@qearlyao/familiar 0.2.5 → 0.3.0

package/dist/web.js

@@ -1,674 +1,62 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { createServer } from "node:http";
-import { join } from "node:path";
 import { getProviders } from "@earendil-works/pi-ai";
 import { addModel, loadAddedModels, removeModel, setAddedModelsPath } from "./added-models.js";
 import { createAgentEventRecorder, storedAgentEventFromAgentEvent, thinkingDurationMs, updateAgentEventSummary, } from "./agent-events.js";
-import { clearConfigOverride, loadConfigOverrides, setConfigOverride } from "./config-overrides.js";
-import { CONFIG_KEYS, CONFIG_REGISTRY, getConfigDefault, isConfigKey } from "./config-registry.js";
+import { loadConfigOverrides } from "./config-overrides.js";
+import { CONFIG_KEYS, CONFIG_REGISTRY, clearConfigChange, commitConfigChange, isConfigKey, } from "./config-registry.js";
 import { getContactNickname, refreshContactNote, setContactNotePath } from "./contact-note.js";
-import { publicAttachmentPath } from "./generated-media.js";
+import { messageId } from "./ids.js";
 import { materializeInboundAttachments } from "./inbound-attachments.js";
-import { PROVIDER_DEFAULTS, parseModelRef, supportedThinkingLevels } from "./models.js";
+import { PROVIDER_DEFAULTS, parseModelRef } from "./models.js";
 import { loadPersona, parsePersonaName } from "./persona.js";
-import { consumeSilentDelta, createSilentFilterState, finalizeSilentFilter, parseAgentReply } from "./silent-marker.js";
-import { createAuth, sessionCookie, verifyTotp } from "./web-auth.js";
-import { acceptWebSocket, decodeFrames, encodeFrame, replayEvents } from "./web-events.js";
-import { isObject, readJsonBody, sendJson, sendText } from "./web-http.js";
-import { serveAttachment, serveStatic } from "./web-static.js";
-import { EVENT_REPLAY_LIMIT, WEB_USER_NAME, } from "./web-types.js";
-function toUnixMs(ts) {
-    const parsed = ts ? Date.parse(ts) : NaN;
-    return Number.isFinite(parsed) ? parsed : Date.now();
+import { formatSetting } from "./settings.js";
+import { parseAgentReply } from "./silent-marker.js";
+import { isRecord } from "./util/guards.js";
+import { createAuth, sessionCookie, verifyTotp } from "./web/auth.js";
+import { createWebEventHub } from "./web/event-hub.js";
+import { HttpError, readJsonBody, sendJson, sendText } from "./web/http.js";
+import { memeCatalogPath, parseMemeCatalog } from "./web/memes.js";
+import { webAttachments, webHistoryPayload } from "./web/messages.js";
+import { isWebUploadAttachment, readMultipartBody } from "./web/multipart.js";
+import { agentSettingsPayload, commandArgs, sessionDto } from "./web/payloads.js";
+import { serveAttachment, serveStatic } from "./web/static.js";
+import { attachWebSocketStream } from "./web/stream.js";
+import { WEB_USER_NAME } from "./web/types.js";
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
 }
-function eventId() {
-    return `evt_${randomUUID()}`;
-}
-function messageId(prefix = "msg") {
-    return `${prefix}_${randomUUID()}`;
-}
-function isUserVisibleRuntimeRecord(record) {
-    return record.type !== "runtime" || !["armed", "reset", "stopped"].includes(record.event);
-}
-function parseMemeCatalog(markdown) {
-    const families = [];
-    let currentFamily;
-    for (const line of markdown.split(/\r?\n/)) {
-        const familyMatch = line.match(/^## (.+)$/);
-        if (familyMatch) {
-            currentFamily = { name: familyMatch[1]?.trim() ?? "", memes: [] };
-            families.push(currentFamily);
-            continue;
-        }
-        if (!currentFamily || !line.startsWith("- ") || !line.includes(" — "))
-            continue;
-        const separator = line.indexOf(" — ");
-        const name = line.slice(2, separator).trim();
-        const suffix = line.slice(separator + " — ".length).trim();
-        if (!name || !suffix)
-            continue;
-        currentFamily.memes.push({ name, url: `https://files.catbox.moe/${suffix}` });
-    }
-    return families;
-}
-function memeCatalogPath(config) {
-    return join(config.workspacePath, "skills", "memes", "SKILL.md");
-}
-function isWebUploadAttachment(value) {
-    return !!value && typeof value === "object" && Buffer.isBuffer(value.buffer);
-}
-async function readRawBody(request, maxBytes) {
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        total += buffer.length;
-        if (total > maxBytes)
-            throw new Error("Request body too large");
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks);
-}
-function multipartBoundary(contentType) {
-    const header = Array.isArray(contentType) ? contentType.find((value) => value.includes("boundary=")) : contentType;
-    const match = header?.match(/boundary=(?:"([^"]+)"|([^;]+))/i);
-    if (!match?.[1] && !match?.[2])
-        throw new Error("Missing multipart boundary");
-    return match[1] ?? match[2] ?? "";
-}
-function parseContentDisposition(header) {
-    const parts = header.split(";").map((part) => part.trim());
-    const values = {};
-    for (const part of parts.slice(1)) {
-        const [key, rawValue] = part.split("=");
-        if (!key || rawValue === undefined)
-            continue;
-        values[key.toLowerCase()] = rawValue.replace(/^"|"$/g, "");
-    }
-    return values;
-}
-async function readMultipartBody(request, contentType) {
-    const boundary = multipartBoundary(contentType);
-    const raw = await readRawBody(request, 32 * 1024 * 1024);
-    const binary = raw.toString("binary");
-    const marker = `--${boundary}`;
-    const attachments = [];
-    const body = { text: "" };
-    for (const section of binary.split(marker).slice(1)) {
-        if (!section || section === "--\r\n" || section === "--")
-            continue;
-        const trimmed = section.replace(/^\r\n/, "").replace(/\r\n--$/, "");
-        const headerEnd = trimmed.indexOf("\r\n\r\n");
-        if (headerEnd < 0)
-            continue;
-        const headerText = trimmed.slice(0, headerEnd);
-        let contentBinary = trimmed.slice(headerEnd + 4);
-        if (contentBinary.endsWith("\r\n"))
-            contentBinary = contentBinary.slice(0, -2);
-        const headers = Object.fromEntries(headerText.split("\r\n").map((line) => {
-            const colon = line.indexOf(":");
-            return colon >= 0
-                ? [line.slice(0, colon).trim().toLowerCase(), line.slice(colon + 1).trim()]
-                : [line.toLowerCase(), ""];
-        }));
-        const disposition = parseContentDisposition(headers["content-disposition"] ?? "");
-        const name = disposition.name;
-        if (!name)
-            continue;
-        if (name === "text" || name === "channelKey" || name === "clientId") {
-            body[name] = Buffer.from(contentBinary, "binary").toString("utf8");
-            continue;
-        }
-        if (name !== "attachments")
-            continue;
-        const buffer = Buffer.from(contentBinary, "binary");
-        if (buffer.length === 0)
-            continue;
-        attachments.push({
-            name: disposition.filename,
-            mimeType: headers["content-type"],
-            size: buffer.length,
-            buffer,
-        });
-    }
-    body.attachments = attachments;
-    return body;
-}
-function webAttachments(config, attachments) {
-    if (!attachments?.length)
-        return undefined;
-    return attachments.map((attachment) => ({
-        id: attachment.id,
-        name: attachment.name,
-        kind: attachment.kind,
-        mimeType: attachment.mimeType,
-        size: attachment.size,
-        url: attachment.localPath ? publicAttachmentPath(config, attachment.localPath) : attachment.remoteUrl,
-    }));
-}
-function attachmentDerivedText(attachment) {
-    if (attachment.derived?.text?.label === "preview")
-        return undefined;
-    return attachment.derived?.text?.text;
-}
-function toolError(result) {
-    if (typeof result === "string")
-        return result;
-    if (!isObject(result))
-        return undefined;
-    if (typeof result.error === "string")
-        return result.error;
-    if (typeof result.message === "string")
-        return result.message;
-    return undefined;
-}
-function toolFromStoredAgentEvent(event, ts) {
-    if (event.type === "tool_execution_start") {
-        return {
-            id: event.toolCallId,
-            name: event.toolName,
-            status: "running",
-            args: event.args,
-            startedAt: ts,
-            updatedAt: ts,
-        };
-    }
-    if (event.type === "tool_execution_update") {
-        return {
