@monster-orange/den 0.1.0 → 0.2.1

package/src/ui/server/index.ts

@@ -11,6 +11,7 @@
  */
 
 import { composeHealthCmd } from "../../shared/stacks/manifest-commands.js";
+import { healthCheckFields } from "./health-row.js";
 import { hasRuntime, repoKind } from "../../shared/repo-kind.js";
 import * as http from "http";
 import * as fs from "fs";
@@ -52,7 +53,7 @@ import {
 } from "../../shared/environment-manager/workspaces.js";
 import { deriveGraph } from "../../shared/environment-manager/derivation/derive-graph.js";
 import { orderForDown } from "../../shared/environment-manager/derivation/derived-up.js";
-import { findConventionalContainer } from "../../shared/environment-manager/opctl.js";
+import { findServiceContainer } from "../../shared/environment-manager/service-container.js";
 import {
   resolveHistorySource,
   ensureSnapshot,
@@ -78,7 +79,10 @@ import {
   shouldDetachServiceCommand,
 } from "../../shared/environment-manager/service-runner.js";
 import { reapDeadDaemons } from "./daemon-reaper.js";
-import { readManifest } from "../../shared/manifest/read-manifest.js";
+import {
+  loadManifest,
+  readManifest,
+} from "../../shared/manifest/read-manifest.js";
 import {
   getServiceLogRoot,
   spawnStreaming,
@@ -86,6 +90,7 @@ import {
 } from "../../shared/process/spawn-streaming.js";
 import {
   readDenConfig,
+  isProductionEnv,
   isLocalEnabled,
   readUserConfig,
   writeUserConfig,
@@ -95,7 +100,7 @@ import {
   type ReleaseConfig,
 } from "../../shared/den-config.js";
 import { readOrg } from "../../shared/org.js";
-import { getDistRoot } from "../../shared/paths.js";
+import { engineVersion, getDistRoot } from "../../shared/paths.js";
 import { enginePath } from "../../shared/engine.js";
 import {
   releaseService,
@@ -106,8 +111,18 @@ import {
 import { deploySessions } from "./release-deploy-session.js";
 import { spawnDetachedWebRestart } from "../cli/web-command.js";
 import { recordInvocation } from "../../shared/dev-metrics/emit.js";
-import { validateManifest } from "../../shared/manifest/validate-manifest.js";
+import {
+  validateManifest,
+  validateManifestLayers,
+} from "../../shared/manifest/validate-manifest.js";
 import { depService } from "../../shared/manifest/deps.js";
+import {
+  placementRefusal,
+  resolveHealthCheck,
+  servicePlacement,
+  type Expect,
+  type Placement,
+} from "../../shared/manifest/placement.js";
 import {
   isOpSignedIn,
   hasSudoInVault,
@@ -115,6 +130,17 @@ import {
   saveSudoToVault,
 } from "../../shared/auth/sudo-vault.js";
 import { DEN_BANNER_LINES, DEN_SUBTITLE } from "../../shared/banner.js";
+import { actorLabel } from "../../shared/agent-actor.js";
+import {
+  actorFromHeaders,
+  actorSuffix,
+  recordAction,
+  recordAgentRefusal,
+  setAuditSink,
+} from "./audit.js";
+import { handleReadonlyRoutes } from "./readonly-routes.js";
+import { serveUiAsset } from "./ui-assets.js";
+import { graphPrefs, mergeGraphPrefs } from "./graph-prefs.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -132,7 +158,10 @@ interface HealthResult {
   repo: string;
   service: string;
   label: string;
+  /** The HTTP check's URL, or null (never a command: see `check`). */
   url: string | null;
+  /** A shell check's command (e.g. a compose stack's `stack health`). */
+  check?: string;
   repoPath: string;
   mode: "dev-managed" | "managed";
   isEntrypoint: boolean;
@@ -143,6 +172,9 @@ interface HealthResult {
   openUrl?: string | null;
   /** Extra named links for this env. */
   links?: OpenLink[];
+  /** Where it runs for this env, and where a remote one is (R13). */
+  runs: Placement["runs"];
+  target: Placement["target"];
 }
 
