crewswarm 0.9.2 → 0.9.3

package/scripts/dashboard.mjs

@@ -30,9 +30,25 @@ import {
 } from "../lib/agents/tool-instructions.mjs";
 import {
   StartBuildSchema,
+  EnhancePromptSchema,
   StartPMLoopSchema,
   ServiceActionSchema,
   ImportSkillSchema,
+  AgentConfigCreateSchema,
+  AgentConfigDeleteSchema,
+  AgentResetSessionSchema,
+  ProviderAddSchema,
+  ProviderSaveSchema,
+  ProviderTestSchema,
+  ProviderBuiltinTestSchema,
+  ContinuousBuildSchema,
+  ReplayDLQSchema,
+  DeleteProjectSchema,
+  UpdateProjectSchema,
+  RoadmapWriteSchema,
+  RoadmapRetryFailedSchema,
+  ContactDeleteSchema,
+  ContactSendSchema,
   validate,
 } from "./dashboard-validation.mjs";
 import { execCrewLeadTools } from "../lib/crew-lead/tools.mjs";
@@ -960,6 +976,233 @@ Keep the same intent; make it specific enough for a PM to break into small tasks
   return content;
 }
 
+function getRtAuthToken() {
+  try {
+    return readSwarmConfigSafe()?.rt?.authToken || "";
+  } catch {
+    return "";
+  }
+}
+
+function resolvePlannerEngine(preferredEngine = null, preferredModel = null) {
+  if (preferredEngine) {
+    return {
+      engine: preferredEngine,
+      model: preferredModel || null,
+      permissionMode: null,
+      sandbox: preferredEngine === "codex" ? "read-only" : null,
+      source: "request",
+    };
+  }
+
+  const cfg = readSwarmConfigSafe();
+  const agents = Array.isArray(cfg?.agents) ? cfg.agents : [];
+  const pm = agents.find((agent) => agent?.id === "crew-pm") || {};
+
+  if (pm.useClaudeCode) {
+    return {
+      engine: "claude",
+      model: pm.claudeCodeModel || null,
+      // Claude's plan mode can exit 0 with no streamed text for this planner path.
+      // Use the normal direct lane here; the build-planner prompt already forbids edits.
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useCodex) {
+    return {
+      engine: "codex",
+      model: pm.codexModel || null,
+      permissionMode: null,
+      sandbox: "read-only",
+      source: "crew-pm",
+    };
+  }
+  if (pm.useCursorCli) {
+    return {
+      engine: "cursor",
+      model: pm.cursorCliModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useGeminiCli) {
+    return {
+      engine: "gemini",
+      model: pm.geminiCliModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useCrewCLI) {
+    return {
+      engine: "crew-cli",
+      model: pm.crewCliModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useOpenCode) {
+    return {
+      engine: "opencode",
+      model: pm.opencodeModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+
+  const fallbacks = [
+    commandExists(process.env.CLAUDE_CODE_BIN || "claude") && { engine: "claude", model: process.env.CREWSWARM_CLAUDE_CODE_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+    commandExists(process.env.CODEX_CLI_BIN || "codex") && { engine: "codex", model: process.env.CREWSWARM_CODEX_MODEL || null, permissionMode: null, sandbox: "read-only", source: "fallback" },
+    commandExists(process.env.CURSOR_CLI_BIN || path.join(os.homedir(), ".local", "bin", "agent"), [path.join(os.homedir(), ".local", "bin", "agent")]) && { engine: "cursor", model: process.env.CREWSWARM_CURSOR_MODEL || process.env.CURSOR_DEFAULT_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+    commandExists(process.env.GEMINI_CLI_BIN || "gemini") && { engine: "gemini", model: process.env.CREWSWARM_GEMINI_CLI_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+    commandExists(process.env.CREWSWARM_OPENCODE_BIN || "opencode") && { engine: "opencode", model: process.env.CREWSWARM_OPENCODE_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+  ].filter(Boolean);
+
+  return fallbacks[0] || null;
+}
+
+function buildRequirementPlanningPrompt(userText, projectDir = null) {
+  return [
+    "You are the planning stage for CrewSwarm's Build tab.",
+    "Transform the user's rough build idea into a concrete build brief that crew-pm can execute.",
+    "If repository context is relevant, inspect the workspace before answering. Do not edit files.",
+    "",
+    "Output format:",
+    "## Build Brief",
+    "A 1-2 paragraph concrete requirement with explicit scope and deliverables.",
+    "",
+    "## Acceptance Criteria",
+    "- 3 to 7 flat bullets",
+    "",
+    "## Constraints / Assumptions",
+    "- Flat bullets only when needed",
+    "",
+    "Rules:",
+    "- Preserve the user's intent; do not invent a different product.",
+    "- Make it specific enough for PM decomposition and agent dispatch.",
+    "- Mention likely subsystems or files only if you have evidence from the repo.",
+    "- Keep it concise and actionable.",
+    "- Do not include implementation code, shell commands, or extra commentary.",
+    projectDir ? `- Current project directory: ${projectDir}` : "",
+    "",
+    "User idea:",
+    userText.trim(),
+  ].filter(Boolean).join("\n");
+}
+
+async function collectClaudePlannerTextDirect({ message, projectDir, model = null }) {
+  const claudeBin = resolveCommandPath(process.env.CLAUDE_CODE_BIN || "claude", [
+    path.join(os.homedir(), ".local", "bin", "claude"),
+    "/usr/local/bin/claude",
+    "/opt/homebrew/bin/claude",
+  ]) || (process.env.CLAUDE_CODE_BIN || "claude");
+  const { execFile } = await import("node:child_process");
+  const { promisify } = await import("node:util");
+  const execFileAsync = promisify(execFile);
+  const args = ["-p"];
+  if (projectDir) args.push("--add-dir", projectDir);
+  if (model) args.push("--model", model);
+  // Match the fixed engine-passthrough Claude invocation:
+  // skip user MCP startup and terminate option parsing before the prompt.
+  args.push(
+    "--strict-mcp-config",
+    "--mcp-config",
