clay-server 2.27.0-beta.8 → 2.27.0

package/lib/server.js

@@ -1,15 +1,20 @@
 var http = require("http");
-var crypto = require("crypto");
 var fs = require("fs");
 var path = require("path");
 var { WebSocketServer } = require("ws");
-var { pinPageHtml, setupPageHtml, adminSetupPageHtml, multiUserLoginPageHtml, smtpLoginPageHtml, invitePageHtml, smtpInvitePageHtml, noProjectsPageHtml } = require("./pages");
+var pages = require("./pages");
 var smtp = require("./smtp");
 var { createProjectContext } = require("./project");
 var users = require("./users");
 var dm = require("./dm");
 var mates = require("./mates");
-var sessionSearch = require("./session-search");
+var serverAuth = require("./server-auth");
+var serverSkills = require("./server-skills");
+var serverDm = require("./server-dm");
+var serverMates = require("./server-mates");
+var serverAdmin = require("./server-admin");
+var serverSettings = require("./server-settings");
+var serverPalette = require("./server-palette");
 
 var { CONFIG_DIR } = require("./config");
 var { provisionLinuxUser } = require("./os-users");
@@ -21,23 +26,7 @@ var publicDir = path.join(__dirname, "public");
 var bundledThemesDir = path.join(__dirname, "themes");
 var userThemesDir = path.join(CONFIG_DIR, "themes");
 
-// --- Skills proxy cache & helpers ---
-var skillsCache = {};
-
-function httpGet(url) {
-  return new Promise(function (resolve, reject) {
-    var mod = url.startsWith("https") ? https : http;
-    mod.get(url, { headers: { "User-Agent": "Clay/1.0" } }, function (resp) {
-      if (resp.statusCode >= 300 && resp.statusCode < 400 && resp.headers.location) {
-        return httpGet(resp.headers.location).then(resolve, reject);
-      }
-      var chunks = [];
-      resp.on("data", function (c) { chunks.push(c); });
-      resp.on("end", function () { resolve(Buffer.concat(chunks).toString("utf8")); });
-      resp.on("error", reject);
-    }).on("error", reject);
-  });
-}
+// --- HTTP helpers (used by skills proxy and extension download) ---
 
 function httpGetBinary(url) {
   return new Promise(function (resolve, reject) {
@@ -57,135 +46,6 @@ function httpGetBinary(url) {
   });
 }
 
-function fetchSkillsPage(url) {
-  return httpGet(url).then(function (html) {
-    // Data is inside self.__next_f.push() with escaped quotes: \"initialSkills\":[{\"source\":...}]
-    var marker = 'initialSkills';
-    var idx = html.indexOf(marker);
-    if (idx < 0) return { skills: [] };
-
-    // Find the start of the array: look for \\\":[
-    var arrStart = html.indexOf(':[', idx);
-    if (arrStart < 0) return { skills: [] };
-    arrStart += 1; // point to '['
-
-    // Find matching ']' — track bracket depth
-    var depth = 0;
-    var arrEnd = -1;
-    for (var i = arrStart; i < html.length; i++) {
-      var ch = html[i];
-      if (ch === '[') depth++;
-      else if (ch === ']') {
-        depth--;
-        if (depth === 0) { arrEnd = i + 1; break; }
-      }
-    }
-    if (arrEnd < 0) return { skills: [] };
-
-    var raw = html.substring(arrStart, arrEnd);
-    // Unescape: \\\" → " and \\\\ → backslash
-    var unescaped = raw.replace(/\\\\"/g, '__BSLASH_QUOTE__').replace(/\\"/g, '"').replace(/__BSLASH_QUOTE__/g, '\\"');
-
-    try {
-      return { skills: JSON.parse(unescaped) };
-    } catch (e) {
-      return { skills: [] };
-    }
-  });
-}
-
-function fetchSkillDetail(url) {
-  return httpGet(url).then(function (html) {
-    var result = {};
-
-    // Title: "skill-name by owner/repo"
-    var titleMatch = html.match(/<title>([^<]+)<\/title>/);
-    if (titleMatch) {
-      var parts = titleMatch[1].split(" by ");
-      result.name = parts[0].trim();
-    }
-
-    // Description from meta
-    var descMatch = html.match(/meta name="description" content="([^"]+)"/);
-    if (descMatch) result.description = descMatch[1];
-
-    // Install command
-    var cmdMatch = html.match(/npx skills add [^ ]+ --skill [^ "<]+/);
-    if (cmdMatch) result.command = cmdMatch[0];
-
-    // Weekly installs: "Weekly Installs</span></div><div ...>VALUE</div>"
-    var wiMatch = html.match(/Weekly Installs<\/span><\/div><div[^>]*>([\d,.]+K?)<\/div>/);
-    if (wiMatch) result.weeklyInstalls = wiMatch[1];
-
-    // GitHub Stars: after SVG icon, inside <span>X.XK</span>
-    var gsIdx = html.indexOf("GitHub Stars");
-    if (gsIdx > 0) {
-      var gsRegion = html.substring(gsIdx, gsIdx + 1000);
-      var gsVal = gsRegion.match(/<span>(\d[\d,.]*K?)<\/span>/);
-      if (gsVal) result.githubStars = gsVal[1];
-    }
-
-    // First Seen
-    var fsMatch = html.match(/First Seen<\/span><\/div><div[^>]*>([^<]+)<\/div>/);
-    if (fsMatch) result.firstSeen = fsMatch[1].trim();
-
-    // Repository: from title "by owner/repo"
-    if (titleMatch) {
-      var byParts = titleMatch[1].split(" by ");
-      if (byParts[1]) result.repository = byParts[1].trim();
-    }
-
-    // Security audits: "text-foreground truncate">NAME</span><span ...>STATUS</span>"
-    var audits = [];
-    var auditRegex = /class="text-sm font-medium text-foreground truncate">([^<]+)<\/span><span class="[^"]*">(\w+)<\/span>/g;
-    var am;
-    while ((am = auditRegex.exec(html)) !== null) {
-      audits.push({ name: am[1], status: am[2].toLowerCase() });
-    }
-    if (audits.length) result.audits = audits;
-
-    // Installed on: "text-foreground">NAME</span><span class="text-muted-foreground font-mono">COUNT</span>
-    var ioIdx = html.indexOf("Installed On");
-    if (ioIdx > 0) {
-      var ioRegion = html.substring(ioIdx, ioIdx + 3000);
-      var platforms = [];
-      var platRegex = /text-foreground">([^<]+)<\/span><span class="text-muted-foreground font-mono">([\d,.]+K?)<\/span>/g;
-      var pm;
-      while ((pm = platRegex.exec(ioRegion)) !== null) {
-        platforms.push({ name: pm[1], installs: pm[2] });
-      }
-      if (platforms.length) result.installedOn = platforms;
-    }
-
-    // SKILL.md content: rendered HTML inside the main content area
-    var skillMdIdx = html.indexOf("SKILL.md");
-    if (skillMdIdx > 0) {
-      // Find the prose content div after SKILL.md marker
-      var proseIdx = html.indexOf("prose", skillMdIdx);
-      if (proseIdx > 0) {
-        var proseStart = html.indexOf(">", proseIdx) + 1;
-        // Find the closing of the prose div (heuristic: next major section boundary)
-        var endMarkers = ["<div class=\"bg-background", "<div class=\"sticky"];
-        var proseEnd = html.length;
-        for (var em = 0; em < endMarkers.length; em++) {
-          var endIdx = html.indexOf(endMarkers[em], proseStart);
-          if (endIdx > 0 && endIdx < proseEnd) proseEnd = endIdx;
-        }
-        var rawMd = html.substring(proseStart, proseEnd);
-        // Rebase relative URLs to absolute (skills.sh base)
-        result.skillMd = rawMd
-          .replace(/src="(?!https?:\/\/|data:)([^"]+)"/g, function (m, p) {
-            return 'src="' + new URL(p, url).href + '"';
-          })
-          .replace(/href="(?!https?:\/\/|mailto:|#)([^"]+)"/g, function (m, p) {
-            return 'href="' + new URL(p, url).href + '"';
-          });
-      }
-    }
-
-    return result;
-  });
-}
 
 var MIME_TYPES = {
   ".html": "text/html",
@@ -202,134 +62,8 @@ var MIME_TYPES = {
   ".ico": "image/x-icon",
 };
 
-function generateAuthToken(pin) {
-  var salt = crypto.randomBytes(16).toString("hex");
-  var hash = crypto.scryptSync("clay:" + pin, salt, 64).toString("hex");
-  return salt + ":" + hash;
-}
-
-function verifyPin(pin, storedHash) {
-  if (!storedHash) return false;
-  // New scrypt format: salt_hex:hash_hex (contains colon)
-  if (storedHash.indexOf(":") !== -1) {
-    var parts = storedHash.split(":");
-    var salt = parts[0];
-    var hash = parts[1];
-    var derived = crypto.scryptSync("clay:" + pin, salt, 64).toString("hex");
-    return crypto.timingSafeEqual(Buffer.from(derived, "hex"), Buffer.from(hash, "hex"));
-  }
-  // Legacy SHA256 format (no colon)
-  var legacyHash = crypto.createHash("sha256").update("clay:" + pin).digest("hex");
-  var match = crypto.timingSafeEqual(Buffer.from(legacyHash, "hex"), Buffer.from(storedHash, "hex"));
-  return match;
-}
-
-function parseCookies(req) {
-  var cookies = {};
-  var header = req.headers.cookie || "";
-  header.split(";").forEach(function (part) {
-    var pair = part.trim().split("=");
-    if (pair.length === 2) cookies[pair[0]] = pair[1];
-  });
-  return cookies;
-}
-
-function isAuthed(req, authToken) {
-  if (!authToken) return true;
-  var cookies = parseCookies(req);
-  return cookies["relay_auth"] === authToken;
-}
-
-// --- Multi-user auth helpers ---
-// Multi-user auth tokens: persisted to disk so they survive restarts
-var _isDevMode = require("./config").isDevMode;
-var TOKENS_FILE = path.join(CONFIG_DIR, _isDevMode ? "auth-tokens-dev.json" : "auth-tokens.json");
-var MULTI_USER_COOKIE = _isDevMode ? "relay_auth_user_dev" : "relay_auth_user";
-var multiUserTokens = {}; // token → userId
-
-function loadTokens() {
-  try {
-    var raw = fs.readFileSync(TOKENS_FILE, "utf8");
-    var data = JSON.parse(raw);
-    if (data && typeof data === "object") {
-      multiUserTokens = data;
-    }
-  } catch (e) {
-    multiUserTokens = {};
-  }
-}
-
-function saveTokens() {
-  try {
-    fs.mkdirSync(path.dirname(TOKENS_FILE), { recursive: true });
-    var tmpPath = TOKENS_FILE + ".tmp";
-    fs.writeFileSync(tmpPath, JSON.stringify(multiUserTokens));
-    fs.renameSync(tmpPath, TOKENS_FILE);
-  } catch (e) {}
-}
-
-loadTokens();
-
-function createMultiUserSession(userId, tlsOptions) {
-  var token = users.generateUserAuthToken(userId);
-  multiUserTokens[token] = userId;
-  saveTokens();
-  var cookie = MULTI_USER_COOKIE + "=" + token + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : "");
-  return { token: token, cookie: cookie };
-}
-
-function getMultiUserFromReq(req) {
-  var cookies = parseCookies(req);
-  var token = cookies[MULTI_USER_COOKIE];
-  if (!token) return null;
-  var userId = multiUserTokens[token];
-  if (!userId) return null;
-  var user = users.findUserById(userId);
-  return user || null;
-}
-
-function isMultiUserAuthed(req) {
-  return !!getMultiUserFromReq(req);
-}
-
-function revokeUserTokens(userId) {
-  var changed = false;
-  for (var token in multiUserTokens) {
-    if (multiUserTokens[token] === userId) {
-      delete multiUserTokens[token];
-      changed = true;
-    }
-  }
-  if (changed) saveTokens();
-}
-
-// --- PIN rate limiting ---
-var pinAttempts = {}; // ip → { count, lastAttempt }
-var PIN_MAX_ATTEMPTS = 5;
-var PIN_LOCKOUT_MS = 15 * 60 * 1000; // 15 minutes
-
-function checkPinRateLimit(ip) {
-  var entry = pinAttempts[ip];
-  if (!entry) return null;
-  if (entry.count >= PIN_MAX_ATTEMPTS) {
-    var elapsed = Date.now() - entry.lastAttempt;
-    if (elapsed < PIN_LOCKOUT_MS) {
-      return Math.ceil((PIN_LOCKOUT_MS - elapsed) / 1000);
-    }
-    delete pinAttempts[ip];
-  }
-  return null;
-}
-
-function recordPinFailure(ip) {
-  if (!pinAttempts[ip]) pinAttempts[ip] = { count: 0, lastAttempt: 0 };
-  pinAttempts[ip].count++;
-  pinAttempts[ip].lastAttempt = Date.now();
-}
-
-function clearPinFailures(ip) {
-  delete pinAttempts[ip];
-}
+var generateAuthToken = serverAuth.generateAuthToken;
+var verifyPin = serverAuth.verifyPin;
 
 function serveStatic(urlPath, res) {
   if (urlPath === "/") urlPath = "/index.html";
@@ -426,118 +160,71 @@ function createServer(opts) {
   var onUserDeleted = opts.onUserDeleted || null;
   var getRemovedProjects = opts.getRemovedProjects || function () { return []; };
 
