brain0 0.1.0

package/vendor/server/server.js

@@ -0,0 +1,1907 @@
+// packages/server/dist/server.js
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile as readFile2 } from "node:fs/promises";
+import { createServer } from "node:http";
+import { resolve as resolve2 } from "node:path";
+
+// packages/server/dist/askcache.js
+function normalizeQuery(q) {
+  return q.trim().toLowerCase().replace(/\s+/g, " ");
+}
+var BoundedCache = class {
+  max;
+  map = /* @__PURE__ */ new Map();
+  constructor(max = 100) {
+    this.max = max;
+  }
+  get(key) {
+    return this.map.get(key);
+  }
+  set(key, value) {
+    if (this.map.has(key))
+      this.map.delete(key);
+    this.map.set(key, value);
+    if (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest !== void 0)
+        this.map.delete(oldest);
+    }
+  }
+  get size() {
+    return this.map.size;
+  }
+};
+
+// packages/server/dist/staticfiles.js
+import { normalize, resolve, sep } from "node:path";
+var CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".json": "application/json",
+  ".map": "application/json",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8"
+};
+function contentTypeFor(path) {
+  const dot = path.lastIndexOf(".");
+  const ext = dot === -1 ? "" : path.slice(dot).toLowerCase();
+  return CONTENT_TYPES[ext] ?? "application/octet-stream";
+}
+function safeJoin(root, urlPathname) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(urlPathname);
+  } catch {
+    return void 0;
+  }
+  if (decoded.includes("\0"))
+    return void 0;
+  if (decoded.split("/").some((seg) => seg === ".."))
+    return void 0;
+  const rootAbs = resolve(root);
+  const joined = resolve(rootAbs, "." + normalize("/" + decoded));
+  return joined === rootAbs || joined.startsWith(rootAbs + sep) ? joined : void 0;
+}
+function cacheControlFor(urlPathname) {
+  return urlPathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache";
+}
+
+// packages/shared/dist/risk.js
+var LOW = 0.34;
+var HIGH = 0.66;
+var APOSTERIORI_EVIDENCE = 0.05;
+function clampUnit(value) {
+  return Math.max(0, Math.min(1, value));
+}
+function fusedScore(risk) {
+  const a = clampUnit(risk.apriori);
+  const p = clampUnit(risk.aposteriori);
+  return 1 - (1 - a) * (1 - p);
+}
+function riskTransition(risk) {
+  const a = clampUnit(risk.apriori);
+  const p = clampUnit(risk.aposteriori);
+  if (p < APOSTERIORI_EVIDENCE)
+    return "pending";
+  const lookedSafe = a < LOW;
+  const lookedRisky = a >= HIGH;
+  const provedDangerous = p >= HIGH;
+  const provedSafe = p < LOW;
+  if (lookedSafe && provedDangerous)
+    return "safe_to_dangerous";
+  if (lookedRisky && provedDangerous)
+    return "confirmed_dangerous";
+  if (lookedRisky && provedSafe)
+    return "overestimated_risk";
+  if (lookedSafe && provedSafe)
+    return "stable";
+  return provedDangerous ? "confirmed_dangerous" : "stable";
+}
+function hslToRgb(hDeg, s, l) {
+  const c = (1 - Math.abs(2 * l - 1)) * s;
+  const h = hDeg / 60;
+  const x = c * (1 - Math.abs(h % 2 - 1));
+  let r1 = 0;
+  let g1 = 0;
+  let b1 = 0;
+  const sextant = Math.floor(h);
+  if (sextant === 0)
+    [r1, g1, b1] = [c, x, 0];
+  else if (sextant === 1)
+    [r1, g1, b1] = [x, c, 0];
+  else if (sextant === 2)
+    [r1, g1, b1] = [0, c, x];
+  else if (sextant === 3)
+    [r1, g1, b1] = [0, x, c];
+  else if (sextant === 4)
+    [r1, g1, b1] = [x, 0, c];
+  else
+    [r1, g1, b1] = [c, 0, x];
+  const m = l - c / 2;
+  return {
+    r: Math.round((r1 + m) * 255),
+    g: Math.round((g1 + m) * 255),
+    b: Math.round((b1 + m) * 255)
+  };
+}
+function hueSweepRgb(t) {
+  const clamped = clampUnit(t);
+  return hslToRgb(120 * (1 - clamped), 1, 0.5);
+}
+function toHex({ r, g, b }) {
+  const h = (n) => n.toString(16).padStart(2, "0");
+  return `#${h(r)}${h(g)}${h(b)}`;
+}
+function riskColor(risk) {
+  const fused = fusedScore(risk);
+  const rgb = hueSweepRgb(fused);
+  return { fused, rgb, hex: toHex(rgb), transition: riskTransition(risk) };
+}
+function isGoldSignal(risk) {
+  return riskTransition(risk) === "safe_to_dangerous";
+}
+
+// packages/shared/dist/payload.js
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+var REF_SCHEME = "blake3:";
+var FsPayloadReader = class {
+  root;
+  constructor(root) {
+    this.root = root;
+  }
+  pathFor(ref) {
+    const hex = ref.startsWith(REF_SCHEME) ? ref.slice(REF_SCHEME.length) : ref;
+    const shard = hex.slice(0, 2);
+    const rest = hex.slice(2);
+    return join(this.root, shard, `${rest}.blob`);
+  }
+  /** Fetch a payload as text, or `undefined` if it is not present. */
+  async getText(ref) {
+    try {
+      return await readFile(this.pathFor(ref), "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT")
+        return void 0;
+      throw err;
+    }
+  }
+};
+
+// packages/shared/dist/graph.js
+var LEVELS = ["repo", "module", "file", "symbol"];
+function buildGraphSnapshot(store2, repo2) {
+  const nodes = [];
+  const edges = [];
+  const edgeKeys = /* @__PURE__ */ new Set();
+  const commitTaskIds = /* @__PURE__ */ new Set();
+  const taskCache = /* @__PURE__ */ new Map();
+  const getTask = (id) => {
+    if (!taskCache.has(id))
+      taskCache.set(id, store2.getTask(id));
+    return taskCache.get(id);
+  };
+  const isCommitTask = (task) => task.sourceAdapter === void 0;
+  const pushEdge = (edge) => {
+    const key = `${edge.kind}|${edge.src}|${edge.dst}`;
+    if (!edgeKeys.has(key)) {
+      edgeKeys.add(key);
+      edges.push(edge);
+    }
+  };
+  for (const level of LEVELS) {
+    for (const artifact of store2.listArtifacts(repo2, level)) {
+      nodes.push({
+        id: artifact.id,
+        kind: "artifact",
+        level: artifact.level,
+        label: artifact.qualifiedPath,
+        risk: artifact.risk,
+        colorHex: riskColor(artifact.risk).hex
+      });
+      for (const edge of store2.outEdges("artifact_contains", artifact.id)) {
+        pushEdge({
+          kind: "artifact_contains",
+          src: String(edge.parent ?? ""),
+          dst: String(edge.child ?? "")
+        });
+      }
+      for (const edge of store2.inEdges("task_modifies_artifact", artifact.id)) {
+        const taskId = String(edge.task ?? "");
+        if (!taskId)
+          continue;
+        const task = getTask(taskId);
+        if (!task || !isCommitTask(task))
+          continue;
+        commitTaskIds.add(taskId);
+        pushEdge({ kind: "task_modifies_artifact", src: taskId, dst: artifact.id });
+      }
+    }
+  }
+  for (const taskId of commitTaskIds) {
+    const task = getTask(taskId);
+    if (task) {
+      nodes.push({
+        id: taskId,
+        kind: "task",
+        label: taskId,
+        ref: task.sessionId,
+        // observer/commit tasks carry the git commit SHA as their session id
+        timestamp: task.createdAt,
+        author: task.author.name,
+        agent: task.agent.name
+      });
+    }
+  }
+  return { repo: repo2, nodes, edges };
+}
+
+// packages/shared/dist/detail.js
+function readablePayload(text) {
+  if (text === void 0)
+    return void 0;
+  let bad = 0;
+  for (const ch of text) {
+    const c = ch.codePointAt(0) ?? 0;
+    if (c === 65533 || c < 9 || c > 126 && c < 160)
+      bad++;
+  }
+  return bad / Math.max(text.length, 1) > 0.1 ? void 0 : text;
+}
+async function buildNodeDetail(store2, getText2, id) {
+  const artifact = store2.getArtifact(id);
+  if (artifact) {
+    const parent = artifact.parentId ? store2.getArtifact(artifact.parentId) : void 0;
+    const parentDiffByRef = /* @__PURE__ */ new Map();
+    let parentLatestDiff;
+    if (parent) {
+      for (const pv of store2.artifactVersions(parent.id)) {
+        if (pv.diffRef) {
+          parentDiffByRef.set(pv.source.ref, pv.diffRef);
+          parentLatestDiff = pv.diffRef;
+        }
+      }
+    }
+    const versions = store2.artifactVersions(id).map((v) => {
+      let diffRef = v.diffRef;
+      let diffOfPath;
+      if (!diffRef && parent) {
+        diffRef = parentDiffByRef.get(v.source.ref) ?? parentLatestDiff;
+        if (diffRef)
+          diffOfPath = parent.qualifiedPath;
+      }
+      return {
+        timestamp: v.timestamp,
+        committer: v.author?.name,
+        changeKind: v.changeKind,
+        linesAdded: v.linesAdded,
+        linesRemoved: v.linesRemoved,
+        source: `${v.source.kind}:${v.source.ref.slice(0, 10)}`,
+        diffRef,
+        diffOfPath
+      };
+    });
+    const intents = [];
+    for (const edge of store2.inEdges("task_modifies_artifact", id)) {
+      const taskId = String(edge.task ?? "");
+      const task2 = taskId ? store2.getTask(taskId) : void 0;
+      if (task2 && task2.sourceAdapter !== void 0) {
+        intents.push({
+          taskId,
+          agent: task2.agent?.name ?? "",
+          author: task2.author?.name ?? "",
+          when: task2.createdAt
+        });
+      }
+    }
+    return {
+      id,
+      kind: "artifact",
+      label: artifact.qualifiedPath,
+      level: artifact.level,
+      risk: artifact.risk,
+      path: artifact.qualifiedPath,
