@ulpi/cli 0.1.4 → 0.1.6

package/dist/chunk-2VYFVYJL.js

@@ -1,4273 +0,0 @@
-import {
-  getApiSecret,
-  validateAuth,
-  validateLoopback
-} from "./chunk-MIAQVCFW.js";
-import {
-  ReviewHub
-} from "./chunk-2MZER6ND.js";
-import {
-  ReviewConfigSchema,
-  buildAiScoringPrompt,
-  extractSections,
-  listPlansWithMeta,
-  loadPlan,
-  parseMarkdownToBlocks,
-  savePlan,
-  scorePlanQuality
-} from "./chunk-3SBPZRB5.js";
-import {
-  detectStack
-} from "./chunk-2CLNOKPA.js";
-import {
-  getDefaultProject,
-  getProject,
-  listProjects,
-  registerProject,
-  scanForProjects,
-  setDefaultProject,
-  unregisterProject
-} from "./chunk-SPOI23SB.js";
-import {
-  BUNDLED_SKILLS,
-  composeTemplates,
-  listUserTemplates,
-  loadBundledTemplates,
-  resolveTemplate
-} from "./chunk-6OCEY7JY.js";
-import {
-  ResponseConfigSchema,
-  loadRulesSync
-} from "./chunk-SIAQVRKG.js";
-import {
-  commitInWorktree,
-  historyBranchExists,
-  initHistoryBranch,
-  readBranchMeta,
-  readHistoryEntry,
-  readTimeline,
-  updateEntryEnrichment,
-  withWorktree,
-  writeAndStage
-} from "./chunk-JGBXM5NC.js";
-import {
-  JsonSessionStore,
-  readEvents
-} from "./chunk-YM2HV4IA.js";
-import {
-  CLI_BIN_NAME,
-  DEFAULT_AI_MODEL,
-  GUARDS_FILENAME,
-  REVIEW_IMAGES_DIR,
-  VERSION_CACHE_FILE,
-  getApiPort,
-  getBinaryPath,
-  getCodemapBranch,
-  getCurrentBranch,
-  getHistoryBranch,
-  globalGuardsFile,
-  loadUlpiSettings,
-  projectConfigDir,
-  projectGuardsFile,
-  resolveApiKey,
-  resolveUlpiUrl,
-  saveUlpiSettings
-} from "./chunk-7LXY5UVC.js";
-
-// ../api/dist/chunk-P4BERD2G.js
-import * as http from "http";
-import * as fs12 from "fs";
-import * as path9 from "path";
-import * as fs from "fs";
-import * as path from "path";
-import { fileURLToPath } from "url";
-import * as fs3 from "fs";
-import * as fs2 from "fs";
-import { stringify as stringifyYaml } from "yaml";
-import * as fs4 from "fs";
-import { parse as parseYaml, stringify as stringifyYaml2 } from "yaml";
-import * as fs5 from "fs";
-import * as path2 from "path";
-import * as os from "os";
-import * as fs6 from "fs";
-import * as path3 from "path";
-import * as fs7 from "fs";
-import * as path4 from "path";
-import * as fs8 from "fs";
-import * as path5 from "path";
-import { spawn } from "child_process";
-import { spawn as spawn2, execFileSync } from "child_process";
-import * as crypto from "crypto";
-import * as fs9 from "fs";
-import * as path6 from "path";
-import { resolve4 as resolve42, resolve6 } from "dns/promises";
-import * as fs11 from "fs";
-import * as path8 from "path";
-import { execFileSync as execFileSync3 } from "child_process";
-import { execFileSync as execFileSync2, spawn as spawn3 } from "child_process";
-import * as fs10 from "fs";
-import * as os2 from "os";
-import * as path7 from "path";
-function getAllowedOrigin(req) {
-  const origin = req.headers.origin;
-  if (origin && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) {
-    return origin;
-  }
-  return `http://localhost:${getApiPort()}`;
-}
-function handleCorsPreFlight(req, res) {
-  if ((req.method ?? "GET") !== "OPTIONS") return false;
-  res.writeHead(204, {
-    "Access-Control-Allow-Origin": getAllowedOrigin(req),
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end();
-  return true;
-}
-var store = /* @__PURE__ */ new Map();
-var CLEANUP_INTERVAL = 6e4;
-setInterval(() => {
-  const now = Date.now();
-  for (const [key, entry] of store) {
-    if (now >= entry.resetAt) {
-      store.delete(key);
-    }
-  }
-}, CLEANUP_INTERVAL).unref();
-function checkRateLimit(ip, limit = 200, windowMs = 6e4) {
-  const now = Date.now();
-  const entry = store.get(ip);
-  if (!entry || now >= entry.resetAt) {
-    store.set(ip, { count: 1, resetAt: now + windowMs });
-    return true;
-  }
-  entry.count++;
-  return entry.count <= limit;
-}
-function getCorsOrigin(req) {
-  if (req) {
-    const origin = req.headers.origin;
-    if (origin && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) {
-      return origin;
-    }
-  }
-  return `http://localhost:${getApiPort()}`;
-}
-function corsHeaders(req) {
-  return {
-    "Access-Control-Allow-Origin": getCorsOrigin(req),
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  };
-}
-function jsonResponse(res, data, status = 200, req) {
-  const body = JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    ...corsHeaders(req)
-  });
-  res.end(body);
-}
-function notFound(res, message = "Not found", req) {
-  jsonResponse(res, { error: message }, 404, req);
-}
-function sseHeaders(res, req) {
-  res.writeHead(200, {
-    "Content-Type": "text/event-stream",
-    "Cache-Control": "no-cache",
-    Connection: "keep-alive",
-    ...corsHeaders(req)
-  });
-}
-function createRouter() {
-  const routes = [];
-  function add(method, pattern, handler) {
-    routes.push({ method, pattern, handler });
-  }
-  return {
-    get(pattern, handler) {
-      add("GET", pattern, handler);
-    },
-    post(pattern, handler) {
-      add("POST", pattern, handler);
-    },
-    put(pattern, handler) {
-      add("PUT", pattern, handler);
-    },
-    delete(pattern, handler) {
-      add("DELETE", pattern, handler);
-    },
-    /**
-     * Try each registered route in order. For string patterns, performs an
-     * exact match against `ctx.pathname`. For RegExp patterns, tests the
-     * pathname and extracts named groups (or positional captures indexed by
-     * their number) into `params`.
-     *
-     * Returns `true` if a matching route was found (and its handler was
-     * invoked), `false` otherwise.
-     */
-    async handle(ctx) {
-      for (const route of routes) {
-        if (route.method !== ctx.method) continue;
-        let params = {};
-        if (typeof route.pattern === "string") {
-          if (ctx.pathname !== route.pattern) continue;
-        } else {
-          const match = route.pattern.exec(ctx.pathname);
-          if (!match) continue;
-          if (match.groups) {
-            params = { ...match.groups };
-          }
-          for (let i = 1; i < match.length; i++) {
-            if (match[i] !== void 0) {
-              params[String(i)] = decodeURIComponent(match[i]);
-            }
-          }
-        }
-        await route.handler({ ...ctx, params });
-        return true;
-      }
-      return false;
-    }
-  };
-}
-function readBody(req, maxSize = 1048576) {
-  return new Promise((resolve7, reject) => {
-    const chunks = [];
-    let size = 0;
-    req.on("data", (chunk) => {
-      size += chunk.length;
-      if (size > maxSize) {
-        req.destroy();
-        reject(new Error("Request body too large"));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => resolve7(Buffer.concat(chunks).toString("utf-8")));
-    req.on("error", reject);
-  });
-}
-function readBodyRaw(req, maxSize = 5 * 1024 * 1024) {
-  return new Promise((resolve7, reject) => {
-    const chunks = [];
-    let size = 0;
-    req.on("data", (chunk) => {
-      size += chunk.length;
-      if (size > maxSize) {
-        req.destroy();
-        reject(new Error("Request body too large"));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => resolve7(Buffer.concat(chunks)));
-    req.on("error", reject);
-  });
-}
-async function parseJsonBody(req) {
-  try {
-    const raw = await readBody(req);
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      return { data: null, error: "Expected a JSON object" };
-    }
-    return { data: parsed, error: null };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Invalid JSON body";
-    return { data: null, error: message };
-  }
-}
-function parseMultipartImage(body, boundary) {
-  const boundaryBuffer = Buffer.from(`--${boundary}`);
-  const start = body.indexOf(boundaryBuffer);
-  if (start === -1) return null;
-  const headerEnd = body.indexOf(Buffer.from("\r\n\r\n"), start);
-  if (headerEnd === -1) return null;
-  const headers = body.subarray(start + boundaryBuffer.length + 2, headerEnd).toString();
-  const ctMatch = headers.match(/Content-Type:\s*(.+)/i);
-  const contentType = ctMatch ? ctMatch[1].trim() : "image/png";
-  const dataStart = headerEnd + 4;
-  const nextBoundary = body.indexOf(boundaryBuffer, dataStart);
-  const dataEnd = nextBoundary !== -1 ? nextBoundary - 2 : body.length;
-  return { data: body.subarray(dataStart, dataEnd), contentType };
-}
-var apiVersion = "0.0.0";
-try {
-  const thisFile = fileURLToPath(import.meta.url);
-  const pkgPath = path.resolve(path.dirname(thisFile), "../package.json");
-  const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-  if (typeof pkg.version === "string") apiVersion = pkg.version;
-} catch {
-}
-async function healthHandler(ctx) {
-  let version = "0.0.0";
-  try {
-    version = globalThis.__ULPI_API_VERSION__ ?? "0.0.0";
-  } catch {
-  }
-  jsonResponse(ctx.res, { status: "ok", version }, 200, ctx.req);
-}
-async function versionHandler(ctx) {
-  const current = apiVersion;
-  let latest = current;
-  let updateAvailable = false;
-  try {
-    if (fs.existsSync(VERSION_CACHE_FILE)) {
-      const raw = fs.readFileSync(VERSION_CACHE_FILE, "utf-8");
-      const cache = JSON.parse(raw);
-      if (typeof cache.latest === "string" && /^\d+\.\d+\.\d+/.test(cache.latest)) {
-        latest = cache.latest;
-        const a = current.split(".").map(Number);
-        const b = latest.split(".").map(Number);
-        for (let i = 0; i < 3; i++) {
-          if ((b[i] ?? 0) > (a[i] ?? 0)) {
-            updateAvailable = true;
-            break;
-          }
-          if ((b[i] ?? 0) < (a[i] ?? 0)) break;
-        }
-      }
-    }
-  } catch {
-  }
-  jsonResponse(ctx.res, { current, latest, updateAvailable }, 200, ctx.req);
-}
-async function pathsHandler(ctx) {
-  const home = process.env.HOME || process.env.USERPROFILE || "";
-  const suggestions = [];
-  if (home) {
-    suggestions.push(home);
-    suggestions.push(path.join(home, "projects"));
-    suggestions.push(path.join(home, "work"));
-    suggestions.push(path.join(home, "dev"));
-  }
-  try {
-    suggestions.push(process.cwd());
-  } catch {
-  }
-  const unique = [...new Set(suggestions)];
-  jsonResponse(ctx.res, { home, cwd: process.cwd(), suggestions: unique }, 200, ctx.req);
-}
-async function getUsernameSettings(ctx) {
-  const settings = loadUlpiSettings();
-  const branch = getCurrentBranch(ctx.projectDir);
-  jsonResponse(ctx.res, {
-    username: settings.username ?? "",
-    resolvedCodemapBranch: getCodemapBranch(branch),
-    resolvedHistoryBranch: getHistoryBranch()
-  }, 200, ctx.req);
-}
-async function putUsernameSettings(ctx) {
-  const body = await readBody(ctx.req);
-  let data;
-  try {
-    data = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  if (typeof data.username !== "string" && data.username !== void 0) {
-    jsonResponse(ctx.res, { error: "username must be a string" }, 400, ctx.req);
-    return;
-  }
-  const username = typeof data.username === "string" ? data.username.trim() : void 0;
-  if (username && (username.length > 64 || !/^[a-zA-Z0-9_-]+$/.test(username))) {
-    jsonResponse(ctx.res, { error: "username must be alphanumeric with hyphens/underscores, max 64 chars" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const settings = loadUlpiSettings();
-    settings.username = username || void 0;
-    saveUlpiSettings(settings);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update settings";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-    return;
-  }
-  const branch = getCurrentBranch(ctx.projectDir);
-  jsonResponse(ctx.res, {
-    success: true,
-    username: username ?? "",
-    resolvedCodemapBranch: getCodemapBranch(branch),
-    resolvedHistoryBranch: getHistoryBranch()
-  }, 200, ctx.req);
-}
-function yamlEscapeString(s) {
-  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-function writeYamlFields(obj, lines, indent) {
-  const pad = " ".repeat(indent);
-  for (const [k, v] of Object.entries(obj)) {
-    if (k === "id" || k === "type" || k === "source") continue;
-    if (typeof v === "string") {
-      lines.push(`${pad}${k}: "${yamlEscapeString(v)}"`);
-    } else if (typeof v === "boolean" || typeof v === "number") {
-      lines.push(`${pad}${k}: ${v}`);
-    } else if (Array.isArray(v)) {
-      lines.push(`${pad}${k}:`);
-      for (const item of v) {
-        if (typeof item === "string") {
-          lines.push(`${pad}  - "${yamlEscapeString(item)}"`);
-        } else if (item && typeof item === "object") {
-          const entries = Object.entries(item);
-          if (entries.length > 0) {
-            const [firstKey, firstVal] = entries[0];
-            lines.push(`${pad}  - ${firstKey}: ${formatScalar(firstVal)}`);
-            for (let i = 1; i < entries.length; i++) {
-              const [ek, ev] = entries[i];
-              lines.push(`${pad}    ${ek}: ${formatScalar(ev)}`);
-            }
-          }
-        }
-      }
-    }
-  }
-}
-function formatScalar(v) {
-  if (typeof v === "string") return `"${yamlEscapeString(v)}"`;
-  if (typeof v === "boolean" || typeof v === "number") return String(v);
-  return `"${String(v)}"`;
-}
-function writeRulesConfig(rulesPath, config) {
-  const lines = [
-    "# ULPI \u2014 Rules Configuration",
-    "# Generated via Web UI",
-    "",
-    "project:",
-    `  name: "${yamlEscapeString(config.project.name)}"`,
-    `  runtime: "${yamlEscapeString(config.project.runtime)}"`,
-    `  package_manager: "${yamlEscapeString(config.project.package_manager)}"`,
-    ""
-  ];
-  const sections = [
-    "preconditions",
-    "postconditions",
-    "permissions",
-    "pipelines"
-  ];
-  for (const section of sections) {
-    const data = config[section];
-    if (data && Object.keys(data).length > 0) {
-      lines.push(`${section}:`);
-      for (const [key, rule] of Object.entries(data)) {
-        lines.push(`  ${key}:`);
-        writeYamlFields(rule, lines, 4);
-      }
-      lines.push("");
-    }
-  }
-  if (config.responses) {
-    const responsesYaml = stringifyYaml(
-      { responses: config.responses },
-      { lineWidth: 120 }
-    );
-    lines.push(responsesYaml.trimEnd());
-    lines.push("");
-  }
-  fs2.writeFileSync(rulesPath, lines.join("\n") + "\n", "utf-8");
-}
-function getRulesPath(projectDir) {
-  const projectPath = projectGuardsFile(projectDir);
-  if (fs3.existsSync(projectPath)) return projectPath;
-  const userPath = globalGuardsFile();
-  if (fs3.existsSync(userPath)) return userPath;
-  return null;
-}
-function flattenRules(config) {
-  const result = [];
-  const sections = [
-    { name: "preconditions", rules: config.preconditions },
-    { name: "postconditions", rules: config.postconditions },
-    { name: "permissions", rules: config.permissions },
-    { name: "pipelines", rules: config.pipelines }
-  ];
-  for (const section of sections) {
-    for (const [id, rule] of Object.entries(section.rules)) {
-      result.push({ id, section: section.name, ...rule });
-    }
-  }
-  return result;
-}
-async function listRulesHandler(ctx) {
-  const rulesPath = getRulesPath(ctx.projectDir);
-  if (!rulesPath) {
-    jsonResponse(ctx.res, [], 200, ctx.req);
-    return;
-  }
-  const config = loadRulesSync(rulesPath);
-  if (!config) {
-    jsonResponse(ctx.res, [], 200, ctx.req);
-    return;
-  }
-  jsonResponse(ctx.res, flattenRules(config), 200, ctx.req);
-}
-async function createRuleHandler(ctx) {
-  const body = await readBody(ctx.req);
-  let ruleData;
-  try {
-    ruleData = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  if (typeof ruleData.type !== "string" || !ruleData.type) {
-    jsonResponse(ctx.res, { error: "Missing or invalid required field: type" }, 400, ctx.req);
-    return;
-  }
-  const ruleType = ruleData.type;
-  const ruleId = typeof ruleData.id === "string" && ruleData.id ? ruleData.id : typeof ruleData.matcher === "string" && ruleData.matcher ? `${ruleType}-${ruleData.matcher.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "")}` : "";
-  if (!ruleId) {
-    jsonResponse(ctx.res, { error: "Missing required field: id or matcher (for auto-generated id)" }, 400, ctx.req);
-    return;
-  }
-  const validTypes = ["precondition", "postcondition", "permission", "pipeline"];
-  if (!validTypes.includes(ruleType)) {
-    jsonResponse(ctx.res, { error: `Invalid rule type: ${ruleType}` }, 400, ctx.req);
-    return;
-  }
-  const rulesPath = projectGuardsFile(ctx.projectDir);
-  if (!fs3.existsSync(rulesPath)) {
-    jsonResponse(ctx.res, { error: "guards.yml not found. Run init first." }, 404, ctx.req);
-    return;
-  }
-  const config = loadRulesSync(rulesPath);
-  if (!config) {
-    jsonResponse(ctx.res, { error: "Failed to load guards.yml" }, 500, ctx.req);
-    return;
-  }
-  const sectionKey = `${ruleType}s`;
-  if (config[sectionKey][ruleId]) {
-    jsonResponse(ctx.res, { error: `Rule "${ruleId}" already exists in ${sectionKey}` }, 409, ctx.req);
-    return;
-  }
-  const { id: _, type: __, ...ruleFields } = ruleData;
-  const newRule = {
-    enabled: true,
-    trigger: "PreToolUse",
-    matcher: "*",
-    ...ruleFields
-  };
-  config[sectionKey][ruleId] = newRule;
-  writeRulesConfig(rulesPath, config);
-  const createdRule = config[sectionKey][ruleId];
-  jsonResponse(ctx.res, { id: ruleId, section: sectionKey, ...createdRule }, 201, ctx.req);
-}
-async function getRuleHandler(ctx) {
-  const ruleId = ctx.params["1"];
-  const rulesPath = getRulesPath(ctx.projectDir);
-  if (!rulesPath) {
-    jsonResponse(ctx.res, { error: `Rule "${ruleId}" not found` }, 404, ctx.req);
-    return;
-  }
-  const config = loadRulesSync(rulesPath);
-  if (!config) {
-    jsonResponse(ctx.res, { error: `Rule "${ruleId}" not found` }, 404, ctx.req);
