codehere 0.6.2 → 0.7.0

package/dist/infrastructure/protocols/mcp-server-impl.js

@@ -23,10 +23,27 @@ import { readFileSync, existsSync, statSync, watchFile, unwatchFile } from 'fs';
 import { join, relative, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { collectFilesForMCP, scoreFileForMCP } from './mcp-helpers.js';
-import { scanPayload, calculateRiskScore, AUDIT_FILE, verifyAuditChain, } from '../hooks/claude-sdk-hook.js';
+import { scanPayload, calculateRiskScore, AUDIT_FILE, verifyAuditChain } from '../hooks/claude-sdk-hook.js';
+import { analyzeSessions, isRealHostSession, previewFromToolInput } from '../hooks/session-analyzer.js';
+import { CodexControlSurface } from '../orchestration/control/codex-control-surface.js';
 import { getVersion } from '../../utils/version.js';
-import { TASK_HTML, HISTORY_HTML, THREAD_HTML } from './ui-page.js';
+import { HISTORY_HTML, THREAD_HTML } from './ui-page.js';
 import { TASK_HTML_V2 } from './ui-page-v2.js';
+import { VERIFY_HTML } from './verify-page.js';
+import { verifyClaim } from '../../application/use-cases/verify-claim.js';
+import { signBundle, verifyBundle, shortFingerprint, } from '../../application/use-cases/thread-export.js';
+import { loadOrCreateKeypair, trustedKeySet, trustKey } from '../orchestration/thread-key-store.js';
+import { loadSessionById } from '../orchestration/session-persistence.js';
+import { validateIntent as validateWritePassIntent, validateDecision as validateWritePassDecision, applyDecision as applyWritePassDecision, applyResponse as applyWritePassResponse, statusToAuditLine as writePassStatusToAuditLine, newPassId, WritePassError, } from '../../application/use-cases/write-pass.js';
+import { putPending as wpPutPending, getById as wpGetById, setStatus as wpSetStatus, listForSession as wpListForSession, listPending as wpListPending, } from '../orchestration/write-pass-store.js';
+import { resolveWriteRequest, WritePassResolveError } from '../context/write-pass-resolver.js';
+import { trustDomain as trustDomainStore } from '../../application/use-cases/domain-trust.js';
+import { appendAuditLog, appendOverrideAudit } from '../hooks/claude-sdk-hook.js';
+import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from 'fs';
+import { resolveContextSourceUrls } from '../context/context-resolver.js';
+import { getDefaultRegistry, createDefaultFetchContextWithPost } from '../context/registry-bootstrap.js';
+import { begin as oauthBegin, complete as oauthComplete, getProvider as getOAuthProvider, listProviders as listOAuthProviders, } from '../context/oauth-flow.js';
+import { saveToken, clearToken, connectionStatus } from '../context/oauth-store.js';
 import { SessionManager, availableAgents, readinessForAllAgents, getAdapter, allAdapters, } from '../orchestration/session-manager.js';
 import { isAbsolute } from 'path';
 import { readCrossToolAgents } from '../storage/cross-tool-agents.js';
@@ -97,7 +114,8 @@ const TOOLS = [
 ];
 // ── Tool handlers ────────────────────────────────────────────────────────────
 import { homedir } from 'os';
-const AUDIT_FILE_PATH = join(homedir(), '.codehere', 'audit', 'hook-events.jsonl');
+const controlSessions = new Map();
+let controlSeq = 0;
 /**
  * Dev-only behavior-observer injection (v0.6.0 — elu joined the team roster
  * 2026-05-03 as behavior reviewer). Activated only when CODEHERE_DEV_ELU=1
@@ -175,9 +193,26 @@ function handleScan(params) {
         findings: findings.slice(0, 10), // cap at 10 to keep response small
     });
 }
+/**
+ * Coerce a client-supplied numeric param to a bounded integer. Daemon
+ * endpoints take topN/limit straight from request bodies; a negative or NaN
+ * value silently corrupts slice() math (limit=-1 → slice keeps all-but-last,
+ * NaN → slice returns everything). Clamp to a sane range instead of trusting
+ * the wire.
+ */
+export function clampInt(v, def, min, max) {
+    // null/undefined = absent → default. Number(null) is 0 (finite), so without
+    // this guard a literal null would coerce to the min instead of the default.
+    if (v === null || v === undefined)
+        return def;
+    const n = Math.floor(Number(v));
+    if (!Number.isFinite(n))
+        return def;
+    return Math.max(min, Math.min(n, max));
+}
 function handleReview(params) {
     const targetPath = String(params.path ?? process.cwd());
-    const topN = Number(params.topN ?? 10);
+    const topN = clampInt(params.topN, 10, 1, 100);
     try {
         const files = collectFilesForMCP(targetPath);
         if (files.length === 0) {
@@ -206,23 +241,23 @@ function handleReview(params) {
     }
 }
 function handleAudit(params) {
-    const limit = Number(params.limit ?? 20);
+    const limit = clampInt(params.limit, 20, 1, 500);
     const blockedOnly = Boolean(params.blockedOnly);
     const overrideOnly = Boolean(params.overrideOnly);
     const verify = Boolean(params.verify);
     if (verify) {
         // Tamper-evidence verification — walks the file, recomputes every hash,
         // checks the chain. Returns full report including ALL break points.
-        const result = verifyAuditChain(AUDIT_FILE_PATH);
+        const result = verifyAuditChain(AUDIT_FILE);
         return JSON.stringify(result, null, 2);
     }
-    if (!existsSync(AUDIT_FILE_PATH)) {
+    if (!existsSync(AUDIT_FILE)) {
         return JSON.stringify({
             message: 'No audit log yet — install hooks first with: codehere hook install',
             entries: [],
         });
     }
-    const lines = readFileSync(AUDIT_FILE_PATH, 'utf-8')
+    const lines = readFileSync(AUDIT_FILE, 'utf-8')
         .split('\n')
         .filter(Boolean)
         .slice(-Math.min(limit * 3, 500)); // read more than needed to account for filter
@@ -301,6 +336,11 @@ function dispatch(req) {
     }
 }
 const MAX_BODY_SIZE = 2_097_152; // 2 MiB — covers 1MB code-scan payloads + framing
+// v0.8 S2.5 · in-memory map of pending OAuth flows keyed by `state` value.
+// Lifecycle: begin() inserts; callback resolves and removes; entries also
+// expire on a 10-min wall clock (the oauth-flow.ts complete() does the
+// check). Daemon restart wipes this · users just click Connect again.
+const PENDING_OAUTH_FLOWS = new Map();
 function readBody(req, res) {
     return new Promise((resolve, reject) => {
         let body = '';
@@ -317,11 +357,52 @@ function readBody(req, res) {
         req.on('error', () => reject(new Error('request aborted')));
     });
 }
+/** v0.9 S6 · Load context-sources.json into the shape resolveWriteRequest
+ *  expects. Same on-disk file as the READ adapters · symmetric storage. */
+function loadContextSourcesConfigForWritePass() {
+    const path = join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'context-sources.json');
+    if (!fsExistsSync(path))
+        return {};
+    try {
+        const raw = JSON.parse(fsReadFileSync(path, 'utf-8'));
+        return raw;
+    }
+    catch {
+        return {};
+    }
+}
 export function startMCPServer(options = {}) {
     const port = options.port ?? 3773;
     const host = options.host ?? '127.0.0.1'; // localhost only by default
     const token = options.token;
     const server = http.createServer((req, res) => {
+        // v0.7 Week-2.2 · CORS for read-only public endpoints.
