@winspan/claude-forge 8.28.2 → 8.33.0

package/dist/web/server.js

@@ -1,2230 +1,80 @@
 /**
- * Web API server — lightweight Express server for Forge dashboard
+ * Web API server — Express entry for the Forge dashboard.
  *
- * 3 pages: Dashboard, Events, Rules
+ * server.ts is intentionally thin: it wires middleware, composes the route
+ * modules under src/web/routes/, and owns lifecycle (start/stop). Each route
+ * module is responsible for its own domain; see src/web/routes/types.ts for
+ * the shared RouteContext.
  */
 import express from 'express';
-import fs from 'fs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-import { homedir } from 'os';
-import yaml from 'js-yaml';
-import { Recommender } from '../engine/recommender.js';
 import { logger } from '../core/utils/logger.js';
 import { ErrorHandler } from '../core/utils/error-handler.js';
-import { ConfigManager } from '../core/config.js';
-import { ClaudeProvider } from '../core/ai/provider.js';
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
+import { requireAuth } from './auth-middleware.js';
+import { registerAuthRoutes } from './routes/auth.js';
+import { registerStaticAssets, registerStaticFallback } from './routes/static.js';
+import { registerStatusRoutes } from './routes/status.js';
+import { registerEventsRoutes } from './routes/events.js';
+import { registerSessionsRoutes } from './routes/sessions.js';
+import { registerRulesRoutes } from './routes/rules.js';
+import { registerRoutingRoutes } from './routes/routing.js';
+import { registerExperimentsRoutes } from './routes/experiments.js';
+import { registerMethodologyRoutes } from './routes/methodology.js';
+import { registerTokenUsageRoutes } from './routes/token-usage.js';
+import { registerExecutionTraceRoutes } from './routes/execution-trace.js';
+import { registerAIRoutes } from './routes/ai.js';
+import { registerPatchRoutes } from './routes/patch.js';
+import { registerAgentsRoutes } from './routes/agents.js';
+import { registerSkillsRoutes } from './routes/skills.js';
 export class WebServer {
     options;
     app;
     server = null;
-    agents;
-    router;
     constructor(options) {
         this.options = options;
         this.app = express();
         this.app.use(express.json());
-        this.agents = options.agents;
-        this.router = options.router;
         this.setupRoutes();
     }
     setupRoutes() {
-        const { storage, ruleEngine } = this.options;
-        const resolvePatchTarget = (targetType, targetName) => {
-            if (targetType === 'agent') {
-                return {
-                    filePath: path.join(homedir(), '.claude', 'agents', `${targetName}.md`),
-                    backupDir: path.join(homedir(), '.claude-forge', 'backups', 'agents'),
-                };
-            }
-            if (targetType === 'skill') {
-                return {
-                    filePath: path.join(homedir(), '.claude', 'skills', `${targetName}.md`),
-                    backupDir: path.join(homedir(), '.claude-forge', 'backups', 'skills'),
-                };
-            }
-            if (targetType === 'routing_rule') {
-                return {
-                    filePath: path.join(homedir(), '.claude-forge', 'routing.yaml'),
-                    backupDir: path.join(homedir(), '.claude-forge', 'backups', 'routing'),
-                };
-            }
-            throw new Error(`Unsupported targetType: ${targetType}`);
+        // Auth gate: write operations (non-GET) always require Bearer token.
+        // GET read endpoints stay open for polling & read-only dashboards.
+        this.app.use('/api', (req, res, next) => {
+            if (req.method === 'GET')
+                return next();
+            return requireAuth(req, res, next);
+        });
+        const ctx = {
+            storage: this.options.storage,
+            ruleEngine: this.options.ruleEngine,
+            router: this.options.router,
+            agents: this.options.agents,
+            skillRegistry: this.options.skillRegistry,
+            executionManager: this.options.executionManager,
+            methodologyRegistry: this.options.methodologyRegistry,
+            methodologyPlanner: this.options.methodologyPlanner,
         };
-        // Serve static files (support both dist/ and src/ layouts)
-        const candidates = [
-            path.join(__dirname, 'static'), // dist/web/static
-            path.join(__dirname, '../../src/web/static'), // dev: src/web/static
-        ];
-        const staticDir = candidates.find(dir => fs.existsSync(dir));
-        if (staticDir) {
-            // Static files with content-hash in filename: long cache
-            // index.html: no cache (always fetch latest)
-            this.app.use(express.static(staticDir, {
-                setHeaders: (res, filePath) => {
-                    if (filePath.endsWith('index.html')) {
-                        res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-                        res.setHeader('Pragma', 'no-cache');
-                        res.setHeader('Expires', '0');
-                    }
-                    else if (filePath.includes('/assets/')) {
-                        // Vite assets are content-hashed, safe to cache forever
-                        res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
-                    }
-                },
-            }));
-            this.app.get('/', (_req, res) => {
-                res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-                res.sendFile('index.html', { root: staticDir });
-            });
-            logger.info(`[Web] Serving static files from ${staticDir}`);
-        }
-        else {
-            logger.warn(`[Web] Static directory not found in: ${candidates.join(', ')}`);
-        }
-        // Dashboard: daemon status
-        this.app.get('/api/status', (_req, res) => {
-            res.json({
-                pid: process.pid,
-                uptime: process.uptime(),
-                memory: process.memoryUsage(),
-                eventCount: storage.countEvents({}),
-            });
-        });
-        // Events: recent events
-        this.app.get('/api/events', (req, res) => {
-            const limit = parseInt(req.query.limit) || 50;
-            const projectPath = req.query.project;
-            const sessionId = req.query.session;
-            const events = storage.queryEvents({ project_path: projectPath, session_id: sessionId, limit });
-            res.json(events);
-        });
-        // Sessions: list with first prompt
-        this.app.get('/api/sessions', (req, res) => {
-            const limit = parseInt(req.query.limit) || 10;
-            const projectPath = req.query.project;
-            const sessions = storage.querySessions({ project_path: projectPath, limit });
-            res.json(sessions);
-        });
-        // Injections: query injection history
-        this.app.get('/api/injections', (req, res) => {
-            const limit = parseInt(req.query.limit) || 50;
-            const sessionId = req.query.session;
-            const eventId = req.query.event;
-            const handler = req.query.handler;
-            const injections = storage.queryInjections({
-                session_id: sessionId,
-                event_id: eventId,
-                source_handler: handler,
-                limit
-            });
-            res.json(injections);
-        });
-        // Decisions: query governance decisions
-        this.app.get('/api/decisions', (req, res) => {
-            const limit = parseInt(req.query.limit) || 50;
-            const sessionId = req.query.session;
-            const decisions = storage.queryDecisions({ session_id: sessionId, limit });
-            res.json(decisions);
-        });
-        // Session Detail: task-grouped session data
-        this.app.get('/api/sessions/:sessionId/detail', (req, res) => {
-            const sessionId = req.params.sessionId;
-            const sessions = storage.querySessions({ limit: 1000 });
-            const session = sessions.find(s => s.session_id === sessionId || s.session_id.startsWith(sessionId));
-            if (!session) {
-                res.status(404).json({ error: 'Session not found' });
-                return;
-            }
-            const fullSessionId = session.session_id;
-            const tasks = storage.queryTasks({ session_id: fullSessionId });
-            const allEvents = storage.queryEvents({ session_id: fullSessionId, limit: 2000 });
-            const allInjections = storage.queryInjections({ session_id: fullSessionId, limit: 200 });
-            const allQualityIssues = storage.queryQualityIssues({ session_id: fullSessionId });
-            const allDecisions = storage.queryDecisions({ session_id: fullSessionId });
-            const buildTaskDetail = (events, injections) => {
-                const prompts = events
-                    .filter(e => e.hook_type === 'UserPromptSubmit' && (e.user_prompt || e.tool_input?.user_prompt))
-                    .map(e => ({ timestamp: e.timestamp, content: e.user_prompt || e.tool_input?.user_prompt }));
-                const toolUsage = {};
-                events.forEach(e => { if (e.tool_name)
-                    toolUsage[e.tool_name] = (toolUsage[e.tool_name] || 0) + 1; });
-                const filesChanged = [...new Set(events
-                        .filter(e => (e.tool_name === 'Edit' || e.tool_name === 'Write') && e.tool_input?.file_path)
-                        .map(e => e.tool_input.file_path))];
-                const commits = events
-                    .filter(e => e.tool_name === 'Bash' && e.tool_input?.command?.includes('git commit'))
-                    .map(e => {
-                    const cmd = e.tool_input?.command || '';
-                    const match = cmd.match(/git commit.*-m\s+["']([^"']+)["']/);
-                    return { timestamp: e.timestamp, message: match ? match[1] : 'commit' };
-                });
-                return { prompts, events: events.slice(0, 200), injections, summary: { toolUsage, filesChanged, commits } };
-            };
-            if (tasks.length === 0) {
-                const detail = buildTaskDetail(allEvents, allInjections);
-                const virtualTask = {
-                    id: 'virtual',
-                    session_id: fullSessionId,
-                    title: session.first_prompt || '(未分类任务)',
-                    start_time: session.start_time,
-                    end_time: session.end_time,
-                    status: 'completed',
-                    event_count: allEvents.length,
-                    ...detail,
-                    qualityIssues: allQualityIssues,
-                    decisions: allDecisions,
-                };
-                res.json({ session, tasks: [virtualTask] });
-                return;
-            }
-            const taskDetails = tasks.map(task => {
-                const taskEventIds = new Set(storage.getTaskEventIds(task.id));
-                const events = allEvents.filter(e => taskEventIds.has(e.event_id ?? ''));
-                const injections = allInjections.filter(i => i.event_id && taskEventIds.has(i.event_id));
-                const qualityIssues = allQualityIssues.filter(q => events.some(e => e.tool_input?.file_path === q.file_path));
-                const decisions = allDecisions.filter(d => events.some(e => Math.abs(new Date(e.timestamp).getTime() - d.timestamp) < 5000));
-                const detail = buildTaskDetail(events, injections);
-                return { ...task, ...detail, qualityIssues, decisions };
-            });
-            res.json({ session, tasks: taskDetails });
-        });
-        // Session timeline: detailed event timeline for a session
-        this.app.get('/api/sessions/:id/timeline', (req, res) => {
-            const sessionIdPrefix = req.params.id;
-            const limit = parseInt(req.query.limit) || 50;
-            const offset = parseInt(req.query.offset) || 0;
-            const sessions = storage.querySessions({ limit: 1000 });