-    return;
-  }
-  const sections = ["preconditions", "postconditions", "permissions", "pipelines"];
-  for (const section of sections) {
-    if (config[section][ruleId]) {
-      const rule = config[section][ruleId];
-      jsonResponse(ctx.res, { id: ruleId, section, ...rule }, 200, ctx.req);
-      return;
-    }
-  }
-  jsonResponse(ctx.res, { error: `Rule "${ruleId}" not found` }, 404, ctx.req);
-}
-async function toggleRuleHandler(ctx) {
-  const ruleId = ctx.params["1"];
-  let explicitEnabled;
-  try {
-    const body = await readBody(ctx.req);
-    if (body.trim()) {
-      const parsed = JSON.parse(body);
-      if (typeof parsed.enabled === "boolean") {
-        explicitEnabled = parsed.enabled;
-      }
-    }
-  } catch {
-  }
-  const rulesPath = projectGuardsFile(ctx.projectDir);
-  if (!fs3.existsSync(rulesPath)) {
-    jsonResponse(ctx.res, { error: "guards.yml not found" }, 404, ctx.req);
-    return;
-  }
-  const config = loadRulesSync(rulesPath);
-  if (!config) {
-    jsonResponse(ctx.res, { error: "Failed to load guards.yml" }, 500, ctx.req);
-    return;
-  }
-  const sections = ["preconditions", "postconditions", "permissions", "pipelines"];
-  let foundRule = null;
-  for (const section of sections) {
-    if (config[section][ruleId]) {
-      foundRule = config[section][ruleId];
-      break;
-    }
-  }
-  if (!foundRule) {
-    jsonResponse(ctx.res, { error: `Rule "${ruleId}" not found` }, 404, ctx.req);
-    return;
-  }
-  const newEnabled = explicitEnabled ?? !(foundRule.enabled ?? true);
-  foundRule.enabled = newEnabled;
-  writeRulesConfig(rulesPath, config);
-  jsonResponse(ctx.res, { success: true, id: ruleId, enabled: newEnabled }, 200, ctx.req);
-}
-async function updateRuleHandler(ctx) {
-  const ruleId = ctx.params["1"];
-  const body = await readBody(ctx.req);
-  let ruleData;
-  try {
-    ruleData = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const rulesPath = projectGuardsFile(ctx.projectDir);
-  if (!fs3.existsSync(rulesPath)) {
-    jsonResponse(ctx.res, { error: "guards.yml not found" }, 404, ctx.req);
-    return;
-  }
-  const config = loadRulesSync(rulesPath);
-  if (!config) {
-    jsonResponse(ctx.res, { error: "Failed to load guards.yml" }, 500, ctx.req);
-    return;
-  }
-  const sections = ["preconditions", "postconditions", "permissions", "pipelines"];
-  let foundSection = null;
-  let foundRule = null;
-  for (const section of sections) {
-    if (config[section][ruleId]) {
-      foundSection = section;
-      foundRule = config[section][ruleId];
-      break;
-    }
-  }
-  if (!foundSection || !foundRule) {
-    jsonResponse(ctx.res, { error: `Rule "${ruleId}" not found` }, 404, ctx.req);
-    return;
-  }
-  if (foundRule.locked) {
-    jsonResponse(ctx.res, { error: `Rule "${ruleId}" is locked and cannot be edited` }, 403, ctx.req);
-    return;
-  }
-  const updatedRule = {
-    ...foundRule,
-    ...ruleData,
-    locked: foundRule.locked,
-    // Preserve locked status
-    id: ruleId
-  };
-  config[foundSection][ruleId] = updatedRule;
-  writeRulesConfig(rulesPath, config);
-  jsonResponse(ctx.res, { success: true, rule: updatedRule }, 200, ctx.req);
-}
-async function deleteRuleHandler(ctx) {
-  const ruleId = ctx.params["1"];
-  const rulesPath = projectGuardsFile(ctx.projectDir);
-  if (!fs3.existsSync(rulesPath)) {
-    jsonResponse(ctx.res, { error: "guards.yml not found" }, 404, ctx.req);
-    return;
-  }
-  const config = loadRulesSync(rulesPath);
-  if (!config) {
-    jsonResponse(ctx.res, { error: "Failed to load guards.yml" }, 500, ctx.req);
-    return;
-  }
-  const sections = ["preconditions", "postconditions", "permissions", "pipelines"];
-  let deleted = false;
-  for (const section of sections) {
-    if (config[section][ruleId]) {
-      const rule = config[section][ruleId];
-      if (rule.locked) {
-        jsonResponse(ctx.res, { error: `Rule "${ruleId}" is locked and cannot be deleted` }, 403, ctx.req);
-        return;
-      }
-      delete config[section][ruleId];
-      deleted = true;
-      break;
-    }
-  }
-  if (!deleted) {
-    jsonResponse(ctx.res, { error: `Rule "${ruleId}" not found` }, 404, ctx.req);
-    return;
-  }
-  writeRulesConfig(rulesPath, config);
-  jsonResponse(ctx.res, { success: true, id: ruleId }, 200, ctx.req);
-}
-function getRulesPath2(projectDir) {
-  const projectPath = projectGuardsFile(projectDir);
-  if (fs4.existsSync(projectPath)) return projectPath;
-  const userPath = globalGuardsFile();
-  if (fs4.existsSync(userPath)) return userPath;
-  return null;
-}
-async function getResponsesHandler(ctx) {
-  const rulesPath = getRulesPath2(ctx.projectDir);
-  if (!rulesPath) {
-    jsonResponse(ctx.res, { dedup_window_seconds: 5 }, 200, ctx.req);
-    return;
-  }
-  const config = loadRulesSync(rulesPath);
-  jsonResponse(ctx.res, config?.responses ?? { dedup_window_seconds: 5 }, 200, ctx.req);
-}
-async function updateResponsesHandler(ctx) {
-  const rulesPath = projectGuardsFile(ctx.projectDir);
-  if (!fs4.existsSync(rulesPath)) {
-    jsonResponse(ctx.res, { error: "guards.yml not found. Run init first." }, 404, ctx.req);
-    return;
-  }
-  const body = await readBody(ctx.req);
-  let responsesData;
-  try {
-    responsesData = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const validation = ResponseConfigSchema.safeParse(responsesData);
-  if (!validation.success) {
-    const errors = validation.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-    jsonResponse(ctx.res, { error: `Validation failed: ${errors}` }, 400, ctx.req);
-    return;
-  }
-  try {
-    const rawYaml = fs4.readFileSync(rulesPath, "utf-8");
-    const doc = parseYaml(rawYaml) ?? {};
-    doc.responses = validation.data;
-    const updatedYaml = stringifyYaml2(doc, { lineWidth: 120 });
-    fs4.writeFileSync(rulesPath, updatedYaml, "utf-8");
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update guards.yml";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-    return;
-  }
-  jsonResponse(ctx.res, { success: true, responses: validation.data }, 200, ctx.req);
-}
-async function listTemplatesHandler(ctx) {
-  const bundled = loadBundledTemplates();
-  const user = listUserTemplates();
-  jsonResponse(ctx.res, { bundled, user }, 200, ctx.req);
-}
-function parseSkillHeader(filePath, fallbackId) {
-  try {
-    const content = fs5.readFileSync(filePath, "utf-8");
-    const lines = content.split("\n");
-    let name = fallbackId;
-    let description = "";
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      if (trimmed.startsWith("# ") && name === fallbackId) {
-        name = trimmed.slice(2).trim();
-        continue;
-      }
-      if (name !== fallbackId && !trimmed.startsWith("#")) {
-        description = trimmed.slice(0, 200);
-        break;
-      }
-    }
-    return { name, description };
-  } catch {
-    return { name: fallbackId, description: "" };
-  }
-}
-function scanSkillsDirectory(dir, source, skills, seen) {
-  if (!fs5.existsSync(dir)) return;
-  let entries;
-  try {
-    entries = fs5.readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const skillDir = path2.join(dir, entry.name);
-    const skillMd = path2.join(skillDir, "SKILL.md");
-    if (!fs5.existsSync(skillMd)) continue;
-    const id = entry.name;
-    if (seen.has(id)) continue;
-    seen.add(id);
-    const { name, description } = parseSkillHeader(skillMd, id);
-    skills.push({
-      id,
-      name,
-      description,
-      filename: path2.relative(dir, skillMd),
-      source,
-      tags: [source]
-    });
-  }
-}
-function collectAllSkills(projectDir) {
-  const skills = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const s of BUNDLED_SKILLS) {
-    skills.push({
-      id: s.id,
-      name: s.name,
-      description: s.description,
-      filename: s.filename,
-      source: "bundled",
-      tags: [s.category]
-    });
-    seen.add(s.id);
-  }
-  const localSkillsDir = path2.join(projectDir, ".claude", "skills");
-  scanSkillsDirectory(localSkillsDir, "project", skills, seen);
-  const globalSkillsDir = path2.join(os.homedir(), ".claude", "skills");
-  scanSkillsDirectory(globalSkillsDir, "global", skills, seen);
-  return skills;
-}
-async function listSkillsHandler(ctx) {
-  const allSkills = collectAllSkills(ctx.projectDir);
-  jsonResponse(ctx.res, allSkills, 200, ctx.req);
-}
-function installHooksForProject(projectDir) {
-  const settingsDir = path3.join(projectDir, ".claude");
-  const settingsPath = path3.join(settingsDir, "settings.local.json");
-  let settings = {};
-  if (fs6.existsSync(settingsPath)) {
-    try {
-      settings = JSON.parse(fs6.readFileSync(settingsPath, "utf-8"));
-    } catch {
-    }
-  }
-  const binary = getBinaryPath();
-  const hookEvents = {
-    PreToolUse: "pre-tool",
-    PostToolUse: "post-tool",
-    PermissionRequest: "permission",
-    Notification: "notification",
-    Stop: "stop",
-    SessionStart: "session-start",
-    SessionEnd: "session-end"
-  };
-  settings.hooks = settings.hooks ?? {};
-  for (const [event, handler] of Object.entries(hookEvents)) {
-    const hookCommand = `${binary} ${handler}`;
-    const existing = settings.hooks[event] ?? [];
-    const alreadyInstalled = existing.some(
-      (h) => h.hooks.some((cmd) => {
-        const cmdStr = typeof cmd === "string" ? cmd : cmd.command;
-        return cmdStr.includes(CLI_BIN_NAME);
-      })
-    );
-    if (!alreadyInstalled) {
-      existing.push({
-        matcher: "",
-        hooks: [{ type: "command", command: hookCommand }]
-      });
-      settings.hooks[event] = existing;
-    }
-  }
-  fs6.mkdirSync(settingsDir, { recursive: true });
-  fs6.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
-}
-async function listProjectsHandler(ctx) {
-  const projects = listProjects().map((p) => {
-    const rulesPath = projectGuardsFile(p.path);
-    const configStatus = fs6.existsSync(rulesPath) ? "configured" : "none";
-    return { ...p, configStatus };
-  });
-  const defaultEntry = getDefaultProject();
-  jsonResponse(ctx.res, { projects, defaultProject: defaultEntry?.id }, 200, ctx.req);
-}
-async function registerProjectHandler(ctx) {
-  const body = await readBody(ctx.req);
-  let projectPath;
-  try {
-    const parsed = JSON.parse(body);
-    projectPath = parsed.path;
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  if (!projectPath) {
-    jsonResponse(ctx.res, { error: "Missing required field: path" }, 400, ctx.req);
-    return;
-  }
-  const absPath = path3.resolve(projectPath);
-  if (!fs6.existsSync(absPath)) {
-    jsonResponse(ctx.res, { error: `Path does not exist: ${absPath}` }, 400, ctx.req);
-    return;
-  }
-  try {
-    const stats = fs6.statSync(absPath);
-    if (!stats.isDirectory()) {
-      jsonResponse(ctx.res, { error: `Path is not a directory: ${absPath}` }, 400, ctx.req);
-      return;
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to stat path";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-    return;
-  }
-  try {
-    const project = registerProject(absPath);
-    jsonResponse(ctx.res, { success: true, project }, 201, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to register project";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function setDefaultProjectHandler(ctx) {
-  const body = await readBody(ctx.req);
-  let projectId;
-  try {
-    const parsed = JSON.parse(body);
-    projectId = parsed.id;
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  if (!projectId) {
-    jsonResponse(ctx.res, { error: "Missing required field: id" }, 400, ctx.req);
-    return;
-  }
-  const entry = getProject(projectId);
-  if (!entry) {
-    jsonResponse(ctx.res, { error: `Project not found: ${projectId}` }, 404, ctx.req);
-    return;
-  }
-  setDefaultProject(projectId);
-  jsonResponse(ctx.res, { success: true, defaultProject: projectId }, 200, ctx.req);
-}
-async function scanProjectsHandler(ctx) {
-  const body = await readBody(ctx.req);
-  let rootDir;
-  let maxDepth = 3;
-  try {
-    const parsed = JSON.parse(body);
-    rootDir = parsed.rootDir;
-    if (typeof parsed.maxDepth === "number") {
-      maxDepth = parsed.maxDepth;
-    }
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  if (!rootDir) {
-    jsonResponse(ctx.res, { error: "Missing required field: rootDir" }, 400, ctx.req);
-    return;
-  }
-  const absRootDir = path3.resolve(rootDir);
-  if (!fs6.existsSync(absRootDir)) {
-    jsonResponse(ctx.res, { error: `Root directory does not exist: ${absRootDir}` }, 400, ctx.req);
-    return;
-  }
-  try {
-    const discoveredPaths = scanForProjects(absRootDir, maxDepth);
-    let registered = 0;
-    for (const pPath of discoveredPaths) {
-      const existingProjects = listProjects();
-      const alreadyRegistered = existingProjects.some((p) => p.path === pPath);
-      if (!alreadyRegistered) {
-        registerProject(pPath);
-        registered++;
-      }
-    }
-    jsonResponse(ctx.res, { success: true, projects: discoveredPaths, registered }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to scan for projects";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function getProjectHandler(ctx) {
-  const projectId = ctx.params["1"];
-  const entry = getProject(projectId);
-  if (!entry) {
-    jsonResponse(ctx.res, { error: `Project not found: ${projectId}` }, 404, ctx.req);
-    return;
-  }
-  const rulesPath = projectGuardsFile(entry.path);
-  const configStatus = fs6.existsSync(rulesPath) ? "configured" : "none";
-  const defaultEntry = getDefaultProject();
-  jsonResponse(ctx.res, { ...entry, configStatus, isDefault: entry.id === defaultEntry?.id }, 200, ctx.req);
-}
-async function updateProjectHandler(ctx) {
-  const projectId = ctx.params["1"];
-  const project = getProject(projectId);
-  if (!project) {
-    jsonResponse(ctx.res, { error: `Project not found: ${projectId}` }, 404, ctx.req);
-    return;
-  }
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const newName = typeof payload.name === "string" ? payload.name.trim() : void 0;
-  if (newName !== void 0 && newName.length === 0) {
-    jsonResponse(ctx.res, { error: "Name cannot be empty" }, 400, ctx.req);
-    return;
-  }
-  const updated = registerProject(project.path, {
-    name: newName ?? project.name,
-    hooksInstalled: project.hooksInstalled,
-    configStatus: project.configStatus,
-    stack: project.stack
-  });
-  jsonResponse(ctx.res, { success: true, project: updated }, 200, ctx.req);
-}
-async function deleteProjectHandler(ctx) {
-  const projectId = ctx.params["1"];
-  const deleted = unregisterProject(projectId);
-  if (!deleted) {
-    jsonResponse(ctx.res, { error: `Project not found: ${projectId}` }, 404, ctx.req);
-    return;
-  }
-  jsonResponse(ctx.res, { success: true, projectId }, 200, ctx.req);
-}
-async function initProjectHandler(ctx) {
-  const projectId = ctx.params["1"];
-  const entry = getProject(projectId);
-  if (!entry) {
-    jsonResponse(ctx.res, { error: `Project not found: ${projectId}` }, 404, ctx.req);
-    return;
-  }
-  const targetDir = entry.path;
-  const stack = detectStack(targetDir);
-  const allTemplates = loadBundledTemplates();
-  const selected = allTemplates.filter((t) => {
-    if (t.id === "quality-of-life") return true;
-    for (const det of [
-      stack.runtime,
-      stack.language,
-      stack.packageManager,
-      stack.framework,
-      stack.formatter,
-      stack.linter,
-      stack.testRunner,
-      stack.orm,
-      stack.gitWorkflow
-    ]) {
-      if (det && det.id === t.id) return true;
-    }
-    return false;
-  });
-  const composed = composeTemplates(selected);
-  const config = {
-    name: path3.basename(targetDir),
-    runtime: stack.runtime?.id ?? "unknown",
-    language: stack.language?.id,
-    framework: stack.framework?.id,
-    package_manager: stack.packageManager?.id ?? "npm",
-    orm: stack.orm?.id,
-    test_runner: stack.testRunner?.id,
-    formatter: stack.formatter?.id,
-    linter: stack.linter?.id,
-    git_workflow: stack.gitWorkflow?.id
-  };
-  const resolved = resolveTemplate(composed, config);
-  const rulesDir = projectConfigDir(targetDir);
-  fs6.mkdirSync(rulesDir, { recursive: true });
-  const rulesConfig = {
-    project: config,
-    preconditions: resolved.preconditions ?? {},
-    postconditions: resolved.postconditions ?? {},
-    permissions: resolved.permissions ?? {},
-    pipelines: resolved.pipelines ?? {}
-  };
-  writeRulesConfig(path3.join(rulesDir, GUARDS_FILENAME), rulesConfig);
-  installHooksForProject(targetDir);
-  registerProject(targetDir);
-  jsonResponse(ctx.res, { success: true, projectId, rulesCount: selected.length }, 200, ctx.req);
-}
-function findLatestSession(store2) {
-  const ids = store2.list();
-  if (ids.length === 0) return null;
-  let latest = null;
-  let latestTime = -Infinity;
-  let latestActive = null;
-  let latestActiveTime = -Infinity;
-  for (const id of ids) {
-    const s = store2.load(id);
-    if (!s) continue;
-    const t = new Date(s.startedAt).getTime();
-    if (t > latestTime) {
-      latestTime = t;
-      latest = s;
-    }
-    const hasActivity = s.filesRead.length > 0 || s.filesWritten.length > 0 || s.commandsRun.length > 0 || s.rulesEnforced > 0;
-    if (hasActivity && t > latestActiveTime) {
-      latestActiveTime = t;
-      latestActive = s;
-    }
-  }
-  return latestActive ?? latest;
-}
-async function sessionsListHandler(ctx) {
-  const store2 = new JsonSessionStore();
-  const ids = store2.list();
-  const active = [];
-  const empty = [];
-  for (const id of ids) {
-    const s = store2.load(id);
-    if (!s) continue;
-    const summary = {
-      sessionId: s.sessionId,
-      startedAt: s.startedAt,