+        // The landing-page daemon-status pill (codehere.uk → 127.0.0.1:3773)
+        // fetches /health · /api/version · /api/tasks across origins to render
+        // "running locally · vX.Y.Z · N tasks." Without these headers the
+        // browser blocks the cross-origin fetch. Safe to allow * on these
+        // because the endpoints expose only version + task COUNTS (no PII ·
+        // no auth-state · no payload). Mutation endpoints (POST /api/task,
+        // /api/writepass/:id/:decision, etc.) are NOT covered by this · they
+        // remain same-origin-only.
+        const url = req.url ?? '';
+        const isReadOnlyPublic = url === '/health' ||
+            url === '/api/version' ||
+            url === '/api/tasks' ||
+            url === '/api/host-sessions' ||
+            url.startsWith('/api/host-sessions/') ||
+            url.startsWith('/api/audit/stats') ||
+            url.startsWith('/api/readiness/agents');
+        if (isReadOnlyPublic) {
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+            if (req.method === 'OPTIONS') {
+                res.writeHead(204);
+                res.end();
+                return;
+            }
+        }
         // Auth check — timing-safe comparison
         if (token) {
             const authHeader = req.headers.authorization ?? '';
@@ -338,6 +419,28 @@ export function startMCPServer(options = {}) {
                 return;
             }
         }
+        // CSRF / DNS-rebind defense for state-changing requests. The daemon binds
+        // localhost, but the user's own browser can reach it — so a page on a
+        // malicious site could fire a cross-origin POST (a text/plain "simple
+        // request" sidesteps the CORS preflight) to spawn an agent or mutate state.
+        // `codehere start` runs without a bearer token, so that gate is off by
+        // default; this enforces the same-origin-only intent noted above. Browsers
+        // attach Origin / Sec-Fetch-Site on these requests; native clients (the
+        // CLI, curl, MCP stdio) do not — so we reject only requests a browser
+        // marks as cross-origin, and leave header-less non-browser clients alone.
+        const method = req.method ?? 'GET';
+        if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {
+            const sfs = req.headers['sec-fetch-site'];
+            const origin = req.headers.origin;
+            const selfOrigins = new Set([`http://${host}:${port}`, `http://127.0.0.1:${port}`, `http://localhost:${port}`]);
+            const browserCrossOrigin = (typeof sfs === 'string' && sfs !== 'same-origin' && sfs !== 'none') ||
+                (typeof origin === 'string' && origin !== 'null' && !selfOrigins.has(origin));
+            if (browserCrossOrigin) {
+                res.writeHead(403, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'cross-origin request rejected' }));
+                return;
+            }
+        }
         // Health check
         if (req.method === 'GET' && req.url === '/health') {
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -350,10 +453,21 @@ export function startMCPServer(options = {}) {
             res.end(withDevElu(TASK_HTML_V2));
             return;
         }
-        // v1 dashboard (legacy — at /v1)
+        // /v1 deleted 2026-05-23 · failover UI ported to v2 (see ui-page-v2.ts
+        // .failover-banner). The route now redirects to / so old bookmarks land
+        // on the real product instead of 404.
         if (req.method === 'GET' && (req.url === '/v1' || req.url === '/v1/')) {
+            res.writeHead(301, { Location: '/' });
+            res.end();
+            return;
+        }
+        // verify-at-the-surface dashboard · /verify (+ /verify/replay, query params).
+        // Serves the SAME HTML for both — the page reads ?mode=replay itself. It
+        // embeds `/` in an iframe as the real observation surface. Not dev-elu
+        // wrapped: it IS the verification view, the elu overlay would be noise.
+        if (req.method === 'GET' && req.url && /^\/verify(\/replay)?(\?.*)?$/.test(req.url)) {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(withDevElu(TASK_HTML));
+            res.end(VERIFY_HTML);
             return;
         }
         // History / audit feed (what we built Day 0; now secondary)
@@ -667,6 +781,310 @@ export function startMCPServer(options = {}) {
             }));
             return;
         }
+        // ── Host sessions — the coding-agent CLIs codehere observes via the hook ──
+        // These are NOT spawned-by-codehere agents (those live in /api/tasks). These
+        // are the Claude Code / Codex / etc. sessions running in the user's own
+        // terminal, captured by the PreToolUse hook. This is the surface that proves
+        // the INWARD axis: every coding agent — including the one the user is talking
+        // to right now — is a first-class workspace member, not a black box.
+        if (req.method === 'GET' && req.url === '/api/host-sessions') {
+            const entries = [];
+            try {
+                if (existsSync(AUDIT_FILE)) {
+                    const lines = readFileSync(AUDIT_FILE, 'utf-8').split('\n');
+                    for (const line of lines) {
+                        const t = line.trim();
+                        if (!t)
+                            continue;
+                        try {
+                            const e = JSON.parse(t);
+                            if (e && typeof e.sessionId === 'string')
+                                entries.push(e);
+                        }
+                        catch {
+                            /* skip malformed line */
+                        }
+                    }
+                }
+            }
+            catch {
+                /* empty audit — empty list is fine */
+            }
+            // Only surface genuine host coding sessions — not seed fixtures or the
+            // synthetic WritePass/pre_prompt audit rows. isRealHostSession() requires
+            // a real coding tool + 48h recency. Without it the strip would claim
+            // "10 sessions running" when 9 are stale demo artifacts — the screen-lie
+            // the no-screen-lies rule bans.
+            const now = Date.now();
+            const sessions = analyzeSessions(entries)
+                .filter((s) => s.sessionId !== 'unknown')
+                .filter((s) => isRealHostSession(s, now))
+                .sort((a, b) => new Date(b.lastSeen).getTime() - new Date(a.lastSeen).getTime())
+                .slice(0, 10)
+                .map((s) => ({
+                sessionId: s.sessionId,
+                shortId: s.sessionId.substring(0, 8),
+                totalCalls: s.totalCalls,
+                blockedCalls: s.blockedCalls,
+                criticalCalls: s.criticalCalls,
+                durationMs: s.durationMs,
+                lastSeen: s.lastSeen,
+                risk: s.amplificationRisk,
+                toolMix: s.toolMix,
+            }));
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ sessions, total: sessions.length }));
+            return;
+        }
+        // ── Host session as a THREAD — full tool-call timeline for one observed ──
+        // session. This is the meta-dogfood payoff: open the coding-agent session
+        // running in your terminal and see every call codehere scanned, in order,
+        // hash-chained. GET /api/host-sessions/:id
+        const hostDetailMatch = req.url?.match(/^\/api\/host-sessions\/([^/?]+)$/);
+        if (req.method === 'GET' && hostDetailMatch) {
+            const wantId = decodeURIComponent(hostDetailMatch[1]);
+            // Group matching entries by their FULL session id, then resolve to ONE
+            // session. The strip links with an 8-char short id; if two sessions share
+            // that prefix, a naive startsWith() would merge their timelines into a
+            // single bogus session. Grouping + resolving keeps each session distinct.
