agserver 1.0.0

package/server/git.mjs

@@ -0,0 +1,328 @@
+import { execFileSync } from 'child_process';
+import path from 'path';
+
+export const IGNORE_DIRS = new Set([
+  '.git', 'node_modules', '.expo', '.expo-shared', '.npm-cache', 'dist', 'ios', 'android',
+]);
+export const IGNORE_FILES = new Set(['iphone-lan-qr.png', 'iphone-tunnel-qr.png']);
+
+export function runGitRaw(repoPath, args, fallback = '') {
+  try {
+    return execFileSync('git', ['-C', repoPath, ...args], {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 2 * 1024 * 1024,
+    });
+  } catch { return fallback; }
+}
+
+export function runGitRawBuffer(repoPath, args, fallback = Buffer.alloc(0)) {
+  try {
+    return execFileSync('git', ['-C', repoPath, ...args], {
+      stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 2 * 1024 * 1024,
+    });
+  } catch { return fallback; }
+}
+
+export function runGit(repoPath, args, fallback = '') {
+  return runGitRaw(repoPath, args, fallback).trim();
+}
+
+export function isGitRepo(repoPath) {
+  return runGit(repoPath, ['rev-parse', '--is-inside-work-tree'], 'false') === 'true';
+}
+
+export function getCurrentBranch(repoPath) {
+  return runGit(repoPath, ['rev-parse', '--abbrev-ref', 'HEAD'], 'HEAD');
+}
+
+export function getDefaultBaseBranch(repoPath) {
+  for (const c of ['main', 'master']) {
+    if (runGit(repoPath, ['show-ref', '--verify', '--quiet', `refs/heads/${c}`], 'missing') !== 'missing') return c;
+  }
+  const remoteHead = runGit(repoPath, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], '');
+  if (remoteHead.startsWith('origin/')) {
+    if (runGit(repoPath, ['show-ref', '--verify', '--quiet', `refs/remotes/${remoteHead}`], 'missing') !== 'missing') return remoteHead;
+  }
+  for (const c of ['develop', 'dev']) {
+    if (runGit(repoPath, ['show-ref', '--verify', '--quiet', `refs/heads/${c}`], 'missing') !== 'missing') return c;
+  }
+  return getCurrentBranch(repoPath);
+}
+
+export function makeBranchId(name) {
+  return `branch-${name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/(^-|-$)/g, '')}`;
+}
+
+export function toProjectId(raw) {
+  return String(raw || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/(^-|-$)/g, '');
+}
+
+export function listBranchRefs(repoPath) {
+  const raw = runGit(repoPath, [
+    'for-each-ref', '--sort=-committerdate',
+    '--format=%(refname:short)|%(committerdate:unix)|%(committerdate:relative)|%(subject)',
+    'refs/heads',
+  ], '');
+  return raw.split('\n').map(l => l.trim()).filter(Boolean).map(line => {
+    const [name, unixStr, relativeDate, subject] = line.split('|');
+    return { name, id: makeBranchId(name), unix: Number(unixStr || 0), relativeDate: relativeDate || 'unknown', subject: subject || `Work in progress on ${name}` };
+  });
+}
+
+export function listGitTags(repoPath, limit = 120) {
+  const raw = runGit(repoPath, [
+    'for-each-ref', '--sort=-creatordate', '--count', String(limit),
+    '--format=%(refname:short)|%(creatordate:relative)|%(subject)', 'refs/tags',
+  ], '');
+  return raw.split('\n').map(l => l.trim()).filter(Boolean).map(line => {
+    const [name, lastChange, subject] = line.split('|');
+    return { id: `tag-${toProjectId(name)}`, name, lastChange: lastChange || 'unknown', subject: subject || '' };
+  });
+}
+
+export function resolveBranchNameById(repoPath, branchId) {
+  if (!branchId) return null;
+  if (branchId.startsWith('tag-')) {
+    const tag = listGitTags(repoPath).find(t => t.id === branchId);
+    if (tag) return tag.name;
+  }
+  return listBranchRefs(repoPath).find(r => r.id === branchId)?.name ?? null;
+}
+
+export function listRevSet(repoPath, refName, limit = 400) {