-            id: event.toolCallId,
-            name: event.toolName,
-            status: "running",
-            args: event.args,
-            partialResult: event.partialResult,
-            updatedAt: ts,
-        };
-    }
-    if (event.type === "tool_execution_end") {
-        return {
-            id: event.toolCallId,
-            name: event.toolName,
-            status: event.isError ? "error" : "completed",
-            result: event.result,
-            error: event.isError ? toolError(event.result) : undefined,
-            completedAt: ts,
-            updatedAt: ts,
-        };
-    }
-    if (event.type === "message_update" && event.assistantMessageEvent.type === "toolcall_end") {
-        return {
-            id: event.assistantMessageEvent.toolCall.id,
-            name: event.assistantMessageEvent.toolCall.name,
-            status: "pending",
-            args: event.assistantMessageEvent.toolCall.arguments,
-            updatedAt: ts,
-        };
-    }
-    return undefined;
-}
-function mergeToolEvent(existing, patch) {
-    const terminal = patch.status === "completed" || patch.status === "error";
-    return {
-        ...existing,
-        ...patch,
-        args: patch.args ?? existing?.args,
-        partialResult: terminal ? undefined : (patch.partialResult ?? existing?.partialResult),
-        result: patch.result ?? existing?.result,
-        error: patch.error ?? existing?.error,
-        startedAt: existing?.startedAt ?? patch.startedAt,
-    };
-}
-function stepId(messageId, kind, index) {
-    return `${messageId}-${kind}-${index}`;
-}
-function closeOpenContentSteps(steps, now) {
-    for (const step of steps) {
-        if (step.kind === "thinking" && !step.complete) {
-            step.complete = true;
-            step.endedAt ??= now;
-        }
-        if (step.kind === "text" && !step.complete)
-            step.complete = true;
-    }
-}
-function appendDeltaStep(steps, messageId, part, content, now) {
-    const last = steps.at(-1);
-    if (part === "thinking") {
-        if (last?.kind === "thinking" && !last.complete) {
-            last.text += content;
-            return;
-        }
-        closeOpenContentSteps(steps, now);
-        steps.push({
-            kind: "thinking",
-            id: stepId(messageId, "thinking", steps.length),
-            text: content,
-            startedAt: now,
-        });
-        return;
-    }
-    if (last?.kind === "text" && !last.complete) {
-        last.text += content;
-        return;
-    }
-    closeOpenContentSteps(steps, now);
-    steps.push({ kind: "text", id: stepId(messageId, "text", steps.length), text: content });
-}
-function upsertToolStep(steps, tool, now) {
-    const index = steps.findIndex((step) => step.kind === "tool" && step.tool.id === tool.id);
-    if (index >= 0) {
-        const existing = steps[index];
-        if (existing?.kind === "tool")
-            existing.tool = mergeToolEvent(existing.tool, tool);
-        return;
-    }
-    closeOpenContentSteps(steps, now);
-    steps.push({ kind: "tool", id: tool.id, tool });
-}
-function applyStoredAgentEventToMessage(message, record, options) {
-    const event = record.event;
-    const ts = toUnixMs(record.ts);
-    message.steps ??= [];
-    const steps = message.steps;
-    if (event.type === "message_update") {
-        const assistantEvent = event.assistantMessageEvent;
-        if (assistantEvent.type === "text_delta") {
-            appendDeltaStep(steps, message.id, "text", assistantEvent.delta, ts);
-            if (options.applyTextDeltas)
-                message.text += assistantEvent.delta;
-        }
-        if (assistantEvent.type === "thinking_delta") {
-            appendDeltaStep(steps, message.id, "thinking", assistantEvent.delta, ts);
-            if (options.applyThinkingDeltas)
-                message.thinking = `${message.thinking ?? ""}${assistantEvent.delta}`;
-        }
-    }
-    if (event.type === "message_end") {
-        closeOpenContentSteps(steps, ts);
-        if (event.usage)
-            message.usage = event.usage;
-    }
-    const tool = toolFromStoredAgentEvent(event, ts);
-    if (tool) {
-        upsertToolStep(steps, tool, ts);
-        const tools = message.tools ?? [];
-        const index = tools.findIndex((candidate) => candidate.id === tool.id);
-        if (index >= 0) {
-            tools[index] = mergeToolEvent(tools[index], tool);
-        }
-        else {
-            tools.push(tool);
-        }
-        message.tools = tools;
-    }
-}
-function ensureFallbackSteps(message) {
-    if (message.steps?.length)
-        return;
-    const steps = [];
-    if (message.thinking || message.thinkingMs != null) {
-        const endedAt = message.ts;
-        steps.push({
-            kind: "thinking",
-            id: stepId(message.id, "thinking", steps.length),
-            text: message.thinking ?? "",
-            startedAt: endedAt - (message.thinkingMs ?? 0),
-            endedAt,
-            complete: true,
-        });
-    }
-    for (const tool of message.tools ?? [])
-        steps.push({ kind: "tool", id: tool.id, tool });
-    if (message.text) {
-        steps.push({ kind: "text", id: stepId(message.id, "text", steps.length), text: message.text, complete: true });
-    }
-    if (steps.length)
-        message.steps = steps;
-}
-function webMessagesFromRecords(config, records, assistantName) {
-    const messages = [];
-    const messagesById = new Map();
-    const pendingAgentEvents = new Map();
-    for (const record of records) {
-        const message = webMessageFromRecord(config, record, assistantName);
-        if (message) {
-            messages.push(message);
-            messagesById.set(message.id, message);
-            const pending = pendingAgentEvents.get(message.id) ?? [];
-            for (const pendingRecord of pending) {
-                applyStoredAgentEventToMessage(message, pendingRecord, {
-                    applyTextDeltas: !message.text && !message.silent,
-                    applyThinkingDeltas: !message.thinking,
-                });
-            }
-            pendingAgentEvents.delete(message.id);
-        }
-        if (record.type === "agent_event") {
-            const existing = messagesById.get(record.messageId);
-            if (existing) {
-                applyStoredAgentEventToMessage(existing, record, {
-                    applyTextDeltas: !existing.silent,
-                    applyThinkingDeltas: true,
-                });
-            }
-            else {
-                const pending = pendingAgentEvents.get(record.messageId) ?? [];
-                pending.push(record);
-                pendingAgentEvents.set(record.messageId, pending);
-            }
-        }
-    }
-    for (const message of messages)
-        ensureFallbackSteps(message);
-    return messages;
-}
-function webHistoryPayload(config, records, assistantName, channelKey, options) {
-    const messages = webMessagesFromRecords(config, records, assistantName);
-    const end = options.before ? messages.findIndex((message) => message.id === options.before) : messages.length;
-    const safeEnd = end >= 0 ? end : messages.length;
-    const page = messages.slice(Math.max(0, safeEnd - options.limit), safeEnd);
-    return { messages: page, hasMore: safeEnd - options.limit > 0, channelKey };
-}
-function webMessageFromRecord(config, record, assistantName) {
-    if (!isUserVisibleRuntimeRecord(record))
-        return undefined;
-    if (record.type === "inbound") {
-        const attachmentText = record.attachments
-            .map((attachment) => attachmentDerivedText(attachment))
-            .filter((text) => !!text)
-            .join("\n");
-        return {
-            id: record.messageId,
-            role: "user",
-            who: record.authorName || getContactNickname(WEB_USER_NAME),
-            text: [record.text, attachmentText].filter(Boolean).join("\n"),
-            attachments: webAttachments(config, record.attachments),
-            ts: toUnixMs(record.ts),
-        };
-    }
-    if (record.type === "outbound" && !record.control) {
-        return {
-            id: record.webMessageId || record.messageIds[0] || `out_${record.recordId}`,
-            role: "assistant",
-            who: assistantName,
-            text: record.text,
-            attachments: webAttachments(config, record.attachments),
-            thinking: record.thinking,
-            thinkingMs: record.thinkingMs,
-            silent: record.silent || undefined,
-            ts: toUnixMs(record.ts),
