alvin-bot 5.6.2 → 5.8.0

package/dist/web/server.js

@@ -1,1831 +1 @@
-/**
- * Web Server — Local dashboard for Alvin Bot.
- *
- * Provides:
- * - Static file serving (web/public/)
- * - WebSocket for real-time chat + streaming
- * - REST API for settings, memory, sessions, etc.
- * - Simple password auth (WEB_PASSWORD env var)
- */
-import http from "http";
-import fs from "fs";
-import path from "path";
-import { resolve } from "path";
-import { execSync } from "child_process";
-import { WebSocketServer, WebSocket } from "ws";
-import { getRegistry } from "../engine.js";
-import { getSession, resetSession, getAllSessions } from "../services/session.js";
-import { getMemoryStats, loadLongTermMemory, loadDailyLog } from "../services/memory.js";
-import { getIndexStats } from "../services/embeddings.js";
-import { getLoadedPlugins } from "../services/plugins.js";
-import { getMCPStatus } from "../services/mcp.js";
-import { listProfiles } from "../services/users.js";
-import { listCustomTools, getCustomTools, executeCustomTool } from "../services/custom-tools.js";
-import { buildSystemPrompt, reloadSoul, getSoulContent } from "../services/personality.js";
-import { config } from "../config.js";
-import { handleSetupAPI } from "./setup-api.js";
-import { handleDoctorAPI } from "./doctor-api.js";
-import { handleOpenAICompat } from "./openai-compat.js";
-import { addCanvasClient } from "./canvas.js";
-import { BOT_ROOT, ENV_FILE, PUBLIC_DIR, MEMORY_DIR, MEMORY_FILE, SOUL_FILE, DATA_DIR, MCP_CONFIG, SKILLS_DIR } from "../paths.js";
-import { writeSecure } from "../services/file-permissions.js";
-import { timingSafeBearerMatch } from "../services/timing-safe-bearer.js";
-import { broadcast } from "../services/broadcast.js";
-import { BOT_VERSION } from "../version.js";
-import { decideNextBindAction } from "./bind-strategy.js";
-const WEB_PORT = parseInt(process.env.WEB_PORT || "3100");
-/** Tuning for the bind loop. Walk the port ladder `MAX_PORT_TRIES` times
- *  then fall back to a `BACKGROUND_RETRY_MS` idle loop — the bot keeps
- *  running on Telegram either way; see bind-strategy.ts for the pure
- *  decision logic. */
-const MAX_PORT_TRIES = 20;
-const BACKGROUND_RETRY_MS = 30_000;
-/** Current live http.Server, if one has successfully bound. */
-let currentServer = null;
-/** Current live WebSocketServer attached to currentServer. */
-let wsServerRef = null;
-/** Background-retry timer handle — set when the bind loop is in its
- *  idle wait between cycles, cleared when stopWebServer() cancels. */
-let bindRetryTimer = null;
-/** Flag flipped by stopWebServer(). Every bind-loop callback checks
- *  this and exits silently if set, so stop is truly terminal. */
-let stopRequested = false;
-const WEB_PASSWORD = process.env.WEB_PASSWORD || "";
-/** The actual port the Web UI is running on (may differ from WEB_PORT if busy). */
-let actualWebPort = WEB_PORT;
-// ── MIME Types ──────────────────────────────────────────
-const MIME = {
-    ".html": "text/html",
-    ".css": "text/css",
-    ".js": "application/javascript",
-    ".json": "application/json",
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".svg": "image/svg+xml",
-    ".ico": "image/x-icon",
-};
-// ── Auth ────────────────────────────────────────────────
-const activeSessions = new Set();
-function generateToken() {
-    return Array.from(crypto.getRandomValues(new Uint8Array(32)))
-        .map(b => b.toString(16).padStart(2, "0")).join("");
-}
-function checkAuth(req) {
-    if (!WEB_PASSWORD)
-        return true; // No password = open access
-    const cookie = req.headers.cookie || "";
-    const token = cookie.match(/alvinbot_token=([a-f0-9]+)/)?.[1];
-    return token ? activeSessions.has(token) : false;
-}
-/** Returns true when the server is exposed to non-loopback addresses but
- *  WEB_PASSWORD is empty.  In that state every mutating / exec endpoint is
- *  hard-refused regardless of any session cookie. */
-function isExposedWithoutPassword() {
-    if (WEB_PASSWORD)
-        return false; // password set → normal auth path
-    const h = config.webHost;
-    // loopback addresses are safe even without a password
-    if (!h || h === "127.0.0.1" || h === "::1" || h === "localhost")
-        return false;
-    return true; // non-loopback + no password = exposed
-}
-// ── REST API ────────────────────────────────────────────
-async function handleAPI(req, res, urlPath, body) {
-    res.setHeader("Content-Type", "application/json");
-    // POST /api/login
-    if (urlPath === "/api/login" && req.method === "POST") {
-        try {
-            const { password } = JSON.parse(body);
-            // v5.x — refuse login entirely when WEB_PASSWORD is not set.
-            // Previously `!WEB_PASSWORD || password === WEB_PASSWORD` minted a
-            // session for ANY input (including "") when the env var was absent,
-            // effectively making every unauthenticated request a valid session.
-            // timingSafeBearerMatch already rejects empty expectedToken → reuse it
-            // by wrapping the provided password as a synthetic "Bearer <pw>" header.
-            const authOk = timingSafeBearerMatch(`Bearer ${password}`, WEB_PASSWORD);
-            if (authOk) {
-                const token = generateToken();
-                activeSessions.add(token);
-                res.setHeader("Set-Cookie", `alvinbot_token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`);
-                res.end(JSON.stringify({ ok: true }));
-            }
-            else {
-                res.statusCode = 401;
-                res.end(JSON.stringify({ error: "Wrong password" }));
-            }
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // POST /api/webhook — external trigger endpoint with bearer auth (no cookie auth needed)
-    if (urlPath === "/api/webhook" && req.method === "POST") {
-        if (!config.webhookEnabled) {
-            res.writeHead(404);
-            res.end(JSON.stringify({ error: "Webhooks disabled" }));
-            return;
-        }
-        // v4.12.2 — timing-safe bearer token comparison. Previously used
-        // naive !== which leaks comparison position via timing side-channel.
-        if (!timingSafeBearerMatch(req.headers.authorization, config.webhookToken ?? "")) {
-            res.writeHead(401);
-            res.end(JSON.stringify({ error: "Unauthorized" }));
-            return;
-        }
-        try {
-            const payload = JSON.parse(body);
-            if (!payload.message) {
-                res.writeHead(400);
-                res.end(JSON.stringify({ error: "Missing message field" }));
-                return;
-            }
-            const channel = payload.channel || "telegram";
-            const chatId = payload.chatId || String(config.allowedUsers[0] || "");
-            const { enqueue } = await import("../services/delivery-queue.js");
-            const id = enqueue(channel, chatId, `[Webhook: ${payload.event || "unknown"}] ${payload.message}`);
-            res.writeHead(200);
-            res.end(JSON.stringify({ ok: true, queued: id }));
-        }
-        catch {
-            res.writeHead(400);
-            res.end(JSON.stringify({ error: "Invalid JSON body" }));
-        }
-        return;
-    }
-    // Auth check for all other API routes
-    if (!checkAuth(req)) {
-        res.statusCode = 401;
-        res.end(JSON.stringify({ error: "Not authenticated" }));
-        return;
-    }
-    // Hard gate: when the web server is reachable from non-loopback addresses
-    // and WEB_PASSWORD is empty, mutating/exec endpoints are refused outright.
-    // Local dev (127.0.0.1 + no password) is intentionally unaffected.
-    // Endpoints that write files, execute commands, or modify configuration
-    // are in scope; read-only status/config endpoints are not gated.
-    const EXPOSED_DANGEROUS_ROUTES = new Set([
-        "/api/terminal",
-        "/api/skills/create",
-        "/api/skills/update",
-        "/api/skills/delete",
-        "/api/files/save",
-        "/api/files/delete",
-        "/api/env/set",
-        "/api/setup-wizard",
-        "/api/soul/save",
-        "/api/memory/save",
-        "/api/memory/delete",
-        "/api/session/reset",
-        // cron — /api/cron/add was wrong; real route is /api/cron/create
-        "/api/cron/create",
-        "/api/cron/update",
-        "/api/cron/delete",
-        "/api/cron/toggle",
-        "/api/cron/run",
-        "/api/plugin/install",
-        "/api/plugin/uninstall",
-        // shell / process exec
-        "/api/tools/execute",
-        "/api/sudo/exec",
-        "/api/sudo/setup",
-        "/api/sudo/admin-dialog",
-        "/api/sudo/revoke",
-        // key / env writes
-        "/api/providers/set-key",
-        "/api/providers/set-primary",
-        "/api/providers/set-fallbacks",
-        "/api/providers/add-custom",
-        "/api/providers/remove-custom",
-        // platform config writes (writes ENV vars / runs npm install)
-        "/api/platforms/configure",
-        "/api/platforms/install-deps",
-        // provider / fallback order writes
-        "/api/fallback",
-        "/api/fallback/move",
-        // MCP config writes
-        "/api/mcp/add",
-        "/api/mcp/remove",
-        // process restart (DoS vector)
-        "/api/restart",
-        // model switching (affects all users)
-        "/api/models/switch",
-        // WhatsApp auth / config writes
-        "/api/whatsapp/disconnect",
-        "/api/whatsapp/group-rules",
-    ]);
-    if (isExposedWithoutPassword() && EXPOSED_DANGEROUS_ROUTES.has(urlPath)) {
-        res.statusCode = 403;
-        res.end(JSON.stringify({ error: "refused: web exposed without WEB_PASSWORD" }));
-        return;
-    }
-    // ── Setup APIs (platforms + models) ─────────────────
-    const handled = await handleSetupAPI(req, res, urlPath, body);
-    if (handled)
-        return;
-    // ── Doctor & Backup APIs ──────────────────────────
-    const doctorHandled = await handleDoctorAPI(req, res, urlPath, body);
-    if (doctorHandled)
-        return;
-    // GET /api/setup-check — is the bot fully configured?
-    if (urlPath === "/api/setup-check") {
-        const envPath = ENV_FILE;
-        let env = {};
-        try {
-            const lines = fs.readFileSync(envPath, "utf-8").split("\n");
-            for (const line of lines) {
-                if (line.startsWith("#") || !line.includes("="))
-                    continue;
-                const idx = line.indexOf("=");
-                env[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();
-            }
-        }
-        catch { }
-        const hasBotToken = !!(env.BOT_TOKEN || process.env.BOT_TOKEN);
-        const hasAllowedUsers = !!(env.ALLOWED_USERS || process.env.ALLOWED_USERS);
-        const hasPrimaryProvider = !!(env.PRIMARY_PROVIDER || process.env.PRIMARY_PROVIDER);
-        // Check which providers have keys
-        const providerKeys = {
-            groq: !!(env.GROQ_API_KEY || process.env.GROQ_API_KEY),
-            openai: !!(env.OPENAI_API_KEY || process.env.OPENAI_API_KEY),
-            google: !!(env.GOOGLE_API_KEY || process.env.GOOGLE_API_KEY),
-            nvidia: !!(env.NVIDIA_API_KEY || process.env.NVIDIA_API_KEY),
-            anthropic: !!(env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_API_KEY),
-            openrouter: !!(env.OPENROUTER_API_KEY || process.env.OPENROUTER_API_KEY),
-        };
-        const hasAnyProvider = hasPrimaryProvider || Object.values(providerKeys).some(Boolean);
-        // Check Claude CLI
-        let claudeCliInstalled = false;
-        try {
-            const { execSync } = await import("child_process");
-            execSync("claude --version", { timeout: 5000, stdio: "pipe" });
-            claudeCliInstalled = true;
-        }
-        catch { }
-        const isComplete = hasBotToken && hasAllowedUsers && hasAnyProvider;
-        res.end(JSON.stringify({
-            isComplete,
-            steps: {
-                telegram: { done: hasBotToken && hasAllowedUsers, botToken: hasBotToken, allowedUsers: hasAllowedUsers },
-                provider: { done: hasAnyProvider, primary: env.PRIMARY_PROVIDER || process.env.PRIMARY_PROVIDER || "", keys: providerKeys, claudeCli: claudeCliInstalled },
-            },
-        }));
-        return;
-    }
-    // POST /api/setup-wizard — save all setup data at once (first-run wizard)
-    if (urlPath === "/api/setup-wizard" && req.method === "POST") {
-        try {
-            const data = JSON.parse(body);
-            const envPath = ENV_FILE;
-            let content = fs.existsSync(envPath) ? fs.readFileSync(envPath, "utf-8") : "";
-            const setEnv = (key, value) => {
-                // M6 (centralized): reject values containing newline characters
-                if (/[\n\r]/.test(value))
-                    throw new Error("env value must not contain newline characters");
-                const regex = new RegExp(`^${key}=.*$`, "m");
-                if (regex.test(content)) {
-                    content = content.replace(regex, `${key}=${value}`);
-                }
-                else {
-                    content = content.trimEnd() + `\n${key}=${value}\n`;
-                }
-                process.env[key] = value;
-            };
-            // Step 1: Telegram
-            if (data.botToken)
-                setEnv("BOT_TOKEN", data.botToken);
-            if (data.allowedUsers)
-                setEnv("ALLOWED_USERS", data.allowedUsers);
-            // Step 2: Provider
-            if (data.primaryProvider)
-                setEnv("PRIMARY_PROVIDER", data.primaryProvider);
-            if (data.apiKey && data.apiKeyEnv)
-                setEnv(data.apiKeyEnv, data.apiKey);
-            // Step 3: Optional
-            if (data.webPassword)
-                setEnv("WEB_PASSWORD", data.webPassword);
-            fs.writeFileSync(envPath, content);
-            res.end(JSON.stringify({ ok: true, note: "Setup complete! Restart needed." }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/validate-bot-token — validate a Telegram bot token
-    if (urlPath === "/api/validate-bot-token" && req.method === "POST") {
-        try {
-            const { token } = JSON.parse(body);
-            if (!token || !token.includes(":")) {
-                res.end(JSON.stringify({ ok: false, error: "Invalid token format" }));
-                return;
-            }
-            const tgRes = await fetch(`https://api.telegram.org/bot${token}/getMe`);
-            const tgData = await tgRes.json();
-            if (tgData.ok) {
-                res.end(JSON.stringify({ ok: true, bot: { username: tgData.result.username, firstName: tgData.result.first_name, id: tgData.result.id } }));
-            }
-            else {
-                res.end(JSON.stringify({ ok: false, error: tgData.description || "Invalid token" }));
-            }
-        }
-        catch (e) {
-            res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // GET /api/status
-    if (urlPath === "/api/status") {
-        let modelInfo = { name: "Not configured", model: "none", status: "unconfigured" };
-        try {
-            const registry = getRegistry();
-            const active = registry.getActive().getInfo();
-            modelInfo = { name: active.name, model: active.model, status: active.status };
-        }
-        catch { /* engine not initialized — no provider configured */ }
-        const memory = getMemoryStats();
-        const index = getIndexStats();
-        const plugins = getLoadedPlugins();
-        const mcp = getMCPStatus();
-        const users = listProfiles();
-        const tools = listCustomTools();
-        // Aggregate token usage across all sessions
-        const { getAllSessions } = await import("../services/session.js");
-        const allSessions = getAllSessions();
-        let totalInputTokens = 0, totalOutputTokens = 0, totalCost = 0;
-        for (const s of allSessions.values()) {
-            totalInputTokens += s.totalInputTokens || 0;
-            totalOutputTokens += s.totalOutputTokens || 0;
-            totalCost += s.totalCost || 0;
-        }
-        const { config: appConfig } = await import("../config.js");
-        res.end(JSON.stringify({
-            bot: { version: BOT_VERSION, uptime: process.uptime() },
-            model: modelInfo,
-            memory: { ...memory, vectors: index.entries, indexSize: index.sizeBytes },
-            plugins: plugins.length,
-            mcp: mcp.length,
-            users: users.length,
-            tools: tools.length,
-            tokens: {
-                totalInput: totalInputTokens,
-                totalOutput: totalOutputTokens,
-                total: totalInputTokens + totalOutputTokens,
-                totalCost,
-            },
-            setup: {
-                telegram: !!appConfig.botToken,
-                provider: modelInfo.status !== "unconfigured",
-            },
-        }));
-        return;
-    }
-    // GET /api/models
-    if (urlPath === "/api/models") {
-        const registry = getRegistry();
-        registry.listAll().then(models => {
-            res.end(JSON.stringify({ models, active: registry.getActiveKey() }));
-        });
-        return;
-    }
-    // POST /api/models/switch
-    if (urlPath === "/api/models/switch" && req.method === "POST") {
-        try {
-            const { key } = JSON.parse(body);
-            const registry = getRegistry();
-            const ok = registry.switchTo(key);
-            res.end(JSON.stringify({ ok, active: registry.getActiveKey() }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/fallback — Get fallback order + health
-    if (urlPath === "/api/fallback" && req.method === "GET") {
-        try {
-            const { getFallbackOrder } = await import("../services/fallback-order.js");
-            const { getHealthStatus, isFailedOver } = await import("../services/heartbeat.js");
-            const registry = getRegistry();
-            const providers = await registry.listAll();
-            res.end(JSON.stringify({
-                order: getFallbackOrder(),
-                health: getHealthStatus(),
-                failedOver: isFailedOver(),
-                activeProvider: registry.getActiveKey(),
-                availableProviders: providers.map(p => ({ key: p.key, name: p.name, status: p.status })),
-            }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // POST /api/fallback — Set fallback order
-    if (urlPath === "/api/fallback" && req.method === "POST") {
-        try {
-            const { primary, fallbacks } = JSON.parse(body);
-            const { setFallbackOrder } = await import("../services/fallback-order.js");
-            const result = setFallbackOrder(primary, fallbacks, "webui");
-            res.end(JSON.stringify({ ok: true, order: result }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // POST /api/fallback/move — Move provider up/down
-    if (urlPath === "/api/fallback/move" && req.method === "POST") {
-        try {
-            const { key, direction } = JSON.parse(body);
-            const fb = await import("../services/fallback-order.js");
-            const result = direction === "up" ? fb.moveUp(key, "webui") : fb.moveDown(key, "webui");
-            res.end(JSON.stringify({ ok: true, order: result }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // GET /api/heartbeat — Health status
-    if (urlPath === "/api/heartbeat") {
-        try {
-            const { getHealthStatus, isFailedOver } = await import("../services/heartbeat.js");
-            res.end(JSON.stringify({
-                health: getHealthStatus(),
-                failedOver: isFailedOver(),
-            }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ health: [], failedOver: false }));
-        }
-        return;
-    }
-    // GET /api/memory
-    if (urlPath === "/api/memory") {
-        const ltm = loadLongTermMemory();
-        const todayLog = loadDailyLog();
-        const stats = getMemoryStats();
-        const index = getIndexStats();
-        // List daily log files
-        let dailyFiles = [];
-        try {
-            dailyFiles = fs.readdirSync(MEMORY_DIR)
-                .filter(f => f.endsWith(".md") && !f.startsWith("."))
-                .sort()
-                .reverse();
-        }
-        catch { /* empty */ }
-        res.end(JSON.stringify({
-            longTermMemory: ltm,
-            todayLog,
-            dailyFiles,
-            stats,
-            index: { entries: index.entries, files: index.files, sizeBytes: index.sizeBytes },
-        }));
-        return;
-    }
-    // GET /api/memory/:file
-    if (urlPath.startsWith("/api/memory/")) {
-        const file = urlPath.slice(12);
-        if (file.includes("..") || !file.endsWith(".md")) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid file" }));
-            return;
-        }
-        try {
-            const content = fs.readFileSync(resolve(MEMORY_DIR, file), "utf-8");
-            res.end(JSON.stringify({ file, content }));
-        }
-        catch {
-            res.statusCode = 404;
-            res.end(JSON.stringify({ error: "File not found" }));
-        }
-        return;
-    }
-    // POST /api/memory/save
-    if (urlPath === "/api/memory/save" && req.method === "POST") {
-        try {
-            const { file, content } = JSON.parse(body);
-            if (file === "MEMORY.md") {
-                fs.writeFileSync(MEMORY_FILE, content);
-            }
-            else if (file.endsWith(".md") && !file.includes("..")) {
-                fs.writeFileSync(resolve(MEMORY_DIR, file), content);
-            }
-            else {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid file" }));
-                return;
-            }
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/plugins
-    if (urlPath === "/api/plugins") {
-        res.end(JSON.stringify({ plugins: getLoadedPlugins() }));
-        return;
-    }
-    // v4.12.0 — Workspace overview: registry + per-workspace cost breakdown
-    if (urlPath === "/api/workspaces") {
-        try {
-            const { listWorkspaces, getDefaultWorkspace } = await import("../services/workspaces.js");
-            const { getCostByWorkspace } = await import("../services/session.js");
-            const costs = getCostByWorkspace();
-            const registered = listWorkspaces();
-            const all = [getDefaultWorkspace(), ...registered];
-            const payload = all.map((ws) => ({
-                name: ws.name,
-                purpose: ws.purpose,
-                emoji: ws.emoji ?? null,
-                color: ws.color ?? null,
-                cwd: ws.cwd,
-                channels: ws.channels,
-                stats: costs[ws.name] ?? { totalCost: 0, sessionCount: 0, messageCount: 0, toolUseCount: 0 },
-            }));
-            res.end(JSON.stringify({ workspaces: payload }));
-        }
-        catch (err) {
-            res.statusCode = 500;
-            res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
-        }
-        return;
-    }
-    // GET /api/users — Enhanced with session data
-    if (urlPath === "/api/users" && req.method === "GET") {
-        const { getAllSessions } = await import("../services/session.js");
-        const profiles = listProfiles();
-        const sessions = getAllSessions();
-        const sessionMap = new Map(Array.from(sessions.entries()).map(([k, s]) => [Number(k), s]));
-        const enriched = profiles.map(p => {
-            const session = sessionMap.get(p.userId);
-            return {
-                ...p,
-                session: session ? {
-                    isProcessing: session.isProcessing,
-                    totalCost: session.totalCost,
-                    historyLength: session.history.length,
-                    effort: session.effort,
-                    voiceReply: session.voiceReply,
-                    startedAt: session.startedAt,
-                    messageCount: session.messageCount,
-                    toolUseCount: session.toolUseCount,
-                    workingDir: session.workingDir,
-                    hasActiveQuery: !!session.abortController,
-                    queuedMessages: session.messageQueue.length,
-                } : null,
-            };
-        });
-        res.end(JSON.stringify({ users: enriched }));
-        return;
-    }
-    // DELETE /api/users/:id — Kill session + delete user data
-    if (urlPath.startsWith("/api/users/") && req.method === "DELETE") {
-        // Pattern route — gate here since EXPOSED_DANGEROUS_ROUTES can't express :id
-        if (isExposedWithoutPassword()) {
-            res.statusCode = 403;
-            res.end(JSON.stringify({ error: "refused: web exposed without WEB_PASSWORD" }));
-            return;
-        }
-        const userId = parseInt(urlPath.split("/").pop() || "0");
-        if (!userId) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid user ID" }));
-            return;
-        }
-        const { deleteUser } = await import("../services/users.js");
-        const result = deleteUser(userId);
-        res.end(JSON.stringify({ ok: true, ...result }));
-        return;
-    }
-    // GET /api/tools
-    if (urlPath === "/api/tools") {
-        const tools = getCustomTools();
-        res.end(JSON.stringify({ tools }));
-        return;
-    }
-    // POST /api/tools/execute — run a tool by name
-    if (urlPath === "/api/tools/execute" && req.method === "POST") {
-        try {
-            const { name, params } = JSON.parse(body);
-            if (!name) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "No tool name" }));
-                return;
-            }
-            const output = await executeCustomTool(name, params || {});
-            res.end(JSON.stringify({ ok: true, output }));
-        }
-        catch (err) {
-            const error = err instanceof Error ? err.message : String(err);
-            res.end(JSON.stringify({ error }));
-        }
-        return;
-    }
-    // ── MCP Management ─────────────────────────────────────
-    // GET /api/mcp — list MCP servers + tools
-    if (urlPath === "/api/mcp") {
-        const { getMCPStatus, getMCPTools, hasMCPConfig } = await import("../services/mcp.js");
-        const servers = getMCPStatus();
-        const tools = getMCPTools();
-        // Read raw config for editing
-        const configPath = MCP_CONFIG;
-        let rawConfig = { servers: {} };
-        try {
-            rawConfig = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-        }
-        catch { }
-        res.end(JSON.stringify({ servers, tools, config: rawConfig, hasConfig: hasMCPConfig() }));
-        return;
-    }
-    // POST /api/mcp/add — add a new MCP server
-    if (urlPath === "/api/mcp/add" && req.method === "POST") {
-        try {
-            const { name, command, args, url: serverUrl, env, headers } = JSON.parse(body);
-            if (!name) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Name required" }));
-                return;
-            }
-            const configPath = MCP_CONFIG;
-            let config = { servers: {} };
-            try {
-                config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-            }
-            catch { }
-            const entry = {};
-            if (command) {
-                entry.command = command;
-                entry.args = args || [];
-                if (env)
-                    entry.env = env;
-            }
-            else if (serverUrl) {
-                entry.url = serverUrl;
-                if (headers)
-                    entry.headers = headers;
-            }
-            else {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "command or url required" }));
-                return;
-            }
-            config.servers[name] = entry;
-            fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-            res.end(JSON.stringify({ ok: true, note: "Restart needed to connect." }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/mcp/remove — remove an MCP server
-    if (urlPath === "/api/mcp/remove" && req.method === "POST") {
-        try {
-            const { name } = JSON.parse(body);
-            const configPath = MCP_CONFIG;
-            let config = { servers: {} };
-            try {
-                config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-            }
-            catch { }
-            delete config.servers[name];
-            fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // GET /api/mcp/discover — auto-discover MCP servers on the system
-    if (urlPath === "/api/mcp/discover") {
-        const discovered = [];
-        const { execSync } = await import("child_process");
-        // Check for common MCP server npm packages
-        const knownServers = [
-            { pkg: "@modelcontextprotocol/server-filesystem", name: "filesystem", args: ["/tmp"] },
-            { pkg: "@modelcontextprotocol/server-brave-search", name: "brave-search", args: [] },
-            { pkg: "@modelcontextprotocol/server-github", name: "github", args: [] },
-            { pkg: "@modelcontextprotocol/server-postgres", name: "postgres", args: [] },
-            { pkg: "@modelcontextprotocol/server-sqlite", name: "sqlite", args: [] },
-            { pkg: "@modelcontextprotocol/server-slack", name: "slack", args: [] },
-            { pkg: "@modelcontextprotocol/server-memory", name: "memory", args: [] },
-            { pkg: "@modelcontextprotocol/server-puppeteer", name: "puppeteer", args: [] },
-            { pkg: "@modelcontextprotocol/server-fetch", name: "web-fetch", args: [] },
-            { pkg: "@anthropic/mcp-server-sequential-thinking", name: "sequential-thinking", args: [] },
-        ];
-        for (const s of knownServers) {
-            try {
-                execSync(`npx --yes ${s.pkg} --help`, { timeout: 5000, stdio: "pipe", env: { ...process.env, PATH: process.env.PATH + ":/opt/homebrew/bin:/usr/local/bin" } });
-                discovered.push({ name: s.name, command: "npx", args: ["-y", s.pkg, ...s.args], source: "npm" });
-            }
-            catch {
-                // Not installed — try checking if globally available
-                try {
-                    execSync(`npm list -g ${s.pkg} --depth=0`, { timeout: 5000, stdio: "pipe" });
-                    discovered.push({ name: s.name, command: "npx", args: ["-y", s.pkg, ...s.args], source: "npm-global" });
-                }
-                catch { /* not installed */ }
-            }
-        }
-        // Check for Claude Desktop MCP config
-        const homeDir = process.env.HOME || process.env.USERPROFILE || "";
-        const claudeConfigPaths = [
-            resolve(homeDir, ".config/claude/claude_desktop_config.json"),
-            resolve(homeDir, "Library/Application Support/Claude/claude_desktop_config.json"),
-            resolve(homeDir, "AppData/Roaming/Claude/claude_desktop_config.json"),
-        ];
-        for (const cfgPath of claudeConfigPaths) {
-            try {
-                const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf-8"));
-                if (cfg.mcpServers) {
-                    for (const [name, srv] of Object.entries(cfg.mcpServers)) {
-                        if (srv.command) {
-                            discovered.push({ name: `claude-${name}`, command: srv.command, args: srv.args || [], source: "claude-desktop" });
-                        }
-                    }
-                }
-            }
-            catch { /* not found */ }
-        }
-        res.end(JSON.stringify({ discovered }));
-        return;
-    }
-    // ── Skills Management ─────────────────────────────────
-    // GET /api/skills — already in setup-api.ts, but add full CRUD here
-    // GET /api/skills/detail/:id — get full skill content
-    if (urlPath?.match(/^\/api\/skills\/detail\//) && req.method === "GET") {
-        const skillId = urlPath.split("/").pop();
-        const { getSkills } = await import("../services/skills.js");
-        const skill = getSkills().find(s => s.id === skillId);
-        if (skill) {
-            res.end(JSON.stringify({ ok: true, skill }));
-        }
-        else {
-            res.statusCode = 404;
-            res.end(JSON.stringify({ error: "Skill not found" }));
-        }
-        return;
-    }
-    // POST /api/skills/create — create a new skill
-    if (urlPath === "/api/skills/create" && req.method === "POST") {
-        try {
-            const { id, name, description, triggers, category, content, priority } = JSON.parse(body);
-            if (!id || !name) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "id and name required" }));
-                return;
-            }
-            // Security: reject id values that could escape SKILLS_DIR.