+  const raw = runGit(repoPath, ['rev-list', '--max-count', String(limit), refName], '');
+  return new Set(raw.split('\n').map(l => l.trim()).filter(Boolean));
+}
+
+export function buildGitGraph(repoPath, selectedBranch, baseBranch) {
+  const isSameBranch = selectedBranch === baseBranch;
+  const selectedHead = runGit(repoPath, ['rev-parse', selectedBranch], '');
+  const baseHead = isSameBranch ? selectedHead : runGit(repoPath, ['rev-parse', baseBranch], '');
+
+  const logArgs = isSameBranch
+    ? ['log', '--date=short', '--pretty=format:%H|%h|%an|%ad|%P|%s', '--max-count', '500', selectedBranch]
+    : ['log', '--date=short', '--pretty=format:%H|%h|%an|%ad|%P|%s', '--max-count', '600', selectedBranch, baseBranch];
+  const logRaw = runGit(repoPath, logArgs, '');
+
+  // Parse all commits newest-first
+  const commits = [];
+  for (const line of logRaw.split('\n').map(l => l.trim()).filter(Boolean)) {
+    const parts = line.split('|');
+    const hash = parts[0] || '';
+    commits.push({
+      hash,
+      shortHash: parts[1] || hash.slice(0, 7),
+      author: parts[2] || 'Unknown',
+      authoredAt: parts[3] || 'n/a',
+      parents: (parts[4] || '').trim() ? parts[4].trim().split(' ') : [],
+      subject: parts.slice(5).join('|') || '(no subject)',
+    });
+  }
+
+  // Build a script for @gitgraph/js imperative API (oldest-first)
+  const script = buildGitgraphScript(commits, selectedBranch, baseBranch, isSameBranch, selectedHead, baseHead);
+
+  return { selectedBranch, baseBranch, isSameBranch, selectedHead, baseHead, script };
+}
+
+function esc(str) {
+  return JSON.stringify(String(str));
+}
+
+// Generates imperative @gitgraph/js JS that creates the graph correctly.
+// commits: newest-first array from git log
+function buildGitgraphScript(commits, selectedBranch, baseBranch, isSameBranch, selectedHead, baseHead) {
+  if (!commits.length) return '';
+
+  // Reverse to oldest-first for imperative API
+  const ordered = [...commits].reverse();
+  const hashIndex = new Map(ordered.map((c, i) => [c.hash, i]));
+
+  // Assign each commit to a branch by walking from branch heads backwards
+  // following first-parent chains (same as git's branch membership)
+  const commitBranch = new Map(); // hash -> branch name
+
+  function walkBranch(startHash, branchName) {
+    let h = startHash;
+    while (h && !commitBranch.has(h)) {
+      if (!hashIndex.has(h)) break;
+      commitBranch.set(h, branchName);
+      const c = ordered[hashIndex.get(h)];
+      h = c.parents[0] || null;
+    }
+  }
+
+  // Walk selected branch first (higher priority), then base
+  walkBranch(selectedHead, selectedBranch);
+  if (!isSameBranch) walkBranch(baseHead, baseBranch);
+
+  // Any remaining commits (reachable via merge parents) get assigned to base
+  for (const c of ordered) {
+    if (!commitBranch.has(c.hash)) {
+      commitBranch.set(c.hash, isSameBranch ? selectedBranch : baseBranch);
+    }
+  }
+
+  const lines = [];
+  // Compact template: tight spacing, thin lines, small dots
+  lines.push(`var g = GitgraphJS.createGitgraph(document.getElementById('g'), {
+  template: GitgraphJS.templateExtend(GitgraphJS.TemplateName.Metro, {
+    colors: ['#f97316','#3b82f6','#10b981','#8b5cf6','#ec4899','#64748b'],
+    branch: {
+      lineWidth: 2,
+      spacing: 22,
+      label: { font: 'bold 11px -apple-system,sans-serif', borderRadius: 4 }
+    },
+    commit: {
+      spacing: 26,
+      dot: { size: 5 },
+      message: { font: '12px -apple-system,sans-serif', displayAuthor: false, displayHash: false }
+    }
+  })
+});`);
+  lines.push(`var branches = {};`);
+
+  // Create branch objects — base first so it gets color index 0 (orange), selected gets index 1 (blue)
