@monoes/monomindcli 2.16.12 → 2.16.13

package/dist/src/ui/routes-org-live.mjs

@@ -0,0 +1,278 @@
+import fs from 'node:fs';
+import path from 'node:path';
+// forwarder.js is compiled from orgrt/forwarder.ts (dist/src/orgrt/forwarder.js
+// sits alongside this file's own compiled copy in dist/src/ui/ after
+// build; under vitest the .js specifier resolves straight to the .ts source,
+// same as every other cross-reference in this codebase). translate()/
+// companionEvents() are pure — no filesystem or process side effects — so
+// importing them here doesn't pull in attachForwarder's spawn/heal logic.
+import { companionEvents, translate } from '../orgrt/forwarder.js';
+import { getMmClientCount } from './sse-manager.mjs';
+
+// Org dashboard routes: loops, status, current run, history and memory.
+// Registered, in order, by handleOrgRoutes in routes-org.mjs.
+export async function handleOrgLiveRoutes(req, res, url, corsOrigin, ctx) {
+  // GET /api/mastermind/loops — list all active loop state files
+  if (req.method === 'GET' && url === '/api/mastermind/loops') {
+    try {
+      const loopsDir = path.join(ctx.projectDir || process.cwd(), '.monomind', 'loops');
+      const loops = [];
+      if (fs.existsSync(loopsDir)) {
+        const files = fs
+          .readdirSync(loopsDir)
+          .filter((f) => f.endsWith('.json') && !f.includes('-hil'));
+        for (const f of files) {
+          try {
+            const d = JSON.parse(fs.readFileSync(path.join(loopsDir, f), 'utf8'));
+            loops.push(d);
+          } catch (_) {}
+        }
+      }
+      loops.sort((a, b) => (b.lastRunAt || 0) - (a.lastRunAt || 0));
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ loops }));
+    } catch (_) {
+      res.writeHead(500);
+      res.end('{"loops":[]}');
+    }
+    return true;
+  }
+
+  // GET /api/status — live system snapshot for dashboard polling
+  if (req.method === 'GET' && url === '/api/status') {
+    try {
+      const root = ctx.projectDir || process.cwd();
+      // Active org runs: { orgName -> runId }
+      const orgRuns = {};
+      ctx.activeOrgRuns.forEach((runId, org) => {
+        orgRuns[org] = runId;
+      });
+      // Recent events (last 10)
+      let recentEvents = [];
+      try {
+        const evPath = path.join(root, 'data', 'mastermind-events.jsonl');
+        const lines = fs
+          .readFileSync(evPath, 'utf8')
+          .split('\n')
+          .filter((l) => l.trim())
+          .slice(-10);
+        recentEvents = lines
+          .map((l) => {
+            try {
+              return JSON.parse(l);
+            } catch (_) {
+              return null;
+            }
+          })
+          .filter(Boolean);
+      } catch (_) {}
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(
+        JSON.stringify({
+          ts: Date.now(),
+          pid: process.pid,
+          uptime: process.uptime(),
+          dir: root,
+          sseClients: getMmClientCount(),
+          activeOrgs: Object.keys(orgRuns).length,
+          orgRuns,
+          recentEvents,
+        }),
+      );
+    } catch (err) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+    return true;
+  }
+
+  // GET /api/orgs/:name/runs/current — events from the active run file for an org
+  if (req.method === 'GET' && /^\/api\/orgs\/[^/]+\/runs\/current$/.test(url)) {
+    try {
+      const orgName = decodeURIComponent(url.split('/')[3]);
+      const _curQs = new URL(req.url, 'http://localhost').searchParams;
+      const root = path.resolve(_curQs.get('dir') || ctx.projectDir || process.cwd());
+      // Validate orgName
+      if (!orgName || orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
+        res.writeHead(400);
+        res.end('{"error":"invalid org name"}');
+        return true;
+      }
+      const runId = ctx.activeOrgRuns.get(orgName);
+      const monoDir = ctx._getGitMonomindDir(root) || path.join(root, '.monomind');
+      // Try active run first, then fall back to most recent run file.