-  var authToken = pinHash || null;
-
-  // --- Admin password recovery (in-memory, one-time) ---
-  var recovery = null; // { urlPath, password }
-
-  function setRecovery(urlPath, password) {
-    recovery = { urlPath: urlPath, password: password };
-  }
-
-  function clearRecovery() {
-    recovery = null;
-  }
-
-  function recoveryPageHtml() {
-    return '<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">'
-      + '<title>Admin Password Recovery</title>'
-      + '<style>'
-      + '*{margin:0;padding:0;box-sizing:border-box}'
-      + 'body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#0a0a0a;color:#e5e5e5;display:flex;align-items:center;justify-content:center;min-height:100vh}'
-      + '.card{background:#171717;border:1px solid #262626;border-radius:12px;padding:32px;width:100%;max-width:380px}'
-      + 'h1{font-size:18px;font-weight:600;margin-bottom:4px}'
-      + '.sub{font-size:13px;color:#737373;margin-bottom:24px}'
-      + 'label{display:block;font-size:13px;color:#a3a3a3;margin-bottom:6px}'
-      + 'input{width:100%;padding:10px 12px;background:#0a0a0a;border:1px solid #333;border-radius:8px;color:#e5e5e5;font-size:14px;outline:none;margin-bottom:16px}'
-      + 'input:focus{border-color:#7c3aed}'
-      + 'button{width:100%;padding:10px;background:#7c3aed;color:#fff;border:none;border-radius:8px;font-size:14px;font-weight:500;cursor:pointer}'
-      + 'button:hover{background:#6d28d9}'
-      + 'button:disabled{opacity:.5;cursor:not-allowed}'
-      + '.error{color:#ef4444;font-size:13px;margin-bottom:12px;display:none}'
-      + '.success{text-align:center;color:#22c55e;font-size:15px}'
-      + '.hidden{display:none}'
-      + '</style></head><body>'
-      + '<div class="card">'
-      + '<div id="step-verify">'
-      + '<h1>Admin Recovery</h1>'
-      + '<p class="sub">Enter the recovery password shown in your terminal.</p>'
-      + '<div id="err-verify" class="error"></div>'
-      + '<label for="recovery-pw">Recovery password</label>'
-      + '<input id="recovery-pw" type="text" autocomplete="off" spellcheck="false" autofocus>'
-      + '<button id="btn-verify">Verify</button>'
-      + '</div>'
-      + '<div id="step-reset" class="hidden">'
-      + '<h1>Reset Admin PIN</h1>'
-      + '<p class="sub">Enter a new 6-digit PIN for the admin account.</p>'
-      + '<div id="err-reset" class="error"></div>'
-      + '<label for="new-pin">New PIN</label>'
-      + '<input id="new-pin" type="password" maxlength="6" pattern="\\d{6}" inputmode="numeric" placeholder="6 digits">'
-      + '<label for="confirm-pin">Confirm PIN</label>'
-      + '<input id="confirm-pin" type="password" maxlength="6" pattern="\\d{6}" inputmode="numeric" placeholder="6 digits">'
-      + '<button id="btn-reset">Reset PIN</button>'
-      + '</div>'
-      + '<div id="step-done" class="hidden">'
-      + '<p class="success">PIN has been reset successfully. You can now log in with your new PIN.</p>'
-      + '</div>'
-      + '</div>'
-      + '<script>'
-      + 'var pw="";\n'
-      + 'document.getElementById("btn-verify").onclick=function(){\n'
-      + '  var el=document.getElementById("recovery-pw");\n'
-      + '  pw=el.value.trim();\n'
-      + '  if(!pw)return;\n'
-      + '  this.disabled=true;\n'
-      + '  fetch(location.pathname,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({step:"verify",password:pw})})\n'
-      + '  .then(function(r){return r.json()}).then(function(d){\n'
-      + '    if(d.ok){document.getElementById("step-verify").classList.add("hidden");document.getElementById("step-reset").classList.remove("hidden");document.getElementById("new-pin").focus()}\n'
-      + '    else{var e=document.getElementById("err-verify");e.textContent=d.error||"Invalid password";e.style.display="block";document.getElementById("btn-verify").disabled=false}\n'
-      + '  }).catch(function(){document.getElementById("btn-verify").disabled=false})\n'
-      + '};\n'
-      + 'document.getElementById("recovery-pw").addEventListener("keydown",function(e){if(e.key==="Enter")document.getElementById("btn-verify").click()});\n'
-      + 'document.getElementById("btn-reset").onclick=function(){\n'
-      + '  var pin=document.getElementById("new-pin").value;\n'
-      + '  var confirm=document.getElementById("confirm-pin").value;\n'
-      + '  var errEl=document.getElementById("err-reset");\n'
-      + '  if(!/^\\d{6}$/.test(pin)){errEl.textContent="PIN must be exactly 6 digits";errEl.style.display="block";return}\n'
-      + '  if(pin!==confirm){errEl.textContent="PINs do not match";errEl.style.display="block";return}\n'
-      + '  this.disabled=true;errEl.style.display="none";\n'
-      + '  fetch(location.pathname,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({step:"reset",password:pw,pin:pin})})\n'
-      + '  .then(function(r){return r.json()}).then(function(d){\n'
-      + '    if(d.ok){document.getElementById("step-reset").classList.add("hidden");document.getElementById("step-done").classList.remove("hidden")}\n'
-      + '    else{errEl.textContent=d.error||"Failed";errEl.style.display="block";document.getElementById("btn-reset").disabled=false}\n'
-      + '  }).catch(function(){document.getElementById("btn-reset").disabled=false})\n'
-      + '};\n'
-      + 'document.getElementById("confirm-pin").addEventListener("keydown",function(e){if(e.key==="Enter")document.getElementById("btn-reset").click()});\n'
-      + '</script></body></html>';
-  }
+  // --- Auth module ---
+  var auth = serverAuth.attachAuth({
+    users: users,
+    smtp: smtp,
+    pages: pages,
+    tlsOptions: tlsOptions,
+    osUsers: osUsers,
+    pinHash: pinHash,
+    provisionLinuxUser: provisionLinuxUser,
+    onUpgradePin: onUpgradePin,
+    onUserProvisioned: onUserProvisioned,
+  });
+  var getMultiUserFromReq = auth.getMultiUserFromReq;
+  var isRequestAuthed = auth.isRequestAuthed;
+  var parseCookies = auth.parseCookies;
 
   var realVersion = require("../package.json").version;
   var currentVersion = debug ? "0.0.9" : realVersion;
 
   var caContent = caPath ? (function () { try { return fs.readFileSync(caPath); } catch (e) { return null; } })() : null;
-  var pinPage = pinPageHtml();
-  var adminSetupPage = adminSetupPageHtml();
-  var loginPage = multiUserLoginPageHtml();
-  var smtpLoginPage = smtpLoginPageHtml();
-
-  // Multi-user auth: determine which page to show for unauthenticated requests
-  function getAuthPage() {
-    if (!users.isMultiUser()) return pinPage;
-    if (!users.hasAdmin()) return adminSetupPage;
-    if (smtp.isEmailLoginEnabled()) return smtpLoginPage;
-    return loginPage;
-  }
-
-  // Unified auth check: works in both single-user and multi-user mode
-  function isRequestAuthed(req) {
-    if (users.isMultiUser()) return isMultiUserAuthed(req);
-    return isAuthed(req, authToken);
-  }
 
   // --- Project registry ---
   var projects = new Map(); // slug → projectContext
 
+  // --- Admin module ---
+  var admin = serverAdmin.attachAdmin({
+    users: users,
+    smtp: smtp,
+    getMultiUserFromReq: getMultiUserFromReq,
+    projects: projects,
+    osUsers: osUsers,
+    tlsOptions: tlsOptions,
+    portNum: portNum,
+    provisionLinuxUser: provisionLinuxUser,
+    onUserProvisioned: onUserProvisioned,
+    onUserDeleted: onUserDeleted,
+    revokeUserTokens: auth.revokeUserTokens,
+    onSetProjectVisibility: onSetProjectVisibility,
+    onSetProjectAllowedUsers: onSetProjectAllowedUsers,
+    onGetProjectAccess: onGetProjectAccess,
+    onProjectOwnerChanged: onProjectOwnerChanged,
+  });
+
+  var skills = serverSkills.attachSkills({
+    users: users,
+    osUsers: osUsers,
+    getMultiUserFromReq: getMultiUserFromReq,
+  });
+
+  var settings = serverSettings.attachSettings({
+    users: users,
+    mates: mates,
+    getMultiUserFromReq: getMultiUserFromReq,
+    projects: projects,
+    opts: opts,
+    CONFIG_DIR: CONFIG_DIR,
+  });
+
+  var palette = serverPalette.attachPalette({
+    users: users,
+    projects: projects,
+    getMultiUserFromReq: getMultiUserFromReq,
+    onGetProjectAccess: onGetProjectAccess,
+  });
+
   // --- Push module (global) ---
   var pushModule = null;
   try {
@@ -545,6 +232,13 @@ function createServer(opts) {
     pushModule = initPush();
   } catch (e) {}
 
+  // --- Notifications module (global singleton, shared by all projects) ---
+  var { attachNotifications: _attachNotifications } = require("./project-notifications");
+  var _globalNotifications = _attachNotifications({
+    broadcastAll: function (msg) { broadcastAll(msg); },
+    pushModule: pushModule,
+  });
+
   // --- Security headers ---
   var securityHeaders = {
     "X-Content-Type-Options": "nosniff",
@@ -567,546 +261,88 @@ function createServer(opts) {
     setSecurityHeaders(res);
     var fullUrl = req.url.split("?")[0];
 
-    // --- Admin password recovery ---
-    if (recovery && fullUrl === "/recover/" + recovery.urlPath) {
-      if (req.method === "GET") {
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(recoveryPageHtml());
-        return;
-      }
-      if (req.method === "POST") {
-        var ip = req.socket.remoteAddress || "";
-        var remaining = checkPinRateLimit(ip);
-        if (remaining !== null) {
-          res.writeHead(429, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
-          return;
-        }
-        var body = "";
-        req.on("data", function (chunk) { body += chunk; });
-        req.on("end", function () {
-          try {
-            var data = JSON.parse(body);
-            if (data.step === "verify") {
-              if (!data.password || data.password !== recovery.password) {
-                recordPinFailure(ip);
-                res.writeHead(401, { "Content-Type": "application/json" });
-                res.end('{"error":"Invalid recovery password"}');
-                return;
-              }
-              clearPinFailures(ip);
-              res.writeHead(200, { "Content-Type": "application/json" });
-              res.end('{"ok":true}');
-            } else if (data.step === "reset") {
-              if (!data.password || data.password !== recovery.password) {
-                res.writeHead(401, { "Content-Type": "application/json" });
-                res.end('{"error":"Invalid recovery password"}');
-                return;
-              }
-              if (!data.pin || !/^\d{6}$/.test(data.pin)) {
-                res.writeHead(400, { "Content-Type": "application/json" });
-                res.end('{"error":"PIN must be exactly 6 digits"}');
-                return;
-              }
-              var admin = users.findAdmin();
-              if (!admin) {
-                res.writeHead(400, { "Content-Type": "application/json" });
-                res.end('{"error":"No admin account found"}');
-                return;
-              }
-              users.updateUserPin(admin.id, data.pin);
-              recovery = null;
-              res.writeHead(200, { "Content-Type": "application/json" });
-              res.end('{"ok":true}');
-            } else {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end('{"error":"Invalid step"}');
-            }
-          } catch (e) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Invalid request"}');
-          }
-        });
-        return;
-      }
+    // --- Auth routes (delegated to server-auth) ---
+    if (auth.handleRequest(req, res, fullUrl)) return;
+    // CA certificate download
+    if (req.url === "/ca/download" && req.method === "GET" && caContent) {
+      res.writeHead(200, {
+        "Content-Type": "application/x-pem-file",
+        "Content-Disposition": 'attachment; filename="clay-ca.pem"',
+      });
+      res.end(caContent);
+      return;
     }
 
-    // Global auth endpoint
-    if (req.method === "POST" && req.url === "/auth") {
-      var ip = req.socket.remoteAddress || "";
-      var remaining = checkPinRateLimit(ip);
-      if (remaining !== null) {
-        res.writeHead(429, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
+    // Chrome extension download (proxy from GitHub)
+    if (fullUrl === "/api/extension/download" && req.method === "GET") {
+      if (!isRequestAuthed(req)) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Unauthorized" }));
         return;
       }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (authToken && verifyPin(data.pin, authToken)) {
-            clearPinFailures(ip);
-            // Auto-upgrade legacy SHA256 hash to scrypt
-            if (authToken.indexOf(":") === -1) {
-              var upgraded = generateAuthToken(data.pin);
-              authToken = upgraded;
-              if (typeof onUpgradePin === "function") {
-                onUpgradePin(upgraded);
-              }
-            }
-            res.writeHead(200, {
-              "Set-Cookie": "relay_auth=" + authToken + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : ""),
-              "Content-Type": "application/json",
-            });
-            res.end('{"ok":true}');
-          } else {
-            recordPinFailure(ip);
-            var attemptsLeft = PIN_MAX_ATTEMPTS - (pinAttempts[ip] ? pinAttempts[ip].count : 0);
-            res.writeHead(401, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, attemptsLeft: Math.max(attemptsLeft, 0) }));
-          }
-        } catch (e) {
-          res.writeHead(400);
-          res.end("Bad request");
-        }
+      var archiveUrl = "https://github.com/chadbyte/clay-chrome/archive/refs/heads/main.zip";
+      httpGetBinary(archiveUrl).then(function (buf) {
+        res.writeHead(200, {
+          "Content-Type": "application/zip",
+          "Content-Disposition": 'attachment; filename="clay-chrome-extension.zip"',
+          "Content-Length": buf.length,
+        });
+        res.end(buf);
+      }).catch(function (err) {
+        res.writeHead(502, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Failed to download extension: " + (err.message || "unknown error") }));
       });
       return;
     }
 