-      projectDir: s.projectDir,
-      sessionName: s.sessionName,
-      filesRead: s.filesRead.length,
-      filesWritten: s.filesWritten.length,
-      commandsRun: s.commandsRun.length,
-      rulesEnforced: s.rulesEnforced,
-      actionsBlocked: s.actionsBlocked
-    };
-    const hasActivity = s.filesRead.length > 0 || s.filesWritten.length > 0 || s.commandsRun.length > 0 || s.rulesEnforced > 0;
-    if (hasActivity) {
-      active.push(summary);
-    } else {
-      empty.push(summary);
-    }
-  }
-  empty.sort(
-    (a, b) => new Date(b.startedAt).getTime() - new Date(a.startedAt).getTime()
-  );
-  const emptyCountByProject = /* @__PURE__ */ new Map();
-  const filteredEmpty = [];
-  for (const s of empty) {
-    const count = emptyCountByProject.get(s.projectDir) ?? 0;
-    if (count < 3) {
-      filteredEmpty.push(s);
-      emptyCountByProject.set(s.projectDir, count + 1);
-    }
-  }
-  const summaries = [...active, ...filteredEmpty];
-  summaries.sort(
-    (a, b) => new Date(b.startedAt).getTime() - new Date(a.startedAt).getTime()
-  );
-  jsonResponse(ctx.res, summaries.slice(0, 50), 200, ctx.req);
-}
-async function sessionHandler(ctx) {
-  const projectParam = ctx.url.searchParams.get("project");
-  const sessionParam = ctx.url.searchParams.get("session");
-  const store2 = projectParam ? new JsonSessionStore(void 0, ctx.projectDir) : new JsonSessionStore();
-  if (sessionParam) {
-    const state2 = store2.load(sessionParam);
-    jsonResponse(ctx.res, state2, 200, ctx.req);
-    return;
-  }
-  if (projectParam) {
-    const state2 = store2.getLatestForProject(ctx.projectDir);
-    jsonResponse(ctx.res, state2, 200, ctx.req);
-    return;
-  }
-  const state = findLatestSession(store2);
-  jsonResponse(ctx.res, state, 200, ctx.req);
-}
-async function eventsHandler(ctx) {
-  const store2 = new JsonSessionStore();
-  const projectParam = ctx.url.searchParams.get("project");
-  const sessionParam = ctx.url.searchParams.get("session");
-  if (sessionParam) {
-    const events2 = readEvents(sessionParam, ctx.projectDir);
-    jsonResponse(ctx.res, events2, 200, ctx.req);
-    return;
-  }
-  if (projectParam) {
-    const state = store2.getLatestForProject(ctx.projectDir);
-    if (!state) {
-      jsonResponse(ctx.res, [], 200, ctx.req);
-      return;
-    }
-    const events2 = readEvents(state.sessionId, ctx.projectDir);
-    jsonResponse(ctx.res, events2, 200, ctx.req);
-    return;
-  }
-  const latestState = findLatestSession(store2);
-  if (!latestState) {
-    jsonResponse(ctx.res, [], 200, ctx.req);
-    return;
-  }
-  const events = readEvents(latestState.sessionId, latestState.projectDir);
-  jsonResponse(ctx.res, events, 200, ctx.req);
-}
-async function stackHandler(ctx) {
-  const result = detectStack(ctx.projectDir);
-  jsonResponse(ctx.res, result, 200, ctx.req);
-}
-async function initHandler(ctx) {
-  const body = await readBody(ctx.req);
-  let templateIds;
-  try {
-    const parsed = JSON.parse(body);
-    if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed.templateIds) && parsed.templateIds.length > 0) {
-      templateIds = parsed.templateIds;
-    }
-  } catch {
-  }
-  const { projectDir } = ctx;
-  const stack = detectStack(projectDir);
-  const allTemplates = loadBundledTemplates();
-  const selected = templateIds ? allTemplates.filter((t) => templateIds.includes(t.id)) : allTemplates.filter((t) => {
-    if (t.id === "quality-of-life") return true;
-    for (const det of [
-      stack.runtime,
-      stack.language,
-      stack.packageManager,
-      stack.framework,
-      stack.formatter,
-      stack.linter,
-      stack.testRunner,
-      stack.orm,
-      stack.gitWorkflow
-    ]) {
-      if (det && det.id === t.id) return true;
-    }
-    return false;
-  });
-  const composed = composeTemplates(selected);
-  const config = {
-    name: path4.basename(projectDir),
-    runtime: stack.runtime?.id ?? "unknown",
-    language: stack.language?.id,
-    framework: stack.framework?.id,
-    package_manager: stack.packageManager?.id ?? "npm",
-    orm: stack.orm?.id,
-    test_runner: stack.testRunner?.id,
-    formatter: stack.formatter?.id,
-    linter: stack.linter?.id,
-    git_workflow: stack.gitWorkflow?.id
-  };
-  const resolved = resolveTemplate(composed, config);
-  const rulesDir = projectConfigDir(projectDir);
-  fs7.mkdirSync(rulesDir, { recursive: true });
-  const rulesConfig = {
-    project: config,
-    preconditions: resolved.preconditions ?? {},
-    postconditions: resolved.postconditions ?? {},
-    permissions: resolved.permissions ?? {},
-    pipelines: resolved.pipelines ?? {}
-  };
-  writeRulesConfig(path4.join(rulesDir, GUARDS_FILENAME), rulesConfig);
-  jsonResponse(ctx.res, { success: true, rulesCount: selected.length }, 200, ctx.req);
-}
-var generationStatus = /* @__PURE__ */ new Map();
-var enrichmentStatus = /* @__PURE__ */ new Map();
-function parseAIScanResponse(response) {
-  const yamlMatch = response.match(/```ya?ml\n([\s\S]*?)```/);
-  if (yamlMatch) {
-    return yamlMatch[1].trim();
-  }
-  const codeMatch = response.match(/```\n([\s\S]*?)```/);
-  if (codeMatch) {
-    return codeMatch[1].trim();
-  }
-  if (response.trim().match(/^[a-z_]+:/m)) {
-    return response.trim();
-  }
-  return null;
-}
-function validateScanResult(yaml) {
-  const warnings = [];
-  const sections = [
-    "preconditions",
-    "postconditions",
-    "permissions",
-    "pipelines"
-  ];
-  let foundSections = 0;
-  for (const section of sections) {
-    if (yaml.includes(`${section}:`)) {
-      foundSections++;
-    } else {
-      warnings.push(`Missing section: ${section}`);
-    }
-  }
-  return {
-    valid: foundSections > 0,
-    warnings
-  };
-}
-async function generateStatusHandler(ctx) {
-  const status = generationStatus.get(ctx.projectDir);
-  if (!status) {
-    jsonResponse(ctx.res, { status: "idle" }, 200, ctx.req);
-    return;
-  }
-  if (status.status === "generating") {
-    const elapsed = Date.now() - status.startedAt;
-    const timeoutMs = 15 * 60 * 1e3;
-    if (elapsed > timeoutMs) {
-      if (status.childProcess && !status.childProcess.killed) {
-        status.childProcess.kill();
-      }
-      const errorStatus = {
-        status: "error",
-        startedAt: status.startedAt,
-        error: "Generation timed out after 15 minutes"
-      };
-      generationStatus.set(ctx.projectDir, errorStatus);
-      jsonResponse(ctx.res, errorStatus, 200, ctx.req);
-      return;
-    }
-  }
-  const { childProcess: _cp, ...safeStatus } = status;
-  jsonResponse(ctx.res, safeStatus, 200, ctx.req);
-}
-async function generateStatusClearHandler(ctx) {
-  generationStatus.delete(ctx.projectDir);
-  jsonResponse(ctx.res, {
-    success: true,
-    message: "Generation status cleared"
-  }, 200, ctx.req);
-}
-async function generateHandler(ctx) {
-  const { projectDir } = ctx;
-  const currentStatus = generationStatus.get(projectDir);
-  if (currentStatus?.status === "generating") {
-    jsonResponse(ctx.res, { error: "Generation already in progress" }, 409, ctx.req);
-    return;
-  }
-  const body = await readBody(ctx.req);
-  let model = DEFAULT_AI_MODEL;
-  if (body) {
-    try {
-      const payload = JSON.parse(body);
-      if (typeof payload === "object" && payload !== null && typeof payload.model === "string") {
-        model = payload.model;
-      }
-    } catch {
-    }
-  }
-  const startedAt = Date.now();
-  generationStatus.set(projectDir, {
-    status: "generating",
-    startedAt
-  });
-  jsonResponse(
-    ctx.res,
-    { success: true, message: "Generation started" },
-    202,
-    ctx.req
-  );
-  (async () => {
-    let claudeProcess;
-    try {
-      claudeProcess = spawn(
-        "claude",
-        [
-          "--print",
-          "--model",
-          model,
-          "--output-format",
-          "text",
-          "--permission-mode",
-          "bypassPermissions",
-          `/ulpi-generate-guardian ${projectDir}`
-        ],
-        {
-          cwd: projectDir,
-          stdio: ["pipe", "pipe", "pipe"]
-        }
-      );
-      const entry = generationStatus.get(projectDir);
-      if (entry) {
-        entry.childProcess = claudeProcess;
-      }
-      let stdout = "";
-      let stderr = "";
-      claudeProcess.stdout.on("data", (data) => {
-        stdout += data.toString();
-      });
-      claudeProcess.stderr.on("data", (data) => {
-        stderr += data.toString();
-      });
-      await new Promise((resolve7, reject) => {
-        claudeProcess.on("close", (code) => {
-          if (code !== 0) {
-            reject(
-              new Error(`Claude CLI exited with code ${code}: ${stderr}`)
-            );
-          } else {
-            resolve7();
-          }
-        });
-        claudeProcess.on("error", (err) => {
-          reject(
-            new Error(
-              `Failed to execute claude command: ${err.message}. Make sure the claude CLI is installed.`
-            )
-          );
-        });
-      });
-      const yaml = parseAIScanResponse(stdout);
-      if (!yaml) {
-        throw new Error("Failed to parse AI response as YAML");
-      }
-      const validation = validateScanResult(yaml);
-      if (!validation.valid) {
-        throw new Error(
-          `AI response does not contain valid rules: ${validation.warnings.join(", ")}`
-        );
-      }
-      const rulesDir = projectConfigDir(projectDir);
-      fs8.mkdirSync(rulesDir, { recursive: true });
-      const header = [
-        "# ULPI \u2014 AI-Generated Rules",
-        `# Generated by AI scan on ${(/* @__PURE__ */ new Date()).toISOString()}`,
-        `# Model: ${model}`,
-        "# Review these rules and adjust as needed.",
-        ""
-      ].join("\n");
-      fs8.writeFileSync(
-        path5.join(rulesDir, GUARDS_FILENAME),
-        header + yaml + "\n",
-        "utf-8"
-      );
-      generationStatus.set(projectDir, {
-        status: "done",
-        startedAt: generationStatus.get(projectDir)?.startedAt ?? Date.now(),
-        warnings: validation.warnings
-      });
-      console.log(
-        `[AI Generate] Completed successfully for ${projectDir}`
-      );
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (claudeProcess && !claudeProcess.killed) {
-        claudeProcess.kill();
-      }
-      generationStatus.set(projectDir, {
-        status: "error",
-        startedAt: generationStatus.get(projectDir)?.startedAt ?? Date.now(),
-        error: message
-      });
-      console.error(
-        `[AI Generate] Failed for ${projectDir}:`,
-        message
-      );
-    }
-  })();
-}
-async function getReviewConfig(ctx) {
-  const settings = loadUlpiSettings();
-  jsonResponse(ctx.res, settings.review, 200, ctx.req);
-}
-async function putReviewConfig(ctx) {
-  const body = await readBody(ctx.req);
-  let reviewData;
-  try {
-    reviewData = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const validation = ReviewConfigSchema.safeParse(reviewData);
-  if (!validation.success) {
-    const errors = validation.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-    jsonResponse(ctx.res, { error: `Validation failed: ${errors}` }, 400, ctx.req);
-    return;
-  }
-  try {
-    const settings = loadUlpiSettings();
-    settings.review = validation.data;
-    saveUlpiSettings(settings);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update settings";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-    return;
-  }
-  jsonResponse(ctx.res, { success: true, review: validation.data }, 200, ctx.req);
-}
-async function listPlans(ctx) {
-  const summaries = await listPlansWithMeta(ctx.projectDir);
-  jsonResponse(ctx.res, summaries, 200, ctx.req);
-}
-async function listPendingPlansAll(ctx) {
-  const summaries = await listPlansWithMeta();
-  const pending = summaries.filter((s) => s.status === "pending");
-  jsonResponse(ctx.res, pending, 200, ctx.req);
-}
-async function getPlan(ctx) {
-  const slug = ctx.params["1"];
-  const plan = await loadPlan(slug, ctx.projectDir);
-  if (!plan) {
-    jsonResponse(ctx.res, { error: `Plan not found: ${slug}` }, 404, ctx.req);
-    return;
-  }
-  jsonResponse(ctx.res, plan, 200, ctx.req);
-}
-async function planDecisionGone(ctx) {
-  jsonResponse(
-    ctx.res,
-    { error: "Gone. Use POST /api/review/hub/session/:id/decision instead." },
-    410,
-    ctx.req
-  );
-}
-async function savePlanVersion(ctx) {
-  const slug = ctx.params["1"];
-  const plan = await loadPlan(slug, ctx.projectDir);
-  if (!plan) {
-    jsonResponse(ctx.res, { error: `Plan not found: ${slug}` }, 404, ctx.req);
-    return;
-  }
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const updatedVersion = {
-    ...plan.version,
-    annotations: payload.annotations || plan.version.annotations || [],
-    inlineEdits: payload.inlineEdits || plan.version.inlineEdits || [],
-    instructions: payload.instructions || plan.version.instructions || [],
-    priorities: payload.priorities || plan.version.priorities || [],
-    risks: payload.risks || plan.version.risks || []
-  };
-  await savePlan(plan.plan, updatedVersion, slug, ctx.projectDir);
-  jsonResponse(ctx.res, { success: true }, 200, ctx.req);
-}
-var SSEBroadcaster = class _SSEBroadcaster {
-  static MAX_CLIENTS = 100;
-  clients = /* @__PURE__ */ new Set();
-  /** Check if the broadcaster can accept another client. */
-  canAccept() {
-    return this.clients.size < _SSEBroadcaster.MAX_CLIENTS;
-  }
-  /** Register a new SSE client. */
-  add(res) {
-    this.clients.add(res);
-  }
-  /** Remove a disconnected SSE client. */
-  remove(res) {
-    this.clients.delete(res);
-  }
-  /** Broadcast a named SSE event to every connected client. */
-  broadcast(eventName, data) {
-    const message = `event: ${eventName}
-data: ${JSON.stringify(data)}
-
-`;
-    for (const client of this.clients) {
-      try {
-        client.write(message);
-      } catch {
-        this.clients.delete(client);
-      }
-    }
-  }
-  /** Number of currently connected clients. */
-  get size() {
-    return this.clients.size;
-  }
-};
-var reviewHub = new ReviewHub();
-var reviewSSE = new SSEBroadcaster();
-function broadcastReviewSSE(eventName, data) {
-  reviewSSE.broadcast(eventName, data);
-}
-var _uiServerPort = 9800;
-function setUiServerPort(port) {
-  _uiServerPort = port;
-}
-function getUiServerPort() {
-  return _uiServerPort;
-}
-async function hubRegister(ctx) {
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const result = await reviewHub.register({
-      type: payload.type ?? "plan",
-      projectPath: payload.projectPath ?? ctx.projectDir,
-      plan: payload.plan ?? payload.markdown,
-      diff: payload.diff,
-      commitMessage: payload.commitMessage
-    });
-    const pubSession = reviewHub.getSession(result.sessionId);
-    broadcastReviewSSE("session-added", pubSession ?? { id: result.sessionId });
-    const reviewSettings = loadUlpiSettings().review;
-    if (reviewSSE.size === 0 && reviewSettings.auto_open_browser) {
-      try {
-        const { exec } = await import("child_process");
-        const reviewPath = result.session.type === "code" ? "review/code" : "review/plan";
-        const port = getUiServerPort();
-        exec(
-          `open "http://localhost:${port}/${reviewPath}?session=${result.sessionId}&token=${result.token}"`
-        );
-      } catch {
-      }
-    }
-    jsonResponse(
-      ctx.res,
-      { success: true, sessionId: result.sessionId, token: result.token },
-      201,
-      ctx.req
-    );
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to register session";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function hubListSessions(ctx) {
-  const typeFilter = ctx.url.searchParams.get("type");
-  const statusFilter = ctx.url.searchParams.get("status") ?? void 0;
-  const sessions = reviewHub.listSessions({
-    type: typeFilter ?? void 0,
-    status: statusFilter
-  });
-  jsonResponse(ctx.res, sessions, 200, ctx.req);
-}
-async function hubEvents(ctx) {
-  if (!reviewSSE.canAccept()) {
-    jsonResponse(ctx.res, { error: "Too many SSE clients" }, 503, ctx.req);
-    return;
-  }
-  sseHeaders(ctx.res, ctx.req);
-  ctx.res.write('data: {"type":"connected"}\n\n');
-  reviewSSE.add(ctx.res);
-  ctx.req.on("close", () => {
-    reviewSSE.remove(ctx.res);
-  });
-}
-async function hubGetSession(ctx) {
-  const id = ctx.params["1"];
-  const session = reviewHub.getSession(id);
-  if (!session) {
-    jsonResponse(ctx.res, { error: "Session not found" }, 404, ctx.req);
-    return;
-  }
-  jsonResponse(ctx.res, session, 200, ctx.req);
-}
-async function hubSubmitDecision(ctx) {
-  const id = ctx.params["1"];
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const token = payload.token ?? ctx.url.searchParams.get("token") ?? ctx.req.headers["x-review-token"];
-  let decision;
-  if (payload.decision && typeof payload.decision === "object") {
-    decision = payload.decision;
-  } else if ("behavior" in payload || "approved" in payload) {
-    decision = payload;
-  } else {
-    jsonResponse(ctx.res, { error: "Missing decision payload" }, 400, ctx.req);
-    return;
-  }
-  if (!token || !reviewHub.verifyToken(id, token)) {
-    jsonResponse(ctx.res, { error: "Missing or invalid session token" }, 403, ctx.req);
-    return;
-  }
-  const submitted = await reviewHub.submitDecision(id, decision, token);
-  if (!submitted) {
-    jsonResponse(
-      ctx.res,
-      { error: "Session not found or already decided" },
-      404,
-      ctx.req
-    );
-    return;
-  }
-  const decidedSession = reviewHub.getSession(id);
-  broadcastReviewSSE(
-    "session-decided",
-    decidedSession ?? { id, decision }
-  );
-  jsonResponse(ctx.res, { success: true }, 200, ctx.req);