+  const branchNames = isSameBranch ? [selectedBranch] : [baseBranch, selectedBranch];
+  for (const name of branchNames) {
+    lines.push(`branches[${esc(name)}] = g.branch(${esc(name)});`);
+  }
+
+  const committed = new Set(); // hashes already committed to graph
+
+  for (const c of ordered) {
+    const branch = commitBranch.get(c.hash) || (isSameBranch ? selectedBranch : baseBranch);
+    const subject = c.subject.replace(/`/g, "'");
+
+    // If this is a merge commit (2 parents), emit merge from the other parent's branch
+    if (c.parents.length >= 2) {
+      const otherParentHash = c.parents[1];
+      const otherBranch = commitBranch.get(otherParentHash);
+      if (otherBranch && otherBranch !== branch && committed.has(otherParentHash)) {
+        lines.push(`branches[${esc(branch)}].merge({ branch: branches[${esc(otherBranch)}], commitOptions: { hash: ${esc(c.hash)}, subject: ${esc(subject)}, author: ${esc(c.author + ' <>')} } });`);
+        committed.add(c.hash);
+        continue;
+      }
+    }
+
+    lines.push(`branches[${esc(branch)}].commit({ hash: ${esc(c.hash)}, subject: ${esc(subject)}, author: ${esc(c.author + ' <>')} });`);
+    committed.add(c.hash);
+  }
+
+  // WIP node on selected branch
+  lines.push(`branches[${esc(selectedBranch)}].commit({ hash: 'wip-node', subject: 'Working tree', author: 'You <>' });`);
+
+  return lines.join('\n');
+}
+
+export function mapNameStatusToEntry(statusToken) {
+  const s = statusToken.toUpperCase();
+  if (s.startsWith('D')) return 'D';
+  if (s.startsWith('A')) return 'U';
+  if (s.startsWith('R')) return 'M';
+  return 'M';
+}
+
+export function parseNameStatus(raw) {
+  const lines = raw.split('\n').map(l => l.trim()).filter(Boolean);
+  let modified = 0, untracked = 0, deleted = 0, conflicts = 0;
+  const entries = [];
+  lines.forEach(line => {
+    const [token, a, b] = line.split('\t');
+    if (!token || !a) return;
+    const filePath = b || a;
+    const mapped = mapNameStatusToEntry(token);
+    if (mapped === 'D') deleted++; else if (mapped === 'U') untracked++; else modified++;
+    if (token.includes('U')) conflicts++;
+    entries.push({ path: filePath, status: mapped });
+  });
+  return { modified, untracked, deleted, conflicts, total: modified + untracked + deleted, entries };
+}
+
+export function parseGitStatusPorcelain(repoPath) {
+  const raw = runGitRaw(repoPath, ['status', '--porcelain=v1', '--untracked-files=all'], '');
+  const lines = raw.split('\n').map(l => l.trimEnd()).filter(Boolean);
+  let modified = 0, untracked = 0, deleted = 0, conflicts = 0;
+  const entries = [];
+  lines.forEach(line => {
+    const status = line.slice(0, 2);
+    let filePath = line.slice(3).trim();
+    if (filePath.includes('->')) filePath = filePath.split('->').at(-1).trim();
+    let mappedStatus = 'M';
+    if (status.includes('D')) { mappedStatus = 'D'; deleted++; }
+    else if (status === '??') { mappedStatus = 'U'; untracked++; }
+    else modified++;
+    if (status.includes('U') || status === 'AA' || status === 'DD') conflicts++;
+    entries.push({ path: filePath, status: mappedStatus });
+  });
+  return { modified, untracked, deleted, conflicts, total: modified + untracked + deleted, entries };
+}
+
+export function buildChangeTree(entries) {
+  const root = { type: 'dir', name: '', path: '', children: new Map() };
+  entries.forEach((entry, index) => {
+    const parts = entry.path.split('/').filter(Boolean);
+    let node = root;
+    parts.forEach((part, i) => {
+      const isFile = i === parts.length - 1;
+      const key = `${isFile ? 'f:' : 'd:'}${part}`;
+      if (!node.children.has(key)) {
+        const fullPath = node.path ? `${node.path}/${part}` : part;
