@phuetz/code-buddy 0.3.0 → 1.0.0-rc.8

package/dist/server/index.js

@@ -9,6 +9,7 @@
  *   codebuddy server --port 3000
  */
 import crypto from 'crypto';
+import os from 'os';
 import { createRequire } from 'module';
 import express from 'express';
 import cors from 'cors';
@@ -18,12 +19,27 @@ let SERVER_VERSION = '0.0.0';
 try {
     SERVER_VERSION = _require('../../package.json').version || SERVER_VERSION;
 }
-catch { /* ignore */ }
-import { createAuthMiddleware, createRateLimitMiddleware, createLoggingMiddleware, createSecurityHeadersMiddleware, requestIdMiddleware, errorHandler, notFoundHandler, } from './middleware/index.js';
-import { chatRoutes, toolsRoutes, sessionsRoutes, memoryRoutes, healthRoutes, metricsRoutes } from './routes/index.js';
+catch {
+    /* ignore */
+}
+import { isOriginAllowed, isLoopbackHost, DEFAULT_LOCALHOST_ORIGINS } from './origin-check.js';
+import { createAuthMiddleware, requireScope, createRateLimitMiddleware, createLoggingMiddleware, createSecurityHeadersMiddleware, requestIdMiddleware, errorHandler, notFoundHandler, } from './middleware/index.js';
+import { chatRoutes, toolsRoutes, sessionsRoutes, memoryRoutes, healthRoutes, metricsRoutes, createWorkflowApiRouter, createA2AProtocolRoutes, createACPRoutes, createK8sHealthAliases, createDashboardRouter, createCloudTaskRoutes, createWebhookRoutes, mobileRoutes, } from './routes/index.js';
 import { setupWebSocket, closeAllConnections, getConnectionStats } from './websocket/index.js';
+import { setupDesktopWebSocket, closeDesktopWebSocket } from './websocket/desktop-handler.js';
+import { startFleetHeartbeat, stopFleetHeartbeat } from '../fleet/heartbeat-broadcaster.js';
+import { startAutonomousTick, stopAutonomousTick } from '../fleet/autonomous-tick-broadcaster.js';
+import { startApiHeartbeatMonitor, stopApiHeartbeatMonitor } from './heartbeat-monitor.js';
+import { wireCompactionBridge, unwireCompactionBridge } from '../fleet/compaction-bridge.js';
+import { wirePeerChatBridge, unwirePeerChatBridge } from '../fleet/peer-chat-bridge.js';
+import { wirePeerSessionBridge, unwirePeerSessionBridge } from '../fleet/peer-session-bridge.js';
+import { wirePeerToolBridge, unwirePeerToolBridge } from '../fleet/peer-tool-bridge.js';
 import { logger } from '../utils/logger.js';
 import { initMetrics } from '../metrics/index.js';
+import { CSRFProtection } from '../security/csrf-protection.js';
+import { initializeDatabase } from '../database/database-manager.js';
+import { SERVER_CONFIG, TIMEOUT_CONFIG, LIMIT_CONFIG } from '../config/constants.js';
+import { listServerModels } from './agent-adapter.js';
 // Lazy import to avoid circular dependency: channels/index.ts re-exports
 // TelegramChannel/DiscordChannel which import BaseChannel from channels/index.ts
 // before it's fully initialized.