-            const session = sessions.find(s => s.session_id.startsWith(sessionIdPrefix));
-            if (!session) {
-                res.status(404).json({ error: 'Session not found' });
-                return;
-            }
-            const fullSessionId = session.session_id;
-            const events = storage.queryEvents({ session_id: fullSessionId, limit: 2000 });
-            const injections = storage.queryInjections({ session_id: fullSessionId, limit: 200 });
-            const qualityIssues = storage.queryQualityIssues({ session_id: fullSessionId, resolved: false });
-            // Build timeline: merge events and injections, sort by timestamp
-            const timeline = [];
-            // User inputs
-            events
-                .filter(e => e.hook_type === 'UserPromptSubmit' && (e.user_prompt || e.tool_input?.user_prompt))
-                .forEach(e => {
-                timeline.push({
-                    timestamp: e.timestamp,
-                    type: 'user_input',
-                    data: { content: e.user_prompt || e.tool_input?.user_prompt },
-                });
-            });
-            // Injections (truncate content for preview)
-            injections.forEach(inj => {
-                timeline.push({
-                    timestamp: inj.timestamp,
-                    type: 'injection',
-                    data: {
-                        source: inj.source_handler,
-                        injection_type: inj.injection_type,
-                        content: inj.content.slice(0, 500), // Truncate to 500 chars
-                        length: inj.content.length,
-                        truncated: inj.content.length > 500,
-                    },
-                });
-            });
-            // Tool calls (truncate large fields)
-            events
-                .filter(e => e.tool_name && e.hook_type === 'PreToolUse')
-                .forEach(e => {
-                const toolInput = e.tool_input;
-                const toolOutput = e.tool_output;
-                // Truncate large fields
-                const truncateField = (obj, maxLen = 200) => {
-                    if (!obj)
-                        return obj;
-                    if (typeof obj === 'string')
-                        return obj.length > maxLen ? obj.slice(0, maxLen) + '...' : obj;
-                    if (Array.isArray(obj))
-                        return obj.slice(0, 5);
-                    if (typeof obj === 'object') {
-                        const result = {};
-                        for (const [k, v] of Object.entries(obj)) {
-                            result[k] = truncateField(v, maxLen);
-                        }
-                        return result;
-                    }
-                    return obj;
-                };
-                timeline.push({
-                    timestamp: e.timestamp,
-                    type: 'tool_call',
-                    data: {
-                        tool: e.tool_name,
-                        input: truncateField(toolInput),
-                        output: truncateField(toolOutput),
-                        success: !toolOutput?.error,
-                    },
-                });
-            });
-            // Quality checks (from PostToolUse events with quality gate results)
-            events
-                .filter(e => e.hook_type === 'PostToolUse' && e.tool_output?.quality_check)
-                .forEach(e => {
-                const qc = e.tool_output.quality_check;
-                timeline.push({
-                    timestamp: e.timestamp,
-                    type: 'quality_check',
-                    data: qc,
-                });
-            });
-            // Sort by timestamp
-            timeline.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
-            // Paginate
-            const total = timeline.length;
-            const paginatedTimeline = timeline.slice(offset, offset + limit);
-            // Summary
-            const commits = events
-                .filter(e => e.tool_name === 'Bash' && e.tool_input?.command?.includes('git commit'))
-                .map(e => {
-                const cmd = e.tool_input?.command || '';
-                const match = cmd.match(/git commit.*-m\s+["']([^"']+)["']/);
-                return { message: match ? match[1] : 'commit' };
-            });
-            const filesChanged = [...new Set(events
-                    .filter(e => (e.tool_name === 'Edit' || e.tool_name === 'Write') && e.tool_input?.file_path)
-                    .map(e => e.tool_input.file_path))];
-            res.json({
-                session,
-                timeline: paginatedTimeline,
-                total,
-                offset,
-                limit,
-                hasMore: offset + limit < total,
-                summary: {
-                    commits,
-                    filesChanged,
-                    unresolvedIssues: qualityIssues,
-                },
-            });
-        });
-        // Rules: loaded conventions with statistics
-        this.app.get('/api/rules', (_req, res) => {
-            const conventions = ruleEngine.getConventions();
-            const conventionsArray = Array.from(conventions.entries());
-            // Add statistics for each convention
-            const conventionsWithStats = conventionsArray.map(([conventionId, conv]) => {
-                const decisions = storage.queryDecisions({ limit: 1000 });
-                const ruleIds = [...(conv.forbidden || []), ...(conv.escalation || [])].map(r => r.id);
-                const stats = {
-                    totalTriggers: decisions.filter(d => ruleIds.includes(d.rule_id || '')).length,
-                    blockCount: decisions.filter(d => ruleIds.includes(d.rule_id || '') && d.level === 'block').length,
-                    warnCount: decisions.filter(d => ruleIds.includes(d.rule_id || '') && d.level === 'warn').length,
-                    lastTriggered: decisions
-                        .filter(d => ruleIds.includes(d.rule_id || ''))
-                        .sort((a, b) => b.timestamp - a.timestamp)[0]?.timestamp || null,
-                };
-                return {
-                    id: conventionId,
-                    name: conv.name,
-                    version: conv.version,
-                    description: conv.description,
-                    stats,
-                    ruleCount: (conv.forbidden || []).length + (conv.escalation || []).length,
-                };
-            });
-            res.json(conventionsWithStats);
-        });
-        // Rule detail: get specific rule with trigger history
-        this.app.get('/api/rules/:conventionId', (req, res) => {
-            const conventionId = req.params.conventionId;
-            const conventions = ruleEngine.getConventions();
-            const convention = conventions.get(conventionId);
-            if (!convention) {
-                res.status(404).json({ error: 'Convention not found' });
-                return;
-            }
-            // Get all decisions for this convention's rules
-            const ruleIds = [...(convention.forbidden || []), ...(convention.escalation || [])].map(r => r.id);
-            const allDecisions = storage.queryDecisions({ limit: 500 });
-            const decisions = allDecisions.filter(d => ruleIds.includes(d.rule_id || ''));
-            // Group by rule
-            const ruleStats = ruleIds.map(ruleId => {
-                const ruleDecisions = decisions.filter(d => d.rule_id === ruleId);
-                const rule = [...(convention.forbidden || []), ...(convention.escalation || [])].find(r => r.id === ruleId);
-                return {
-                    ruleId,
-                    rule,
-                    triggerCount: ruleDecisions.length,
-                    blockCount: ruleDecisions.filter(d => d.level === 'block').length,
-                    warnCount: ruleDecisions.filter(d => d.level === 'warn').length,
-                    recentTriggers: ruleDecisions.slice(0, 10).map(d => ({
-                        timestamp: d.timestamp,
-                        level: d.level,
-                        reason: d.reason,
-                    })),
-                };
-            });
-            res.json({
-                convention,
-                ruleStats,
-                totalDecisions: decisions.length,
-            });
-        });
-        // Statistics: overall system statistics
-        this.app.get('/api/stats', (_req, res) => {
-            const sessions = storage.querySessions({ limit: 1000 });
-            const events = storage.queryEvents({ limit: 5000 });
-            const decisions = storage.queryDecisions({ limit: 1000 });
-            // Tool usage distribution
-            const toolUsage = {};
-            events.forEach(e => {
-                if (e.tool_name) {
-                    toolUsage[e.tool_name] = (toolUsage[e.tool_name] || 0) + 1;
-                }
-            });
-            // Decision level distribution
-            const decisionLevels = {
-                block: decisions.filter(d => d.level === 'block').length,
-                warn: decisions.filter(d => d.level === 'warn').length,
-                confirm: decisions.filter(d => d.level === 'confirm').length,
-                allow: decisions.filter(d => d.level === 'allow').length,
-            };
-            // Daily activity (last 7 days, local dates to match DB-stored local ISO strings)
-            const today = new Date();
-            const dailyActivity = Array.from({ length: 7 }, (_, i) => {
-                const d = new Date(today.getFullYear(), today.getMonth(), today.getDate() - (6 - i));
-                const dateStr = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
-                const dayEvents = events.filter(e => e.timestamp.slice(0, 10) === dateStr);
-                return {
-                    date: dateStr,
-                    eventCount: dayEvents.length,
-                    sessionCount: new Set(dayEvents.map(e => e.session_id)).size,
-                };
-            });
-            res.json({
-                totalSessions: sessions.length,
-                totalEvents: storage.countEvents({}),
-                totalDecisions: decisions.length,
-                toolUsage,
-                decisionLevels,
-                dailyActivity,
-            });
-        });
-        // ── Agent Routing API ─────────────────────────────────────────────────
-        // Overview stats for the Agent Routing page
-        this.app.get('/api/routing/stats', (req, res) => {
-            const windowHours = parseInt(req.query.window || '168'); // default 7d
-            const since = Date.now() - windowHours * 3600 * 1000;
-            const events = storage.queryRoutingEvents({ since_ts: since, limit: 5000 });
-            const total = events.length;
-            const byAgent = {};
-            let forced = 0;
-            let obeyedCount = 0;
-            let refusedCount = 0;
-            let unknownCount = 0;
-            let fallbackUsedCount = 0;
-            const latencies = [];
-            const byVersion = {};
-            for (const e of events) {
-                if (e.is_forced)
-                    forced++;
-                if (e.fallback_used)
-                    fallbackUsedCount++;
-                if (typeof e.classification_ms === 'number')
-                    latencies.push(e.classification_ms);
-                const key = e.routed_to_name ?? '—';
-                const bucket = (byAgent[key] ||= { total: 0, obeyed: 0, refused: 0, unknown: 0 });
-                bucket.total++;
-                if (e.obeyed === 1) {
-                    bucket.obeyed++;
-                    obeyedCount++;
-                }
-                else if (e.obeyed === 0) {
-                    bucket.refused++;
-                    refusedCount++;
-                }
-                else {
-                    bucket.unknown++;
-                    unknownCount++;
-                }
-                const v = e.injection_version ?? '—';