+        node.children.set(key, { type: isFile ? 'file' : 'dir', name: part, path: fullPath, status: isFile ? entry.status : '', children: new Map(), fileStatus: isFile ? entry.status : '', order: index });
+      }
+      node = node.children.get(key);
+      if (isFile) node.fileStatus = entry.status;
+    });
+  });
+  const flat = [];
+  let id = 1;
+  const walk = (node, level) => {
+    const children = Array.from(node.children.values()).sort((a, b) => {
+      if (a.type === 'dir' && b.type === 'file') return -1;
+      if (a.type === 'file' && b.type === 'dir') return 1;
+      return a.name.localeCompare(b.name);
+    });
+    children.forEach(child => {
+      flat.push({ id: `c${id++}`, level, type: child.type, name: child.name, path: child.path, status: child.type === 'file' ? child.fileStatus : '' });
+      if (child.type === 'dir') walk(child, level + 1);
+    });
+  };
+  walk(root, 0);
+  return flat;
+}
+
+export function truncatePatch(rawPatch) {
+  const max = 280_000;
+  if (!rawPatch) return { patch: '', patchTruncated: false };
+  if (rawPatch.length <= max) return { patch: rawPatch, patchTruncated: false };
+  return { patch: `${rawPatch.slice(0, max)}\n\n[Patch preview truncated for large changes.]`, patchTruncated: true };
+}
+
+export function parseLsTreeEntry(rawLine) {
+  const m = rawLine.match(/^(\d+)\s+(\w+)\s+([0-9a-f]+)\s+(-|\d+)\t(.+)$/);
+  if (!m) return null;
+  return { mode: m[1], objectType: m[2], object: m[3], size: m[4] === '-' ? undefined : Number(m[4]), name: m[5] };
+}
+
+export function hashToColor(input) {
+  const palette = ['#2563EB', '#059669', '#EA580C', '#8B5CF6', '#DB2777', '#4B5563'];
+  let h = 0;
+  for (let i = 0; i < input.length; i++) h = (h * 31 + input.charCodeAt(i)) >>> 0;
+  return palette[h % palette.length];
+}
+
+export function iconForBranchName(name) {
+  const lower = name.toLowerCase();
+  if (lower.includes('fix') || lower.includes('bug')) return 'bug-report';
+  if (lower.includes('feat')) return 'alt-route';
+  if (lower.includes('chore')) return 'build';
+  if (lower.includes('exp')) return 'science';
+  return 'call-split';
+}
+
+export function getBranchContext(project, branchId) {
+  const currentBranch = getCurrentBranch(project.repoPath);
+  const resolved = branchId ? resolveBranchNameById(project.repoPath, branchId) : null;
+  if (branchId && !resolved) throw new Error('branch_not_found');
+  const selectedBranch = resolved || currentBranch;
+  return { currentBranch, selectedBranch, usingLiveFs: selectedBranch === currentBranch };
+}

package/server/index.mjs

@@ -0,0 +1,225 @@
+import http from 'http';
+import fs from 'fs';
+import { randomBytes } from 'crypto';
+import { assertAuthorized, isWeakApiKey, listLanIps } from './auth.mjs';
+import { runGit, runGitRawBuffer, getCurrentBranch, getDefaultBaseBranch, resolveBranchNameById, makeBranchId, truncatePatch, getBranchContext } from './git.mjs';
+import { readFileContent, readFileContentFromRef, listDirChunk, listDirChunkFromRef, normalizeRepoSubPath, resolveSafePath, smudgeLfsPointer, isLfsPointer } from './files.mjs';
+import { findProjectById, scanProjectsRoot, getProjectListData, getBranchesData, getWorkspaceData, getCommitDetailData, getCommitFileContent, getProjectSettings, setProjectSettings } from './projects.mjs';
+import { handleChatStream, handleChatMessage, handleWorktreesDispose, syncWorktrees } from './chat.mjs';
+
+export const API_VERSION = '1.0.0';
+
+export function createServer({ PORT, HOST, API_KEY, API_KEY_IS_GENERATED, PRIVATE_IP_ONLY }) {
+  function json(res, status, payload) {
+    res.writeHead(status, {
+      'Content-Type': 'application/json; charset=utf-8',
+      'Cache-Control': 'no-store',
