alvin-bot 5.7.0 → 5.8.1

package/dist/web/server.js

@@ -1,1902 +1 @@
-/**
- * Web Server — Local dashboard for Alvin Bot.
- *
- * Provides:
- * - Static file serving (web/public/)
- * - WebSocket for real-time chat + streaming
- * - REST API for settings, memory, sessions, etc.
- * - Simple password auth (WEB_PASSWORD env var)
- */
-import http from "http";
-import fs from "fs";
-import path from "path";
-import { resolve } from "path";
-import { execSync } from "child_process";
-import crypto from "crypto";
-import { WebSocketServer, WebSocket } from "ws";
-import { getRegistry } from "../engine.js";
-import { getSession, resetSession, getAllSessions } from "../services/session.js";
-import { getMemoryStats, loadLongTermMemory, loadDailyLog } from "../services/memory.js";
-import { getIndexStats } from "../services/embeddings.js";
-import { getLoadedPlugins } from "../services/plugins.js";
-import { getMCPStatus } from "../services/mcp.js";
-import { listProfiles } from "../services/users.js";
-import { listCustomTools, getCustomTools, executeCustomTool } from "../services/custom-tools.js";
-import { buildSystemPrompt, reloadSoul, getSoulContent } from "../services/personality.js";
-import { config } from "../config.js";
-import { handleSetupAPI } from "./setup-api.js";
-import { handleDoctorAPI } from "./doctor-api.js";
-import { handleOpenAICompat } from "./openai-compat.js";
-import { addCanvasClient } from "./canvas.js";
-import { BOT_ROOT, ENV_FILE, PUBLIC_DIR, MEMORY_DIR, MEMORY_FILE, SOUL_FILE, DATA_DIR, MCP_CONFIG, SKILLS_DIR } from "../paths.js";
-import { writeSecure } from "../services/file-permissions.js";
-import { timingSafeBearerMatch } from "../services/timing-safe-bearer.js";
-import { broadcast } from "../services/broadcast.js";
-import { BOT_VERSION } from "../version.js";
-import { decideNextBindAction } from "./bind-strategy.js";
-const WEB_PORT = parseInt(process.env.WEB_PORT || "3100");
-/** Tuning for the bind loop. Walk the port ladder `MAX_PORT_TRIES` times
- *  then fall back to a `BACKGROUND_RETRY_MS` idle loop — the bot keeps
- *  running on Telegram either way; see bind-strategy.ts for the pure
- *  decision logic. */
-const MAX_PORT_TRIES = 20;
-const BACKGROUND_RETRY_MS = 30_000;
-/** Current live http.Server, if one has successfully bound. */
-let currentServer = null;
-/** Current live WebSocketServer attached to currentServer. */
-let wsServerRef = null;
-/** Background-retry timer handle — set when the bind loop is in its
- *  idle wait between cycles, cleared when stopWebServer() cancels. */
-let bindRetryTimer = null;
-/** Flag flipped by stopWebServer(). Every bind-loop callback checks
- *  this and exits silently if set, so stop is truly terminal. */
-let stopRequested = false;
-const WEB_PASSWORD = process.env.WEB_PASSWORD || "";
-/**
- * v5.7.0 — Per-boot random token guarding POST /internal/subagent-exit.
- * Generated once at module load; never persisted, never logged. The
- * detached-agent exit hook reads it in-process via getInternalToken().
- * The route is loopback-bound by default; this token additionally
- * defends the opt-in WEB_HOST=0.0.0.0 (LAN-exposed) case. 48 hex chars.
- */
-const INTERNAL_TOKEN = crypto.randomBytes(24).toString("hex");
-/** In-process accessor for the per-boot internal-route token. */
-export function getInternalToken() {
-    return INTERNAL_TOKEN;
-}
-/** The actual port the Web UI is running on (may differ from WEB_PORT if busy). */
-let actualWebPort = WEB_PORT;
-// ── MIME Types ──────────────────────────────────────────
-const MIME = {
-    ".html": "text/html",
-    ".css": "text/css",
-    ".js": "application/javascript",
-    ".json": "application/json",
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".svg": "image/svg+xml",
-    ".ico": "image/x-icon",
-};
-// ── Auth ────────────────────────────────────────────────
-const activeSessions = new Set();
-function generateToken() {
-    return Array.from(crypto.getRandomValues(new Uint8Array(32)))
-        .map(b => b.toString(16).padStart(2, "0")).join("");
-}
-function checkAuth(req) {
-    if (!WEB_PASSWORD)
-        return true; // No password = open access
-    const cookie = req.headers.cookie || "";
-    const token = cookie.match(/alvinbot_token=([a-f0-9]+)/)?.[1];
-    return token ? activeSessions.has(token) : false;
-}
-/** Returns true when the server is exposed to non-loopback addresses but
- *  WEB_PASSWORD is empty.  In that state every mutating / exec endpoint is
- *  hard-refused regardless of any session cookie. */
-function isExposedWithoutPassword() {
-    if (WEB_PASSWORD)
-        return false; // password set → normal auth path
-    const h = config.webHost;
-    // loopback addresses are safe even without a password
-    if (!h || h === "127.0.0.1" || h === "::1" || h === "localhost")
-        return false;
-    return true; // non-loopback + no password = exposed
-}
-// ── REST API ────────────────────────────────────────────
-async function handleAPI(req, res, urlPath, body) {
-    res.setHeader("Content-Type", "application/json");
-    // POST /api/login
-    if (urlPath === "/api/login" && req.method === "POST") {
-        try {
-            const { password } = JSON.parse(body);
-            // v5.x — refuse login entirely when WEB_PASSWORD is not set.
-            // Previously `!WEB_PASSWORD || password === WEB_PASSWORD` minted a
-            // session for ANY input (including "") when the env var was absent,
-            // effectively making every unauthenticated request a valid session.
-            // timingSafeBearerMatch already rejects empty expectedToken → reuse it
-            // by wrapping the provided password as a synthetic "Bearer <pw>" header.
-            const authOk = timingSafeBearerMatch(`Bearer ${password}`, WEB_PASSWORD);
-            if (authOk) {
-                const token = generateToken();
-                activeSessions.add(token);
-                res.setHeader("Set-Cookie", `alvinbot_token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`);
-                res.end(JSON.stringify({ ok: true }));
-            }
-            else {
-                res.statusCode = 401;
-                res.end(JSON.stringify({ error: "Wrong password" }));
-            }
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // POST /api/webhook — external trigger endpoint with bearer auth (no cookie auth needed)
-    if (urlPath === "/api/webhook" && req.method === "POST") {
-        if (!config.webhookEnabled) {
-            res.writeHead(404);
-            res.end(JSON.stringify({ error: "Webhooks disabled" }));
-            return;
-        }
-        // v4.12.2 — timing-safe bearer token comparison. Previously used
-        // naive !== which leaks comparison position via timing side-channel.
-        if (!timingSafeBearerMatch(req.headers.authorization, config.webhookToken ?? "")) {
-            res.writeHead(401);
-            res.end(JSON.stringify({ error: "Unauthorized" }));
-            return;
-        }
-        try {
-            const payload = JSON.parse(body);
-            if (!payload.message) {
-                res.writeHead(400);
-                res.end(JSON.stringify({ error: "Missing message field" }));
-                return;
-            }
-            const channel = payload.channel || "telegram";
-            const chatId = payload.chatId || String(config.allowedUsers[0] || "");
-            const { enqueue } = await import("../services/delivery-queue.js");
-            const id = enqueue(channel, chatId, `[Webhook: ${payload.event || "unknown"}] ${payload.message}`);
-            res.writeHead(200);
-            res.end(JSON.stringify({ ok: true, queued: id }));
-        }
-        catch {
-            res.writeHead(400);
-            res.end(JSON.stringify({ error: "Invalid JSON body" }));
-        }
-        return;
-    }
-    // POST /internal/subagent-exit — detached sub-agent exit push (v5.7.0).
-    // Always available (NO WEBHOOK_ENABLED dependency, so it works for every
-    // install with zero config); loopback-bound by default; per-boot bearer
-    // token. Reads the agent's jsonl, classifies, delivers immediately
-    // (claim-gated). Idempotent — a repeat POST is a 404 no-op.
-    if (urlPath === "/internal/subagent-exit" && req.method === "POST") {
-        // The legitimate payload is ~80 bytes ({agentId, exitCode}). Reject
-        // anything absurd before the auth compare so an unauthenticated
-        // caller (only reachable at all under the opt-in WEB_HOST=0.0.0.0)
-        // cannot push large bodies through this always-on route. (A deeper
-        // streaming cap on the shared body accumulator — also used by
-        // /api/ and /v1/ — is a separate pre-existing hardening item.)
-        if (body.length > 8 * 1024) {
-            res.statusCode = 413;
-            res.end(JSON.stringify({ error: "Payload too large" }));
-            return;
-        }
-        if (!timingSafeBearerMatch(req.headers.authorization, INTERNAL_TOKEN)) {
-            res.statusCode = 401;
-            res.end(JSON.stringify({ error: "Unauthorized" }));
-            return;
-        }
-        let agentId;
-        try {
-            const payload = JSON.parse(body);
-            agentId = typeof payload.agentId === "string" ? payload.agentId : "";
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid JSON body" }));
-            return;
-        }
-        if (!agentId) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Missing agentId" }));
-            return;
-        }
-        try {
-            const { deliverByAgentId } = await import("../services/async-agent-watcher.js");
-            const outcome = await deliverByAgentId(agentId);
-            res.statusCode = outcome === "unknown" ? 404 : outcome === "pending" ? 202 : 200;
-            res.end(JSON.stringify({ ok: outcome !== "unknown", outcome }));
-        }
-        catch (err) {
-            res.statusCode = 500;
-            res.end(JSON.stringify({ error: "delivery failed" }));
-            console.error("[internal/subagent-exit] delivery error:", err);
-        }
-        return;
-    }
-    // Auth check for all other API routes
-    if (!checkAuth(req)) {
-        res.statusCode = 401;
-        res.end(JSON.stringify({ error: "Not authenticated" }));
-        return;
-    }
-    // Hard gate: when the web server is reachable from non-loopback addresses
-    // and WEB_PASSWORD is empty, mutating/exec endpoints are refused outright.
-    // Local dev (127.0.0.1 + no password) is intentionally unaffected.
-    // Endpoints that write files, execute commands, or modify configuration
-    // are in scope; read-only status/config endpoints are not gated.
-    const EXPOSED_DANGEROUS_ROUTES = new Set([
-        "/api/terminal",
-        "/api/skills/create",
-        "/api/skills/update",
-        "/api/skills/delete",
-        "/api/files/save",
-        "/api/files/delete",
-        "/api/env/set",
-        "/api/setup-wizard",
-        "/api/soul/save",
-        "/api/memory/save",
-        "/api/memory/delete",
-        "/api/session/reset",
-        // cron — /api/cron/add was wrong; real route is /api/cron/create
-        "/api/cron/create",
-        "/api/cron/update",
-        "/api/cron/delete",
-        "/api/cron/toggle",
-        "/api/cron/run",
-        "/api/plugin/install",
-        "/api/plugin/uninstall",
-        // shell / process exec
-        "/api/tools/execute",
-        "/api/sudo/exec",
-        "/api/sudo/setup",
-        "/api/sudo/admin-dialog",
-        "/api/sudo/revoke",
-        // key / env writes
-        "/api/providers/set-key",
-        "/api/providers/set-primary",
-        "/api/providers/set-fallbacks",
-        "/api/providers/add-custom",
-        "/api/providers/remove-custom",
-        // platform config writes (writes ENV vars / runs npm install)
-        "/api/platforms/configure",
-        "/api/platforms/install-deps",
-        // provider / fallback order writes
-        "/api/fallback",
-        "/api/fallback/move",
-        // MCP config writes
-        "/api/mcp/add",
-        "/api/mcp/remove",
-        // process restart (DoS vector)
-        "/api/restart",
-        // model switching (affects all users)
-        "/api/models/switch",
-        // WhatsApp auth / config writes
-        "/api/whatsapp/disconnect",
-        "/api/whatsapp/group-rules",
-    ]);
-    if (isExposedWithoutPassword() && EXPOSED_DANGEROUS_ROUTES.has(urlPath)) {
-        res.statusCode = 403;
-        res.end(JSON.stringify({ error: "refused: web exposed without WEB_PASSWORD" }));
-        return;
-    }
-    // ── Setup APIs (platforms + models) ─────────────────
-    const handled = await handleSetupAPI(req, res, urlPath, body);
-    if (handled)
-        return;
-    // ── Doctor & Backup APIs ──────────────────────────
-    const doctorHandled = await handleDoctorAPI(req, res, urlPath, body);
-    if (doctorHandled)
-        return;
-    // GET /api/setup-check — is the bot fully configured?
-    if (urlPath === "/api/setup-check") {
-        const envPath = ENV_FILE;
-        let env = {};
-        try {
-            const lines = fs.readFileSync(envPath, "utf-8").split("\n");
-            for (const line of lines) {
-                if (line.startsWith("#") || !line.includes("="))
-                    continue;
-                const idx = line.indexOf("=");
-                env[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();
-            }
-        }
-        catch { }
-        const hasBotToken = !!(env.BOT_TOKEN || process.env.BOT_TOKEN);
-        const hasAllowedUsers = !!(env.ALLOWED_USERS || process.env.ALLOWED_USERS);
-        const hasPrimaryProvider = !!(env.PRIMARY_PROVIDER || process.env.PRIMARY_PROVIDER);
-        // Check which providers have keys
-        const providerKeys = {
-            groq: !!(env.GROQ_API_KEY || process.env.GROQ_API_KEY),
-            openai: !!(env.OPENAI_API_KEY || process.env.OPENAI_API_KEY),
-            google: !!(env.GOOGLE_API_KEY || process.env.GOOGLE_API_KEY),
-            nvidia: !!(env.NVIDIA_API_KEY || process.env.NVIDIA_API_KEY),
-            anthropic: !!(env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_API_KEY),
-            openrouter: !!(env.OPENROUTER_API_KEY || process.env.OPENROUTER_API_KEY),
-        };
-        const hasAnyProvider = hasPrimaryProvider || Object.values(providerKeys).some(Boolean);
-        // Check Claude CLI
-        let claudeCliInstalled = false;
-        try {
-            const { execSync } = await import("child_process");
-            execSync("claude --version", { timeout: 5000, stdio: "pipe" });
-            claudeCliInstalled = true;
-        }
-        catch { }
-        const isComplete = hasBotToken && hasAllowedUsers && hasAnyProvider;
-        res.end(JSON.stringify({
-            isComplete,
-            steps: {
-                telegram: { done: hasBotToken && hasAllowedUsers, botToken: hasBotToken, allowedUsers: hasAllowedUsers },
-                provider: { done: hasAnyProvider, primary: env.PRIMARY_PROVIDER || process.env.PRIMARY_PROVIDER || "", keys: providerKeys, claudeCli: claudeCliInstalled },
-            },
-        }));
-        return;
-    }
-    // POST /api/setup-wizard — save all setup data at once (first-run wizard)
-    if (urlPath === "/api/setup-wizard" && req.method === "POST") {
-        try {
-            const data = JSON.parse(body);
-            const envPath = ENV_FILE;
-            let content = fs.existsSync(envPath) ? fs.readFileSync(envPath, "utf-8") : "";
-            const setEnv = (key, value) => {
-                // M6 (centralized): reject values containing newline characters
-                if (/[\n\r]/.test(value))
-                    throw new Error("env value must not contain newline characters");
-                const regex = new RegExp(`^${key}=.*$`, "m");
-                if (regex.test(content)) {
-                    content = content.replace(regex, `${key}=${value}`);
-                }
-                else {
-                    content = content.trimEnd() + `\n${key}=${value}\n`;
-                }
-                process.env[key] = value;
-            };
-            // Step 1: Telegram
-            if (data.botToken)
-                setEnv("BOT_TOKEN", data.botToken);
-            if (data.allowedUsers)
-                setEnv("ALLOWED_USERS", data.allowedUsers);
-            // Step 2: Provider
-            if (data.primaryProvider)
-                setEnv("PRIMARY_PROVIDER", data.primaryProvider);
-            if (data.apiKey && data.apiKeyEnv)
-                setEnv(data.apiKeyEnv, data.apiKey);
-            // Step 3: Optional
-            if (data.webPassword)
-                setEnv("WEB_PASSWORD", data.webPassword);
-            fs.writeFileSync(envPath, content);
-            res.end(JSON.stringify({ ok: true, note: "Setup complete! Restart needed." }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/validate-bot-token — validate a Telegram bot token
-    if (urlPath === "/api/validate-bot-token" && req.method === "POST") {
-        try {
-            const { token } = JSON.parse(body);
-            if (!token || !token.includes(":")) {
-                res.end(JSON.stringify({ ok: false, error: "Invalid token format" }));
-                return;
-            }
-            const tgRes = await fetch(`https://api.telegram.org/bot${token}/getMe`);
-            const tgData = await tgRes.json();
-            if (tgData.ok) {
-                res.end(JSON.stringify({ ok: true, bot: { username: tgData.result.username, firstName: tgData.result.first_name, id: tgData.result.id } }));
-            }
-            else {
-                res.end(JSON.stringify({ ok: false, error: tgData.description || "Invalid token" }));
-            }
-        }
-        catch (e) {
-            res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // GET /api/status
-    if (urlPath === "/api/status") {
-        let modelInfo = { name: "Not configured", model: "none", status: "unconfigured" };
-        try {
-            const registry = getRegistry();
-            const active = registry.getActive().getInfo();
-            modelInfo = { name: active.name, model: active.model, status: active.status };
-        }
-        catch { /* engine not initialized — no provider configured */ }
-        const memory = getMemoryStats();
-        const index = getIndexStats();
-        const plugins = getLoadedPlugins();
-        const mcp = getMCPStatus();
-        const users = listProfiles();
-        const tools = listCustomTools();
-        // Aggregate token usage across all sessions
-        const { getAllSessions } = await import("../services/session.js");
-        const allSessions = getAllSessions();
-        let totalInputTokens = 0, totalOutputTokens = 0, totalCost = 0;
-        for (const s of allSessions.values()) {
-            totalInputTokens += s.totalInputTokens || 0;
-            totalOutputTokens += s.totalOutputTokens || 0;
-            totalCost += s.totalCost || 0;
-        }
-        const { config: appConfig } = await import("../config.js");
-        res.end(JSON.stringify({
-            bot: { version: BOT_VERSION, uptime: process.uptime() },
-            model: modelInfo,
-            memory: { ...memory, vectors: index.entries, indexSize: index.sizeBytes },
-            plugins: plugins.length,
-            mcp: mcp.length,
-            users: users.length,
-            tools: tools.length,
-            tokens: {
-                totalInput: totalInputTokens,
-                totalOutput: totalOutputTokens,
-                total: totalInputTokens + totalOutputTokens,
-                totalCost,
-            },
-            setup: {
-                telegram: !!appConfig.botToken,
-                provider: modelInfo.status !== "unconfigured",
-            },
-        }));
-        return;
-    }
-    // GET /api/models
-    if (urlPath === "/api/models") {
-        const registry = getRegistry();
-        registry.listAll().then(models => {
-            res.end(JSON.stringify({ models, active: registry.getActiveKey() }));
-        });
-        return;
-    }
-    // POST /api/models/switch
-    if (urlPath === "/api/models/switch" && req.method === "POST") {
-        try {
-            const { key } = JSON.parse(body);
-            const registry = getRegistry();
-            const ok = registry.switchTo(key);
-            res.end(JSON.stringify({ ok, active: registry.getActiveKey() }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/fallback — Get fallback order + health
-    if (urlPath === "/api/fallback" && req.method === "GET") {
-        try {
-            const { getFallbackOrder } = await import("../services/fallback-order.js");
-            const { getHealthStatus, isFailedOver } = await import("../services/heartbeat.js");
-            const registry = getRegistry();
-            const providers = await registry.listAll();
-            res.end(JSON.stringify({
-                order: getFallbackOrder(),
-                health: getHealthStatus(),
-                failedOver: isFailedOver(),
-                activeProvider: registry.getActiveKey(),
-                availableProviders: providers.map(p => ({ key: p.key, name: p.name, status: p.status })),
-            }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // POST /api/fallback — Set fallback order
-    if (urlPath === "/api/fallback" && req.method === "POST") {
-        try {
-            const { primary, fallbacks } = JSON.parse(body);
-            const { setFallbackOrder } = await import("../services/fallback-order.js");
-            const result = setFallbackOrder(primary, fallbacks, "webui");
-            res.end(JSON.stringify({ ok: true, order: result }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // POST /api/fallback/move — Move provider up/down
-    if (urlPath === "/api/fallback/move" && req.method === "POST") {
-        try {
-            const { key, direction } = JSON.parse(body);
-            const fb = await import("../services/fallback-order.js");
-            const result = direction === "up" ? fb.moveUp(key, "webui") : fb.moveDown(key, "webui");
-            res.end(JSON.stringify({ ok: true, order: result }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // GET /api/heartbeat — Health status
-    if (urlPath === "/api/heartbeat") {
-        try {
-            const { getHealthStatus, isFailedOver } = await import("../services/heartbeat.js");
-            res.end(JSON.stringify({
-                health: getHealthStatus(),
-                failedOver: isFailedOver(),
-            }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ health: [], failedOver: false }));
-        }
-        return;
-    }
-    // GET /api/memory
-    if (urlPath === "/api/memory") {
-        const ltm = loadLongTermMemory();
-        const todayLog = loadDailyLog();
-        const stats = getMemoryStats();
-        const index = getIndexStats();
-        // List daily log files
-        let dailyFiles = [];
-        try {
-            dailyFiles = fs.readdirSync(MEMORY_DIR)
-                .filter(f => f.endsWith(".md") && !f.startsWith("."))