+            const bySession = new Map();
+            const lastTs = new Map();
+            try {
+                if (existsSync(AUDIT_FILE)) {
+                    const lines = readFileSync(AUDIT_FILE, 'utf-8').split('\n');
+                    for (const line of lines) {
+                        const t = line.trim();
+                        if (!t)
+                            continue;
+                        let e;
+                        try {
+                            e = JSON.parse(t);
+                        }
+                        catch {
+                            continue;
+                        }
+                        const sid = e.sessionId;
+                        if (!sid || (sid !== wantId && !sid.startsWith(wantId)))
+                            continue;
+                        // Plain-English preview: the bash command or the file path, never
+                        // the full JSON blob. Persona-facing surface, not a log dump.
+                        const preview = previewFromToolInput(e.toolInput);
+                        const call = {
+                            timestamp: e.timestamp,
+                            toolName: e.toolName,
+                            riskScore: e.riskScore ?? 0,
+                            blocked: !!e.blocked,
+                            findings: e.findings ?? 0,
+                            criticalFindings: e.criticalFindings ?? 0,
+                            seq: e.seq,
+                            chained: typeof e.entryHash === 'string' && e.entryHash.length > 0,
+                            preview,
+                        };
+                        if (!bySession.has(sid))
+                            bySession.set(sid, []);
+                        bySession.get(sid).push(call);
+                        const ts = e.timestamp ? Date.parse(e.timestamp) : 0;
+                        if (Number.isFinite(ts) && ts > (lastTs.get(sid) ?? 0))
+                            lastTs.set(sid, ts);
+                    }
+                }
+            }
+            catch {
+                /* empty / unreadable audit — empty timeline is honest */
+            }
+            // Resolve to one session: an exact full-id match wins; otherwise the most
+            // recently active session carrying the prefix. We never merge two.
+            let resolvedId;
+            if (bySession.has(wantId)) {
+                resolvedId = wantId;
+            }
+            else if (bySession.size >= 1) {
+                resolvedId = [...bySession.keys()].sort((a, b) => (lastTs.get(b) ?? 0) - (lastTs.get(a) ?? 0))[0];
+            }
+            const calls = resolvedId ? bySession.get(resolvedId) : [];
+            if (calls.length === 0) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'No observed session matching ' + wantId }));
+                return;
+            }
+            calls.sort((a, b) => new Date(String(a.timestamp)).getTime() - new Date(String(b.timestamp)).getTime());
+            const chain = verifyAuditChain(AUDIT_FILE);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                sessionId: resolvedId ?? wantId,
+                calls,
+                totalCalls: calls.length,
+                blockedCalls: calls.filter((c) => c.blocked).length,
+                criticalCalls: calls.filter((c) => c.criticalFindings > 0).length,
+                chainValid: chain.valid,
+                chainEntries: chain.chainedEntries,
+            }));
+            return;
+        }
+        // ── Remote control · drive a running agent from the web ───────────────
+        // POST /api/control/open  { agent, prompt } → opens a ControlSurface, starts
+        //   a thread + initial turn, returns { controlId, threadId }.
+        // POST /api/control/:id/inject  { message } → turn/steer into the running
+        //   turn (the remote-control primitive).
+        // GET  /api/control/:id/events → what the driven agent emitted.
+        // Same-origin only (mutating). Under CODEHERE_MOCK=1 the surface drives the
+        // mock app-server — zero API, no rate-limit.
+        if (req.method === 'POST' && req.url === '/api/control/open') {
+            (async () => {
+                try {
+                    const raw = JSON.parse((await readBody(req, res)) || '{}');
+                    const agent = String(raw.agent ?? 'codex');
+                    const prompt = String(raw.prompt ?? '').trim();
+                    if (!prompt) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'prompt required' }));
+                        return;
+                    }
+                    if (agent !== 'codex') {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'only codex control surface is wired today' }));
+                        return;
+                    }
+                    const surface = new CodexControlSurface();
+                    const controlId = 'ctrl-' + ++controlSeq;
+                    const entry = { surface, agent, threadId: '', events: [], openedAt: Date.now() };
+                    surface.onEvent((e) => entry.events.push(e));
+                    controlSessions.set(controlId, entry);
+                    const { threadId } = await surface.open(prompt);
+                    entry.threadId = threadId;
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ controlId, threadId, agent }));
+                }
+                catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'control open failed: ' + e.message }));
+                }
+            })();
+            return;
+        }
+        const ctlInject = req.url?.match(/^\/api\/control\/([^/]+)\/inject$/);
+        if (req.method === 'POST' && ctlInject) {
+            (async () => {
+                const entry = controlSessions.get(decodeURIComponent(ctlInject[1]));
+                if (!entry) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'no such control session' }));
+                    return;
+                }
+                try {
+                    const raw = JSON.parse((await readBody(req, res)) || '{}');
+                    const message = String(raw.message ?? '').trim();
+                    if (!message) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'message required' }));
+                        return;
+                    }
+                    const r = await entry.surface.inject(message);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ accepted: r.accepted }));
+                }
+                catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'inject failed: ' + e.message }));
+                }
+            })();
+            return;
+        }
+        const ctlEvents = req.url?.match(/^\/api\/control\/([^/]+)\/events$/);
+        if (req.method === 'GET' && ctlEvents) {
+            const entry = controlSessions.get(decodeURIComponent(ctlEvents[1]));
+            if (!entry) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'no such control session' }));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ threadId: entry.threadId, agent: entry.agent, events: entry.events }));
+            return;
+        }
+        // ── User override · a human reviewed a block and chose to proceed ──────
+        // POST /api/audit/override · body { sessionId, toolName, reason }. Appends
+        // a 'user_override' entry with the free-text reason to the hash chain and
+        // returns the new entry's seq + short hash, so the UI can show "logged ·
+        // chain continues <hash>" with the REAL hash, not a mockup. Same-origin
+        // only (mutating · not in the CORS read-only list).
+        if (req.method === 'POST' && req.url === '/api/audit/override') {
+            (async () => {
+                try {
+                    const text = await readBody(req, res);
+                    let raw;
+                    try {
+                        raw = JSON.parse(text || '{}');
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid JSON' }));
+                        return;
+                    }
+                    const reason = String(raw.reason ?? '').trim();
+                    if (!reason) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'a reason is required to log an override' }));
+                        return;
+                    }
+                    appendOverrideAudit('user_override', {
+                        sessionId: typeof raw.sessionId === 'string' ? raw.sessionId : 'unknown',
+                        toolName: typeof raw.toolName === 'string' ? raw.toolName : 'unknown',
+                        note: reason,
+                    });
+                    // appendOverrideAudit → appendAuditLog is fail-open: it swallows
+                    // write errors so a logging failure never blocks a tool call. That's
+                    // right for the hook, but here the UI shows "✓ override logged", so
+                    // we must CONFIRM our entry actually landed before claiming success
+                    // (no screen-lies). Scan the tail backward for our exact entry — a
+                    // concurrent hook process may have appended after ours, so it isn't
+                    // guaranteed to be the very last line.