 /**
@@ -267,6 +299,8 @@ interface LogEntry {
   ts: string;
   kind: string;
   text: string;
+  /** Set when an agent (via `<cli> mcp`) asked for this action: its label. */
+  actor?: string;
 }
 
 const LOG_RING_MAX = 500;
@@ -281,11 +315,12 @@ function stripAnsi(s: string): string {
   return s.replace(ANSI_RE, "");
 }
 
-function pushLog(kind: string, text: string): void {
+function pushLog(kind: string, text: string, actor?: string): void {
   const entry: LogEntry = {
     ts: new Date().toISOString(),
     kind,
     text: stripAnsi(text),
+    ...(actor ? { actor } : {}),
   };
   logRing.push(entry);
   if (logRing.length > LOG_RING_MAX) logRing.shift();
@@ -302,11 +337,17 @@ function pushLog(kind: string, text: string): void {
  * Log to stdout unless --silent was passed, AND fan out to the log ring so the
  * /logs page and any connected SSE subscribers see the same stream.
  */
-function serverLog(msg: string, kind: string = "info"): void {
-  pushLog(kind, msg);
+function serverLog(msg: string, kind: string = "info", actor?: string): void {
+  pushLog(kind, msg, actor);
   if (!SILENT) process.stdout.write(msg + "\n");
 }
 
+// Every audited action (exec, run, sync) lands in the log as a lifecycle
+// line; an agent's carries its label so the /logs page can mark it.
+setAuditSink((line, actor) =>
+  serverLog(line, "lifecycle", actor ? actorLabel(actor) : undefined),
+);
+
 /** ANSI helpers (no chalk dependency in the server) */
 const dim = (s: string) => `\x1b[2m${s}\x1b[0m`;
 const green = (s: string) => `\x1b[32m${s}\x1b[0m`;
@@ -369,6 +410,7 @@ import { parseChangelog } from "./changelog-parser.js";
 import { GitHubService } from "./github-service.js";
 import { EditorManager, SUPPORTED_LANGUAGES } from "./editor-manager.js";
 import { handleWorkspaceRoutes } from "./workspace-routes.js";
+import { isLifecycleExecCmd, streamLifecycleExec } from "./lifecycle-exec.js";
 import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
 import {
   linksFor,
@@ -552,6 +594,9 @@ async function handleRequest(
     return serveFile(res, path.join(PUBLIC_DIR, "header.js"));
   }
 
+  // The graph's modules (graph.js, panel.js, …) and vendored libraries (ELK).
+  if (serveUiAsset(res, pathname, PUBLIC_DIR)) return;
+
   if (pathname === "/perf-report.js") {
     return serveFile(res, path.join(PUBLIC_DIR, "perf-report.js"));
   }
@@ -687,6 +732,28 @@ async function handleRequest(
     }
   }
 
