@mecha.im/cli 0.3.4

package/agent/routes/api.ts

@@ -0,0 +1,149 @@
+import { Hono } from "hono";
+import { streamSSE } from "hono/streaming";
+import { writeFileSync } from "node:fs";
+import { log } from "../../shared/logger.js";
+import type { BotConfig } from "../types.js";
+import type { SessionManager } from "../session.js";
+import type { CostTracker } from "../costs.js";
+import type { ActivityTracker } from "../activity.js";
+import type { Mutex } from "../../shared/mutex.js";
+import { readEvents } from "../event-log.js";
+
+interface ApiDeps {
+  config: BotConfig;
+  startedAt: number;
+  sessions: SessionManager;
+  costs: CostTracker;
+  activity: ActivityTracker;
+  busy: Mutex;
+}
+
+export function createApiRoutes(deps: ApiDeps): Hono {
+  const { config, startedAt, sessions, costs, activity, busy } = deps;
+  const app = new Hono();
+
+  app.get("/costs", (c) => {
+    return c.json(costs.getCosts());
+  });
+
+  app.get("/tasks", (c) => {
+    return c.json(sessions.listTasks());
+  });
+
+  app.get("/tasks/:id", (c) => {
+    const task = sessions.getTask(c.req.param("id"));
+    if (!task) return c.json({ error: "Task not found" }, 404);
+    return c.json(task);
+  });
+
+  app.post("/bot/restart", (c) => {
+    if (busy.isLocked) {
+      const force = c.req.query("force") === "true";
+      if (!force) {
+        return c.json({ error: "Bot is busy", code: "BOT_BUSY", state: activity.getState() }, 409);
+      }
+    }
+    log.info("Restart requested via dashboard");
+    setTimeout(() => process.exit(0), 200);
+    return c.json({ status: "restarting" });
+  });
+
+  app.post("/bot/stop", (c) => {
+    if (busy.isLocked) {
+      const force = c.req.query("force") === "true";
+      if (!force) {
+        return c.json({ error: "Bot is busy", code: "BOT_BUSY", state: activity.getState() }, 409);
+      }
+    }
+    log.info("Stop requested via dashboard");
+    try { writeFileSync("/state/stop-requested", ""); } catch { /* ignore */ }
+    setTimeout(() => process.exit(0), 200);
+    return c.json({ status: "stopping" });
+  });
+
+  // Cache package versions (resolved async at startup, non-blocking)
+  let cachedVersions: Record<string, string> = {};
+  function resolveVersionAsync(): void {
+    const ver = (cmd: string, args: string[]): Promise<string> =>
+      new Promise((resolve) => {
+        import("node:child_process").then(({ execFile }) => {
+          execFile(cmd, args, { encoding: "utf-8", timeout: 5000 }, (err, stdout) => {
+            resolve(err ? "not installed" : stdout.trim());
+          });
+        });
+      });
+    Promise.all([
+      ver("claude", ["--version"]),
+      ver("node", ["-e", 'try{const p=require.resolve("@anthropic-ai/claude-agent-sdk/package.json");console.log(require(p).version)}catch{console.log("not installed")}']),
+      ver("python3", ["-c", "import claude_agent_sdk;print(claude_agent_sdk.__version__)"]),
+      ver("codex", ["--version"]),
+      ver("gemini", ["--version"]),
+    ]).then(([claude, sdkJs, sdkPy, codex, gemini]) => {
+      cachedVersions = {
+        claude_code: claude.split("\n")[0] || claude,
+        claude_agent_sdk_js: sdkJs,
+        claude_agent_sdk_py: sdkPy,
+        codex: codex.split("\n")[0] || codex,
+        gemini_cli: gemini.split("\n")[0] || gemini,
+      };
+    });
+  }
+  // Resolve versions at startup (non-blocking)
+  resolveVersionAsync();
+
+  app.get("/status", (c) => {
+    const activeTask = sessions.getActiveTask();
+    return c.json({
+      name: config.name,
+      state: activity.getState(),
+      model: config.model,
+      uptime: Math.floor((Date.now() - startedAt) / 1000),
+      current_task: activeTask?.id ?? null,
+      current_session_id: activeTask?.session_id ?? null,
+      talking_to: activity.getTalkingTo(),
+      last_active: activity.getLastActive(),
+      versions: cachedVersions,
+    });
+  });
+
+  app.get("/status/stream", async (c) => {
+    return streamSSE(c, async (stream) => {
+      const snapshot = {
+        activity: activity.getState(),
+        talkingTo: activity.getTalkingTo(),
+        lastActive: activity.getLastActive(),
+      };
+      await stream.writeSSE({ event: "snapshot", data: JSON.stringify(snapshot) });
+
+      const onStateChange = (data: unknown) => {
+        stream.writeSSE({ event: "state", data: JSON.stringify(data) }).catch(() => {});
+      };
+      activity.on("change", onStateChange);
+
+      const heartbeat = setInterval(() => {
+        stream.writeSSE({ event: "heartbeat", data: "" }).catch(() => {});
+      }, 30_000);
+
+      await new Promise<void>((resolve) => {
+        c.req.raw.signal.addEventListener("abort", () => {
+          activity.off("change", onStateChange);
+          clearInterval(heartbeat);
+          resolve();
+        });
+      });
+    });
+  });
+
+  app.get("/logs", (c) => {
+    const rawLimit = parseInt(c.req.query("limit") ?? "100", 10);
+    const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 500) : 100;
+    const source = c.req.query("source");
+    let events = readEvents(limit);
+    if (source) {
+      events = events.filter((e) => e.type === source || e.source === source);
+    }
+    return c.json(events);
+  });
+
+  return app;
+}

