@jungjaehoon/mama-os 0.53.0 → 0.57.0

package/dist/api/graph-api.js

@@ -1,3460 +0,0 @@
-"use strict";
-/**
- * MAMA Graph API
- *
- * HTTP API endpoints for the Viewer.
- * Provides /graph endpoint for fetching decisions and edges data.
- * Provides /viewer endpoint for serving HTML viewer.
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.viewerCssPath = exports.viewerHtmlPath = exports.DEFAULT_GRAPH_LIMIT = void 0;
-exports.createGraphHandler = createGraphHandler;
-exports.mapDecisionRowToGraphNode = mapDecisionRowToGraphNode;
-exports.parseGraphLimit = parseGraphLimit;
-exports.buildGraphMeta = buildGraphMeta;
-exports.validateConfigUpdate = validateConfigUpdate;
-exports.migrateLegacyManagedBackends = migrateLegacyManagedBackends;
-exports.getAllNodes = getAllNodes;
-exports.getAllEdges = getAllEdges;
-exports.getAllCheckpoints = getAllCheckpoints;
-exports.getUniqueTopics = getUniqueTopics;
-exports.filterNodesByTopic = filterNodesByTopic;
-exports.filterEdgesByNodes = filterEdgesByNodes;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const os_1 = __importDefault(require("os"));
-const js_yaml_1 = __importDefault(require("js-yaml"));
-const auth_middleware_js_1 = require("./auth-middleware.js");
-const trusted_proxy_js_1 = require("../security/trusted-proxy.js");
-const run_context_registry_js_1 = require("../agent/code-act/run-context-registry.js");
-const backend_model_policy_js_1 = require("../agent/backend-model-policy.js");
-const types_js_1 = require("../cli/config/types.js");
-const agent_handler_js_1 = require("./agent-handler.js");
-const ui_command_handler_js_1 = require("./ui-command-handler.js");
-const entity_review_handler_js_1 = require("./entity-review-handler.js");
-const entity_audit_handler_js_1 = require("./entity-audit-handler.js");
-const entity_audit_queue_js_1 = require("./entity-audit-queue.js");
-const entity_audit_runner_js_1 = require("./entity-audit-runner.js");
-const store_js_1 = require("../validation/store.js");
-// mama-core is pure JS with no .d.ts — require + any is intentional
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { getAdapter, initDB, vectorSearch } = require('@jungjaehoon/mama-core/memory-store');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { DebugLogger } = require('@jungjaehoon/mama-core/debug-logger');
-const logger = new DebugLogger('GraphAPI');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { generateEmbedding } = require('@jungjaehoon/mama-core/embeddings');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const mama = require('@jungjaehoon/mama-core/mama-api');
-// Config paths
-const MAMA_CONFIG_PATH = path_1.default.join(os_1.default.homedir(), '.mama', 'config.yaml');
-const PACKAGE_ROOT_DIR = path_1.default.resolve(__dirname, '../..');
-// Paths to viewer files (now in public/viewer/). Resolved per request so the
-// MAMA_VIEWER_DIR override works for tests without module-load ordering games.
-function getViewerDirectory() {
-    if (process.env.MAMA_VIEWER_DIR) {
-        // resolve() drops trailing slashes; without it the `operatorRoot + path.sep`
-        // traversal guard in the /viewer/operator route would 404 every request for
-        // '/foo/bar/'-style values.
-        return path_1.default.resolve(process.env.MAMA_VIEWER_DIR);
-    }
-    const packagePublicViewer = path_1.default.join(PACKAGE_ROOT_DIR, 'public', 'viewer');
-    const candidateDirs = [
-        path_1.default.join(process.cwd(), 'public', 'viewer'),
-        packagePublicViewer,
-        path_1.default.join(__dirname, '../../public/viewer'),
-        path_1.default.join(__dirname, '../../../public/viewer'),
-        path_1.default.join(process.cwd(), 'packages', 'standalone', 'public', 'viewer'),
-    ];
-    for (const candidate of candidateDirs) {
-        if (fs_1.default.existsSync(candidate) && fs_1.default.statSync(candidate).isDirectory()) {
-            return candidate;
-        }
-    }
-    // Fallback for unusual launch locations.
-    return path_1.default.join(process.cwd(), 'public', 'viewer');
-}
-const viewerHtmlPath = () => path_1.default.join(getViewerDirectory(), 'viewer.html');
-exports.viewerHtmlPath = viewerHtmlPath;
-const viewerCssPath = () => path_1.default.join(getViewerDirectory(), 'viewer.css');
-exports.viewerCssPath = viewerCssPath;
-const swJsPath = () => path_1.default.join(getViewerDirectory(), 'sw.js');
-const manifestJsonPath = () => path_1.default.join(getViewerDirectory(), 'manifest.json');
-const viewerIconDir = () => path_1.default.join(getViewerDirectory(), 'icons');
-const viewerFaviconPath = () => path_1.default.join(getViewerDirectory(), '..', 'favicon.ico');
-const viewerOperatorDir = () => path_1.default.join(getViewerDirectory(), 'operator');
-// Operator bundle assets live under public/viewer/operator/ and are the only
-// extensions that route serves.
-const VIEWER_OPERATOR_MIME = {
-    '.js': 'application/javascript',
-    '.css': 'text/css',
-};
-const DEFAULT_GRAPH_LIMIT = 300;
-exports.DEFAULT_GRAPH_LIMIT = DEFAULT_GRAPH_LIMIT;
-const MAX_GRAPH_LIMIT = 2000;
-const GRAPH_PREVIEW_CHARS = 220;
-const SIMILAR_QUERY_DECISION_CHARS = 400;
-const CODE_ACT_RATE_LIMIT_WINDOW_MS = 60_000;
-const CODE_ACT_RATE_LIMIT_TTL_MS = CODE_ACT_RATE_LIMIT_WINDOW_MS * 5;
-const CODE_ACT_RATE_LIMIT_DEFAULT_MAX = 30;
-const codeActRateBuckets = new Map();
-// Model pattern helpers (used in multiple validation functions)
-const isClaudeModel = (model) => /^claude-/i.test(model);
-const isCodexModel = (model) => /^(gpt-|o\d|codex)/i.test(model);
-const supportedManagedBackends = ['claude', 'codex', 'cline'];
-const isCodexFamilyBackend = (backend) => backend === 'codex';
-const VALIDATION_TRIGGER_TYPES = new Set([
-    'agent_test',
-    'delegate_run',
-    'system_run',
-    'audit',
-]);
-const isOpus46Model = (model) => /^claude-opus-4-6(?:$|-)/i.test(model) || model.toLowerCase() === 'claude-opus-4-latest';
-const VALID_EFFORT_LEVELS = new Set(['low', 'medium', 'high', 'max']);
-function normalizeLegacyManagedBackend(backend, configPath) {
-    if (typeof backend === 'string' && backend.toLowerCase() === 'codex-mcp') {
-        console.warn(`[GraphAPI] Deprecated backend "codex-mcp" at ${configPath}; using "codex" app-server for compatibility.`);
-        return 'codex';
-    }
-    if (typeof backend === 'string' && backend.toLowerCase() === 'gemini') {
-        console.warn(`[GraphAPI] Deprecated backend "gemini" at ${configPath}; using "claude" for compatibility.`);
-        return 'claude';
-    }
-    return backend;
-}
-function normalizeLegacyManagedModel(agent, configPath) {
-    if (typeof agent.model === 'string' && !isClaudeModel(agent.model)) {
-        console.warn(`[GraphAPI] Deprecated Gemini model at ${configPath}; using "claude-sonnet-4-6" for compatibility.`);
-        agent.model = 'claude-sonnet-4-6';
-        return true;
-    }
-    return false;
-}
-function isLegacyGeminiBackend(backend) {
-    return typeof backend === 'string' && backend.toLowerCase() === 'gemini';
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function migrateLegacyManagedBackends(config) {
-    let migrated = false;
-    const next = { ...config };
-    const originalAgent = isRecord(config.agent) ? config.agent : undefined;
-    const originalAgentBackend = originalAgent?.backend;
-    if (isRecord(next.agent)) {
-        const agent = { ...next.agent };
-        const backend = normalizeLegacyManagedBackend(agent.backend, 'agent.backend');
-        if (backend !== agent.backend) {
-            const migrateModel = isLegacyGeminiBackend(agent.backend);
-            agent.backend = backend;
-            if (migrateModel) {
-                normalizeLegacyManagedModel(agent, 'agent.model');
-            }
-            next.agent = agent;
-            migrated = true;
-        }
-    }
-    if (isRecord(next.multi_agent)) {
-        const multiAgent = { ...next.multi_agent };
-        const originalMultiAgent = isRecord(config.multi_agent) ? config.multi_agent : {};
-        const originalMultiAgentBackend = originalMultiAgent.backend;
-        const normalizedMultiAgentBackend = normalizeLegacyManagedBackend(originalMultiAgentBackend, 'multi_agent.backend');
-        if (normalizedMultiAgentBackend !== originalMultiAgentBackend) {
-            multiAgent.backend = normalizedMultiAgentBackend;
-            migrated = true;
-        }
-        const inheritedBackend = originalMultiAgentBackend ?? originalAgentBackend;
-        const normalizedInheritedBackend = normalizeLegacyManagedBackend(inheritedBackend, originalMultiAgentBackend !== undefined ? 'multi_agent.backend' : 'agent.backend');
-        if (isRecord(multiAgent.agents)) {
-            const agents = { ...multiAgent.agents };
-            let agentsMigrated = false;
-            for (const [agentId, agentConfig] of Object.entries(agents)) {
-                if (!isRecord(agentConfig)) {
-                    continue;
-                }
-                const agent = { ...agentConfig };
-                const hasExplicitBackend = Object.prototype.hasOwnProperty.call(agent, 'backend');
-                const priorEffectiveBackend = hasExplicitBackend ? agent.backend : inheritedBackend;
-                const normalizedBackend = normalizeLegacyManagedBackend(priorEffectiveBackend, `multi_agent.agents.${agentId}.backend`);
-                const inheritedBackendWasNormalized = !hasExplicitBackend && normalizedInheritedBackend !== inheritedBackend;
-                if (normalizedBackend !== priorEffectiveBackend || inheritedBackendWasNormalized) {
-                    agent.backend = normalizedBackend;
-                    if (isLegacyGeminiBackend(priorEffectiveBackend)) {
-                        normalizeLegacyManagedModel(agent, `multi_agent.agents.${agentId}.model`);
-                    }
-                    agents[agentId] = agent;
-                    agentsMigrated = true;
-                    migrated = true;
-                }
-            }
-            if (agentsMigrated) {
-                multiAgent.agents = agents;
-            }
-        }
-        if (migrated) {
-            next.multi_agent = multiAgent;
-        }
-    }
-    return (migrated ? next : config);
-}
-function getCodeActRateLimitMax() {
-    const raw = process.env.MAMA_CODE_ACT_RATE_LIMIT_PER_MINUTE;
-    if (!raw) {
-        return CODE_ACT_RATE_LIMIT_DEFAULT_MAX;
-    }
-    const parsed = Number.parseInt(raw, 10);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : CODE_ACT_RATE_LIMIT_DEFAULT_MAX;
-}
-function getCodeActClientKey(req) {
-    return (0, trusted_proxy_js_1.getForwardedClientAddress)(req);
-}
-function pruneCodeActRateBuckets(now) {
-    for (const [clientKey, bucket] of codeActRateBuckets.entries()) {
-        if (now - bucket.lastSeenMs > CODE_ACT_RATE_LIMIT_TTL_MS) {
-            codeActRateBuckets.delete(clientKey);
-        }
-    }
-}
-function checkCodeActRateLimit(req) {
-    const now = Date.now();
-    pruneCodeActRateBuckets(now);
-    const clientKey = getCodeActClientKey(req);
-    const limit = getCodeActRateLimitMax();
-    const existing = codeActRateBuckets.get(clientKey);
-    if (!existing || now - existing.windowStartMs >= CODE_ACT_RATE_LIMIT_WINDOW_MS) {
-        codeActRateBuckets.set(clientKey, { windowStartMs: now, count: 1, lastSeenMs: now });
-        return { allowed: true, clientKey };
-    }
-    existing.lastSeenMs = now;
-    if (existing.count >= limit) {
-        return {
-            allowed: false,
-            clientKey,
-            retryAfterSeconds: Math.max(1, Math.ceil((CODE_ACT_RATE_LIMIT_WINDOW_MS - (now - existing.windowStartMs)) / 1000)),
-        };
-    }
-    existing.count++;
-    return { allowed: true, clientKey };
-}
-// Allowed directories for persona files (security: prevent arbitrary file read)
-const ALLOWED_PERSONA_DIRS = [
-    path_1.default.join(os_1.default.homedir(), '.mama', 'personas'),
-    path_1.default.join(os_1.default.homedir(), '.mama', 'workspace'),
-];
-/**
- * Validate persona_file path to prevent arbitrary file read attacks.
- * Only allows paths within ~/.mama/personas/ or ~/.mama/workspace/.
- * Uses fs.realpathSync to resolve symlinks and prevent symlink escape attacks.
- */
-function isValidPersonaPath(filePath) {
-    if (!filePath) {
-        return false;
-    }
-    const expandedPath = filePath.startsWith('~/')
-        ? path_1.default.join(os_1.default.homedir(), filePath.slice(2))
-        : path_1.default.resolve(filePath);
-    const normalizedPath = path_1.default.normalize(expandedPath);
-    let resolvedPath;
-    try {
-        resolvedPath = fs_1.default.realpathSync(normalizedPath);
-    }
-    catch {
-        // File doesn't exist or can't be resolved - reject
-        return false;
-    }
-    return ALLOWED_PERSONA_DIRS.some((dir) => resolvedPath.startsWith(dir + path_1.default.sep));
-}
-function buildDecisionPreview(decision) {
-    const normalized = decision.replace(/\s+/g, ' ').trim();
-    if (normalized.length <= GRAPH_PREVIEW_CHARS) {
-        return normalized;
-    }
-    return `${normalized.slice(0, GRAPH_PREVIEW_CHARS)}...`;
-}
-function mapDecisionRowToGraphNode(row) {
-    return {
-        id: row.id,
-        topic: row.topic,
-        decision_preview: buildDecisionPreview(row.decision),
-        outcome: row.outcome,
-        confidence: row.confidence,
-        created_at: row.created_at,
-    };
-}
-function parseGraphLimit(params) {
-    if (params.get('full') === 'true') {
-        return null;
-    }
-    const rawLimit = params.get('limit');
-    if (!rawLimit) {
-        return DEFAULT_GRAPH_LIMIT;
-    }
-    const parsed = parseInt(rawLimit, 10);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-        return DEFAULT_GRAPH_LIMIT;
-    }
-    return Math.min(parsed, MAX_GRAPH_LIMIT);
-}
-function buildGraphMeta(input) {
-    return {
-        total_nodes: input.returnedNodes,
-        total_edges: input.returnedEdges,
-        similarity_edges: input.similarityEdges,
-        partial: input.isPartial,
-        total_available_nodes: input.totalNodes,
-        total_available_edges: input.totalEdges,
-    };
-}
-async function getAllNodes(limit) {
-    const adapter = getAdapter();
-    const sql = `
-    SELECT
-      id,
-      topic,
-      decision,
-      outcome,
-      confidence,
-      created_at
-    FROM decisions
-    ORDER BY created_at DESC
-  `;
-    const stmt = adapter.prepare(limit ? `${sql}\nLIMIT ?` : sql);
-    const rows = (limit ? stmt.all(limit) : stmt.all());
-    return rows.map(mapDecisionRowToGraphNode);
-}
-/**
- * Fetch nodes by their IDs (for neighbor expansion).