+  // ── API: an agent's refused call (F2) ─────────────────────────────────────
+  // The MCP server's guards refuse some calls before they reach an action
+  // route; it reports them here so the activity trail shows failed attempts.
+  // Agents only (the audit header), and the entry is all it can write.
+  if (pathname === "/api/activity" && req.method === "POST") {
+    const actor = actorFromHeaders(req.headers);
+    if (!actor) return sendJson(res, { error: "agents only" }, 403);
+    const raw = await readBody(req).catch(() => "");
+    if (raw.length > 4096) return send400(res, "report too large");
+    let report: Record<string, unknown> = {};
+    try {
+      report = JSON.parse(raw || "{}") as Record<string, unknown>;
+    } catch {
+      return send400(res, "invalid JSON");
+    }
+    const entry = recordAgentRefusal(actor, report);
+    return sendJson(res, { recorded: true, ts: entry.ts });
+  }
+
+  // ── API: stacks, edge, security plan (read-only; see readonly-routes.ts) ──
+  if (await handleReadonlyRoutes(req, res, pathname, url)) return;
+
   // ── API: test sources ─────────────────────────────────────────────────────
   // Returns the repos that contribute tests for a given pillar, with their
   // current branch + short SHA. Lets the Tests UI show "you are testing
@@ -827,6 +894,9 @@ async function handleRequest(
       links: OpenLink[];
       /** The GitHub org that owns the repo. */
       org: string;
+      /** Codes that count as up for a remote target.url probe. */
+      expect?: Expect;
+      meta: Pick<HealthResult, "runs" | "target">;
     }> = [];
     let edgeDomain: string | null = null;
     try {
@@ -858,6 +928,7 @@ async function handleRequest(
           openUrl: null,
           links: [],
           org: orgOf(resolved.repoName, catalog),
+          meta: { runs: "none", target: null },
         });
         continue;
       }
@@ -873,11 +944,16 @@ async function handleRequest(
               ws.name,
             )
           : null;
-      const healthCfg =
-        svcCfg?.health?.[env] ??
-        (composeHealth
-          ? { type: "shell" as const, cmd: composeHealth }
-          : undefined);
+      // One resolution path with `<cli> status` (placement.ts): a remote
+      // service is checked by target.env's declaration, else target.url.
+      const plan = resolveHealthCheck(
+        manifest,
+        resolved.subsystem,
+        env,
+        composeHealth,
+      );
+      const healthCfg = plan.check;
+      const remote = plan.placement.runs === "remote";
       // Keep services with no health check (checkType "none") so systems like
       // jobs-runtime still appear — as an "unknown" (muted) dot, matching
       // `den status`, rather than vanishing from the health row.
@@ -896,7 +972,7 @@ async function handleRequest(
         deps,
         repo: resolved.repoName,
         service: resolved.subsystem,
-        label: healthCfg?.label ?? resolved.subsystem,
+        label: plan.label ?? healthCfg?.label ?? resolved.subsystem,
         checkType: healthCfg
           ? healthCfg.type === "shell"
             ? "shell"
@@ -914,7 +990,7 @@ async function handleRequest(
         // service with no declared local health check may still serve the stack
         // convention at http://<repo>/healthz via opctl DNS.
         conventional: (() => {
-          if (healthCfg || env !== "local") return null;
+          if (healthCfg || env !== "local" || remote) return null;
           const keys = Object.keys(manifest.services ?? {});
           const isPrimary = manifest.entrypoint
             ? resolved.subsystem === manifest.entrypoint
@@ -932,6 +1008,8 @@ async function handleRequest(
         }),
         links: linksFor(manifest, resolved.subsystem, env),
         org: orgOf(resolved.repoName, catalog),
+        ...(plan.expect ? { expect: plan.expect } : {}),
+        meta: { runs: plan.placement.runs, target: plan.placement.target },
       });
     }
 
@@ -961,6 +1039,7 @@ async function handleRequest(
       isEntrypoint,
       conventional,
       meta,
+      expect,
     }) => {
       if (checkType !== "none") {
         const started = Date.now();
@@ -969,15 +1048,16 @@ async function handleRequest(
             ? await pingShell(target, awsProfileEnv(env), repoPath)
             : await pingHttp(
                 target,
-                env === "local"
+                env === "local" && meta.runs !== "remote"
                   ? HEALTH_CHECK_TIMEOUT_MS
                   : HOSTED_HEALTH_CHECK_TIMEOUT_MS,
+                expect,
               );
         return {
           repo,
           service,
           label,
-          url: target,
+          ...healthCheckFields(checkType, target),
           repoPath,
           mode,
           isEntrypoint,
@@ -1131,23 +1211,28 @@ async function handleRequest(
 
