@useorgx/openclaw-plugin 0.2.0 → 0.3.0

package/dist/http-handler.js

@@ -9,11 +9,269 @@
  *   /orgx/api/activity   → activity feed
  *   /orgx/api/initiatives → initiative data
  *   /orgx/api/onboarding → onboarding / config state
+ *   /orgx/api/delegation/preflight → delegation preflight
+ *   /orgx/api/runs/:id/checkpoints → list/create checkpoints
+ *   /orgx/api/runs/:id/checkpoints/:checkpointId/restore → restore checkpoint
+ *   /orgx/api/runs/:id/actions/:action → run control action
  */
 import { readFileSync, existsSync } from "node:fs";
 import { join, extname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import { formatStatus, formatAgents, formatActivity, formatInitiatives, getOnboardingState, } from "./dashboard-api.js";
+import { loadLocalOpenClawSnapshot, loadLocalTurnDetail, toLocalLiveActivity, toLocalLiveAgents, toLocalLiveInitiatives, toLocalSessionTree, } from "./local-openclaw.js";
+import { readAllOutboxItems } from "./outbox.js";
+// =============================================================================
+// Helpers
+// =============================================================================
+function safeErrorMessage(err) {
+    if (err instanceof Error)
+        return err.message;
+    if (typeof err === "string")
+        return err;
+    return "Unexpected error";
+}
+const ACTIVITY_HEADLINE_TIMEOUT_MS = 4_000;
+const ACTIVITY_HEADLINE_CACHE_TTL_MS = 12 * 60 * 60_000;
+const ACTIVITY_HEADLINE_CACHE_MAX = 1_000;
+const ACTIVITY_HEADLINE_MAX_INPUT_CHARS = 8_000;
+const DEFAULT_ACTIVITY_HEADLINE_MODEL = "openai/gpt-4.1-nano";
+const activityHeadlineCache = new Map();
+let resolvedActivitySummaryApiKey;
+function normalizeSpaces(value) {
+    return value.replace(/\s+/g, " ").trim();
+}
+function stripMarkdownLite(value) {
+    return value
+        .replace(/```[\s\S]*?```/g, " ")
+        .replace(/`([^`]+)`/g, "$1")
+        .replace(/\*\*([^*]+)\*\*/g, "$1")
+        .replace(/__([^_]+)__/g, "$1")
+        .replace(/\*([^*\n]+)\*/g, "$1")
+        .replace(/_([^_\n]+)_/g, "$1")
+        .replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, "$1")
+        .replace(/^\s{0,3}#{1,6}\s+/gm, "")
+        .replace(/^\s*[-*]\s+/gm, "")
+        .replace(/^\s*\d+\.\s+/gm, "")
+        .replace(/\r\n/g, "\n")
+        .trim();
+}
+function cleanActivityHeadline(value) {
+    const lines = stripMarkdownLite(value)
+        .split("\n")
+        .map((line) => normalizeSpaces(line))
+        .filter((line) => line.length > 0 && !/^\|?[:\-| ]+\|?$/.test(line));
+    const headline = lines[0] ?? "";
+    if (!headline)
+        return "";
+    if (headline.length <= 108)
+        return headline;
+    return `${headline.slice(0, 107).trimEnd()}…`;
+}
+function heuristicActivityHeadline(text, title) {
+    const cleanedText = cleanActivityHeadline(text);
+    if (cleanedText.length > 0)
+        return cleanedText;
+    const cleanedTitle = cleanActivityHeadline(title ?? "");
+    if (cleanedTitle.length > 0)
+        return cleanedTitle;
+    return "Activity update";
+}
+function readDotEnvValue(pattern) {
+    try {
+        const envPath = join(homedir(), "Code", "orgx", "orgx", ".env.local");
+        const envContent = readFileSync(envPath, "utf-8");
+        const match = envContent.match(pattern);
+        return match?.[1]?.trim() ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+function findOpenRouterApiKeyInConfig(input, trail = []) {
+    if (!input || typeof input !== "object")
+        return null;
+    if (Array.isArray(input)) {
+        for (const value of input) {
+            const nested = findOpenRouterApiKeyInConfig(value, trail);
+            if (nested)
+                return nested;
+        }
+        return null;
+    }
+    const record = input;
+    for (const [key, value] of Object.entries(record)) {
+        const nextTrail = [...trail, key.toLowerCase()];
+        if (typeof value === "string" &&
+            key.toLowerCase() === "apikey" &&
+            nextTrail.join(".").includes("openrouter") &&
+            value.trim().length > 0) {
+            return value.trim();
+        }
+        const nested = findOpenRouterApiKeyInConfig(value, nextTrail);
+        if (nested)
+            return nested;
+    }
+    return null;
+}
+function readOpenRouterApiKeyFromConfig() {
+    try {
+        const raw = readFileSync(join(homedir(), ".openclaw", "openclaw.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        return findOpenRouterApiKeyInConfig(parsed) ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+function resolveActivitySummaryApiKey() {
+    if (resolvedActivitySummaryApiKey !== undefined) {
+        return resolvedActivitySummaryApiKey;
+    }
+    const candidates = [
+        process.env.ORGX_ACTIVITY_SUMMARY_API_KEY ?? "",
+        process.env.OPENROUTER_API_KEY ?? "",
+        readDotEnvValue(/^ORGX_ACTIVITY_SUMMARY_API_KEY=["']?([^"'\n]+)["']?$/m),
+        readDotEnvValue(/^OPENROUTER_API_KEY=["']?([^"'\n]+)["']?$/m),
+        readOpenRouterApiKeyFromConfig(),
+    ];
+    const key = candidates.find((candidate) => candidate.trim().length > 0)?.trim() ?? "";
+    resolvedActivitySummaryApiKey = key || null;
+    return resolvedActivitySummaryApiKey;
+}
+function trimActivityHeadlineCache() {
+    while (activityHeadlineCache.size > ACTIVITY_HEADLINE_CACHE_MAX) {
+        const firstKey = activityHeadlineCache.keys().next().value;
+        if (!firstKey)
+            break;
+        activityHeadlineCache.delete(firstKey);
+    }
+}
+function extractCompletionText(payload) {
+    const choices = payload.choices;
+    if (!Array.isArray(choices) || choices.length === 0)
+        return null;
+    const first = choices[0];
+    if (!first || typeof first !== "object")
+        return null;
+    const firstRecord = first;
+    const message = firstRecord.message;
+    if (message && typeof message === "object") {
+        const content = message.content;
+        if (typeof content === "string") {
+            return content;
+        }
+        if (Array.isArray(content)) {
+            const textParts = content
+                .map((part) => {
+                if (typeof part === "string")
+                    return part;
+                if (!part || typeof part !== "object")
+                    return "";
+                const record = part;
+                return typeof record.text === "string" ? record.text : "";
+            })
+                .filter((part) => part.length > 0);
+            if (textParts.length > 0) {
+                return textParts.join(" ");
+            }
+        }
+    }
+    return pickString(firstRecord, ["text", "content"]);
+}
+async function summarizeActivityHeadline(input) {
+    const normalizedText = normalizeSpaces(input.text).slice(0, ACTIVITY_HEADLINE_MAX_INPUT_CHARS);
+    const normalizedTitle = normalizeSpaces(input.title ?? "");
+    const normalizedType = normalizeSpaces(input.type ?? "");
+    const heuristic = heuristicActivityHeadline(normalizedText, normalizedTitle);
+    const cacheKey = createHash("sha256")
+        .update(`${normalizedType}\n${normalizedTitle}\n${normalizedText}`)
+        .digest("hex");
+    const cached = activityHeadlineCache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+        return { headline: cached.headline, source: cached.source, model: null };
+    }
+    const apiKey = resolveActivitySummaryApiKey();
+    if (!apiKey) {
+        activityHeadlineCache.set(cacheKey, {
+            headline: heuristic,
+            source: "heuristic",
+            expiresAt: Date.now() + ACTIVITY_HEADLINE_CACHE_TTL_MS,
+        });
+        trimActivityHeadlineCache();
+        return { headline: heuristic, source: "heuristic", model: null };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), ACTIVITY_HEADLINE_TIMEOUT_MS);
+    const model = process.env.ORGX_ACTIVITY_SUMMARY_MODEL?.trim() || DEFAULT_ACTIVITY_HEADLINE_MODEL;
+    const prompt = [
+        "Create one short activity title for a dashboard header.",
+        "Rules:",
+        "- Max 96 characters.",
+        "- Keep key numbers/status markers (for example: 15 tasks, 0 blocked).",
+        "- No markdown, no quotes, no trailing period unless needed.",
+        "- Prefer plain language over jargon.",
+        "",
+        `Type: ${normalizedType || "activity"}`,
+        normalizedTitle ? `Current title: ${normalizedTitle}` : "",
+        "Full detail:",
+        normalizedText,
+    ]
+        .filter(Boolean)
+        .join("\n");
+    try {
+        const response = await fetch("https://openrouter.ai/api/v1/chat/completions", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({
+                model,
+                temperature: 0.1,
+                max_tokens: 48,
+                messages: [
+                    {
+                        role: "system",
+                        content: "You write concise activity headers for operational dashboards. Return only the header text.",
+                    },
+                    {
+                        role: "user",
+                        content: prompt,
+                    },
+                ],
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            throw new Error(`headline model request failed (${response.status})`);
+        }
+        const payload = (await response.json());
+        const generated = cleanActivityHeadline(extractCompletionText(payload) ?? "");
