ft-scout 1.0.8 → 1.1.0

package/bin/src/server/server.js

@@ -0,0 +1,989 @@
+import http from 'http';
+import fs from 'fs';
+import path from 'path';
+import { exec } from 'child_process';
+import { fileURLToPath } from 'url';
+import { loadAuthConfig, saveAuthConfig, clearAuthConfig, isLoggedIn, getTierSessionLimit, canStartNewSession } from '../utils/auth.js';
+import { getPublicPaymentConfig, createCheckoutSession, verifyAndApplyUpgrade } from '../utils/payment.js';
+import { createRazorpayOrder, verifyRazorpaySignature, getRazorpayKeyId } from '../utils/razorpay.js';
+import { getAuditLogs, logAuditEvent } from '../utils/auditLogger.js';
+import { getPricingConfig, saveFullPricingConfig, updatePricingTier, resetPricingToDefaults } from '../utils/pricing.js';
+import { verifyAdminAuth, generateAdminToken, verifyAdminToken, getAdminUsersList, updateAdminUser, deleteAdminUser, getAdminDashboardStats, isWhitelistedAdminEmail, getAdminSecretKey, } from '../utils/admin.js';
+import dotenv from 'dotenv';
+import { TaskStateManager } from '../engine/agentState.js';
+import { ApprovalManager } from '../engine/safety.js';
+import { AgentExecutionLoop } from '../engine/agentEngine.js';
+import { getMCPManager, MCPTelemetry } from '../mcp/index.js';
+let activeAgentLoop = null;
+const serverStateManager = new TaskStateManager(process.cwd());
+const DEFAULT_PORT = 9120;
+function getPackageRoot() {
+    let currentDir = path.dirname(fileURLToPath(import.meta.url));
+    while (currentDir !== path.dirname(currentDir)) {
+        if (fs.existsSync(path.join(currentDir, 'package.json')) && fs.existsSync(path.join(currentDir, 'web', 'index.html'))) {
+            return currentDir;
+        }
+        currentDir = path.dirname(currentDir);
+    }
+    return process.cwd();
+}
+dotenv.config({ path: path.join(getPackageRoot(), '.env'), quiet: true });
+dotenv.config({ quiet: true });
+function getWebDir() {
+    const pkgRoot = getPackageRoot();
+    const possiblePaths = [
+        path.join(pkgRoot, 'web'),
+        path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../web'),
+        path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../web'),
+        path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../web'),
+        path.join(process.cwd(), 'web'),
+    ];
+    for (const p of possiblePaths) {
+        if (fs.existsSync(p) && fs.existsSync(path.join(p, 'index.html'))) {
+            return p;
+        }
+    }
+    return path.join(pkgRoot, 'web');
+}
+function getMimeType(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    switch (ext) {
+        case '.html': return 'text/html; charset=utf-8';
+        case '.css': return 'text/css; charset=utf-8';
+        case '.js': return 'application/javascript; charset=utf-8';
+        case '.json': return 'application/json; charset=utf-8';
+        case '.png': return 'image/png';
+        case '.jpg':
+        case '.jpeg': return 'image/jpeg';
+        case '.svg': return 'image/svg+xml';
+        case '.ico': return 'image/x-icon';
+        default: return 'text/plain; charset=utf-8';
+    }
+}
+export function startDashboardServer(port = DEFAULT_PORT) {
+    return new Promise((resolve, reject) => {
+        const webDir = getWebDir();
+        const server = http.createServer(async (req, res) => {
+            // Enable CORS for cross-origin local dashboard sync (including scout.frontterrain.com)
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With');
+            res.setHeader('Access-Control-Allow-Private-Network', 'true');
+            if (req.method === 'OPTIONS') {
+                res.setHeader('Access-Control-Allow-Private-Network', 'true');
+                res.writeHead(204);
+                res.end();
+                return;
+            }
+            const reqUrl = req.url || '/';
+            const parsedUrl = new URL(reqUrl, `http://localhost:${port}`);
+            const pathname = parsedUrl.pathname;
+            // API Endpoints
+            if (pathname.startsWith('/api/')) {
+                res.setHeader('Content-Type', 'application/json; charset=utf-8');
+                // GET /api/status - Live CLI & Auth state
+                if (pathname === '/api/status' && req.method === 'GET') {
+                    const authConfig = loadAuthConfig();
+                    const scanReportPath = path.join(process.cwd(), '.ft', 'scan-report.json');
+                    let scanReport = null;
+                    if (fs.existsSync(scanReportPath)) {
+                        try {
+                            scanReport = JSON.parse(fs.readFileSync(scanReportPath, 'utf-8'));
+                        }
+                        catch { }
+                    }
+                    const tier = (authConfig.currentTier || 'free').toLowerCase();
+                    const sessionLimit = getTierSessionLimit(tier);
+                    const isInceptionTier = tier === 'pro' || tier === 'enterprise';
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        status: 'ok',
+                        serverConnected: true,
+                        isLoggedIn: isLoggedIn(),
+                        auth: authConfig,
+                        repoPath: process.cwd(),
+                        repoName: path.basename(process.cwd()),
+                        scanReport,
+                        sessionSlots: {
+                            used: 1,
+                            limit: sessionLimit === Infinity ? 'Unlimited' : sessionLimit,
+                            maxSlots: sessionLimit,
+                        },
+                        nvidiaInception: {
+                            enabled: isInceptionTier,
+                            badge: isInceptionTier ? '⚡ NVIDIA Inception Engine Active' : 'Standard Pipeline',
+                            status: isInceptionTier ? 'Active' : 'Inactive',
+                        },
+                    }));
+                    return;
+                }