-        };
-    }
-    if (record.type === "runtime" || record.type === "error") {
-        return {
-            id: `sys_${record.recordId}`,
-            role: "system",
-            who: "system",
-            text: record.type === "runtime" ? record.detail || record.event : record.message,
-            ts: toUnixMs(record.ts),
-        };
-    }
-    return undefined;
-}
-function commandArgs(command, args) {
-    if (!isObject(args))
-        return "";
-    if (command === "model")
-        return typeof args.model === "string" ? args.model : "";
-    if (command === "thinking")
-        return typeof args.level === "string" ? args.level : "";
-    if (command === "channel-trigger")
-        return typeof args.trigger === "string" ? args.trigger : "";
-    return "";
-}
-function formatSetting(setting) {
-    return `${setting.value} (${setting.source})`;
-}
-function agentSettingsPayload(familiarAgent, channelKey, personaName) {
-    const { model } = familiarAgent.resolveChannelModel(channelKey);
-    return {
-        model: familiarAgent.getModel(channelKey),
-        thinking: familiarAgent.getThinkingLevel(channelKey),
-        supportedThinking: supportedThinkingLevels(model),
-        persona: { name: personaName },
-    };
-}
-function sessionDto(session) {
-    return {
-        key: session.key,
-        label: session.label,
-        service: session.channel.service,
-        scope: session.channel.scope,
-        channelId: session.channel.channelId,
-        channelName: session.channel.channelName,
-        threadId: session.channel.threadId,
-        isDefault: session.isDefault,
-    };
-}
-export async function startWebDaemon(config, familiarAgent, discordDaemon, options = {}) {
+export async function startWebDaemon(config, familiarAgent, agentCore, options = {}) {
     setAddedModelsPath(config.workspace.dataDir);
     setContactNotePath(config.persona.contact);
     await refreshContactNote();
     const persona = await loadPersona(config);
     const personaName = parsePersonaName(persona.soul);
     const auth = createAuth(config);
-    const clients = new Set();
-    const eventsByChannel = new Map();
-    const runtimeSubscriptions = new Map();
-    const IN_FLIGHT_TTL_MS = 10 * 60 * 1000;
-    const inFlightMessages = new Map();
-    const getOrCreateInFlight = (messageIdValue) => {
-        let entry = inFlightMessages.get(messageIdValue);
-        if (!entry) {
-            entry = { locallyStreamed: false, startedSilent: false, lastActiveAt: Date.now() };
-            inFlightMessages.set(messageIdValue, entry);
-        }
-        else {
-            entry.lastActiveAt = Date.now();
-        }
-        return entry;
-    };
-    const touchInFlight = (messageIdValue) => {
-        const entry = inFlightMessages.get(messageIdValue);
-        if (entry)
-            entry.lastActiveAt = Date.now();
-    };
-    const inFlightGcTimer = setInterval(() => {
-        const cutoff = Date.now() - IN_FLIGHT_TTL_MS;
-        for (const [id, entry] of inFlightMessages) {
-            if (entry.lastActiveAt < cutoff)
-                inFlightMessages.delete(id);
-        }
-    }, 60 * 1000);
-    inFlightGcTimer.unref?.();
-    const publish = (event) => {
-        const fullEvent = { ...event, eventId: eventId(), ts: event.ts ?? Date.now() };
-        const events = eventsByChannel.get(fullEvent.channelKey ?? "") ?? [];
-        events.push(fullEvent);
-        if (events.length > EVENT_REPLAY_LIMIT)
-            events.shift();
-        eventsByChannel.set(fullEvent.channelKey ?? "", events);
-        const frame = encodeFrame(JSON.stringify(fullEvent));
-        for (const client of clients) {
-            if (client.channelKey === fullEvent.channelKey && !client.socket.destroyed) {
-                if (client.authed) {
-                    client.socket.write(frame);
-                }
-                else {
-                    const pendingEvents = client.pendingEvents ?? [];
-                    pendingEvents.push(fullEvent);
-                    client.pendingEvents = pendingEvents;
-                }
-            }
-        }
-        return fullEvent;
-    };
-    const publishDelta = (channelKey, messageIdValue, part, text, ts) => publish({ type: "delta", channelKey, messageId: messageIdValue, part, content: text, text, ts });
-    const publishStoredAgentEvent = (channelKey, messageIdValue, storedEvent, ts) => {
-        touchInFlight(messageIdValue);
-        if (storedEvent.type === "message_start" && storedEvent.role === "assistant") {
-            const entry = getOrCreateInFlight(messageIdValue);
-            entry.locallyStreamed = true;
-            entry.silentFilter = createSilentFilterState();
-            entry.pendingStartTs = ts;
-            entry.startedSilent = false;
-        }
-        const startedSilentMessage = () => {
-            const entry = inFlightMessages.get(messageIdValue);
-            if (!entry || entry.startedSilent)
-                return false;
-            const startTs = entry.pendingStartTs;
-            entry.pendingStartTs = undefined;
-            entry.startedSilent = true;
-            publish({
-                type: "message_started",
-                channelKey,
-                messageId: messageIdValue,
-                role: "assistant",
-                who: personaName,
-                ts: startTs,
-            });
-            return true;
-        };
-        if (storedEvent.type === "message_update") {
-            const assistantEvent = storedEvent.assistantMessageEvent;
-            if (assistantEvent.type === "thinking_delta") {
-                startedSilentMessage();
-                publishDelta(channelKey, messageIdValue, "thinking", assistantEvent.delta, ts);
-            }
-            if (assistantEvent.type === "text_delta") {
-                const filter = inFlightMessages.get(messageIdValue)?.silentFilter;
-                if (!filter) {
-                    startedSilentMessage();
-                    publishDelta(channelKey, messageIdValue, "text", assistantEvent.delta, ts);
-                }
-                else {
-                    const result = consumeSilentDelta(filter, assistantEvent.delta);
-                    if (result.kind === "emit" && result.text) {
-                        startedSilentMessage();
-                        publishDelta(channelKey, messageIdValue, "text", result.text, ts);
-                    }
-                }
-            }
-        }
-        if (storedEvent.type === "tool_execution_start") {
-            startedSilentMessage();
-        }
-        if (storedEvent.type === "message_end" && storedEvent.role === "assistant") {
-            const entry = inFlightMessages.get(messageIdValue);
-            const filter = entry?.silentFilter;
-            let silent = false;
-            if (filter && entry) {
-                const final = finalizeSilentFilter(filter);
-                silent = final.silent;
-                if (!silent) {
-                    startedSilentMessage();
-                    if (final.flush) {
-                        publishDelta(channelKey, messageIdValue, "text", final.flush, ts);
-                    }
-                }
-                else {
-                    entry.startedSilent = true;
-                    entry.pendingStartTs = undefined;
-                }
-                entry.silentFilter = undefined;
-            }
-            else {
-                startedSilentMessage();
-            }
-            publish({
-                type: "message_completed",
-                channelKey,
-                messageId: messageIdValue,
-                usage: storedEvent.usage,
-                silent: silent || undefined,
-                ts,
-            });
-        }
-        const tool = toolFromStoredAgentEvent(storedEvent, ts ?? Date.now());
-        if (tool)
-            publish({ type: "tool_event", channelKey, messageId: messageIdValue, tool, ts });
-    };
-    const subscribeRuntime = (runtime) => {
-        if (runtimeSubscriptions.has(runtime.channelKey))
-            return;
-        const unsubscribeRecords = runtime.subscribe((record) => {
-            if (record.type === "inbound") {
-                publish({
-                    type: "message_started",
-                    channelKey: runtime.channelKey,
-                    messageId: record.messageId,
-                    role: "user",
-                    who: record.authorName || getContactNickname(WEB_USER_NAME),
-                    ts: toUnixMs(record.ts),
-                });