+        const headline = generated || heuristic;
+        const source = generated ? "llm" : "heuristic";
+        activityHeadlineCache.set(cacheKey, {
+            headline,
+            source,
+            expiresAt: Date.now() + ACTIVITY_HEADLINE_CACHE_TTL_MS,
+        });
+        trimActivityHeadlineCache();
+        return { headline, source, model };
+    }
+    catch {
+        activityHeadlineCache.set(cacheKey, {
+            headline: heuristic,
+            source: "heuristic",
+            expiresAt: Date.now() + ACTIVITY_HEADLINE_CACHE_TTL_MS,
+        });
+        trimActivityHeadlineCache();
+        return { headline: heuristic, source: "heuristic", model: null };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 // =============================================================================
 // Content-Type mapping
 // =============================================================================
@@ -42,9 +300,10 @@ function contentType(filePath) {
 // =============================================================================
 const CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Methods": "GET, POST, PATCH, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization",
 };
+const STREAM_IDLE_TIMEOUT_MS = 60_000;
 // =============================================================================
 // Resolve the dashboard/dist/ directory relative to this file
 // =============================================================================
@@ -137,6 +396,23 @@ function pickString(record, keys) {
     }
     return null;
 }
+function pickHeaderString(headers, keys) {
+    for (const key of keys) {
+        const candidates = [key, key.toLowerCase(), key.toUpperCase()];
+        for (const candidate of candidates) {
+            const raw = headers[candidate];
+            if (typeof raw === "string" && raw.trim().length > 0) {
+                return raw.trim();
+            }
+            if (Array.isArray(raw)) {
+                const first = raw.find((value) => typeof value === "string" && value.trim().length > 0);
+                if (first)
+                    return first.trim();
+            }
+        }
+    }
+    return null;
+}
 function pickNumber(record, keys) {
     for (const key of keys) {
         const value = record[key];
@@ -203,10 +479,727 @@ function mapDecisionEntity(entity) {
         metadata: record,
     };
 }
+function parsePositiveInt(raw, fallback) {
+    if (!raw)
+        return fallback;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    return Math.max(1, Math.floor(parsed));
+}
+const DEFAULT_DURATION_HOURS = {
+    initiative: 40,
+    workstream: 16,
+    milestone: 6,
+    task: 2,
+};
+const DEFAULT_BUDGET_USD = {
+    initiative: 1500,
+    workstream: 300,
+    milestone: 120,
+    task: 40,
+};
+const PRIORITY_LABEL_TO_NUM = {
+    urgent: 10,
+    high: 25,
+    medium: 50,
+    low: 75,
+};
+function clampPriority(value) {
+    if (!Number.isFinite(value))
+        return 60;
+    return Math.max(1, Math.min(100, Math.round(value)));
+}
+function mapPriorityNumToLabel(priorityNum) {
+    if (priorityNum <= 12)
+        return "urgent";
+    if (priorityNum <= 30)
+        return "high";
+    if (priorityNum <= 60)
+        return "medium";
+    return "low";
+}
+function getRecordMetadata(record) {
+    const metadata = record.metadata;
+    if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+        return metadata;
+    }
+    return {};
+}
+function extractBudgetUsdFromText(...texts) {
+    for (const text of texts) {
+        if (typeof text !== "string" || text.trim().length === 0)
+            continue;
+        const moneyMatch = /(?:expected\s+budget|budget)[^0-9$]{0,24}\$?\s*([0-9][0-9,]*(?:\.[0-9]{1,2})?)/i.exec(text);
+        if (!moneyMatch)
+            continue;
+        const numeric = Number(moneyMatch[1].replace(/,/g, ""));
+        if (Number.isFinite(numeric) && numeric >= 0)
+            return numeric;
+    }
+    return null;
+}
+function extractDurationHoursFromText(...texts) {
+    for (const text of texts) {
+        if (typeof text !== "string" || text.trim().length === 0)
+            continue;
+        const durationMatch = /(?:expected\s+duration|duration)[^0-9]{0,24}([0-9]+(?:\.[0-9]+)?)\s*h/i.exec(text);
+        if (!durationMatch)
+            continue;
+        const numeric = Number(durationMatch[1]);
+        if (Number.isFinite(numeric) && numeric >= 0)
+            return numeric;
+    }
+    return null;
+}
+function pickStringArray(record, keys) {
+    for (const key of keys) {
+        const value = record[key];
+        if (Array.isArray(value)) {
+            const items = value
+                .filter((entry) => typeof entry === "string")
+                .map((entry) => entry.trim())
+                .filter(Boolean);
+            if (items.length > 0)
+                return items;
+        }
+        if (typeof value === "string") {
+            const items = value
+                .split(",")
+                .map((entry) => entry.trim())
+                .filter(Boolean);
+            if (items.length > 0)
+                return items;
+        }
+    }
+    return [];
+}
+function dedupeStrings(items) {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        if (!item || seen.has(item))
+            continue;
+        seen.add(item);
+        out.push(item);
+    }
+    return out;
+}
+function normalizePriorityForEntity(record) {
+    const explicitPriorityNum = pickNumber(record, [
+        "priority_num",
+        "priorityNum",
+        "priority_number",
+    ]);
+    const priorityLabelRaw = pickString(record, ["priority", "priority_label"]);
+    if (explicitPriorityNum !== null) {
+        const clamped = clampPriority(explicitPriorityNum);
+        return {
+            priorityNum: clamped,
+            priorityLabel: priorityLabelRaw ?? mapPriorityNumToLabel(clamped),
+        };
+    }
+    if (priorityLabelRaw) {
+        const mapped = PRIORITY_LABEL_TO_NUM[priorityLabelRaw.toLowerCase()] ?? 60;
+        return {
+            priorityNum: mapped,
+            priorityLabel: priorityLabelRaw.toLowerCase(),
+        };
+    }
+    return {
+        priorityNum: 60,
+        priorityLabel: null,
+    };
+}
+function normalizeDependencies(record) {
+    const metadata = getRecordMetadata(record);
+    const direct = pickStringArray(record, [
+        "depends_on",
+        "dependsOn",
+        "dependency_ids",
+        "dependencyIds",
+        "dependencies",
+    ]);
+    const nested = pickStringArray(metadata, [
+        "depends_on",
+        "dependsOn",
+        "dependency_ids",
+        "dependencyIds",
+        "dependencies",
+    ]);
+    return dedupeStrings([...direct, ...nested]);
+}
+function normalizeAssignedAgents(record) {
+    const metadata = getRecordMetadata(record);
+    const ids = dedupeStrings([
+        ...pickStringArray(record, ["assigned_agent_ids", "assignedAgentIds"]),
+        ...pickStringArray(metadata, ["assigned_agent_ids", "assignedAgentIds"]),
+    ]);
+    const names = dedupeStrings([
+        ...pickStringArray(record, ["assigned_agent_names", "assignedAgentNames"]),
+        ...pickStringArray(metadata, ["assigned_agent_names", "assignedAgentNames"]),
+    ]);
+    const objectCandidates = [
+        record.assigned_agents,
+        record.assignedAgents,
+        metadata.assigned_agents,
+        metadata.assignedAgents,
+    ];
+    const fromObjects = [];
+    for (const candidate of objectCandidates) {
+        if (!Array.isArray(candidate))
+            continue;
+        for (const entry of candidate) {
+            if (!entry || typeof entry !== "object")
+                continue;
+            const item = entry;
+            const id = pickString(item, ["id", "agent_id", "agentId"]) ?? "";
+            const name = pickString(item, ["name", "agent_name", "agentName"]) ?? id;
+            if (!name)
+                continue;
+            fromObjects.push({
+                id: id || `name:${name}`,
+                name,
+                domain: pickString(item, ["domain", "role"]),
+            });
+        }
+    }
+    const merged = [...fromObjects];
+    if (merged.length === 0 && (names.length > 0 || ids.length > 0)) {
+        const maxLen = Math.max(names.length, ids.length);
+        for (let i = 0; i < maxLen; i += 1) {
+            const id = ids[i] ?? `name:${names[i] ?? `agent-${i + 1}`}`;
+            const name = names[i] ?? ids[i] ?? `Agent ${i + 1}`;
+            merged.push({ id, name, domain: null });
+        }
+    }
+    const seen = new Set();
+    const deduped = [];
+    for (const item of merged) {
+        const key = `${item.id}:${item.name}`.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        deduped.push(item);
+    }
+    return deduped;
+}
+function toMissionControlNode(type, entity, fallbackInitiativeId) {
+    const record = entity;
+    const metadata = getRecordMetadata(record);
+    const initiativeId = pickString(record, ["initiative_id", "initiativeId"]) ??
+        pickString(metadata, ["initiative_id", "initiativeId"]) ??
+        (type === "initiative" ? String(record.id ?? fallbackInitiativeId) : fallbackInitiativeId);
+    const workstreamId = type === "workstream"
+        ? String(record.id ?? "")
+        : pickString(record, ["workstream_id", "workstreamId"]) ??