-                const vb = (byVersion[v] ||= { total: 0, obeyed: 0 });
-                vb.total++;
-                if (e.obeyed === 1)
-                    vb.obeyed++;
-            }
-            latencies.sort((a, b) => a - b);
-            const p = (pct) => latencies.length === 0 ? null : latencies[Math.min(latencies.length - 1, Math.floor(latencies.length * pct))];
-            res.json({
-                windowHours,
-                total,
-                forced,
-                obeyedCount,
-                refusedCount,
-                unknownCount,
-                obedienceRate: forced === 0 ? null : obeyedCount / forced,
-                refusalRate: forced === 0 ? null : refusedCount / forced,
-                fallbackUsedCount,
-                fallbackRate: total === 0 ? null : fallbackUsedCount / total,
-                latency: {
-                    p50: p(0.5),
-                    p95: p(0.95),
-                    p99: p(0.99),
-                    count: latencies.length,
-                },
-                byAgent,
-                byVersion,
-            });
-        });
-        // Performance analysis for the Agent Routing page
-        this.app.get('/api/routing/performance', (req, res) => {
-            const windowHours = parseInt(req.query.window || '168');
-            const minAttempts = Math.max(1, parseInt(req.query.minAttempts || '10'));
-            const since = Date.now() - windowHours * 3600 * 1000;
-            const events = storage.queryRoutingEvents({ since_ts: since, limit: 5000 });
-            const relevant = events.filter(e => e.routed_to_name);
-            const judged = relevant.filter(e => e.obeyed === 0 || e.obeyed === 1);
-            const obeyedCount = judged.filter(e => e.obeyed === 1).length;
-            const refusedCount = judged.filter(e => e.obeyed === 0).length;
-            const unknownCount = relevant.length - judged.length;
-            const latencies = relevant
-                .map(e => e.classification_ms)
-                .filter((ms) => typeof ms === 'number');
-            const executionLatencies = relevant
-                .map(e => e.total_execution_ms ?? ((typeof e.completed_ts === 'number') ? e.completed_ts - e.ts : null))
-                .filter((ms) => typeof ms === 'number');
-            const avgClassificationMs = latencies.length === 0
-                ? null
-                : Math.round(latencies.reduce((sum, n) => sum + n, 0) / latencies.length);
-            const avgExecutionMs = executionLatencies.length === 0
-                ? null
-                : Math.round(executionLatencies.reduce((sum, n) => sum + n, 0) / executionLatencies.length);
-            const sortedExecution = [...executionLatencies].sort((a, b) => a - b);
-            const p95ExecutionMs = sortedExecution.length === 0
-                ? null
-                : sortedExecution[Math.min(sortedExecution.length - 1, Math.floor(sortedExecution.length * 0.95))];
-            const byAgentMap = new Map();
-            const dailyMap = new Map();
-            for (const e of relevant) {
-                const agent = e.routed_to_name ?? '—';
-                const agentBucket = byAgentMap.get(agent) ?? {
-                    agent,
-                    total: 0,
-                    judged: 0,
-                    obeyed: 0,
-                    refused: 0,
-                    unknown: 0,
-                    latencySum: 0,
-                    latencyCount: 0,
-                    executionSum: 0,
-                    executionCount: 0,
-                };
-                agentBucket.total++;
-                if (e.obeyed === 1) {
-                    agentBucket.judged++;
-                    agentBucket.obeyed++;
-                }
-                else if (e.obeyed === 0) {
-                    agentBucket.judged++;
-                    agentBucket.refused++;
-                }
-                else {
-                    agentBucket.unknown++;
-                }
-                if (typeof e.classification_ms === 'number') {
-                    agentBucket.latencySum += e.classification_ms;
-                    agentBucket.latencyCount++;
-                }
-                const executionMs = e.total_execution_ms ?? ((typeof e.completed_ts === 'number') ? e.completed_ts - e.ts : null);
-                if (typeof executionMs === 'number') {
-                    agentBucket.executionSum += executionMs;
-                    agentBucket.executionCount++;
-                }
-                byAgentMap.set(agent, agentBucket);
-                const date = new Date(e.ts).toISOString().slice(0, 10);
-                const dayBucket = dailyMap.get(date) ?? {
-                    date,
-                    total: 0,
-                    obeyed: 0,
-                    refused: 0,
-                    unknown: 0,
-                    latencySum: 0,
-                    latencyCount: 0,
-                    executionSum: 0,
-                    executionCount: 0,
-                };
-                dayBucket.total++;
-                if (e.obeyed === 1)
-                    dayBucket.obeyed++;
-                else if (e.obeyed === 0)
-                    dayBucket.refused++;
-                else
-                    dayBucket.unknown++;
-                if (typeof e.classification_ms === 'number') {
-                    dayBucket.latencySum += e.classification_ms;
-                    dayBucket.latencyCount++;
-                }
-                if (typeof executionMs === 'number') {
-                    dayBucket.executionSum += executionMs;
-                    dayBucket.executionCount++;
-                }
-                dailyMap.set(date, dayBucket);
-            }
-            const byAgent = Array.from(byAgentMap.values())
-                .map(a => ({
-                agent: a.agent,
-                total: a.total,
-                judged: a.judged,
-                obeyed: a.obeyed,
-                refused: a.refused,
-                unknown: a.unknown,
-                obedienceRate: a.judged === 0 ? null : a.obeyed / a.judged,
-                refusalRate: a.judged === 0 ? null : a.refused / a.judged,
-                avgClassificationMs: a.latencyCount === 0 ? null : Math.round(a.latencySum / a.latencyCount),
-                avgExecutionMs: a.executionCount === 0 ? null : Math.round(a.executionSum / a.executionCount),
-            }))
-                .sort((a, b) => b.total - a.total);
-            const dailyTrend = Array.from(dailyMap.values())
-                .map(d => ({
-                date: d.date,
-                total: d.total,
-                obeyed: d.obeyed,
-                refused: d.refused,
-                unknown: d.unknown,
-                avgClassificationMs: d.latencyCount === 0 ? null : Math.round(d.latencySum / d.latencyCount),
-                avgExecutionMs: d.executionCount === 0 ? null : Math.round(d.executionSum / d.executionCount),
-            }))
-                .sort((a, b) => a.date.localeCompare(b.date));
-            const highRefusalAgents = byAgent
-                .filter(a => a.judged >= minAttempts && (a.refusalRate ?? 0) > 0)
-                .sort((a, b) => {
-                const rateDiff = (b.refusalRate ?? 0) - (a.refusalRate ?? 0);
-                return rateDiff !== 0 ? rateDiff : b.judged - a.judged;
-            })
-                .slice(0, 10)
-                .map(a => ({
-                agent: a.agent,
-                totalAttempts: a.judged,
-                obeyed: a.obeyed,
-                refused: a.refused,
-                refusalRate: a.refusalRate,
-                avgClassificationMs: a.avgClassificationMs,
-                avgExecutionMs: a.avgExecutionMs,
-            }));
-            res.json({
-                windowHours,
-                minAttempts,
-                summary: {
-                    totalRouted: relevant.length,
-                    totalJudged: judged.length,
-                    obeyed: obeyedCount,
-                    refused: refusedCount,
-                    unknown: unknownCount,
-                    obedienceRate: judged.length === 0 ? null : obeyedCount / judged.length,
-                    refusalRate: judged.length === 0 ? null : refusedCount / judged.length,
-                    avgClassificationMs,
-                    avgExecutionMs,
-                    p95ExecutionMs,
-                },
-                byAgent,
-                dailyTrend,
-                highRefusalAgents,
-            });
-        });
-        // Recent routing events (timeline / detail)
-        this.app.get('/api/routing/events', (req, res) => {
-            const limit = parseInt(req.query.limit || '50');
-            const sessionId = req.query.session;
-            const projectPath = req.query.project;
-            const agent = req.query.agent;
-            const obeyedParam = req.query.obeyed;
-            const filter = { limit };
-            if (sessionId)
-                filter.session_id = sessionId;
-            if (projectPath)
-                filter.project_path = projectPath;
-            if (agent)
-                filter.routed_to_name = agent;
-            if (obeyedParam === 'null')
-                filter.obeyed = null;
-            else if (obeyedParam === '0')
-                filter.obeyed = 0;
-            else if (obeyedParam === '1')
-                filter.obeyed = 1;
-            const rows = storage.queryRoutingEvents(filter);
-            res.json(rows);
-        });
-        // Methodology Executions: list all executions
-        this.app.get('/api/methodology-executions', (req, res) => {
-            const limit = parseInt(req.query.limit) || 50;
-            const sessionId = req.query.session;
-            const db = storage.getDatabase();
-            const query = sessionId
-                ? 'SELECT * FROM methodology_executions WHERE session_id = ? ORDER BY started_at DESC LIMIT ?'
-                : 'SELECT * FROM methodology_executions ORDER BY started_at DESC LIMIT ?';
-            const params = sessionId ? [sessionId, limit] : [limit];
-            const executions = db.prepare(query).all(...params);
-            res.json(executions);
-        });
-        // Methodology Execution Detail: get single execution with phases
-        this.app.get('/api/methodology-executions/:id', (req, res) => {
-            const executionId = parseInt(req.params.id);
-            const db = storage.getDatabase();
-            const execution = db.prepare('SELECT * FROM methodology_executions WHERE id = ?').get(executionId);
-            if (!execution) {
-                res.status(404).json({ error: 'Execution not found' });
-                return;
-            }
-            const phases = db.prepare(`
-        SELECT * FROM phase_executions
-        WHERE methodology_execution_id = ?
-        ORDER BY phase_index ASC
-      `).all(executionId);
-            res.json({
-                ...execution,
-                plan: JSON.parse(execution.plan_json),
-                phases,
-            });
-        });
-        // Methodology Execution: cancel a running execution
-        this.app.post('/api/methodology-executions/:id/cancel', (req, res) => {
-            const executionId = parseInt(req.params.id);
-            const db = storage.getDatabase();
-            const execution = db.prepare('SELECT * FROM methodology_executions WHERE id = ?').get(executionId);
-            if (!execution) {
-                res.status(404).json({ error: 'Execution not found' });
-                return;
-            }
-            if (execution.status !== 'running') {
-                res.status(400).json({ error: `Cannot cancel execution in ${execution.status} state` });
-                return;
-            }
-            db.prepare(`
-        UPDATE methodology_executions
-        SET status = 'cancelled', completed_at = ?
-        WHERE id = ?
-      `).run(Date.now(), executionId);
-            // Also mark any running phase as cancelled
-            db.prepare(`
-        UPDATE phase_executions
-        SET status = 'cancelled', completed_at = ?