-                .sort()
-                .reverse();
-        }
-        catch { /* empty */ }
-        res.end(JSON.stringify({
-            longTermMemory: ltm,
-            todayLog,
-            dailyFiles,
-            stats,
-            index: { entries: index.entries, files: index.files, sizeBytes: index.sizeBytes },
-        }));
-        return;
-    }
-    // GET /api/memory/:file
-    if (urlPath.startsWith("/api/memory/")) {
-        const file = urlPath.slice(12);
-        if (file.includes("..") || !file.endsWith(".md")) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid file" }));
-            return;
-        }
-        try {
-            const content = fs.readFileSync(resolve(MEMORY_DIR, file), "utf-8");
-            res.end(JSON.stringify({ file, content }));
-        }
-        catch {
-            res.statusCode = 404;
-            res.end(JSON.stringify({ error: "File not found" }));
-        }
-        return;
-    }
-    // POST /api/memory/save
-    if (urlPath === "/api/memory/save" && req.method === "POST") {
-        try {
-            const { file, content } = JSON.parse(body);
-            if (file === "MEMORY.md") {
-                fs.writeFileSync(MEMORY_FILE, content);
-            }
-            else if (file.endsWith(".md") && !file.includes("..")) {
-                fs.writeFileSync(resolve(MEMORY_DIR, file), content);
-            }
-            else {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid file" }));
-                return;
-            }
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/plugins
-    if (urlPath === "/api/plugins") {
-        res.end(JSON.stringify({ plugins: getLoadedPlugins() }));
-        return;
-    }
-    // v4.12.0 — Workspace overview: registry + per-workspace cost breakdown
-    if (urlPath === "/api/workspaces") {
-        try {
-            const { listWorkspaces, getDefaultWorkspace } = await import("../services/workspaces.js");
-            const { getCostByWorkspace } = await import("../services/session.js");
-            const costs = getCostByWorkspace();
-            const registered = listWorkspaces();
-            const all = [getDefaultWorkspace(), ...registered];
-            const payload = all.map((ws) => ({
-                name: ws.name,
-                purpose: ws.purpose,
-                emoji: ws.emoji ?? null,
-                color: ws.color ?? null,
-                cwd: ws.cwd,
-                channels: ws.channels,
-                stats: costs[ws.name] ?? { totalCost: 0, sessionCount: 0, messageCount: 0, toolUseCount: 0 },
-            }));
-            res.end(JSON.stringify({ workspaces: payload }));
-        }
-        catch (err) {
-            res.statusCode = 500;
-            res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
-        }
-        return;
-    }
-    // GET /api/users — Enhanced with session data
-    if (urlPath === "/api/users" && req.method === "GET") {
-        const { getAllSessions } = await import("../services/session.js");
-        const profiles = listProfiles();
-        const sessions = getAllSessions();
-        const sessionMap = new Map(Array.from(sessions.entries()).map(([k, s]) => [Number(k), s]));
-        const enriched = profiles.map(p => {
-            const session = sessionMap.get(p.userId);
-            return {
-                ...p,
-                session: session ? {
-                    isProcessing: session.isProcessing,
-                    totalCost: session.totalCost,
-                    historyLength: session.history.length,
-                    effort: session.effort,
-                    voiceReply: session.voiceReply,
-                    startedAt: session.startedAt,
-                    messageCount: session.messageCount,
-                    toolUseCount: session.toolUseCount,
-                    workingDir: session.workingDir,
-                    hasActiveQuery: !!session.abortController,
-                    queuedMessages: session.messageQueue.length,
-                } : null,
-            };
-        });
-        res.end(JSON.stringify({ users: enriched }));
-        return;
-    }
-    // DELETE /api/users/:id — Kill session + delete user data
-    if (urlPath.startsWith("/api/users/") && req.method === "DELETE") {
-        // Pattern route — gate here since EXPOSED_DANGEROUS_ROUTES can't express :id
-        if (isExposedWithoutPassword()) {
-            res.statusCode = 403;
-            res.end(JSON.stringify({ error: "refused: web exposed without WEB_PASSWORD" }));
-            return;
-        }
-        const userId = parseInt(urlPath.split("/").pop() || "0");
-        if (!userId) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid user ID" }));
-            return;
-        }
-        const { deleteUser } = await import("../services/users.js");
-        const result = deleteUser(userId);
-        res.end(JSON.stringify({ ok: true, ...result }));
-        return;
-    }
-    // GET /api/tools
-    if (urlPath === "/api/tools") {
-        const tools = getCustomTools();
-        res.end(JSON.stringify({ tools }));
-        return;
-    }
-    // POST /api/tools/execute — run a tool by name
-    if (urlPath === "/api/tools/execute" && req.method === "POST") {
-        try {
-            const { name, params } = JSON.parse(body);
-            if (!name) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "No tool name" }));
-                return;
-            }
-            const output = await executeCustomTool(name, params || {});
-            res.end(JSON.stringify({ ok: true, output }));
-        }
-        catch (err) {
-            const error = err instanceof Error ? err.message : String(err);
-            res.end(JSON.stringify({ error }));
-        }
-        return;
-    }
-    // ── MCP Management ─────────────────────────────────────
-    // GET /api/mcp — list MCP servers + tools
-    if (urlPath === "/api/mcp") {
-        const { getMCPStatus, getMCPTools, hasMCPConfig } = await import("../services/mcp.js");
-        const servers = getMCPStatus();
-        const tools = getMCPTools();
-        // Read raw config for editing
-        const configPath = MCP_CONFIG;
-        let rawConfig = { servers: {} };
-        try {
-            rawConfig = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-        }
-        catch { }
-        res.end(JSON.stringify({ servers, tools, config: rawConfig, hasConfig: hasMCPConfig() }));
-        return;
-    }
-    // POST /api/mcp/add — add a new MCP server
-    if (urlPath === "/api/mcp/add" && req.method === "POST") {
-        try {
-            const { name, command, args, url: serverUrl, env, headers } = JSON.parse(body);
-            if (!name) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Name required" }));
-                return;
-            }
-            const configPath = MCP_CONFIG;
-            let config = { servers: {} };
-            try {
-                config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-            }
-            catch { }
-            const entry = {};
-            if (command) {
-                entry.command = command;
-                entry.args = args || [];
-                if (env)
-                    entry.env = env;
-            }
-            else if (serverUrl) {
-                entry.url = serverUrl;
-                if (headers)
-                    entry.headers = headers;
-            }
-            else {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "command or url required" }));
-                return;
-            }
-            config.servers[name] = entry;
-            fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-            res.end(JSON.stringify({ ok: true, note: "Restart needed to connect." }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/mcp/remove — remove an MCP server
-    if (urlPath === "/api/mcp/remove" && req.method === "POST") {
-        try {
-            const { name } = JSON.parse(body);
-            const configPath = MCP_CONFIG;
-            let config = { servers: {} };
-            try {
-                config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-            }
-            catch { }
-            delete config.servers[name];
-            fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // GET /api/mcp/discover — auto-discover MCP servers on the system
-    if (urlPath === "/api/mcp/discover") {
-        const discovered = [];
-        const { execSync } = await import("child_process");
-        // Check for common MCP server npm packages
-        const knownServers = [
-            { pkg: "@modelcontextprotocol/server-filesystem", name: "filesystem", args: ["/tmp"] },
-            { pkg: "@modelcontextprotocol/server-brave-search", name: "brave-search", args: [] },
-            { pkg: "@modelcontextprotocol/server-github", name: "github", args: [] },
-            { pkg: "@modelcontextprotocol/server-postgres", name: "postgres", args: [] },
-            { pkg: "@modelcontextprotocol/server-sqlite", name: "sqlite", args: [] },
-            { pkg: "@modelcontextprotocol/server-slack", name: "slack", args: [] },
-            { pkg: "@modelcontextprotocol/server-memory", name: "memory", args: [] },
-            { pkg: "@modelcontextprotocol/server-puppeteer", name: "puppeteer", args: [] },
-            { pkg: "@modelcontextprotocol/server-fetch", name: "web-fetch", args: [] },
-            { pkg: "@anthropic/mcp-server-sequential-thinking", name: "sequential-thinking", args: [] },
-        ];
-        for (const s of knownServers) {
-            try {
-                execSync(`npx --yes ${s.pkg} --help`, { timeout: 5000, stdio: "pipe", env: { ...process.env, PATH: process.env.PATH + ":/opt/homebrew/bin:/usr/local/bin" } });
-                discovered.push({ name: s.name, command: "npx", args: ["-y", s.pkg, ...s.args], source: "npm" });
-            }
-            catch {
-                // Not installed — try checking if globally available
-                try {
-                    execSync(`npm list -g ${s.pkg} --depth=0`, { timeout: 5000, stdio: "pipe" });
-                    discovered.push({ name: s.name, command: "npx", args: ["-y", s.pkg, ...s.args], source: "npm-global" });
-                }
-                catch { /* not installed */ }
-            }
-        }
-        // Check for Claude Desktop MCP config
-        const homeDir = process.env.HOME || process.env.USERPROFILE || "";
-        const claudeConfigPaths = [
-            resolve(homeDir, ".config/claude/claude_desktop_config.json"),
-            resolve(homeDir, "Library/Application Support/Claude/claude_desktop_config.json"),
-            resolve(homeDir, "AppData/Roaming/Claude/claude_desktop_config.json"),
-        ];
-        for (const cfgPath of claudeConfigPaths) {
-            try {
-                const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf-8"));
-                if (cfg.mcpServers) {
-                    for (const [name, srv] of Object.entries(cfg.mcpServers)) {
-                        if (srv.command) {
-                            discovered.push({ name: `claude-${name}`, command: srv.command, args: srv.args || [], source: "claude-desktop" });
-                        }
-                    }
-                }
-            }
-            catch { /* not found */ }
-        }
-        res.end(JSON.stringify({ discovered }));
-        return;
-    }
-    // ── Skills Management ─────────────────────────────────
-    // GET /api/skills — already in setup-api.ts, but add full CRUD here
-    // GET /api/skills/detail/:id — get full skill content
-    if (urlPath?.match(/^\/api\/skills\/detail\//) && req.method === "GET") {
-        const skillId = urlPath.split("/").pop();
-        const { getSkills } = await import("../services/skills.js");
-        const skill = getSkills().find(s => s.id === skillId);
-        if (skill) {
-            res.end(JSON.stringify({ ok: true, skill }));
-        }
-        else {
-            res.statusCode = 404;
-            res.end(JSON.stringify({ error: "Skill not found" }));
-        }
-        return;
-    }
-    // POST /api/skills/create — create a new skill
-    if (urlPath === "/api/skills/create" && req.method === "POST") {
-        try {
-            const { id, name, description, triggers, category, content, priority } = JSON.parse(body);
-            if (!id || !name) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "id and name required" }));
-                return;
-            }
-            // Security: reject id values that could escape SKILLS_DIR.
-            // Mirror the resolve+startsWith containment pattern used in /api/files/save (server.ts ~:921).
-            // Also guard against ids with path separators or absolute paths before
-            // resolve() ever runs, so the raw string never reaches the filesystem.
-            if (typeof id !== "string" ||
-                id.includes("..") ||
-                id.includes("/") ||
-                id.includes("\\") ||
-                path.isAbsolute(id)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            const skillsDir = SKILLS_DIR;
-            const skillDir = resolve(skillsDir, id);
-            // Belt-and-suspenders: resolved path must still be inside SKILLS_DIR
-            if (!skillDir.startsWith(skillsDir)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            if (!fs.existsSync(skillDir))
-                fs.mkdirSync(skillDir, { recursive: true });
-            const frontmatter = [
-                "---",
-                `name: ${name}`,
-                description ? `description: ${description}` : "",
-                triggers ? `triggers: ${Array.isArray(triggers) ? triggers.join(", ") : triggers}` : "",
-                `priority: ${priority || 3}`,
-                `category: ${category || "custom"}`,
-                "---",
-            ].filter(Boolean).join("\n");
-            fs.writeFileSync(resolve(skillDir, "SKILL.md"), `${frontmatter}\n\n${content || ""}`);
-            // Force reload
-            const { loadSkills } = await import("../services/skills.js");
-            loadSkills();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/skills/update — update an existing skill
-    if (urlPath === "/api/skills/update" && req.method === "POST") {
-        try {
-            const { id, content } = JSON.parse(body);
-            // Security: same id containment as /api/skills/create
-            if (typeof id !== "string" ||
-                id.includes("..") ||
-                id.includes("/") ||
-                id.includes("\\") ||
-                path.isAbsolute(id)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            // Belt-and-suspenders: resolved path must still be inside SKILLS_DIR
-            if (!resolve(SKILLS_DIR, id).startsWith(SKILLS_DIR)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            const skillPath = resolve(SKILLS_DIR, id, "SKILL.md");
-            if (!fs.existsSync(skillPath)) {
-                // Try flat file
-                const flatPath = resolve(SKILLS_DIR, id + ".md");
-                if (fs.existsSync(flatPath)) {
-                    fs.writeFileSync(flatPath, content);
-                }
-                else {
-                    res.statusCode = 404;
-                    res.end(JSON.stringify({ error: "Skill not found" }));
-                    return;
-                }
-            }
-            else {
-                fs.writeFileSync(skillPath, content);
-            }
-            const { loadSkills } = await import("../services/skills.js");
-            loadSkills();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // POST /api/skills/delete — delete a skill
-    if (urlPath === "/api/skills/delete" && req.method === "POST") {
-        try {
-            const { id } = JSON.parse(body);
-            // Security: same raw-string id containment as /api/skills/create + /api/skills/update
-            if (typeof id !== "string" ||
-                id.includes("..") ||
-                id.includes("/") ||
-                id.includes("\\") ||
-                path.isAbsolute(id)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid skill id" }));
-                return;
-            }
-            const skillDir = resolve(SKILLS_DIR, id);
-            const flatFile = resolve(SKILLS_DIR, id + ".md");
-            if (fs.existsSync(skillDir)) {
-                fs.rmSync(skillDir, { recursive: true });
-            }
-            else if (fs.existsSync(flatFile)) {
-                fs.unlinkSync(flatFile);
-            }
-            else {
-                res.statusCode = 404;
-                res.end(JSON.stringify({ error: "Skill not found" }));
-                return;
-            }
-            const { loadSkills } = await import("../services/skills.js");
-            loadSkills();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (e) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
-        }
-        return;
-    }
-    // GET /api/config
-    if (urlPath === "/api/config") {
-        res.end(JSON.stringify({
-            providers: config.fallbackProviders,
-            primaryProvider: config.primaryProvider,
-            allowedUsers: config.allowedUsers,
-            hasKeys: {
-                groq: !!config.apiKeys.groq,
-                openai: !!config.apiKeys.openai,
-                google: !!config.apiKeys.google,
-                nvidia: !!config.apiKeys.nvidia,
-                openrouter: !!config.apiKeys.openrouter,
-            },
-        }));
-        return;
-    }
-    // GET /api/sessions
-    if (urlPath === "/api/sessions") {
-        const sessions = getAllSessions();
-        const profiles = listProfiles();
-        const data = Array.from(sessions.entries()).map(([key, session]) => {
-            const userId = Number(key.split(":").pop());
-            const profile = profiles.find(p => p.userId === userId);
-            return {
-                userId: key,
-                name: profile?.name || `User ${key}`,
-                username: profile?.username,
-                messageCount: session.messageCount,
-                toolUseCount: session.toolUseCount,
-                totalCost: session.totalCost,
-                totalInputTokens: session.totalInputTokens || 0,
-                totalOutputTokens: session.totalOutputTokens || 0,
-                effort: session.effort,
-                startedAt: session.startedAt,
-                lastActivity: session.lastActivity,
-                historyLength: session.history.length,
-                isProcessing: session.isProcessing,
-                provider: Object.keys(session.queriesByProvider).join(", ") || "none",
-            };
-        });
-        res.end(JSON.stringify({ sessions: data }));
-        return;
-    }
-    // GET /api/sessions/:userId/history
-    if (urlPath.match(/^\/api\/sessions\/\d+\/history$/)) {
-        const userId = parseInt(urlPath.split("/")[3]);
-        const session = getSession(userId);
-        res.end(JSON.stringify({
-            userId,
-            history: session.history.map(h => ({ role: h.role, content: h.content.slice(0, 2000) })),
-        }));
-        return;
-    }
-    // GET /api/files?path=...
-    if (urlPath === "/api/files") {
-        const params = new URLSearchParams((req.url || "").split("?")[1] || "");
-        const reqPath = params.get("path") || "";
-        const basePath = resolve(BOT_ROOT, reqPath || ".");
-        // Security: must be within BOT_ROOT
-        if (!basePath.startsWith(BOT_ROOT)) {
-            res.statusCode = 403;
-            res.end(JSON.stringify({ error: "Access denied" }));
-            return;
-        }
-        try {
-            const stat = fs.statSync(basePath);
-            if (stat.isDirectory()) {
-                const entries = fs.readdirSync(basePath, { withFileTypes: true })
-                    .filter(e => !e.name.startsWith(".") && e.name !== "node_modules")
-                    .map(e => ({
-                    name: e.name,
-                    type: e.isDirectory() ? "dir" : "file",
-                    size: e.isFile() ? fs.statSync(resolve(basePath, e.name)).size : 0,
-                    modified: fs.statSync(resolve(basePath, e.name)).mtimeMs,
-                }))
-                    .sort((a, b) => {
-                    if (a.type !== b.type)
-                        return a.type === "dir" ? -1 : 1;
-                    return a.name.localeCompare(b.name);
-                });
-                res.end(JSON.stringify({ path: reqPath || ".", entries }));
-            }
-            else {
-                // Read file content — text files up to 500KB
-                const ext = path.extname(basePath).toLowerCase();
-                const textExts = new Set([
-                    ".md", ".txt", ".json", ".js", ".ts", ".jsx", ".tsx", ".css", ".html", ".htm",
-                    ".xml", ".svg", ".yml", ".yaml", ".toml", ".ini", ".cfg", ".conf", ".env",
-                    ".sh", ".bash", ".zsh", ".fish", ".py", ".rb", ".go", ".rs", ".java", ".kt",
-                    ".c", ".cpp", ".h", ".hpp", ".cs", ".php", ".sql", ".graphql", ".prisma",
-                    ".dockerfile", ".gitignore", ".gitattributes", ".editorconfig", ".prettierrc",
-                    ".eslintrc", ".babelrc", ".npmrc", ".nvmrc", ".lock", ".log", ".csv", ".tsv",
-                    ".mjs", ".cjs", ".mts", ".cts", ".vue", ".svelte", ".astro",
-                ]);
-                // Files without extension that match known names are always text
-                const textNames = new Set([
-                    "dockerfile", "makefile", "procfile", "gemfile", "rakefile",
-                    "vagrantfile", "brewfile", "justfile", "taskfile", "cakefile",
-                    "license", "licence", "readme", "changelog", "authors", "contributors",
-                ]);
-                const baseName = path.basename(basePath).toLowerCase();
-                const isKnownTextName = textNames.has(baseName);
-                const isText = textExts.has(ext) || isKnownTextName || (!ext && stat.size < 100_000);
-                if (stat.size > 500_000) {
-                    res.end(JSON.stringify({ path: reqPath, content: `[File too large: ${(stat.size / 1024).toFixed(1)} KB — max 500 KB]`, size: stat.size }));
-                }
-                else if (isText) {
-                    try {
-                        const content = fs.readFileSync(basePath, "utf-8");
-                        // Quick binary check: if >10% null bytes, it's binary
-                        const nullCount = [...content.slice(0, 1000)].filter(c => c === "\0").length;
-                        if (nullCount > 100) {
-                            res.end(JSON.stringify({ path: reqPath, content: null, size: stat.size, binary: true }));
-                        }
-                        else {
-                            res.end(JSON.stringify({ path: reqPath, content, size: stat.size }));
-                        }
-                    }
-                    catch {
-                        res.end(JSON.stringify({ path: reqPath, content: null, size: stat.size, binary: true }));
-                    }
-                }
-                else {
-                    res.end(JSON.stringify({ path: reqPath, content: null, size: stat.size, binary: true }));
-                }
-            }
-        }
-        catch {
-            res.statusCode = 404;
-            res.end(JSON.stringify({ error: "Not found" }));
-        }
-        return;
-    }
-    // POST /api/files/save
-    if (urlPath === "/api/files/save" && req.method === "POST") {
-        try {
-            const { path: filePath, content } = JSON.parse(body);
-            const absPath = resolve(BOT_ROOT, filePath);
-            if (!absPath.startsWith(BOT_ROOT)) {
-                res.statusCode = 403;
-                res.end(JSON.stringify({ error: "Access denied" }));
-                return;
-            }
-            fs.writeFileSync(absPath, content);
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            const error = err instanceof Error ? err.message : "Invalid request";
-            res.end(JSON.stringify({ error }));
-        }
-        return;
-    }
-    // POST /api/files/delete
-    if (urlPath === "/api/files/delete" && req.method === "POST") {
-        try {
-            const { path: filePath } = JSON.parse(body);
-            const absPath = resolve(BOT_ROOT, filePath);
-            if (!absPath.startsWith(BOT_ROOT)) {
-                res.statusCode = 403;
-                res.end(JSON.stringify({ error: "Access denied" }));
-                return;
-            }
-            // Safety: don't allow deleting critical files
-            const critical = [".env", "package.json", "tsconfig.json", "ecosystem.config.cjs"];
-            const baseName = path.basename(absPath);
-            if (critical.includes(baseName)) {
-                res.statusCode = 403;
-                res.end(JSON.stringify({ error: `${baseName} cannot be deleted (protected)` }));
-                return;
-            }
-            if (!fs.existsSync(absPath)) {
-                res.statusCode = 404;
-                res.end(JSON.stringify({ error: "File not found" }));
-                return;
-            }
-            const stat = fs.statSync(absPath);
-            if (stat.isDirectory()) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Directories cannot be deleted" }));
-                return;
-            }
-            fs.unlinkSync(absPath);
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            const error = err instanceof Error ? err.message : "Invalid request";
-            res.end(JSON.stringify({ error }));
-        }
-        return;
-    }
-    // POST /api/terminal
-    if (urlPath === "/api/terminal" && req.method === "POST") {
-        try {
-            const { command } = JSON.parse(body);
-            if (!command) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "No command" }));
-                return;
-            }
-            // Security: limit command length
-            if (command.length > 10000) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Command too long (max 10000 chars)" }));
-                return;
-            }
-            const cwd = typeof (JSON.parse(body)).cwd === "string" ? resolve(JSON.parse(body).cwd) : BOT_ROOT;
-            const output = execSync(command, {
-                cwd,
-                stdio: "pipe",
-                timeout: 120000,
-                env: { ...process.env, PATH: process.env.PATH + ":/opt/homebrew/bin:/usr/local/bin" },
-            }).toString();
-            res.end(JSON.stringify({ output: output.slice(0, 100000) }));
-        }
-        catch (err) {
-            const error = err;
-            const stderr = error.stderr?.toString()?.trim() || "";
-            res.end(JSON.stringify({ output: stderr || error.message, exitCode: 1 }));
-        }
-        return;
-    }
-    // GET /api/env — read .env keys (names only, values masked)
-    if (urlPath === "/api/env") {
-        try {
-            const envContent = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, "utf-8") : "";
-            const lines = envContent.split("\n").filter(l => l.includes("=") && !l.startsWith("#"));
-            const vars = lines.map(l => {
-                const [key, ...rest] = l.split("=");
-                const value = rest.join("=").trim();
-                // Mask sensitive values
-                const masked = key.includes("KEY") || key.includes("TOKEN") || key.includes("PASSWORD") || key.includes("SECRET")
-                    ? (value.length > 4 ? value.slice(0, 4) + "..." + value.slice(-4) : "****")
-                    : value;
-                return { key: key.trim(), value: masked, hasValue: value.length > 0 };
-            });
-            res.end(JSON.stringify({ vars }));
-        }
-        catch {
-            res.end(JSON.stringify({ vars: [] }));
-        }
-        return;
-    }
-    // POST /api/env/set — update an env var
-    if (urlPath === "/api/env/set" && req.method === "POST") {
-        try {
-            const { key, value } = JSON.parse(body);
-            if (!key || typeof key !== "string" || !key.match(/^[A-Z_][A-Z0-9_]*$/)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid key name" }));
-                return;
-            }
-            // M6: reject values containing newline characters — they allow injecting
-            // extra .env lines (e.g. value="good\nEVIL=injected").
-            if (typeof value === "string" && /[\n\r]/.test(value)) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "Invalid value: newline characters not allowed" }));
-                return;
-            }
-            let envContent = fs.existsSync(ENV_FILE) ? fs.readFileSync(ENV_FILE, "utf-8") : "";
-            const regex = new RegExp(`^${key}=.*$`, "m");
-            if (regex.test(envContent)) {
-                envContent = envContent.replace(regex, `${key}=${value}`);
-            }
-            else {
-                envContent = envContent.trimEnd() + `\n${key}=${value}\n`;
-            }
-            // v4.12.2 — enforce 0o600 on .env
-            writeSecure(ENV_FILE, envContent);
-            res.end(JSON.stringify({ ok: true, note: "Restart required for changes to take effect" }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/soul — read SOUL.md
-    if (urlPath === "/api/soul") {
-        const content = getSoulContent();
-        res.end(JSON.stringify({ content }));
-        return;
-    }
-    // POST /api/soul/save — update SOUL.md
-    if (urlPath === "/api/soul/save" && req.method === "POST") {
-        try {
-            const { content } = JSON.parse(body);
-            const soulPath = SOUL_FILE;
-            fs.writeFileSync(soulPath, content);
-            reloadSoul();
-            res.end(JSON.stringify({ ok: true }));
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // GET /api/platforms — platform adapter status
-    if (urlPath === "/api/platforms") {
-        const platforms = [
-            { name: "Telegram", key: "BOT_TOKEN", icon: "📱", configured: !!process.env.BOT_TOKEN },
-            { name: "Discord", key: "DISCORD_TOKEN", icon: "🎮", configured: !!process.env.DISCORD_TOKEN },
-            { name: "WhatsApp", key: "WHATSAPP_ENABLED", icon: "💬", configured: process.env.WHATSAPP_ENABLED === "true" },
-            { name: "Signal", key: "SIGNAL_API_URL", icon: "🔒", configured: !!process.env.SIGNAL_API_URL },
-            { name: "Web UI", key: "WEB_PORT", icon: "🌐", configured: true },
-        ];
-        res.end(JSON.stringify({ platforms }));
-        return;
-    }
-    // POST /api/restart — restart the bot process
-    if (urlPath === "/api/restart" && req.method === "POST") {
-        const { scheduleGracefulRestart } = await import("../services/restart.js");
-        res.end(JSON.stringify({ ok: true, note: "Restarting..." }));
-        scheduleGracefulRestart(500);
-        return;
-    }
-    // POST /api/chat/export — export chat history
-    if (urlPath === "/api/chat/export" && req.method === "POST") {
-        try {
-            const { messages, format } = JSON.parse(body);
-            if (format === "json") {
-                res.setHeader("Content-Type", "application/json");
-                res.end(JSON.stringify({ export: messages }, null, 2));
-            }
-            else {
-                // Markdown
-                const md = messages.map((m) => {
-                    const prefix = m.role === "user" ? "**Du:**" : m.role === "assistant" ? "**Alvin Bot:**" : "*System:*";
-                    const time = m.time ? ` _(${m.time})_` : "";
-                    return `${prefix}${time}\n${m.text}\n`;
-                }).join("\n---\n\n");
-                res.setHeader("Content-Type", "text/markdown");
-                res.end(`# Chat Export — Alvin Bot\n_${new Date().toLocaleString("de-DE")}_\n\n---\n\n${md}`);
-            }
-        }
-        catch {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-        return;
-    }
-    // ── WhatsApp Group Management API ────────────────────────────────────
-    // GET /api/whatsapp/groups — list all WhatsApp groups (live from WA)
-    if (urlPath === "/api/whatsapp/groups" && req.method === "GET") {
-        try {
-            const { getWhatsAppAdapter } = await import("../platforms/whatsapp.js");
-            const adapter = getWhatsAppAdapter();
-            if (!adapter) {
-                res.end(JSON.stringify({ groups: [], error: "WhatsApp nicht verbunden" }));
-                return;
-            }
-            const groups = await adapter.getGroups();
-            res.end(JSON.stringify({ groups }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ groups: [], error: String(err) }));
-        }
-        return;
-    }
-    // GET /api/whatsapp/groups/:id/participants — fetch group participants
-    if (urlPath.match(/^\/api\/whatsapp\/groups\/[^/]+\/participants$/)) {
-        try {
-            const groupId = decodeURIComponent(urlPath.split("/")[4]);
-            const { getWhatsAppAdapter } = await import("../platforms/whatsapp.js");
-            const adapter = getWhatsAppAdapter();
-            if (!adapter) {
-                res.end(JSON.stringify({ participants: [], error: "WhatsApp nicht verbunden" }));
-                return;
-            }
-            const participants = await adapter.getGroupParticipants(groupId);
-            res.end(JSON.stringify({ participants }));
-        }
-        catch (err) {
-            res.end(JSON.stringify({ participants: [], error: String(err) }));
-        }
-        return;
-    }
-    // GET /api/whatsapp/group-rules — get all configured group rules
-    if (urlPath === "/api/whatsapp/group-rules" && req.method === "GET") {
-        const { getGroupRules } = await import("../platforms/whatsapp.js");
-        res.end(JSON.stringify({ rules: getGroupRules() }));
-        return;
-    }
-    // POST /api/whatsapp/group-rules — create or update a group rule
-    if (urlPath === "/api/whatsapp/group-rules" && req.method === "POST") {
-        try {
-            const rule = JSON.parse(body);
-            if (!rule.groupId) {
-                res.statusCode = 400;
-                res.end(JSON.stringify({ error: "groupId ist erforderlich" }));
-                return;
-            }
-            const { upsertGroupRule } = await import("../platforms/whatsapp.js");
-            const saved = upsertGroupRule(rule);
-            res.end(JSON.stringify({ ok: true, rule: saved }));
-        }
-        catch (err) {
-            res.statusCode = 400;
-            res.end(JSON.stringify({ error: String(err) }));
-        }
-        return;
-    }
-    // DELETE /api/whatsapp/group-rules/:id — delete a group rule
-    if (urlPath.match(/^\/api\/whatsapp\/group-rules\//) && req.method === "DELETE") {
-        // Pattern route — gate here since EXPOSED_DANGEROUS_ROUTES can't express :id
-        if (isExposedWithoutPassword()) {
-            res.statusCode = 403;
-            res.end(JSON.stringify({ error: "refused: web exposed without WEB_PASSWORD" }));
-            return;
-        }
-        const groupId = decodeURIComponent(urlPath.split("/").slice(4).join("/"));
-        const { deleteGroupRule } = await import("../platforms/whatsapp.js");
-        const ok = deleteGroupRule(groupId);
-        res.end(JSON.stringify({ ok }));
-        return;
-    }
-    res.statusCode = 404;
-    res.end(JSON.stringify({ error: "Not found" }));
-}
-// ── WebSocket Chat ──────────────────────────────────────
-// Set of all currently connected chat WebSocket clients (excluding canvas).