package/agent/routes/config.ts

@@ -0,0 +1,116 @@
+import { Hono } from "hono";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { z } from "zod";
+import { log } from "../../shared/logger.js";
+import type { BotConfig } from "../types.js";
+import type { Mutex } from "../../shared/mutex.js";
+import type { ActivityTracker } from "../activity.js";
+
+const configUpdateSchema = z.object({
+  model: z.string().min(1).optional(),
+  max_turns: z.number().int().min(1).max(100).optional(),
+  permission_mode: z.enum(["default", "acceptEdits", "bypassPermissions", "plan", "dontAsk"]).optional(),
+  system: z.string().min(1).optional(),
+  auth: z.string().min(1).optional(),
+}).refine(obj => Object.keys(obj).length > 0, { message: "No fields to update" });
+
+const CREDENTIALS_PATH = "/state/credentials.yaml";
+const CONFIG_PATH = process.env.MECHA_CONFIG_PATH ?? "/config/bot.yaml";
+
+export function createConfigRoutes(config: BotConfig, busy: Mutex, activity: ActivityTracker): Hono {
+  const app = new Hono();
+
+  app.get("/config", (c) => {
+    const hasOauth = !!process.env.CLAUDE_CODE_OAUTH_TOKEN;
+    const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
+    const authType = hasOauth ? "oauth" : hasApiKey ? "api_key" : "unknown";
+
+    return c.json({
+      name: config.name,
+      model: config.model,
+      auth_type: authType,
+      auth_profile: config.auth ?? null,
+      max_turns: config.max_turns,
+      permission_mode: config.permission_mode,
+      workspace: config.workspace ? true : undefined,
+      workspace_writable: config.workspace_writable,
+      schedule: config.schedule?.length ?? 0,
+      webhooks: config.webhooks ? { accept: config.webhooks.accept } : undefined,
+    });
+  });
+
+  app.get("/auth/profiles", (c) => {
+    if (!existsSync(CREDENTIALS_PATH)) {
+      return c.json({ current_profile: config.auth ?? null, profiles: [] });
+    }
+    try {
+      const raw = readFileSync(CREDENTIALS_PATH, "utf-8");
+      const parsed = parseYaml(raw) as { credentials?: Array<{ name: string; type: string }> };
+      const claudeProfiles = (parsed.credentials ?? [])
+        .filter((cr) => cr.type === "api_key" || cr.type === "oauth_token")
+        .map((cr) => ({ name: cr.name, type: cr.type }));
+      return c.json({ current_profile: config.auth ?? null, profiles: claudeProfiles });
+    } catch {
+      return c.json({ current_profile: config.auth ?? null, profiles: [] });
+    }
+  });
+
+  app.put("/config", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (!body) {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+
+    const result = configUpdateSchema.safeParse(body);
+    if (!result.success) {
+      return c.json({ error: result.error.issues[0].message }, 400);
+    }
+
+    const updates = result.data;
+
+    // Validate auth profile if being changed
+    if (updates.auth !== undefined) {
+      if (!existsSync(CREDENTIALS_PATH)) {
+        return c.json({ error: "No credentials file available" }, 400);
+      }
+      try {
+        const credsRaw = readFileSync(CREDENTIALS_PATH, "utf-8");
+        const credsParsed = parseYaml(credsRaw) as { credentials?: Array<{ name: string; type: string }> };
+        const cred = credsParsed.credentials?.find((cr) => cr.name === updates.auth);
+        if (!cred || (cred.type !== "api_key" && cred.type !== "oauth_token")) {
+          return c.json({ error: `Profile "${updates.auth}" not found or not a Claude auth credential` }, 404);
+        }
+      } catch {
+        return c.json({ error: "Failed to read credentials file" }, 500);
+      }
+    }
+
+    const force = c.req.query("force") === "true";
+    if (!force && busy.isLocked) {
+      return c.json({ error: "Bot is busy", code: "BOT_BUSY", state: activity.getState() }, 409);
+    }
+
+    try {
+      const configRaw = readFileSync(CONFIG_PATH, "utf-8");
+      const configParsed = parseYaml(configRaw) as Record<string, unknown>;
+      const changes: Record<string, unknown> = {};
+
+      if (updates.model !== undefined) { configParsed.model = updates.model; changes.model = updates.model; }
+      if (updates.max_turns !== undefined) { configParsed.max_turns = updates.max_turns; changes.max_turns = updates.max_turns; }
+      if (updates.permission_mode !== undefined) { configParsed.permission_mode = updates.permission_mode; changes.permission_mode = updates.permission_mode; }
+      if (updates.system !== undefined) { configParsed.system = updates.system; changes.system = updates.system; }
+      if (updates.auth !== undefined) { configParsed.auth = updates.auth; changes.auth = updates.auth; }
+
+      writeFileSync(CONFIG_PATH, stringifyYaml(configParsed));
+      log.info(`Config updated: [${Object.keys(changes).join(", ")}], restarting...`);
+
+      setTimeout(() => process.exit(0), 200);
+      return c.json({ status: "updating", changes, message: "Bot is restarting with updated config..." });
+    } catch {
+      return c.json({ error: "Failed to update config" }, 500);
+    }
+  });
+
+  return app;
+}

