agent-relay 2.3.14 → 2.3.16

package/packages/daemon/src/api.ts

@@ -1,1034 +0,0 @@
-/**
- * Daemon API
- * REST and WebSocket API for dashboard communication.
- */
-
-import * as http from 'http';
-import WebSocket, { WebSocketServer, WebSocket as WS } from 'ws';
-import { EventEmitter } from 'events';
-import { createLogger, metrics } from '@agent-relay/resiliency';
-import { getWorkspaceManager, WorkspaceManager } from './workspace-manager.js';
-import { getAgentManager, AgentManager } from './agent-manager.js';
-import type {
-  ApiDaemonConfig,
-  DaemonEvent,
-  UserSession,
-  WorkspacesResponse,
-  AgentsResponse,
-  AddWorkspaceRequest,
-  SpawnAgentRequest,
-} from './types.js';
-import {
-  startCLIAuth,
-  getAuthSession,
-  submitAuthCode,
-  cancelAuthSession,
-  getSupportedProviders,
-} from './cli-auth.js';
-import { getRepoManager, initRepoManager } from './repo-manager.js';
-
-const logger = createLogger('daemon-api');
-
-interface ApiRequest {
-  method: string;
-  path: string;
-  body?: unknown;
-  params: Record<string, string>;
-  query: Record<string, string>;
-}
-
-interface ApiResponse {
-  status: number;
-  body: unknown;
-  headers?: Record<string, string>;
-}
-
-type RouteHandler = (req: ApiRequest) => Promise<ApiResponse>;
-
-export class DaemonApi extends EventEmitter {
-  private server?: http.Server;
-  private wss?: WebSocketServer;
-  private workspaceManager: WorkspaceManager;
-  private agentManager: AgentManager;
-  private sessions = new Map<WS, UserSession>();
-  private routes = new Map<string, RouteHandler>();
-  private config: ApiDaemonConfig;
-  private allowedOrigins: Set<string>;
-  private allowAllOrigins: boolean;
-  // Track output subscriptions per agent/client
-  private outputSubscribers = new Map<string, Set<WS>>();
-  private wsSubscriptions = new WeakMap<WS, Set<string>>();
-
-  // Track alive status for ping/pong keepalive
-  private clientAlive = new WeakMap<WS, boolean>();
-  private pingInterval?: NodeJS.Timeout;
-
-  constructor(config: ApiDaemonConfig) {
-    super();
-    this.config = config;
-    this.workspaceManager = getWorkspaceManager(config.dataDir);
-    this.agentManager = getAgentManager(config.dataDir);
-    const configuredOrigins = this.loadAllowedOrigins(config);
-    this.allowAllOrigins = configuredOrigins.includes('*');
-    this.allowedOrigins = new Set(
-      configuredOrigins
-        .map(origin => origin.trim())
-        .filter(origin => origin && origin !== '*')
-    );
-
-    // Setup routes
-    this.setupRoutes();
-
-    // Forward events to WebSocket clients
-    this.workspaceManager.on('event', (event: DaemonEvent) => this.broadcastEvent(event));
-    this.agentManager.on('event', (event: DaemonEvent) => this.broadcastEvent(event));
-  }
-
-  /**
-   * Resolve allowed origins from config/env (comma-separated list).
-   * Empty list means no cross-origin access is permitted.
-   */
-  private loadAllowedOrigins(config: ApiDaemonConfig): string[] {
-    if (config.allowedOrigins?.length) {
-      return config.allowedOrigins;
-    }
-    const envOrigins = process.env.AGENT_RELAY_API_ALLOWED_ORIGINS;
-    if (envOrigins?.trim()) {
-      return envOrigins.split(',').map(origin => origin.trim()).filter(Boolean);
-    }
-    return [];
-  }
-
-  /**
-   * Return allowed origin for CORS or null if explicitly blocked.
-   * Undefined means no CORS header will be set (same-origin/server-to-server).