-                publishDelta(runtime.channelKey, record.messageId, "text", record.text, toUnixMs(record.ts));
-                publish({
-                    type: "message_completed",
-                    channelKey: runtime.channelKey,
-                    messageId: record.messageId,
-                    attachments: webAttachments(config, record.attachments),
-                    ts: toUnixMs(record.ts),
-                });
-            }
-            if (record.type === "outbound" && !record.control) {
-                const outboundId = record.webMessageId || record.messageIds[0] || `out_${record.recordId}`;
-                const completion = {
-                    type: "message_completed",
-                    channelKey: runtime.channelKey,
-                    messageId: outboundId,
-                    thinkingMs: record.thinkingMs,
-                    attachments: webAttachments(config, record.attachments),
-                    silent: record.silent || undefined,
-                    ts: toUnixMs(record.ts),
-                };
-                if (inFlightMessages.get(outboundId)?.locallyStreamed) {
-                    inFlightMessages.delete(outboundId);
-                    publish(completion);
-                    return;
-                }
-                if (!record.silent) {
-                    publish({
-                        type: "message_started",
-                        channelKey: runtime.channelKey,
-                        messageId: outboundId,
-                        role: "assistant",
-                        who: personaName,
-                        ts: toUnixMs(record.ts),
-                    });
-                    if (record.thinking)
-                        publishDelta(runtime.channelKey, outboundId, "thinking", record.thinking, toUnixMs(record.ts));
-                    if (record.text)
-                        publishDelta(runtime.channelKey, outboundId, "text", record.text, toUnixMs(record.ts));
-                }
-                publish(completion);
-            }
-        });
-        const unsubscribeAgentEvents = runtime.subscribeAgentEvents((agentEvent) => {
-            publishStoredAgentEvent(runtime.channelKey, agentEvent.messageId, agentEvent.event, agentEvent.ts);
-        });
-        runtimeSubscriptions.set(runtime.channelKey, () => {
-            unsubscribeRecords();
-            unsubscribeAgentEvents();
-        });
-    };
+    const eventHub = createWebEventHub(config, personaName);
+    const { appendAndPublishError, publish, publishDelta } = eventHub;
     const getRuntime = async (channelKey) => {
-        const runtime = await discordDaemon.getRuntimeForWebChannel(channelKey);
-        subscribeRuntime(runtime);
+        if (!agentCore.hasSessionSource())
+            throw new HttpError(503, "Owner identity is not established yet.");
+        const runtime = await agentCore.getRuntimeForWebChannel(channelKey);
+        eventHub.subscribeRuntime(runtime);
         return runtime;
     };
     const subscribeKnownRuntimes = async () => {
-        const sessions = await discordDaemon.getWebSessions();
+        if (!agentCore.hasSessionSource())
+            return;
+        const sessions = await agentCore.getWebSessions();
         await Promise.all(sessions.map(async (session) => {
-            const runtime = await discordDaemon.getRuntimeForWebChannel(session.key);
-            subscribeRuntime(runtime);
+            const runtime = await agentCore.getRuntimeForWebChannel(session.key);
+            eventHub.subscribeRuntime(runtime);
         }));
     };
     const getChannelKeyFromRequest = (url, body) => {
         const queryKey = url.searchParams.get("channelKey");
         if (queryKey)
             return queryKey;
-        if (isObject(body) && typeof body.channelKey === "string")
+        if (isRecord(body) && typeof body.channelKey === "string")
             return body.channelKey;
         return undefined;
     };
@@ -711,20 +99,25 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
             return { ok: false, error: "format must be provider/model-id" };
         return { ok: true, model: ref.key, ref };
     };
-    const replay = (client, channelKey, lastEventId) => {
-        const events = eventsByChannel.get(channelKey) ?? [];
-        replayEvents(client, events, lastEventId, () => publish({ type: "replay_window_lost", channelKey }));
-    };
     const promptForRuntime = async (runtime, jobId, prompt, attachments = [], onTurnEnd) => {
-        const assistantMessageId = messageId();
+        return promptAssistantMessage({
+            runtime,
+            jobId,
+            assistantMessageId: messageId(),
+            dispatch: (onEvent) => agentCore.promptForRuntime(runtime, jobId, prompt, attachments, onEvent, onTurnEnd),
+        });
+    };
+    const promptAssistantMessage = async (options) => {
+        const { runtime, jobId, assistantMessageId } = options;
         const summary = { thinking: "" };
         const recorder = createAgentEventRecorder((storedEvent) => runtime.noteAgentEvent(jobId, assistantMessageId, storedEvent, { notify: false }));
         let started = false;
         let reply;
         try {
-            reply = await discordDaemon.runPromptForWeb(runtime, jobId, prompt, attachments, async (event) => {
+            reply = await options.dispatch(async (event) => {
                 if (event.type === "message_start" && event.message.role === "assistant" && !started) {
                     started = true;
+                    options.onAssistantStart?.();
                 }
                 updateAgentEventSummary(summary, event);
                 const storedEvent = storedAgentEventFromAgentEvent(event);
@@ -732,23 +125,26 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
                     runtime.publishAgentEvent(jobId, assistantMessageId, storedEvent);
                     await recorder.record(storedEvent);
                 }
-            }, onTurnEnd);
+            });
         }
         finally {
             await recorder.flush();
         }
         const parsed = parseAgentReply(reply.text);
         const finalText = parsed.silent ? "" : reply.text;
-        if (!started && !parsed.silent) {
-            publish({
-                type: "message_started",
-                channelKey: runtime.channelKey,
-                messageId: assistantMessageId,
-                role: "assistant",
-                who: personaName,
-            });
-            if (finalText) {
-                publishDelta(runtime.channelKey, assistantMessageId, "text", finalText);
+        if (!started) {
+            options.onAssistantStart?.();
+            if (!parsed.silent) {
+                publish({
+                    type: "message_started",
+                    channelKey: runtime.channelKey,
+                    messageId: assistantMessageId,
+                    role: "assistant",
+                    who: personaName,
+                });
+                if (finalText) {
+                    publishDelta(runtime.channelKey, assistantMessageId, "text", finalText);
+                }
             }
         }
         const thinkingMs = thinkingDurationMs(summary);
@@ -760,8 +156,7 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
             attachments: webAttachments(config, reply.attachments),
             silent: parsed.silent || undefined,
         });
-        const entry = getOrCreateInFlight(assistantMessageId);
-        entry.locallyStreamed = true;
+        eventHub.markLocallyStreamed(assistantMessageId);
         return {
             text: finalText,
             messageId: assistantMessageId,
@@ -771,6 +166,81 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
             silent: parsed.silent,
         };
     };
+    const retryLatestAssistant = async (runtime) => {
+        if (runtime.hasActiveJob())
+            throw new Error("Cannot retry while a turn is running");
+        const target = runtime.latestAssistantRetryTarget();
+        if (!target)
+            throw new Error("No assistant message to retry");
+        const jobId = randomUUID();
+        const assistantMessageId = messageId();
+        const replaceMessage = () => {
+            publish({
+                type: "message_replaced",
+                channelKey: runtime.channelKey,
+                oldMessageId: target.messageId,
+                newMessageId: assistantMessageId,
+            });
+        };
+        try {
+            const reply = await promptAssistantMessage({
+                runtime,