+      // Org Runtime v2 (#238): the active run's own events live under
+      // orgs/<org>/<runId>/bus.jsonl, never the v1 flat orgs/<org>/runs/
+      // layout — check that shape (and translate it) before the v1 lookup.
+      let runFile = null;
+      let isV2 = false;
+      if (runId) {
+        const v2Candidate = path.join(monoDir, 'orgs', orgName, runId, 'bus.jsonl');
+        if (fs.existsSync(v2Candidate)) {
+          runFile = v2Candidate;
+          isV2 = true;
+        } else {
+          const candidate = path.join(monoDir, 'orgs', orgName, 'runs', `${runId}.jsonl`);
+          if (fs.existsSync(candidate)) runFile = candidate;
+        }
+      }
+      if (!runFile) {
+        const orgDir = path.join(monoDir, 'orgs', orgName);
+        const runDirs = fs.existsSync(orgDir)
+          ? fs
+              .readdirSync(orgDir)
+              .filter(
+                (d) => d.startsWith('run-') && fs.existsSync(path.join(orgDir, d, 'bus.jsonl')),
+              )
+              .sort()
+              .reverse()
+          : [];
+        if (runDirs.length) {
+          runFile = path.join(orgDir, runDirs[0], 'bus.jsonl');
+          isV2 = true;
+        }
+      }
+      if (!runFile) {
+        const runsDir = path.join(monoDir, 'orgs', orgName, 'runs');
+        if (fs.existsSync(runsDir)) {
+          const files = fs
+            .readdirSync(runsDir)
+            .filter((f) => f.endsWith('.jsonl') && !f.startsWith('._'));
+          if (files.length) {
+            files.sort();
+            runFile = path.join(runsDir, files[files.length - 1]);
+          }
+        }
+      }
+      if (!runFile) {
+        res.writeHead(404);
+        res.end('{"events":[],"runId":null}');
+        return true;
+      }
+      const detectedRunId = isV2
+        ? path.basename(path.dirname(runFile))
+        : path.basename(runFile, '.jsonl');
+      const lines = fs
+        .readFileSync(runFile, 'utf8')
+        .split('\n')
+        .filter((l) => l.trim())
+        .slice(-100);
+      const rawEvents = lines
+        .map((l) => {
+          try {
+            return JSON.parse(l);
+          } catch (_) {
+            return null;
+          }
+        })
+        .filter(Boolean);
+      // v1's stored events are already dashboard-native; v2's raw BusEvents
+      // need the same translate()/companionEvents() pass the live view gets.
+      const events = isV2
+        ? rawEvents.flatMap((e) => [...companionEvents(e), translate(e)])
+        : rawEvents;
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(
+        JSON.stringify({ runId: detectedRunId, events, active: ctx.activeOrgRuns.has(orgName) }),
+      );
+    } catch (err) {
+      res.writeHead(500);
+      res.end(JSON.stringify({ error: err.message }));
+    }
+    return true;
+  }
+
+  // GET /api/orgs/:name/history — per-run outcome summaries (history.jsonl, newest first)
+  if (req.method === 'GET' && /^\/api\/orgs\/[^/]+\/history$/.test(url)) {
+    try {
+      const orgName = decodeURIComponent(url.split('/')[3]);
+      const _histQs = new URL(req.url, 'http://localhost').searchParams;
+      const root = path.resolve(_histQs.get('dir') || ctx.projectDir || process.cwd());
+      if (!orgName || orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
+        res.writeHead(400);
+        res.end('{"error":"invalid org name"}');
+        return true;
+      }
+      const monoDir = ctx._getGitMonomindDir(root) || path.join(root, '.monomind');
+      const histFile = path.join(monoDir, 'orgs', orgName, 'history.jsonl');
+      let runs = [];
+      if (fs.existsSync(histFile)) {
+        runs = fs
+          .readFileSync(histFile, 'utf8')
