@monoes/monomindcli 2.14.1 → 2.15.1

package/dist/src/ui/routes-org.mjs

@@ -29,23 +29,43 @@ function hilRoot(req, ctx) {
   return path.resolve(dir || ctx.projectDir || process.cwd());
 }
 
-/** JSON body (≤64KB); null when absent or malformed. */
+const HIL_BODY_MAX = 65536;
+
+/** JSON body (≤64KB); null when malformed. Call inside hilRespond: an
+ *  oversized body throws 413 and an aborted upload 400, instead of an
+ *  unhandled rejection that would take the dashboard process down. Bytes are
+ *  decoded once at the end, so a character split across chunks survives. */
 async function readHilBody(req) {
-  let body = '';
-  for await (const chunk of req) {
-    body += chunk;
-    if (body.length > 65536) {
-      req.destroy();
-      return null;
+  const chunks = [];
+  let size = 0;
+  try {
+    // Past the cap, keep draining (without keeping) so the 413 still reaches
+    // the client — leaving the iterator early destroys the socket.
+    for await (const chunk of req) {
+      size += chunk.length;
+      if (size <= HIL_BODY_MAX) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
     }
+  } catch (err) {
+    throw Object.assign(new Error(`request body not received: ${err.message}`), { status: 400 });
   }
+  if (size > HIL_BODY_MAX)
+    throw Object.assign(new Error('request body is over 64KB'), { status: 413 });
   try {
-    return JSON.parse(body || '{}');
+    return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
   } catch (_) {
     return null;
   }
 }
 
+/** decodeURIComponent for a path segment; a malformed escape is a 400. */
+function decodeHilSegment(seg) {
+  try {
+    return decodeURIComponent(seg);
+  } catch (_) {
+    throw Object.assign(new Error(`malformed path segment: ${seg}`), { status: 400 });
+  }
+}
+
 /** Run `fn` and answer with its JSON result, or the HIL error's status. */
 async function hilRespond(res, corsOrigin, fn) {
   const cors = corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {};
@@ -524,74 +544,6 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
     return true;
   }
 
-  // GET /api/org/:name/projects — org projects from projects json file
-  if (req.method === 'GET' && /^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/projects$/i.test(url)) {
-    try {
-      const parts = url.split('/');
-      const orgName = decodeURIComponent(parts[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('[]');
-        return true;
-      }
-      const _projsQs = new URL(req.url, 'http://localhost').searchParams;
-      const d = path.resolve(_projsQs.get('dir') || ctx.projectDir || process.cwd());
-      const projFile = path.join(d, '.monomind', 'orgs', `${orgName}-projects.json`);
-      if (!fs.existsSync(projFile)) {
-        res.writeHead(200, {
-          'Content-Type': 'application/json',
-          ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
-        });
-        res.end('[]');
-        return true;
-      }
-      const data = JSON.parse(fs.readFileSync(projFile, 'utf8'));
-      res.writeHead(200, {
-        'Content-Type': 'application/json',
-        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
-      });
-      res.end(JSON.stringify(data.projects || []));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('[]');
-    }
-    return true;
-  }
-
-  // GET /api/org/:name/members — org member list and join requests
-  if (req.method === 'GET' && /^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/members$/i.test(url)) {
-    try {
-      const parts = url.split('/');
-      const orgName = decodeURIComponent(parts[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('{}');
-        return true;
-      }
-      const _membersQs = new URL(req.url, 'http://localhost').searchParams;
-      const d = path.resolve(_membersQs.get('dir') || ctx.projectDir || process.cwd());
-      const membersFile = path.join(d, '.monomind', 'orgs', `${orgName}-members.json`);
-      if (!fs.existsSync(membersFile)) {
-        res.writeHead(200, {
-          'Content-Type': 'application/json',
-          ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
-        });
-        res.end('{"members":[],"join_requests":[]}');
-        return true;
-      }
-      const data = JSON.parse(fs.readFileSync(membersFile, 'utf8'));
-      res.writeHead(200, {
-        'Content-Type': 'application/json',
-        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
-      });
-      res.end(JSON.stringify(data));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{}');
-    }
-    return true;
-  }
-
   // GET /api/org/:name/adapters — org adapter registry
   if (req.method === 'GET' && /^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/adapters$/i.test(url)) {
     try {
@@ -1039,47 +991,6 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
     return true;
   }
 