-            // Mirror the resolve+startsWith containment pattern used in /api/files/save (server.ts ~:921).
-            // Also guard against ids with path separators or absolute paths before
-            // resolve() ever runs, so the raw string never reaches the filesystem.
-            if (typeof id !== "string" ||
-                id.includes("..") ||
-                id.includes("/") ||
-                id.includes("\\") ||
-                path.isAbsolute(id)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            const skillsDir = SKILLS_DIR;
-            const skillDir = resolve(skillsDir, id);
-            // Belt-and-suspenders: resolved path must still be inside SKILLS_DIR
-            if (!skillDir.startsWith(skillsDir)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            if (!fs.existsSync(skillDir))
-                fs.mkdirSync(skillDir, { recursive: true });
-            const frontmatter = [
-                "---",
-                `name: ${name}`,
-                description ? `description: ${description}` : "",
-                triggers ? `triggers: ${Array.isArray(triggers) ? triggers.join(", ") : triggers}` : "",
-                `priority: ${priority || 3}`,
-                `category: ${category || "custom"}`,
-                "---",
-            ].filter(Boolean).join("\n");
-            fs.writeFileSync(resolve(skillDir, "SKILL.md"), `${frontmatter}\n\n${content || ""}`);
-            // Force reload
-            const { loadSkills } = await import("../services/skills.js");
-            loadSkills();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/skills/update — update an existing skill
-    if (urlPath === "/api/skills/update" && req.method === "POST") {
-        try {
-            const { id, content } = JSON.parse(body);
-            // Security: same id containment as /api/skills/create
-            if (typeof id !== "string" ||
-                id.includes("..") ||
-                id.includes("/") ||
-                id.includes("\\") ||
-                path.isAbsolute(id)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            // Belt-and-suspenders: resolved path must still be inside SKILLS_DIR
-            if (!resolve(SKILLS_DIR, id).startsWith(SKILLS_DIR)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            const skillPath = resolve(SKILLS_DIR, id, "SKILL.md");
-            if (!fs.existsSync(skillPath)) {
-                // Try flat file
-                const flatPath = resolve(SKILLS_DIR, id + ".md");
-                if (fs.existsSync(flatPath)) {
-                    fs.writeFileSync(flatPath, content);
-                }
-                else {
-                    res.statusCode = 404;
-                    res.end(JSON.stringify({ error: "Skill not found" }));
-                    return;
-                }
-            }
-            else {
-                fs.writeFileSync(skillPath, content);
-            }
-            const { loadSkills } = await import("../services/skills.js");
-            loadSkills();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/skills/delete — delete a skill
-    if (urlPath === "/api/skills/delete" && req.method === "POST") {
-        try {
-            const { id } = JSON.parse(body);
-            // Security: same raw-string id containment as /api/skills/create + /api/skills/update
-            if (typeof id !== "string" ||
-                id.includes("..") ||
-                id.includes("/") ||
-                id.includes("\\") ||
-                path.isAbsolute(id)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            const skillDir = resolve(SKILLS_DIR, id);
-            const flatFile = resolve(SKILLS_DIR, id + ".md");
-            if (fs.existsSync(skillDir)) {
-                fs.rmSync(skillDir, { recursive: true });
-            }
-            else if (fs.existsSync(flatFile)) {
-                fs.unlinkSync(flatFile);
-            }
-            else {
-                res.statusCode = 404;
-                res.end(JSON.stringify({ error: "Skill not found" }));
-                return;
-            }
-            const { loadSkills } = await import("../services/skills.js");
-            loadSkills();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // GET /api/config
-    if (urlPath === "/api/config") {
-        res.end(JSON.stringify({
-            providers: config.fallbackProviders,
-            primaryProvider: config.primaryProvider,
-            allowedUsers: config.allowedUsers,
-            hasKeys: {
-                groq: !!config.apiKeys.groq,
-                openai: !!config.apiKeys.openai,
-                google: !!config.apiKeys.google,
-                nvidia: !!config.apiKeys.nvidia,
-                openrouter: !!config.apiKeys.openrouter,
-            },
-        }));
-        return;
-    }
-    // GET /api/sessions
-    if (urlPath === "/api/sessions") {
-        const sessions = getAllSessions();
-        const profiles = listProfiles();
-        const data = Array.from(sessions.entries()).map(([key, session]) => {
-            const userId = Number(key.split(":").pop());
-            const profile = profiles.find(p => p.userId === userId);
-            return {
-                userId: key,
-                name: profile?.name || `User ${key}`,
-                username: profile?.username,
-                messageCount: session.messageCount,
-                toolUseCount: session.toolUseCount,
-                totalCost: session.totalCost,
-                totalInputTokens: session.totalInputTokens || 0,
-                totalOutputTokens: session.totalOutputTokens || 0,
-                effort: session.effort,
-                startedAt: session.startedAt,
-                lastActivity: session.lastActivity,
-                historyLength: session.history.length,
-                isProcessing: session.isProcessing,
-                provider: Object.keys(session.queriesByProvider).join(", ") || "none",
-            };
-        });
-        res.end(JSON.stringify({ sessions: data }));
-        return;
-    }
-    // GET /api/sessions/:userId/history
-    if (urlPath.match(/^\/api\/sessions\/\d+\/history$/)) {
-        const userId = parseInt(urlPath.split("/")[3]);
-        const session = getSession(userId);
-        res.end(JSON.stringify({
-            userId,
-            history: session.history.map(h => ({ role: h.role, content: h.content.slice(0, 2000) })),
-        }));
-        return;
-    }
-    // GET /api/files?path=...
-    if (urlPath === "/api/files") {
-        const params = new URLSearchParams((req.url || "").split("?")[1] || "");
-        const reqPath = params.get("path") || "";
-        const basePath = resolve(BOT_ROOT, reqPath || ".");
-        // Security: must be within BOT_ROOT
-        if (!basePath.startsWith(BOT_ROOT)) {
-            res.statusCode = 403;
-            res.end(JSON.stringify({ error: "Access denied" }));
-            return;
-        }
-        try {
-            const stat = fs.statSync(basePath);
-            if (stat.isDirectory()) {
-                const entries = fs.readdirSync(basePath, { withFileTypes: true })
-                    .filter(e => !e.name.startsWith(".") && e.name !== "node_modules")
-                    .map(e => ({
-                    name: e.name,
-                    type: e.isDirectory() ? "dir" : "file",
-                    size: e.isFile() ? fs.statSync(resolve(basePath, e.name)).size : 0,
-                    modified: fs.statSync(resolve(basePath, e.name)).mtimeMs,
-                }))
-                    .sort((a, b) => {
-                    if (a.type !== b.type)
-                        return a.type === "dir" ? -1 : 1;
-                    return a.name.localeCompare(b.name);
-                });
-                res.end(JSON.stringify({ path: reqPath || ".", entries }));
-            }
-            else {
-                // Read file content — text files up to 500KB
-                const ext = path.extname(basePath).toLowerCase();
-                const textExts = new Set([
-                    ".md", ".txt", ".json", ".js", ".ts", ".jsx", ".tsx", ".css", ".html", ".htm",
-                    ".xml", ".svg", ".yml", ".yaml", ".toml", ".ini", ".cfg", ".conf", ".env",
-                    ".sh", ".bash", ".zsh", ".fish", ".py", ".rb", ".go", ".rs", ".java", ".kt",
-                    ".c", ".cpp", ".h", ".hpp", ".cs", ".php", ".sql", ".graphql", ".prisma",
-                    ".dockerfile", ".gitignore", ".gitattributes", ".editorconfig", ".prettierrc",
-                    ".eslintrc", ".babelrc", ".npmrc", ".nvmrc", ".lock", ".log", ".csv", ".tsv",
-                    ".mjs", ".cjs", ".mts", ".cts", ".vue", ".svelte", ".astro",
-                ]);
-                // Files without extension that match known names are always text
-                const textNames = new Set([
-                    "dockerfile", "makefile", "procfile", "gemfile", "rakefile",
-                    "vagrantfile", "brewfile", "justfile", "taskfile", "cakefile",
-                    "license", "licence", "readme", "changelog", "authors", "contributors",
-                ]);
-                const baseName = path.basename(basePath).toLowerCase();
-                const isKnownTextName = textNames.has(baseName);
-                const isText = textExts.has(ext) || isKnownTextName || (!ext && stat.size < 100_000);
-                if (stat.size > 500_000) {
-                    res.end(JSON.stringify({ path: reqPath, content: `[File too large: ${(stat.size / 1024).toFixed(1)} KB — max 500 KB]`, size: stat.size }));
-                }
-                else if (isText) {
-                    try {
-                        const content = fs.readFileSync(basePath, "utf-8");
-                        // Quick binary check: if >10% null bytes, it's binary
-                        const nullCount = [...content.slice(0, 1000)].filter(c => c === "\0").length;
-                        if (nullCount > 100) {
-                            res.end(JSON.stringify({ path: reqPath, content: null, size: stat.size, binary: true }));
-                        }
-                        else {
-                            res.end(JSON.stringify({ path: reqPath, content, size: stat.size }));
-                        }
-                    }
-                    catch {
-                        res.end(JSON.stringify({ path: reqPath, content: null, size: stat.size, binary: true }));
-                    }
-                }
-                else {
-                    res.end(JSON.stringify({ path: reqPath, content: null, size: stat.size, binary: true }));
-                }
-            }
-        }
-        catch {
-            res.statusCode = 404;
-            res.end(JSON.stringify({ error: "Not found" }));
-        }
-        return;
-    }
-    // POST /api/files/save
-    if (urlPath === "/api/files/save" && req.method === "POST") {
-        try {
-            const { path: filePath, content } = JSON.parse(body);
-            const absPath = resolve(BOT_ROOT, filePath);
-            if (!absPath.startsWith(BOT_ROOT)) {
-                res.statusCode = 403;
-                res.end(JSON.stringify({ error: "Access denied" }));
-                return;
-            }
-            fs.writeFileSync(absPath, content);
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            const error = err instanceof Error ? err.message : "Invalid request";
-            res.end(JSON.stringify({ error }));
-        }
-        return;
-    }
-    // POST /api/files/delete
-    if (urlPath === "/api/files/delete" && req.method === "POST") {
-        try {
-            const { path: filePath } = JSON.parse(body);
-            const absPath = resolve(BOT_ROOT, filePath);
-            if (!absPath.startsWith(BOT_ROOT)) {
-                res.statusCode = 403;
-                res.end(JSON.stringify({ error: "Access denied" }));
-                return;
-            }
-            // Safety: don't allow deleting critical files
-            const critical = [".env", "package.json", "tsconfig.json", "ecosystem.config.cjs"];
-            const baseName = path.basename(absPath);
-            if (critical.includes(baseName)) {
-                res.statusCode = 403;
-                res.end(JSON.stringify({ error: `${baseName} cannot be deleted (protected)` }));
-                return;
-            }
-            if (!fs.existsSync(absPath)) {
-                res.statusCode = 404;
-                res.end(JSON.stringify({ error: "File not found" }));
-                return;
-            }
-            const stat = fs.statSync(absPath);
-            if (stat.isDirectory()) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Directories cannot be deleted" }));
-                return;
-            }
-            fs.unlinkSync(absPath);
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            const error = err instanceof Error ? err.message : "Invalid request";
-            res.end(JSON.stringify({ error }));
-        }
-        return;
-    }
-    // POST /api/terminal
-    if (urlPath === "/api/terminal" && req.method === "POST") {
-        try {
-            const { command } = JSON.parse(body);
-            if (!command) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "No command" }));
-                return;
-            }
-            // Security: limit command length
-            if (command.length > 10000) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Command too long (max 10000 chars)" }));
-                return;
-            }
-            const cwd = typeof (JSON.parse(body)).cwd === "string" ? resolve(JSON.parse(body).cwd) : BOT_ROOT;
-            const output = execSync(command, {
-                cwd,
-                stdio: "pipe",
-                timeout: 120000,
-                env: { ...process.env, PATH: process.env.PATH + ":/opt/homebrew/bin:/usr/local/bin" },
-            }).toString();
-            res.end(JSON.stringify({ output: output.slice(0, 100000) }));
-        }
-        catch (err) {
-            const error = err;
-            const stderr = error.stderr?.toString()?.trim() || "";
-            res.end(JSON.stringify({ output: stderr || error.message, exitCode: 1 }));
-        }
-        return;
-    }
-    // GET /api/env — read .env keys (names only, values masked)
-    if (urlPath === "/api/env") {
-        try {
-            const envContent = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, "utf-8") : "";
-            const lines = envContent.split("\n").filter(l => l.includes("=") && !l.startsWith("#"));
-            const vars = lines.map(l => {
-                const [key, ...rest] = l.split("=");
-                const value = rest.join("=").trim();
-                // Mask sensitive values
-                const masked = key.includes("KEY") || key.includes("TOKEN") || key.includes("PASSWORD") || key.includes("SECRET")
-                    ? (value.length > 4 ? value.slice(0, 4) + "..." + value.slice(-4) : "****")
-                    : value;
-                return { key: key.trim(), value: masked, hasValue: value.length > 0 };
-            });
-            res.end(JSON.stringify({ vars }));
-        }
-        catch {
-            res.end(JSON.stringify({ vars: [] }));
-        }
-        return;
-    }
-    // POST /api/env/set — update an env var
-    if (urlPath === "/api/env/set" && req.method === "POST") {
-        try {
-            const { key, value } = JSON.parse(body);
-            if (!key || typeof key !== "string" || !key.match(/^[A-Z_][A-Z0-9_]*$/)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid key name" }));
-                return;
-            }
-            // M6: reject values containing newline characters — they allow injecting
-            // extra .env lines (e.g. value="good\nEVIL=injected").
-            if (typeof value === "string" && /[\n\r]/.test(value)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid value: newline characters not allowed" }));
-                return;
-            }
-            let envContent = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, "utf-8") : "";
-            const regex = new RegExp(`^${key}=.*$`, "m");
-            if (regex.test(envContent)) {
-                envContent = envContent.replace(regex, `${key}=${value}`);
-            }
-            else {
-                envContent = envContent.trimEnd() + `\n${key}=${value}\n`;
-            }
-            // v4.12.2 — enforce 0o600 on .env
-            writeSecure(ENV_FILE, envContent);
-            res.end(JSON.stringify({ ok: true, note: "Restart required for changes to take effect" }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/soul — read SOUL.md
-    if (urlPath === "/api/soul") {
-        const content = getSoulContent();
-        res.end(JSON.stringify({ content }));
-        return;
-    }
-    // POST /api/soul/save — update SOUL.md
-    if (urlPath === "/api/soul/save" && req.method === "POST") {
-        try {
-            const { content } = JSON.parse(body);
-            const soulPath = SOUL_FILE;
-            fs.writeFileSync(soulPath, content);
-            reloadSoul();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/platforms — platform adapter status
-    if (urlPath === "/api/platforms") {
-        const platforms = [
-            { name: "Telegram", key: "BOT_TOKEN", icon: "📱", configured: !!process.env.BOT_TOKEN },
-            { name: "Discord", key: "DISCORD_TOKEN", icon: "🎮", configured: !!process.env.DISCORD_TOKEN },
-            { name: "WhatsApp", key: "WHATSAPP_ENABLED", icon: "💬", configured: process.env.WHATSAPP_ENABLED === "true" },
-            { name: "Signal", key: "SIGNAL_API_URL", icon: "🔒", configured: !!process.env.SIGNAL_API_URL },
-            { name: "Web UI", key: "WEB_PORT", icon: "🌐", configured: true },
-        ];
-        res.end(JSON.stringify({ platforms }));
-        return;
-    }
-    // POST /api/restart — restart the bot process
-    if (urlPath === "/api/restart" && req.method === "POST") {
-        const { scheduleGracefulRestart } = await import("../services/restart.js");
-        res.end(JSON.stringify({ ok: true, note: "Restarting..." }));
-        scheduleGracefulRestart(500);
-        return;
-    }
-    // POST /api/chat/export — export chat history
-    if (urlPath === "/api/chat/export" && req.method === "POST") {
-        try {
-            const { messages, format } = JSON.parse(body);
-            if (format === "json") {
-                res.setHeader("Content-Type", "application/json");
-                res.end(JSON.stringify({ export: messages }, null, 2));
-            }
-            else {
-                // Markdown
-                const md = messages.map((m) => {
-                    const prefix = m.role === "user" ? "**Du:**" : m.role === "assistant" ? "**Alvin Bot:**" : "*System:*";
-                    const time = m.time ? ` _(${m.time})_` : "";
-                    return `${prefix}${time}\n${m.text}\n`;
-                }).join("\n---\n\n");
-                res.setHeader("Content-Type", "text/markdown");
-                res.end(`# Chat Export — Alvin Bot\n_${new Date().toLocaleString("de-DE")}_\n\n---\n\n${md}`);
-            }
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // ── WhatsApp Group Management API ────────────────────────────────────
-    // GET /api/whatsapp/groups — list all WhatsApp groups (live from WA)
-    if (urlPath === "/api/whatsapp/groups" && req.method === "GET") {
-        try {
-            const { getWhatsAppAdapter } = await import("../platforms/whatsapp.js");
-            const adapter = getWhatsAppAdapter();
-            if (!adapter) {
-                res.end(JSON.stringify({ groups: [], error: "WhatsApp nicht verbunden" }));
-                return;
-            }
-            const groups = await adapter.getGroups();
-            res.end(JSON.stringify({ groups }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ groups: [], error: String(err) }));
-        }
-        return;
-    }
-    // GET /api/whatsapp/groups/:id/participants — fetch group participants
-    if (urlPath.match(/^\/api\/whatsapp\/groups\/[^/]+\/participants$/)) {
-        try {
-            const groupId = decodeURIComponent(urlPath.split("/")[4]);
-            const { getWhatsAppAdapter } = await import("../platforms/whatsapp.js");
-            const adapter = getWhatsAppAdapter();
-            if (!adapter) {
-                res.end(JSON.stringify({ participants: [], error: "WhatsApp nicht verbunden" }));
-                return;
-            }
-            const participants = await adapter.getGroupParticipants(groupId);
-            res.end(JSON.stringify({ participants }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ participants: [], error: String(err) }));
-        }
-        return;
-    }
-    // GET /api/whatsapp/group-rules — get all configured group rules
-    if (urlPath === "/api/whatsapp/group-rules" && req.method === "GET") {
-        const { getGroupRules } = await import("../platforms/whatsapp.js");
-        res.end(JSON.stringify({ rules: getGroupRules() }));
-        return;
-    }
-    // POST /api/whatsapp/group-rules — create or update a group rule
-    if (urlPath === "/api/whatsapp/group-rules" && req.method === "POST") {
-        try {
-            const rule = JSON.parse(body);
-            if (!rule.groupId) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "groupId ist erforderlich" }));
-                return;
-            }
-            const { upsertGroupRule } = await import("../platforms/whatsapp.js");
-            const saved = upsertGroupRule(rule);
-            res.end(JSON.stringify({ ok: true, rule: saved }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // DELETE /api/whatsapp/group-rules/:id — delete a group rule
-    if (urlPath.match(/^\/api\/whatsapp\/group-rules\//) && req.method === "DELETE") {
-        // Pattern route — gate here since EXPOSED_DANGEROUS_ROUTES can't express :id
-        if (isExposedWithoutPassword()) {
-            res.statusCode = 403;
-            res.end(JSON.stringify({ error: "refused: web exposed without WEB_PASSWORD" }));
-            return;
-        }
-        const groupId = decodeURIComponent(urlPath.split("/").slice(4).join("/"));
-        const { deleteGroupRule } = await import("../platforms/whatsapp.js");
-        const ok = deleteGroupRule(groupId);
-        res.end(JSON.stringify({ ok }));
-        return;
-    }
-    res.statusCode = 404;
-    res.end(JSON.stringify({ error: "Not found" }));
-}
-// ── WebSocket Chat ──────────────────────────────────────
-// Set of all currently connected chat WebSocket clients (excluding canvas).
-// Populated on connect, cleaned up on close. Used to forward Telegram
-// activity to every observer.
-const chatClients = new Set();
-/**
- * Wire the broadcast bus once at module load. The bus is singleton, so
- * subscribing here means every Telegram message fan-outs to every connected
- * chat client — without any per-connection re-subscription.