-}
-async function hubAwaitDecision(ctx) {
-  const id = ctx.params["1"];
-  const token = ctx.url.searchParams.get("token") ?? ctx.req.headers["x-review-token"];
-  if (!token || !reviewHub.verifyToken(id, token)) {
-    jsonResponse(ctx.res, { error: "Missing or invalid session token" }, 403, ctx.req);
-    return;
-  }
-  const session = reviewHub.getSession(id);
-  if (!session) {
-    jsonResponse(ctx.res, { error: "Session not found" }, 404, ctx.req);
-    return;
-  }
-  if (session.status === "decided") {
-    const rawDecision = reviewHub.getDecisionPayload(id);
-    if (rawDecision) {
-      jsonResponse(ctx.res, { decision: rawDecision }, 200, ctx.req);
-      return;
-    }
-  }
-  const decision = await reviewHub.awaitDecision(id, 3e4);
-  if (decision) {
-    jsonResponse(ctx.res, { decision }, 200, ctx.req);
-  } else {
-    ctx.res.writeHead(204);
-    ctx.res.end();
-  }
-}
-async function hubSaveVersion(ctx) {
-  const id = ctx.params["1"];
-  const body = await readBody(ctx.req);
-  let version;
-  try {
-    version = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const token = version.token;
-  if (!token || !reviewHub.verifyToken(id, token)) {
-    jsonResponse(ctx.res, { error: "Missing or invalid session token" }, 403, ctx.req);
-    return;
-  }
-  const saved = await reviewHub.saveVersion(id, version);
-  if (!saved) {
-    jsonResponse(ctx.res, { error: "Session not found" }, 404, ctx.req);
-    return;
-  }
-  broadcastReviewSSE("session-updated", { id });
-  jsonResponse(ctx.res, { success: true }, 200, ctx.req);
-}
-async function hubGetToken(ctx) {
-  const id = ctx.params["1"];
-  const token = reviewHub.getSessionToken(id);
-  if (!token) {
-    jsonResponse(ctx.res, { error: "Session not found" }, 404, ctx.req);
-    return;
-  }
-  jsonResponse(ctx.res, { token }, 200, ctx.req);
-}
-async function hubHealth(ctx) {
-  const sessions = reviewHub.listSessions({});
-  const pending = sessions.filter(
-    (s) => s.status === "pending" || s.status === "active"
-  ).length;
-  const decided = sessions.filter((s) => s.status === "decided").length;
-  const orphaned = sessions.filter((s) => s.status === "orphaned").length;
-  jsonResponse(ctx.res, {
-    status: "ok",
-    sessions: sessions.length,
-    pending,
-    decided,
-    orphaned,
-    sseClients: reviewSSE.size,
-    uptimeMs: process.uptime() * 1e3
-  }, 200, ctx.req);
-}
-var cachedClaudePath;
-function resolveClaudePath() {
-  try {
-    const result = execFileSync("which", ["claude"], {
-      stdio: "pipe",
-      timeout: 5e3
-    }).toString().trim();
-    return result || null;
-  } catch {
-    return null;
-  }
-}
-function getClaudePath() {
-  if (cachedClaudePath === void 0) {
-    cachedClaudePath = resolveClaudePath();
-  }
-  return cachedClaudePath;
-}
-function isClaudeCliAvailable() {
-  const p = getClaudePath();
-  if (!p) return false;
-  try {
-    execFileSync(p, ["--version"], { stdio: "pipe", timeout: 5e3 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function getAiAvailable(ctx) {
-  const available = isClaudeCliAvailable();
-  jsonResponse(ctx.res, { available }, 200, ctx.req);
-}
-async function postQualityScore(ctx) {
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON body" }, 400, ctx.req);
-    return;
-  }
-  const markdown = payload.markdown;
-  if (!markdown) {
-    jsonResponse(ctx.res, { error: "markdown field required" }, 400, ctx.req);
-    return;
-  }
-  if (payload.ai === true) {
-    const claudePath = getClaudePath();
-    if (!claudePath) {
-      jsonResponse(
-        ctx.res,
-        {
-          error: "Claude CLI not found. Install it to enable AI scoring.",
-          available: false
-        },
-        400,
-        ctx.req
-      );
-      return;
-    }
-    const model = payload.model || DEFAULT_AI_MODEL;
-    try {
-      const prompt = buildAiScoringPrompt(markdown);
-      const aiScoringSchema = JSON.stringify({
-        type: "object",
-        properties: {
-          overall: {
-            type: "number",
-            description: "Weighted average score 0-100"
-          },
-          breakdown: {
-            type: "array",
-            items: {
-              type: "object",
-              properties: {
-                name: { type: "string" },
-                score: { type: "number" },
-                found: { type: "boolean" },
-                details: { type: "string" }
-              },
-              required: ["name", "score", "found", "details"]
-            }
-          },
-          suggestions: { type: "array", items: { type: "string" } }
-        },
-        required: ["overall", "breakdown", "suggestions"]
-      });
-      const score2 = await new Promise(
-        (resolve7, reject) => {
-          const timeout = 2 * 60 * 1e3;
-          const proc = spawn2(claudePath, [
-            "--print",
-            "--model",
-            model,
-            "--output-format",
-            "json",
-            "--json-schema",
-            aiScoringSchema,
-            "--permission-mode",
-            "bypassPermissions"
-          ], {
-            stdio: ["pipe", "pipe", "pipe"]
-          });
-          let stdout = "";
-          let stderr = "";
-          proc.stdout.on("data", (data) => {
-            stdout += data.toString();
-          });
-          proc.stderr.on("data", (data) => {
-            stderr += data.toString();
-          });
-          proc.stdin.write(prompt);
-          proc.stdin.end();
-          const timer = setTimeout(() => {
-            proc.kill("SIGTERM");
-            reject(
-              new Error("AI scoring timed out after 2 minutes")
-            );
-          }, timeout);
-          proc.on("close", (code) => {
-            clearTimeout(timer);
-            if (code !== 0) {
-              reject(
-                new Error(
-                  `Claude CLI exited with code ${code}: ${stderr.slice(0, 500)}`
-                )
-              );
-              return;
-            }
-            try {
-              const envelope = JSON.parse(stdout.trim());
-              if (envelope.structured_output && typeof envelope.structured_output === "object") {
-                resolve7(envelope.structured_output);
-                return;
-              }
-              if (typeof envelope.result === "string" && envelope.result.trim().startsWith("{")) {
-                resolve7(JSON.parse(envelope.result));
-                return;
-              }
-              if (typeof envelope.overall === "number") {
-                resolve7(envelope);
-                return;
-              }
-              const jsonMatch = stdout.match(/\{[\s\S]*\}/);
-              if (jsonMatch) {
-                resolve7(JSON.parse(jsonMatch[0]));
-                return;
-              }
-              reject(
-                new Error("Failed to parse AI scoring response")
-              );
-            } catch (parseErr) {
-              reject(
-                new Error(
-                  `Failed to parse AI response: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`
-                )
-              );
-            }
-          });
-          proc.on("error", (err) => {
-            clearTimeout(timer);
-            reject(
-              new Error(`Failed to run Claude CLI: ${err.message}`)
-            );
-          });
-        }
-      );
-      score2.scoredAt = Date.now();
-      score2.isAiScore = true;
-      score2.aiModel = model;
-      jsonResponse(ctx.res, score2, 200, ctx.req);
-    } catch (err) {
-      jsonResponse(
-        ctx.res,
-        {
-          error: `AI scoring failed: ${err instanceof Error ? err.message : String(err)}`
-        },
-        500,
-        ctx.req
-      );
-    }
-    return;
-  }
-  const blocks = parseMarkdownToBlocks(markdown);
-  const sections = extractSections(blocks);
-  const score = scorePlanQuality(blocks, sections);
-  jsonResponse(ctx.res, score, 200, ctx.req);
-}
-function isSafePathSegment(value) {
-  if (!value || value.length === 0 || value.length > 255) return false;
-  return !/[/\\]|\.\./.test(value);
-}
-async function uploadImage(ctx) {
-  const sessionId = ctx.url.searchParams.get("session");
-  if (!sessionId) {
-    jsonResponse(ctx.res, { error: "session query param required" }, 400, ctx.req);
-    return;
-  }
-  if (!isSafePathSegment(sessionId)) {
-    jsonResponse(ctx.res, { error: "Invalid session ID" }, 400, ctx.req);
-    return;
-  }
-  const contentType = ctx.req.headers["content-type"] ?? "";
-  const boundaryMatch = contentType.match(/boundary=(.+)/);
-  if (!boundaryMatch) {
-    jsonResponse(
-      ctx.res,
-      { error: "multipart/form-data with boundary required" },
-      400,
-      ctx.req
-    );
-    return;
-  }
-  const rawBody = await readBodyRaw(ctx.req);
-  if (rawBody.length > 5 * 1024 * 1024) {
-    jsonResponse(ctx.res, { error: "Image too large (max 5MB)" }, 413, ctx.req);
-    return;
-  }
-  const parsed = parseMultipartImage(rawBody, boundaryMatch[1]);
-  if (!parsed) {
-    jsonResponse(ctx.res, { error: "Failed to parse multipart image" }, 400, ctx.req);
-    return;
-  }
-  const extMap = {
-    "image/png": "png",
-    "image/jpeg": "jpg",
-    "image/gif": "gif",
-    "image/webp": "webp"
-  };
-  const ext = extMap[parsed.contentType] ?? "png";
-  const filename = `${crypto.randomUUID()}.${ext}`;
-  const dir = path6.join(REVIEW_IMAGES_DIR, sessionId);
-  fs9.mkdirSync(dir, { recursive: true });
-  fs9.writeFileSync(path6.join(dir, filename), parsed.data);
-  jsonResponse(ctx.res, { filename }, 200, ctx.req);
-}
-async function getImage(ctx) {
-  const sessionId = ctx.url.searchParams.get("session");
-  if (!sessionId) {
-    jsonResponse(ctx.res, { error: "session query param required" }, 400, ctx.req);
-    return;
-  }
-  const filename = ctx.params["1"];
-  if (!isSafePathSegment(sessionId) || !isSafePathSegment(filename)) {
-    jsonResponse(ctx.res, { error: "Invalid path" }, 400, ctx.req);
-    return;
-  }
-  const filePath = path6.join(REVIEW_IMAGES_DIR, sessionId, filename);
-  const resolved = path6.resolve(filePath);
-  if (!resolved.startsWith(path6.resolve(REVIEW_IMAGES_DIR) + path6.sep)) {
-    jsonResponse(ctx.res, { error: "Invalid path" }, 400, ctx.req);
-    return;
-  }
-  if (!fs9.existsSync(filePath)) {
-    jsonResponse(ctx.res, { error: "Image not found" }, 404, ctx.req);
-    return;
-  }
-  const mimeMap = {
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".gif": "image/gif",
-    ".webp": "image/webp"
-  };
-  const ext = path6.extname(filename).toLowerCase();
-  const mime = mimeMap[ext] ?? "application/octet-stream";
-  const buffer = fs9.readFileSync(filePath);
-  ctx.res.writeHead(200, {
-    "Content-Type": mime,
-    "Content-Length": buffer.length,
-    "Cache-Control": "public, max-age=86400"
-  });
-  ctx.res.end(buffer);
-}
-function isAllowedWebhookUrl(raw) {
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return false;
-  }
-  if (parsed.protocol !== "https:") return false;
-  const hostname = parsed.hostname;
-  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]" || hostname === "0.0.0.0") {
-    return false;
-  }
-  if (/^10\./.test(hostname)) return false;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(hostname)) return false;
-  if (/^192\.168\./.test(hostname)) return false;
-  if (/^169\.254\./.test(hostname)) return false;
-  if (/^0\./.test(hostname)) return false;
-  if (hostname === "metadata.google.internal") return false;
-  if (hostname === "169.254.169.254") return false;
-  return true;
-}
-function isPrivateIPv4(ip) {
-  if (ip === "127.0.0.1" || ip === "0.0.0.0") return true;
-  if (/^10\./.test(ip)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(ip)) return true;
-  if (/^192\.168\./.test(ip)) return true;
-  if (/^169\.254\./.test(ip)) return true;
-  if (/^0\./.test(ip)) return true;
-  return false;
-}
-function isPrivateIP(ip) {
-  if (ip === "::1" || ip === "::") return true;
-  if (/^f[cd][0-9a-f]{2}:/i.test(ip)) return true;
-  if (/^fe[89ab][0-9a-f]:/i.test(ip)) return true;
-  if (/^::ffff:/i.test(ip)) {
-    const v4 = ip.slice(7);
-    return isPrivateIPv4(v4);
-  }
-  return isPrivateIPv4(ip);
-}
-async function resolveAndValidateHost(hostname) {
-  try {
-    const [v4addrs, v6addrs] = await Promise.all([
-      resolve42(hostname).catch(() => []),
-      resolve6(hostname).catch(() => [])
-    ]);
-    const allAddrs = [...v4addrs, ...v6addrs];
-    if (allAddrs.length === 0) return false;
-    return allAddrs.every((addr) => !isPrivateIP(addr));
-  } catch {
-    return false;
-  }
-}
-async function exportGithub(ctx) {
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON" }, 400, ctx.req);
-    return;
-  }
-  const title = payload.title || "Plan Review";
-  const markdown = payload.markdown || "";
-  const annotations = payload.annotations || [];
-  const priorities = payload.priorities || [];
-  const risks = payload.risks || [];
-  let md = `# ${title}
-
-## Review Summary
-
-`;
-  md += `- Annotations: ${annotations.length}
-`;
-  md += `- Priorities: ${priorities.length}
-`;
-  md += `- Risks: ${risks.length}
-
-`;
-  if (annotations.length > 0) {
-    md += `### Comments
-
-`;
-    for (const a of annotations)
-      md += `- [ ] **${a.type}**: ${a.text}
-`;
-    md += "\n";
-  }
-  if (priorities.length > 0) {
-    md += `### Priorities
-
-`;
-    for (const p of priorities)
-      md += `- **${p.priority}**: ${p.sectionId}${p.note ? ` -- ${p.note}` : ""}
-`;
-    md += "\n";
-  }
-  if (risks.length > 0) {
-    md += `### Risks
-
-`;
-    for (const r of risks)
-      md += `- **${r.level}**: ${r.sectionId}${r.description ? ` -- ${r.description}` : ""}
-`;
-    md += "\n";
-  }
-  md += `<details><summary>Full Plan</summary>
-
-${markdown}
-
-</details>`;
-  jsonResponse(ctx.res, { format: "github", content: md }, 200, ctx.req);
-}
-async function exportWebhook(ctx) {
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON" }, 400, ctx.req);
-    return;
-  }
-  const webhookUrl = payload.webhookUrl;
-  if (!webhookUrl) {
-    jsonResponse(ctx.res, { error: "webhookUrl required" }, 400, ctx.req);
-    return;
-  }
-  if (!isAllowedWebhookUrl(webhookUrl)) {
-    jsonResponse(
-      ctx.res,
-      { error: "Webhook URL must be HTTPS and must not target private/internal networks" },
-      400,
-      ctx.req
-    );
-    return;
-  }
-  const parsedUrl = new URL(webhookUrl);
-  const hostSafe = await resolveAndValidateHost(parsedUrl.hostname);
-  if (!hostSafe) {
-    jsonResponse(
-      ctx.res,
-      { error: "Webhook URL resolves to a private/internal IP address" },
-      403,
-      ctx.req
-    );
-    return;
-  }
-  try {
-    const webhookBody = JSON.stringify({
-      title: payload.title,
-      markdown: payload.markdown,
-      annotations: payload.annotations,
-      priorities: payload.priorities,
-      risks: payload.risks,
-      exportedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    const resp = await fetch(webhookUrl, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: webhookBody
-    });
-    const statusCode = resp.ok ? 200 : 502;
-    jsonResponse(ctx.res, { success: resp.ok, status: resp.status }, statusCode, ctx.req);
-  } catch (err) {
-    jsonResponse(
-      ctx.res,
-      {
-        error: `Webhook failed: ${err instanceof Error ? err.message : String(err)}`
-      },
-      502,
-      ctx.req
-    );
-  }
-}
-async function exportObsidian(ctx) {
-  const body = await readBody(ctx.req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(ctx.res, { error: "Invalid JSON" }, 400, ctx.req);
-    return;
-  }
-  const title = payload.title || "Plan Review";
-  const markdown = payload.markdown || "";
-  const annotations = payload.annotations || [];
-  const priorities = payload.priorities || [];
-  const risks = payload.risks || [];
-  const tags = ["ulpi", "plan-review"];
-  if (annotations.length > 0) tags.push("has-annotations");
-  if (risks.some((r) => r.level === "high")) tags.push("high-risk");
-  let md = `---
-`;
-  md += `title: "${title.replace(/"/g, '\\"')}"
-`;
-  md += `date: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}
-`;
-  md += `tags: [${tags.map((t) => `"${t}"`).join(", ")}]
-`;
-  md += `annotations: ${annotations.length}
-`;
-  md += `priorities: ${priorities.length}
-`;
-  md += `risks: ${risks.length}
-`;
-  md += `---
-
-`;
-  md += `# ${title}
-
-`;
-  if (annotations.length > 0) {
-    md += `## Review Notes
-
-`;
-    for (const a of annotations) md += `- **${a.type}**: ${a.text}
-`;
-    md += "\n";
-  }
-  md += markdown;
-  jsonResponse(ctx.res, { format: "obsidian", content: md }, 200, ctx.req);
-}
-async function getEngine() {
-  return await import("./dist-CB5D5LMO.js");
-}
-var runningPipelines = /* @__PURE__ */ new Map();
-var activeWatchers = /* @__PURE__ */ new Map();
-var pipelineProgress = /* @__PURE__ */ new Map();
-var pipelineErrors = /* @__PURE__ */ new Map();
-async function codemapStatusHandler(ctx) {
-  try {
-    const engine = await getEngine();
-    const { getCurrentBranch: getCurrentBranch2 } = await import("./dist-RKOGLK7R.js");
-    const branch = getCurrentBranch2(ctx.projectDir);
-    const status = engine.getCodemapStatus(ctx.projectDir, branch);
-    const isIndexing = runningPipelines.has(ctx.projectDir);
-    const watcher = activeWatchers.get(ctx.projectDir);
-    const isWatching = watcher?.isRunning ?? false;
-    const progress = isIndexing ? pipelineProgress.get(ctx.projectDir) : void 0;
-    const lastError = pipelineErrors.get(ctx.projectDir);
-    const effectiveMode = isIndexing ? "indexing" : isWatching ? "watching" : status.mode;
-    const response = {
-      ...status,