+      childCount: store2.children(id).length,
+      intents,
+      versions
+    };
+  }
+  const task = store2.getTask(id);
+  if (task) {
+    if (task.sourceAdapter === void 0) {
+      let encrypted2 = false;
+      let message;
+      for (const v of store2.taskVersions(id)) {
+        if (!v.decisionSummaryRef)
+          continue;
+        const raw = await getText2(v.decisionSummaryRef);
+        const text = readablePayload(raw);
+        if (text)
+          message = text;
+        else if (raw !== void 0)
+          encrypted2 = true;
+      }
+      const changedFiles = [];
+      const touched = /* @__PURE__ */ new Set();
+      const touchedVersions = /* @__PURE__ */ new Set();
+      for (const edge of store2.outEdges("task_modifies_artifact", id)) {
+        const artifactId = String(edge.artifact ?? "");
+        if (!artifactId)
+          continue;
+        touched.add(artifactId);
+        const versionId = String(edge.version ?? "");
+        if (versionId)
+          touchedVersions.add(versionId);
+        const art = store2.getArtifact(artifactId);
+        if (!art || art.level !== "file")
+          continue;
+        const avs = store2.artifactVersions(artifactId);
+        const v = avs.find((x) => x.id === versionId) ?? avs[avs.length - 1];
+        changedFiles.push({
+          artifactId,
+          path: art.qualifiedPath,
+          changeKind: v?.changeKind,
+          linesAdded: v?.linesAdded,
+          linesRemoved: v?.linesRemoved,
+          diffRef: v?.diffRef
+        });
+      }
+      changedFiles.sort((a, b) => a.path.localeCompare(b.path));
+      const promptIds = /* @__PURE__ */ new Set();
+      for (const artifactId of touched) {
+        for (const edge of store2.inEdges("task_modifies_artifact", artifactId)) {
+          const other = String(edge.task ?? "");
+          const ev = String(edge.version ?? "");
+          if (other && other !== id && ev && touchedVersions.has(ev))
+            promptIds.add(other);
+        }
+      }
+      const prompts = [];
+      const readsSet = /* @__PURE__ */ new Set();
+      const secretKinds = /* @__PURE__ */ new Map();
+      for (const promptId of promptIds) {
+        const t = store2.getTask(promptId);
+        if (!t || t.sourceAdapter === void 0)
+          continue;
+        let summary;
+        for (const v of store2.taskVersions(promptId)) {
+          for (const r of v.reads ?? [])
+            readsSet.add(r);
+          for (const rs of v.readSecrets ?? []) {
+            const set = secretKinds.get(rs.path) ?? /* @__PURE__ */ new Set();
+            for (const k of rs.kinds)
+              set.add(k);
+            secretKinds.set(rs.path, set);
+          }
+          if (v.decisionSummaryRef) {
+            const text = readablePayload(await getText2(v.decisionSummaryRef));
+            if (text)
+              summary = text;
+          }
+        }
+        prompts.push({
+          taskId: promptId,
+          summary,
+          agent: t.agent?.name ?? "",
+          author: t.author?.name ?? "",
+          when: t.createdAt
+        });
+      }
+      prompts.sort((a, b) => a.when.localeCompare(b.when));
+      const reads = [...readsSet].sort();
+      const readSecrets = [...secretKinds.entries()].map(([path, kinds]) => ({ path, kinds: [...kinds].sort() })).sort((a, b) => a.path.localeCompare(b.path));
+      return {
+        id,
+        kind: "commit",
+        label: id,
+        agent: task.agent?.name,
+        author: task.author?.name,
+        createdAt: task.createdAt,
+        message,
+        source: `git:${task.sessionId.slice(0, 10)}`,
+        changedFiles,
+        prompts,
+        reads,
+        readSecrets,
+        versions: [],
+        note: encrypted2 ? "payload encrypted \u2014 re-run observe with --no-encrypt-payload to preview the message" : void 0
+      };
+    }
+    let encrypted = false;
+    const versions = [];
+    for (const v of store2.taskVersions(id)) {
+      let summary;
+      if (v.decisionSummaryRef) {
+        const raw = await getText2(v.decisionSummaryRef);
+        summary = readablePayload(raw);
+        if (raw !== void 0 && summary === void 0)
+          encrypted = true;
+      }
+      versions.push({
+        timestamp: v.timestamp,
+        declared: v.declared.map((d) => d.path),
+        driftUndeclared: v.drift?.undeclared,
+        driftPhantom: v.drift?.phantom,
+        summary
+      });
+    }
+    return {
+      id,
+      kind: "task",
+      label: id,
+      agent: task.agent?.name,
+      author: task.author?.name,
+      createdAt: task.createdAt,
+      versions,
+      note: encrypted ? "payload encrypted \u2014 re-run observe with --no-encrypt-payload to preview summaries" : void 0
+    };
+  }
+  return void 0;
+}
+
+// packages/shared/dist/store.js
+import { DatabaseSync } from "node:sqlite";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+var ARTIFACT_COLS = "id, level, repo, qualified_path, lang, parent_id, current_version, risk_apriori, risk_aposteriori";
+var TASK_COLS = "id, session_id, agent_name, agent_version, author_name, author_email, created_at, current_version, source_adapter, session_cwd";
+var AV_COLS = "id, artifact_id, timestamp, author_name, author_email, agent_name, agent_version, source_kind, source_ref, qualified_path, fingerprint, change_kind, change_from, lines_added, lines_removed, diff_ref";
+var TV_COLS = "id, task_id, timestamp, prompt_ref, decision_summary_ref, declared_json, drift_json, reads_json, read_secrets_json";
+function str(value) {
+  return value == null ? "" : String(value);
+}
+function optStr(value) {
+  return value == null ? void 0 : String(value);
+}
+function num(value) {
+  return typeof value === "number" ? value : Number(value ?? 0);
+}
+function encodeVector(vector) {
+  const buf = new Uint8Array(vector.length * 4);
+  const view = new DataView(buf.buffer);
+  vector.forEach((v, i) => view.setFloat32(i * 4, v, true));
+  return buf;
+}
+function decodeVector(bytes) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const out = [];
+  for (let i = 0; i + 4 <= bytes.byteLength; i += 4)
+    out.push(view.getFloat32(i, true));
+  return out;
+}
+function cosine(a, b) {
+  if (a.length !== b.length)
+    return 0;
+  let dot = 0;
+  let na = 0;
+  let nb = 0;
+  for (let i = 0; i < a.length; i++) {
+    const x = a[i] ?? 0;
+    const y = b[i] ?? 0;
+    dot += x * y;
+    na += x * x;
+    nb += y * y;
+  }
+  if (na === 0 || nb === 0)
+    return 0;
+  return dot / (Math.sqrt(na) * Math.sqrt(nb));
+}
+function mapArtifact(row) {
+  return {
+    id: str(row.id),
+    level: str(row.level),
+    repo: str(row.repo),
+    qualifiedPath: str(row.qualified_path),
+    lang: optStr(row.lang),
+    parentId: optStr(row.parent_id),
+    currentVersion: str(row.current_version),
+    risk: { apriori: num(row.risk_apriori), aposteriori: num(row.risk_aposteriori) }
+  };
+}
+function mapTask(row) {
+  return {
+    id: str(row.id),
+    sessionId: str(row.session_id),
+    agent: { name: str(row.agent_name), version: optStr(row.agent_version) },
+    author: { name: str(row.author_name), email: optStr(row.author_email) },
+    createdAt: str(row.created_at),
+    currentVersion: str(row.current_version),
+    sourceAdapter: optStr(row.source_adapter),
+    sessionCwd: optStr(row.session_cwd)
+  };
+}
+function mapArtifactVersion(row) {
+  const source = {
+    kind: str(row.source_kind) === "git" ? "git" : "checkpoint",
+    ref: str(row.source_ref)
+  };
+  return {
+    id: str(row.id),
+    artifactId: str(row.artifact_id),
+    timestamp: str(row.timestamp),
+    author: { name: str(row.author_name), email: optStr(row.author_email) },
+    agent: { name: str(row.agent_name), version: optStr(row.agent_version) },
+    source,
+    qualifiedPath: str(row.qualified_path),
+    fingerprint: str(row.fingerprint),
+    changeKind: str(row.change_kind),
+    changeFrom: optStr(row.change_from),
+    linesAdded: num(row.lines_added),
+    linesRemoved: num(row.lines_removed),
+    diffRef: optStr(row.diff_ref)
+  };
+}
+function mapTaskVersion(row) {
+  return {
+    id: str(row.id),
+    taskId: str(row.task_id),
+    timestamp: str(row.timestamp),
+    promptRef: optStr(row.prompt_ref),
+    decisionSummaryRef: optStr(row.decision_summary_ref),
+    declared: row.declared_json ? JSON.parse(str(row.declared_json)) : [],
+    drift: row.drift_json ? JSON.parse(str(row.drift_json)) : void 0,
+    reads: row.reads_json ? JSON.parse(str(row.reads_json)) : [],
+    readSecrets: row.read_secrets_json ? JSON.parse(str(row.read_secrets_json)) : []
+  };
+}
+function schemaPath() {
+  return fileURLToPath(new URL("../../../schema/sqlite.sql", import.meta.url));
+}
+var Brain0Store = class {
+  db;
+  constructor(dbPath) {
+    this.db = new DatabaseSync(dbPath);
+    this.db.exec("PRAGMA busy_timeout=5000");
+  }
+  /** Apply the shared schema (idempotent) — mainly for tests; the core normally migrates. */
+  migrate() {
+    this.db.exec(readFileSync(schemaPath(), "utf8"));
+  }