- * Returns only nodes whose IDs are in the given set.
- */
-async function getNodesByIds(ids) {
-    if (ids.size === 0)
-        return [];
-    const adapter = getAdapter();
-    const placeholders = Array.from(ids)
-        .map(() => '?')
-        .join(',');
-    const stmt = adapter.prepare(`
-    SELECT id, topic, decision, outcome, confidence, created_at
-    FROM decisions
-    WHERE id IN (${placeholders})
-  `);
-    const rows = stmt.all(...Array.from(ids));
-    return rows.map(mapDecisionRowToGraphNode);
-}
-async function getDecisionDetail(id) {
-    const adapter = getAdapter();
-    const stmt = adapter.prepare(`
-    SELECT
-      id,
-      topic,
-      decision,
-      reasoning,
-      outcome,
-      confidence,
-      created_at
-    FROM decisions
-    WHERE id = ?
-  `);
-    const row = stmt.get(id);
-    if (!row) {
-        return null;
-    }
-    return {
-        id: row.id,
-        topic: row.topic,
-        decision: row.decision,
-        reasoning: row.reasoning,
-        outcome: row.outcome,
-        confidence: row.confidence,
-        created_at: row.created_at,
-        decision_preview: buildDecisionPreview(row.decision),
-    };
-}
-async function getAllEdges() {
-    const adapter = getAdapter();
-    const stmt = adapter.prepare(`
-    SELECT
-      from_id,
-      to_id,
-      relationship,
-      reason
-    FROM decision_edges
-    ORDER BY created_at DESC
-  `);
-    const rows = stmt.all();
-    return rows.map((row) => ({
-        from: row.from_id,
-        to: row.to_id,
-        relationship: row.relationship,
-        reason: row.reason,
-    }));
-}
-function safeParseJsonArray(value) {
-    try {
-        const parsed = JSON.parse(value);
-        return Array.isArray(parsed) ? parsed : [];
-    }
-    catch {
-        return [];
-    }
-}
-async function getAllCheckpoints() {
-    const adapter = getAdapter();
-    const stmt = adapter.prepare(`
-    SELECT
-      id,
-      timestamp,
-      summary,
-      open_files,
-      next_steps,
-      status
-    FROM checkpoints
-    ORDER BY timestamp DESC
-    LIMIT 50
-  `);
-    const rows = stmt.all();
-    return rows.map((row) => ({
-        id: row.id,
-        timestamp: row.timestamp,
-        summary: row.summary,
-        open_files: row.open_files ? safeParseJsonArray(row.open_files) : [],
-        next_steps: row.next_steps,
-        status: row.status,
-    }));
-}
-function getUniqueTopics(nodes) {
-    const topicSet = new Set(nodes.map((n) => n.topic));
-    return Array.from(topicSet).sort();
-}
-function filterNodesByTopic(nodes, topic) {
-    return nodes.filter((n) => n.topic === topic);
-}
-function filterEdgesByNodes(edges, nodes) {
-    const nodeIds = new Set(nodes.map((n) => n.id));
-    return edges.filter((e) => nodeIds.has(e.from) || nodeIds.has(e.to));
-}
-function serveStaticFile(res, filePath, contentType, extraHeaders = {}) {
-    try {
-        const stats = fs_1.default.statSync(filePath);
-        if (!stats.isFile()) {
-            throw new Error('Requested path is not a file');
-        }
-        const isBinary = contentType.startsWith('image/') || contentType === 'application/octet-stream';
-        const content = isBinary ? fs_1.default.readFileSync(filePath) : fs_1.default.readFileSync(filePath, 'utf8');
-        const etag = `"${Date.now()}"`;
-        const fullContentType = isBinary ? contentType : `${contentType}; charset=utf-8`;
-        res.writeHead(200, {
-            'Content-Type': fullContentType,
-            'Cache-Control': 'no-cache, no-store, must-revalidate, max-age=0',
-            Pragma: 'no-cache',
-            Expires: '0',
-            ETag: etag,
-            ...extraHeaders,
-        });
-        res.end(content);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] Static file error: ${message}`);
-        const err = error;
-        if (err?.code === 'ENOENT' || err?.code === 'EISDIR' || /not a file/i.test(message)) {
-            res.writeHead(404, { 'Content-Type': 'text/plain' });
-            res.end('Not found');
-            return;
-        }
-        res.writeHead(500, { 'Content-Type': 'text/plain' });
-        res.end('Internal server error');
-    }
-}
-function handleViewerRequest(_req, res) {
-    serveStaticFile(res, viewerHtmlPath(), 'text/html');
-}
-function handleCssRequest(_req, res) {
-    serveStaticFile(res, viewerCssPath(), 'text/css');
-}
-async function handleGraphRequest(_req, res, params) {
-    const startTime = Date.now();
-    try {
-        await initDB();
-        const limit = parseGraphLimit(params);
-        const allEdges = await getAllEdges();
-        const topicFilter = params.get('topic');
-        // When topic filter is active, fetch all nodes first so the filter
-        // sees every matching node — then apply limit.  Without this, SQL
-        // LIMIT could exclude matching nodes that appear later in the table.
-        let nodes = await getAllNodes(topicFilter ? null : limit);
-        let edges = allEdges;
-        if (topicFilter) {
-            nodes = filterNodesByTopic(nodes, topicFilter);
-            if (limit !== null) {
-                nodes = nodes.slice(0, limit);
-            }
-            edges = filterEdgesByNodes(edges, nodes);
-        }
-        else if (limit !== null) {
-            edges = filterEdgesByNodes(edges, nodes);
-        }
-        // Expand: fetch neighbor nodes connected via edges but outside the LIMIT
-        const nodeIdSet = new Set(nodes.map((n) => n.id));
-        const missingIds = new Set();
-        for (const e of edges) {
-            if (!nodeIdSet.has(e.from))
-                missingIds.add(e.from);
-            if (!nodeIdSet.has(e.to))
-                missingIds.add(e.to);
-        }
-        if (missingIds.size > 0) {
-            const neighborNodes = await getNodesByIds(missingIds);
-            nodes = [...nodes, ...neighborNodes];
-            // Re-filter edges now that we have the full node set
-            edges = filterEdgesByNodes(allEdges, nodes);
-        }
-        const includeCluster = params.get('cluster') === 'true';
-        let similarityEdges = [];
-        if (includeCluster) {
-            similarityEdges = await getSimilarityEdges();
-            const nodeIds = new Set(nodes.map((n) => n.id));
-            similarityEdges = similarityEdges.filter((e) => nodeIds.has(e.from) && nodeIds.has(e.to));
-        }
-        const latency = Date.now() - startTime;
-        const meta = buildGraphMeta({
-            totalNodes: limit ? await getDecisionCount() : nodes.length,
-            totalEdges: allEdges.length,
-            similarityEdges: similarityEdges.length,
-            isPartial: !topicFilter && limit !== null,
-            returnedNodes: nodes.length,
-            returnedEdges: edges.length,
-        });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            nodes,
-            edges,
-            similarityEdges,
-            meta,
-            latency,
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] Error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'INTERNAL_ERROR',
-            message,
-        }));
-    }
-}
-async function getDecisionCount() {
-    const adapter = getAdapter();
-    const row = adapter.prepare('SELECT COUNT(*) as count FROM decisions').get();
-    return row?.count ?? 0;
-}
-async function handleGraphDetailRequest(_req, res, params) {
-    try {
-        const decisionId = params.get('id');
-        if (!decisionId) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'MISSING_ID',
-                message: 'Missing required parameter: id',
-            }));
-            return;
-        }
-        await initDB();
-        const detail = await getDecisionDetail(decisionId);
-        if (!detail) {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, code: 'NOT_FOUND', message: 'Decision not found' }));
-            return;
-        }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ node: detail }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        logger.error('Graph detail error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: true, code: 'INTERNAL_ERROR', message }));
-    }
-}
-function readBody(req) {
-    // When mounted as Express middleware, body is already parsed by express.json()
-    const expressBody = req.body;
-    if (expressBody && typeof expressBody === 'object') {
-        return Promise.resolve(expressBody);
-    }
-    return new Promise((resolve, reject) => {
-        let data = '';
-        req.on('data', (chunk) => {
-            data += chunk;
-            if (data.length > 1_048_576) {
-                req.destroy();
-                reject(new Error('Request body too large (max 1MB)'));
-                return;
-            }
-        });
-        req.on('end', () => {
-            try {
-                resolve(JSON.parse(data));
-            }
-            catch {
-                reject(new Error('Invalid JSON'));
-            }
-        });
-        req.on('error', reject);
-    });
-}
-async function readBodyOrRespond(req, res) {
-    try {
-        return await readBody(req);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        const statusCode = message === 'Invalid JSON'
-            ? 400
-            : message.includes('Request body too large (max 1MB)')
-                ? 413
-                : 500;
-        res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: message === 'Invalid JSON'
-                ? 'Invalid JSON'
-                : message.includes('Request body too large (max 1MB)')
-                    ? 'Request body too large (max 1MB)'
-                    : message,
-        }));
-        return null;
-    }
-}
-async function handleUpdateRequest(req, res) {
-    try {
-        const body = await readBody(req);
-        if (!body.id || !body.outcome) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'INVALID_REQUEST',
-                message: 'Missing required fields: id, outcome',
-            }));
-            return;
-        }
-        await initDB();
-        await mama.updateOutcome(body.id, {
-            outcome: body.outcome,
-            failure_reason: body.reason,
-        });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            success: true,
-            id: body.id,
-            outcome: String(body.outcome).toUpperCase(),
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] Update error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'UPDATE_FAILED',
-            message,
-        }));
-    }
-}
-async function getSimilarityEdges() {
-    const adapter = getAdapter();
-    const stmt = adapter.prepare(`
-    SELECT id, topic, decision FROM decisions
-    ORDER BY created_at DESC
-    LIMIT 100
-  `);
-    const decisions = stmt.all();
-    if (decisions.length < 2) {
-        return [];
-    }
-    const similarityEdges = [];
-    const similarityEdgeKeys = new Set();
-    for (const decision of decisions.slice(0, 50)) {
-        try {
-            const query = `${decision.topic} ${decision.decision}`;
-            const embedding = await generateEmbedding(query, 'query');
-            const similar = (await vectorSearch(embedding, 3, 0.7));
-            for (const s of similar) {
-                if (s.id !== decision.id && s.similarity > 0.7) {
-                    const edgeKey = [decision.id, s.id].sort().join('|');
-                    if (!similarityEdgeKeys.has(edgeKey)) {
-                        similarityEdges.push({
-                            from: decision.id,
-                            to: s.id,
-                            relationship: 'similar',
-                            similarity: s.similarity,
-                        });
-                        similarityEdgeKeys.add(edgeKey);
-                    }
-                }
-            }
-        }
-        catch (e) {
-            const msg = e instanceof Error ? e.message : String(e);
-            console.error(`[GraphAPI] Similarity search error for ${decision.id}:`, msg);
-        }
-    }
-    return similarityEdges;
-}
-async function handleSimilarRequest(_req, res, params) {
-    const startTime = Date.now();
-    try {
-        const decisionId = params.get('id');
-        console.log(`[GraphAPI] Similar request for decision: ${decisionId}`);
-        if (!decisionId) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'MISSING_ID',
-                message: 'Missing required parameter: id',
-            }));
-            return;
-        }
-        console.log(`[GraphAPI] Initializing DB...`);
-        await initDB();
-        console.log(`[GraphAPI] Fetching decision ${decisionId}...`);
-        const adapter = getAdapter();
-        const stmt = adapter.prepare(`
-      SELECT topic, decision, reasoning FROM decisions WHERE id = ?
