@jungjaehoon/mama-os 0.32.3 → 0.34.0

package/README.md

@@ -86,7 +86,7 @@ npx @jungjaehoon/mama-os init --backend cline  # or claude / codex / auto
 mama start
 
 # 3. Open the operator board
-open http://localhost:3847/ui
+open http://localhost:3847/viewer
 ```
 
 **Prerequisites:** Node.js >= 22.13.0, one authenticated backend CLI (Claude, Codex, or Cline), 500MB disk space.
@@ -157,25 +157,23 @@ Agents delegate via `delegate()` with skill injection and automatic retry. Confi
 
 ## Viewer
 
-Web UI at `http://localhost:3847` (redirects to the operator board at `/ui`). PWA-enabled for
-mobile (add to home screen).
+One web console at `http://localhost:3847/viewer` (`/` redirects there), opening on the
+operator board. PWA-enabled for mobile (add to home screen).
 
-**Operator board (`/ui`)** — the primary surface: four agent-published report slots (briefing,
-action required, decisions, pipeline) rendered live over SSE, plus a Triggers tab showing the
-trigger loop's library with an owner veto tray.
+Three groups:
 
-**Legacy viewer (`/viewer`)** tabs:
+| Group         | View       | What it shows                                                                                    |
+| ------------- | ---------- | ------------------------------------------------------------------------------------------------ |
+| **Operator**  | Board      | Four agent-published report slots (briefing, action required, decisions, pipeline) live over SSE |
+| **Operator**  | Tasks      | The task board fed from your channels                                                            |
+| **Operator**  | Triggers   | The trigger loop's library with an owner veto tray                                               |
+| **Knowledge** | Memory     | Interactive reasoning graph (1000+ nodes), search, export                                        |
+| **Knowledge** | Wiki       | Knowledge base (syncs with Obsidian vault)                                                       |
+| **System**    | Runtime    | Read-only runtime truth: backend, model, gateways, health                                        |
+| **System**    | Connectors | Connector status and last poll                                                                   |
+| **System**    | Logs       | Daemon logs with filtering, pinning, stats, WebSocket and polling                                |
 
-| Tab           | What it shows                                              |
-| ------------- | ---------------------------------------------------------- |
-| **Dashboard** | Agent activity, memory stats, system health                |
-| **Feed**      | Real-time stream from all connected sources                |
-| **Wiki**      | Knowledge base (syncs with Obsidian vault)                 |
-| **Memory**    | Interactive reasoning graph (1000+ nodes), search, export  |
-| **Logs**      | Daemon logs with filtering, pinning, stats, WebSocket mode |
-| **Settings**  | Connectors, gateways, agents, cron, token budget           |
-
-Floating chat panel on every tab — voice input, TTS, slash commands.
+Each view has its own hash route, e.g. `/viewer#operator/tasks?task=42`.
 
 ## Gateway Integrations
 

package/dist/agent/os-agent-capabilities.md

@@ -355,7 +355,7 @@ Restart unnecessary. Continue anyway?
 
 **DO NOT confuse contexts**:
 
-❌ **Wrong** (in Mobile Chat):
+❌ **Wrong** (in a chat gateway conversation):
 
 ```text
 
@@ -365,7 +365,7 @@ Want me to check the system status?" ← Mentioning OS Agent role in normal Chat
 
 ```
 
-✅ **Correct** (in Mobile Chat):
+✅ **Correct** (in a chat gateway conversation):
 