+          .split('\n')
+          .filter((l) => l.trim())
+          .map((l) => {
+            try {
+              return JSON.parse(l);
+            } catch (_) {
+              return null;
+            }
+          })
+          .filter(Boolean)
+          .reverse()
+          .slice(0, 50);
+      }
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(JSON.stringify({ runs }));
+    } catch (err) {
+      res.writeHead(500);
+      res.end(JSON.stringify({ error: err.message }));
+    }
+    return true;
+  }
+
+  // GET /api/orgs/:name/memory — org knowledge-graph stats + glossary + rules
+  if (req.method === 'GET' && /^\/api\/orgs\/[^/]+\/memory$/.test(url)) {
+    try {
+      const orgName = decodeURIComponent(url.split('/')[3]);
+      const _memQs = new URL(req.url, 'http://localhost').searchParams;
+      const root = path.resolve(_memQs.get('dir') || ctx.projectDir || process.cwd());
+      if (!orgName || orgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(orgName)) {
+        res.writeHead(400);
+        res.end('{"error":"invalid org name"}');
+        return true;
+      }
+      const monoDir = ctx._getGitMonomindDir(root) || path.join(root, '.monomind');
+      const dbPath = path.join(monoDir, 'org-memory');
+      if (!fs.existsSync(dbPath)) {
+        res.writeHead(200, {
+          'Content-Type': 'application/json',
+          ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+        });
+        res.end(JSON.stringify({ nodes: 0, edges: 0, rules: 0, glossary: [], ruleTexts: [] }));
+        return true;
+      }
+      const kg = await import('../memory/memory-kg.js');
+      const [stats, glossary, ruleList] = await Promise.all([
+        kg.kgStats({ dbPath }),
+        kg.kgGlossary({ dbPath, limit: 12 }),
+        kg.kgListRules({ dbPath, limit: 10 }),
+      ]);
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(
+        JSON.stringify({
+          ...stats,
+          glossary,
+          ruleTexts: ruleList.map((r) => r.rule.slice(0, 200)),
+        }),
+      );
+    } catch (err) {
+      res.writeHead(500);
+      res.end(JSON.stringify({ error: err.message }));
+    }
+    return true;
+  }
+  return false;
+}

package/dist/src/ui/routes-org-mastermind.mjs

@@ -0,0 +1,346 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Org dashboard routes: artifacts, mastermind events, stream, sessions and pages.
+// Registered, in order, by handleOrgRoutes in routes-org.mjs.
+export async function handleOrgMastermindRoutes(req, res, url, corsOrigin, ctx) {
+  // GET /api/org/:name/artifact — serve file content for chat "View" button
+  if (req.method === 'GET' && /^\/api\/org\/[^/]+\/artifact/.test(url)) {
+    try {
+      const _artOrgName = decodeURIComponent(url.split('/')[3] || '');
+      if (_artOrgName.length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(_artOrgName)) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: 'Invalid org name' }));
+        return true;
+      }
+      const _artQp = new URL(`http://x${req.url}`).searchParams;
+      const _rawPath = _artQp.get('path');
+      if (!_rawPath) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: 'path required' }));
+        return true;
+      }
+      const _filePath = path.resolve(decodeURIComponent(_rawPath));
+      // Security: this endpoint used to allow reads anywhere under the project
+      // root or any data/known-projects.json entry — letting any dashboard
+      // client read .env, .git/config, or other arbitrary project files.
+      // Restrict it, like /api/file-content above, to this org's own
+      // .monomind/orgs/<name>/ directory — never outside .monomind.
