 200, response);
-      return;
     }
-    this.respondJson(res, 404, { error: "not_found" });
+    return {
+      jsonrpc: "2.0",
+      id,
+      error: {
+        code: -32601,
+        message: `Method not found: ${method}`
+      }
+    };
   }
-  respondJson(res, status, payload) {
-    const body = JSON.stringify(payload, null, 2);
-    res.statusCode = status;
-    res.setHeader("content-type", "application/json; charset=utf-8");
-    res.setHeader("content-length", String(Buffer.byteLength(body)));
-    res.end(body);
+  async runStdio(input, output) {
+    input.on("data", (chunk) => {
+      this.buffer = Buffer.concat([this.buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
+      this.scheduleFlush(output);
+    });
+    await new Promise((resolve, reject) => {
+      input.on("end", resolve);
+      input.on("error", reject);
+    });
+    while (this.flushTask) {
+      await this.flushTask;
+    }
   }
-  async handleAdminConsole(req, res, pathname) {
-    if (req.method !== "GET") return false;
-    if (pathname === "/engram/ui" || pathname === "/engram/ui/") {
-      await this.respondStatic(res, path64.join(this.adminConsolePublicDir, "index.html"), "text/html; charset=utf-8");
-      return true;
-    }
-    if (pathname === "/engram/ui/app.js") {
-      await this.respondStatic(res, path64.join(this.adminConsolePublicDir, "app.js"), "application/javascript; charset=utf-8");
-      return true;
-    }
-    return false;
-  }
-  async respondStatic(res, filePath, contentType) {
-    try {
-      const body = await readFile38(filePath, "utf-8");
-      res.statusCode = 200;
-      res.setHeader("content-type", contentType);
-      res.setHeader("content-length", String(Buffer.byteLength(body)));
-      res.end(body);
-    } catch {
-      this.respondJson(res, 404, { error: "not_found" });
-    }
+  scheduleFlush(output) {
+    if (this.flushTask) return;
+    const task = this.flushBuffer(output).catch((err) => {
+      this.writeMessage(output, {
+        jsonrpc: "2.0",
+        id: null,
+        error: {
+          code: -32700,
+          message: err instanceof Error ? err.message : String(err)
+        }
+      });
+    }).finally(() => {
+      if (this.flushTask === task) {
+        this.flushTask = null;
+      }
+      if (this.buffer.length > 0) {
+        this.scheduleFlush(output);
+      }
+    });
+    this.flushTask = task;
   }
-  async readJsonBody(req) {
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of req) {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      total += buffer.length;
-      if (total > this.maxBodyBytes) {
-        throw new HttpError(413, "request_body_too_large");
+  async flushBuffer(output) {
+    while (true) {
+      const headerEnd = this.buffer.indexOf("\r\n\r\n");
+      if (headerEnd < 0) return;
+      const headerText = this.buffer.slice(0, headerEnd).toString("utf-8");
+      const headers = headerText.split("\r\n");
+      const contentLengthHeader = headers.find((line) => line.toLowerCase().startsWith("content-length:"));
+      if (!contentLengthHeader) {
+        this.buffer = Buffer.alloc(0);
+        return;
+      }
+      const contentLength = parseInt(contentLengthHeader.split(":")[1]?.trim() ?? "0", 10);
+      if (!Number.isFinite(contentLength) || contentLength < 0) {
+        this.buffer = Buffer.alloc(0);
+        return;
+      }
+      const messageStart = headerEnd + 4;
+      const messageEnd = messageStart + contentLength;
+      if (this.buffer.length < messageEnd) return;
+      const body = this.buffer.slice(messageStart, messageEnd).toString("utf-8");
+      this.buffer = this.buffer.slice(messageEnd);
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        this.writeMessage(output, {
+          jsonrpc: "2.0",
+          id: null,
+          error: {
+            code: -32700,
+            message: "Parse error"
+          }
+        });
+        continue;
+      }
+      const response = await this.handleRequest(parsed);
+      if (response) {
+        this.writeMessage(output, response);
       }
-      chunks.push(buffer);
-    }
-    if (chunks.length === 0) return {};
-    const raw = Buffer.concat(chunks).toString("utf-8").trim();
-    if (raw.length === 0) return {};
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      throw new HttpError(400, "invalid_json");
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new HttpError(400, "invalid_json_object");
     }
-    return parsed;
-  }
-  isAuthorized(req) {
-    if (!this.authToken) return false;
-    const raw = req.headers.authorization;
-    if (!raw) return false;
-    const separator = raw.indexOf(" ");
-    if (separator <= 0) return false;
-    const scheme = raw.slice(0, separator).toLowerCase();
-    if (scheme !== "bearer") return false;
-    const token = raw.slice(separator + 1).trim();
-    return this.timingSafeStringEqual(token, this.authToken);
-  }
-  timingSafeStringEqual(a, b) {
-    const left = this.encodeSecret(a);
-    const right = this.encodeSecret(b);
-    if (!left || !right) return false;
-    return timingSafeEqual2(left, right);
-  }
-  encodeSecret(value) {