-        WHERE methodology_execution_id = ? AND status = 'running'
-      `).run(Date.now(), executionId);
-            res.json({ success: true, message: 'Execution cancelled' });
-        });
-        // Methodology Execution: delete an execution
-        this.app.delete('/api/methodology-executions/:id', (req, res) => {
-            const executionId = parseInt(req.params.id);
-            const db = storage.getDatabase();
-            db.prepare('DELETE FROM phase_executions WHERE methodology_execution_id = ?').run(executionId);
-            const result = db.prepare('DELETE FROM methodology_executions WHERE id = ?').run(executionId);
-            if (result.changes === 0) {
-                res.status(404).json({ error: 'Execution not found' });
-                return;
-            }
-            res.json({ success: true });
-        });
-        // Methodology: list all available methodologies
-        this.app.get('/api/methodologies', (_req, res) => {
-            try {
-                const candidates = [
-                    path.join(__dirname, '../capability/methodologies'),
-                    path.join(__dirname, '../../src/capability/methodologies'),
-                ];
-                const dir = candidates.find(d => fs.existsSync(d));
-                if (!dir) {
-                    res.json([]);
-                    return;
-                }
-                const files = fs.readdirSync(dir).filter(f => f.endsWith('.yaml'));
-                const methodologies = files.map(f => {
-                    const content = fs.readFileSync(path.join(dir, f), 'utf-8');
-                    return yaml.load(content);
-                });
-                res.json(methodologies);
-            }
-            catch (err) {
-                res.status(500).json({ error: err.message });
-            }
-        });
-        // Refusal clustering (Plan A: SQL GROUP BY by taskType × agent)
-        this.app.get('/api/routing/refusals', (req, res) => {
-            const windowHours = parseInt(req.query.window || '168');
-            const since = Date.now() - windowHours * 3600 * 1000;
-            const events = storage.queryRoutingEvents({
-                since_ts: since,
-                obeyed: 0,
-                limit: 1000,
-            });
-            // Group by (taskType, routed_to_name)
-            const groups = new Map();
-            for (const e of events) {
-                let taskType = 'unknown';
-                try {
-                    const parsed = JSON.parse(e.intent_json ?? '{}');
-                    if (typeof parsed.taskType === 'string')
-                        taskType = parsed.taskType;
-                }
-                catch { /* ignore */ }
-                const key = `${taskType}__${e.routed_to_name ?? '—'}`;
-                const g = groups.get(key) ?? {
-                    taskType,
-                    agent: e.routed_to_name ?? '—',
-                    count: 0,
-                    samples: [],
-                };
-                g.count++;
-                if (g.samples.length < 5) {
-                    g.samples.push({
-                        prompt: e.prompt.slice(0, 200),
-                        refusal_reason: e.refusal_reason ?? null,
-                        ts: e.ts,
-                    });
-                }
-                groups.set(key, g);
-            }
-            const sorted = Array.from(groups.values()).sort((a, b) => b.count - a.count);
-            res.json({ windowHours, groups: sorted });
-        });
-        // Routing violations analysis (Phase 3 Feature 3)
-        this.app.get('/api/routing/violations', (req, res) => {
-            const windowHours = parseInt(req.query.window || '168'); // default 7d
-            const since = Date.now() - windowHours * 3600 * 1000;
-            const events = storage.queryRoutingEvents({ since_ts: since, limit: 5000 });
-            // Analyze violation patterns: consecutive refusals for same (taskType, agent)
-            const patterns = new Map();
-            for (const e of events) {
-                if (!e.is_forced || e.obeyed === null)
-                    continue; // only analyze forced routes with judgement
-                let taskType = 'unknown';
-                try {
-                    const parsed = JSON.parse(e.intent_json ?? '{}');
-                    if (typeof parsed.taskType === 'string')
-                        taskType = parsed.taskType;
-                }
-                catch { /* ignore */ }
-                const key = `${taskType}__${e.routed_to_name ?? '—'}`;
-                const p = patterns.get(key) ?? {
-                    taskType,
-                    agent: e.routed_to_name ?? '—',
-                    totalAttempts: 0,
-                    refusals: 0,
-                    refusalRate: 0,
-                    recentRefusals: 0,
-                    severity: 'low',
-                    samples: [],
-                };
-                p.totalAttempts++;
-                if (e.obeyed === 0) {
-                    p.refusals++;
-                    if (p.samples.length < 5) {
-                        p.samples.push({
-                            prompt: e.prompt.slice(0, 200),
-                            refusal_reason: e.refusal_reason ?? null,
-                            ts: e.ts,
-                        });
-                    }
-                }
-                patterns.set(key, p);
-            }
-            // Calculate metrics and severity
-            const violations = Array.from(patterns.values())
-                .map(p => {
-                p.refusalRate = p.totalAttempts === 0 ? 0 : p.refusals / p.totalAttempts;
-                // Calculate recent refusals (last 5 attempts for this pattern)
-                const recentEvents = events
-                    .filter(e => {
-                    let taskType = 'unknown';
-                    try {
-                        const parsed = JSON.parse(e.intent_json ?? '{}');
-                        if (typeof parsed.taskType === 'string')
-                            taskType = parsed.taskType;
-                    }
-                    catch { /* ignore */ }
-                    return taskType === p.taskType && e.routed_to_name === p.agent;
-                })
-                    .slice(0, 5);
-                p.recentRefusals = recentEvents.filter(e => e.obeyed === 0).length;
-                // Determine severity
-                if (p.refusalRate >= 0.8 && p.totalAttempts >= 5)
-                    p.severity = 'critical';
-                else if (p.refusalRate >= 0.6 && p.totalAttempts >= 3)
-                    p.severity = 'high';
-                else if (p.refusalRate >= 0.4)
-                    p.severity = 'medium';
-                else
-                    p.severity = 'low';
-                return p;
-            })
-                .filter(p => p.refusals > 0) // only show patterns with at least 1 refusal
-                .sort((a, b) => {
-                // Sort by severity, then refusal rate
-                const severityOrder = { critical: 4, high: 3, medium: 2, low: 1 };
-                if (severityOrder[a.severity] !== severityOrder[b.severity]) {
-                    return severityOrder[b.severity] - severityOrder[a.severity];
-                }
-                return b.refusalRate - a.refusalRate;
-            });
-            res.json({ windowHours, violations });
-        });
-        // Routing config editor API (Phase 3 Feature 2)
-        this.app.get('/api/routing/config', (_req, res) => {
-            const userPath = path.join(homedir(), '.claude-forge', 'routing.yaml');
-            const defaultPath = path.join(__dirname, 'engine', 'conventions', 'routing.yaml');
-            let content = '';
-            let source = 'none';
-            if (fs.existsSync(userPath)) {
-                content = fs.readFileSync(userPath, 'utf-8');
-                source = 'user';
-            }
-            else if (fs.existsSync(defaultPath)) {
-                content = fs.readFileSync(defaultPath, 'utf-8');
-                source = 'default';
-            }
-            res.json({ content, source, userPath, defaultPath });
-        });
-        this.app.put('/api/routing/config', (req, res) => {
-            const { content } = req.body;
-            if (typeof content !== 'string') {
-                res.status(400).json({ error: 'content must be a string' });
-                return;
-            }
-            const userPath = path.join(homedir(), '.claude-forge', 'routing.yaml');
-            const dir = path.dirname(userPath);
-            try {
-                // Validate YAML syntax before saving
-                yaml.load(content);
-                // Ensure directory exists
-                if (!fs.existsSync(dir)) {
-                    fs.mkdirSync(dir, { recursive: true });
-                }
-                // Write to user override path
-                fs.writeFileSync(userPath, content, 'utf-8');
-                logger.info(`[Web] Routing config updated: ${userPath}`);
-                res.json({ success: true, path: userPath });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to save routing config: ${err}`);
-                res.status(400).json({ error: String(err) });
-            }
-        });
-        // ── Phase 5: A/B Testing APIs ────────────────────────────────────────
-        const experimentsPath = path.join(homedir(), '.claude-forge', 'routing-experiments.yaml');
-        this.app.get('/api/routing/experiments/config', (_req, res) => {
-            let content = '';
-            let source = 'none';
-            if (fs.existsSync(experimentsPath)) {
-                content = fs.readFileSync(experimentsPath, 'utf-8');
-                source = 'user';
-            }
-            res.json({ content, source, path: experimentsPath });
-        });
-        this.app.put('/api/routing/experiments/config', async (req, res) => {
-            const { content } = req.body;
-            if (typeof content !== 'string') {
-                res.status(400).json({ error: 'content must be a string' });
-                return;
-            }
-            try {
-                const parsed = yaml.load(content, { schema: yaml.CORE_SCHEMA });
-                // Reuse validateConfig for structural enforcement (weights, groups, etc.).
-                const { validateConfig } = await import('../engine/experiment-router.js');
-                const cfg = validateConfig(parsed);
-                if (!cfg) {
-                    res.status(400).json({ error: 'experiments YAML failed validation (see daemon logs)' });
-                    return;
-                }
-                const dir = path.dirname(experimentsPath);
-                if (!fs.existsSync(dir))
-                    fs.mkdirSync(dir, { recursive: true });
-                fs.writeFileSync(experimentsPath, content, 'utf-8');
-                logger.info(`[Web] Experiments config updated: ${experimentsPath}`);
-                res.json({ success: true, path: experimentsPath });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to save experiments config: ${err}`);
-                res.status(400).json({ error: String(err) });
-            }
-        });
-        this.app.get('/api/routing/experiments/analysis', async (_req, res) => {
-            try {
-                if (!fs.existsSync(experimentsPath)) {
-                    res.json({ enabled: false, experimentId: null, groups: [] });
-                    return;
-                }
-                const raw = fs.readFileSync(experimentsPath, 'utf-8');
-                const parsed = yaml.load(raw, { schema: yaml.CORE_SCHEMA });
-                const { validateConfig } = await import('../engine/experiment-router.js');
-                const cfg = validateConfig(parsed);
-                if (!cfg || !cfg.experiment) {
-                    res.json({ enabled: cfg?.enabled ?? false, experimentId: null, groups: [] });
-                    return;
-                }
-                const stats = storage.queryExperimentStats(cfg.experiment.id);
-                const groups = cfg.experiment.groups.map(g => {
-                    const s = stats.find(row => row.group_id === g.id);
-                    const total = s?.total ?? 0;
-                    const obeyed = s?.obeyed ?? 0;
-                    const refused = s?.refused ?? 0;
-                    return {
-                        id: g.id,
-                        name: g.name,
-                        weight: g.weight,
-                        total,
-                        obeyed,
-                        refused,
-                        unknown: s?.unknown ?? 0,
-                        obeyedRate: total > 0 ? obeyed / total : null,
-                        avgClassificationMs: s?.avg_classification_ms ?? null,
-                    };
-                });
-                // Simple z-test between the two groups with the largest samples.