-   */
-  private resolveAllowedOrigin(
-    originHeader?: string | null,
-    requestHost?: string | null
-  ): string | null | undefined {
-    if (!originHeader) return undefined; // Non-browser or requests without Origin header
-    if (this.allowAllOrigins) return originHeader;
-    if (this.allowedOrigins.has(originHeader)) return originHeader;
-    if (requestHost) {
-      try {
-        const originHost = new URL(originHeader).host;
-        // Allow same-origin requests even if not explicitly configured
-        if (originHost === requestHost) {
-          return originHeader;
-        }
-      } catch {
-        // Malformed origin; treat as blocked below
-      }
-    }
-    return null;
-  }
-
-  /**
-   * Track an output subscription for a client/agent pair
-   */
-  private addOutputSubscription(ws: WS, agentId: string): void {
-    const subscribers = this.outputSubscribers.get(agentId) ?? new Set<WS>();
-    subscribers.add(ws);
-    this.outputSubscribers.set(agentId, subscribers);
-
-    const wsAgents = this.wsSubscriptions.get(ws) ?? new Set<string>();
-    wsAgents.add(agentId);
-    this.wsSubscriptions.set(ws, wsAgents);
-  }
-
-  /**
-   * Remove output subscriptions for a client. If agentId is provided, only that
-   * subscription is removed.
-   */
-  private removeOutputSubscription(ws: WS, agentId?: string): void {
-    const wsAgents = this.wsSubscriptions.get(ws);
-    if (!wsAgents) return;
-
-    const removeForAgent = (id: string): void => {
-      const agentSubscribers = this.outputSubscribers.get(id);
-      agentSubscribers?.delete(ws);
-      if (agentSubscribers && agentSubscribers.size === 0) {
-        this.outputSubscribers.delete(id);
-      }
-    };
-
-    if (agentId) {
-      wsAgents.delete(agentId);
-      removeForAgent(agentId);
-    } else {
-      for (const id of wsAgents) {
-        removeForAgent(id);
-      }
-      this.wsSubscriptions.delete(ws);
-    }
-  }
-
-  /**
-   * Send a snapshot of recent output to the client.
-   */
-  private sendOutputSnapshot(ws: WS, agentId: string, limit?: number): boolean {
-    const normalizedLimit = this.normalizeLimit(limit) ?? 200;
-    const output = this.agentManager.getOutput(agentId, normalizedLimit);
-    if (output === null) {
-      this.sendToClient(ws, { type: 'error', data: { message: `Agent ${agentId} not found` } });
-      return false;
-    }
-
-    const agent = this.agentManager.get(agentId);
-    this.sendToClient(ws, {
-      type: 'output:init',
-      data: {
-        agentId,
-        workspaceId: agent?.workspaceId,
-        output,
-      },
-    });
-    return true;
-  }
-
-  /**
-   * Broadcast output events only to subscribed clients
-   */
-  private broadcastOutputEvent(event: DaemonEvent): void {
-    if (!this.wss || !event.agentId) return;
-    const subscribers = this.outputSubscribers.get(event.agentId);
-    if (!subscribers?.size) return;
-
-    const data = event.data as { output?: string; agentName?: string } | undefined;
-    const message = JSON.stringify({
-      type: 'output:append',
-      data: {
-        agentId: event.agentId,
-        workspaceId: event.workspaceId,
-        output: data?.output ?? event.data,
-        agentName: data?.agentName,
-        timestamp: event.timestamp,
-      },
-    });
-
-    for (const ws of subscribers) {
-      if (ws.readyState === WebSocket.OPEN) {
-        ws.send(message);
-      }
-    }
-  }
-
-  /**
-   * Clamp and normalize requested output limit
-   */
-  private normalizeLimit(value: unknown): number | undefined {
-    const num = typeof value === 'number' ? value : Number(value);
-    if (!Number.isFinite(num)) return undefined;
-    const limit = Math.floor(num);
-    return Math.min(2000, Math.max(1, limit));
-  }
-
-  /**
-   * Start the API server
-   */
-  async start(): Promise<void> {
-    // Initialize repo manager (scans for existing repos, syncs from env)
-    // This runs in background - don't block server startup
-    initRepoManager().catch((err) => {
-      logger.warn('Failed to initialize repo manager', { error: String(err) });
-    });
-
-    return new Promise((resolve) => {
-      this.server = http.createServer((req, res) => this.handleRequest(req, res));
-
-      // Setup WebSocket server (disable compression for compatibility)
-      this.wss = new WebSocketServer({ server: this.server, perMessageDeflate: false });
-      this.wss.on('connection', (ws, req) => this.handleWebSocketConnection(ws, req));