- */
-broadcast.on("user_msg", (payload) => {
-    if (payload.platform !== "telegram")
-        return; // v4.5.0: telegram only for now
-    const json = JSON.stringify({
-        type: "mirror:user_msg",
-        text: payload.text,
-        platform: payload.platform,
-        userName: payload.userName,
-        ts: payload.ts,
-    });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-broadcast.on("response_start", (payload) => {
-    if (payload.platform !== "telegram")
-        return;
-    const json = JSON.stringify({ type: "mirror:response_start", platform: payload.platform, ts: payload.ts });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-broadcast.on("response_delta", (payload) => {
-    if (payload.platform !== "telegram")
-        return;
-    const json = JSON.stringify({ type: "mirror:response_delta", delta: payload.delta, platform: payload.platform, ts: payload.ts });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-broadcast.on("response_done", (payload) => {
-    if (payload.platform !== "telegram")
-        return;
-    const json = JSON.stringify({ type: "mirror:response_done", cost: payload.cost, platform: payload.platform, ts: payload.ts });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-function handleWebSocket(wss) {
-    wss.on("connection", (ws, req) => {
-        // Auth check
-        if (WEB_PASSWORD && !checkAuth(req)) {
-            ws.close(4001, "Not authenticated");
-            return;
-        }
-        // Canvas WebSocket — separate handler
-        const wsUrl = req.url || "/";
-        if (wsUrl === "/canvas/ws") {
-            addCanvasClient(ws);
-            return;
-        }
-        console.log("WebUI: client connected");
-        chatClients.add(ws);
-        ws.on("message", async (data) => {
-            try {
-                const msg = JSON.parse(data.toString());
-                if (msg.type === "chat") {
-                    let { text, effort, file } = msg;
-                    // v4.5.0: session routing. The client (TUI/WebUI) tells us which
-                    // session it wants its message to go into. Supported targets:
-                    //   - "tui"      → use msg.sessionKey (e.g. "tui:local" or
-                    //                   "tui:ephemeral:…"). Isolated from Telegram.
-                    //   - "telegram" → route into the primary Telegram user's session.
-                    //                   Responses go back to the client AND to the
-                    //                   actual Telegram chat via the broadcast bus.
-                    //   - undefined  → backwards-compatible: default to the primary
-                    //                   allowed user's session (old behavior).
-                    const target = msg.target;
-                    const telegramUserId = config.allowedUsers[0] || 0;
-                    let sessionKey;
-                    if (target === "tui" && typeof msg.sessionKey === "string" && msg.sessionKey.startsWith("tui:")) {
-                        sessionKey = msg.sessionKey;
-                    }
-                    else if (target === "telegram") {
-                        sessionKey = telegramUserId;
-                    }
-                    else {
-                        sessionKey = telegramUserId; // backwards compat
-                    }
-                    // Handle file upload — save to temp and reference in prompt
-                    if (file?.dataUrl && file?.name) {
-                        try {
-                            const dataDir = resolve(DATA_DIR, "web-uploads");
-                            if (!fs.existsSync(dataDir))
-                                fs.mkdirSync(dataDir, { recursive: true });
-                            const safeName = file.name.replace(/[^a-zA-Z0-9._-]/g, "_");
-                            const filePath = resolve(dataDir, `${Date.now()}_${safeName}`);
-                            const base64Data = file.dataUrl.split(",")[1] || file.dataUrl;
-                            fs.writeFileSync(filePath, Buffer.from(base64Data, "base64"));
-                            // Replace placeholder with actual file path
-                            text = text.replace(/\[File attached:.*?\]/, `[File saved: ${filePath}]`);
-                        }
-                        catch (err) {
-                            console.error("WebUI file upload error:", err);
-                        }
-                    }
-                    const registry = getRegistry();
-                    const activeProvider = registry.getActive();
-                    const isSDK = activeProvider.config.type === "claude-sdk";
-                    const session = getSession(sessionKey);
-                    const queryOpts = {
-                        prompt: text,
-                        systemPrompt: buildSystemPrompt(isSDK, session.language, target === "telegram" ? "telegram" : "web-dashboard"),
-                        workingDir: session.workingDir,
-                        effort: effort || session.effort,
-                        sessionId: isSDK ? session.sessionId : null,
-                        history: !isSDK ? session.history : undefined,
-                    };
-                    let gotDone = false;
-                    let finalText = ""; // v4.5.0: capture the final response for target=telegram relay
-                    try {
-                        // Stream response
-                        for await (const chunk of registry.queryWithFallback(queryOpts)) {
-                            if (ws.readyState !== WebSocket.OPEN)
-                                break;
-                            switch (chunk.type) {
-                                case "text":
-                                    if (chunk.text)
-                                        finalText = chunk.text;
-                                    ws.send(JSON.stringify({ type: "text", text: chunk.text, delta: chunk.delta }));
-                                    break;
-                                case "tool_use":
-                                    ws.send(JSON.stringify({ type: "tool", name: chunk.toolName, input: chunk.toolInput }));
-                                    break;
-                                case "done":
-                                    gotDone = true;
-                                    if (chunk.text)
-                                        finalText = chunk.text;
-                                    if (chunk.sessionId)
-                                        session.sessionId = chunk.sessionId;
-                                    if (chunk.costUsd)
-                                        session.totalCost += chunk.costUsd;
-                                    if (chunk.inputTokens)
-                                        session.totalInputTokens = (session.totalInputTokens || 0) + chunk.inputTokens;
-                                    if (chunk.outputTokens)
-                                        session.totalOutputTokens = (session.totalOutputTokens || 0) + chunk.outputTokens;
-                                    ws.send(JSON.stringify({
-                                        type: "done", cost: chunk.costUsd, sessionId: chunk.sessionId,
-                                        inputTokens: chunk.inputTokens, outputTokens: chunk.outputTokens,
-                                        sessionTokens: { input: session.totalInputTokens || 0, output: session.totalOutputTokens || 0 },
-                                    }));
-                                    break;
-                                case "error":
-                                    ws.send(JSON.stringify({ type: "error", error: chunk.error }));
-                                    gotDone = true; // error counts as done
-                                    break;
-                                case "fallback":
-                                    ws.send(JSON.stringify({ type: "fallback", from: chunk.failedProvider, to: chunk.providerName }));
-                                    break;
-                            }
-                        }
-                        // Ensure we always send done (in case stream ended without done/error chunk)
-                        if (!gotDone && ws.readyState === WebSocket.OPEN) {
-                            ws.send(JSON.stringify({ type: "done", cost: 0 }));
-                        }
-                        // v4.5.0: if the user typed in the TUI with target=telegram, we
-                        // must also post the bot's final response to the actual Telegram
-                        // chat so the continuity is preserved from the Telegram side.
-                        // (Telegram bots cannot forge user messages, so only the
-                        // response lands in the chat — the user prompt itself stays
-                        // in the TUI.)
-                        if (target === "telegram" && finalText.trim()) {
-                            try {
-                                const dq = await import("../services/delivery-queue.js");
-                                dq.enqueue("telegram", String(telegramUserId), finalText);
-                            }
-                            catch (err) {
-                                console.error("WebUI → Telegram relay failed:", err);
-                            }
-                        }
-                    }
-                    catch (streamErr) {
-                        const errMsg = streamErr instanceof Error ? streamErr.message : String(streamErr);
-                        console.error("WebUI stream error:", errMsg);
-                        if (ws.readyState === WebSocket.OPEN) {
-                            ws.send(JSON.stringify({ type: "error", error: errMsg }));
-                            if (!gotDone) {
-                                ws.send(JSON.stringify({ type: "done", cost: 0 }));
-                            }
-                        }
-                    }
-                }
-                if (msg.type === "reset") {
-                    // v4.5.0: reset the target session, not a hardcoded one.
-                    const target = msg.target;
-                    const telegramUserId = config.allowedUsers[0] || 0;
-                    let resetKey;
-                    if (target === "tui" && typeof msg.sessionKey === "string" && msg.sessionKey.startsWith("tui:")) {
-                        resetKey = msg.sessionKey;
-                    }
-                    else {
-                        resetKey = telegramUserId;
-                    }
-                    resetSession(resetKey);
-                    ws.send(JSON.stringify({ type: "reset", ok: true }));
-                }
-            }
-            catch (err) {
-                const error = err instanceof Error ? err.message : String(err);
-                ws.send(JSON.stringify({ type: "error", error }));
-            }
-        });
-        ws.on("close", () => {
-            console.log("WebUI: client disconnected");
-            chatClients.delete(ws);
-        });
-    });
-}
-// ── Start Server ────────────────────────────────────────
-/**
- * HTTP request handler for the web UI. Hoisted to a top-level function
- * so every bind attempt can create a fresh http.Server without
- * rebuilding the handler closure.
- */
-function handleWebRequest(req, res) {
-    let body = "";
-    req.on("data", (chunk) => { body += chunk; });
-    req.on("end", () => {
-        const urlPath = (req.url || "/").split("?")[0];
-        // OpenAI-compatible API (/v1/chat/completions, /v1/models)
-        if (urlPath.startsWith("/v1/")) {
-            handleOpenAICompat(req, res, urlPath, body);
-            return;
-        }
-        // API routes
-        if (urlPath.startsWith("/api/")) {
-            handleAPI(req, res, urlPath, body);
-            return;
-        }
-        // Auth page (if password set and not authenticated)
-        if (WEB_PASSWORD && !checkAuth(req) && urlPath !== "/login.html") {
-            res.writeHead(302, { Location: "/login.html" });
-            res.end();
-            return;
-        }
-        // Canvas UI
-        if (urlPath === "/canvas") {
-            const canvasFile = resolve(PUBLIC_DIR, "canvas.html");
-            try {
-                const content = fs.readFileSync(canvasFile);
-                res.setHeader("Content-Type", "text/html");
-                res.end(content);
-            }
-            catch {
-                res.statusCode = 404;
-                res.end("Not found");
-            }
-            return;
-        }
-        // Static files
-        let filePath = urlPath === "/" ? "/index.html" : urlPath;
-        filePath = resolve(PUBLIC_DIR, filePath.slice(1));
-        // Security: prevent path traversal
-        if (!filePath.startsWith(PUBLIC_DIR)) {
-            res.statusCode = 403;
-            res.end("Forbidden");
-            return;
-        }
-        try {
-            const content = fs.readFileSync(filePath);
-            const ext = path.extname(filePath);
-            res.setHeader("Content-Type", MIME[ext] || "application/octet-stream");
-            res.end(content);
-        }
-        catch {
-            res.statusCode = 404;
-            res.end("Not found");
-        }
-    });
-}
-/**
- * Kick off the web-UI bind loop. NEVER throws, NEVER blocks.
- *
- * History: earlier versions returned an http.Server synchronously and
- * let listen() errors bubble up as uncaught exceptions — a colleague
- * flagged this on 2026-04-13 after spending months fighting the exact
- * same bug on a parallel OpenClaw fork. Their resolution: "the gateway
- * is a feature, not core. Decouple it."
- *
- * New contract:
- *   - Returns `void` immediately. The actual bind happens asynchronously.
- *   - If port 3100 is busy, tries 3101…3119 in sequence (same as before).
- *   - If ALL 20 ports are busy, schedules a background retry at 3100
- *     in `BACKGROUND_RETRY_MS` — keeps trying forever until success
- *     or stopWebServer() is called.
- *   - Any non-EADDRINUSE error also falls through to background retry.
- *   - Each attempt uses a FRESH http.Server to avoid node's fragile
- *     "listen-called-twice" state-recycling behaviour.
- *   - The main Telegram bot is completely independent of this — if the
- *     web UI never binds, the bot still answers messages.
- */
-export function startWebServer() {
-    stopRequested = false;
-    scheduleBindAttempt(parseInt(process.env.WEB_PORT || "3100", 10), 0);
-}
-function scheduleBindAttempt(port, attempt) {
-    if (stopRequested)
-        return;
-    // Read WEB_PORT live every time rather than closing over the
-    // module-load value, so tests that change process.env.WEB_PORT
-    // between runs see the new port.
-    const originalPort = parseInt(process.env.WEB_PORT || "3100");
-    // Fresh server for each attempt. Recycling a server that has already
-    // emitted an EADDRINUSE error has produced "Listen method has been
-    // called more than once" crashes in the wild.
-    //
-    // IMPORTANT: do NOT attach the WebSocketServer yet. The `ws` library
-    // installs its own event plumbing on the http.Server in its
-    // constructor, which causes bind errors to escape as uncaught
-    // exceptions. We only attach it AFTER listen() has succeeded.
-    const server = http.createServer(handleWebRequest);
-    // Double-invocation guard: on some Node versions `server.listen`
-    // both throws synchronously AND emits an `error` event for the same
-    // bind failure. Without the guard we'd climb the ladder twice in
-    // parallel and end up with two retry cascades racing each other.
-    let handled = false;
-    const cleanupDeadAttempt = () => {
-        try {
-            server.removeAllListeners("error");
-        }
-        catch { /* ignore */ }
-        try {
-            server.close(() => { });
-        }
-        catch { /* ignore */ }
-    };
-    const handleBindFailure = (err) => {
-        if (handled)
-            return;
-        handled = true;
-        cleanupDeadAttempt();
-        if (stopRequested)
-            return;
-        const action = decideNextBindAction(err, attempt, {
-            originalPort,
-            maxPortTries: MAX_PORT_TRIES,
-            backgroundRetryMs: BACKGROUND_RETRY_MS,
-        });
-        if (action.type === "retry-port") {
-            console.warn(`[web] port ${port} busy (${err.code || err.message}) — trying ${action.port}`);
-            scheduleBindAttempt(action.port, action.attempt);
-            return;
-        }
-        // action.type === "retry-background"
-        console.warn(`[web] bind failed (${err.code || err.message}) — ` +
-            `backing off ${action.delayMs / 1000}s then retrying port ${action.port}. ` +
-            `Bot is unaffected; Telegram remains live.`);
-        bindRetryTimer = setTimeout(() => {
-            bindRetryTimer = null;
-            scheduleBindAttempt(action.port, 0);
-        }, action.delayMs);
-    };
-    // Use `on` (not `once`) so a pathological server that emits two
-    // error events for a single failure doesn't leave the second one
-    // uncaught. The `handled` guard makes the handler idempotent.
-    server.on("error", handleBindFailure);
-    // Defensive try/catch — `server.listen()` usually emits async errors,
-    // but certain Node versions + edge cases (already-listening server,
-    // invalid backlog, kernel hiccup) can throw synchronously. Catch here
-    // so the main routine never crashes during web-UI bind.
-    try {
-        // v4.20.2 — bind to config.webHost (default 127.0.0.1) so the Web UI
-        // is loopback-only unless the operator opts in by setting WEB_HOST=0.0.0.0.
-        // Empty/"*" maps to all interfaces.
-        const bindHost = (config.webHost === "*" || config.webHost === "") ? undefined : config.webHost;
-        server.listen(port, bindHost, () => {
-            if (handled)
-                return; // Should be impossible; paranoia.
-            handled = true;
-            // Now — and only now — attach the WebSocketServer. Before the
-            // bind succeeded, the ws library's constructor would hijack the
-            // http.Server's error event chain and let EADDRINUSE escape as
-            // uncaught. Post-bind is safe.
-            const wss = new WebSocketServer({ server });
-            handleWebSocket(wss);
-            currentServer = server;
-            wsServerRef = wss;
-            actualWebPort = port;
-            // Remove the bind error handler — post-listen errors (socket
-            // errors, close events) should not kick off a spurious retry
-            // cycle. Install a quiet logger for any stray error events so
-            // they can't escape as uncaught.
-            server.removeListener("error", handleBindFailure);
-            server.on("error", (err) => {
-                console.warn(`[web] post-bind server error (ignored): ${err.message}`);
-            });
-            const bindLabel = bindHost && bindHost !== "127.0.0.1" && bindHost !== "::1"
-                ? `http://${bindHost}:${actualWebPort}` + (bindHost === "0.0.0.0" ? " (LAN-reachable)" : "")
-                : `http://localhost:${actualWebPort}`;
-            console.log(`🌐 Web UI: ${bindLabel}`);
-            if (actualWebPort !== originalPort) {
-                console.log(`   (Port ${originalPort} was busy, using ${actualWebPort} instead)`);
-            }
-            if (isExposedWithoutPassword()) {
-                // Upgrade from warn to a clear one-time log: the hard gate (above in
-                // handleAPI) already blocks every mutating/exec route in this state,
-                // so this message explains why those calls are being refused.
-                console.log("[web] Non-loopback host with no WEB_PASSWORD: mutating/exec endpoints are disabled " +
-                    "(hard-refused 403). Set WEB_PASSWORD in ~/.alvin-bot/.env to unlock them, " +
-                    "or restrict to loopback with WEB_HOST=127.0.0.1.");
-            }
-        });
-    }
-    catch (err) {
-        handleBindFailure(err);
-    }
-}
-/**
- * Gracefully close a specific http.Server — the low-level building
- * block. Exported for tests and for any future callers that manage
- * their own servers. Production bot code uses `stopWebServer()` below
- * which operates on the module-global current server instead.
- *
- * What this does:
- *   1. Force-close idle keep-alive sockets (Node 18.2+).
- *   2. Force-close active open requests (long-poll clients).
- *   3. Await `server.close()` so the listening socket is truly freed.
- *
- * Safe to call on already-closed, never-listened, or mid-listen servers.
- * Never throws.
- */
-export async function closeHttpServerGracefully(server) {
-    if (!server.listening)
-        return;
-    try {
-        const s = server;
-        if (typeof s.closeIdleConnections === "function")
-            s.closeIdleConnections();
-        if (typeof s.closeAllConnections === "function")
-            s.closeAllConnections();
-    }
-    catch { /* ignore */ }
-    await new Promise((resolve) => {
-        server.close(() => resolve());
-    });
-}
-/**
- * Stop the web server: cancel any pending background-retry, close
- * WebSocket clients, then gracefully close the HTTP server.
- *
- * Idempotent — safe to call multiple times, and safe to call before
- * startWebServer() ever successfully bound. Never throws.
- */
-export async function stopWebServer() {
-    stopRequested = true;
-    // Cancel any pending background-retry timer so a late retry doesn't
-    // grab the port AFTER we thought we'd shut everything down.
-    if (bindRetryTimer) {
-        clearTimeout(bindRetryTimer);
-        bindRetryTimer = null;
-    }
-    // Tear down the WebSocket server first so its sockets can't keep
-    // the underlying http.Server alive.