-  // GET /api/org/:name/issues — org task/issue list from issues file
-  if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/issues$/i)) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _issuesQs = new URL(req.url, 'http://localhost').searchParams;
-      const _issuesDir = path.resolve(_issuesQs.get('dir') || ctx.projectDir || process.cwd());
-      const issuesPath = path.join(_issuesDir, '.monomind', 'orgs', `${orgName}-issues.json`);
-      const payload = { issues: [] };
-      try {
-        const raw = JSON.parse(fs.readFileSync(issuesPath, 'utf8'));
-        payload.issues = (raw.issues || []).map((i) => ({
-          id: i.id,
-          slug: i.slug,
-          title: i.title,
-          description: i.description || null,
-          status: i.status || 'open',
-          priority: i.priority || 'medium',
-          assignee_id: i.assignee_id || null,
-          assignee: i.assignee || i.assignee_id || null,
-          project_id: i.project_id || null,
-          parent_id: i.parent_id || null,
-          created_at: i.created_at,
-          updated_at: i.updated_at,
-        }));
-      } catch (_) {
-        /* file missing is fine */
-      }
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(payload));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{}');
-    }
-    return true;
-  }
-
   // GET /api/org/:name/health — aggregate org health, from the same runtime
   // sources as /runtime: live role sessions, the task DAG, this run's usage on
   // the budget's enforcement basis, and how the last 7 days of runs ended.
@@ -1094,7 +1005,12 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
       ).length;
       const activeTasks = v.tasks.filter((t) => t.status === 'running').length;
       const weekAgo = Date.now() - 7 * 24 * 60 * 60 * 1000;
-      const week = v.history.filter((h) => (h.endedAt || 0) >= weekAgo);
+      // A resumed run keeps its run id and appends a history line per stop:
+      // count each run once, by its latest line (history is newest first).
+      const seenRuns = new Set();
+      const week = v.history.filter(
+        (h) => (h.endedAt || 0) >= weekAgo && !seenRuns.has(h.run) && seenRuns.add(h.run),
+      );
       // Only a boss's gate-checked org_complete with 'achieved' counts as success.
       const achieved = week.filter(
         (h) => h.closedBy === 'org-complete' && h.outcome?.status === 'achieved',
@@ -1118,149 +1034,6 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
     });
   }
 