-      mode: effectiveMode,
-      initialized: isIndexing ? true : status.initialized,
-      pollIntervalMs: isIndexing ? 2e3 : isWatching ? 5e3 : 15e3,
-      progress: progress ?? void 0,
-      totalFiles: isIndexing && progress ? progress.totalFiles : status.totalFiles,
-      totalChunks: isIndexing && progress ? progress.totalChunks : status.totalChunks,
-      staleFiles: isIndexing && progress ? progress.totalChunks - progress.current : status.staleFiles,
-      indexSizeBytes: isIndexing ? 0 : status.indexSizeBytes,
-      lastError: lastError ?? void 0,
-      queueDepth: isWatching && watcher ? watcher.queueDepth : status.queueDepth,
-      watcherStats: isWatching && watcher ? {
-        recentEvents: watcher.recentEvents,
-        totalProcessed: watcher.totalEventsProcessed,
-        lastFlushAt: watcher.lastFlushAt
-      } : void 0
-    };
-    jsonResponse(ctx.res, response, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to get codemap status";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function codemapSearchHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  const query = data.query;
-  if (typeof query !== "string" || !query.trim()) {
-    jsonResponse(ctx.res, { error: "Missing or empty 'query' field" }, 400, ctx.req);
-    return;
-  }
-  if (query.length > 1e3) {
-    jsonResponse(ctx.res, { error: "Query too long (max 1000 characters)" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const engine = await getEngine();
-    const { getCurrentBranch: getCurrentBranch2 } = await import("./dist-RKOGLK7R.js");
-    const branch = getCurrentBranch2(ctx.projectDir);
-    const status = engine.getCodemapStatus(ctx.projectDir, branch);
-    if (!status.initialized) {
-      jsonResponse(ctx.res, {
-        query: query.trim(),
-        durationMs: 0,
-        source: "preview",
-        results: []
-      }, 200, ctx.req);
-      return;
-    }
-    const result = await engine.searchCode(ctx.projectDir, query.trim(), {
-      limit: typeof data.limit === "number" ? Math.min(Math.max(1, data.limit), 50) : 10,
-      threshold: typeof data.threshold === "number" ? data.threshold : void 0,
-      pathPrefix: typeof data.pathPrefix === "string" ? data.pathPrefix : void 0,
-      includeTests: typeof data.includeTests === "boolean" ? data.includeTests : void 0,
-      includeDocs: typeof data.includeDocs === "boolean" ? data.includeDocs : void 0,
-      branch
-    });
-    const response = {
-      query: result.query,
-      durationMs: result.durationMs,
-      source: "live",
-      results: result.results.map((r) => ({
-        filePath: r.filePath,
-        startLine: r.startLine,
-        endLine: r.endLine,
-        score: r.score,
-        snippet: r.snippet
-      }))
-    };
-    jsonResponse(ctx.res, response, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Search failed";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function codemapConfigHandler(ctx) {
-  try {
-    const engine = await getEngine();
-    const config = engine.loadCodemapConfig(ctx.projectDir);
-    jsonResponse(ctx.res, config, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load codemap config";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function codemapConfigUpdateHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const engine = await getEngine();
-    const existing = engine.loadCodemapConfig(ctx.projectDir);
-    const merged = { ...existing };
-    if (typeof data.embedding === "object" && data.embedding !== null) {
-      merged.embedding = { ...merged.embedding, ...data.embedding };
-    }
-    engine.saveCodemapConfig(ctx.projectDir, merged);
-    jsonResponse(ctx.res, merged, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update codemap config";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function codemapActionHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  const action = data.action;
-  const validActions = ["init", "watch", "stop-watch", "reindex", "export", "import", "serve"];
-  if (!validActions.includes(action)) {
-    jsonResponse(
-      ctx.res,
-      { error: `Invalid action: ${action}. Valid: ${validActions.join(", ")}` },
-      400,
-      ctx.req
-    );
-    return;
-  }
-  try {
-    const { getCurrentBranch: getCurrentBranch2 } = await import("./dist-RKOGLK7R.js");
-    const branch = getCurrentBranch2(ctx.projectDir);
-    switch (action) {
-      case "init":
-      case "reindex": {
-        if (runningPipelines.has(ctx.projectDir)) {
-          jsonResponse(
-            ctx.res,
-            { ok: false, action, message: "Indexing already in progress" },
-            409,
-            ctx.req
-          );
-          return;
-        }
-        const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-        const projectDir = ctx.projectDir;
-        pipelineErrors.delete(projectDir);
-        const pipeline = (async () => {
-          const engine = await getEngine();
-          await engine.runInitPipeline(projectDir, (p) => {
-            const prev = pipelineProgress.get(projectDir);
-            let totalFiles = prev?.totalFiles ?? 0;
-            let totalChunks = prev?.totalChunks ?? 0;
-            if (p.phase === "scanning" && p.current > 0) {
-              totalFiles = p.current;
-            }
-            if (p.phase === "embedding" || p.phase === "storing") {
-              totalChunks = p.total;
-            }
-            pipelineProgress.set(projectDir, {
-              phase: p.phase,
-              current: p.current,
-              total: p.total,
-              message: p.message,
-              totalFiles,
-              totalChunks
-            });
-          }, branch);
-          try {
-            const { installMcpServer } = await import("@ulpi/cli/mcp-installer");
-            installMcpServer(projectDir);
-          } catch {
-          }
-        })().catch((err) => {
-          const msg = err instanceof Error ? err.message : String(err);
-          console.error(`[codemap] Pipeline error: ${msg}`);
-          pipelineErrors.set(projectDir, msg);
-        }).finally(() => {
-          runningPipelines.delete(projectDir);
-          pipelineProgress.delete(projectDir);
-        });
-        runningPipelines.set(projectDir, pipeline);
-        jsonResponse(
-          ctx.res,
-          {
-            ok: true,
-            action,
-            message: action === "init" ? "Indexing started" : "Re-indexing started",
-            startedAt
-          },
-          202,
-          ctx.req
-        );
-        return;
-      }
-      case "watch": {
-        if (runningPipelines.has(ctx.projectDir)) {
-          jsonResponse(ctx.res, { ok: false, action, message: "Indexing in progress, cannot start watcher" }, 409, ctx.req);
-          return;
-        }
-        const engine = await getEngine();
-        const watchStatus = engine.getCodemapStatus(ctx.projectDir, branch);
-        if (!watchStatus.initialized) {
-          const projectDir = ctx.projectDir;
-          pipelineErrors.delete(projectDir);
-          const pipeline = (async () => {
-            await engine.runInitPipeline(projectDir, (p) => {
-              const prev = pipelineProgress.get(projectDir);
-              let totalFiles = prev?.totalFiles ?? 0;
-              let totalChunks = prev?.totalChunks ?? 0;
-              if (p.phase === "scanning" && p.current > 0) totalFiles = p.current;
-              if (p.phase === "embedding" || p.phase === "storing") totalChunks = p.total;
-              pipelineProgress.set(projectDir, {
-                phase: p.phase,
-                current: p.current,
-                total: p.total,
-                message: p.message,
-                totalFiles,
-                totalChunks
-              });
-            }, branch);
-            const watcher = new engine.CodemapWatcher({ projectDir, branch });
-            activeWatchers.set(projectDir, watcher);
-            await watcher.start();
-          })().catch((err) => {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`[codemap] Watch+init error: ${msg}`);
-            pipelineErrors.set(projectDir, msg);
-            activeWatchers.delete(projectDir);
-          }).finally(() => {
-            runningPipelines.delete(projectDir);
-            pipelineProgress.delete(projectDir);
-          });
-          runningPipelines.set(projectDir, pipeline);
-          jsonResponse(ctx.res, { ok: true, action, message: "Initializing index, then starting watcher\u2026" }, 202, ctx.req);
-          return;
-        }
-        const existingWatcher = activeWatchers.get(ctx.projectDir);
-        if (!existingWatcher || !existingWatcher.isRunning) {
-          const watcher = new engine.CodemapWatcher({ projectDir: ctx.projectDir, branch });
-          activeWatchers.set(ctx.projectDir, watcher);
-          watcher.start().catch((err) => {
-            console.error(`[codemap] Watcher error: ${err instanceof Error ? err.message : String(err)}`);
-            activeWatchers.delete(ctx.projectDir);
-          });
-        }
-        jsonResponse(ctx.res, { ok: true, action, message: "Watcher started" }, 200, ctx.req);
-        return;
-      }
-      case "stop-watch": {
-        const existingWatcher = activeWatchers.get(ctx.projectDir);
-        if (existingWatcher && existingWatcher.isRunning) {
-          await existingWatcher.stop();
-          activeWatchers.delete(ctx.projectDir);
-          jsonResponse(ctx.res, { ok: true, action, message: "Watcher stopped" }, 200, ctx.req);
-        } else {
-          activeWatchers.delete(ctx.projectDir);
-          jsonResponse(ctx.res, { ok: true, action, message: "No watcher was running" }, 200, ctx.req);
-        }
-        return;
-      }
-      case "export": {
-        const engine = await getEngine();
-        const result = await engine.exportIndex(ctx.projectDir, branch);
-        jsonResponse(ctx.res, { ok: true, action, ...result }, 200, ctx.req);
-        return;
-      }
-      case "import": {
-        const engine = await getEngine();
-        const result = await engine.importIndex(ctx.projectDir, branch);
-        jsonResponse(ctx.res, { ok: true, action, ...result }, 200, ctx.req);
-        return;
-      }
-      case "serve": {
-        jsonResponse(
-          ctx.res,
-          { ok: false, action, message: "MCP server is CLI-only (stdio transport). Use 'ulpi codemap serve' from the command line." },
-          400,
-          ctx.req
-        );
-        return;
-      }
-      default:
-        jsonResponse(ctx.res, { error: `Unknown action: ${action}` }, 400, ctx.req);
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Action failed";
-    jsonResponse(ctx.res, { ok: false, action, error: message }, 500, ctx.req);
-  }
-}
-async function getEngine2() {
-  return await import("./dist-GJYT2OQV.js");
-}
-async function memoryStatusHandler(ctx) {
-  try {
-    const engine = await getEngine2();
-    const stats = await engine.getMemoryStats(ctx.projectDir);
-    const config = engine.loadMemoryConfig(ctx.projectDir);
-    const initialized = engine.isMemoryInitialized(ctx.projectDir);
-    const classifyProgress = engine.readClassifyBatchProgress(ctx.projectDir);
-    jsonResponse(ctx.res, { stats, config, initialized, classifyProgress }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to get memory status";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function memorySearchHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  const query = data.query;
-  if (typeof query !== "string" || !query.trim()) {
-    jsonResponse(ctx.res, { error: "Missing or empty 'query' field" }, 400, ctx.req);
-    return;
-  }
-  if (query.length > 1e3) {
-    jsonResponse(ctx.res, { error: "Query too long (max 1000 characters)" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const engine = await getEngine2();
-    const initialized = engine.isMemoryInitialized(ctx.projectDir);
-    if (!initialized) {
-      jsonResponse(ctx.res, {
-        query: query.trim(),
-        durationMs: 0,
-        results: []
-      }, 200, ctx.req);
-      return;
-    }
-    const result = await engine.searchMemory(ctx.projectDir, {
-      query: query.trim(),
-      limit: typeof data.limit === "number" ? Math.min(Math.max(1, data.limit), 50) : 10,
-      types: Array.isArray(data.types) ? data.types : void 0,
-      importance: Array.isArray(data.importance) ? data.importance : void 0,
-      tags: Array.isArray(data.tags) ? data.tags : void 0,
-      since: typeof data.since === "string" ? data.since : void 0
-    });
-    jsonResponse(ctx.res, {
-      query: result.query,
-      durationMs: result.durationMs,
-      results: result.results.map((r) => ({
-        entry: r.entry,
-        score: r.score,
-        finalScore: r.finalScore
-      }))
-    }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Search failed";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function memoryRememberHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  const summary = data.summary;
-  if (typeof summary !== "string" || !summary.trim()) {
-    jsonResponse(ctx.res, { error: "Missing or empty 'summary' field" }, 400, ctx.req);
-    return;
-  }
-  const type = data.type;
-  if (typeof type !== "string") {
-    jsonResponse(ctx.res, { error: "Missing 'type' field" }, 400, ctx.req);
-    return;
-  }
-  const validTypes = [
-    "DECISION",
-    "PATTERN",
-    "BUG_ROOT_CAUSE",
-    "PREFERENCE",
-    "CONSTRAINT",
-    "CONTEXT",
-    "LESSON",
-    "RELATIONSHIP"
-  ];
-  if (!validTypes.includes(type)) {
-    jsonResponse(ctx.res, { error: `Invalid type: ${type}. Valid: ${validTypes.join(", ")}` }, 400, ctx.req);
-    return;
-  }
-  try {
-    const engine = await getEngine2();
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const id = engine.generateMemoryId(type, summary.trim());
-    const entry = {
-      id,
-      type,
-      summary: summary.trim(),
-      detail: typeof data.detail === "string" ? data.detail : null,
-      importance: typeof data.importance === "string" ? data.importance : "medium",
-      tags: Array.isArray(data.tags) ? data.tags.filter((t) => typeof t === "string") : [],
-      relatedFiles: Array.isArray(data.relatedFiles) ? data.relatedFiles.filter((f) => typeof f === "string") : [],
-      source: {
-        type: "explicit"
-      },
-      createdAt: now,
-      updatedAt: now,
-      accessCount: 0
-    };
-    await engine.rememberMemory(ctx.projectDir, entry);
-    jsonResponse(ctx.res, { success: true, id }, 201, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to remember memory";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function memoryTimelineHandler(ctx) {
-  try {
-    const engine = await getEngine2();
-    let entries = engine.listEntries(ctx.projectDir);
-    const typeParam = ctx.url.searchParams.get("type");
-    if (typeParam) {
-      const types = typeParam.split(",");
-      entries = entries.filter((e) => types.includes(e.type));
-    }
-    const sinceParam = ctx.url.searchParams.get("since");
-    if (sinceParam) {
-      entries = entries.filter((e) => e.createdAt >= sinceParam);
-    }
-    entries.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
-    const limitParam = ctx.url.searchParams.get("limit");
-    const limit = limitParam ? Math.min(Math.max(1, parseInt(limitParam, 10) || 20), 200) : 20;
-    entries = entries.slice(0, limit);
-    jsonResponse(ctx.res, { entries }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to list timeline";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function memoryEntryHandler(ctx) {
-  const id = ctx.params["1"];
-  if (!id) {
-    jsonResponse(ctx.res, { error: "Missing entry ID" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const engine = await getEngine2();
-    const entry = engine.loadEntry(ctx.projectDir, id);
-    if (!entry) {
-      jsonResponse(ctx.res, { error: "Entry not found" }, 404, ctx.req);
-      return;
-    }
-    jsonResponse(ctx.res, entry, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load entry";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function memoryForgetHandler(ctx) {
-  const id = ctx.params["1"];
-  if (!id) {
-    jsonResponse(ctx.res, { error: "Missing entry ID" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const engine = await getEngine2();
-    const updated = engine.updateEntry(ctx.projectDir, id, {
-      supersededBy: "manual"
-    });
-    if (!updated) {
-      jsonResponse(ctx.res, { error: "Entry not found" }, 404, ctx.req);
-      return;
-    }
-    jsonResponse(ctx.res, { success: true }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to forget entry";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function memoryActionHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  const action = data.action;
-  const validActions = ["init", "export", "import", "enable", "disable", "classify", "classify-all", "classify-clear", "reindex"];
-  if (!validActions.includes(action)) {
-    jsonResponse(
-      ctx.res,
-      { error: `Invalid action: ${action}. Valid: ${validActions.join(", ")}` },
-      400,
-      ctx.req
-    );
-    return;
-  }
-  try {
-    const engine = await getEngine2();
-    switch (action) {
-      case "init": {
-        const config = engine.loadMemoryConfig(ctx.projectDir);
-        engine.saveMemoryConfig(ctx.projectDir, { ...config, enabled: true });
-        if (!engine.memoryBranchExists(ctx.projectDir)) {
-          try {
-            engine.initMemoryBranch(ctx.projectDir);
-          } catch {
-          }
-        }
-        jsonResponse(ctx.res, { ok: true, action, message: "Memory initialized" }, 200, ctx.req);
-        return;
-      }
-      case "export": {