-                let zScore = null;
-                let sampleAdequate = false;
-                let suggestedWinner = null;
-                if (groups.length >= 2) {
-                    const sorted = [...groups].sort((a, b) => b.total - a.total).slice(0, 2);
-                    const [g1, g2] = sorted;
-                    sampleAdequate = g1.total >= 50 && g2.total >= 50;
-                    if (sampleAdequate) {
-                        const p1 = g1.obeyed / g1.total;
-                        const p2 = g2.obeyed / g2.total;
-                        const pPool = (g1.obeyed + g2.obeyed) / (g1.total + g2.total);
-                        const se = Math.sqrt(pPool * (1 - pPool) * (1 / g1.total + 1 / g2.total));
-                        zScore = se > 0 ? (p1 - p2) / se : 0;
-                        if (Math.abs(zScore) > 1.96) {
-                            suggestedWinner = p1 > p2 ? g1.id : g2.id;
-                        }
-                    }
-                }
-                res.json({
-                    enabled: cfg.enabled,
-                    experimentId: cfg.experiment.id,
-                    experimentName: cfg.experiment.name,
-                    startedAt: cfg.experiment.startedAt,
-                    endedAt: cfg.experiment.endedAt,
-                    groups,
-                    zScore,
-                    sampleAdequate,
-                    suggestedWinner,
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Experiments analysis failed: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        this.app.post('/api/routing/experiments/promote', async (req, res) => {
-            const { groupId } = req.body;
-            if (typeof groupId !== 'string' || groupId.length === 0) {
-                res.status(400).json({ error: 'groupId is required' });
-                return;
-            }
-            try {
-                if (!fs.existsSync(experimentsPath)) {
-                    res.status(400).json({ error: 'experiments config does not exist' });
-                    return;
-                }
-                const raw = fs.readFileSync(experimentsPath, 'utf-8');
-                const parsed = yaml.load(raw, { schema: yaml.CORE_SCHEMA });
-                const { validateConfig } = await import('../engine/experiment-router.js');
-                const cfg = validateConfig(parsed);
-                if (!cfg || !cfg.experiment) {
-                    res.status(400).json({ error: 'experiments config has no active experiment' });
-                    return;
-                }
-                const group = cfg.experiment.groups.find(g => g.id === groupId);
-                if (!group) {
-                    res.status(404).json({ error: `group '${groupId}' not found` });
-                    return;
-                }
-                // Step 1: backup existing routing.yaml if present
-                const routingPath = path.join(homedir(), '.claude-forge', 'routing.yaml');
-                const ts = new Date().toISOString().replace(/[:.]/g, '-');
-                let backupPath = null;
-                if (fs.existsSync(routingPath)) {
-                    backupPath = `${routingPath}.bak-${ts}`;
-                    fs.copyFileSync(routingPath, backupPath);
-                }
-                else {
-                    const dir = path.dirname(routingPath);
-                    if (!fs.existsSync(dir))
-                        fs.mkdirSync(dir, { recursive: true });
-                }
-                // Step 2: write the winner's rules as the new routing.yaml
-                const newRouting = yaml.dump({ schemaVersion: '1.0', rules: group.rules });
-                fs.writeFileSync(routingPath, newRouting, 'utf-8');
-                // Step 3: mark experiment as ended (enabled=false, endedAt=now)
-                const endedAt = new Date().toISOString();
-                const updated = yaml.dump({
-                    schemaVersion: '1.0',
-                    enabled: false,
-                    experiment: {
-                        ...cfg.experiment,
-                        endedAt,
-                    },
-                });
-                fs.writeFileSync(experimentsPath, updated, 'utf-8');
-                logger.info(`[Web] Promoted group '${groupId}' from experiment '${cfg.experiment.id}'; backup: ${backupPath}`);
-                res.json({ promoted: groupId, routingPath, backupPath, endedAt });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to promote experiment group: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // ── Phase 5 Feature 2: Rule States (auto-disable) ────────────────────
-        this.app.get('/api/routing/rule-states', (req, res) => {
-            const disabledOnly = req.query.disabled === '1' || req.query.disabled === 'true';
-            const rows = storage.listRuleStates({ disabledOnly });
-            res.json({ ruleStates: rows });
-        });
-        this.app.put('/api/routing/rule-states', (req, res) => {
-            const { taskType, agent, disabled, reason } = req.body ?? {};
-            if (typeof taskType !== 'string' || taskType.length === 0) {
-                res.status(400).json({ error: 'taskType is required' });
-                return;
-            }
-            if (typeof agent !== 'string' || agent.length === 0) {
-                res.status(400).json({ error: 'agent is required' });
-                return;
-            }
-            if (typeof disabled !== 'boolean') {
-                res.status(400).json({ error: 'disabled must be boolean' });
-                return;
-            }
-            try {
-                storage.setRuleState({
-                    taskType,
-                    agent,
-                    disabled,
-                    reason: typeof reason === 'string' ? reason : null,
-                    autoDisabled: false, // manual toggle
-                });
-                logger.info(`[Web] Rule state updated: ${taskType}__${agent} disabled=${disabled}`);
-                res.json({ success: true });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to set rule state: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // ── Phase 5 Feature 3: Rule Recommendations ──────────────────────────
-        this.app.get('/api/routing/recommendations', (req, res) => {
-            const { router, agents } = this.options;
-            if (!router || !agents) {
-                res.json({ recommendations: [], reason: 'router/agents not injected' });
-                return;
-            }
-            const windowDays = Math.max(1, Math.min(90, parseInt(req.query.days || '7')));
-            try {
-                const recommender = new Recommender(storage, router, agents, {
-                    windowMs: windowDays * 24 * 3600 * 1000,
-                });
-                const recommendations = recommender.analyze();
-                res.json({ windowDays, recommendations });
-            }
-            catch (err) {
-                logger.warn(`[Web] Recommender failed: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // AI-assisted optimization recommendations
-        this.app.get('/api/routing/ai-optimization', async (req, res) => {
-            const { router, agents } = this.options;
-            if (!router || !agents) {
-                res.status(400).json({ error: 'router/agents not injected' });
-                return;
-            }
-            const windowHours = Math.max(1, Math.min(720, parseInt(req.query.window || '168')));
-            const minAttempts = Math.max(1, parseInt(req.query.minAttempts || '10'));
-            const since = Date.now() - windowHours * 3600 * 1000;
-            try {
-                const config = new ConfigManager().get();
-                const apiKey = config.distill.api_key || process.env.ANTHROPIC_API_KEY || '';
-                if (!apiKey) {
-                    res.status(400).json({ error: 'AI API key not configured' });
-                    return;
-                }
-                const ai = new ClaudeProvider(apiKey, config.distill.model, config.distill.base_url);
-                const recommender = new Recommender(storage, router, agents, { windowMs: windowHours * 3600 * 1000 });
-                const ruleRecommendations = recommender.analyze();
-                const performanceRes = await (async () => {
-                    const events = storage.queryRoutingEvents({ since_ts: since, limit: 5000 });
-                    const relevant = events.filter(e => e.routed_to_name);
-                    const judged = relevant.filter(e => e.obeyed === 0 || e.obeyed === 1);
-                    const byAgent = new Map();
-                    for (const e of relevant) {
-                        const key = e.routed_to_name ?? '—';
-                        const bucket = byAgent.get(key) ?? { total: 0, judged: 0, obeyed: 0, refused: 0, latencySum: 0, latencyCount: 0 };
-                        bucket.total++;
-                        if (e.obeyed === 1) {
-                            bucket.judged++;
-                            bucket.obeyed++;
-                        }
-                        else if (e.obeyed === 0) {
-                            bucket.judged++;
-                            bucket.refused++;
-                        }
-                        if (typeof e.classification_ms === 'number') {
-                            bucket.latencySum += e.classification_ms;
-                            bucket.latencyCount++;
-                        }
-                        byAgent.set(key, bucket);
-                    }
-                    return {
-                        totalRouted: relevant.length,
-                        totalJudged: judged.length,
-                        byAgent: Array.from(byAgent.entries()).map(([agent, b]) => ({
-                            agent,
-                            total: b.total,
-                            judged: b.judged,
-                            obeyed: b.obeyed,
-                            refused: b.refused,
-                            refusalRate: b.judged === 0 ? null : b.refused / b.judged,
-                            avgClassificationMs: b.latencyCount === 0 ? null : Math.round(b.latencySum / b.latencyCount),
-                        })).sort((a, b) => (b.refusalRate ?? 0) - (a.refusalRate ?? 0)),
-                    };
-                })();
-                const highRefusalAgents = performanceRes.byAgent
-                    .filter(a => a.judged >= minAttempts && (a.refusalRate ?? 0) > 0)
-                    .slice(0, 10);
-                const topViolations = (await (async () => {
-                    const events = storage.queryRoutingEvents({ since_ts: since, obeyed: 0, limit: 1000 });
-                    const patterns = new Map();
-                    for (const e of events) {
-                        let taskType = 'unknown';
-                        try {
-                            const parsed = JSON.parse(e.intent_json ?? '{}');
-                            if (typeof parsed.taskType === 'string')
-                                taskType = parsed.taskType;
-                        }
-                        catch { /* ignore */ }
-                        const key = `${taskType}__${e.routed_to_name ?? '—'}`;
-                        const p = patterns.get(key) ?? { taskType, agent: e.routed_to_name ?? '—', total: 0, refusals: 0, refusalRate: 0, samples: [] };
-                        p.total++;
-                        p.refusals++;
-                        if (p.samples.length < 3)
-                            p.samples.push(e.prompt.slice(0, 180));
-                        patterns.set(key, p);
-                    }
-                    return Array.from(patterns.values()).map(p => ({
-                        ...p,
-                        refusalRate: p.total === 0 ? 0 : p.refusals / p.total,
-                    })).sort((a, b) => b.refusalRate - a.refusalRate).slice(0, 5);
-                })());
-                const prompt = [
-                    'You are reviewing Claude Forge routing performance and should produce practical improvement suggestions.',
-                    'Return ONLY valid JSON with keys: summary, priorities, suggestedChanges.',
-                    '',
-                    'Context:',
-                    `- windowHours: ${windowHours}`,
-                    `- minAttempts: ${minAttempts}`,
-                    `- totalRouted: ${performanceRes.totalRouted}`,
-                    `- totalJudged: ${performanceRes.totalJudged}`,
-                    '',
-                    'Performance by agent:',
-                    JSON.stringify(highRefusalAgents, null, 2),
-                    '',
-                    'Top refusal patterns:',
-                    JSON.stringify(topViolations, null, 2),
-                    '',
-                    'Routing rule recommendations:',
-                    JSON.stringify(ruleRecommendations.slice(0, 8), null, 2),
-                    '',
-                    'Please provide:',
-                    '- summary: 2-3 sentences summarizing the main issues',
-                    '- priorities: array of { area, finding, impact, confidence }',
-                    '- suggestedChanges: array of { targetType: agent|skill|routing_rule, targetName, recommendation, rationale, expectedBenefit }',
-                ].join('\n');
-                const raw = await ai.complete(prompt, { maxTokens: 2500 });
-                const cleaned = raw.replace(/```json\s*/g, '').replace(/```\s*/g, '');
-                const match = cleaned.match(/\{[\s\S]*\}/);
-                if (!match) {
-                    res.status(500).json({ error: 'AI did not return JSON', raw });
-                    return;
-                }
-                const parsed = JSON.parse(match[0]);
-                res.json({
-                    windowHours,
-                    minAttempts,
-                    generatedAt: new Date().toISOString(),
-                    summary: parsed.summary ?? '',
-                    priorities: Array.isArray(parsed.priorities) ? parsed.priorities : [],
-                    suggestedChanges: Array.isArray(parsed.suggestedChanges) ? parsed.suggestedChanges : [],
-                    evidence: {
-                        highRefusalAgents,
-                        topViolations,
-                        ruleRecommendations: ruleRecommendations.slice(0, 8),
-                    },
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to generate AI optimization: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // ── Patch APIs ────────────────────────────────────────────────────────
-        // POST /api/patch/preview — generate structured patch preview
-        this.app.post('/api/patch/preview', async (req, res) => {
-            const { targetType, targetName, recommendation, rationale } = req.body ?? {};
-            if (!targetType || !targetName || !recommendation) {
-                res.status(400).json({ error: 'targetType, targetName, and recommendation are required' });
-                return;
-            }
-            try {
-                const config = new ConfigManager().get();
-                const apiKey = config.distill.api_key || process.env.ANTHROPIC_API_KEY || '';
-                if (!apiKey) {
-                    res.status(400).json({ error: 'AI API key not configured' });
-                    return;
-                }
-                const { filePath } = resolvePatchTarget(targetType, targetName);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: `Target file not found: ${filePath}` });
-                    return;
-                }
-                const currentContent = fs.readFileSync(filePath, 'utf-8');
-                const ai = new ClaudeProvider(apiKey, config.distill.model, config.distill.base_url);
-                const prompt = `You are a code/config optimization assistant. Given the current file content and a recommended change, generate the updated content.