+            pickString(metadata, ["workstream_id", "workstreamId"]);
+    const milestoneId = type === "milestone"
+        ? String(record.id ?? "")
+        : pickString(record, ["milestone_id", "milestoneId"]) ??
+            pickString(metadata, ["milestone_id", "milestoneId"]);
+    const parentIdRaw = pickString(record, ["parentId", "parent_id"]) ??
+        pickString(metadata, ["parentId", "parent_id"]);
+    const parentId = parentIdRaw ??
+        (type === "initiative"
+            ? null
+            : type === "workstream"
+                ? initiativeId
+                : type === "milestone"
+                    ? workstreamId ?? initiativeId
+                    : milestoneId ?? workstreamId ?? initiativeId);
+    const status = pickString(record, ["status"]) ??
+        (type === "task" ? "todo" : "planned");
+    const dueDate = toIsoString(pickString(record, ["due_date", "dueDate", "target_date", "targetDate"]));
+    const etaEndAt = toIsoString(pickString(record, ["eta_end_at", "etaEndAt"]));
+    const expectedDuration = pickNumber(record, [
+        "expected_duration_hours",
+        "expectedDurationHours",
+        "duration_hours",
+        "durationHours",
+    ]) ??
+        pickNumber(metadata, [
+            "expected_duration_hours",
+            "expectedDurationHours",
+            "duration_hours",
+            "durationHours",
+        ]) ??
+        extractDurationHoursFromText(pickString(record, ["description", "summary", "context"]), pickString(metadata, ["description", "summary", "context"])) ??
+        DEFAULT_DURATION_HOURS[type];
+    const expectedBudget = pickNumber(record, [
+        "expected_budget_usd",
+        "expectedBudgetUsd",
+        "budget_usd",
+        "budgetUsd",
+    ]) ??
+        pickNumber(metadata, [
+            "expected_budget_usd",
+            "expectedBudgetUsd",
+            "budget_usd",
+            "budgetUsd",
+        ]) ??
+        extractBudgetUsdFromText(pickString(record, ["description", "summary", "context"]), pickString(metadata, ["description", "summary", "context"])) ??
+        DEFAULT_BUDGET_USD[type];
+    const priority = normalizePriorityForEntity(record);
+    return {
+        id: String(record.id ?? ""),
+        type,
+        title: pickString(record, ["title", "name"]) ??
+            `${type[0].toUpperCase()}${type.slice(1)} ${String(record.id ?? "")}`,
+        status,
+        parentId: parentId ?? null,
+        initiativeId: initiativeId ?? null,
+        workstreamId: workstreamId ?? null,
+        milestoneId: milestoneId ?? null,
+        priorityNum: priority.priorityNum,
+        priorityLabel: priority.priorityLabel,
+        dependencyIds: normalizeDependencies(record),
+        dueDate,
+        etaEndAt,
+        expectedDurationHours: expectedDuration > 0 ? expectedDuration : DEFAULT_DURATION_HOURS[type],
+        expectedBudgetUsd: expectedBudget >= 0 ? expectedBudget : DEFAULT_BUDGET_USD[type],
+        assignedAgents: normalizeAssignedAgents(record),
+        updatedAt: toIsoString(pickString(record, [
+            "updated_at",
+            "updatedAt",
+            "created_at",
+            "createdAt",
+        ])),
+    };
+}
+function isTodoStatus(status) {
+    const normalized = status.toLowerCase();
+    return (normalized === "todo" ||
+        normalized === "not_started" ||
+        normalized === "planned" ||
+        normalized === "backlog" ||
+        normalized === "pending");
+}
+function isInProgressStatus(status) {
+    const normalized = status.toLowerCase();
+    return (normalized === "in_progress" ||
+        normalized === "active" ||
+        normalized === "running" ||
+        normalized === "queued");
+}
+function isDoneStatus(status) {
+    const normalized = status.toLowerCase();
+    return (normalized === "done" ||
+        normalized === "completed" ||
+        normalized === "cancelled" ||
+        normalized === "archived" ||
+        normalized === "deleted");
+}
+function detectCycleEdgeKeys(edges) {
+    const adjacency = new Map();
+    for (const edge of edges) {
+        const list = adjacency.get(edge.from) ?? [];
+        list.push(edge.to);
+        adjacency.set(edge.from, list);
+    }
+    const visiting = new Set();
+    const visited = new Set();
+    const cycleEdgeKeys = new Set();
+    function dfs(nodeId) {
+        if (visited.has(nodeId))
+            return;
+        visiting.add(nodeId);
+        const next = adjacency.get(nodeId) ?? [];
+        for (const childId of next) {
+            if (visiting.has(childId)) {
+                cycleEdgeKeys.add(`${nodeId}->${childId}`);
+                continue;
+            }
+            dfs(childId);
+        }
+        visiting.delete(nodeId);
+        visited.add(nodeId);
+    }
+    for (const key of adjacency.keys()) {
+        if (!visited.has(key))
+            dfs(key);
+    }
+    return cycleEdgeKeys;
+}
+async function listEntitiesSafe(client, type, filters) {
+    try {
+        const response = await client.listEntities(type, filters);
+        const items = Array.isArray(response.data) ? response.data : [];
+        return { items, warning: null };
+    }
+    catch (err) {
+        return {
+            items: [],
+            warning: `${type} unavailable (${safeErrorMessage(err)})`,
+        };
+    }
+}
+async function buildMissionControlGraph(client, initiativeId) {
+    const degraded = [];
+    const [initiativeResult, workstreamResult, milestoneResult, taskResult] = await Promise.all([
+        listEntitiesSafe(client, "initiative", { limit: 300 }),
+        listEntitiesSafe(client, "workstream", {
+            initiative_id: initiativeId,
+            limit: 500,
+        }),
+        listEntitiesSafe(client, "milestone", {
+            initiative_id: initiativeId,
+            limit: 700,
+        }),
+        listEntitiesSafe(client, "task", {
+            initiative_id: initiativeId,
+            limit: 1200,
+        }),
+    ]);
+    for (const warning of [
+        initiativeResult.warning,
+        workstreamResult.warning,
+        milestoneResult.warning,
+        taskResult.warning,
+    ]) {
+        if (warning)
+            degraded.push(warning);
+    }
+    const initiativeEntity = initiativeResult.items.find((item) => String(item.id ?? "") === initiativeId);
+    const initiativeNode = initiativeEntity
+        ? toMissionControlNode("initiative", initiativeEntity, initiativeId)
+        : {
+            id: initiativeId,
+            type: "initiative",
+            title: `Initiative ${initiativeId.slice(0, 8)}`,
+            status: "active",
+            parentId: null,
+            initiativeId,
+            workstreamId: null,
+            milestoneId: null,
+            priorityNum: 60,
+            priorityLabel: null,
+            dependencyIds: [],
+            dueDate: null,
+            etaEndAt: null,
+            expectedDurationHours: DEFAULT_DURATION_HOURS.initiative,
+            expectedBudgetUsd: DEFAULT_BUDGET_USD.initiative,
+            assignedAgents: [],
+            updatedAt: null,
+        };
+    const workstreamNodes = workstreamResult.items.map((item) => toMissionControlNode("workstream", item, initiativeId));
+    const milestoneNodes = milestoneResult.items.map((item) => toMissionControlNode("milestone", item, initiativeId));
+    const taskNodes = taskResult.items.map((item) => toMissionControlNode("task", item, initiativeId));
+    const nodes = [
+        initiativeNode,
+        ...workstreamNodes,
+        ...milestoneNodes,
+        ...taskNodes,
+    ];
+    const nodeMap = new Map(nodes.map((node) => [node.id, node]));
+    for (const node of nodes) {
+        const validDependencies = dedupeStrings(node.dependencyIds.filter((depId) => depId !== node.id && nodeMap.has(depId)));
+        node.dependencyIds = validDependencies;
+    }
+    let edges = [];
+    for (const node of nodes) {
+        if (node.type === "initiative")
+            continue;
+        for (const depId of node.dependencyIds) {
+            edges.push({
+                from: depId,
+                to: node.id,
+                kind: "depends_on",
+            });
+        }
+    }
+    edges = edges.filter((edge, index, arr) => arr.findIndex((candidate) => candidate.from === edge.from &&
+        candidate.to === edge.to &&
+        candidate.kind === edge.kind) === index);
+    const cyclicEdgeKeys = detectCycleEdgeKeys(edges);
+    if (cyclicEdgeKeys.size > 0) {
+        degraded.push(`Detected ${cyclicEdgeKeys.size} cyclic dependency edge(s); excluded from ETA graph.`);
+        edges = edges.filter((edge) => !cyclicEdgeKeys.has(`${edge.from}->${edge.to}`));
+        for (const node of nodes) {
+            node.dependencyIds = node.dependencyIds.filter((depId) => !cyclicEdgeKeys.has(`${depId}->${node.id}`));
+        }
+    }
+    const etaMemo = new Map();
+    const etaVisiting = new Set();
+    const computeEtaEpoch = (nodeId) => {
+        const node = nodeMap.get(nodeId);
+        if (!node)
+            return Date.now();
+        const cached = etaMemo.get(nodeId);
+        if (cached !== undefined)
+            return cached;
+        const parsedEtaOverride = node.etaEndAt ? Date.parse(node.etaEndAt) : Number.NaN;
+        if (Number.isFinite(parsedEtaOverride)) {
+            etaMemo.set(nodeId, parsedEtaOverride);
+            return parsedEtaOverride;
+        }
+        const parsedDueDate = node.dueDate ? Date.parse(node.dueDate) : Number.NaN;
+        if (Number.isFinite(parsedDueDate)) {
+            etaMemo.set(nodeId, parsedDueDate);
+            return parsedDueDate;
+        }
+        if (etaVisiting.has(nodeId)) {
+            degraded.push(`ETA cycle fallback on node ${nodeId}.`);
+            const fallback = Date.now();
+            etaMemo.set(nodeId, fallback);
+            return fallback;
+        }
+        etaVisiting.add(nodeId);
+        let dependencyMax = 0;
+        for (const depId of node.dependencyIds) {
+            dependencyMax = Math.max(dependencyMax, computeEtaEpoch(depId));
+        }
+        etaVisiting.delete(nodeId);
+        const durationMs = (node.expectedDurationHours > 0