-// Populated on connect, cleaned up on close. Used to forward Telegram
-// activity to every observer.
-const chatClients = new Set();
-/**
- * Wire the broadcast bus once at module load. The bus is singleton, so
- * subscribing here means every Telegram message fan-outs to every connected
- * chat client — without any per-connection re-subscription.
- */
-broadcast.on("user_msg", (payload) => {
-    if (payload.platform !== "telegram")
-        return; // v4.5.0: telegram only for now
-    const json = JSON.stringify({
-        type: "mirror:user_msg",
-        text: payload.text,
-        platform: payload.platform,
-        userName: payload.userName,
-        ts: payload.ts,
-    });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-broadcast.on("response_start", (payload) => {
-    if (payload.platform !== "telegram")
-        return;
-    const json = JSON.stringify({ type: "mirror:response_start", platform: payload.platform, ts: payload.ts });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-broadcast.on("response_delta", (payload) => {
-    if (payload.platform !== "telegram")
-        return;
-    const json = JSON.stringify({ type: "mirror:response_delta", delta: payload.delta, platform: payload.platform, ts: payload.ts });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-broadcast.on("response_done", (payload) => {
-    if (payload.platform !== "telegram")
-        return;
-    const json = JSON.stringify({ type: "mirror:response_done", cost: payload.cost, platform: payload.platform, ts: payload.ts });
-    for (const client of chatClients) {
-        if (client.readyState === WebSocket.OPEN)
-            client.send(json);
-    }
-});
-function handleWebSocket(wss) {
-    wss.on("connection", (ws, req) => {
-        // Auth check
-        if (WEB_PASSWORD && !checkAuth(req)) {
-            ws.close(4001, "Not authenticated");
-            return;
-        }
-        // Canvas WebSocket — separate handler
-        const wsUrl = req.url || "/";
-        if (wsUrl === "/canvas/ws") {
-            addCanvasClient(ws);
-            return;
-        }
-        console.log("WebUI: client connected");
-        chatClients.add(ws);
-        ws.on("message", async (data) => {
-            try {
-                const msg = JSON.parse(data.toString());
-                if (msg.type === "chat") {
-                    let { text, effort, file } = msg;
-                    // v4.5.0: session routing. The client (TUI/WebUI) tells us which
-                    // session it wants its message to go into. Supported targets:
-                    //   - "tui"      → use msg.sessionKey (e.g. "tui:local" or
-                    //                   "tui:ephemeral:…"). Isolated from Telegram.
-                    //   - "telegram" → route into the primary Telegram user's session.
-                    //                   Responses go back to the client AND to the
-                    //                   actual Telegram chat via the broadcast bus.
-                    //   - undefined  → backwards-compatible: default to the primary
-                    //                   allowed user's session (old behavior).
-                    const target = msg.target;
-                    const telegramUserId = config.allowedUsers[0] || 0;
-                    let sessionKey;
-                    if (target === "tui" && typeof msg.sessionKey === "string" && msg.sessionKey.startsWith("tui:")) {
-                        sessionKey = msg.sessionKey;
-                    }
-                    else if (target === "telegram") {
-                        sessionKey = telegramUserId;
-                    }
-                    else {
-                        sessionKey = telegramUserId; // backwards compat
-                    }
-                    // Handle file upload — save to temp and reference in prompt
-                    if (file?.dataUrl && file?.name) {
-                        try {
-                            const dataDir = resolve(DATA_DIR, "web-uploads");
-                            if (!fs.existsSync(dataDir))
-                                fs.mkdirSync(dataDir, { recursive: true });
-                            const safeName = file.name.replace(/[^a-zA-Z0-9._-]/g, "_");
-                            const filePath = resolve(dataDir, `${Date.now()}_${safeName}`);
-                            const base64Data = file.dataUrl.split(",")[1] || file.dataUrl;
-                            fs.writeFileSync(filePath, Buffer.from(base64Data, "base64"));
-                            // Replace placeholder with actual file path
-                            text = text.replace(/\[File attached:.*?\]/, `[File saved: ${filePath}]`);
-                        }
-                        catch (err) {
-                            console.error("WebUI file upload error:", err);
-                        }
-                    }
-                    const registry = getRegistry();
-                    const activeProvider = registry.getActive();
-                    const isSDK = activeProvider.config.type === "claude-sdk";
-                    const session = getSession(sessionKey);
-                    const queryOpts = {
-                        prompt: text,
-                        systemPrompt: buildSystemPrompt(isSDK, session.language, target === "telegram" ? "telegram" : "web-dashboard"),
-                        workingDir: session.workingDir,
-                        effort: effort || session.effort,
-                        sessionId: isSDK ? session.sessionId : null,
-                        history: !isSDK ? session.history : undefined,
-                    };
-                    let gotDone = false;
-                    let finalText = ""; // v4.5.0: capture the final response for target=telegram relay
-                    try {
-                        // Stream response
-                        for await (const chunk of registry.queryWithFallback(queryOpts)) {
-                            if (ws.readyState !== WebSocket.OPEN)
-                                break;
-                            switch (chunk.type) {
-                                case "text":
-                                    if (chunk.text)
-                                        finalText = chunk.text;
-                                    ws.send(JSON.stringify({ type: "text", text: chunk.text, delta: chunk.delta }));
-                                    break;
-                                case "tool_use":
-                                    ws.send(JSON.stringify({ type: "tool", name: chunk.toolName, input: chunk.toolInput }));
-                                    break;
-                                case "done":
-                                    gotDone = true;
-                                    if (chunk.text)
-                                        finalText = chunk.text;
-                                    if (chunk.sessionId)
-                                        session.sessionId = chunk.sessionId;
-                                    if (chunk.costUsd)
-                                        session.totalCost += chunk.costUsd;
-                                    if (chunk.inputTokens)
-                                        session.totalInputTokens = (session.totalInputTokens || 0) + chunk.inputTokens;
-                                    if (chunk.outputTokens)
-                                        session.totalOutputTokens = (session.totalOutputTokens || 0) + chunk.outputTokens;
-                                    ws.send(JSON.stringify({
-                                        type: "done", cost: chunk.costUsd, sessionId: chunk.sessionId,
-                                        inputTokens: chunk.inputTokens, outputTokens: chunk.outputTokens,
-                                        sessionTokens: { input: session.totalInputTokens || 0, output: session.totalOutputTokens || 0 },
-                                    }));
-                                    break;
-                                case "error":
-                                    ws.send(JSON.stringify({ type: "error", error: chunk.error }));
-                                    gotDone = true; // error counts as done
-                                    break;
-                                case "fallback":
-                                    ws.send(JSON.stringify({ type: "fallback", from: chunk.failedProvider, to: chunk.providerName }));
-                                    break;
-                            }
-                        }
-                        // Ensure we always send done (in case stream ended without done/error chunk)
-                        if (!gotDone && ws.readyState === WebSocket.OPEN) {
-                            ws.send(JSON.stringify({ type: "done", cost: 0 }));
-                        }
-                        // v4.5.0: if the user typed in the TUI with target=telegram, we
-                        // must also post the bot's final response to the actual Telegram
-                        // chat so the continuity is preserved from the Telegram side.
-                        // (Telegram bots cannot forge user messages, so only the
-                        // response lands in the chat — the user prompt itself stays
-                        // in the TUI.)
-                        if (target === "telegram" && finalText.trim()) {
-                            try {
-                                const dq = await import("../services/delivery-queue.js");
-                                dq.enqueue("telegram", String(telegramUserId), finalText);
-                            }
-                            catch (err) {
-                                console.error("WebUI → Telegram relay failed:", err);
-                            }
-                        }
-                    }
-                    catch (streamErr) {
-                        const errMsg = streamErr instanceof Error ? streamErr.message : String(streamErr);
-                        console.error("WebUI stream error:", errMsg);
-                        if (ws.readyState === WebSocket.OPEN) {
-                            ws.send(JSON.stringify({ type: "error", error: errMsg }));
-                            if (!gotDone) {
-                                ws.send(JSON.stringify({ type: "done", cost: 0 }));
-                            }
-                        }
-                    }
-                }
-                if (msg.type === "reset") {
-                    // v4.5.0: reset the target session, not a hardcoded one.
-                    const target = msg.target;
-                    const telegramUserId = config.allowedUsers[0] || 0;
-                    let resetKey;
-                    if (target === "tui" && typeof msg.sessionKey === "string" && msg.sessionKey.startsWith("tui:")) {
-                        resetKey = msg.sessionKey;
-                    }
-                    else {
-                        resetKey = telegramUserId;
-                    }
-                    resetSession(resetKey);
-                    ws.send(JSON.stringify({ type: "reset", ok: true }));
-                }
-            }
-            catch (err) {
-                const error = err instanceof Error ? err.message : String(err);
-                ws.send(JSON.stringify({ type: "error", error }));
-            }
-        });
-        ws.on("close", () => {
-            console.log("WebUI: client disconnected");
-            chatClients.delete(ws);
-        });
-    });
-}
-// ── Start Server ────────────────────────────────────────
-/**
- * HTTP request handler for the web UI. Hoisted to a top-level function
- * so every bind attempt can create a fresh http.Server without
- * rebuilding the handler closure.
- */
-function handleWebRequest(req, res) {
-    let body = "";
-    req.on("data", (chunk) => { body += chunk; });
-    req.on("end", () => {
-        const urlPath = (req.url || "/").split("?")[0];
-        // OpenAI-compatible API (/v1/chat/completions, /v1/models)
-        if (urlPath.startsWith("/v1/")) {
-            handleOpenAICompat(req, res, urlPath, body);
-            return;
-        }
-        // API routes
-        if (urlPath.startsWith("/api/")) {
-            handleAPI(req, res, urlPath, body);
-            return;
-        }
-        // v5.7.0 — internal bot-to-bot routes (detached sub-agent exit
-        // push). Dispatched through handleAPI, which bearer-auths it and
-        // returns before the cookie-auth gate. Kept off the /api/ prefix so
-        // it is never surfaced in the Web UI route surface.
-        if (urlPath.startsWith("/internal/")) {
-            handleAPI(req, res, urlPath, body);
-            return;
-        }
-        // Auth page (if password set and not authenticated)
-        if (WEB_PASSWORD && !checkAuth(req) && urlPath !== "/login.html") {
-            res.writeHead(302, { Location: "/login.html" });
-            res.end();
-            return;
-        }
-        // Canvas UI
-        if (urlPath === "/canvas") {
-            const canvasFile = resolve(PUBLIC_DIR, "canvas.html");
-            try {
-                const content = fs.readFileSync(canvasFile);
-                res.setHeader("Content-Type", "text/html");
-                res.end(content);
-            }
-            catch {
-                res.statusCode = 404;
-                res.end("Not found");
-            }
-            return;
-        }
-        // Static files
-        let filePath = urlPath === "/" ? "/index.html" : urlPath;
-        filePath = resolve(PUBLIC_DIR, filePath.slice(1));
-        // Security: prevent path traversal
-        if (!filePath.startsWith(PUBLIC_DIR)) {
-            res.statusCode = 403;
-            res.end("Forbidden");
-            return;
-        }
-        try {
-            const content = fs.readFileSync(filePath);
-            const ext = path.extname(filePath);
-            res.setHeader("Content-Type", MIME[ext] || "application/octet-stream");
-            res.end(content);
-        }
-        catch {
-            res.statusCode = 404;
-            res.end("Not found");
-        }
-    });
-}
-/**
- * Kick off the web-UI bind loop. NEVER throws, NEVER blocks.
- *
- * History: earlier versions returned an http.Server synchronously and
- * let listen() errors bubble up as uncaught exceptions — a colleague
- * flagged this on 2026-04-13 after spending months fighting the exact
- * same bug on a parallel OpenClaw fork. Their resolution: "the gateway
- * is a feature, not core. Decouple it."
- *
- * New contract:
- *   - Returns `void` immediately. The actual bind happens asynchronously.
- *   - If port 3100 is busy, tries 3101…3119 in sequence (same as before).
- *   - If ALL 20 ports are busy, schedules a background retry at 3100
- *     in `BACKGROUND_RETRY_MS` — keeps trying forever until success
- *     or stopWebServer() is called.
- *   - Any non-EADDRINUSE error also falls through to background retry.
- *   - Each attempt uses a FRESH http.Server to avoid node's fragile
- *     "listen-called-twice" state-recycling behaviour.
- *   - The main Telegram bot is completely independent of this — if the
- *     web UI never binds, the bot still answers messages.
- */
-export function startWebServer() {
-    stopRequested = false;
-    scheduleBindAttempt(parseInt(process.env.WEB_PORT || "3100", 10), 0);
-}
-function scheduleBindAttempt(port, attempt) {
-    if (stopRequested)
-        return;
-    // Read WEB_PORT live every time rather than closing over the
-    // module-load value, so tests that change process.env.WEB_PORT
-    // between runs see the new port.
-    const originalPort = parseInt(process.env.WEB_PORT || "3100");
-    // Fresh server for each attempt. Recycling a server that has already
-    // emitted an EADDRINUSE error has produced "Listen method has been
-    // called more than once" crashes in the wild.
-    //
-    // IMPORTANT: do NOT attach the WebSocketServer yet. The `ws` library
-    // installs its own event plumbing on the http.Server in its
-    // constructor, which causes bind errors to escape as uncaught
-    // exceptions. We only attach it AFTER listen() has succeeded.
-    const server = http.createServer(handleWebRequest);
-    // Double-invocation guard: on some Node versions `server.listen`
-    // both throws synchronously AND emits an `error` event for the same
-    // bind failure. Without the guard we'd climb the ladder twice in
-    // parallel and end up with two retry cascades racing each other.
-    let handled = false;
-    const cleanupDeadAttempt = () => {
-        try {
-            server.removeAllListeners("error");
-        }
-        catch { /* ignore */ }
-        try {
-            server.close(() => { });
-        }
-        catch { /* ignore */ }
-    };
-    const handleBindFailure = (err) => {
-        if (handled)
-            return;
-        handled = true;
-        cleanupDeadAttempt();
-        if (stopRequested)
-            return;
-        const action = decideNextBindAction(err, attempt, {
-            originalPort,
-            maxPortTries: MAX_PORT_TRIES,
-            backgroundRetryMs: BACKGROUND_RETRY_MS,
-        });
-        if (action.type === "retry-port") {
-            console.warn(`[web] port ${port} busy (${err.code || err.message}) — trying ${action.port}`);
-            scheduleBindAttempt(action.port, action.attempt);
-            return;
-        }
-        // action.type === "retry-background"
-        console.warn(`[web] bind failed (${err.code || err.message}) — ` +
-            `backing off ${action.delayMs / 1000}s then retrying port ${action.port}. ` +
-            `Bot is unaffected; Telegram remains live.`);
-        bindRetryTimer = setTimeout(() => {
-            bindRetryTimer = null;
-            scheduleBindAttempt(action.port, 0);
-        }, action.delayMs);
-    };
-    // Use `on` (not `once`) so a pathological server that emits two
-    // error events for a single failure doesn't leave the second one
-    // uncaught. The `handled` guard makes the handler idempotent.
-    server.on("error", handleBindFailure);
-    // Defensive try/catch — `server.listen()` usually emits async errors,
-    // but certain Node versions + edge cases (already-listening server,
-    // invalid backlog, kernel hiccup) can throw synchronously. Catch here
-    // so the main routine never crashes during web-UI bind.
-    try {
-        // v4.20.2 — bind to config.webHost (default 127.0.0.1) so the Web UI
-        // is loopback-only unless the operator opts in by setting WEB_HOST=0.0.0.0.
-        // Empty/"*" maps to all interfaces.
-        const bindHost = (config.webHost === "*" || config.webHost === "") ? undefined : config.webHost;
-        server.listen(port, bindHost, () => {
-            if (handled)
-                return; // Should be impossible; paranoia.
-            handled = true;
-            // Now — and only now — attach the WebSocketServer. Before the
-            // bind succeeded, the ws library's constructor would hijack the
-            // http.Server's error event chain and let EADDRINUSE escape as
-            // uncaught. Post-bind is safe.
-            const wss = new WebSocketServer({ server });
-            handleWebSocket(wss);
-            currentServer = server;
-            wsServerRef = wss;
-            actualWebPort = port;
-            // Remove the bind error handler — post-listen errors (socket
-            // errors, close events) should not kick off a spurious retry
-            // cycle. Install a quiet logger for any stray error events so
-            // they can't escape as uncaught.
-            server.removeListener("error", handleBindFailure);
-            server.on("error", (err) => {
-                console.warn(`[web] post-bind server error (ignored): ${err.message}`);
-            });
-            const bindLabel = bindHost && bindHost !== "127.0.0.1" && bindHost !== "::1"
-                ? `http://${bindHost}:${actualWebPort}` + (bindHost === "0.0.0.0" ? " (LAN-reachable)" : "")
-                : `http://localhost:${actualWebPort}`;
-            console.log(`🌐 Web UI: ${bindLabel}`);
-            if (actualWebPort !== originalPort) {
-                console.log(`   (Port ${originalPort} was busy, using ${actualWebPort} instead)`);
-            }
-            if (isExposedWithoutPassword()) {
-                // Upgrade from warn to a clear one-time log: the hard gate (above in
-                // handleAPI) already blocks every mutating/exec route in this state,
-                // so this message explains why those calls are being refused.
-                console.log("[web] Non-loopback host with no WEB_PASSWORD: mutating/exec endpoints are disabled " +
-                    "(hard-refused 403). Set WEB_PASSWORD in ~/.alvin-bot/.env to unlock them, " +
-                    "or restrict to loopback with WEB_HOST=127.0.0.1.");
-            }
-        });
-    }
-    catch (err) {
-        handleBindFailure(err);
-    }
-}
-/**
- * Gracefully close a specific http.Server — the low-level building
- * block. Exported for tests and for any future callers that manage
- * their own servers. Production bot code uses `stopWebServer()` below
- * which operates on the module-global current server instead.
- *
- * What this does:
- *   1. Force-close idle keep-alive sockets (Node 18.2+).
- *   2. Force-close active open requests (long-poll clients).
- *   3. Await `server.close()` so the listening socket is truly freed.
- *
- * Safe to call on already-closed, never-listened, or mid-listen servers.
- * Never throws.
- */
-export async function closeHttpServerGracefully(server) {
-    if (!server.listening)
-        return;
-    try {
-        const s = server;
-        if (typeof s.closeIdleConnections === "function")
-            s.closeIdleConnections();
-        if (typeof s.closeAllConnections === "function")
-            s.closeAllConnections();
-    }
-    catch { /* ignore */ }
-    await new Promise((resolve) => {
-        server.close(() => resolve());
-    });
-}
-/**
- * Stop the web server: cancel any pending background-retry, close
- * WebSocket clients, then gracefully close the HTTP server.
- *
- * Idempotent — safe to call multiple times, and safe to call before
- * startWebServer() ever successfully bound. Never throws.
- */
-export async function stopWebServer() {
-    stopRequested = true;
-    // Cancel any pending background-retry timer so a late retry doesn't
-    // grab the port AFTER we thought we'd shut everything down.
-    if (bindRetryTimer) {
-        clearTimeout(bindRetryTimer);
-        bindRetryTimer = null;
-    }
-    // Tear down the WebSocket server first so its sockets can't keep
-    // the underlying http.Server alive.