package/agent/routes/dashboard.ts

@@ -0,0 +1,101 @@
+import { Hono } from "hono";
+import { resolve, normalize, join } from "node:path";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { existsSync } from "node:fs";
+
+// Hot-reload path (writable bind-mount) takes priority over image-baked dist
+const HOT_DASHBOARD_ROOT = "/state/dashboard-dist";
+const DEFAULT_DASHBOARD_ROOT = "/app/agent/dashboard/dist";
+const COOKIE_NAME = "mecha_session";
+
+function getDashboardRoot(): string {
+  return existsSync(join(HOT_DASHBOARD_ROOT, "index.html"))
+    ? HOT_DASHBOARD_ROOT
+    : DEFAULT_DASHBOARD_ROOT;
+}
+
+const MIME_TYPES: Record<string, string> = {
+  html: "text/html",
+  js: "application/javascript",
+  css: "text/css",
+  json: "application/json",
+  svg: "image/svg+xml",
+  png: "image/png",
+};
+
+function makeSessionToken(botToken: string): string {
+  return createHmac("sha256", botToken).update("mecha-dashboard-session").digest("hex");
+}
+
+export function verifySessionCookie(cookieHeader: string | undefined, botToken: string): boolean {
+  if (!cookieHeader) return false;
+  const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${COOKIE_NAME}=([^;]+)`));
+  if (!match) return false;
+  const received = Buffer.from(match[1]);
+  const expected = Buffer.from(makeSessionToken(botToken));
+  return received.length === expected.length && timingSafeEqual(received, expected);
+}
+
+export function createDashboardRoutes(botToken: string): Hono {
+  const app = new Hono();
+  const sessionToken = makeSessionToken(botToken);
+
+  function setSessionCookie(c: import("hono").Context): void {
+    c.header("Set-Cookie", `${COOKIE_NAME}=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Secure`);
+  }
+
+  /** Only grant session cookie if: (a) loopback client, (b) valid ?token= param, or (c) proxied via fleet dashboard */
+  function shouldGrantSession(c: import("hono").Context): boolean {
+    // Already has valid cookie — keep it
+    if (verifySessionCookie(c.req.header("cookie"), botToken)) return true;
+    // Token provided as query param (one-time auth)
+    const qToken = new URL(c.req.url).searchParams.get("token");
+    if (qToken && timingSafeEqual(Buffer.from(qToken), Buffer.from(botToken))) return true;
+    // Proxied from fleet dashboard (has Authorization header with bot token)
+    const auth = c.req.header("authorization");
+    if (auth === `Bearer ${botToken}`) return true;
+    // Loopback client — auto-grant (same as fleet dashboard pattern)
+    const remoteAddr = c.req.header("x-forwarded-for") ?? "";
+    const isLoopback = !remoteAddr || remoteAddr === "127.0.0.1" || remoteAddr === "::1";
+    return isLoopback;
+  }
+
+  // Redirect /dashboard to /dashboard/ for consistent relative paths
+  app.get("/dashboard", (c) => c.redirect("/dashboard/"));
+
+  app.get("/dashboard/*", async (c) => {
+    const dashboardRoot = getDashboardRoot();
+    const reqPath = c.req.path.replace("/dashboard", "") || "/index.html";
+    const filePath = reqPath === "/" ? "/index.html" : reqPath;
+    const resolved = resolve(dashboardRoot, filePath.replace(/^\//, ""));
+    const normalized = normalize(resolved);
+
+    if (normalized !== dashboardRoot && !normalized.startsWith(dashboardRoot + "/")) {
+      return c.json({ error: "Forbidden" }, 403);
+    }
+
+    const grantCookie = shouldGrantSession(c);
+
+    try {
+      const { readFile } = await import("node:fs/promises");
+      const content = await readFile(normalized);
+      const ext = normalized.split(".").pop() ?? "";
+      const isHtml = ext === "html";
+      if (isHtml && grantCookie) setSessionCookie(c);
+      return c.body(content, 200, {
+        "Content-Type": MIME_TYPES[ext] ?? "application/octet-stream",
+      });
+    } catch {
+      try {
+        const { readFile } = await import("node:fs/promises");
+        const html = await readFile(`${dashboardRoot}/index.html`);
+        if (grantCookie) setSessionCookie(c);
+        return c.body(html, 200, { "Content-Type": "text/html" });
+      } catch {
+        return c.json({ error: "Dashboard not built" }, 404);
+      }
+    }
+  });
+
+  return app;
+}