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Headers': 'Content-Type, x-agserver-key',
+      'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+      'x-agserver-version': API_VERSION,
+    });
+    res.end(JSON.stringify(payload));
+  }
+
+  function parseQuery(urlObj) {
+    const params = {};
+    urlObj.searchParams.forEach((value, key) => { params[key] = value; });
+    return params;
+  }
+
+  const server = http.createServer((req, res) => {
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, {
+        'Access-Control-Allow-Origin': '*',
+        'Access-Control-Allow-Headers': 'Content-Type, x-agserver-key',
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+      });
+      res.end();
+      return;
+    }
+
+    const urlObj = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+    const pathname = urlObj.pathname;
+
+    if (pathname === '/health') {
+      json(res, 200, { ok: true, apiVersion: API_VERSION, host: HOST, port: PORT, privateIpOnly: PRIVATE_IP_ONLY, time: new Date().toISOString() });
+      return;
+    }
+
+    if (!pathname.startsWith('/api/')) { json(res, 404, { error: 'not_found' }); return; }
+    if (!assertAuthorized(req, res, { API_KEY, PRIVATE_IP_ONLY, jsonFn: json })) return;
+
+    try {
+      const q = parseQuery(urlObj);
+
+      if (pathname === '/api/project-list') { json(res, 200, getProjectListData()); return; }
+
+      if (pathname === '/api/project-branches') {
+        if (!q.projectId) { json(res, 400, { error: 'missing_project_id' }); return; }
+        const data = getBranchesData(q.projectId);
+        if (!data) { json(res, 404, { error: 'project_not_found' }); return; }
+        json(res, 200, data); return;
+      }
+
+      if (pathname === '/api/branch-workspace') {
+        if (!q.projectId || !q.branchId) { json(res, 400, { error: 'missing_project_or_branch' }); return; }
+        const data = getWorkspaceData(q.projectId, q.branchId);
+        if (!data) { json(res, 404, { error: 'workspace_not_found' }); return; }
+        json(res, 200, data); return;
+      }
+
+      if (pathname === '/api/git/commit') {
+        if (!q.projectId || !q.branchId || !q.commitId) { json(res, 400, { error: 'missing_project_branch_or_commit' }); return; }
+        const data = getCommitDetailData(q.projectId, q.branchId, q.commitId);
+        if (!data) { json(res, 404, { error: 'commit_not_found' }); return; }
+        json(res, 200, data); return;
+      }
+
+      if (pathname === '/api/git/commit-file') {
+        if (!q.projectId || !q.branchId || !q.commitId || !q.path) { json(res, 400, { error: 'missing_project_branch_commit_or_path' }); return; }
+        const data = getCommitFileContent(q.projectId, q.branchId, q.commitId, q.path);
+        if (!data) { json(res, 404, { error: 'commit_or_file_not_found' }); return; }
+        json(res, 200, data); return;
+      }
+
+      if (pathname === '/api/git/commit-file-diff') {
+        if (!q.projectId || !q.branchId || !q.commitId || !q.path) { json(res, 400, { error: 'missing_project_branch_commit_or_path' }); return; }
+        const project = findProjectById(q.projectId);
+        if (!project) { json(res, 404, { error: 'project_not_found' }); return; }
+        const branchName = resolveBranchNameById(project.repoPath, q.branchId);
+        if (!branchName) { json(res, 404, { error: 'branch_not_found' }); return; }
+        const relative = normalizeRepoSubPath(q.path);
+        let diffRaw = '';
+        if (q.commitId === 'working-tree') {
+          const currentBranch = getCurrentBranch(project.repoPath);
+          if (branchName === currentBranch) {
+            diffRaw = runGit(project.repoPath, ['diff', '--no-color', 'HEAD', '--', relative], '');