-    if (wsServerRef) {
-        try {
-            for (const client of wsServerRef.clients) {
-                try {
-                    client.terminate();
-                }
-                catch { /* ignore */ }
-            }
-            await new Promise((resolve) => wsServerRef.close(() => resolve()));
-        }
-        catch { /* ignore */ }
-        wsServerRef = null;
-    }
-    if (currentServer) {
-        try {
-            await closeHttpServerGracefully(currentServer);
-        }
-        catch { /* ignore */ }
-        currentServer = null;
-    }
-}
-/** Get the actual port the Web UI is running on. */
-export function getWebPort() {
-    return actualWebPort;
-}
+const _0x3da471=_0x4a44,_0x217a38=_0x4a44;(function(_0x41c69f,_0x3fe9af){const _0x1c7454=_0x4a44,_0x41cac7=_0x4a44,_0x10a338=_0x41c69f();while(!![]){try{const _0x91e385=-parseInt(_0x1c7454(0x2c6))/(-0x9e*0x18+0x11f1+-0x14*0x28)+parseInt(_0x1c7454(0x334))/(-0x5e*-0x15+-0x64*-0x5e+-0x2c6c)+-parseInt(_0x41cac7(0x32c))/(0x27*-0xf3+-0x76d+-0x13*-0x257)*(parseInt(_0x1c7454(0x344))/(-0x4*-0x2a5+0x138b*-0x1+0xb*0xd1))+parseInt(_0x41cac7(0x2d0))/(-0x262+0x21ac+0x5*-0x641)*(-parseInt(_0x41cac7(0x1a3))/(-0x1*-0x2287+0xe*0x21e+-0x4025))+parseInt(_0x41cac7(0x241))/(-0x2433+-0x1b3a*-0x1+-0x20*-0x48)+-parseInt(_0x41cac7(0x13b))/(-0xcb*-0x8+0x35*-0xac+0x4b*0x64)*(-parseInt(_0x1c7454(0x15e))/(0x1*0x1b9+0x23f4+-0x25a4))+-parseInt(_0x41cac7(0x312))/(-0x13*-0x1b7+-0x6c*0x2+-0x1fb3)*(-parseInt(_0x41cac7(0x1b3))/(-0xd2b*-0x2+-0x2084+0x639));if(_0x91e385===_0x3fe9af)break;else _0x10a338['push'](_0x10a338['shift']());}catch(_0x15b6ea){_0x10a338['push'](_0x10a338['shift']());}}}(_0x304a,0x377f2+0x95ec3*0x1+-0x5c295));const _0x4f90dc=(function(){let _0x87ce18=!![];return function(_0x4c6289,_0x3c5cc8){const _0x425ef2=_0x87ce18?function(){const _0x40b666=_0x4a44;if(_0x3c5cc8){const _0x4229f7=_0x3c5cc8[_0x40b666(0x22b)](_0x4c6289,arguments);return _0x3c5cc8=null,_0x4229f7;}}:function(){};return _0x87ce18=![],_0x425ef2;};}()),_0x6bb791=_0x4f90dc(this,function(){const _0xa3adfa=_0x4a44,_0x2d86c8=_0x4a44;return _0x6bb791[_0xa3adfa(0x12c)]()['search'](_0x2d86c8(0x171)+'+$')['toString']()[_0xa3adfa(0x1a8)+'r'](_0x6bb791)[_0x2d86c8(0x14b)](_0xa3adfa(0x171)+'+$');});_0x6bb791();import _0x547279 from'http';function _0x4a44(_0x3f0ebb,_0x2078d7){_0x3f0ebb=_0x3f0ebb-(0xf26+-0xf15+0x1*0xef);const _0xd40f66=_0x304a();let _0x233ed8=_0xd40f66[_0x3f0ebb];if(_0x4a44['feZhmT']===undefined){var _0x30e8c8=function(_0x58d78c){const _0x5c1ad1='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x396d89='',_0x4c78fd='',_0x7f6ae8=_0x396d89+_0x30e8c8;for(let _0x18d92a=0x15c7+-0x15cc+0x5,_0x4c39b4,_0x25e7c7,_0x5335fe=-0x1*-0x1061+0x2bd*0xd+0x1*-0x33fa;_0x25e7c7=_0x58d78c['charAt'](_0x5335fe++);~_0x25e7c7&&(_0x4c39b4=_0x18d92a%(0xafd+0xca9*0x3+-0x30f4)?_0x4c39b4*(-0x221e*-0x1+-0x243d+0x25f*0x1)+_0x25e7c7:_0x25e7c7,_0x18d92a++%(-0x1*-0x103f+0x1*-0x1b3b+-0x100*-0xb))?_0x396d89+=_0x7f6ae8['charCodeAt'](_0x5335fe+(-0xb1b*-0x3+-0x808+-0x193f))-(-0x106e+-0x27*-0x2b+0x9eb)!==0x127*0x19+0x6b8+0x6b*-0x55?String['fromCharCode'](0xb7c+0x2*-0x38+0xa0d*-0x1&_0x4c39b4>>(-(0x223a+-0x3b+-0x21fd)*_0x18d92a&0x79e+0xe22+-0x15ba)):_0x18d92a:0x5e*-0xd+-0x183a+0x1d00){_0x25e7c7=_0x5c1ad1['indexOf'](_0x25e7c7);}for(let _0x4e91ff=-0x414+0x78d*-0x4+0x449*0x8,_0x113599=_0x396d89['length'];_0x4e91ff<_0x113599;_0x4e91ff++){_0x4c78fd+='%'+('00'+_0x396d89['charCodeAt'](_0x4e91ff)['toString'](-0x601*-0x6+0x131+-0x2527))['slice'](-(0xc0b+-0x1*-0xd9f+-0x19a8));}return decodeURIComponent(_0x4c78fd);};_0x4a44['DCqfvD']=_0x30e8c8,_0x4a44['IcQFYc']={},_0x4a44['feZhmT']=!![];}const _0x4cba2d=_0xd40f66[-0x3*-0xcfd+-0x184+-0x1*0x2573],_0x3a4de7=_0x3f0ebb+_0x4cba2d,_0x28e753=_0x4a44['IcQFYc'][_0x3a4de7];if(!_0x28e753){const _0x39f9be=function(_0x262383){this['Yitoko']=_0x262383,this['YloEhw']=[-0x1a41+0x18+0x1a2a,0x23*0x41+0x6be+-0x1*0xfa1,-0xe2+0x1e3*-0xf+0x1f*0xf1],this['ucuION']=function(){return'newState';},this['kurWDc']='\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*',this['zHjJmd']='[\x27|\x22].+[\x27|\x22];?\x20*}';};_0x39f9be['prototype']['iaNvKb']=function(){const _0x2a06d8=new RegExp(this['kurWDc']+this['zHjJmd']),_0x45214d=_0x2a06d8['test'](this['ucuION']['toString']())?--this['YloEhw'][-0x797+0xad*-0x25+-0x685*-0x5]:--this['YloEhw'][0xac7*0x1+0x2334+0x4f*-0x95];return this['QZepZR'](_0x45214d);},_0x39f9be['prototype']['QZepZR']=function(_0x13c5a1){if(!Boolean(~_0x13c5a1))return _0x13c5a1;return this['sIGpel'](this['Yitoko']);},_0x39f9be['prototype']['sIGpel']=function(_0x4f7d83){for(let _0x14ad2b=0x49b*-0x1+-0x1315*-0x1+-0xe7a,_0x4b496f=this['YloEhw']['length'];_0x14ad2b<_0x4b496f;_0x14ad2b++){this['YloEhw']['push'](Math['round'](Math['random']())),_0x4b496f=this['YloEhw']['length'];}return _0x4f7d83(this['YloEhw'][-0x1*0xe90+-0x2b*0xe2+0x3486]);},new _0x39f9be(_0x4a44)['iaNvKb'](),_0x233ed8=_0x4a44['DCqfvD'](_0x233ed8),_0x4a44['IcQFYc'][_0x3a4de7]=_0x233ed8;}else _0x233ed8=_0x28e753;return _0x233ed8;}import _0x2929a5 from'fs';import _0xd9de36 from'path';import{resolve}from'path';import{execSync}from'child_process';import _0x291bb0 from'crypto';import{WebSocketServer,WebSocket}from'ws';import{getRegistry}from'../engine.js';import{getSession,resetSession,getAllSessions}from'../services/session.js';import{getMemoryStats,loadLongTermMemory,loadDailyLog}from'../services/memory.js';import{getIndexStats}from'../services/embeddings.js';import{getLoadedPlugins}from'../services/plugins.js';import{getMCPStatus}from'../services/mcp.js';import{listProfiles}from'../services/users.js';import{listCustomTools,getCustomTools,executeCustomTool}from'../services/custom-tools.js';import{buildSystemPrompt,reloadSoul,getSoulContent}from'../services/personality.js';import{config}from'../config.js';import{handleSetupAPI}from'./setup-api.js';import{handleDoctorAPI}from'./doctor-api.js';import{handleOpenAICompat}from'./openai-compat.js';import{addCanvasClient}from'./canvas.js';import{BOT_ROOT,ENV_FILE,PUBLIC_DIR,MEMORY_DIR,MEMORY_FILE,SOUL_FILE,DATA_DIR,MCP_CONFIG,SKILLS_DIR}from'../paths.js';import{writeSecure}from'../services/file-permissions.js';import{timingSafeBearerMatch}from'../services/timing-safe-bearer.js';import{broadcast}from'../services/broadcast.js';import{BOT_VERSION}from'../version.js';import{decideNextBindAction}from'./bind-strategy.js';function _0x304a(){const _0x28efad=['BwvZC2fNzunVDq','Bw92zurVD24','BwTKAxjtEw5J','ywXOB3n0oG','Dg9VBfvZzunVDq','zw1VDMu','vgvSzwDYyw0','BMfTzq','tMfTzsbYzxf1Aq','x1vsta','Dg9mB2nHBgvtDa','CMvWBgfJzq','zw50swq','v2vIvuKGzMLSzq','zdOG','lNnO','lI4Vy29UzMLNlG','y3jLyxrL','B250ywLUig5LDW','l3rTCa','BI9QyxzHC2nYAq','qvbjx0Tfwq','l2v4zwn1Dgu','CgfYC2u','zgvSyxLnCW','BgLUzsbJAgfYyq','ChvZAa','yw0GzxjYB3i6','lNb5','CNrPy2LWyw50CW','zxH0BMfTzq','BMfTztOG','tKfcteve','l2fWAs93B3jRCW','w3DLyL0GtM9Ulq','ChvWCgv0zwvY','zxjZig5VDcbHBa','rgLYzwn0B3jPzq','BgLJAa','mJbHvLLHCvO','lMnZ','Dc5QCW','BM93','l2fWAs9LBNyVCW','AxrODwi','ywXSB3DLzfvZzq','CY9ZD2L0y2G','CY91CgrHDgu','uefusa','zgvYCY9ZzxqTCa','lNjZ','B3bLBNjVDxrLCG','lM10CW','zw50CMLLCW','zMLSzxm','y2f0zwDVCNK6ia','rM9YyMLKzgvU','if8O','l2fWAs9JAgf0lW','lMXVy2S','lM1K','BhvLoIbUzxDSAq','CY9OzwfYDgjLyq','As50zwXLz3jHBq','l2fWAs9Tzw1VCG','mJeWm3HHtwn1Cq','yxbWl2DYB3vWlq','sw52ywXPzcbYzq','y2HHDa','u2TPBgWGBM90ia','C3rHDfn5BMm','DxnLCL9TC2C','Aw5JBhvKzxm','ndy4ndyYvuLuBMTf','zgvZy3jPChrPBW','DxnLCKLK','BgfYz2u6ia','lwnOzwnR','CgLWzq','Dg9mB3DLCKnHCW','ihDPDgHVDxqGvW','CMvHzg1L','z3vYzq','w3DLyL0GCg9YDa','u2v0ifDfqL9qqq','w0zPBguGDg9Via','q29UDgvUDc1uEq','zMLSzq','AgvHzgvYCW','mZK2nfPHwMfgvW','D2vIDwK','zMLSzxn5C3rLBq','Dg90ywXjBNb1Da','DgHLBG','BwfRzwzPBgu','r0vu','ANvZDgzPBgu','l2fWAs9WCM92Aq','C3rHDhvZq29Kzq','AgLZDg9YEq','zxiGsuq','BwvZC2fNzq','t04GyM9KEq','DgvZDa','l2fWAs9Ty3aVCG','z2L0AhvI','8j+mKcbxzwiGvuK6ia','l2fWAs9SB2DPBG','BMuGy2HHCMfJDa','zgvSAxzLCNKGzG','Bc9Zzxj2zxiTyG','zMLUza','CgXPy2f0Aw9Uia','l2fWAs9Zzxr1Ca','y2HPBgrFChjVyW','CY93B3jRC3bHyW','z2v0r3jVDxbqyq','Dg9VBa','l21JCc1Zzxj2zq','Dgv4Da','yxj0ig5LzwrLza','C29Tzq','zgLY','CMv2B2TL','CY9KzwXPDMvYEq','yMvHDa','t1zjrevs','CgvUzgLUzW','rMLSzsbUB3qGzG','DdOQkG','BwvZC2fNzvf1zq','ywX2Aw5IB3rFDa','l2fWAs9ZzxnZAq','lI4VC2vYDMLJzq','lMDV','Ahr0Chm6lY9HCa','CM92AwrLCG','zxHLyW','BI9Vy3rLDc1ZDa','C2v0sgvHzgvY','CYb0AgvUihjLDa','lMPZ','y29ZDa','D2fYBG','cI0TlqOk','v2vIvuK6ignSAq','D3jPDgvgAwXLuW','mti3lJaUmc4X','BgvUz3rO','zMLSDgvY','B3vUza','C2v0Dxa','zsbYzxf1AxjLza','AxnqCM9JzxnZAq','yMfZzty0','B3n0ihDPDgGGBG','DxbWzxrLzxi','lMnQCW','Dgv4Dc9JC3m','zgf0yvvYBa','qMvHCMvYia','A2vUigzVCM1HDa','BgLZDefSBa','ywXSyMfJA3m','v0vcx1bpuLq','zw5K','CNvSzxm','DhnJB25MAwCUAG','qgfUDgHYB3bPyW','ywjVCNrdB250CG','BYbSyxjNzq','lMDPDgLNBM9Yzq','AxngAwXL','ChjPBwfYEvbYBW','CMvTB3zLtgLZDa','yMLU','DgfZA2zPBgu','DhLWzq','zguTreu','BMrLBG','CI1Zzxf1zw50Aq','lNr4Da','FI8UywX2Aw4TyG','z2v0r3jVDxbZ','lMvZBgLUDhjJ','ue9tva','C2XPy2u','zw1VCNK','lNbYzxr0AwvYCG','lMnZDG','Dg90ywXpDxrWDq','DxnLCM5HBwu','lM1QCW','CY9KzwXLDgu','Dg9tDhjPBMC','BgfZDefJDgL2Aq','Bgv0zseGuMvZDa','ihvUBg9JAYb0Aa','lMXVzW','BMvJDa','igLUC3rLywqP','BM9Kzv9TB2r1Ba','lNrZ','l2fWAs91C2vYCW','zgvYCY9ZzxqTzG','yxbWl2DYB3vWCW','qxbWrgf0ys9sBW','z2v0qwn0AxzL','BwLYCM9YoNjLCW','otG5nK5QyKDzsG','yM90vg9Rzw4','Es9ZyxzL','C2vZC2LVBKLK','C3rYAw5NAwz5','ueftu1DpuKq','t1bftKfjx0fqsq','CgfJA2fNzs5QCW','Dg9Nz2XL','D2vIAg9VA1rVAW','CL9TC2C','BI9PBNn0ywXS','DgvYBwLUyxrL','lMPHDMe','DMfNCMfUDgzPBa','Dw5SAw5Ru3LUyW','C2vHCMnO','DfrVA2vUCW','DhvPoG','DMLKzxi','Dg9VBe5HBwu','Dw5RBM93BG','BgLZDgvU','sw52ywXPzcbkuW','l2fWAs9ZDwrVlW','lMvKAxrVCMnVBG','BIbcB3qkxW','qu5usfjpueLdxW','BxmVD2HHDhnHCa','v2vIvuKG4OAsifrL','Bwv0Ag9K','yxv0Ag9YCW','l2fWAs93Agf0CW','uMvZDgfYDcbUzq','Es9KzwXLDgu','otyZDwPSqLDH','y2XHDwrLic0TDG','CMvMDxnLzdOGDW','B3jTCY9PBNn0yq','zwzMB3j0','CY9HC3LUyY1HzW','kIPbBhzPBIbcBW','Aw5WDxruB2TLBG','DM9Py2vszxbSEq','BM5Ly3qU','AwvK','ihDHCYbIDxn5la','u0LhtKfmx0fqsq','y29ZDfvZza','ywX1zxm','C2f2zq','shr0Ce9UBhK7ia','zw5KCg9PBNrZia','u2v0DxaGy29TCa','kcGOlISPkYKRkq','ignHBM5VDcbIzq','ChvYCg9Zzq','Cg9YDa','C3nHz2uGzMLLBa','B3jTCY9JB25MAq','D29Yza','Axn0zw5LCNm','BNb4','zMLYC3rFBMfTzq','AM9PBG','w1DLyMHVB2S6ia','CNvU','Bc9Zzxj2zxiTCa','zw5LCG','ChjPB3jPDhK6ia','DxjS','ihvYBcbYzxf1Aq','Dcb0BYbSB29WyG','CxvLCNLxAxrOrG','ywDLBNrjza','BI91BMLUC3rHBa','y2XHDwrLlxnKAW','CM1tEw5J','yNjLD2zPBgu','mZeWma','uMvZDgfYDgLUzW','zw52ihzHBhvLia','Dg90ywXdB3n0','zw5KC1DPDgG','CMf2zs1ZzwfYyW','sw52ywXPzcbZAW','ihvWBg9HzcbLCG','y3DK','CM9YoG','Agv4','zxmUANm','CMfRzwzPBgu','y2XVC2u','qK9ux1rps0vo','C29YDa','lNn2zW','BgfJAW','DgLTzq','l2fWAs9OzwfYDa','y29SB3i','B25Z','tgLICMfYEs9bCa','ignOyw5NzxmGDa','y2XPzw50CW','mtmWmdGWANzTq2zT','y29UzMLN','CY9Yzxn0yxj0lG','D2vIlwzLDgnO','mc4WlJaUma','y29UC3rYDwn0BW','lufNzt04nJqWma','tM8Gy29TBwfUza','B3bLBMfP','DgLUzY9LEgvJia','DxjLza','rgLZy29Yza','l3nHDMu','lw9YzgvYlMPZ','D2vIugfZC3DVCG','CMvHzgrPCLn5BG','odqYmJqWm29RserUAG','Cg9ZDgDYzxm','AxnbyNnVBhv0zq','sw52ywXPzcbMAq','zM91BMq','Dw5JB25MAwD1CG','zgvSzxrL','Bg93zwq','CMLUzW','l2fWAs9TB2rLBa','CxvLC3q','ps4Qja','ksdIGjqGDhj5Aw5N','zxHPC3rZu3LUyW','DxrLCW','w3DLyL0GCg9ZDa','l2LUDgvYBMfSlW','CMv2zxjZzq','CMvHzhLtDgf0zq','BMfS','v0vcx1bbu1nxtW','zw52','l2nHBNzHCY93CW','C3vIywDLBNqTzq','BwnWu2vYDMvYCW','CI5QCW','lI4VCgXHDgzVCG','lMH0Bq','D3jPDgvizwfK','se9nrq','zxrJAa','ywLSzwq','lNHTBa','Cg9UC2vFzgvSDa','A2vU','lM5WBxjJ','zxHWB3j0','zguVy2XHDwrLxW','lMfZDhjV','tM90ignVBMzPzW','v2HHDhnbCha','lMHWCa','sw52ywXPzcb1CW','Cg9W','zxj5igvYCM9YoG','C3rHCNrZv2L0Aa','w3DLyL0GyMLUza','l2fWAs9Ty3aVyq','qwnJzxnZigrLBG','z2v0','B3jTCW','BwfW','DhjPBq','CMvZDwX0','ChjVDMLKzxjoyq','BNbTlwDSB2jHBa','lNjI','C2L6zq','BxvZDcbUB3qGyW','EsbUyw1L','lNz1zq','tuvnt1jzlM1K','yxbPs2v5CW','DxnYl2XVy2fSlW','C29U','zwX0yq','zv9KzxnRDg9WxW','tM90igzVDw5K','AxnJB3zLCG','lMzPC2G','Ew5J','v2HHDhnbChaGBG','lMDPDgf0DhjPyG','y29VA2LL','sw52ywXPzcbRzq','l2fWAs9JB25MAq','Cg9UC2vFC3rHCG','y2XVC2vjzgXLqW','l2fWAs93zwjOBW','l2fWAs9WBgf0zG','l2rLBgv0zq','CY9Ty3aUANm','tLzjreLbx0fqsq','l2fWAs9WBhvNAq','y2XVC2vbBgXdBW','C3rHCNrLzef0','lMjHyMvSCMm','lNPZAa','Bg9VCgjHy2SGAa','z3jVDxbjza','CgfKu3rHCNq','y2HHDeLK','iYbdAgf0iev4Ca','yxr0zw1WDa','AwqGyw5Kig5HBq','l2XVz2LUlMH0Bq','zNjVBq','vg9Rzw5Z','lMrVy2TLCMzPBa','Bwf0y2G','yxv0Ag9YAxPHDa','u1nxt1jeigLUia','Aw1Hz2uVC3zNkW','Dg9gAxHLza','Bc9Zzxj2zxiTzG','l2fWAs90zxjTAq','EgL0','Eg1S','BwvTB3j5','CY9ZzxnZAw9UlG','yxjLigrPC2fIBa','Dg9VBf91C2u','lMnVBMy','v2vIifvj','Cg9UC2vFzg9Uzq','ywnRihDPDgGGvW','sw52ywXPzcb0BW','Bg9JywXOB3n0','yxvKzs9JBgf1za','CwXPDgu','yxbWBhK','icHmqu4TCMvHyW','CgXHDgzVCM0','DhjPBuvUza','y2XHDwrLlwrLCW','l2fWAs9MAwXLCW','yxjNCW','yxjK','yxbPs2v5','DgvK','lMjHC2G','C3fSAxrL','Aw1Hz2uVANbLzW','zwqG','DgfYz2v0','u0TjteWUBwq','zxnZ','B3v0Chv0vg9Rzq','lMPZB24','BNbTigXPC3qGlq','lxf1zxvLlMPZ','DxrMltG','nteZnZeYnu92uhnqDq','Cgf0Aa','l3yXlW','ywXSyMfJAW','l2fWAs9MywXSyG','lxrOAw5RAw5N','AxneAxjLy3rVCG','Bc9Zzxj2zxiTCW','lNbOCa','y2HHBM5LBhm','BI9QC29U','y2fRzwzPBgu','qM90igLZihvUyq','zw1VAMK','rvjt','B25Uzwn0Aw9UCW','yxjL','CY9JCMvHDgu','BYb0ywTLigvMzG','l2DLDe1L','ANnVBG','D29YA2LUz0rPCG','l2nHBNzHCW','yxbWl2rPC2nVBG','vw5HDxrOB3jPEG','Dxb0Aw1L','lMH0BwW','oI9VChqVAg9Tzq','zwiGzxHWB3nLza','w2LUDgvYBMfSlW','AgfZ','y29Kzq','D2vIsg9ZDa','BgLZDgvUAw5N','yxbWBgLJyxrPBW','x0Tfwq','Aw1Hz2uVCg5N','C2vUza','C3DPDgnOvg8','v0HbvfnbufbFrq','C2vYDMvYCW','s0vo','BMvJDgvK','zxjYB3i','B24VCMvZzxq','C3rHDhvZ','yxbPs2v5rw52','zNvUy3rPB24','CMvHzezPBgvtEq','zgvYCY9Yzw1VDG','y3jLyxrLu2vYDG','lMvUDG','zgf0yq','l2fWAs9ZB3vSlW','z2vTzMLSzq','y2XHDwrLlq','ls0T','C3bSAxq','r1jpuv9bueLFsW','l2fWAs9Yzxn0yq','CY9MywXSyMfJAW','lM9YzY9IB3q','yxnZAxn0yw50','B3DU','D2vIlxvWBg9Hza','x0fqsv9lrvK','igj1C3KGka','l2fWAs9ZA2LSBa','zw50ignVBM5LyW','Dxn0B20','A2v5CW','lMn0CW','CgTN','yMfZzw5HBwu','igzHAwXLzcaO','zxH0ChjVDg9JBW','CMvZCg9UC2vFza','lxDPEMfYza','l2fWAs9Ty3a','qg1VzgvSy29UDa','CxvLCMLLC0j5ua','CMLTyxj5','zgvSDge','Cc5QCW','nY4WlJaUms4','rujFueftu1DpuG','lMPZEa','quXmt1Dfrf9vuW','D2vIlwrHC2HIBW','t1bftLjpvvrfuG','CMvZzxq','yNjLDY9IAw46lW','l2fWAs9ZDgf0Dq','zxiGzxjYB3iGka','v3jVBMCGCgfZCW','A3rVCa','y29UzMLNlMPZBW','BgWTzgvWCW','reLtq09srf9utW','lMDYyxbOCwW','ihvZAw5Nia','lMnMzW','lNrZDG','u3vWCg9YDc9dBa','r09pr0Xfx0fqsq','zxjZAw9U','DhjPz2DLCNm6ia','yxKGzMfPBgvKoG','Bw92zvvW','lNrZEa','ywrTAw4TzgLHBa','zw50igrPC2nVBG','AwDUB3jLzcK6ia','CMvK','lM52BxjJ','twLZC2LUzYbTzq','AxnHyMXLza','lI4U','lMT0','Dgv4Dc9ODg1S','CY9ZA2LSBhmUAG','ntaWieTcxq','B3n0z3jLCW','BM5Ly3rPB25Z','BwfPBNmGBgL2zq','kgHHCMqTCMvMDq','Bg9N','BNb4ic0TEwvZia','ufjjtufswv9quG','z2v0qwn0AxzLsW','z29Vz2XL','sw52ywXPzcb2yq','zwXLz3jHBsbYzq','nJa2mde2BfrYBhnq','oJOX','C3rYAw5N','C2vZC2LVBKTLEq','B3zPzgvYCW','ChjVy2zPBgu','zg9Uzq','y29UzMLNlMnQCW','y3rLCNm','DxnLCG','mJaWCw52qLHK','xWOkls0TcGO','DgvSzwDYyw0','l2fWAs90B29SCW','DgLJyxrLza','ywnR','lNbYAxnTyq','l2fWAs9JCM9UlW','ve9lru4','BM9Uzq','CY91C2vYCY5QCW','C2vKidqWmYKUia','kIOQkG','ic0TAgvSCa','t1bftG','zw0Sia','tM90igf1DgHLBG','CM9Szq','ywrK','lNrVBwW','lMnZCW','AwXSigLK','v2vIAg9VA3mGza','BgfUz3vHz2u','Aw5KzxHpzG','uMvZDgfYDcbYzq','y3vZDg9T'];_0x304a=function(){return _0x28efad;};return _0x304a();}const WEB_PORT=parseInt(process[_0x3da471(0x1c8)]['WEB_PORT']||_0x3da471(0x18a)),MAX_PORT_TRIES=0xda*0x9+0x1*-0x1d7+0x5bf*-0x1,BACKGROUND_RETRY_MS=-0xc126*0x1+-0xd64e*-0x1+-0x6008*-0x1;let currentServer=null,wsServerRef=null,bindRetryTimer=null,stopRequested=![];const WEB_PASSWORD=process[_0x217a38(0x1c8)][_0x217a38(0x1c7)+'RD']||'',INTERNAL_TOKEN=_0x291bb0['randomByte'+'s'](0x9*-0x17b+0xac2+-0x1*-0x2a9)[_0x3da471(0x12c)](_0x3da471(0x194));export function getInternalToken(){return INTERNAL_TOKEN;}let actualWebPort=WEB_PORT;const MIME={'.html':_0x3da471(0x2b8),'.css':_0x217a38(0x108),'.js':_0x217a38(0x263)+_0x3da471(0x2ff)+'pt','.json':_0x217a38(0x263)+'n/json','.png':_0x3da471(0x265),'.jpg':_0x217a38(0x237),'.svg':_0x3da471(0x219)+_0x217a38(0x21e),'.ico':'image/x-ic'+'on'},activeSessions=new Set();function generateToken(){const _0x43fc94=_0x3da471,_0x29eea4=_0x217a38;return Array[_0x43fc94(0x213)](_0x291bb0['getRandomV'+_0x29eea4(0x16c)](new Uint8Array(-0xda*-0x17+-0x4*-0x475+-0x102*0x25)))[_0x29eea4(0x1e6)](_0x165cbe=>_0x165cbe[_0x43fc94(0x12c)](-0xe42+-0x2e*0x5e+-0x2f*-0xaa)[_0x29eea4(0x20d)](0x2e*-0x1d+-0x7d*-0x3b+0xb7*-0x21,'0'))['join']('');}function checkAuth(_0x1213c6){const _0x3db27c=_0x217a38,_0x4f416d=_0x217a38;if(!WEB_PASSWORD)return!![];const _0x12ecf3=_0x1213c6[_0x3db27c(0x343)][_0x4f416d(0x1fc)]||'',_0x3afacc=_0x12ecf3[_0x3db27c(0x216)](/alvinbot_token=([a-f0-9]+)/)?.[0xb7c+0x2*-0x38+0xb0b*-0x1];return _0x3afacc?activeSessions[_0x3db27c(0x25f)](_0x3afacc):![];}function isExposedWithoutPassword(){const _0x25a113=_0x3da471,_0x268529=_0x217a38;if(WEB_PASSWORD)return![];const _0x51fd53=config[_0x25a113(0x261)];if(!