-    const encoded = Buffer.from(value, "utf-8");
-    if (encoded.length > 1024) return null;
-    const out = Buffer.alloc(2 + 1024);
-    out.writeUInt16BE(encoded.length, 0);
-    encoded.copy(out, 2);
-    return out;
   }
-  writeResponseStatus(response) {
-    if (response.dryRun === true) return 200;
-    if (response.status === "stored" || response.status === "queued_for_review") return 201;
-    return 200;
+  writeMessage(output, payload) {
+    const body = JSON.stringify(payload);
+    const message = `Content-Length: ${Buffer.byteLength(body, "utf-8")}\r
+\r
+${body}`;
+    output.write(message);
   }
-  ensureWriteRateLimitAvailable() {
-    const now = Date.now();
-    while (this.writeRequestTimestamps.length > 0 && now - (this.writeRequestTimestamps[0] ?? 0) > WRITE_RATE_LIMIT_WINDOW_MS) {
-      this.writeRequestTimestamps.shift();
-    }
-    if (this.writeRequestTimestamps.length >= WRITE_RATE_LIMIT_MAX_REQUESTS) {
-      throw new HttpError(429, "write_rate_limited");
+  async callTool(name, args) {
+    switch (name) {
+      case "engram.recall":
+        return this.service.recall({
+          query: typeof args.query === "string" ? args.query : "",
+          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
+          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
+          topK: typeof args.topK === "number" && Number.isFinite(args.topK) ? args.topK : void 0,
+          mode: typeof args.mode === "string" ? args.mode : void 0,
+          includeDebug: args.includeDebug === true
+        });
+      case "engram.recall_explain":
+        return this.service.recallExplain({
+          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
+          namespace: typeof args.namespace === "string" ? args.namespace : void 0
+        });
+      case "engram.memory_get":
+        return this.service.memoryGet(
+          typeof args.memoryId === "string" ? args.memoryId : "",
+          typeof args.namespace === "string" ? args.namespace : void 0
+        );
+      case "engram.memory_timeline": {
+        const limit = typeof args.limit === "number" && Number.isFinite(args.limit) ? args.limit : 200;
+        return this.service.memoryTimeline(
+          typeof args.memoryId === "string" ? args.memoryId : "",
+          typeof args.namespace === "string" ? args.namespace : void 0,
+          limit
+        );
+      }
+      case "engram.memory_store":
+        return this.service.memoryStore({
+          schemaVersion: typeof args.schemaVersion === "number" ? args.schemaVersion : void 0,
+          idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : void 0,
+          dryRun: args.dryRun === true,
+          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
+          authenticatedPrincipal: this.authenticatedPrincipal,
+          content: typeof args.content === "string" ? args.content : "",
+          category: typeof args.category === "string" ? args.category : void 0,
+          confidence: typeof args.confidence === "number" ? args.confidence : void 0,
+          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
+          tags: Array.isArray(args.tags) ? args.tags.filter((tag) => typeof tag === "string") : void 0,
+          entityRef: typeof args.entityRef === "string" ? args.entityRef : void 0,
+          ttl: typeof args.ttl === "string" ? args.ttl : void 0,
+          sourceReason: typeof args.sourceReason === "string" ? args.sourceReason : void 0
+        });
+      case "engram.suggestion_submit":
+        return this.service.suggestionSubmit({
+          schemaVersion: typeof args.schemaVersion === "number" ? args.schemaVersion : void 0,
+          idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : void 0,
+          dryRun: args.dryRun === true,
+          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
+          authenticatedPrincipal: this.authenticatedPrincipal,
+          content: typeof args.content === "string" ? args.content : "",
+          category: typeof args.category === "string" ? args.category : void 0,
+          confidence: typeof args.confidence === "number" ? args.confidence : void 0,
+          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
+          tags: Array.isArray(args.tags) ? args.tags.filter((tag) => typeof tag === "string") : void 0,
+          entityRef: typeof args.entityRef === "string" ? args.entityRef : void 0,
+          ttl: typeof args.ttl === "string" ? args.ttl : void 0,
+          sourceReason: typeof args.sourceReason === "string" ? args.sourceReason : void 0
+        });
+      case "engram.entity_get":
+        return this.service.entityGet(
+          typeof args.name === "string" ? args.name : "",
+          typeof args.namespace === "string" ? args.namespace : void 0
+        );
+      case "engram.review_queue_list":
+        return this.service.reviewQueue(
+          typeof args.runId === "string" ? args.runId : void 0,
+          typeof args.namespace === "string" ? args.namespace : void 0
+        );
+      default:
+        throw new Error(`unknown tool: ${name}`);
     }
   }
-  recordWriteRateLimitHit() {