@@ -39,35 +55,50 @@ async function getPeerRouter() {
  * Generate a secure random secret for development use only
  * In production, JWT_SECRET environment variable MUST be set
  */
-function getJwtSecret() {
+function getJwtSecret(authEnabled) {
     if (process.env.JWT_SECRET) {
         return process.env.JWT_SECRET;
     }
+    if (!authEnabled) {
+        return '';
+    }
     // In production, require explicit JWT_SECRET
     if (process.env.NODE_ENV === 'production') {
         throw new Error('SECURITY ERROR: JWT_SECRET environment variable must be set in production. ' +
-            'Generate one with: node -e "console.log(require(\'crypto\').randomBytes(64).toString(\'hex\'))"');
+            "Generate one with: node -e \"console.log(require('crypto').randomBytes(64).toString('hex'))\"");
     }
     // Development only: generate ephemeral secret (warning: tokens won't persist across restarts)
     logger.warn('No JWT_SECRET set. Using ephemeral secret for development. ' +
         'Set JWT_SECRET environment variable for production use.');
     return crypto.randomBytes(64).toString('hex');
 }
+export function getServerBaseUrl(server, config) {
+    const address = server.address();
+    const port = typeof address === 'object' && address ? address.port : config.port;
+    const publicHost = config.host === '0.0.0.0' || config.host === '::' ? '127.0.0.1' : config.host;
+    const host = publicHost.includes(':') && !publicHost.startsWith('[') ? `[${publicHost}]` : publicHost;
+    return `http://${host}:${port}`;
+}
 // Default configuration
 const DEFAULT_CONFIG = {
-    port: parseInt(process.env.PORT || '3000', 10),
-    host: process.env.HOST || '0.0.0.0',
+    port: parseInt(process.env.PORT || String(SERVER_CONFIG.DEFAULT_PORT), 10),
+    host: process.env.HOST || SERVER_CONFIG.DEFAULT_HOST,
     cors: true,
-    corsOrigins: process.env.CORS_ORIGINS?.split(',') || ['*'],
+    // Secure-by-default: localhost only. Server-to-server callers (e.g. the fleet hub)
+    // ignore CORS, so this does not affect the mesh; set CORS_ORIGINS (or '*') to widen.
+    corsOrigins: process.env.CORS_ORIGINS?.split(',') || DEFAULT_LOCALHOST_ORIGINS,
     rateLimit: true,
-    rateLimitMax: parseInt(process.env.RATE_LIMIT_MAX || '100', 10),
-    rateLimitWindow: parseInt(process.env.RATE_LIMIT_WINDOW || '60000', 10),
-    authEnabled: process.env.AUTH_ENABLED !== 'false',
-    jwtSecret: getJwtSecret(),
-    jwtExpiration: process.env.JWT_EXPIRATION || '24h',
+    rateLimitMax: parseInt(process.env.RATE_LIMIT_MAX || String(LIMIT_CONFIG.DEFAULT_RATE_LIMIT_MAX), 10),
+    rateLimitWindow: parseInt(process.env.RATE_LIMIT_WINDOW || String(TIMEOUT_CONFIG.DEFAULT_RATE_LIMIT_WINDOW), 10),
+    authEnabled: process.env.NODE_ENV === 'production'
+        ? true // Auth is always enabled in production (fail-closed)
+        : process.env.AUTH_ENABLED !== 'false',
+    jwtSecret: process.env.JWT_SECRET || '',
+    jwtExpiration: process.env.JWT_EXPIRATION || SERVER_CONFIG.DEFAULT_JWT_EXPIRATION,
     websocketEnabled: process.env.WS_ENABLED !== 'false',
+    channelIntakeEnabled: process.env.CODEBUDDY_SERVER_CHANNEL_INTAKE === 'true',
     logging: process.env.LOGGING !== 'false',
-    maxRequestSize: process.env.MAX_REQUEST_SIZE || '10mb',
+    maxRequestSize: process.env.MAX_REQUEST_SIZE || SERVER_CONFIG.DEFAULT_MAX_REQUEST_SIZE,
     // Security headers: enabled by default, can be disabled via SECURITY_HEADERS=false
     securityHeaders: {
         enabled: process.env.SECURITY_HEADERS !== 'false',
@@ -77,6 +108,20 @@ const DEFAULT_CONFIG = {
         referrerPolicy: 'strict-origin-when-cross-origin',
     },
 };
+function getFirstQueryValue(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value)) {
+        const first = value[0];
+        return typeof first === 'string' ? first : undefined;
+    }
+    return undefined;
+}
+function wantsStatusReport(query) {
+    const format = getFirstQueryValue(query.format)?.toLowerCase();
+    const report = getFirstQueryValue(query.report)?.toLowerCase();
+    return format === 'report' || report === '1' || report === 'true' || report === 'yes';
+}
 /**
  * Create and configure the Express application
  */
@@ -95,11 +140,26 @@ function createApp(config) {
     // CORS
     if (config.cors) {
         const isWildcard = config.corsOrigins?.includes('*');
+        const allowedOrigins = Array.isArray(config.corsOrigins)
+            ? config.corsOrigins
+            : typeof config.corsOrigins === 'string'
+                ? config.corsOrigins.split(',')
+                : DEFAULT_LOCALHOST_ORIGINS;
         app.use(cors({
-            origin: isWildcard ? true : config.corsOrigins,
+            // Function form so wildcard-port patterns (e.g. http://localhost:*) match and
+            // non-browser clients (no Origin header) are allowed. '*' keeps legacy open behavior.