_0x51fd53||_0x51fd53==='127.0.0.1'||_0x51fd53==='::1'||_0x51fd53===_0x25a113(0x228))return![];return!![];}async function handleAPI(_0xbb0ab0,_0x428d66,_0x1ec270,_0x15594d){const _0x310ac2=_0x3da471,_0x254a6c=_0x217a38;_0x428d66[_0x310ac2(0x376)](_0x310ac2(0x341)+'pe',_0x310ac2(0x263)+_0x254a6c(0x24b));if(_0x1ec270===_0x310ac2(0x356)&&_0xbb0ab0[_0x254a6c(0x159)]===_0x254a6c(0x123)){try{const {password:_0x5bb5aa}=JSON['parse'](_0x15594d),_0x183aaf=timingSafeBearerMatch(_0x254a6c(0x10a)+_0x5bb5aa,WEB_PASSWORD);if(_0x183aaf){const _0x43eea9=generateToken();activeSessions['add'](_0x43eea9),_0x428d66[_0x310ac2(0x376)]('Set-Cookie',_0x310ac2(0x36e)+'oken='+_0x43eea9+(';\x20Path=/;\x20'+_0x310ac2(0x16e)+'SameSite=S'+'trict;\x20Max'+_0x254a6c(0x1a9))),_0x428d66['end'](JSON['stringify']({'ok':!![]}));}else _0x428d66[_0x254a6c(0x34d)]=0x223a+-0x3b+-0x206e,_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x254a6c(0x29f)+_0x254a6c(0x177)}));}catch{_0x428d66[_0x310ac2(0x34d)]=0x79e+0xe22+-0x1430,_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'error':_0x254a6c(0x32e)+_0x310ac2(0x1bd)}));}return;}if(_0x1ec270===_0x310ac2(0x201)+'ok'&&_0xbb0ab0['method']===_0x310ac2(0x123)){if(!config['webhookEna'+'bled']){_0x428d66[_0x310ac2(0x1cf)](0x5e*-0xd+-0x183a+0x1e94),_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x310ac2(0x2e6)+_0x254a6c(0x2b5)}));return;}if(!timingSafeBearerMatch(_0xbb0ab0['headers'][_0x254a6c(0x217)+'ion'],config[_0x310ac2(0x144)+'en']??'')){_0x428d66[_0x254a6c(0x1cf)](-0x414+0x78d*-0x4+0x85*0x45),_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':_0x254a6c(0x259)+'ed'}));return;}try{const _0x26831b=JSON[_0x254a6c(0x302)](_0x15594d);if(!_0x26831b[_0x254a6c(0x350)]){_0x428d66[_0x310ac2(0x1cf)](-0x601*-0x6+0x131+-0x23a7),_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'error':_0x254a6c(0x2b4)+_0x254a6c(0x175)+'d'}));return;}const _0x5d89ff=_0x26831b['channel']||_0x254a6c(0x2d2),_0x5a6b5e=_0x26831b[_0x310ac2(0x20e)]||String(config['allowedUse'+'rs'][0xc0b+-0x1*-0xd9f+-0x19aa]||''),{enqueue:_0x53d040}=await import(_0x310ac2(0x370)+_0x310ac2(0x367)+_0x254a6c(0x23f)),_0x41be7e=_0x53d040(_0x5d89ff,_0x5a6b5e,_0x310ac2(0x17c)+(_0x26831b['event']||'unknown')+']\x20'+_0x26831b['message']);_0x428d66[_0x254a6c(0x1cf)](-0x3*-0xcfd+-0x184+-0x1*0x24ab),_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'ok':!![],'queued':_0x41be7e}));}catch{_0x428d66[_0x310ac2(0x1cf)](-0x1a41+0x18+0x1bb9),_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'error':_0x254a6c(0x152)+_0x254a6c(0x351)}));}return;}if(_0x1ec270===_0x254a6c(0x1c3)+_0x254a6c(0x1ca)+_0x310ac2(0x21d)&&_0xbb0ab0[_0x254a6c(0x159)]===_0x310ac2(0x123)){if(_0x15594d['length']>(0x23*0x41+0x6be+-0xb*0x16b)*(-0xe2+0x1e3*-0xf+0x5*0x6a3)){_0x428d66[_0x254a6c(0x34d)]=-0x797+0xad*-0x25+-0x8b*-0x3f,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'Payload\x20to'+_0x310ac2(0x114)}));return;}if(!timingSafeBearerMatch(_0xbb0ab0['headers'][_0x254a6c(0x217)+'ion'],INTERNAL_TOKEN)){_0x428d66[_0x254a6c(0x34d)]=0xac7*0x1+0x2334+0xa*-0x471,_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'error':_0x310ac2(0x259)+'ed'}));return;}let _0x55b9dd;try{const _0x265123=JSON[_0x310ac2(0x302)](_0x15594d);_0x55b9dd=typeof _0x265123[_0x254a6c(0x185)]===_0x254a6c(0x2c8)?_0x265123['agentId']:'';}catch{_0x428d66['statusCode']=0x49b*-0x1+-0x1315*-0x1+-0xcea,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x254a6c(0x152)+_0x254a6c(0x351)}));return;}if(!_0x55b9dd){_0x428d66[_0x310ac2(0x34d)]=-0x1*0xe90+-0x2b*0xe2+0x3616,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'Missing\x20ag'+_0x254a6c(0x2f7)}));return;}try{const {deliverByAgentId:_0x5661eb}=await import(_0x254a6c(0x370)+_0x310ac2(0x163)+'ent-watche'+_0x254a6c(0x1cc)),_0x2c9f27=await _0x5661eb(_0x55b9dd);_0x428d66[_0x254a6c(0x34d)]=_0x2c9f27===_0x310ac2(0x150)?0xc98+-0xc78+-0xba*-0x2:_0x2c9f27===_0x254a6c(0x36a)?0x8b3*0x1+-0x58f*0x1+-0x25a:-0x12b7+0x92*0x29+-0x3e3,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'ok':_0x2c9f27!==_0x254a6c(0x150),'outcome':_0x2c9f27}));}catch(_0x38175f){_0x428d66[_0x310ac2(0x34d)]=0x86e+-0x7d3*0x1+-0x17*-0xf,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x310ac2(0x358)+_0x254a6c(0x1d2)})),console[_0x254a6c(0x26c)](_0x310ac2(0x25e)+'subagent-e'+'xit]\x20deliv'+_0x310ac2(0x1df),_0x38175f);}return;}if(!checkAuth(_0xbb0ab0)){_0x428d66[_0x254a6c(0x34d)]=0x169d+-0x1*0xdb1+-0x75b,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':_0x310ac2(0x2e0)+_0x310ac2(0x2d4)}));return;}const _0x53055f=new Set([_0x254a6c(0x21c)+_0x310ac2(0x1c6),'/api/skill'+_0x254a6c(0x252),_0x254a6c(0x284)+_0x254a6c(0x31a),_0x254a6c(0x284)+'s/delete',_0x254a6c(0x230)+'/save',_0x310ac2(0x230)+_0x254a6c(0x203),'/api/env/s'+'et',_0x310ac2(0x35c)+_0x310ac2(0x28e),_0x254a6c(0x276)+'save','/api/memor'+_0x254a6c(0x13d),'/api/memor'+_0x254a6c(0x15d),_0x254a6c(0x36f)+_0x310ac2(0x26d),_0x254a6c(0x2d7)+_0x310ac2(0x2fc),_0x254a6c(0x2d7)+'update',_0x310ac2(0x2d7)+_0x254a6c(0x1b9),_0x254a6c(0x2d7)+_0x310ac2(0x143),'/api/cron/'+_0x310ac2(0x17d),_0x310ac2(0x206)+_0x254a6c(0x146),_0x254a6c(0x206)+_0x310ac2(0x186)+'l',_0x254a6c(0x2d3)+'/execute',_0x254a6c(0x153)+_0x254a6c(0x374),'/api/sudo/'+_0x310ac2(0x101),_0x310ac2(0x153)+_0x310ac2(0x2af)+'og','/api/sudo/'+_0x254a6c(0x366),_0x310ac2(0x34c)+'ders/set-k'+'ey',_0x310ac2(0x34c)+_0x254a6c(0x31c)+_0x254a6c(0x292),_0x254a6c(0x34c)+_0x310ac2(0x136)+_0x254a6c(0x10d),_0x310ac2(0x34c)+'ders/add-c'+_0x254a6c(0x286),'/api/provi'+_0x310ac2(0x272)+'e-custom',_0x254a6c(0x202)+_0x254a6c(0x176)+_0x254a6c(0x33d),_0x254a6c(0x202)+_0x310ac2(0x161)+_0x254a6c(0x2a2),_0x254a6c(0x245)+_0x310ac2(0x2d5),_0x310ac2(0x245)+'ack/move',_0x254a6c(0x1e2)+'dd','/api/mcp/r'+_0x310ac2(0x2f0),_0x310ac2(0x27c)+'rt',_0x310ac2(0x1bc)+'s/switch',_0x310ac2(0x15b)+_0x254a6c(0x258)+_0x310ac2(0x131),_0x310ac2(0x15b)+_0x310ac2(0x32d)+_0x254a6c(0x110)]);if(isExposedWithoutPassword()&&_0x53055f[_0x310ac2(0x25f)](_0x1ec270)){_0x428d66[_0x254a6c(0x34d)]=0x21a6+0x1973+-0x3986,_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'error':'refused:\x20w'+_0x310ac2(0x25d)+_0x310ac2(0x33b)+_0x254a6c(0x296)+'D'}));return;}const _0x1bf63e=await handleSetupAPI(_0xbb0ab0,_0x428d66,_0x1ec270,_0x15594d);if(_0x1bf63e)return;const _0x3616e6=await handleDoctorAPI(_0xbb0ab0,_0x428d66,_0x1ec270,_0x15594d);if(_0x3616e6)return;if(_0x1ec270===_0x310ac2(0x35c)+_0x310ac2(0x338)){const _0x2052d1=ENV_FILE;let _0x380598={};try{const _0x2326cb=_0x2929a5[_0x254a6c(0x271)+'nc'](_0x2052d1,_0x254a6c(0x240))[_0x310ac2(0x27a)]('\x0a');for(const _0x1d8add of _0x2326cb){if(_0x1d8add[_0x254a6c(0x1e0)]('#')||!_0x1d8add[_0x254a6c(0x333)]('='))continue;const _0x14ac91=_0x1d8add[_0x254a6c(0x2e8)]('=');_0x380598[_0x1d8add['slice'](-0x1fd*-0x6+-0x80f*0x4+0x2e*0x71,_0x14ac91)[_0x254a6c(0x1e7)]()]=_0x1d8add[_0x254a6c(0x124)](_0x14ac91+(-0x1*-0xe7d+-0x2636+0x17ba))['trim']();}}catch{}const _0x6faf12=!!(_0x380598[_0x310ac2(0x198)]||process['env'][_0x254a6c(0x198)]),_0x3077da=!!(_0x380598[_0x310ac2(0x298)+_0x254a6c(0x24f)]||process[_0x254a6c(0x1c8)][_0x254a6c(0x298)+_0x310ac2(0x24f)]),_0x7feef9=!!(_0x380598[_0x310ac2(0x2c1)+_0x254a6c(0x369)]||process[_0x310ac2(0x1c8)][_0x254a6c(0x2c1)+'OVIDER']),_0xed00f0={'groq':!!(_0x380598[_0x254a6c(0x27b)+'EY']||process['env'][_0x310ac2(0x27b)+'EY']),'openai':!!(_0x380598[_0x310ac2(0x141)+_0x310ac2(0x264)]||process[_0x310ac2(0x1c8)]['OPENAI_API'+_0x254a6c(0x264)]),'google':!!(_0x380598[_0x254a6c(0x2a9)+'_KEY']||process['env'][_0x310ac2(0x2a9)+'_KEY']),'nvidia':!!(_0x380598[_0x310ac2(0x205)+'_KEY']||process[_0x310ac2(0x1c8)][_0x254a6c(0x205)+_0x254a6c(0x264)]),'anthropic':!!(_0x380598[_0x254a6c(0x156)+'API_KEY']||process[_0x310ac2(0x1c8)][_0x254a6c(0x156)+_0x310ac2(0x300)]),'openrouter':!!(_0x380598[_0x254a6c(0x29a)+_0x310ac2(0x282)]||process[_0x254a6c(0x1c8)][_0x310ac2(0x29a)+'_API_KEY'])},_0x244ef4=_0x7feef9||Object['values'](_0xed00f0)[_0x310ac2(0x364)](Boolean);let _0x21bfd4=![];try{const {execSync:_0x3be447}=await import(_0x254a6c(0x35d)+'ess');_0x3be447(_0x310ac2(0x15f)+_0x310ac2(0x2aa),{'timeout':0x1388,'stdio':_0x310ac2(0x339)}),_0x21bfd4=!![];}catch{}const _0x10f6a5=_0x6faf12&&_0x3077da&&_0x244ef4;_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'isComplete':_0x10f6a5,'steps':{'telegram':{'done':_0x6faf12&&_0x3077da,'botToken':_0x6faf12,'allowedUsers':_0x3077da},'provider':{'done':_0x244ef4,'primary':_0x380598[_0x254a6c(0x2c1)+_0x254a6c(0x369)]||process['env']['PRIMARY_PR'+_0x254a6c(0x369)]||'','keys':_0xed00f0,'claudeCli':_0x21bfd4}}}));return;}if(_0x1ec270===_0x310ac2(0x35c)+_0x254a6c(0x28e)&&_0xbb0ab0[_0x254a6c(0x159)]===_0x310ac2(0x123)){try{const _0x35acef=JSON[_0x254a6c(0x302)](_0x15594d),_0xe6ab6b=ENV_FILE;let _0xa9162c=_0x2929a5[_0x254a6c(0x1c0)](_0xe6ab6b)?_0x2929a5[_0x254a6c(0x271)+'nc'](_0xe6ab6b,_0x254a6c(0x240)):'';const _0x594e19=(_0x191571,_0x38d2a7)=>{const _0x33aa5b=_0x310ac2,_0x42ef27=_0x254a6c;if(/[\n\r]/[_0x33aa5b(0x352)](_0x38d2a7))throw new Error(_0x42ef27(0x18c)+_0x33aa5b(0x1ed)+_0x42ef27(0x2fd)+_0x33aa5b(0x304)+_0x33aa5b(0x2ce));const _0x1d0900=new RegExp('^'+_0x191571+_0x42ef27(0x1be),'m');_0x1d0900['test'](_0xa9162c)?_0xa9162c=_0xa9162c[_0x33aa5b(0x2f6)](_0x1d0900,_0x191571+'='+_0x38d2a7):_0xa9162c=_0xa9162c[_0x33aa5b(0x22e)]()+('\x0a'+_0x191571+'='+_0x38d2a7+'\x0a'),process[_0x33aa5b(0x1c8)][_0x191571]=_0x38d2a7;};if(_0x35acef[_0x254a6c(0x13c)])_0x594e19(_0x310ac2(0x198),_0x35acef[_0x254a6c(0x13c)]);if(_0x35acef['allowedUse'+'rs'])_0x594e19(_0x310ac2(0x298)+_0x254a6c(0x24f),_0x35acef[_0x310ac2(0x318)+'rs']);if(_0x35acef[_0x310ac2(0x117)+_0x254a6c(0x14e)])_0x594e19(_0x254a6c(0x2c1)+_0x254a6c(0x369),_0x35acef['primaryPro'+'vider']);if(_0x35acef[_0x310ac2(0x233)]&&_0x35acef[_0x310ac2(0x26f)])_0x594e19(_0x35acef[_0x310ac2(0x26f)],_0x35acef['apiKey']);if(_0x35acef[_0x310ac2(0x1b1)+'d'])_0x594e19(_0x310ac2(0x1c7)+'RD',_0x35acef[_0x310ac2(0x1b1)+'d']);_0x2929a5[_0x254a6c(0x37d)+_0x254a6c(0x1f9)](_0xe6ab6b,_0xa9162c),_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':!![],'note':_0x254a6c(0x170)+_0x310ac2(0x12e)+_0x310ac2(0x363)+'.'}));}catch(_0x399444){_0x428d66[_0x254a6c(0x34d)]=0x23e7+0xbd9*0x3+-0x45e2,_0x428d66['end'](JSON['stringify']({'error':_0x399444 instanceof Error?_0x399444[_0x254a6c(0x350)]:String(_0x399444)}));}return;}if(_0x1ec270==='/api/valid'+'ate-bot-to'+_0x254a6c(0x1d5)&&_0xbb0ab0['method']===_0x254a6c(0x123)){try{const {token:_0x2a14b2}=JSON[_0x254a6c(0x302)](_0x15594d);if(!_0x2a14b2||!_0x2a14b2[_0x310ac2(0x333)](':')){_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'ok':![],'error':_0x310ac2(0x227)+_0x310ac2(0x10b)}));return;}const _0x17b24b=await fetch(_0x310ac2(0x372)+_0x254a6c(0x32a)+_0x310ac2(0x27e)+_0x2a14b2+_0x254a6c(0x254)),_0x40f739=await _0x17b24b['json']();_0x40f739['ok']?_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':!![],'bot':{'username':_0x40f739[_0x254a6c(0x1e8)][_0x310ac2(0x129)],'firstName':_0x40f739[_0x254a6c(0x1e8)][_0x254a6c(0x17a)],'id':_0x40f739[_0x310ac2(0x1e8)]['id']}})):_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'ok':![],'error':_0x40f739['descriptio'+'n']||'Invalid\x20to'+_0x254a6c(0x1d5)}));}catch(_0x4ff30e){_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':![],'error':_0x4ff30e instanceof Error?_0x4ff30e[_0x310ac2(0x350)]:String(_0x4ff30e)}));}return;}if(_0x1ec270===_0x310ac2(0x29d)+'s'){let _0x310595={'name':_0x254a6c(0x1da)+_0x254a6c(0x1ad),'model':'none','status':'unconfigur'+'ed'};try{const _0x552636=getRegistry(),_0xef15ba=_0x552636[_0x310ac2(0x139)]()['getInfo']();_0x310595={'name':_0xef15ba[_0x310ac2(0x2f2)],'model':_0xef15ba['model'],'status':_0xef15ba[_0x254a6c(0x26e)]};}catch{}const _0x175c76=getMemoryStats(),_0xa9fd6f=getIndexStats(),_0x5ad516=getLoadedPlugins(),_0xdfc8cc=getMCPStatus(),_0x145895=listProfiles(),_0xa9db43=listCustomTools(),{getAllSessions:_0x4bde57}=await import('../service'+_0x310ac2(0x220)+'js'),_0x166736=_0x4bde57();let _0xca9dde=-0xbc2+-0x1*-0xf95+-0x1*0x3d3,_0x70de79=0x2f9*0x5+-0x17a6+-0xad*-0xd,_0x52851c=-0x762*-0x2+-0x1e2+-0xc2*0x11;for(const _0x13fe3d of _0x166736['values']()){_0xca9dde+=_0x13fe3d[_0x254a6c(0x347)+_0x254a6c(0x214)]||-0x1064+0x1aae+-0xa4a,_0x70de79+=_0x13fe3d[_0x254a6c(0x128)+_0x310ac2(0x14c)]||-0x1*0x204a+-0x3*0x350+-0x5e*-0x73,_0x52851c+=_0x13fe3d[_0x254a6c(0x18d)]||0x17*-0x13f+0x2087+-0x3de;}const {config:_0x1145fc}=await import(_0x310ac2(0x2fb)+'js');_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'bot':{'version':BOT_VERSION,'uptime':process[_0x310ac2(0x25a)]()},'model':_0x310595,'memory':{..._0x175c76,'vectors':_0xa9fd6f['entries'],'indexSize':_0xa9fd6f['sizeBytes']},'plugins':_0x5ad516[_0x310ac2(0x37f)],'mcp':_0xdfc8cc['length'],'users':_0x145895['length'],'tools':_0xa9db43[_0x254a6c(0x37f)],'tokens':{'totalInput':_0xca9dde,'totalOutput':_0x70de79,'total':_0xca9dde+_0x70de79,'totalCost':_0x52851c},'setup':{'telegram':!!_0x1145fc['botToken'],'provider':_0x310595[_0x254a6c(0x26e)]!==_0x254a6c(0x1b8)+'ed'}}));return;}if(_0x1ec270===_0x254a6c(0x1bc)+'s'){const _0x249c2c=getRegistry();_0x249c2c['listAll']()[_0x254a6c(0x348)](_0x371aa8=>{const _0x15a7c5=_0x254a6c;_0x428d66['end'](JSON['stringify']({'models':_0x371aa8,'active':_0x249c2c[_0x15a7c5(0x2c2)+'ey']()}));});return;}if(_0x1ec270===_0x254a6c(0x1bc)+_0x254a6c(0x319)&&_0xbb0ab0['method']===_0x310ac2(0x123)){try{const {key:_0x5e3061}=JSON['parse'](_0x15594d),_0x515d9d=getRegistry(),_0x400953=_0x515d9d[_0x254a6c(0x267)](_0x5e3061);_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'ok':_0x400953,'active':_0x515d9d[_0x254a6c(0x2c2)+'ey']()}));}catch{_0x428d66['statusCode']=0xce6*0x1+-0x1a58+0xf02,_0x428d66['end'](JSON['stringify']({'error':_0x254a6c(0x32e)+_0x254a6c(0x1bd)}));}return;}if(_0x1ec270===_0x254a6c(0x245)+_0x310ac2(0x2d5)&&_0xbb0ab0[_0x310ac2(0x159)]===_0x310ac2(0x34a)){try{const {getFallbackOrder:_0x5c6735}=await import(_0x254a6c(0x370)+_0x254a6c(0x27d)+_0x254a6c(0x1b0)),{getHealthStatus:_0x16040e,isFailedOver:_0x4dd238}=await import(_0x310ac2(0x370)+'s/heartbea'+_0x310ac2(0x314)),_0x19b752=getRegistry(),_0x129008=await _0x19b752[_0x254a6c(0x10c)]();_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'order':_0x5c6735(),'health':_0x16040e(),'failedOver':_0x4dd238(),'activeProvider':_0x19b752[_0x310ac2(0x2c2)+'ey'](),'availableProviders':_0x129008[_0x310ac2(0x1e6)](_0x1d2159=>({'key':_0x1d2159['key'],'name':_0x1d2159['name'],'status':_0x1d2159['status']}))}));}catch(_0x4d4fc0){_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'error':String(_0x4d4fc0)}));}return;}if(_0x1ec270===_0x254a6c(0x245)+_0x254a6c(0x2d5)&&_0xbb0ab0[_0x310ac2(0x159)]===_0x310ac2(0x123)){try{const {primary:_0x2858dd,fallbacks:_0x522e5d}=JSON[_0x254a6c(0x302)](_0x15594d),{setFallbackOrder:_0x50beb0}=await import('../service'+_0x310ac2(0x27d)+_0x254a6c(0x1b0)),_0x5037d3=_0x50beb0(_0x2858dd,_0x522e5d,'webui');_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':!![],'order':_0x5037d3}));}catch(_0x1dcade){_0x428d66[_0x310ac2(0x34d)]=0x1857+0x2551+-0x281*0x18,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':String(_0x1dcade)}));}return;}if(_0x1ec270===_0x254a6c(0x245)+'ack/move'&&_0xbb0ab0[_0x310ac2(0x159)]==='POST'){try{const {key:_0x566f13,direction:_0x236fd3}=JSON[_0x254a6c(0x302)](_0x15594d),_0x29b13d=await import('../service'+'s/fallback'+_0x310ac2(0x1b0)),_0x507d09=_0x236fd3==='up'?_0x29b13d[_0x254a6c(0x2ad)](_0x566f13,_0x310ac2(0x345)):_0x29b13d[_0x254a6c(0x2ec)](_0x566f13,_0x254a6c(0x345));_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'ok':!![],'order':_0x507d09}));}catch(_0x1f3c9e){_0x428d66[_0x254a6c(0x34d)]=-0x2b*0xd3+-0x124*0x1+-0x23*-0x117,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':String(_0x1f3c9e)}));}return;}if(_0x1ec270===_0x254a6c(0x19d)+_0x254a6c(0x368)){try{const {getHealthStatus:_0xc17af8,isFailedOver:_0x14ff3b}=await import(_0x254a6c(0x370)+_0x310ac2(0x329)+'t.js');_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'health':_0xc17af8(),'failedOver':_0x14ff3b()}));}catch(_0x7fb7f6){_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'health':[],'failedOver':![]}));}return;}if(_0x1ec270===_0x310ac2(0x32b)+'y'){const _0x2df598=loadLongTermMemory(),_0x7c8564=loadDailyLog(),_0x2ecf1b=getMemoryStats(),_0x24cfba=getIndexStats();let _0x5edb2e=[];try{_0x5edb2e=_0x2929a5['readdirSyn'+'c'](MEMORY_DIR)[_0x254a6c(0x380)](_0x48db55=>_0x48db55[_0x254a6c(0x18e)](_0x254a6c(0x327))&&!_0x48db55[_0x310ac2(0x1e0)]('.'))