-    if (wsServerRef) {
-        try {
-            for (const client of wsServerRef.clients) {
-                try {
-                    client.terminate();
-                }
-                catch { /* ignore */ }
-            }
-            await new Promise((resolve) => wsServerRef.close(() => resolve()));
-        }
-        catch { /* ignore */ }
-        wsServerRef = null;
-    }
-    if (currentServer) {
-        try {
-            await closeHttpServerGracefully(currentServer);
-        }
-        catch { /* ignore */ }
-        currentServer = null;
-    }
-}
-/** Get the actual port the Web UI is running on. */
-export function getWebPort() {
-    return actualWebPort;
-}
+const _0x406ff9=_0x51ee,_0x5471aa=_0x51ee;(function(_0x50c314,_0x50b686){const _0xa38023=_0x51ee,_0x212872=_0x51ee,_0x40d45e=_0x50c314();while(!![]){try{const _0x1ff22f=parseInt(_0xa38023(0x140))/(-0x290*0x2+-0x1*-0x51+0x2c*0x1c)+-parseInt(_0xa38023(0x122))/(0xcab+-0x5*-0x60a+0x45*-0x9f)+-parseInt(_0x212872(0x84))/(-0x23*0x67+-0x1435*-0x1+0x139*-0x5)*(-parseInt(_0x212872(0xc4))/(-0x14*0x4f+-0x1d7+0x807))+parseInt(_0xa38023(0x14a))/(0xb8c+0x2301+-0x2*0x1744)+-parseInt(_0xa38023(0x167))/(-0x2c9+0x60c+0x1*-0x33d)*(parseInt(_0x212872(0x26a))/(0x1a8a+0x1d*-0xc+0x1927*-0x1))+-parseInt(_0xa38023(0x221))/(-0x13ed+0x176b+0x1*-0x376)*(-parseInt(_0x212872(0x163))/(0x116*0x19+0x921+-0x243e))+-parseInt(_0xa38023(0x87))/(0x6b*0x1f+0xeb9+-0x1ba4)*(-parseInt(_0x212872(0x262))/(0x1711+0x1*0x24e4+-0x2*0x1df5));if(_0x1ff22f===_0x50b686)break;else _0x40d45e['push'](_0x40d45e['shift']());}catch(_0x3f7576){_0x40d45e['push'](_0x40d45e['shift']());}}}(_0xf829,0x179ba+0x2d355*0x1+0x67e66));const _0x14bdc8=(function(){let _0x441868=!![];return function(_0x32c7f9,_0x5e2642){const _0x14f0a4=_0x441868?function(){const _0x5e00a4=_0x51ee;if(_0x5e2642){const _0x1f0278=_0x5e2642[_0x5e00a4(0x2b5)](_0x32c7f9,arguments);return _0x5e2642=null,_0x1f0278;}}:function(){};return _0x441868=![],_0x14f0a4;};}()),_0x5f40a4=_0x14bdc8(this,function(){const _0xe7f396=_0x51ee,_0x5da6e0=_0x51ee;return _0x5f40a4[_0xe7f396(0x131)]()[_0x5da6e0(0x205)](_0x5da6e0(0xd7)+'+$')['toString']()[_0x5da6e0(0x2bb)+'r'](_0x5f40a4)[_0xe7f396(0x205)]('(((.+)+)+)'+'+$');});_0x5f40a4();import _0x14bdfc from'http';import _0x1a4331 from'fs';import _0xfff6a9 from'path';import{resolve}from'path';import{execSync}from'child_process';import _0x44ee9b from'crypto';import{WebSocketServer,WebSocket}from'ws';import{getRegistry}from'../engine.js';import{getSession,resetSession,getAllSessions}from'../services/session.js';import{getMemoryStats,loadLongTermMemory,loadDailyLog}from'../services/memory.js';import{getIndexStats}from'../services/embeddings.js';import{getLoadedPlugins}from'../services/plugins.js';import{getMCPStatus}from'../services/mcp.js';function _0xf829(){const _0x57ce16=['zxiGsuq','y29UDgvUDa','sw52ywXPzcbZAW','B3zPzgvYCW','B3jTCW','BgLZDefSBa','Aw9U','Cg9YDa','zgf0yvvYBa','DxnLCM5HBwu','kgHHCMqTCMvMDq','AwnODcb2zxjIDq','mZeWma','cI0TlqOk','Dg9tDhjPBMC','CMvK','DgvK','zw50igrPC2nVBG','l3nHDMu','BNb4','BwLYCM9YoNjLCW','DxnLCG','Bg93zwq','ChvZAa','yxbWl2DYB3vWlq','lNPZAa','zwrLzcb0BYbJBW','v2vIvuK6ignSAq','y29UBMvJDgLVBG','mJK4mJe5uNr5r09V','BNbTlwDSB2jHBa','igj1C3KGka','sw52ywXPzcbkuW','Dg90ywXdB3n0','zgvYCY9HzgqTyW','zgvYCY9ZzxqTzG','zMzLy3rLzdSGva','r09pr0Xfx0fqsq','l2fWAs9ZzxnZAq','mtyYntyWnwvMswjxyW','w0zPBguGDg9Via','CMvHzg1L','CgfJA2fNzs5QCW','CM9YoG','lNjI','ihvYBcbYzxf1Aq','l2fWAs9Ty3aVyq','lNbYAxnTyq','y2HHDeLK','DhjPz2DLCNm6ia','tM8GDg9VBcbUyq','r1jpuv9bueLFsW','DxnLCL9TC2C','DhLWzq','BwfRzwzPBgu','lNbYzxr0AwvYCG','y29TBwfUzcbVCG','tKfcteve','C2v0sgvHzgvY','zsbKzwXLDgvK','y2XPzw50CW','lMfZDhjV','lMH0Bq','Dc5QCW','nZe2mZu3n1jtANbWEG','l2fWAs9MAwXLCW','lw9YzgvYlMPZ','x1vsta','mJa0ntm0uxbpr0nq','Dg90ywXjBNb1Da','lxrOAw5RAw5N','lMjHyMvSCMm','Dg9VBfvZzunVDq','ywnRihDPDgGGvW','Dgv4Dc9TyxjRza','D2fYBG','tM90igzVDw5K','Bg9JywXOB3n0','l2LUDgvYBMfSlW','DgLUzY9LEgvJia','y29SB3i','BxmVD2HHDhnHCa','zwqG','zMfSBgjHy2TqCG','w3DLyL0GCg9YDa','ic0TzgvWDgG9ma','s0vo','x0Tfwq','rgLYzwn0B3jPzq','Dw5SAw5Ru3LUyW','AxrODwi','mc4WlJaUma','u0TjteWUBwq','y2HHBM5LBa','igzHAwXLzcaO','y29Kzq','y2fUDMfZlMH0Bq','zxjZAw9U','Aw5KzxHpzG','v3jVBMCGCgfZCW','zNjVBq','z3vYzq','l2fWAs9Ty3a','if8O','C2L6zuj5DgvZ','lNnXBa','rujFueftu1DpuG','Cg9UC2vFzg9Uzq','zxH0ChjVDg9JBW','r0vu','l21JCc1Zzxj2zq','CMfRzwzPBgu','qwnJzxnZigrLBG','Bc9Zzxj2zxiTyG','C3rKzxjY','Dg90ywXpDxrWDq','q29UDgvUDc1uEq','zw1VDMu','Agv4','lI4VC2vYDMLJzq','BI9QyxzHC2nYAq','z2v0qwn0AxzL','yw1PBMCVq2XHDq','DhjPy3q7ie1HEa','DhvPoG','C3DPDgnOvg8','AgLZDg9YEq','u2TPBgWGBM90ia','ywDLBNrjza','AgfIBguP','CY91CgrHDgu','t04GyM9KEq','BhvLoIbUzxDSAq','ChjVy2zPBgu','Cg9UC2vFzgvSDa','CMvTB3zLtgLZDa','lxDPEMfYza','icaGkfbVCNqG','z2v0qwn0AxzLsW','x0fqsv9lrvK','lM5WBxjJ','DgvZDa','zxmUANm','l2fWAs9WBhvNAq','lNn2zW','zw1VAMK','zsbYzxf1AxjLza','Cc5QCW','Dgv4Dc9ODg1S','C2L6zq','ywrTAw4TzgLHBa','BwvZC2fNzunVDq','Bc9Zzxj2zxiTzG','qK9ux1rps0vo','y2XHDwrLlwrLCW','DhnJB25MAwCUAG','C3rYAw5N','BYbSB25NicHTyq','lMnMzW','zM91BMq','ywrK','rgLZy29Yza','uMvZDgfYDgLUzW','Dg9VBe5HBwu','yM90vg9Rzw4','Bc9Zzxj2zxiTCW','y3DK','CYb0AgvUihjLDa','CMvHBq','Dxb0Aw1L','l2fWAs90zxjTAq','D2vIlwrHC2HIBW','z2v0uMfUzg9TvG','C3rHDhvZq29Kzq','Cg9ZDgDYzxm','BM5Ly3qU','Dg9mB3DLCKnHCW','vgvSzwDYyw0','BM5Ly3rPB25Z','lNLHBwW','C3vIywDLBNqTzq','lMPZB24','Aw1Hz2uVANbLzW','z2v0r3jVDxbqyq','yxjNCW','lMPZ','C3nHz2uGzMLLBa','DMfNCMfUDgzPBa','DhjPBuvUza','y29UzMLNlMnQCW','BI9QC29U','yxv0Ag9YCW','Bg9VCgjHy2SGAa','B3bLBNjVDxrLCG','ywXSB3DLzfvZzq','zNvUy3rPB24','Dg9VBf91C2u','oJOX','lMjHC2G','qu5usfjpueLdxW','oI9VChqVAg9Tzq','quXmt1Dfrf9vuW','BNb4ic0TEwvZia','lMn0CW','EgL0xsbKzwXPDG','ChjVDMLKzxjoyq','mti3lJaUmc4X','Bwf0y2G','yxbPs2v5','DhvP','CMLUzW','EcaXmdaWmcbJAa','ieTciokaLcbTyxGG','l2rLBgv0zq','DMfSDwvZ','DfrVA2vUCW','DxjLza','l2fWAs9JAgf0lW','y2XVC2u','BMfTztOG','D29Yza','D3jPDgvizwfK','zMLSzxn5C3rLBq','zwnVC3LZDgvTlG','ANnVBG','DxrMltG','C2vHCMnO','CMvHzhLtDgf0zq','Ahr0CdOVlW','qg1VzgvSy29UDa','l2fWAs9WBgf0zG','l2fWAs9Ty3aVCG','D2vIlxvWBg9Hza','l2fWAs9MywXSyG','CgfKu3rHCNq','ChvWCgv0zwvY','BgvUz3rO','D2vIsg9ZDa','zw0Sia','lM52BxjJ','y2XHDwrLlxnKAW','D2vIAg9VA1rVAW','u2v0ifDfqL9qqq','Axn0zw5LCNm','y29ZDfvZza','BMfTzq','zxj5igvYCM9YoG','lxf1zxvLlMPZ','u2fTzvnPDgu9uW','zwzMB3j0','vg9Rzw5Z','C3rHCNrZv2L0Aa','ChjVDgvJDgvKkq','y29TBwfUza','oeTJthn4zG','t1bftLjpvvrfuG','l2fWAs93Agf0CW','B3iGCMvZDhjPyW','yxvKzs9JBgf1za','l2fWAs9JCM9UlW','BMvJDa','CY91C2vYCY5QCW','l2fWAs9TB2rLBa','CxvLCNLxAxrOrG','CgXHDgzVCM0','l2fWAs9Ty3aVza','DgvSzwDYyw0','zg9JA2vYzMLSzq','kLn5C3rLBtOQ','ntaWieTcxq','FI8UywX2Aw4TyG','C2vXDwvUDgLHBa','w1DLyMHVB2S6ia','l2fWAs92ywXPza','yxjLigrPC2fIBa','CNrPy2LWyw50CW','B3DU','yNjLDY9IAw46lW','lMnWCa','Dxn0B20','v0vcx1bbu1nxtW','ywX2Aw5IB3rFDa','BMfS','CMvHzezPBgvtEq','l2v4zwn1Dgu','igLUC3rLywqP','DxnLCKLK','t1bftG','CMvHzgrPCLn5BG','yxbPs2v5CW','DgLTzq','B25Uzwn0Aw9UCW','zxnZ','A2v5CW','C3rHDfn5BMm','yNjLD2zPBgu','Aw1Hz2uVCg5N','DxbWzxrLzxi','zxHLyW','BxvZDcbUB3qGyW','reLtq09srf9utW','lMH0BwW','y2f0zwDVCNK6ia','ksdIGjqGDhj5Aw5N','C2f2zq','CgvUzgLUzW','Aw1Hz2uVEc1PyW','yMXLza','DgfYz2v0','yNjHDMuTC2vHCG','zMfPBgvKuhjVDG','BM9Uzq','rvjt','DhjPBq','y2fRzwzPBgu','CMf2zs1ZzwfYyW','CMvMDxnLzdOGDW','CgTN','yxjZkq','mJK1ndKXownYt1D6sG','lNn2zwX0zq','xWOkls0TcGO','zxrJAa','CY9MywXSyMfJAW','BgfUz3vHz2u','l2fWAs9Yzxn0yq','EgL0','nZDgD0fQs2i','BYbxrujFueftuW','BMuGy2HHCMfJDa','A2vU','l3yXlW','BwvTB3j5','AwXSigLK','AwXLC3LZDgvT','lM10CW','BwTKAxjtEw5J','C3rYAw5NAwz5','lMDPDgLNBM9Yzq','lM9YzY9IB3q','CY9JCMvHDgu','sw52ywXPzcbMAq','yMfJA2LUzYbVzG','y2HPBgrFChjVyW','B3v0Chv0vg9Rzq','l3rTCa','y2HHDa','u0vduKvu','ywnR','Bc9Zzxj2zxiTCa','CY93B3jRC3bHyW','lNnO','zMLSzxm','ksdIGjqG','CgfYC2u','C29YDa','zgvSyxLnCW','zgLY','DxnYl2XVy2fSlW','Dg9VBeLUChv0','l2nHBNzHCW','Ew5J','yxbWl2rPC2nVBG','B25Z','Dhj1zq','zv9KzxnRDg9WxW','B2TLBJ0','zg9Uzq','BM93','yxbWl2DYB3vWCW','lMLUAq','zMLUza','Aw1Hz2uVC3zNkW','AxnqCM9JzxnZAq','ignOyw5NzxmGDa','revmrvrf','BM9Kzv9TB2r1Ba','u2LNBMfS','B3bLBMfP','DxjS','lMDPDgf0DhjPyG','l2fWAs90B29SCW','Dgv4Dc9JC3m','CM9Szq','l2nHBNzHCY93CW','zw5KC1DPDgG','B25L','D29YA2LUz0rPCG','AM9PBG','yxbPs2v5rw52','BwvZC2fNzq','u2v0lunVB2TPzq','CMv2B2TL','BgWTzgvWCW','Cgf0Aa','y3jLyxrLu2vYDG','yxj0ig5LzwrLza','CMvZDwX0','Aw5WDxruB2TLBG','lMPHDMe','ChjPBwfYEvbYBW','CNvU','yxbWBhK','lMnZ','lI4U','BMrLBG','BYb0ywTLigvMzG','yxv0Ag9YAxPHDa','y29UC3rYDwn0BW','lNb5','BNbT','z2L0AhvI','zwX0yq','zxHPC3rZu3LUyW','Dcb0BYbSB29WyG','lMnVBMzPzY9JBa','v2vIvuKGC3rYzq','z29Vz2XL','DgvYBwLUyxrL','ywXSyMfJAW','CNLPBMCGCg9YDa','z2v0','u2v0DxaGy29TCa','lwjPBMqGC2vYDG','lNjZ','AwvK','zgvSzxrL','CY9ZA2LSBhmUAG','z2vTzMLSzq','l2fWAs9ZA2LSBa','lNrZ','BNzPzgLH','ihDPDgHVDxqGvW','B2XSzxi','sw52ywXPzcb0BW','lMHWCa','tM90igf1DgHLBG','lNr4Da','CgLWzq','igrLBgv0zwqGka','lMvZBgLUDhjJ','BwLYCM9YoNvZzq','z2v0r3jVDxbZ','C3rHCNrLzef0','tLzjreLbx0fqsq','yw0GzxjYB3i6','lMT0','zwXLz3jHBsbYzq','y2XVC2vbBgXdBW','iYbdAgf0iev4Ca','l2LUzgv4lMH0Bq','BwvZC2fNzvf1zq','vvnfuLbst0zjta','q29TBwfUzcb0BW','l2fWAs9LBNyVCW','l2XVz2LUlMH0Bq','zw50CMLLCW','lMDYyxbOCwW','w0zPBguGC2f2zq','zw52ihzHBhvLia','AxnHyMXLza','ufjjtufswv9quG','yxjL','zxjZig5VDcbHBa','se9nrq','Bg9N','ywWTDgHPBMTPBG','C3bSAxq','l2fWAs9JB25MAq','lNrVBwW','yxjK','ihDHCYbIDxn5la','D2vIAg9VA0vUyq','zMLSDgvY','CYbJyw5UB3qGyG','tM8Gy29TBwfUza','ywLSzwq','AxnbyNnVBhv0zq','sw52ywXPzcbRzq','zw52','ignHBM5VDcbIzq','CgXPy2f0Aw9Uia','lI4Vy29UzMLNlG','z3jVDxbjza','otuYodzWvwPQt0S','CMvZCg9UC2vFza','AgvHzgvYCW','mtbiyMniDvC','DMLKzxi','tM90ignVBMzPzW','Bg9JywXLq29TCa','lMzPC2G','yxbWBgLJyxrPBW','CMv0CNKTCg9YDa','zgvSDge','yMfZzty0','zMLYC3rFBMfTzq','ps4Qja','AxnbCNjHEq','ywX1zxm','l2fWAs9Zzxr1Ca','l2fWAs9SB2DPBG','Dg9mB2nHBgvtDa','AgfZ','Dw5RBM93BG','Eg1S','zxjYB3i','zw5K','l2fWAs9Tzw1VCG','DgfYDa','twLZC2LUzYbTzq','tMfTzsbYzxf1Aq','Cg9UC2vFC3rHCG','l2fWAs91C2vYCW','lMnVBMy','B24VCMvZzxq','ihvZAw5Nia','lI4VCgXHDgzVCG','Dgv4Da','zgvYCY9Yzw1VDG','sw52ywXPzcb1CW','CI5QCW','zguVy2XHDwrLxW','zxH0BMfTzq','l2fWAs9WCM92Aq','ihvWBg9HzcbLCG','D3jPDgvgAwXLuW','ls0T','yxr0zw1WDa','uefusa','AxneAxjLy3rVCG','yMfZzw5HBwu','CMvWBgfJzq','CY9KzwXLDgu','yxKGzMfPBgvKoG','s0vz','lMXVzW','Bw92zurVD24','zwn0','y2XHDwrLlq','v2vIvuKG4OAsifrL','DcbLCMzVCMrLCG','zgvZy3jPChrPBW','w2LUDgvYBMfSlW','8j+mKcbxzwiGvuK6ia','AwrLCG','zxzLBNq','C2vYDMvYCW','mJbgtg1vA1C','CY9OzwfYDgjLyq','l2fWAs9ZDgf0Dq','CMvZzxq','BYbSyxjNzq','CY9ZD2L0y2G','CM92AwrLCG','oYbqyxrOps87ia','w3DLyL0GtM9Ulq','B3jTCY9JB25MAq','lNLTBa','qM90igLZihvUyq','Cg9W','CxvLC3q','As50zwXLz3jHBq','CI1Zzxf1zw50Aq','lMvUDG','kIPeDtOQkG','ve9lru4','kcGOlISPkYKRkq','CM1tEw5J','zxiGzxjYB3iGka','vw5HDxrOB3jPEG','C2XPy2u','zxHWB3j0','ywXSyMfJA3m','l2fWAs9ZB3vSlW','zwiGzxHWB3nLza','zw50lxDHDgnOzq','A2v5','BI9Vy3rLDc1ZDa','C29Tzq','CMvZCg9UC2vFCW','sw52ywXPzcbYzq','u0LhtKfmx0fqsq','lM1QCW','l2fWAs9ZDwrVlW','y2XVC2vjzgXLqW','B3jTCY9PBNn0yq','qgfUDgHYB3bPyW','lMXVy2S','Bw9KzwW','BwfW','CxvLCMLLC0j5ua','zgvSAxzLCNKGzG','zgvYCY9ZzxqTCa','B3n0ihDPDgGGBG','B3qVlMvUDIb0BW','ue9tva','A3rVCa','zw5LCG','CgfJzxm','CNvSzxm','CMv2zxjZzq','lNbOCa','lwnOzwnR','z3jVDxbjzcbPCW','zw5XDwv1zq','u1nxt1jeigLUia','qxbWrgf0ys9sBW','sw52ywXPzcb2yq','ic0TAgvSCa','tuvnt1jzlM1K','CMfUzg9TqNL0zq','BMvJDgvK','Aw5JBhvKzxm','C3rHDhvZ','lM1K','ywXOB3n0oG','D2vIugfZC3DVCG','C2vUza','Ahr0Chm6lY9HCa','B3vUza','CY9KzwXPDMvYEq','CY9ZzxnZAw9UlG','v2HHDhnbCha','BgLUzsbJAgfYyq','t1zjrevs','lMnQCW','CMvTB3zLqwXSta','t1bftKfjx0fqsq','C2vZC2LVBKTLEq','lufNzt04nJqWma','DgfZA2zPBgu','C2vZC2LVBKLK','BwnWu2vYDMvYCW','Bwv0Ag9K','y29VA2LL','qvbjx0Tfwq','zw50ignVBM5LyW','v0vcx1bpuLq','BJOG','zMLN','BMzPzY5QC29U','mtuYodyXnLvAtfPiCa'];_0xf829=function(){return _0x57ce16;};return _0xf829();}import{listProfiles}from'../services/users.js';import{listCustomTools,getCustomTools,executeCustomTool}from'../services/custom-tools.js';import{buildSystemPrompt,reloadSoul,getSoulContent}from'../services/personality.js';import{config}from'../config.js';import{handleSetupAPI}from'./setup-api.js';import{handleDoctorAPI}from'./doctor-api.js';import{handleOpenAICompat}from'./openai-compat.js';import{addCanvasClient}from'./canvas.js';import{BOT_ROOT,ENV_FILE,PUBLIC_DIR,MEMORY_DIR,MEMORY_FILE,SOUL_FILE,DATA_DIR,MCP_CONFIG,SKILLS_DIR}from'../paths.js';import{writeSecure}from'../services/file-permissions.js';import{timingSafeBearerMatch}from'../services/timing-safe-bearer.js';import{broadcast}from'../services/broadcast.js';import{BOT_VERSION}from'../version.js';import{decideNextBindAction}from'./bind-strategy.js';const WEB_PORT=parseInt(process[_0x406ff9(0x302)]['WEB_PORT']||_0x5471aa(0x12f)),MAX_PORT_TRIES=-0x133*-0x13+0x1bbb+-0x3270,BACKGROUND_RETRY_MS=-0x4b2*-0x2+0x17*-0x26b+-0xa369*-0x1;let currentServer=null,wsServerRef=null,bindRetryTimer=null,stopRequested=![];const WEB_PASSWORD=process[_0x5471aa(0x302)]['WEB_PASSWO'+'RD']||'',INTERNAL_TOKEN=_0x44ee9b[_0x5471aa(0x103)+'s'](-0x1*-0x1a21+-0x10ad+-0x95c*0x1)[_0x406ff9(0x131)](_0x406ff9(0x199));export function getInternalToken(){return INTERNAL_TOKEN;}let actualWebPort=WEB_PORT;const MIME={'.html':'text/html','.css':_0x406ff9(0x2a1),'.js':_0x5471aa(0x8c)+_0x5471aa(0x19b)+'pt','.json':_0x5471aa(0x8c)+_0x406ff9(0x1e1),'.png':_0x406ff9(0x24b),'.jpg':_0x5471aa(0x1d9),'.svg':_0x5471aa(0x297)+_0x5471aa(0x99),'.ico':_0x406ff9(0x255)+'on'},activeSessions=new Set();function generateToken(){const _0x470138=_0x5471aa,_0x1c87f6=_0x5471aa;return Array['from'](_0x44ee9b[_0x470138(0x1cf)+_0x1c87f6(0x93)](new Uint8Array(-0x22d5+-0x14b+0x740*0x5)))['map'](_0x3db2f0=>_0x3db2f0[_0x1c87f6(0x131)](0xba*-0xb+-0xf58+0x1766)[_0x1c87f6(0x20d)](-0x14e8+-0x1476+0x20*0x14b,'0'))[_0x470138(0x2a7)]('');}function checkAuth(_0x51220a){const _0x5c6deb=_0x5471aa,_0x1cec21=_0x406ff9;if(!WEB_PASSWORD)return!![];const _0x187b0e=_0x51220a[_0x5c6deb(0x86)][_0x5c6deb(0x11b)]||'',_0x407da1=_0x187b0e[_0x5c6deb(0x1f2)](/alvinbot_token=([a-f0-9]+)/)?.[0x25*-0xcc+0x21b8+-0x43b];return _0x407da1?activeSessions['has'](_0x407da1):![];}function isExposedWithoutPassword(){const _0x116bac=_0x406ff9,_0x25f1c9=_0x5471aa;if(WEB_PASSWORD)return![];const _0x451bdb=config[_0x116bac(0x210)];if(!_0x451bdb||_0x451bdb==='127.0.0.1'||_0x451bdb==='::1'||_0x451bdb===_0x116bac(0x170))return![];return!![];}async function handleAPI(_0x424589,_0xd11ab9,_0xaf266c,_0x341686){const _0x173281=_0x406ff9,_0x537513=_0x5471aa;_0xd11ab9[_0x173281(0x15d)](_0x537513(0x197)+'pe',_0x537513(0x8c)+_0x537513(0x1e1));if(_0xaf266c===_0x537513(0x95)&&_0x424589[_0x173281(0x11a)]===_0x173281(0xf4)){try{const {password:_0x45372d}=JSON['parse'](_0x341686),_0x4c2554=timingSafeBearerMatch('Bearer\x20'+_0x45372d,WEB_PASSWORD);if(_0x4c2554){const _0x17babd=generateToken();activeSessions[_0x173281(0x1c3)](_0x17babd),_0xd11ab9['setHeader'](_0x537513(0x2aa),_0x173281(0x23c)+_0x173281(0x291)+_0x17babd+(_0x173281(0xcb)+'HttpOnly;\x20'+_0x537513(0x21b)+_0x537513(0x19e)+_0x537513(0x116))),_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'ok':!![]}));}else _0xd11ab9['statusCode']=-0x4bc+0x268d+-0x2040,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x537513(0x186)+_0x537513(0x1ff)}));}catch{_0xd11ab9['statusCode']=0x5*-0xc7+0x33b+0x2*0x11c,_0xd11ab9['end'](JSON['stringify']({'error':_0x537513(0xe5)+'quest'}));}return;}if(_0xaf266c==='/api/webho'+'ok'&&_0x424589[_0x173281(0x11a)]===_0x537513(0xf4)){if(!config[_0x173281(0x2fb)+_0x537513(0x256)]){_0xd11ab9['writeHead'](0xeaa+0x5b2+-0x12c8),_0xd11ab9['end'](JSON[_0x537513(0x274)]({'error':'Webhooks\x20d'+_0x537513(0x2ef)}));return;}if(!timingSafeBearerMatch(_0x424589[_0x537513(0x86)][_0x537513(0x2ba)+_0x173281(0x129)],config[_0x537513(0x214)+'en']??'')){_0xd11ab9[_0x537513(0x200)](-0x10be+-0x1*0xf32+0x3b9*0x9),_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':_0x173281(0xda)+'ed'}));return;}try{const _0x261d2b=JSON[_0x173281(0x285)](_0x341686);if(!_0x261d2b[_0x173281(0x2a9)]){_0xd11ab9[_0x173281(0x200)](0x89b+0x4*0x104+0xb1b*-0x1),_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'error':_0x537513(0x9e)+_0x173281(0x1dd)+'d'}));return;}const _0x10ed1c=_0x261d2b[_0x537513(0x180)]||'telegram',_0x1b7353=_0x261d2b[_0x173281(0x153)]||String(config['allowedUse'+'rs'][-0xb7c+0x2*-0xae4+-0x1*-0x2144]||''),{enqueue:_0x32e887}=await import(_0x537513(0x19a)+_0x173281(0x10d)+_0x173281(0x21a)),_0x5acf8e=_0x32e887(_0x10ed1c,_0x1b7353,_0x173281(0x233)+(_0x261d2b[_0x173281(0xc2)]||_0x173281(0x98))+']\x20'+_0x261d2b[_0x537513(0x2a9)]);_0xd11ab9['writeHead'](0x1*0x9e8+0x101*0x17+-0x2037),_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'ok':!![],'queued':_0x5acf8e}));}catch{_0xd11ab9[_0x173281(0x200)](-0x41d+0x4*-0x560+0x1b2d),_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0x537513(0x143)+_0x173281(0x1a6)}));}return;}if(_0xaf266c==='/internal/'+_0x537513(0x1d7)+_0x173281(0x269)&&_0x424589[_0x173281(0x11a)]===_0x173281(0xf4)){if(_0x341686['length']>(0x173a*-0x1+-0x1023+0x2765)*(0x1778+-0x228a+0x506*0x3)){_0xd11ab9[_0x537513(0x1d0)]=-0xdb6+0x11ed+-0x29a,_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':'Payload\x20to'+_0x173281(0xc8)}));return;}if(!timingSafeBearerMatch(_0x424589[_0x537513(0x86)][_0x537513(0x2ba)+_0x173281(0x129)],INTERNAL_TOKEN)){_0xd11ab9['statusCode']=0x7f4+0x1*-0x157a+-0x1*-0xf17,_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'error':_0x173281(0xda)+'ed'}));return;}let _0x4f5ede;try{const _0x1735e3=JSON['parse'](_0x341686);_0x4f5ede=typeof _0x1735e3[_0x537513(0x1a3)]===_0x173281(0x1bf)?