-
-      // Setup ping/pong keepalive (30 second interval)
-      this.pingInterval = setInterval(() => {
-        this.wss?.clients.forEach((ws) => {
-          if (this.clientAlive.get(ws) === false) {
-            logger.info('WebSocket client unresponsive, closing');
-            ws.terminate();
-            return;
-          }
-          this.clientAlive.set(ws, false);
-          ws.ping();
-        });
-      }, 30000);
-
-      this.server.listen(this.config.port, this.config.host, () => {
-        logger.info('Daemon API started', { port: this.config.port, host: this.config.host });
-        resolve();
-      });
-    });
-  }
-
-  /**
-   * Stop the API server
-   */
-  async stop(): Promise<void> {
-    // Clear ping interval
-    if (this.pingInterval) {
-      clearInterval(this.pingInterval);
-      this.pingInterval = undefined;
-    }
-
-    // Close all WebSocket connections
-    if (this.wss) {
-      for (const ws of this.wss.clients) {
-        ws.close();
-      }
-      this.wss.close();
-    }
-
-    // Stop agent manager
-    await this.agentManager.shutdown();
-
-    // Close HTTP server
-    if (this.server) {
-      return new Promise((resolve) => {
-        this.server!.close(() => {
-          logger.info('Daemon API stopped');
-          resolve();
-        });
-      });
-    }
-  }
-
-  /**
-   * Setup API routes
-   */
-  private setupRoutes(): void {
-    // Health check
-    this.routes.set('GET /', async () => ({
-      status: 200,
-      body: { status: 'ok', version: '1.0.0' },
-    }));
-
-    // Metrics endpoint
-    this.routes.set('GET /metrics', async () => ({
-      status: 200,
-      body: metrics.toPrometheus(),
-      headers: { 'Content-Type': 'text/plain' },
-    }));
-
-    // === Workspaces ===
-
-    // List workspaces
-    this.routes.set('GET /workspaces', async (): Promise<ApiResponse> => {
-      const workspaces = this.workspaceManager.getAll();
-      const active = this.workspaceManager.getActive();
-      const response: WorkspacesResponse = {
-        workspaces,
-        activeWorkspaceId: active?.id,
-      };
-      return { status: 200, body: response };
-    });
-
-    // Add workspace
-    this.routes.set('POST /workspaces', async (req): Promise<ApiResponse> => {
-      const body = req.body as AddWorkspaceRequest;
-      if (!body?.path) {
-        return { status: 400, body: { error: 'path is required' } };
-      }
-      try {
-        const workspace = this.workspaceManager.add(body);
-        return { status: 201, body: workspace };
-      } catch (err) {
-        return { status: 400, body: { error: String(err) } };
-      }
-    });
-
-    // Get workspace
-    this.routes.set('GET /workspaces/:id', async (req): Promise<ApiResponse> => {
-      const workspace = this.workspaceManager.get(req.params.id);
-      if (!workspace) {
-        return { status: 404, body: { error: 'Workspace not found' } };
-      }
-      return { status: 200, body: workspace };
-    });
-
-    // Delete workspace
-    this.routes.set('DELETE /workspaces/:id', async (req): Promise<ApiResponse> => {
-      const removed = this.workspaceManager.remove(req.params.id);
-      if (!removed) {
-        return { status: 404, body: { error: 'Workspace not found' } };
-      }
-      return { status: 204, body: null };
-    });
-
-    // Switch workspace
-    this.routes.set('POST /workspaces/:id/switch', async (req): Promise<ApiResponse> => {
-      try {
-        const workspace = this.workspaceManager.switchTo(req.params.id);
-        return { status: 200, body: workspace };
-      } catch (err) {
-        return { status: 404, body: { error: String(err) } };
-      }
-    });
-
-    // === Agents ===
-
-    // List agents in workspace
-    this.routes.set('GET /workspaces/:id/agents', async (req): Promise<ApiResponse> => {
-      const workspace = this.workspaceManager.get(req.params.id);
-      if (!workspace) {
-        return { status: 404, body: { error: 'Workspace not found' } };
-      }
-      const agents = this.agentManager.getByWorkspace(req.params.id);
-      const response: AgentsResponse = {
-        agents,
-        workspaceId: req.params.id,
-      };
-      return { status: 200, body: response };
-    });
-
-    // Spawn agent in workspace
-    this.routes.set('POST /workspaces/:id/agents', async (req): Promise<ApiResponse> => {
-      const workspace = this.workspaceManager.get(req.params.id);