-    `);
-        const decision = stmt.get(decisionId);
-        if (!decision) {
-            console.log(`[GraphAPI] Decision ${decisionId} not found`);
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'NOT_FOUND',
-                message: 'Decision not found',
-            }));
-            return;
-        }
-        const searchQuery = `${decision.topic} ${decision.decision.slice(0, SIMILAR_QUERY_DECISION_CHARS)}`;
-        console.log(`[GraphAPI] Searching for similar decisions with query: "${searchQuery.substring(0, 50)}..."`);
-        const searchStart = Date.now();
-        const results = await mama.suggest(searchQuery, {
-            limit: 6,
-            threshold: 0.5,
-        });
-        console.log(`[GraphAPI] Semantic search completed in ${Date.now() - searchStart}ms`);
-        let similar = [];
-        if (results && results.results) {
-            similar = results.results
-                .filter((r) => r.id !== decisionId)
-                .slice(0, 5)
-                .map((r) => ({
-                id: r.id,
-                topic: r.topic,
-                decision: r.decision,
-                similarity: (r.similarity ?? r.final_score ?? 0.5),
-                outcome: (r.outcome ?? null),
-            }));
-        }
-        console.log(`[GraphAPI] Found ${similar.length} similar decisions (total time: ${Date.now() - startTime}ms)`);
-        res.writeHead(200, {
-            'Content-Type': 'application/json',
-        });
-        res.end(JSON.stringify({
-            id: decisionId,
-            similar,
-            count: similar.length,
-        }));
-        console.log(`[GraphAPI] Response sent for ${decisionId}`);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        const stack = error instanceof Error ? error.stack : undefined;
-        console.error(`[GraphAPI] Similar error: ${message}`);
-        console.error(`[GraphAPI] Similar error stack:`, stack);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'SEARCH_FAILED',
-            message,
-        }));
-    }
-}
-async function handleMamaSearchRequest(_req, res, params) {
-    try {
-        const query = params.get('q');
-        const rawLimit = parseInt(params.get('limit') || '10', 10);
-        const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 500) : 10;
-        if (!query) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'MISSING_QUERY',
-                message: 'Missing required parameter: q',
-            }));
-            return;
-        }
-        await initDB();
-        const topicPrefix = params.get('topicPrefix') || '';
-        const fetchLimit = topicPrefix ? Math.max(limit * 5, 100) : limit;
-        const searchResults = await mama.suggest(query, {
-            limit: fetchLimit,
-            threshold: 0.3,
-            topicPrefix: topicPrefix || undefined,
-        });
-        let results = [];
-        if (searchResults && searchResults.results) {
-            let rawResults = searchResults.results;
-            if (topicPrefix) {
-                rawResults = rawResults.filter((r) => String(r.topic || '').startsWith(topicPrefix));
-            }
-            results = rawResults.slice(0, limit).map((r) => ({
-                id: r.id,
-                topic: r.topic,
-                decision: r.decision,
-                reasoning: r.reasoning,
-                outcome: (r.outcome ?? null),
-                confidence: (r.confidence ?? null),
-                similarity: (r.similarity ?? r.final_score ?? 0.5),
-                created_at: r.created_at,
-                event_date: r.event_date ?? null,
-            }));
-        }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            query,
-            results,
-            count: results.length,
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] MAMA search error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'SEARCH_FAILED',
-            message,
-        }));
-    }
-}
-async function handleMamaSaveRequest(req, res) {
-    try {
-        const body = await readBody(req);
-        if (!body.topic || !body.decision || !body.reasoning) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'MISSING_FIELDS',
-                message: 'Missing required fields: topic, decision, reasoning',
-            }));
-            return;
-        }
-        await initDB();
-        const result = await mama.save({
-            type: 'user_decision',
-            topic: body.topic,
-            decision: body.decision,
-            reasoning: body.reasoning,
-            confidence: body.confidence ?? 0.8,
-            ...(body.event_date ? { event_date: body.event_date } : {}),
-        });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            success: true,
-            id: result.id,
-            message: 'Decision saved successfully',
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] MAMA save error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'SAVE_FAILED',
-            message,
-        }));
-    }
-}
-async function handleCheckpointSaveRequest(req, res) {
-    try {
-        const body = await readBody(req);
-        if (!body.summary) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'MISSING_FIELDS',
-                message: 'Missing required field: summary',
-            }));
-            return;
-        }
-        await initDB();
-        const checkpointId = await mama.saveCheckpoint(body.summary, body.open_files || [], body.next_steps || '');
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            success: true,
-            id: checkpointId,
-            message: 'Checkpoint saved successfully',
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] Checkpoint save error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'SAVE_FAILED',
-            message,
-        }));
-    }
-}
-async function handleCheckpointLoadRequest(_req, res) {
-    try {
-        await initDB();
-        const checkpoint = await mama.loadCheckpoint();
-        if (!checkpoint) {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'NO_CHECKPOINT',
-                message: 'No checkpoint found',
-            }));
-            return;
-        }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            success: true,
-            checkpoint,
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] Checkpoint load error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'LOAD_FAILED',
-            message,
-        }));
-    }
-}
-async function handleCheckpointsRequest(_req, res) {
-    try {
-        await initDB();
-        const checkpoints = await getAllCheckpoints();
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            checkpoints,
-            count: checkpoints.length,
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] Checkpoints error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'CHECKPOINTS_FAILED',
-            message,
-        }));
-    }
-}
-function createGraphHandler(options = {}) {
-    let entityAuditQueue = null;
-    let entityAuditQueuePromise = null;
-    const getEntityAuditQueue = async () => {
-        if (entityAuditQueue) {
-            return entityAuditQueue;
-        }
-        if (entityAuditQueuePromise) {
-            return entityAuditQueuePromise;
-        }
-        entityAuditQueuePromise = (async () => {
-            await initDB();
-            const queue = new entity_audit_queue_js_1.EntityAuditRunQueue({ adapter: getAdapter() });
-            const recovered = queue.recoverOrphans();
-            if (recovered > 0) {
-                logger.warn('[entity-audit] Recovered orphaned audit runs on boot', { recovered });
-            }
-            entityAuditQueue = queue;
-            return queue;
-        })();
-        return entityAuditQueuePromise;
-    };
-    const parsePositiveInt = (value, fallback, max) => {
-        const parsed = Number.parseInt(value ?? '', 10);
-        if (!Number.isFinite(parsed) || parsed < 1) {
-            return fallback;
-        }
-        return Math.min(parsed, max);
-    };
-    const parseValidationTriggerType = (value) => {
-        if (!value) {
-            return null;
-        }
-        const normalized = value.trim().toLowerCase();
-        return VALIDATION_TRIGGER_TYPES.has(normalized) ? normalized : null;
-    };
-    return async function graphHandler(req, res) {
-        if (!req.url) {
-            res.writeHead(400, { 'Content-Type': 'text/plain' });
-            res.end('Bad Request');
-            return true;
-        }
-        const url = new URL(req.url, `http://${req.headers.host}`);
-        const pathname = url.pathname;
-        const params = url.searchParams;
-        console.log('[GraphHandler] Request:', req.method, pathname);
-        // Set CORS headers — restrict to localhost origins only
-        const origin = req.headers.origin || '';
-        const isLocalhost = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
-        if (isLocalhost) {
-            res.setHeader('Access-Control-Allow-Origin', origin);
-        }
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-        // Handle preflight OPTIONS requests
-        if (req.method === 'OPTIONS') {
-            res.writeHead(204);
-            res.end();
-            return true;
-        }
-        // Route: GET / - redirect to /viewer, the ONE public shell. The temporary
-        // /ui SPA route was retired; there is no second face to fall back to.
-        if (pathname === '/' && req.method === 'GET') {
-            console.log('[GraphHandler] Redirecting / to /viewer');
-            res.writeHead(302, { Location: '/viewer' });
-            res.end();
-            return true;
-        }
-        // Route: GET/HEAD /viewer or /viewer/ - serve HTML viewer
-        if ((pathname === '/viewer' || pathname === '/viewer/') &&
-            (req.method === 'GET' || req.method === 'HEAD')) {
-            console.log('[GraphHandler] Serving viewer.html');
-            handleViewerRequest(req, res);
-            return true;
-        }
-        // Route: GET/HEAD /viewer/viewer.css - serve stylesheet
-        if (pathname === '/viewer/viewer.css' && (req.method === 'GET' || req.method === 'HEAD')) {
-            handleCssRequest(req, res);
-            return true;
-        }
-        // Route: GET/HEAD /sw.js - serve Service Worker
-        if (pathname === '/sw.js' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, swJsPath(), 'application/javascript');
-            return true;
-        }
-        // Route: GET/HEAD /viewer/sw.js - serve Service Worker (alternative path)
-        if (pathname === '/viewer/sw.js' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, swJsPath(), 'application/javascript');
-            return true;
-        }
-        // Route: GET/HEAD /viewer/manifest.json - serve PWA manifest
-        if (pathname === '/viewer/manifest.json' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, manifestJsonPath(), 'application/json');
-            return true;
-        }
-        // Route: GET/HEAD /favicon.ico - serve favicon
-        if (pathname === '/favicon.ico' && (req.method === 'GET' || req.method === 'HEAD')) {
-            serveStaticFile(res, viewerFaviconPath(), 'image/x-icon');
-            return true;
-        }
-        // Route: GET/HEAD /viewer/operator/*.{js,css} - operator bundle assets.
-        // Traversal-safe and extension-allowlisted: this route must never become a
-        // generic file server rooted at the viewer directory.
-        if (pathname.startsWith('/viewer/operator/') &&
-            (req.method === 'GET' || req.method === 'HEAD')) {
-            const operatorRoot = viewerOperatorDir();
-            const resolved = path_1.default.resolve(operatorRoot, pathname.slice('/viewer/operator/'.length));
-            const contentType = VIEWER_OPERATOR_MIME[path_1.default.extname(resolved)];
-            if (!resolved.startsWith(operatorRoot + path_1.default.sep) || !contentType) {
-                res.writeHead(404, { 'Content-Type': 'text/plain' });
-                res.end('Not found');
-                return true;
-            }
-            serveStaticFile(res, resolved, contentType);
-            return true;
-        }
-        // Route: GET/HEAD /viewer/icons/*.png - serve PWA icons
-        if (pathname.startsWith('/viewer/icons/') &&
-            pathname.endsWith('.png') &&
-            (req.method === 'GET' || req.method === 'HEAD')) {
-            const fileName = path_1.default.basename(pathname.split('/').pop() || '');
-            const filePath = path_1.default.join(viewerIconDir(), fileName);
-            serveStaticFile(res, filePath, 'image/png');
-            return true;
-        }
-        // Route: GET/HEAD /viewer/icons/*.svg - serve SVG icons
-        if (pathname.startsWith('/viewer/icons/') &&
-            pathname.endsWith('.svg') &&
-            (req.method === 'GET' || req.method === 'HEAD')) {
-            const fileName = path_1.default.basename(pathname.split('/').pop() || '');
-            const filePath = path_1.default.join(viewerIconDir(), fileName);
-            serveStaticFile(res, filePath, 'image/svg+xml');
-            return true;
-        }
-        // Route: GET/HEAD /viewer/js/utils/*.js - serve utility modules
-        if (pathname.startsWith('/viewer/js/utils/') &&
-            pathname.endsWith('.js') &&
-            (req.method === 'GET' || req.method === 'HEAD')) {
-            const fileName = pathname.split('/').pop();
-            const filePath = path_1.default.join(getViewerDirectory(), 'js', 'utils', fileName);
-            serveStaticFile(res, filePath, 'application/javascript');
-            return true;
-        }
-        // Route: GET/HEAD /viewer/js/*.js - serve first-party viewer entry modules
-        if (pathname.startsWith('/viewer/js/') &&
-            !pathname.includes('/modules/') &&
-            !pathname.includes('/utils/') &&
-            pathname.endsWith('.js') &&
-            (req.method === 'GET' || req.method === 'HEAD')) {
-            const fileName = pathname.split('/').pop();
-            const filePath = path_1.default.join(getViewerDirectory(), 'js', fileName);
-            serveStaticFile(res, filePath, 'application/javascript');
-            return true;
-        }
-        // Route: GET/HEAD /viewer/js/modules/*.js - serve feature modules
-        if (pathname.startsWith('/viewer/js/modules/') &&
-            pathname.endsWith('.js') &&
-            (req.method === 'GET' || req.method === 'HEAD')) {
-            const fileName = pathname.split('/').pop();
-            const filePath = path_1.default.join(getViewerDirectory(), 'js', 'modules', fileName);
-            serveStaticFile(res, filePath, 'application/javascript');
-            return true;
-        }
-        // ── Auth gate: all routes below require authentication ──
-        // Static assets (viewer, css, js, icons) are served above without auth.
-        // All data API routes below must pass isAuthenticated().
-        // Note: /graph/* write endpoints are also gated in start.ts for defense-in-depth.
-        if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-            (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, code: 'UNAUTHORIZED', message: 'Authentication required.' }));
-            return true;
-        }
-        // Route: GET /graph/similar - find similar decisions (check before /graph)
-        if (pathname === '/graph/similar' && req.method === 'GET') {
-            console.log('[GraphHandler] Routing to handleSimilarRequest');
-            await handleSimilarRequest(req, res, params);
-            return true;
-        }
-        // Route: GET /graph/detail - fetch full node detail lazily
-        if (pathname === '/graph/detail' && req.method === 'GET') {
-            await handleGraphDetailRequest(req, res, params);
-            return true;
-        }
-        // Route: POST /graph/update - update decision outcome
-        if (pathname === '/graph/update' && req.method === 'POST') {
-            await handleUpdateRequest(req, res);
-            return true;
-        }
-        // Route: GET /graph - API endpoint
-        if (pathname === '/graph' && req.method === 'GET') {
-            await handleGraphRequest(req, res, params);
-            return true;
-        }
-        // Alias: GET /api/graph -> /graph
-        if (pathname === '/api/graph' && req.method === 'GET') {
-            await handleGraphRequest(req, res, params);
-            return true;
-        }
-        // Alias: GET /api/graph/detail -> /graph/detail
-        if (pathname === '/api/graph/detail' && req.method === 'GET') {
-            await handleGraphDetailRequest(req, res, params);
-            return true;
-        }
-        // Route: GET /checkpoints - list all checkpoints
-        if (pathname === '/checkpoints' && req.method === 'GET') {
-            await handleCheckpointsRequest(req, res);
-            return true;
-        }
-        // Alias: GET /api/checkpoints -> /checkpoints
-        if (pathname === '/api/checkpoints' && req.method === 'GET') {
-            await handleCheckpointsRequest(req, res);
-            return true;
-        }
-        // Route: GET /api/mama/search - semantic search for decisions
-        if (pathname === '/api/mama/search' && req.method === 'GET') {
-            await handleMamaSearchRequest(req, res, params);
-            return true;
-        }
-        // Alias: GET /api/search -> /api/mama/search (with query param conversion)
-        if (pathname === '/api/search' && req.method === 'GET') {
-            const query = params.get('query');
-            if (query) {
-                params.set('q', query);
-            }
-            await handleMamaSearchRequest(req, res, params);
-            return true;
-        }
-        // Route: POST /api/mama/save - save a new decision
-        if (pathname === '/api/mama/save' && req.method === 'POST') {
-            await handleMamaSaveRequest(req, res);
-            return true;
-        }
-        // Alias: POST /api/save -> /api/mama/save
-        if (pathname === '/api/save' && req.method === 'POST') {
-            await handleMamaSaveRequest(req, res);
-            return true;
-        }
-        // Route: POST /api/mama/ingest-conversation - ingest conversation with LLM extraction
-        if (pathname === '/api/mama/ingest-conversation' && req.method === 'POST') {
-            try {
-                const body = await readBody(req);
-                // Validate payload at HTTP boundary
-                if (!Array.isArray(body.messages) || body.messages.length === 0) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: true, message: 'messages must be a non-empty array' }));
-                    return true;
-                }
-                const validRoles = new Set(['user', 'assistant']);
-                for (const msg of body.messages) {
-                    if (typeof msg !== 'object' ||
-                        msg === null ||
-                        typeof msg.role !== 'string' ||
-                        typeof msg.content !== 'string') {
-                        res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({
-                            error: true,
-                            message: 'Each message must have string "role" and "content" fields',
-                        }));
-                        return true;
-                    }
-                    if (!validRoles.has(msg.role)) {
-                        res.writeHead(400, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({
-                            error: true,
-                            message: `Invalid role "${msg.role}". Must be "user" or "assistant"`,
-                        }));
-                        return true;
-                    }
-                }
-                if (body.scopes && !Array.isArray(body.scopes)) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: true, message: 'scopes must be an array' }));
-                    return true;
-                }
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { ingestConversation } = require('@jungjaehoon/mama-core');
-                const source = body.source || {
-                    package: 'standalone',
-                    source_type: 'api',
-                };
-                const result = await ingestConversation({
-                    messages: (body.messages || []),
-                    scopes: (body.scopes || []),
-                    source: { package: source.package, source_type: source.source_type },
-                    extract: body.extract,
-                    topicPrefix: body.topicPrefix || undefined,
-                    sessionDate: body.sessionDate || undefined,
-                });
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: true, ...result }));
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                // Use 400 for client errors (validation), 500 for unexpected server failures
-                const isClientError = error instanceof Error &&
-                    (error.message.includes('required') ||
-                        error.message.includes('invalid') ||
-                        error.message.includes('missing'));
-                const statusCode = isClientError ? 400 : 500;
-                res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: true, message }));
-            }
-            return true;
-        }
-        // Retired model-as-function endpoints fail explicitly. Conversation memory
-        // is handled by the standing owner through mama_save, not a hidden agent.