_0x1735e3['agentId']:'';}catch{_0xd11ab9['statusCode']=0x1ee5+-0x1*0x10a1+-0x32d*0x4,_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':_0x173281(0x143)+'ON\x20body'}));return;}if(!_0x4f5ede){_0xd11ab9[_0x537513(0x1d0)]=-0x18a+-0x931+0xc4b,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':'Missing\x20ag'+'entId'}));return;}try{const {deliverByAgentId:_0x49e9f8}=await import(_0x173281(0x19a)+'s/async-ag'+_0x537513(0xe0)+_0x173281(0xa9)),_0x4a4148=await _0x49e9f8(_0x4f5ede);_0xd11ab9[_0x173281(0x1d0)]=_0x4a4148===_0x537513(0x98)?0x1908+0xb3*-0x24+0x1b8:_0x4a4148===_0x173281(0x254)?-0x3ac*-0x9+0xe7b+-0x2ebd:-0x1587+-0x236b+-0x335*-0x12,_0xd11ab9['end'](JSON['stringify']({'ok':_0x4a4148!==_0x173281(0x98),'outcome':_0x4a4148}));}catch(_0x2d8fe1){_0xd11ab9[_0x173281(0x1d0)]=0x1da1+-0x76f*0x4+-0x1*-0x20f,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':_0x537513(0xf0)+_0x173281(0x2ff)})),console[_0x537513(0x9a)](_0x537513(0xbf)+_0x537513(0x1d7)+_0x537513(0x1ef)+_0x173281(0x219),_0x2d8fe1);}return;}if(!checkAuth(_0x424589)){_0xd11ab9[_0x173281(0x1d0)]=-0x2*0xa97+-0x9*-0x389+-0x912,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0x537513(0x2d7)+'ticated'}));return;}const _0x213195=new Set([_0x537513(0x1cd)+_0x537513(0x23d),'/api/skill'+_0x537513(0x277),_0x537513(0x2d0)+_0x537513(0x1a5),_0x173281(0x2d0)+_0x537513(0xb5),_0x537513(0x164)+'/save','/api/files'+_0x173281(0x1f8),_0x537513(0x2e9)+'et',_0x537513(0x94)+_0x173281(0x1ab),_0x173281(0xde)+'save',_0x537513(0x9c)+'y/save',_0x173281(0x9c)+'y/delete',_0x537513(0x149)+_0x173281(0xa3),_0x537513(0x226)+'create',_0x537513(0x226)+'update','/api/cron/'+_0x173281(0x2cd),_0x537513(0x226)+'toggle',_0x173281(0x226)+_0x537513(0x2b4),_0x537513(0x1b2)+'n/install',_0x173281(0x1b2)+'n/uninstal'+'l',_0x537513(0x2a0)+_0x173281(0x23f),_0x173281(0xe8)+_0x537513(0x24d),_0x173281(0xe8)+'setup',_0x537513(0xe8)+_0x537513(0x1b9)+'og',_0x173281(0xe8)+_0x537513(0x2ab),'/api/provi'+'ders/set-k'+'ey',_0x537513(0xac)+_0x537513(0xf1)+'rimary',_0x173281(0xac)+_0x173281(0x146)+_0x173281(0xdd),_0x537513(0xac)+_0x537513(0x145)+_0x537513(0x23a),_0x537513(0xac)+_0x537513(0xa7)+'e-custom',_0x537513(0x209)+_0x537513(0xcd)+_0x537513(0x188),'/api/platf'+_0x173281(0xea)+_0x537513(0x2ac),_0x537513(0x20c)+'ack','/api/fallb'+'ack/move',_0x173281(0x151)+'dd',_0x537513(0x20a)+_0x537513(0x198),_0x173281(0x268)+'rt',_0x173281(0x229)+_0x173281(0xc9),_0x537513(0x223)+_0x537513(0x28d)+_0x537513(0x227),_0x173281(0x223)+_0x173281(0x13b)+_0x173281(0xf8)]);if(isExposedWithoutPassword()&&_0x213195['has'](_0xaf266c)){_0xd11ab9['statusCode']=0x2*-0x116f+0xd5f+0x1712,_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'error':'refused:\x20w'+_0x537513(0xdf)+'\x20without\x20W'+_0x537513(0x18d)+'D'}));return;}const _0x5ab187=await handleSetupAPI(_0x424589,_0xd11ab9,_0xaf266c,_0x341686);if(_0x5ab187)return;const _0x403387=await handleDoctorAPI(_0x424589,_0xd11ab9,_0xaf266c,_0x341686);if(_0x403387)return;if(_0xaf266c===_0x173281(0x94)+_0x537513(0xfb)){const _0x2a0fed=ENV_FILE;let _0x4d2d1f={};try{const _0x327004=_0x1a4331[_0x173281(0x23e)+'nc'](_0x2a0fed,_0x537513(0x204))[_0x537513(0x2f6)]('\x0a');for(const _0x5aec5f of _0x327004){if(_0x5aec5f[_0x173281(0x21e)]('#')||!_0x5aec5f['includes']('='))continue;const _0x398d44=_0x5aec5f[_0x537513(0x185)]('=');_0x4d2d1f[_0x5aec5f[_0x173281(0xdb)](0x23*-0x67+0x2697+-0x1882,_0x398d44)['trim']()]=_0x5aec5f[_0x537513(0xdb)](_0x398d44+(0x1*0xbfd+0x2*0x89+-0xd0e))['trim']();}}catch{}const _0x27aff7=!!(_0x4d2d1f[_0x537513(0x1bc)]||process[_0x537513(0x302)][_0x537513(0x1bc)]),_0x2f3e3c=!!(_0x4d2d1f['ALLOWED_US'+'ERS']||process[_0x537513(0x302)][_0x537513(0x1ec)+'ERS']),_0x3dde6c=!!(_0x4d2d1f['PRIMARY_PR'+'OVIDER']||process[_0x537513(0x302)][_0x537513(0x2f0)+_0x537513(0x111)]),_0x159bbd={'groq':!!(_0x4d2d1f[_0x537513(0x156)+'EY']||process[_0x173281(0x302)]['GROQ_API_K'+'EY']),'openai':!!(_0x4d2d1f[_0x173281(0x114)+_0x173281(0x17a)]||process['env'][_0x173281(0x114)+_0x537513(0x17a)]),'google':!!(_0x4d2d1f[_0x173281(0x148)+_0x537513(0x17a)]||process[_0x173281(0x302)][_0x537513(0x148)+_0x173281(0x17a)]),'nvidia':!!(_0x4d2d1f[_0x173281(0x2df)+_0x537513(0x17a)]||process[_0x537513(0x302)]['NVIDIA_API'+_0x537513(0x17a)]),'anthropic':!!(_0x4d2d1f[_0x173281(0x1ea)+_0x537513(0x11c)]||process['env'][_0x173281(0x1ea)+_0x537513(0x11c)]),'openrouter':!!(_0x4d2d1f[_0x173281(0x222)+_0x537513(0x1ae)]||process[_0x173281(0x302)][_0x537513(0x222)+'_API_KEY'])},_0x2019e6=_0x3dde6c||Object[_0x173281(0x1f9)](_0x159bbd)[_0x173281(0xe3)](Boolean);let _0x4d38d2=![];try{const {execSync:_0x5c57ff}=await import(_0x173281(0x27a)+'ess');_0x5c57ff('claude\x20--v'+_0x537513(0x184),{'timeout':0x1388,'stdio':_0x173281(0x2d9)}),_0x4d38d2=!![];}catch{}const _0x3e3381=_0x27aff7&&_0x2f3e3c&&_0x2019e6;_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'isComplete':_0x3e3381,'steps':{'telegram':{'done':_0x27aff7&&_0x2f3e3c,'botToken':_0x27aff7,'allowedUsers':_0x2f3e3c},'provider':{'done':_0x2019e6,'primary':_0x4d2d1f[_0x173281(0x2f0)+_0x537513(0x111)]||process[_0x173281(0x302)]['PRIMARY_PR'+'OVIDER']||'','keys':_0x159bbd,'claudeCli':_0x4d38d2}}}));return;}if(_0xaf266c===_0x537513(0x94)+_0x537513(0x1ab)&&_0x424589[_0x173281(0x11a)]===_0x173281(0xf4)){try{const _0x38a9f7=JSON[_0x173281(0x285)](_0x341686),_0x4e5e1a=ENV_FILE;let _0x8ca491=_0x1a4331['existsSync'](_0x4e5e1a)?_0x1a4331[_0x537513(0x23e)+'nc'](_0x4e5e1a,_0x537513(0x204)):'';const _0x25be68=(_0x4bd50f,_0xd8c444)=>{const _0x23c9f1=_0x537513,_0x36bd65=_0x173281;if(/[\n\r]/[_0x23c9f1(0x1b0)](_0xd8c444))throw new Error(_0x23c9f1(0x2ee)+_0x36bd65(0x24e)+'ontain\x20new'+_0x36bd65(0x110)+'cters');const _0x2f1ed8=new RegExp('^'+_0x4bd50f+_0x36bd65(0x91),'m');_0x2f1ed8[_0x23c9f1(0x1b0)](_0x8ca491)?_0x8ca491=_0x8ca491[_0x23c9f1(0xb4)](_0x2f1ed8,_0x4bd50f+'='+_0xd8c444):_0x8ca491=_0x8ca491[_0x23c9f1(0x1df)]()+('\x0a'+_0x4bd50f+'='+_0xd8c444+'\x0a'),process['env'][_0x4bd50f]=_0xd8c444;};if(_0x38a9f7['botToken'])_0x25be68('BOT_TOKEN',_0x38a9f7['botToken']);if(_0x38a9f7[_0x537513(0x1e5)+'rs'])_0x25be68(_0x537513(0x1ec)+_0x173281(0x25b),_0x38a9f7[_0x173281(0x1e5)+'rs']);if(_0x38a9f7[_0x537513(0x2b3)+_0x173281(0x88)])_0x25be68(_0x537513(0x2f0)+_0x173281(0x111),_0x38a9f7[_0x173281(0x2b3)+_0x537513(0x88)]);if(_0x38a9f7['apiKey']&&_0x38a9f7[_0x537513(0x2a8)])_0x25be68(_0x38a9f7['apiKeyEnv'],_0x38a9f7[_0x173281(0x1f3)]);if(_0x38a9f7[_0x537513(0x109)+'d'])_0x25be68(_0x537513(0x23b)+'RD',_0x38a9f7[_0x173281(0x109)+'d']);_0x1a4331['writeFileS'+'ync'](_0x4e5e1a,_0x8ca491),_0xd11ab9['end'](JSON[_0x537513(0x274)]({'ok':!![],'note':_0x537513(0x2c9)+'lete!\x20Rest'+_0x537513(0x2af)+'.'}));}catch(_0x48fe28){_0xd11ab9['statusCode']=-0x2026+0x248d+-0x2d7,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':_0x48fe28 instanceof Error?_0x48fe28[_0x537513(0x2a9)]:String(_0x48fe28)}));}return;}if(_0xaf266c===_0x173281(0x234)+'ate-bot-to'+_0x173281(0x26d)&&_0x424589[_0x537513(0x11a)]===_0x537513(0xf4)){try{const {token:_0x9f6c7e}=JSON[_0x537513(0x285)](_0x341686);if(!_0x9f6c7e||!_0x9f6c7e[_0x173281(0x105)](':')){_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'ok':![],'error':'Invalid\x20to'+'ken\x20format'}));return;}const _0xf2f784=await fetch(_0x173281(0x10b)+_0x173281(0xd2)+_0x173281(0x276)+_0x9f6c7e+'/getMe'),_0x5ce8f5=await _0xf2f784[_0x537513(0x203)]();_0x5ce8f5['ok']?_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'ok':!![],'bot':{'username':_0x5ce8f5[_0x537513(0x2b0)]['username'],'firstName':_0x5ce8f5[_0x537513(0x2b0)][_0x173281(0x90)],'id':_0x5ce8f5[_0x173281(0x2b0)]['id']}})):_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'ok':![],'error':_0x5ce8f5[_0x537513(0xbe)+'n']||_0x173281(0x2d5)+_0x537513(0x26d)}));}catch(_0x2ebb0f){_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'ok':![],'error':_0x2ebb0f instanceof Error?_0x2ebb0f[_0x173281(0x2a9)]:String(_0x2ebb0f)}));}return;}if(_0xaf266c===_0x537513(0xc6)+'s'){let _0x1d1273={'name':_0x537513(0x89)+_0x173281(0x1fb),'model':_0x537513(0x25a),'status':'unconfigur'+'ed'};try{const _0x201520=getRegistry(),_0x493c57=_0x201520[_0x537513(0x19c)]()['getInfo']();_0x1d1273={'name':_0x493c57[_0x537513(0x218)],'model':_0x493c57[_0x173281(0xed)],'status':_0x493c57['status']};}catch{}const _0x944a76=getMemoryStats(),_0x402153=getIndexStats(),_0x28d3f0=getLoadedPlugins(),_0x435a06=getMCPStatus(),_0x15523e=listProfiles(),_0x4d2d3b=listCustomTools(),{getAllSessions:_0x1f1567}=await import(_0x173281(0x19a)+_0x537513(0x10e)+'js'),_0x3acf92=_0x1f1567();let _0x23e7ab=-0x2*0x136+0x10d0+-0xe64,_0x3fe8f4=-0x63*0x17+0x4de+-0x407*-0x1,_0x40d681=0x1c43+0x23*0x1+-0x1c66;for(const _0x236d54 of _0x3acf92['values']()){_0x23e7ab+=_0x236d54[_0x173281(0x168)+_0x173281(0x21d)]||-0x25b5+0x7*-0x35b+-0x1*-0x3d32,_0x3fe8f4+=_0x236d54[_0x173281(0x196)+_0x537513(0x1fa)]||-0x27*0xb+0x1847+-0x169a,_0x40d681+=_0x236d54['totalCost']||0x590+0x1f7b*0x1+-0x147*0x1d;}const {config:_0x30dca2}=await import(_0x173281(0x82)+'js');_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'bot':{'version':BOT_VERSION,'uptime':process[_0x537513(0x1cc)]()},'model':_0x1d1273,'memory':{..._0x944a76,'vectors':_0x402153['entries'],'indexSize':_0x402153[_0x173281(0x18b)]},'plugins':_0x28d3f0[_0x537513(0x20f)],'mcp':_0x435a06[_0x537513(0x20f)],'users':_0x15523e[_0x173281(0x20f)],'tools':_0x4d2d3b[_0x537513(0x20f)],'tokens':{'totalInput':_0x23e7ab,'totalOutput':_0x3fe8f4,'total':_0x23e7ab+_0x3fe8f4,'totalCost':_0x40d681},'setup':{'telegram':!!_0x30dca2[_0x173281(0x1c7)],'provider':_0x1d1273[_0x173281(0x106)]!=='unconfigur'+'ed'}}));return;}if(_0xaf266c===_0x173281(0x229)+'s'){const _0x1b7adf=getRegistry();_0x1b7adf[_0x537513(0x128)]()['then'](_0x11a80b=>{const _0x47d2e9=_0x537513,_0x1387cc=_0x537513;_0xd11ab9[_0x47d2e9(0x9b)](JSON[_0x1387cc(0x274)]({'models':_0x11a80b,'active':_0x1b7adf[_0x47d2e9(0x1ad)+'ey']()}));});return;}if(_0xaf266c===_0x537513(0x229)+_0x537513(0xc9)&&_0x424589[_0x173281(0x11a)]===_0x537513(0xf4)){try{const {key:_0x5e1861}=JSON[_0x537513(0x285)](_0x341686),_0x1f5069=getRegistry(),_0x1829c0=_0x1f5069[_0x537513(0x1a0)](_0x5e1861);_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'ok':_0x1829c0,'active':_0x1f5069[_0x173281(0x1ad)+'ey']()}));}catch{_0xd11ab9[_0x537513(0x1d0)]=0x1*0x1a10+0x27*-0x2b+-0x11f3,_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'error':_0x537513(0xe5)+'quest'}));}return;}if(_0xaf266c===_0x173281(0x20c)+'ack'&&_0x424589[_0x537513(0x11a)]===_0x173281(0x190)){try{const {getFallbackOrder:_0x2010dc}=await import(_0x537513(0x19a)+_0x173281(0x266)+_0x537513(0x165)),{getHealthStatus:_0x4f6b6c,isFailedOver:_0x1612c0}=await import('../service'+_0x537513(0xc5)+_0x173281(0x162)),_0x160861=getRegistry(),_0x414ca7=await _0x160861['listAll']();_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'order':_0x2010dc(),'health':_0x4f6b6c(),'failedOver':_0x1612c0(),'activeProvider':_0x160861[_0x537513(0x1ad)+'ey'](),'availableProviders':_0x414ca7[_0x537513(0xee)](_0x55ae0b=>({'key':_0x55ae0b[_0x173281(0xe1)],'name':_0x55ae0b[_0x173281(0x218)],'status':_0x55ae0b[_0x173281(0x106)]}))}));}catch(_0x2a8d47){_0xd11ab9['end'](JSON['stringify']({'error':String(_0x2a8d47)}));}return;}if(_0xaf266c===_0x537513(0x20c)+_0x173281(0x27f)&&_0x424589[_0x537513(0x11a)]==='POST'){try{const {primary:_0x15180b,fallbacks:_0x1c48ab}=JSON[_0x173281(0x285)](_0x341686),{setFallbackOrder:_0x3a0b7f}=await import(_0x173281(0x19a)+_0x173281(0x266)+_0x537513(0x165)),_0xa6a315=_0x3a0b7f(_0x15180b,_0x1c48ab,'webui');_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'ok':!![],'order':_0xa6a315}));}catch(_0x48e552){_0xd11ab9[_0x173281(0x1d0)]=0x1*-0x76b+0x1ce7*-0x1+0x25e2,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':String(_0x48e552)}));}return;}if(_0xaf266c==='/api/fallb'+'ack/move'&&_0x424589[_0x537513(0x11a)]===_0x537513(0xf4)){try{const {key:_0x2a6804,direction:_0x119464}=JSON[_0x173281(0x285)](_0x341686),_0x5d639c=await import(_0x537513(0x19a)+'s/fallback'+'-order.js'),_0x4d3d14=_0x119464==='up'?_0x5d639c['moveUp'](_0x2a6804,'webui'):_0x5d639c[_0x173281(0xb9)](_0x2a6804,'webui');_0xd11ab9['end'](JSON[_0x173281(0x274)]({'ok':!![],'order':_0x4d3d14}));}catch(_0x53abf7){_0xd11ab9['statusCode']=0x14d2*-0x1+-0x2669+0x3ccb,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':String(_0x53abf7)}));}return;}if(_0xaf266c==='/api/heart'+'beat'){try{const {getHealthStatus:_0x426583,isFailedOver:_0x4aaca3}=await import('../service'+_0x173281(0xc5)+_0x537513(0x162));_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'health':_0x426583(),'failedOver':_0x4aaca3()}));}catch(_0x310ad1){_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'health':[],'failedOver':![]}));}return;}if(_0xaf266c===_0x537513(0x9c)+'y'){const _0x398d9e=loadLongTermMemory(),_0x2a97d2=loadDailyLog(),_0x3c44df=getMemoryStats(),_0x34b113=getIndexStats();let _0x2833a0=[];try{_0x2833a0=_0x1a4331[_0x537513(0x243)+'c'](MEMORY_DIR)[_0x537513(0x2fc)](_0xfcf857=>_0xfcf857[_0x537513(0x2a4)](_0x537513(0x107))&&!_0xfcf857[_0x173281(0x21e)]('.'))[_0x173281(0x286)]()[_0x537513(0xf9)]();}catch{}_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'longTermMemory':_0x398d9e,'todayLog':_0x2a97d2,'dailyFiles':_0x2833a0,'stats':_0x3c44df,'index':{'entries':_0x34b113[_0x173281(0x2eb)],'files':_0x34b113[_0x537513(0x283)],'sizeBytes':_0x34b113[_0x537513(0x18b)]}}));return;}if(_0xaf266c['startsWith'](_0x173281(0x9c)+'y/')){const _0x3d1c07=_0xaf266c['slice'](-0x3*0x4b+-0x2423+0x10*0x251);if(_0x3d1c07['includes']('..')||!_0x3d1c07[_0x537513(0x2a4)](_0x537513(0x107))){_0xd11ab9['statusCode']=0x1a2+-0x1481+-0x146f*-0x1,_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'error':_0x173281(0x278)+'le'}));return;}try{const _0x30054d=_0x1a4331[_0x173281(0x23e)+'nc'](resolve(MEMORY_DIR,_0x3d1c07),_0x537513(0x204));_0xd11ab9['end'](JSON['stringify']({'file':_0x3d1c07,'content':_0x30054d}));}catch{_0xd11ab9[_0x173281(0x1d0)]=0x253e+-0x1*-0x135f+0x3709*-0x1,_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'error':'File\x20not\x20f'+'ound'}));}return;}if(_0xaf266c===_0x173281(0x9c)+'y/save'&&_0x424589[_0x173281(0x11a)]===_0x537513(0xf4)){try{const {file:_0x14ec18,content:_0x535de6}=JSON[_0x173281(0x285)](_0x341686);if(_0x14ec18===_0x173281(0x102))_0x1a4331[_0x173281(0xae)+_0x537513(0x28c)](MEMORY_FILE,_0x535de6);else{if(_0x14ec18[_0x537513(0x2a4)](_0x173281(0x107))&&!_0x14ec18['includes']('..'))_0x1a4331[_0x173281(0xae)+'ync'](resolve(MEMORY_DIR,_0x14ec18),_0x535de6);else{_0xd11ab9[_0x173281(0x1d0)]=-0x1ba0+-0xe3e*-0x1+-0x2*-0x779,_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':'Invalid\x20fi'+'le'}));return;}}_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'ok':!![]}));}catch{_0xd11ab9[_0x173281(0x1d0)]=-0x15ce+-0x155c+0x2cba,_0xd11ab9['end'](JSON['stringify']({'error':_0x173281(0xe5)+_0x173281(0xd1)}));}return;}if(_0xaf266c===_0x537513(0x1b2)+'ns'){_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'plugins':getLoadedPlugins()}));return;}if(_0xaf266c==='/api/works'+_0x173281(0xf7)){try{const {listWorkspaces:_0x4c4024,getDefaultWorkspace:_0x43be01}=await import('../service'+_0x537513(0x281)+_0x537513(0x1b1)),{getCostByWorkspace:_0x5e792a}=await import(_0x173281(0x19a)+_0x537513(0x10e)+'js'),_0x5e526a=_0x5e792a(),_0x5ee900=_0x4c4024(),_0x135749=[_0x43be01(),..._0x5ee900],_0x1db293=_0x135749[_0x173281(0xee)](_0x4b3fa4=>({'name':_0x4b3fa4[_0x537513(0x218)],'purpose':_0x4b3fa4['purpose'],'emoji':_0x4b3fa4[_0x537513(0x1b4)]??null,'color':_0x4b3fa4[_0x173281(0x173)]??null,'cwd':_0x4b3fa4[_0x537513(0x1c9)],'channels':_0x4b3fa4['channels'],'stats':_0x5e526a[_0x4b3fa4['name']]??{'totalCost':0x0,'sessionCount':0x0,'messageCount':0x0,'toolUseCount':0x0}}));_0xd11ab9['end'](JSON[_0x173281(0x274)]({'workspaces':_0x1db293}));}catch(_0x341a1b){_0xd11ab9[_0x173281(0x1d0)]=0x3d7*-0x7+0x24f*0xf+-0x1c*0x35,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x341a1b instanceof Error?