-      if (!workspace) {
-        return { status: 404, body: { error: 'Workspace not found' } };
-      }
-      const body = req.body as SpawnAgentRequest;
-      if (!body?.name) {
-        return { status: 400, body: { error: 'name is required' } };
-      }
-      try {
-        const agent = await this.agentManager.spawn(req.params.id, workspace.path, body);
-        return { status: 201, body: agent };
-      } catch (err) {
-        return { status: 400, body: { error: String(err) } };
-      }
-    });
-
-    // Get agent
-    this.routes.set('GET /agents/:id', async (req): Promise<ApiResponse> => {
-      const agent = this.agentManager.get(req.params.id);
-      if (!agent) {
-        return { status: 404, body: { error: 'Agent not found' } };
-      }
-      return { status: 200, body: agent };
-    });
-
-    // Stop agent
-    this.routes.set('DELETE /agents/:id', async (req): Promise<ApiResponse> => {
-      const stopped = await this.agentManager.stop(req.params.id);
-      if (!stopped) {
-        return { status: 404, body: { error: 'Agent not found' } };
-      }
-      return { status: 204, body: null };
-    });
-
-    // Get agent output
-    this.routes.set('GET /agents/:id/output', async (req): Promise<ApiResponse> => {
-      const limit = req.query.limit ? parseInt(req.query.limit, 10) : undefined;
-      const output = this.agentManager.getOutput(req.params.id, limit);
-      if (output === null) {
-        return { status: 404, body: { error: 'Agent not found' } };
-      }
-      return { status: 200, body: { output } };
-    });
-
-    // Send input to agent
-    this.routes.set('POST /agents/:id/input', async (req): Promise<ApiResponse> => {
-      const body = req.body as { input: string };
-      if (!body?.input) {
-        return { status: 400, body: { error: 'input is required' } };
-      }
-      const sent = this.agentManager.sendInput(req.params.id, body.input);
-      if (!sent) {
-        return { status: 404, body: { error: 'Agent not found' } };
-      }
-      return { status: 200, body: { success: true } };
-    });
-
-    // Interrupt agent by ID (send Ctrl+C to break out of stuck loops)
-    this.routes.set('POST /agents/:id/interrupt', async (req): Promise<ApiResponse> => {
-      const interrupted = this.agentManager.interrupt(req.params.id);
-      if (!interrupted) {
-        return { status: 404, body: { error: 'Agent not found' } };
-      }
-      return { status: 200, body: { success: true } };
-    });
-
-    // Interrupt agent by name (for dashboard where only name is available)
-    this.routes.set('POST /agents/by-name/:name/interrupt', async (req): Promise<ApiResponse> => {
-      const interrupted = this.agentManager.interruptByName(req.params.name);
-      if (!interrupted) {
-        return { status: 404, body: { error: 'Agent not found' } };
-      }
-      return { status: 200, body: { success: true } };
-    });
-
-    // === All Agents ===
-
-    // List all agents
-    this.routes.set('GET /agents', async (): Promise<ApiResponse> => {
-      const agents = this.agentManager.getAll();
-      return { status: 200, body: { agents } };
-    });
-
-    // === CLI Auth (for cloud server to call) ===
-
-    // List supported providers
-    this.routes.set('GET /auth/providers', async (): Promise<ApiResponse> => {
-      return { status: 200, body: { providers: getSupportedProviders() } };
-    });
-
-    // Start CLI auth flow
-    this.routes.set('POST /auth/cli/:provider/start', async (req): Promise<ApiResponse> => {
-      const { provider } = req.params;
-      try {
-        const session = await startCLIAuth(provider);
-        return {
-          status: 200,
-          body: {
-            sessionId: session.id,
-            status: session.status,
-            authUrl: session.authUrl,
-          },
-        };
-      } catch (err) {
-        return {
-          status: 400,
-          body: { error: err instanceof Error ? err.message : 'Failed to start auth' },
-        };
-      }
-    });
-
-    // Get auth session status
-    this.routes.set('GET /auth/cli/:provider/status/:sessionId', async (req): Promise<ApiResponse> => {
-      const { provider, sessionId } = req.params;
-      const session = getAuthSession(sessionId);
-      if (!session) {
-        return { status: 404, body: { error: 'Session not found' } };
-      }
-
-      // Fallback: if status is still waiting_auth, check if credentials exist on disk.