-    // --- Multi-user auth endpoints ---
-
-    // Admin setup (first-time multi-user setup)
-    if (req.method === "POST" && fullUrl === "/auth/setup") {
-      if (!users.isMultiUser()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Multi-user mode is not enabled"}');
-        return;
-      }
-      if (users.hasAdmin()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin already exists"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (!users.validateSetupCode(data.setupCode)) {
-            res.writeHead(401, { "Content-Type": "application/json" });
-            res.end('{"error":"Invalid setup code"}');
-            return;
-          }
-          if (!data.username || data.username.trim().length < 1 || data.username.length > 100) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Username is required"}');
-            return;
-          }
-          if (!data.pin || !/^\d{6}$/.test(data.pin)) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"PIN must be exactly 6 digits"}');
-            return;
-          }
-          // Migrate existing profile.json to admin profile
-          var adminProfile = undefined;
-          try {
-            var existingProfile = JSON.parse(fs.readFileSync(path.join(CONFIG_DIR, "profile.json"), "utf8"));
-            adminProfile = {
-              name: data.displayName || data.username,
-              lang: existingProfile.lang || "en-US",
-              avatarColor: existingProfile.avatarColor || "#7c3aed",
-              avatarStyle: existingProfile.avatarStyle || "thumbs",
-              avatarSeed: existingProfile.avatarSeed || crypto.randomBytes(4).toString("hex"),
-            };
-          } catch (e) {}
-          var result = users.createAdmin({
-            username: data.username.trim(),
-            displayName: data.displayName || data.username.trim(),
-            pin: data.pin,
-            profile: adminProfile,
-          });
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          // Auto-provision Linux account if OS users mode is enabled
-          if (osUsers && !result.user.linuxUser) {
-            var provision = provisionLinuxUser(result.user.username);
-            if (provision.ok) {
-              users.updateLinuxUser(result.user.id, provision.linuxUser);
-              if (onUserProvisioned) onUserProvisioned(result.user.id, provision.linuxUser);
-            }
-          }
-          users.clearSetupCode();
-          var session = createMultiUserSession(result.user.id, tlsOptions);
-          res.writeHead(200, {
-            "Set-Cookie": session.cookie,
-            "Content-Type": "application/json",
-          });
-          res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
+    // CORS preflight for cross-origin requests (HTTP onboarding → HTTPS)
+    if (req.method === "OPTIONS") {
+      res.writeHead(204, {
+        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Methods": "GET, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type",
+        "Access-Control-Max-Age": "86400",
       });
+      res.end();
       return;
     }
 
-    // Multi-user login
-    if (req.method === "POST" && fullUrl === "/auth/login") {
-      if (!users.isMultiUser()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Multi-user mode is not enabled"}');
-        return;
-      }
-      var ip = req.socket.remoteAddress || "";
-      var remaining = checkPinRateLimit(ip);
-      if (remaining !== null) {
-        res.writeHead(429, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          var user = users.authenticateUser(data.username, data.pin);
-          if (!user) {
-            recordPinFailure(ip);
-            var attemptsLeft = PIN_MAX_ATTEMPTS - (pinAttempts[ip] ? pinAttempts[ip].count : 0);
-            res.writeHead(401, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: "Invalid username or PIN", attemptsLeft: Math.max(attemptsLeft, 0) }));
-            return;
-          }
-          clearPinFailures(ip);
-          var session = createMultiUserSession(user.id, tlsOptions);
-          var loginResp = { ok: true, user: { id: user.id, username: user.username, role: user.role } };
-          if (user.mustChangePin) loginResp.mustChangePin = true;
-          res.writeHead(200, {
-            "Set-Cookie": session.cookie,
-            "Content-Type": "application/json",
-          });
-          res.end(JSON.stringify(loginResp));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
+    // Setup page
+    if (fullUrl === "/setup" && req.method === "GET") {
+      var host = req.headers.host || "localhost";
+      var hostname = host.split(":")[0];
+      var protocol = tlsOptions ? "https" : "http";
+      var setupUrl = protocol + "://" + hostname + ":" + portNum;
+      var lanMode = /[?&]mode=lan/.test(req.url);
+      res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Access-Control-Allow-Origin": "*",
       });
+      res.end(pages.setupPageHtml(setupUrl, setupUrl, !!caContent, lanMode));
       return;
     }
 
-    // Request OTP code (SMTP login)
-    if (req.method === "POST" && fullUrl === "/auth/request-otp") {
-      if (!users.isMultiUser() || !smtp.isEmailLoginEnabled()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"OTP login not available"}');
-        return;
-      }
-      var ip = req.socket.remoteAddress || "";
-      var remaining = checkPinRateLimit(ip);
-      if (remaining !== null) {
-        res.writeHead(429, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (!data.email) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Email is required"}');
-            return;
-          }
-          var user = users.findUserByEmail(data.email);
-          if (!user) {
-            // Don't reveal whether user exists — still say ok
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end('{"ok":true}');
-            return;
-          }
-          var result = smtp.requestOtp(data.email);
-          if (result.error) {
-            res.writeHead(429, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          smtp.sendOtpEmail(data.email, result.code).then(function () {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end('{"ok":true}');
-          }).catch(function () {
-            res.writeHead(500, { "Content-Type": "application/json" });
-            res.end('{"error":"Failed to send email"}');
-          });
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
+    // PWA install guide (builtin cert mode, no CA step needed)
+    if (fullUrl === "/pwa" && req.method === "GET") {
+      var host = req.headers.host || "localhost";
+      var hostname = host.split(":")[0];
+      var protocol = tlsOptions ? "https" : "http";
+      var pwaUrl = protocol + "://" + hostname + ":" + portNum;
+      res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
       });
+      res.end(pages.setupPageHtml(pwaUrl, pwaUrl, false, true));
       return;
     }
 