+    path.join(os.homedir(), ".crewswarm", "config", "empty-mcp.json"),
+    "--",
+    message,
+  );
+  const { stdout, stderr } = await execFileAsync(claudeBin, args, {
+    cwd: projectDir || process.cwd(),
+    env: process.env,
+    timeout: Number(process.env.CREWSWARM_PLANNER_TIMEOUT_MS || 300000),
+    maxBuffer: 2 * 1024 * 1024,
+  });
+  const trimmed = String(stdout || "").trim();
+  if (trimmed) return trimmed;
+  const stderrText = String(stderr || "").trim();
+  if (stderrText) throw new Error(stderrText);
+  throw new Error("planner produced no output");
+}
+
+async function collectPassthroughText({
+  engine,
+  message,
+  projectDir,
+  model = null,
+  permissionMode = null,
+  sandbox = null,
+  forceL2 = false,
+}) {
+  if (engine === "claude") {
+    return collectClaudePlannerTextDirect({ message, projectDir, model });
+  }
+  const token = getRtAuthToken();
+  const crewLeadPort = process.env.CREW_LEAD_PORT || "5010";
+  let upstream;
+  try {
+    upstream = await fetch(`http://127.0.0.1:${crewLeadPort}/api/engine-passthrough`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+        "x-passthrough-continue": "false",
+      },
+      body: JSON.stringify({
+        engine,
+        message,
+        projectDir: projectDir || process.cwd(),
+        sessionId: "build-planner",
+        ...(model ? { model } : {}),
+        ...(permissionMode ? { permissionMode } : {}),
+        ...(sandbox ? { sandbox } : {}),
+        ...(forceL2 ? { forceL2: true } : {}),
+      }),
+      signal: AbortSignal.timeout(300_000),
+    });
+  } catch (fetchErr) {
+    throw new Error(`planner fetch failed for ${engine}: ${fetchErr.message}`);
+  }
+
+  if (!upstream.ok) {
+    throw new Error(`planner upstream ${upstream.status}`);
+  }
+
+  let rawSSE;
+  try {
+    rawSSE = await upstream.text();
+  } catch (readErr) {
+    throw new Error(`planner SSE read failed for ${engine}: ${readErr.message}`);
+  }
+  let text = "";
+  let stderr = "";
+  let exitCode = 0;
+
+  for (const line of rawSSE.split("\n")) {
+    if (!line.startsWith("data: ")) continue;
+    try {
+      const ev = JSON.parse(line.slice(6));
+      if (ev.type === "chunk" && ev.text) text += ev.text;
+      else if (ev.type === "stderr" && ev.text) stderr += ev.text;
+      else if (ev.type === "done") exitCode = ev.exitCode ?? 0;
+    } catch {}
+  }
+
+  const trimmed = text.trim();
+  if (!trimmed && stderr.trim()) {
+    throw new Error(stderr.trim());
+  }
+  if (!trimmed) {
+    throw new Error(`planner produced no output${exitCode ? ` (exit ${exitCode})` : ""}`);
+  }
+  return trimmed;
+}
+
 async function getPhasedProgress(limit = 80) {
   const { readFile } = await import("node:fs/promises");
   const { existsSync } = await import("node:fs");
@@ -1908,7 +2151,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Auth Token (for Studio) ───────────────────────────────────────────────────
+    // ── Auth Token (for Vibe) ─────────────────────────────────────────────────────
     if (url.pathname === "/api/auth/token") {
       res.writeHead(200, {
         "content-type": "application/json",
@@ -2335,24 +2578,76 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/enhance-prompt" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { text } = JSON.parse(body || "{}");
-      if (!text || typeof text !== "string") {
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(EnhancePromptSchema, parsed);
+      if (!vr.ok) {
         res.writeHead(400, { "content-type": "application/json" });
-        res.end(JSON.stringify({ error: "missing text" }));
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
         return;
       }
+      const { text, projectId, engine: requestedEngine, model: requestedModel } = vr.data;
       try {
-        const enhanced = await enhancePromptWithGroq(text);
+        // Default to cwd for planner context — engines need repo access to produce aware briefs.
+        // Claude/Cursor/Codex use --add-dir for safe read access; crew-cli uses --project.
+        // Fall back to temp dir only if no project context is available.
+        let projectDir = process.cwd();
+        if (projectId) {
+          const regPath = path.join(CFG_DIR, "projects.json");
+          if (fs.existsSync(regPath)) {
+            const reg = JSON.parse(fs.readFileSync(regPath, "utf8") || "{}");
+            const proj = reg[projectId];
+            if (proj?.outputDir) projectDir = proj.outputDir;
+          }
+        }
+        fs.mkdirSync(projectDir, { recursive: true });
+
+        const planner = resolvePlannerEngine(requestedEngine, requestedModel);
+        if (!planner) throw new Error("No planning engine is configured or installed");
+
+        const planned = await collectPassthroughText({
+          engine: planner.engine,
+          message: buildRequirementPlanningPrompt(text, projectDir),
+          projectDir,
+          model: planner.model,
+          permissionMode: planner.permissionMode,
+          sandbox: planner.sandbox,
+          forceL2: planner.engine === "crew-cli",
+        });
+
         res.writeHead(200, { "content-type": "application/json" });
-        res.end(JSON.stringify({ enhanced }));
+        res.end(JSON.stringify({
+          enhanced: planned,
+          engine: planner.engine,
+          model: planner.model,
+          mode: planner.permissionMode || planner.sandbox || "prompt",
+          source: planner.source,
+        }));
       } catch (err) {
-        res.writeHead(200, { "content-type": "application/json" });
-        res.end(
-          JSON.stringify({
-            error: err?.message || String(err),
-            enhanced: null,
-          }),
-        );
+        try {