+  /** Direct access to the underlying connection (e.g. to seed test data). */
+  raw() {
+    return this.db;
+  }
+  close() {
+    this.db.close();
+  }
+  getTask(id) {
+    const row = this.db.prepare(`SELECT ${TASK_COLS} FROM task_nodes WHERE id=?`).get(id);
+    return row ? mapTask(row) : void 0;
+  }
+  /** Commit task ids whose git SHA (stored as `session_id`) starts with `prefix` — for resolving
+   *  an explicit commit referenced by SHA in a query. Commit tasks have no source adapter. */
+  commitTaskIdsByShaPrefix(prefix) {
+    const rows = this.db.prepare("SELECT id FROM task_nodes WHERE source_adapter IS NULL AND session_id LIKE ? ORDER BY created_at").all(`${prefix}%`);
+    return rows.map((r) => str(r.id));
+  }
+  taskVersions(taskId) {
+    const rows = this.db.prepare(`SELECT ${TV_COLS} FROM task_versions WHERE task_id=? ORDER BY timestamp, id`).all(taskId);
+    return rows.map(mapTaskVersion);
+  }
+  getArtifact(id) {
+    const row = this.db.prepare(`SELECT ${ARTIFACT_COLS} FROM artifact_nodes WHERE id=?`).get(id);
+    return row ? mapArtifact(row) : void 0;
+  }
+  /** All artifacts in a repo at a given level (e.g. all symbols), for audit/aggregation. */
+  listArtifacts(repo2, level) {
+    const rows = this.db.prepare(`SELECT ${ARTIFACT_COLS} FROM artifact_nodes WHERE repo=? AND level=? ORDER BY qualified_path`).all(repo2, level);
+    return rows.map(mapArtifact);
+  }
+  children(parentId) {
+    const rows = this.db.prepare(`SELECT ${ARTIFACT_COLS} FROM artifact_nodes WHERE parent_id=? ORDER BY qualified_path`).all(parentId);
+    return rows.map(mapArtifact);
+  }
+  /** Version chain for an artifact, oldest first (the timeline axis). */
+  artifactVersions(artifactId) {
+    const rows = this.db.prepare(`SELECT ${AV_COLS} FROM artifact_versions WHERE artifact_id=? ORDER BY timestamp, id`).all(artifactId);
+    return rows.map(mapArtifactVersion);
+  }
+  outEdges(kind, src) {
+    const rows = this.db.prepare("SELECT attrs_json FROM edges WHERE kind=? AND src=?").all(kind, src);
+    return rows.map((r) => JSON.parse(str(r.attrs_json)));
+  }
+  inEdges(kind, dst) {
+    const rows = this.db.prepare("SELECT attrs_json FROM edges WHERE kind=? AND dst=?").all(kind, dst);
+    return rows.map((r) => JSON.parse(str(r.attrs_json)));
+  }
+  /** Task ids that have no embedding yet (the indexer's work-list). */
+  tasksMissingEmbeddings() {
+    const rows = this.db.prepare("SELECT t.id FROM task_nodes t LEFT JOIN task_embeddings e ON e.task_id=t.id WHERE e.task_id IS NULL").all();
+    return rows.map((r) => str(r.id));
+  }
+  putTaskEmbedding(taskId, vector) {
+    this.db.prepare("INSERT OR REPLACE INTO task_embeddings (task_id, dim, vec) VALUES (?,?,?)").run(taskId, vector.length, encodeVector(vector));
+  }
+  /** Top-k task nodes by cosine similarity to the query embedding. */
+  searchTasksByVector(query, k) {
+    const rows = this.db.prepare("SELECT te.task_id AS task_id, te.vec AS vec, tn.created_at AS created_at FROM task_embeddings te JOIN task_nodes tn ON tn.id = te.task_id").all();
+    const hits = rows.map((r) => ({
+      taskId: str(r.task_id),
+      cosine: cosine(query, decodeVector(r.vec)),
+      createdAt: str(r.created_at)
+    }));
+    hits.sort((a, b) => b.cosine - a.cosine);
+    return hits.slice(0, k);
+  }
+};
+
+// packages/agent/dist/embeddings.js
+function fnv1a(text) {
+  let hash = 2166136261;
+  for (let i = 0; i < text.length; i++) {
+    hash ^= text.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return hash >>> 0;
+}
+function tokenize(text) {
+  return text.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 0);
+}
+function localEmbed(text, dimension) {
+  const vec = new Array(dimension).fill(0);
+  for (const token of tokenize(text)) {
+    const bucket = fnv1a(token) % dimension;
+    const sign = (fnv1a(`sign:${token}`) & 1) === 1 ? 1 : -1;
+    vec[bucket] = (vec[bucket] ?? 0) + sign;
+  }
+  let norm = 0;
+  for (const x of vec)
+    norm += x * x;
+  norm = Math.sqrt(norm);
+  if (norm === 0)
+    return vec;
+  return vec.map((x) => x / norm);
+}
+var LocalEmbeddingProvider = class {
+  dimension;
+  descriptor = { name: "local", remote: false };
+  constructor(dimension = 256) {
+    this.dimension = dimension;
+  }
+  embed(text) {
+    return Promise.resolve(localEmbed(text, this.dimension));
+  }
+};
+var OpenAIEmbeddingProvider = class {
+  apiKey;
+  model;
+  baseUrl;
+  dimension;
+  descriptor = { name: "openai", remote: true };
+  constructor(apiKey, model = "text-embedding-3-small", dimension = 1536, baseUrl = "https://api.openai.com/v1") {
+    this.apiKey = apiKey;
+    this.model = model;
+    this.baseUrl = baseUrl;
+    this.dimension = dimension;
+  }
+  async embed(text) {
+    const res = await fetch(`${this.baseUrl}/embeddings`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${this.apiKey}`
+      },
+      body: JSON.stringify({ model: this.model, input: text })
+    });
+    if (!res.ok) {
+      throw new Error(`OpenAI embeddings failed: ${res.status} ${await res.text()}`);
+    }
+    const json2 = await res.json();
+    const embedding = json2.data[0]?.embedding;
+    if (!embedding)
+      throw new Error("OpenAI embeddings: empty response");
+    return embedding;
+  }
+};
+
+// packages/agent/dist/ranking.js
+var DEFAULT_WEIGHTS = { semantic: 0.6, recency: 0.3, risk: 0.1 };
+var DEFAULT_HALF_LIFE_DAYS = 30;
+var MS_PER_DAY = 864e5;
+function recencyDecay(createdAt, now, halfLifeDays) {
+  const ts = Date.parse(createdAt);
+  if (Number.isNaN(ts))
+    return 0;
+  const ageDays = Math.max(0, (now.getTime() - ts) / MS_PER_DAY);
+  return Math.pow(0.5, ageDays / halfLifeDays);
+}
+function recencyAwareRank(candidates, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const halfLife = options.halfLifeDays ?? DEFAULT_HALF_LIFE_DAYS;
+  const w = { ...DEFAULT_WEIGHTS, ...options.weights };
+  const ranked = candidates.map((c) => {
+    const recency = recencyDecay(c.createdAt, now, halfLife);
+    const score2 = w.semantic * c.cosine + w.recency * recency + w.risk * (c.risk ?? 0);
+    return { ...c, recency, score: score2 };
+  });
+  ranked.sort((a, b) => b.score - a.score || b.recency - a.recency);
+  return ranked;
+}
+
+// packages/agent/dist/indexer.js
+async function taskEmbeddingText(store2, taskId, getText2) {
+  const parts = [];
+  for (const version of store2.taskVersions(taskId)) {
+    if (version.promptRef) {
+      const text = await getText2(version.promptRef);
+      if (text)
+        parts.push(text);
+    }
+    if (version.decisionSummaryRef) {
+      const text = await getText2(version.decisionSummaryRef);
+      if (text)
+        parts.push(text);
+    }
+  }
+  return parts.join("\n");
+}
+async function backfillEmbeddings(store2, getText2, provider) {
+  let indexed = 0;
+  for (const taskId of store2.tasksMissingEmbeddings()) {
+    const text = await taskEmbeddingText(store2, taskId, getText2);
+    if (text.trim().length === 0)
+      continue;
+    const embedding = await provider.embed(text);
+    store2.putTaskEmbedding(taskId, embedding);
+    indexed += 1;
+  }
+  return indexed;
+}
+
+// packages/agent/dist/llm.js
+var NoLlmError = class extends Error {
+  constructor(message = "no LLM configured or reachable") {
+    super(message);
+    this.name = "NoLlmError";
+  }
+};
+var EchoLLM = class {
+  complete(messages) {
+    const user = messages.find((m) => m.role === "user")?.content ?? "";
+    const firstLine = user.split("\n").find((l) => l.trim().length > 0) ?? "";
+    return Promise.resolve(`[offline-llm] ${firstLine.slice(0, 200)}`);
+  }
+};
+async function withTimeout(p, ms) {
+  return Promise.race([
+    p,
+    new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), ms))
+  ]);
+}
+var OpenAICompatProvider = class {
+  apiKey;
+  model;
+  baseUrl;
+  maxTokens;
+  descriptor;
+  constructor(apiKey, model = "gpt-4o-mini", baseUrl = "https://api.openai.com/v1", descriptor, maxTokens = 4096) {
+    this.apiKey = apiKey;
+    this.model = model;
+    this.baseUrl = baseUrl;
+    this.maxTokens = maxTokens;
+    this.descriptor = {
+      name: descriptor?.name ?? "openai",
+      model,
+      endpoint: baseUrl,
+      remote: descriptor?.remote ?? true,
+      ok: descriptor?.ok
+    };
+  }
+  headers() {
+    const h = { "content-type": "application/json" };
+    if (this.apiKey)
+      h.authorization = `Bearer ${this.apiKey}`;
+    return h;
+  }
+  async chat(body) {
+    const res = await fetch(`${this.baseUrl}/chat/completions`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ model: this.model, max_tokens: this.maxTokens, ...body })
+    });
+    if (!res.ok)
+      throw new Error(`${this.descriptor.name} failed: ${res.status} ${await res.text()}`);
+    const json2 = await res.json();
+    return json2.choices[0]?.message?.content ?? "";
+  }
+  complete(messages) {
+    return this.chat({ messages });
+  }
+  // Best-effort native JSON mode (broadly supported by OpenAI and recent Ollama). The caller still
+  // validates with parseStructured and falls back to `complete()` if this errors.