-    // Verify OTP code (SMTP login)
-    if (req.method === "POST" && fullUrl === "/auth/verify-otp") {
-      if (!users.isMultiUser() || !smtp.isEmailLoginEnabled()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"OTP login not available"}');
-        return;
-      }
-      var ip = req.socket.remoteAddress || "";
-      var remaining = checkPinRateLimit(ip);
-      if (remaining !== null) {
-        res.writeHead(429, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (!data.email || !data.code) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Email and code are required"}');
-            return;
-          }
-          var otpResult = smtp.verifyOtp(data.email, data.code);
-          if (!otpResult.valid) {
-            recordPinFailure(ip);
-            res.writeHead(401, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: otpResult.error, attemptsLeft: otpResult.attemptsLeft }));
-            return;
-          }
-          var user = users.findUserByEmail(data.email);
-          if (!user) {
-            res.writeHead(401, { "Content-Type": "application/json" });
-            res.end('{"ok":false,"error":"Account not found"}');
-            return;
-          }
-          clearPinFailures(ip);
-          var session = createMultiUserSession(user.id, tlsOptions);
-          res.writeHead(200, {
-            "Set-Cookie": session.cookie,
-            "Content-Type": "application/json",
-          });
-          res.end(JSON.stringify({ ok: true, user: { id: user.id, username: user.username, role: user.role } }));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Invite registration
-    if (req.method === "POST" && fullUrl === "/auth/register") {
-      if (!users.isMultiUser()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Multi-user mode is not enabled"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          var validation = users.validateInvite(data.inviteCode);
-          if (!validation.valid) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: validation.error }));
-            return;
-          }
-          if (!data.username || data.username.trim().length < 1 || data.username.length > 100) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Username is required"}');
-            return;
-          }
-          var result;
-          if (smtp.isEmailLoginEnabled() && !data.pin) {
-            // SMTP mode: username + email required, no PIN
-            if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end('{"error":"A valid email address is required"}');
-              return;
-            }
-            result = users.createUserWithoutPin({
-              username: data.username.trim(),
-              email: data.email,
-              displayName: data.displayName || data.username.trim(),
-              role: "user",
-            });
-          } else {
-            // PIN mode: username + PIN, no email required
-            if (!data.pin || !/^\d{6}$/.test(data.pin)) {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end('{"error":"PIN must be exactly 6 digits"}');
-              return;
-            }
-            result = users.createUser({
-              username: data.username.trim(),
-              email: data.email || null,
-              displayName: data.displayName || data.username.trim(),
-              pin: data.pin,
-              role: "user",
-            });
-          }
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          // Auto-provision Linux account if OS users mode is enabled
-          if (osUsers && !result.user.linuxUser) {
-            var provision = provisionLinuxUser(result.user.username);
-            if (provision.ok) {
-              users.updateLinuxUser(result.user.id, provision.linuxUser);
-              if (onUserProvisioned) onUserProvisioned(result.user.id, provision.linuxUser);
-            }
-          }
-          users.markInviteUsed(data.inviteCode);
-          var session = createMultiUserSession(result.user.id, tlsOptions);
-          res.writeHead(200, {
-            "Set-Cookie": session.cookie,
-            "Content-Type": "application/json",
-          });
-          res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Logout
-    if (req.method === "POST" && fullUrl === "/auth/logout") {
-      if (users.isMultiUser()) {
-        var cookies = parseCookies(req);
-        var token = cookies[MULTI_USER_COOKIE];
-        if (token && multiUserTokens[token]) {
-          delete multiUserTokens[token];
-          saveTokens();
-        }
-        res.writeHead(200, {
-          "Set-Cookie": MULTI_USER_COOKIE + "=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
-          "Content-Type": "application/json",
-        });
-      } else {
-        res.writeHead(200, {
-          "Set-Cookie": "relay_auth=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
-          "Content-Type": "application/json",
-        });
-      }
-      res.end('{"ok":true}');
-      return;
-    }
-
-    // Invite page (magic link)
-    if (req.method === "GET" && fullUrl.indexOf("/invite/") === 0) {
-      var inviteCode = fullUrl.substring("/invite/".length);
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "text/plain" });
-        res.end("Not found");
-        return;
-      }
-      var validation = users.validateInvite(inviteCode);
-      if (!validation.valid) {
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end('<!DOCTYPE html><html><head><title>Clay</title>' +
-          '<style>body{background:#2F2E2B;color:#E8E5DE;font-family:system-ui;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}' +
-          '.c{text-align:center;max-width:360px;padding:20px}h1{color:#DA7756;margin-bottom:16px}p{color:#908B81}</style></head>' +
-          '<body><div class="c"><h1>Clay</h1><p>' + (validation.error === "Invite expired" ? "This invite link has expired." : validation.error === "Invite already used" ? "This invite link has already been used." : "Invalid invite link.") + '</p></div></body></html>');
-        return;
-      }
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(smtp.isEmailLoginEnabled() ? smtpInvitePageHtml(inviteCode) : invitePageHtml(inviteCode));
-      return;
-    }
-
-    // CA certificate download
-    if (req.url === "/ca/download" && req.method === "GET" && caContent) {
-      res.writeHead(200, {
-        "Content-Type": "application/x-pem-file",
-        "Content-Disposition": 'attachment; filename="clay-ca.pem"',
-      });
-      res.end(caContent);
-      return;
-    }
-
-    // Chrome extension download (proxy from GitHub)
-    if (fullUrl === "/api/extension/download" && req.method === "GET") {
-      if (!isRequestAuthed(req)) {
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Unauthorized" }));
-        return;
-      }
-      var archiveUrl = "https://github.com/chadbyte/clay-chrome/archive/refs/heads/main.zip";
-      httpGetBinary(archiveUrl).then(function (buf) {
-        res.writeHead(200, {
-          "Content-Type": "application/zip",
-          "Content-Disposition": 'attachment; filename="clay-chrome-extension.zip"',
-          "Content-Length": buf.length,
-        });
-        res.end(buf);
-      }).catch(function (err) {
-        res.writeHead(502, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Failed to download extension: " + (err.message || "unknown error") }));
-      });
-      return;
-    }
-
-    // CORS preflight for cross-origin requests (HTTP onboarding → HTTPS)
-    if (req.method === "OPTIONS") {
-      res.writeHead(204, {
-        "Access-Control-Allow-Origin": "*",
-        "Access-Control-Allow-Methods": "GET, OPTIONS",
-        "Access-Control-Allow-Headers": "Content-Type",
-        "Access-Control-Max-Age": "86400",
-      });
-      res.end();
-      return;
-    }
-
-    // Setup page
-    if (fullUrl === "/setup" && req.method === "GET") {
-      var host = req.headers.host || "localhost";
-      var hostname = host.split(":")[0];
-      var protocol = tlsOptions ? "https" : "http";
-      var setupUrl = protocol + "://" + hostname + ":" + portNum;
-      var lanMode = /[?&]mode=lan/.test(req.url);
-      res.writeHead(200, {
-        "Content-Type": "text/html; charset=utf-8",
-        "Access-Control-Allow-Origin": "*",
-      });
-      res.end(setupPageHtml(setupUrl, setupUrl, !!caContent, lanMode));
-      return;
-    }
-
-    // PWA install guide (builtin cert mode, no CA step needed)
-    if (fullUrl === "/pwa" && req.method === "GET") {
-      var host = req.headers.host || "localhost";
-      var hostname = host.split(":")[0];
-      var protocol = tlsOptions ? "https" : "http";
-      var pwaUrl = protocol + "://" + hostname + ":" + portNum;
-      res.writeHead(200, {
-        "Content-Type": "text/html; charset=utf-8",
-      });
-      res.end(setupPageHtml(pwaUrl, pwaUrl, false, true));
-      return;
-    }
-
-    // Global push endpoints (used by setup page)
-    if (req.method === "GET" && fullUrl === "/api/vapid-public-key" && pushModule) {
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ publicKey: pushModule.publicKey }));
-      return;
-    }
-
-    if (req.method === "POST" && fullUrl === "/api/push-subscribe" && pushModule) {
+    // Global push endpoints (used by setup page)
+    if (req.method === "GET" && fullUrl === "/api/vapid-public-key" && pushModule) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ publicKey: pushModule.publicKey }));
+      return;
+    }
+
+    if (req.method === "POST" && fullUrl === "/api/push-subscribe" && pushModule) {
       var body = "";
       req.on("data", function (chunk) { body += chunk; });
       req.on("end", function () {
@@ -1117,1315 +353,88 @@ function createServer(opts) {
           pushModule.addSubscription(sub, parsed.replaceEndpoint, _httpPushUser ? _httpPushUser.id : null);
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end('{"ok":true}');
-        } catch (e) {
-          res.writeHead(400);
-          res.end("Bad request");
-        }
-      });
-      return;
-    }
-
-    // Health check endpoint
-    // Unauthenticated: minimal liveness info only
-    // Authenticated: full system details (memory, pid, version, sessions)
-    if (req.method === "GET" && fullUrl === "/api/health") {
-      var health = {
-        status: "ok",
-        timestamp: new Date().toISOString(),
-      };
-      if (isRequestAuthed(req)) {
-        var mem = process.memoryUsage();
-        var activeSessions = 0;
-        projects.forEach(function (ctx) {
-          if (ctx && ctx.clients) {
-            activeSessions += ctx.clients.size || 0;
-          }
-        });
-        health.uptime = process.uptime();
-        health.version = pkg.version;
-        health.node = process.version;
-        health.sessions = activeSessions;
-        health.projects = projects.size;
-        health.memory = {
-          rss: mem.rss,
-          heapUsed: mem.heapUsed,
-          heapTotal: mem.heapTotal,
-        };
-        health.pid = process.pid;
-      }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify(health));
-      return;
-    }
-
-    // Theme list: bundled (lib/themes/) + user (~/.clay/themes/)
-    if (req.method === "GET" && fullUrl === "/api/themes") {
-      var bundled = {};
-      var custom = {};
-      // Read bundled themes
-      try {
-        var bFiles = fs.readdirSync(bundledThemesDir);
-        for (var i = 0; i < bFiles.length; i++) {
-          if (!bFiles[i].endsWith(".json")) continue;
-          try {
-            var raw = fs.readFileSync(path.join(bundledThemesDir, bFiles[i]), "utf8");
-            var id = bFiles[i].replace(/\.json$/, "");
-            bundled[id] = JSON.parse(raw);
-          } catch (e) {}
-        }
-      } catch (e) {}
-      // Read user themes (override bundled if same id)
-      try {
-        var uFiles = fs.readdirSync(userThemesDir);
-        for (var j = 0; j < uFiles.length; j++) {
-          if (!uFiles[j].endsWith(".json")) continue;
-          try {
-            var uRaw = fs.readFileSync(path.join(userThemesDir, uFiles[j]), "utf8");
-            var uid = uFiles[j].replace(/\.json$/, "");
-            custom[uid] = JSON.parse(uRaw);
-          } catch (e) {}
-        }
-      } catch (e) {}
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ bundled: bundled, custom: custom }));
-      return;
-    }
-
-    // User profile — user-scoped in multi-user mode, global in single-user mode
-    var profilePath = path.join(CONFIG_DIR, "profile.json");
-
-    if (req.method === "GET" && fullUrl === "/api/profile") {
-      if (users.isMultiUser()) {
-        var mu = getMultiUserFromReq(req);
-        if (!mu) {
-          res.writeHead(401, { "Content-Type": "application/json" });
-          res.end('{"error":"unauthorized"}');
-          return;
-        }
-        var profile = mu.profile || { name: "", lang: "en-US", avatarColor: "#7c3aed", avatarStyle: "thumbs", avatarSeed: "", avatarCustom: "" };
-        profile.username = mu.username;
-        profile.userId = mu.id;
-        profile.role = mu.role;
-        profile.autoContinueOnRateLimit = !!mu.autoContinueOnRateLimit;
-        profile.chatLayout = mu.chatLayout || "channel";
-        profile.mateOnboardingShown = !!mu.mateOnboardingShown;
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(profile));
-        return;
-      }
-      var profile = { name: "", lang: "en-US", avatarColor: "#7c3aed", avatarStyle: "thumbs", avatarSeed: "", avatarCustom: "" };
-      try {
-        var raw = fs.readFileSync(profilePath, "utf8");
-        var saved = JSON.parse(raw);
-        if (saved.name !== undefined) profile.name = saved.name;
-        if (saved.lang) profile.lang = saved.lang;
-        if (saved.avatarColor) profile.avatarColor = saved.avatarColor;
-        if (saved.avatarStyle) profile.avatarStyle = saved.avatarStyle;
-        if (saved.avatarSeed) profile.avatarSeed = saved.avatarSeed;
-        if (saved.avatarCustom) profile.avatarCustom = saved.avatarCustom;
-      } catch (e) { /* file doesn't exist yet */ }
-      // Single-user settings from daemon config
-      if (typeof opts.onGetDaemonConfig === "function") {
-        var dc = opts.onGetDaemonConfig();
-        profile.autoContinueOnRateLimit = !!dc.autoContinueOnRateLimit;
-        profile.chatLayout = dc.chatLayout || "channel";
-        profile.mateOnboardingShown = !!dc.mateOnboardingShown;
-      }
-      // Check if custom avatar file exists
-      try {
-        var avatarFiles = fs.readdirSync(path.join(CONFIG_DIR, "avatars"));
-        for (var afi = 0; afi < avatarFiles.length; afi++) {
-          if (avatarFiles[afi].startsWith("default.")) {
-            profile.avatarCustom = "/api/avatar/default?v=" + fs.statSync(path.join(CONFIG_DIR, "avatars", avatarFiles[afi])).mtimeMs;
-            break;
-          }
-        }
-      } catch (e) {}
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify(profile));
-      return;
-    }
-
-    if (req.method === "PUT" && fullUrl === "/api/profile") {
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          var profile = {};
-          if (typeof data.name === "string") profile.name = data.name.substring(0, 50);
-          if (typeof data.lang === "string") profile.lang = data.lang.substring(0, 10);
-          if (typeof data.avatarColor === "string" && /^#[0-9a-fA-F]{6}$/.test(data.avatarColor)) {
-            profile.avatarColor = data.avatarColor;
-          }
-          if (typeof data.avatarStyle === "string") profile.avatarStyle = data.avatarStyle.substring(0, 30);
-          if (typeof data.avatarSeed === "string") profile.avatarSeed = data.avatarSeed.substring(0, 30);
-          if (typeof data.avatarCustom === "string") profile.avatarCustom = data.avatarCustom;
-          if (data.avatarCustom === null || data.avatarCustom === "") profile.avatarCustom = undefined;
-          if (users.isMultiUser()) {
-            var mu = getMultiUserFromReq(req);
-            if (!mu) {
-              res.writeHead(401, { "Content-Type": "application/json" });
-              res.end('{"error":"unauthorized"}');
-              return;
-            }
-            users.updateUserProfile(mu.id, profile);
-            // Broadcast updated avatar/presence to all projects
-            projects.forEach(function (pCtx) {
-              pCtx.refreshUserProfile(mu.id);
-            });
-          } else {
-            fs.writeFileSync(profilePath, JSON.stringify(profile, null, 2), "utf8");
-            if (process.platform !== "win32") {
-              try { fs.chmodSync(profilePath, 0o600); } catch (chmodErr) {}
-            }
-          }
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify(profile));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "Invalid request" }));
-        }
-      });
-      return;
-    }
-
-    // Upload custom avatar image
-    if (req.method === "POST" && fullUrl === "/api/avatar") {
-      var chunks = [];
-      var totalSize = 0;
-      var maxSize = 2 * 1024 * 1024; // 2MB
-      req.on("data", function (chunk) {
-        totalSize += chunk.length;
-        if (totalSize <= maxSize) chunks.push(chunk);
-      });
-      req.on("end", function () {
-        if (totalSize > maxSize) {
-          res.writeHead(413, { "Content-Type": "application/json" });
-          res.end('{"error":"File too large (max 2MB)"}');
-          return;
-        }
-        var raw = Buffer.concat(chunks);
-        // Detect content type from magic bytes
-        var ct = null;
-        if (raw[0] === 0xFF && raw[1] === 0xD8) ct = "image/jpeg";
-        else if (raw[0] === 0x89 && raw[1] === 0x50) ct = "image/png";
-        else if (raw[0] === 0x47 && raw[1] === 0x49) ct = "image/gif";
-        else if (raw[0] === 0x52 && raw[1] === 0x49) ct = "image/webp";
-        if (!ct) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Unsupported image format"}');
-          return;
-        }
-        var ext = ct.split("/")[1] === "jpeg" ? "jpg" : ct.split("/")[1];
-        var avatarDir = path.join(CONFIG_DIR, "avatars");
-        fs.mkdirSync(avatarDir, { recursive: true });
-
-        var userId = "default";
-        if (users.isMultiUser()) {
-          var mu = getMultiUserFromReq(req);
-          if (!mu) {
-            res.writeHead(401, { "Content-Type": "application/json" });
-            res.end('{"error":"unauthorized"}');
-            return;
-          }
-          userId = mu.id;
-        }
-        var filename = userId + "." + ext;
-        // Remove old avatar files for this user
-        try {
-          var existing = fs.readdirSync(avatarDir);
-          for (var ei = 0; ei < existing.length; ei++) {
-            if (existing[ei].startsWith(userId + ".")) {
-              fs.unlinkSync(path.join(avatarDir, existing[ei]));
-            }
-          }
-        } catch (e) {}
-        var avatarFilePath = path.join(avatarDir, filename);
-        fs.writeFileSync(avatarFilePath, raw);
-        try { fs.chmodSync(avatarFilePath, 0o644); } catch (e) {}
-        try { fs.chmodSync(avatarDir, 0o755); } catch (e) {}
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: true, avatar: "/api/avatar/" + userId + "?v=" + Date.now() }));
-      });
-      return;
-    }
-
-    // Serve custom avatar image
-    if (req.method === "GET" && fullUrl.startsWith("/api/avatar/")) {
-      var avatarUserId = fullUrl.split("/api/avatar/")[1].split("?")[0];
-      var avatarDir = path.join(CONFIG_DIR, "avatars");
-      try {
-        var files = fs.readdirSync(avatarDir);
-        var match = null;
-        for (var fi = 0; fi < files.length; fi++) {
-          if (files[fi].startsWith(avatarUserId + ".")) {
-            match = files[fi];
-            break;
-          }
-        }
-        if (match) {
-          var ext = match.split(".").pop();
-          var ctMap = { jpg: "image/jpeg", png: "image/png", gif: "image/gif", webp: "image/webp" };
-          res.writeHead(200, {
-            "Content-Type": ctMap[ext] || "application/octet-stream",
-            "Cache-Control": "public, max-age=31536000, immutable",
-          });
-          res.end(fs.readFileSync(path.join(avatarDir, match)));
-          return;
-        }
-      } catch (e) {}
-      res.writeHead(404, { "Content-Type": "application/json" });
-      res.end('{"error":"not found"}');
-      return;
-    }
-
-    // Upload custom avatar for a mate
-    if (req.method === "POST" && fullUrl.startsWith("/api/mate-avatar/")) {
-      var mateIdFromUrl = fullUrl.split("/api/mate-avatar/")[1].split("?")[0];
-      if (!mateIdFromUrl) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Missing mate ID"}');
-        return;
-      }
-      var chunks = [];
-      var totalSize = 0;
-      var maxSize = 2 * 1024 * 1024; // 2MB
-      req.on("data", function (chunk) {
-        totalSize += chunk.length;
-        if (totalSize <= maxSize) chunks.push(chunk);
-      });
-      req.on("end", function () {
-        if (totalSize > maxSize) {
-          res.writeHead(413, { "Content-Type": "application/json" });
-          res.end('{"error":"File too large (max 2MB)"}');
-          return;
-        }
-        var raw = Buffer.concat(chunks);
-        var ct = null;
-        if (raw[0] === 0xFF && raw[1] === 0xD8) ct = "image/jpeg";
-        else if (raw[0] === 0x89 && raw[1] === 0x50) ct = "image/png";
-        else if (raw[0] === 0x47 && raw[1] === 0x49) ct = "image/gif";
-        else if (raw[0] === 0x52 && raw[1] === 0x49) ct = "image/webp";
-        if (!ct) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Unsupported image format"}');
-          return;
-        }
-        var userId = null;
-        if (users.isMultiUser()) {
-          var mu = getMultiUserFromReq(req);
-          if (!mu) {
-            res.writeHead(401, { "Content-Type": "application/json" });
-            res.end('{"error":"unauthorized"}');
-            return;
-          }
-          userId = mu.id;
-        }
-        var mateCtx = mates.buildMateCtx(userId);
-        var mate = mates.getMate(mateCtx, mateIdFromUrl);
-        if (!mate) {
-          res.writeHead(404, { "Content-Type": "application/json" });
-          res.end('{"error":"Mate not found"}');
-          return;
-        }
-        var ext = ct.split("/")[1] === "jpeg" ? "jpg" : ct.split("/")[1];
-        var avatarDir = path.join(CONFIG_DIR, "mate-avatars");
-        fs.mkdirSync(avatarDir, { recursive: true });
-        var filename = mateIdFromUrl + "." + ext;
-        // Remove old avatar files for this mate
-        try {
-          var existing = fs.readdirSync(avatarDir);
-          for (var ei = 0; ei < existing.length; ei++) {
-            if (existing[ei].startsWith(mateIdFromUrl + ".")) {
-              fs.unlinkSync(path.join(avatarDir, existing[ei]));
-            }
-          }
-        } catch (e) {}
-        var mateAvatarFilePath = path.join(avatarDir, filename);
-        fs.writeFileSync(mateAvatarFilePath, raw);
-        try { fs.chmodSync(mateAvatarFilePath, 0o644); } catch (e) {}
-        try { fs.chmodSync(avatarDir, 0o755); } catch (e) {}
-        var avatarPath = "/api/mate-avatar/" + mateIdFromUrl + "?v=" + Date.now();
-        // Update mate profile with custom avatar URL
-        var profile = mate.profile || {};
-        profile.avatarCustom = avatarPath;
-        mates.updateMate(mateCtx, mateIdFromUrl, { profile: profile });
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: true, avatar: avatarPath }));
-      });
-      return;
-    }
-
-    // Serve custom mate avatar image
-    if (req.method === "GET" && fullUrl.startsWith("/api/mate-avatar/")) {
-      var mateAvatarId = fullUrl.split("/api/mate-avatar/")[1].split("?")[0];
-      var mateAvatarDir = path.join(CONFIG_DIR, "mate-avatars");
-      try {
-        var files = fs.readdirSync(mateAvatarDir);
-        var match = null;
-        for (var fi = 0; fi < files.length; fi++) {
-          if (files[fi].startsWith(mateAvatarId + ".")) {
-            match = files[fi];
-            break;
-          }
-        }
-        if (match) {
-          var ext = match.split(".").pop();
-          var ctMap = { jpg: "image/jpeg", png: "image/png", gif: "image/gif", webp: "image/webp" };
-          res.writeHead(200, {
-            "Content-Type": ctMap[ext] || "application/octet-stream",
-            "Cache-Control": "public, max-age=31536000, immutable",
-          });
-          res.end(fs.readFileSync(path.join(mateAvatarDir, match)));
-          return;
-        }
-      } catch (e) {}
-      res.writeHead(404, { "Content-Type": "application/json" });
-      res.end('{"error":"not found"}');
-      return;
-    }
-
-    // Change own PIN (multi-user mode)
-    if (req.method === "PUT" && fullUrl === "/api/user/pin") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu) {
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end('{"error":"unauthorized"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (!data.newPin || typeof data.newPin !== "string" || !/^\d{6}$/.test(data.newPin)) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"PIN must be exactly 6 digits"}');
-            return;
-          }
-          var result = users.updateUserPin(mu.id, data.newPin);
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end('{"ok":true}');
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // PUT /api/user/auto-continue
-    if (req.method === "PUT" && fullUrl === "/api/user/auto-continue") {
-      var mu = getMultiUserFromReq(req);
-      if (!mu) {
-        // Single-user: use daemon config fallback
-        var body = "";
-        req.on("data", function (chunk) { body += chunk; });
-        req.on("end", function () {
-          try {
-            var data = JSON.parse(body);
-            if (typeof opts.onSetAutoContinue === "function") {
-              opts.onSetAutoContinue(!!data.enabled);
-            }
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true, autoContinueOnRateLimit: !!data.enabled }));
-          } catch (e) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Invalid request"}');
-          }
-        });
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          var result = users.setAutoContinue(mu.id, !!data.enabled);
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: true, autoContinueOnRateLimit: result.autoContinueOnRateLimit }));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // PUT /api/user/chat-layout
-    if (req.method === "PUT" && fullUrl === "/api/user/chat-layout") {
-      var mu = getMultiUserFromReq(req);
-      if (!mu) {
-        // Single-user: save to daemon config
-        var body = "";
-        req.on("data", function (chunk) { body += chunk; });
-        req.on("end", function () {
-          try {
-            var data = JSON.parse(body);
-            var val = (data.layout === "bubble") ? "bubble" : "channel";
-            if (typeof opts.onSetChatLayout === "function") {
-              opts.onSetChatLayout(val);
-            }
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true, chatLayout: val }));
-          } catch (e) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Invalid request"}');
-          }
-        });
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          var result = users.setChatLayout(mu.id, data.layout);
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: true, chatLayout: result.chatLayout }));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // POST /api/user/mate-onboarded
-    if (req.method === "POST" && fullUrl === "/api/user/mate-onboarded") {
-      var mu = getMultiUserFromReq(req);
-      if (!mu) {
-        // Single-user: save to daemon config
-        if (typeof opts.onSetMateOnboarded === "function") {
-          opts.onSetMateOnboarded();
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end('{"ok":true}');
-      } else {
-        users.setMateOnboarded(mu.id);
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end('{"ok":true}');
-      }
-      return;
-    }
-
-    // GET /api/user/auto-continue
-    if (req.method === "GET" && fullUrl === "/api/user/auto-continue") {
-      var mu = getMultiUserFromReq(req);
-      if (!mu) {
-        // Single-user: read from daemon config
-        var enabled = false;
-        if (typeof opts.onGetDaemonConfig === "function") {
-          var dc = opts.onGetDaemonConfig();
-          enabled = !!dc.autoContinueOnRateLimit;
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ autoContinueOnRateLimit: enabled }));
-        return;
-      }
-      var val = users.getAutoContinue(mu.id);
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ autoContinueOnRateLimit: val }));
-      return;
-    }
-
-    // --- Admin API endpoints (multi-user mode only) ---
-
-    // List all users (admin only)
-    if (req.method === "GET" && fullUrl === "/api/admin/users") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu) {
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end('{"error":"Authentication required"}');
-        return;
-      }
-      // Admins get full user list; project owners get limited list (id, displayName, username)
-      if (mu.role === "admin") {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ users: users.getAllUsers() }));
-      } else {
-        var allU = users.getAllUsers();
-        var safeUsers = allU.map(function (u) {
-          return { id: u.id, displayName: u.displayName, username: u.username };
-        });
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ users: safeUsers }));
-      }
-      return;
-    }
-
-    // Remove user (admin only)
-    if (req.method === "DELETE" && fullUrl.indexOf("/api/admin/users/") === 0) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var targetUserId = fullUrl.substring("/api/admin/users/".length);
-      if (targetUserId === mu.id) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Cannot remove yourself"}');
-        return;
-      }
-      // Look up the user before deletion to get linuxUser for deactivation
-      var targetUser = users.findUserById(targetUserId);
-      var targetLinuxUser = targetUser ? targetUser.linuxUser : null;
-      var result = users.removeUser(targetUserId);
-      if (result.error) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: result.error }));
-        return;
-      }
-      // Remove auth tokens for deleted user
-      revokeUserTokens(targetUserId);
-      // Deactivate the Linux account if applicable
-      if (onUserDeleted && targetLinuxUser) {
-        onUserDeleted(targetUserId, targetLinuxUser);
-      }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end('{"ok":true}');
-      return;
-    }
-
-    // Create user (admin only) — generates a temporary PIN that must be changed on first login
-    if (req.method === "POST" && fullUrl === "/api/admin/users") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (!data.username || typeof data.username !== "string" || data.username.trim().length < 1) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Username is required"}');
-            return;
-          }
-          var result = users.createUserByAdmin({
-            username: data.username.trim(),
-            displayName: data.displayName ? data.displayName.trim() : data.username.trim(),
-            email: data.email ? data.email.trim() : null,
-            role: data.role === "admin" ? "admin" : "user",
-          });
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          // Auto-provision Linux account if OS users mode is enabled
-          if (osUsers && !result.user.linuxUser) {
-            var provision = provisionLinuxUser(result.user.username);
-            if (provision.ok) {
-              users.updateLinuxUser(result.user.id, provision.linuxUser);
-              if (onUserProvisioned) onUserProvisioned(result.user.id, provision.linuxUser);
-            }
-          }
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({
-            ok: true,
-            user: {
-              id: result.user.id,
-              username: result.user.username,
-              displayName: result.user.displayName,
-              role: result.user.role,
-            },
-            tempPin: result.tempPin,
-          }));
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Reset user PIN (admin only) — generates a new temp PIN
-    if (req.method === "POST" && fullUrl.match(/^\/api\/admin\/users\/[^/]+\/reset-pin$/)) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var urlParts = fullUrl.split("/");
-      var targetUserId = urlParts[4]; // /api/admin/users/{userId}/reset-pin
-      var targetUser = users.findUserById(targetUserId);
-      if (!targetUser) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"User not found"}');
-        return;
-      }
-      var newPin = users.generatePin();
-      var pinResult = users.updateUserPin(targetUserId, newPin);
-      if (pinResult.error) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: pinResult.error }));
-        return;
-      }
-      // Mark as must change on next login
-      var data = users.loadUsers();
-      for (var i = 0; i < data.users.length; i++) {
-        if (data.users[i].id === targetUserId) {
-          data.users[i].mustChangePin = true;
-          users.saveUsers(data);
-          break;
-        }
-      }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, tempPin: newPin }));
-      return;
-    }
-
-    // Set Linux user mapping (admin only, OS-level multi-user)
-    if (req.method === "PUT" && fullUrl.match(/^\/api\/admin\/users\/[^/]+\/linux-user$/)) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var urlParts = fullUrl.split("/");
-      var targetUserId = urlParts[4]; // /api/admin/users/{userId}/linux-user
-      var body = "";
-      req.on("data", function(chunk) { body += chunk; });
-      req.on("end", function() {
-        try {
-          var parsed = JSON.parse(body);
-          var result = users.updateLinuxUser(targetUserId, parsed.linuxUser || null);
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-          } else {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end('{"ok":true}');
-          }
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request body"}');
-        }
-      });
-      return;
-    }
-
-    // Update user permissions (admin only)
-    if (req.method === "PUT" && fullUrl.match(/^\/api\/admin\/users\/[^/]+\/permissions$/)) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var urlParts = fullUrl.split("/");
-      var targetUserId = urlParts[4]; // /api/admin/users/{userId}/permissions
-      var body = "";
-      req.on("data", function(chunk) { body += chunk; });
-      req.on("end", function() {
-        try {
-          var parsed = JSON.parse(body);
-          var result = users.updateUserPermissions(targetUserId, parsed.permissions || {});
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-          } else {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true, permissions: result.permissions }));
-          }
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request body"}');
-        }
-      });
-      return;
-    }
-
-    // Create invite (admin only)
-    if (req.method === "POST" && fullUrl === "/api/admin/invites") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var invite = users.createInvite(mu.id);
-      var proto = tlsOptions ? "https" : "http";
-      var host = req.headers.host || ("localhost:" + portNum);
-      var inviteUrl = proto + "://" + host + "/invite/" + invite.code;
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, invite: invite, url: inviteUrl }));
-      return;
-    }
-
-    // List invites (admin only)
-    if (req.method === "GET" && fullUrl === "/api/admin/invites") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ invites: users.getInvites() }));
-      return;
-    }
-
-    // Revoke invite (admin only)
-    if (req.method === "DELETE" && fullUrl.indexOf("/api/admin/invites/") === 0) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var inviteCode = decodeURIComponent(fullUrl.replace("/api/admin/invites/", ""));
-      if (!inviteCode) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Invite code is required"}');
-        return;
-      }
-      var result = users.revokeInvite(inviteCode);
-      if (result.error) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: result.error }));
-        return;
-      }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end('{"ok":true}');
-      return;
-    }
-
-    // Send invite via email (admin only)
-    if (req.method === "POST" && fullUrl === "/api/admin/invites/email") {
-      if (!users.isMultiUser() || !smtp.isSmtpConfigured()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"SMTP not configured"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Valid email is required"}');
-            return;
-          }
-          var invite = users.createInvite(mu.id, data.email);
-          var proto = tlsOptions ? "https" : "http";
-          var host = req.headers.host || ("localhost:" + portNum);
-          var inviteUrl = proto + "://" + host + "/invite/" + invite.code;
-          smtp.sendInviteEmail(data.email, inviteUrl, mu.displayName || mu.username).then(function () {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true, invite: invite, url: inviteUrl }));
-          }).catch(function (err) {
-            res.writeHead(500, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Failed to send email: " + (err.message || "unknown error") }));
-          });
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Get SMTP config (admin only)
-    if (req.method === "GET" && fullUrl === "/api/admin/smtp") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var cfg = smtp.getSmtpConfig();
-      if (cfg) {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ smtp: { host: cfg.host, port: cfg.port, secure: cfg.secure, user: cfg.user, pass: "••••••••", from: cfg.from, emailLoginEnabled: !!cfg.emailLoginEnabled } }));
-      } else {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end('{"smtp":null}');
-      }
-      return;
-    }
-
-    // Save SMTP config (admin only)
-    if (req.method === "POST" && fullUrl === "/api/admin/smtp") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          // Allow clearing SMTP config by sending empty fields
-          if (!data.host && !data.user && !data.pass && !data.from) {
-            smtp.saveSmtpConfig(null);
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end('{"ok":true}');
-            return;
-          }
-          if (!data.host || !data.user || !data.pass || !data.from) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Host, user, password, and from address are required"}');
-            return;
-          }
-          // If password is masked, keep existing
-          var existingCfg = smtp.getSmtpConfig();
-          var pass = data.pass;
-          if (pass === "••••••••" && existingCfg) {
-            pass = existingCfg.pass;
-          }
-          smtp.saveSmtpConfig({
-            host: data.host,
-            port: parseInt(data.port, 10) || 587,
-            secure: !!data.secure,
-            user: data.user,
-            pass: pass,
-            from: data.from,
-            emailLoginEnabled: !!data.emailLoginEnabled,
-          });
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end('{"ok":true}');
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Test SMTP connection (admin only)
-    if (req.method === "POST" && fullUrl === "/api/admin/smtp/test") {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          // Use provided config or fall back to saved
-          var existingCfg = smtp.getSmtpConfig();
-          var pass = data.pass;
-          if (pass === "••••••••" && existingCfg) {
-            pass = existingCfg.pass;
-          }
-          var cfg = {
-            host: data.host || (existingCfg && existingCfg.host),
-            port: parseInt(data.port, 10) || (existingCfg && existingCfg.port) || 587,
-            secure: data.secure !== undefined ? !!data.secure : (existingCfg && !!existingCfg.secure),
-            user: data.user || (existingCfg && existingCfg.user),
-            pass: pass || (existingCfg && existingCfg.pass),
-            from: data.from || (existingCfg && existingCfg.from),
-          };
-          if (!cfg.host || !cfg.user || !cfg.pass || !cfg.from) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"SMTP configuration is incomplete"}');
-            return;
-          }
-          var testTo = mu.email || cfg.from;
-          smtp.sendTestEmail(cfg, testTo).then(function (result) {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true, message: "Test email sent to " + testTo }));
-          }).catch(function (err) {
-            res.writeHead(500, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: err.message || "Connection failed" }));
-          });
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // --- Project access control (admin only, multi-user) ---
-
-    // Set project visibility (admin only)
-    if (req.method === "PUT" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/visibility$/.test(fullUrl)) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      var _visSlug = fullUrl.split("/")[4];
-      var _visAccess = onGetProjectAccess ? onGetProjectAccess(_visSlug) : null;
-      var _isOwner = mu && _visAccess && _visAccess.ownerId && mu.id === _visAccess.ownerId;
-      if (!mu || (mu.role !== "admin" && !_isOwner)) {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin or project owner access required"}');
-        return;
-      }
-      var projSlug = fullUrl.split("/")[4];
-      if (projSlug.indexOf("--") !== -1) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Worktree projects inherit parent visibility"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (data.visibility !== "public" && data.visibility !== "private") {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"Visibility must be public or private"}');
-            return;
-          }
-          if (!onSetProjectVisibility) {
-            res.writeHead(500, { "Content-Type": "application/json" });
-            res.end('{"error":"Visibility handler not configured"}');
-            return;
-          }
-          var result = onSetProjectVisibility(projSlug, data.visibility);
-          if (result && result.error) {
-            res.writeHead(404, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end('{"ok":true}');
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Set project owner (admin only)
-    if (req.method === "PUT" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/owner$/.test(fullUrl)) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
-        return;
-      }
-      var projSlug = fullUrl.split("/")[4];
-      if (projSlug.indexOf("--") !== -1) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Worktree projects inherit parent settings"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          var targetCtx = projects.get(projSlug);
-          if (!targetCtx) {
-            res.writeHead(404, { "Content-Type": "application/json" });
-            res.end('{"error":"Project not found"}');
-            return;
-          }
-          var ownerId = data.userId || null;
-          targetCtx.setProjectOwner(ownerId);
-          if (onProjectOwnerChanged) {
-            onProjectOwnerChanged(projSlug, ownerId);
-          }
-          // Broadcast to project clients
-          var ownerName = null;
-          if (ownerId) {
-            var ownerUser = users.findUserById(ownerId);
-            ownerName = ownerUser ? (ownerUser.displayName || ownerUser.username) : ownerId;
-          }
-          targetCtx.send({ type: "project_owner_changed", ownerId: ownerId, ownerName: ownerName });
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end('{"ok":true}');
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Set project allowed users (admin only)
-    if (req.method === "PUT" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/users$/.test(fullUrl)) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      var _usrSlug = fullUrl.split("/")[4];
-      var _usrAccess = onGetProjectAccess ? onGetProjectAccess(_usrSlug) : null;
-      var _isOwnerU = mu && _usrAccess && _usrAccess.ownerId && mu.id === _usrAccess.ownerId;
-      if (!mu || (mu.role !== "admin" && !_isOwnerU)) {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin or project owner access required"}');
-        return;
-      }
-      var projSlug = fullUrl.split("/")[4];
-      if (projSlug.indexOf("--") !== -1) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Worktree projects inherit parent settings"}');
-        return;
-      }
-      var body = "";
-      req.on("data", function (chunk) { body += chunk; });
-      req.on("end", function () {
-        try {
-          var data = JSON.parse(body);
-          if (!Array.isArray(data.allowedUsers)) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end('{"error":"allowedUsers must be an array"}');
-            return;
-          }
-          if (!onSetProjectAllowedUsers) {
-            res.writeHead(500, { "Content-Type": "application/json" });
-            res.end('{"error":"AllowedUsers handler not configured"}');
-            return;
-          }
-          var result = onSetProjectAllowedUsers(projSlug, data.allowedUsers);
-          if (result && result.error) {
-            res.writeHead(404, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-            return;
-          }
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end('{"ok":true}');
-        } catch (e) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end('{"error":"Invalid request"}');
-        }
-      });
-      return;
-    }
-
-    // Get project access info (admin or project owner)
-    if (req.method === "GET" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/access$/.test(fullUrl)) {
-      if (!users.isMultiUser()) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end('{"error":"Not found"}');
-        return;
-      }
-      var mu = getMultiUserFromReq(req);
-      var _accSlug = fullUrl.split("/")[4];
-      var _accAccess = onGetProjectAccess ? onGetProjectAccess(_accSlug) : null;
-      var _isOwnerA = mu && _accAccess && _accAccess.ownerId && mu.id === _accAccess.ownerId;
-      if (!mu || (mu.role !== "admin" && !_isOwnerA)) {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin or project owner access required"}');
-        return;
-      }
-      var projSlug = fullUrl.split("/")[4];
-      if (!onGetProjectAccess) {
-        res.writeHead(500, { "Content-Type": "application/json" });
-        res.end('{"error":"Access handler not configured"}');
-        return;
-      }
-      var access = onGetProjectAccess(projSlug);
-      if (access && access.error) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: access.error }));
-        return;
-      }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify(access));
+        } catch (e) {
+          res.writeHead(400);
+          res.end("Bad request");
+        }
+      });
       return;
     }
 