+            origin: isWildcard
+                ? true
+                : (origin, cb) => cb(null, !origin || isOriginAllowed(origin, allowedOrigins)),
             credentials: !isWildcard,
             methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-            allowedHeaders: ['Content-Type', 'Authorization', 'X-API-Key', 'X-Request-ID'],
+            allowedHeaders: [
+                'Content-Type',
+                'Authorization',
+                'X-API-Key',
+                'X-Request-ID',
+                'X-CSRF-Token',
+            ],
         }));
     }
     // Body parsing
@@ -109,23 +169,52 @@ function createApp(config) {
     if (config.rateLimit) {
         app.use(createRateLimitMiddleware(config));
     }
-    // Authentication
-    if (config.authEnabled) {
-        app.use(createAuthMiddleware(config));
-    }
     // Health routes (no auth required)
     app.use('/api/health', healthRoutes);
+    // Kubernetes-standard health aliases (no auth required)
+    app.use(createK8sHealthAliases());
     // Metrics routes (no auth required for monitoring)
     app.use('/api/metrics', metricsRoutes);
     // Also expose at /metrics for Prometheus compatibility
     app.use('/metrics', metricsRoutes);
+    // Mobile remote-supervision routes (custom pairing-token auth)
+    app.use('/api/mobile', mobileRoutes);
+    // Authentication (applied after public health/metrics/mobile endpoints)
+    app.use(createAuthMiddleware(config));
+    // A2A routes (auth-based, exempt from CSRF) — must be mounted BEFORE CSRF middleware
+    app.use('/api/a2a', createA2AProtocolRoutes());
+    // CSRF protection for state-changing endpoints (POST/PUT/DELETE)
+    // Applied AFTER A2A routes so they are never touched by CSRF middleware
+    if (config.authEnabled && process.env.CSRF_PROTECTION !== 'false') {
+        const csrfProtection = new CSRFProtection({
+            secure: process.env.NODE_ENV === 'production',
+        });
+        // Provide CSRF token endpoint
+        app.get('/api/csrf-token', (req, res) => {
+            const sessionId = req.sessionId;
+            const token = csrfProtection.generateToken(sessionId);
+            res.json({ token: token.token });
+        });
+        // Apply CSRF middleware for state-changing requests (now applied after A2A)
+        app.use(csrfProtection.middleware());
+    }
     // API routes
     app.use('/api/chat', chatRoutes);
     app.use('/api/tools', toolsRoutes);
     app.use('/api/sessions', sessionsRoutes);
     app.use('/api/memory', memoryRoutes);
+    app.use('/api/workflows', createWorkflowApiRouter());
+    app.use('/api/acp', createACPRoutes());
+    app.use('/api/cloud/tasks', createCloudTaskRoutes());
+    app.use('/api/webhooks', createWebhookRoutes());
     // OpenAI-compatible alias
     app.use('/v1/chat', chatRoutes);
+    app.get('/v1/models', requireScope('chat'), (_req, res) => {
+        res.json({
+            object: 'list',
+            data: listServerModels(),
+        });
+    });
     // Peer routing stats endpoint
     app.get('/api/routing/stats', async (_req, res) => {
         try {
@@ -156,15 +245,27 @@ function createApp(config) {
         }
     });
     // Daemon status endpoint
-    app.get('/api/daemon/status', async (_req, res) => {
+    app.get('/api/daemon/status', async (req, res) => {
+        const report = wantsStatusReport(req.query);
         try {
             const { getDaemonManager } = await import('../daemon/index.js');
             const manager = getDaemonManager();
             const status = await manager.status();
+            if (report) {
+                const { buildDaemonStatusReport } = await import('../daemon/status-reports.js');
+                res.json(buildDaemonStatusReport(status));
+                return;
+            }
             res.json(status);
         }
-        catch (error) {
-            res.json({ running: false, services: [], restartCount: 0 });
+        catch (_error) {
+            const status = { running: false, services: [], restartCount: 0 };
+            if (report) {
+                const { buildDaemonStatusReport } = await import('../daemon/status-reports.js');
+                res.json(buildDaemonStatusReport(status));
+                return;
+            }
+            res.json(status);
         }
     });