package/agent/routes/schedule.ts

@@ -0,0 +1,84 @@
+import { Hono } from "hono";
+import type { Scheduler } from "../scheduler.js";
+
+export function createScheduleRoutes(getScheduler: () => Scheduler | undefined): Hono {
+  const app = new Hono();
+
+  app.get("/", (c) => {
+    const scheduler = getScheduler();
+    if (!scheduler) return c.json([]);
+    return c.json(scheduler.getStatus());
+  });
+
+  app.post("/", async (c) => {
+    const scheduler = getScheduler();
+    if (!scheduler) return c.json({ error: "Scheduler not initialized" }, 400);
+    const body = await c.req.json().catch(() => null);
+    if (!body || typeof body.cron !== "string" || typeof body.prompt !== "string") {
+      return c.json({ error: "cron and prompt are required" }, 400);
+    }
+    const { cron, prompt } = body as { cron: string; prompt: string };
+    if (!prompt.trim()) return c.json({ error: "prompt cannot be empty" }, 400);
+    const result = scheduler.addEntry(cron, prompt.trim());
+    if (result.error) return c.json({ error: result.error }, 400);
+    return c.json({ id: result.id, status: "created" }, 201);
+  });
+
+  app.put("/:id", async (c) => {
+    const scheduler = getScheduler();
+    if (!scheduler) return c.json({ error: "Scheduler not initialized" }, 400);
+    const id = c.req.param("id");
+    if (!/^[a-f0-9]{16}$/.test(id)) return c.json({ error: "Invalid schedule ID" }, 400);
+    const body = await c.req.json().catch(() => null);
+    if (!body) return c.json({ error: "Request body required" }, 400);
+    const updates: { cron?: string; prompt?: string } = {};
+    if (typeof body.cron === "string") updates.cron = body.cron;
+    if (typeof body.prompt === "string") updates.prompt = body.prompt.trim();
+    if (!updates.cron && !updates.prompt) return c.json({ error: "cron or prompt required" }, 400);
+    const result = scheduler.updateEntry(id, updates);
+    if (result.error) return c.json({ error: result.error }, 400);
+    return c.json({ status: "updated" });
+  });
+
+  app.delete("/:id", (c) => {
+    const scheduler = getScheduler();
+    if (!scheduler) return c.json({ error: "Scheduler not initialized" }, 400);
+    const id = c.req.param("id");
+    if (!/^[a-f0-9]{16}$/.test(id)) return c.json({ error: "Invalid schedule ID" }, 400);
+    const ok = scheduler.removeEntry(id);
+    if (!ok) return c.json({ error: "Schedule not found" }, 404);
+    return c.json({ status: "deleted" });
+  });
+
+  app.post("/:id/pause", (c) => {
+    const scheduler = getScheduler();
+    if (!scheduler) return c.json({ error: "Scheduler not initialized" }, 400);
+    const id = c.req.param("id");