-
-Current file (${targetType}/${targetName}):
-\`\`\`
-${currentContent}
-\`\`\`
-
-Recommendation: ${recommendation}
-${rationale ? `Rationale: ${rationale}` : ''}
-
-Return ONLY a JSON object with this exact structure (no markdown, no explanation):
-{
-  "summary": "brief description of what changed",
-  "afterContent": "the complete updated file content",
-  "risk": "low|medium|high"
-}`;
-                const response = await ai.complete(prompt, { maxTokens: 4096 });
-                const parsed = JSON.parse(response.trim());
-                res.json({
-                    targetType,
-                    targetName,
-                    filePath,
-                    before: currentContent,
-                    after: parsed.afterContent,
-                    summary: parsed.summary,
-                    risk: parsed.risk || 'medium',
-                    recommendation,
-                    rationale: rationale || null,
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Patch preview failed: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // POST /api/patch/apply — apply patch with backup
-        this.app.post('/api/patch/apply', (req, res) => {
-            const { targetType, targetName, afterContent } = req.body ?? {};
-            if (!targetType || !targetName || typeof afterContent !== 'string') {
-                res.status(400).json({ error: 'targetType, targetName, and afterContent are required' });
-                return;
-            }
-            try {
-                const { filePath, backupDir } = resolvePatchTarget(targetType, targetName);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: `Target file not found: ${filePath}` });
-                    return;
-                }
-                // Create backup
-                if (!fs.existsSync(backupDir)) {
-                    fs.mkdirSync(backupDir, { recursive: true });
-                }
-                const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-                const backupName = `${targetName}_${timestamp}${path.extname(filePath)}`;
-                const backupPath = path.join(backupDir, backupName);
-                fs.copyFileSync(filePath, backupPath);
-                // Apply patch
-                fs.writeFileSync(filePath, afterContent, 'utf-8');
-                logger.info(`[Web] Patch applied to ${targetType}/${targetName}, backup: ${backupPath}`);
-                res.json({
-                    success: true,
-                    targetType,
-                    targetName,
-                    filePath,
-                    backupPath,
-                    timestamp,
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Patch apply failed: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // ── AI Configuration APIs ─────────────────────────────────────────────
-        // GET /api/config/ai — read current AI config (mask apiKey)
-        this.app.get('/api/config/ai', (_req, res) => {
-            const configManager = new ConfigManager();
-            const config = configManager.get();
-            const maskApiKey = (key) => {
-                if (!key || key.length < 10)
-                    return '***';
-                return key.slice(0, 6) + '***' + key.slice(-4);
-            };
-            res.json({
-                api_key: maskApiKey(config.distill.api_key),
-                base_url: config.distill.base_url || '',
-                model: config.distill.model,
-                provider: config.distill.provider,
-                classifier_model: config.distill.classifier_model || '',
-                classifier_timeout: config.distill.classifier_timeout || 10000,
-            });
-        });
-        // PUT /api/config/ai — update AI config
-        this.app.put('/api/config/ai', (req, res) => {
-            const { api_key, base_url, model, provider, classifier_model, classifier_timeout } = req.body ?? {};
-            try {
-                const configManager = new ConfigManager();
-                const config = configManager.get();
-                // Update only provided fields
-                if (typeof api_key === 'string')
-                    config.distill.api_key = api_key;
-                if (typeof base_url === 'string') {
-                    // Normalize http → https for upstream gateways that force HTTPS redirect
-                    // (e.g. iflytek one.iflytek.com returns 302 and drops Authorization header)
-                    let url = base_url.trim();
-                    if (url.startsWith('http://'))
-                        url = 'https://' + url.slice('http://'.length);
-                    config.distill.base_url = url;
-                }
-                if (typeof model === 'string')
-                    config.distill.model = model;
-                if (typeof provider === 'string')
-                    config.distill.provider = provider;
-                if (typeof classifier_model === 'string')
-                    config.distill.classifier_model = classifier_model || undefined;
-                if (typeof classifier_timeout === 'number')
-                    config.distill.classifier_timeout = classifier_timeout;
-                configManager.save();
-                logger.info('[Web] AI config updated');
-                res.json({ success: true });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to update AI config: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/ai/models — proxy to upstream /v1/models
-        // Supports ?api_key= and ?base_url= to test unsaved config; falls back to config.yaml.
-        this.app.get('/api/ai/models', async (req, res) => {
-            try {
-                const configManager = new ConfigManager();
-                const config = configManager.get();
-                const queryKey = typeof req.query.api_key === 'string' ? req.query.api_key : '';
-                const queryUrl = typeof req.query.base_url === 'string' ? req.query.base_url : '';
-                const apiKey = queryKey || config.distill.api_key;
-                let baseUrl = queryUrl || config.distill.base_url || 'https://api.anthropic.com';
-                // Upstream gateways that force HTTPS drop headers on 302 — normalize proactively.
-                if (baseUrl.startsWith('http://'))
-                    baseUrl = 'https://' + baseUrl.slice('http://'.length);
-                if (!apiKey) {
-                    res.status(400).json({ error: 'API key not configured' });
-                    return;
-                }
-                // Construct models endpoint URL
-                const modelsUrl = baseUrl.endsWith('/v1')
-                    ? `${baseUrl}/models`
-                    : `${baseUrl}/v1/models`;
-                const response = await fetch(modelsUrl, {
-                    redirect: 'follow',
-                    headers: {
-                        'Authorization': `Bearer ${apiKey}`,
-                        'x-api-key': apiKey,
-                    },
-                });
-                if (!response.ok) {
-                    const text = await response.text();
-                    logger.warn(`[Web] Upstream /v1/models failed: ${response.status} ${text}`);
-                    res.status(response.status).json({ error: text });
-                    return;
-                }
-                const data = await response.json();
-                res.json(data);
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to fetch models: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // POST /api/ai/test — test AI connection using provided or saved config
-        this.app.post('/api/ai/test', async (req, res) => {
-            try {
-                const configManager = new ConfigManager();
-                const config = configManager.get();
-                const { api_key, base_url, model } = req.body ?? {};
-                const apiKey = (typeof api_key === 'string' && api_key) || config.distill.api_key;
-                let baseUrl = (typeof base_url === 'string' && base_url) || config.distill.base_url || 'https://api.anthropic.com';
-                const useModel = (typeof model === 'string' && model) || config.distill.model;
-                // Normalize http → https
-                if (baseUrl.startsWith('http://'))
-                    baseUrl = 'https://' + baseUrl.slice('http://'.length);
-                if (!apiKey) {
-                    res.status(400).json({ error: 'API key not configured' });
-                    return;
-                }
-                const messagesUrl = baseUrl.endsWith('/v1')
-                    ? `${baseUrl}/messages`
-                    : `${baseUrl}/v1/messages`;
-                const response = await fetch(messagesUrl, {
-                    method: 'POST',
-                    redirect: 'follow',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        'x-api-key': apiKey,
-                        'anthropic-version': '2023-06-01',
-                    },
-                    body: JSON.stringify({
-                        model: useModel,
-                        max_tokens: 10,
-                        messages: [{ role: 'user', content: 'ping' }],
-                    }),
-                });
-                if (!response.ok) {
-                    const text = await response.text();
-                    res.status(response.status).json({ error: text });
-                    return;
-                }
-                const data = await response.json();
-                res.json({ success: true, model: data.model || useModel });
-            }
-            catch (err) {
-                logger.warn(`[Web] AI connection test failed: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // ── Agent & Skill Management APIs ────────────────────────────────────────
-        // GET /api/agents — list all agents (official + user)
-        this.app.get('/api/agents', (_req, res) => {
-            try {
-                const agentsDir = path.join(homedir(), '.claude', 'agents');
-                const official = this.agents?.getAll() || [];
-                const userAgents = [];
-                if (fs.existsSync(agentsDir)) {
-                    const files = fs.readdirSync(agentsDir).filter(f => f.endsWith('.md'));
-                    for (const file of files) {
-                        const name = file.replace('.md', '');
-                        if (official.some((a) => a.name === name))
-                            continue; // Skip official agents
-                        const content = fs.readFileSync(path.join(agentsDir, file), 'utf-8');
-                        const match = content.match(/^---\n([\s\S]*?)\n---/);
-                        if (match) {
-                            const fm = match[1];
-                            const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
-                            const verMatch = fm.match(/version:\s*["']?([^"'\n]+)["']?/);
-                            userAgents.push({
-                                name,
-                                description: descMatch?.[1] || '',
-                                version: verMatch?.[1],
-                            });
-                        }
-                    }
-                }
-                res.json({ official, user: userAgents });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to list agents: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/agents/:name — get agent details
-        this.app.get('/api/agents/:name', (req, res) => {
-            try {
-                const { name } = req.params;
-                const agentsDir = path.join(homedir(), '.claude', 'agents');
-                const filePath = path.join(agentsDir, `${name}.md`);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: 'Agent not found' });
-                    return;
-                }
-                const content = fs.readFileSync(filePath, 'utf-8');
-                const match = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
-                if (!match) {
-                    res.json({ name, content });
-                    return;
-                }
-                const fm = match[1];
-                const body = match[2];
-                const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
-                const verMatch = fm.match(/version:\s*["']?([^"'\n]+)["']?/);
-                const toolsMatch = fm.match(/tools:\s*(.+)/);
-                res.json({
-                    name,
-                    description: descMatch?.[1] || '',
-                    version: verMatch?.[1],
-                    tools: toolsMatch?.[1],
-                    content,
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to get agent ${req.params.name}: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // PUT /api/agents/:name — update agent content
-        this.app.put('/api/agents/:name', (req, res) => {
-            try {
-                const { name } = req.params;
-                const { content } = req.body;
-                if (!content || typeof content !== 'string') {
-                    res.status(400).json({ error: 'Missing content' });
-                    return;
-                }
-                const agentsDir = path.join(homedir(), '.claude', 'agents');
-                const filePath = path.join(agentsDir, `${name}.md`);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: 'Agent not found' });
-                    return;
-                }
-                // Backup before editing
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'agents');
-                fs.mkdirSync(backupDir, { recursive: true });
-                const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-                const backupPath = path.join(backupDir, `${name}-${timestamp}.md`);
-                fs.copyFileSync(filePath, backupPath);
-                // Write new content
-                fs.writeFileSync(filePath, content, 'utf-8');
-                logger.info(`[Web] Updated agent ${name} (backup: ${backupPath})`);
-                res.json({ success: true, backup: backupPath });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to update agent ${req.params.name}: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/skills — list all skills (official + user)
-        this.app.get('/api/skills', (_req, res) => {
-            try {
-                const skillsDir = path.join(homedir(), '.claude', 'skills');
-                const skills = [];
-                if (fs.existsSync(skillsDir)) {
-                    const files = fs.readdirSync(skillsDir).filter(f => f.endsWith('.md'));
-                    for (const file of files) {
-                        const name = file.replace('.md', '');
-                        const content = fs.readFileSync(path.join(skillsDir, file), 'utf-8');
-                        const match = content.match(/^---\n([\s\S]*?)\n---/);
-                        if (match) {
-                            const fm = match[1];
-                            const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
-                            const verMatch = fm.match(/version:\s*["']?([^"'\n]+)["']?/);
-                            const sourceMatch = fm.match(/source:\s*["']?([^"'\n]+)["']?/);
-                            skills.push({
-                                name,
-                                description: descMatch?.[1] || '',
-                                version: verMatch?.[1],
-                                source: sourceMatch?.[1] || 'user',
-                            });
-                        }
-                    }
-                }