+                    const wantSid = typeof raw.sessionId === 'string' ? raw.sessionId : 'unknown';
+                    const wantNote = reason.slice(0, 500);
+                    let seq = null;
+                    let entryHash = '';
+                    let confirmed = false;
+                    try {
+                        const lines = readFileSync(AUDIT_FILE, 'utf-8').trim().split('\n');
+                        for (let i = lines.length - 1; i >= 0 && i >= lines.length - 10; i--) {
+                            let e;
+                            try {
+                                e = JSON.parse(lines[i]);
+                            }
+                            catch {
+                                continue;
+                            }
+                            if (e.overrideReason === 'user_override' && e.sessionId === wantSid && e.overrideNote === wantNote) {
+                                seq = typeof e.seq === 'number' ? e.seq : null;
+                                entryHash = typeof e.entryHash === 'string' ? e.entryHash : '';
+                                confirmed = true;
+                                break;
+                            }
+                        }
+                    }
+                    catch {
+                        /* readback failed — cannot confirm the write landed */
+                    }
+                    if (!confirmed) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, error: 'override could not be confirmed in the audit log' }));
+                        return;
+                    }
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        ok: true,
+                        seq,
+                        entryHash,
+                        shortHash: entryHash ? entryHash.slice(0, 4) + '...' + entryHash.slice(-4) : '',
+                    }));
+                }
+                catch {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'override failed' }));
+                }
+            })();
+            return;
+        }
         // ── F1 · Agent install (zero-terminal setup — principle #10) ──────────────
         // POST /api/agents/:id/install → SSE stream of install output.
         // The command comes from the adapter's checkReadiness().installHint — never
@@ -938,6 +1356,10 @@ export function startMCPServer(options = {}) {
                                 results.push({ error: 'prompt (string) required', agent: t.agent ?? null });
                                 continue;
                             }
+                            if (prompt.trim().length === 0) {
+                                results.push({ error: 'prompt is empty — describe what you want done', agent: t.agent ?? null });
+                                continue;
+                            }
                             const agentId = typeof t.agent === 'string' && t.agent.length > 0 ? t.agent : 'conductor';
                             if (!validAgentIds.has(agentId)) {
                                 results.push({ error: `Unknown agent: ${agentId}`, agent: agentId });
@@ -1011,6 +1433,14 @@ export function startMCPServer(options = {}) {
                                 res.end(JSON.stringify({ error: 'prompt (string) required' }));
                                 return;
                             }
+                            // Whitespace-only prompts are a real spawn with nothing to do —
+                            // they burn an agent run for no work (dogfood 2026-05-27 Phase D).
+                            // Reject before spawn; require something to act on.
+                            if (prompt.trim().length === 0) {
+                                res.writeHead(400, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: 'prompt is empty — describe what you want done' }));
+                                return;
+                            }
                             // CRIT-5 fix · whitelist agent ID against the registry BEFORE any
                             // log/spawn. Stops log injection (`agent: "claude-code\n[FAKE]"`),
                             // future-proofs against partial-match exploits, and fails fast
@@ -1065,7 +1495,36 @@ export function startMCPServer(options = {}) {
                                     }
                                 }
                             }
-                            const session = manager.spawn(prompt, agentId, { cwd });
+                            // v0.8 S2 · resolve any context-source URLs in the prompt
+                            // (linear://INFRA-247, figma://file/<key>/...) before spawn.
+                            // Best-effort · resolver failures get logged inline in the
+                            // prompt + emit audit lines, never block the spawn.
+                            const reg = getDefaultRegistry();
+                            const fetchCtx = createDefaultFetchContextWithPost({
+                                emitAuditLine: (line) => {
+                                    // Future · feed into the hook audit chain (F-05/F-06).
+                                    // For now console-debug only · the spawn audit line below
+                                    // captures the user-facing outcome.
+                                    if (process.env.CODEHERE_DEBUG === '1') {
+                                        console.error('[context-source]', line.status, line.source, line.url, line.detail ?? '');
+                                    }
+                                },
+                            });
+                            let promptForSpawn = prompt;
+                            try {
+                                const r = await resolveContextSourceUrls(prompt, reg, fetchCtx);
+                                promptForSpawn = r.enrichedPrompt;
+                                if (r.outcomes.length && process.env.CODEHERE_DEBUG === '1') {
+                                    console.error('[context-source] resolved', r.outcomes.length, 'URL(s) ·', r.totalEstimatedTokens, 'tokens');
+                                }
+                            }
+                            catch (e) {
+                                // Resolver-level failure (registry corrupt, etc) · log and
+                                // fall back to the raw prompt. The agent runs without
+                                // enrichment instead of failing outright.
+                                console.error('[context-source] resolver failed:', e instanceof Error ? e.message : String(e));
+                            }
+                            const session = manager.spawn(promptForSpawn, agentId, { cwd });
                             res.writeHead(200, { 'Content-Type': 'application/json' });
                             res.end(JSON.stringify({
                                 sessionId: session.sessionId,
@@ -1101,6 +1560,15 @@ export function startMCPServer(options = {}) {
                     const continuedFrom = manager.getContinuedFrom(s.sessionId);
                     const continuedAs = manager.getContinuedAs(s.sessionId);
                     const failedReport = manager.hasFailedReport(s.sessionId);
+                    const stalledReason = manager.getStallReason(s.sessionId);
+                    // F-07 · verifier-agent block · run claim vs reality on every task.
+                    // Pure function, no I/O, runs sync · cheap to do per request.
+                    // The UI renders the verdict + findings inline below the Summary.
+                    const verifyResult = verifyClaim({
+                        summary: finalReport?.summary,
+                        artifacts: s.artifacts,
+                        steps: s.steps,
+                    });
                     return {
                         sessionId: s.sessionId,
                         prompt: s.prompt,
@@ -1112,6 +1580,8 @@ export function startMCPServer(options = {}) {
                         ...(completedAt !== undefined ? { completedAt, durationMs: completedAt - s.startedAt } : {}),
                         ...(finalReport !== undefined ? { finalReport } : {}),
                         ...(failedReport ? { failedReport: true } : {}),
+                        ...(stalledReason ? { stalledReason } : {}),
+                        verifyResult,
                         canAppendMessage: s.canAppendMessage === true,
                         ...(cwd !== undefined ? { cwd } : {}),
                         ...(continuedFrom !== undefined ? { continuedFrom } : {}),
@@ -1120,7 +1590,15 @@ export function startMCPServer(options = {}) {
                     };
                 });
                 const activeAgents = manager.listActiveAgents();
-                const persisted = manager.listPersisted();
+                // F-07 · attach verifyResult to persisted records too · same logic.
+                const persisted = manager.listPersisted().map((p) => ({
+                    ...p,
+                    verifyResult: verifyClaim({
+                        summary: p.finalReport?.summary,
+                        artifacts: p.artifacts,
+                        steps: p.steps,
+                    }),
+                }));
                 // Layer 7: timestamp of most recent hook-audit line (= "last edit on this machine")
                 let lastEditAt = null;
                 try {
@@ -1382,6 +1860,766 @@ export function startMCPServer(options = {}) {
             })();
             return;
         }
+        // F-05 / F-06 · public endpoint for the audit chain verifier · powers
+        // the web UI's "Verify chain" button + can be hit directly by CI.