+          const enhanced = await enhancePromptWithGroq(text);
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({
+            enhanced,
+            engine: "groq",
+            model: "llama-3.3-70b-versatile",
+            mode: "fallback-rewrite",
+            source: "fallback",
+            warning: err?.message || String(err),
+          }));
+        } catch (fallbackErr) {
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: fallbackErr?.message || err?.message || String(fallbackErr || err),
+              enhanced: null,
+            }),
+          );
+        }
       }
       return;
     }
@@ -2457,9 +2752,19 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/continuous-build" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { requirement, projectId } = JSON.parse(body || "{}");
-      if (!requirement || typeof requirement !== "string")
-        throw new Error("missing requirement");
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ContinuousBuildSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { requirement, projectId } = vr.data;
       let projectEnv = {};
       if (projectId) {
         const { existsSync: ex } = await import("node:fs");
@@ -3097,8 +3402,19 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/projects/delete" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { projectId } = JSON.parse(body || "{}");
-      if (!projectId) throw new Error("projectId required");
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(DeleteProjectSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { projectId } = vr.data;
       const registryFile = path.join(CFG_DIR, "projects.json");
       const { existsSync, rmSync, writeFileSync, unlinkSync } = await import("node:fs");
       const { readFile: rf, writeFile: wf } = await import("node:fs/promises");
@@ -3146,9 +3462,19 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/projects/update" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { projectId, autoAdvance, name, description, outputDir } =
-        JSON.parse(body || "{}");
-      if (!projectId) throw new Error("projectId required");
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(UpdateProjectSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { projectId, autoAdvance, name, description, outputDir } = vr.data;
       const registryFile = path.join(CFG_DIR, "projects.json");
       const { existsSync } = await import("node:fs");
       const { readFile: rf, writeFile: wf } = await import("node:fs/promises");
@@ -3423,8 +3749,19 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/dlq/replay" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { key } = JSON.parse(body);
-      if (!key) throw new Error("missing key");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ReplayDLQSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { key } = vr.data;
       const { execSync } = await import("node:child_process");
       execSync(`"${ctlPath}" dlq-replay "${key}"`, {
         encoding: "utf8",
@@ -3779,7 +4116,19 @@ const server = http.createServer(async (req, res) => {
     ) {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { providerId } = JSON.parse(body);
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderBuiltinTestSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { providerId } = vr.data;
       const apiKey = getBuiltinKey(providerId);
       const baseUrl = BUILTIN_URLS[providerId] || "";
       if (providerId === "ollama") {
@@ -4690,7 +5039,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Models API (list available models for CrewChat dropdown) ─────────────
+    // ── Models API (list available models for crewchat dropdown) ─────────────
     if (url.pathname === "/api/models" && req.method === "GET") {
       try {
         const csSwarm = JSON.parse(
@@ -4780,7 +5129,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── CLI Chat API (CrewChat CLI mode passthrough) ──────────────────────
+    // ── CLI Chat API (crewchat CLI mode passthrough) ──────────────────────
     if (url.pathname === "/api/cli/chat" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
@@ -5020,7 +5369,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Chat Agent API (CrewChat direct agent chat) ──────────────────────────
+    // ── Chat Agent API (crewchat direct agent chat) ──────────────────────────
     if (url.pathname === "/api/chat-agent" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
@@ -5068,7 +5417,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Dispatch API (CrewChat agent direct mode) ─────────────────────────────
+    // ── Dispatch API (crewchat agent direct mode) ─────────────────────────────
     if (url.pathname === "/api/dispatch" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
@@ -5139,7 +5488,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (url.pathname === "/api/transcribe-audio" && req.method === "POST") {
-      // Expects multipart/form-data with audio file (CrewChat: m4a, Dashboard: webm)
+      // Expects multipart/form-data with audio file (crewchat: m4a, Dashboard: webm)
       // Per Groq docs: https://console.groq.com/docs/speech-to-text — file, model required
       const sendJson = (status, body) => {
         if (res.headersSent) return;
@@ -5149,7 +5498,7 @@ const server = http.createServer(async (req, res) => {
       try {
         const busboy = await import("busboy");
         const chunks = [];
-        let mimeType = "audio/m4a"; // CrewChat default
+        let mimeType = "audio/m4a"; // crewchat default
         let resolved = false;
         const resolveOnce = () => {
           if (resolved) return;
@@ -5371,7 +5720,7 @@ const server = http.createServer(async (req, res) => {
           }
 