+  completeStructured(messages, _schema) {
+    return this.chat({ messages, response_format: { type: "json_object" } });
+  }
+  // Cheap reachability: GET /models (no model load), so a cold Ollama still reports reachable.
+  async probe() {
+    try {
+      const res = await withTimeout(fetch(`${this.baseUrl}/models`, { headers: this.headers() }), 4e3);
+      return res.ok;
+    } catch {
+      return false;
+    }
+  }
+};
+var ClaudeProvider = class {
+  apiKey;
+  model;
+  maxTokens;
+  baseUrl;
+  descriptor;
+  constructor(apiKey, model = "claude-sonnet-4-6", maxTokens = 4096, baseUrl = "https://api.anthropic.com/v1") {
+    this.apiKey = apiKey;
+    this.model = model;
+    this.maxTokens = maxTokens;
+    this.baseUrl = baseUrl;
+    this.descriptor = { name: "anthropic", model, endpoint: baseUrl, remote: true };
+  }
+  async complete(messages) {
+    const system = messages.filter((m) => m.role === "system").map((m) => m.content).join("\n\n");
+    const rest = messages.filter((m) => m.role !== "system").map((m) => ({ role: m.role, content: m.content }));
+    const res = await fetch(`${this.baseUrl}/messages`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-api-key": this.apiKey,
+        "anthropic-version": "2023-06-01"
+      },
+      body: JSON.stringify({
+        model: this.model,
+        max_tokens: this.maxTokens,
+        system: system || void 0,
+        messages: rest
+      })
+    });
+    if (!res.ok)
+      throw new Error(`Claude failed: ${res.status} ${await res.text()}`);
+    const json2 = await res.json();
+    return json2.content.map((c) => c.text ?? "").join("");
+  }
+  async probe() {
+    try {
+      await withTimeout(this.complete([{ role: "user", content: "ping" }]), 6e3);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// packages/agent/dist/structured.js
+var SEVERITIES = ["info", "warn", "critical", "gold"];
+var KINDS = /* @__PURE__ */ new Set(["task", "artifact", "version"]);
+var STRUCTURED_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    intent: { type: "string", enum: ["debug", "audit"] },
+    highlights: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          id: { type: "string" },
+          kind: { type: "string", enum: ["task", "artifact", "version"] },
+          reason: { type: "string" },
+          severity: { type: "string", enum: ["info", "warn", "critical", "gold"] },
+          verdict: { type: ["string", "null"] }
+        },
+        required: ["id", "kind", "reason", "severity", "verdict"]
+      }
+    },
+    explanation: { type: "string" }
+  },
+  required: ["intent", "highlights", "explanation"]
+};
+function extractJson(raw) {
+  let s = raw.trim();
+  const fence = s.match(/```(?:json)?\s*([\s\S]*?)```/i);
+  if (fence?.[1])
+    s = fence[1].trim();
+  const start = s.indexOf("{");
+  const end = s.lastIndexOf("}");
+  if (start === -1 || end === -1 || end < start)
+    return void 0;
+  return s.slice(start, end + 1);
+}
+function clampSeverity(value) {
+  return SEVERITIES.includes(value) ? value : "info";
+}
+function validateHighlight(h, knownIds) {
+  if (typeof h !== "object" || h === null)
+    return void 0;
+  const hi = h;
+  const id = typeof hi.id === "string" ? hi.id : "";
+  const kind = typeof hi.kind === "string" ? hi.kind : "";
+  if (!id || !knownIds.has(id) || !KINDS.has(kind))
+    return void 0;
+  const verdict = typeof hi.verdict === "string" && hi.verdict.trim() ? hi.verdict.trim() : void 0;
+  return {
+    id,
+    kind,
+    reason: typeof hi.reason === "string" ? hi.reason : "",
+    severity: clampSeverity(hi.severity),
+    verdict
+  };
+}
+function validateHighlights(arr, knownIds) {
+  const out = [];
+  for (const h of arr) {
+    const f = validateHighlight(h, knownIds);
+    if (f)
+      out.push(f);
+  }
+  return out;
+}
+function recoverHighlightObjects(text) {
+  const key = text.indexOf('"highlights"');
+  if (key < 0)
+    return [];
+  const open = text.indexOf("[", key);
+  if (open < 0)
+    return [];
+  const out = [];
+  let depth = 0;
+  let objStart = -1;
+  let inStr = false;
+  let esc = false;
+  for (let i = open + 1; i < text.length; i++) {
+    const ch = text[i];
+    if (inStr) {
+      if (esc)
+        esc = false;
+      else if (ch === "\\")
+        esc = true;
+      else if (ch === '"')
+        inStr = false;
+      continue;
+    }
+    if (ch === '"')
+      inStr = true;
+    else if (ch === "{") {
+      if (depth === 0)
+        objStart = i;
+      depth += 1;
+    } else if (ch === "}") {
+      depth -= 1;
+      if (depth === 0 && objStart >= 0) {
+        try {
+          out.push(JSON.parse(text.slice(objStart, i + 1)));
+        } catch {
+        }
+        objStart = -1;
+      }
+    } else if (ch === "]" && depth === 0) {
+      break;
+    }
+  }
+  return out;
+}
+function parseStructured(raw, knownIds, fallbackIntent) {
+  const trimmed = raw.trim();
+  const looksJson = trimmed.startsWith("{") || /^```(?:json)?/i.test(trimmed);
+  const intentOf = (v) => v === "audit" ? "audit" : v === "debug" ? "debug" : fallbackIntent;
+  const recover = () => {
+    const recovered = validateHighlights(recoverHighlightObjects(raw), knownIds);
+    if (recovered.length > 0) {
+      const im = raw.match(/"intent"\s*:\s*"(debug|audit)"/);
+      return {
+        intent: intentOf(im?.[1]),
+        highlights: recovered,
+        explanation: "The model's answer was cut off (too long) \u2014 showing the findings recovered before the cut."
+      };
+    }
+    return {
+      intent: fallbackIntent,
+      highlights: [],
+      explanation: "The model's structured answer was malformed or cut off. Try a more specific question, or a stronger / higher-token model."