+        // v0.8 S2.5 · context-source OAuth routes
+        // GET  /api/context-sources                · list all providers + status
+        // POST /api/context-sources/:id/connect    · returns authorize URL + opens browser
+        // POST /api/context-sources/:id/disconnect · clears stored token
+        // GET  /oauth/callback?code=...&state=...  · provider redirect target
+        if (req.url === '/api/context-sources' && req.method === 'GET') {
+            try {
+                const oauthItems = listOAuthProviders().map((p) => {
+                    const status = connectionStatus(p.id);
+                    return {
+                        id: p.id,
+                        label: p.label,
+                        scheme: p.id,
+                        authType: 'oauth',
+                        status: status.status,
+                        userLabel: status.userLabel ?? null,
+                        connectedAt: status.connectedAt ?? null,
+                        expiresAt: status.expiresAt ?? null,
+                        clientIdConfigured: !!process.env[p.clientIdEnv],
+                    };
+                });
+                // v0.8 S5 · public-by-URL adapters appear with status='available'
+                // (no Connect button needed · they work out of the box).
+                const oauthIds = new Set(oauthItems.map((i) => i.id));
+                const reg = getDefaultRegistry();
+                const noAuthItems = [...reg.bySchemeOnly.values()]
+                    .filter((s) => !oauthIds.has(s.id))
+                    .map((s) => ({
+                    id: s.id,
+                    label: s.label,
+                    scheme: s.scheme,
+                    authType: 'public',
+                    status: 'available',
+                    userLabel: null,
+                    connectedAt: null,
+                    expiresAt: null,
+                    clientIdConfigured: true,
+                    description: s.description,
+                }));
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ providers: [...oauthItems, ...noAuthItems] }));
+            }
+            catch (e) {
+                console.error('[/api/context-sources] failed:', e);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Failed to list context sources' }));
+            }
+            return;
+        }
+        const connectMatch = req.url?.match(/^\/api\/context-sources\/([^/]+)\/connect$/);
+        if (connectMatch && req.method === 'POST') {
+            const providerId = connectMatch[1];
+            const provider = getOAuthProvider(providerId);
+            if (!provider) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: `unknown provider: ${providerId}` }));
+                return;
+            }
+            const clientId = process.env[provider.clientIdEnv] || null;
+            const r = oauthBegin(provider, { clientId });
+            if ('kind' in r && r.kind === 'not_registered') {
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: 'provider_not_registered',
+                    provider: providerId,
+                    envVar: provider.clientIdEnv,
+                    message: `Set ${provider.clientIdEnv} to the OAuth client id from ${provider.label}. Until then, paste a manual key into ~/.codehere/context-sources.json under '${providerId}.apiKey'.`,
+                }));
+                return;
+            }
+            const result = r;
+            PENDING_OAUTH_FLOWS.set(result.pending.state, result.pending);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ authorizeUrl: result.authorizeUrl, state: result.pending.state }));
+            return;
+        }
+        // S2.6 · /test endpoint · proves the stored token actually works against
+        // the provider with a minimal read. Returns ok or detail.
+        const testMatch = req.url?.match(/^\/api\/context-sources\/([^/]+)\/test$/);
+        if (testMatch && req.method === 'POST') {
+            const providerId = testMatch[1];
+            const provider = getOAuthProvider(providerId);
+            if (!provider) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: 'unknown_provider' }));
+                return;
+            }
+            (async () => {
+                try {
+                    const status = connectionStatus(providerId);
+                    if (status.status === 'disconnected') {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, error: 'not_connected' }));
+                        return;
+                    }
+                    // Minimal probe per provider · the user-info endpoint is the
+                    // cheapest "does this token read at all" call.
+                    const userInfoUrl = provider.userInfoUrl;
+                    if (!userInfoUrl) {
+                        res.writeHead(501, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, error: 'no_test_endpoint' }));
+                        return;
+                    }
+                    const cfg = JSON.parse(readFileSync(join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'context-sources.json'), 'utf-8'));
+                    const entry = cfg[providerId] ?? {};
+                    let probeRes;
+                    if (providerId === 'linear') {
+                        const auth = entry.oauth?.accessToken ? `Bearer ${entry.oauth.accessToken}` : (entry.apiKey ?? '');
+                        probeRes = await fetch(userInfoUrl, {
+                            method: 'POST',
+                            headers: { Authorization: auth, 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ query: '{ viewer { name email } }' }),
+                        });
+                    }
+                    else {
+                        // figma · GET with X-Figma-Token OR Bearer
+                        const headers = entry.oauth?.accessToken
+                            ? { Authorization: `Bearer ${entry.oauth.accessToken}` }
+                            : { 'X-Figma-Token': entry.token ?? '' };
+                        probeRes = await fetch(userInfoUrl, { headers });
+                    }
+                    if (!probeRes.ok) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, error: 'provider_returned_' + probeRes.status }));
+                        return;
+                    }
+                    const body = (await probeRes.json());
+                    const who = body.data?.viewer?.email || body.data?.viewer?.name || body.email || body.handle || null;
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true, who }));
+                }
+                catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
+                }
+            })();
+            return;
+        }
+        const disconnectMatch = req.url?.match(/^\/api\/context-sources\/([^/]+)\/disconnect$/);
+        if (disconnectMatch && req.method === 'POST') {
+            const providerId = disconnectMatch[1];
+            const ok = clearToken(providerId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok, provider: providerId }));
+            return;
+        }
+        if (req.url?.startsWith('/oauth/callback') && req.method === 'GET') {
+            (async () => {
+                try {
+                    const u = new URL(req.url, 'http://127.0.0.1');
+                    const code = u.searchParams.get('code');
+                    const state = u.searchParams.get('state');
+                    const error = u.searchParams.get('error');
+                    if (error || !code || !state) {
+                        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                        res.end(callbackHtml('error', error || 'missing code/state', null));
+                        return;
+                    }
+                    const pending = PENDING_OAUTH_FLOWS.get(state);
+                    if (!pending) {
+                        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                        res.end(callbackHtml('error', 'unknown state · this flow was not started by this daemon or has expired', null));
+                        return;
+                    }
+                    const provider = getOAuthProvider(pending.provider);
+                    if (!provider) {
+                        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                        res.end(callbackHtml('error', `unknown provider: ${pending.provider}`, null));
+                        return;
+                    }
+                    const clientId = process.env[provider.clientIdEnv] || null;
+                    const out = await oauthComplete(code, state, {
+                        clientId,
+                        pending: PENDING_OAUTH_FLOWS,
+                        async httpPost(target, body, headers) {
+                            const r = await fetch(target, { method: 'POST', headers: headers ?? {}, body });
+                            const text = await r.text();
+                            const h = {};
+                            r.headers.forEach((v, k) => {
+                                h[k.toLowerCase()] = v;
+                            });
+                            return { status: r.status, body: text, headers: h };
+                        },
+                        async fetchUserInfo(token, userInfoUrl) {
+                            try {
+                                if (provider.id === 'linear') {
+                                    const r = await fetch(userInfoUrl, {
+                                        method: 'POST',
+                                        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+                                        body: JSON.stringify({ query: '{ viewer { name email } }' }),
+                                    });
+                                    if (!r.ok)
+                                        return null;
+                                    const j = (await r.json());
+                                    return j.data?.viewer ?? null;
+                                }
+                                if (provider.id === 'figma') {
+                                    const r = await fetch(userInfoUrl, {
+                                        headers: { Authorization: `Bearer ${token}` },
+                                    });
+                                    if (!r.ok)
+                                        return null;
+                                    const j = (await r.json());
+                                    return { name: j.handle, email: j.email };
+                                }
+                                return null;
+                            }
+                            catch {
+                                return null;
+                            }
+                        },
+                    });
+                    if ('kind' in out) {
+                        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                        res.end(callbackHtml('error', `${out.kind}: ${out.detail}`, provider.label));
+                        return;
+                    }
+                    saveToken(out);
+                    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(callbackHtml('ok', `Connected as ${out.userLabel ?? '(unknown user)'}`, provider.label));
+                }
+                catch (e) {
+                    console.error('[/oauth/callback] failed:', e);
+                    res.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(callbackHtml('error', e instanceof Error ? e.message : String(e), null));
+                }
+            })();
+            return;
+        }
+        if (req.url === '/api/audit/verify' && req.method === 'GET') {
+            try {
+                const r = verifyAuditChain(AUDIT_FILE);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    path: AUDIT_FILE,
+                    valid: r.valid,
+                    totalEntries: r.totalEntries,
+                    chainedEntries: r.chainedEntries,
+                    legacyEntries: r.legacyEntries,
+                    errors: r.errors,
+                }));
+            }
+            catch (e) {
+                console.error('[/api/audit/verify] failed:', e);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Failed to verify audit chain' }));
+            }
+            return;
+        }
+        // v0.8 S4 · share-thread · POST /api/thread/:id/export returns a signed
+        // bundle of one session that the recipient can replay locally. No relay
+        // through codehere's infrastructure · the response stays on-machine.