-        const result = await engine.exportMemories(ctx.projectDir);
-        jsonResponse(ctx.res, { ok: true, action, ...result }, 200, ctx.req);
-        return;
-      }
-      case "import": {
-        const result = await engine.importMemories(ctx.projectDir);
-        jsonResponse(ctx.res, { ok: true, action, ...result }, 200, ctx.req);
-        return;
-      }
-      case "enable": {
-        const config = engine.loadMemoryConfig(ctx.projectDir);
-        engine.saveMemoryConfig(ctx.projectDir, { ...config, enabled: true });
-        jsonResponse(ctx.res, { ok: true, action, message: "Memory enabled" }, 200, ctx.req);
-        return;
-      }
-      case "disable": {
-        const config = engine.loadMemoryConfig(ctx.projectDir);
-        engine.saveMemoryConfig(ctx.projectDir, { ...config, enabled: false });
-        jsonResponse(ctx.res, { ok: true, action, message: "Memory disabled" }, 200, ctx.req);
-        return;
-      }
-      case "classify": {
-        const sessionId = typeof data.sessionId === "string" ? data.sessionId : void 0;
-        if (!sessionId) {
-          jsonResponse(ctx.res, { error: "Missing 'sessionId' for classify action" }, 400, ctx.req);
-          return;
-        }
-        const result = await engine.classifySession(ctx.projectDir, sessionId);
-        jsonResponse(ctx.res, { ok: true, action, ...result }, 200, ctx.req);
-        return;
-      }
-      case "classify-all": {
-        const { spawn: spawn4 } = await import("child_process");
-        const ulpiBin = process.argv[1];
-        const args = ["memory", "classify", "-p", ctx.projectDir];
-        if (typeof data.branch === "string" && data.branch) {
-          args.push("--branch", data.branch);
-        }
-        if (data.export) args.push("--export");
-        const child = spawn4(process.execPath, [ulpiBin, ...args], {
-          detached: true,
-          stdio: "ignore",
-          env: { ...process.env, ULPI_BG_CLASSIFY: "1" }
-        });
-        child.unref();
-        jsonResponse(ctx.res, {
-          ok: true,
-          action,
-          message: "Classification started"
-        }, 200, ctx.req);
-        return;
-      }
-      case "classify-clear": {
-        engine.clearClassifyBatchProgress(ctx.projectDir);
-        jsonResponse(ctx.res, { ok: true, action, message: "Classification progress cleared" }, 200, ctx.req);
-        return;
-      }
-      case "reindex": {
-        const result = await engine.reindexMemories(ctx.projectDir);
-        jsonResponse(ctx.res, { ok: true, action, ...result }, 200, ctx.req);
-        return;
-      }
-      default:
-        jsonResponse(ctx.res, { error: `Unknown action: ${action}` }, 400, ctx.req);
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Action failed";
-    jsonResponse(ctx.res, { ok: false, action, error: message }, 500, ctx.req);
-  }
-}
-async function memoryConfigHandler(ctx) {
-  try {
-    const engine = await getEngine2();
-    const config = engine.loadMemoryConfig(ctx.projectDir);
-    jsonResponse(ctx.res, config, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load memory config";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function memoryConfigUpdateHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  try {
-    const engine = await getEngine2();
-    const existing = engine.loadMemoryConfig(ctx.projectDir);
-    const merged = { ...existing };
-    if (typeof data.enabled === "boolean") merged.enabled = data.enabled;
-    if (typeof data.captureMode === "string") merged.captureMode = data.captureMode;
-    if (typeof data.surfaceOnStart === "boolean") merged.surfaceOnStart = data.surfaceOnStart;
-    if (typeof data.surfaceLimit === "number") merged.surfaceLimit = data.surfaceLimit;
-    if (typeof data.autoExport === "boolean") merged.autoExport = data.autoExport;
-    if (Array.isArray(data.redactPatterns)) merged.redactPatterns = data.redactPatterns;
-    if (typeof data.classifier === "object" && data.classifier !== null) {
-      merged.classifier = { ...merged.classifier, ...data.classifier };
-    }
-    if (typeof data.embedding === "object" && data.embedding !== null) {
-      merged.embedding = { ...merged.embedding, ...data.embedding };
-    }
-    if (typeof data.retention === "object" && data.retention !== null) {
-      merged.retention = { ...merged.retention, ...data.retention };
-    }
-    if (typeof data.ranking === "object" && data.ranking !== null) {
-      merged.ranking = { ...merged.ranking, ...data.ranking };
-    }
-    engine.saveMemoryConfig(ctx.projectDir, merged);
-    jsonResponse(ctx.res, merged, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update memory config";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function getDepgraph() {
-  return await import("./dist-YA2BWZB2.js");
-}
-async function getBranch(projectDir) {
-  const { getCurrentBranch: getCurrentBranch2 } = await import("./dist-RKOGLK7R.js");
-  return getCurrentBranch2(projectDir);
-}
-async function depgraphStatusHandler(ctx) {
-  try {
-    const depgraph = await getDepgraph();
-    const branch = await getBranch(ctx.projectDir);
-    const graph = depgraph.loadGraph(ctx.projectDir, branch);
-    if (!graph) {
-      jsonResponse(ctx.res, {
-        available: false,
-        nodeCount: 0,
-        edgeCount: 0,
-        definitionCount: 0,
-        referenceCount: 0,
-        cycleCount: 0,
-        topFiles: []
-      }, 200, ctx.req);
-      return;
-    }
-    const pageRank = depgraph.loadPageRank(ctx.projectDir, branch);
-    const metrics = depgraph.loadMetrics(ctx.projectDir, branch);
-    let definitionCount = 0;
-    let referenceCount = 0;
-    for (const node of Object.values(graph.nodes)) {
-      definitionCount += node.definitionCount;
-      referenceCount += node.referenceCount;
-    }
-    const topFiles = [];
-    if (pageRank) {
-      const sorted = Object.entries(pageRank.ranks).sort((a, b) => b[1] - a[1]).slice(0, 10);
-      for (const [filePath, rank] of sorted) {
-        topFiles.push({ filePath, rank });
-      }
-    }
-    jsonResponse(ctx.res, {
-      available: true,
-      nodeCount: Object.keys(graph.nodes).length,
-      edgeCount: graph.edges.length,
-      definitionCount,
-      referenceCount,
-      cycleCount: metrics?.cycles?.length ?? 0,
-      topFiles
-    }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to get depgraph status";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function depgraphSearchHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  const filePath = data.filePath;
-  if (typeof filePath !== "string" || !filePath.trim()) {
-    jsonResponse(ctx.res, { error: "Missing or empty 'filePath' field" }, 400, ctx.req);
-    return;
-  }
-  const direction = data.direction;
-  if (direction !== "deps" && direction !== "dependents") {
-    jsonResponse(ctx.res, { error: "Field 'direction' must be 'deps' or 'dependents'" }, 400, ctx.req);
-    return;
-  }
-  const includeTransitive = data.includeTransitive === true;
-  const maxDepth = typeof data.maxDepth === "number" ? Math.max(1, Math.min(data.maxDepth, 50)) : 10;
-  try {
-    const depgraph = await getDepgraph();
-    const branch = await getBranch(ctx.projectDir);
-    const graph = depgraph.loadGraph(ctx.projectDir, branch);
-    if (!graph) {
-      jsonResponse(ctx.res, {
-        filePath: filePath.trim(),
-        direction,
-        results: []
-      }, 200, ctx.req);
-      return;
-    }
-    let results;
-    if (includeTransitive) {
-      const files = direction === "deps" ? depgraph.getTransitiveDeps(graph, filePath.trim(), maxDepth) : depgraph.getTransitiveRdeps(graph, filePath.trim(), maxDepth);
-      results = files.map((f) => ({ filePath: f }));
-    } else {
-      const edges = direction === "deps" ? depgraph.getOutgoingEdges(graph, filePath.trim()) : depgraph.getIncomingEdges(graph, filePath.trim());
-      results = edges.map((e) => ({
-        filePath: direction === "deps" ? e.target : e.source,
-        symbols: e.symbols
-      }));
-    }
-    jsonResponse(ctx.res, {
-      filePath: filePath.trim(),
-      direction,
-      results
-    }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Depgraph search failed";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function depgraphRankingHandler(ctx) {
-  try {
-    const depgraph = await getDepgraph();
-    const branch = await getBranch(ctx.projectDir);
-    const pageRank = depgraph.loadPageRank(ctx.projectDir, branch);
-    if (!pageRank) {
-      jsonResponse(ctx.res, { totalFiles: 0, rankings: [] }, 200, ctx.req);
-      return;
-    }
-    const limitParam = ctx.url.searchParams.get("limit");
-    const limit = limitParam ? Math.max(1, Math.min(parseInt(limitParam, 10) || 20, 500)) : 20;
-    const sorted = Object.entries(pageRank.ranks).sort((a, b) => b[1] - a[1]);
-    const rankings = sorted.slice(0, limit).map(([filePath, rank], i) => ({
-      filePath,
-      rank,
-      position: i + 1
-    }));
-    jsonResponse(ctx.res, {
-      totalFiles: sorted.length,
-      rankings
-    }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to get depgraph ranking";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function depgraphCyclesHandler(ctx) {
-  try {
-    const depgraph = await getDepgraph();
-    const branch = await getBranch(ctx.projectDir);
-    const graph = depgraph.loadGraph(ctx.projectDir, branch);
-    if (!graph) {
-      jsonResponse(ctx.res, { totalCycles: 0, cycles: [] }, 200, ctx.req);
-      return;
-    }
-    const limitParam = ctx.url.searchParams.get("limit");
-    const limit = limitParam ? Math.max(1, Math.min(parseInt(limitParam, 10) || 20, 500)) : 20;
-    const cycles = depgraph.detectCycles(graph);
-    jsonResponse(ctx.res, {
-      totalCycles: cycles.length,
-      cycles: cycles.slice(0, limit).map((c) => ({
-        files: c.files,
-        edgeCount: c.edgeCount
-      }))
-    }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to detect cycles";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function depgraphMetricsHandler(ctx) {
-  const { data, error } = await parseJsonBody(ctx.req);
-  if (error || !data) {
-    jsonResponse(ctx.res, { error: error ?? "Invalid request body" }, 400, ctx.req);
-    return;
-  }
-  const modulePath = typeof data.modulePath === "string" ? data.modulePath : "";
-  try {
-    const depgraph = await getDepgraph();
-    const branch = await getBranch(ctx.projectDir);
-    const graph = depgraph.loadGraph(ctx.projectDir, branch);
-    if (!graph) {
-      jsonResponse(ctx.res, {
-        modulePath: modulePath.trim(),
-        metrics: []
-      }, 200, ctx.req);
-      return;
-    }
-    const coupling = depgraph.computeCoupling(graph);
-    const prefix = modulePath.trim();
-    const filtered = coupling.filter((c) => c.filePath.startsWith(prefix));
-    jsonResponse(ctx.res, {
-      modulePath: prefix,
-      metrics: filtered.map((c) => ({
-        filePath: c.filePath,
-        afferentCoupling: c.afferentCoupling,
-        efferentCoupling: c.efferentCoupling,
-        instability: c.instability
-      }))
-    }, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to compute metrics";
-    jsonResponse(ctx.res, { error: message }, 500, ctx.req);
-  }
-}
-async function ulpiModelsHandler(ctx) {
-  const apiKey = resolveApiKey("ulpi");
-  const baseUrl = resolveUlpiUrl();
-  if (!apiKey) {
-    jsonResponse(
-      ctx.res,
-      { error: "No ULPI API key configured. Set it with: ulpi config set ulpi-key <key>" },
-      400,
-      ctx.req
-    );
-    return;
-  }
-  try {
-    const response = await fetch(`${baseUrl}/api/v1/models`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!response.ok) {
-      const text = await response.text().catch(() => "");
-      jsonResponse(
-        ctx.res,
-        { error: `ULPI API returned ${response.status}: ${text.slice(0, 200)}` },
-        response.status === 401 || response.status === 403 ? 401 : 502,
-        ctx.req
-      );
-      return;
-    }
-    const data = await response.json();
-    jsonResponse(ctx.res, data, 200, ctx.req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to fetch ULPI models";
-    jsonResponse(ctx.res, { error: message }, 502, ctx.req);
-  }
-}
-function resolveClaudePath2() {
-  try {
-    const result = execFileSync2("which", ["claude"], { stdio: "pipe", timeout: 3e3 }).toString().trim();
-    if (result) return result;
-  } catch {
-  }
-  const home = os2.homedir();
-  const candidates = [
-    path7.join(home, ".local", "bin", "claude"),
-    path7.join(home, ".claude", "bin", "claude"),
-    "/usr/local/bin/claude"
-  ];
-  for (const p of candidates) {
-    try {
-      if (fs10.existsSync(p)) return p;
-    } catch {
-    }
-  }
-  return null;
-}
-var cachedClaudePath2;
-function getClaudePath2() {
-  if (cachedClaudePath2 === void 0) {
-    cachedClaudePath2 = resolveClaudePath2();
-  }
-  return cachedClaudePath2;
-}
-function isClaudeCliAvailable2() {
-  const p = getClaudePath2();
-  if (!p) return false;
-  try {
-    execFileSync2(p, ["--version"], { stdio: "pipe", timeout: 5e3 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function computeAntiPatternMetrics(events) {
-  const rawFileEdits = {};
-  for (const ev of events) {
-    if ((ev.toolName === "Write" || ev.toolName === "Edit") && ev.filePath) {
-      rawFileEdits[ev.filePath] = (rawFileEdits[ev.filePath] ?? 0) + 1;
-    }
-  }
-  const fileEditCounts = {};
-  for (const [file, count] of Object.entries(rawFileEdits)) {
-    if (count >= 3) fileEditCounts[file] = count;
-  }
-  const postcondFailRates = {};
-  for (const ev of events) {
-    if (ev.event === "postcondition_run" && ev.command) {
-      if (!postcondFailRates[ev.command]) {
-        postcondFailRates[ev.command] = { success: 0, fail: 0 };
-      }
-      postcondFailRates[ev.command].success++;
-    }
-    if (ev.event === "postcondition_failed" && ev.command) {
-      if (!postcondFailRates[ev.command]) {
-        postcondFailRates[ev.command] = { success: 0, fail: 0 };
-      }
-      postcondFailRates[ev.command].fail++;
-    }
-  }
-  const blockRetrySequences = [];
-  let currentBlock = null;
-  for (const ev of events) {
-    if (ev.event === "tool_blocked" && ev.toolName) {
-      const key = `${ev.toolName}|${ev.filePath ?? ""}|${ev.ruleName ?? ""}`;
-      if (currentBlock && `${currentBlock.tool}|${currentBlock.file}|${currentBlock.rule}` === key) {
-        currentBlock.count++;
-      } else {
-        if (currentBlock && currentBlock.count >= 2) {
-          blockRetrySequences.push({ ...currentBlock });
-        }
-        currentBlock = {
-          tool: ev.toolName,
-          file: ev.filePath ?? "",
-          rule: ev.ruleName ?? "",
-          count: 1
-        };
-      }
-    } else {
-      if (currentBlock && currentBlock.count >= 2) {
-        blockRetrySequences.push({ ...currentBlock });
-      }
-      currentBlock = null;
-    }
-  }
-  if (currentBlock && currentBlock.count >= 2) {
-    blockRetrySequences.push({ ...currentBlock });
-  }
-  const rawCmdCounts = {};
-  for (const ev of events) {
-    if (ev.toolName === "Bash" && ev.command) {
-      rawCmdCounts[ev.command] = (rawCmdCounts[ev.command] ?? 0) + 1;
-    }
-  }
-  const commandRepeatCounts = {};
-  for (const [cmd, count] of Object.entries(rawCmdCounts)) {
-    if (count >= 5) commandRepeatCounts[cmd] = count;
-  }
-  return { fileEditCounts, postcondFailRates, blockRetrySequences, commandRepeatCounts };
-}
-function buildEnrichmentPrompt(entry, rawEvents) {
-  const sections = [];
-  sections.push("You are analyzing a commit captured by ULPI, a rules engine for AI coding agents.");
-  sections.push("Fill in the structured output fields:");
-  sections.push("- summary: A concise 1-2 sentence description of what this commit accomplishes.");
-  sections.push("- intent: The high-level goal or motivation behind the changes.");
-  sections.push("- challenges: Specific difficulties encountered during this session (e.g. test failures, blocked tools, repeated edits). Be concrete, not vague.");
-  sections.push("- ruleInsights: Observations about which guardian rules helped, which were too strict, or what rules could be added. Reference specific rule names when possible.");
-  sections.push("");
-  sections.push("## Commit");
-  sections.push(`SHA: ${entry.commit.shortSha}`);
-  sections.push(`Subject: ${entry.commit.subject}`);
-  sections.push(`Author: ${entry.commit.authorName}`);
-  sections.push(`Date: ${entry.commit.authorDate}`);
-  sections.push(`Branch: ${entry.commit.branch}`);
-  if (entry.commit.message !== entry.commit.subject) {
-    sections.push(`Message:
-${entry.commit.message}`);
-  }
-  sections.push("");
-  sections.push("## Diff Stats");
-  sections.push(`Files changed: ${entry.diff.filesChanged}`);
-  sections.push(`Insertions: +${entry.diff.insertions}`);
-  sections.push(`Deletions: -${entry.diff.deletions}`);
-  if (entry.diff.files.length > 0) {
-    sections.push("Files:");
-    for (const f of entry.diff.files.slice(0, 30)) {
-      sections.push(`  ${f.status} ${f.path} (+${f.additions}/-${f.deletions})`);
-    }
-    if (entry.diff.files.length > 30) {
-      sections.push(`  ... and ${entry.diff.files.length - 30} more files`);
-    }
-  }
-  sections.push("");
-  if (entry.session) {
-    const s = entry.session;
-    sections.push("## Session Summary");
-    sections.push(`Session: ${s.sessionId}${s.sessionName ? ` (${s.sessionName})` : ""}`);
-    sections.push(`Total events: ${s.totalEvents}`);
-    sections.push(`Rules enforced: ${s.stats.rulesEnforced}`);
-    sections.push(`Actions blocked: ${s.stats.actionsBlocked}`);
-    sections.push(`Auto-approved: ${s.stats.autoActionsRun}`);