+    if (!/^[a-f0-9]{16}$/.test(id)) return c.json({ error: "Invalid schedule ID" }, 400);
+    const ok = scheduler.pauseEntry(id);
+    if (!ok) return c.json({ error: "Entry not found or already paused" }, 400);
+    return c.json({ status: "paused" });
+  });
+
+  app.post("/:id/resume", (c) => {
+    const scheduler = getScheduler();
+    if (!scheduler) return c.json({ error: "Scheduler not initialized" }, 400);
+    const id = c.req.param("id");
+    if (!/^[a-f0-9]{16}$/.test(id)) return c.json({ error: "Invalid schedule ID" }, 400);
+    const result = scheduler.resumeEntry(id);
+    if (result.error) return c.json({ error: result.error }, 400);
+    return c.json({ status: "resumed" });
+  });
+
+  app.post("/trigger/:id", async (c) => {
+    const scheduler = getScheduler();
+    if (!scheduler) return c.json({ error: "No scheduler" }, 404);
+    const id = c.req.param("id");
+    if (!/^[a-f0-9]{16}$/.test(id)) return c.json({ error: "Invalid schedule ID" }, 400);
+    const ok = await scheduler.triggerNow(id);
+    if (!ok) return c.json({ error: "Schedule not found" }, 404);
+    return c.json({ status: "triggered" });
+  });
+
+  return app;
+}

package/agent/routes/sessions.ts

@@ -0,0 +1,43 @@
+import { Hono } from "hono";
+import { log } from "../../shared/logger.js";
+import type { SessionHistory } from "../session-history.js";
+
+export function createSessionRoutes(sessionHistory: SessionHistory): Hono {
+  const app = new Hono();
+
+  app.get("/", async (c) => {
+    try {
+      const list = await sessionHistory.list();
+      return c.json(list);
+    } catch (err) {
+      log.error("Failed to list sessions", { error: err instanceof Error ? err.message : String(err) });
+      return c.json({ error: "Failed to list sessions" }, 500);
+    }
+  });
+
+  app.get("/search", async (c) => {
+    try {
+      const q = (c.req.query("q") ?? "").slice(0, 500);
+      if (!q.trim()) return c.json([]);
+      const results = await sessionHistory.search(q);
+      return c.json(results);
+    } catch (err) {
+      log.error("Failed to search sessions", { error: err instanceof Error ? err.message : String(err) });
+      return c.json({ error: "Failed to search sessions" }, 500);
+    }
+  });
+
+  app.get("/:id", async (c) => {
+    try {
+      const id = c.req.param("id");
+      const detail = await sessionHistory.getConversation(id);
+      if (!detail) return c.json({ error: "Session not found" }, 404);
+      return c.json(detail);
+    } catch (err) {
+      log.error("Failed to get session", { error: err instanceof Error ? err.message : String(err) });
+      return c.json({ error: "Failed to get session" }, 500);
+    }
+  });
+
+  return app;
+}