-        if ((pathname === '/api/memory-agent/ingest' || pathname === '/api/mama/audit-conversation') &&
-            req.method === 'POST') {
-            res.writeHead(410, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                message: 'Separate memory-agent ingestion was retired; use the One MAMA owner runtime',
-            }));
-            return true;
-        }
-        // Alias: POST /api/update -> /graph/update
-        if (pathname === '/api/update' && req.method === 'POST') {
-            await handleUpdateRequest(req, res);
-            return true;
-        }
-        // Route: POST /api/checkpoint/save - save session checkpoint
-        if (pathname === '/api/checkpoint/save' && req.method === 'POST') {
-            await handleCheckpointSaveRequest(req, res);
-            return true;
-        }
-        // Route: GET /api/checkpoint/load - load latest checkpoint
-        if (pathname === '/api/checkpoint/load' && req.method === 'GET') {
-            await handleCheckpointLoadRequest(req, res);
-            return true;
-        }
-        // Route: GET /api/health - health check
-        if (pathname === '/api/health' && req.method === 'GET') {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ status: 'ok', service: 'MAMA Graph API' }));
-            return true;
-        }
-        // Route: GET /api/metrics/health - system health report
-        if (pathname === '/api/metrics/health' && req.method === 'GET') {
-            // Prefer HealthCheckService (connection-based) over legacy stats-only service
-            if (options.healthCheckService) {
-                try {
-                    const report = await options.healthCheckService.check();
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(report));
-                }
-                catch (e) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: String(e) }));
-                }
-                return true;
-            }
-            // Fallback to legacy HealthScoreService
-            if (!options.healthService) {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Metrics disabled' }));
-                return true;
-            }
-            try {
-                const report = options.healthService.compute();
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(report));
-            }
-            catch (e) {
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: String(e) }));
-            }
-            return true;
-        }
-        // Route: GET /api/dashboard/status - dashboard status
-        if (pathname === '/api/dashboard/status' && req.method === 'GET') {
-            await handleDashboardStatusRequest(req, res);
-            return true;
-        }
-        // Route: GET /api/config - get current config
-        if (pathname === '/api/config' && req.method === 'GET') {
-            await handleGetConfigRequest(req, res);
-            return true;
-        }
-        // Route: PUT /api/config - update config
-        if (pathname === '/api/config' && req.method === 'PUT') {
-            await handleUpdateConfigRequest(req, res, options);
-            return true;
-        }
-        // Route: POST /api/restart - graceful restart via mama CLI
-        if (pathname === '/api/restart' && req.method === 'POST') {
-            if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                res.writeHead(401, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: true, code: 'UNAUTHORIZED', message: 'Authentication required' }));
-                return true;
-            }
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, message: 'Restarting...' }));
-            // Prefer systemd restart when running as a service; otherwise spawn detached daemon.
-            setTimeout(() => {
-                console.log('[API] Restart requested via API — spawning new daemon');
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { spawn: spawnChild } = require('node:child_process');
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { openSync } = require('node:fs');
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { join: joinPath, dirname: dirnamePath } = require('node:path');
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { homedir: getHome } = require('node:os');
-                const isSystemd = Boolean(process.env.INVOCATION_ID) || Boolean(process.env.SYSTEMD_EXEC_PID);
-                if (isSystemd) {
-                    spawnChild('systemctl', ['--user', 'restart', 'mama-os'], {
-                        detached: true,
-                        stdio: 'ignore',
-                    }).unref();
-                    process.exit(0);
-                }
-                const script = process.argv[1];
-                if (!script) {
-                    throw new Error('Unable to determine executable script path');
-                }
-                const logDir = joinPath(getHome(), '.mama', 'logs');
-                const logFile = joinPath(logDir, 'daemon.log');
-                const out = openSync(logFile, 'a');
-                const runCli = (cmd) => {
-                    const child = spawnChild(process.execPath, [script, cmd], {
-                        detached: true,
-                        stdio: ['ignore', out, out],
-                        cwd: dirnamePath(script),
-                        env: { ...process.env, MAMA_DAEMON: '1' },
-                    });
-                    child.unref();
-                };
-                // Wait for port to be released after stop (2s delay between stop and start)
-                setTimeout(() => {
-                    runCli('stop');
-                    setTimeout(() => {
-                        runCli('start');
-                        process.exit(0);
-                    }, 2000);
-                }, 1000);
-            }, 500);
-            return true;
-        }
-        // Route: GET /api/memory/export - export decisions
-        if (pathname === '/api/memory/export' && req.method === 'GET') {
-            await handleExportRequest(req, res, params);
-            return true;
-        }
-        // ── UI Command API (SmartStore bidirectional communication) ──
-        // Route: GET /api/ui/commands — viewer polls for pending commands
-        if (pathname === '/api/ui/commands' && req.method === 'GET') {
-            if (options.uiCommandQueue) {
-                (0, ui_command_handler_js_1.handleGetUICommands)(res, options.uiCommandQueue);
-            }
-            else {
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ commands: [] }));
-            }
-            return true;
-        }
-        // Route: GET /api/ui/page-context — agent reads current viewer state
-        if (pathname === '/api/ui/page-context' && req.method === 'GET') {
-            if (options.uiCommandQueue) {
-                const { handleGetPageContext } = await import('./ui-command-handler.js');
-                handleGetPageContext(res, options.uiCommandQueue);
-            }
-            else {
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: true, context: null }));
-            }
-            return true;
-        }
-        // Route: POST /api/ui/page-context — viewer reports current page state
-        if (pathname === '/api/ui/page-context' && req.method === 'POST') {
-            if (options.uiCommandQueue) {
-                const body = await readBodyOrRespond(req, res);
-                if (!body) {
-                    return true;
-                }
-                (0, ui_command_handler_js_1.handlePostPageContext)(res, body, options.uiCommandQueue);
-            }
-            else {
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: true }));
-            }
-            return true;
-        }
-        // Route: POST /api/ui/commands — agent pushes UI commands
-        if (pathname === '/api/ui/commands' && req.method === 'POST') {
-            if (options.uiCommandQueue) {
-                const body = await readBodyOrRespond(req, res);
-                if (!body) {
-                    return true;
-                }
-                (0, ui_command_handler_js_1.handlePostUICommand)(res, body, options.uiCommandQueue);
-            }
-            else {
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: true }));
-            }
-            return true;
-        }
-        // Route: POST /api/ui/commands/ack — viewer acknowledges applied commands
-        if (pathname === '/api/ui/commands/ack' && req.method === 'POST') {
-            if (options.uiCommandQueue) {
-                const body = await readBodyOrRespond(req, res);
-                if (!body) {
-                    return true;
-                }
-                const { handlePostUICommandAck } = await import('./ui-command-handler.js');
-                handlePostUICommandAck(res, body, options.uiCommandQueue);
-            }
-            else {
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: true, acknowledged: 0 }));
-            }
-            return true;
-        }
-        // ── Agent Management API (Managed Agents pattern) ──
-        // Route: GET /api/agents/:id/versions/:v1/compare/:v2 — before/after (must be before /api/agents/:id)
-        if (pathname.match(/^\/api\/agents\/[^/]+\/versions\/\d+\/compare\/\d+$/) &&
-            req.method === 'GET') {
-            const parts = pathname.split('/');
-            const agentId = decodeURIComponent(parts[3]);
-            const v1 = parseInt(parts[5], 10);
-            const v2 = parseInt(parts[7], 10);
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleCompareVersions)(res, agentId, v1, v2, options.sessionsDb);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents/:id/versions — version history
-        if (pathname.match(/^\/api\/agents\/[^/]+\/versions$/) && req.method === 'GET') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleListVersions)(res, agentId, options.sessionsDb);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents/:id/metrics?from=&to= — metrics for period
-        if (pathname.match(/^\/api\/agents\/[^/]+\/metrics$/) && req.method === 'GET') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            // Parse query params from raw URL
-            const rawUrl = req.url || pathname;
-            const qIdx = rawUrl.indexOf('?');
-            const params = qIdx >= 0 ? new URLSearchParams(rawUrl.slice(qIdx)) : new URLSearchParams();
-            const from = params.get('from') || '2020-01-01';
-            const to = params.get('to') || '2099-12-31';
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleGetAgentMetrics)(res, agentId, from, to, options.sessionsDb);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents/:id/activity?limit= — activity log
-        if (pathname.match(/^\/api\/agents\/[^/]+\/activity$/) && req.method === 'GET') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            const rawUrl = req.url || pathname;
-            const qIdx = rawUrl.indexOf('?');
-            const params = qIdx >= 0 ? new URLSearchParams(rawUrl.slice(qIdx)) : new URLSearchParams();
-            const limit = parsePositiveInt(params.get('limit'), 20, 100);
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleGetAgentActivity)(res, agentId, options.sessionsDb, limit);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: POST /api/agents/:id/archive — archive agent
-        if (pathname.match(/^\/api\/agents\/[^/]+\/archive$/) && req.method === 'POST') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleArchiveAgent)(res, agentId, options.sessionsDb);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // ── Validation API ──────────────────────────────────────────────────
-        // Route: GET /api/agents/:id/validation/summary?trigger_type=
-        if (pathname.match(/^\/api\/agents\/[^/]+\/validation\/summary$/) && req.method === 'GET') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            if (options.sessionsDb) {
-                const triggerType = parseValidationTriggerType(params.get('trigger_type'));
-                if (!triggerType) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'trigger_type required' }));
-                    return true;
-                }
-                const summary = (0, store_js_1.getValidationSummary)(options.sessionsDb, agentId, triggerType);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ summary }));
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents/:id/validation/history?trigger_type=
-        if (pathname.match(/^\/api\/agents\/[^/]+\/validation\/history$/) && req.method === 'GET') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            if (options.sessionsDb) {
-                const rawUrl = req.url || pathname;
-                const qIdx = rawUrl.indexOf('?');
-                const params = qIdx >= 0 ? new URLSearchParams(rawUrl.slice(qIdx)) : new URLSearchParams();
-                const limit = parsePositiveInt(params.get('limit'), 50, 200);
-                const triggerType = parseValidationTriggerType(params.get('trigger_type'));
-                if (!triggerType) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'trigger_type required' }));
-                    return true;
-                }
-                const history = (0, store_js_1.listValidationHistory)(options.sessionsDb, agentId, limit, triggerType);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ history }));
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/validation-sessions/:id
-        if (pathname.match(/^\/api\/validation-sessions\/[^/]+$/) && req.method === 'GET') {
-            const sessionId = decodeURIComponent(pathname.split('/')[3]);
-            if (options.sessionsDb) {
-                const detail = (0, store_js_1.getValidationSessionDetail)(options.sessionsDb, sessionId);
-                if (!detail) {
-                    res.writeHead(404, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Session not found' }));
-                }
-                else {
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify(detail));
-                }
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: POST /api/agents/:id/validation/approve
-        if (pathname.match(/^\/api\/agents\/[^/]+\/validation\/approve$/) && req.method === 'POST') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            if (options.sessionsDb) {
-                const rawUrl = req.url || pathname;
-                const qIdx = rawUrl.indexOf('?');
-                const params = qIdx >= 0 ? new URLSearchParams(rawUrl.slice(qIdx)) : new URLSearchParams();
-                let sessionId = params.get('session_id');
-                if (!sessionId) {
-                    const body = await readBodyOrRespond(req, res);
-                    if (!body) {
-                        return true;
-                    }
-                    sessionId = body?.session_id;
-                }
-                if (!sessionId) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'session_id required' }));
-                }
-                else {
-                    const detail = (0, store_js_1.getValidationSessionDetail)(options.sessionsDb, sessionId);
-                    if (!detail) {
-                        res.writeHead(404, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Session not found' }));
-                        return true;
-                    }
-                    if (detail.session.agent_id !== agentId) {
-                        res.writeHead(403, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'session does not belong to requested agent' }));
-                        return true;
-                    }
-                    try {
-                        (0, store_js_1.approveValidationSession)(options.sessionsDb, sessionId);
-                        res.writeHead(200, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ success: true, approved_session: sessionId }));
-                    }
-                    catch (error) {
-                        const message = error instanceof Error ? error.message : String(error);
-                        const statusCode = /not found|required|invalid/i.test(message) ? 400 : 500;
-                        res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: message }));
-                    }
-                }
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents/:id/validation/compare?session=X&baseline=approved
-        if (pathname.match(/^\/api\/agents\/[^/]+\/validation\/compare$/) && req.method === 'GET') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            if (options.sessionsDb) {
-                const rawUrl = req.url || pathname;
-                const qIdx = rawUrl.indexOf('?');
-                const params = qIdx >= 0 ? new URLSearchParams(rawUrl.slice(qIdx)) : new URLSearchParams();
-                const sessionId = params.get('session');
-                const baselineMode = params.get('baseline') || 'approved';
-                if (!sessionId) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'session query parameter required' }));
-                }
-                else {
-                    const current = (0, store_js_1.getValidationSessionDetail)(options.sessionsDb, sessionId);
-                    if (!current) {
-                        res.writeHead(404, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Session not found' }));
-                    }
-                    else if (current.session.agent_id !== agentId) {
-                        res.writeHead(403, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'session does not belong to requested agent' }));
-                    }
-                    else {
-                        let baselineSessionId = null;
-                        if (baselineMode === 'approved') {
-                            const state = (0, store_js_1.getAgentValidationState)(options.sessionsDb, agentId, current.session.trigger_type);
-                            baselineSessionId = state?.approved_session_id ?? null;
-                        }
-                        else {
-                            baselineSessionId = baselineMode;
-                        }
-                        const baseline = baselineSessionId
-                            ? (0, store_js_1.getValidationSessionDetail)(options.sessionsDb, baselineSessionId)