+            ? node.expectedDurationHours
+            : DEFAULT_DURATION_HOURS[node.type]) * 60 * 60 * 1000;
+        const eta = Math.max(Date.now(), dependencyMax) + durationMs;
+        etaMemo.set(nodeId, eta);
+        return eta;
+    };
+    for (const node of nodes) {
+        const eta = computeEtaEpoch(node.id);
+        if (Number.isFinite(eta)) {
+            node.etaEndAt = new Date(eta).toISOString();
+        }
+    }
+    const taskNodesOnly = nodes.filter((node) => node.type === "task");
+    const hasActiveTasks = taskNodesOnly.some((node) => isInProgressStatus(node.status));
+    const hasTodoTasks = taskNodesOnly.some((node) => isTodoStatus(node.status));
+    if (initiativeNode.status.toLowerCase() === "active" &&
+        !hasActiveTasks &&
+        hasTodoTasks) {
+        initiativeNode.status = "paused";
+    }
+    const nodeById = new Map(nodes.map((node) => [node.id, node]));
+    const taskIsReady = (task) => task.dependencyIds.every((depId) => {
+        const dependency = nodeById.get(depId);
+        return dependency ? isDoneStatus(dependency.status) : true;
+    });
+    const taskHasBlockedParent = (task) => {
+        const milestone = task.milestoneId ? nodeById.get(task.milestoneId) ?? null : null;
+        const workstream = task.workstreamId ? nodeById.get(task.workstreamId) ?? null : null;
+        return (milestone?.status?.toLowerCase() === "blocked" ||
+            workstream?.status?.toLowerCase() === "blocked");
+    };
+    const recentTodos = nodes
+        .filter((node) => node.type === "task" && isTodoStatus(node.status))
+        .sort((a, b) => {
+        const aReady = taskIsReady(a);
+        const bReady = taskIsReady(b);
+        if (aReady !== bReady)
+            return aReady ? -1 : 1;
+        const aBlocked = taskHasBlockedParent(a);
+        const bBlocked = taskHasBlockedParent(b);
+        if (aBlocked !== bBlocked)
+            return aBlocked ? 1 : -1;
+        const priorityDelta = a.priorityNum - b.priorityNum;
+        if (priorityDelta !== 0)
+            return priorityDelta;
+        const aDue = a.dueDate ? Date.parse(a.dueDate) : Number.POSITIVE_INFINITY;
+        const bDue = b.dueDate ? Date.parse(b.dueDate) : Number.POSITIVE_INFINITY;
+        if (aDue !== bDue)
+            return aDue - bDue;
+        const aEta = a.etaEndAt ? Date.parse(a.etaEndAt) : Number.POSITIVE_INFINITY;
+        const bEta = b.etaEndAt ? Date.parse(b.etaEndAt) : Number.POSITIVE_INFINITY;
+        if (aEta !== bEta)
+            return aEta - bEta;
+        const aEpoch = a.updatedAt ? Date.parse(a.updatedAt) : 0;
+        const bEpoch = b.updatedAt ? Date.parse(b.updatedAt) : 0;
+        return aEpoch - bEpoch;
+    })
+        .map((node) => node.id);
+    return {
+        initiative: {
+            id: initiativeNode.id,
+            title: initiativeNode.title,
+            status: initiativeNode.status,
+            summary: initiativeEntity
+                ? pickString(initiativeEntity, [
+                    "summary",
+                    "description",
+                    "context",
+                ])
+                : null,
+            assignedAgents: initiativeNode.assignedAgents,
+        },
+        nodes,
+        edges,
+        recentTodos,
+        degraded,
+    };
+}
+function normalizeEntityMutationPayload(payload) {
+    const next = { ...payload };
+    const priorityNumRaw = pickNumber(next, ["priority_num", "priorityNum"]);
+    const priorityLabelRaw = pickString(next, ["priority", "priority_label"]);
+    if (priorityNumRaw !== null) {
+        const clamped = clampPriority(priorityNumRaw);
+        next.priority_num = clamped;
+        if (!priorityLabelRaw) {
+            next.priority = mapPriorityNumToLabel(clamped);
+        }
+    }
+    else if (priorityLabelRaw) {
+        next.priority_num = PRIORITY_LABEL_TO_NUM[priorityLabelRaw.toLowerCase()] ?? 60;
+        next.priority = priorityLabelRaw.toLowerCase();
+    }
+    const dependsOnArray = pickStringArray(next, ["depends_on", "dependsOn", "dependencies"]);
+    if (dependsOnArray.length > 0) {
+        next.depends_on = dedupeStrings(dependsOnArray);
+    }
+    else if ("depends_on" in next) {
+        next.depends_on = [];
+    }
+    const expectedDuration = pickNumber(next, [
+        "expected_duration_hours",
+        "expectedDurationHours",
+    ]);
+    if (expectedDuration !== null) {
+        next.expected_duration_hours = Math.max(0, expectedDuration);
+    }
+    const expectedBudget = pickNumber(next, [
+        "expected_budget_usd",
+        "expectedBudgetUsd",
+        "budget_usd",
+        "budgetUsd",
+    ]);
+    if (expectedBudget !== null) {
+        next.expected_budget_usd = Math.max(0, expectedBudget);
+    }
+    const etaEndAt = pickString(next, ["eta_end_at", "etaEndAt"]);
+    if (etaEndAt !== null) {
+        next.eta_end_at = toIsoString(etaEndAt) ?? null;
+    }
+    const assignedIds = pickStringArray(next, [
+        "assigned_agent_ids",
+        "assignedAgentIds",
+    ]);
+    const assignedNames = pickStringArray(next, [
+        "assigned_agent_names",
+        "assignedAgentNames",
+    ]);
+    if (assignedIds.length > 0) {
+        next.assigned_agent_ids = dedupeStrings(assignedIds);
+    }
+    if (assignedNames.length > 0) {
+        next.assigned_agent_names = dedupeStrings(assignedNames);
+    }
+    return next;
+}
+async function resolveAutoAssignments(input) {
+    const warnings = [];
+    const assignedById = new Map();
+    const addAgent = (agent) => {
+        const key = agent.id || `name:${agent.name}`;
+        if (!assignedById.has(key))
+            assignedById.set(key, agent);
+    };
+    let liveAgents = [];
+    try {
+        const data = await input.client.getLiveAgents({
+            initiative: input.initiativeId,
+            includeIdle: true,
+        });
+        liveAgents = (Array.isArray(data.agents) ? data.agents : [])
+            .map((raw) => {
+            if (!raw || typeof raw !== "object")
+                return null;
+            const record = raw;
+            const id = pickString(record, ["id", "agentId"]) ?? "";
+            const name = pickString(record, ["name", "agentName"]) ?? (id ? `Agent ${id}` : "");
+            if (!name)
+                return null;
+            return {
+                id: id || `name:${name}`,
+                name,
+                domain: pickString(record, ["domain", "role"]),
+                status: pickString(record, ["status"]),
+            };
+        })
+            .filter((item) => item !== null);
+    }
+    catch (err) {
+        warnings.push(`live agent lookup failed (${safeErrorMessage(err)})`);
+    }
+    const orchestrator = liveAgents.find((agent) => /holt|orchestrator/i.test(agent.name) ||
+        /orchestrator/i.test(agent.domain ?? ""));
+    if (orchestrator)
+        addAgent(orchestrator);
+    let assignmentSource = "fallback";
+    try {
+        const preflight = await input.client.delegationPreflight({
+            intent: `${input.title}${input.summary ? `: ${input.summary}` : ""}`,
+        });
+        const recommendations = preflight.data?.recommended_split ?? [];
+        const recommendedDomains = dedupeStrings(recommendations
+            .map((entry) => String(entry.owner_domain ?? "").trim().toLowerCase())
+            .filter(Boolean));
+        for (const domain of recommendedDomains) {
+            const matched = liveAgents.find((agent) => (agent.domain ?? "").toLowerCase().includes(domain));
+            if (matched)
+                addAgent(matched);
+        }
+        if (recommendedDomains.length > 0) {
+            assignmentSource = "orchestrator";
+        }
+    }
+    catch (err) {
+        warnings.push(`delegation preflight failed (${safeErrorMessage(err)})`);
+    }
+    if (assignedById.size === 0) {
+        const text = `${input.title} ${input.summary ?? ""}`.toLowerCase();
+        const fallbackDomains = [];
+        if (/market|campaign|thread|article|tweet|copy/.test(text)) {
+            fallbackDomains.push("marketing");
+        }
+        else if (/design|ux|ui|a11y|accessibility/.test(text)) {
+            fallbackDomains.push("design");
+        }
+        else if (/ops|incident|runbook|reliability/.test(text)) {
+            fallbackDomains.push("operations");
+        }
+        else if (/sales|deal|pipeline|mrr/.test(text)) {
+            fallbackDomains.push("sales");
+        }
+        else {
+            fallbackDomains.push("engineering", "product");
+        }
+        for (const domain of fallbackDomains) {
+            const matched = liveAgents.find((agent) => (agent.domain ?? "").toLowerCase().includes(domain));
+            if (matched)
+                addAgent(matched);
+        }
+    }
+    if (assignedById.size === 0 && liveAgents.length > 0) {
+        addAgent(liveAgents[0]);
+        warnings.push("using first available live agent as fallback");
+    }
+    const assignedAgents = Array.from(assignedById.values());
+    const updatePayload = normalizeEntityMutationPayload({
+        assigned_agent_ids: assignedAgents.map((agent) => agent.id),
+        assigned_agent_names: assignedAgents.map((agent) => agent.name),
+        assignment_source: assignmentSource,
+    });
+    let updatedEntity;
+    try {
+        updatedEntity = await input.client.updateEntity(input.entityType, input.entityId, updatePayload);
+    }
+    catch (err) {
+        warnings.push(`assignment patch failed (${safeErrorMessage(err)})`);
+    }
+    return {
+        ok: true,
+        assignment_source: assignmentSource,
+        assigned_agents: assignedAgents,
+        warnings,
+        ...(updatedEntity ? { updated_entity: updatedEntity } : {}),
+    };
+}
 // =============================================================================
 // Factory
 // =============================================================================
-export function createHttpHandler(config, client, getSnapshot) {
+export function createHttpHandler(config, client, getSnapshot, onboarding) {
     const dashboardEnabled = config.dashboardEnabled ??