-                res.json({ skills });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to list skills: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/skills/:name — get skill details
-        this.app.get('/api/skills/:name', (req, res) => {
-            try {
-                const { name } = req.params;
-                const skillsDir = path.join(homedir(), '.claude', 'skills');
-                const filePath = path.join(skillsDir, `${name}.md`);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: 'Skill not found' });
-                    return;
-                }
-                const content = fs.readFileSync(filePath, 'utf-8');
-                const match = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
-                if (!match) {
-                    res.json({ name, content });
-                    return;
-                }
-                const fm = match[1];
-                const body = match[2];
-                const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
-                const verMatch = fm.match(/version:\s*["']?([^"'\n]+)["']?/);
-                const sourceMatch = fm.match(/source:\s*["']?([^"'\n]+)["']?/);
-                res.json({
-                    name,
-                    description: descMatch?.[1] || '',
-                    version: verMatch?.[1],
-                    source: sourceMatch?.[1] || 'user',
-                    content,
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to get skill ${req.params.name}: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // PUT /api/skills/:name — update skill content
-        this.app.put('/api/skills/:name', (req, res) => {
-            try {
-                const { name } = req.params;
-                const { content } = req.body;
-                if (!content || typeof content !== 'string') {
-                    res.status(400).json({ error: 'Missing content' });
-                    return;
-                }
-                const skillsDir = path.join(homedir(), '.claude', 'skills');
-                const filePath = path.join(skillsDir, `${name}.md`);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: 'Skill not found' });
-                    return;
-                }
-                // Backup before editing
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
-                fs.mkdirSync(backupDir, { recursive: true });
-                const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-                const backupPath = path.join(backupDir, `${name}-${timestamp}.md`);
-                fs.copyFileSync(filePath, backupPath);
-                // Write new content
-                fs.writeFileSync(filePath, content, 'utf-8');
-                logger.info(`[Web] Updated skill ${name} (backup: ${backupPath})`);
-                res.json({ success: true, backup: backupPath });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to update skill ${req.params.name}: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // ── Version Management APIs ────────────────────────────────────────────────
-        // GET /api/agents/:name/versions — list backup versions
-        this.app.get('/api/agents/:name/versions', (req, res) => {
-            try {
-                const { name } = req.params;
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'agents');
-                if (!fs.existsSync(backupDir)) {
-                    res.json({ versions: [] });
-                    return;
-                }
-                const files = fs.readdirSync(backupDir)
-                    .filter(f => f.startsWith(`${name}-`) && f.endsWith('.md'))
-                    .map(f => {
-                    const filePath = path.join(backupDir, f);
-                    const stats = fs.statSync(filePath);
-                    const timestampMatch = f.match(/-(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)\.md$/);
-                    return {
-                        filename: f,
-                        timestamp: timestampMatch ? timestampMatch[1].replace(/-/g, ':').replace(/T(\d{2}):(\d{2}):(\d{2})/, 'T$1:$2:$3') : '',
-                        size: stats.size,
-                        mtime: stats.mtime.toISOString(),
-                    };
-                })
-                    .sort((a, b) => new Date(b.mtime).getTime() - new Date(a.mtime).getTime());
-                res.json({ versions: files });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to list agent versions: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/agents/:name/versions/:timestamp — get specific version content
-        this.app.get('/api/agents/:name/versions/:timestamp', (req, res) => {
-            try {
-                const { name, timestamp } = req.params;
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'agents');
-                const filename = `${name}-${timestamp}.md`;
-                const filePath = path.join(backupDir, filename);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: 'Version not found' });
-                    return;
-                }
-                const content = fs.readFileSync(filePath, 'utf-8');
-                res.json({ content });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to get agent version: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // POST /api/agents/:name/rollback — rollback to a specific version
-        this.app.post('/api/agents/:name/rollback', (req, res) => {
-            try {
-                const { name } = req.params;
-                const { timestamp } = req.body;
-                if (!timestamp) {
-                    res.status(400).json({ error: 'Missing timestamp' });
-                    return;
-                }
-                const agentsDir = path.join(homedir(), '.claude', 'agents');
-                const currentPath = path.join(agentsDir, `${name}.md`);
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'agents');
-                const versionPath = path.join(backupDir, `${name}-${timestamp}.md`);
-                if (!fs.existsSync(currentPath)) {
-                    res.status(404).json({ error: 'Agent not found' });
-                    return;
-                }
-                if (!fs.existsSync(versionPath)) {
-                    res.status(404).json({ error: 'Version not found' });
-                    return;
-                }
-                // Backup current version before rollback
-                fs.mkdirSync(backupDir, { recursive: true });
-                const rollbackTimestamp = new Date().toISOString().replace(/[:.]/g, '-');
-                const rollbackBackupPath = path.join(backupDir, `${name}-${rollbackTimestamp}.md`);
-                fs.copyFileSync(currentPath, rollbackBackupPath);
-                // Restore version
-                const versionContent = fs.readFileSync(versionPath, 'utf-8');
-                fs.writeFileSync(currentPath, versionContent, 'utf-8');
-                logger.info(`[Web] Rolled back agent ${name} to ${timestamp} (backup: ${rollbackBackupPath})`);
-                res.json({ success: true, backup: rollbackBackupPath });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to rollback agent: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/skills/:name/versions — list backup versions
-        this.app.get('/api/skills/:name/versions', (req, res) => {
-            try {
-                const { name } = req.params;
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
-                if (!fs.existsSync(backupDir)) {
-                    res.json({ versions: [] });
-                    return;
-                }
-                const files = fs.readdirSync(backupDir)
-                    .filter(f => f.startsWith(`${name}-`) && f.endsWith('.md'))
-                    .map(f => {
-                    const filePath = path.join(backupDir, f);
-                    const stats = fs.statSync(filePath);
-                    const timestampMatch = f.match(/-(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)\.md$/);
-                    return {
-                        filename: f,
-                        timestamp: timestampMatch ? timestampMatch[1].replace(/-/g, ':').replace(/T(\d{2}):(\d{2}):(\d{2})/, 'T$1:$2:$3') : '',
-                        size: stats.size,
-                        mtime: stats.mtime.toISOString(),
-                    };
-                })
-                    .sort((a, b) => new Date(b.mtime).getTime() - new Date(a.mtime).getTime());
-                res.json({ versions: files });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to list skill versions: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/skills/:name/versions/:timestamp — get specific version content
-        this.app.get('/api/skills/:name/versions/:timestamp', (req, res) => {
-            try {
-                const { name, timestamp } = req.params;
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
-                const filename = `${name}-${timestamp}.md`;
-                const filePath = path.join(backupDir, filename);
-                if (!fs.existsSync(filePath)) {
-                    res.status(404).json({ error: 'Version not found' });
-                    return;
-                }
-                const content = fs.readFileSync(filePath, 'utf-8');
-                res.json({ content });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to get skill version: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // POST /api/skills/:name/rollback — rollback to a specific version
-        this.app.post('/api/skills/:name/rollback', (req, res) => {
-            try {
-                const { name } = req.params;
-                const { timestamp } = req.body;
-                if (!timestamp) {
-                    res.status(400).json({ error: 'Missing timestamp' });
-                    return;
-                }
-                const skillsDir = path.join(homedir(), '.claude', 'skills');
-                const currentPath = path.join(skillsDir, `${name}.md`);
-                const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
-                const versionPath = path.join(backupDir, `${name}-${timestamp}.md`);
-                if (!fs.existsSync(currentPath)) {
-                    res.status(404).json({ error: 'Skill not found' });
-                    return;
-                }
-                if (!fs.existsSync(versionPath)) {
-                    res.status(404).json({ error: 'Version not found' });
-                    return;
-                }
-                // Backup current version before rollback
-                fs.mkdirSync(backupDir, { recursive: true });
-                const rollbackTimestamp = new Date().toISOString().replace(/[:.]/g, '-');
-                const rollbackBackupPath = path.join(backupDir, `${name}-${rollbackTimestamp}.md`);
-                fs.copyFileSync(currentPath, rollbackBackupPath);
-                // Restore version
-                const versionContent = fs.readFileSync(versionPath, 'utf-8');
-                fs.writeFileSync(currentPath, versionContent, 'utf-8');
-                logger.info(`[Web] Rolled back skill ${name} to ${timestamp} (backup: ${rollbackBackupPath})`);
-                res.json({ success: true, backup: rollbackBackupPath });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to rollback skill: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // ── Execution Trace APIs ──────────────────────────────────────────────────
-        // GET /api/execution-trace — list execution traces with routing info
-        this.app.get('/api/execution-trace', (req, res) => {
-            try {
-                const limit = parseInt(req.query.limit) || 50;
-                const agentFilter = req.query.agent;
-                const obeyedFilter = req.query.obeyed;
-                const db = storage.getDatabase();
-                let sql = `
-          SELECT
-            re.id,
-            re.session_id,
-            re.route_request_id,
-            re.project_path,
-            re.ts,
-            re.prompt,
-            re.intent_json,
-            re.routed_to_type,
-            re.routed_to_name,
-            re.obeyed,
-            re.classification_ms,
-            re.fallback_used,
-            re.first_tool_name,
-            re.first_tool_ts,
-            re.completed_ts,
-            re.total_execution_ms,
-            re.completion_reason,
-            re.downstream_task_chain,
-            s.status as session_status,
-            s.start_time,
-            s.end_time,
-            s.event_count
-          FROM routing_events re
-          LEFT JOIN sessions s ON re.session_id = s.session_id
-          WHERE 1=1
-        `;
-                const params = [];
-                if (agentFilter) {
-                    sql += ` AND re.routed_to_name = ?`;
-                    params.push(agentFilter);
-                }
-                if (obeyedFilter === 'true') {
-                    sql += ` AND re.obeyed = 1`;
-                }
-                else if (obeyedFilter === 'false') {
-                    sql += ` AND re.obeyed = 0`;
-                }
-                sql += ` ORDER BY re.ts DESC LIMIT ?`;
-                params.push(limit);
-                const rows = db.prepare(sql).all(...params);
-                const traces = rows.map(row => ({
-                    id: row.id,
-                    sessionId: row.session_id,
-                    routeRequestId: row.route_request_id,
-                    projectPath: row.project_path,
-                    timestamp: row.ts,
-                    prompt: row.prompt,
-                    intent: JSON.parse(row.intent_json || '{}'),
-                    routedToType: row.routed_to_type,
-                    routedToName: row.routed_to_name,
-                    obeyed: row.obeyed,
-                    classificationMs: row.classification_ms,
-                    fallbackUsed: row.fallback_used === 1,
-                    firstTool: row.first_tool_name,
-                    firstToolTs: row.first_tool_ts,
-                    completedTs: row.completed_ts,
-                    totalExecutionMs: row.total_execution_ms,
-                    completionReason: row.completion_reason,
-                    taskChain: row.downstream_task_chain ? JSON.parse(row.downstream_task_chain) : [],
-                    sessionStatus: row.session_status,
-                    sessionStart: row.start_time,
-                    sessionEnd: row.end_time,
-                    eventCount: row.event_count,
-                }));
-                res.json({ traces });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to get execution traces: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/execution-trace/:id — detailed trace for a routing event
-        this.app.get('/api/execution-trace/:id', (req, res) => {
-            try {
-                const id = Number(req.params.id);
-                if (!Number.isFinite(id)) {
-                    res.status(400).json({ error: 'Invalid trace id' });
-                    return;
-                }
-                const db = storage.getDatabase();
-                // Get routing event by unique id
-                const routing = db.prepare(`
-          SELECT * FROM routing_events WHERE id = ?
-        `).get(id);
-                if (!routing) {
-                    res.status(404).json({ error: 'Trace not found' });
-                    return;
-                }
-                const sessionId = routing.session_id;
-                const routeRequestId = routing.route_request_id ?? null;
-                // Get all events for this session
-                const events = db.prepare(`
-          SELECT event_id, timestamp, hook_type, tool_name, user_prompt
-          FROM events
-          WHERE session_id = ?