-    // Command palette: cross-project session search
-    if (req.method === "GET" && fullUrl === "/api/palette/search") {
-      var paletteUser = null;
-      if (users.isMultiUser()) {
-        paletteUser = getMultiUserFromReq(req);
-        if (!paletteUser) {
-          res.writeHead(401, { "Content-Type": "application/json" });
-          res.end('{"error":"unauthorized"}');
-          return;
-        }
-      }
-      var pqs = req.url.indexOf("?") >= 0 ? req.url.substring(req.url.indexOf("?")) : "";
-      var pQuery = new URLSearchParams(pqs).get("q") || "";
-      var pResults = [];
-
-      if (!pQuery) {
-        // Recent mode: return all sessions sorted by lastActivity
-        projects.forEach(function (pCtx, pSlug) {
-          var status = pCtx.getStatus();
-          if (status.isWorktree) return;
-          if (paletteUser && onGetProjectAccess) {
-            var pAccess = onGetProjectAccess(pSlug);
-            if (pAccess && !pAccess.error && !users.canAccessProject(paletteUser.id, pAccess)) return;
-          }
-          pCtx.sm.sessions.forEach(function (session) {
-            if (session.hidden) return;
-            if (paletteUser) {
-              if (users.isMultiUser()) {
-                var sAccess = onGetProjectAccess ? onGetProjectAccess(pSlug) : null;
-                if (!users.canAccessSession(paletteUser.id, session, sAccess)) return;
-              }
-            } else {
-              if (session.ownerId) return;
-            }
-            var pItem = {
-              projectSlug: pSlug,
-              projectTitle: status.title || status.project,
-              projectIcon: status.icon || null,
-              sessionId: session.localId,
-              sessionTitle: session.title || "New Session",
-              lastActivity: session.lastActivity || session.createdAt || 0,
-              matchType: null,
-              snippet: null
-            };
-            if (status.isMate) {
-              pItem.isMate = true;
-              pItem.mateId = status.mateId || null;
-            }
-            pResults.push(pItem);
-          });
-        });
-        pResults.sort(function (a, b) { return b.lastActivity - a.lastActivity; });
-        if (pResults.length > 30) pResults = pResults.slice(0, 30);
-      } else {
-        // Search mode: BM25 ranked search across all sessions
-        var projectSessions = [];
-        projects.forEach(function (pCtx, pSlug) {
-          var status = pCtx.getStatus();
-          if (status.isWorktree) return;
-          if (paletteUser && onGetProjectAccess) {
-            var pAccess = onGetProjectAccess(pSlug);
-            if (pAccess && !pAccess.error && !users.canAccessProject(paletteUser.id, pAccess)) return;
-          }
-          var accessibleSessions = [];
-          pCtx.sm.sessions.forEach(function (session) {
-            if (session.hidden) return;
-            if (paletteUser) {
-              if (users.isMultiUser()) {
-                var sAccess = onGetProjectAccess ? onGetProjectAccess(pSlug) : null;
-                if (!users.canAccessSession(paletteUser.id, session, sAccess)) return;
-              }
-            } else {
-              if (session.ownerId) return;
-            }
-            accessibleSessions.push(session);
-          });
-          if (accessibleSessions.length > 0) {
-            projectSessions.push({
-              projectSlug: pSlug,
-              projectTitle: status.title || status.project,
-              projectIcon: status.icon || null,
-              isMate: status.isMate || false,
-              mateId: status.mateId || null,
-              sessions: accessibleSessions
-            });
+    // Health check endpoint
+    // Unauthenticated: minimal liveness info only
+    // Authenticated: full system details (memory, pid, version, sessions)
+    if (req.method === "GET" && fullUrl === "/api/health") {
+      var health = {
+        status: "ok",
+        timestamp: new Date().toISOString(),
+      };
+      if (isRequestAuthed(req)) {
+        var mem = process.memoryUsage();
+        var activeSessions = 0;
+        projects.forEach(function (ctx) {
+          if (ctx && ctx.clients) {
+            activeSessions += ctx.clients.size || 0;
           }
         });
-        pResults = sessionSearch.searchPalette(projectSessions, pQuery, { maxResults: 30 });
+        health.uptime = process.uptime();
+        health.version = pkg.version;
+        health.node = process.version;
+        health.sessions = activeSessions;
+        health.projects = projects.size;
+        health.memory = {
+          rss: mem.rss,
+          heapUsed: mem.heapUsed,
+          heapTotal: mem.heapTotal,
+        };
+        health.pid = process.pid;
       }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(health));
+      return;
+    }
 