         true;
     return async function handler(req, res) {
@@ -229,6 +1222,119 @@ export function createHttpHandler(config, client, getSnapshot) {
         if (url.startsWith("/orgx/api/")) {
             const route = url.replace("/orgx/api/", "").replace(/\/+$/, "");
             const decisionApproveMatch = route.match(/^live\/decisions\/([^/]+)\/approve$/);
+            const runActionMatch = route.match(/^runs\/([^/]+)\/actions\/([^/]+)$/);
+            const runCheckpointsMatch = route.match(/^runs\/([^/]+)\/checkpoints$/);
+            const runCheckpointRestoreMatch = route.match(/^runs\/([^/]+)\/checkpoints\/([^/]+)\/restore$/);
+            const isDelegationPreflight = route === "delegation/preflight";
+            const isMissionControlAutoAssignmentRoute = route === "mission-control/assignments/auto";
+            const isEntitiesRoute = route === "entities";
+            const entityActionMatch = route.match(/^entities\/([^/]+)\/([^/]+)\/([^/]+)$/);
+            const isOnboardingStartRoute = route === "onboarding/start";
+            const isOnboardingStatusRoute = route === "onboarding/status";
+            const isOnboardingManualKeyRoute = route === "onboarding/manual-key";
+            const isOnboardingDisconnectRoute = route === "onboarding/disconnect";
+            const isLiveActivityHeadlineRoute = route === "live/activity/headline";
+            if (method === "POST" && isOnboardingStartRoute) {
+                try {
+                    const payload = parseJsonBody(req.body);
+                    const started = await onboarding.startPairing({
+                        openclawVersion: pickString(payload, ["openclawVersion", "openclaw_version"]) ??
+                            undefined,
+                        platform: pickString(payload, ["platform"]) ?? undefined,
+                        deviceName: pickString(payload, ["deviceName", "device_name"]) ?? undefined,
+                    });
+                    sendJson(res, 200, {
+                        ok: true,
+                        data: {
+                            pairingId: started.pairingId,
+                            connectUrl: started.connectUrl,
+                            expiresAt: started.expiresAt,
+                            pollIntervalMs: started.pollIntervalMs,
+                            state: getOnboardingState(started.state),
+                        },
+                    });
+                }
+                catch (err) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (method === "GET" && isOnboardingStatusRoute) {
+                try {
+                    const state = await onboarding.getStatus();
+                    sendJson(res, 200, {
+                        ok: true,
+                        data: getOnboardingState(state),
+                    });
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        ok: false,
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (method === "POST" && isOnboardingManualKeyRoute) {
+                try {
+                    const payload = parseJsonBody(req.body);
+                    const authHeader = pickHeaderString(req.headers, ["authorization"]);
+                    const bearerApiKey = authHeader && authHeader.toLowerCase().startsWith("bearer ")
+                        ? authHeader.slice("bearer ".length).trim()
+                        : null;
+                    const headerApiKey = pickHeaderString(req.headers, [
+                        "x-orgx-api-key",
+                        "x-api-key",
+                    ]);
+                    const apiKey = pickString(payload, ["apiKey", "api_key"]) ??
+                        headerApiKey ??
+                        bearerApiKey;
+                    if (!apiKey) {
+                        sendJson(res, 400, {
+                            ok: false,
+                            error: "apiKey is required",
+                        });
+                        return true;
+                    }
+                    const userId = pickString(payload, ["userId", "user_id"]) ??
+                        pickHeaderString(req.headers, ["x-orgx-user-id", "x-user-id"]) ??
+                        undefined;
+                    const state = await onboarding.submitManualKey({
+                        apiKey,
+                        userId,
+                    });
+                    sendJson(res, 200, {
+                        ok: true,
+                        data: getOnboardingState(state),
+                    });
+                }
+                catch (err) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (method === "POST" && isOnboardingDisconnectRoute) {
+                try {
+                    const state = await onboarding.disconnect();
+                    sendJson(res, 200, {
+                        ok: true,
+                        data: getOnboardingState(state),
+                    });
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        ok: false,
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
             if (method === "POST" &&
                 (route === "live/decisions/approve" || decisionApproveMatch)) {
                 try {
@@ -268,12 +1374,189 @@ export function createHttpHandler(config, client, getSnapshot) {
                 }
                 catch (err) {
                     sendJson(res, 500, {
-                        error: err instanceof Error ? err.message : String(err),
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (method === "POST" && isDelegationPreflight) {
+                try {
+                    const payload = parseJsonBody(req.body);
+                    const intent = pickString(payload, ["intent"]);
+                    if (!intent) {
+                        sendJson(res, 400, { error: "intent is required" });
+                        return true;
+                    }
+                    const toStringArray = (value) => Array.isArray(value)
+                        ? value.filter((entry) => typeof entry === "string")
+                        : undefined;
+                    const data = await client.delegationPreflight({
+                        intent,
+                        acceptanceCriteria: toStringArray(payload.acceptanceCriteria),
+                        constraints: toStringArray(payload.constraints),
+                        domains: toStringArray(payload.domains),
+                    });
+                    sendJson(res, 200, data);
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (method === "POST" && isMissionControlAutoAssignmentRoute) {
+                try {
+                    const payload = parseJsonBody(req.body);
+                    const entityId = pickString(payload, ["entity_id", "entityId"]);
+                    const entityType = pickString(payload, ["entity_type", "entityType"]);
+                    const initiativeId = pickString(payload, ["initiative_id", "initiativeId"]) ?? null;
+                    const title = pickString(payload, ["title", "name"]) ?? "Untitled";
+                    const summary = pickString(payload, ["summary", "description", "context"]) ?? null;
+                    if (!entityId || !entityType) {
+                        sendJson(res, 400, {
+                            ok: false,
+                            error: "entity_id and entity_type are required.",
+                        });
+                        return true;
+                    }
+                    const assignment = await resolveAutoAssignments({
+                        client,
+                        entityId,
+                        entityType,
+                        initiativeId,
+                        title,
+                        summary,
+                    });
+                    sendJson(res, 200, assignment);
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        ok: false,
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (runCheckpointsMatch && method === "POST") {
+                try {
+                    const runId = decodeURIComponent(runCheckpointsMatch[1]);
+                    const payload = parseJsonBody(req.body);
+                    const reason = pickString(payload, ["reason"]) ?? undefined;
+                    const rawPayload = payload.payload;
+                    const checkpointPayload = rawPayload && typeof rawPayload === "object" && !Array.isArray(rawPayload)
+                        ? rawPayload
+                        : undefined;
+                    const data = await client.createRunCheckpoint(runId, {
+                        reason,
+                        payload: checkpointPayload,
+                    });
+                    sendJson(res, 200, data);
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (runCheckpointRestoreMatch && method === "POST") {
+                try {
+                    const runId = decodeURIComponent(runCheckpointRestoreMatch[1]);
+                    const checkpointId = decodeURIComponent(runCheckpointRestoreMatch[2]);
+                    const payload = parseJsonBody(req.body);
+                    const reason = pickString(payload, ["reason"]) ?? undefined;
+                    const data = await client.restoreRunCheckpoint(runId, {
+                        checkpointId,
+                        reason,
+                    });
+                    sendJson(res, 200, data);
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (runActionMatch && method === "POST") {
+                try {
+                    const runId = decodeURIComponent(runActionMatch[1]);
+                    const action = decodeURIComponent(runActionMatch[2]);
+                    const payload = parseJsonBody(req.body);
+                    const checkpointId = pickString(payload, ["checkpointId", "checkpoint_id"]);
+                    const reason = pickString(payload, ["reason"]);
+                    const data = await client.runAction(runId, action, {
+                        checkpointId: checkpointId ?? undefined,
+                        reason: reason ?? undefined,
+                    });
+                    sendJson(res, 200, data);
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            // Entity action / delete route: POST /orgx/api/entities/{type}/{id}/{action}
+            if (entityActionMatch && method === "POST") {
+                try {
+                    const entityType = decodeURIComponent(entityActionMatch[1]);
+                    const entityId = decodeURIComponent(entityActionMatch[2]);
+                    const entityAction = decodeURIComponent(entityActionMatch[3]);
+                    const payload = parseJsonBody(req.body);
+                    if (entityAction === "delete") {
+                        // Delete via status update
+                        const entity = await client.updateEntity(entityType, entityId, {
+                            status: "deleted",
+                        });
+                        sendJson(res, 200, { ok: true, entity });
+                    }
+                    else {
+                        // Map action to status update
+                        const statusMap = {
+                            start: "in_progress",
+                            complete: "done",
+                            block: "blocked",
+                            unblock: "in_progress",
+                            pause: "paused",
+                            resume: "active",
+                        };
+                        const newStatus = statusMap[entityAction];
+                        if (!newStatus) {
+                            sendJson(res, 400, {
+                                error: `Unknown entity action: ${entityAction}`,
+                            });
+                            return true;
+                        }
+                        const entity = await client.updateEntity(entityType, entityId, {
+                            status: newStatus,
+                            ...(payload.force ? { force: true } : {}),
+                        });
+                        sendJson(res, 200, { ok: true, entity });
+                    }
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        error: safeErrorMessage(err),