+        if (req.method === 'POST' && req.url && /^\/api\/thread\/[^/]+\/export$/.test(req.url)) {
+            try {
+                const m = req.url.match(/^\/api\/thread\/([^/]+)\/export$/);
+                const sessionId = m ? decodeURIComponent(m[1]) : '';
+                const session = sessionId ? loadSessionById(sessionId) : undefined;
+                if (!session) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'session not found', sessionId }));
+                    return;
+                }
+                const keys = loadOrCreateKeypair();
+                const body = {
+                    schema: 1,
+                    kind: 'thread',
+                    sessionId: session.sessionId,
+                    session,
+                    exporter: { codehereVersion: '0.7.0' },
+                    exportedAt: new Date().toISOString(),
+                };
+                const bundle = signBundle(body, keys);
+                const fp = shortFingerprint(bundle.publicKey);
+                const link = `codehere://thread/${session.sessionId}?signed=ed25519:${bundle.signature.slice(0, 24)}`;
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ bundle, link, fingerprint: fp }));
+            }
+            catch (e) {
+                console.error('[/api/thread/.../export] failed:', e);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'export failed' }));
+            }
+            return;
+        }
+        // v0.8 S4 · share-thread · POST /api/thread/import · accepts a bundle in
+        // the body, verifies it, optionally trusts the signer if the caller sets
+        // { trust: true }, persists the session record on success.
+        if (req.method === 'POST' && req.url === '/api/thread/import') {
+            (async () => {
+                try {
+                    const text = await readBody(req, res);
+                    let payload = {};
+                    try {
+                        payload = JSON.parse(text || '{}');
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid JSON' }));
+                        return;
+                    }
+                    const verdict = verifyBundle(payload.bundle, trustedKeySet());
+                    if (verdict.status === 'malformed' || verdict.status === 'tampered') {
+                        res.writeHead(verdict.status === 'malformed' ? 400 : 409, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ status: verdict.status, reason: verdict.reason }));
+                        return;
+                    }
+                    if (verdict.status === 'unknown_key') {
+                        if (!payload.trust) {
+                            res.writeHead(202, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({
+                                status: 'unknown_key',
+                                publicKey: verdict.publicKey,
+                                fingerprint: shortFingerprint(verdict.publicKey),
+                                hint: 'Re-POST with { "trust": true } to trust this key and import.',
+                            }));
+                            return;
+                        }
+                        trustKey(verdict.publicKey);
+                    }
+                    const finalBundle = verdict.bundle;
+                    const ses = finalBundle.body.session;
+                    const home = process.env.CODEHERE_HOME || homedir();
+                    const sessionsPath = join(home, '.codehere', 'sessions.jsonl');
+                    const fs = await import('fs');
+                    fs.mkdirSync(dirname(sessionsPath), { recursive: true });
+                    const lines = [];
+                    lines.push(JSON.stringify({
+                        t: 'spawned',
+                        id: ses.sessionId,
+                        agent: ses.agent,
+                        prompt: ses.prompt,
+                        cwd: ses.cwd,
+                        startedAt: ses.startedAt,
+                    }));
+                    lines.push(JSON.stringify({
+                        t: 'completed',
+                        id: ses.sessionId,
+                        status: ses.status,
+                        durationMs: ses.durationMs,
+                        completedAt: ses.completedAt,
+                        steps: ses.steps,
+                        artifacts: ses.artifacts,
+                    }));
+                    if (ses.finalReport) {
+                        lines.push(JSON.stringify({
+                            t: 'finalReport',
+                            id: ses.sessionId,
+                            summary: ses.finalReport.summary,
+                            generatedAt: ses.finalReport.generatedAt,
+                            durationMs: ses.finalReport.durationMs,
+                        }));
+                    }
+                    fs.appendFileSync(sessionsPath, lines.join('\n') + '\n', 'utf-8');
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        status: 'imported',
+                        sessionId: ses.sessionId,
+                        fingerprint: shortFingerprint(finalBundle.publicKey),
+                    }));
+                }
+                catch (e) {
+                    console.error('[/api/thread/import] failed:', e);
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'import failed' }));
+                }
+            })();
+            return;
+        }
+        /* v0.9 S7 · overlay-renderer · preview a 3rd-party URL via context-source */
+        // GET /api/context-source/preview?url=<urlencoded scheme://...>
+        if (req.method === 'GET' && req.url && req.url.startsWith('/api/context-source/preview')) {
+            (async () => {
+                try {
+                    const u = new URL(req.url, 'http://localhost');
+                    const target = u.searchParams.get('url');
+                    if (!target) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'url required' }));
+                        return;
+                    }
+                    const reg = getDefaultRegistry();
+                    const fetchCtx = createDefaultFetchContextWithPost({
+                        emitAuditLine: (line) => {
+                            if (process.env.CODEHERE_DEBUG === '1') {
+                                console.error('[overlay-renderer]', line.status, line.source, line.url, line.detail ?? '');
+                            }
+                        },
+                    });
+                    const { fetchViaRegistry } = await import('../context/context-source.js');
+                    try {
+                        const payload = await fetchViaRegistry(reg, target, fetchCtx);
+                        if (!payload) {
+                            // No adapter registered for that scheme · honest 400 instead of
+                            // silent ok:true with payload:null.