     // Legacy: discovered repos from .den/ symlinks / registered-repos.json
     const legacyRepos = discoverRepos();
-    const legacyEntries = legacyRepos.flatMap((repo) =>
-      Object.entries(repo.manifest.services ?? {}).map(([svcName, svc]) => ({
-        repo: repo.repoName,
-        service: svcName,
-        address: `${repo.repoName}/${svcName}`,
-        repoPath: repo.repoPath,
-        commands: withDown(Object.keys(svc.commands?.[env] ?? {})),
-        logs: svc.logs?.[env] ?? null,
-        mode: "dev-managed" as const,
-        branch: null as string | null,
-        fromCatalog: false,
-        isEntrypoint: repo.manifest.entrypoint === svcName,
-        autostart: true, // legacy discovery has no workspace entry to toggle
-        deps: (svc.depends_on ?? []).map(depService),
-        cloned: true, // legacy discovery only ever finds on-disk repos
-      })),
-    );
+    const legacyEntries = legacyRepos.flatMap((repo) => {
+      const manifestLayers = loadManifest(repo.repoPath).layers;
+      return Object.entries(repo.manifest.services ?? {}).map(
+        ([svcName, svc]) => ({
+          repo: repo.repoName,
+          service: svcName,
+          address: `${repo.repoName}/${svcName}`,
+          repoPath: repo.repoPath,
+          commands: withDown(Object.keys(svc.commands?.[env] ?? {})),
+          logs: svc.logs?.[env] ?? null,
+          mode: "dev-managed" as const,
+          branch: null as string | null,
+          fromCatalog: false,
+          isEntrypoint: repo.manifest.entrypoint === svcName,
+          autostart: true, // legacy discovery has no workspace entry to toggle
+          deps: (svc.depends_on ?? []).map(depService),
+          cloned: true, // legacy discovery only ever finds on-disk repos
+          manifestLayers,
+          ...servicePlacement(repo.manifest, svcName, env),
+        }),
+      );
+    });
 