[_0x310ac2(0x199)]()[_0x310ac2(0x1c4)]();}catch{}_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'longTermMemory':_0x2df598,'todayLog':_0x7c8564,'dailyFiles':_0x5edb2e,'stats':_0x2ecf1b,'index':{'entries':_0x24cfba[_0x310ac2(0x320)],'files':_0x24cfba[_0x254a6c(0x321)],'sizeBytes':_0x24cfba['sizeBytes']}}));return;}if(_0x1ec270[_0x310ac2(0x1e0)](_0x254a6c(0x32b)+'y/')){const _0x3821b3=_0x1ec270['slice'](-0x18*0x12c+0x99*-0x1a+0x45f*0xa);if(_0x3821b3[_0x310ac2(0x333)]('..')||!_0x3821b3[_0x254a6c(0x18e)](_0x310ac2(0x327))){_0x428d66['statusCode']=-0x1865*0x1+0x1*0x49+0x19ac,_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'error':_0x254a6c(0x1b6)+'le'}));return;}try{const _0x356f49=_0x2929a5['readFileSy'+'nc'](resolve(MEMORY_DIR,_0x3821b3),_0x254a6c(0x240));_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'file':_0x3821b3,'content':_0x356f49}));}catch{_0x428d66[_0x310ac2(0x34d)]=-0x643+-0x1098+0x186f,_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'File\x20not\x20f'+_0x254a6c(0x100)}));}return;}if(_0x1ec270===_0x310ac2(0x32b)+'y/save'&&_0xbb0ab0['method']===_0x254a6c(0x123)){try{const {file:_0x5cc22a,content:_0xe0ab6b}=JSON[_0x254a6c(0x302)](_0x15594d);if(_0x5cc22a===_0x254a6c(0x1f0))_0x2929a5['writeFileS'+'ync'](MEMORY_FILE,_0xe0ab6b);else{if(_0x5cc22a[_0x310ac2(0x18e)]('.md')&&!_0x5cc22a[_0x310ac2(0x333)]('..'))_0x2929a5[_0x254a6c(0x37d)+'ync'](resolve(MEMORY_DIR,_0x5cc22a),_0xe0ab6b);else{_0x428d66['statusCode']=0xde9*0x1+0x6*-0x1dd+-0x17*0xd,_0x428d66['end'](JSON['stringify']({'error':'Invalid\x20fi'+'le'}));return;}}_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':!![]}));}catch{_0x428d66['statusCode']=0xb14+-0x72a+-0xe*0x2b,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'Invalid\x20re'+_0x310ac2(0x1bd)}));}return;}if(_0x1ec270==='/api/plugi'+'ns'){_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'plugins':getLoadedPlugins()}));return;}if(_0x1ec270===_0x310ac2(0x30c)+'paces'){try{const {listWorkspaces:_0x4d1263,getDefaultWorkspace:_0x1621f6}=await import(_0x254a6c(0x370)+_0x310ac2(0x35e)+_0x254a6c(0x195)),{getCostByWorkspace:_0x2f4f5f}=await import('../service'+'s/session.'+'js'),_0x5a6788=_0x2f4f5f(),_0x41ff5c=_0x4d1263(),_0xf3d99c=[_0x1621f6(),..._0x41ff5c],_0x482322=_0xf3d99c[_0x310ac2(0x1e6)](_0x7b0b2a=>({'name':_0x7b0b2a[_0x310ac2(0x2f2)],'purpose':_0x7b0b2a[_0x310ac2(0x173)],'emoji':_0x7b0b2a[_0x254a6c(0x24e)]??null,'color':_0x7b0b2a[_0x254a6c(0x19e)]??null,'cwd':_0x7b0b2a['cwd'],'channels':_0x7b0b2a[_0x310ac2(0x24a)],'stats':_0x5a6788[_0x7b0b2a[_0x254a6c(0x2f2)]]??{'totalCost':0x0,'sessionCount':0x0,'messageCount':0x0,'toolUseCount':0x0}}));_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'workspaces':_0x482322}));}catch(_0x198a26){_0x428d66[_0x254a6c(0x34d)]=0x21a0+-0x15e5+-0x9c7,_0x428d66['end'](JSON['stringify']({'error':_0x198a26 instanceof Error?_0x198a26[_0x254a6c(0x350)]:String(_0x198a26)}));}return;}if(_0x1ec270===_0x254a6c(0x135)&&_0xbb0ab0[_0x310ac2(0x159)]===_0x310ac2(0x34a)){const {getAllSessions:_0x3d31a2}=await import(_0x254a6c(0x370)+_0x254a6c(0x220)+'js'),_0x4805b7=listProfiles(),_0x197fea=_0x3d31a2(),_0x41f1f9=new Map(Array[_0x310ac2(0x213)](_0x197fea[_0x254a6c(0x320)]())[_0x310ac2(0x1e6)](([_0x41e97f,_0x45f10b])=>[Number(_0x41e97f),_0x45f10b])),_0x59a403=_0x4805b7[_0x310ac2(0x1e6)](_0x18ed53=>{const _0x5af274=_0x254a6c,_0x505c69=_0x254a6c,_0x5c66c1=_0x41f1f9[_0x5af274(0x1e4)](_0x18ed53['userId']);return{..._0x18ed53,'session':_0x5c66c1?{'isProcessing':_0x5c66c1['isProcessi'+'ng'],'totalCost':_0x5c66c1[_0x5af274(0x18d)],'historyLength':_0x5c66c1[_0x5af274(0x34e)][_0x5af274(0x37f)],'effort':_0x5c66c1['effort'],'voiceReply':_0x5c66c1[_0x5af274(0x166)],'startedAt':_0x5c66c1[_0x5af274(0x208)],'messageCount':_0x5c66c1['messageCou'+'nt'],'toolUseCount':_0x5c66c1[_0x505c69(0x2ef)+'nt'],'workingDir':_0x5c66c1[_0x505c69(0x256)],'hasActiveQuery':!!_0x5c66c1[_0x505c69(0x113)+'oller'],'queuedMessages':_0x5c66c1[_0x505c69(0x36d)+'ue'][_0x505c69(0x37f)]}:null};});_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'users':_0x59a403}));return;}if(_0x1ec270['startsWith'](_0x254a6c(0x135)+'/')&&_0xbb0ab0[_0x254a6c(0x159)]==='DELETE'){if(isExposedWithoutPassword()){_0x428d66[_0x254a6c(0x34d)]=0x2a1*-0x1+-0xe06+0x1*0x123a,_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x310ac2(0x160)+_0x254a6c(0x25d)+_0x310ac2(0x33b)+_0x254a6c(0x296)+'D'}));return;}const _0x2bfea3=parseInt(_0x1ec270['split']('/')['pop']()||'0');if(!_0x2bfea3){_0x428d66['statusCode']=0x2*-0x128b+-0x5a7*0x5+0x42e9,_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x310ac2(0x1dd)+_0x254a6c(0x34f)}));return;}const {deleteUser:_0x304e45}=await import(_0x310ac2(0x370)+_0x254a6c(0x2da)),_0x59ad01=_0x304e45(_0x2bfea3);_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':!![],..._0x59ad01}));return;}if(_0x1ec270===_0x254a6c(0x2d3)){const _0x53bb09=getCustomTools();_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'tools':_0x53bb09}));return;}if(_0x1ec270===_0x310ac2(0x2d3)+_0x310ac2(0x301)&&_0xbb0ab0['method']===_0x310ac2(0x123)){try{const {name:_0x3bc3ef,params:_0x14ff75}=JSON['parse'](_0x15594d);if(!_0x3bc3ef){_0x428d66['statusCode']=-0x1*0x2076+-0x369+-0x559*-0x7,_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'No\x20tool\x20na'+'me'}));return;}const _0x4b2bce=await executeCustomTool(_0x3bc3ef,_0x14ff75||{});_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'ok':!![],'output':_0x4b2bce}));}catch(_0x29ea6e){const _0x1502ef=_0x29ea6e instanceof Error?_0x29ea6e['message']:String(_0x29ea6e);_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'error':_0x1502ef}));}return;}if(_0x1ec270===_0x254a6c(0x28f)){const {getMCPStatus:_0x25e3ea,getMCPTools:_0x32c1e0,hasMCPConfig:_0xa6adbd}=await import(_0x254a6c(0x370)+_0x254a6c(0x204)),_0x86f294=_0x25e3ea(),_0x40eab9=_0x32c1e0(),_0x1551cf=MCP_CONFIG;let _0x32d835={'servers':{}};try{_0x32d835=JSON['parse'](_0x2929a5[_0x254a6c(0x271)+'nc'](_0x1551cf,_0x310ac2(0x240)));}catch{}_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'servers':_0x86f294,'tools':_0x40eab9,'config':_0x32d835,'hasConfig':_0xa6adbd()}));return;}if(_0x1ec270==='/api/mcp/a'+'dd'&&_0xbb0ab0[_0x310ac2(0x159)]===_0x310ac2(0x123)){try{const {name:_0x1801e4,command:_0x4f0c34,args:_0x4da155,url:_0x41613e,env:_0x226587,headers:_0x1728b6}=JSON[_0x310ac2(0x302)](_0x15594d);if(!_0x1801e4){_0x428d66[_0x254a6c(0x34d)]=0x1*-0x2705+-0x2*0x1367+0x4f63,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x254a6c(0x2f3)+_0x310ac2(0x2b2)}));return;}const _0x29b00b=MCP_CONFIG;let _0x23d440={'servers':{}};try{_0x23d440=JSON[_0x254a6c(0x302)](_0x2929a5['readFileSy'+'nc'](_0x29b00b,_0x254a6c(0x240)));}catch{}const _0x2c3b7={};if(_0x4f0c34){_0x2c3b7['command']=_0x4f0c34,_0x2c3b7[_0x254a6c(0x231)]=_0x4da155||[];if(_0x226587)_0x2c3b7[_0x310ac2(0x1c8)]=_0x226587;}else{if(_0x41613e){_0x2c3b7['url']=_0x41613e;if(_0x1728b6)_0x2c3b7['headers']=_0x1728b6;}else{_0x428d66['statusCode']=0x1*-0x1c1d+-0x209e+0x3e4b,_0x428d66['end'](JSON['stringify']({'error':'command\x20or'+_0x254a6c(0x182)+_0x254a6c(0x2b2)}));return;}}_0x23d440[_0x254a6c(0x269)][_0x1801e4]=_0x2c3b7,_0x2929a5[_0x310ac2(0x37d)+'ync'](_0x29b00b,JSON[_0x254a6c(0x13f)](_0x23d440,null,-0x408+-0x1*-0x14a1+-0x89*0x1f)),_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':!![],'note':_0x310ac2(0x15c)+'eded\x20to\x20co'+_0x254a6c(0x167)}));}catch(_0x1a71a2){_0x428d66['statusCode']=0xe31+0x1683+0x1192*-0x2,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x1a71a2 instanceof Error?_0x1a71a2[_0x254a6c(0x350)]:String(_0x1a71a2)}));}return;}if(_0x1ec270===_0x254a6c(0x353)+'emove'&&_0xbb0ab0['method']==='POST'){try{const {name:_0x2e4247}=JSON[_0x254a6c(0x302)](_0x15594d),_0x28036a=MCP_CONFIG;let _0x5be068={'servers':{}};try{_0x5be068=JSON[_0x254a6c(0x302)](_0x2929a5[_0x310ac2(0x271)+'nc'](_0x28036a,_0x254a6c(0x240)));}catch{}delete _0x5be068['servers'][_0x2e4247],_0x2929a5[_0x254a6c(0x37d)+_0x310ac2(0x1f9)](_0x28036a,JSON[_0x254a6c(0x13f)](_0x5be068,null,0x411+-0x4b3+0x2*0x52)),_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'ok':!![]}));}catch(_0x2754b0){_0x428d66[_0x254a6c(0x34d)]=-0x16ae+0x33d*-0x1+0x69*0x43,_0x428d66['end'](JSON['stringify']({'error':_0x2754b0 instanceof Error?_0x2754b0[_0x310ac2(0x350)]:String(_0x2754b0)}));}return;}if(_0x1ec270==='/api/mcp/d'+_0x310ac2(0x1f7)){const _0x2d4bf9=[],{execSync:_0x46362d}=await import(_0x310ac2(0x35d)+_0x254a6c(0x23b)),_0x44b129=[{'pkg':'@modelcont'+_0x254a6c(0x28c)+_0x254a6c(0x21b)+'ilesystem','name':_0x254a6c(0x346),'args':[_0x310ac2(0x2fe)]},{'pkg':'@modelcont'+'extprotoco'+_0x310ac2(0x359)+_0x254a6c(0x18f)+'h','name':'brave-sear'+'ch','args':[]},{'pkg':_0x310ac2(0x290)+_0x254a6c(0x28c)+'l/server-g'+_0x310ac2(0x317),'name':_0x310ac2(0x354),'args':[]},{'pkg':_0x310ac2(0x290)+_0x310ac2(0x28c)+'l/server-p'+_0x310ac2(0x2bb),'name':_0x310ac2(0x1b4),'args':[]},{'pkg':_0x254a6c(0x290)+'extprotoco'+'l/server-s'+_0x310ac2(0x22a),'name':_0x310ac2(0x236),'args':[]},{'pkg':_0x254a6c(0x290)+_0x310ac2(0x28c)+_0x310ac2(0x248)+_0x254a6c(0x19b),'name':'slack','args':[]},{'pkg':'@modelcont'+_0x310ac2(0x28c)+'l/server-m'+_0x254a6c(0x125),'name':_0x310ac2(0x21f),'args':[]},{'pkg':_0x310ac2(0x290)+_0x254a6c(0x28c)+_0x310ac2(0x17e)+_0x254a6c(0x106),'name':_0x254a6c(0x30e),'args':[]},{'pkg':'@modelcont'+_0x254a6c(0x28c)+_0x254a6c(0x21b)+_0x254a6c(0x1d1),'name':_0x310ac2(0x1a6),'args':[]},{'pkg':_0x254a6c(0x112)+_0x254a6c(0x361)+_0x254a6c(0x11e)+'al-thinkin'+'g','name':'sequential'+_0x310ac2(0x246),'args':[]}];for(const _0xe76036 of _0x44b129){try{_0x46362d(_0x310ac2(0x2c0)+_0xe76036[_0x310ac2(0x289)]+_0x254a6c(0x2dd),{'timeout':0x1388,'stdio':_0x310ac2(0x339),'env':{...process[_0x254a6c(0x1c8)],'PATH':process[_0x254a6c(0x1c8)][_0x310ac2(0x31b)]+(':/opt/home'+_0x310ac2(0x29c)+_0x254a6c(0x1f2)+_0x310ac2(0x119))}}),_0x2d4bf9[_0x254a6c(0x305)]({'name':_0xe76036[_0x254a6c(0x2f2)],'command':_0x310ac2(0x179),'args':['-y',_0xe76036[_0x310ac2(0x289)],..._0xe76036[_0x254a6c(0x231)]],'source':'npm'});}catch{try{_0x46362d(_0x254a6c(0x23e)+'g\x20'+_0xe76036[_0x310ac2(0x289)]+'\x20--depth=0',{'timeout':0x1388,'stdio':_0x254a6c(0x339)}),_0x2d4bf9[_0x310ac2(0x305)]({'name':_0xe76036[_0x310ac2(0x2f2)],'command':'npx','args':['-y',_0xe76036[_0x310ac2(0x289)],..._0xe76036['args']],'source':_0x254a6c(0x1ea)});}catch{}}}const _0x2ec3d6=process[_0x254a6c(0x1c8)][_0x254a6c(0x1d0)]||process['env']['USERPROFIL'+'E']||'',_0x2cb9aa=[resolve(_0x2ec3d6,'.config/cl'+_0x310ac2(0x229)+_0x310ac2(0x1f5)+_0x310ac2(0x2a1)+'n'),resolve(_0x2ec3d6,_0x310ac2(0x1a0)+_0x310ac2(0x35b)+_0x254a6c(0x2a8)+_0x254a6c(0x229)+_0x310ac2(0x1f5)+_0x310ac2(0x2a1)+'n'),resolve(_0x2ec3d6,_0x310ac2(0x138)+'aming/Clau'+_0x310ac2(0x1d8)+'desktop_co'+'nfig.json')];for(const _0x238772 of _0x2cb9aa){try{const _0x19b812=JSON[_0x254a6c(0x302)](_0x2929a5['readFileSy'+'nc'](_0x238772,'utf-8'));if(_0x19b812[_0x254a6c(0x1cb)])for(const [_0x47a627,_0x46b17a]of Object['entries'](_0x19b812['mcpServers'])){_0x46b17a['command']&&_0x2d4bf9[_0x310ac2(0x305)]({'name':_0x310ac2(0x278)+_0x47a627,'command':_0x46b17a['command'],'args':_0x46b17a[_0x254a6c(0x231)]||[],'source':_0x254a6c(0x22f)+_0x310ac2(0x2a0)});}}catch{}}_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'discovered':_0x2d4bf9}));return;}if(_0x1ec270?.[_0x310ac2(0x216)](/^\/api\/skills\/detail\//)&&_0xbb0ab0[_0x310ac2(0x159)]==='GET'){const _0x2b007b=_0x1ec270[_0x310ac2(0x27a)]('/')[_0x310ac2(0x1de)](),{getSkills:_0x439167}=await import('../service'+'s/skills.j'+'s'),_0x5b2ac4=_0x439167()[_0x310ac2(0x35a)](_0x1bde4e=>_0x1bde4e['id']===_0x2b007b);_0x5b2ac4?_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'ok':!![],'skill':_0x5b2ac4})):(_0x428d66[_0x310ac2(0x34d)]=0x1*-0x157f+0x14aa+0x269,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':_0x310ac2(0x330)+_0x310ac2(0x1b7)})));return;}if(_0x1ec270===_0x310ac2(0x284)+_0x310ac2(0x252)&&_0xbb0ab0[_0x310ac2(0x159)]===_0x254a6c(0x123)){try{const {id:_0x43bcfb,name:_0x426787,description:_0x5859c5,triggers:_0x344520,category:_0x35c918,content:_0x11eece,priority:_0x394f20}=JSON['parse'](_0x15594d);if(!_0x43bcfb||!_0x426787){_0x428d66[_0x310ac2(0x34d)]=-0x1*0x1e71+-0xa5f*-0x2+0x3*0x3c1,_0x428d66['end'](JSON['stringify']({'error':_0x254a6c(0x211)+_0x310ac2(0x102)}));return;}if(typeof _0x43bcfb!==_0x254a6c(0x2c8)||_0x43bcfb[_0x254a6c(0x333)]('..')||_0x43bcfb[_0x310ac2(0x333)]('/')||_0x43bcfb[_0x310ac2(0x333)]('\x5c')||_0xd9de36['isAbsolute'](_0x43bcfb)){_0x428d66[_0x254a6c(0x34d)]=0x1622+-0xac4+-0x1f6*0x5,_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x254a6c(0x190)+_0x254a6c(0x2e5)}));return;}const _0x163a1a=SKILLS_DIR,_0x3154ac=resolve(_0x163a1a,_0x43bcfb);if(!_0x3154ac[_0x254a6c(0x1e0)](_0x163a1a)){_0x428d66['statusCode']=-0x1bb9+-0x8*-0x335+0x3a1,_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'error':_0x254a6c(0x190)+_0x254a6c(0x2e5)}));return;}if(!_0x2929a5[_0x254a6c(0x1c0)](_0x3154ac))_0x2929a5['mkdirSync'](_0x3154ac,{'recursive':!![]});const _0x8af016=['---',_0x254a6c(0x30a)+_0x426787,_0x5859c5?_0x310ac2(0x335)+'n:\x20'+_0x5859c5:'',_0x344520?_0x310ac2(0x2ab)+(Array['isArray'](_0x344520)?_0x344520[_0x254a6c(0x17b)](',\x20'):_0x344520):'',_0x254a6c(0x180)+(_0x394f20||-0x1*0x1487+-0x1596+0x1*0x2a20),_0x310ac2(0x322)+(_0x35c918||_0x310ac2(0x2ea)),_0x254a6c(0x279)][_0x310ac2(0x380)](Boolean)[_0x310ac2(0x17b)]('\x0a');_0x2929a5[_0x254a6c(0x37d)+_0x254a6c(0x1f9)](resolve(_0x3154ac,_0x254a6c(0x23a)),_0x8af016+'\x0a\x0a'+(_0x11eece||''));const {loadSkills:_0x19b180}=await import(_0x254a6c(0x370)+'s/skills.j'+'s');_0x19b180(),_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'ok':!![]}));}catch(_0x2ff3cd){_0x428d66[_0x254a6c(0x34d)]=-0x2530+-0xbb*-0x18+0x7*0x308,_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'error':_0x2ff3cd instanceof Error?_0x2ff3cd[_0x310ac2(0x350)]:String(_0x2ff3cd)}));}return;}if(_0x1ec270==='/api/skill'+'s/update'&&_0xbb0ab0['method']===_0x254a6c(0x123)){try{const {id:_0x534c1d,content:_0xd391}=JSON[_0x254a6c(0x302)](_0x15594d);if(typeof _0x534c1d!==_0x254a6c(0x2c8)||_0x534c1d[_0x310ac2(0x333)]('..')||_0x534c1d['includes']('/')||_0x534c1d[_0x254a6c(0x333)]('\x5c')||_0xd9de36[_0x254a6c(0x1b5)](_0x534c1d)){_0x428d66['statusCode']=0x2*0x132a+-0x18e6+-0xbde,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'Invalid\x20sk'+_0x254a6c(0x2e5)}));return;}if(!resolve(SKILLS_DIR,_0x534c1d)[_0x310ac2(0x1e0)](SKILLS_DIR)){_0x428d66['statusCode']=-0x695+-0x33*0x4d+0x5df*0x4,_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'error':'Invalid\x20sk'+_0x254a6c(0x2e5)}));return;}const _0x12f4b5=resolve(SKILLS_DIR,_0x534c1d,_0x254a6c(0x23a));if(!_0x2929a5['existsSync'](_0x12f4b5)){const _0x239362=resolve(SKILLS_DIR,_0x534c1d+_0x254a6c(0x327));if(_0x2929a5[_0x254a6c(0x1c0)](_0x239362))_0x2929a5[_0x254a6c(0x37d)+_0x254a6c(0x1f9)](_0x239362,_0xd391);else{_0x428d66[_0x254a6c(0x34d)]=0x262+-0x1956+0x8*0x311,_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x254a6c(0x330)+'found'}));return;}}else _0x2929a5[_0x310ac2(0x37d)+_0x254a6c(0x1f9)](_0x12f4b5,_0xd391);const {loadSkills:_0x217eab}=await import(_0x254a6c(0x370)+_0x254a6c(0x2b9)+'s');_0x217eab(),_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'ok':!![]}));}catch(_0x496db0){_0x428d66[_0x310ac2(0x34d)]=0x103c+-0x2157+-0x3b*-0x51,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':_0x496db0 instanceof Error?_0x496db0[_0x310ac2(0x350)]:String(_0x496db0)}));}return;}if(_0x1ec270===_0x254a6c(0x284)+_0x254a6c(0x12b)&&_0xbb0ab0['method']===_0x310ac2(0x123)){try{const {id:_0x43e6ac}=JSON['parse'](_0x15594d);if(typeof _0x43e6ac!=='string'||_0x43e6ac[_0x310ac2(0x333)]('..')||_0x43e6ac['includes']('/')||_0x43e6ac[_0x310ac2(0x333)]('\x5c')||_0xd9de36['isAbsolute'](_0x43e6ac)){_0x428d66['statusCode']=0xc43+0x1537+0xff5*-0x2,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'Invalid\x20sk'+_0x254a6c(0x2e5)}));return;}const _0x1d61cb=resolve(SKILLS_DIR,_0x43e6ac),_0x30ffee=resolve(SKILLS_DIR,_0x43e6ac+_0x310ac2(0x327));if(_0x2929a5[_0x310ac2(0x1c0)](_0x1d61cb))_0x2929a5[_0x310ac2(0x188)](_0x1d61cb,{'recursive':!![]});else{if(_0x2929a5[_0x310ac2(0x1c0)](_0x30ffee))_0x2929a5[_0x254a6c(0x14a)](_0x30ffee);else{_0x428d66[_0x254a6c(0x34d)]=0x1a32+0x16aa+-0x4*0xbd2,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x254a6c(0x330)+'found'}));return;}}const {loadSkills:_0x5e81a5}=await import(_0x254a6c(0x370)+'s/skills.j'+'s');_0x5e81a5(),_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'ok':!![]}));}catch(_0x2ce149){_0x428d66['statusCode']=0x21e5+-0x9fb+-0x165a,_0x428d66['end'](JSON['stringify']({'error':_0x2ce149 instanceof Error?