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({
+                                ok: false,
+                                kind: 'invalid_url',
+                                error: `No adapter registered for "${target}" · supported: linear://, github://, figma://, drawio://`,
+                            }));
+                            return;
+                        }
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true, payload }));
+                    }
+                    catch (err) {
+                        const code = err.kind ?? 'unknown';
+                        const message = err instanceof Error ? err.message : String(err);
+                        // Map adapter errors to honest HTTP codes so the UI can render
+                        // a useful empty/error state instead of swallowing everything.
+                        const httpStatus = code === 'not_found'
+                            ? 404
+                            : code === 'auth'
+                                ? 401
+                                : code === 'rate_limit'
+                                    ? 429
+                                    : code === 'invalid_url'
+                                        ? 400
+                                        : 502;
+                        res.writeHead(httpStatus, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, kind: code, error: message }));
+                    }
+                }
+                catch (e) {
+                    console.error('[/api/context-source/preview] failed:', e);
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: false, error: 'preview failed' }));
+                }
+            })();
+            return;
+        }
+        /* v0.9 S6 part B · W-PASS write-pass routes ────────────────────────── */
+        // POST /api/writepass/intent · agent emits an intent.
+        // Body: { sessionId, target, method, payload, reason, emittedBy? }
+        // Response: 201 { status: 'pending', intent: WritePassIntent }
+        if (req.method === 'POST' && req.url === '/api/writepass/intent') {
+            (async () => {
+                try {
+                    const text = await readBody(req, res);
+                    let raw;
+                    try {
+                        raw = JSON.parse(text || '{}');
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid JSON' }));
+                        return;
+                    }
+                    // Server assigns the id · agents shouldn't pick collisions.
+                    raw.id = typeof raw.id === 'string' && raw.id ? raw.id : newPassId();
+                    raw.emittedAt =
+                        typeof raw.emittedAt === 'number' && Number.isFinite(raw.emittedAt) ? raw.emittedAt : Date.now();
+                    let intent;
+                    try {
+                        intent = validateWritePassIntent(raw);
+                    }
+                    catch (err) {
+                        if (err instanceof WritePassError) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: err.code, detail: err.message }));
+                            return;
+                        }
+                        throw err;
+                    }
+                    const status = wpPutPending(intent);
+                    // Audit the intent immediately · the chain captures the agent's
+                    // request even if the user never decides (i.e. session ends).
+                    try {
+                        const line = writePassStatusToAuditLine(status);
+                        appendAuditLog({
+                            timestamp: line.timestamp,
+                            sessionId: line.sessionId,
+                            toolName: line.toolName,
+                            toolInput: line.toolInput,
+                            riskScore: line.riskScore,
+                            blocked: line.blocked,
+                            findings: line.findings,
+                            criticalFindings: line.criticalFindings,
+                        });
+                    }
+                    catch (e) {
+                        // Audit failure must not block the API (matches claude-sdk-hook discipline).
+                        console.error('[w-pass] audit append failed for intent:', e);
+                    }
+                    res.writeHead(201, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(status));
+                }
+                catch (e) {
+                    console.error('[/api/writepass/intent] failed:', e);
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'intent failed' }));
+                }
+            })();
+            return;
+        }
+        // GET /api/writepass/pending · list all pending intents (UI poll target).
+        if (req.method === 'GET' && req.url === '/api/writepass/pending') {
+            try {
+                const pending = wpListPending();
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ passes: pending }));
+            }
+            catch (e) {
+                console.error('[/api/writepass/pending] failed:', e);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'list failed' }));
+            }
+            return;
+        }
+        // GET /api/writepass/session/:id · list all passes for a session.
+        if (req.method === 'GET' && req.url && /^\/api\/writepass\/session\/[^/]+$/.test(req.url)) {
+            try {
+                const m = req.url.match(/^\/api\/writepass\/session\/([^/]+)$/);
+                const sessionId = m ? decodeURIComponent(m[1]) : '';
+                const passes = wpListForSession(sessionId);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ sessionId, passes }));
+            }
+            catch (e) {
+                console.error('[/api/writepass/session] failed:', e);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'list failed' }));
+            }
+            return;
+        }
+        // GET /api/writepass/:id/trust · returns the domain trust grade the
+        // pending pass would resolve to. UI uses this to render the trust chip
+        // BEFORE the user clicks approve.
+        if (req.method === 'GET' && req.url && /^\/api\/writepass\/[^/]+\/trust$/.test(req.url)) {
+            try {
+                const m = req.url.match(/^\/api\/writepass\/([^/]+)\/trust$/);
+                const passId = m ? decodeURIComponent(m[1]) : '';
+                const current = wpGetById(passId);
+                if (!current) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'pass not found' }));
+                    return;
+                }
+                const payload = current.kind === 'edited' ? current.effectivePayload : current.intent.payload;
+                try {
+                    const resolved = resolveWriteRequest(current.intent, payload, loadContextSourcesConfigForWritePass());
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(resolved.trust));
+                }
+                catch (err) {
+                    // Resolver failed (auth missing, unsupported scheme) · return null
+                    // trust so the UI knows there's no domain to grade yet.
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        host: '',
+                        grade: 'F',
+                        reason: err instanceof Error ? err.message : 'resolve failed',
+                        userTrusted: false,
+                        requiresFirstWriteConfirmation: false,
+                    }));
+                }
+            }
+            catch (e) {
+                console.error('[/api/writepass/.../trust] failed:', e);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'trust lookup failed' }));
+            }
+            return;
+        }
+        // POST /api/writepass/:id/decide · user approves / edits / cancels.
+        // Body: { kind: 'approve'|'edit'|'cancel', editedPayload?, note? }
+        // On approve/edit · the daemon resolves + sends, audits the outcome.
+        if (req.method === 'POST' && req.url && /^\/api\/writepass\/[^/]+\/decide$/.test(req.url)) {
+            (async () => {
+                try {
+                    const m = req.url.match(/^\/api\/writepass\/([^/]+)\/decide$/);
+                    const passId = m ? decodeURIComponent(m[1]) : '';
+                    const current = wpGetById(passId);
+                    if (!current) {
+                        res.writeHead(404, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'pass not found', passId }));
+                        return;
+                    }
+                    if (current.kind !== 'pending') {
+                        res.writeHead(409, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'already decided', current }));
+                        return;
+                    }
+                    const bodyText = await readBody(req, res);
+                    let raw;
+                    try {
+                        raw = JSON.parse(bodyText || '{}');
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid JSON' }));
+                        return;
+                    }
+                    // Default decidedAt to now if the client didn't set one.
+                    raw.passId = passId;
+                    raw.decidedAt =
+                        typeof raw.decidedAt === 'number' && Number.isFinite(raw.decidedAt) ? raw.decidedAt : Date.now();
+                    let decision;
+                    try {
+                        decision = validateWritePassDecision(raw, current.intent);
+                    }
+                    catch (err) {
+                        if (err instanceof WritePassError) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: err.code, detail: err.message }));
+                            return;
+                        }
+                        throw err;
+                    }
+                    const next = applyWritePassDecision(current.intent, decision);
+                    wpSetStatus(next);
+                    // Audit the decision.