+    };
+  };
+  const jsonText = extractJson(raw);
+  if (!jsonText) {
+    if (!looksJson)
+      return { intent: fallbackIntent, highlights: [], explanation: trimmed };
+    return recover();
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonText);
+  } catch {
+    return recover();
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return recover();
+  const obj = parsed;
+  return {
+    intent: intentOf(obj.intent),
+    highlights: Array.isArray(obj.highlights) ? validateHighlights(obj.highlights, knownIds) : [],
+    explanation: typeof obj.explanation === "string" ? obj.explanation : ""
+  };
+}
+
+// packages/agent/dist/intent.js
+var AUDIT_TERMS = [
+  "audit",
+  "secret",
+  "secrets",
+  "credential",
+  "credentials",
+  "leak",
+  "leaked",
+  "exposed",
+  "exfiltrat",
+  "egress",
+  "privacy",
+  "sensitive",
+  "password",
+  "token",
+  "api key",
+  "apikey",
+  ".env",
+  "read",
+  "reads",
+  "reached the model",
+  "sent to",
+  "compliance",
+  "pii"
+];
+var DEBUG_TERMS = [
+  "debug",
+  "bug",
+  "error",
+  "fail",
+  "failing",
+  "broke",
+  "broken",
+  "crash",
+  "regression",
+  "root cause",
+  "introduced",
+  "stack trace",
+  "exception",
+  "why",
+  "wrong",
+  "issue",
+  "fix",
+  "not working"
+];
+function score(haystack, terms) {
+  let n = 0;
+  for (const t of terms)
+    if (haystack.includes(t))
+      n += 1;
+  return n;
+}
+function classifyIntent(query) {
+  const q = query.toLowerCase();
+  const audit = score(q, AUDIT_TERMS);
+  const debug = score(q, DEBUG_TERMS);
+  if (audit === 0 && debug === 0)
+    return { intent: "debug", confidence: 0 };
+  const intent = audit > debug ? "audit" : "debug";
+  const total = audit + debug;
+  const confidence = total === 0 ? 0 : Math.abs(audit - debug) / total;
+  return { intent, confidence };
+}
+
+// packages/agent/dist/redact.js
+function isExternal(path) {
+  return path.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path);
+}
+function entropy(s) {
+  if (!s)
+    return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s)
+    counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let e = 0;
+  for (const n of counts.values()) {
+    const p = n / s.length;
+    e -= p * Math.log2(p);
+  }
+  return e;
+}
+function isHighEntropy(token) {
+  return token.length >= 32 && /[0-9]/.test(token) && /[A-Za-z]/.test(token) && entropy(token) >= 4;
+}
+var WHOLE = [
+  { kind: "private_key", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g },
+  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  { kind: "anthropic_key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "openai_key", re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "aws_access_key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { kind: "gcp_api_key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: "github_token", re: /\b(?:gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,})\b/g },
+  { kind: "slack_token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g }
+];
+function secretScrub(text) {
+  let out = text;
+  for (const { kind, re } of WHOLE)
+    out = out.replace(re, `[REDACTED:${kind}]`);
+  out = out.replace(/(:\/\/[^:@/\s]+:)([^@/\s]+)(@)/g, (_m, a, _pw, c) => `${a}[REDACTED:url_credentials]${c}`);
+  out = out.replace(/\b([a-z0-9_]*(?:key|token|secret|password|passwd|pwd|credential)[a-z0-9_]*)\s*([:=])\s*["']?([^"'\s]{6,})["']?/gi, (_m, k, sep2, _v) => `${k}${sep2}[REDACTED:env_secret]`);
+  return out;
+}
+function redactPaths(text) {
+  return text.replace(/(?<![:\w])\/(?:[A-Za-z0-9._-]+\/)+[A-Za-z0-9._-]+/g, "[REDACTED:path]").replace(/\b[A-Za-z]:\\(?:[A-Za-z0-9._-]+\\)*[A-Za-z0-9._-]+/g, "[REDACTED:path]");
+}
+function redactEntropy(text) {
+  return text.replace(/[A-Za-z0-9+/=_-]{32,}/g, (m) => isHighEntropy(m) ? "[REDACTED:high_entropy]" : m);
+}
+function redactFreeText(text) {
+  return redactPaths(redactEntropy(secretScrub(text)));
+}
+function redactStructural(text) {
+  return redactPaths(secretScrub(text));
+}
+
+// packages/agent/dist/llm-config.js
+var OLLAMA_ENDPOINT = "http://localhost:11434/v1";
+var DEFAULT_OLLAMA_MODEL = "qwen3:4b";
+function resolveLlmConfig(env) {
+  const model = env.BRAIN0_LLM_MODEL;
+  const endpoint = env.BRAIN0_LLM_ENDPOINT;
+  const ollama = () => ({
+    provider: "ollama",
+    model: model ?? DEFAULT_OLLAMA_MODEL,
+    endpoint: endpoint ?? OLLAMA_ENDPOINT,
+    apiKey: "",
+    remote: false
+  });
+  const anthropic = () => ({
+    provider: "anthropic",
+    model: model ?? "claude-sonnet-4-6",
+    endpoint: endpoint ?? "https://api.anthropic.com/v1",
+    apiKey: env.ANTHROPIC_API_KEY ?? "",
+    remote: true
+  });
+  const openai = () => ({
+    provider: "openai",
+    model: model ?? "gpt-4o-mini",
+    endpoint: endpoint ?? "https://api.openai.com/v1",
+    apiKey: env.OPENAI_API_KEY ?? "",
+    remote: true
+  });
+  switch (env.BRAIN0_LLM_PROVIDER?.toLowerCase()) {
+    case "ollama":
+      return ollama();
+    case "anthropic":
+      return anthropic();
+    case "openai":
+      return openai();
+    case "echo":
+      return { provider: "echo", model: "", endpoint: "", apiKey: "", remote: false };
+    default:
+      break;
+  }
+  if (env.ANTHROPIC_API_KEY)
+    return anthropic();
+  if (env.OPENAI_API_KEY)
+    return openai();
+  return ollama();
+}
+function resolveEmbedderConfig(env) {
+  const dim = Number(env.BRAIN0_EMBED_DIM ?? "256") || 256;
+  if (env.BRAIN0_EMBED_PROVIDER?.toLowerCase() === "openai") {
+    return {
+      provider: "openai",
+      model: env.BRAIN0_EMBED_MODEL ?? "text-embedding-3-small",
+      endpoint: env.BRAIN0_EMBED_ENDPOINT ?? "https://api.openai.com/v1",
+      apiKey: env.OPENAI_API_KEY ?? "",
+      dim,
+      remote: true
+    };
+  }
+  return { provider: "local", model: "local-feature-hash", endpoint: "", apiKey: "", dim, remote: false };
+}
+
+// packages/agent/dist/agent.js
+var DEBUG_SYSTEM = "You are brain0's root-cause debugging assistant. Given an issue and the candidate intents (prompts/decisions) plus the code they changed \u2014 ordered most-relevant and most-recent first \u2014 identify the change most likely to have introduced the issue. Cite task and artifact ids. Be concise.";
+var AUDIT_SYSTEM = "You are brain0's audit assistant. Summarize what changed, where the risk concentrates, and call out any 'looked safe but proved dangerous' (gold-signal) artifacts. Be concise.";
+var ASK_SYSTEM = 'You are brain0\'s debug+audit assistant. From the user\'s question, decide the INTENT: \'debug\' (find the change/root cause of an issue) or \'audit\' (what reached the model \u2014 files read, secrets, risk concentration). Use ONLY the evidence provided. Reply with a single JSON object: {"intent":"debug"|"audit", "highlights":[{"id":"<copied from evidence>","kind":"task"|"artifact"|"version","reason":"why it matters","severity":"info"|"warn"|"critical"|"gold","verdict":"short label or null"}],"explanation":"concise prose"}. Every id MUST be copied verbatim from the evidence. Highlight only the few nodes that matter (the root-cause chain for debug; the risky / secret-touching nodes for audit), MOST IMPORTANT FIRST: AT MOST 8 highlights, each `reason` <= 12 words and `verdict` a few words. Keep `explanation` to 1\u20132 sentences. Keep the whole answer compact so the JSON stays complete and valid. Output JSON only, no prose outside it.';
+var Brain0Agent = class {
+  store;
+  embedder;
+  llm;
+  getText;
+  maxHydrate;
+  weights;
+  repo;
+  level;
+  constructor(opts) {
+    this.store = opts.store;
+    this.embedder = opts.embedder;
+    this.llm = opts.llm;
+    this.getText = opts.getText ?? (() => Promise.resolve(void 0));
+    this.maxHydrate = opts.maxHydrate ?? 8;
+    this.weights = opts.weights;
+    this.repo = opts.repo;
+    this.level = opts.level;
+  }
+  /** Max fused risk across the artifacts a task modified (for ranking). */
+  taskRisk(taskId) {
+    let max = 0;
+    for (const edge of this.store.outEdges("task_modifies_artifact", taskId)) {
+      const artId = String(edge.artifact ?? "");
+      const art = this.store.getArtifact(artId);
+      if (art)
+        max = Math.max(max, fusedScore(art.risk));
+    }
+    return max;
+  }
+  /**
+   * Root-cause debug: from the issue text, find the relevant intents, rank recency-aware,
+   * traverse to the code + its version chains, and explain — operating by reference.
+   */
+  async debug(query) {
+    const qvec = await this.embedder.embed(query);
+    const pool = this.store.searchTasksByVector(qvec, Math.max(this.maxHydrate * 3, this.maxHydrate));
+    const candidates = pool.map((h) => ({
+      taskId: h.taskId,
+      cosine: h.cosine,
+      createdAt: h.createdAt,
+      risk: this.taskRisk(h.taskId)
+    }));
+    const ranked = recencyAwareRank(candidates, { weights: this.weights });
+    const top = ranked.slice(0, this.maxHydrate);
+    const artifacts = /* @__PURE__ */ new Set();
+    const versions = /* @__PURE__ */ new Set();
+    const evidence = [];
+    for (const cand of top) {
+      const text = await taskEmbeddingText(this.store, cand.taskId, this.getText);
+      const artifactLines = [];
+      for (const edge of this.store.outEdges("task_modifies_artifact", cand.taskId)) {
+        const artId = String(edge.artifact ?? "");
+        const art = this.store.getArtifact(artId);
+        if (!art)
+          continue;
+        artifacts.add(artId);
+        const chain = this.store.artifactVersions(artId);
+        for (const v of chain)
+          versions.add(v.id);
+        const last = chain[chain.length - 1];
+        const color = riskColor(art.risk);
+        artifactLines.push(`  - ${artId} ${art.qualifiedPath} risk=${color.fused.toFixed(2)} (${color.transition}) lastChange=${last?.changeKind ?? "?"} by ${last?.author.name ?? "?"} @ ${last?.timestamp ?? "?"}`);
+      }
+      evidence.push(`Task ${cand.taskId} [relevance=${cand.cosine.toFixed(2)} recency=${cand.recency.toFixed(2)} risk=${(cand.risk ?? 0).toFixed(2)}]
+${text || "(no payload)"}
+Changed:
+${artifactLines.join("\n") || "  (none)"}`);
+    }
+    const explanation = await this.llm.complete([
+      { role: "system", content: DEBUG_SYSTEM },
+      {
+        role: "user",
+        content: `Issue: ${query}
+
+Candidate intents (most relevant first):
+
+${evidence.join("\n\n")}`
+      }
+    ]);
+    return {
+      query,
+      highlights: {
+        tasks: top.map((t) => t.taskId),
+        artifacts: [...artifacts],
+        versions: [...versions]
+      },
+      ranked: top,
+      explanation
+    };
+  }
+  /**
+   * Big-picture audit over a repo: risk distribution, gold-signal artifacts, and the
+   * riskiest nodes — by reference (no payload dump).