-    this.writeRequestTimestamps.push(Date.now());
-  }
-  shouldCountWriteRateLimit(response) {
-    return response.dryRun !== true && response.idempotencyReplay !== true;
-  }
 };
 
-// src/access-mcp.ts
-import { readFile as readFile39 } from "fs/promises";
-var MCP_PROTOCOL_VERSION = "2024-11-05";
-async function getMcpServerVersion() {
-  const envVersion = process.env.OPENCLAW_ENGRAM_VERSION?.trim() || process.env.npm_package_version?.trim();
-  if (envVersion) return envVersion;
-  try {
-    const pkgPath = new URL("../package.json", import.meta.url);
-    const raw = await readFile39(pkgPath, "utf-8");
-    const parsed = JSON.parse(raw);
-    return parsed.version?.trim() || "unknown";
-  } catch {
-    return "unknown";
+// src/access-http.ts
+function resolveDefaultAdminConsolePublicDir() {
+  const candidates = [
+    fileURLToPath2(new URL3("../admin-console/public", import.meta.url)),
+    fileURLToPath2(new URL3("./admin-console/public", import.meta.url))
+  ];
+  return candidates.find((candidate) => existsSync5(candidate)) ?? candidates[0];
+}
+var defaultAdminConsolePublicDir = resolveDefaultAdminConsolePublicDir();
+var WRITE_RATE_LIMIT_WINDOW_MS = 6e4;
+var WRITE_RATE_LIMIT_MAX_REQUESTS = 30;
+var HttpError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+};
+function hostToUrlAuthority2(host) {
+  if (host.includes(":") && !host.startsWith("[") && !host.endsWith("]")) {
+    return `[${host}]`;
   }
+  return host;
 }
-var EngramMcpServer = class {
-  constructor(service, options = {}) {
-    this.service = service;
-    this.authenticatedPrincipal = options.principal?.trim() || process.env.OPENCLAW_ENGRAM_ACCESS_PRINCIPAL?.trim() || void 0;
-    this.tools = [
-      {
-        name: "engram.recall",
-        description: "Recall Engram context for a query.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            query: { type: "string" },
-            sessionKey: { type: "string" },
-            namespace: { type: "string" },
-            topK: { type: "number" },
-            mode: { type: "string", enum: ["auto", "no_recall", "minimal", "full", "graph_mode"] },
-            includeDebug: { type: "boolean" }
-          },
-          required: ["query"],
-          additionalProperties: false
-        }
-      },
-      {
-        name: "engram.recall_explain",
-        description: "Return the last recall snapshot for a session or the most recent one.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            sessionKey: { type: "string" },
-            namespace: { type: "string" }
-          },
-          additionalProperties: false
-        }
-      },
-      {
-        name: "engram.memory_get",
-        description: "Fetch one Engram memory by id.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            memoryId: { type: "string" },
-            namespace: { type: "string" }
-          },
-          required: ["memoryId"],
-          additionalProperties: false
-        }
-      },
-      {
-        name: "engram.memory_timeline",
-        description: "Fetch one Engram memory timeline by id.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            memoryId: { type: "string" },
-            namespace: { type: "string" },
-            limit: { type: "number" }
-          },
-          required: ["memoryId"],
-          additionalProperties: false
-        }
-      },
-      {
-        name: "engram.memory_store",
-        description: "Store an explicit Engram memory through the access layer.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            schemaVersion: { type: "number" },
-            idempotencyKey: { type: "string" },
-            dryRun: { type: "boolean" },
-            sessionKey: { type: "string" },
-            content: { type: "string" },
-            category: { type: "string" },
-            confidence: { type: "number" },
-            namespace: { type: "string" },
-            tags: { type: "array", items: { type: "string" } },
-            entityRef: { type: "string" },
-            ttl: { type: "string" },
-            sourceReason: { type: "string" }
-          },
-          required: ["content"],
-          additionalProperties: false
-        }
-      },
-      {
-        name: "engram.suggestion_submit",
-        description: "Queue a suggested Engram memory for review.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            schemaVersion: { type: "number" },
-            idempotencyKey: { type: "string" },
-            dryRun: { type: "boolean" },
-            sessionKey: { type: "string" },
-            content: { type: "string" },
-            category: { type: "string" },
-            confidence: { type: "number" },
-            namespace: { type: "string" },
-            tags: { type: "array", items: { type: "string" } },
-            entityRef: { type: "string" },
-            ttl: { type: "string" },
-            sourceReason: { type: "string" }
-          },
-          required: ["content"],
-          additionalProperties: false
+var EngramAccessHttpServer = class {
+  service;
+  host;
+  requestedPort;
+  authToken;
+  authenticatedPrincipal;
+  maxBodyBytes;