                     });
                 }
                 return true;
             }
-            if (method !== "GET") {
+            if (method !== "GET" &&
+                !(runCheckpointsMatch && method === "POST") &&
+                !(runCheckpointRestoreMatch && method === "POST") &&
+                !(runActionMatch && method === "POST") &&
+                !(isDelegationPreflight && method === "POST") &&
+                !(isMissionControlAutoAssignmentRoute && method === "POST") &&
+                !(isEntitiesRoute && method === "POST") &&
+                !(isEntitiesRoute && method === "PATCH") &&
+                !(entityActionMatch && method === "POST") &&
+                !(isOnboardingStartRoute && method === "POST") &&
+                !(isOnboardingManualKeyRoute && method === "POST") &&
+                !(isOnboardingDisconnectRoute && method === "POST") &&
+                !(isLiveActivityHeadlineRoute && method === "POST")) {
                 res.writeHead(405, {
                     "Content-Type": "text/plain",
                     ...CORS_HEADERS,
@@ -306,8 +1589,302 @@ export function createHttpHandler(config, client, getSnapshot) {
                     sendJson(res, 200, formatInitiatives(getSnapshot()));
                     return true;
                 case "onboarding":
-                    sendJson(res, 200, getOnboardingState(config, dashboardEnabled));
+                    sendJson(res, 200, getOnboardingState(await onboarding.getStatus()));
+                    return true;
+                case "mission-control/graph": {
+                    const initiativeId = searchParams.get("initiative_id") ??
+                        searchParams.get("initiativeId");
+                    if (!initiativeId || initiativeId.trim().length === 0) {
+                        sendJson(res, 400, {
+                            error: "Query parameter 'initiative_id' is required.",
+                        });
+                        return true;
+                    }
+                    try {
+                        const graph = await buildMissionControlGraph(client, initiativeId.trim());
+                        sendJson(res, 200, graph);
+                    }
+                    catch (err) {
+                        sendJson(res, 500, {
+                            error: safeErrorMessage(err),
+                        });
+                    }
+                    return true;
+                }
+                case "entities": {
+                    if (method === "POST") {
+                        try {
+                            const payload = parseJsonBody(req.body);
+                            const type = pickString(payload, ["type"]);
+                            const title = pickString(payload, ["title", "name"]);
+                            if (!type || !title) {
+                                sendJson(res, 400, {
+                                    error: "Both 'type' and 'title' are required.",
+                                });
+                                return true;
+                            }
+                            const data = normalizeEntityMutationPayload({ ...payload, title });
+                            delete data.type;
+                            let entity = await client.createEntity(type, data);
+                            let autoAssignment = null;
+                            if (type === "initiative" || type === "workstream") {
+                                const entityRecord = entity;
+                                autoAssignment = await resolveAutoAssignments({
+                                    client,
+                                    entityId: String(entityRecord.id ?? ""),
+                                    entityType: type,
+                                    initiativeId: type === "initiative"
+                                        ? String(entityRecord.id ?? "")
+                                        : pickString(data, ["initiative_id", "initiativeId"]),
+                                    title: pickString(entityRecord, ["title", "name"]) ??
+                                        title ??
+                                        "Untitled",
+                                    summary: pickString(entityRecord, [
+                                        "summary",
+                                        "description",
+                                        "context",
+                                    ]) ?? null,
+                                });
+                                if (autoAssignment.updated_entity) {
+                                    entity = autoAssignment.updated_entity;
+                                }
+                            }
+                            sendJson(res, 201, { ok: true, entity, auto_assignment: autoAssignment });
+                        }
+                        catch (err) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                            });
+                        }
+                        return true;
+                    }
+                    if (method === "PATCH") {
+                        try {
+                            const payload = parseJsonBody(req.body);
+                            const type = pickString(payload, ["type"]);
+                            const id = pickString(payload, ["id"]);
+                            if (!type || !id) {
+                                sendJson(res, 400, {
+                                    error: "Both 'type' and 'id' are required for PATCH.",
+                                });
+                                return true;
+                            }
+                            const updates = { ...payload };
+                            delete updates.type;
+                            delete updates.id;
+                            const entity = await client.updateEntity(type, id, normalizeEntityMutationPayload(updates));
+                            sendJson(res, 200, { ok: true, entity });
+                        }
+                        catch (err) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                            });
+                        }
+                        return true;
+                    }
+                    try {
+                        const type = searchParams.get("type");
+                        if (!type) {
+                            sendJson(res, 400, {
+                                error: "Query parameter 'type' is required for GET /entities.",
+                            });
+                            return true;
+                        }
+                        const status = searchParams.get("status") ?? undefined;
+                        const initiativeId = searchParams.get("initiative_id") ?? undefined;
+                        const limit = searchParams.get("limit")
+                            ? Number(searchParams.get("limit"))
+                            : undefined;
+                        const data = await client.listEntities(type, {
+                            status,
+                            initiative_id: initiativeId,
+                            limit: Number.isFinite(limit) ? limit : undefined,
+                        });
+                        sendJson(res, 200, data);
+                    }
+                    catch (err) {
+                        sendJson(res, 500, {
+                            error: safeErrorMessage(err),
+                        });
+                    }
+                    return true;
+                }
+                case "live/snapshot": {
+                    const sessionsLimit = parsePositiveInt(searchParams.get("sessionsLimit") ?? searchParams.get("sessions_limit"), 320);
+                    const activityLimit = parsePositiveInt(searchParams.get("activityLimit") ?? searchParams.get("activity_limit"), 600);
+                    const decisionsLimit = parsePositiveInt(searchParams.get("decisionsLimit") ?? searchParams.get("decisions_limit"), 120);
+                    const initiative = searchParams.get("initiative");
+                    const run = searchParams.get("run");
+                    const since = searchParams.get("since");
+                    const decisionStatus = searchParams.get("status") ?? "pending";
+                    const includeIdleRaw = searchParams.get("include_idle");
+                    const includeIdle = includeIdleRaw === null ? undefined : includeIdleRaw !== "false";
+                    let localSnapshot = null;
+                    const ensureLocalSnapshot = async (minimumLimit) => {
+                        if (!localSnapshot || localSnapshot.sessions.length < minimumLimit) {
+                            localSnapshot = await loadLocalOpenClawSnapshot(minimumLimit);
+                        }
+                        return localSnapshot;
+                    };
+                    const settled = await Promise.allSettled([
+                        client.getLiveSessions({
+                            initiative,
+                            limit: sessionsLimit,
+                        }),
+                        client.getLiveActivity({
+                            run,
+                            since,
+                            limit: activityLimit,
+                        }),
+                        client.getHandoffs(),
+                        client.getLiveDecisions({
+                            status: decisionStatus,
+                            limit: decisionsLimit,
+                        }),
+                        client.getLiveAgents({
+                            initiative,
+                            includeIdle,
+                        }),
+                    ]);
+                    const degraded = [];
+                    // sessions
+                    let sessions = {
+                        nodes: [],
+                        edges: [],
+                        groups: [],
+                    };
+                    const sessionsResult = settled[0];
+                    if (sessionsResult.status === "fulfilled") {
+                        sessions = sessionsResult.value;
+                    }
+                    else {
+                        degraded.push(`sessions unavailable (${safeErrorMessage(sessionsResult.reason)})`);
+                        try {
+                            let local = toLocalSessionTree(await ensureLocalSnapshot(Math.max(sessionsLimit, 200)), sessionsLimit);
+                            if (initiative && initiative.trim().length > 0) {
+                                const filteredNodes = local.nodes.filter((node) => node.initiativeId === initiative || node.groupId === initiative);
+                                const filteredIds = new Set(filteredNodes.map((node) => node.id));
+                                const filteredGroupIds = new Set(filteredNodes.map((node) => node.groupId));
+                                local = {
+                                    nodes: filteredNodes,
+                                    edges: local.edges.filter((edge) => filteredIds.has(edge.parentId) && filteredIds.has(edge.childId)),
+                                    groups: local.groups.filter((group) => filteredGroupIds.has(group.id)),
+                                };
+                            }
+                            sessions = local;
+                        }
+                        catch (localErr) {
+                            degraded.push(`sessions local fallback failed (${safeErrorMessage(localErr)})`);
+                        }
+                    }
+                    // activity
+                    let activity = [];
+                    const activityResult = settled[1];
+                    if (activityResult.status === "fulfilled") {
+                        activity = Array.isArray(activityResult.value.activities)
+                            ? activityResult.value.activities
+                            : [];
+                    }
+                    else {
+                        degraded.push(`activity unavailable (${safeErrorMessage(activityResult.reason)})`);
+                        try {