-                            : null;
-                        if (baselineMode !== 'approved' && baselineSessionId && !baseline) {
-                            res.writeHead(404, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({ error: 'baseline session not found' }));
-                            return true;
-                        }
-                        if (baseline && baseline.session.agent_id !== agentId) {
-                            res.writeHead(403, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({ error: 'baseline session does not belong to requested agent' }));
-                            return true;
-                        }
-                        if (baseline && baseline.session.trigger_type !== current.session.trigger_type) {
-                            res.writeHead(400, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({
-                                error: 'baseline session trigger_type does not match current session',
-                            }));
-                            return true;
-                        }
-                        const baselineMetrics = new Map((baseline?.metrics ?? []).map((m) => [
-                            m.name,
-                            m.value,
-                        ]));
-                        const deltas = current.metrics.map((m) => {
-                            const bVal = baselineMetrics.get(m.name);
-                            return {
-                                name: m.name,
-                                current: m.value,
-                                baseline: bVal ?? null,
-                                delta: bVal !== undefined ? m.value - bVal : null,
-                                direction: m.direction,
-                            };
-                        });
-                        res.writeHead(200, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ current, baseline, deltas }));
-                    }
-                }
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents/activity-summary — aggregated activity with alerts
-        if (pathname === '/api/agents/activity-summary' && req.method === 'GET') {
-            const rawUrl = req.url || pathname;
-            const qIdx = rawUrl.indexOf('?');
-            const params = qIdx >= 0 ? new URLSearchParams(rawUrl.slice(qIdx)) : new URLSearchParams();
-            const since = params.get('since') || new Date(Date.now() - 86400000).toISOString().slice(0, 10);
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleGetActivitySummary)(res, options.sessionsDb, since);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents — list all agents
-        if (pathname === '/api/agents' && req.method === 'GET') {
-            const config = loadMAMAConfig();
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleGetAgents)(res, config, options.sessionsDb);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: POST /api/agents — create new agent
-        if (pathname === '/api/agents' && req.method === 'POST') {
-            const body = await readBodyOrRespond(req, res);
-            if (!body) {
-                return true;
-            }
-            if (options.sessionsDb) {
-                await (0, agent_handler_js_1.handleCreateAgent)(res, body, options.sessionsDb, {
-                    loadConfig: async () => loadMAMAConfig(),
-                    saveConfig: async (config) => saveMAMAConfig(config),
-                    applyMultiAgentConfig: options.applyMultiAgentConfig ?? null,
-                    restartMultiAgentAgent: options.restartMultiAgentAgent ?? null,
-                });
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: GET /api/agents/:id — single agent detail (must be after /api/agents/:id/*)
-        if (pathname.match(/^\/api\/agents\/[^/]+$/) && req.method === 'GET') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            const config = loadMAMAConfig();
-            if (options.sessionsDb) {
-                (0, agent_handler_js_1.handleGetAgent)(res, agentId, config, options.sessionsDb);
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // Route: POST /api/agents/:id — update agent (Managed Agents: version required)
-        if (pathname.match(/^\/api\/agents\/[^/]+$/) && req.method === 'POST') {
-            const agentId = decodeURIComponent(pathname.split('/')[3]);
-            const body = await readBodyOrRespond(req, res);
-            if (!body) {
-                return true;
-            }
-            if (options.sessionsDb) {
-                await (0, agent_handler_js_1.handleUpdateAgent)(res, agentId, body, options.sessionsDb, {
-                    loadConfig: async () => loadMAMAConfig(),
-                    saveConfig: async (config) => saveMAMAConfig(config),
-                    applyMultiAgentConfig: options.applyMultiAgentConfig ?? null,
-                    restartMultiAgentAgent: options.restartMultiAgentAgent ?? null,
-                });
-            }
-            else {
-                res.writeHead(503, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Sessions DB not available' }));
-            }
-            return true;
-        }
-        // ── Legacy Multi-Agent API (redirect-compatible) ──
-        // Route: GET /api/multi-agent/status - get multi-agent system status
-        if (pathname === '/api/multi-agent/status' && req.method === 'GET') {
-            await handleMultiAgentStatusRequest(req, res, options);
-            return true;
-        }
-        // Route: GET /api/multi-agent/agents - get all agents config
-        if (pathname === '/api/multi-agent/agents' && req.method === 'GET') {
-            await handleMultiAgentAgentsRequest(req, res);
-            return true;
-        }
-        // Route: PUT /api/multi-agent/agents/:id - update agent config
-        if (pathname.startsWith('/api/multi-agent/agents/') && req.method === 'PUT') {
-            await handleMultiAgentUpdateAgentRequest(req, res, pathname, options);
-            return true;
-        }
-        // Route: POST /api/multi-agent/agents/:id/restart - restart a single agent
-        if (pathname.match(/^\/api\/multi-agent\/agents\/[^/]+\/restart$/) && req.method === 'POST') {
-            if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                res.writeHead(401, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: false, error: 'Authentication required' }));
-                return true;
-            }
-            const agentId = decodeURIComponent(pathname.split('/')[4]);
-            if (!options.restartMultiAgentAgent) {
-                res.writeHead(501, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: false, error: 'Restart callback not configured' }));
-                return true;
-            }
-            try {
-                await options.restartMultiAgentAgent(agentId);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: true, message: `Agent ${agentId} restarted` }));
-            }
-            catch (err) {
-                logger.error(`Agent restart failed for ${agentId}:`, err);
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    success: false,
-                    error: err instanceof Error ? err.message : String(err),
-                }));
-            }
-            return true;
-        }
-        // Route: POST /api/multi-agent/agents/:id/stop - stop a single agent
-        if (pathname.match(/^\/api\/multi-agent\/agents\/[^/]+\/stop$/) && req.method === 'POST') {
-            if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                res.writeHead(401, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: false, error: 'Authentication required' }));
-                return true;
-            }
-            const agentId = decodeURIComponent(pathname.split('/')[4]);
-            if (!options.stopMultiAgentAgent) {
-                res.writeHead(501, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: false, error: 'Stop callback not configured' }));
-                return true;
-            }
-            try {
-                await options.stopMultiAgentAgent(agentId);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ success: true, message: `Agent ${agentId} stopped` }));
-            }
-            catch (err) {
-                logger.error(`Agent stop failed for ${agentId}:`, err);
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    success: false,
-                    error: err instanceof Error ? err.message : String(err),
-                }));
-            }
-            return true;
-        }
-        // Route: GET /api/mcp-servers - get available MCP servers from config
-        if (pathname === '/api/mcp-servers' && req.method === 'GET') {
-            await handleMCPServersRequest(req, res);
-            return true;
-        }
-        // Route: DELETE /api/mcp-servers/:name - remove MCP server from config
-        if (pathname.startsWith('/api/mcp-servers/') && req.method === 'DELETE') {
-            await handleDeleteMCPServerRequest(req, res, pathname);
-            return true;
-        }
-        // Route: POST /api/code-act - execute code in Code-Act sandbox
-        if (pathname === '/api/code-act' && req.method === 'POST') {
-            await handleCodeActRequest(req, res, options);
-            return true;
-        }
-        // Route: GET /api/entities/candidates - list pending review candidates
-        if (pathname === '/api/entities/candidates' && req.method === 'GET') {
-            if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                res.writeHead(401, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: true,
-                    code: 'UNAUTHORIZED',
-                    message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-                }));
-                return true;
-            }
-            await initDB();
-            await (0, entity_review_handler_js_1.handleListEntityCandidates)(req, res, getAdapter());
-            return true;
-        }
-        // Route: POST /api/entities/candidates/:id/{approve,reject,defer}
-        {
-            const reviewMatch = pathname.match(/^\/api\/entities\/candidates\/([^/]+)\/(approve|reject|defer)$/);
-            if (reviewMatch && req.method === 'POST') {
-                if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                    (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                    res.writeHead(401, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        error: true,
-                        code: 'UNAUTHORIZED',
-                        message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-                    }));
-                    return true;
-                }
-                await initDB();
-                const action = reviewMatch[2];
-                await (0, entity_review_handler_js_1.handleReviewEntityCandidate)(req, res, getAdapter(), action);
-                return true;
-            }
-        }
-        // Route: GET /api/entities/candidates/:id - candidate detail
-        {
-            const detailMatch = pathname.match(/^\/api\/entities\/candidates\/([^/]+)$/);
-            if (detailMatch && req.method === 'GET') {
-                if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                    (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                    res.writeHead(401, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        error: true,
-                        code: 'UNAUTHORIZED',
-                        message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-                    }));
-                    return true;
-                }
-                await initDB();
-                await (0, entity_review_handler_js_1.handleGetEntityCandidate)(req, res, getAdapter());
-                return true;
-            }
-        }
-        // Route: POST /api/entities/audit/run - start a new audit run
-        if (pathname === '/api/entities/audit/run' && req.method === 'POST') {
-            if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                res.writeHead(401, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: true,
-                    code: 'UNAUTHORIZED',
-                    message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-                }));
-                return true;
-            }
-            const queue = await getEntityAuditQueue();
-            const deps = {
-                queue,
-                runAuditInBackground: (runId) => {
-                    void (0, entity_audit_runner_js_1.runEntityAuditInBackground)({
-                        queue,
-                        adapter: getAdapter(),
-                        runId,
-                    });
-                },
-            };
-            const handler = (0, entity_audit_handler_js_1.createEntityAuditHandler)(deps);
-            await handler.handleStartAuditRun(req, res);
-            return true;
-        }
-        // Route: GET /api/entities/audit/runs - list recent audit runs
-        if (pathname === '/api/entities/audit/runs' && req.method === 'GET') {
-            if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                res.writeHead(401, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: true,
-                    code: 'UNAUTHORIZED',
-                    message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-                }));
-                return true;
-            }
-            const queue = await getEntityAuditQueue();
-            const handler = (0, entity_audit_handler_js_1.createEntityAuditHandler)({
-                queue,
-            });
-            await handler.handleListAuditRuns(req, res);
-            return true;
-        }
-        // Route: GET /api/entities/audit/runs/:id - single run detail
-        {
-            const runDetail = pathname.match(/^\/api\/entities\/audit\/runs\/([^/]+)$/);
-            if (runDetail && req.method === 'GET') {
-                if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-                    (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-                    res.writeHead(401, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        error: true,
-                        code: 'UNAUTHORIZED',
-                        message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-                    }));
-                    return true;
-                }
-                const queue = await getEntityAuditQueue();
-                const handler = (0, entity_audit_handler_js_1.createEntityAuditHandler)({
-                    queue,
-                });
-                await handler.handleGetAuditRun(req, res);
-                return true;
-            }
-        }
-        return false;
-    };
-}
-async function handleDashboardStatusRequest(_req, res) {
-    try {
-        const config = loadMAMAConfig();
-        await initDB();
-        const memoryStats = await getMemoryStats();
-        const gateways = {
-            discord: {
-                configured: !!config.discord?.token,
-                enabled: config.discord?.enabled ?? false,
-                channel: config.discord?.default_channel_id || null,
-            },
-            slack: {
-                configured: !!config.slack?.bot_token,
-                enabled: config.slack?.enabled ?? false,
-                channel: config.slack?.default_channel || null,
-            },
-            telegram: {
-                configured: !!config.telegram?.token,
-                enabled: config.telegram?.enabled ?? false,
-                chats: config.telegram?.allowed_chats || [],
-            },
-            chatwork: {
-                configured: !!config.chatwork?.api_token,
-                enabled: config.chatwork?.enabled ?? false,
-                rooms: config.chatwork?.room_ids || [],
-            },
-        };
-        const heartbeat = {
-            enabled: config.heartbeat?.enabled ?? false,
-            interval: config.heartbeat?.interval ?? 1800000,
-            quietStart: config.heartbeat?.quiet_start ?? 23,
-            quietEnd: config.heartbeat?.quiet_end ?? 8,
-        };
-        const agent = {
-            model: config.agent?.model || 'unknown',
-            maxTurns: config.agent?.max_turns ?? 10,
-            timeout: config.agent?.timeout ?? 300000,
-            tools: config.agent?.tools || { gateway: ['*'], mcp: [] },
-        };
-        const sessionStats = getSessionStats();
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            timestamp: new Date().toISOString(),
-            gateways,
-            heartbeat,
-            agent,
-            memory: memoryStats,
-            sessions: sessionStats,
-            database: {
-                path: config.database?.path ?? '~/.claude/mama-memory.db',
-            },
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`[GraphAPI] Dashboard status error: ${message}`);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'DASHBOARD_ERROR',
-            message,
-        }));
-    }
-}
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function loadMAMAConfig() {
-    try {
-        if (!fs_1.default.existsSync(MAMA_CONFIG_PATH)) {
-            console.log('[GraphAPI] Config file not found:', MAMA_CONFIG_PATH);
-            return {};
-        }
-        const content = fs_1.default.readFileSync(MAMA_CONFIG_PATH, 'utf8');
-        const config = js_yaml_1.default.load(content) || {};
-        return migrateLegacyManagedBackends(config);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Config load error:', message);
-        return {};
-    }
-}
-async function getMemoryStats() {
-    try {
-        const adapter = getAdapter();
-        const now = Date.now();
-        const weekAgo = now - 7 * 24 * 60 * 60 * 1000;
-        const monthAgo = now - 30 * 24 * 60 * 60 * 1000;
-        const totalResult = adapter.prepare('SELECT COUNT(*) as count FROM decisions').get();
-        const total = totalResult?.count ?? 0;
-        const weekResult = adapter
-            .prepare('SELECT COUNT(*) as count FROM decisions WHERE created_at > ?')
-            .get(weekAgo);
-        const thisWeek = weekResult?.count ?? 0;
-        const monthResult = adapter
-            .prepare('SELECT COUNT(*) as count FROM decisions WHERE created_at > ?')