+                jobId,
+                assistantMessageId,
+                onAssistantStart: replaceMessage,
+                dispatch: (onEvent) => familiarAgent.retryLastAssistant(runtime.channelKey, onEvent, {
+                    onTurnEnd: () => {
+                        publish({
+                            type: "status",
+                            channelKey: runtime.channelKey,
+                            kind: "idle",
+                        });
+                    },
+                }),
+            });
+            await runtime.noteAssistantRetry({
+                oldMessageId: target.messageId,
+                newMessageId: assistantMessageId,
+                jobId,
+                triggerRecordId: target.triggerRecordId,
+            });
+            await runtime.noteOutbound({
+                text: reply.text,
+                messageIds: [reply.messageId],
+                webMessageId: reply.messageId,
+                attachments: reply.attachments,
+                thinking: reply.thinking,
+                thinkingMs: reply.thinkingMs,
+                silent: reply.silent,
+                replyToMessageId: target.messageId,
+                jobId,
+            });
+        }
+        catch (error) {
+            const message = errorMessage(error);
+            await appendAndPublishError(runtime, message);
+        }
+    };
+    const deleteLatestAssistant = async (runtime) => {
+        if (runtime.hasActiveJob())
+            throw new Error("Cannot delete while a turn is running");
+        const target = runtime.latestAssistantDeleteTarget();
+        if (!target)
+            throw new Error("No assistant message to delete");
+        try {
+            await familiarAgent.deleteLastAssistant(runtime.channelKey);
+            await runtime.noteMessageDelete(target.messageId);
+            publish({
+                type: "message_deleted",
+                channelKey: runtime.channelKey,
+                messageId: target.messageId,
+            });
+        }
+        catch (error) {
+            const message = errorMessage(error);
+            await appendAndPublishError(runtime, message);
+        }
+    };
     const drainJobs = async (runtime) => {
         for (;;) {
             const dispatch = runtime.beginNextJob();
@@ -798,17 +268,16 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
             catch (error) {
                 if (!runtime.hasActiveJob(dispatch.job.jobId))
                     return;
-                const message = error instanceof Error ? error.message : String(error);
+                const message = errorMessage(error);
                 await runtime.failActiveJob(message);
-                await runtime.appendError(message);
-                publish({ type: "error", channelKey: runtime.channelKey, code: "unknown", message });
+                await appendAndPublishError(runtime, message);
             }
         }
     };
     const applyControlCommand = async (runtime, control) => {
         if (control.command === "stop") {
-            familiarAgent.requestSoftStop(runtime.channelKey);
-            return "Stopped after current step. Conversation preserved.";
+            await familiarAgent.abort(runtime.channelKey);
+            return "Stopped current work.";
         }
         if (control.command === "new") {
             await familiarAgent.reset(runtime.channelKey);
@@ -844,6 +313,270 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
         }
         return "Compact is not wired for this runtime yet. I logged the command, but I won't run lossy compaction here.";
     };
+    const webRoutes = new Map();
+    const route = (method, pathname, handler) => {
+        webRoutes.set(`${method} ${pathname}`, handler);
+    };
+    route("GET", "/api/web/auth/mode", async (_request, response) => {
+        sendJson(response, 200, { mode: config.web.authMode, personaName });
+        return true;
+    });
+    route("GET", "/api/web/sessions", async (_request, response) => {
+        if (!agentCore.hasSessionSource()) {
+            sendJson(response, 200, { sessions: [] });
+            return true;
+        }
+        const sessions = await agentCore.getWebSessions();
+        sendJson(response, 200, { sessions: sessions.map(sessionDto) });
+        return true;
+    });
+    route("GET", "/api/web/history", async (_request, response, url) => {
+        const runtime = await getRuntime(getChannelKeyFromRequest(url));
+        const limit = Math.min(Math.max(Number(url.searchParams.get("limit") ?? 50) || 50, 1), 200);
+        const before = url.searchParams.get("before") ?? undefined;
+        sendJson(response, 200, webHistoryPayload(config, runtime.getRecords(), personaName, runtime.channelKey, { limit, before }));
+        return true;
+    });
+    route("GET", "/api/web/agent/settings", async (_request, response, url) => {
+        const runtime = await getRuntime(getChannelKeyFromRequest(url));
+        sendJson(response, 200, agentSettingsPayload(familiarAgent, runtime.channelKey, personaName));
+        return true;
+    });
+    route("GET", "/api/web/agent/models", async (_request, response) => {
+        sendJson(response, 200, getAgentModelsPayload());
+        return true;
+    });
+    route("POST", "/api/web/agent/models", async (request, response) => {
+        const body = await readJsonBody(request);
+        if (!isRecord(body)) {
+            sendJson(response, 400, { error: "body is required" });
+            return true;
+        }
+        const parsed = parseRequestedModel(body.model);
+        if (!parsed.ok) {
+            sendJson(response, 400, { error: parsed.error });
+            return true;
+        }
+        if (!Object.hasOwn(PROVIDER_DEFAULTS, parsed.ref.provider) &&
+            !getProviders().includes(parsed.ref.provider)) {
+            sendJson(response, 400, { error: `unsupported provider: ${parsed.ref.provider}` });
+            return true;
+        }
+        if (config.models.allow.includes(parsed.model) || loadAddedModels().includes(parsed.model)) {
+            sendJson(response, 200, getAgentModelsPayload());
+            return true;
+        }
+        await addModel(parsed.model);
+        sendJson(response, 200, getAgentModelsPayload());
+        return true;
+    });
+    route("DELETE", "/api/web/agent/models", async (request, response) => {
+        const body = await readJsonBody(request);
+        if (!isRecord(body)) {
+            sendJson(response, 400, { error: "body is required" });
+            return true;
+        }
+        const parsed = parseRequestedModel(body.model);
+        if (!parsed.ok) {
+            sendJson(response, 400, { error: parsed.error });
+            return true;
+        }
+        if (!loadAddedModels().includes(parsed.model)) {
+            sendJson(response, 400, { error: "model is not user-added" });
+            return true;
+        }
+        await removeModel(parsed.model);
+        sendJson(response, 200, getAgentModelsPayload());
+        return true;
+    });
+    route("GET", "/api/web/config", async (_request, response) => {
+        sendJson(response, 200, getConfigPayload());
+        return true;
+    });
+    route("POST", "/api/web/config", async (request, response) => {
+        const body = await readJsonBody(request);
+        if (!isRecord(body) || typeof body.key !== "string") {
+            sendJson(response, 400, { error: "key is required" });
+            return true;
+        }
+        if (!isConfigKey(body.key)) {
+            sendJson(response, 400, { error: `unknown config key: ${body.key}` });
+            return true;
+        }
+        const key = body.key;
+        const entry = CONFIG_REGISTRY[key];
+        try {
+            const validated = entry.validate(body.value, config);
+            await commitConfigChange(key, validated, { config, scheduler: agentCore });
+        }
+        catch (error) {
+            const message = errorMessage(error);
+            sendJson(response, 400, { error: message });
+            return true;
+        }
+        sendJson(response, 200, getConfigPayload());
+        return true;
+    });
+    route("DELETE", "/api/web/config", async (request, response) => {
+        const body = await readJsonBody(request);
+        if (!isRecord(body) || typeof body.key !== "string") {
+            sendJson(response, 400, { error: "key is required" });
+            return true;
+        }
+        if (!isConfigKey(body.key)) {
+            sendJson(response, 400, { error: `unknown config key: ${body.key}` });