 ```text
 

package/dist/api/graph-api.d.ts

@@ -1,13 +1,13 @@
 /**
  * MAMA Graph API
  *
- * HTTP API endpoints for Graph Viewer.
+ * HTTP API endpoints for the Viewer.
  * Provides /graph endpoint for fetching decisions and edges data.
  * Provides /viewer endpoint for serving HTML viewer.
  */
 import type { GraphNode, GraphEdge, CheckpointData, GraphHandlerOptions, GraphHandlerFn } from './graph-api-types.js';
-declare const VIEWER_HTML_PATH: string;
-declare const VIEWER_CSS_PATH: string;
+declare const viewerHtmlPath: () => string;
+declare const viewerCssPath: () => string;
 declare const DEFAULT_GRAPH_LIMIT = 300;
 declare function migrateLegacyManagedBackends<T extends Record<string, unknown>>(config: T): T;
 type GraphDecisionRow = {
@@ -37,6 +37,6 @@ declare function filterNodesByTopic(nodes: GraphNode[], topic: string): GraphNod
 declare function filterEdgesByNodes(edges: GraphEdge[], nodes: GraphNode[]): GraphEdge[];
 declare function createGraphHandler(options?: GraphHandlerOptions): GraphHandlerFn;
 declare function validateConfigUpdate(config: Record<string, any>): string[];
-export { createGraphHandler, DEFAULT_GRAPH_LIMIT, mapDecisionRowToGraphNode, parseGraphLimit, buildGraphMeta, validateConfigUpdate, migrateLegacyManagedBackends, getAllNodes, getAllEdges, getAllCheckpoints, getUniqueTopics, filterNodesByTopic, filterEdgesByNodes, VIEWER_HTML_PATH, VIEWER_CSS_PATH, };
+export { createGraphHandler, DEFAULT_GRAPH_LIMIT, mapDecisionRowToGraphNode, parseGraphLimit, buildGraphMeta, validateConfigUpdate, migrateLegacyManagedBackends, getAllNodes, getAllEdges, getAllCheckpoints, getUniqueTopics, filterNodesByTopic, filterEdgesByNodes, viewerHtmlPath, viewerCssPath, };
 export type { GraphNode, GraphEdge, SimilarityEdge, CheckpointData, GraphHandlerOptions, } from './graph-api-types.js';
 //# sourceMappingURL=graph-api.d.ts.map

package/dist/api/graph-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-api.d.ts","sourceRoot":"","sources":["../../src/api/graph-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6CH,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EAET,cAAc,EACd,mBAAmB,EAGnB,cAAc,EACf,MAAM,sBAAsB,CAAC;AAwC9B,QAAA,MAAM,gBAAgB,QAAuC,CAAC;AAC9D,QAAA,MAAM,eAAe,QAAsC,CAAC;AA+C5D,QAAA,MAAM,mBAAmB,MAAM,CAAC;AA8DhC,iBAAS,4BAA4B,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CA4ErF;AAqFD,KAAK,gBAAgB,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAUF,iBAAS,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,CASnE;AAED,iBAAS,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAgB/D;AAED,iBAAS,cAAc,CAAC,KAAK,EAAE;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CASnC;AAED,iBAAe,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAmBtE;AAqDD,iBAAe,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BjD;AAWD,iBAAe,iBAAiB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiC5D;AAED,iBAAS,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAGrD;AAED,iBAAS,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAE1E;AAED,iBAAS,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAG/E;AAorBD,iBAAS,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,cAAc,CA4xC7E;AAmpBD,iBAAS,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAiGnE;AAm3BD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,4BAA4B,EAC5B,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,CAAC;AAEF,YAAY,EACV,SAAS,EACT,SAAS,EACT,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"graph-api.d.ts","sourceRoot":"","sources":["../../src/api/graph-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6CH,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EAET,cAAc,EACd,mBAAmB,EAGnB,cAAc,EACf,MAAM,sBAAsB,CAAC;AA8C9B,QAAA,MAAM,cAAc,QAAO,MAAwD,CAAC;AACpF,QAAA,MAAM,aAAa,QAAO,MAAuD,CAAC;AAclF,QAAA,MAAM,mBAAmB,MAAM,CAAC;AA8DhC,iBAAS,4BAA4B,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CA4ErF;AAqFD,KAAK,gBAAgB,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAUF,iBAAS,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,CASnE;AAED,iBAAS,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAgB/D;AAED,iBAAS,cAAc,CAAC,KAAK,EAAE;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CASnC;AAED,iBAAe,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAmBtE;AAqDD,iBAAe,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BjD;AAWD,iBAAe,iBAAiB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiC5D;AAED,iBAAS,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAGrD;AAED,iBAAS,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAE1E;AAED,iBAAS,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAG/E;AAorBD,iBAAS,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,cAAc,CAmxC7E;AAmpBD,iBAAS,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAiGnE;AAm3BD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,4BAA4B,EAC5B,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,CAAC;AAEF,YAAY,EACV,SAAS,EACT,SAAS,EACT,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,sBAAsB,CAAC"}