+    // Theme list: bundled (lib/themes/) + user (~/.clay/themes/)
+    if (req.method === "GET" && fullUrl === "/api/themes") {
+      var bundled = {};
+      var custom = {};
+      // Read bundled themes
+      try {
+        var bFiles = fs.readdirSync(bundledThemesDir);
+        for (var i = 0; i < bFiles.length; i++) {
+          if (!bFiles[i].endsWith(".json")) continue;
+          try {
+            var raw = fs.readFileSync(path.join(bundledThemesDir, bFiles[i]), "utf8");
+            var id = bFiles[i].replace(/\.json$/, "");
+            bundled[id] = JSON.parse(raw);
+          } catch (e) {}
+        }
+      } catch (e) {}
+      // Read user themes (override bundled if same id)
+      try {
+        var uFiles = fs.readdirSync(userThemesDir);
+        for (var j = 0; j < uFiles.length; j++) {
+          if (!uFiles[j].endsWith(".json")) continue;
+          try {
+            var uRaw = fs.readFileSync(path.join(userThemesDir, uFiles[j]), "utf8");
+            var uid = uFiles[j].replace(/\.json$/, "");
+            custom[uid] = JSON.parse(uRaw);
+          } catch (e) {}
+        }
+      } catch (e) {}
       res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ results: pResults }));
+      res.end(JSON.stringify({ bundled: bundled, custom: custom }));
       return;
     }
 
+    if (settings.handleRequest(req, res, fullUrl)) return;
+
+    // --- Admin API endpoints (multi-user mode only) ---
+    if (admin.handleRequest(req, res, fullUrl)) return;
+
+    // --- Palette search (delegated to server-palette) ---
+    if (palette.handleRequest(req, res, fullUrl)) return;
+
     // Multi-user info endpoint (who am I?)
     if (req.method === "GET" && fullUrl === "/api/me") {
       if (!users.isMultiUser()) {
@@ -2447,121 +456,14 @@ function createServer(opts) {
       return;
     }
 