-  // GET /api/org/:name/environments — org execution environments (strips key material)
-  if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/environments$/i)) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _envsQs = new URL(req.url, 'http://localhost').searchParams;
-      const envsPath = path.join(
-        path.resolve(_envsQs.get('dir') || ctx.projectDir || process.cwd()),
-        '.monomind',
-        'orgs',
-        `${orgName}-environments.json`,
-      );
-      const payload = { environments: [], default_env: null };
-      try {
-        const raw = JSON.parse(fs.readFileSync(envsPath, 'utf8'));
-        // Strip any accidental key_material or private_key fields — never send to browser
-        payload.default_env = raw.default_env || null;
-        payload.environments = (raw.environments || []).map((e) => {
-          const safe = { ...e };
-          delete safe.key_material;
-          delete safe.private_key;
-          delete safe.ssh_key;
-          delete safe.password;
-          return safe;
-        });
-      } catch (_) {
-        /* file missing is fine — return empty */
-      }
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(payload));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{}');
-    }
-    return true;
-  }
-
-  // GET /api/org/:name/workspaces — org workspaces cross-referenced with worktree registry
-  if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/workspaces$/i)) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _wsQs = new URL(req.url, 'http://localhost').searchParams;
-      const base = path.join(
-        path.resolve(_wsQs.get('dir') || ctx.projectDir || process.cwd()),
-        '.monomind',
-        'orgs',
-      );
-      const payload = { workspaces: [] };
-      try {
-        const wsRaw = JSON.parse(
-          fs.readFileSync(path.join(base, `${orgName}-workspaces.json`), 'utf8'),
-        );
-        const workspaces = wsRaw.workspaces || [];
-        // Optionally cross-reference worktree registry for branch/status enrichment
-        const worktreeMap = {};
-        try {
-          const wtRaw = JSON.parse(
-            fs.readFileSync(path.join(base, `${orgName}-worktrees.json`), 'utf8'),
-          );
-          (wtRaw.worktrees || []).forEach((wt) => {
-            worktreeMap[wt.path] = wt;
-          });
-        } catch (_) {
-          /* no worktree registry, that's fine */
-        }
-        payload.workspaces = workspaces.map((w) => {
-          const wt = w.worktree_path ? worktreeMap[w.worktree_path] : null;
-          return wt ? { ...w, branch: w.branch || wt.branch || w.branch } : w;
-        });
-      } catch (_) {
-        /* file missing is fine */
-      }
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(payload));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{}');
-    }
-    return true;
-  }
-
-  // GET /api/org/:name/invites — active invites + pending join requests
-  if (
-    req.method === 'GET' &&
-    url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/invites(\?.*)?$/i)
-  ) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3].split('?')[0]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _invitesQs = new URL(req.url, 'http://localhost').searchParams;
-      const base = path.join(
-        path.resolve(_invitesQs.get('dir') || ctx.projectDir || process.cwd()),
-        '.monomind',
-        'orgs',
-      );
-      const payload = { invites: [], join_requests: [] };
-      try {
-        const raw = JSON.parse(fs.readFileSync(path.join(base, `${orgName}-members.json`), 'utf8'));
-        const all = raw.join_requests || [];
-        payload.invites = all
-          .filter((r) => r.type === 'invite' && r.status === 'pending')
-          .map((r) => ({
-            id: r.id,
-            token: r.token ? `${r.token.slice(0, 8)}…` : r.id,
-            role: r.role || 'operator',
-            createdAt: r.createdAt || null,
-            expiresAt: r.expiresAt || null,
-            status: r.status,
-          }));
-        payload.join_requests = all
-          .filter((r) => r.type !== 'invite' && r.status === 'pending_approval')
-          .map((r) => ({
-            id: r.id,
-            requestType: r.requestType || 'human',
-            role: r.role || 'viewer',
-            createdAt: r.createdAt || null,
-            message: r.message || '',
-          }));
-      } catch (_) {
-        /* members file missing */
-      }
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(payload));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{}');
-    }
-    return true;
-  }
-
   // GET /api/org/:name/plugins — plugins from registry filtered/merged with org overrides
   if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/plugins$/i)) {
     try {
@@ -1322,52 +1095,6 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
     return true;
   }
 