package/dist/api/graph-api.js

@@ -2,7 +2,7 @@
 /**
  * MAMA Graph API
  *
- * HTTP API endpoints for Graph Viewer.
+ * HTTP API endpoints for the Viewer.
  * Provides /graph endpoint for fetching decisions and edges data.
  * Provides /viewer endpoint for serving HTML viewer.
  */
@@ -10,7 +10,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VIEWER_CSS_PATH = exports.VIEWER_HTML_PATH = exports.DEFAULT_GRAPH_LIMIT = void 0;
+exports.viewerCssPath = exports.viewerHtmlPath = exports.DEFAULT_GRAPH_LIMIT = void 0;
 exports.createGraphHandler = createGraphHandler;
 exports.mapDecisionRowToGraphNode = mapDecisionRowToGraphNode;
 exports.parseGraphLimit = parseGraphLimit;
@@ -52,8 +52,15 @@ const mama = require('@jungjaehoon/mama-core/mama-api');
 // Config paths
 const MAMA_CONFIG_PATH = path_1.default.join(os_1.default.homedir(), '.mama', 'config.yaml');
 const PACKAGE_ROOT_DIR = path_1.default.resolve(__dirname, '../..');
-// Paths to viewer files (now in public/viewer/)
+// Paths to viewer files (now in public/viewer/). Resolved per request so the
+// MAMA_VIEWER_DIR override works for tests without module-load ordering games.
 function getViewerDirectory() {
+    if (process.env.MAMA_VIEWER_DIR) {
+        // resolve() drops trailing slashes; without it the `operatorRoot + path.sep`
+        // traversal guard in the /viewer/operator route would 404 every request for
+        // '/foo/bar/'-style values.
+        return path_1.default.resolve(process.env.MAMA_VIEWER_DIR);
+    }
     const packagePublicViewer = path_1.default.join(PACKAGE_ROOT_DIR, 'public', 'viewer');
     const candidateDirs = [
         path_1.default.join(process.cwd(), 'public', 'viewer'),
@@ -70,52 +77,21 @@ function getViewerDirectory() {
     // Fallback for unusual launch locations.
     return path_1.default.join(process.cwd(), 'public', 'viewer');
 }
-const VIEWER_DIR = getViewerDirectory();
-const VIEWER_HTML_PATH = path_1.default.join(VIEWER_DIR, 'viewer.html');
-exports.VIEWER_HTML_PATH = VIEWER_HTML_PATH;
-const VIEWER_CSS_PATH = path_1.default.join(VIEWER_DIR, 'viewer.css');
-exports.VIEWER_CSS_PATH = VIEWER_CSS_PATH;
-const SW_JS_PATH = path_1.default.join(VIEWER_DIR, 'sw.js');
-const MANIFEST_JSON_PATH = path_1.default.join(VIEWER_DIR, 'manifest.json');
-const VIEWER_ICON_DIR = path_1.default.join(VIEWER_DIR, 'icons');
-const VIEWER_FAVICON_PATH = path_1.default.join(VIEWER_DIR, '..', 'favicon.ico');
-// Operator viewer SPA (built from ui/ into public/ui/). Resolved per request so
-// the MAMA_UI_DIR override works for tests without module-load ordering games.
-function getUiDirectory() {
-    if (process.env.MAMA_UI_DIR) {
-        // resolve() drops trailing slashes; without it the `uiRoot + path.sep`
-        // traversal guard below would 404 every request for '/foo/bar/'-style values.
-        return path_1.default.resolve(process.env.MAMA_UI_DIR);
-    }
-    const candidateDirs = [
-        path_1.default.join(process.cwd(), 'public', 'ui'),
-        path_1.default.join(PACKAGE_ROOT_DIR, 'public', 'ui'),
-        path_1.default.join(__dirname, '../../public/ui'),
-        path_1.default.join(__dirname, '../../../public/ui'),
-        path_1.default.join(process.cwd(), 'packages', 'standalone', 'public', 'ui'),
-    ];
-    for (const candidate of candidateDirs) {
-        if (fs_1.default.existsSync(candidate) && fs_1.default.statSync(candidate).isDirectory()) {
-            return candidate;
-        }
-    }
-    return path_1.default.join(process.cwd(), 'public', 'ui');
-}
-// serveStaticFile requires an explicit content type and only reads bytes (not
-// utf-8) for image/* or octet-stream -- fonts map to octet-stream for integrity.
-const UI_STATIC_MIME = {
-    '.html': 'text/html',
-    '.js': 'text/javascript',
+const viewerHtmlPath = () => path_1.default.join(getViewerDirectory(), 'viewer.html');
+exports.viewerHtmlPath = viewerHtmlPath;
+const viewerCssPath = () => path_1.default.join(getViewerDirectory(), 'viewer.css');
+exports.viewerCssPath = viewerCssPath;
+const swJsPath = () => path_1.default.join(getViewerDirectory(), 'sw.js');
+const manifestJsonPath = () => path_1.default.join(getViewerDirectory(), 'manifest.json');
+const viewerIconDir = () => path_1.default.join(getViewerDirectory(), 'icons');