-      // The CLI may have completed auth without matching our success patterns.
-      if (session.status === 'waiting_auth') {
-        const { checkProviderAuth } = await import('./cli-auth.js');
-        const authenticated = await checkProviderAuth(provider, session.userId);
-        if (authenticated) {
-          session.status = 'success';
-        }
-      }
-
-      return {
-        status: 200,
-        body: {
-          sessionId: session.id,
-          status: session.status,
-          authUrl: session.authUrl,
-          error: session.error,
-          errorHint: session.errorHint,
-          recoverable: session.recoverable,
-          promptsHandled: session.promptsHandled,
-        },
-      };
-    });
-
-    // Get credentials from completed auth
-    this.routes.set('GET /auth/cli/:provider/creds/:sessionId', async (req): Promise<ApiResponse> => {
-      const { sessionId } = req.params;
-      const session = getAuthSession(sessionId);
-      if (!session) {
-        return { status: 404, body: { error: 'Session not found' } };
-      }
-      // Check for error state first
-      if (session.status === 'error') {
-        return {
-          status: 400,
-          body: {
-            error: session.error || 'Authentication failed',
-            errorHint: session.errorHint,
-            recoverable: session.recoverable,
-            status: session.status,
-          },
-        };
-      }
-      // Check if auth is complete AND we have credentials
-      // Status can be 'success' before credentials are extracted (race condition)
-      if (session.status !== 'success' || !session.token) {
-        return {
-          status: 400,
-          body: {
-            error: 'Auth not complete or credentials not yet available',
-            status: session.status,
-            hasToken: !!session.token,
-          },
-        };
-      }
-      return {
-        status: 200,
-        body: {
-          token: session.token,
-          refreshToken: session.refreshToken,
-          tokenExpiresAt: session.tokenExpiresAt,
-          provider: session.provider,
-        },
-      };
-    });
-
-    // Submit auth code to PTY session
-    this.routes.set('POST /auth/cli/:provider/code/:sessionId', async (req): Promise<ApiResponse> => {
-      const { sessionId } = req.params;
-      const { code, state } = req.body as { code?: string; state?: string };
-
-      if (!code || typeof code !== 'string') {
-        return { status: 400, body: { error: 'Auth code is required' } };
-      }
-
-      const result = await submitAuthCode(sessionId, code, state);
-      if (!result.success) {
-        return {
-          status: 400,
-          body: {
-            error: result.error || 'Failed to submit auth code',
-            needsRestart: result.needsRestart,
-          },
-        };
-      }
-
-      return { status: 200, body: { success: true, message: 'Auth code submitted' } };
-    });
-
-    // Complete auth and wait for credentials
-    this.routes.set('POST /auth/cli/:provider/complete/:sessionId', async (req): Promise<ApiResponse> => {
-      const { sessionId } = req.params;
-      const { authCode, state } = req.body as { authCode?: string; state?: string };
-
-      // For Codex, we need to forward the authCode to the CLI's callback server
-      // The Codex CLI starts a callback server at localhost:1455
-      if (authCode) {
-        try {
-          // Forward the OAuth callback to the Codex CLI's callback server
-          const callbackUrl = `http://localhost:1455/auth/callback?code=${encodeURIComponent(authCode)}${state ? `&state=${encodeURIComponent(state)}` : ''}`;
-          logger.info('Forwarding OAuth callback to Codex CLI', { callbackUrl: callbackUrl.replace(authCode, '[REDACTED]') });
-
-          const callbackResponse = await fetch(callbackUrl, {
-            signal: AbortSignal.timeout(5000),
-          });
-
-          if (!callbackResponse.ok) {
-            logger.error('Failed to forward callback to Codex CLI', { status: callbackResponse.status });
-            return {
-              status: 400,
-              body: {
-                error: 'Failed to deliver OAuth callback to Codex CLI. The CLI may have timed out.',