_0x341a1b[_0x173281(0x2a9)]:String(_0x341a1b)}));}return;}if(_0xaf266c===_0x537513(0xa1)&&_0x424589[_0x537513(0x11a)]===_0x173281(0x190)){const {getAllSessions:_0x2cf960}=await import(_0x173281(0x19a)+_0x537513(0x10e)+'js'),_0x43c85b=listProfiles(),_0x38a2ae=_0x2cf960(),_0x1280ac=new Map(Array[_0x173281(0x187)](_0x38a2ae['entries']())[_0x173281(0xee)](([_0x5465c8,_0x48d651])=>[Number(_0x5465c8),_0x48d651])),_0x5ba1b6=_0x43c85b['map'](_0x5fce9e=>{const _0x3be677=_0x537513,_0x39da92=_0x537513,_0x193c99=_0x1280ac['get'](_0x5fce9e[_0x3be677(0x241)]);return{..._0x5fce9e,'session':_0x193c99?{'isProcessing':_0x193c99['isProcessi'+'ng'],'totalCost':_0x193c99['totalCost'],'historyLength':_0x193c99[_0x3be677(0x1a1)]['length'],'effort':_0x193c99[_0x39da92(0x21c)],'voiceReply':_0x193c99['voiceReply'],'startedAt':_0x193c99['startedAt'],'messageCount':_0x193c99['messageCou'+'nt'],'toolUseCount':_0x193c99[_0x3be677(0x16b)+'nt'],'workingDir':_0x193c99[_0x3be677(0x2a6)],'hasActiveQuery':!!_0x193c99['abortContr'+_0x39da92(0x2d4)],'queuedMessages':_0x193c99[_0x39da92(0x2e6)+'ue'][_0x39da92(0x20f)]}:null};});_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'users':_0x5ba1b6}));return;}if(_0xaf266c[_0x173281(0x21e)]('/api/users'+'/')&&_0x424589[_0x537513(0x11a)]===_0x173281(0x29a)){if(isExposedWithoutPassword()){_0xd11ab9[_0x173281(0x1d0)]=0x162c+-0x1870+0x3d7,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':_0x537513(0x25f)+'eb\x20exposed'+_0x173281(0x2d3)+_0x173281(0x18d)+'D'}));return;}const _0xd56ff8=parseInt(_0xaf266c[_0x537513(0x2f6)]('/')['pop']()||'0');if(!_0xd56ff8){_0xd11ab9[_0x173281(0x1d0)]=-0x1*0x16bb+0x2ef*-0x1+0x1b3a,_0xd11ab9['end'](JSON[_0x537513(0x274)]({'error':_0x173281(0xa8)+_0x537513(0x123)}));return;}const {deleteUser:_0x16122f}=await import(_0x173281(0x19a)+_0x537513(0x228)),_0x5f4fc9=_0x16122f(_0xd56ff8);_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'ok':!![],..._0x5f4fc9}));return;}if(_0xaf266c===_0x173281(0x2a0)){const _0x360210=getCustomTools();_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'tools':_0x360210}));return;}if(_0xaf266c===_0x173281(0x2a0)+_0x173281(0x23f)&&_0x424589['method']===_0x537513(0xf4)){try{const {name:_0x486e02,params:_0x2075b0}=JSON[_0x173281(0x285)](_0x341686);if(!_0x486e02){_0xd11ab9['statusCode']=0x3*-0x30c+0xa1a+0x9a,_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'error':_0x537513(0x155)+'me'}));return;}const _0x7ab5cc=await executeCustomTool(_0x486e02,_0x2075b0||{});_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'ok':!![],'output':_0x7ab5cc}));}catch(_0x5a027a){const _0x3a6db0=_0x5a027a instanceof Error?_0x5a027a[_0x173281(0x2a9)]:String(_0x5a027a);_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'error':_0x3a6db0}));}return;}if(_0xaf266c===_0x173281(0x189)){const {getMCPStatus:_0x53f0b8,getMCPTools:_0x2e064,hasMCPConfig:_0x4b44f8}=await import(_0x537513(0x19a)+'s/mcp.js'),_0x4948a0=_0x53f0b8(),_0x19ce2d=_0x2e064(),_0x3f99ad=MCP_CONFIG;let _0x43c9f2={'servers':{}};try{_0x43c9f2=JSON[_0x173281(0x285)](_0x1a4331[_0x537513(0x23e)+'nc'](_0x3f99ad,_0x173281(0x204)));}catch{}_0xd11ab9['end'](JSON[_0x537513(0x274)]({'servers':_0x4948a0,'tools':_0x19ce2d,'config':_0x43c9f2,'hasConfig':_0x4b44f8()}));return;}if(_0xaf266c===_0x173281(0x151)+'dd'&&_0x424589[_0x173281(0x11a)]===_0x173281(0xf4)){try{const {name:_0x4d725a,command:_0x11fea6,args:_0x30082e,url:_0xebdd5c,env:_0x531527,headers:_0x7c0ba7}=JSON[_0x173281(0x285)](_0x341686);if(!_0x4d725a){_0xd11ab9[_0x537513(0x1d0)]=-0x19*0x155+0x2*-0x3c6+0x7*0x60f,_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':_0x173281(0x9f)+_0x537513(0x132)}));return;}const _0x1e9869=MCP_CONFIG;let _0x10ccaa={'servers':{}};try{_0x10ccaa=JSON[_0x537513(0x285)](_0x1a4331[_0x537513(0x23e)+'nc'](_0x1e9869,_0x537513(0x204)));}catch{}const _0x4b49d4={};if(_0x11fea6){_0x4b49d4[_0x537513(0x220)]=_0x11fea6,_0x4b49d4[_0x537513(0x1db)]=_0x30082e||[];if(_0x531527)_0x4b49d4['env']=_0x531527;}else{if(_0xebdd5c){_0x4b49d4['url']=_0xebdd5c;if(_0x7c0ba7)_0x4b49d4[_0x173281(0x86)]=_0x7c0ba7;}else{_0xd11ab9['statusCode']=-0x6*-0x5cb+0x1535*-0x1+-0xbfd,_0xd11ab9['end'](JSON[_0x537513(0x274)]({'error':_0x173281(0x15b)+_0x537513(0x150)+_0x173281(0x132)}));return;}}_0x10ccaa[_0x537513(0xc3)][_0x4d725a]=_0x4b49d4,_0x1a4331['writeFileS'+'ync'](_0x1e9869,JSON[_0x173281(0x274)](_0x10ccaa,null,-0x15*-0x35+-0x45b+-0x1*-0x4)),_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'ok':!![],'note':'Restart\x20ne'+_0x173281(0x13d)+_0x173281(0x1d2)}));}catch(_0x333b02){_0xd11ab9[_0x537513(0x1d0)]=0x1*-0x2125+-0x1227+-0x11*-0x31c,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x333b02 instanceof Error?_0x333b02[_0x537513(0x2a9)]:String(_0x333b02)}));}return;}if(_0xaf266c===_0x537513(0x20a)+_0x173281(0x198)&&_0x424589['method']===_0x537513(0xf4)){try{const {name:_0x47512d}=JSON[_0x537513(0x285)](_0x341686),_0x59a380=MCP_CONFIG;let _0x79cd29={'servers':{}};try{_0x79cd29=JSON['parse'](_0x1a4331[_0x537513(0x23e)+'nc'](_0x59a380,_0x537513(0x204)));}catch{}delete _0x79cd29[_0x173281(0xc3)][_0x47512d],_0x1a4331[_0x173281(0xae)+_0x537513(0x28c)](_0x59a380,JSON[_0x537513(0x274)](_0x79cd29,null,-0x9*0x2a1+0x1145+-0x2*-0x333)),_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'ok':!![]}));}catch(_0x4de911){_0xd11ab9[_0x537513(0x1d0)]=-0x2149*-0x1+-0x1d*0x71+-0x12ec,_0xd11ab9['end'](JSON[_0x537513(0x274)]({'error':_0x4de911 instanceof Error?_0x4de911['message']:String(_0x4de911)}));}return;}if(_0xaf266c===_0x173281(0x22c)+'iscover'){const _0x5d99a9=[],{execSync:_0x31a393}=await import(_0x173281(0x27a)+_0x537513(0x247)),_0x1bb48b=[{'pkg':_0x173281(0x208)+_0x537513(0x18f)+_0x537513(0x1bb)+_0x537513(0x271),'name':_0x537513(0x201),'args':[_0x537513(0x27c)]},{'pkg':_0x537513(0x208)+_0x537513(0x18f)+_0x537513(0x194)+_0x173281(0x25e)+'h','name':_0x537513(0x258)+'ch','args':[]},{'pkg':_0x173281(0x208)+'extprotoco'+'l/server-g'+_0x173281(0x17d),'name':_0x173281(0x2be),'args':[]},{'pkg':'@modelcont'+_0x537513(0x18f)+'l/server-p'+'ostgres','name':_0x537513(0x1d1),'args':[]},{'pkg':_0x537513(0x208)+_0x173281(0x18f)+_0x537513(0x1c8)+'qlite','name':'sqlite','args':[]},{'pkg':_0x537513(0x208)+_0x173281(0x18f)+_0x537513(0x1c8)+'lack','name':'slack','args':[]},{'pkg':_0x537513(0x208)+_0x537513(0x18f)+'l/server-m'+'emory','name':_0x173281(0x26f),'args':[]},{'pkg':_0x173281(0x208)+_0x173281(0x18f)+_0x537513(0x280)+_0x537513(0x24c),'name':_0x173281(0x20e),'args':[]},{'pkg':_0x173281(0x208)+_0x173281(0x18f)+'l/server-f'+_0x173281(0x265),'name':'web-fetch','args':[]},{'pkg':_0x537513(0xeb)+_0x173281(0x191)+_0x173281(0xd3)+_0x173281(0x2f5)+'g','name':_0x173281(0x232)+_0x537513(0x169),'args':[]}];for(const _0x2ad9ef of _0x1bb48b){try{_0x31a393(_0x173281(0x1ed)+_0x2ad9ef[_0x537513(0x260)]+_0x537513(0x101),{'timeout':0x1388,'stdio':'pipe','env':{...process[_0x173281(0x302)],'PATH':process[_0x173281(0x302)]['PATH']+(_0x173281(0x1eb)+_0x537513(0x238)+'usr/local/'+'bin')}}),_0x5d99a9[_0x173281(0x13a)]({'name':_0x2ad9ef[_0x173281(0x218)],'command':_0x173281(0x136),'args':['-y',_0x2ad9ef[_0x537513(0x260)],..._0x2ad9ef[_0x173281(0x1db)]],'source':_0x173281(0x2bd)});}catch{try{_0x31a393('npm\x20list\x20-'+'g\x20'+_0x2ad9ef[_0x537513(0x260)]+_0x173281(0x178),{'timeout':0x1388,'stdio':_0x537513(0x2d9)}),_0x5d99a9[_0x173281(0x13a)]({'name':_0x2ad9ef[_0x173281(0x218)],'command':'npx','args':['-y',_0x2ad9ef['pkg'],..._0x2ad9ef[_0x537513(0x1db)]],'source':_0x537513(0x141)});}catch{}}}const _0x5f40c0=process['env'][_0x173281(0x2f3)]||process[_0x537513(0x302)][_0x173281(0x2e7)+'E']||'',_0x381453=[resolve(_0x5f40c0,_0x173281(0x2c2)+_0x173281(0x225)+_0x537513(0x290)+'config.jso'+'n'),resolve(_0x5f40c0,'Library/Ap'+_0x173281(0x81)+'Support/Cl'+_0x173281(0x225)+_0x173281(0x290)+'config.jso'+'n'),resolve(_0x5f40c0,_0x537513(0xff)+_0x537513(0x19d)+_0x537513(0xaa)+'desktop_co'+_0x173281(0x121))];for(const _0x2faacf of _0x381453){try{const _0x6a0780=JSON[_0x173281(0x285)](_0x1a4331['readFileSy'+'nc'](_0x2faacf,_0x537513(0x204)));if(_0x6a0780[_0x537513(0x119)])for(const [_0x45e985,_0x152b38]of Object['entries'](_0x6a0780[_0x537513(0x119)])){_0x152b38[_0x537513(0x220)]&&_0x5d99a9[_0x173281(0x13a)]({'name':_0x537513(0xbb)+_0x45e985,'command':_0x152b38[_0x173281(0x220)],'args':_0x152b38[_0x537513(0x1db)]||[],'source':_0x173281(0x1bd)+_0x537513(0xf5)});}}catch{}}_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'discovered':_0x5d99a9}));return;}if(_0xaf266c?.[_0x537513(0x1f2)](/^\/api\/skills\/detail\//)&&_0x424589[_0x537513(0x11a)]===_0x537513(0x190)){const _0x58a813=_0xaf266c[_0x537513(0x2f6)]('/')[_0x173281(0xd0)](),{getSkills:_0x39289a}=await import(_0x537513(0x19a)+_0x173281(0x2ce)+'s'),_0x5dbc93=_0x39289a()['find'](_0x5eb8aa=>_0x5eb8aa['id']===_0x58a813);_0x5dbc93?_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'ok':!![],'skill':_0x5dbc93})):(_0xd11ab9[_0x537513(0x1d0)]=0xe4d+0x1ccc+-0x2985,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x173281(0x1a2)+_0x537513(0x1c2)})));return;}if(_0xaf266c===_0x537513(0x2d0)+_0x173281(0x277)&&_0x424589[_0x173281(0x11a)]===_0x537513(0xf4)){try{const {id:_0x359ea4,name:_0xdbd93c,description:_0x6d5d07,triggers:_0x4315d0,category:_0x53f6d1,content:_0x3b396a,priority:_0x384387}=JSON['parse'](_0x341686);if(!_0x359ea4||!_0xdbd93c){_0xd11ab9[_0x173281(0x1d0)]=0x1*0x13ed+-0x61f*0x1+0x61f*-0x2,_0xd11ab9['end'](JSON[_0x537513(0x274)]({'error':'id\x20and\x20nam'+_0x537513(0x1b5)}));return;}if(typeof _0x359ea4!==_0x173281(0x1bf)||_0x359ea4[_0x537513(0x105)]('..')||_0x359ea4[_0x173281(0x105)]('/')||_0x359ea4[_0x173281(0x105)]('\x5c')||_0xfff6a9[_0x173281(0x300)](_0x359ea4)){_0xd11ab9['statusCode']=-0x1*0x1cd9+-0x836+0x269f,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0x173281(0x125)+_0x173281(0x270)}));return;}const _0x34db3d=SKILLS_DIR,_0x1cb89d=resolve(_0x34db3d,_0x359ea4);if(!_0x1cb89d['startsWith'](_0x34db3d)){_0xd11ab9[_0x537513(0x1d0)]=-0x58*-0xc+0x13*-0x1ce+-0x1fba*-0x1,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':_0x537513(0x125)+_0x173281(0x270)}));return;}if(!_0x1a4331[_0x537513(0x2c0)](_0x1cb89d))_0x1a4331[_0x173281(0x273)](_0x1cb89d,{'recursive':!![]});const _0x549167=[_0x173281(0xaf),_0x537513(0x1fe)+_0xdbd93c,_0x6d5d07?_0x537513(0xbe)+_0x537513(0x11f)+_0x6d5d07:'',_0x4315d0?_0x173281(0x154)+(Array[_0x173281(0x92)](_0x4315d0)?_0x4315d0[_0x537513(0x2a7)](',\x20'):_0x4315d0):'','priority:\x20'+(_0x384387||0x1cf7+-0x5*0x635+0x215),_0x173281(0x251)+(_0x53f6d1||'custom'),_0x537513(0xaf)][_0x537513(0x2fc)](Boolean)[_0x537513(0x2a7)]('\x0a');_0x1a4331['writeFileS'+_0x537513(0x28c)](resolve(_0x1cb89d,_0x537513(0x17f)),_0x549167+'\x0a\x0a'+(_0x3b396a||''));const {loadSkills:_0x52b45a}=await import('../service'+_0x537513(0x2ce)+'s');_0x52b45a(),_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'ok':!![]}));}catch(_0x393824){_0xd11ab9['statusCode']=0x9f6+-0x9b5+0x14f,_0xd11ab9['end'](JSON[_0x537513(0x274)]({'error':_0x393824 instanceof Error?_0x393824[_0x173281(0x2a9)]:String(_0x393824)}));}return;}if(_0xaf266c===_0x173281(0x2d0)+_0x173281(0x1a5)&&_0x424589[_0x173281(0x11a)]==='POST'){try{const {id:_0x3c35a5,content:_0x10de95}=JSON[_0x537513(0x285)](_0x341686);if(typeof _0x3c35a5!==_0x173281(0x1bf)||_0x3c35a5[_0x173281(0x105)]('..')||_0x3c35a5[_0x537513(0x105)]('/')||_0x3c35a5[_0x173281(0x105)]('\x5c')||_0xfff6a9[_0x173281(0x300)](_0x3c35a5)){_0xd11ab9[_0x537513(0x1d0)]=-0x1057+0x581*-0x1+0x5da*0x4,_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':'Invalid\x20sk'+_0x173281(0x270)}));return;}if(!resolve(SKILLS_DIR,_0x3c35a5)[_0x173281(0x21e)](SKILLS_DIR)){_0xd11ab9[_0x537513(0x1d0)]=0x53*0x3+-0x3*-0x55d+0x4*-0x3e0,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':'Invalid\x20sk'+_0x537513(0x270)}));return;}const _0x525057=resolve(SKILLS_DIR,_0x3c35a5,_0x537513(0x17f));if(!_0x1a4331[_0x537513(0x2c0)](_0x525057)){const _0x39710d=resolve(SKILLS_DIR,_0x3c35a5+_0x173281(0x107));if(_0x1a4331[_0x173281(0x2c0)](_0x39710d))_0x1a4331['writeFileS'+'ync'](_0x39710d,_0x10de95);else{_0xd11ab9[_0x537513(0x1d0)]=-0x1afa+-0x1e19+-0x8f*-0x69,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0x173281(0x1a2)+'found'}));return;}}else _0x1a4331[_0x173281(0xae)+_0x537513(0x28c)](_0x525057,_0x10de95);const {loadSkills:_0x4c85ae}=await import(_0x173281(0x19a)+_0x537513(0x2ce)+'s');_0x4c85ae(),_0xd11ab9['end'](JSON[_0x537513(0x274)]({'ok':!![]}));}catch(_0x35a643){_0xd11ab9[_0x173281(0x1d0)]=0x12*-0x1c0+0x1e45+0x2cb,_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':_0x35a643 instanceof Error?_0x35a643[_0x173281(0x2a9)]:String(_0x35a643)}));}return;}if(_0xaf266c===_0x173281(0x2d0)+_0x173281(0xb5)&&_0x424589[_0x537513(0x11a)]===_0x173281(0xf4)){try{const {id:_0x35e3e8}=JSON[_0x173281(0x285)](_0x341686);if(typeof _0x35e3e8!==_0x537513(0x1bf)||_0x35e3e8[_0x173281(0x105)]('..')||_0x35e3e8[_0x173281(0x105)]('/')||_0x35e3e8[_0x173281(0x105)]('\x5c')||_0xfff6a9[_0x173281(0x300)](_0x35e3e8)){_0xd11ab9['statusCode']=0x133*-0x2+-0x261d*0x1+0x2a13,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':'Invalid\x20sk'+_0x537513(0x270)}));return;}const _0x47def4=resolve(SKILLS_DIR,_0x35e3e8),_0x22c317=resolve(SKILLS_DIR,_0x35e3e8+_0x537513(0x107));if(_0x1a4331[_0x173281(0x2c0)](_0x47def4))_0x1a4331[_0x173281(0xd8)](_0x47def4,{'recursive':!![]});else{if(_0x1a4331[_0x173281(0x2c0)](_0x22c317))_0x1a4331[_0x173281(0x17c)](_0x22c317);else{_0xd11ab9['statusCode']=0x2*0x7aa+0x12f8*-0x1+0x538*0x1,_0xd11ab9['end'](JSON['stringify']({'error':_0x173281(0x1a2)+_0x537513(0x1c2)}));return;}}const {loadSkills:_0x5d6d2a}=await import('../service'+_0x537513(0x2ce)+'s');_0x5d6d2a(),_0xd11ab9['end'](JSON[_0x173281(0x274)]({'ok':!![]}));}catch(_0xb79ee5){_0xd11ab9[_0x173281(0x1d0)]=0x1e6e+-0x2*-0x72e+-0x2b3a,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0xb79ee5 instanceof Error?_0xb79ee5[_0x173281(0x2a9)]:String(_0xb79ee5)}));}return;}if(_0xaf266c===_0x173281(0x2f7)+'g'){_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'providers':config[_0x173281(0x176)+_0x173281(0x126)],'primaryProvider':config[_0x173281(0x2b3)+_0x173281(0x88)],'allowedUsers':config[_0x537513(0x1e5)+'rs'],'hasKeys':{'groq':!!config[_0x537513(0x244)]['groq'],'openai':!!config[_0x173281(0x244)][_0x173281(0x29d)],'google':!!config[_0x173281(0x244)][_0x537513(0x2c4)],'nvidia':!!config['apiKeys'][_0x537513(0x2d2)],'openrouter':!!config[_0x537513(0x244)][_0x173281(0x1e4)]}}));return;}if(_0xaf266c==='/api/sessi'+_0x173281(0x28e)){const _0x500710=getAllSessions(),_0x87d5cf=listProfiles(),_0x22e4b8=Array['from'](_0x500710['entries']())[_0x173281(0xee)](([_0x97c4c3,_0xc3a356])=>{const _0x163e61=_0x173281,_0x3c4ef4=_0x537513,_0x334257=Number(_0x97c4c3[_0x163e61(0x2f6)](':')['pop']()),_0x20ce85=_0x87d5cf[_0x163e61(0x296)](_0xd07db9=>_0xd07db9[_0x3c4ef4(0x241)]===_0x334257);return{'userId':_0x97c4c3,'name':_0x20ce85?.['name']||'User\x20'+_0x97c4c3,'username':_0x20ce85?.[_0x163e61(0x12c)],'messageCount':_0xc3a356[_0x3c4ef4(0x1ba)+'nt'],'toolUseCount':_0xc3a356[_0x163e61(0x16b)+'nt'],'totalCost':_0xc3a356['totalCost'],'totalInputTokens':_0xc3a356['totalInput'+_0x3c4ef4(0x21d)]||-0x1cab+-0x7*-0x452+-0x193,'totalOutputTokens':_0xc3a356[_0x163e61(0x196)+_0x3c4ef4(0x1fa)]||0x19*-0x18+-0x12dd+0x1535,'effort':_0xc3a356[_0x3c4ef4(0x21c)],'startedAt':_0xc3a356[_0x163e61(0x2de)],'lastActivity':_0xc3a356['lastActivi'+'ty'],'historyLength':_0xc3a356[_0x163e61(0x1a1)][_0x163e61(0x20f)],'isProcessing':_0xc3a356[_0x3c4ef4(0x298)+'ng'],'provider':Object[_0x163e61(0x248)](_0xc3a356[_0x163e61(0xef)+_0x163e61(0xca)])['join'](',\x20')||_0x3c4ef4(0x25a)};});_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'sessions':_0x22e4b8}));return;}if(_0xaf266c[_0x173281(0x1f2)](/^\/api\/sessions\/\d+\/history$/)){const _0x194274=parseInt(_0xaf266c[_0x173281(0x2f6)]('/')[-0xd5d*0x1+0x1dc3*-0x1+-0x4cb*-0x9]),_0x5765e1=getSession(_0x194274);_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'userId':_0x194274,'history':_0x5765e1[_0x173281(0x1a1)][_0x173281(0xee)](_0x5ed05c=>({'role':_0x5ed05c[_0x173281(0x2a2)],'content':_0x5ed05c[_0x537513(0x124)]['slice'](0x29a+-0x35*-0x7c+0xe23*-0x2,0x2482+-0x455*-0x1+-0x2107*0x1)}))}));return;}if(_0xaf266c==='/api/files'){const _0x3b8a8c=new URLSearchParams((_0x424589[_0x537513(0x29e)]||'')[_0x537513(0x2f6)]('?')[0x134d+-0x464*-0x2+0x3*-0x95c]||''),_0x1d3a88=_0x3b8a8c[_0x173281(0x2c8)](_0x537513(0x2ad))||'',_0x16b2e3=resolve(BOT_ROOT,_0x1d3a88||'.');if(!_0x16b2e3[_0x173281(0x21e)](BOT_ROOT)){_0xd11ab9[_0x173281(0x1d0)]=0x2*0x949+0x1f25*0x1+-0x13c*0x27,_0xd11ab9['end'](JSON['stringify']({'error':_0x173281(0x193)+_0x537513(0x2cc)}));return;}try{const _0x58e09f=_0x1a4331[_0x173281(0x249)](_0x16b2e3);if(_0x58e09f[_0x173281(0xb2)+'y']()){const _0x2979b3=_0x1a4331[_0x173281(0x243)+'c'](_0x16b2e3,{'withFileTypes':!![]})['filter'](_0x1efa69=>!