     // Daemon health endpoint
@@ -174,7 +275,7 @@ function createApp(config) {
             const monitor = getHealthMonitor();
             res.json(monitor.getHealthSummary());
         }
-        catch (error) {
+        catch (_error) {
             res.json({ status: 'unknown', uptime: 0, memory: { percentage: 0, rss: 0 }, services: [] });
         }
     });
@@ -183,10 +284,11 @@ function createApp(config) {
         try {
             const { getCronScheduler } = await import('../scheduler/cron-scheduler.js');
             const scheduler = getCronScheduler();
+            await scheduler.loadFromDisk();
             const jobs = scheduler.listJobs();
             res.json({ jobs, stats: scheduler.getStats() });
         }
-        catch (error) {
+        catch (_error) {
             res.json({ jobs: [], stats: {} });
         }
     });
@@ -194,6 +296,7 @@ function createApp(config) {
         try {
             const { getCronScheduler } = await import('../scheduler/cron-scheduler.js');
             const scheduler = getCronScheduler();
+            await scheduler.loadFromDisk();
             const run = await scheduler.runJobNow(req.params.id);
             if (run) {
                 res.json({ success: true, run });
@@ -213,7 +316,7 @@ function createApp(config) {
             const manager = getNotificationManager();
             res.json(manager.getPreferences());
         }
-        catch (error) {
+        catch (_error) {
             res.json({});
         }
     });
@@ -297,13 +400,44 @@ function createApp(config) {
         }
     });
     // Heartbeat endpoints
-    app.get('/api/heartbeat/status', async (_req, res) => {
+    app.get('/api/heartbeat/status', async (req, res) => {
+        const report = wantsStatusReport(req.query);
         try {
             const { getHeartbeatEngine } = await import('../daemon/heartbeat.js');
             const engine = getHeartbeatEngine();
-            res.json(engine.getStatus());
+            const status = engine.getStatus();
+            if (report) {
+                const { buildHeartbeatStatusReport } = await import('../daemon/status-reports.js');
+                res.json(buildHeartbeatStatusReport(status, engine.getConfig()));
+                return;
+            }
+            res.json(status);
         }
-        catch (error) {
+        catch (_error) {
+            const status = {
+                running: false,
+                enabled: false,
+                lastRunTime: null,
+                nextRunTime: null,
+                consecutiveSuppressions: 0,
+                totalTicks: 0,
+                totalSuppressions: 0,
+                lastResult: null,
+            };
+            if (report) {
+                const { buildHeartbeatStatusReport } = await import('../daemon/status-reports.js');
+                res.json(buildHeartbeatStatusReport(status, {
+                    intervalMs: 0,
+                    activeHoursStart: 0,
+                    activeHoursEnd: 0,
+                    timezone: 'unknown',
+                    heartbeatFilePath: '',
+                    suppressionKeyword: 'HEARTBEAT_OK',
+                    maxConsecutiveSuppressions: 0,
+                    enabled: false,
+                }));
+                return;
+            }
             res.json({ running: false, enabled: false, totalTicks: 0 });
         }
     });
@@ -515,8 +649,10 @@ function createApp(config) {
                 res.status(400).json({ error: 'Request body must be a JSON object' });
                 return;
             }
-            if (!profile.id || typeof profile.id !== 'string' ||
-                !profile.provider || typeof profile.provider !== 'string') {
+            if (!profile.id ||
+                typeof profile.id !== 'string' ||
+                !profile.provider ||
+                typeof profile.provider !== 'string') {
                 res.status(400).json({ error: 'id (string) and provider (string) are required' });
                 return;
             }
@@ -569,7 +705,9 @@ function createApp(config) {
             docs: '/api/docs',
             health: '/api/health',
             metrics: '/api/metrics',
-            dashboard: '/api/metrics/dashboard',
+            cloud: '/api/cloud/tasks',
+            dashboard: '/__codebuddy__/dashboard/',