-    // Skills proxy: permission gate
-    if (fullUrl === "/api/skills" || fullUrl.startsWith("/api/skills/") || fullUrl.startsWith("/api/skills?")) {
-      if (users.isMultiUser()) {
-        var skMu = getMultiUserFromReq(req);
-        if (skMu) {
-          var skPerms = users.getEffectivePermissions(skMu, osUsers);
-          if (!skPerms.skills) {
-            res.writeHead(403, { "Content-Type": "application/json" });
-            res.end('{"error":"Skills access is not permitted"}');
-            return;
-          }
-        }
-      }
-    }
-
-    // Skills proxy: leaderboard list
-    if (req.method === "GET" && fullUrl === "/api/skills") {
-      var qs = req.url.indexOf("?") >= 0 ? req.url.substring(req.url.indexOf("?")) : "";
-      var tabParam = new URLSearchParams(qs).get("tab") || "all";
-      var tabPath = tabParam === "trending" ? "/trending" : tabParam === "hot" ? "/hot" : "/";
-      var cacheKey = "skills_" + tabParam;
-      var cached = skillsCache[cacheKey];
-      if (cached && Date.now() - cached.ts < 300000) {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(cached.data);
-        return;
-      }
-      fetchSkillsPage("https://skills.sh" + tabPath).then(function (data) {
-        var json = JSON.stringify(data);
-        skillsCache[cacheKey] = { ts: Date.now(), data: json };
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(json);
-      }).catch(function (err) {
-        res.writeHead(502, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Failed to fetch skills: " + (err.message || err) }));
-      });
-      return;
-    }
-
-    // Skills proxy: search
-    if (req.method === "GET" && fullUrl.startsWith("/api/skills/search")) {
-      var sqsRaw = req.url.indexOf("?") >= 0 ? req.url.substring(req.url.indexOf("?")) : "";
-      var searchQ = new URLSearchParams(sqsRaw).get("q") || "";
-      if (!searchQ) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"missing q param"}');
-        return;
-      }
-      var searchCacheKey = "search_" + searchQ.toLowerCase();
-      var searchCached = skillsCache[searchCacheKey];
-      if (searchCached && Date.now() - searchCached.ts < 300000) {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(searchCached.data);
-        return;
-      }
-      // Reuse cached "all" tab data if available, otherwise fetch
-      var allCached = skillsCache["skills_all"];
-      var allPromise = (allCached && Date.now() - allCached.ts < 300000)
-        ? Promise.resolve(JSON.parse(allCached.data))
-        : fetchSkillsPage("https://skills.sh/");
-      allPromise.then(function (data) {
-        var q = searchQ.toLowerCase();
-        var filtered = (data.skills || []).filter(function (s) {
-          var name = (s.name || "").toLowerCase();
-          var source = (s.source || "").toLowerCase();
-          var skillId = (s.skillId || "").toLowerCase();
-          return name.indexOf(q) >= 0 || source.indexOf(q) >= 0 || skillId.indexOf(q) >= 0;
-        });
-        var json = JSON.stringify({ skills: filtered });
-        skillsCache[searchCacheKey] = { ts: Date.now(), data: json };
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(json);
-      }).catch(function (err) {
-        res.writeHead(502, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Failed to search skills: " + (err.message || err) }));
-      });
-      return;
-    }
-
-    // Skills proxy: skill detail
-    if (req.method === "GET" && fullUrl.startsWith("/api/skills/detail")) {
-      var qs2 = req.url.indexOf("?") >= 0 ? req.url.substring(req.url.indexOf("?")) : "";
-      var params2 = new URLSearchParams(qs2);
-      var detailSource = params2.get("source");
-      var detailSkill = params2.get("skill");
-      if (!detailSource || !detailSkill) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"missing source or skill param"}');
-        return;
-      }
-      var detailCacheKey = "detail_" + detailSource + "_" + detailSkill;
-      var detailCached = skillsCache[detailCacheKey];
-      if (detailCached && Date.now() - detailCached.ts < 300000) {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(detailCached.data);
-        return;
-      }
-      var detailUrl = "https://skills.sh/" + encodeURIComponent(detailSource).replace(/%2F/g, "/") + "/" + encodeURIComponent(detailSkill);
-      fetchSkillDetail(detailUrl).then(function (data) {
-        var json = JSON.stringify(data);
-        skillsCache[detailCacheKey] = { ts: Date.now(), data: json };
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(json);
-      }).catch(function (err) {
-        res.writeHead(502, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Failed to fetch skill detail: " + (err.message || err) }));
-      });
-      return;
-    }
+    // --- Skills routes (delegated to server-skills) ---
+    if (skills.handleRequest(req, res, fullUrl)) return;
 
     // Root path — redirect to first accessible project
     if (fullUrl === "/" && req.method === "GET") {
       if (!isRequestAuthed(req)) {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(getAuthPage());
+        res.end(auth.getAuthPage());
         return;
       }
       if (projects.size > 0) {
@@ -2602,7 +504,7 @@ function createServer(opts) {
       // No accessible projects — show info page
       if (users.isMultiUser()) {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(noProjectsPageHtml());
+        res.end(pages.noProjectsPageHtml());
         return;
       }
       res.writeHead(200, { "Content-Type": "text/plain" });
@@ -2660,7 +562,7 @@ function createServer(opts) {
     // Auth check for project routes
     if (!isRequestAuthed(req)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(getAuthPage());
+      res.end(auth.getAuthPage());
       return;
     }
 
@@ -2739,7 +641,7 @@ function createServer(opts) {
         var httpSetupUrl = "http://" + hostname + ":" + (portNum + 1);
         var lanMode = /[?&]mode=lan/.test(req.url);
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(setupPageHtml(httpsSetupUrl, httpSetupUrl, !!caContent, lanMode));
+        res.end(pages.setupPageHtml(httpsSetupUrl, httpSetupUrl, !!caContent, lanMode));
         return;
       }
 
@@ -3091,6 +993,9 @@ function createServer(opts) {
       onShutdown: onShutdown,
       onRestart: onRestart,
       onDmMessage: handleDmMessage,
+      broadcastAll: broadcastAll,
+      notificationsModule: _globalNotifications,
+      getProject: function (s) { return projects.get(s) || null; },
     });
     projects.set(slug, ctx);
     ctx.warmup();
@@ -3099,446 +1004,26 @@ function createServer(opts) {
     return true;
   }
 