+   */
+  async audit(opts) {
+    const level = opts.level ?? "symbol";
+    const artifacts = this.store.listArtifacts(opts.repo, level);
+    const scored = artifacts.map((a) => ({ a, fused: fusedScore(a.risk) }));
+    let green = 0;
+    let yellow = 0;
+    let red = 0;
+    const goldSignals = [];
+    for (const { a, fused } of scored) {
+      if (fused < 0.34)
+        green += 1;
+      else if (fused < 0.66)
+        yellow += 1;
+      else
+        red += 1;
+      if (isGoldSignal(a.risk))
+        goldSignals.push(a.id);
+    }
+    const topRisky = [...scored].sort((x, y) => y.fused - x.fused).slice(0, this.maxHydrate).map(({ a, fused }) => ({ id: a.id, path: a.qualifiedPath, fused }));
+    const summary = `Repo ${opts.repo}: ${artifacts.length} ${level}(s). Risk distribution green=${green} yellow=${yellow} red=${red}. Gold-signal (looked safe \u2192 proved dangerous): ${goldSignals.length}.`;
+    const explanation = await this.llm.complete([
+      { role: "system", content: AUDIT_SYSTEM },
+      {
+        role: "user",
+        content: `${summary}
+Top risky:
+` + topRisky.map((t) => `- ${t.id} ${t.path} ${t.fused.toFixed(2)}`).join("\n")
+      }
+    ]);
+    return { repo: opts.repo, level, distribution: { green, yellow, red }, goldSignals, topRisky, explanation };
+  }
+  /**
+   * Assemble the enriched, reference-preserving evidence for the top tasks: hydrated summary,
+   * files read (with out-of-repo flag), declared↔done drift, and each changed artifact's risk +
+   * coupling (centrality/blast via the co-change `artifact_depends_on` edges, omitted when absent).
+   * Returns the prompt block, the set of valid ids (to reject hallucinated ones), the retrieval
+   * highlight floor, and which tasks read an out-of-repo file (for the audit card flag).
+   */
+  async buildBundle(top) {
+    const ids = /* @__PURE__ */ new Set();
+    const tasks = [];
+    const artifacts = /* @__PURE__ */ new Set();
+    const versions = /* @__PURE__ */ new Set();
+    const taskExternalRead = /* @__PURE__ */ new Map();
+    const blocks = [];
+    for (const cand of top) {
+      tasks.push(cand.taskId);
+      ids.add(cand.taskId);
+      const reads = /* @__PURE__ */ new Set();
+      let undeclared = 0;
+      let phantom = 0;
+      for (const v of this.store.taskVersions(cand.taskId)) {
+        for (const r of v.reads ?? [])
+          reads.add(r);
+        undeclared += v.drift?.undeclared?.length ?? 0;
+        phantom += v.drift?.phantom?.length ?? 0;
+      }
+      const readList = [...reads];
+      taskExternalRead.set(cand.taskId, readList.some(isExternal));
+      const artLines = [];
+      for (const edge of this.store.outEdges("task_modifies_artifact", cand.taskId)) {
+        const artId = String(edge.artifact ?? "");
+        const art = this.store.getArtifact(artId);
+        if (!art)
+          continue;
+        artifacts.add(artId);
+        ids.add(artId);
+        for (const v of this.store.artifactVersions(artId)) {
+          versions.add(v.id);
+          ids.add(v.id);
+        }
+        const color = riskColor(art.risk);
+        const coupled = this.store.inEdges("artifact_depends_on", artId).length;
+        const gold = isGoldSignal(art.risk) ? " GOLD(safe\u2192dangerous)" : "";
+        artLines.push(`    - ${artId} ${art.qualifiedPath} risk=${color.fused.toFixed(2)} (${color.transition})${gold}` + (coupled ? ` coupledTo=${coupled}` : ""));
+      }
+      const fullSummary = await taskEmbeddingText(this.store, cand.taskId, this.getText);
+      const summary = fullSummary.length > 480 ? `${fullSummary.slice(0, 480)}\u2026 (truncated)` : fullSummary;
+      const readsLine = readList.length ? readList.slice(0, 8).map((r) => isExternal(r) ? `${r} (EXTERNAL)` : r).join(", ") : "(none)";
+      blocks.push(`Task ${cand.taskId} [rel=${cand.cosine.toFixed(2)} rec=${cand.recency.toFixed(2)} risk=${(cand.risk ?? 0).toFixed(2)}]
+${summary || "(no payload)"}
+  reads: ${readsLine}
+  drift: undeclared=${undeclared} phantom=${phantom}
+  changed:
+${capped(artLines, 6).join("\n") || "    (none)"}`);
+    }
+    return {
+      text: blocks.join("\n\n"),
+      ids,
+      retrieval: { tasks, artifacts: [...artifacts], versions: [...versions] },
+      taskExternalRead
+    };
+  }
+  /** Repo-wide audit numbers (distribution / gold signals / top risky) — the misclassification-safe
+   * floor, computed from the full level scan, not the ~8 retrieved tasks. */
+  auditNumbers() {
+    if (!this.repo)
+      return void 0;
+    const level = this.level ?? "symbol";
+    const scored = this.store.listArtifacts(this.repo, level).map((a) => ({ a, fused: fusedScore(a.risk) }));
+    let green = 0;
+    let yellow = 0;
+    let red = 0;
+    const goldSignals = [];
+    for (const { a, fused } of scored) {
+      if (fused < 0.34)
+        green += 1;
+      else if (fused < 0.66)
+        yellow += 1;
+      else
+        red += 1;
+      if (isGoldSignal(a.risk))
+        goldSignals.push(a.id);
+    }
+    const topRisky = [...scored].sort((x, y) => y.fused - x.fused).slice(0, this.maxHydrate).map(({ a, fused }) => ({ id: a.id, path: a.qualifiedPath, fused }));
+    return { distribution: { green, yellow, red }, goldSignals, topRisky };
+  }
+  /** Artifacts (and their linked tasks) named by the query — the lexical channel. */
+  resolveEntityArtifacts(query) {
+    const artifacts = /* @__PURE__ */ new Set();
+    const tasks = /* @__PURE__ */ new Set();
+    if (!this.repo)
+      return { artifacts: [], tasks: [] };
+    const tokens = extractEntityTokens(query).map((t) => t.toLowerCase());
+    if (tokens.length === 0)
+      return { artifacts: [], tasks: [] };
+    for (const level of ["file", "symbol"]) {
+      for (const art of this.store.listArtifacts(this.repo, level)) {
+        const path = art.qualifiedPath.toLowerCase();
+        if (tokens.some((t) => path.includes(t))) {
+          artifacts.add(art.id);
+          for (const edge of this.store.inEdges("task_modifies_artifact", art.id)) {
+            const task = String(edge.task ?? "");
+            if (task)
+              tasks.add(task);
+          }
+        }
+      }
+    }
+    return { artifacts: [...artifacts], tasks: [...tasks] };
+  }
+  /** Commit task ids referenced by a git SHA in the query (hex tokens of 7–40 chars matched as a
+   *  commit's session_id prefix). Empty when the query names no known commit. */
+  resolveCommitTasks(query) {
+    const out = /* @__PURE__ */ new Set();
+    const tokens = query.toLowerCase().match(/\b[0-9a-f]{7,40}\b/g) ?? [];
+    for (const token of tokens) {
+      for (const id of this.store.commitTaskIdsByShaPrefix(token))
+        out.add(id);
+    }
+    return [...out];
+  }
+  /**
+   * Single auto-intent entry point for the smart chat. Retrieval is ALWAYS intent-agnostic; the
+   * LLM self-classifies debug vs audit and returns structured findings (validated against the
+   * bundle ids) plus prose. Egress is redacted per-channel when the provider is remote; the result
+   * carries the truthful egress state. The LLM call failing never blanks the graph — the retrieval
+   * floor still highlights — and never throws: it returns `error` instead.