+  adminConsoleEnabled;
+  adminConsolePublicDir;
+  writeRequestTimestamps = [];
+  mcpServer;
+  server = null;
+  boundPort = 0;
+  constructor(options) {
+    this.service = options.service;
+    this.host = options.host?.trim() || "127.0.0.1";
+    this.requestedPort = Number.isFinite(options.port) ? Math.max(0, Math.floor(options.port ?? 0)) : 0;
+    this.authToken = options.authToken?.trim() || void 0;
+    this.authenticatedPrincipal = options.principal?.trim() || void 0;
+    this.maxBodyBytes = Number.isFinite(options.maxBodyBytes) ? Math.max(1, Math.floor(options.maxBodyBytes ?? 131072)) : 131072;
+    this.adminConsoleEnabled = options.adminConsoleEnabled !== false;
+    this.adminConsolePublicDir = options.adminConsolePublicDir ?? defaultAdminConsolePublicDir;
+    this.mcpServer = new EngramMcpServer(this.service, { principal: options.principal });
+  }
+  async start() {
+    if (!this.authToken) {
+      throw new Error("engram access HTTP requires authToken");
+    }
+    if (this.server) return this.status();
+    const server = createServer3((req, res) => {
+      void this.handle(req, res).catch((err) => {
+        log.debug(`engram access HTTP request failed: ${err}`);
+        if (err instanceof HttpError) {
+          this.respondJson(res, err.status, { error: err.message });
+          return;
         }
-      },
-      {
-        name: "engram.entity_get",
-        description: "Fetch one Engram entity by name.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            name: { type: "string" },
-            namespace: { type: "string" }
-          },
-          required: ["name"],
-          additionalProperties: false
+        if (err instanceof EngramAccessInputError) {
+          this.respondJson(res, 400, { error: err.message });
+          return;
         }
-      },
-      {
-        name: "engram.review_queue_list",
-        description: "Fetch the latest Engram review queue artifact bundle.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            runId: { type: "string" },
-            namespace: { type: "string" }
-          },
-          additionalProperties: false
+        if (res.headersSent) {
+          res.destroy(err);
+          return;
         }
-      }
-    ];
+        this.respondJson(res, 500, { error: "internal_error" });
+      });
+    });
+    try {
+      await new Promise((resolve, reject) => {
+        const onError = (err) => {
+          server.off("listening", onListening);
+          reject(err);
+        };
+        const onListening = () => {
+          server.off("error", onError);
+          resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(this.requestedPort, this.host);
+      });
+    } catch (err) {
+      server.close();
+      throw err;
+    }
+    this.server = server;
+    const address = server.address();
+    this.boundPort = typeof address === "object" && address ? address.port : this.requestedPort;
+    return this.status();
   }
-  buffer = Buffer.alloc(0);
-  flushTask = null;
-  tools;
-  authenticatedPrincipal;
-  async handleRequest(request) {
-    const id = request.id ?? null;
-    const method = request.method ?? "";
-    if (method === "notifications/initialized") return null;
-    if (method === "ping") {
-      return { jsonrpc: "2.0", id, result: {} };
+  async stop() {
+    if (!this.server) return;
+    const server = this.server;
+    this.server = null;
+    this.boundPort = 0;
+    await new Promise((resolve, reject) => {
+      server.close((err) => err ? reject(err) : resolve());
+    });
+  }
+  status() {
+    return {
+      running: this.server !== null,
+      host: this.host,
+      port: this.boundPort,
+      maxBodyBytes: this.maxBodyBytes
+    };
+  }
+  async handle(req, res) {
+    const parsed = new URL3(req.url ?? "/", `http://${hostToUrlAuthority2(this.host)}`);
+    const pathname = parsed.pathname;
+    if (this.adminConsoleEnabled && await this.handleAdminConsole(req, res, pathname)) {
+      return;
     }
-    if (method === "initialize") {
-      const version = await getMcpServerVersion();
-      return {
-        jsonrpc: "2.0",
-        id,
-        result: {
-          protocolVersion: MCP_PROTOCOL_VERSION,
-          capabilities: {
-            tools: {}
-          },
-          serverInfo: {
-            name: "openclaw-engram",
-            version
-          }
-        }
+    if (!this.isAuthorized(req)) {
+      res.writeHead(401, {
+        "content-type": "application/json; charset=utf-8",
+        "www-authenticate": "Bearer"
+      });
+      res.end(JSON.stringify({ error: "unauthorized" }));
+      return;
+    }
+    if (req.method === "POST" && pathname === "/mcp") {
+      await this.handleMcpRequest(req, res);
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/health") {
+      this.respondJson(res, 200, await this.service.health());
+      return;
+    }
+    if (req.method === "POST" && pathname === "/engram/v1/recall") {
+      const body = await this.readJsonBody(req);
+      const response = await this.service.recall({
+        query: typeof body.query === "string" ? body.query : "",