+            return true;
+        }
+        const key = body.key;
+        try {
+            await clearConfigChange(key, { config, scheduler: agentCore });
+        }
+        catch (error) {
+            const message = errorMessage(error);
+            sendJson(response, 400, { error: message });
+            return true;
+        }
+        sendJson(response, 200, getConfigPayload());
+        return true;
+    });
+    route("GET", "/api/web/memes", async (_request, response) => {
+        try {
+            const markdown = await readFile(memeCatalogPath(config), "utf8");
+            sendJson(response, 200, { families: parseMemeCatalog(markdown) });
+        }
+        catch {
+            sendJson(response, 500, { error: "memes catalog unavailable" });
+        }
+        return true;
+    });
+    route("POST", "/api/web/send", async (request, response, url) => {
+        const contentType = request.headers["content-type"] ?? "";
+        const isMultipart = Array.isArray(contentType)
+            ? contentType.some((value) => value.includes("multipart/form-data"))
+            : contentType.includes("multipart/form-data");
+        const body = isMultipart ? await readMultipartBody(request, contentType) : await readJsonBody(request);
+        const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
+        if (!isRecord(body) || typeof body.text !== "string") {
+            sendJson(response, 400, { error: "text is required" });
+            return true;
+        }
+        if (!isMultipart && isRecord(body) && Array.isArray(body.attachments) && body.attachments.length > 0) {
+            sendJson(response, 400, { error: "attachments require multipart form data" });
+            return true;
+        }
+        const rawAttachments = Array.isArray(body.attachments) ? body.attachments : [];
+        const attachments = await materializeInboundAttachments(config, rawAttachments
+            .filter((attachment) => isWebUploadAttachment(attachment))
+            .map((attachment) => ({ ...attachment, source: "web" })));
+        if (!body.text.trim() && attachments.length === 0) {
+            sendJson(response, 400, { error: "text or attachment is required" });
+            return true;
+        }
+        const id = messageId("user");
+        const ts = Date.now();
+        const input = {
+            messageId: id,
+            authorId: config.discord.ownerId,
+            authorName: getContactNickname(WEB_USER_NAME),
+            text: body.text,
+            isBot: false,
+            mentionedBot: true,
+            remoteTimestamp: new Date(ts).toISOString(),
+            checkpoint: { messageId: id },
+            attachments,
+        };
+        await runtime.ingestInbound(input, { mode: "queue" });
+        void drainJobs(runtime).catch((error) => console.error("Web job drain failed", error));
+        sendJson(response, 200, { id, ts, channelKey: runtime.channelKey });
+        return true;
+    });
+    route("POST", "/api/web/retry", async (request, response, url) => {
+        const body = await readJsonBody(request);
+        const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
+        void retryLatestAssistant(runtime).catch((error) => console.error("Web retry failed", error));
+        sendJson(response, 200, { ok: true, channelKey: runtime.channelKey });
+        return true;
+    });
+    route("POST", "/api/web/delete", async (request, response, url) => {
+        const body = await readJsonBody(request);
+        const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
+        void deleteLatestAssistant(runtime).catch((error) => console.error("Web delete failed", error));
+        sendJson(response, 200, { ok: true, channelKey: runtime.channelKey });
+        return true;
+    });
+    route("POST", "/api/web/agent/settings", async (request, response, url) => {
+        const body = await readJsonBody(request);
+        const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
+        if (!isRecord(body)) {
+            sendJson(response, 400, { error: "body is required" });
+            return true;
+        }
+        try {
+            if (typeof body.model === "string")
+                await familiarAgent.setModel(runtime.channelKey, body.model);
+            if (typeof body.thinking === "string")
+                await familiarAgent.setThinkingLevel(runtime.channelKey, body.thinking);
+        }
+        catch (error) {
+            const message = errorMessage(error);
+            sendJson(response, 400, { error: message });
+            return true;
+        }
+        sendJson(response, 200, agentSettingsPayload(familiarAgent, runtime.channelKey, personaName));
+        return true;
+    });
+    route("POST", "/api/web/agent/new", async (request, response, url) => {
+        const body = await readJsonBody(request);
+        const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
+        await familiarAgent.reset(runtime.channelKey);
+        await runtime.resetConversation("new conversation requested from web");
+        publish({
+            type: "status",
+            channelKey: runtime.channelKey,
+            kind: "idle",
+            detail: "started fresh from web",
+        });
+        sendJson(response, 200, { ok: true });
+        return true;
+    });
+    route("POST", "/api/web/control", async (request, response, url) => {
+        const body = await readJsonBody(request);
+        const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
+        if (!isRecord(body) || typeof body.command !== "string") {
+            sendJson(response, 400, { error: "command is required" });
+            return true;
+        }
+        if (config.web.authMode === "public-2fa" && body.command === "login") {
+            const token = isRecord(body.args) && typeof body.args.token === "string" ? body.args.token : "";
+            if (!config.web.totpSecret || !verifyTotp(config.web.totpSecret, token)) {
+                sendJson(response, 401, { ok: false, message: "Invalid TOTP token." });
+                return true;
+            }
+            const sessionId = auth.createSession();
+            sendJson(response, 200, { ok: true, message: "Authenticated." }, { "set-cookie": sessionCookie(sessionId) });
+            return true;
+        }
+        const args = commandArgs(body.command, body.args);
+        const input = {
+            messageId: messageId("control"),
+            authorId: config.discord.ownerId,
+            authorName: getContactNickname(WEB_USER_NAME),
+            text: `/${body.command}${args ? ` ${args}` : ""}`,
+            isBot: false,
+            mentionedBot: true,
+            remoteTimestamp: new Date().toISOString(),
+        };
+        const control = runtime.parseControlCommand(input);
+        if (!control) {
+            sendJson(response, 400, { ok: false, message: "Unsupported command." });
+            return true;
+        }
+        await runtime.noteControlCommand(input, control);
+        const message = await applyControlCommand(runtime, control);
+        await runtime.noteOutbound({ text: message, messageIds: [], control: control.command });
+        sendJson(response, 200, { ok: true, message, channelKey: runtime.channelKey });
+        return true;
+    });
     const handleApi = async (request, response, url) => {
         if (!url.pathname.startsWith("/api/web/"))
             return false;
@@ -855,258 +588,17 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
             if (request.method === "GET" && url.pathname.startsWith("/api/web/attachments/")) {
                 return serveAttachment(config, response, url.pathname, request.headers.range);
             }
-            if (request.method === "GET" && url.pathname === "/api/web/auth/mode") {
-                sendJson(response, 200, { mode: config.web.authMode, personaName });
-                return true;
-            }
-            if (request.method === "GET" && url.pathname === "/api/web/sessions") {
-                const sessions = await discordDaemon.getWebSessions();
-                sendJson(response, 200, { sessions: sessions.map(sessionDto) });
-                return true;
-            }
-            if (request.method === "GET" && url.pathname === "/api/web/history") {
-                const runtime = await getRuntime(getChannelKeyFromRequest(url));
-                const limit = Math.min(Math.max(Number(url.searchParams.get("limit") ?? 50) || 50, 1), 200);
-                const before = url.searchParams.get("before") ?? undefined;