+            if (!diffRaw) diffRaw = runGit(project.repoPath, ['diff', '--no-color', '--', '/dev/null', relative], '');
+          } else {
+            const baseBranch = getDefaultBaseBranch(project.repoPath);
+            diffRaw = runGit(project.repoPath, ['diff', '--no-color', `${baseBranch}...${branchName}`, '--', relative], '');
+          }
+        } else {
+          diffRaw = runGit(project.repoPath, ['show', '--no-color', '--format=', q.commitId, '--', relative], '');
+        }
+        const { patch, patchTruncated } = truncatePatch(diffRaw);
+        json(res, 200, { diff: patch, truncated: patchTruncated }); return;
+      }
+
+      if (pathname === '/api/files/tree') {
+        if (!q.projectId) { json(res, 400, { error: 'missing_project_id' }); return; }
+        const project = findProjectById(q.projectId);
+        if (!project) { json(res, 404, { error: 'project_not_found' }); return; }
+        const branchContext = getBranchContext(project, q.branchId || '');
+        const levelNum = Math.max(1, Math.min(4, Number(q.levels) || 2));
+        const nodes = branchContext.usingLiveFs
+          ? listDirChunk(project.repoPath, q.path || '', levelNum)
+          : listDirChunkFromRef(project.repoPath, branchContext.selectedBranch, q.path || '', levelNum);
+        json(res, 200, { projectId: q.projectId, branchId: q.branchId || makeBranchId(branchContext.selectedBranch), sourceBranch: branchContext.selectedBranch, usingLiveFs: branchContext.usingLiveFs, path: q.path || '', levels: levelNum, nodes }); return;
+      }
+
+      if (pathname === '/api/files/pdf') {
+        if (!q.projectId || !q.path) { json(res, 400, { error: 'missing_project_or_path' }); return; }
+        const project = findProjectById(q.projectId);
+        if (!project) { json(res, 404, { error: 'project_not_found' }); return; }
+        let rawBuffer;
+        if (q.commitId) {
+          const relative = normalizeRepoSubPath(q.path);
+          rawBuffer = runGitRawBuffer(project.repoPath, ['show', `${q.commitId}:${relative}`]);
+          if (!rawBuffer.length) { json(res, 404, { error: 'file_not_found' }); return; }
+          const asText = rawBuffer.toString('utf8');
+          if (isLfsPointer(asText)) { const s = smudgeLfsPointer(project.repoPath, asText); if (!s) { json(res, 404, { error: 'lfs_unavailable' }); return; } rawBuffer = s; }
+        } else {
+          const branchContext = getBranchContext(project, q.branchId || '');
+          if (branchContext.usingLiveFs) {
+            const { target } = resolveSafePath(project.repoPath, q.path);
+            rawBuffer = fs.readFileSync(target);
+          } else {
+            const relative = normalizeRepoSubPath(q.path);
+            rawBuffer = runGitRawBuffer(project.repoPath, ['show', `${branchContext.selectedBranch}:${relative}`]);
+            if (!rawBuffer.length) { json(res, 404, { error: 'file_not_found' }); return; }
+            const asText = rawBuffer.toString('utf8');
+            if (isLfsPointer(asText)) { const s = smudgeLfsPointer(project.repoPath, asText); if (!s) { json(res, 404, { error: 'lfs_unavailable' }); return; } rawBuffer = s; }
+          }
+        }
+        res.writeHead(200, { 'Content-Type': 'application/pdf', 'Content-Length': rawBuffer.length, 'Cache-Control': 'no-store', 'Access-Control-Allow-Origin': '*', 'x-agserver-version': API_VERSION });
+        res.end(rawBuffer); return;
+      }
+
+      if (pathname === '/api/files/content') {
+        if (!q.projectId || !q.path) { json(res, 400, { error: 'missing_project_or_path' }); return; }
+        const project = findProjectById(q.projectId);
+        if (!project) { json(res, 404, { error: 'project_not_found' }); return; }