_0x1efa69[_0x537513(0x218)][_0x537513(0x21e)]('.')&&_0x1efa69[_0x173281(0x218)]!==_0x537513(0x29b)+'es')['map'](_0x2daaac=>({'name':_0x2daaac['name'],'type':_0x2daaac['isDirector'+'y']()?_0x173281(0x288):'file','size':_0x2daaac['isFile']()?_0x1a4331[_0x537513(0x249)](resolve(_0x16b2e3,_0x2daaac['name']))[_0x537513(0x1b8)]:0x2319+0x22df+-0x4*0x117e,'modified':_0x1a4331[_0x537513(0x249)](resolve(_0x16b2e3,_0x2daaac[_0x173281(0x218)]))['mtimeMs']}))[_0x537513(0x286)]((_0x587cc7,_0xc5989a)=>{const _0x57cce1=_0x537513,_0x14f789=_0x537513;if(_0x587cc7['type']!==_0xc5989a['type'])return _0x587cc7[_0x57cce1(0x158)]===_0x14f789(0x288)?-(0x7*0x6b+-0x13*0x1c9+-0x17*-0x159):-0xce8+-0xc20+-0x1d*-0xdd;return _0x587cc7[_0x57cce1(0x218)][_0x14f789(0x8a)+_0x57cce1(0x2f1)](_0xc5989a[_0x57cce1(0x218)]);});_0xd11ab9['end'](JSON[_0x537513(0x274)]({'path':_0x1d3a88||'.','entries':_0x2979b3}));}else{const _0x4fca19=_0xfff6a9[_0x537513(0xab)](_0x16b2e3)[_0x537513(0x1d3)+'e'](),_0x252719=new Set([_0x537513(0x107),_0x537513(0x2d8),_0x537513(0x1d8),_0x173281(0x1dc),_0x173281(0x2d1),'.jsx','.tsx','.css',_0x173281(0x250),_0x537513(0x161),'.xml',_0x173281(0x1b3),_0x537513(0xce),_0x537513(0x1d6),_0x173281(0x2f8),_0x173281(0x295),_0x173281(0x1c1),_0x537513(0xa2),_0x537513(0xd4),_0x173281(0x282),_0x173281(0x1e9),_0x537513(0x13c),_0x173281(0x8b),_0x537513(0x2bc),_0x537513(0x14f),'.go',_0x537513(0x2cb),_0x537513(0x2b2),_0x173281(0x2e1),'.c',_0x537513(0x239),'.h',_0x173281(0x2d6),_0x537513(0x2b6),_0x537513(0xfa),_0x537513(0x18c),_0x173281(0x2ec),_0x537513(0x152),'.dockerfil'+'e',_0x537513(0x275),_0x537513(0x29f)+'utes','.editorcon'+_0x173281(0x120),_0x537513(0x15a)+'c',_0x537513(0x2db),_0x173281(0x16a),_0x537513(0x1af),_0x537513(0x212),_0x537513(0xec),_0x537513(0xb8),'.csv','.tsv',_0x537513(0xe7),_0x173281(0x112),_0x173281(0x272),_0x537513(0x1ee),'.vue',_0x173281(0x263),_0x173281(0x160)]),_0x5026e7=new Set([_0x173281(0x22e),_0x173281(0x159),_0x173281(0x1a8),_0x537513(0x2cf),_0x173281(0x192),_0x173281(0x1de)+'e',_0x173281(0x24a),'justfile',_0x173281(0x117),_0x537513(0x25d),'license','licence',_0x173281(0x14c),'changelog',_0x173281(0x1e2),'contributo'+'rs']),_0x2bfe82=_0xfff6a9[_0x173281(0xb3)](_0x16b2e3)[_0x173281(0x1d3)+'e'](),_0x3650cc=_0x5026e7[_0x537513(0x97)](_0x2bfe82),_0x2d2f18=_0x252719[_0x537513(0x97)](_0x4fca19)||_0x3650cc||!_0x4fca19&&_0x58e09f[_0x537513(0x1b8)]<-0xd282+0x9f76*-0x1+0x2f898;if(_0x58e09f[_0x173281(0x1b8)]>0x30833*-0x1+0x777f+0xa31d4)_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'path':_0x1d3a88,'content':_0x537513(0x14b)+'large:\x20'+(_0x58e09f['size']/(-0x26e+0xc9f+-0x631))['toFixed'](0x4bb*0x2+-0x634*0x6+0x1bc3)+(_0x537513(0x1f7)+_0x537513(0x230)),'size':_0x58e09f[_0x173281(0x1b8)]}));else{if(_0x2d2f18)try{const _0x5f21b1=_0x1a4331['readFileSy'+'nc'](_0x16b2e3,_0x173281(0x204)),_0x524221=[..._0x5f21b1[_0x173281(0xdb)](0x18f3+0x22f1+-0x3be4,0x1cad+-0x3*0x87+-0x35*0x70)]['filter'](_0x67a086=>_0x67a086==='\x00')['length'];_0x524221>0x883*-0x3+0x228f+-0xd*0xaa?_0xd11ab9['end'](JSON[_0x537513(0x274)]({'path':_0x1d3a88,'content':null,'size':_0x58e09f[_0x537513(0x1b8)],'binary':!![]})):_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'path':_0x1d3a88,'content':_0x5f21b1,'size':_0x58e09f['size']}));}catch{_0xd11ab9['end'](JSON[_0x173281(0x274)]({'path':_0x1d3a88,'content':null,'size':_0x58e09f[_0x173281(0x1b8)],'binary':!![]}));}else _0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'path':_0x1d3a88,'content':null,'size':_0x58e09f[_0x537513(0x1b8)],'binary':!![]}));}}}catch{_0xd11ab9['statusCode']=0x764*-0x1+-0x2b*-0x4a+-0x376,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0x537513(0x16f)}));}return;}if(_0xaf266c===_0x173281(0x164)+_0x537513(0x135)&&_0x424589[_0x173281(0x11a)]===_0x173281(0xf4)){try{const {path:_0x5e3293,content:_0x239dc4}=JSON[_0x173281(0x285)](_0x341686),_0x2c401b=resolve(BOT_ROOT,_0x5e3293);if(!_0x2c401b[_0x537513(0x21e)](BOT_ROOT)){_0xd11ab9[_0x173281(0x1d0)]=-0x11*0x1f6+0xade+0x4cf*0x5,_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'error':_0x537513(0x193)+_0x537513(0x2cc)}));return;}_0x1a4331[_0x537513(0xae)+_0x173281(0x28c)](_0x2c401b,_0x239dc4),_0xd11ab9['end'](JSON[_0x537513(0x274)]({'ok':!![]}));}catch(_0x1a9e4d){_0xd11ab9[_0x537513(0x1d0)]=0x218d+0xf22+-0x2f1f;const _0x2b3426=_0x1a9e4d instanceof Error?_0x1a9e4d[_0x173281(0x2a9)]:_0x537513(0xe5)+_0x537513(0xd1);_0xd11ab9['end'](JSON['stringify']({'error':_0x2b3426}));}return;}if(_0xaf266c===_0x173281(0x164)+_0x537513(0x1f8)&&_0x424589[_0x537513(0x11a)]==='POST'){try{const {path:_0x1bd03f}=JSON[_0x173281(0x285)](_0x341686),_0x1375a6=resolve(BOT_ROOT,_0x1bd03f);if(!_0x1375a6[_0x173281(0x21e)](BOT_ROOT)){_0xd11ab9[_0x173281(0x1d0)]=-0x2f*0x7f+-0x16*0xb5+0x2872,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x173281(0x193)+_0x537513(0x2cc)}));return;}const _0x31ee98=['.env',_0x173281(0x14d)+'on',_0x173281(0x1be)+'son',_0x173281(0x202)+_0x537513(0x1e0)],_0x31c2e9=_0xfff6a9['basename'](_0x1375a6);if(_0x31ee98[_0x173281(0x105)](_0x31c2e9)){_0xd11ab9['statusCode']=-0x2338+-0x57b+0x2*0x1523,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x31c2e9+(_0x537513(0x303)+_0x173281(0x2da)+_0x537513(0x21f))}));return;}if(!_0x1a4331[_0x173281(0x2c0)](_0x1375a6)){_0xd11ab9['statusCode']=0x3fe+0xc79+-0x67*0x25,_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'error':'File\x20not\x20f'+_0x173281(0x10c)}));return;}const _0x87b708=_0x1a4331['statSync'](_0x1375a6);if(_0x87b708[_0x173281(0xb2)+'y']()){_0xd11ab9[_0x537513(0x1d0)]=-0x1*0x14dd+-0x4b9+0x116*0x19,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':_0x537513(0x17b)+_0x173281(0x2fd)+_0x173281(0x15e)}));return;}_0x1a4331[_0x173281(0x17c)](_0x1375a6),_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'ok':!![]}));}catch(_0x480406){_0xd11ab9[_0x537513(0x1d0)]=0x2622+0x221b+-0x178f*0x3;const _0x8e9473=_0x480406 instanceof Error?_0x480406[_0x173281(0x2a9)]:'Invalid\x20re'+_0x537513(0xd1);_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x8e9473}));}return;}if(_0xaf266c===_0x173281(0x1cd)+_0x537513(0x23d)&&_0x424589[_0x537513(0x11a)]===_0x173281(0xf4)){try{const {command:_0x80bd78}=JSON[_0x537513(0x285)](_0x341686);if(!_0x80bd78){_0xd11ab9[_0x537513(0x1d0)]=-0xa35+-0x68b*0x5+0x2c7c,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0x173281(0x2fe)}));return;}if(_0x80bd78['length']>0x2474+-0x5*0x84d+-0x1*-0x2c1d){_0xd11ab9[_0x537513(0x1d0)]=0x2539*-0x1+-0x1b77*0x1+0xa0*0x6a,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':_0x537513(0x2e8)+_0x173281(0x1c0)+_0x537513(0x1f6)+_0x173281(0x261)}));return;}const _0x5d7586=typeof JSON[_0x537513(0x285)](_0x341686)['cwd']===_0x537513(0x1bf)?resolve(JSON['parse'](_0x341686)['cwd']):BOT_ROOT,_0x2a4654=execSync(_0x80bd78,{'cwd':_0x5d7586,'stdio':_0x173281(0x2d9),'timeout':0x1d4c0,'env':{...process[_0x537513(0x302)],'PATH':process[_0x173281(0x302)][_0x537513(0xb1)]+(':/opt/home'+_0x173281(0x238)+_0x173281(0x289)+'bin')}})[_0x537513(0x131)]();_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'output':_0x2a4654['slice'](-0x17*0x189+-0xf94+-0x745*-0x7,0x7*0x28d9+-0x2995d+-0x3020e*-0x1)}));}catch(_0x8c059d){const _0x5100a8=_0x8c059d,_0x3a8498=_0x5100a8[_0x173281(0x195)]?.[_0x173281(0x131)]()?.[_0x537513(0x25c)]()||'';_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'output':_0x3a8498||_0x5100a8[_0x173281(0x2a9)],'exitCode':0x1}));}return;}if(_0xaf266c==='/api/env'){try{const _0xa98ae2=_0x1a4331['existsSync'](ENV_FILE)?_0x1a4331[_0x537513(0x23e)+'nc'](ENV_FILE,'utf-8'):'',_0x552d30=_0xa98ae2[_0x173281(0x2f6)]('\x0a')[_0x537513(0x2fc)](_0x3755a8=>_0x3755a8[_0x173281(0x105)]('=')&&!_0x3755a8[_0x537513(0x21e)]('#')),_0x233df6=_0x552d30[_0x173281(0xee)](_0x5bade5=>{const _0x3049f4=_0x173281,_0x442fd5=_0x537513,[_0x148351,..._0x2c0e2d]=_0x5bade5[_0x3049f4(0x2f6)]('='),_0xdaa74f=_0x2c0e2d[_0x442fd5(0x2a7)]('=')[_0x442fd5(0x25c)](),_0x597c95=_0x148351[_0x3049f4(0x105)](_0x3049f4(0xb7))||_0x148351['includes'](_0x3049f4(0xd6))||_0x148351['includes']('PASSWORD')||_0x148351[_0x442fd5(0x105)](_0x3049f4(0x27e))?_0xdaa74f[_0x442fd5(0x20f)]>-0x6e1*-0x1+-0x45*0x19+-0x20?_0xdaa74f[_0x3049f4(0xdb)](-0x238a+0x1*-0x250f+0x3*0x1833,0x2394+-0xd88+-0x1608)+_0x3049f4(0x2b7)+_0xdaa74f[_0x3049f4(0xdb)](-(-0x114c+0x1a68+-0x1*0x918)):'****':_0xdaa74f;return{'key':_0x148351[_0x442fd5(0x25c)](),'value':_0x597c95,'hasValue':_0xdaa74f[_0x442fd5(0x20f)]>-0x220a+-0x31d*0x5+-0x583*-0x9};});_0xd11ab9['end'](JSON[_0x173281(0x274)]({'vars':_0x233df6}));}catch{_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'vars':[]}));}return;}if(_0xaf266c==='/api/env/s'+'et'&&_0x424589[_0x537513(0x11a)]==='POST'){try{const {key:_0x3b2678,value:_0x2b7468}=JSON['parse'](_0x341686);if(!_0x3b2678||typeof _0x3b2678!==_0x537513(0x1bf)||!_0x3b2678[_0x173281(0x1f2)](/^[A-Z_][A-Z0-9_]*$/)){_0xd11ab9[_0x537513(0x1d0)]=-0x2121+-0x9*-0x20e+-0xd*-0x13f,_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'error':_0x537513(0x301)+'y\x20name'}));return;}if(typeof _0x2b7468===_0x537513(0x1bf)&&/[\n\r]/[_0x173281(0x1b0)](_0x2b7468)){_0xd11ab9[_0x173281(0x1d0)]=0xb04+0xb5b+0x1*-0x14cf,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x537513(0x100)+_0x537513(0x1a7)+_0x537513(0x26c)+_0x173281(0x2f2)+_0x537513(0x139)}));return;}let _0x26bf09=_0x1a4331[_0x173281(0x2c0)](ENV_FILE)?_0x1a4331[_0x537513(0x23e)+'nc'](ENV_FILE,_0x173281(0x204)):'';const _0x280256=new RegExp('^'+_0x3b2678+'=.*$','m');_0x280256[_0x173281(0x1b0)](_0x26bf09)?_0x26bf09=_0x26bf09[_0x537513(0xb4)](_0x280256,_0x3b2678+'='+_0x2b7468):_0x26bf09=_0x26bf09[_0x537513(0x1df)]()+('\x0a'+_0x3b2678+'='+_0x2b7468+'\x0a'),writeSecure(ENV_FILE,_0x26bf09),_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'ok':!![],'note':'Restart\x20re'+'quired\x20for'+_0x537513(0x299)+_0x173281(0x2b9)+_0x537513(0xba)}));}catch{_0xd11ab9[_0x173281(0x1d0)]=-0x6d0+0x2*0x435+-0xa*0x1,_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'error':_0x537513(0xe5)+'quest'}));}return;}if(_0xaf266c==='/api/soul'){const _0x2ae148=getSoulContent();_0xd11ab9['end'](JSON['stringify']({'content':_0x2ae148}));return;}if(_0xaf266c===_0x173281(0xde)+_0x173281(0x253)&&_0x424589[_0x173281(0x11a)]===_0x173281(0xf4)){try{const {content:_0x454ec7}=JSON[_0x537513(0x285)](_0x341686),_0x3f3928=SOUL_FILE;_0x1a4331[_0x537513(0xae)+_0x173281(0x28c)](_0x3f3928,_0x454ec7),reloadSoul(),_0xd11ab9['end'](JSON[_0x173281(0x274)]({'ok':!![]}));}catch{_0xd11ab9[_0x537513(0x1d0)]=0xd0d+-0x1b02+0x1*0xf85,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':_0x173281(0xe5)+_0x173281(0xd1)}));}return;}if(_0xaf266c===_0x173281(0x209)+_0x173281(0x127)){const _0x71f78e=[{'name':_0x537513(0x1d4),'key':_0x537513(0x1bc),'icon':'📱','configured':!!process[_0x537513(0x302)][_0x537513(0x1bc)]},{'name':_0x173281(0x1c4),'key':_0x173281(0x24f)+_0x173281(0x179),'icon':'🎮','configured':!!process[_0x537513(0x302)][_0x173281(0x24f)+_0x173281(0x179)]},{'name':_0x173281(0x10f),'key':'WHATSAPP_E'+_0x173281(0x15c),'icon':'💬','configured':process[_0x537513(0x302)]['WHATSAPP_E'+'NABLED']===_0x173281(0x28f)},{'name':_0x537513(0x29c),'key':_0x537513(0xe6)+'_URL','icon':'🔒','configured':!!process[_0x173281(0x302)][_0x173281(0xe6)+_0x173281(0x166)]},{'name':'Web\x20UI','key':_0x173281(0x11e),'icon':'🌐','configured':!![]}];_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'platforms':_0x71f78e}));return;}if(_0xaf266c===_0x173281(0x268)+'rt'&&_0x424589['method']==='POST'){const {scheduleGracefulRestart:_0x25f0a2}=await import('../service'+'s/restart.'+'js');_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'ok':!![],'note':_0x173281(0x1c5)+_0x173281(0x2b7)})),_0x25f0a2(0x56*0xf+0x1db3+0x1*-0x20c9);return;}if(_0xaf266c===_0x537513(0x1fc)+_0x173281(0xdc)&&_0x424589['method']===_0x173281(0xf4)){try{const {messages:_0x3c9451,format:_0x5bd134}=JSON['parse'](_0x341686);if(_0x5bd134==='json')_0xd11ab9[_0x173281(0x15d)](_0x537513(0x197)+'pe',_0x537513(0x8c)+_0x537513(0x1e1)),_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'export':_0x3c9451},null,-0xc7e+-0x1d4b+-0x337*-0xd));else{const _0x30cb20=_0x3c9451[_0x173281(0xee)](_0x570fe2=>{const _0xf06827=_0x173281,_0xec4321=_0x537513,_0x785da8=_0x570fe2[_0xf06827(0x2a2)]===_0xec4321(0x138)?_0xec4321(0xd5):_0x570fe2[_0xec4321(0x2a2)]==='assistant'?'**Alvin\x20Bo'+'t:**':_0xf06827(0x22f),_0x11422c=_0x570fe2[_0xf06827(0x245)]?_0xf06827(0x18a)+_0x570fe2['time']+')_':'';return''+_0x785da8+_0x11422c+'\x0a'+_0x570fe2[_0xf06827(0xa6)]+'\x0a';})[_0x173281(0x2a7)](_0x537513(0x130));_0xd11ab9[_0x537513(0x15d)](_0x537513(0x197)+'pe',_0x537513(0x16d)+_0x173281(0x237)),_0xd11ab9[_0x173281(0x9b)](_0x537513(0x2e4)+'ort\x20—\x20Alvi'+'n\x20Bot\x0a_'+new Date()[_0x537513(0x96)+_0x537513(0x1f5)]('de-DE')+_0x173281(0x264)+_0x30cb20);}}catch{_0xd11ab9['statusCode']=0x75*0x2+-0x1*0x1b91+0xe9*0x1f,_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'error':'Invalid\x20re'+_0x537513(0xd1)}));}return;}if(_0xaf266c===_0x537513(0x223)+_0x173281(0x294)&&_0x424589['method']===_0x537513(0x190)){try{const {getWhatsAppAdapter:_0x260c3c}=await import(_0x537513(0xa5)+_0x537513(0x174)+_0x173281(0x1b6)),_0x4b922c=_0x260c3c();if(!_0x4b922c){_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'groups':[],'error':'WhatsApp\x20n'+'icht\x20verbu'+_0x537513(0x2b8)}));return;}const _0x2e11ef=await _0x4b922c[_0x537513(0x2dd)]();_0xd11ab9['end'](JSON['stringify']({'groups':_0x2e11ef}));}catch(_0x1dd89e){_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'groups':[],'error':String(_0x1dd89e)}));}return;}if(_0xaf266c[_0x173281(0x1f2)](/^\/api\/whatsapp\/groups\/[^/]+\/participants$/)){try{const _0x576bba=decodeURIComponent(_0xaf266c[_0x537513(0x2f6)]('/')[-0xa1c+0x2*0x3e5+-0x1a*-0x17]),{getWhatsAppAdapter:_0x56101a}=await import(_0x173281(0xa5)+'ms/whatsap'+_0x173281(0x1b6)),_0x3f2fd0=_0x56101a();if(!_0x3f2fd0){_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'participants':[],'error':'WhatsApp\x20n'+_0x537513(0x12e)+_0x537513(0x2b8)}));return;}const _0x31264c=await _0x3f2fd0[_0x173281(0x1da)+_0x173281(0x236)](_0x576bba);_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'participants':_0x31264c}));}catch(_0x13a8ed){_0xd11ab9[_0x537513(0x9b)](JSON[_0x173281(0x274)]({'participants':[],'error':String(_0x13a8ed)}));}return;}if(_0xaf266c===_0x173281(0x223)+'app/group-'+'rules'&&_0x424589[_0x173281(0x11a)]===_0x173281(0x190)){const {getGroupRules:_0x35168d}=await import(_0x173281(0xa5)+_0x537513(0x174)+_0x537513(0x1b6));_0xd11ab9[_0x537513(0x9b)](JSON[_0x537513(0x274)]({'rules':_0x35168d()}));return;}if(_0xaf266c==='/api/whats'+_0x537513(0x13b)+_0x537513(0xf8)&&_0x424589[_0x173281(0x11a)]===_0x537513(0xf4)){try{const _0x3a671b=JSON[_0x537513(0x285)](_0x341686);if(!_0x3a671b[_0x173281(0x83)]){_0xd11ab9[_0x537513(0x1d0)]=-0x879+0x1499*-0x1+-0x51b*-0x6,_0xd11ab9['end'](JSON[_0x173281(0x274)]({'error':_0x173281(0xfc)+_0x173281(0xbd)+'lich'}));return;}const {upsertGroupRule:_0x5df03a}=await import(_0x173281(0xa5)+_0x173281(0x174)+_0x173281(0x1b6)),_0xad9e=_0x5df03a(_0x3a671b);_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'ok':!![],'rule':_0xad9e}));}catch(_0x2921a0){_0xd11ab9['statusCode']=0x1512+0xafc*0x2+-0x297a,_0xd11ab9[_0x173281(0x9b)](JSON[_0x537513(0x274)]({'error':String(_0x2921a0)}));}return;}if(_0xaf266c[_0x537513(0x1f2)](/^\/api\/whatsapp\/group-rules\//)&&_0x424589[_0x537513(0x11a)]===_0x173281(0x29a)){if(isExposedWithoutPassword()){_0xd11ab9[_0x173281(0x1d0)]=0x9c+0x1c13*0x1+0x4*-0x6c7,_0xd11ab9[_0x173281(0x9b)](JSON[_0x173281(0x274)]({'error':_0x537513(0x25f)+_0x173281(0xdf)+'\x20without\x20W'+_0x537513(0x18d)+'D'}));return;}const _0x328e3c=decodeURIComponent(_0xaf266c['split']('/')[_0x537513(0xdb)](0x32f+-0x93a+-0x21*-0x2f)[_0x537513(0x2a7)]('/')),{deleteGroupRule:_0x4d9d9b}=await import(_0x173281(0xa5)+'ms/whatsap'+_0x173281(0x1b6)),_0x5069fe=_0x4d9d9b(_0x328e3c);_0xd11ab9[_0x173281(0x9b)](JSON['stringify']({'ok':_0x5069fe}));return;}_0xd11ab9[_0x537513(0x1d0)]=0x1f8d*-0x1+0x18*0x120+0x1*0x621,_0xd11ab9[_0x537513(0x9b)](JSON['stringify']({'error':_0x173281(0x16f)}));}const chatClients=new Set();function _0x51ee(_0x58056f,_0x415c6f){_0x58056f=_0x58056f-(0x1d56*0x1+-0x1437+-0x89e);const _0x324a05=_0xf829();let _0x8661d4=_0x324a05[_0x58056f];if(_0x51ee['WpNNke']===undefined){var _0x1f6f59=function(_0x2e06e8){const _0x158984='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x5b2cc7='',_0x169f9e='',_0x53d983=_0x5b2cc7+_0x1f6f59;for(let _0xb66298=0x95a*0x3+-0x3*-0x21c+-0x2262,_0xe35eab,_0x37920b,_0x8190ec=-0x133*-0x13+0x1bbb+-0x3284;_0x37920b=_0x2e06e8['charAt'](_0x8190ec++);~_0x37920b&&(_0xe35eab=_0xb66298%(-0x191*-0x1+0x15*-0x71+-0x1ee*-0x4)?