+            metricsDashboard: '/api/metrics/dashboard',
         });
     });
     // API docs placeholder
@@ -626,9 +764,75 @@ function createApp(config) {
                     get: { summary: 'List memory entries', tags: ['Memory'] },
                     post: { summary: 'Create memory entry', tags: ['Memory'] },
                 },
+                '/api/workflows': {
+                    get: { summary: 'List all workflows', tags: ['Workflows'] },
+                    post: { summary: 'Create a workflow', tags: ['Workflows'] },
+                },
+                '/api/workflows/{id}': {
+                    get: { summary: 'Get workflow details', tags: ['Workflows'] },
+                    put: { summary: 'Update a workflow', tags: ['Workflows'] },
+                    delete: { summary: 'Delete a workflow', tags: ['Workflows'] },
+                },
+                '/api/workflows/{id}/run': {
+                    post: { summary: 'Execute a workflow', tags: ['Workflows'] },
+                },
+                '/api/workflows/{id}/status': {
+                    get: { summary: 'Get execution status', tags: ['Workflows'] },
+                },
+                '/api/workflows/validate': {
+                    post: { summary: 'Validate a workflow DAG (cycles, missing deps)', tags: ['Workflows'] },
+                },
+                '/api/workflows/{id}/optimize': {
+                    get: { summary: 'Run AFlow optimization on a workflow', tags: ['Workflows'] },
+                },
+                '/api/acp/send': {
+                    post: { summary: 'Send a message to an agent', tags: ['ACP'] },
+                },
+                '/api/acp/agents': {
+                    get: { summary: 'List available agents', tags: ['ACP'] },
+                },
+                '/api/acp/request': {
+                    post: { summary: 'Submit a task to an agent', tags: ['ACP'] },
+                },
+                '/api/acp/tasks/{id}': {
+                    get: { summary: 'Get task status', tags: ['ACP'] },
+                },
+                '/api/acp/tasks/{id}/yield': {
+                    post: { summary: 'Yield (pause) a task', tags: ['ACP'] },
+                },
+                '/api/acp/tasks/{id}/resume': {
+                    post: { summary: 'Resume a yielded task', tags: ['ACP'] },
+                },
+                '/api/acp/sessions': {
+                    get: { summary: 'List named sessions', tags: ['ACP'] },
+                    post: { summary: 'Create a named session', tags: ['ACP'] },
+                },
+                '/api/acp/sessions/{name}': {
+                    get: { summary: 'Get session with tasks', tags: ['ACP'] },
+                    delete: { summary: 'Delete a session', tags: ['ACP'] },
+                },
+                '/api/cloud/tasks': {
+                    get: { summary: 'List cloud background tasks', tags: ['Cloud'] },
+                    post: { summary: 'Submit a new cloud background task', tags: ['Cloud'] },
+                },
+                '/api/cloud/tasks/{id}': {
+                    get: { summary: 'Get cloud task status and result', tags: ['Cloud'] },
+                    delete: { summary: 'Delete a cloud task record', tags: ['Cloud'] },
+                },
+                '/api/cloud/tasks/{id}/stream': {
+                    get: { summary: 'SSE stream of cloud task progress', tags: ['Cloud'] },
+                },
+                '/api/cloud/tasks/{id}/cancel': {
+                    post: { summary: 'Cancel a running cloud task', tags: ['Cloud'] },
+                },
+                '/api/cloud/tasks/{id}/logs': {
+                    get: { summary: 'Get cloud task execution logs', tags: ['Cloud'] },
+                },
             },
         });
     });
+    // Dashboard SPA
+    app.use('/__codebuddy__/dashboard', createDashboardRouter());
     // 404 handler
     app.use(notFoundHandler);
     // Error handler
@@ -639,32 +843,202 @@ function createApp(config) {
  * Start the server
  */
 export async function startServer(userConfig = {}) {
-    const config = { ...DEFAULT_CONFIG, ...userConfig };
+    const mergedConfig = { ...DEFAULT_CONFIG, ...userConfig };
+    const config = {
+        ...mergedConfig,
+        jwtSecret: userConfig.jwtSecret ?? getJwtSecret(mergedConfig.authEnabled),
+    };