+      const _artBaseDir = path.resolve(_artQp.get('dir') || ctx.projectDir || process.cwd());
+      const _artProjDir = ctx._resolveOrgProjectDir(_artOrgName, _artBaseDir) || _artBaseDir;
+      const _artMonoDir =
+        ctx._getGitMonomindDir(_artProjDir) || path.join(_artProjDir, '.monomind');
+      const _artOrgDir = path.join(_artMonoDir, 'orgs', _artOrgName);
+      const _safe = _filePath === _artOrgDir || _filePath.startsWith(_artOrgDir + path.sep);
+      if (!_safe) {
+        res.writeHead(403);
+        res.end(JSON.stringify({ error: 'path not allowed' }));
+        return true;
+      }
+      if (!fs.existsSync(_filePath)) {
+        res.writeHead(404);
+        res.end(JSON.stringify({ error: 'file not found' }));
+        return true;
+      }
+      const _mime = ctx._detectMimeType(_filePath);
+      const _size = fs.statSync(_filePath).size;
+      // Reject files >2MB to avoid blocking the event loop
+      if (_size > 2 * 1024 * 1024) {
+        res.writeHead(413);
+        res.end(JSON.stringify({ error: 'file too large', size: _size }));
+        return true;
+      }
+      if (!_mime.startsWith('text/') && _mime !== 'application/json') {
+        res.writeHead(200, {
+          'Content-Type': 'application/json',
+          ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+        });
+        res.end(JSON.stringify({ binary: true, mimeType: _mime, size: _size }));
+        return true;
+      }
+      const _content = fs.readFileSync(_filePath, 'utf8');
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(JSON.stringify({ content: _content, mimeType: _mime, size: _size }));
+    } catch (_e) {
+      res.writeHead(500);
+      res.end(JSON.stringify({ error: 'read failed' }));
+    }
+    return true;
+  }
+
+  // ------------------------------------------------- Mastermind event system
+  // POST /api/mastermind/event — ingest event from mastermind skill
+  if (req.method === 'POST' && url === '/api/mastermind/event') {
+    await ctx.handleMastermindEvent(req, res, corsOrigin);
+    return true;
+  }
+
+  // GET /api/mastermind-stream — SSE for real-time events
+  if (req.method === 'GET' && url === '/api/mastermind-stream') {
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive',
+      ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+    });
+    res.write(': connected\n\n');
+    ctx.addMmClient(res);
+    // Replay last 50 events from disk (use ?project= param if provided)
+    try {
+      const _sseQp = new URL(`http://x${req.url}`).searchParams;
+      const _sseProj = _sseQp.get('project');
+      const root2 = _sseProj || ctx.projectDir || process.cwd();
+      const evFile = path.join(root2, 'data', 'mastermind-events.jsonl');
+      const lines = fs.readFileSync(evFile, 'utf8').trim().split('\n').filter(Boolean).slice(-50);
+      for (const l of lines) res.write(`data: ${l}\n\n`);
+    } catch (_) {}
+    const ka = setInterval(() => {
+      try {
+        res.write(': ping\n\n');
+      } catch (_) {
+        clearInterval(ka);
+        ctx.removeMmClient(res);
+      }
+    }, 20000);
+    req.on('close', () => {
+      ctx.removeMmClient(res);
+      clearInterval(ka);
+    });
+    return true;
+  }
+
+  // GET /api/mastermind/sessions
+  if (req.method === 'GET' && url.startsWith('/api/mastermind/sessions')) {
+    try {
+      const qp = new URL(`http://x${req.url}`).searchParams;
+      const filterProject = qp.get('project');
+      const limitParam = Math.min(parseInt(qp.get('limit') || '200', 10) || 200, 500);
+      const serverRoot = ctx.projectDir || process.cwd();
+      // Collect all project dirs to aggregate
+      const projectDirs = new Set([serverRoot]);
+      try {
+        const known = JSON.parse(
+          fs.readFileSync(path.join(serverRoot, 'data', 'known-projects.json'), 'utf8'),
+        );
+        known.forEach((p) => projectDirs.add(p));
+      } catch (_) {}
+      let allSessions = [];
+      for (const pd of projectDirs) {