     // Catalog entries (workspace-aware)
     const catalog = readCatalog();
@@ -1182,7 +1267,11 @@ async function handleRequest(
       ? listWorkspaceServices(ws.config, catalog, ws.name)
           .filter((r) => hasRuntime(repoKind(r.repoPath)))
           .flatMap((resolved) => {
-            const manifest = readManifest(resolved.repoPath);
+            // The manifest and the layers it was built from: repo or held,
+            // plus override when manifests/<repo>.override.yml applied.
+            const { manifest, layers: manifestLayers } = loadManifest(
+              resolved.repoPath,
+            );
             const svc = manifest?.services?.[resolved.subsystem];
             if (!manifest || !svc) {
               // Workspace membership is config-driven: a managed entry
@@ -1207,6 +1296,8 @@ async function handleRequest(
                   owners: daemonOwners.get(resolved.address) ?? [],
                   deps: [] as string[],
                   cloned: fs.existsSync(resolved.repoPath),
+                  manifestLayers,
+                  ...servicePlacement(null, resolved.subsystem, env),
                 },
               ];
             }
@@ -1228,6 +1319,8 @@ async function handleRequest(
                   resolveDepAddress(depService(d), catalog, ws.config, ws.name),
                 ),
                 cloned: true,
+                manifestLayers,
+                ...servicePlacement(manifest, resolved.subsystem, env),
               },
             ];
           })
@@ -1289,7 +1382,15 @@ async function handleRequest(
     const emit = (obj: unknown): void => {
       res.write(`data: ${JSON.stringify(obj)}\n\n`);
     };
+    // Every fail here is before anything ran: a refusal or a lookup miss.
+    // Recorded, so failed attempts show in the activity trail (F2).
     const fail = (msg: string): void => {
+      recordAction(actorFromHeaders(req.headers), {
+        verb: "exec",
+        detail: `${repoName}/${svcName} ${cmdName} (${env})`,
+        outcome: "refused",
+        reason: msg,
+      });
       emit({ type: "error", text: msg });
       emit({ type: "done", exitCode: 1, duration: 0 });
       res.end();
@@ -1316,10 +1417,70 @@ async function handleRequest(
     if (resolved) {
       repoPath = resolved.repoPath;
       const manifest = readManifest(repoPath);
+      // R13: nothing runs a command on a remote service.
+      const refusal = placementRefusal(
+        `${repoName}/${svcName}`,
+        servicePlacement(manifest, resolved.subsystem, env),
+        (e) => isProductionEnv(e),
+        cmdName,
+      );
+      if (refusal) return fail(refusal);
       if (manifest) {
         cmdDef =
           manifest.services?.[resolved.subsystem]?.commands?.[env]?.[cmdName];
       }
+      // Lifecycle commands run through the service runner, as the CLI's do:
+      // restart without a declared restart is down + up, up on a healthy
+      // service starts nothing, down honours workspace ownership.
+      if (env === "local" && isLifecycleExecCmd(cmdName)) {
+        if (cmdDef && isInteractiveServiceCommand(cmdDef))
+          return fail(
+            `"${cmdName}" requires an interactive terminal (HITL).\n` +
+              `Run in your terminal:\n  ${product().cli} ${cmdName} ${resolved.address}`,
+          );
+        const execId = shortRunId();
+        const execDesc = `${repoName}/${svcName} ${cmdName} (${env})`;
+        const execActor = actorFromHeaders(req.headers);
+        recordAction(execActor, {
+          verb: "exec",
+          detail: `${execDesc} [${execId}]`,
+        });
+        prewarmSudo();
+        void streamLifecycleExec(
+          {
+            resolved,
+            cmd: cmdName,
+            workspace: wsParam ?? undefined,
+            env: { E2E_ENVIRONMENT: env, ...getSudoEnv() },
+            emit: (e) => {
+              if (e.type === "line" && typeof e.text === "string")
+                mirrorLine(execId, e.text);
+              emit(e);
+            },
+            end: () => res.end(),
+            onClientClose: (fn) => res.on("close", fn),
+            onExit: (exitCode, duration) => {
+              serverLog(
+                `■ exec ${execDesc} · exit=${exitCode} · ${formatDuration(duration)} [${execId}]${actorSuffix(execActor)}`,
+                "lifecycle",
+                execActor ? actorLabel(execActor) : undefined,
+              );
+              recordInvocation({
+                command: "service.exec",
+                surface: "ux",
+                durationMs: duration,
+                exit: exitCode,
+                extra: { action: cmdName, env },
+              });
+            },
+          },
+          {
+            run: runServiceCommand,
+            health: (r) => checkServiceHealth(r, "local"),
+          },
+        );
+        return;
+      }
     }
 
     if (!cmdDef) {
@@ -1327,6 +1488,15 @@ async function handleRequest(
       const repos = discoverRepos();
       const repo = repos.find((r) => r.repoName === repoName);
       repoPath = repo?.repoPath;
+      const refusal = repo
+        ? placementRefusal(
+            `${repoName}/${svcName}`,
+            servicePlacement(repo.manifest, svcName, env),
+            (e) => isProductionEnv(e),
+            cmdName,
+          )
+        : null;
+      if (refusal) return fail(refusal);
       cmdDef = repo?.manifest.services?.[svcName]?.commands?.[env]?.[cmdName];
     }
 
@@ -1373,7 +1543,11 @@ async function handleRequest(
 
     const execId = shortRunId();
     const execDesc = `${repoName}/${svcName} ${cmdName} (${env})`;
-    serverLog(`▶ exec ${execDesc} [${execId}]`, "lifecycle");
+    const execActor = actorFromHeaders(req.headers);
+    recordAction(execActor, {
+      verb: "exec",
+      detail: `${execDesc} [${execId}]`,
+    });
 