-    sections.push(`Files read: ${s.stats.filesRead}, written: ${s.stats.filesWritten}, deleted: ${s.stats.filesDeleted}`);
-    sections.push(`Commands run: ${s.stats.commandsRun}`);
-    sections.push(`Tests: ${s.stats.testsRun ? s.stats.testsPassed ? "passed" : "failed/unknown" : "not run"}`);
-    sections.push(`Lint: ${s.stats.lintRun ? "run" : "not run"}, Build: ${s.stats.buildRun ? "run" : "not run"}`);
-    if (s.blockedTools.length > 0) {
-      sections.push(`Blocked tools: ${s.blockedTools.join(", ")}`);
-    }
-    if (s.preconditionsFired.length > 0) {
-      sections.push(`Preconditions fired: ${s.preconditionsFired.join(", ")}`);
-    }
-    if (s.postconditionsRun.length > 0) {
-      sections.push(`Postconditions run: ${s.postconditionsRun.join(", ")}`);
-    }
-    if (s.skillsInjected.length > 0) {
-      sections.push(`Skills injected: ${s.skillsInjected.join(", ")}`);
-    }
-    sections.push("");
-  }
-  if (rawEvents && rawEvents.length > 0) {
-    const metrics = computeAntiPatternMetrics(rawEvents);
-    const hasMetrics = Object.keys(metrics.fileEditCounts).length > 0 || Object.keys(metrics.postcondFailRates).length > 0 || metrics.blockRetrySequences.length > 0 || Object.keys(metrics.commandRepeatCounts).length > 0;
-    if (hasMetrics) {
-      sections.push("## Anti-Pattern Metrics");
-      if (Object.keys(metrics.fileEditCounts).length > 0) {
-        sections.push("Files edited 3+ times (possible churn):");
-        for (const [file, count] of Object.entries(metrics.fileEditCounts)) {
-          sections.push(`  ${file}: ${count} edits`);
-        }
-      }
-      if (metrics.blockRetrySequences.length > 0) {
-        sections.push("Block-retry sequences (tool blocked then retried):");
-        for (const seq of metrics.blockRetrySequences) {
-          sections.push(`  ${seq.tool}${seq.file ? ` on ${seq.file}` : ""}${seq.rule ? ` by ${seq.rule}` : ""}: ${seq.count}x`);
-        }
-      }
-      const failedPostconds = Object.entries(metrics.postcondFailRates).filter(
-        ([, v]) => v.fail > 0
-      );
-      if (failedPostconds.length > 0) {
-        sections.push("Postcondition failure rates:");
-        for (const [cmd, rates] of failedPostconds) {
-          sections.push(`  ${cmd}: ${rates.success} pass, ${rates.fail} fail`);
-        }
-      }
-      if (Object.keys(metrics.commandRepeatCounts).length > 0) {
-        sections.push("Commands run 5+ times:");
-        for (const [cmd, count] of Object.entries(metrics.commandRepeatCounts)) {
-          sections.push(`  ${cmd}: ${count}x`);
-        }
-      }
-      sections.push("");
-    }
-  }
-  if (entry.rawDiff) {
-    const maxAiDiff = 1e4;
-    const diffExcerpt = entry.rawDiff.length > maxAiDiff ? entry.rawDiff.slice(0, maxAiDiff) + "\n... (truncated)" : entry.rawDiff;
-    sections.push("## Raw Diff (excerpt)");
-    sections.push(diffExcerpt);
-    sections.push("");
-  }
-  sections.push("Fill in all fields based on the data above. Be specific and concrete.");
-  return sections.join("\n");
-}
-function toAiEnrichment(parsed, model, generatedAt) {
-  return {
-    summary: typeof parsed.summary === "string" ? parsed.summary : "",
-    intent: typeof parsed.intent === "string" ? parsed.intent : void 0,
-    challenges: Array.isArray(parsed.challenges) ? parsed.challenges : void 0,
-    ruleInsights: Array.isArray(parsed.ruleInsights) ? parsed.ruleInsights : void 0,
-    model,
-    generatedAt
-  };
-}
-function parseEnrichmentResponse(response, model) {
-  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  try {
-    const envelope = JSON.parse(response.trim());
-    if (envelope.structured_output && typeof envelope.structured_output === "object") {
-      return toAiEnrichment(envelope.structured_output, model, generatedAt);
-    }
-    if (typeof envelope.result === "string" && envelope.result.trim().startsWith("{")) {
-      const parsed = JSON.parse(envelope.result);
-      return toAiEnrichment(parsed, model, generatedAt);
-    }
-    if (typeof envelope.summary === "string") {
-      return toAiEnrichment(envelope, model, generatedAt);
-    }
-  } catch {
-  }
-  const jsonMatch = response.match(/```json\s*\n?([\s\S]*?)\n?\s*```/);
-  if (jsonMatch) {
-    try {
-      const parsed = JSON.parse(jsonMatch[1]);
-      return toAiEnrichment(parsed, model, generatedAt);
-    } catch {
-    }
-  }
-  try {
-    const parsed = JSON.parse(response.trim());
-    return toAiEnrichment(parsed, model, generatedAt);
-  } catch {
-  }
-  return {
-    summary: response.trim().slice(0, 500),
-    model,
-    generatedAt
-  };
-}
-var ENRICHMENT_SCHEMA = JSON.stringify({
-  type: "object",
-  properties: {
-    summary: { type: "string", description: "Concise 1-2 sentence description of what this commit accomplishes" },
-    intent: { type: "string", description: "High-level goal or motivation behind the changes" },
-    challenges: {
-      type: "array",
-      items: { type: "string" },
-      description: "Specific difficulties encountered (test failures, blocked tools, repeated edits)"
-    },
-    ruleInsights: {
-      type: "array",
-      items: { type: "string" },
-      description: "Observations about which guardian rules helped, which were too strict, or what rules could be added"
-    }
-  },
-  required: ["summary"]
-});
-function enrichEntry(entry, rawEvents, model = DEFAULT_AI_MODEL) {
-  const prompt = buildEnrichmentPrompt(entry, rawEvents);
-  return new Promise((resolve7, reject) => {
-    const timeout = 2 * 60 * 1e3;
-    const claudePath = getClaudePath2();
-    if (!claudePath) {
-      reject(new Error("Claude CLI not found"));
-      return;
-    }
-    const proc = spawn3(claudePath, [
-      "--print",
-      "--model",
-      model,
-      "--output-format",
-      "json",
-      "--json-schema",
-      ENRICHMENT_SCHEMA,
-      "--permission-mode",
-      "bypassPermissions"
-    ], {
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    proc.stdout.on("data", (data) => {
-      stdout += data.toString();
-    });
-    proc.stderr.on("data", (data) => {
-      stderr += data.toString();
-    });
-    proc.stdin.write(prompt);
-    proc.stdin.end();
-    const timer = setTimeout(() => {
-      proc.kill("SIGTERM");
-      reject(new Error("AI enrichment timed out after 2 minutes"));
-    }, timeout);
-    proc.on("close", (code) => {
-      clearTimeout(timer);
-      if (code !== 0) {
-        reject(new Error(`claude CLI exited with code ${code}: ${stderr.slice(0, 500)}`));
-      } else {
-        resolve7(parseEnrichmentResponse(stdout, model));
-      }
-    });
-    proc.on("error", (err) => {
-      clearTimeout(timer);
-      reject(new Error(`Failed to run claude CLI: ${err.message}`));
-    });
-  });
-}
-var HISTORY_CONFIG_FIELDS = {
-  enabled: "boolean",
-  branchName: "string",
-  aiEnrichment: "boolean",
-  aiModel: "string",
-  maxDiffSize: "number",
-  maxAiDiffSize: "number",
-  collectReviewPlans: "boolean",
-  captureTranscript: "boolean",
-  maxTranscriptSize: "number",
-  captureStrategy: "string"
-};
-function getUlpiVersion() {
-  try {
-    return globalThis.__ULPI_API_VERSION__ ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
-async function historyStatusHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  let totalEntries = 0;
-  let collectReviewPlans = false;
-  if (exists) {
-    const meta = readBranchMeta(projectDir);
-    if (meta) {
-      totalEntries = meta.totalEntries;
-      collectReviewPlans = meta.config?.collectReviewPlans ?? false;
-    }
-  }
-  jsonResponse(res, { exists, totalEntries, collectReviewPlans }, 200, req);
-}
-async function historyInitHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const alreadyExists = historyBranchExists(projectDir);
-  try {
-    if (!alreadyExists) {
-      const projectName = path8.basename(projectDir);
-      initHistoryBranch(projectDir, projectName, getUlpiVersion());
-    }
-    const body = await readBody(req);
-    let options = {};
-    try {
-      options = JSON.parse(body);
-    } catch {
-    }
-    if (options.collectReviewPlans) {
-      const meta = readBranchMeta(projectDir);
-      if (meta && !meta.config.collectReviewPlans) {
-        meta.config.collectReviewPlans = true;
-        await withWorktree(projectDir, getHistoryBranch(), (worktreeDir) => {
-          writeAndStage(worktreeDir, "meta.json", JSON.stringify(meta, null, 2) + "\n");
-          commitInWorktree(worktreeDir, "Enable review plan collection");
-        });
-      }
-    }
-    let gitHooksResult = { installed: [], skipped: [] };
-    try {
-      const { installGitHooks } = await import("./dist-QAU3LGJN.js");
-      const binaryPath = getBinaryPath();
-      gitHooksResult = installGitHooks(projectDir, binaryPath);
-    } catch {
-    }
-    const status = readBranchMeta(projectDir);
-    const totalEntries = status?.totalEntries ?? 0;
-    jsonResponse(
-      res,
-      {
-        success: true,
-        totalEntries,
-        config: status?.config,
-        gitHooks: gitHooksResult,
-        reinitialized: alreadyExists
-      },
-      alreadyExists ? 200 : 201,
-      req
-    );
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to initialize history";
-    jsonResponse(res, { error: message }, 500, req);
-  }
-}
-async function historyBackfillHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const body = await readBody(req);
-  let options = {};
-  try {
-    options = JSON.parse(body);
-  } catch {
-  }
-  const limit = Math.min(options.limit ?? 20, 100);
-  const branchOnly = options.branchOnly ?? false;
-  const {
-    listRecentCommits,
-    listBranchOnlyCommits,
-    getCommitMetadata,
-    getCommitDiffStats,
-    getCommitRawDiff,
-    loadActiveGuards,
-    findSessionForCommit,
-    buildSessionSummary,
-    entryExists,
-    writeHistoryEntry,
-    DEFAULT_HISTORY_CONFIG
-  } = await import("./dist-QAU3LGJN.js");
-  const commits = branchOnly ? listBranchOnlyCommits(projectDir, limit) : listRecentCommits(projectDir, limit);
-  if (commits.length === 0) {
-    jsonResponse(res, { captured: 0, skipped: 0, total: 0 }, 200, req);
-    return;
-  }
-  const meta = readBranchMeta(projectDir);
-  const config = meta?.config ?? DEFAULT_HISTORY_CONFIG;
-  let captured = 0;
-  let skipped = 0;
-  for (const sha of commits) {
-    if (entryExists(projectDir, sha)) {
-      skipped++;
-      continue;
-    }
-    try {
-      const metadata = getCommitMetadata(projectDir, sha);
-      const diffStats = getCommitDiffStats(projectDir, sha);
-      const rawDiffResult = getCommitRawDiff(projectDir, sha, config.maxDiffSize);
-      const guardsYaml = loadActiveGuards(projectDir);
-      let sessionSummary = null;
-      let sessionState = null;
-      let sessionEvents = [];
-      const sessionMatch = findSessionForCommit(projectDir, metadata.authorDate);
-      if (sessionMatch) {
-        sessionSummary = buildSessionSummary(sessionMatch.state, sessionMatch.events);
-        sessionState = sessionMatch.state;
-        sessionEvents = sessionMatch.events;
-      }
-      const entry = {
-        version: 1,
-        capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        commit: metadata,
-        diff: diffStats,
-        rawDiff: rawDiffResult.diff || void 0,
-        diffTruncated: rawDiffResult.truncated || void 0,
-        session: sessionSummary,
-        enrichment: null,
-        reviewPlans: null
-      };
-      await writeHistoryEntry(projectDir, entry, {
-        state: sessionState,
-        events: sessionEvents,
-        guardsYaml
-      });
-      captured++;
-    } catch {
-    }
-  }
-  jsonResponse(res, { captured, skipped, total: commits.length }, 200, req);
-}
-async function historyRewindHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const body = await readBody(req);
-  let payload = {};
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(res, { error: "Invalid JSON body" }, 400, req);
-    return;
-  }
-  if (!payload.sha) {
-    jsonResponse(res, { error: "sha is required" }, 400, req);
-    return;
-  }
-  if (!/^[0-9a-f]{4,40}$/i.test(payload.sha)) {
-    jsonResponse(res, { error: "Invalid SHA format" }, 400, req);
-    return;
-  }
-  const timeline = readTimeline(projectDir);
-  if (!timeline) {
-    jsonResponse(res, { error: "No timeline found" }, 400, req);
-    return;
-  }
-  const match = timeline.entries.find(
-    (e) => e.sha === payload.sha || e.shortSha === payload.sha || e.sha.startsWith(payload.sha)
-  );
-  if (!match) {
-    jsonResponse(res, { error: `No history entry found for SHA: ${payload.sha}` }, 404, req);
-    return;
-  }
-  try {
-    execFileSync3("git", ["diff", "--quiet"], {
-      cwd: projectDir,
-      encoding: "utf-8",
-      timeout: 5e3,
-      stdio: "pipe"
-    });
-    execFileSync3("git", ["diff", "--cached", "--quiet"], {
-      cwd: projectDir,
-      encoding: "utf-8",
-      timeout: 5e3,
-      stdio: "pipe"
-    });
-  } catch {
-    jsonResponse(res, { error: "You have uncommitted changes. Commit or stash before rewinding." }, 409, req);
-    return;
-  }
-  if (!payload.confirm) {
-    let diffStat = "";
-    try {
-      diffStat = execFileSync3("git", ["diff", "--stat", `HEAD...${match.sha}`], {
-        cwd: projectDir,
-        encoding: "utf-8",
-        timeout: 1e4,
-        stdio: "pipe"
-      }).trim();
-    } catch {
-    }
-    jsonResponse(res, {
-      preview: true,
-      sha: match.sha,
-      shortSha: match.shortSha,
-      subject: match.subject,
-      date: match.date,
-      diffStat
-    }, 200, req);
-    return;
-  }
-  try {
-    execFileSync3("git", ["reset", "--hard", match.sha], {
-      cwd: projectDir,
-      encoding: "utf-8",
-      timeout: 1e4,
-      stdio: "pipe"
-    });
-    jsonResponse(res, { success: true, sha: match.sha, shortSha: match.shortSha }, 200, req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Rewind failed";
-    jsonResponse(res, { error: message }, 500, req);
-  }
-}
-async function historyConfigGetHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, {
-      enabled: false,
-      branchName: getHistoryBranch(),
-      aiEnrichment: true,
-      aiModel: DEFAULT_AI_MODEL,
-      maxDiffSize: 5e4,
-      maxAiDiffSize: 1e4,
-      collectReviewPlans: false
-    }, 200, req);
-    return;
-  }
-  const meta = readBranchMeta(projectDir);
-  if (!meta) {
-    jsonResponse(res, { error: "Failed to read history branch metadata" }, 500, req);
-    return;
-  }
-  jsonResponse(res, meta.config, 200, req);
-}
-async function historyConfigPutHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: `History branch not initialized. Run '${CLI_BIN_NAME} history init' first.` }, 400, req);
-    return;
-  }
-  const body = await readBody(req);
-  let updates;
-  try {
-    updates = JSON.parse(body);
-  } catch {
-    jsonResponse(res, { error: "Invalid JSON body" }, 400, req);
-    return;
-  }
-  const filtered = {};
-  for (const [key, value] of Object.entries(updates)) {
-    const expectedType = HISTORY_CONFIG_FIELDS[key];
-    if (expectedType && typeof value === expectedType) {
-      filtered[key] = value;
-    }
-  }
-  if (Object.keys(filtered).length === 0) {
-    jsonResponse(res, { error: "No valid config fields provided" }, 400, req);
-    return;
-  }
-  try {
-    await withWorktree(projectDir, getHistoryBranch(), (worktreeDir) => {
-      const metaPath = path8.join(worktreeDir, "meta.json");
-      const raw = fs11.readFileSync(metaPath, "utf-8");
-      const meta2 = JSON.parse(raw);
-      meta2.config = { ...meta2.config, ...filtered };
-      writeAndStage(worktreeDir, "meta.json", JSON.stringify(meta2, null, 2));
-      commitInWorktree(worktreeDir, "chore(history): update config");
-    });
-    const meta = readBranchMeta(projectDir);
-    jsonResponse(res, meta?.config ?? updates, 200, req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update config";
-    jsonResponse(res, { error: message }, 500, req);
-  }
-}
-async function historyStatsHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const timeline = readTimeline(projectDir);
-  if (!timeline || timeline.entries.length === 0) {
-    jsonResponse(res, {
-      totalEntries: 0,
-      dateRange: null,
-      enrichmentCoverage: 0,
-      avgFilesChanged: 0,
-      avgInsertions: 0,
-      avgDeletions: 0,
-      topFiles: [],
-      tagCounts: {},
-      commitsByDay: {}
-    }, 200, req);
-    return;
-  }
-  const entries = timeline.entries;
-  const totalEntries = entries.length;
-  const dates = entries.map((e) => new Date(e.date).getTime()).filter((t) => !isNaN(t));
-  const dateRange = dates.length > 0 ? { from: new Date(Math.min(...dates)).toISOString(), to: new Date(Math.max(...dates)).toISOString() } : null;
-  const enriched = entries.filter((e) => e.hasEnrichment).length;
-  const enrichmentCoverage = Math.round(enriched / totalEntries * 100);
-  let totalFilesChanged = 0;
-  let totalInsertions = 0;
-  let totalDeletions = 0;
-  const fileChangeCounts = /* @__PURE__ */ new Map();
-  const tagCounts = {};
-  const commitsByDay = {};
-  for (const te of entries) {
-    totalFilesChanged += te.filesChanged;
-    try {
-      const day = te.date.slice(0, 10);
-      commitsByDay[day] = (commitsByDay[day] ?? 0) + 1;
-    } catch {
-    }
-    if (te.tags) {
-      for (const tag of te.tags) {
-        tagCounts[tag] = (tagCounts[tag] ?? 0) + 1;
-      }
-    }
-    const full = readHistoryEntry(projectDir, te.sha);
-    if (full) {
-      totalInsertions += full.diff.insertions;
-      totalDeletions += full.diff.deletions;
-      for (const f of full.diff.files) {
-        fileChangeCounts.set(f.path, (fileChangeCounts.get(f.path) ?? 0) + 1);
-      }
-    }
-  }