+                            const local = await toLocalLiveActivity(await ensureLocalSnapshot(Math.max(activityLimit, 240)), Math.max(activityLimit, 240));
+                            let filtered = local.activities;
+                            if (run && run.trim().length > 0) {
+                                filtered = filtered.filter((item) => item.runId === run);
+                            }
+                            if (since && since.trim().length > 0) {
+                                const sinceEpoch = Date.parse(since);
+                                if (Number.isFinite(sinceEpoch)) {
+                                    filtered = filtered.filter((item) => Date.parse(item.timestamp) >= sinceEpoch);
+                                }
+                            }
+                            activity = filtered.slice(0, activityLimit);
+                        }
+                        catch (localErr) {
+                            degraded.push(`activity local fallback failed (${safeErrorMessage(localErr)})`);
+                        }
+                    }
+                    // handoffs
+                    let handoffs = [];
+                    const handoffsResult = settled[2];
+                    if (handoffsResult.status === "fulfilled") {
+                        handoffs = Array.isArray(handoffsResult.value.handoffs)
+                            ? handoffsResult.value.handoffs
+                            : [];
+                    }
+                    else {
+                        degraded.push(`handoffs unavailable (${safeErrorMessage(handoffsResult.reason)})`);
+                    }
+                    // decisions
+                    let decisions = [];
+                    const decisionsResult = settled[3];
+                    if (decisionsResult.status === "fulfilled") {
+                        decisions = decisionsResult.value.decisions
+                            .map(mapDecisionEntity)
+                            .sort((a, b) => b.waitingMinutes - a.waitingMinutes);
+                    }
+                    else {
+                        degraded.push(`decisions unavailable (${safeErrorMessage(decisionsResult.reason)})`);
+                    }
+                    // agents
+                    let agents = [];
+                    const agentsResult = settled[4];
+                    if (agentsResult.status === "fulfilled") {
+                        agents = Array.isArray(agentsResult.value.agents)
+                            ? agentsResult.value.agents
+                            : [];
+                    }
+                    else {
+                        degraded.push(`agents unavailable (${safeErrorMessage(agentsResult.reason)})`);
+                        try {
+                            const local = toLocalLiveAgents(await ensureLocalSnapshot(Math.max(sessionsLimit, 240)));
+                            let localAgents = local.agents;
+                            if (initiative && initiative.trim().length > 0) {
+                                localAgents = localAgents.filter((agent) => agent.initiativeId === initiative);
+                            }
+                            if (includeIdle === false) {
+                                localAgents = localAgents.filter((agent) => agent.status !== "idle");
+                            }
+                            agents = localAgents;
+                        }
+                        catch (localErr) {
+                            degraded.push(`agents local fallback failed (${safeErrorMessage(localErr)})`);
+                        }
+                    }
+                    // include locally buffered events so offline-generated actions are visible
+                    try {
+                        const buffered = await readAllOutboxItems();
+                        if (buffered.length > 0) {
+                            const merged = [...activity, ...buffered]
+                                .sort((a, b) => Date.parse(b.timestamp) - Date.parse(a.timestamp))
+                                .slice(0, activityLimit);
+                            const deduped = [];
+                            const seen = new Set();
+                            for (const item of merged) {
+                                if (seen.has(item.id))
+                                    continue;
+                                seen.add(item.id);
+                                deduped.push(item);
+                            }
+                            activity = deduped;
+                        }
+                    }
+                    catch (err) {
+                        degraded.push(`outbox unavailable (${safeErrorMessage(err)})`);
+                    }
+                    sendJson(res, 200, {
+                        sessions,
+                        activity,
+                        handoffs,
+                        decisions,
+                        agents,
+                        generatedAt: new Date().toISOString(),
+                        degraded: degraded.length > 0 ? degraded : undefined,
+                    });
                     return true;
+                }
+                // Legacy endpoints retained for backwards compatibility.
                 case "live/sessions": {
                     try {
                         const initiative = searchParams.get("initiative");
@@ -321,9 +1898,31 @@ export function createHttpHandler(config, client, getSnapshot) {
                         sendJson(res, 200, data);
                     }
                     catch (err) {
-                        sendJson(res, 500, {
-                            error: err instanceof Error ? err.message : String(err),
-                        });
+                        try {
+                            const initiative = searchParams.get("initiative");
+                            const limitRaw = searchParams.get("limit")
+                                ? Number(searchParams.get("limit"))
+                                : undefined;
+                            const limit = Number.isFinite(limitRaw) ? Math.max(1, Number(limitRaw)) : 100;
+                            let local = toLocalSessionTree(await loadLocalOpenClawSnapshot(Math.max(limit, 200)), limit);
+                            if (initiative && initiative.trim().length > 0) {
+                                const filteredNodes = local.nodes.filter((node) => node.initiativeId === initiative || node.groupId === initiative);
+                                const filteredIds = new Set(filteredNodes.map((node) => node.id));
+                                const filteredGroupIds = new Set(filteredNodes.map((node) => node.groupId));
+                                local = {
+                                    nodes: filteredNodes,
+                                    edges: local.edges.filter((edge) => filteredIds.has(edge.parentId) && filteredIds.has(edge.childId)),
+                                    groups: local.groups.filter((group) => filteredGroupIds.has(group.id)),
+                                };
+                            }
+                            sendJson(res, 200, local);
+                        }
+                        catch (localErr) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                                localFallbackError: safeErrorMessage(localErr),
+                            });
+                        }
                     }
                     return true;
                 }
@@ -341,9 +1940,102 @@ export function createHttpHandler(config, client, getSnapshot) {
                         });
                         sendJson(res, 200, data);
                     }
+                    catch (err) {
+                        try {
+                            const run = searchParams.get("run");
+                            const limitRaw = searchParams.get("limit")
+                                ? Number(searchParams.get("limit"))
+                                : undefined;
+                            const since = searchParams.get("since");
+                            const limit = Number.isFinite(limitRaw) ? Math.max(1, Number(limitRaw)) : 240;
+                            const localSnapshot = await loadLocalOpenClawSnapshot(Math.max(limit, 240));
+                            let local = await toLocalLiveActivity(localSnapshot, Math.max(limit, 240));
+                            if (run && run.trim().length > 0) {
+                                local = {
+                                    activities: local.activities.filter((item) => item.runId === run),
+                                    total: local.activities.filter((item) => item.runId === run).length,
+                                };
+                            }
+                            if (since && since.trim().length > 0) {
+                                const sinceEpoch = Date.parse(since);
+                                if (Number.isFinite(sinceEpoch)) {
+                                    const filtered = local.activities.filter((item) => Date.parse(item.timestamp) >= sinceEpoch);
+                                    local = {
+                                        activities: filtered,
+                                        total: filtered.length,
+                                    };
+                                }
+                            }
+                            sendJson(res, 200, {
+                                activities: local.activities.slice(0, limit),
+                                total: local.total,
+                            });
+                        }
+                        catch (localErr) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                                localFallbackError: safeErrorMessage(localErr),
+                            });
+                        }
+                    }
+                    return true;
+                }
+                case "live/activity/detail": {
+                    const turnId = searchParams.get("turnId") ?? searchParams.get("turn_id");
+                    const sessionKey = searchParams.get("sessionKey") ?? searchParams.get("session_key");
+                    const run = searchParams.get("run");
+                    if (!turnId || turnId.trim().length === 0) {
+                        sendJson(res, 400, { error: "turnId is required" });
+                        return true;
+                    }
+                    try {
+                        const detail = await loadLocalTurnDetail({
+                            turnId,
+                            sessionKey,
+                            runId: run,
+                        });
+                        if (!detail) {
+                            sendJson(res, 404, {
+                                error: "Turn detail unavailable",
+                                turnId,
+                            });
+                            return true;
+                        }
+                        sendJson(res, 200, { detail });
+                    }
+                    catch (err) {
+                        sendJson(res, 500, { error: safeErrorMessage(err), turnId });
+                    }
+                    return true;
+                }
+                case "live/activity/headline": {
+                    if (method !== "POST") {
+                        sendJson(res, 405, { error: "Use POST /orgx/api/live/activity/headline" });
+                        return true;
+                    }
+                    try {
+                        const payload = parseJsonBody(req.body);
+                        const text = pickString(payload, ["text", "summary", "detail", "content"]);
+                        if (!text) {
+                            sendJson(res, 400, { error: "text is required" });
+                            return true;
+                        }
+                        const title = pickString(payload, ["title", "name"]);
+                        const type = pickString(payload, ["type", "kind"]);
+                        const result = await summarizeActivityHeadline({
+                            text,
+                            title,
+                            type,