+    try {
+        await initializeDatabase();
+        logger.debug('Database initialized for API server');
+    }
+    catch (error) {
+        logger.warn('Database initialization failed; API server will start with degraded health', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
     // Initialize metrics collector
     initMetrics({
         consoleExport: process.env.METRICS_CONSOLE === 'true',
         fileExport: process.env.METRICS_FILE === 'true',
         filePath: process.env.METRICS_PATH,
-        exportInterval: parseInt(process.env.METRICS_INTERVAL || '60000', 10),
+        exportInterval: parseInt(process.env.METRICS_INTERVAL || String(TIMEOUT_CONFIG.DEFAULT_METRICS_INTERVAL), 10),
     });
+    // Initialize Prometheus exporter for advanced analytics metrics
+    try {
+        const { getPrometheusExporter, createMetricsCollector } = await import('../analytics/prometheus-exporter.js');
+        const promExporter = getPrometheusExporter({
+            prefix: 'codebuddy_',
+            defaultLabels: { service: 'codebuddy-server' },
+        });
+        createMetricsCollector(promExporter);
+        logger.debug('Prometheus exporter initialized');
+    }
+    catch {
+        /* prometheus exporter optional */
+    }
     const app = createApp(config);
     const server = createServer(app);
+    const startChannelBridge = async (baseUrl) => {
+        try {
+            const { getChannelManager } = await import('../channels/index.js');
+            const { loadChannelConfig, instantiateChannel } = await import('../commands/handlers/channel-handlers.js');
+            const { startChannelA2ABridge } = await import('./channel-a2a-bridge.js');
+            const manager = getChannelManager();
+            const cfg = loadChannelConfig();
+            if (!cfg || cfg.channels.length === 0) {
+                logger.info('[channel-a2a-bridge] no .codebuddy/channels.json found, skipping channel boot');
+            }
+            else {
+                for (const chCfg of cfg.channels) {
+                    if (!chCfg.enabled)
+                        continue;
+                    try {
+                        const channel = await instantiateChannel(chCfg);
+                        if (channel) {
+                            manager.registerChannel(channel);
+                            await channel.connect();
+                            logger.info(`[channel-a2a-bridge] ${chCfg.type} channel started`);
+                        }
+                    }
+                    catch (err) {
+                        logger.warn(`[channel-a2a-bridge] ${chCfg.type} failed to start`, {
+                            error: err instanceof Error ? err.message : String(err),
+                        });
+                    }
+                }
+            }
+            const bridge = startChannelA2ABridge({
+                hubBaseUrl: baseUrl,
+                channelManager: manager,
+                defaultSkill: process.env.A2A_BRIDGE_DEFAULT_SKILL || 'ollama-qwen3-4b',
+                defaultModel: process.env.A2A_BRIDGE_DEFAULT_MODEL || 'qwen3:4b',
+                defaultAgent: process.env.A2A_BRIDGE_DEFAULT_AGENT,
+            });
+            // Stash on the http server for graceful shutdown.
+            server._channelA2ABridge =
+                bridge;
+        }
+        catch (err) {
+            logger.warn('[channel-a2a-bridge] init failed', {
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    };
     // Setup WebSocket if enabled
     if (config.websocketEnabled) {
         await setupWebSocket(server, config);
         logger.info('WebSocket server enabled at /ws');
+        // Dedicated desktop (Cowork) endpoint for the conversational core only
+        // (chat / sessions / live stream events). Speaks the Cowork ClientEvent
+        // /ServerEvent protocol, auth at handshake (JWT), origin-hardened. Mounted
+        // additively via a prepended `upgrade` listener so /ws stays untouched.
+        await setupDesktopWebSocket(server, config);
+        logger.info(`Desktop WebSocket endpoint enabled at /desktop`);
+        // Phase (d).9 — start the fleet presence beacon. Periodic
+        // fleet:peer:heartbeat events let remote FleetListener clients flag
+        // a peer as stale when they stop arriving. Idempotent + unref'd.