+        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
+        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
+        topK: typeof body.topK === "number" ? body.topK : void 0,
+        mode: typeof body.mode === "string" ? body.mode : void 0,
+        includeDebug: body.includeDebug === true
+      });
+      this.respondJson(res, 200, response);
+      return;
+    }
+    if (req.method === "POST" && pathname === "/engram/v1/recall/explain") {
+      const body = await this.readJsonBody(req);
+      const response = await this.service.recallExplain({
+        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
+        namespace: typeof body.namespace === "string" ? body.namespace : void 0
+      });
+      this.respondJson(res, 200, response);
+      return;
+    }
+    if (req.method === "POST" && pathname === "/engram/v1/memories") {
+      const body = await this.readJsonBody(req);
+      const request = {
+        schemaVersion: typeof body.schemaVersion === "number" ? body.schemaVersion : void 0,
+        idempotencyKey: typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0,
+        dryRun: body.dryRun === true,
+        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
+        authenticatedPrincipal: this.authenticatedPrincipal,
+        content: typeof body.content === "string" ? body.content : "",
+        category: typeof body.category === "string" ? body.category : void 0,
+        confidence: typeof body.confidence === "number" ? body.confidence : void 0,
+        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
+        tags: Array.isArray(body.tags) ? body.tags.filter((tag) => typeof tag === "string") : void 0,
+        entityRef: typeof body.entityRef === "string" ? body.entityRef : void 0,
+        ttl: typeof body.ttl === "string" ? body.ttl : void 0,
+        sourceReason: typeof body.sourceReason === "string" ? body.sourceReason : void 0
       };
+      const idempotencyStatus = await this.service.peekMemoryStoreIdempotency(request);
+      if (idempotencyStatus === "miss" && request.dryRun !== true) {
+        this.ensureWriteRateLimitAvailable();
+      }
+      const response = await this.service.memoryStore(request);
+      if (this.shouldCountWriteRateLimit(response)) {
+        this.recordWriteRateLimitHit();
+      }
+      this.respondJson(res, this.writeResponseStatus(response), response);
+      return;
     }
-    if (method === "tools/list") {
-      return {
-        jsonrpc: "2.0",
-        id,
-        result: {
-          tools: this.tools
-        }
+    if (req.method === "POST" && pathname === "/engram/v1/suggestions") {
+      const body = await this.readJsonBody(req);
+      const request = {
+        schemaVersion: typeof body.schemaVersion === "number" ? body.schemaVersion : void 0,
+        idempotencyKey: typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0,
+        dryRun: body.dryRun === true,
+        sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
+        authenticatedPrincipal: this.authenticatedPrincipal,
+        content: typeof body.content === "string" ? body.content : "",
+        category: typeof body.category === "string" ? body.category : void 0,
+        confidence: typeof body.confidence === "number" ? body.confidence : void 0,
+        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
+        tags: Array.isArray(body.tags) ? body.tags.filter((tag) => typeof tag === "string") : void 0,
+        entityRef: typeof body.entityRef === "string" ? body.entityRef : void 0,
+        ttl: typeof body.ttl === "string" ? body.ttl : void 0,
+        sourceReason: typeof body.sourceReason === "string" ? body.sourceReason : void 0
       };
+      const idempotencyStatus = await this.service.peekSuggestionSubmitIdempotency(request);
+      if (idempotencyStatus === "miss" && request.dryRun !== true) {
+        this.ensureWriteRateLimitAvailable();
+      }
+      const response = await this.service.suggestionSubmit(request);
+      if (this.shouldCountWriteRateLimit(response)) {
+        this.recordWriteRateLimitHit();
+      }
+      this.respondJson(res, this.writeResponseStatus(response), response);
+      return;
     }
-    if (method === "tools/call") {
-      const params = request.params ?? {};
-      const name = typeof params.name === "string" ? params.name : "";
-      const argumentsObject = params.arguments && typeof params.arguments === "object" && !Array.isArray(params.arguments) ? params.arguments : {};
-      try {
-        const result = await this.callTool(name, argumentsObject);
-        return {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-            structuredContent: result,
-            isError: false
-          }
-        };
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            content: [{ type: "text", text: message }],
-            isError: true
-          }
-        };
+    if (req.method === "GET" && pathname === "/engram/v1/memories") {
+      const limitRaw = parseInt(parsed.searchParams.get("limit") ?? "50", 10);
+      const offsetRaw = parseInt(parsed.searchParams.get("offset") ?? "0", 10);