+                        });
+                        sendJson(res, 200, {
+                            headline: result.headline,
+                            source: result.source,
+                            model: result.model,
+                        });
+                    }
                     catch (err) {
                         sendJson(res, 500, {
-                            error: err instanceof Error ? err.message : String(err),
+                            error: safeErrorMessage(err),
                         });
                     }
                     return true;
@@ -360,9 +2052,31 @@ export function createHttpHandler(config, client, getSnapshot) {
                         sendJson(res, 200, data);
                     }
                     catch (err) {
-                        sendJson(res, 500, {
-                            error: err instanceof Error ? err.message : String(err),
-                        });
+                        try {
+                            const initiative = searchParams.get("initiative");
+                            const includeIdleRaw = searchParams.get("include_idle");
+                            const includeIdle = includeIdleRaw === null ? undefined : includeIdleRaw !== "false";
+                            const localSnapshot = await loadLocalOpenClawSnapshot(240);
+                            const local = toLocalLiveAgents(localSnapshot);
+                            let agents = local.agents;
+                            if (initiative && initiative.trim().length > 0) {
+                                agents = agents.filter((agent) => agent.initiativeId === initiative);
+                            }
+                            if (includeIdle === false) {
+                                agents = agents.filter((agent) => agent.status !== "idle");
+                            }
+                            const summary = agents.reduce((acc, agent) => {
+                                acc[agent.status] = (acc[agent.status] ?? 0) + 1;
+                                return acc;
+                            }, {});
+                            sendJson(res, 200, { agents, summary });
+                        }
+                        catch (localErr) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                                localFallbackError: safeErrorMessage(localErr),
+                            });
+                        }
                     }
                     return true;
                 }
@@ -379,9 +2093,28 @@ export function createHttpHandler(config, client, getSnapshot) {
                         sendJson(res, 200, data);
                     }
                     catch (err) {
-                        sendJson(res, 500, {
-                            error: err instanceof Error ? err.message : String(err),
-                        });
+                        try {
+                            const id = searchParams.get("id");
+                            const limitRaw = searchParams.get("limit")
+                                ? Number(searchParams.get("limit"))
+                                : undefined;
+                            const limit = Number.isFinite(limitRaw) ? Math.max(1, Number(limitRaw)) : 100;
+                            const local = toLocalLiveInitiatives(await loadLocalOpenClawSnapshot(240));
+                            let initiatives = local.initiatives;
+                            if (id && id.trim().length > 0) {
+                                initiatives = initiatives.filter((item) => item.id === id);
+                            }
+                            sendJson(res, 200, {
+                                initiatives: initiatives.slice(0, limit),
+                                total: initiatives.length,
+                            });
+                        }
+                        catch (localErr) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                                localFallbackError: safeErrorMessage(localErr),
+                            });
+                        }
                     }
                     return true;
                 }
@@ -403,9 +2136,10 @@ export function createHttpHandler(config, client, getSnapshot) {
                             total: data.total,
                         });
                     }
-                    catch (err) {
-                        sendJson(res, 500, {
-                            error: err instanceof Error ? err.message : String(err),
+                    catch {
+                        sendJson(res, 200, {
+                            decisions: [],
+                            total: 0,
                         });
                     }
                     return true;
@@ -415,10 +2149,8 @@ export function createHttpHandler(config, client, getSnapshot) {
                         const data = await client.getHandoffs();
                         sendJson(res, 200, data);
                     }
-                    catch (err) {
-                        sendJson(res, 500, {
-                            error: err instanceof Error ? err.message : String(err),
-                        });
+                    catch {
+                        sendJson(res, 200, { handoffs: [] });
                     }
                     return true;
                 }
@@ -429,6 +2161,36 @@ export function createHttpHandler(config, client, getSnapshot) {
                         return true;
                     }
                     const target = `${config.baseUrl.replace(/\/+$/, "")}/api/client/live/stream${queryString ? `?${queryString}` : ""}`;
+                    const streamAbortController = new AbortController();
+                    let reader = null;
+                    let closed = false;
+                    let streamOpened = false;
+                    let idleTimer = null;
+                    const clearIdleTimer = () => {
+                        if (idleTimer) {
+                            clearTimeout(idleTimer);
+                            idleTimer = null;
+                        }
+                    };
+                    const closeStream = () => {
+                        if (closed)
+                            return;
+                        closed = true;
+                        clearIdleTimer();
+                        streamAbortController.abort();
+                        if (reader) {
+                            void reader.cancel().catch(() => undefined);
+                        }
+                        if (streamOpened && !res.writableEnded) {
+                            res.end();
+                        }
+                    };
+                    const resetIdleTimer = () => {
+                        clearIdleTimer();
+                        idleTimer = setTimeout(() => {
+                            closeStream();
+                        }, STREAM_IDLE_TIMEOUT_MS);
+                    };
                     try {
                         const upstream = await fetch(target, {
                             method: "GET",
@@ -439,6 +2201,7 @@ export function createHttpHandler(config, client, getSnapshot) {
                                     ? { "X-Orgx-User-Id": config.userId }
                                     : {}),
                             },
+                            signal: streamAbortController.signal,
                         });
                         const contentType = upstream.headers.get("content-type")?.toLowerCase() ?? "";
                         if (!upstream.ok || !contentType.includes("text/event-stream")) {
@@ -459,33 +2222,84 @@ export function createHttpHandler(config, client, getSnapshot) {
                             Connection: "keep-alive",
                             ...CORS_HEADERS,
                         });
+                        streamOpened = true;
                         if (!upstream.body) {
-                            res.end();
+                            closeStream();
                             return true;
                         }
-                        const reader = upstream.body.getReader();
+                        req.on?.("close", closeStream);
+                        req.on?.("aborted", closeStream);
+                        res.on?.("close", closeStream);
+                        res.on?.("finish", closeStream);
+                        reader = upstream.body.getReader();
+                        const streamReader = reader;
+                        resetIdleTimer();
+                        const waitForDrain = async () => {
+                            if (typeof res.once === "function") {
+                                await new Promise((resolve) => {
+                                    res.once?.("drain", () => resolve());
+                                });
+                            }
+                        };
                         const pump = async () => {
-                            while (true) {
-                                const { done, value } = await reader.read();
-                                if (done)
-                                    break;
-                                if (value)
-                                    write(Buffer.from(value));
+                            try {
+                                while (!closed) {
+                                    const { done, value } = await streamReader.read();
+                                    if (done)
+                                        break;
+                                    if (!value || value.byteLength === 0)
+                                        continue;
+                                    resetIdleTimer();
+                                    const accepted = write(Buffer.from(value));
+                                    if (accepted === false) {
+                                        await waitForDrain();
+                                    }
+                                }
+                            }
+                            catch {
+                                // Swallow pump errors; client disconnects are expected.
+                            }
+                            finally {
+                                closeStream();
                             }
-                            res.end();
                         };
                         void pump();
                     }
                     catch (err) {
-                        sendJson(res, 500, {
-                            error: err instanceof Error ? err.message : String(err),
-                        });
+                        closeStream();
+                        if (!streamOpened && !res.writableEnded) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                            });
+                        }
                     }
                     return true;
                 }
-                default:
+                case "delegation/preflight": {
+                    sendJson(res, 405, { error: "Use POST /orgx/api/delegation/preflight" });
+                    return true;
+                }
+                default: {
+                    if (runCheckpointsMatch) {
+                        try {
+                            const runId = decodeURIComponent(runCheckpointsMatch[1]);
+                            const data = await client.listRunCheckpoints(runId);
+                            sendJson(res, 200, data);
+                        }
+                        catch (err) {
+                            sendJson(res, 500, {
+                                error: safeErrorMessage(err),
+                            });
+                        }
+                        return true;
+                    }
+                    if (runActionMatch || runCheckpointRestoreMatch) {
+                        sendJson(res, 405, { error: "Use POST for this endpoint" });
+                        return true;
+                    }
                     sendJson(res, 404, { error: "Unknown API endpoint" });
                     return true;
+                }
             }
         }
         // ── Dashboard SPA + static assets ──────────────────────────────────────