-                needsRestart: true,
-              },
-            };
-          }
-
-          logger.info('Successfully forwarded OAuth callback to Codex CLI');
-        } catch (err) {
-          logger.error('Error forwarding callback to Codex CLI', { error: String(err) });
-          return {
-            status: 500,
-            body: {
-              error: 'Failed to reach Codex CLI callback server. The CLI may not be running.',
-              needsRestart: true,
-            },
-          };
-        }
-      }
-
-      // Wait for credentials to be available (polls for up to 15 seconds)
-      const { completeAuthSession } = await import('./cli-auth.js');
-      const completeResult = await completeAuthSession(sessionId);
-
-      if (!completeResult.success) {
-        return {
-          status: 400,
-          body: {
-            error: completeResult.error || 'Authentication failed',
-          },
-        };
-      }
-
-      return { status: 200, body: { success: true, token: completeResult.token } };
-    });
-
-    // Cancel auth session
-    this.routes.set('POST /auth/cli/:provider/cancel/:sessionId', async (req): Promise<ApiResponse> => {
-      const { sessionId } = req.params;
-      const cancelled = cancelAuthSession(sessionId);
-      if (!cancelled) {
-        return { status: 404, body: { error: 'Session not found' } };
-      }
-      return { status: 200, body: { success: true } };
-    });
-
-    // Delete credential files for a provider (used by cloud disconnect flow)
-    this.routes.set('DELETE /api/credentials/apikey', async (req): Promise<ApiResponse> => {
-      const { userId, provider } = (req.body || {}) as { userId?: string; provider?: string };
-      if (!provider) {
-        return { status: 400, body: { error: 'Missing provider' } };
-      }
-      const { deleteProviderCredentials } = await import('./cli-auth.js');
-      const result = await deleteProviderCredentials(provider, userId);
-      return { status: 200, body: { success: true, deletedPaths: result.deletedPaths } };
-    });
-
-    // Check if provider is authenticated (credentials exist)
-    this.routes.set('GET /auth/cli/:provider/check', async (req): Promise<ApiResponse> => {
-      const { provider } = req.params;
-      const userId = req.query.userId;
-      const { checkProviderAuth } = await import('./cli-auth.js');
-      const authenticated = await checkProviderAuth(provider, userId);
-      return { status: 200, body: { authenticated } };
-    });
-
-    // === Repository Management ===
-    // Dynamic repo management without workspace restart
-
-    // List all repos
-    this.routes.set('GET /repos', async (): Promise<ApiResponse> => {
-      try {
-        const repoManager = getRepoManager();
-        const repos = repoManager.getRepos();
-        return { status: 200, body: { repos } };
-      } catch (err) {
-        logger.error('Failed to list repos', { error: String(err) });
-        return { status: 500, body: { error: 'Failed to list repositories' } };
-      }
-    });
-
-    // Get a specific repo
-    this.routes.set('GET /repos/:name', async (req): Promise<ApiResponse> => {
-      try {
-        const repoManager = getRepoManager();
-        // Handle encoded slashes (e.g., "owner%2Frepo" -> "owner/repo")
-        const fullName = decodeURIComponent(req.params.name);
-        const repo = repoManager.getRepo(fullName);
-        if (!repo) {
-          return { status: 404, body: { error: 'Repository not found' } };
-        }
-        return { status: 200, body: repo };
-      } catch (err) {
-        logger.error('Failed to get repo', { error: String(err) });
-        return { status: 500, body: { error: 'Failed to get repository' } };
-      }
-    });
-
-    // Sync (clone or update) a repo
-    this.routes.set('POST /repos/sync', async (req): Promise<ApiResponse> => {
-      const body = req.body as { repo?: string; repos?: string[] };
-
-      // Support single repo or batch
-      const reposToSync: string[] = [];
-      if (body.repo) {
-        reposToSync.push(body.repo);
-      }
-      if (body.repos && Array.isArray(body.repos)) {
-        reposToSync.push(...body.repos);
-      }
-
-      if (reposToSync.length === 0) {