+                    try {
+                        const line = writePassStatusToAuditLine(next);
+                        appendAuditLog({
+                            timestamp: line.timestamp,
+                            sessionId: line.sessionId,
+                            toolName: line.toolName,
+                            toolInput: line.toolInput,
+                            riskScore: line.riskScore,
+                            blocked: line.blocked,
+                            findings: line.findings,
+                            criticalFindings: line.criticalFindings,
+                        });
+                    }
+                    catch (e) {
+                        console.error('[w-pass] audit append failed for decision:', e);
+                    }
+                    // Cancelled · we stop here.
+                    if (next.kind === 'cancelled') {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(next));
+                        return;
+                    }
+                    // Approved or edited · do the mediated send.
+                    if (next.kind !== 'approved' && next.kind !== 'edited') {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'unexpected status after decision', next }));
+                        return;
+                    }
+                    const effectivePayload = next.kind === 'edited' ? next.effectivePayload : current.intent.payload;
+                    // Load auth config from the same context-sources.json the read
+                    // adapters use · symmetric storage.
+                    const writePassConfig = loadContextSourcesConfigForWritePass();
+                    let resolved;
+                    try {
+                        resolved = resolveWriteRequest(current.intent, effectivePayload, writePassConfig);
+                    }
+                    catch (err) {
+                        if (err instanceof WritePassResolveError) {
+                            const failResponse = {
+                                passId,
+                                status: 0,
+                                bodySnippet: '',
+                                receivedAt: Date.now(),
+                                error: err.message,
+                            };
+                            const failed = applyWritePassResponse(next, failResponse);
+                            wpSetStatus(failed);
+                            try {
+                                const line = writePassStatusToAuditLine(failed);
+                                appendAuditLog({
+                                    timestamp: line.timestamp,
+                                    sessionId: line.sessionId,
+                                    toolName: line.toolName,
+                                    toolInput: line.toolInput,
+                                    riskScore: line.riskScore,
+                                    blocked: line.blocked,
+                                    findings: line.findings,
+                                    criticalFindings: line.criticalFindings,
+                                });
+                            }
+                            catch { }
+                            res.writeHead(424, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: err.code, detail: err.message, status: failed }));
+                            return;
+                        }
+                        throw err;
+                    }
+                    // v0.9 · per-domain mediated-write trust gate. If the resolved
+                    // target's host is graded F (unknown), require the decision to
+                    // explicitly include trustThisDomain:true before sending. Once
+                    // set, persist the host to trusted-domains.json so subsequent
+                    // writes auto-allow at grade B.
+                    if (resolved.trust.requiresFirstWriteConfirmation) {
+                        const decisionRaw = raw;
+                        if (!decisionRaw.trustThisDomain) {
+                            res.writeHead(202, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({
+                                status: 'requires_domain_trust',
+                                host: resolved.trust.host,
+                                grade: resolved.trust.grade,
+                                reason: resolved.trust.reason,
+                                hint: 'Re-POST with { "kind": "approve", "trustThisDomain": true } to trust this host once + send.',
+                            }));
+                            return;
+                        }
+                        try {
+                            trustDomainStore(resolved.trust.host, 'trusted during first W-PASS approval');
+                        }
+                        catch (e) {
+                            console.error('[w-pass] trustDomain store failed:', e);
+                        }
+                    }
+                    // Mediated send.
+                    let response;
+                    try {
+                        const f = await fetch(resolved.url, {
+                            method: resolved.method,
+                            headers: resolved.headers,
+                            body: resolved.body,
+                        });
+                        const text = await f.text();
+                        response = {
+                            passId,
+                            status: f.status,
+                            bodySnippet: text.slice(0, 2048),
+                            receivedAt: Date.now(),
+                        };
+                    }
+                    catch (err) {
+                        response = {
+                            passId,
+                            status: 0,
+                            bodySnippet: '',
+                            receivedAt: Date.now(),
+                            error: err instanceof Error ? err.message : String(err),
+                        };
+                    }
+                    const final = applyWritePassResponse(next, response);
+                    wpSetStatus(final);
+                    try {
+                        const line = writePassStatusToAuditLine(final);
+                        appendAuditLog({
+                            timestamp: line.timestamp,
+                            sessionId: line.sessionId,
+                            toolName: line.toolName,
+                            toolInput: line.toolInput,
+                            riskScore: line.riskScore,
+                            blocked: line.blocked,
+                            findings: line.findings,
+                            criticalFindings: line.criticalFindings,
+                        });
+                    }
+                    catch (e) {
+                        console.error('[w-pass] audit append failed for response:', e);
+                    }
+                    res.writeHead(final.kind === 'sent' ? 200 : 502, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(final));
+                }
+                catch (e) {
+                    console.error('[/api/writepass/decide] failed:', e);
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'decide failed' }));
+                }
+            })();
+            return;
+        }
         // /api/version — small completeness item for ops monitoring (rc.17).
         // ESM-friendly: resolve package.json relative to the compiled module's
         // own URL via fileURLToPath. Works in both src/ (during dev) and dist/
@@ -1518,4 +2756,34 @@ export function startMCPServer(options = {}) {
     });
     return server;
 }
+/**
+ * v0.8 S2.5 · response page rendered to the user's browser after the OAuth
+ * provider redirects to /oauth/callback. Tiny styled card with status +
+ * "you can close this tab now" affordance. Auto-closes after 3s if window
+ * was opened via window.open() from our UI.
+ */
+function callbackHtml(status, message, providerLabel) {
+    const safe = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+    const tone = status === 'ok' ? '#28c840' : '#ff5f57';
+    const icon = status === 'ok' ? '✓' : '✗';
+    const title = status === 'ok' ? `${providerLabel ?? 'Provider'} connected` : 'Connection failed';
+    return `<!doctype html><html lang="en"><head>
+<meta charset="utf-8"><title>${safe(title)}</title>
+<style>
+  body { margin:0; background:#0a0a0a; color:#fff; font-family:ui-sans-serif,system-ui,-apple-system,sans-serif; display:flex; align-items:center; justify-content:center; min-height:100vh; }
+  .card { max-width:480px; padding:32px 36px; border:1px solid rgba(255,255,255,0.08); border-radius:12px; background:#111; }
+  .icon { width:48px; height:48px; border-radius:50%; background:${tone}; display:flex; align-items:center; justify-content:center; font-size:28px; font-weight:600; color:#000; margin-bottom:16px; }
+  h1 { font-size:18px; font-weight:600; margin:0 0 8px; }
+  p { color:rgba(255,255,255,0.65); font-size:14px; line-height:1.5; margin:0 0 16px; }
+  .hint { color:rgba(255,255,255,0.4); font-size:12px; font-family:ui-monospace,Menlo,monospace; }
+</style></head><body>
+<div class="card">
+  <div class="icon">${icon}</div>
+  <h1>${safe(title)}</h1>
+  <p>${safe(message)}</p>
+  <p class="hint">You can close this tab. Codehere has stored the connection locally.</p>
+</div>
+<script>setTimeout(function(){ try{ window.close(); }catch(_){} }, 3000);</script>
+</body></html>`;
+}
 //# sourceMappingURL=mcp-server-impl.js.map