_0x2ce149[_0x254a6c(0x350)]:String(_0x2ce149)}));}return;}if(_0x1ec270===_0x310ac2(0x1fe)+'g'){_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'providers':config['fallbackPr'+_0x310ac2(0x2ca)],'primaryProvider':config[_0x310ac2(0x117)+_0x254a6c(0x14e)],'allowedUsers':config[_0x254a6c(0x318)+'rs'],'hasKeys':{'groq':!!config[_0x310ac2(0x1f1)]['groq'],'openai':!!config['apiKeys'][_0x310ac2(0x1ab)],'google':!!config[_0x310ac2(0x1f1)][_0x310ac2(0x2c3)],'nvidia':!!config[_0x254a6c(0x1f1)]['nvidia'],'openrouter':!!config[_0x310ac2(0x1f1)][_0x254a6c(0x31e)]}}));return;}if(_0x1ec270==='/api/sessi'+_0x310ac2(0x19f)){const _0x216961=getAllSessions(),_0xd88ea3=listProfiles(),_0x1355ab=Array['from'](_0x216961[_0x254a6c(0x320)]())[_0x310ac2(0x1e6)](([_0x239adf,_0x367c8a])=>{const _0x1f5115=_0x310ac2,_0x54a8ea=_0x310ac2,_0x6edbc3=Number(_0x239adf[_0x1f5115(0x27a)](':')['pop']()),_0x5a22fb=_0xd88ea3[_0x1f5115(0x35a)](_0x2f22ad=>_0x2f22ad[_0x54a8ea(0x336)]===_0x6edbc3);return{'userId':_0x239adf,'name':_0x5a22fb?.[_0x54a8ea(0x2f2)]||'User\x20'+_0x239adf,'username':_0x5a22fb?.[_0x54a8ea(0x129)],'messageCount':_0x367c8a[_0x54a8ea(0x2eb)+'nt'],'toolUseCount':_0x367c8a['toolUseCou'+'nt'],'totalCost':_0x367c8a[_0x1f5115(0x18d)],'totalInputTokens':_0x367c8a[_0x54a8ea(0x347)+_0x1f5115(0x214)]||-0x1*-0x1c87+0x25*-0x67+0x3*-0x48c,'totalOutputTokens':_0x367c8a[_0x54a8ea(0x128)+_0x54a8ea(0x14c)]||0x1eb*0xa+-0x2689+-0x135b*-0x1,'effort':_0x367c8a[_0x54a8ea(0x162)],'startedAt':_0x367c8a['startedAt'],'lastActivity':_0x367c8a[_0x54a8ea(0x12d)+'ty'],'historyLength':_0x367c8a[_0x54a8ea(0x34e)][_0x1f5115(0x37f)],'isProcessing':_0x367c8a[_0x1f5115(0x103)+'ng'],'provider':Object[_0x54a8ea(0x287)](_0x367c8a[_0x1f5115(0x291)+_0x54a8ea(0x373)])[_0x54a8ea(0x17b)](',\x20')||_0x54a8ea(0x2d9)};});_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'sessions':_0x1355ab}));return;}if(_0x1ec270[_0x310ac2(0x216)](/^\/api\/sessions\/\d+\/history$/)){const _0x57e374=parseInt(_0x1ec270[_0x310ac2(0x27a)]('/')[-0x1fc8+0x2*0x99d+0xc91]),_0x38541a=getSession(_0x57e374);_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'userId':_0x57e374,'history':_0x38541a['history'][_0x310ac2(0x1e6)](_0x1f63e7=>({'role':_0x1f63e7[_0x310ac2(0x2e1)],'content':_0x1f63e7['content'][_0x254a6c(0x124)](-0x142d*0x1+0x2181+0x355*-0x4,-0x48+0x215d+-0x1945)}))}));return;}if(_0x1ec270==='/api/files'){const _0x168b68=new URLSearchParams((_0xbb0ab0[_0x310ac2(0x181)]||'')[_0x310ac2(0x27a)]('?')[0x17fd+0x2014+-0x3810]||''),_0x386507=_0x168b68[_0x310ac2(0x1e4)](_0x310ac2(0x242))||'',_0x554243=resolve(BOT_ROOT,_0x386507||'.');if(!_0x554243['startsWith'](BOT_ROOT)){_0x428d66[_0x254a6c(0x34d)]=0xf9c+0x4*0x8e4+0x1*-0x3199,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':_0x254a6c(0x1e3)+'ied'}));return;}try{const _0x36fccc=_0x2929a5[_0x310ac2(0x331)](_0x554243);if(_0x36fccc['isDirector'+'y']()){const _0x2de3f8=_0x2929a5[_0x310ac2(0x1b2)+'c'](_0x554243,{'withFileTypes':!![]})[_0x254a6c(0x380)](_0x14ba99=>!_0x14ba99[_0x310ac2(0x2f2)][_0x254a6c(0x1e0)]('.')&&_0x14ba99['name']!==_0x310ac2(0x133)+'es')[_0x310ac2(0x1e6)](_0x519889=>({'name':_0x519889['name'],'type':_0x519889[_0x254a6c(0x247)+'y']()?_0x254a6c(0x365):_0x310ac2(0x342),'size':_0x519889[_0x310ac2(0x116)]()?_0x2929a5['statSync'](resolve(_0x554243,_0x519889['name']))[_0x310ac2(0x1ec)]:-0x74*-0x40+-0x535+-0x17cb,'modified':_0x2929a5['statSync'](resolve(_0x554243,_0x519889['name']))['mtimeMs']}))[_0x254a6c(0x199)]((_0x129c21,_0x3ed771)=>{const _0x11ee1e=_0x310ac2,_0x4b87d4=_0x254a6c;if(_0x129c21['type']!==_0x3ed771[_0x11ee1e(0x11b)])return _0x129c21[_0x4b87d4(0x11b)]==='dir'?-(0xc51+-0x15da+0x6f*0x16):0xab5*-0x2+-0x2*0x1c5+0x18f5*0x1;return _0x129c21[_0x11ee1e(0x2f2)]['localeComp'+_0x11ee1e(0x251)](_0x3ed771['name']);});_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'path':_0x386507||'.','entries':_0x2de3f8}));}else{const _0x4b9721=_0xd9de36[_0x254a6c(0x309)](_0x554243)['toLowerCas'+'e'](),_0x312ec5=new Set([_0x310ac2(0x327),_0x310ac2(0x11f),_0x310ac2(0x23d),_0x254a6c(0x378),_0x254a6c(0x134),_0x254a6c(0x297),_0x310ac2(0x2ae),_0x310ac2(0x2e4),_0x310ac2(0x25b),_0x310ac2(0x1ce),_0x310ac2(0x1d3),_0x254a6c(0x19a),'.yml','.yaml',_0x310ac2(0x2e3),'.ini',_0x310ac2(0x2a6),_0x254a6c(0x223),'.env',_0x254a6c(0x2fa),_0x254a6c(0x235),_0x310ac2(0x20a),_0x254a6c(0x1f8),_0x310ac2(0x307),_0x254a6c(0x1eb),_0x254a6c(0x371),_0x310ac2(0x31d),_0x310ac2(0x148),_0x254a6c(0x2b7),'.c','.cpp','.h',_0x254a6c(0x1dc),_0x310ac2(0x313),_0x254a6c(0x249),'.sql',_0x254a6c(0x2a4),_0x254a6c(0x2d6),_0x254a6c(0x215)+'e',_0x310ac2(0x115),_0x310ac2(0x1fb)+_0x310ac2(0x1c1),_0x254a6c(0x154)+'fig',_0x310ac2(0x126)+'c',_0x310ac2(0x122),_0x254a6c(0x209),_0x310ac2(0x1d6),_0x254a6c(0x2b3),_0x254a6c(0x326),_0x310ac2(0x130),_0x310ac2(0x127),_0x254a6c(0x2a7),_0x310ac2(0x12a),_0x310ac2(0x107),_0x310ac2(0x31f),_0x310ac2(0x288),_0x254a6c(0x1ef),'.svelte',_0x254a6c(0x1d9)]),_0x553ce1=new Set(['dockerfile',_0x310ac2(0x349),_0x254a6c(0x2cb),_0x254a6c(0x277),_0x254a6c(0x196),_0x254a6c(0x149)+'e',_0x310ac2(0x189),_0x254a6c(0x34b),_0x254a6c(0x11a),_0x254a6c(0x24c),'license','licence',_0x254a6c(0x33c),'changelog',_0x254a6c(0x15a),'contributo'+'rs']),_0x303b65=_0xd9de36[_0x254a6c(0x28a)](_0x554243)[_0x254a6c(0x33a)+'e'](),_0x2887c6=_0x553ce1[_0x254a6c(0x25f)](_0x303b65),_0x23e842=_0x312ec5[_0x310ac2(0x25f)](_0x4b9721)||_0x2887c6||!_0x4b9721&&_0x36fccc[_0x310ac2(0x1ec)]<0x1a6c1+0x1*-0x21196+0x1f175;if(_0x36fccc[_0x310ac2(0x1ec)]>0x1fca6+0x71959+-0x174df)_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'path':_0x386507,'content':_0x254a6c(0x340)+_0x310ac2(0x337)+(_0x36fccc[_0x310ac2(0x1ec)]/(0x1abc+-0x1d7a+-0x6be*-0x1))[_0x254a6c(0x21a)](-0x3*-0xc33+0x17*-0x157+-0x5c7)+('\x20KB\x20—\x20max\x20'+_0x310ac2(0x2ba)),'size':_0x36fccc[_0x254a6c(0x1ec)]}));else{if(_0x23e842)try{const _0x36cfe9=_0x2929a5[_0x254a6c(0x271)+'nc'](_0x554243,'utf-8'),_0x151290=[..._0x36cfe9[_0x310ac2(0x124)](0x14f1+-0x7*-0x482+0x1*-0x347f,0x871*-0x1+-0x4*-0x182+0x31*0x21)]['filter'](_0x269896=>_0x269896==='\x00')[_0x254a6c(0x37f)];_0x151290>-0xcff+-0x2f*0x40+0x1923?_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'path':_0x386507,'content':null,'size':_0x36fccc[_0x310ac2(0x1ec)],'binary':!![]})):_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'path':_0x386507,'content':_0x36cfe9,'size':_0x36fccc[_0x254a6c(0x1ec)]}));}catch{_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'path':_0x386507,'content':null,'size':_0x36fccc['size'],'binary':!![]}));}else _0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'path':_0x386507,'content':null,'size':_0x36fccc[_0x254a6c(0x1ec)],'binary':!![]}));}}}catch{_0x428d66['statusCode']=-0x1efd+0x14a1+0x8*0x17e,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x254a6c(0x1f6)}));}return;}if(_0x1ec270===_0x254a6c(0x230)+_0x254a6c(0x1af)&&_0xbb0ab0['method']==='POST'){try{const {path:_0x1e15d1,content:_0x4b91e9}=JSON['parse'](_0x15594d),_0x4a390d=resolve(BOT_ROOT,_0x1e15d1);if(!_0x4a390d[_0x310ac2(0x1e0)](BOT_ROOT)){_0x428d66['statusCode']=0x2*-0x45b+-0x7*-0x448+0x1*-0x13af,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':'Access\x20den'+_0x310ac2(0x168)}));return;}_0x2929a5[_0x310ac2(0x37d)+_0x254a6c(0x1f9)](_0x4a390d,_0x4b91e9),_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'ok':!![]}));}catch(_0x26114d){_0x428d66['statusCode']=-0xbb*-0x7+0x28*0x2+-0x3dd;const _0x45aad4=_0x26114d instanceof Error?_0x26114d[_0x310ac2(0x350)]:'Invalid\x20re'+'quest';_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x45aad4}));}return;}if(_0x1ec270===_0x310ac2(0x230)+'/delete'&&_0xbb0ab0[_0x310ac2(0x159)]===_0x254a6c(0x123)){try{const {path:_0x22d99d}=JSON[_0x254a6c(0x302)](_0x15594d),_0x28aefd=resolve(BOT_ROOT,_0x22d99d);if(!_0x28aefd[_0x254a6c(0x1e0)](BOT_ROOT)){_0x428d66[_0x254a6c(0x34d)]=-0x828+-0x1ffd+0x29b8,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':'Access\x20den'+'ied'}));return;}const _0x19c31f=[_0x310ac2(0x274),_0x310ac2(0x142)+'on',_0x254a6c(0x111)+_0x310ac2(0x1f3),'ecosystem.'+_0x310ac2(0x2cd)],_0x25872f=_0xd9de36[_0x310ac2(0x28a)](_0x28aefd);if(_0x19c31f[_0x254a6c(0x333)](_0x25872f)){_0x428d66[_0x310ac2(0x34d)]=-0x120a+-0x35e+-0x16fb*-0x1,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x25872f+(_0x254a6c(0x172)+'\x20deleted\x20('+'protected)')}));return;}if(!_0x2929a5[_0x310ac2(0x1c0)](_0x28aefd)){_0x428d66['statusCode']=0xfbb+0x22c2+-0x30e9,_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'error':_0x310ac2(0x36b)+_0x310ac2(0x100)}));return;}const _0x7d237b=_0x2929a5[_0x310ac2(0x331)](_0x28aefd);if(_0x7d237b['isDirector'+'y']()){_0x428d66[_0x254a6c(0x34d)]=-0xd71+0x2573*-0x1+0x3474,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x310ac2(0x310)+'s\x20cannot\x20b'+'e\x20deleted'}));return;}_0x2929a5[_0x254a6c(0x14a)](_0x28aefd),_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'ok':!![]}));}catch(_0x582754){_0x428d66[_0x310ac2(0x34d)]=0x1b81*0x1+-0x1bb+-0x1836*0x1;const _0x43a911=_0x582754 instanceof Error?_0x582754['message']:_0x254a6c(0x32e)+_0x310ac2(0x1bd);_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x43a911}));}return;}if(_0x1ec270==='/api/termi'+_0x310ac2(0x1c6)&&_0xbb0ab0[_0x310ac2(0x159)]===_0x254a6c(0x123)){try{const {command:_0x22defd}=JSON['parse'](_0x15594d);if(!_0x22defd){_0x428d66[_0x310ac2(0x34d)]=0x1f94+-0x941*-0x1+0xd17*-0x3,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':_0x310ac2(0x1aa)}));return;}if(_0x22defd[_0x310ac2(0x37f)]>-0x13*0x296+0xff*-0x2b+0x8307){_0x428d66[_0x310ac2(0x34d)]=-0x2675+0x1*-0x11d1+0x39d6*0x1,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':'Command\x20to'+'o\x20long\x20(ma'+'x\x2010000\x20ch'+'ars)'}));return;}const _0x41f5a9=typeof JSON['parse'](_0x15594d)[_0x254a6c(0x192)]==='string'?resolve(JSON[_0x310ac2(0x302)](_0x15594d)[_0x310ac2(0x192)]):BOT_ROOT,_0x2101c2=execSync(_0x22defd,{'cwd':_0x41f5a9,'stdio':'pipe','timeout':0x1d4c0,'env':{...process[_0x310ac2(0x1c8)],'PATH':process['env'][_0x254a6c(0x31b)]+(_0x310ac2(0x25c)+_0x310ac2(0x29c)+'usr/local/'+'bin')}})[_0x310ac2(0x12c)]();_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'output':_0x2101c2[_0x254a6c(0x124)](0x1b7d+0x1082+-0x2bff,-0xe2a9+0x2*0x521e+0x1c50d*0x1)}));}catch(_0x108450){const _0x2b8ced=_0x108450,_0x3f5bec=_0x2b8ced['stderr']?.[_0x310ac2(0x12c)]()?.[_0x310ac2(0x1e7)]()||'';_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'output':_0x3f5bec||_0x2b8ced['message'],'exitCode':0x1}));}return;}if(_0x1ec270==='/api/env'){try{const _0x4cefa3=_0x2929a5[_0x310ac2(0x1c0)](ENV_FILE)?_0x2929a5['readFileSy'+'nc'](ENV_FILE,_0x254a6c(0x240)):'',_0x1a7b27=_0x4cefa3[_0x310ac2(0x27a)]('\x0a')['filter'](_0x144c80=>_0x144c80['includes']('=')&&!_0x144c80[_0x254a6c(0x1e0)]('#')),_0x24989d=_0x1a7b27['map'](_0x6d082a=>{const _0x23ecfc=_0x254a6c,_0x103b37=_0x254a6c,[_0x4208d2,..._0x40d3c8]=_0x6d082a['split']('='),_0x43c254=_0x40d3c8['join']('=')[_0x23ecfc(0x1e7)](),_0x4f486b=_0x4208d2[_0x23ecfc(0x333)]('KEY')||_0x4208d2[_0x23ecfc(0x333)](_0x103b37(0x2d8))||_0x4208d2['includes'](_0x23ecfc(0x140))||_0x4208d2[_0x23ecfc(0x333)]('SECRET')?_0x43c254['length']>0xf9c+0xd3b+0x1cd3*-0x1?_0x43c254[_0x23ecfc(0x124)](-0x6e3+0x4cb*0x1+-0x2*-0x10c,0x132e+-0x2394+0x106a)+'...'+_0x43c254[_0x103b37(0x124)](-(0x79f*0x3+0x4c9+0x189*-0x12)):_0x103b37(0x2dc):_0x43c254;return{'key':_0x4208d2[_0x23ecfc(0x1e7)](),'value':_0x4f486b,'hasValue':_0x43c254[_0x23ecfc(0x37f)]>-0x3d*-0x29+0x1012+0x1b9*-0xf};});_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'vars':_0x24989d}));}catch{_0x428d66['end'](JSON['stringify']({'vars':[]}));}return;}if(_0x1ec270===_0x310ac2(0x316)+'et'&&_0xbb0ab0[_0x254a6c(0x159)]===_0x254a6c(0x123)){try{const {key:_0x1a7bd9,value:_0x414b08}=JSON[_0x310ac2(0x302)](_0x15594d);if(!_0x1a7bd9||typeof _0x1a7bd9!==_0x254a6c(0x2c8)||!_0x1a7bd9[_0x254a6c(0x216)](/^[A-Z_][A-Z0-9_]*$/)){_0x428d66[_0x254a6c(0x34d)]=0x1f96+-0x2*0x8e+-0x1cea,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x254a6c(0x1fd)+_0x310ac2(0x1ee)}));return;}if(typeof _0x414b08===_0x254a6c(0x2c8)&&/[\n\r]/['test'](_0x414b08)){_0x428d66[_0x254a6c(0x34d)]=-0x1*0x1f9a+-0x14f3+0x361d,_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'error':_0x254a6c(0x2c4)+_0x310ac2(0x328)+_0x254a6c(0x357)+_0x310ac2(0x30f)+_0x254a6c(0x1ba)}));return;}let _0x3061eb=_0x2929a5[_0x310ac2(0x1c0)](ENV_FILE)?_0x2929a5[_0x310ac2(0x271)+'nc'](ENV_FILE,_0x310ac2(0x240)):'';const _0x5dc7e2=new RegExp('^'+_0x1a7bd9+'=.*$','m');_0x5dc7e2[_0x254a6c(0x352)](_0x3061eb)?_0x3061eb=_0x3061eb[_0x254a6c(0x2f6)](_0x5dc7e2,_0x1a7bd9+'='+_0x414b08):_0x3061eb=_0x3061eb[_0x254a6c(0x22e)]()+('\x0a'+_0x1a7bd9+'='+_0x414b08+'\x0a'),writeSecure(ENV_FILE,_0x3061eb),_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'ok':!![],'note':_0x254a6c(0x2e9)+'quired\x20for'+_0x254a6c(0x1a1)+_0x254a6c(0x253)+'ect'}));}catch{_0x428d66[_0x310ac2(0x34d)]=-0x9cd+0x180f+0x145*-0xa,_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'error':'Invalid\x20re'+_0x254a6c(0x1bd)}));}return;}if(_0x1ec270==='/api/soul'){const _0x160fa2=getSoulContent();_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'content':_0x160fa2}));return;}if(_0x1ec270===_0x254a6c(0x276)+_0x310ac2(0x16d)&&_0xbb0ab0['method']==='POST'){try{const {content:_0x5aa558}=JSON[_0x254a6c(0x302)](_0x15594d),_0x5f3baa=SOUL_FILE;_0x2929a5[_0x254a6c(0x37d)+_0x310ac2(0x1f9)](_0x5f3baa,_0x5aa558),reloadSoul(),_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'ok':!![]}));}catch{_0x428d66[_0x254a6c(0x34d)]=-0xa*0x21e+0x1bc*-0x8+0x249c,_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'error':_0x310ac2(0x32e)+_0x254a6c(0x1bd)}));}return;}if(_0x1ec270===_0x310ac2(0x202)+_0x254a6c(0x1e5)){const _0x3a266f=[{'name':_0x310ac2(0x2f1),'key':'BOT_TOKEN','icon':'📱','configured':!!process[_0x254a6c(0x1c8)][_0x310ac2(0x198)]},{'name':_0x254a6c(0x1ae),'key':'DISCORD_TO'+_0x310ac2(0x26a),'icon':'🎮','configured':!!process[_0x254a6c(0x1c8)][_0x310ac2(0x2a3)+'KEN']},{'name':_0x254a6c(0x1db),'key':_0x254a6c(0x268)+'NABLED','icon':'💬','configured':process[_0x254a6c(0x1c8)][_0x310ac2(0x268)+_0x254a6c(0x30b)]==='true'},{'name':'Signal','key':_0x254a6c(0x16a)+_0x254a6c(0x2f4),'icon':'🔒','configured':!!process[_0x254a6c(0x1c8)][_0x254a6c(0x16a)+_0x254a6c(0x2f4)]},{'name':_0x254a6c(0x224),'key':_0x254a6c(0x10e),'icon':'🌐','configured':!![]}];_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'platforms':_0x3a266f}));return;}if(_0x1ec270===_0x310ac2(0x27c)+'rt'&&_0xbb0ab0['method']===_0x254a6c(0x123)){const {scheduleGracefulRestart:_0x2bfa86}=await import(_0x254a6c(0x370)+_0x310ac2(0x1a5)+'js');_0x428d66[_0x310ac2(0x10f)](JSON['stringify']({'ok':!![],'note':_0x254a6c(0x18b)+_0x310ac2(0x2b6)})),_0x2bfa86(0x1*-0xf61+0xf73+0x1e2);return;}if(_0x1ec270===_0x310ac2(0x325)+_0x310ac2(0x1d7)&&_0xbb0ab0[_0x310ac2(0x159)]===_0x310ac2(0x123)){try{const {messages:_0x5777fa,format:_0x4867a4}=JSON['parse'](_0x15594d);if(_0x4867a4===_0x254a6c(0x255))_0x428d66[_0x254a6c(0x376)](_0x254a6c(0x341)+'pe',_0x310ac2(0x263)+_0x254a6c(0x24b)),_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'export':_0x5777fa},null,-0x1814+0x10f9*0x1+0x25f*0x3));else{const _0xc4ad9a=_0x5777fa[_0x254a6c(0x1e6)](_0x5d7e54=>{const _0x53e470=_0x310ac2,_0x392073=_0x310ac2,_0x1aed9a=_0x5d7e54[_0x53e470(0x2e1)]===_0x53e470(0x2cf)?'**Du:**':_0x5d7e54[_0x392073(0x2e1)]===_0x392073(0x27f)?_0x53e470(0x164)+_0x392073(0x36c):'*System:*',_0x2cf888=_0x5d7e54[_0x53e470(0x19c)]?_0x53e470(0x324)+_0x5d7e54[_0x53e470(0x19c)]+')_':'';return''+_0x1aed9a+_0x2cf888+'\x0a'+_0x5d7e54[_0x53e470(0x362)]+'\x0a';})[_0x254a6c(0x17b)](_0x254a6c(0x37b));_0x428d66[_0x310ac2(0x376)]('Content-Ty'+'pe','text/markd'+_0x310ac2(0x280)),_0x428d66[_0x254a6c(0x10f)](_0x310ac2(0x20f)+'ort\x20—\x20Alvi'+_0x310ac2(0x155)+new Date()[_0x310ac2(0x2f5)+_0x310ac2(0x1bb)](_0x254a6c(0x11c))+_0x310ac2(0x2d1)+_0xc4ad9a);}}catch{_0x428d66[_0x310ac2(0x34d)]=0x395+-0x1fa6+-0x1*-0x1da1,_0x428d66[_0x254a6c(0x10f)](JSON[_0x310ac2(0x13f)]({'error':'Invalid\x20re'+_0x310ac2(0x1bd)}));}return;}if(_0x1ec270===_0x310ac2(0x15b)+_0x254a6c(0x137)&&_0xbb0ab0[_0x254a6c(0x159)]==='GET'){try{const {getWhatsAppAdapter:_0x1ab316}=await import('../platfor'+_0x310ac2(0x157)+_0x310ac2(0x294)),_0x544237=_0x1ab316();if(!_0x544237){_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'groups':[],'error':_0x254a6c(0x1fa)+'icht\x20verbu'+'nden'}));return;}const _0x447a15=await _0x544237[_0x310ac2(0x121)]();_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'groups':_0x447a15}));}catch(_0x2d8fcd){_0x428d66['end'](JSON[_0x254a6c(0x13f)]({'groups':[],'error':String(_0x2d8fcd)}));}return;}if(_0x1ec270[_0x254a6c(0x216)](/^\/api\/whatsapp\/groups\/[^/]+\/participants$/)){try{const _0x27f697=decodeURIComponent(_0x1ec270[_0x310ac2(0x27a)]('/')[-0x116*0x23+0x219c+-0x5*-0xe2]),{getWhatsAppAdapter:_0x3d41bc}=await import('../platfor'+_0x254a6c(0x157)+_0x310ac2(0x294)),_0x3c0ebe=_0x3d41bc();if(!