-  // --- DM message handler (server-level, cross-project) ---
-  function handleDmMessage(ws, msg) {
-    if (!users.isMultiUser() || !ws._clayUser) return;
-    var userId = ws._clayUser.id;
-
-    if (msg.type === "dm_list") {
-      var dmList = dm.getDmList(userId);
-      // Enrich with user info
-      for (var i = 0; i < dmList.length; i++) {
-        var otherUser = users.findUserById(dmList[i].otherUserId);
-        if (otherUser) {
-          var p = otherUser.profile || {};
-          dmList[i].otherUser = {
-            id: otherUser.id,
-            displayName: p.name || otherUser.displayName || otherUser.username,
-            username: otherUser.username,
-            avatarStyle: p.avatarStyle || "thumbs",
-            avatarSeed: p.avatarSeed || otherUser.username,
-            avatarColor: p.avatarColor || "#7c3aed",
-            avatarCustom: p.avatarCustom || "",
-          };
-        }
-      }
-      // Include mates in the list
-      var mateCtx = mates.buildMateCtx(userId);
-      var mateList = mates.getAllMates(mateCtx);
-      ws.send(JSON.stringify({ type: "dm_list", dms: dmList, mates: mateList }));
-      return;
-    }
-
-    if (msg.type === "dm_open") {
-      if (!msg.targetUserId) return;
-
-      // Check if target is a mate
-      var mateCtx2 = mates.buildMateCtx(userId);
-      if (mates.isMate(mateCtx2, msg.targetUserId)) {
-        var mate = mates.getMate(mateCtx2, msg.targetUserId);
-        if (!mate) return;
-        // Ensure mate project is registered (survives server restarts)
-        var mateSlug2 = "mate-" + mate.id;
-        if (!projects.has(mateSlug2)) {
-          var mateDir2 = mates.getMateDir(mateCtx2, mate.id);
-          fs.mkdirSync(mateDir2, { recursive: true });
-          var mateName2 = (mate.profile && mate.profile.displayName) || mate.name || "New Mate";
-          addProject(mateDir2, mateSlug2, mateName2, null, mate.createdBy || userId, null, { isMate: true, mateDisplayName: mateName2 });
-        }
-        var mp = mate.profile || {};
-        ws.send(JSON.stringify({
-          type: "dm_history",
-          dmKey: "mate:" + mate.id,
-          messages: dm.loadHistory("mate:" + mate.id),
-          isMate: true,
-          projectSlug: mateSlug2,
-          targetUser: {
-            id: mate.id,
-            displayName: mp.displayName || mate.name || "New Mate",
-            username: mate.id,
-            avatarStyle: mp.avatarStyle || "bottts",
-            avatarSeed: mp.avatarSeed || mate.id,
-            avatarColor: mp.avatarColor || "#6c5ce7",
-            avatarCustom: mp.avatarCustom || "",
-            isMate: true,
-            primary: !!mate.primary,
-            mateStatus: mate.status,
-            seedData: mate.seedData || {},
-          },
-        }));
-        return;
-      }
-
-      var result = dm.openDm(userId, msg.targetUserId);
-      var targetUser = users.findUserById(msg.targetUserId);
-      var tp = targetUser ? (targetUser.profile || {}) : {};
-      ws.send(JSON.stringify({
-        type: "dm_history",
-        dmKey: result.dmKey,
-        messages: result.messages,
-        targetUser: targetUser ? {
-          id: targetUser.id,
-          displayName: tp.name || targetUser.displayName || targetUser.username,
-          username: targetUser.username,
-          avatarStyle: tp.avatarStyle || "thumbs",
-          avatarSeed: tp.avatarSeed || targetUser.username,
-          avatarColor: tp.avatarColor || "#7c3aed",
-          avatarCustom: tp.avatarCustom || "",
-        } : null,
-      }));
-      return;
-    }
-
-    if (msg.type === "dm_typing") {
-      // Relay typing indicator to DM partner
-      var dmKey = msg.dmKey;
-      if (!dmKey) return;
-      var parts = dmKey.split(":");
-      if (parts.indexOf(userId) === -1) return;
-      var targetId = parts[0] === userId ? parts[1] : parts[0];
-      projects.forEach(function (ctx) {
-        ctx.forEachClient(function (otherWs) {
-          if (otherWs === ws) return;
-          if (!otherWs._clayUser || otherWs._clayUser.id !== targetId) return;
-          if (otherWs.readyState !== 1) return;
-          otherWs.send(JSON.stringify({ type: "dm_typing", dmKey: dmKey, userId: userId, typing: !!msg.typing }));
-        });
-      });
-      return;
-    }
-
-    if (msg.type === "dm_send") {
-      if (!msg.dmKey || !msg.text) return;
-      var parts = msg.dmKey.split(":");
-
-      // Handle mate DM: dmKey is "mate:mate_xxx"
-      var mateCtx3 = mates.buildMateCtx(userId);
-      if (parts[0] === "mate" && mates.isMate(mateCtx3, parts[1])) {
-        var mate = mates.getMate(mateCtx3, parts[1]);
-        if (!mate) return;
-        // Verify sender is the mate's creator
-        if (mate.createdBy !== userId) return;
-        var message = dm.sendMessage(msg.dmKey, userId, msg.text);
-        ws.send(JSON.stringify({ type: "dm_message", dmKey: msg.dmKey, message: message }));
-        return;
-      }
-
-      // Regular DM: verify sender is a participant
-      if (parts.indexOf(userId) === -1) return;
-      var message = dm.sendMessage(msg.dmKey, userId, msg.text);
-      // Send confirmation to sender
-      ws.send(JSON.stringify({ type: "dm_message", dmKey: msg.dmKey, message: message }));
-      // Broadcast to target user's connections across all projects
-      var targetId = parts[0] === userId ? parts[1] : parts[0];
-      projects.forEach(function (ctx) {
-        ctx.forEachClient(function (otherWs) {
-          if (otherWs === ws) return;
-          if (!otherWs._clayUser || otherWs._clayUser.id !== targetId) return;
-          if (otherWs.readyState !== 1) return;
-          otherWs.send(JSON.stringify({ type: "dm_message", dmKey: msg.dmKey, message: message }));
-        });
-      });
-      // Send push notification to target user
-      if (pushModule && pushModule.sendPushToUser) {
-        var senderName = ws._clayUser ? (ws._clayUser.displayName || ws._clayUser.username || "Someone") : "Someone";
-        var preview = (msg.text || "").substring(0, 140);
-        pushModule.sendPushToUser(targetId, {
-          type: "dm",
-          title: senderName,
-          body: preview,
-          tag: "dm-" + msg.dmKey,
-          dmKey: msg.dmKey,
-        });
-      }
-      return;
-    }
-
-    if (msg.type === "dm_add_favorite") {
-      if (!msg.targetUserId) return;
-      users.removeDmHidden(userId, msg.targetUserId);
-      var updatedFavorites = users.addDmFavorite(userId, msg.targetUserId);
-      var allUsersList = users.getAllUsers().map(function (u) {
-        var p = u.profile || {};
-        return {
-          id: u.id,
-          displayName: p.name || u.displayName || u.username,
-          username: u.username,
-          role: u.role,
-          avatarStyle: p.avatarStyle || "thumbs",
-          avatarSeed: p.avatarSeed || u.username,
-          avatarColor: p.avatarColor || "#7c3aed",
-          avatarCustom: p.avatarCustom || "",
-        };
-      });
-      ws.send(JSON.stringify({
-        type: "dm_favorites_updated",
-        dmFavorites: updatedFavorites,
-        allUsers: allUsersList,
-      }));
-      return;
-    }
-
-    if (msg.type === "dm_remove_favorite") {
-      if (!msg.targetUserId) return;
-      users.addDmHidden(userId, msg.targetUserId);
-      var updatedFavorites = users.removeDmFavorite(userId, msg.targetUserId);
-      ws.send(JSON.stringify({
-        type: "dm_favorites_updated",
-        dmFavorites: updatedFavorites,
-      }));
-      return;
-    }
-
-    // --- Mate handlers ---
-
-    if (msg.type === "mate_create") {
-      if (!msg.seedData) return;
-      try {
-        var mateCtx4 = mates.buildMateCtx(userId);
-        var mate = mates.createMate(mateCtx4, msg.seedData);
-        // Register mate as a project
-        var mateDir = mates.getMateDir(mateCtx4, mate.id);
-        var mateSlug = "mate-" + mate.id;
-        var mateName = (mate.profile && mate.profile.displayName) || mate.name || "New Mate";
-        addProject(mateDir, mateSlug, mateName, null, mate.createdBy, null, { isMate: true, mateDisplayName: mateName });
-        // Auto-add to favorites so it shows in sidebar
-        users.addDmFavorite(userId, mate.id);
-        ws.send(JSON.stringify({ type: "mate_created", mate: mate, projectSlug: mateSlug }));
-      } catch (e) {
-        ws.send(JSON.stringify({ type: "mate_error", error: "Failed to create mate: " + e.message }));
-      }
-      return;
-    }
-
-    if (msg.type === "mate_list") {
-      var mateCtx5 = mates.buildMateCtx(userId);
-      // Backfill built-in mates for existing users
-      try {
-        var deletedKeys = users.getDeletedBuiltinKeys(userId);
-        var newBuiltins = mates.ensureBuiltinMates(mateCtx5, deletedKeys);
-        for (var bi = 0; bi < newBuiltins.length; bi++) {
-          var nb = newBuiltins[bi];
-          var nbSlug = "mate-" + nb.id;
-          var nbDir = mates.getMateDir(mateCtx5, nb.id);
-          var nbName = (nb.profile && nb.profile.displayName) || nb.name || "New Mate";
-          addProject(nbDir, nbSlug, nbName, null, nb.createdBy || userId, null, { isMate: true, mateDisplayName: nbName });
-          users.addDmFavorite(userId, nb.id);
-        }
-      } catch (e) {
-        console.error("[server] Failed to ensure built-in mates:", e.message);
-      }
-      // Auto-sync primary mates (Ally) with latest definition
-      try { mates.syncPrimaryMates(mateCtx5); } catch (e) {}
-      // Ensure core built-in mates are in favorites (unless user explicitly removed them)
-      // Only auto-favorite the core 3: Ally (chief of staff), Arch (architect), Buzz (marketer)
-      var coreMateKeys = ["ally", "arch", "buzz"];
-      var mateList = mates.getAllMates(mateCtx5);
-      var currentFavs = users.getDmFavorites(userId);
-      var hiddenIds = users.getDmHidden(userId);
-      for (var bfi = 0; bfi < mateList.length; bfi++) {
-        if (mateList[bfi].builtinKey && coreMateKeys.indexOf(mateList[bfi].builtinKey) !== -1 && currentFavs.indexOf(mateList[bfi].id) === -1 && hiddenIds.indexOf(mateList[bfi].id) === -1) {
-          users.addDmFavorite(userId, mateList[bfi].id);
-        }
-      }
-      // Ensure all mate projects are registered (survives server restarts)
-      for (var mi = 0; mi < mateList.length; mi++) {
-        var m = mateList[mi];
-        var mSlug = "mate-" + m.id;
-        if (!projects.has(mSlug)) {
-          var mDir = mates.getMateDir(mateCtx5, m.id);
-          fs.mkdirSync(mDir, { recursive: true });
-          var mName = (m.profile && m.profile.displayName) || m.name || "New Mate";
-          addProject(mDir, mSlug, mName, null, m.createdBy || userId, null, { isMate: true, mateDisplayName: mName });
-        }
-      }
-      // Include deleted built-in mates for re-add UI
-      var builtinDefs2 = require("./builtin-mates");
-      var missingKeys2 = mates.getMissingBuiltinKeys(mateCtx5);
-      var availableBuiltins2 = [];
-      for (var abk2 = 0; abk2 < missingKeys2.length; abk2++) {
-        var bDef2 = builtinDefs2.getBuiltinByKey(missingKeys2[abk2]);
-        if (bDef2) {
-          availableBuiltins2.push({
-            key: bDef2.key,
-            displayName: bDef2.displayName,
-            bio: bDef2.bio,
-            avatarCustom: bDef2.avatarCustom || "",
-            avatarStyle: bDef2.avatarStyle || "bottts",
-            avatarColor: bDef2.avatarColor || "",
-          });
-        }
-      }
-      ws.send(JSON.stringify({ type: "mate_list", mates: mateList, availableBuiltins: availableBuiltins2 }));
-      return;
-    }
-
-    if (msg.type === "mate_delete") {
-      if (!msg.mateId) return;
-      var mateCtx6 = mates.buildMateCtx(userId);
-      // Track deleted built-in mate key so it doesn't auto-recreate
-      var mateToDelete = mates.getMate(mateCtx6, msg.mateId);
-      if (mateToDelete && mateToDelete.builtinKey) {
-        users.addDeletedBuiltinKey(userId, mateToDelete.builtinKey);
-      }
-      var result = mates.deleteMate(mateCtx6, msg.mateId);
-      if (result.error) {
-        ws.send(JSON.stringify({ type: "mate_error", error: result.error }));
-      } else {
-        removeProject("mate-" + msg.mateId);
-        // Build updated available builtins list
-        var builtinDefs3 = require("./builtin-mates");
-        var missingKeys3 = mates.getMissingBuiltinKeys(mateCtx6);
-        var availableBuiltins3 = [];
-        for (var abk3 = 0; abk3 < missingKeys3.length; abk3++) {
-          var bDef3 = builtinDefs3.getBuiltinByKey(missingKeys3[abk3]);
-          if (bDef3) {
-            availableBuiltins3.push({
-              key: bDef3.key,
-              displayName: bDef3.displayName,
-              bio: bDef3.bio,
-              avatarCustom: bDef3.avatarCustom || "",
-              avatarStyle: bDef3.avatarStyle || "bottts",
-              avatarColor: bDef3.avatarColor || "",
-            });
-          }
-        }
-        ws.send(JSON.stringify({ type: "mate_deleted", mateId: msg.mateId, availableBuiltins: availableBuiltins3 }));
-        // Broadcast to all clients so strips update
-        projects.forEach(function (ctx) {
-          ctx.forEachClient(function (otherWs) {
-            if (otherWs === ws) return;
-            if (otherWs.readyState !== 1) return;
-            otherWs.send(JSON.stringify({ type: "mate_deleted", mateId: msg.mateId, availableBuiltins: availableBuiltins3 }));
-          });
-        });
-      }
-      return;
-    }
-
-    if (msg.type === "mate_readd_builtin") {
-      if (!msg.builtinKey) return;
-      try {
-        var mateCtxR = mates.buildMateCtx(userId);
-        var missingKeys = mates.getMissingBuiltinKeys(mateCtxR);
-        if (missingKeys.indexOf(msg.builtinKey) === -1) {
-          ws.send(JSON.stringify({ type: "mate_error", error: "This built-in mate already exists" }));
-          return;
-        }
-        var newMate = mates.createBuiltinMate(mateCtxR, msg.builtinKey);
-        users.removeDeletedBuiltinKey(userId, msg.builtinKey);
-        var updatedFavsR = users.addDmFavorite(userId, newMate.id);
-        var readdSlug = "mate-" + newMate.id;
-        var readdDir = mates.getMateDir(mateCtxR, newMate.id);
-        var readdName = (newMate.profile && newMate.profile.displayName) || newMate.name || "New Mate";
-        addProject(readdDir, readdSlug, readdName, null, newMate.createdBy || userId, null, { isMate: true, mateDisplayName: readdName });
-        // Build updated available builtins
-        var builtinDefsR = require("./builtin-mates");
-        var missingKeysR = mates.getMissingBuiltinKeys(mateCtxR);
-        var availableBuiltinsR = [];
-        for (var abkR = 0; abkR < missingKeysR.length; abkR++) {
-          var bDefR = builtinDefsR.getBuiltinByKey(missingKeysR[abkR]);
-          if (bDefR) {
-            availableBuiltinsR.push({ key: bDefR.key, displayName: bDefR.displayName, bio: bDefR.bio, avatarCustom: bDefR.avatarCustom || "", avatarStyle: bDefR.avatarStyle || "bottts", avatarColor: bDefR.avatarColor || "" });
-          }
-        }
-        ws.send(JSON.stringify({ type: "mate_created", mate: newMate, projectSlug: readdSlug, availableBuiltins: availableBuiltinsR, dmFavorites: updatedFavsR }));
-      } catch (e) {
-        ws.send(JSON.stringify({ type: "mate_error", error: "Failed to re-add built-in mate: " + e.message }));
-      }
-      return;
-    }
-
-    if (msg.type === "mate_list_available_builtins") {
-      var mateCtxAB = mates.buildMateCtx(userId);
-      var missingBuiltinKeys = mates.getMissingBuiltinKeys(mateCtxAB);
-      var builtinDefs = require("./builtin-mates");
-      var availableBuiltins = [];
-      for (var abk = 0; abk < missingBuiltinKeys.length; abk++) {
-        var bDef = builtinDefs.getBuiltinByKey(missingBuiltinKeys[abk]);
-        if (bDef) {
-          availableBuiltins.push({
-            key: bDef.key,
-            displayName: bDef.displayName,
-            bio: bDef.bio,
-            avatarColor: bDef.avatarColor,
-            avatarStyle: bDef.avatarStyle,
-            avatarCustom: bDef.avatarCustom || "",
-          });
-        }
-      }
-      ws.send(JSON.stringify({ type: "mate_available_builtins", builtins: availableBuiltins }));
-      return;
-    }
-
-    if (msg.type === "mate_update") {
-      if (!msg.mateId || !msg.updates) return;
-      var mateCtx7 = mates.buildMateCtx(userId);
-      var updated = mates.updateMate(mateCtx7, msg.mateId, msg.updates);
-      if (updated) {
-        ws.send(JSON.stringify({ type: "mate_updated", mate: updated }));
-        // Broadcast update
-        projects.forEach(function (ctx) {
-          ctx.forEachClient(function (otherWs) {
-            if (otherWs === ws) return;
-            if (otherWs.readyState !== 1) return;
-            otherWs.send(JSON.stringify({ type: "mate_updated", mate: updated }));
-          });
-        });
-        // Re-enforce team sections across all mate projects so roster stays current
-        refreshTeamSections(mateCtx7);
-      } else {
-        ws.send(JSON.stringify({ type: "mate_error", error: "Mate not found" }));
-      }
-      return;
-    }
-  }
+  // --- DM message handler (delegated to server-dm + server-mates inline) ---
+  var dmHandler = serverDm.attachDm({
+    users: users,
+    dm: dm,
+    mates: mates,
+    projects: projects,
+    pushModule: pushModule,
+    addProject: addProject,
+  });
 
-  /**
-   * Re-enforce team sections on all mate projects so the roster stays current
-   * after a mate name/bio/status change.
-   */
-  function refreshTeamSections(mateCtx) {
-    try {
-      var allMates = mates.getAllMates(mateCtx);
-      // Collect non-mate projects for registry injection
-      var projList = [];
-      projects.forEach(function (pCtx) {
-        var st = pCtx.getStatus();
-        if (!st.isMate && !st.isWorktree) projList.push(st);
-      });
-      for (var ri = 0; ri < allMates.length; ri++) {
-        var mDir = mates.getMateDir(mateCtx, allMates[ri].id);
-        var claudePath = path.join(mDir, "CLAUDE.md");
-        try {
-          mates.enforceAllSections(claudePath, { ctx: mateCtx, mateId: allMates[ri].id, projects: projList });
-        } catch (e) {}
-      }
-    } catch (e) {
-      console.error("[mates] refreshTeamSections failed:", e.message);
-    }
+  // --- Mate handler ---
+  // Forward reference: mateHandler is set up after removeProject is defined
+  var mateHandler = null;
+  function scheduleRegistryRefresh() {
+    if (mateHandler) mateHandler.scheduleRegistryRefresh();
   }
 
-  // Debounced project registry refresh for all mates
-  var _registryRefreshTimer = null;
-  function scheduleRegistryRefresh() {
-    if (_registryRefreshTimer) clearTimeout(_registryRefreshTimer);
-    _registryRefreshTimer = setTimeout(function () {
-      _registryRefreshTimer = null;
-      // Refresh for all known user contexts
-      try {
-        var allCtxs = {};
-        projects.forEach(function (pCtx) {
-          var st = pCtx.getStatus();
-          if (st.projectOwnerId && !allCtxs[st.projectOwnerId]) {
-            allCtxs[st.projectOwnerId] = mates.buildMateCtx(st.projectOwnerId);
-          }
-        });
-        var ctxKeys = Object.keys(allCtxs);
-        for (var ci = 0; ci < ctxKeys.length; ci++) {
-          refreshTeamSections(allCtxs[ctxKeys[ci]]);
-        }
-      } catch (e) {}
-    }, 2000);
+  function handleDmMessage(ws, msg) {
+    if (dmHandler.handleMessage(ws, msg)) return;
+    if (mateHandler && mateHandler.handleMessage(ws, msg)) return;
   }
 
   function removeProject(slug) {
@@ -3551,6 +1036,16 @@ function createServer(opts) {
     return true;
   }
 
+  // Now that addProject and removeProject are defined, initialize mateHandler
+  mateHandler = serverMates.attachMates({
+    users: users,
+    mates: mates,
+    projects: projects,
+    addProject: addProject,
+    removeProject: removeProject,
+    onGetProjectAccess: onGetProjectAccess,
+  });
+
   function getProjects() {
     var list = [];
     projects.forEach(function (ctx) {
@@ -3589,10 +1084,6 @@ function createServer(opts) {
     return true;
   }
 
-  function setAuthToken(hash) {
-    authToken = hash;
-  }
-
   // Collect all unique users across all projects (for topbar server-wide presence)
   function getServerUsers() {
     var seen = {};
@@ -3767,9 +1258,9 @@ function createServer(opts) {
     reorderProjects: reorderProjects,
     setProjectTitle: setProjectTitle,
     setProjectIcon: setProjectIcon,
-    setAuthToken: setAuthToken,
-    setRecovery: setRecovery,
-    clearRecovery: clearRecovery,
+    setAuthToken: auth.setAuthToken,
+    setRecovery: auth.setRecovery,
+    clearRecovery: auth.clearRecovery,
     broadcastAll: broadcastAll,
     destroyAll: destroyAll,
   };