+      const sortParam = parsed.searchParams.get("sort") ?? void 0;
+      const sort = sortParam === "updated_desc" || sortParam === "updated_asc" || sortParam === "created_desc" || sortParam === "created_asc" ? sortParam : void 0;
+      const response = await this.service.memoryBrowse({
+        query: parsed.searchParams.get("q") ?? void 0,
+        status: parsed.searchParams.get("status") ?? void 0,
+        category: parsed.searchParams.get("category") ?? void 0,
+        namespace: parsed.searchParams.get("namespace") ?? void 0,
+        sort,
+        limit: Number.isFinite(limitRaw) ? limitRaw : 50,
+        offset: Number.isFinite(offsetRaw) ? offsetRaw : 0
+      });
+      this.respondJson(res, 200, response);
+      return;
+    }
+    const memoryMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)$/);
+    if (req.method === "GET" && memoryMatch) {
+      const memoryId = decodeURIComponent(memoryMatch[1] ?? "");
+      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const response = await this.service.memoryGet(memoryId, namespace);
+      this.respondJson(res, response.found ? 200 : 404, response);
+      return;
+    }
+    const timelineMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)\/timeline$/);
+    if (req.method === "GET" && timelineMatch) {
+      const memoryId = decodeURIComponent(timelineMatch[1] ?? "");
+      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const limitRaw = parseInt(parsed.searchParams.get("limit") ?? "200", 10);
+      const limit = Number.isFinite(limitRaw) ? limitRaw : 200;
+      const response = await this.service.memoryTimeline(memoryId, namespace, limit);
+      this.respondJson(res, response.found ? 200 : 404, response);
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/entities") {
+      const limitRaw = parseInt(parsed.searchParams.get("limit") ?? "50", 10);
+      const offsetRaw = parseInt(parsed.searchParams.get("offset") ?? "0", 10);
+      const response = await this.service.entityList({
+        namespace: parsed.searchParams.get("namespace") ?? void 0,
+        query: parsed.searchParams.get("q") ?? void 0,
+        limit: Number.isFinite(limitRaw) ? limitRaw : 50,
+        offset: Number.isFinite(offsetRaw) ? offsetRaw : 0
+      });
+      this.respondJson(res, 200, response);
+      return;
+    }
+    const entityMatch = pathname.match(/^\/engram\/v1\/entities\/([^/]+)$/);
+    if (req.method === "GET" && entityMatch) {
+      const entityName = decodeURIComponent(entityMatch[1] ?? "");
+      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const response = await this.service.entityGet(entityName, namespace);
+      this.respondJson(res, response.found ? 200 : 404, response);
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/review-queue") {
+      const response = await this.service.reviewQueue(
+        parsed.searchParams.get("runId") ?? void 0,
+        parsed.searchParams.get("namespace") ?? void 0
+      );
+      this.respondJson(res, 200, response);
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/maintenance") {
+      this.respondJson(res, 200, await this.service.maintenance(parsed.searchParams.get("namespace") ?? void 0));
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/quality") {
+      this.respondJson(res, 200, await this.service.quality(parsed.searchParams.get("namespace") ?? void 0));
+      return;
+    }
+    if (req.method === "POST" && pathname === "/engram/v1/review-disposition") {
+      const body = await this.readJsonBody(req);
+      const status = typeof body.status === "string" ? body.status : "";
+      if (status !== "active" && status !== "pending_review" && status !== "quarantined" && status !== "rejected" && status !== "superseded" && status !== "archived") {
+        throw new HttpError(400, "invalid_review_status");
+      }
+      this.ensureWriteRateLimitAvailable();
+      const response = await this.service.reviewDisposition({
+        memoryId: typeof body.memoryId === "string" ? body.memoryId : "",
+        status,
+        reasonCode: typeof body.reasonCode === "string" ? body.reasonCode : "",
+        namespace: typeof body.namespace === "string" ? body.namespace : void 0,
+        authenticatedPrincipal: this.authenticatedPrincipal
+      });
+      if (this.shouldCountWriteRateLimit(response)) {
+        this.recordWriteRateLimitHit();
       }
+      this.respondJson(res, 200, response);
+      return;
     }
-    return {
-      jsonrpc: "2.0",
-      id,
-      error: {
-        code: -32601,
-        message: `Method not found: ${method}`
+    this.respondJson(res, 404, { error: "not_found" });
+  }
+  async handleMcpRequest(req, res) {
+    const body = await this.readJsonBody(req);
+    const request = body;
+    if (request.method === "tools/call") {
+      const toolName = typeof request.params?.name === "string" ? request.params.name : "";
+      if (toolName === "engram.memory_store" || toolName === "engram.suggestion_submit") {
+        this.ensureWriteRateLimitAvailable();
+        this.recordWriteRateLimitHit();
       }
-    };
+    }
+    const response = await this.mcpServer.handleRequest(request);
+    if (response === null) {