+const viewerFaviconPath = () => path_1.default.join(getViewerDirectory(), '..', 'favicon.ico');
+const viewerOperatorDir = () => path_1.default.join(getViewerDirectory(), 'operator');
+// Operator bundle assets live under public/viewer/operator/ and are the only
+// extensions that route serves.
+const VIEWER_OPERATOR_MIME = {
+    '.js': 'application/javascript',
     '.css': 'text/css',
-    '.json': 'application/json',
-    '.svg': 'image/svg+xml',
-    '.png': 'image/png',
-    '.ico': 'image/x-icon',
-    '.woff2': 'application/octet-stream',
 };
-// Agent-authored slot HTML renders inside this SPA. Two independent XSS layers:
-// DOMPurify at render (ui/src/api/report.ts) + this CSP on the document.
-const UI_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'";
 const DEFAULT_GRAPH_LIMIT = 300;
 exports.DEFAULT_GRAPH_LIMIT = DEFAULT_GRAPH_LIMIT;
 const MAX_GRAPH_LIMIT = 2000;
@@ -494,10 +470,10 @@ function serveStaticFile(res, filePath, contentType, extraHeaders = {}) {
     }
 }
 function handleViewerRequest(_req, res) {
-    serveStaticFile(res, VIEWER_HTML_PATH, 'text/html');
+    serveStaticFile(res, viewerHtmlPath(), 'text/html');
 }
 function handleCssRequest(_req, res) {
-    serveStaticFile(res, VIEWER_CSS_PATH, 'text/css');
+    serveStaticFile(res, viewerCssPath(), 'text/css');
 }
 async function handleGraphRequest(_req, res, params) {
     const startTime = Date.now();
@@ -1047,11 +1023,11 @@ function createGraphHandler(options = {}) {
             res.end();
             return true;
         }
-        // Route: GET / - redirect to the operator board (M7 phase 2: /ui is the
-        // default face; the legacy viewer stays reachable at /viewer)
+        // Route: GET / - redirect to /viewer, the ONE public shell. The temporary
+        // /ui SPA route was retired; there is no second face to fall back to.
         if (pathname === '/' && req.method === 'GET') {
-            console.log('[GraphHandler] Redirecting / to /ui');
-            res.writeHead(302, { Location: '/ui' });
+            console.log('[GraphHandler] Redirecting / to /viewer');
+            res.writeHead(302, { Location: '/viewer' });
             res.end();
             return true;
         }
@@ -1069,45 +1045,38 @@ function createGraphHandler(options = {}) {
         }
         // Route: GET/HEAD /sw.js - serve Service Worker
         if (pathname === '/sw.js' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, SW_JS_PATH, 'application/javascript');
+            serveStaticFile(res, swJsPath(), 'application/javascript');
             return true;
         }
         // Route: GET/HEAD /viewer/sw.js - serve Service Worker (alternative path)
         if (pathname === '/viewer/sw.js' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, SW_JS_PATH, 'application/javascript');
+            serveStaticFile(res, swJsPath(), 'application/javascript');
             return true;
         }
         // Route: GET/HEAD /viewer/manifest.json - serve PWA manifest
         if (pathname === '/viewer/manifest.json' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, MANIFEST_JSON_PATH, 'application/json');
+            serveStaticFile(res, manifestJsonPath(), 'application/json');
             return true;
         }
         // Route: GET/HEAD /favicon.ico - serve favicon
         if (pathname === '/favicon.ico' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, VIEWER_FAVICON_PATH, 'image/x-icon');
+            serveStaticFile(res, viewerFaviconPath(), 'image/x-icon');
             return true;
         }
-        // Route: GET/HEAD /ui/* - operator viewer SPA (public/ui, Vite build)
-        if ((pathname === '/ui' || pathname.startsWith('/ui/')) &&
+        // Route: GET/HEAD /viewer/operator/*.{js,css} - operator bundle assets.
+        // Traversal-safe and extension-allowlisted: this route must never become a
+        // generic file server rooted at the viewer directory.
+        if (pathname.startsWith('/viewer/operator/') &&
             (req.method === 'GET' || req.method === 'HEAD')) {
-            const uiRoot = getUiDirectory();
-            // '/ui' and '/ui/' both mean the SPA shell; slicing '/ui/' yields '' which