     // For detachable commands (up/restart), the service is spawned as a daemon
     // writing to a log file so it survives den restarts.  The tail proc
@@ -1397,8 +1571,9 @@ async function handleRequest(
         if (!active) return; // client already closed — don't write to dead response
         const duration = Date.now() - startTime;
         serverLog(
-          `■ exec ${execDesc} · exit=${exitCode} · ${formatDuration(duration)} [${execId}]`,
+          `■ exec ${execDesc} · exit=${exitCode} · ${formatDuration(duration)} [${execId}]${actorSuffix(execActor)}`,
           "lifecycle",
+          execActor ? actorLabel(execActor) : undefined,
         );
         // Dev-tooling telemetry: one invocation per service command run. The
         // action is whitelisted to common lifecycle verbs (low cardinality);
@@ -1675,9 +1850,10 @@ async function handleRequest(
   //
   // Source resolution, in order:
   //   1. The service's manifest `logs.local` shell command (e.g. `docker logs -f`)
-  //   2. Conventional container derivation: a running `opctl_<base>_<hash>`
-  //      container matched from the repo's op manifest / repo name →
-  //      `docker logs -f` — real runtime logs with zero manifest config
+  //   2. The service's running container → `docker logs -f`: a compose
+  //      stack's `<stack>-<workspace>-<service>-1`, else an
+  //      `opctl_<base>_<hash>` one matched from the repo's op manifest / repo
+  //      name — real runtime logs with zero manifest config
   //   3. The den daemon startup log (~/.den/logs/<repo>/<service>.log) —
   //      last resort, covers host-run processes with no container
   // A manifest command that exits within the quick-exit window (container not
@@ -1818,13 +1994,13 @@ async function handleRequest(
     let retryCount = 0;
     let retryTimer: ReturnType<typeof setTimeout> | null = null;
 
-    // Fallback tier 1: resolve the service's running container by opctl
-    // naming convention (`opctl_<base>_<hash>`) and stream `docker logs -f`.
-    // This gives REAL runtime logs for services with no (or broken)
-    // manifest `logs.local` — no den daemon file needed. Returns false
-    // when no conventional container is running.
+    // Fallback tier 1: resolve the service's running container (its compose
+    // stack's, else opctl's `opctl_<base>_<hash>`) and stream
+    // `docker logs -f`. This gives REAL runtime logs for services with no (or
+    // broken) manifest `logs.local` — no den daemon file needed. Returns
+    // false when no such container is running.
     const startDockerFallback = (): boolean => {
-      const container = findConventionalContainer(
+      const container = findServiceContainer(
         repoName,
         tailResolved?.repoPath,
         tailSubsystem,
@@ -2084,7 +2260,8 @@ async function handleRequest(
     const runId = shortRunId();
     const modDesc = modules.length ? modules.join(",") : "all";
     const runDesc = `${pillar}/${env} · modules=${modDesc}`;
-    serverLog(`▶ run ${runDesc} [${runId}]`, "lifecycle");
+    const runActor = actorFromHeaders(req.headers);
+    recordAction(runActor, { verb: "run", detail: `${runDesc} [${runId}]` });
     if (
       pillar === "synthetic" ||
       pillar === "smoke" ||
@@ -2108,8 +2285,9 @@ async function handleRequest(
       const dur = formatDuration(Date.now() - startTime);
       const extra = note ? ` · ${note}` : "";
       serverLog(
-        `■ run ${runDesc} · exit=${exitCode} · ${dur}${extra} [${runId}]`,
+        `■ run ${runDesc} · exit=${exitCode} · ${dur}${extra} [${runId}]${actorSuffix(runActor)}`,
         "lifecycle",
+        runActor ? actorLabel(runActor) : undefined,
       );
       // Dev-tooling telemetry: one invocation per test run (pillar/env are
       // low-cardinality enums; module count only — never module names/args).
@@ -2254,6 +2432,8 @@ async function handleRequest(
     return sendJson(res, {
       pid: process.pid,
       port: PORT,
+      // Den's version: the MCP server compares it with the routes it needs.
+      version: engineVersion() ?? null,
       startedAt: new Date(SERVER_STARTED_AT).toISOString(),
       uptimeMs: Date.now() - SERVER_STARTED_AT,
       stale,
@@ -2584,10 +2764,24 @@ async function handleRequest(
       const filePath = url.searchParams.get("path");
       if (!filePath) return send400(res, '"path" query param required');
       try {
-        const denYml = fs.existsSync(filePath)
-          ? fs.lstatSync(filePath).isDirectory()
-            ? path.join(filePath, `${product().manifestYml}`)
-            : filePath
+        const isDir =
+          fs.existsSync(filePath) && fs.lstatSync(filePath).isDirectory();
+        // A repo folder: every layer that applies (repo or held, override,
+        // merged), flattened into the usual shape; each error names its file.
+        if (isDir) {
+          const layered = validateManifestLayers(filePath);
+          if (layered.layers.length > 0)
+            return sendJson(res, {
+              valid: layered.valid,
+              version: layered.layers[0].result.version,
+              errors: layered.layers.flatMap((l) => l.result.errors),
+              warnings: layered.layers.flatMap((l) => l.result.warnings),
+              manifestLayers: loadManifest(filePath).layers,
+              layers: layered.layers,
+            });
+        }
+        const denYml = isDir
+          ? path.join(filePath, `${product().manifestYml}`)
           : filePath;
         const content = fs.readFileSync(denYml, "utf-8");
         return sendJson(res, validateManifest(content));
@@ -2726,7 +2920,8 @@ async function handleRequest(
 