-  const topFiles = [...fileChangeCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 20).map(([file, count]) => ({ file, count }));
-  jsonResponse(res, {
-    totalEntries,
-    dateRange,
-    enrichmentCoverage,
-    avgFilesChanged: Math.round(totalFilesChanged / totalEntries),
-    avgInsertions: Math.round(totalInsertions / totalEntries),
-    avgDeletions: Math.round(totalDeletions / totalEntries),
-    topFiles,
-    tagCounts,
-    commitsByDay
-  }, 200, req);
-}
-async function historyEntriesListHandler(ctx) {
-  const { projectDir, url, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const timeline = readTimeline(projectDir);
-  if (!timeline) {
-    jsonResponse(res, [], 200, req);
-    return;
-  }
-  const tagFilter = url.searchParams.get("tag");
-  let entries = timeline.entries;
-  if (tagFilter) {
-    entries = entries.filter((e) => e.tags?.includes(tagFilter));
-  }
-  jsonResponse(res, entries, 200, req);
-}
-async function historyEntryDetailHandler(ctx) {
-  const { projectDir, params, req, res } = ctx;
-  const sha = params.sha ?? params["1"] ?? "";
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const entry = readHistoryEntry(projectDir, sha);
-  if (!entry) {
-    jsonResponse(res, { error: `Entry not found: ${sha}` }, 404, req);
-    return;
-  }
-  jsonResponse(res, entry, 200, req);
-}
-async function historyEntryTagsHandler(ctx) {
-  const { projectDir, params, req, res } = ctx;
-  const sha = params.sha ?? params["1"] ?? "";
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const body = await readBody(req);
-  let payload;
-  try {
-    payload = JSON.parse(body);
-  } catch {
-    jsonResponse(res, { error: "Invalid JSON body" }, 400, req);
-    return;
-  }
-  if (!Array.isArray(payload.tags) || !payload.tags.every((t) => typeof t === "string")) {
-    jsonResponse(res, { error: "tags must be a string array" }, 400, req);
-    return;
-  }
-  try {
-    const { updateEntryTags } = await import("./dist-QAU3LGJN.js");
-    await updateEntryTags(projectDir, sha, payload.tags);
-    jsonResponse(res, { success: true, sha, tags: payload.tags }, 200, req);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update tags";
-    jsonResponse(res, { error: message }, 500, req);
-  }
-}
-async function historyEntryTranscriptHandler(ctx) {
-  const { projectDir, params, req, res } = ctx;
-  const sha = params.sha ?? params["1"] ?? "";
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const { readEntryTranscript } = await import("./dist-QAU3LGJN.js");
-  const transcript = readEntryTranscript(projectDir, sha);
-  if (!transcript) {
-    jsonResponse(res, { error: "No transcript for this entry" }, 404, req);
-    return;
-  }
-  jsonResponse(res, { sha, transcript }, 200, req);
-}
-async function historyExportHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const timeline = readTimeline(projectDir);
-  const meta = readBranchMeta(projectDir);
-  if (!timeline) {
-    jsonResponse(res, { error: "No timeline data found" }, 404, req);
-    return;
-  }
-  const fullEntries = [];
-  for (const te of timeline.entries) {
-    const full = readHistoryEntry(projectDir, te.sha);
-    fullEntries.push({ timeline: te, entry: full });
-  }
-  jsonResponse(res, {
-    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    meta,
-    timeline: timeline.entries,
-    entries: fullEntries
-  }, 200, req);
-}
-async function historyEnrichStatusGetHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const status = enrichmentStatus.get(projectDir);
-  if (!status) {
-    jsonResponse(res, { status: "idle", total: 0, completed: 0, failed: 0 }, 200, req);
-  } else {
-    jsonResponse(res, status, 200, req);
-  }
-}
-async function historyEnrichStatusDeleteHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  enrichmentStatus.delete(projectDir);
-  jsonResponse(res, { success: true }, 200, req);
-}
-async function historyEnrichHandler(ctx) {
-  const { projectDir, req, res } = ctx;
-  const exists = historyBranchExists(projectDir);
-  if (!exists) {
-    jsonResponse(res, { error: "History branch not initialized" }, 400, req);
-    return;
-  }
-  const current = enrichmentStatus.get(projectDir);
-  if (current?.status === "enriching") {
-    jsonResponse(res, { error: "Enrichment already in progress" }, 409, req);
-    return;
-  }
-  if (!isClaudeCliAvailable2()) {
-    jsonResponse(res, { error: "Claude CLI not found. Install it from https://claude.ai/download" }, 400, req);
-    return;
-  }
-  const body = await readBody(req);
-  let targetSha;
-  let model = DEFAULT_AI_MODEL;
-  if (body) {
-    try {
-      const payload = JSON.parse(body);
-      if (payload.sha && typeof payload.sha === "string") targetSha = payload.sha;
-      if (payload.model && typeof payload.model === "string") model = payload.model;
-    } catch {
-    }
-  }
-  const timeline = readTimeline(projectDir);
-  if (!timeline || timeline.entries.length === 0) {
-    jsonResponse(res, { error: "No history entries to enrich" }, 400, req);
-    return;
-  }
-  let toEnrich;
-  if (targetSha) {
-    toEnrich = [targetSha];
-  } else {
-    toEnrich = timeline.entries.filter((e) => !e.hasEnrichment).map((e) => e.sha);
-  }
-  if (toEnrich.length === 0) {
-    jsonResponse(res, { status: "done", total: 0, completed: 0, failed: 0 }, 200, req);
-    return;
-  }
-  enrichmentStatus.set(projectDir, {
-    status: "enriching",
-    total: toEnrich.length,
-    completed: 0,
-    failed: 0
-  });
-  jsonResponse(res, { success: true, total: toEnrich.length }, 202, req);
-  (async () => {
-    let completed = 0;
-    let failed = 0;
-    for (const sha of toEnrich) {
-      const statusEntry = enrichmentStatus.get(projectDir);
-      if (!statusEntry || statusEntry.status !== "enriching") break;
-      statusEntry.current = sha.slice(0, 7);
-      try {
-        const entry = readHistoryEntry(projectDir, sha);
-        if (!entry) {
-          console.error(`[enrich] Entry not found for sha ${sha.slice(0, 7)}`);
-          failed++;
-          continue;
-        }
-        let rawEvents;
-        if (entry.session?.sessionId) {
-          try {
-            rawEvents = readEvents(entry.session.sessionId, projectDir);
-          } catch {
-          }
-        }
-        console.error(`[enrich] Enriching ${sha.slice(0, 7)} with model ${model}...`);
-        const enrichment = await enrichEntry(entry, rawEvents, model);
-        console.error(`[enrich] Got enrichment for ${sha.slice(0, 7)}, writing...`);
-        await updateEntryEnrichment(projectDir, sha, enrichment);
-        console.error(`[enrich] Successfully enriched ${sha.slice(0, 7)}`);
-        completed++;
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[enrich] Failed to enrich ${sha.slice(0, 7)}: ${msg}`);
-        failed++;
-        const s = enrichmentStatus.get(projectDir);
-        if (s) s.error = msg;
-      }
-      const progress = enrichmentStatus.get(projectDir);
-      if (progress) {
-        progress.completed = completed;
-        progress.failed = failed;
-      }
-    }
-    enrichmentStatus.set(projectDir, {
-      status: "done",
-      total: toEnrich.length,
-      completed,
-      failed,
-      current: void 0
-    });
-  })().catch((err) => {
-    enrichmentStatus.set(projectDir, {
-      status: "error",
-      total: toEnrich.length,
-      completed: 0,
-      failed: 0,
-      error: err instanceof Error ? err.message : String(err)
-    });
-  });
-}
-function registerHistoryRoutes(router) {
-  router.get("/api/history/status", historyStatusHandler);
-  router.post("/api/history/init", historyInitHandler);
-  router.post("/api/history/backfill", historyBackfillHandler);
-  router.post("/api/history/rewind", historyRewindHandler);
-  router.get("/api/history/config", historyConfigGetHandler);
-  router.put("/api/history/config", historyConfigPutHandler);
-  router.get("/api/history/stats", historyStatsHandler);
-  router.get(
-    /^\/api\/history\/entries\/(?<sha>[^/]+)\/transcript$/,
-    historyEntryTranscriptHandler
-  );
-  router.put(
-    /^\/api\/history\/entries\/(?<sha>[^/]+)\/tags$/,
-    historyEntryTagsHandler
-  );
-  router.get(
-    /^\/api\/history\/entries\/(?<sha>[^/]+)$/,
-    historyEntryDetailHandler
-  );
-  router.get("/api/history/entries", historyEntriesListHandler);
-  router.get("/api/history/export", historyExportHandler);
-  router.get("/api/history/enrich/status", historyEnrichStatusGetHandler);
-  router.delete("/api/history/enrich/status", historyEnrichStatusDeleteHandler);
-  router.post("/api/history/enrich", historyEnrichHandler);
-}
-function resolveHtmlPath() {
-  const candidates = [];
-  if (process.argv[1]) {
-    const entryDir = path9.dirname(path9.resolve(process.argv[1]));
-    candidates.push(path9.join(entryDir, "ui.html"));
-    candidates.push(path9.join(entryDir, "../../web-ui/dist/index.html"));
-    try {
-      const realEntry = path9.dirname(fs12.realpathSync(process.argv[1]));
-      if (realEntry !== entryDir) {
-        candidates.push(path9.join(realEntry, "ui.html"));
-        candidates.push(path9.join(realEntry, "../../web-ui/dist/index.html"));
-      }
-    } catch {
-    }
-    try {
-      const shimContent = fs12.readFileSync(process.argv[1], "utf-8");
-      const importMatch = shimContent.match(/import\(["']([^"']+)["']\)/);
-      if (importMatch) {
-        const shimTarget = path9.dirname(importMatch[1]);
-        candidates.push(path9.join(shimTarget, "ui.html"));
-        candidates.push(path9.join(shimTarget, "../../web-ui/dist/index.html"));
-      }
-    } catch {
-    }
-  }
-  const thisDir = path9.dirname(new URL(import.meta.url).pathname);
-  candidates.push(path9.join(thisDir, "ui.html"));
-  candidates.push(path9.join(thisDir, "../../cli/dist/ui.html"));
-  candidates.push(path9.join(thisDir, "../../web-ui/dist/index.html"));
-  for (const p of candidates) {
-    if (fs12.existsSync(p)) return p;
-  }
-  return null;
-}
-function createApiServer(projectDir) {
-  const router = createRouter();
-  router.get("/api/health", healthHandler);
-  router.get("/api/version", versionHandler);
-  router.get("/api/paths", pathsHandler);
-  router.get("/api/rules", listRulesHandler);
-  router.post("/api/rules", createRuleHandler);
-  router.get(/^\/api\/rules\/([^/]+)$/, getRuleHandler);
-  router.post(/^\/api\/rules\/([^/]+)\/toggle$/, toggleRuleHandler);
-  router.put(/^\/api\/rules\/([^/]+)$/, updateRuleHandler);
-  router.delete(/^\/api\/rules\/([^/]+)$/, deleteRuleHandler);
-  router.get("/api/responses", getResponsesHandler);
-  router.put("/api/responses", updateResponsesHandler);
-  router.get("/api/templates", listTemplatesHandler);
-  router.get("/api/skills", listSkillsHandler);
-  router.get("/api/projects", listProjectsHandler);
-  router.post("/api/projects", registerProjectHandler);
-  router.post("/api/projects/default", setDefaultProjectHandler);
-  router.post("/api/projects/scan", scanProjectsHandler);
-  router.post(/^\/api\/projects\/([^/]+)\/init$/, initProjectHandler);
-  router.get(/^\/api\/projects\/([^/]+)$/, getProjectHandler);
-  router.put(/^\/api\/projects\/([^/]+)$/, updateProjectHandler);
-  router.delete(/^\/api\/projects\/([^/]+)$/, deleteProjectHandler);
-  router.get("/api/sessions", sessionsListHandler);
-  router.get("/api/session", sessionHandler);
-  router.get("/api/events", eventsHandler);
-  router.get("/api/stack", stackHandler);
-  router.post("/api/init", initHandler);
-  router.post("/api/generate", generateHandler);
-  router.get("/api/generate/status", generateStatusHandler);
-  router.delete("/api/generate/status", generateStatusClearHandler);
-  router.get("/api/review/config", getReviewConfig);
-  router.put("/api/review/config", putReviewConfig);
-  router.get("/api/review/plans", listPlans);
-  router.get("/api/review/plans/pending-all", listPendingPlansAll);
-  router.get(/^\/api\/review\/plans\/([^/]+)$/, getPlan);
-  router.post(/^\/api\/review\/plans\/([^/]+)\/decision$/, planDecisionGone);
-  router.post(/^\/api\/review\/plans\/([^/]+)\/save$/, savePlanVersion);
-  router.post("/api/review/hub/register", hubRegister);
-  router.get("/api/review/hub/sessions", hubListSessions);
-  router.get("/api/review/hub/events", hubEvents);
-  router.get("/api/review/hub/health", hubHealth);
-  router.post(/^\/api\/review\/hub\/session\/([^/]+)\/decision$/, hubSubmitDecision);
-  router.get(/^\/api\/review\/hub\/session\/([^/]+)\/await$/, hubAwaitDecision);
-  router.get(/^\/api\/review\/hub\/session\/([^/]+)\/token$/, hubGetToken);
-  router.post(/^\/api\/review\/hub\/session\/([^/]+)\/save$/, hubSaveVersion);
-  router.get(/^\/api\/review\/hub\/session\/([^/]+)$/, hubGetSession);
-  router.get("/api/review/quality/ai-available", getAiAvailable);
-  router.post("/api/review/quality", postQualityScore);
-  router.post("/api/review/images", uploadImage);
-  router.get(/^\/api\/review\/images\/([^/]+)$/, getImage);
-  router.post("/api/review/export/github", exportGithub);
-  router.post("/api/review/export/webhook", exportWebhook);
-  router.post("/api/review/export/obsidian", exportObsidian);
-  router.get("/api/settings/username", getUsernameSettings);
-  router.put("/api/settings/username", putUsernameSettings);
-  router.get("/api/codemap/status", codemapStatusHandler);
-  router.get("/api/codemap/config", codemapConfigHandler);
-  router.put("/api/codemap/config", codemapConfigUpdateHandler);
-  router.post("/api/codemap/search", codemapSearchHandler);
-  router.post("/api/codemap/action", codemapActionHandler);
-  router.get("/api/codemap/depgraph/status", depgraphStatusHandler);
-  router.post("/api/codemap/depgraph/search", depgraphSearchHandler);
-  router.get("/api/codemap/depgraph/ranking", depgraphRankingHandler);
-  router.get("/api/codemap/depgraph/cycles", depgraphCyclesHandler);
-  router.post("/api/codemap/depgraph/metrics", depgraphMetricsHandler);
-  router.get("/api/memory/status", memoryStatusHandler);
-  router.post("/api/memory/search", memorySearchHandler);
-  router.post("/api/memory/remember", memoryRememberHandler);
-  router.get("/api/memory/timeline", memoryTimelineHandler);
-  router.get("/api/memory/config", memoryConfigHandler);
-  router.put("/api/memory/config", memoryConfigUpdateHandler);
-  router.post("/api/memory/action", memoryActionHandler);
-  router.get(/^\/api\/memory\/entries\/([^/]+)$/, memoryEntryHandler);
-  router.post(/^\/api\/memory\/entries\/([^/]+)\/forget$/, memoryForgetHandler);
-  router.get("/api/ulpi/models", ulpiModelsHandler);
-  registerHistoryRoutes(router);
-  const server = http.createServer(async (req, res) => {
-    const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
-    const method = req.method ?? "GET";
-    if (handleCorsPreFlight(req, res)) return;
-    const clientIp = req.socket.remoteAddress ?? "unknown";
-    if (!checkRateLimit(clientIp)) {
-      jsonResponse(res, { error: "Too many requests" }, 429, req);
-      return;
-    }
-    if (url.pathname.startsWith("/api/")) {
-      if (url.pathname !== "/api/health" && !validateAuth(req)) {
-        jsonResponse(res, { error: "Unauthorized: only local connections allowed" }, 401, req);
-        return;
-      }
-      if ((method === "POST" || method === "PUT") && req.headers["content-length"] && req.headers["content-length"] !== "0") {
-        const ct = req.headers["content-type"] ?? "";
-        if (!ct.includes("application/json") && !ct.includes("multipart/form-data") && !ct.includes("text/plain")) {
-          jsonResponse(res, { error: "Unsupported Content-Type" }, 415, req);
-          return;
-        }
-      }
-      let resolvedProjectDir = projectDir;
-      const projectParam = url.searchParams.get("project");
-      if (projectParam) {
-        const entry = getProject(projectParam);
-        if (!entry) {
-          jsonResponse(res, { error: `Unknown project: ${projectParam}` }, 404, req);
-          return;
-        }
-        resolvedProjectDir = entry.path;
-      }
-      try {
-        const matched = await router.handle({
-          req,
-          res,
-          pathname: url.pathname,
-          method,
-          url,
-          projectDir: resolvedProjectDir
-        });
-        if (!matched) {
-          notFound(res, `Unknown API route: ${method} ${url.pathname}`, req);
-        }
-      } catch (err) {
-        const rawMessage = err instanceof Error ? err.message : "Internal server error";
-        const safeMessage = rawMessage.length > 200 ? rawMessage.slice(0, 200) : rawMessage;
-        jsonResponse(res, { error: safeMessage }, 500, req);
-      }
-      return;
-    }
-    if (!validateLoopback(req)) {
-      jsonResponse(res, { error: "Unauthorized: only local connections allowed" }, 401, req);
-      return;
-    }
-    if (method === "GET") {
-      const normalized = path9.normalize(url.pathname);
-      if (normalized.includes("..")) {
-        notFound(res, "Not found", req);
-        return;
-      }
-      const htmlPath = resolveHtmlPath();
-      if (!htmlPath) {
-        res.writeHead(404, { "Content-Type": "text/plain" });
-        res.end("UI HTML file not found. Build the web-ui package first.");
-        return;
-      }
-      let html = fs12.readFileSync(htmlPath, "utf-8");
-      const secret = getApiSecret();
-      if (secret) {
-        const injection = `<script>window.__ULPI_API_SECRET__="${secret}";</script>`;
-        html = html.replace("</head>", `${injection}</head>`);
-      }
-      res.writeHead(200, {
-        "Content-Type": "text/html; charset=utf-8",
-        "Cache-Control": "no-cache"
-      });
-      res.end(html);
-      return;
-    }
-    notFound(res, "Not found", req);
-  });
-  return server;
-}
-
-export {
-  setUiServerPort,
-  createApiServer
-};