-            .get(monthAgo);
-        const thisMonth = monthResult?.count ?? 0;
-        const outcomeResults = adapter
-            .prepare(`
-      SELECT outcome, COUNT(*) as count
-      FROM decisions
-      WHERE outcome IS NOT NULL
-      GROUP BY outcome
-    `)
-            .all();
-        const outcomes = {};
-        for (const row of outcomeResults) {
-            outcomes[row.outcome?.toLowerCase() ?? 'unknown'] = row.count;
-        }
-        const topicResults = adapter
-            .prepare(`
-      SELECT topic, COUNT(*) as count
-      FROM decisions
-      WHERE topic IS NOT NULL
-      GROUP BY topic
-      ORDER BY count DESC
-      LIMIT 5
-    `)
-            .all();
-        const checkpointResult = adapter.prepare('SELECT COUNT(*) as count FROM checkpoints').get();
-        const checkpoints = checkpointResult?.count ?? 0;
-        return {
-            total,
-            thisWeek,
-            thisMonth,
-            checkpoints,
-            outcomes,
-            topTopics: topicResults,
-        };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Memory stats error:', message);
-        return {
-            total: 0,
-            thisWeek: 0,
-            thisMonth: 0,
-            checkpoints: 0,
-            outcomes: {},
-            topTopics: [],
-        };
-    }
-}
-function getSessionStats() {
-    try {
-        const config = loadMAMAConfig();
-        const memoryDbPath = config.database?.path || '~/.claude/mama-memory.db';
-        const expandedPath = memoryDbPath.startsWith('~/')
-            ? path_1.default.join(os_1.default.homedir(), memoryDbPath.slice(2))
-            : memoryDbPath;
-        const sessionsDbPath = expandedPath.replace('mama-memory.db', 'mama-sessions.db');
-        if (!fs_1.default.existsSync(sessionsDbPath)) {
-            return { total: 0, bySource: {}, channels: [] };
-        }
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const Database = require('../sqlite.js').default;
-        const sessionsDb = new Database(sessionsDbPath);
-        try {
-            const bySourceRows = sessionsDb
-                .prepare(`
-        SELECT source, COUNT(*) as count
-        FROM messenger_sessions
-        GROUP BY source
-      `)
-                .all();
-            const bySource = {};
-            let total = 0;
-            for (const row of bySourceRows) {
-                bySource[row.source] = row.count;
-                total += row.count;
-            }
-            const channelRows = sessionsDb
-                .prepare(`
-        SELECT
-          source,
-          channel_id,
-          channel_name,
-          last_active,
-          json_array_length(context) as message_count
-        FROM messenger_sessions
-        ORDER BY last_active DESC
-        LIMIT 10
-      `)
-                .all();
-            const channels = channelRows.map((row) => ({
-                source: row.source,
-                channelId: row.channel_id,
-                channelName: row.channel_name || null,
-                lastActive: row.last_active,
-                messageCount: row.message_count || 0,
-            }));
-            return { total, bySource, channels };
-        }
-        finally {
-            sessionsDb.close();
-        }
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Session stats error:', message);
-        return { total: 0, bySource: {}, channels: [] };
-    }
-}
-async function handleGetConfigRequest(_req, res) {
-    try {
-        const config = loadMAMAConfig();
-        const maskedConfig = {
-            version: config.version || 1,
-            agent: {
-                ...(config.agent || {}),
-                tools: config.agent?.tools || {
-                    gateway: ['*'],
-                    mcp: [],
-                    mcp_config: '~/.mama/mama-mcp-config.json',
-                },
-            },
-            database: config.database || {},
-            logging: config.logging || {},
-            discord: config.discord
-                ? {
-                    enabled: config.discord.enabled || false,
-                    token: config.discord.token ? maskToken(config.discord.token) : '',
-                    default_channel_id: config.discord.default_channel_id || '',
-                }
-                : { enabled: false, token: '', default_channel_id: '' },
-            slack: config.slack
-                ? {
-                    enabled: config.slack.enabled || false,
-                    bot_token: config.slack.bot_token ? maskToken(config.slack.bot_token) : '',
-                    app_token: config.slack.app_token ? maskToken(config.slack.app_token) : '',
-                }
-                : { enabled: false, bot_token: '', app_token: '' },
-            telegram: config.telegram
-                ? {
-                    enabled: config.telegram.enabled || false,
-                    token: config.telegram.token ? maskToken(config.telegram.token) : '',
-                }
-                : { enabled: false, token: '' },
-            chatwork: config.chatwork
-                ? {
-                    enabled: config.chatwork.enabled || false,
-                    api_token: config.chatwork.api_token ? maskToken(config.chatwork.api_token) : '',
-                }
-                : { enabled: false, api_token: '' },
-            heartbeat: config.heartbeat || {
-                enabled: false,
-                interval: 1800000,
-                quiet_start: 23,
-                quiet_end: 8,
-            },
-            roles: config.roles
-                ? {
-                    definitions: { ...types_js_1.DEFAULT_ROLES.definitions, ...config.roles.definitions },
-                    sourceMapping: { ...types_js_1.DEFAULT_ROLES.sourceMapping, ...config.roles.sourceMapping },
-                }
-                : types_js_1.DEFAULT_ROLES,
-            multi_agent: config.multi_agent
-                ? {
-                    enabled: config.multi_agent.enabled || false,
-                    agents: maskAgentsTokens(config.multi_agent.agents || {}),
-                    loop_prevention: config.multi_agent.loop_prevention || {
-                        max_chain_length: 3,
-                        global_cooldown_ms: 2000,
-                        chain_window_ms: 60000,
-                    },
-                    free_chat: config.multi_agent.free_chat || false,
-                    default_agent: config.multi_agent.default_agent || null,
-                    mention_delegation: config.multi_agent.mention_delegation || false,
-                    max_mention_depth: config.multi_agent.max_mention_depth || 3,
-                    workflow: config.multi_agent.workflow || { enabled: true },
-                }
-                : undefined,
-            prompt: config.prompt,
-            timeouts: config.timeouts,
-            gateway_tuning: config.gateway_tuning,
-            io: config.io,
-            metrics: config.metrics,
-        };
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(maskedConfig));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Get config error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'CONFIG_ERROR',
-            message,
-        }));
-    }
-}
-async function handleUpdateConfigRequest(req, res, options = {}) {
-    try {
-        // Verify authentication for config modifications
-        if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-            (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-            res.writeHead(401, {
-                'Content-Type': 'application/json',
-                'WWW-Authenticate': 'Bearer realm="MAMA API"',
-            });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'UNAUTHORIZED',
-                message: 'Authentication required. Set MAMA_AUTH_TOKEN or MAMA_SERVER_TOKEN environment variable ' +
-                    'and provide it in the Authorization header.',
-            }));
-            return;
-        }
-        const body = await readBody(req);
-        const currentConfig = loadMAMAConfig();
-        let updatedConfig;
-        try {
-            updatedConfig = mergeConfigUpdates(currentConfig, body);
-        }
-        catch (err) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'VALIDATION_ERROR',
-                message: err instanceof Error ? err.message : String(err),
-            }));
-            return;
-        }
-        const modelPolicyEntries = rescopeModelsForConfigSave(updatedConfig);
-        const errors = validateConfigUpdate(updatedConfig);
-        if (errors.length > 0) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'VALIDATION_ERROR',
-                message: errors.join(', '),
-            }));
-            return;
-        }
-        (0, backend_model_policy_js_1.emitBackendModelWarnings)([...modelPolicyEntries.changes, ...modelPolicyEntries.warnings]);
-        saveMAMAConfig(updatedConfig);
-        if (updatedConfig.multi_agent && options.applyMultiAgentConfig) {
-            try {
-                await options.applyMultiAgentConfig(updatedConfig.multi_agent);
-            }
-            catch (err) {
-                logger.warn('Multi-agent hot-apply failed after config update:', err instanceof Error ? err.message : String(err));
-            }
-        }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            success: true,
-            message: 'Configuration saved successfully',
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Update config error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'CONFIG_ERROR',
-            message,
-        }));
-    }
-}
-function rescopeModelsForConfigSave(config) {
-    if (!isRecord(config.agent) || typeof config.agent.backend !== 'string') {
-        return { changes: [], warnings: [] };
-    }
-    const backend = config.agent.backend.toLowerCase();
-    if (!supportedManagedBackends.includes(backend)) {
-        return { changes: [], warnings: [] };
-    }
-    const roles = isRecord(config.roles) ? config.roles : undefined;
-    const definitions = roles && isRecord(roles.definitions) ? roles.definitions : {};
-    const roleModels = Object.fromEntries(Object.entries(definitions)
-        .filter((entry) => isRecord(entry[1]))
-        .map(([name, definition]) => [
-        name,
-        typeof definition.model === 'string' ? definition.model : undefined,
-    ]));
-    const scopedModels = (0, backend_model_policy_js_1.rescopeConfigModels)({
-        backend: backend,
-        agentModel: typeof config.agent.model === 'string' ? config.agent.model : undefined,
-        roleModels,
-    });
-    config.agent.model = scopedModels.agentModel;
-    for (const [name, model] of Object.entries(scopedModels.roleModels)) {
-        const definition = definitions[name];
-        if (isRecord(definition)) {
-            definition.model = model;
-        }
-    }
-    const changes = [...scopedModels.changes];
-    const warnings = [...(scopedModels.warnings ?? [])];
-    const multiAgent = isRecord(config.multi_agent) ? config.multi_agent : undefined;
-    const managedAgents = multiAgent && isRecord(multiAgent.agents) ? multiAgent.agents : {};
-    for (const [agentId, agentConfig] of Object.entries(managedAgents)) {
-        if (!isRecord(agentConfig)) {
-            continue;
-        }
-        const effectiveBackend = typeof agentConfig.backend === 'string' ? agentConfig.backend.toLowerCase() : backend;
-        if (!supportedManagedBackends.includes(effectiveBackend)) {
-            continue;
-        }
-        const configuredModel = typeof agentConfig.model === 'string' ? agentConfig.model.trim() : undefined;
-        const target = `multi_agent.agents.${agentId}.model`;
-        const resolvedModel = (0, backend_model_policy_js_1.resolveBackendScopedModel)({
-            backend: effectiveBackend,
-            model: configuredModel,
-            inheritedBackend: backend,
-            inheritedModel: scopedModels.agentModel,
-            warningTarget: target,
-            onWarning: (warning) => warnings.push(warning),
-        });
-        agentConfig.model = resolvedModel;
-        if (configuredModel && configuredModel !== resolvedModel) {
-            changes.push({ target, from: configuredModel, to: resolvedModel });
-        }
-    }
-    return { changes, warnings };
-}
-function maskToken(token) {
-    if (!token || token.length < 4) {
-        return '***[redacted]***';
-    }
-    return '***[redacted]***';
-}
-// isLocalRequest and isAuthenticated imported from ./auth-middleware.js
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function maskAgentsTokens(agents) {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const masked = {};
-    for (const [id, agent] of Object.entries(agents)) {
-        masked[id] = { ...agent };
-        if (agent.bot_token) {
-            masked[id].bot_token = maskToken(agent.bot_token);
-        }
-        if (agent.slack_bot_token) {
-            masked[id].slack_bot_token = maskToken(agent.slack_bot_token);
-        }
-        if (agent.slack_app_token) {
-            masked[id].slack_app_token = maskToken(agent.slack_app_token);
-        }
-    }
-    return masked;
-}
-/* eslint-disable @typescript-eslint/no-explicit-any */
-function mergeConfigUpdates(current, updates) {
-    /* eslint-enable @typescript-eslint/no-explicit-any */
-    const merged = { ...current };
-    if (updates.use_claude_cli !== undefined) {
-        if (typeof updates.use_claude_cli !== 'boolean') {
-            throw new Error('use_claude_cli must be a boolean');
-        }
-        merged.use_claude_cli = updates.use_claude_cli;
-    }
-    const normalizeAgentNumber = (value) => {
-        if (typeof value === 'number' && Number.isFinite(value)) {
-            return value;
-        }
-        if (typeof value === 'string' && value.trim()) {
-            const parsed = Number(value);
-            return Number.isFinite(parsed) ? parsed : undefined;
-        }
-        return undefined;
-    };
-    if (updates.agent && typeof updates.agent === 'object') {
-        const agentUpdates = updates.agent;
-        const normalizedAgent = {
-            ...current.agent,
-            ...agentUpdates,
-        };
-        if (agentUpdates.max_turns !== undefined) {
-            const normalized = normalizeAgentNumber(agentUpdates.max_turns);
-            if (normalized === undefined) {
-                throw new Error('agent.max_turns must be a number');
-            }
-            normalizedAgent.max_turns = normalized;
-        }
-        if (agentUpdates.timeout !== undefined) {
-            const normalized = normalizeAgentNumber(agentUpdates.timeout);
-            if (normalized === undefined) {
-                throw new Error('agent.timeout must be a number');
-            }
-            normalizedAgent.timeout = normalized;
-        }
-        merged.agent = normalizedAgent;
-    }
-    if (updates.heartbeat) {
-        merged.heartbeat = {
-            ...current.heartbeat,
-            ...updates.heartbeat,
-        };
-    }
-    if (updates.discord) {
-        const discordUpdates = updates.discord;
-        merged.discord = {
-            ...current.discord,
-            enabled: discordUpdates.enabled,
-            default_channel_id: discordUpdates.default_channel_id || current.discord?.default_channel_id,
-        };
-        if (discordUpdates.token && typeof discordUpdates.token === 'string') {
-            const isMasked = discordUpdates.token === '***[redacted]***' ||
-                (discordUpdates.token.startsWith('***[') && discordUpdates.token.endsWith(']***'));
-            if (!isMasked) {
-                merged.discord.token = discordUpdates.token;
-            }
-        }
-    }
-    if (updates.slack) {
-        const slackUpdates = updates.slack;
-        merged.slack = {
-            ...current.slack,
-            enabled: slackUpdates.enabled,
-        };
-        if (slackUpdates.bot_token && typeof slackUpdates.bot_token === 'string') {
-            const isMasked = slackUpdates.bot_token === '***[redacted]***' ||
-                (slackUpdates.bot_token.startsWith('***[') && slackUpdates.bot_token.endsWith(']***'));
-            if (!isMasked) {
-                merged.slack.bot_token = slackUpdates.bot_token;
-            }
-        }
-        if (slackUpdates.app_token && typeof slackUpdates.app_token === 'string') {
-            const isMasked = slackUpdates.app_token === '***[redacted]***' ||
-                (slackUpdates.app_token.startsWith('***[') && slackUpdates.app_token.endsWith(']***'));
-            if (!isMasked) {
-                merged.slack.app_token = slackUpdates.app_token;
-            }
-        }
-    }
-    if (updates.telegram) {
-        const telegramUpdates = updates.telegram;
-        merged.telegram = {
-            ...current.telegram,
-            enabled: telegramUpdates.enabled,
-        };
-        if (telegramUpdates.token && typeof telegramUpdates.token === 'string') {
-            const isMasked = telegramUpdates.token === '***[redacted]***' ||
-                (telegramUpdates.token.startsWith('***[') && telegramUpdates.token.endsWith(']***'));
-            if (!isMasked) {
-                merged.telegram.token = telegramUpdates.token;
-            }
-        }
-    }
-    if (updates.chatwork) {
-        const chatworkUpdates = updates.chatwork;
-        merged.chatwork = {
-            ...current.chatwork,
-            enabled: chatworkUpdates.enabled,
-        };
-        if (chatworkUpdates.api_token && typeof chatworkUpdates.api_token === 'string') {
-            const isMasked = chatworkUpdates.api_token === '***[redacted]***' ||
-                (chatworkUpdates.api_token.startsWith('***[') &&
-                    chatworkUpdates.api_token.endsWith(']***'));
-            if (!isMasked) {