   // ── API: user settings ────────────────────────────────────────────────────
   // GET  /api/settings  → { editor, editors, terminal, terminals, editor_overrides, languages }
-  // POST /api/settings  body: { editor?, terminal?, editor_overrides? }
+  // POST /api/settings  body: { editor?, terminal?, editor_overrides?, graph? }
+  //   graph: { direction, group, density, panelWidth } (see graph-prefs.ts)
   if (pathname === "/api/settings") {
     if (req.method === "GET") {
       const user = readUserConfig();
@@ -2740,6 +2935,7 @@ async function handleRequest(
         editor_overrides: user.editor_overrides ?? {},
         languages: SUPPORTED_LANGUAGES,
         log_window_lines: user.log_window_lines ?? 20_000,
+        graph: graphPrefs(user.graph),
       });
     }
     if (req.method === "POST") {
@@ -2748,8 +2944,14 @@ async function handleRequest(
           editor?: string | null;
           terminal?: string | null;
           editor_overrides?: Record<string, string> | null;
+          graph?: unknown;
         };
         const user = readUserConfig();
+        if (body.graph !== undefined) {
+          const g = mergeGraphPrefs(graphPrefs(user.graph), body.graph);
+          if (!g.ok) return send400(res, g.error);
+          user.graph = g.value;
+        }
         if (body.editor === null || body.editor === "") {
           delete user.editor;
         } else if (body.editor !== undefined) {
@@ -2793,6 +2995,7 @@ async function handleRequest(
           editor: user.editor ?? null,
           terminal: user.terminal ?? null,
           editor_overrides: user.editor_overrides ?? {},
+          graph: graphPrefs(user.graph),
         });
       } catch (e) {
         return send400(res, `Invalid request: ${(e as Error).message}`);
@@ -3078,15 +3281,7 @@ server.listen(PORT, BIND_HOST, () => {
     ? `${product().cli}`
     : "localhost";
 
-  let pkgVersion = "?";
-  try {
-    const pkg = JSON.parse(
-      fs.readFileSync(enginePath("package.json"), "utf-8"),
-    ) as { version?: string };
-    if (pkg.version) pkgVersion = pkg.version;
-  } catch (_e) {
-    /* package.json unreadable — version stays "?" */
-  }
+  const pkgVersion = engineVersion() ?? "?";
 
   console.log();
   for (const line of DEN_BANNER_LINES) {