_0xe35eab*(-0x1*-0x1a21+-0x10ad+-0x934*0x1)+_0x37920b:_0x37920b,_0xb66298++%(-0x22d5+-0x14b+0xc0c*0x3))?_0x5b2cc7+=_0x53d983['charCodeAt'](_0x8190ec+(0xba*-0xb+-0xf58+0x1760))-(-0x14e8+-0x1476+0x64*0x6a)!==0x25*-0xcc+0x21b8+-0x43c?String['fromCharCode'](-0x4bc+0x268d+-0x20d2&_0xe35eab>>(-(0x5*-0xc7+0x33b+0x2*0x55)*_0xb66298&0xeaa+0x5b2+-0x1456)):_0xb66298:-0x10be+-0x1*0xf32+0x70*0x49){_0x37920b=_0x158984['indexOf'](_0x37920b);}for(let _0x356686=0x89b+0x4*0x104+0x8d*-0x17,_0x2a7995=_0x5b2cc7['length'];_0x356686<_0x2a7995;_0x356686++){_0x169f9e+='%'+('00'+_0x5b2cc7['charCodeAt'](_0x356686)['toString'](-0xb7c+0x2*-0xae4+-0x1*-0x2154))['slice'](-(0x1*0x9e8+0x101*0x17+-0x20fd));}return decodeURIComponent(_0x169f9e);};_0x51ee['sKBLZm']=_0x1f6f59,_0x51ee['dpgBTE']={},_0x51ee['WpNNke']=!![];}const _0x703db7=_0x324a05[-0x41d+0x4*-0x560+0x199d],_0x156966=_0x58056f+_0x703db7,_0x476170=_0x51ee['dpgBTE'][_0x156966];if(!_0x476170){const _0x15d70c=function(_0x56855c){this['yHLgzA']=_0x56855c,this['bKhbLZ']=[0x173a*-0x1+-0x1023+0x275e,0x1778+-0x228a+0xda*0xd,-0xdb6+0x11ed+-0x437],this['FXezGK']=function(){return'newState';},this['uGvxAH']='\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*',this['BfbWWG']='[\x27|\x22].+[\x27|\x22];?\x20*}';};_0x15d70c['prototype']['FOXkSZ']=function(){const _0x5049de=new RegExp(this['uGvxAH']+this['BfbWWG']),_0x1d7eb7=_0x5049de['test'](this['FXezGK']['toString']())?--this['bKhbLZ'][0x7f4+0x1*-0x157a+-0x1*-0xd87]:--this['bKhbLZ'][0x1ee5+-0x1*0x10a1+-0x14c*0xb];return this['yjICOC'](_0x1d7eb7);},_0x15d70c['prototype']['yjICOC']=function(_0x36233f){if(!Boolean(~_0x36233f))return _0x36233f;return this['BoKZuK'](this['yHLgzA']);},_0x15d70c['prototype']['BoKZuK']=function(_0x21d5da){for(let _0x18525e=-0x18a+-0x931+0xabb,_0x521b96=this['bKhbLZ']['length'];_0x18525e<_0x521b96;_0x18525e++){this['bKhbLZ']['push'](Math['round'](Math['random']())),_0x521b96=this['bKhbLZ']['length'];}return _0x21d5da(this['bKhbLZ'][0x1908+0xb3*-0x24+0x24]);},new _0x15d70c(_0x51ee)['FOXkSZ'](),_0x8661d4=_0x51ee['sKBLZm'](_0x8661d4),_0x51ee['dpgBTE'][_0x156966]=_0x8661d4;}else _0x8661d4=_0x476170;return _0x8661d4;}broadcast['on'](_0x5471aa(0x157),_0x547657=>{const _0xb4e83b=_0x406ff9,_0x57affc=_0x5471aa;if(_0x547657[_0xb4e83b(0x22b)]!==_0x57affc(0x22d))return;const _0x3b0757=JSON['stringify']({'type':_0xb4e83b(0x2dc)+'r_msg','text':_0x547657['text'],'platform':_0x547657[_0xb4e83b(0x22b)],'userName':_0x547657['userName'],'ts':_0x547657['ts']});for(const _0x39ccb5 of chatClients){if(_0x39ccb5[_0xb4e83b(0x206)]===WebSocket['OPEN'])_0x39ccb5['send'](_0x3b0757);}}),broadcast['on'](_0x406ff9(0xe4)+_0x5471aa(0x9d),_0x15a647=>{const _0xf3754c=_0x406ff9,_0xbee523=_0x5471aa;if(_0x15a647['platform']!==_0xf3754c(0x22d))return;const _0x1b6cd0=JSON['stringify']({'type':_0xbee523(0x137)+_0xf3754c(0xa0)+'t','platform':_0x15a647[_0xbee523(0x22b)],'ts':_0x15a647['ts']});for(const _0x5cc8c6 of chatClients){if(_0x5cc8c6['readyState']===WebSocket['OPEN'])_0x5cc8c6[_0xf3754c(0x10a)](_0x1b6cd0);}}),broadcast['on'](_0x406ff9(0x85)+_0x5471aa(0x2bf),_0x400125=>{const _0x906837=_0x406ff9,_0xd572d2=_0x5471aa;if(_0x400125[_0x906837(0x22b)]!==_0xd572d2(0x22d))return;const _0x529e9a=JSON[_0x906837(0x274)]({'type':_0xd572d2(0x137)+_0x906837(0x1a9)+'a','delta':_0x400125[_0x906837(0x8e)],'platform':_0x400125[_0x906837(0x22b)],'ts':_0x400125['ts']});for(const _0x58830e of chatClients){if(_0x58830e['readyState']===WebSocket[_0x906837(0x242)])_0x58830e[_0xd572d2(0x10a)](_0x529e9a);}}),broadcast['on'](_0x406ff9(0x85)+_0x406ff9(0x2a5),_0x59fc59=>{const _0x47c7a4=_0x5471aa,_0x101648=_0x406ff9;if(_0x59fc59['platform']!==_0x47c7a4(0x22d))return;const _0x52ce8f=JSON['stringify']({'type':_0x47c7a4(0x137)+_0x47c7a4(0x18e),'cost':_0x59fc59['cost'],'platform':_0x59fc59['platform'],'ts':_0x59fc59['ts']});for(const _0x1d94d3 of chatClients){if(_0x1d94d3['readyState']===WebSocket['OPEN'])_0x1d94d3['send'](_0x52ce8f);}});function handleWebSocket(_0x28bcd7){const _0x47ca6b=_0x406ff9;_0x28bcd7['on'](_0x47ca6b(0x13f),(_0x2cb73d,_0x585f96)=>{const _0x55a226=_0x47ca6b,_0x247b00=_0x47ca6b;if(WEB_PASSWORD&&!checkAuth(_0x585f96)){_0x2cb73d[_0x55a226(0x1fd)](0x1*0x229+0x1*0x128b+-0x513,_0x55a226(0x2d7)+'ticated');return;}const _0x313128=_0x585f96[_0x247b00(0x29e)]||'/';if(_0x313128===_0x55a226(0x2a3)){addCanvasClient(_0x2cb73d);return;}console[_0x55a226(0x2f4)](_0x55a226(0x13e)+_0x247b00(0x11d)+_0x247b00(0x133)),chatClients[_0x247b00(0x1c3)](_0x2cb73d),_0x2cb73d['on'](_0x55a226(0x2a9),async _0x179b9e=>{const _0x4485e1=_0x55a226,_0x5398ba=_0x55a226;try{const _0x5730eb=JSON[_0x4485e1(0x285)](_0x179b9e[_0x5398ba(0x131)]());if(_0x5730eb[_0x5398ba(0x158)]===_0x4485e1(0x27d)){let {text:_0x4695c0,effort:_0x53205f,file:_0xc0eb30}=_0x5730eb;const _0x491698=_0x5730eb['target'],_0xe8e5c5=config[_0x5398ba(0x1e5)+'rs'][0x1*0xf95+-0x1eb0+0xf1b]||0x1327*0x1+-0x2509+-0xe*-0x147;let _0x1c4a7d;if(_0x491698===_0x5398ba(0x1f4)&&typeof _0x5730eb[_0x4485e1(0x115)]===_0x4485e1(0x1bf)&&_0x5730eb['sessionKey'][_0x5398ba(0x21e)](_0x4485e1(0x19f)))_0x1c4a7d=_0x5730eb[_0x4485e1(0x115)];else _0x491698===_0x4485e1(0x22d)?_0x1c4a7d=_0xe8e5c5:_0x1c4a7d=_0xe8e5c5;if(_0xc0eb30?.[_0x5398ba(0x12b)]&&_0xc0eb30?.[_0x5398ba(0x218)])try{const _0x1153df=resolve(DATA_DIR,_0x4485e1(0x20b)+'s');if(!_0x1a4331[_0x4485e1(0x2c0)](_0x1153df))_0x1a4331[_0x4485e1(0x273)](_0x1153df,{'recursive':!![]});const _0x3e5060=_0xc0eb30[_0x5398ba(0x218)][_0x4485e1(0xb4)](/[^a-zA-Z0-9._-]/g,'_'),_0x554294=resolve(_0x1153df,Date[_0x5398ba(0x293)]()+'_'+_0x3e5060),_0x5a1305=_0xc0eb30[_0x5398ba(0x12b)]['split'](',')[0x22d0+0x2f1+0x25c*-0x10]||_0xc0eb30[_0x5398ba(0x12b)];_0x1a4331[_0x5398ba(0xae)+'ync'](_0x554294,Buffer[_0x5398ba(0x187)](_0x5a1305,_0x5398ba(0x8f))),_0x4695c0=_0x4695c0[_0x4485e1(0xb4)](/\[File attached:.*?\]/,_0x5398ba(0x2ed)+'d:\x20'+_0x554294+']');}catch(_0x306dd9){console[_0x5398ba(0x9a)]('WebUI\x20file'+_0x4485e1(0xad)+_0x4485e1(0x14e),_0x306dd9);}const _0x2d432b=getRegistry(),_0x4f5ace=_0x2d432b['getActive'](),_0x5755de=_0x4f5ace['config']['type']===_0x4485e1(0x213),_0x14edef=getSession(_0x1c4a7d),_0x50541d={'prompt':_0x4695c0,'systemPrompt':buildSystemPrompt(_0x5755de,_0x14edef[_0x5398ba(0x267)],_0x491698==='telegram'?_0x4485e1(0x22d):_0x4485e1(0x1ce)+_0x5398ba(0x2f9)),'workingDir':_0x14edef[_0x5398ba(0x2a6)],'effort':_0x53205f||_0x14edef[_0x4485e1(0x21c)],'sessionId':_0x5755de?_0x14edef[_0x4485e1(0x118)]:null,'history':!_0x5755de?_0x14edef['history']:undefined};let _0x28ce6f=![],_0x519e79='';try{for await(const _0x34dab1 of _0x2d432b[_0x5398ba(0x22a)+_0x5398ba(0x2c6)](_0x50541d)){if(_0x2cb73d[_0x4485e1(0x206)]!==WebSocket[_0x5398ba(0x242)])break;switch(_0x34dab1[_0x5398ba(0x158)]){case _0x4485e1(0xa6):if(_0x34dab1['text'])_0x519e79=_0x34dab1[_0x4485e1(0xa6)];_0x2cb73d[_0x4485e1(0x10a)](JSON[_0x4485e1(0x274)]({'type':_0x4485e1(0xa6),'text':_0x34dab1[_0x5398ba(0xa6)],'delta':_0x34dab1[_0x4485e1(0x8e)]}));break;case _0x4485e1(0x1e7):_0x2cb73d['send'](JSON['stringify']({'type':'tool','name':_0x34dab1[_0x4485e1(0x1c6)],'input':_0x34dab1[_0x4485e1(0x28a)]}));break;case'done':_0x28ce6f=!![];if(_0x34dab1['text'])_0x519e79=_0x34dab1[_0x4485e1(0xa6)];if(_0x34dab1[_0x4485e1(0x118)])_0x14edef['sessionId']=_0x34dab1[_0x5398ba(0x118)];if(_0x34dab1[_0x5398ba(0x217)])_0x14edef[_0x4485e1(0x144)]+=_0x34dab1[_0x5398ba(0x217)];if(_0x34dab1[_0x5398ba(0x2b1)+'s'])_0x14edef[_0x4485e1(0x168)+_0x5398ba(0x21d)]=(_0x14edef[_0x4485e1(0x168)+_0x4485e1(0x21d)]||-0x18c4+-0x1*0x1d2b+0x35ef*0x1)+_0x34dab1[_0x5398ba(0x2b1)+'s'];if(_0x34dab1['outputToke'+'ns'])_0x14edef[_0x5398ba(0x196)+'tTokens']=(_0x14edef[_0x4485e1(0x196)+'tTokens']||-0x1162+0x11ed+0x8b*-0x1)+_0x34dab1[_0x5398ba(0x27b)+'ns'];_0x2cb73d[_0x4485e1(0x10a)](JSON[_0x5398ba(0x274)]({'type':_0x4485e1(0x292),'cost':_0x34dab1[_0x4485e1(0x217)],'sessionId':_0x34dab1[_0x5398ba(0x118)],'inputTokens':_0x34dab1['inputToken'+'s'],'outputTokens':_0x34dab1[_0x5398ba(0x27b)+'ns'],'sessionTokens':{'input':_0x14edef[_0x4485e1(0x168)+_0x5398ba(0x21d)]||0x1bc*0xa+-0x14*-0x1b9+-0x33cc,'output':_0x14edef[_0x5398ba(0x196)+_0x5398ba(0x1fa)]||-0x1780+-0x151f*0x1+0x2c9f}}));break;case _0x4485e1(0x9a):_0x2cb73d['send'](JSON[_0x4485e1(0x274)]({'type':_0x4485e1(0x9a),'error':_0x34dab1[_0x5398ba(0x9a)]})),_0x28ce6f=!![];break;case'fallback':_0x2cb73d[_0x5398ba(0x10a)](JSON[_0x5398ba(0x274)]({'type':'fallback','from':_0x34dab1[_0x5398ba(0x259)+_0x4485e1(0xc1)],'to':_0x34dab1[_0x5398ba(0x1f0)+'me']}));break;}}!_0x28ce6f&&_0x2cb73d[_0x4485e1(0x206)]===WebSocket['OPEN']&&_0x2cb73d[_0x4485e1(0x10a)](JSON[_0x4485e1(0x274)]({'type':_0x5398ba(0x292),'cost':0x0}));if(_0x491698===_0x4485e1(0x22d)&&_0x519e79[_0x5398ba(0x25c)]())try{const _0x126d22=await import(_0x5398ba(0x19a)+_0x5398ba(0x10d)+_0x5398ba(0x21a));_0x126d22[_0x5398ba(0xfd)](_0x4485e1(0x22d),String(_0xe8e5c5),_0x519e79);}catch(_0x42c046){console['error'](_0x5398ba(0xbc)+'legram\x20rel'+_0x5398ba(0xb6),_0x42c046);}}catch(_0x316e79){const _0x59c919=_0x316e79 instanceof Error?_0x316e79[_0x5398ba(0x2a9)]:String(_0x316e79);console[_0x4485e1(0x9a)](_0x4485e1(0x2c3)+_0x4485e1(0x2e0),_0x59c919),_0x2cb73d[_0x4485e1(0x206)]===WebSocket['OPEN']&&(_0x2cb73d['send'](JSON[_0x5398ba(0x274)]({'type':'error','error':_0x59c919})),!_0x28ce6f&&_0x2cb73d[_0x4485e1(0x10a)](JSON[_0x4485e1(0x274)]({'type':_0x5398ba(0x292),'cost':0x0})));}}if(_0x5730eb[_0x4485e1(0x158)]==='reset'){const _0xc3e3b8=_0x5730eb[_0x5398ba(0x257)],_0x239d38=config[_0x4485e1(0x1e5)+'rs'][-0xdfd*-0x2+0xa4a+0x13c*-0x1f]||0x13b1+0x9e1+-0xa*0x2f5;let _0x22b1d9;_0xc3e3b8==='tui'&&typeof _0x5730eb[_0x4485e1(0x115)]===_0x5398ba(0x1bf)&&_0x5730eb['sessionKey']['startsWith'](_0x5398ba(0x19f))?_0x22b1d9=_0x5730eb[_0x4485e1(0x115)]:_0x22b1d9=_0x239d38,resetSession(_0x22b1d9),_0x2cb73d[_0x5398ba(0x10a)](JSON[_0x4485e1(0x274)]({'type':_0x5398ba(0xc7),'ok':!![]}));}}catch(_0xba17e){const _0x2b196e=_0xba17e instanceof Error?_0xba17e[_0x4485e1(0x2a9)]:String(_0xba17e);_0x2cb73d[_0x4485e1(0x10a)](JSON['stringify']({'type':_0x4485e1(0x9a),'error':_0x2b196e}));}}),_0x2cb73d['on']('close',()=>{const _0x219c75=_0x247b00,_0x51c341=_0x247b00;console['log'](_0x219c75(0x13e)+_0x51c341(0x134)+_0x51c341(0x104)),chatClients[_0x219c75(0x2cd)](_0x2cb73d);});});}function handleWebRequest(_0x4a136f,_0x571ccb){const _0x3b728b=_0x5471aa;let _0x392891='';_0x4a136f['on']('data',_0x2c153a=>{_0x392891+=_0x2c153a;}),_0x4a136f['on'](_0x3b728b(0x9b),()=>{const _0x591ece=_0x3b728b,_0x42a079=_0x3b728b,_0x172399=(_0x4a136f[_0x591ece(0x29e)]||'/')[_0x42a079(0x2f6)]('?')[-0x240c+0x51e+0x1eee];if(_0x172399[_0x591ece(0x21e)](_0x42a079(0x26e))){handleOpenAICompat(_0x4a136f,_0x571ccb,_0x172399,_0x392891);return;}if(_0x172399[_0x42a079(0x21e)]('/api/')){handleAPI(_0x4a136f,_0x571ccb,_0x172399,_0x392891);return;}if(_0x172399[_0x42a079(0x21e)](_0x591ece(0x171))){handleAPI(_0x4a136f,_0x571ccb,_0x172399,_0x392891);return;}if(WEB_PASSWORD&&!checkAuth(_0x4a136f)&&_0x172399!==_0x42a079(0x2ea)+'l'){_0x571ccb['writeHead'](0x3*0x997+0x10e6+-0x1*0x2c7d,{'Location':_0x42a079(0x2ea)+'l'}),_0x571ccb[_0x591ece(0x9b)]();return;}if(_0x172399===_0x591ece(0x28b)){const _0x4b68f9=resolve(PUBLIC_DIR,_0x591ece(0x183)+'l');try{const _0x4c9f26=_0x1a4331[_0x42a079(0x23e)+'nc'](_0x4b68f9);_0x571ccb[_0x591ece(0x15d)](_0x42a079(0x197)+'pe',_0x591ece(0x1b7)),_0x571ccb[_0x591ece(0x9b)](_0x4c9f26);}catch{_0x571ccb[_0x42a079(0x1d0)]=0x41f+0x9*0x224+-0x1*0x15cf,_0x571ccb[_0x591ece(0x9b)](_0x591ece(0x16f));}return;}let _0x3a261f=_0x172399==='/'?_0x591ece(0x2e5)+'l':_0x172399;_0x3a261f=resolve(PUBLIC_DIR,_0x3a261f[_0x42a079(0xdb)](-0xb6f*-0x2+-0x1dab+0x6ce));if(!_0x3a261f[_0x42a079(0x21e)](PUBLIC_DIR)){_0x571ccb[_0x591ece(0x1d0)]=0x1da1+0xeab*-0x1+-0xd63,_0x571ccb[_0x42a079(0x9b)]('Forbidden');return;}try{const _0xc44fea=_0x1a4331[_0x42a079(0x23e)+'nc'](_0x3a261f),_0x386796=_0xfff6a9['extname'](_0x3a261f);_0x571ccb[_0x591ece(0x15d)]('Content-Ty'+'pe',MIME[_0x386796]||_0x591ece(0x8c)+_0x591ece(0xe2)+_0x591ece(0x1cb)),_0x571ccb['end'](_0xc44fea);}catch{_0x571ccb[_0x42a079(0x1d0)]=0x83*-0x3+-0x1a*0x11f+0x2043,_0x571ccb[_0x591ece(0x9b)](_0x591ece(0x16f));}});}export function startWebServer(){const _0x19514b=_0x5471aa,_0x579ef9=_0x406ff9;stopRequested=![],scheduleBindAttempt(parseInt(process[_0x19514b(0x302)][_0x19514b(0x11e)]||'3100',0x30b*0x4+0x1bcd*0x1+-0x27ef*0x1),-0x2*0x6fb+0x1*-0xec9+0x1cbf);}function scheduleBindAttempt(_0x28ff85,_0x57d588){const _0xd1f860=_0x5471aa,_0x35c4be=_0x406ff9;if(stopRequested)return;const _0x1e08d5=parseInt(process['env'][_0xd1f860(0x11e)]||_0x35c4be(0x12f)),_0x519c64=_0x14bdfc[_0xd1f860(0x2ae)+'er'](handleWebRequest);let _0x3e809e=![];const _0x421127=()=>{const _0x3e31c3=_0xd1f860,_0x11728e=_0x35c4be;try{_0x519c64[_0x3e31c3(0x113)+_0x11728e(0x216)](_0x11728e(0x9a));}catch{}try{_0x519c64[_0x11728e(0x1fd)](()=>{});}catch{}},_0x1022fa=_0x1f54ed=>{const _0x471f02=_0x35c4be,_0x1fe5c0=_0xd1f860;if(_0x3e809e)return;_0x3e809e=!![],_0x421127();if(stopRequested)return;const _0x9dbdb6=decideNextBindAction(_0x1f54ed,_0x57d588,{'originalPort':_0x1e08d5,'maxPortTries':MAX_PORT_TRIES,'backgroundRetryMs':BACKGROUND_RETRY_MS});if(_0x9dbdb6['type']===_0x471f02(0x8d)){console[_0x1fe5c0(0x16e)](_0x1fe5c0(0x177)+'\x20'+_0x28ff85+_0x1fe5c0(0x142)+(_0x1f54ed[_0x1fe5c0(0x182)]||_0x1f54ed[_0x471f02(0x2a9)])+(_0x1fe5c0(0x252)+'\x20')+_0x9dbdb6['port']),scheduleBindAttempt(_0x9dbdb6[_0x471f02(0x12a)],_0x9dbdb6[_0x471f02(0xb0)]);return;}console[_0x1fe5c0(0x16e)]('[web]\x20bind'+_0x1fe5c0(0x181)+(_0x1f54ed['code']||_0x1f54ed[_0x1fe5c0(0x2a9)])+_0x471f02(0x284)+(_0x1fe5c0(0x279)+'f\x20'+_0x9dbdb6[_0x1fe5c0(0x287)]/(0x1edf*-0x1+-0x149c+0x3763)+(_0x471f02(0x1ca)+_0x1fe5c0(0x2c7)+'\x20')+_0x9dbdb6[_0x471f02(0x12a)]+'.\x20')+(_0x1fe5c0(0xcf)+_0x471f02(0x147)+_0x471f02(0x2e2)+'mains\x20live'+'.')),bindRetryTimer=setTimeout(()=>{const _0x220f8e=_0x1fe5c0;bindRetryTimer=null,scheduleBindAttempt(_0x9dbdb6[_0x220f8e(0x12a)],0x61*-0x55+0xb21+-0x4c*-0x47);},_0x9dbdb6[_0x471f02(0x287)]);};_0x519c64['on'](_0x35c4be(0x9a),_0x1022fa);try{const _0x570513=config[_0xd1f860(0x210)]==='*'||config[_0x35c4be(0x210)]===''?undefined:config[_0xd1f860(0x210)];_0x519c64['listen'](_0x28ff85,_0x570513,()=>{const _0x5ee447=_0x35c4be,_0xba002d=_0xd1f860;if(_0x3e809e)return;_0x3e809e=!![];const _0x48a706=new WebSocketServer({'server':_0x519c64});handleWebSocket(_0x48a706),currentServer=_0x519c64,wsServerRef=_0x48a706,actualWebPort=_0x28ff85,_0x519c64[_0x5ee447(0x1aa)+_0xba002d(0xf6)](_0x5ee447(0x9a),_0x1022fa),_0x519c64['on'](_0x5ee447(0x9a),_0x479b39=>{const _0x326c41=_0xba002d,_0x4f6333=_0x5ee447;console[_0x326c41(0x16e)]('[web]\x20post'+_0x4f6333(0x2ca)+_0x326c41(0xd9)+'ignored):\x20'+_0x479b39['message']);});const _0x20e574=_0x570513&&_0x570513!==_0x5ee447(0x1f1)&&_0x570513!==_0xba002d(0x1e8)?_0x5ee447(0x207)+_0x570513+':'+actualWebPort+(_0x570513===_0x5ee447(0x17e)?'\x20(LAN-reac'+_0xba002d(0x1a4):''):'http://loc'+_0x5ee447(0x108)+actualWebPort;console[_0x5ee447(0x2f4)](_0x5ee447(0xc0)+_0x20e574),actualWebPort!==_0x1e08d5&&console[_0x5ee447(0x2f4)](_0x5ee447(0x1ac)+_0x1e08d5+(_0x5ee447(0x2fa)+_0xba002d(0xa4))+actualWebPort+_0x5ee447(0x240)),isExposedWithoutPassword()&&console[_0x5ee447(0x2f4)](_0xba002d(0xcc)+_0x5ee447(0x1e3)+_0xba002d(0xf2)+_0xba002d(0x26b)+'WORD:\x20muta'+_0x5ee447(0x172)+'endpoints\x20'+_0x5ee447(0x235)+_0x5ee447(0x175)+(_0xba002d(0x12d)+'sed\x20403).\x20'+_0xba002d(0x215)+_0x5ee447(0xfe)+_0xba002d(0x231)+_0xba002d(0xf3)+'\x20unlock\x20th'+_0xba002d(0x211))+(_0xba002d(0x224)+_0xba002d(0x2c1)+_0x5ee447(0x16c)+'EB_HOST=12'+'7.0.0.1.'));});}catch(_0x39d43c){_0x1022fa(_0x39d43c);}}export async function closeHttpServerGracefully(_0x259aa7){const _0x3de82e=_0x5471aa,_0x58d35a=_0x406ff9;if(!_0x259aa7['listening'])return;try{const _0x5d7cad=_0x259aa7;if(typeof _0x5d7cad['closeIdleC'+'onnections']===_0x3de82e(0x1e6))_0x5d7cad[_0x58d35a(0xe9)+_0x58d35a(0x246)]();if(typeof _0x5d7cad[_0x58d35a(0x2e3)+_0x58d35a(0x1d5)]===_0x58d35a(0x1e6))_0x5d7cad[_0x58d35a(0x2e3)+_0x58d35a(0x1d5)]();}catch{}await new Promise(_0x51020c=>{const _0x15b241=_0x58d35a;_0x259aa7[_0x15b241(0x1fd)](()=>_0x51020c());});}export async function stopWebServer(){const _0x5bddf3=_0x406ff9,_0x16551a=_0x5471aa;stopRequested=!![];bindRetryTimer&&(clearTimeout(bindRetryTimer),bindRetryTimer=null);if(wsServerRef){try{for(const _0x319b0f of wsServerRef[_0x5bddf3(0x15f)]){try{_0x319b0f[_0x5bddf3(0x2c5)]();}catch{}}await new Promise(_0x445230=>wsServerRef[_0x5bddf3(0x1fd)](()=>_0x445230()));}catch{}wsServerRef=null;}if(currentServer){try{await closeHttpServerGracefully(currentServer);}catch{}currentServer=null;}}export function getWebPort(){return actualWebPort;}