-                merged.chatwork.api_token = chatworkUpdates.api_token;
-            }
-        }
-    }
-    // Tuning sections: shallow merge each
-    for (const section of ['prompt', 'timeouts', 'gateway_tuning', 'io', 'metrics']) {
-        if (updates[section] && typeof updates[section] === 'object') {
-            merged[section] = {
-                ...(current[section] || {}),
-                ...updates[section],
-            };
-        }
-    }
-    if (updates.multi_agent) {
-        const multiAgentUpdates = updates.multi_agent;
-        merged.multi_agent = {
-            ...current.multi_agent,
-            ...multiAgentUpdates,
-        };
-        if (multiAgentUpdates.agents) {
-            const agentUpdatesMap = multiAgentUpdates.agents;
-            merged.multi_agent.agents = { ...current.multi_agent?.agents };
-            for (const [agentId, agentUpdates] of Object.entries(agentUpdatesMap)) {
-                const currentAgent = current.multi_agent?.agents?.[agentId] || {};
-                merged.multi_agent.agents[agentId] = {
-                    ...currentAgent,
-                    ...agentUpdates,
-                };
-                if (agentUpdates.bot_token && typeof agentUpdates.bot_token === 'string') {
-                    const isMasked = agentUpdates.bot_token === '***[redacted]***' ||
-                        (agentUpdates.bot_token.startsWith('***[') && agentUpdates.bot_token.endsWith(']***'));
-                    if (isMasked) {
-                        merged.multi_agent.agents[agentId].bot_token = currentAgent.bot_token;
-                    }
-                }
-                if (agentUpdates.slack_bot_token && typeof agentUpdates.slack_bot_token === 'string') {
-                    const isMasked = agentUpdates.slack_bot_token === '***[redacted]***' ||
-                        (agentUpdates.slack_bot_token.startsWith('***[') &&
-                            agentUpdates.slack_bot_token.endsWith(']***'));
-                    if (isMasked) {
-                        merged.multi_agent.agents[agentId].slack_bot_token = currentAgent.slack_bot_token;
-                    }
-                }
-                if (agentUpdates.slack_app_token && typeof agentUpdates.slack_app_token === 'string') {
-                    const isMasked = agentUpdates.slack_app_token === '***[redacted]***' ||
-                        (agentUpdates.slack_app_token.startsWith('***[') &&
-                            agentUpdates.slack_app_token.endsWith(']***'));
-                    if (isMasked) {
-                        merged.multi_agent.agents[agentId].slack_app_token = currentAgent.slack_app_token;
-                    }
-                }
-            }
-        }
-    }
-    return merged;
-}
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function validateConfigUpdate(config) {
-    const errors = [];
-    const normalizeNumber = (value) => {
-        if (typeof value === 'number' && Number.isFinite(value)) {
-            return value;
-        }
-        if (typeof value === 'string' && value.trim()) {
-            const parsed = Number(value);
-            return Number.isFinite(parsed) ? parsed : undefined;
-        }
-        return undefined;
-    };
-    if (config.agent) {
-        const maxTurns = normalizeNumber(config.agent.max_turns);
-        if (config.agent.max_turns !== undefined &&
-            (maxTurns === undefined || !Number.isInteger(maxTurns) || maxTurns < 1 || maxTurns > 100)) {
-            errors.push('max_turns must be between 1 and 100');
-        }
-        const timeoutMs = normalizeNumber(config.agent.timeout);
-        if (config.agent.timeout !== undefined &&
-            (timeoutMs === undefined ||
-                !Number.isFinite(timeoutMs) ||
-                !Number.isInteger(timeoutMs) ||
-                timeoutMs < 1000)) {
-            errors.push('timeout must be at least 1000ms');
-        }
-        if (config.agent.backend &&
-            !supportedManagedBackends.includes(String(config.agent.backend).toLowerCase())) {
-            errors.push('agent.backend must be "claude", "codex", or "cline"');
-        }
-        if (config.agent.backend && config.agent.model && typeof config.agent.model === 'string') {
-            const backend = String(config.agent.backend).toLowerCase();
-            const model = config.agent.model;
-            const modelBackend = (0, backend_model_policy_js_1.backendForModel)(model);
-            if (backend === 'claude' && modelBackend !== null && modelBackend !== 'claude') {
-                errors.push('agent.model must be a Claude model when agent.backend is "claude"');
-            }
-            if (isCodexFamilyBackend(backend) && modelBackend !== null && modelBackend !== 'codex') {
-                errors.push(`agent.model must be a Codex/OpenAI model when agent.backend is "${backend}"`);
-            }
-        }
-    }
-    if (config.heartbeat) {
-        const heartbeatIntervalMs = normalizeNumber(config.heartbeat.interval);
-        if (config.heartbeat.interval !== undefined &&
-            (heartbeatIntervalMs === undefined ||
-                !Number.isFinite(heartbeatIntervalMs) ||
-                heartbeatIntervalMs < 60000)) {
-            errors.push('heartbeat interval must be at least 60000ms (1 minute)');
-        }
-    }
-    if (config.use_claude_cli !== undefined && typeof config.use_claude_cli !== 'boolean') {
-        errors.push('use_claude_cli must be a boolean');
-    }
-    const globalBackend = config.agent?.backend;
-    if (config.multi_agent?.agents && typeof config.multi_agent.agents === 'object') {
-        for (const [agentId, agentConfig] of Object.entries(config.multi_agent.agents)) {
-            const cfg = agentConfig;
-            const backendRaw = cfg.backend ?? globalBackend;
-            const modelRaw = cfg.model;
-            if (backendRaw !== undefined) {
-                const backend = String(backendRaw).toLowerCase();
-                if (!supportedManagedBackends.includes(backend)) {
-                    errors.push(`multi_agent.agents.${agentId}.backend must be "claude", "codex", or "cline"`);
-                    continue;
-                }
-                if (typeof modelRaw === 'string' && modelRaw.trim()) {
-                    const modelBackend = (0, backend_model_policy_js_1.backendForModel)(modelRaw);
-                    if (backend === 'claude' && modelBackend !== null && modelBackend !== 'claude') {
-                        errors.push(`multi_agent.agents.${agentId}.model must be a Claude model when backend is "claude"`);
-                    }
-                    if (isCodexFamilyBackend(backend) && modelBackend !== null && modelBackend !== 'codex') {
-                        errors.push(`multi_agent.agents.${agentId}.model must be a Codex/OpenAI model when backend is "${backend}"`);
-                    }
-                }
-            }
-        }
-    }
-    return errors;
-}
-function canonicalRolesJson(value) {
-    if (Array.isArray(value)) {
-        return `[${value.map(canonicalRolesJson).join(',')}]`;
-    }
-    if (value && typeof value === 'object') {
-        const entries = Object.entries(value)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalRolesJson(v)}`);
-        return `{${entries.join(',')}}`;
-    }
-    return JSON.stringify(value) ?? 'undefined';
-}
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function saveMAMAConfig(config) {
-    const configDir = path_1.default.dirname(MAMA_CONFIG_PATH);
-    if (!fs_1.default.existsSync(configDir)) {
-        fs_1.default.mkdirSync(configDir, { recursive: true });
-    }
-    // Prune role entries identical to shipped defaults (review R3-m1): this UI
-    // save path bypasses config-manager.saveConfig, and without the prune it
-    // would freeze default definitions into config.yaml (B1 silent-death class).
-    if (config.roles && types_js_1.DEFAULT_ROLES) {
-        const definitions = {};
-        for (const [name, def] of Object.entries(config.roles.definitions ?? {})) {
-            const defaultDef = types_js_1.DEFAULT_ROLES.definitions[name];
-            if (!defaultDef || canonicalRolesJson(def) !== canonicalRolesJson(defaultDef)) {
-                definitions[name] = def;
-            }
-        }
-        const sourceMapping = {};
-        for (const [source, role] of Object.entries(config.roles.sourceMapping ?? {})) {
-            if (types_js_1.DEFAULT_ROLES.sourceMapping[source] !== role) {
-                sourceMapping[source] = role;
-            }
-        }
-        if (Object.keys(definitions).length === 0 && Object.keys(sourceMapping).length === 0) {
-            delete config.roles;
-        }
-        else {
-            config.roles = { definitions, sourceMapping };
-        }
-    }
-    const content = js_yaml_1.default.dump(config, {
-        indent: 2,
-        lineWidth: 120,
-        noRefs: true,
-    });
-    const fileContent = `# MAMA Configuration
-# Updated: ${new Date().toISOString()}
-# Documentation: https://github.com/jungjaehoon-lifegamez/MAMA
-
-${content}`;
-    fs_1.default.writeFileSync(MAMA_CONFIG_PATH, fileContent, 'utf8');
-    console.log('[GraphAPI] Config saved to:', MAMA_CONFIG_PATH);
-}
-/**
- * Fetch all decisions with full text (decision + reasoning) for export.
- * Unlike getAllNodes() which returns preview-truncated fields for the graph
- * viewer, this returns the complete text needed for Markdown/CSV/JSON export.
- */
-async function getAllNodesForExport() {
-    const adapter = getAdapter();
-    const rows = adapter
-        .prepare(`SELECT id, topic, decision, reasoning, outcome, confidence, created_at
-       FROM decisions ORDER BY created_at DESC`)
-        .all();
-    return rows.map((row) => ({
-        id: row.id,
-        topic: row.topic,
-        decision: row.decision,
-        reasoning: row.reasoning,
-        decision_preview: buildDecisionPreview(row.decision),
-        outcome: row.outcome,
-        confidence: row.confidence,
-        created_at: row.created_at,
-    }));
-}
-async function handleExportRequest(_req, res, params) {
-    try {
-        const format = params.get('format') || 'json';
-        await initDB();
-        // Use full-text query so exports include complete decision + reasoning
-        const decisions = await getAllNodesForExport();
-        let content;
-        let contentType;
-        let filename;
-        switch (format) {
-            case 'markdown':
-                content = exportToMarkdown(decisions);
-                contentType = 'text/markdown';
-                filename = `mama-decisions-${new Date().toISOString().split('T')[0]}.md`;
-                break;
-            case 'csv':
-                content = exportToCSV(decisions);
-                contentType = 'text/csv';
-                filename = `mama-decisions-${new Date().toISOString().split('T')[0]}.csv`;
-                break;
-            case 'json':
-            default:
-                content = JSON.stringify({ decisions, exported_at: new Date().toISOString() }, null, 2);
-                contentType = 'application/json';
-                filename = `mama-decisions-${new Date().toISOString().split('T')[0]}.json`;
-                break;
-        }
-        res.writeHead(200, {
-            'Content-Type': contentType,
-            'Content-Disposition': `attachment; filename="${filename}"`,
-        });
-        res.end(content);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Export error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'EXPORT_ERROR',
-            message,
-        }));
-    }
-}
-function exportToMarkdown(decisions) {
-    const lines = [
-        '# MAMA Decisions Export',
-        '',
-        `Exported: ${new Date().toISOString()}`,
-        `Total Decisions: ${decisions.length}`,
-        '',
-        '---',
-        '',
-    ];
-    for (const d of decisions) {
-        lines.push(`## ${d.topic || 'Untitled'}`);
-        lines.push('');
-        lines.push(`**Decision:** ${d.decision || 'N/A'}`);
-        lines.push('');
-        if (d.reasoning) {
-            lines.push(`**Reasoning:**`);
-            lines.push('');
-            lines.push(d.reasoning);
-            lines.push('');
-        }
-        lines.push(`- **Outcome:** ${d.outcome || 'Pending'}`);
-        lines.push(`- **Confidence:** ${d.confidence || 'N/A'}`);
-        lines.push(`- **Created:** ${d.created_at ? new Date(d.created_at).toISOString() : 'N/A'}`);
-        lines.push(`- **ID:** \`${d.id}\``);
-        lines.push('');
-        lines.push('---');
-        lines.push('');
-    }
-    return lines.join('\n');
-}
-async function handleMultiAgentStatusRequest(_req, res, options = {}) {
-    try {
-        const config = loadMAMAConfig();
-        const multiAgentConfig = config.multi_agent || { enabled: false, agents: {} };
-        const agentStatesMap = options.getAgentStates ? options.getAgentStates() : null;
-        const agents = [];
-        const seenAgentIds = new Set();
-        if (multiAgentConfig.enabled && multiAgentConfig.agents) {
-            for (const [id, agentConfig] of Object.entries(multiAgentConfig.agents)) {
-                let status = 'online';
-                if (agentConfig.enabled === false) {
-                    status = 'disabled';
-                }
-                else if (agentStatesMap && agentStatesMap.has(id)) {
-                    status = agentStatesMap.get(id);
-                }
-                agents.push({
-                    id,
-                    name: agentConfig.name || id,
-                    tier: agentConfig.tier || 1,
-                    model: agentConfig.model || config.agent?.model || 'unknown',
-                    status,
-                    lastActivity: status === 'busy' ? new Date().toISOString() : null,
-                });
-                seenAgentIds.add(id);
-            }
-        }
-        // Include ephemeral agents from process pool (not in config but active)
-        if (agentStatesMap) {
-            for (const [id, processState] of agentStatesMap) {
-                if (!seenAgentIds.has(id)) {
-                    agents.push({
-                        id,
-                        name: id.charAt(0).toUpperCase() + id.slice(1),
-                        tier: 2,
-                        model: 'unknown',
-                        status: processState,
-                        lastActivity: processState === 'busy' ? new Date().toISOString() : null,
-                        ephemeral: true,
-                    });
-                }
-            }
-        }
-        // Count active chains (agents currently busy)
-        const busyCount = agents.filter((a) => a.status === 'busy').length;
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            enabled: multiAgentConfig.enabled || false,
-            agents,
-            activeChains: busyCount,
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Multi-agent status error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'MULTI_AGENT_STATUS_ERROR',
-            message,
-        }));
-    }
-}
-async function handleMultiAgentAgentsRequest(_req, res) {
-    try {
-        const config = loadMAMAConfig();
-        const multiAgentConfig = config.multi_agent || { enabled: false, agents: {} };
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const agentsList = [];
-        if (multiAgentConfig.agents) {
-            for (const [id, agentConfig] of Object.entries(multiAgentConfig.agents)) {
-                agentsList.push({
-                    id,
-                    name: agentConfig.name || id,
-                    display_name: agentConfig.display_name || agentConfig.name || id,
-                    tier: agentConfig.tier || 1,
-                    backend: agentConfig.backend || null,
-                    model: agentConfig.model || null,
-                    enabled: agentConfig.enabled !== false,
-                    persona_file: agentConfig.persona_file || null,
-                    trigger_prefix: agentConfig.trigger_prefix || null,
-                    bot_token: agentConfig.bot_token ? maskToken(agentConfig.bot_token) : null,
-                    slack_bot_token: agentConfig.slack_bot_token
-                        ? maskToken(agentConfig.slack_bot_token)
-                        : null,
-                    slack_app_token: agentConfig.slack_app_token
-                        ? maskToken(agentConfig.slack_app_token)
-                        : null,
-                    auto_respond_keywords: agentConfig.auto_respond_keywords || [],
-                    cooldown_ms: agentConfig.cooldown_ms || 5000,
-                    can_delegate: agentConfig.can_delegate || false,
-                    effort: agentConfig.effort || null,
-                    tool_permissions: agentConfig.tool_permissions || null,
-                });
-            }
-        }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ agents: agentsList }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Multi-agent agents list error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'MULTI_AGENT_AGENTS_ERROR',
-            message,
-        }));
-    }
-}
-async function handleMultiAgentUpdateAgentRequest(req, res, pathname, options = {}) {
-    try {
-        // Security: require authentication for config-writing endpoint
-        if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-            (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'UNAUTHORIZED',
-                message: 'Authentication required. Set Authorization header with valid token.',
-            }));
-            return;
-        }
-        const match = pathname.match(/\/api\/multi-agent\/agents\/([^/]+)/);
-        if (!match) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'INVALID_URL',
-                message: 'Invalid agent ID in URL',
-            }));