_0x3c0ebe){_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'participants':[],'error':_0x254a6c(0x1fa)+'icht\x20verbu'+_0x310ac2(0x11d)}));return;}const _0x569d05=await _0x3c0ebe[_0x254a6c(0x35f)+_0x254a6c(0x308)](_0x27f697);_0x428d66[_0x310ac2(0x10f)](JSON[_0x310ac2(0x13f)]({'participants':_0x569d05}));}catch(_0x4aec0e){_0x428d66[_0x310ac2(0x10f)](JSON[_0x254a6c(0x13f)]({'participants':[],'error':String(_0x4aec0e)}));}return;}if(_0x1ec270==='/api/whats'+_0x310ac2(0x32d)+_0x310ac2(0x110)&&_0xbb0ab0[_0x254a6c(0x159)]===_0x254a6c(0x34a)){const {getGroupRules:_0x1fc91b}=await import(_0x310ac2(0x1cd)+_0x254a6c(0x157)+'p.js');_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'rules':_0x1fc91b()}));return;}if(_0x1ec270===_0x254a6c(0x15b)+_0x310ac2(0x32d)+_0x254a6c(0x110)&&_0xbb0ab0['method']===_0x310ac2(0x123)){try{const _0x5ce708=JSON[_0x310ac2(0x302)](_0x15594d);if(!_0x5ce708[_0x254a6c(0x20c)]){_0x428d66['statusCode']=0x251b+0x119*0xd+0x8*-0x63a,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':'groupId\x20is'+'t\x20erforder'+_0x254a6c(0x311)}));return;}const {upsertGroupRule:_0x2a4264}=await import(_0x254a6c(0x1cd)+_0x254a6c(0x157)+_0x254a6c(0x294)),_0x211734=_0x2a4264(_0x5ce708);_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'ok':!![],'rule':_0x211734}));}catch(_0x577d8c){_0x428d66[_0x310ac2(0x34d)]=0x124a+-0x21b6+0x10fc,_0x428d66['end'](JSON[_0x310ac2(0x13f)]({'error':String(_0x577d8c)}));}return;}if(_0x1ec270['match'](/^\/api\/whatsapp\/group-rules\//)&&_0xbb0ab0[_0x310ac2(0x159)]==='DELETE'){if(isExposedWithoutPassword()){_0x428d66[_0x254a6c(0x34d)]=0x265d+-0x17d*0x4+-0x1ed6*0x1,_0x428d66[_0x254a6c(0x10f)](JSON[_0x254a6c(0x13f)]({'error':_0x254a6c(0x160)+_0x310ac2(0x25d)+_0x310ac2(0x33b)+_0x310ac2(0x296)+'D'}));return;}const _0x14d351=decodeURIComponent(_0x1ec270[_0x310ac2(0x27a)]('/')[_0x254a6c(0x124)](0x1*-0x17cf+0x8d7+0xefc)[_0x254a6c(0x17b)]('/')),{deleteGroupRule:_0x373d99}=await import('../platfor'+_0x310ac2(0x157)+'p.js'),_0x811f42=_0x373d99(_0x14d351);_0x428d66['end'](JSON['stringify']({'ok':_0x811f42}));return;}_0x428d66['statusCode']=0x1*0x2429+-0xa86+0x180f*-0x1,_0x428d66[_0x254a6c(0x10f)](JSON['stringify']({'error':_0x310ac2(0x1f6)}));}const chatClients=new Set();broadcast['on'](_0x217a38(0x332),_0x4a5fe9=>{const _0x410e44=_0x217a38,_0x113967=_0x3da471;if(_0x4a5fe9[_0x410e44(0x22d)]!==_0x113967(0x2d2))return;const _0x8802e6=JSON['stringify']({'type':'mirror:use'+_0x410e44(0x145),'text':_0x4a5fe9[_0x410e44(0x362)],'platform':_0x4a5fe9['platform'],'userName':_0x4a5fe9['userName'],'ts':_0x4a5fe9['ts']});for(const _0x313d5b of chatClients){if(_0x313d5b[_0x113967(0x1c5)]===WebSocket[_0x410e44(0x2de)])_0x313d5b[_0x113967(0x266)](_0x8802e6);}}),broadcast['on']('response_s'+'tart',_0x20b0de=>{const _0x42db7e=_0x3da471,_0x89c228=_0x217a38;if(_0x20b0de[_0x42db7e(0x22d)]!==_0x42db7e(0x2d2))return;const _0x117353=JSON[_0x89c228(0x13f)]({'type':'mirror:res'+_0x89c228(0x1ff)+'t','platform':_0x20b0de['platform'],'ts':_0x20b0de['ts']});for(const _0x2b4fbd of chatClients){if(_0x2b4fbd['readyState']===WebSocket[_0x89c228(0x2de)])_0x2b4fbd['send'](_0x117353);}}),broadcast['on'](_0x3da471(0x28d)+_0x217a38(0x1f4),_0x2f5b99=>{const _0x1873ac=_0x217a38,_0x3d4d51=_0x217a38;if(_0x2f5b99[_0x1873ac(0x22d)]!=='telegram')return;const _0x2b0ca7=JSON[_0x1873ac(0x13f)]({'type':_0x1873ac(0x13a)+_0x1873ac(0x1d4)+'a','delta':_0x2f5b99[_0x1873ac(0x293)],'platform':_0x2f5b99[_0x1873ac(0x22d)],'ts':_0x2f5b99['ts']});for(const _0x23efa2 of chatClients){if(_0x23efa2[_0x1873ac(0x1c5)]===WebSocket[_0x3d4d51(0x2de)])_0x23efa2[_0x3d4d51(0x266)](_0x2b0ca7);}}),broadcast['on'](_0x217a38(0x28d)+'one',_0x29d102=>{const _0xc066f=_0x217a38,_0x3e0985=_0x217a38;if(_0x29d102[_0xc066f(0x22d)]!==_0x3e0985(0x2d2))return;const _0xb26cf2=JSON[_0xc066f(0x13f)]({'type':'mirror:res'+_0x3e0985(0x225),'cost':_0x29d102[_0x3e0985(0x379)],'platform':_0x29d102[_0x3e0985(0x22d)],'ts':_0x29d102['ts']});for(const _0x5f50a2 of chatClients){if(_0x5f50a2[_0xc066f(0x1c5)]===WebSocket[_0x3e0985(0x2de)])_0x5f50a2[_0xc066f(0x266)](_0xb26cf2);}});function handleWebSocket(_0x51d436){_0x51d436['on']('connection',(_0x26769b,_0x331571)=>{const _0x5e5722=_0x4a44,_0x1c302d=_0x4a44;if(WEB_PASSWORD&&!checkAuth(_0x331571)){_0x26769b['close'](0x1d31+-0x4*0x64e+0xba8,_0x5e5722(0x2e0)+'ticated');return;}const _0x2ec326=_0x331571[_0x1c302d(0x181)]||'/';if(_0x2ec326===_0x1c302d(0x1c9)){addCanvasClient(_0x26769b);return;}console[_0x5e5722(0x2bf)](_0x1c302d(0x37c)+_0x1c302d(0x285)+_0x5e5722(0x234)),chatClients[_0x5e5722(0x2e2)](_0x26769b),_0x26769b['on'](_0x5e5722(0x350),async _0x17514a=>{const _0x5612a7=_0x1c302d,_0xd80e73=_0x1c302d;try{const _0x2e0383=JSON['parse'](_0x17514a[_0x5612a7(0x12c)]());if(_0x2e0383[_0xd80e73(0x11b)]===_0x5612a7(0x32f)){let {text:_0x27d8d6,effort:_0x581fa9,file:_0x4448b6}=_0x2e0383;const _0x2b5134=_0x2e0383[_0xd80e73(0x239)],_0x29c455=config[_0x5612a7(0x318)+'rs'][0x49*-0x3f+-0x2160+0x3357*0x1]||0x1*-0x2670+-0xf3e+0x35ae;let _0x219d19;if(_0x2b5134==='tui'&&typeof _0x2e0383[_0x5612a7(0x2c9)]===_0xd80e73(0x2c8)&&_0x2e0383[_0xd80e73(0x2c9)][_0x5612a7(0x1e0)](_0xd80e73(0x14d)))_0x219d19=_0x2e0383[_0x5612a7(0x2c9)];else _0x2b5134==='telegram'?_0x219d19=_0x29c455:_0x219d19=_0x29c455;if(_0x4448b6?.[_0xd80e73(0x109)]&&_0x4448b6?.[_0xd80e73(0x2f2)])try{const _0x269ec1=resolve(DATA_DIR,_0xd80e73(0x281)+'s');if(!_0x2929a5['existsSync'](_0x269ec1))_0x2929a5[_0xd80e73(0x2ed)](_0x269ec1,{'recursive':!![]});const _0x56cfce=_0x4448b6['name'][_0x5612a7(0x2f6)](/[^a-zA-Z0-9._-]/g,'_'),_0xb60c53=resolve(_0x269ec1,Date[_0x5612a7(0x315)]()+'_'+_0x56cfce),_0x55b051=_0x4448b6[_0xd80e73(0x109)][_0xd80e73(0x27a)](',')[0x23f8+0x1226*0x1+0x1*-0x361d]||_0x4448b6[_0x5612a7(0x109)];_0x2929a5[_0xd80e73(0x37d)+_0x5612a7(0x1f9)](_0xb60c53,Buffer[_0xd80e73(0x213)](_0x55b051,_0xd80e73(0x104))),_0x27d8d6=_0x27d8d6[_0x5612a7(0x2f6)](/\[File attached:.*?\]/,'[File\x20save'+_0x5612a7(0x2f9)+_0xb60c53+']');}catch(_0xd01a28){console['error'](_0x5612a7(0x2f8)+_0x5612a7(0x191)+_0xd80e73(0x193),_0xd01a28);}const _0x42acff=getRegistry(),_0x40e1ac=_0x42acff[_0x5612a7(0x139)](),_0x23400a=_0x40e1ac[_0x5612a7(0x1a4)][_0xd80e73(0x11b)]===_0x5612a7(0x187),_0x482c1a=getSession(_0x219d19),_0x1ebe5b={'prompt':_0x27d8d6,'systemPrompt':buildSystemPrompt(_0x23400a,_0x482c1a[_0xd80e73(0x2e7)],_0x2b5134===_0xd80e73(0x2d2)?'telegram':_0xd80e73(0x299)+_0x5612a7(0x232)),'workingDir':_0x482c1a['workingDir'],'effort':_0x581fa9||_0x482c1a[_0x5612a7(0x162)],'sessionId':_0x23400a?_0x482c1a[_0xd80e73(0x13e)]:null,'history':!_0x23400a?_0x482c1a['history']:undefined};let _0x439962=![],_0x2413bc='';try{for await(const _0x21d0c9 of _0x42acff[_0xd80e73(0x184)+_0xd80e73(0x244)](_0x1ebe5b)){if(_0x26769b['readyState']!==WebSocket['OPEN'])break;switch(_0x21d0c9[_0xd80e73(0x11b)]){case _0x5612a7(0x362):if(_0x21d0c9['text'])_0x2413bc=_0x21d0c9[_0xd80e73(0x362)];_0x26769b[_0x5612a7(0x266)](JSON['stringify']({'type':_0x5612a7(0x362),'text':_0x21d0c9[_0xd80e73(0x362)],'delta':_0x21d0c9[_0x5612a7(0x293)]}));break;case _0xd80e73(0x222):_0x26769b['send'](JSON[_0xd80e73(0x13f)]({'type':_0x5612a7(0x360),'name':_0x21d0c9[_0x5612a7(0x14f)],'input':_0x21d0c9['toolInput']}));break;case _0xd80e73(0x2cc):_0x439962=!![];if(_0x21d0c9['text'])_0x2413bc=_0x21d0c9[_0x5612a7(0x362)];if(_0x21d0c9[_0xd80e73(0x13e)])_0x482c1a['sessionId']=_0x21d0c9['sessionId'];if(_0x21d0c9[_0xd80e73(0x16b)])_0x482c1a[_0x5612a7(0x18d)]+=_0x21d0c9['costUsd'];if(_0x21d0c9['inputToken'+'s'])_0x482c1a[_0x5612a7(0x347)+'Tokens']=(_0x482c1a['totalInput'+_0x5612a7(0x214)]||0x1bf*0x6+0x17b2+-0x222c)+_0x21d0c9[_0xd80e73(0x165)+'s'];if(_0x21d0c9[_0xd80e73(0x23c)+'ns'])_0x482c1a[_0xd80e73(0x128)+_0xd80e73(0x14c)]=(_0x482c1a[_0xd80e73(0x128)+_0x5612a7(0x14c)]||0xca1+0x15df+-0x8*0x450)+_0x21d0c9[_0x5612a7(0x23c)+'ns'];_0x26769b['send'](JSON[_0xd80e73(0x13f)]({'type':_0xd80e73(0x2cc),'cost':_0x21d0c9['costUsd'],'sessionId':_0x21d0c9[_0xd80e73(0x13e)],'inputTokens':_0x21d0c9[_0x5612a7(0x165)+'s'],'outputTokens':_0x21d0c9[_0xd80e73(0x23c)+'ns'],'sessionTokens':{'input':_0x482c1a['totalInput'+_0xd80e73(0x214)]||0x2409+0x1*0x19a9+-0x1ed9*0x2,'output':_0x482c1a[_0xd80e73(0x128)+_0x5612a7(0x14c)]||0x67f+0x70*0x30+-0x1b7f}}));break;case _0x5612a7(0x26c):_0x26769b[_0x5612a7(0x266)](JSON[_0xd80e73(0x13f)]({'type':_0x5612a7(0x26c),'error':_0x21d0c9[_0xd80e73(0x26c)]})),_0x439962=!![];break;case'fallback':_0x26769b['send'](JSON[_0xd80e73(0x13f)]({'type':'fallback','from':_0x21d0c9['failedProv'+'ider'],'to':_0x21d0c9[_0x5612a7(0x1e9)+'me']}));break;}}!_0x439962&&_0x26769b[_0xd80e73(0x1c5)]===WebSocket[_0xd80e73(0x2de)]&&_0x26769b[_0xd80e73(0x266)](JSON[_0xd80e73(0x13f)]({'type':_0xd80e73(0x2cc),'cost':0x0}));if(_0x2b5134===_0x5612a7(0x2d2)&&_0x2413bc[_0xd80e73(0x1e7)]())try{const _0x5778b9=await import(_0xd80e73(0x370)+_0xd80e73(0x367)+_0xd80e73(0x23f));_0x5778b9['enqueue'](_0xd80e73(0x2d2),String(_0x29c455),_0x2413bc);}catch(_0x3d3f6f){console['error'](_0x5612a7(0x158)+'legram\x20rel'+_0xd80e73(0x2ac),_0x3d3f6f);}}catch(_0x1f3892){const _0x29a7cd=_0x1f3892 instanceof Error?_0x1f3892[_0xd80e73(0x350)]:String(_0x1f3892);console[_0xd80e73(0x26c)]('WebUI\x20stre'+_0xd80e73(0x306),_0x29a7cd),_0x26769b[_0xd80e73(0x1c5)]===WebSocket[_0x5612a7(0x2de)]&&(_0x26769b[_0x5612a7(0x266)](JSON[_0x5612a7(0x13f)]({'type':_0xd80e73(0x26c),'error':_0x29a7cd})),!_0x439962&&_0x26769b[_0x5612a7(0x266)](JSON[_0x5612a7(0x13f)]({'type':_0xd80e73(0x2cc),'cost':0x0})));}}if(_0x2e0383[_0xd80e73(0x11b)]===_0x5612a7(0x29b)){const _0x29e43d=_0x2e0383[_0xd80e73(0x239)],_0xdbd994=config['allowedUse'+'rs'][0x90d+0x1*-0x1d+-0x8f0]||0x22be+0x1ed0+-0x418e;let _0x23867c;_0x29e43d==='tui'&&typeof _0x2e0383[_0x5612a7(0x2c9)]===_0xd80e73(0x2c8)&&_0x2e0383['sessionKey'][_0x5612a7(0x1e0)](_0xd80e73(0x14d))?_0x23867c=_0x2e0383['sessionKey']:_0x23867c=_0xdbd994,resetSession(_0x23867c),_0x26769b['send'](JSON[_0x5612a7(0x13f)]({'type':_0x5612a7(0x29b),'ok':!![]}));}}catch(_0x3d798d){const _0x2cfc37=_0x3d798d instanceof Error?_0x3d798d[_0xd80e73(0x350)]:String(_0x3d798d);_0x26769b[_0xd80e73(0x266)](JSON[_0xd80e73(0x13f)]({'type':_0x5612a7(0x26c),'error':_0x2cfc37}));}}),_0x26769b['on']('close',()=>{const _0x3c3376=_0x1c302d,_0x38fde6=_0x1c302d;console[_0x3c3376(0x2bf)](_0x38fde6(0x37c)+_0x3c3376(0x2b0)+_0x38fde6(0x26b)),chatClients[_0x3c3376(0x1b9)](_0x26769b);});});}function handleWebRequest(_0x3214f2,_0x5b326e){const _0x29b4c1=_0x217a38,_0x1548c3=_0x217a38;let _0x3604a2='';_0x3214f2['on'](_0x29b4c1(0x275),_0x5a159a=>{_0x3604a2+=_0x5a159a;}),_0x3214f2['on'](_0x29b4c1(0x10f),()=>{const _0x5e0da9=_0x1548c3,_0x2fab8d=_0x29b4c1,_0x9dd217=(_0x3214f2[_0x5e0da9(0x181)]||'/')[_0x5e0da9(0x27a)]('?')[0x35d*0x4+0xbe*-0xe+-0x62*0x8];if(_0x9dd217[_0x5e0da9(0x1e0)](_0x2fab8d(0x243))){handleOpenAICompat(_0x3214f2,_0x5b326e,_0x9dd217,_0x3604a2);return;}if(_0x9dd217[_0x5e0da9(0x1e0)]('/api/')){handleAPI(_0x3214f2,_0x5b326e,_0x9dd217,_0x3604a2);return;}if(_0x9dd217[_0x2fab8d(0x1e0)](_0x5e0da9(0x1c3))){handleAPI(_0x3214f2,_0x5b326e,_0x9dd217,_0x3604a2);return;}if(WEB_PASSWORD&&!checkAuth(_0x3214f2)&&_0x9dd217!==_0x2fab8d(0x212)+'l'){_0x5b326e[_0x5e0da9(0x1cf)](0x893*-0x2+-0x7*0x577+0x3895,{'Location':_0x5e0da9(0x212)+'l'}),_0x5b326e[_0x2fab8d(0x10f)]();return;}if(_0x9dd217===_0x2fab8d(0x257)){const _0x43f7a6=resolve(PUBLIC_DIR,'canvas.htm'+'l');try{const _0x2970c3=_0x2929a5['readFileSy'+'nc'](_0x43f7a6);_0x5b326e[_0x2fab8d(0x376)](_0x2fab8d(0x341)+'pe',_0x5e0da9(0x2b8)),_0x5b326e[_0x5e0da9(0x10f)](_0x2970c3);}catch{_0x5b326e['statusCode']=-0xa17+0x7*0x21b+-0x312,_0x5b326e['end'](_0x5e0da9(0x1f6));}return;}let _0x4a797c=_0x9dd217==='/'?'/index.htm'+'l':_0x9dd217;_0x4a797c=resolve(PUBLIC_DIR,_0x4a797c['slice'](0x2a3+-0x1eed+0x1c4b));if(!_0x4a797c[_0x2fab8d(0x1e0)](PUBLIC_DIR)){_0x5b326e['statusCode']=-0x1*-0x1cb7+0x1919+0x343d*-0x1,_0x5b326e[_0x2fab8d(0x10f)](_0x2fab8d(0x323));return;}try{const _0x53e8aa=_0x2929a5[_0x2fab8d(0x271)+'nc'](_0x4a797c),_0x2a4884=_0xd9de36[_0x5e0da9(0x309)](_0x4a797c);_0x5b326e['setHeader'](_0x5e0da9(0x341)+'pe',MIME[_0x2a4884]||_0x2fab8d(0x263)+_0x5e0da9(0x375)+'ream'),_0x5b326e[_0x2fab8d(0x10f)](_0x53e8aa);}catch{_0x5b326e[_0x5e0da9(0x34d)]=-0x1*0x995+0x8*-0x16c+0x1689,_0x5b326e['end']('Not\x20found');}});}export function startWebServer(){const _0x2482ce=_0x3da471;stopRequested=![],scheduleBindAttempt(parseInt(process['env'][_0x2482ce(0x10e)]||'3100',-0x2*-0xb77+0x1e13*0x1+-0x34f7),-0x3*0x5f3+0x9e5*-0x1+-0x35*-0x86);}function scheduleBindAttempt(_0x390fac,_0x12d65b){const _0x292262=_0x3da471,_0x407f8f=_0x3da471;if(stopRequested)return;const _0x434b38=parseInt(process[_0x292262(0x1c8)][_0x407f8f(0x10e)]||_0x407f8f(0x18a)),_0xf8adf3=_0x547279[_0x407f8f(0x273)+'er'](handleWebRequest);let _0x1a0942=![];const _0x3818e4=()=>{const _0x29aa70=_0x407f8f,_0x3ed6a6=_0x407f8f;try{_0xf8adf3['removeAllL'+_0x29aa70(0x178)](_0x3ed6a6(0x26c));}catch{}try{_0xf8adf3['close'](()=>{});}catch{}},_0x26d422=_0x42866b=>{const _0x46790f=_0x407f8f,_0x1e6014=_0x292262;if(_0x1a0942)return;_0x1a0942=!![],_0x3818e4();if(stopRequested)return;const _0x131ff9=decideNextBindAction(_0x42866b,_0x12d65b,{'originalPort':_0x434b38,'maxPortTries':MAX_PORT_TRIES,'backgroundRetryMs':BACKGROUND_RETRY_MS});if(_0x131ff9[_0x46790f(0x11b)]==='retry-port'){console[_0x46790f(0x37a)](_0x1e6014(0x33e)+'\x20'+_0x390fac+_0x46790f(0x283)+(_0x42866b[_0x46790f(0x260)]||_0x42866b[_0x46790f(0x350)])+(_0x46790f(0x1bf)+'\x20')+_0x131ff9[_0x46790f(0x174)]),scheduleBindAttempt(_0x131ff9[_0x1e6014(0x174)],_0x131ff9[_0x46790f(0x210)]);return;}console['warn'](_0x1e6014(0x1e1)+_0x46790f(0x28b)+(_0x42866b[_0x1e6014(0x260)]||_0x42866b[_0x1e6014(0x350)])+')\x20—\x20'+('backing\x20of'+'f\x20'+_0x131ff9[_0x1e6014(0x303)]/(-0x281+-0x30*-0xa7+-0x18e7)+(_0x1e6014(0x377)+'rying\x20port'+'\x20')+_0x131ff9[_0x1e6014(0x174)]+'.\x20')+(_0x1e6014(0x24d)+'ffected;\x20T'+_0x46790f(0x2c5)+_0x1e6014(0x2bd)+'.')),bindRetryTimer=setTimeout(()=>{const _0x2a663e=_0x1e6014;bindRetryTimer=null,scheduleBindAttempt(_0x131ff9[_0x2a663e(0x174)],0x2585+-0xe*0x179+-0x1*0x10e7);},_0x131ff9[_0x1e6014(0x303)]);};_0xf8adf3['on'](_0x292262(0x26c),_0x26d422);try{const _0x37d6f2=config[_0x292262(0x261)]==='*'||config['webHost']===''?undefined:config[_0x407f8f(0x261)];_0xf8adf3[_0x407f8f(0x151)](_0x390fac,_0x37d6f2,()=>{const _0x3069af=_0x407f8f,_0x4a065c=_0x407f8f;if(_0x1a0942)return;_0x1a0942=!![];const _0x313951=new WebSocketServer({'server':_0xf8adf3});handleWebSocket(_0x313951),currentServer=_0xf8adf3,wsServerRef=_0x313951,actualWebPort=_0x390fac,_0xf8adf3[_0x3069af(0x118)+_0x3069af(0x17f)]('error',_0x26d422),_0xf8adf3['on']('error',_0x2d3091=>{const _0xb87f19=_0x3069af,_0x23cfbf=_0x4a065c;console['warn'](_0xb87f19(0x1c2)+'-bind\x20serv'+_0xb87f19(0x29e)+_0x23cfbf(0x2b1)+_0x2d3091[_0x23cfbf(0x350)]);});const _0x1b242a=_0x37d6f2&&_0x37d6f2!==_0x3069af(0x37e)&&_0x37d6f2!==_0x3069af(0x2c7)?'http://'+_0x37d6f2+':'+actualWebPort+(_0x37d6f2===_0x4a065c(0x1a7)?_0x4a065c(0x22c)+'hable)':''):'http://loc'+_0x4a065c(0x2ee)+actualWebPort;console['log'](_0x4a065c(0x355)+_0x1b242a),actualWebPort!==_0x434b38&&console['log']('\x20\x20\x20(Port\x20'+_0x434b38+(_0x3069af(0x169)+_0x3069af(0x2a5))+actualWebPort+_0x4a065c(0x132)),isExposedWithoutPassword()&&console['log'](_0x4a065c(0x30d)+_0x3069af(0x20b)+_0x3069af(0x105)+'o\x20WEB_PASS'+'WORD:\x20muta'+_0x4a065c(0x1ac)+_0x4a065c(0x16f)+_0x3069af(0x221)+_0x3069af(0x238)+(_0x3069af(0x2be)+_0x4a065c(0x2db)+_0x3069af(0x33f)+_0x4a065c(0x218)+_0x4a065c(0x120)+'ot/.env\x20to'+_0x4a065c(0x12f)+_0x4a065c(0x2df))+('or\x20restric'+_0x3069af(0x183)+_0x3069af(0x226)+'EB_HOST=12'+_0x4a065c(0x295)));});}catch(_0x73ba63){_0x26d422(_0x73ba63);}}export async function closeHttpServerGracefully(_0x33b639){const _0x5cb13d=_0x217a38,_0x76f390=_0x3da471;if(!_0x33b639[_0x5cb13d(0x262)])return;try{const _0x36d28c=_0x33b639;if(typeof _0x36d28c['closeIdleC'+_0x76f390(0x250)]==='function')_0x36d28c[_0x5cb13d(0x200)+_0x5cb13d(0x250)]();if(typeof _0x36d28c[_0x5cb13d(0x207)+_0x76f390(0x2bc)]===_0x76f390(0x270))_0x36d28c['closeAllCo'+'nnections']();}catch{}await new Promise(_0x38bf21=>{_0x33b639['close'](()=>_0x38bf21());});}export async function stopWebServer(){const _0x2e12ee=_0x217a38,_0x551571=_0x217a38;stopRequested=!![];bindRetryTimer&&(clearTimeout(bindRetryTimer),bindRetryTimer=null);if(wsServerRef){try{for(const _0x25c440 of wsServerRef[_0x2e12ee(0x1a2)]){try{_0x25c440[_0x551571(0x147)]();}catch{}}await new Promise(_0x363f95=>wsServerRef[_0x551571(0x197)](()=>_0x363f95()));}catch{}wsServerRef=null;}if(currentServer){try{await closeHttpServerGracefully(currentServer);}catch{}currentServer=null;}}export function getWebPort(){return actualWebPort;}