           if (wantAgentSSE && upstream.body) {
-            // SSE streaming path (Vibe, Studio)
+            // SSE streaming path (Dashboard or Vibe)
             res.writeHead(200, {
               "content-type": "text/event-stream",
               "cache-control": "no-cache",
@@ -5471,7 +5820,7 @@ const server = http.createServer(async (req, res) => {
         }
 
         if (wantSSE && upstream.body) {
-          // SSE streaming path (Vibe, Studio)
+          // SSE streaming path (Dashboard or Vibe)
           res.writeHead(200, {
             "content-type": "text/event-stream",
             "cache-control": "no-cache",
@@ -5820,9 +6169,19 @@ const server = http.createServer(async (req, res) => {
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { providerId, apiKey } = JSON.parse(body);
-      if (!providerId || !apiKey)
-        throw new Error("providerId and apiKey required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderSaveSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { providerId, apiKey } = vr.data;
       const cfgPath = CFG_FILE;
       const cfg = JSON.parse(await readFile(cfgPath, "utf8"));
       const fromModels = cfg?.models?.providers?.[providerId];
@@ -5870,8 +6229,19 @@ const server = http.createServer(async (req, res) => {
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { id, baseUrl, apiKey, api } = JSON.parse(body);
-      if (!id || !baseUrl) throw new Error("id and baseUrl required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderAddSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { id, baseUrl, apiKey, api } = vr.data;
       const cfgPath = CFG_FILE;
       const cfg = JSON.parse(await readFile(cfgPath, "utf8"));
       if (!cfg.models) cfg.models = {};
@@ -6191,7 +6561,19 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/providers/test" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { providerId } = JSON.parse(body);
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderTestSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { providerId } = vr.data;
       const { readFile } = await import("node:fs/promises");
       const cfgPath = CFG_FILE;
       const cfg = JSON.parse(await readFile(cfgPath, "utf8").catch(() => "{}"));
@@ -7204,6 +7586,18 @@ ORDER BY day DESC, cost DESC;`;
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(AgentConfigCreateSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
       const {
         id,
         model,
@@ -7212,7 +7606,7 @@ ORDER BY day DESC, cost DESC;`;
         theme,
         systemPrompt,
         alsoAllow: reqAlsoAllow,
-      } = JSON.parse(body);
+      } = vr.data;
       const rawId = String(id || "");
       const normalizedId =
         rawId && !rawId.startsWith("crew-")
@@ -7302,8 +7696,19 @@ ORDER BY day DESC, cost DESC;`;
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { agentId } = JSON.parse(body);
-      if (!agentId) throw new Error("agentId required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(AgentConfigDeleteSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { agentId } = vr.data;
       const cfgPath = CFG_FILE;
       const promptsPath = path.join(CFG_DIR, "agent-prompts.json");
       const cfg = JSON.parse(await readFile(cfgPath, "utf8"));
@@ -7351,12 +7756,19 @@ ORDER BY day DESC, cost DESC;`;
     ) {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { agentId } = JSON.parse(body || "{}");
-      if (!agentId) {
-        res.writeHead(400);
-        res.end(JSON.stringify({ error: "agentId required" }));
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(AgentResetSessionSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
         return;
       }
+      const { agentId } = vr.data;
       const { execFile } = await import("node:child_process");
       const bridgePath = path.join(CREWSWARM_DIR, "gateway-bridge.mjs");
       // 1. Reset the agent session via gateway-bridge --reset-session
@@ -7434,9 +7846,19 @@ ORDER BY day DESC, cost DESC;`;
       const { writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { roadmapFile, content } = JSON.parse(body);
-      if (!roadmapFile || content === undefined)
-        throw new Error("roadmapFile and content required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(RoadmapWriteSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { roadmapFile, content } = vr.data;
       await writeFile(roadmapFile, content, "utf8");
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
@@ -7448,8 +7870,19 @@ ORDER BY day DESC, cost DESC;`;
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { roadmapFile } = JSON.parse(body);
-      if (!roadmapFile) throw new Error("roadmapFile required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(RoadmapRetryFailedSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { roadmapFile } = vr.data;
       const content = await readFile(roadmapFile, "utf8");
       // Strip [!] markers back to [ ] and remove failure timestamps
       const reset = content
@@ -8117,11 +8550,22 @@ ORDER BY day DESC, cost DESC;`;
     }
 