+      res.statusCode = 202;
+      res.end();
+      return;
+    }
+    this.respondJson(res, 200, response);
   }
-  async runStdio(input, output) {
-    input.on("data", (chunk) => {
-      this.buffer = Buffer.concat([this.buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
-      this.scheduleFlush(output);
-    });
-    await new Promise((resolve, reject) => {
-      input.on("end", resolve);
-      input.on("error", reject);
-    });
-    while (this.flushTask) {
-      await this.flushTask;
+  respondJson(res, status, payload) {
+    const body = JSON.stringify(payload, null, 2);
+    res.statusCode = status;
+    res.setHeader("content-type", "application/json; charset=utf-8");
+    res.setHeader("content-length", String(Buffer.byteLength(body)));
+    res.end(body);
+  }
+  async handleAdminConsole(req, res, pathname) {
+    if (req.method !== "GET") return false;
+    if (pathname === "/engram/ui" || pathname === "/engram/ui/") {
+      await this.respondStatic(res, path64.join(this.adminConsolePublicDir, "index.html"), "text/html; charset=utf-8");
+      return true;
+    }
+    if (pathname === "/engram/ui/app.js") {
+      await this.respondStatic(res, path64.join(this.adminConsolePublicDir, "app.js"), "application/javascript; charset=utf-8");
+      return true;
     }
+    return false;
   }
-  scheduleFlush(output) {
-    if (this.flushTask) return;
-    const task = this.flushBuffer(output).catch((err) => {
-      this.writeMessage(output, {
-        jsonrpc: "2.0",
-        id: null,
-        error: {
-          code: -32700,
-          message: err instanceof Error ? err.message : String(err)
-        }
-      });
-    }).finally(() => {
-      if (this.flushTask === task) {
-        this.flushTask = null;
-      }
-      if (this.buffer.length > 0) {
-        this.scheduleFlush(output);
-      }
-    });
-    this.flushTask = task;
+  async respondStatic(res, filePath, contentType) {
+    try {
+      const body = await readFile39(filePath, "utf-8");
+      res.statusCode = 200;
+      res.setHeader("content-type", contentType);
+      res.setHeader("content-length", String(Buffer.byteLength(body)));
+      res.end(body);
+    } catch {
+      this.respondJson(res, 404, { error: "not_found" });
+    }
   }
-  async flushBuffer(output) {
-    while (true) {
-      const headerEnd = this.buffer.indexOf("\r\n\r\n");
-      if (headerEnd < 0) return;
-      const headerText = this.buffer.slice(0, headerEnd).toString("utf-8");
-      const headers = headerText.split("\r\n");
-      const contentLengthHeader = headers.find((line) => line.toLowerCase().startsWith("content-length:"));
-      if (!contentLengthHeader) {
-        this.buffer = Buffer.alloc(0);
-        return;
-      }
-      const contentLength = parseInt(contentLengthHeader.split(":")[1]?.trim() ?? "0", 10);
-      if (!Number.isFinite(contentLength) || contentLength < 0) {
-        this.buffer = Buffer.alloc(0);
-        return;
-      }
-      const messageStart = headerEnd + 4;
-      const messageEnd = messageStart + contentLength;
-      if (this.buffer.length < messageEnd) return;
-      const body = this.buffer.slice(messageStart, messageEnd).toString("utf-8");
-      this.buffer = this.buffer.slice(messageEnd);
-      let parsed;
-      try {
-        parsed = JSON.parse(body);
-      } catch {
-        this.writeMessage(output, {
-          jsonrpc: "2.0",
-          id: null,
-          error: {
-            code: -32700,
-            message: "Parse error"
-          }
-        });
-        continue;
-      }
-      const response = await this.handleRequest(parsed);
-      if (response) {
-        this.writeMessage(output, response);
+  async readJsonBody(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buffer.length;
+      if (total > this.maxBodyBytes) {
+        throw new HttpError(413, "request_body_too_large");
       }
+      chunks.push(buffer);
+    }
+    if (chunks.length === 0) return {};
+    const raw = Buffer.concat(chunks).toString("utf-8").trim();
+    if (raw.length === 0) return {};
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new HttpError(400, "invalid_json");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new HttpError(400, "invalid_json_object");
     }
+    return parsed;
   }
-  writeMessage(output, payload) {
-    const body = JSON.stringify(payload);
-    const message = `Content-Length: ${Buffer.byteLength(body, "utf-8")}\r
-\r
-${body}`;
-    output.write(message);
+  isAuthorized(req) {
+    if (!this.authToken) return false;
+    const raw = req.headers.authorization;
+    if (!raw) return false;
+    const separator = raw.indexOf(" ");
+    if (separator <= 0) return false;
+    const scheme = raw.slice(0, separator).toLowerCase();
+    if (scheme !== "bearer") return false;
+    const token = raw.slice(separator + 1).trim();
+    return this.timingSafeStringEqual(token, this.authToken);
   }
-  async callTool(name, args) {
-    switch (name) {
-      case "engram.recall":
-        return this.service.recall({
-          query: typeof args.query === "string" ? args.query : "",