+        const branchContext = getBranchContext(project, q.branchId || '');
+        const data = branchContext.usingLiveFs
+          ? readFileContent(project.repoPath, q.path)
+          : readFileContentFromRef(project.repoPath, branchContext.selectedBranch, q.path);
+        json(res, 200, data); return;
+      }
+
+      if (pathname === '/api/chat/stream' && req.method === 'POST') { handleChatStream(req, res, json); return; }
+      if (pathname === '/api/chat/message' && req.method === 'POST') { handleChatMessage(req, res, json); return; }
+      if (pathname === '/api/worktrees/dispose' && req.method === 'POST') { handleWorktreesDispose(req, res, json); return; }
+
+      if (pathname === '/api/project-settings') {
+        if (!q.projectId) { json(res, 400, { error: 'missing_project_id' }); return; }
+        if (!findProjectById(q.projectId)) { json(res, 404, { error: 'project_not_found' }); return; }
+        if (req.method === 'GET') {
+          json(res, 200, { projectId: q.projectId, settings: getProjectSettings(q.projectId) }); return;
+        }
+        if (req.method === 'POST') {
+          let body = '';
+          req.on('data', c => { body += c; });
+          req.on('end', () => {
+            let patch;
+            try { patch = JSON.parse(body); } catch { json(res, 400, { error: 'invalid_json' }); return; }
+            const updated = setProjectSettings(q.projectId, patch);
+            json(res, 200, { projectId: q.projectId, settings: updated });
+          });
+          return;
+        }
+      }
+
+      json(res, 404, { error: 'not_found' });
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      const code = typeof error === 'object' && error && 'code' in error ? error.code : '';
+      if (msg === 'branch_not_found' || msg === 'file_not_found') { json(res, 404, { error: msg }); return; }
+      if (['missing_file_path', 'not_a_file', 'path_outside_repo', 'path_blocked'].includes(msg) || code === 'ENOENT') { json(res, 400, { error: msg || 'invalid_request' }); return; }
+      json(res, 500, { error: 'server_error', message: msg });
+    }
+  });
+
+  return server;
+}
+
+export function startServer(opts = {}) {
+  const PORT = opts.port ?? Number(process.env.AGSERVER_PORT || 8765);
+  const HOST = opts.host ?? process.env.AGSERVER_HOST ?? '127.0.0.1';
+  const ALLOW_WEAK_KEY = opts.allowWeakKey ?? process.env.AGSERVER_ALLOW_WEAK_KEY === '1';
+  const PRIVATE_IP_ONLY = opts.privateIpOnly ?? process.env.AGSERVER_PRIVATE_IP_ONLY === '1';
+  const API_KEY_IS_GENERATED = !opts.apiKey && !process.env.AGSERVER_API_KEY;
+  const API_KEY = opts.apiKey ?? process.env.AGSERVER_API_KEY ?? randomBytes(24).toString('base64url');
+
+  if (!ALLOW_WEAK_KEY && !API_KEY_IS_GENERATED && isWeakApiKey(API_KEY)) {
+    throw new Error('Weak AGSERVER_API_KEY — use at least 24 random characters, or set AGSERVER_ALLOW_WEAK_KEY=1.');
+  }
+
+  try {
+    for (const p of scanProjectsRoot()) {
+      try { syncWorktrees(p.repoPath); } catch { /* best effort */ }
+    }
+  } catch { /* best effort */ }
+
+  const server = createServer({ PORT, HOST, API_KEY, API_KEY_IS_GENERATED, PRIVATE_IP_ONLY, ALLOW_WEAK_KEY });
+  server.listen(PORT, HOST, () => {
+    const localIps = listLanIps();
+    console.log('[agserver] running');
+    console.log(`[agserver] host=${HOST} port=${PORT} apiVersion=${API_VERSION}`);
+    console.log(`[agserver] projects root=${process.env.AGSERVER_PROJECTS_ROOT || '/Volumes/Agentic/AGProject'}`);
+    console.log(`[agserver] local ips=${localIps.join(', ') || 'n/a'}`);
+    if (API_KEY_IS_GENERATED) console.log(`[agserver] api key: ${API_KEY}`);
+  });
+  return server;
+}