     if (url.pathname === "/api/contacts/delete" && req.method === "POST") {
+      let raw = "";
+      for await (const chunk of req) raw += chunk;
+      let parsed;
+      try { parsed = JSON.parse(raw || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ContactDeleteSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { contactId } = vr.data;
       try {
-        let raw = "";
-        for await (const chunk of req) raw += chunk;
-        const { contactId } = JSON.parse(raw || "{}");
-        if (!contactId) throw new Error("contactId required");
         const { deleteContact } = await import("../lib/contacts/index.mjs");
         deleteContact(contactId);
         res.writeHead(200, { "content-type": "application/json" });
@@ -8134,12 +8578,22 @@ ORDER BY day DESC, cost DESC;`;
     }
 
     if (url.pathname === "/api/contacts/send" && req.method === "POST") {
+      let raw = "";
+      for await (const chunk of req) raw += chunk;
+      let parsedSend;
+      try { parsedSend = JSON.parse(raw || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vrSend = validate(ContactSendSchema, parsedSend);
+      if (!vrSend.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vrSend.error }));
+        return;
+      }
+      const { contactId, platform, message } = vrSend.data;
       try {
-        let raw = "";
-        for await (const chunk of req) raw += chunk;
-        const { contactId, platform, message } = JSON.parse(raw || "{}");
-        if (!contactId || !message)
-          throw new Error("contactId and message required");
 