-            // resolves to uiRoot itself and would fail the traversal guard below.
-            const rel = pathname === '/ui' || pathname === '/ui/' ? 'index.html' : pathname.slice('/ui/'.length);
-            const resolved = path_1.default.resolve(uiRoot, rel);
-            if (!resolved.startsWith(uiRoot + path_1.default.sep)) {
+            const operatorRoot = viewerOperatorDir();
+            const resolved = path_1.default.resolve(operatorRoot, pathname.slice('/viewer/operator/'.length));
+            const contentType = VIEWER_OPERATOR_MIME[path_1.default.extname(resolved)];
+            if (!resolved.startsWith(operatorRoot + path_1.default.sep) || !contentType) {
                 res.writeHead(404, { 'Content-Type': 'text/plain' });
                 res.end('Not found');
                 return true;
             }
-            const isAsset = rel.startsWith('assets/');
-            const exists = fs_1.default.existsSync(resolved) && fs_1.default.statSync(resolved).isFile();
-            // Missing hashed assets must 404 (via serveStaticFile's ENOENT path) -- an
-            // index.html fallback would mask them as 200 text/html.
-            const target = exists || isAsset ? resolved : path_1.default.join(uiRoot, 'index.html');
-            const contentType = UI_STATIC_MIME[path_1.default.extname(target)] ?? 'application/octet-stream';
-            const extraHeaders = contentType === 'text/html' ? { 'Content-Security-Policy': UI_CSP } : {};
-            serveStaticFile(res, target, contentType, extraHeaders);
+            serveStaticFile(res, resolved, contentType);
             return true;
         }
         // Route: GET/HEAD /viewer/icons/*.png - serve PWA icons
@@ -1115,7 +1084,7 @@ function createGraphHandler(options = {}) {
             pathname.endsWith('.png') &&
             (req.method === 'GET' || req.method === 'HEAD')) {
             const fileName = path_1.default.basename(pathname.split('/').pop() || '');
-            const filePath = path_1.default.join(VIEWER_ICON_DIR, fileName);
+            const filePath = path_1.default.join(viewerIconDir(), fileName);
             serveStaticFile(res, filePath, 'image/png');
             return true;
         }
@@ -1124,7 +1093,7 @@ function createGraphHandler(options = {}) {
             pathname.endsWith('.svg') &&
             (req.method === 'GET' || req.method === 'HEAD')) {
             const fileName = path_1.default.basename(pathname.split('/').pop() || '');
-            const filePath = path_1.default.join(VIEWER_ICON_DIR, fileName);
+            const filePath = path_1.default.join(viewerIconDir(), fileName);
             serveStaticFile(res, filePath, 'image/svg+xml');
             return true;
         }
@@ -1133,7 +1102,7 @@ function createGraphHandler(options = {}) {
             pathname.endsWith('.js') &&
             (req.method === 'GET' || req.method === 'HEAD')) {
             const fileName = pathname.split('/').pop();
-            const filePath = path_1.default.join(VIEWER_DIR, 'js', 'utils', fileName);
+            const filePath = path_1.default.join(getViewerDirectory(), 'js', 'utils', fileName);
             serveStaticFile(res, filePath, 'application/javascript');
             return true;
         }
@@ -1144,7 +1113,7 @@ function createGraphHandler(options = {}) {
             pathname.endsWith('.js') &&
             (req.method === 'GET' || req.method === 'HEAD')) {
             const fileName = pathname.split('/').pop();
-            const filePath = path_1.default.join(VIEWER_DIR, 'js', fileName);
+            const filePath = path_1.default.join(getViewerDirectory(), 'js', fileName);
             serveStaticFile(res, filePath, 'application/javascript');
             return true;
         }
@@ -1153,7 +1122,7 @@ function createGraphHandler(options = {}) {
             pathname.endsWith('.js') &&
             (req.method === 'GET' || req.method === 'HEAD')) {
             const fileName = pathname.split('/').pop();
-            const filePath = path_1.default.join(VIEWER_DIR, 'js', 'modules', fileName);
+            const filePath = path_1.default.join(getViewerDirectory(), 'js', 'modules', fileName);
             serveStaticFile(res, filePath, 'application/javascript');
             return true;
         }