-          ORDER BY timestamp ASC
-        `).all(sessionId);
-                // Get injections
-                const injections = db.prepare(`
-          SELECT injection_type, content, timestamp
-          FROM injections
-          WHERE session_id = ?
-          ORDER BY timestamp ASC
-        `).all(sessionId);
-                // Get Agent/Task tool events tied to this route_request_id (preferred)
-                const agentCallRows = routeRequestId
-                    ? db.prepare(`
-              SELECT id, tool, args, success, error, timestamp
-              FROM v2_tool_events
-              WHERE route_request_id = ? AND tool IN ('Agent','Task')
-              ORDER BY timestamp ASC
-            `).all(routeRequestId)
-                    : [];
-                // Completion signals: PostToolUse for Agent/Task within this session after routing.ts
-                const postUseRows = db.prepare(`
-          SELECT event_id, timestamp, tool_name
-          FROM events
-          WHERE session_id = ? AND hook_type = 'PostToolUse' AND tool_name IN ('Agent','Task')
-            AND timestamp >= ?
-          ORDER BY timestamp ASC
-        `).all(sessionId, new Date(routing.ts).toISOString());
-                const agentCalls = agentCallRows.map(r => {
-                    let subagent = null;
-                    try {
-                        const parsed = JSON.parse(r.args || '{}');
-                        if (typeof parsed.subagent_type === 'string')
-                            subagent = parsed.subagent_type;
-                    }
-                    catch { /* ignore */ }
-                    const completed = postUseRows.find(p => p.tool_name === r.tool && new Date(p.timestamp).getTime() >= r.timestamp);
-                    return {
-                        toolEventId: r.id,
-                        tool: r.tool,
-                        subagent,
-                        startedTs: r.timestamp,
-                        allowed: r.success === 1,
-                        error: r.error,
-                        completedTs: completed ? new Date(completed.timestamp).getTime() : null,
-                        completedEventId: completed?.event_id ?? null,
-                        status: !completed ? 'started' : 'completed',
-                    };
-                });
-                res.json({
-                    routing: {
-                        id: routing.id,
-                        sessionId,
-                        routeRequestId,
-                        prompt: routing.prompt,
-                        timestamp: routing.ts,
-                        intent: JSON.parse(routing.intent_json || '{}'),
-                        routedToType: routing.routed_to_type,
-                        routedToName: routing.routed_to_name,
-                        obeyed: routing.obeyed,
-                        classificationMs: routing.classification_ms,
-                        fallbackUsed: routing.fallback_used === 1,
-                        refusalReason: routing.refusal_reason,
-                        firstTool: routing.first_tool_name,
-                        firstToolTs: routing.first_tool_ts,
-                        completedTs: routing.completed_ts,
-                        totalExecutionMs: routing.total_execution_ms,
-                        completionReason: routing.completion_reason,
-                        taskChain: routing.downstream_task_chain ? JSON.parse(routing.downstream_task_chain) : [],
-                    },
-                    events,
-                    injections,
-                    agentCalls,
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to get trace details for ${req.params.id}: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // GET /api/execution-trace/:session_id/status — current status snapshot
-        this.app.get('/api/execution-trace/:session_id/status', (req, res) => {
-            try {
-                const { session_id } = req.params;
-                const db = storage.getDatabase();
-                const routing = db.prepare(`SELECT * FROM routing_events WHERE session_id = ? ORDER BY ts DESC LIMIT 1`).get(session_id);
-                if (!routing) {
-                    res.status(404).json({ error: 'Trace not found' });
-                    return;
-                }
-                const latestToolEvent = db.prepare(`
-          SELECT tool, success, error, timestamp
-          FROM v2_tool_events
-          WHERE session_id = ? AND timestamp >= ?
-          ORDER BY timestamp DESC LIMIT 1
-        `).get(session_id, routing.ts);
-                const latestDecision = db.prepare(`
-          SELECT level, reason, timestamp
-          FROM v2_decisions
-          WHERE session_id = ? AND timestamp >= ?
-          ORDER BY timestamp DESC LIMIT 1
-        `).get(session_id, routing.ts);
-                let status = 'routing';
-                if (latestDecision?.level === 'block' || latestToolEvent?.success === 0)
-                    status = 'failed';
-                else if (routing.completed_ts)
-                    status = 'completed';
-                else if (routing.first_tool_ts || latestToolEvent)
-                    status = 'executing';
-                res.json({
-                    status,
-                    timestamp: routing.ts,
-                    firstTool: routing.first_tool_name ?? latestToolEvent?.tool ?? null,
-                    firstToolTs: routing.first_tool_ts ?? latestToolEvent?.timestamp ?? null,
-                    completedTs: routing.completed_ts ?? null,
-                    totalExecutionMs: routing.total_execution_ms ?? null,
-                    completionReason: routing.completion_reason ?? null,
-                    error: latestToolEvent?.success === 0 ? latestToolEvent.error : (latestDecision?.level === 'block' ? latestDecision.reason : null),
-                });
-            }
-            catch (err) {
-                logger.warn(`[Web] Failed to get trace status for ${req.params.session_id}: ${err}`);
-                res.status(500).json({ error: String(err) });
-            }
-        });
-        // SSE: execution trace live status stream
-        this.app.get('/api/execution-trace/stream', (req, res) => {
-            res.writeHead(200, {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                Connection: 'keep-alive',
-            });
-            res.write('data: {"type":"connected"}\n\n');
-            const filterSession = req.query.session;
-            const readOnlyTools = new Set(['Read', 'Grep', 'Glob', 'LS', 'NotebookRead', 'WebFetch', 'WebSearch']);
-            const writeStatus = (payload) => {
-                if (filterSession && payload.sessionId !== filterSession)
-                    return;
-                res.write(`data: ${JSON.stringify(payload)}\n\n`);
-            };
-            const onEvent = (event) => {
-                const hookType = event.hook_type;
-                const toolName = event.tool_name;
-                const sessionId = event.session_id;
-                const timestamp = event.timestamp;
-                if (!sessionId || !hookType)
-                    return;
-                if (hookType === 'UserPromptSubmit') {
-                    writeStatus({ type: 'execution-status', status: 'routing', sessionId, timestamp, prompt: event.user_prompt ?? null });
-                    return;
-                }
-                if (hookType === 'PreToolUse' && toolName && !readOnlyTools.has(toolName)) {
-                    writeStatus({ type: 'execution-status', status: 'executing', sessionId, timestamp, tool: toolName });
-                    return;
-                }
-                if (hookType === 'Stop') {
-                    writeStatus({ type: 'execution-status', status: 'completed', sessionId, timestamp });
-                }
-            };
-            const onToolEvent = (event) => {
-                const sessionId = event.session_id;
-                if (!sessionId)
-                    return;
-                if (event.success === false || event.success === 0) {
-                    writeStatus({
-                        type: 'execution-status',
-                        status: 'failed',
-                        sessionId,
-                        timestamp: event.timestamp ?? Date.now(),
-                        tool: event.tool ?? null,
-                        error: event.error ?? null,
-                    });
-                }
-            };
-            const onDecision = (decision) => {
-                const sessionId = decision.session_id;
-                if (!sessionId)
-                    return;
-                if (decision.level === 'block') {
-                    writeStatus({
-                        type: 'execution-status',
-                        status: 'failed',
-                        sessionId,
-                        timestamp: decision.timestamp ?? Date.now(),
-                        error: decision.reason ?? null,
-                    });
-                }
-            };
-            storage.on('event', onEvent);
-            storage.on('tool-event', onToolEvent);
-            storage.on('decision', onDecision);
-            req.on('close', () => {
-                storage.removeListener('event', onEvent);
-                storage.removeListener('tool-event', onToolEvent);
-                storage.removeListener('decision', onDecision);
-            });
-        });
-        // SSE: real-time event stream
-        this.app.get('/api/events/stream', (req, res) => {
-            res.writeHead(200, {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                Connection: 'keep-alive',
-            });
-            res.write('data: {"type":"connected"}\n\n');
-            const filterSession = req.query.session;
-            const filterProject = req.query.project;
-            const filterHook = req.query.hook;
-            const onEvent = (event) => {
-                if (filterSession && event.session_id !== filterSession)
-                    return;
-                if (filterProject && event.project_path !== filterProject)
-                    return;
-                if (filterHook && event.hook_type !== filterHook)
-                    return;
-                res.write(`data: ${JSON.stringify(event)}\n\n`);
-            };
-            storage.on('event', onEvent);
-            req.on('close', () => {
-                storage.removeListener('event', onEvent);
-            });
-        });
-        // SSE: real-time governance decisions
-        this.app.get('/api/decisions/stream', (req, res) => {
-            res.writeHead(200, {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                Connection: 'keep-alive',
-            });
-            res.write('data: {"type":"connected"}\n\n');
-            const filterSession = req.query.session;
-            const onDecision = (decision) => {
-                if (filterSession && decision.session_id !== filterSession)
-                    return;
-                res.write(`data: ${JSON.stringify(decision)}\n\n`);
-            };
-            storage.on('decision', onDecision);
-            req.on('close', () => {
-                storage.removeListener('decision', onDecision);
-            });
-        });
-        // SPA fallback: serve index.html for any non-API route
-        // (must be the LAST route to not interfere with API routes)
-        const spaCandidates = [
-            path.join(__dirname, 'static'),
-            path.join(__dirname, '../../src/web/static'),
-        ];
-        const spaStaticDir = spaCandidates.find(dir => fs.existsSync(dir));
-        if (spaStaticDir) {
-            this.app.get(/^(?!\/api).*$/, (_req, res) => {
-                res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-                res.sendFile('index.html', { root: spaStaticDir });
-            });
-        }
+        // 1. Auth bootstrap (must be available before everything else)
+        registerAuthRoutes(this.app, ctx);
+        // 2. Static assets (serves UI; fallback registered last)
+        registerStaticAssets(this.app, ctx);
+        // 3. API routes, grouped by domain. Order within /api doesn't matter
+        //    because Express matches exact paths — but execution-trace preserves
+        //    the original (buggy) definition order intentionally.
+        registerStatusRoutes(this.app, ctx);
+        registerEventsRoutes(this.app, ctx);
+        registerSessionsRoutes(this.app, ctx);
+        registerRulesRoutes(this.app, ctx);
+        registerRoutingRoutes(this.app, ctx);
+        registerExperimentsRoutes(this.app, ctx);
+        registerMethodologyRoutes(this.app, ctx);
+        registerTokenUsageRoutes(this.app, ctx);
+        registerExecutionTraceRoutes(this.app, ctx);
+        registerAIRoutes(this.app, ctx);
+        registerPatchRoutes(this.app, ctx);
+        registerAgentsRoutes(this.app, ctx);
+        registerSkillsRoutes(this.app, ctx);
+        // 4. SPA catch-all — must be LAST so it can't shadow any API route.
+        registerStaticFallback(this.app, ctx);
     }
     async start() {
         return new Promise((resolve, reject) => {
@@ -2242,7 +92,7 @@ Return ONLY a JSON object with this exact structure (no markdown, no explanation
     }
     async stop() {
         if (this.server) {
-            return new Promise((resolve) => {
+            return new Promise(resolve => {
                 this.server.close(() => resolve());
             });
         }