-                sendJson(response, 200, webHistoryPayload(config, runtime.getRecords(), personaName, runtime.channelKey, { limit, before }));
-                return true;
-            }
-            if (request.method === "GET" && url.pathname === "/api/web/agent/settings") {
-                const runtime = await getRuntime(getChannelKeyFromRequest(url));
-                sendJson(response, 200, agentSettingsPayload(familiarAgent, runtime.channelKey, personaName));
-                return true;
-            }
-            if (request.method === "GET" && url.pathname === "/api/web/agent/models") {
-                sendJson(response, 200, getAgentModelsPayload());
-                return true;
-            }
-            if (request.method === "POST" && url.pathname === "/api/web/agent/models") {
-                const body = await readJsonBody(request);
-                if (!isObject(body)) {
-                    sendJson(response, 400, { error: "body is required" });
-                    return true;
-                }
-                const parsed = parseRequestedModel(body.model);
-                if (!parsed.ok) {
-                    sendJson(response, 400, { error: parsed.error });
-                    return true;
-                }
-                if (!Object.hasOwn(PROVIDER_DEFAULTS, parsed.ref.provider) &&
-                    !getProviders().includes(parsed.ref.provider)) {
-                    sendJson(response, 400, { error: `unsupported provider: ${parsed.ref.provider}` });
-                    return true;
-                }
-                if (config.models.allow.includes(parsed.model) || loadAddedModels().includes(parsed.model)) {
-                    sendJson(response, 200, getAgentModelsPayload());
-                    return true;
-                }
-                await addModel(parsed.model);
-                sendJson(response, 200, getAgentModelsPayload());
-                return true;
-            }
-            if (request.method === "DELETE" && url.pathname === "/api/web/agent/models") {
-                const body = await readJsonBody(request);
-                if (!isObject(body)) {
-                    sendJson(response, 400, { error: "body is required" });
-                    return true;
-                }
-                const parsed = parseRequestedModel(body.model);
-                if (!parsed.ok) {
-                    sendJson(response, 400, { error: parsed.error });
-                    return true;
-                }
-                if (!loadAddedModels().includes(parsed.model)) {
-                    sendJson(response, 400, { error: "model is not user-added" });
-                    return true;
-                }
-                await removeModel(parsed.model);
-                sendJson(response, 200, getAgentModelsPayload());
-                return true;
-            }
-            if (request.method === "GET" && url.pathname === "/api/web/config") {
-                sendJson(response, 200, getConfigPayload());
-                return true;
-            }
-            if (request.method === "POST" && url.pathname === "/api/web/config") {
-                const body = await readJsonBody(request);
-                if (!isObject(body) || typeof body.key !== "string") {
-                    sendJson(response, 400, { error: "key is required" });
-                    return true;
-                }
-                if (!isConfigKey(body.key)) {
-                    sendJson(response, 400, { error: `unknown config key: ${body.key}` });
-                    return true;
-                }
-                const entry = CONFIG_REGISTRY[body.key];
-                try {
-                    const validated = entry.validate(body.value, config);
-                    entry.write(config, validated);
-                    await setConfigOverride(body.key, validated);
-                    await entry.apply?.({ config, discordDaemon });
-                }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    sendJson(response, 400, { error: message });
-                    return true;
-                }
-                sendJson(response, 200, getConfigPayload());
-                return true;
-            }
-            if (request.method === "DELETE" && url.pathname === "/api/web/config") {
-                const body = await readJsonBody(request);
-                if (!isObject(body) || typeof body.key !== "string") {
-                    sendJson(response, 400, { error: "key is required" });
-                    return true;
-                }
-                if (!isConfigKey(body.key)) {
-                    sendJson(response, 400, { error: `unknown config key: ${body.key}` });
-                    return true;
-                }
-                const entry = CONFIG_REGISTRY[body.key];
-                try {
-                    const fallback = getConfigDefault(body.key);
-                    entry.write(config, fallback);
-                    await clearConfigOverride(body.key);
-                    await entry.apply?.({ config, discordDaemon });
-                }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    sendJson(response, 400, { error: message });
-                    return true;
-                }
-                sendJson(response, 200, getConfigPayload());
-                return true;
-            }
-            if (request.method === "GET" && url.pathname === "/api/web/memes") {
-                try {
-                    const markdown = await readFile(memeCatalogPath(config), "utf8");
-                    sendJson(response, 200, { families: parseMemeCatalog(markdown) });
-                }
-                catch {
-                    sendJson(response, 500, { error: "memes catalog unavailable" });
-                }
-                return true;
-            }
-            if (request.method === "POST" && url.pathname === "/api/web/send") {
-                const contentType = request.headers["content-type"] ?? "";
-                const isMultipart = Array.isArray(contentType)
-                    ? contentType.some((value) => value.includes("multipart/form-data"))
-                    : contentType.includes("multipart/form-data");
-                const body = isMultipart ? await readMultipartBody(request, contentType) : await readJsonBody(request);
-                const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
-                if (!isObject(body) || typeof body.text !== "string") {
-                    sendJson(response, 400, { error: "text is required" });
-                    return true;
-                }
-                if (!isMultipart && isObject(body) && Array.isArray(body.attachments) && body.attachments.length > 0) {
-                    sendJson(response, 400, { error: "attachments require multipart form data" });
-                    return true;
-                }
-                const rawAttachments = Array.isArray(body.attachments) ? body.attachments : [];
-                const attachments = await materializeInboundAttachments(config, rawAttachments
-                    .filter((attachment) => isWebUploadAttachment(attachment))
-                    .map((attachment) => ({ ...attachment, source: "web" })));
-                if (!body.text.trim() && attachments.length === 0) {
-                    sendJson(response, 400, { error: "text or attachment is required" });
-                    return true;
-                }
-                const id = messageId("user");
-                const ts = Date.now();
-                const input = {
-                    messageId: id,
-                    authorId: config.discord.ownerId,
-                    authorName: getContactNickname(WEB_USER_NAME),
-                    text: body.text,
-                    isBot: false,
-                    mentionedBot: true,
-                    remoteTimestamp: new Date(ts).toISOString(),
-                    checkpoint: { messageId: id },
-                    attachments,
-                };
-                await runtime.ingestInbound(input, { mode: "queue" });
-                void drainJobs(runtime).catch((error) => console.error("Web job drain failed", error));
-                sendJson(response, 200, { id, ts, channelKey: runtime.channelKey });
-                return true;
-            }
-            if (request.method === "POST" && url.pathname === "/api/web/agent/settings") {
-                const body = await readJsonBody(request);
-                const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
-                if (!isObject(body)) {