+        if (filterProject && pd !== filterProject) continue;
+        const sessDir = path.join(pd, 'data', 'sessions');
+        const indexFile = path.join(sessDir, '_index.json');
+        // ── New format: per-session JSONL + _index.json ──
+        if (fs.existsSync(indexFile)) {
+          try {
+            const idx = JSON.parse(fs.readFileSync(indexFile, 'utf8'));
+            const top = idx.slice(0, limitParam);
+            for (const entry of top) {
+              const _sid = String(entry.id || '').trim();
+              if (!_sid || !ctx.SESSION_ID_RE.test(_sid)) continue;
+              let events = [];
+              try {
+                const jl = fs.readFileSync(path.join(sessDir, `${_sid}.jsonl`), 'utf8');
+                events = jl
+                  .trim()
+                  .split('\n')
+                  .filter(Boolean)
+                  .map((l) => {
+                    try {
+                      return JSON.parse(l);
+                    } catch {
+                      return null;
+                    }
+                  })
+                  .filter(Boolean);
+              } catch (_) {}
+              allSessions.push({ ...entry, events, project: pd });
+            }
+          } catch (_) {}
+        } else {
+          // ── Legacy fallback: mastermind-sessions.json ──
+          const f = path.join(pd, 'data', 'mastermind-sessions.json');
+          if (fs.existsSync(f)) {
+            try {
+              const s = JSON.parse(fs.readFileSync(f, 'utf8'));
+              s.forEach((sess) => {
+                if (!sess.project) sess.project = pd;
+              });
+              allSessions = allSessions.concat(s);
+            } catch (_) {}
+          }
+        }
+      }
+      allSessions.sort((a, b) => (b.ts || b.startedAt || 0) - (a.ts || a.startedAt || 0));
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(JSON.stringify(allSessions.slice(0, limitParam)));
+    } catch (_) {
+      res.writeHead(200);
+      res.end('[]');
+    }
+    return true;
+  }
+
+  // GET /api/mastermind/session/:id/trace — human-readable markdown trace
+  if (req.method === 'GET' && url.match(/^\/api\/mastermind\/session\/[^/]+\/trace$/)) {
+    try {
+      const sid = url.split('/')[4];
+      const sessFile = path.join(
+        ctx.projectDir || process.cwd(),
+        'data',
+        'sessions',
+        `${sid}.json`,
+      );
+      let s = null;
+      if (fs.existsSync(sessFile)) {
+        s = JSON.parse(fs.readFileSync(sessFile, 'utf8'));
+      } else {
+        const f = path.join(ctx.projectDir || process.cwd(), 'data', 'mastermind-sessions.json');
+        const sessions = JSON.parse(fs.readFileSync(f, 'utf8'));
+        s = sessions.find((x) => x.id === sid);
+      }
+      if (!s) {
+        res.writeHead(404);
+        res.end('Session not found');
+        return true;
+      }
+      const fmt = (ts) => `${new Date(ts).toISOString().replace('T', ' ').slice(0, 19)} UTC`;
+      const lines = [
+        `# Mastermind Session Trace: ${s.id}`,
+        ``,
+        `**Prompt:** ${s.prompt || '(none)'}`,
+        `**Status:** ${s.status}`,
+        `**Started:** ${fmt(s.ts)}`,
+        s.endTs ? `**Ended:** ${fmt(s.endTs)}` : '',
+        `**Domains:** ${(s.domains || []).join(', ') || '(none yet)'}`,
+        ``,
+      ];
+      for (const ev of s.events || []) {
+        const t = fmt(ev.ts);
+        if (ev.type === 'session:start')
+          lines.push(`\`${t}\` **SESSION START** — prompt: "${ev.prompt || ''}"`);
+        else if (ev.type === 'domain:dispatch')
+          lines.push(`\`${t}\` **DOMAIN DISPATCH** → \`${ev.domain}\` — ${ev.cmd || ''}`);
+        else if (ev.type === 'agent:spawn')
+          lines.push(
+            `\`${t}\` **AGENT SPAWN** [\`${ev.domain}\`] → agent: \`${ev.agent}\` — ${ev.task || ''}`,
+          );
+        else if (ev.type === 'intercom')
+          lines.push(`\`${t}\` **INTERCOM** \`${ev.from}\` → \`${ev.to}\`: ${ev.msg || ''}`);
+        else if (ev.type === 'domain:complete')