-  // GET /api/org/:name/my-issues — open + in_progress issues (self-assignable queue)
-  if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/my-issues$/i)) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _myIssuesQs = new URL(req.url, 'http://localhost').searchParams;
-      const base = path.join(
-        path.resolve(_myIssuesQs.get('dir') || ctx.projectDir || process.cwd()),
-        '.monomind',
-        'orgs',
-      );
-      const payload = { issues: [] };
-      try {
-        const raw = JSON.parse(fs.readFileSync(path.join(base, `${orgName}-issues.json`), 'utf8'));
-        // Return open + in_progress issues — the "my issues" queue for the operator
-        payload.issues = (raw.issues || [])
-          .filter((i) => i.status === 'open' || i.status === 'in_progress')
-          .map((i) => ({
-            id: i.id,
-            title: i.title || null,
-            description: i.description || null,
-            status: i.status || 'open',
-            priority: i.priority || 'medium',
-            assigneeId: i.assigneeId || i.assigned_to || null,
-            projectId: i.projectId || i.project_id || null,
-            createdAt: i.createdAt || null,
-            lastActivityAt: i.lastActivityAt || null,
-            updated_at: i.updated_at || i.lastActivityAt || i.updatedAt || i.ts || null,
-            ts: i.ts || i.updated_at || i.lastActivityAt || null,
-          }));
-      } catch (_) {
-        /* issues file missing */
-      }
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(payload));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{}');
-    }
-    return true;
-  }
-
   // GET /api/org/:name/runtime — what the org is doing now, from the runtime's
   // own sources (live daemon status, run bus, idle watchdog, history).
   if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/runtime$/i)) {
@@ -1385,9 +1112,9 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
   // same OrgDefSchema parse `org run` does.
   if (req.method === 'POST' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/config$/i)) {
     const orgName = decodeURIComponent(url.split('/')[3]);
-    const body = await readHilBody(req);
     const root = hilRoot(req, ctx);
-    return hilRespond(res, corsOrigin, () => {
+    return hilRespond(res, corsOrigin, async () => {
+      const body = await readHilBody(req);
       if (!body || typeof body !== 'object')
         throw Object.assign(new Error('JSON body required'), { status: 400 });
       try {
@@ -1500,16 +1227,14 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
   // POST /api/questions/answer { dir, org, questionId, answer } — live to the
   // hosting daemon (operator credential), else queued for the org's next run.
   if (req.method === 'POST' && url === '/api/questions/answer') {
-    const body = await readHilBody(req);
-    const { org, questionId, answer } = body || {};
-    if (!validOrgName(org) || !questionId || typeof answer !== 'string' || !answer.trim())
-      return hilRespond(res, corsOrigin, () => {
+    return hilRespond(res, corsOrigin, async () => {
+      const body = await readHilBody(req);
+      const { org, questionId, answer } = body || {};
+      if (!validOrgName(org) || !questionId || typeof answer !== 'string' || !answer.trim())
         throw Object.assign(new Error('org, questionId and a non-empty answer are required'), {
           status: 400,
         });
-      });
-    const root = path.resolve(body.dir || ctx.projectDir || process.cwd());
-    return hilRespond(res, corsOrigin, async () => {
+      const root = path.resolve(body.dir || ctx.projectDir || process.cwd());
       const r = await hil.answerQuestion(root, org, String(questionId), answer.trim());
       hilEvent(ctx, root, {
         type: 'org:question-answered',
@@ -1530,14 +1255,14 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
   ) {
     const parts = url.split('?')[0].split('/');
     const orgName = decodeURIComponent(parts[3]);
-    const gateId = decodeURIComponent(parts[5]);
-    const body = await readHilBody(req);
-    const resolution =
-      typeof body?.resolution === 'string' && body.resolution.trim()
-        ? body.resolution.trim().slice(0, 4000)
-        : undefined;
     const root = hilRoot(req, ctx);
     return hilRespond(res, corsOrigin, async () => {
+      const gateId = decodeHilSegment(parts[5]);
+      const body = await readHilBody(req);
+      const resolution =
+        typeof body?.resolution === 'string' && body.resolution.trim()
+          ? body.resolution.trim().slice(0, 4000)
+          : undefined;
       if (typeof body?.approved !== 'boolean')
         throw Object.assign(new Error('approved (boolean) is required'), { status: 400 });
       const r = await hil.resolveGate(root, orgName, gateId, body.approved, resolution);
@@ -1561,10 +1286,10 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
   ) {
     const parts = url.split('?')[0].split('/');
     const orgName = decodeURIComponent(parts[3]);
-    const requestId = decodeURIComponent(parts[5]);
-    const body = await readHilBody(req);
     const root = hilRoot(req, ctx);
     return hilRespond(res, corsOrigin, async () => {
+      const requestId = decodeHilSegment(parts[5]);
+      const body = await readHilBody(req);
       if (body?.action !== 'approve' && body?.action !== 'reject')
         throw Object.assign(new Error('action must be approve or reject'), { status: 400 });
       const approved = body.action === 'approve';
@@ -1581,54 +1306,6 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
     });
   }
 