-        return { status: 400, body: { error: 'repo or repos field is required' } };
-      }
-
-      try {
-        const repoManager = getRepoManager();
-        const results = await repoManager.syncRepos(reposToSync);
-
-        const allSuccess = results.every(r => r.success);
-        return {
-          status: allSuccess ? 200 : 207, // 207 Multi-Status if partial success
-          body: { results },
-        };
-      } catch (err) {
-        logger.error('Failed to sync repos', { error: String(err) });
-        return { status: 500, body: { error: 'Failed to sync repositories' } };
-      }
-    });
-
-    // Remove a repo
-    this.routes.set('DELETE /repos/:name', async (req): Promise<ApiResponse> => {
-      try {
-        const repoManager = getRepoManager();
-        const fullName = decodeURIComponent(req.params.name);
-        const deleteFiles = req.query.deleteFiles === 'true';
-
-        const removed = await repoManager.removeRepo(fullName, deleteFiles);
-        if (!removed) {
-          return { status: 404, body: { error: 'Repository not found' } };
-        }
-        return { status: 200, body: { success: true, deleted: deleteFiles } };
-      } catch (err) {
-        logger.error('Failed to remove repo', { error: String(err) });
-        return { status: 500, body: { error: 'Failed to remove repository' } };
-      }
-    });
-  }
-
-  /**
-   * Handle HTTP request
-   */
-  private async handleRequest(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {
-    const originHeader = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
-    const allowedOrigin = this.resolveAllowedOrigin(originHeader, req.headers.host);
-
-    // CORS headers (default denies cross-origin unless explicitly allowed)
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-    res.setHeader('Vary', 'Origin');
-
-    if (allowedOrigin === null) {
-      logger.warn('CORS origin blocked', { origin: originHeader });
-      res.writeHead(403, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'CORS origin not allowed' }));
-      return;
-    }
-
-    if (allowedOrigin) {
-      res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-    }
-
-    if (req.method === 'OPTIONS') {
-      res.writeHead(204);
-      res.end();
-      return;
-    }
-
-    try {
-      const url = new URL(req.url || '/', `http://${req.headers.host}`);
-      const apiReq = await this.parseRequest(req, url);
-
-      // Find matching route
-      const response = await this.routeRequest(apiReq);
-
-      // Send response
-      res.writeHead(response.status, {
-        'Content-Type': 'application/json',
-        ...response.headers,
-      });
-
-      if (response.body !== null) {
-        const body =
-          typeof response.body === 'string' ? response.body : JSON.stringify(response.body);
-        res.end(body);
-      } else {
-        res.end();
-      }
-    } catch (err) {
-      logger.error('Request error', { error: String(err) });
-      res.writeHead(500, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Internal server error' }));
-    }
-  }
-
-  /**
-   * Parse incoming request
-   */
-  private async parseRequest(req: http.IncomingMessage, url: URL): Promise<ApiRequest> {
-    // Parse query params
-    const query: Record<string, string> = {};
-    url.searchParams.forEach((value, key) => {
-      query[key] = value;
-    });
-
-    // Parse body for POST/PUT/DELETE
-    let body: unknown;
-    if (req.method === 'POST' || req.method === 'PUT' || req.method === 'DELETE') {
-      body = await this.parseBody(req);
-    }
-
-    return {
-      method: req.method || 'GET',
-      path: url.pathname,
-      body,
-      params: {},
-      query,
-    };
-  }
-
-  /**
-   * Parse request body
-   */
-  private parseBody(req: http.IncomingMessage): Promise<unknown> {
-    return new Promise((resolve, reject) => {
-      let data = '';
-      req.on('data', (chunk) => {
-        data += chunk;
-      });
-      req.on('end', () => {
-        try {
-          resolve(data ? JSON.parse(data) : undefined);
-        } catch {
-          reject(new Error('Invalid JSON body'));
-        }
-      });
-      req.on('error', reject);
-    });
-  }
-
-  /**
-   * Route request to handler
-   */