+          lines.push(
+            `\`${t}\` **DOMAIN COMPLETE** [\`${ev.domain}\`] status: ${ev.status}${ev.artifacts?.length ? ` — artifacts: ${ev.artifacts.join(', ')}` : ''}`,
+          );
+        else if (ev.type === 'session:complete')
+          lines.push(
+            `\`${t}\` **SESSION COMPLETE** — status: ${ev.status}, domains: ${(ev.domains || []).join(', ')}`,
+          );
+        else lines.push(`\`${t}\` ${ev.type} ${JSON.stringify(ev)}`);
+      }
+      res.writeHead(200, {
+        'Content-Type': 'text/plain; charset=utf-8',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(lines.join('\n'));
+    } catch (_) {
+      res.writeHead(500);
+      res.end('Error');
+    }
+    return true;
+  }
+
+  // GET /api/mastermind/session/:id
+  if (req.method === 'GET' && url.startsWith('/api/mastermind/session/')) {
+    try {
+      const sid = url.slice('/api/mastermind/session/'.length);
+      // Check individual session file first
+      const sessFile = path.join(
+        ctx.projectDir || process.cwd(),
+        'data',
+        'sessions',
+        `${sid}.json`,
+      );
+      if (fs.existsSync(sessFile)) {
+        res.writeHead(200, {
+          'Content-Type': 'application/json',
+          ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+        });
+        res.end(fs.readFileSync(sessFile, 'utf8'));
+        return true;
+      }
+      const f = path.join(ctx.projectDir || process.cwd(), 'data', 'mastermind-sessions.json');
+      const sessions = JSON.parse(fs.readFileSync(f, 'utf8'));
+      const s = sessions.find((x) => x.id === sid);
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+      });
+      res.end(JSON.stringify(s || null));
+    } catch (_) {
+      res.writeHead(200);
+      res.end('null');
+    }
+    return true;
+  }
+
+  // -------------------------------------------------------- GET /mastermind
+  if (req.method === 'GET' && url === '/mastermind') {
+    // Serve local file if present (dev), otherwise fall back to bundled HTML
+    const root = ctx.projectDir || process.cwd();
+    const htmlPath = path.join(root, 'docs', 'mastermind-diagram.html');
+    let html = ctx.MASTERMIND_DIAGRAM_HTML;
+    try {
+      html = fs.readFileSync(htmlPath, 'utf8');
+    } catch (_) {}
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(html);
+    return true;
+  }
+
+  // ----------------------------------------------------------- GET /orgs
+  if (req.method === 'GET' && url === '/orgs') {
+    try {
+      const htmlPath = path.join(ctx.__dirname, 'orgs.html');
+      let html = fs.readFileSync(htmlPath, 'utf8');
+      // Inject this process's auth credential the same way GET / does for
+      // dashboard.html — orgs.html's fetch() calls hit the same now
+      // default-closed /api/* routes and need a way to know the token.
+      html = html.replace(
+        '<head>',
+        `<head>\n<meta name="mm-token" content="${ctx.dashboardAuthValue}">`,
+      );
+      res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Cache-Control': 'no-cache, no-store, must-revalidate',
+      });
+      res.end(html);
+    } catch (err) {
+      res.writeHead(404);
+      res.end(`orgs.html not found: ${err.message}`);
+    }
+    return true;
+  }
+
+  // ------------------------------------------------ GET /orgs-files.js
+  // Files-tab + diff-view script, split out of orgs.html (see orgs.html's
+  // script-src comment). Not a generic static handler — this UI serves each
+  // sibling asset via its own hardcoded route, same as GET /orgs above.
+  if (req.method === 'GET' && url === '/orgs-files.js') {
+    try {
+      const jsPath = path.join(ctx.__dirname, 'orgs-files.js');
+      const js = fs.readFileSync(jsPath, 'utf8');
+      res.writeHead(200, { 'Content-Type': 'application/javascript; charset=utf-8' });
+      res.end(js);
+    } catch (err) {
+      res.writeHead(404);
+      res.end(`orgs-files.js not found: ${err.message}`);
+    }
+    return true;
+  }
+  return false;
+}