+        startFleetHeartbeat();
+        // Hermes-style autonomous tick daemon. Wakes the proven
+        // `fleet-tick-handler.runFleetTick()` (Phase (d).18) as an
+        // in-process timer when `CODEBUDDY_FLEET_REPO_PATH` is set —
+        // otherwise it logs `daemon inactive` and stays opt-in.
+        startAutonomousTick({
+            repoPath: process.env.CODEBUDDY_FLEET_REPO_PATH,
+            host: process.env.CODEBUDDY_FLEET_HOSTNAME ||
+                process.env.CODEBUDDY_FLEET_MACHINE_LABEL ||
+                os.hostname(),
+            intervalMs: Number(process.env.CODEBUDDY_FLEET_TICK_INTERVAL_MS) || undefined,
+        });
+        // /api/health apiHeartbeat — periodically pings the configured LLM
+        // base URL so the dashboard shows a live latency + reachability
+        // status instead of `lastCheck: null`.
+        startApiHeartbeatMonitor();
+        // Phase (d).10 — bridge SmartCompactionEngine lifecycle events to
+        // fleet:peer:compacting:* so remote Claudes know when this peer is
+        // briefly indisposed by a summarization pass.
+        wireCompactionBridge();
+        // Phase (d).23 — peer.tool.invoke read-only bridge. No factory
+        // needed: the bridge wraps standalone executors and runs gates
+        // (allowlist + fleetSafe + workspace root) per invocation.
+        wirePeerToolBridge();
+        // Phase (d).16a — auto-detect the peer.chat client from env
+        // (priority order: ollama > grok > anthropic > gemini > openai).
+        // When no key is detected, peer.chat still wires but answers
+        // CLIENT_UNAVAILABLE. The providerInfo is surfaced via peer.describe
+        // so remote Claudes know what they're talking to.
+        (async () => {
+            try {
+                const { createPeerChatClientFromEnv } = await import('../fleet/peer-chat-client-factory.js');
+                const factory = createPeerChatClientFromEnv();
+                if (factory) {
+                    wirePeerChatBridge(() => factory.client, factory.info);
+                    await wirePeerSessionBridge(() => factory.client);
+                    logger.info(`[fleet] peer.chat wired: ${factory.info.provider} (${factory.info.model}${factory.info.isLocal ? ', local' : ''})`);
+                }
+                else {
+                    wirePeerChatBridge(() => null);
+                    await wirePeerSessionBridge(() => null);
+                    logger.info('[fleet] peer.chat wired without provider — set GOOGLE_API_KEY / GROK_API_KEY / ... or OLLAMA_HOST to activate');
+                }
+            }
+            catch (err) {
+                logger.warn('[fleet] peer.chat factory failed, falling back to null client', {
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                wirePeerChatBridge(() => null);
+                await wirePeerSessionBridge(() => null);
+            }
+        })().catch(() => {
+            /* unhandled-rejection guard */
+        });
     }
     return new Promise((resolve, reject) => {
         server.listen(config.port, config.host, async () => {
-            logger.info(`API Server started on http://${config.host}:${config.port}`);
-            logger.info(`Health: http://${config.host}:${config.port}/api/health`);
-            logger.info(`Metrics: http://${config.host}:${config.port}/api/metrics`);
-            logger.info(`Dashboard: http://${config.host}:${config.port}/api/metrics/dashboard`);
-            logger.info(`Docs: http://${config.host}:${config.port}/api/docs`);
+            const baseUrl = getServerBaseUrl(server, config);
+            logger.info(`API Server started on ${baseUrl}`);
+            logger.info(`Health: ${baseUrl}/api/health`);
+            logger.info(`Metrics: ${baseUrl}/api/metrics`);
+            logger.info(`Dashboard: ${baseUrl}/__codebuddy__/dashboard/`);
+            logger.info(`Metrics Dashboard: ${baseUrl}/api/metrics/dashboard`);
+            logger.info(`Docs: ${baseUrl}/api/docs`);
             logger.info(`WebSocket: ${config.websocketEnabled ? 'Enabled (/ws)' : 'Disabled'}`);
             logger.info(`Auth: ${config.authEnabled ? 'Enabled' : 'Disabled'}`);
+            if (!isLoopbackHost(config.host)) {
+                logger.warn(`Server is bound to ${config.host} (non-loopback) and is reachable from the network. ` +
+                    `Auth is ${config.authEnabled ? 'ENABLED' : 'DISABLED'}; CORS origins: ${[config.corsOrigins ?? []].flat().join(', ') || '(none)'}. ` +
+                    `Bind to localhost with HOST=127.0.0.1 if remote access is not intended.`);
+            }
             logger.info(`Rate Limit: ${config.rateLimit ? `${config.rateLimitMax} req/${config.rateLimitWindow / 1000}s` : 'Disabled'}`);
             logger.info(`Security Headers: ${config.securityHeaders?.enabled !== false ? 'Enabled (CSP, X-Frame-Options, HSTS, etc.)' : 'Disabled'}`);
+            if (config.websocketEnabled) {
+                // Channel -> A2A bridge needs the actual bound port when callers use
+                // port 0 for ephemeral smoke/integration servers.