-  private async routeRequest(req: ApiRequest): Promise<ApiResponse> {
-    for (const [pattern, handler] of this.routes) {
-      const match = this.matchRoute(pattern, req.method, req.path);
-      if (match) {
-        req.params = match.params;
-        return handler(req);
-      }
-    }
-
-    return { status: 404, body: { error: 'Not found' } };
-  }
-
-  /**
-   * Match route pattern against request
-   */
-  private matchRoute(
-    pattern: string,
-    method: string,
-    path: string
-  ): { params: Record<string, string> } | null {
-    const [patternMethod, patternPath] = pattern.split(' ');
-
-    if (patternMethod !== method) {
-      return null;
-    }
-
-    const patternParts = patternPath.split('/');
-    const pathParts = path.split('/');
-
-    if (patternParts.length !== pathParts.length) {
-      return null;
-    }
-
-    const params: Record<string, string> = {};
-
-    for (let i = 0; i < patternParts.length; i++) {
-      const patternPart = patternParts[i];
-      const pathPart = pathParts[i];
-
-      if (patternPart.startsWith(':')) {
-        params[patternPart.slice(1)] = pathPart;
-      } else if (patternPart !== pathPart) {
-        return null;
-      }
-    }
-
-    return { params };
-  }
-
-  /**
-   * Handle WebSocket connection
-   */
-  private handleWebSocketConnection(ws: WS, req: http.IncomingMessage): void {
-    logger.info('WebSocket client connected', { url: req.url });
-
-    // Mark client as alive for ping/pong keepalive
-    this.clientAlive.set(ws, true);
-
-    // Handle pong responses
-    ws.on('pong', () => {
-      this.clientAlive.set(ws, true);
-    });
-
-    // Create session
-    const session: UserSession = {
-      userId: 'anonymous', // Would be set from auth
-      githubUsername: 'anonymous',
-      connectedAt: new Date(),
-    };
-    this.sessions.set(ws, session);
-
-    // Send initial state
-    this.sendInitialState(ws);
-
-    // Handle messages
-    ws.on('message', (data) => {
-      try {
-        const message = JSON.parse(data.toString());
-        this.handleWebSocketMessage(ws, session, message);
-      } catch (err) {
-        logger.error('WebSocket message error', { error: String(err) });
-      }
-    });
-
-    ws.on('close', () => {
-      logger.info('WebSocket client disconnected');
-      this.sessions.delete(ws);
-    });
-
-    ws.on('error', (err) => {
-      logger.error('WebSocket error', { error: String(err) });
-    });
-  }
-
-  /**
-   * Send initial state to WebSocket client
-   */
-  private sendInitialState(ws: WS): void {
-    const workspaces = this.workspaceManager.getAll();
-    const active = this.workspaceManager.getActive();
-    const agents = this.agentManager.getAll();
-
-    this.sendToClient(ws, {
-      type: 'init',
-      data: {
-        workspaces,
-        activeWorkspaceId: active?.id,
-        agents,
-      },
-    });
-  }
-
-  /**
-   * Handle WebSocket message from client
-   */
-  private handleWebSocketMessage(
-    ws: WS,
-    session: UserSession,
-    message: { type: string; data?: unknown }
-  ): void {
-    switch (message.type) {
-      case 'switch_workspace':
-        if (typeof message.data === 'string') {
-          try {
-            this.workspaceManager.switchTo(message.data);
-            session.activeWorkspaceId = message.data;
-          } catch (err) {
-            this.sendToClient(ws, { type: 'error', data: String(err) });
-          }
-        }
-        break;
-
-      case 'subscribe_output':
-        // Subscribe to agent output stream
-        // TODO: Implement output streaming
-        break;
-
-      case 'ping':
-        this.sendToClient(ws, { type: 'pong' });
-        break;
-    }
-  }
-
-  /**
-   * Send message to WebSocket client
-   */
-  private sendToClient(ws: WS, message: unknown): void {
-    if (ws.readyState === WebSocket.OPEN) {
-      ws.send(JSON.stringify(message));
-    }
-  }
-
-  /**
-   * Broadcast event to all WebSocket clients
-   */
-  private broadcastEvent(event: DaemonEvent): void {
-    if (!this.wss) return;
-
-    const message = JSON.stringify({ type: 'event', data: event });
-
-    for (const ws of this.wss.clients) {
-      if (ws.readyState === WebSocket.OPEN) {
-        ws.send(message);
-      }
-    }
-  }
-}