+   */
+  /** The shared retrieval stage (no LLM): classify, resolve entities, rank, build the bundle. */
+  async gather(query) {
+    const cls = classifyIntent(query);
+    const llmDesc = this.llm.descriptor ?? {
+      name: "echo",
+      model: "",
+      endpoint: "",
+      remote: false
+    };
+    const embDesc = this.embedder.descriptor ?? { name: "local", remote: false };
+    const resolved = this.resolveCommitTasks(query);
+    const entity = this.resolveEntityArtifacts(query);
+    let top;
+    if (resolved.length > 0) {
+      top = resolved.slice(0, this.maxHydrate).map((taskId) => ({
+        taskId,
+        cosine: 1,
+        createdAt: this.store.getTask(taskId)?.createdAt ?? "",
+        risk: this.taskRisk(taskId),
+        recency: 1,
+        score: 1
+      }));
+    } else {
+      const embedInput = embDesc.remote ? redactFreeText(query) : query;
+      const qvec = await this.embedder.embed(embedInput);
+      const pool = this.store.searchTasksByVector(qvec, Math.max(this.maxHydrate * 3, this.maxHydrate));
+      const candidates = pool.map((h) => ({
+        taskId: h.taskId,
+        cosine: h.cosine,
+        createdAt: h.createdAt,
+        risk: this.taskRisk(h.taskId)
+      }));
+      const ranked = recencyAwareRank(candidates, { weights: this.weights });
+      const lex = entity.tasks.map((taskId) => ({
+        taskId,
+        cosine: 0.95,
+        createdAt: this.store.getTask(taskId)?.createdAt ?? "",
+        risk: this.taskRisk(taskId),
+        recency: 1,
+        score: 0.95
+      })).sort((a, b) => b.createdAt.localeCompare(a.createdAt)).slice(0, Math.ceil(this.maxHydrate / 2));
+      const lexIds = new Set(lex.map((t) => t.taskId));
+      top = [...lex, ...ranked.filter((t) => !lexIds.has(t.taskId))].slice(0, this.maxHydrate);
+    }
+    const bundle = await this.buildBundle(top);
+    for (const id of entity.artifacts) {
+      bundle.ids.add(id);
+      if (!bundle.retrieval.artifacts.includes(id))
+        bundle.retrieval.artifacts.push(id);
+    }
+    return { cls, llmDesc, embDesc, top, bundle };
+  }
+  /**
+   * Phase 1 of the two-phase smart chat: retrieval only — highlights, ranked candidates, and
+   * (for audit-shaped queries) the deterministic numbers. Milliseconds, zero LLM tokens; the
+   * GUI paints this immediately while `ask()` produces the explanation.
+   */
+  async retrieve(query) {
+    const { cls, llmDesc, embDesc, top, bundle } = await this.gather(query);
+    const audit = cls.intent === "audit" ? this.auditNumbers() : void 0;
+    return {
+      query,
+      intent: cls.intent,
+      confidence: cls.confidence,
+      highlights: bundle.retrieval,
+      findings: [],
+      ranked: top,
+      distribution: audit?.distribution,
+      goldSignals: audit?.goldSignals,
+      topRisky: audit?.topRisky,
+      explanation: "",
+      egress: {
+        llm: llmDesc,
+        embedder: embDesc,
+        redacted: llmDesc.remote,
+        zeroEgress: !llmDesc.remote && !embDesc.remote
+      },
+      error: void 0
+    };
+  }
+  async ask(query) {
+    const { cls, llmDesc, embDesc, top, bundle } = await this.gather(query);
+    const queryOut = llmDesc.remote ? redactFreeText(query) : query;
+    const structuralOut = llmDesc.remote ? redactStructural(bundle.text) : bundle.text;
+    const userMsg = `Question: ${queryOut}
+
+Evidence (choose ids ONLY from here):
+
+${structuralOut}`;
+    const messages = [
+      { role: "system", content: ASK_SYSTEM },
+      { role: "user", content: userMsg }
+    ];
+    let raw = "";
+    let error;
+    try {
+      if (this.llm.completeStructured) {
+        try {
+          raw = await this.llm.completeStructured(messages, STRUCTURED_SCHEMA);
+        } catch (err) {
+          if (err instanceof NoLlmError)
+            throw err;
+          raw = await this.llm.complete(messages);
+        }
+      } else {
+        raw = await this.llm.complete(messages);
+      }
+    } catch (err) {
+      error = err instanceof NoLlmError ? "no-llm" : "llm-unreachable";
+    }
+    const structured = error ? { intent: cls.intent, highlights: [], explanation: "" } : parseStructured(raw, bundle.ids, cls.intent);
+    const union = (floor, add) => [.../* @__PURE__ */ new Set([...floor, ...add])];
+    const llmByKind = (kind) => structured.highlights.filter((h) => h.kind === kind).map((h) => h.id);
+    const highlights = {
+      tasks: union(bundle.retrieval.tasks, llmByKind("task")),
+      artifacts: union(bundle.retrieval.artifacts, llmByKind("artifact")),
+      versions: union(bundle.retrieval.versions, llmByKind("version"))
+    };
+    const findings = structured.highlights.map((h) => {
+      const art = h.kind === "artifact" ? this.store.getArtifact(h.id) : void 0;
+      const external = h.kind === "artifact" ? art ? isExternal(art.qualifiedPath) : false : bundle.taskExternalRead.get(h.id) ?? false;
+      return { ...h, path: art?.qualifiedPath, external };
+    });
+    const audit = structured.intent === "audit" ? this.auditNumbers() : void 0;
+    return {
+      query,
+      intent: structured.intent,
+      confidence: cls.confidence,
+      highlights,
+      findings,
+      ranked: top,
+      distribution: audit?.distribution,
+      goldSignals: audit?.goldSignals,
+      topRisky: audit?.topRisky,
+      explanation: structured.explanation,
+      egress: { llm: llmDesc, embedder: embDesc, redacted: llmDesc.remote, zeroEgress: !llmDesc.remote && !embDesc.remote },
+      error
+    };
+  }
+};
+function extractEntityTokens(query) {
+  const out = /* @__PURE__ */ new Set();
+  for (const m of query.matchAll(/`([^`]+)`/g)) {
+    const t = m[1]?.trim();
+    if (t && t.length >= 3)
+      out.add(t);
+  }
+  for (const raw of query.split(/\s+/)) {
+    const w = raw.replace(/^[('"«]+|[)'"».,;:!?]+$/g, "");
+    if (w.length < 3)
+      continue;
+    if (w.includes("/") || w.includes("::") || /\.[a-z]{1,4}$/i.test(w))
+      out.add(w);
+  }
+  return [...out];
+}
+function capped(lines, keep) {
+  if (lines.length <= keep)
+    return lines;
+  return [...lines.slice(0, keep), `    \u2026 +${lines.length - keep} more`];
+}
+
+// packages/server/dist/server.js
+function buildEmbedder() {
+  const c = resolveEmbedderConfig(process.env);
+  if (c.provider === "openai")
+    return new OpenAIEmbeddingProvider(c.apiKey, c.model, 1536, c.endpoint);
+  return new LocalEmbeddingProvider(c.dim);
+}
+async function buildLlm() {
+  const c = resolveLlmConfig(process.env);
+  let provider;
+  switch (c.provider) {
+    case "anthropic":
+      provider = new ClaudeProvider(c.apiKey, c.model, 4096, c.endpoint);
+      break;
+    case "openai":
+      provider = new OpenAICompatProvider(c.apiKey, c.model, c.endpoint, { name: "openai", remote: true });
+      break;
+    case "echo":
+      provider = new EchoLLM();
+      break;
+    default:
+      provider = new OpenAICompatProvider("", c.model, c.endpoint, { name: "ollama", remote: false });
+      break;
+  }
+  const ok = provider.probe ? await provider.probe() : true;
+  if (provider.descriptor)
+    provider.descriptor.ok = ok;
+  return provider;
+}
+function json(res, status, body) {
+  res.writeHead(status, {
+    "content-type": "application/json",
+    "access-control-allow-origin": "*"
+  });
+  res.end(JSON.stringify(body));
+}
+var db = resolve2(process.env.BRAIN0_DB ?? ".brain0/index.db");
+var payloadDir = resolve2(process.env.BRAIN0_PAYLOAD ?? ".brain0/payload");
+var repo = process.env.BRAIN0_REPO ?? "";
+var port = Number(process.env.PORT ?? 8787);
+if (!existsSync(db)) {
+  console.error(`brain0-server: index database not found at ${db}
+  (cwd is ${process.cwd()}; pnpm runs scripts from the package directory)
+  Pass an ABSOLUTE path, run from the repo root, e.g.:
+    BRAIN0_REPO=${repo || "myorg/myrepo"} \\
+    BRAIN0_DB="$PWD/.brain0/index.db" BRAIN0_PAYLOAD="$PWD/.brain0/payload" \\
+      pnpm --filter @brain0/server start
+  Create the index first with: brain0 observe (and/or brain0 ingest).`);
+  process.exit(1);
+}
+var store = new Brain0Store(db);
+var payload = new FsPayloadReader(payloadDir);
+var getText = (ref) => payload.getText(ref);
+var embedder = buildEmbedder();
+var llm = await buildLlm();
+var agent = new Brain0Agent({ store, embedder, llm, getText, repo: repo || void 0 });
+var repoRoot = resolve2(import.meta.dirname, "../../..");
+var guiDir = process.env.BRAIN0_GUI_DIR ? resolve2(process.env.BRAIN0_GUI_DIR) : resolve2(repoRoot, "packages/gui/build");
+var guiAvailable = existsSync(resolve2(guiDir, "index.html"));
+async function serveStatic(pathname, res) {
+  if (!guiAvailable) {