-            return;
-        }
-        const agentId = match[1];
-        if (!/^[a-z0-9_-]+$/i.test(agentId)) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'INVALID_AGENT_ID',
-                message: 'Invalid agent ID format',
-            }));
-            return;
-        }
-        const body = await readBody(req);
-        const config = loadMAMAConfig();
-        if (!config.multi_agent) {
-            config.multi_agent = { enabled: false, agents: {} };
-        }
-        if (!config.multi_agent.agents) {
-            config.multi_agent.agents = {};
-        }
-        if (!config.multi_agent.agents[agentId]) {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'AGENT_NOT_FOUND',
-                message: `Agent '${agentId}' not found`,
-            }));
-            return;
-        }
-        const currentAgent = config.multi_agent.agents[agentId];
-        const updatedAgent = { ...currentAgent };
-        // Validate critical field types before applying
-        const validationErrors = [];
-        if (body.tier !== undefined &&
-            (typeof body.tier !== 'number' || body.tier < 1 || body.tier > 3)) {
-            validationErrors.push('tier must be a number between 1 and 3');
-        }
-        if (body.enabled !== undefined && typeof body.enabled !== 'boolean') {
-            validationErrors.push('enabled must be a boolean');
-        }
-        if (body.cooldown_ms !== undefined &&
-            (typeof body.cooldown_ms !== 'number' || body.cooldown_ms < 0)) {
-            validationErrors.push('cooldown_ms must be a non-negative number');
-        }
-        if (body.can_delegate !== undefined && typeof body.can_delegate !== 'boolean') {
-            validationErrors.push('can_delegate must be a boolean');
-        }
-        if (body.backend !== undefined &&
-            (typeof body.backend !== 'string' ||
-                !supportedManagedBackends.includes(String(body.backend).toLowerCase()))) {
-            validationErrors.push('backend must be "claude", "codex", or "cline"');
-        }
-        const nextBackend = (body.backend !== undefined ? String(body.backend).toLowerCase() : currentAgent.backend);
-        const backendChanged = typeof body.backend === 'string' &&
-            String(body.backend).toLowerCase() !== String(currentAgent.backend ?? config.agent.backend);
-        const nextModel = (body.model !== undefined
-            ? body.model
-            : backendChanged && typeof nextBackend === 'string'
-                ? (0, backend_model_policy_js_1.defaultModelForBackend)(nextBackend)
-                : currentAgent.model);
-        if (typeof nextBackend === 'string' && typeof nextModel === 'string' && nextModel.trim()) {
-            if (nextBackend === 'claude' && !isClaudeModel(nextModel)) {
-                validationErrors.push('model must be a Claude model when backend is "claude"');
-            }
-            if (isCodexFamilyBackend(nextBackend) && !isCodexModel(nextModel)) {
-                validationErrors.push(`model must be a Codex/OpenAI model when backend is "${nextBackend}"`);
-            }
-        }
-        if (body.effort !== undefined) {
-            if (typeof body.effort !== 'string') {
-                validationErrors.push('effort must be one of: low, medium, high, max');
-            }
-            else {
-                const normalizedEffort = body.effort.toLowerCase();
-                if (!VALID_EFFORT_LEVELS.has(normalizedEffort)) {
-                    validationErrors.push('effort must be one of: low, medium, high, max');
-                }
-                else {
-                    if (nextBackend !== 'claude') {
-                        validationErrors.push('effort is only supported when backend is "claude"');
-                    }
-                    if (normalizedEffort === 'max' &&
-                        (typeof nextModel !== 'string' || !isOpus46Model(nextModel))) {
-                        validationErrors.push('effort "max" is only supported for claude-opus-4-6 models');
-                    }
-                }
-            }
-        }
-        if (validationErrors.length > 0) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'VALIDATION_ERROR',
-                message: validationErrors.join(', '),
-            }));
-            return;
-        }
-        if (body.name !== undefined) {
-            updatedAgent.name = body.name;
-        }
-        if (body.display_name !== undefined) {
-            updatedAgent.display_name = body.display_name;
-        }
-        if (body.tier !== undefined) {
-            updatedAgent.tier = body.tier;
-        }
-        if (body.backend !== undefined) {
-            updatedAgent.backend = String(body.backend).toLowerCase();
-        }
-        if (body.model !== undefined) {
-            updatedAgent.model = body.model;
-        }
-        else if (backendChanged && typeof nextModel === 'string') {
-            updatedAgent.model = nextModel;
-        }
-        if (body.enabled !== undefined) {
-            updatedAgent.enabled = body.enabled;
-        }
-        if (body.persona_file !== undefined && body.persona_file !== null) {
-            if (typeof body.persona_file !== 'string' || !isValidPersonaPath(body.persona_file)) {
-                res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: 'Invalid persona_file path. Must be within ~/.mama/personas/ or ~/.mama/workspace/',
-                }));
-                return;
-            }
-            updatedAgent.persona_file = body.persona_file;
-        }
-        if (body.trigger_prefix !== undefined)
-            updatedAgent.trigger_prefix = body.trigger_prefix;
-        if (body.auto_respond_keywords !== undefined)
-            updatedAgent.auto_respond_keywords = body.auto_respond_keywords;
-        if (body.cooldown_ms !== undefined)
-            updatedAgent.cooldown_ms = body.cooldown_ms;
-        if (body.can_delegate !== undefined)
-            updatedAgent.can_delegate = body.can_delegate;
-        if (body.effort !== undefined) {
-            updatedAgent.effort = String(body.effort).toLowerCase();
-        }
-        if (body.tool_permissions !== undefined)
-            updatedAgent.tool_permissions = body.tool_permissions;
-        const isMaskedToken = (token) => {
-            if (typeof token !== 'string')
-                return false;
-            return token === '***[redacted]***' || (token.startsWith('***[') && token.endsWith(']***'));
-        };
-        if (body.bot_token && !isMaskedToken(body.bot_token)) {
-            updatedAgent.bot_token = body.bot_token;
-        }
-        if (body.slack_bot_token && !isMaskedToken(body.slack_bot_token)) {
-            updatedAgent.slack_bot_token = body.slack_bot_token;
-        }
-        if (body.slack_app_token && !isMaskedToken(body.slack_app_token)) {
-            updatedAgent.slack_app_token = body.slack_app_token;
-        }
-        config.multi_agent.agents[agentId] = updatedAgent;
-        saveMAMAConfig(config);
-        let runtimeReloaded = true;
-        if (options.applyMultiAgentConfig) {
-            try {
-                await options.applyMultiAgentConfig(config.multi_agent);
-            }
-            catch (err) {
-                runtimeReloaded = false;
-                logger.warn(`Multi-agent hot-apply failed for ${agentId}:`, err instanceof Error ? err.message : String(err));
-            }
-        }
-        if (options.restartMultiAgentAgent) {
-            try {
-                await options.restartMultiAgentAgent(agentId);
-            }
-            catch (err) {
-                runtimeReloaded = false;
-                logger.warn(`Agent runtime restart failed for ${agentId}:`, err instanceof Error ? err.message : String(err));
-            }
-        }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            success: true,
-            message: runtimeReloaded
-                ? `Agent '${agentId}' updated successfully (runtime reloaded)`
-                : `Agent '${agentId}' config saved (runtime reload skipped or failed)`,
-        }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error('[GraphAPI] Multi-agent update agent error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'MULTI_AGENT_UPDATE_ERROR',
-            message,
-        }));
-    }
-}
-function exportToCSV(decisions) {
-    const escapeCSV = (str) => {
-        if (!str) {
-            return '';
-        }
-        const escaped = String(str).replace(/"/g, '""');
-        return escaped.includes(',') || escaped.includes('\n') || escaped.includes('"')
-            ? `"${escaped}"`
-            : escaped;
-    };
-    const headers = ['id', 'topic', 'decision', 'reasoning', 'outcome', 'confidence', 'created_at'];
-    const lines = [headers.join(',')];
-    for (const d of decisions) {
-        const row = [
-            escapeCSV(d.id),
-            escapeCSV(d.topic),
-            escapeCSV(d.decision),
-            escapeCSV(d.reasoning),
-            escapeCSV(d.outcome),
-            d.confidence ?? '',
-            d.created_at ? new Date(d.created_at).toISOString() : '',
-        ];
-        lines.push(row.join(','));
-    }
-    return lines.join('\n');
-}
-/**
- * Handle GET /api/mcp-servers - return available MCP servers from config
- * Security: Requires authentication, redacts sensitive fields (command, url, configPath)
- */
-async function handleMCPServersRequest(req, res) {
-    try {
-        // Security: require authentication for config endpoint
-        if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-            (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'UNAUTHORIZED',
-                message: 'Authentication required',
-            }));
-            return;
-        }
-        const config = loadMAMAConfig();
-        const mcpConfigPath = config.agent?.tools?.mcp_config || '~/.mama/mama-mcp-config.json';
-        const resolvedPath = mcpConfigPath.replace(/^~/, os_1.default.homedir());
-        let mcpServers = {};
-        if (fs_1.default.existsSync(resolvedPath)) {
-            const content = fs_1.default.readFileSync(resolvedPath, 'utf8');
-            const mcpConfig = JSON.parse(content);
-            mcpServers = mcpConfig.mcpServers || {};
-        }
-        // Transform to array with server names - redact sensitive fields
-        const servers = Object.entries(mcpServers).map(([name, serverConfig]) => {
-            const cfg = serverConfig;
-            return {
-                name,
-                type: cfg.type || 'stdio',
-                // Redact command and url to prevent credential leakage
-                hasCommand: !!cfg.command,
-                hasUrl: !!cfg.url,
-                // Mask args to prevent credential leakage (show count only)
-                hasArgs: Array.isArray(cfg.args) && cfg.args.length > 0,
-                argCount: Array.isArray(cfg.args) ? cfg.args.length : 0,
-            };
-        });
-        // Remove configPath from response to prevent path disclosure
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ servers }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        logger.error('MCP servers list error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: true,
-            code: 'MCP_SERVERS_ERROR',
-            message,
-        }));
-    }
-}
-/**
- * Handle DELETE /api/mcp-servers/:name - remove MCP server from config
- */
-async function handleDeleteMCPServerRequest(req, res, pathname) {
-    try {
-        // Security: require authentication for config-writing endpoint
-        if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-            (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                code: 'UNAUTHORIZED',
-                message: 'Authentication required',
-            }));
-            return;
-        }
-        const match = pathname.match(/\/api\/mcp-servers\/([^/]+)/);
-        if (!match) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, message: 'Invalid server name' }));
-            return;
-        }
-        // Safely decode URI component - malformed percent-encoding throws URIError
-        let serverName;
-        try {
-            serverName = decodeURIComponent(match[1]);
-        }
-        catch (e) {
-            if (e instanceof URIError) {
-                res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: true, message: 'Invalid server name encoding' }));
-                return;
-            }
-            throw e; // Re-throw non-decoding errors
-        }
-        // Validate serverName format (same pattern as agentId validation)
-        const SERVER_NAME_PATTERN = /^[a-z0-9_-]+$/i;
-        if (!SERVER_NAME_PATTERN.test(serverName)) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, message: 'Invalid server name format' }));
-            return;
-        }
-        const config = loadMAMAConfig();
-        const mcpConfigPath = config.agent?.tools?.mcp_config || '~/.mama/mama-mcp-config.json';
-        const resolvedPath = mcpConfigPath.replace(/^~/, os_1.default.homedir());
-        if (!fs_1.default.existsSync(resolvedPath)) {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, message: 'MCP config not found' }));
-            return;
-        }
-        const content = fs_1.default.readFileSync(resolvedPath, 'utf8');
-        const mcpConfig = JSON.parse(content);
-        if (!mcpConfig.mcpServers || !mcpConfig.mcpServers[serverName]) {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, message: `Server "${serverName}" not found` }));
-            return;
-        }
-        delete mcpConfig.mcpServers[serverName];
-        fs_1.default.writeFileSync(resolvedPath, JSON.stringify(mcpConfig, null, 2), 'utf8');
-        logger.info('Removed MCP server:', serverName);
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ deleted: true, name: serverName }));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        logger.error('Delete MCP server error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: true, message }));
-    }
-}
-async function handleCodeActRequest(req, res, options = {}) {
-    try {
-        // Security: require authentication for code execution endpoint
-        if (!(0, auth_middleware_js_1.isAuthenticated)(req)) {
-            (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: true,
-                message: 'Authentication required. Set Authorization header with valid token.',
-            }));
-            return;
-        }
-        const rateLimit = checkCodeActRateLimit(req);
-        if (!rateLimit.allowed) {
-            logger.warn('Code-Act rate limit exceeded', {
-                client: rateLimit.clientKey,
-                retryAfterSeconds: rateLimit.retryAfterSeconds,
-            });
-            res.writeHead(429, {
-                'Content-Type': 'application/json',
-                'Retry-After': String(rateLimit.retryAfterSeconds ?? 60),
-            });
-            res.end(JSON.stringify({
-                error: true,
-                message: 'Code-Act rate limit exceeded. Retry later.',
-                retry_after_seconds: rateLimit.retryAfterSeconds ?? 60,
-            }));
-            return;
-        }
-        if (!options.executeCodeAct) {
-            res.writeHead(501, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, message: 'Code-Act executor not configured' }));
-            return;
-        }
-        const body = await readBody(req);
-        const code = body?.code;
-        if (!code || typeof code !== 'string') {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: true, message: 'Missing required field: code (string)' }));
-            return;
-        }
-        let contextKey;
-        if (body.context_key !== undefined) {
-            if (!(0, run_context_registry_js_1.isProcessContextKey)(body.context_key)) {
-                res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: true,
-                    message: 'context_key must be a 32-byte base64url value without padding.',
-                }));
-                return;
-            }
-            contextKey = body.context_key;
-        }
-        let agentId;
-        if (body.agent_id !== undefined) {
-            if (typeof body.agent_id !== 'string' || body.agent_id.trim().length === 0) {
-                res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: true, message: 'agent_id must be a non-empty string.' }));
-                return;
-            }
-            agentId = body.agent_id.trim();
-        }
-        const allowedTools = normalizeCodeActToolList(body.allowed_tools, 'allowed_tools', res);
-        if (allowedTools === false) {
-            return;
-        }
-        const blockedTools = normalizeCodeActToolList(body.blocked_tools, 'blocked_tools', res);
-        if (blockedTools === false) {
-            return;
-        }
-        const result = await options.executeCodeAct(code, {
-            ...(contextKey ? { contextKey } : {}),
-            ...(agentId ? { agentId } : {}),
-            ...(allowedTools ? { allowedTools } : {}),
-            ...(blockedTools ? { blockedTools } : {}),
-        });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(result));
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        logger.error('Code-Act execution error:', message);
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: true, message }));
-    }
-}
-function normalizeCodeActToolList(value, field, res) {
-    if (value === undefined) {
-        return undefined;
-    }
-    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
-        res.writeHead(400, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: true, message: `${field} must be an array of strings.` }));
-        return false;
-    }
-    return value.map((item) => item.trim()).filter((item) => item.length > 0);
-}
-//# sourceMappingURL=graph-api.js.map