-  // GET /api/org/:name/secrets — masked secrets list (NEVER exposes values)
-  if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/secrets$/i)) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _secretsQs = new URL(req.url, 'http://localhost').searchParams;
-      const base = path.join(
-        path.resolve(_secretsQs.get('dir') || ctx.projectDir || process.cwd()),
-        '.monomind',
-        'orgs',
-      );
-      const secretsDir = path.join(base, '.secrets');
-      const readJsonSafe = (f) => {
-        try {
-          return JSON.parse(fs.readFileSync(f, 'utf8'));
-        } catch (_) {
-          return null;
-        }
-      };
-      // Read secrets index — NEVER expose actual values
-      const indexFile = path.join(secretsDir, `${orgName}-index.json`);
-      const data = readJsonSafe(indexFile) || { secrets: [] };
-      const secrets = (data.secrets || []).map((s) => ({
-        name: s.name,
-        purpose: s.purpose || null,
-        maskedRef: s.maskedRef || `${(s.name || '').substring(0, 4)}***`,
-        status: s.status || 'active',
-        createdAt: s.createdAt || null,
-        rotatedAt: s.rotatedAt || null,
-        lastUsedAt: s.lastUsedAt || null,
-        usageCount: s.usageCount || 0,
-      }));
-      res.writeHead(200, {
-        'Content-Type': 'application/json',
-        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
-      });
-      res.end(JSON.stringify({ secrets }));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{"secrets":[]}');
-    }
-    return true;
-  }
-
   // GET /api/org/:name/budgets — org and per-agent budget data
   // Returns: { org_budget: {limit_tokens, limit_usd}, agent_budgets: {agentId: {limit_usd}}, agents: [{id, title, tokens_in, tokens_out, total_cost_usd}] }
   if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/budgets$/i)) {
@@ -1847,79 +1524,6 @@ export async function handleOrgRoutes(req, res, url, corsOrigin, ctx) {
     return true;
   }
 
-  // GET /api/org/:name/join-requests — pending join requests for this org
-  // Returns: { requests: [{id, requesterId, requesterName, type, status, createdAt, resolvedAt}], pending: N }
-  if (
-    req.method === 'GET' &&
-    url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/join-requests(\?.*)?$/i)
-  ) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3].split('?')[0]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _joinQs = new URL(req.url, 'http://localhost').searchParams;
-      const joinFile = path.join(
-        path.resolve(_joinQs.get('dir') || ctx.projectDir || process.cwd()),
-        '.monomind',
-        'orgs',
-        `${orgName}-join-requests.json`,
-      );
-      let requests = [];
-      try {
-        const raw = fs.readFileSync(joinFile, 'utf8');
-        const data = JSON.parse(raw);
-        requests = (data.requests || []).map((r) => ({
-          id: r.id,
-          requesterId: r.requesterId,
-          requesterName: r.requesterName || r.requesterId,
-          type: r.type || 'human',
-          status: r.status || 'pending_approval',
-          createdAt: r.createdAt,
-          resolvedAt: r.resolvedAt || null,
-        }));
-      } catch (_) {}
-      const pending = requests.filter((r) => r.status === 'pending_approval').length;
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ requests, pending }));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{"requests":[],"pending":0}');
-    }
-    return true;
-  }
-
-  // GET /api/org/:name/goals — read org goals
-  if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/goals$/i)) {
-    try {
-      const orgName = decodeURIComponent(url.split('/')[3]);
-      if (orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
-        res.writeHead(400);
-        res.end('Invalid org name');
-        return true;
-      }
-      const _goalsQs = new URL(req.url, 'http://localhost').searchParams;
-      const _goalsRoot = path.resolve(_goalsQs.get('dir') || ctx.projectDir || process.cwd());
-      const _goalsProjDir = ctx._resolveOrgProjectDir(orgName, _goalsRoot) || _goalsRoot;
-      const goalsFile = path.join(_goalsProjDir, '.monomind', 'orgs', `${orgName}-goals.json`);
-      let data = { goals: [] };
-      try {
-        data = JSON.parse(fs.readFileSync(goalsFile, 'utf8'));
-      } catch (_) {}
-      res.writeHead(200, {
-        'Content-Type': 'application/json',
-        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
-      });
-      res.end(JSON.stringify({ goals: data.goals || [] }));
-    } catch (_) {
-      res.writeHead(500);
-      res.end('{"goals":[]}');
-    }
-    return true;
-  }
-
   // GET /api/org/:name/routines — read org routines (falls back to synthesizing from org config's loop object)
   if (req.method === 'GET' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/routines$/i)) {
     try {