         const { getContact } = await import("../lib/contacts/index.mjs");
         const contact = getContact(contactId);
@@ -8155,12 +8609,19 @@ ORDER BY day DESC, cost DESC;`;
               : platformLinks.whatsapp;
           if (waJid) {
             // Call WhatsApp bridge's sendMessage function
-            const waUrl = `http://127.0.0.1:${process.env.WA_HTTP_PORT || 3000}/send`;
-            await fetch(waUrl, {
+            const waUrl = `http://127.0.0.1:${process.env.WA_HTTP_PORT || 5015}/send`;
+            const waRes = await fetch(waUrl, {
               method: "POST",
               headers: { "content-type": "application/json" },
-              body: JSON.stringify({ jid: waJid, message }),
+              body: JSON.stringify({ jid: waJid, text: message }),
             });
+            const waData = await waRes.json().catch(() => ({}));
+            if (!waRes.ok || !waData.ok) {
+              throw new Error(
+                waData.error ||
+                  `WhatsApp send failed (${waRes.status})`,
+              );
+            }
           }
         }
 
@@ -8179,7 +8640,7 @@ ORDER BY day DESC, cost DESC;`;
             const tgCfg = JSON.parse(fs.readFileSync(TG_CONFIG_PATH, "utf8"));
             const botToken = tgCfg.token;
             if (botToken) {
-              await fetch(
+              const tgRes = await fetch(
                 `https://api.telegram.org/bot${botToken}/sendMessage`,
                 {
                   method: "POST",
@@ -8187,6 +8648,14 @@ ORDER BY day DESC, cost DESC;`;
                   body: JSON.stringify({ chat_id: tgChatId, text: message }),
                 },
               );
+              const tgData = await tgRes.json().catch(() => ({}));
+              if (!tgRes.ok || !tgData.ok) {
+                throw new Error(
+                  tgData.description ||
+                    tgData.error ||
+                    `Telegram send failed (${tgRes.status})`,
+                );
+              }
             }
           }
         }
@@ -8458,7 +8927,7 @@ ORDER BY day DESC, cost DESC;`;
           {
             id: "crew-lead",
             label: "crew-lead",
-            description: "Chat commander — dashboard chat, CrewChat, Telegram",
+            description: "Chat commander — dashboard chat, crewchat, Telegram",
             port: crewLeadPort,
             running: crewLeadUp,
             canRestart: true,
@@ -8590,7 +9059,7 @@ ORDER BY day DESC, cost DESC;`;
             label: "Vibe UI",
             description: studioUp
               ? "Monaco editor + agent chat — Cursor-like IDE for crewswarm"
-              : "Run: npm run studio:start (port 3333)",
+              : "Run: npm run vibe:start (port 3333)",
             port: 3333,
             running: studioUp,
             canRestart: true,
@@ -8602,7 +9071,7 @@ ORDER BY day DESC, cost DESC;`;
             label: "Vibe Watch Server",
             description: watchUp
               ? "CLI → Vibe live reload WebSocket relay (port 3334)"
-              : "Run: npm run studio:watch — enables live file reload in Vibe",
+              : "Run: npm run vibe:watch — enables live file reload in Vibe",
             port: 3334,
             running: watchUp,
             canRestart: true,
@@ -9683,14 +10152,35 @@ if (process.argv.includes("--print-html")) {
 }
 
 process.on("uncaughtException", (err) => {
+  const msg = String(err?.message || err || "");
   console.error(
     "[dashboard] uncaughtException:",
-    err?.stack || err?.message || err,
+    err?.stack || msg,
   );
 
-  // Always exit on uncaught exceptions — process is in undefined state
-  console.error("[dashboard] FATAL — exiting due to uncaught exception");
-  process.exit(1);
+  // Benign errors from engine passthrough / SSE streams — keep alive
+  if (
+    msg === "terminated" ||
+    msg === "aborted" ||
+    /client.*disconnect/i.test(msg) ||
+    /socket hang up/i.test(msg) ||
+    /ECONNRESET/i.test(msg) ||
+    /EPIPE/i.test(msg) ||
+    /fetch failed/i.test(msg) ||
+    /UND_ERR/i.test(msg)
+  ) {
+    console.error("[dashboard] Non-fatal uncaughtException — keeping alive");
+    return;
+  }
+
+  // Fatal errors: port conflicts, permissions, OOM — must exit
+  if (/EADDRINUSE|EACCES|out of memory|cannot allocate/i.test(msg)) {
+    console.error("[dashboard] FATAL — exiting due to uncaught exception");
+    process.exit(1);
+  }
+
+  // Default: log but keep alive — engine passthrough errors shouldn't kill the dashboard
+  console.error("[dashboard] Unexpected uncaughtException — keeping alive (not fatal)");
 });
 
 process.on("unhandledRejection", (reason) => {