+                startChannelBridge(baseUrl).catch(() => {
+                    /* unhandled-rejection guard */
+                });
+            }
+            // Inbound channel intake (GAP-7): start enabled channels + wire the AI
+            // receiver loop so two-way messaging works without `buddy channels start`.
+            // Opt-in via CODEBUDDY_SERVER_CHANNEL_INTAKE to avoid surprise connections.
+            if (config.channelIntakeEnabled) {
+                try {
+                    const { startConfiguredChannels } = await import('../commands/handlers/channel-handlers.js');
+                    const result = await startConfiguredChannels();
+                    if (result.noConfig) {
+                        logger.info('Channel intake: enabled but no channels.json found — nothing started');
+                    }
+                    else {
+                        logger.info(`Channel intake: started ${result.registered.length} channel(s)` +
+                            `${result.registered.length ? ` (${result.registered.join(', ')})` : ''}` +
+                            `${result.skipped.length ? `; skipped disabled: ${result.skipped.join(', ')}` : ''}` +
+                            `${result.failed.length ? `; failed: ${result.failed.map((f) => f.type).join(', ')}` : ''}`);
+                    }
+                }
+                catch (err) {
+                    logger.error('Channel intake failed to start', err);
+                }
+            }
             // Log peer routing stats
             try {
                 const peerRouter = await getPeerRouter();
@@ -684,8 +1058,46 @@ export async function startServer(userConfig = {}) {
  */
 export async function stopServer(server) {
     return new Promise((resolve, reject) => {
+        // Phase (d).9 — cancel the heartbeat timer so it doesn't keep
+        // emitting against a half-shut server. Idempotent.
+        stopFleetHeartbeat();
+        // Stop the autonomous tick daemon (no-op when never started).
+        stopAutonomousTick();
+        stopApiHeartbeatMonitor();
+        // Phase (d).10 — detach the compaction-event bridge so the
+        // SmartCompactionEngine doesn't retain dangling listener refs.
+        unwireCompactionBridge();
+        // Phase (d).15 — un-register peer.chat method.
+        unwirePeerChatBridge();
+        // Phase (d).20 — un-register peer.chat-session.* methods.
+        unwirePeerSessionBridge();
+        // Phase (d).23 — un-register peer.tool.invoke + .stream.
+        unwirePeerToolBridge();
+        // Detach the channel-A2A bridge handler + shut down the
+        // ChannelManager so polling loops (Telegram, Discord, ...) stop.
+        const bridgeStop = server
+            ._channelA2ABridge;
+        if (bridgeStop) {
+            try {
+                bridgeStop.stop();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        void (async () => {
+            try {
+                const { getChannelManager } = await import('../channels/index.js');
+                await getChannelManager().shutdown();
+            }
+            catch {
+                /* shutdown is best-effort */
+            }
+        })();
         // Close WebSocket connections
         closeAllConnections();
+        // Tear down the desktop endpoint (detaches its upgrade listener + closes sockets).
+        closeDesktopWebSocket();
         // Close HTTP server
         server.close((err) => {
             if (err) {