package/agent/routes/webhooks.ts

@@ -0,0 +1,113 @@
+import { Hono } from "hono";
+import { readFileSync, writeFileSync } from "node:fs";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { z } from "zod";
+import type { BotConfig } from "../types.js";
+import type { WebhookState } from "../webhook.js";
+
+const CONFIG_PATH = process.env.MECHA_CONFIG_PATH ?? "/config/bot.yaml";
+
+const updateSchema = z.object({
+  accept: z.array(z.string().min(1)).max(50).optional(),
+  secret: z.string().min(1).nullable().optional(),
+}).refine(obj => obj.accept !== undefined || obj.secret !== undefined, {
+  message: "At least one of accept or secret is required",
+});
+
+const addEventSchema = z.object({
+  event: z.string().min(1),
+});
+
+function persistWebhooks(accept: string[], secret?: string | null): void {
+  const raw = readFileSync(CONFIG_PATH, "utf-8");
+  const parsed = parseYaml(raw) as Record<string, unknown>;
+  const webhooks = (parsed.webhooks ?? {}) as Record<string, unknown>;
+  webhooks.accept = accept;
+  if (secret === null) {
+    delete webhooks.secret;
+  } else if (secret !== undefined) {
+    webhooks.secret = secret;
+  }
+  parsed.webhooks = webhooks;
+  writeFileSync(CONFIG_PATH, stringifyYaml(parsed));
+}
+
+export function createWebhookConfigRoutes(
+  config: BotConfig,
+  webhookState: WebhookState,
+): Hono {
+  const app = new Hono();
+
+  app.get("/", (c) => {
+    return c.json({
+      accept: webhookState.accept,
+      secret_set: !!webhookState.secret,
+      endpoint: "/webhook",
+    });
+  });
+
+  app.put("/", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (!body) return c.json({ error: "Invalid JSON body" }, 400);
+
+    const result = updateSchema.safeParse(body);
+    if (!result.success) return c.json({ error: result.error.issues[0].message }, 400);
+
+    const { accept, secret } = result.data;
+    const newAccept = accept ?? webhookState.accept;
+
+    try {
+      persistWebhooks(newAccept, secret);
+      webhookState.accept = newAccept;
+      if (secret === null) webhookState.secret = undefined;
+      else if (secret !== undefined) webhookState.secret = secret;
+      return c.json({ status: "updated", accept: newAccept, secret_set: !!webhookState.secret });
+    } catch {
+      return c.json({ error: "Failed to update config" }, 500);
+    }
+  });
+
+  app.post("/accept", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (!body) return c.json({ error: "Invalid JSON body" }, 400);
+
+    const result = addEventSchema.safeParse(body);
+    if (!result.success) return c.json({ error: result.error.issues[0].message }, 400);
+
+    const current = webhookState.accept;
+    if (current.includes(result.data.event)) {
+      return c.json({ error: "Event type already in accept list" }, 409);
+    }
+    if (current.length >= 50) {
+      return c.json({ error: "Accept list cannot exceed 50 items" }, 400);
+    }
+
+    const newAccept = [...current, result.data.event];
+    try {
+      persistWebhooks(newAccept);
+      webhookState.accept = newAccept;
+      return c.json({ status: "added", accept: newAccept });
+    } catch {
+      return c.json({ error: "Failed to update config" }, 500);
+    }
+  });
+
+  app.delete("/accept/:event", (c) => {
+    const event = c.req.param("event");
+    const current = webhookState.accept;
+    const newAccept = current.filter((e) => e !== event);
+    if (newAccept.length === current.length) {
+      return c.json({ error: "Event type not found" }, 404);
+    }
+
+    try {
+      persistWebhooks(newAccept);
+      webhookState.accept = newAccept;
+      return c.json({ status: "removed", accept: newAccept });
+    } catch {
+      return c.json({ error: "Failed to update config" }, 500);
+    }
+  });
+
+  return app;
+}