-                    sendJson(response, 400, { error: "body is required" });
-                    return true;
-                }
-                try {
-                    if (typeof body.model === "string")
-                        await familiarAgent.setModel(runtime.channelKey, body.model);
-                    if (typeof body.thinking === "string")
-                        await familiarAgent.setThinkingLevel(runtime.channelKey, body.thinking);
-                }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    sendJson(response, 400, { error: message });
-                    return true;
-                }
-                sendJson(response, 200, agentSettingsPayload(familiarAgent, runtime.channelKey, personaName));
-                return true;
-            }
-            if (request.method === "POST" && url.pathname === "/api/web/agent/new") {
-                const body = await readJsonBody(request);
-                const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
-                await familiarAgent.reset(runtime.channelKey);
-                await runtime.resetConversation("new conversation requested from web");
-                publish({
-                    type: "status",
-                    channelKey: runtime.channelKey,
-                    kind: "idle",
-                    detail: "started fresh from web",
-                });
-                sendJson(response, 200, { ok: true });
-                return true;
-            }
-            if (request.method === "POST" && url.pathname === "/api/web/control") {
-                const body = await readJsonBody(request);
-                const runtime = await getRuntime(getChannelKeyFromRequest(url, body));
-                if (!isObject(body) || typeof body.command !== "string") {
-                    sendJson(response, 400, { error: "command is required" });
-                    return true;
-                }
-                if (config.web.authMode === "public-2fa" && body.command === "login") {
-                    const token = isObject(body.args) && typeof body.args.token === "string" ? body.args.token : "";
-                    if (!config.web.totpSecret || !verifyTotp(config.web.totpSecret, token)) {
-                        sendJson(response, 401, { ok: false, message: "Invalid TOTP token." });
-                        return true;
-                    }
-                    const sessionId = auth.createSession();
-                    sendJson(response, 200, { ok: true, message: "Authenticated." }, { "set-cookie": sessionCookie(sessionId) });
-                    return true;
-                }
-                const args = commandArgs(body.command, body.args);
-                const input = {
-                    messageId: messageId("control"),
-                    authorId: config.discord.ownerId,
-                    authorName: getContactNickname(WEB_USER_NAME),
-                    text: `/${body.command}${args ? ` ${args}` : ""}`,
-                    isBot: false,
-                    mentionedBot: true,
-                    remoteTimestamp: new Date().toISOString(),
-                };
-                const control = runtime.parseControlCommand(input);
-                if (!control) {
-                    sendJson(response, 400, { ok: false, message: "Unsupported command." });
-                    return true;
-                }
-                await runtime.noteControlCommand(input, control);
-                const message = await applyControlCommand(runtime, control);
-                await runtime.noteOutbound({ text: message, messageIds: [], control: control.command });
-                sendJson(response, 200, { ok: true, message, channelKey: runtime.channelKey });
-                return true;
-            }
+            const handler = webRoutes.get(`${request.method} ${url.pathname}`);
+            // await is load-bearing: it keeps handler rejections inside this try so the catch maps HttpError to a status.
+            if (handler)
+                return await handler(request, response, url);
             sendJson(response, 404, { error: "not found" });
             return true;
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            sendJson(response, 500, { error: message });
+            const status = error instanceof HttpError ? error.status : 500;
+            const message = errorMessage(error);
+            sendJson(response, status, { error: message });
             return true;
         }
     };
@@ -1121,61 +613,13 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
             sendText(response, 404, "Not found");
         });
     });
-    server.on("upgrade", (request, socket) => {
-        const netSocket = socket;
-        const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
-        if (url.pathname !== "/api/web/stream" || !auth.authorize(request, url.pathname)) {
-            netSocket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
-            netSocket.destroy();
-            return;
-        }
-        const requestedChannelKey = url.searchParams.get("channelKey") || undefined;
-        void getRuntime(requestedChannelKey)
-            .then((runtime) => {
-            if (netSocket.destroyed)
-                return;
-            if (!acceptWebSocket(request, netSocket))
-                return;
-            netSocket.setNoDelay(true);
-            const client = { socket: netSocket, channelKey: runtime.channelKey, authed: false };
-            clients.add(client);
-            let frameBuffer = Buffer.alloc(0);
-            netSocket.on("data", (chunk) => {
-                try {
-                    frameBuffer = Buffer.concat([frameBuffer, chunk]);
-                    const decoded = decodeFrames(frameBuffer);
-                    frameBuffer = decoded.remaining;
-                    if (decoded.close)
-                        netSocket.destroy();
-                    for (const raw of decoded.messages) {
-                        const message = JSON.parse(raw);
-                        if (isObject(message) && message.type === "hello") {
-                            if (!client.channelKey)
-                                continue;
-                            replay(client, client.channelKey, typeof message.lastEventId === "string" ? message.lastEventId : null);
-                        }
-                        if (isObject(message) && message.type === "abort") {
-                            void getRuntime(client.channelKey).then(async (runtime) => {
-                                familiarAgent.requestSoftStop(runtime.channelKey);
-                            });
-                        }
-                    }
-                }
-                catch (error) {
-                    console.error("WebSocket frame handling failed", error);
-                    netSocket.destroy();
-                }
-            });
-            netSocket.on("close", () => clients.delete(client));
-            netSocket.on("error", () => clients.delete(client));
-        })
-            .catch((error) => {
-            console.error("WebSocket runtime lookup failed", error);
-            if (!netSocket.destroyed) {
-                netSocket.write("HTTP/1.1 503 Service Unavailable\r\n\r\n");
-                netSocket.destroy();
-            }
-        });
+    attachWebSocketStream(server, {
+        authorize: (request, pathname) => auth.authorize(request, pathname),
+        eventHub,
+        getRuntime,
+        abort: (runtime) => familiarAgent.abort(runtime.channelKey),
+        retry: retryLatestAssistant,
+        deleteLatest: deleteLatestAssistant,
     });
     await new Promise((resolveListen, rejectListen) => {
         server.once("error", rejectListen);
@@ -1188,22 +632,10 @@ export async function startWebDaemon(config, familiarAgent, discordDaemon, optio
     return {
         server,
         async stop() {
-            clearInterval(inFlightGcTimer);
-            for (const client of clients)
-                client.socket.destroy();
-            clients.clear();
-            for (const unsubscribe of runtimeSubscriptions.values())
-                unsubscribe();
-            runtimeSubscriptions.clear();
+            eventHub.stop();
             await new Promise((resolveClose, rejectClose) => {
                 server.close((error) => (error ? rejectClose(error) : resolveClose()));
             });
         },
     };
 }
-export const __webTest = {
-    memeCatalogPath,
-    parseMemeCatalog,
-    webHistoryPayload,
-    webMessagesFromRecords,
-};