+    json(res, 404, {
+      error: "not found",
+      hint: "GUI build not present \u2014 run `pnpm --filter @brain0/gui build` (or set BRAIN0_GUI_DIR)"
+    });
+    return;
+  }
+  const wanted = pathname === "/" ? "/index.html" : pathname;
+  const file = safeJoin(guiDir, wanted);
+  if (!file) {
+    json(res, 403, { error: "forbidden" });
+    return;
+  }
+  try {
+    const body = await readFile2(file);
+    res.writeHead(200, {
+      "content-type": contentTypeFor(file),
+      "cache-control": cacheControlFor(wanted)
+    });
+    res.end(body);
+  } catch {
+    try {
+      const body = await readFile2(resolve2(guiDir, "index.html"));
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" });
+      res.end(body);
+    } catch {
+      json(res, 404, { error: "not found" });
+    }
+  }
+}
+var repoPath = process.env.BRAIN0_REPO_PATH;
+var REPO_RE = /^[A-Za-z0-9._/-]+$/;
+function resolveBin() {
+  if (process.env.BRAIN0_BIN && existsSync(process.env.BRAIN0_BIN))
+    return process.env.BRAIN0_BIN;
+  for (const p of ["target/release/brain0", "target/debug/brain0"]) {
+    const abs = resolve2(repoRoot, p);
+    if (existsSync(abs))
+      return abs;
+  }
+  return void 0;
+}
+function payloadIsEncrypted() {
+  try {
+    const row = store.raw().prepare("SELECT value FROM meta WHERE key='payload_encryption'").get();
+    return row?.value !== "plaintext";
+  } catch {
+    return true;
+  }
+}
+var refresh = { state: "idle", phase: "", jobId: "", startedAt: 0, finishedAt: 0, error: "", lines: [] };
+function pushLine(s) {
+  const last = refresh.lines.at(-1);
+  if (s && s !== last) {
+    refresh.lines.push(s);
+    if (refresh.lines.length > 50)
+      refresh.lines.shift();
+  }
+}
+function spawnStep(bin, args) {
+  return new Promise((res, rej) => {
+    const child = spawn(bin, args, { cwd: repoPath, env: process.env });
+    const capture = (buf) => {
+      for (const raw of buf.toString().split(/[\r\n]+/)) {
+        const l = raw.trim();
+        if (l)
+          pushLine(l);
+      }
+    };
+    child.stdout.on("data", capture);
+    child.stderr.on("data", capture);
+    child.on("exit", (c) => c === 0 ? res() : rej(new Error(`${args[0]} exited with code ${c}`)));
+    child.on("error", rej);
+  });
+}
+async function runRefresh() {
+  const bin = resolveBin();
+  refresh.state = "running";
+  refresh.jobId = randomUUID();
+  refresh.startedAt = Date.now();
+  refresh.finishedAt = 0;
+  refresh.error = "";
+  refresh.lines = [];
+  const enc = payloadIsEncrypted() ? [] : ["--no-encrypt-payload"];
+  const common = ["--repo", repo, "--path", repoPath, "--db", db, "--payload", payloadDir, ...enc];
+  try {
+    refresh.phase = "ingest";
+    await spawnStep(bin, ["ingest", ...common]);
+    refresh.phase = "observe";
+    await spawnStep(bin, ["observe", ...common]);
+    refresh.phase = "embed";
+    await backfillEmbeddings(store, getText, embedder);
+    refresh.state = "done";
+  } catch (err) {
+    refresh.state = "error";
+    refresh.error = String(err);
+  } finally {
+    refresh.finishedAt = Date.now();
+  }
+}
+await backfillEmbeddings(store, getText, embedder);
+function shapeAsk(result) {
+  return {
+    tasks: result.highlights.tasks,
+    // legacy
+    artifacts: result.highlights.artifacts,
+    // legacy
+    explanation: result.explanation,
+    // legacy
+    intent: result.intent,
+    confidence: result.confidence,
+    findings: result.findings,
+    distribution: result.distribution,
+    goldSignals: result.goldSignals,
+    topRisky: result.topRisky,
+    provider: {
+      name: result.egress.llm.name,
+      remote: result.egress.llm.remote,
+      ok: result.egress.llm.ok,
+      embedder: result.egress.embedder,
+      redacted: result.egress.redacted,
+      zeroEgress: result.egress.zeroEgress
+    },
+    error: result.error
+  };
+}
+var askCache = new BoundedCache(100);
+function indexGeneration() {
+  try {
+    const row = store.raw().prepare("SELECT (SELECT COUNT(*) FROM task_versions) tv, (SELECT COUNT(*) FROM artifact_versions) av, (SELECT COALESCE(MAX(timestamp),'') FROM artifact_versions) m").get();
+    return `${row?.tv ?? 0}:${row?.av ?? 0}:${row?.m ?? ""}`;
+  } catch {
+    return String(Date.now());
+  }
+}
+var server = createServer((req, res) => {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  void (async () => {
+    try {
+      if (url.pathname === "/graph.json") {
+        json(res, 200, buildGraphSnapshot(store, repo));
+      } else if (url.pathname === "/api/node") {
+        const detail = await buildNodeDetail(store, getText, url.searchParams.get("id") ?? "");
+        if (detail)
+          json(res, 200, detail);
+        else
+          json(res, 404, { error: "node not found" });
+      } else if (url.pathname === "/api/diff") {
+        const raw = await getText(url.searchParams.get("ref") ?? "");
+        if (raw === void 0) {
+          json(res, 404, { error: "diff not found" });
+        } else {
+          const text = readablePayload(raw);
+          json(res, 200, text === void 0 ? { encrypted: true } : { diff: text });
+        }
+      } else if (url.pathname === "/api/debug") {
+        const q = url.searchParams.get("q") ?? "";
+        if (url.searchParams.get("phase") === "retrieve") {
+          json(res, 200, shapeAsk(await agent.retrieve(q)));
+        } else {
+          const key = `${indexGeneration()}|${normalizeQuery(q)}`;
+          const hit = askCache.get(key);
+          if (hit) {
+            json(res, 200, { ...hit, cached: true });
+          } else {
+            const result = await agent.ask(q);
+            const shaped = shapeAsk(result);
+            if (!result.error)
+              askCache.set(key, shaped);
+            json(res, 200, shaped);
+          }
+        }
+      } else if (url.pathname === "/health") {
+        json(res, 200, {
+          ok: true,
+          repo,
+          db,
+          llm: { name: llm.descriptor?.name ?? "echo", remote: llm.descriptor?.remote ?? false, ok: llm.descriptor?.ok },
+          embedder: { name: embedder.descriptor?.name ?? "local", remote: embedder.descriptor?.remote ?? false },
+          zeroEgress: !(llm.descriptor?.remote ?? false) && !(embedder.descriptor?.remote ?? false)
+        });
+      } else if (url.pathname === "/api/refresh" && req.method === "POST") {
+        const sameSite = req.headers["sec-fetch-site"] ?? "same-origin";
+        if (req.headers["x-brain0-refresh"] !== "1" || sameSite !== "same-origin" && sameSite !== "none") {
+          json(res, 403, { error: "forbidden: refresh is same-origin only" });
+        } else if (!repo || !REPO_RE.test(repo) || repo.startsWith("-")) {
+          json(res, 503, {
+            error: "BRAIN0_REPO unset or invalid",
+            hint: "start the server with a valid BRAIN0_REPO=<id>"
+          });
+        } else if (!repoPath || !existsSync(repoPath) || repoPath.startsWith("-")) {
+          json(res, 503, {
+            error: "BRAIN0_REPO_PATH unset or not a directory",
+            hint: "set BRAIN0_REPO_PATH to the observed repo working tree (dev.mjs sets it)"
+          });
+        } else if (!resolveBin()) {
+          json(res, 503, { error: "brain0 binary not found", hint: "run: cargo build -p brain0-cli" });
+        } else if (refresh.state === "running") {
+          json(res, 409, { error: "refresh already running", jobId: refresh.jobId });
+        } else {
+          void runRefresh();
+          json(res, 202, { jobId: refresh.jobId, state: "running" });
+        }
+      } else if (url.pathname === "/api/refresh/status") {
+        json(res, 200, refresh);
+      } else if (req.method === "GET" || req.method === "HEAD") {
+        await serveStatic(url.pathname, res);
+      } else {
+        json(res, 404, { error: "not found" });
+      }
+    } catch (err) {
+      json(res, 500, { error: String(err) });
+    }
+  })();
+});
+var zeroEgress = !(llm.descriptor?.remote ?? false) && !(embedder.descriptor?.remote ?? false);
+server.listen(port, "127.0.0.1", () => {
+  console.log(`brain0-server listening on :${port} (repo=${repo || "<unset>"} db=${db})`);
+  console.log(guiAvailable ? `  gui: http://localhost:${port}/ (serving ${guiDir})` : `  gui: not built \u2014 API only (run \`pnpm --filter @brain0/gui build\` or set BRAIN0_GUI_DIR)`);
+  console.log(`  llm: ${llm.descriptor?.name ?? "echo"}${llm.descriptor?.ok === false ? " (UNREACHABLE \u2014 run `ollama serve` or set a key)" : ""} \xB7 embeddings: ${embedder.descriptor?.name ?? "local"} \xB7 ${zeroEgress ? "zero egress (all local)" : "REMOTE \u2014 context redacted before egress"}`);
+});