-          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
-          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
-          topK: typeof args.topK === "number" && Number.isFinite(args.topK) ? args.topK : void 0,
-          mode: typeof args.mode === "string" ? args.mode : void 0,
-          includeDebug: args.includeDebug === true
-        });
-      case "engram.recall_explain":
-        return this.service.recallExplain({
-          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
-          namespace: typeof args.namespace === "string" ? args.namespace : void 0
-        });
-      case "engram.memory_get":
-        return this.service.memoryGet(
-          typeof args.memoryId === "string" ? args.memoryId : "",
-          typeof args.namespace === "string" ? args.namespace : void 0
-        );
-      case "engram.memory_timeline": {
-        const limit = typeof args.limit === "number" && Number.isFinite(args.limit) ? args.limit : 200;
-        return this.service.memoryTimeline(
-          typeof args.memoryId === "string" ? args.memoryId : "",
-          typeof args.namespace === "string" ? args.namespace : void 0,
-          limit
-        );
-      }
-      case "engram.memory_store":
-        return this.service.memoryStore({
-          schemaVersion: typeof args.schemaVersion === "number" ? args.schemaVersion : void 0,
-          idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : void 0,
-          dryRun: args.dryRun === true,
-          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
-          authenticatedPrincipal: this.authenticatedPrincipal,
-          content: typeof args.content === "string" ? args.content : "",
-          category: typeof args.category === "string" ? args.category : void 0,
-          confidence: typeof args.confidence === "number" ? args.confidence : void 0,
-          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
-          tags: Array.isArray(args.tags) ? args.tags.filter((tag) => typeof tag === "string") : void 0,
-          entityRef: typeof args.entityRef === "string" ? args.entityRef : void 0,
-          ttl: typeof args.ttl === "string" ? args.ttl : void 0,
-          sourceReason: typeof args.sourceReason === "string" ? args.sourceReason : void 0
-        });
-      case "engram.suggestion_submit":
-        return this.service.suggestionSubmit({
-          schemaVersion: typeof args.schemaVersion === "number" ? args.schemaVersion : void 0,
-          idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : void 0,
-          dryRun: args.dryRun === true,
-          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
-          authenticatedPrincipal: this.authenticatedPrincipal,
-          content: typeof args.content === "string" ? args.content : "",
-          category: typeof args.category === "string" ? args.category : void 0,
-          confidence: typeof args.confidence === "number" ? args.confidence : void 0,
-          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
-          tags: Array.isArray(args.tags) ? args.tags.filter((tag) => typeof tag === "string") : void 0,
-          entityRef: typeof args.entityRef === "string" ? args.entityRef : void 0,
-          ttl: typeof args.ttl === "string" ? args.ttl : void 0,
-          sourceReason: typeof args.sourceReason === "string" ? args.sourceReason : void 0
-        });
-      case "engram.entity_get":
-        return this.service.entityGet(
-          typeof args.name === "string" ? args.name : "",
-          typeof args.namespace === "string" ? args.namespace : void 0
-        );
-      case "engram.review_queue_list":
-        return this.service.reviewQueue(
-          typeof args.runId === "string" ? args.runId : void 0,
-          typeof args.namespace === "string" ? args.namespace : void 0
-        );
-      default:
-        throw new Error(`unknown tool: ${name}`);
+  timingSafeStringEqual(a, b) {
+    const left = this.encodeSecret(a);
+    const right = this.encodeSecret(b);
+    if (!left || !right) return false;
+    return timingSafeEqual2(left, right);
+  }
+  encodeSecret(value) {
+    const encoded = Buffer.from(value, "utf-8");
+    if (encoded.length > 1024) return null;
+    const out = Buffer.alloc(2 + 1024);
+    out.writeUInt16BE(encoded.length, 0);
+    encoded.copy(out, 2);
+    return out;
+  }
+  writeResponseStatus(response) {
+    if (response.dryRun === true) return 200;
+    if (response.status === "stored" || response.status === "queued_for_review") return 201;
+    return 200;
+  }
+  ensureWriteRateLimitAvailable() {
+    const now = Date.now();
+    while (this.writeRequestTimestamps.length > 0 && now - (this.writeRequestTimestamps[0] ?? 0) > WRITE_RATE_LIMIT_WINDOW_MS) {
+      this.writeRequestTimestamps.shift();
+    }
+    if (this.writeRequestTimestamps.length >= WRITE_RATE_LIMIT_MAX_REQUESTS) {
+      throw new HttpError(429, "write_rate_limited");
     }
   }
+  recordWriteRateLimitHit() {
+    this.writeRequestTimestamps.push(Date.now());
+  }
+  shouldCountWriteRateLimit(response) {
+    return response.dryRun !== true && response.idempotencyReplay !== true;
+  }
 };
 
 // src/compat/checks.ts