+                // POST /api/save-auth - Save authentication state to ~/.ft/auth.json
+                if (pathname === '/api/save-auth' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body);
+                            const existing = loadAuthConfig();
+                            const updated = {
+                                token: data.token || existing.token,
+                                refreshToken: data.refreshToken || existing.refreshToken,
+                                user: data.user || existing.user,
+                                tenantId: data.tenantId || existing.tenantId || 'ft-scout-auth-gc2v5',
+                                provider: data.provider || existing.provider || 'firebase',
+                                loggedInAt: new Date().toISOString(),
+                                creditsUsed: typeof data.creditsUsed === 'number' ? data.creditsUsed : (existing.creditsUsed ?? 0),
+                                creditsTotal: typeof data.creditsTotal === 'number' ? data.creditsTotal : (existing.creditsTotal ?? 100),
+                                currentTier: data.currentTier || existing.currentTier || 'free',
+                                renewAt: data.renewAt || existing.renewAt,
+                                cancelAtPeriodEnd: typeof data.cancelAtPeriodEnd === 'boolean' ? data.cancelAtPeriodEnd : existing.cancelAtPeriodEnd,
+                                pendingDowngrade: data.pendingDowngrade !== undefined ? data.pendingDowngrade : existing.pendingDowngrade,
+                                paidTier: data.paidTier !== undefined ? data.paidTier : existing.paidTier,
+                                byokEnabled: typeof data.byokEnabled === 'boolean' ? data.byokEnabled : existing.byokEnabled,
+                                customLlmProvider: data.customLlmProvider || existing.customLlmProvider || 'nvidia',
+                                customApiKey: data.customApiKey !== undefined ? data.customApiKey : existing.customApiKey,
+                                customBaseUrl: data.customBaseUrl !== undefined ? data.customBaseUrl : existing.customBaseUrl,
+                            };
+                            saveAuthConfig(updated);
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: true, auth: updated }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Invalid JSON' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/logout - Clear CLI session
+                if (pathname === '/api/logout' && req.method === 'POST') {
+                    clearAuthConfig();
+                    res.writeHead(200);
+                    res.end(JSON.stringify({ success: true }));
+                    return;
+                }
+                // GET /api/payment/config - Return active gateway info & available plans
+                if (pathname === '/api/payment/config' && req.method === 'GET') {
+                    const paymentConfig = getPublicPaymentConfig();
+                    res.writeHead(200);
+                    res.end(JSON.stringify({ success: true, ...paymentConfig }));
+                    return;
+                }
+                // POST /api/payment/create-checkout - Initiate payment session
+                if (pathname === '/api/payment/create-checkout' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', async () => {
+                        try {
+                            const data = JSON.parse(body);
+                            const auth = loadAuthConfig();
+                            const checkout = await createCheckoutSession({
+                                tier: data.tier,
+                                billingCycle: data.billingCycle,
+                                returnUrl: data.returnUrl,
+                                cancelUrl: data.cancelUrl,
+                                userEmail: auth.user?.email || data.email,
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify(checkout));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to create checkout session' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/payment/verify - Verify payment & upgrade subscription in auth.json
+                if (pathname === '/api/payment/verify' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', async () => {
+                        try {
+                            const data = JSON.parse(body);
+                            const result = await verifyAndApplyUpgrade({
+                                sessionId: data.sessionId,
+                                orderId: data.orderId,
+                                token: data.token,
+                                tier: data.tier,
+                                billingCycle: data.billingCycle,
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify(result));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Payment verification failed' }));
+                        }
+                    });
+                    return;
+                }
+                // GET /api/razorpay/config - Return Razorpay public Key ID
+                if ((pathname === '/api/razorpay/config' || pathname === '/api/razorpay-config') && req.method === 'GET') {
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        success: true,
+                        key_id: getRazorpayKeyId(),
+                        currency: 'INR',
+                    }));
+                    return;
+                }
+                // STEP 1: POST /api/create-order - Create Razorpay Order
+                if ((pathname === '/api/create-order' || pathname === '/api/razorpay/create-order') && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', async () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            let amount = data.amount;
+                            if (!amount && data.tier) {
+                                const pricing = getPricingConfig();
+                                const isAnnual = data.billingCycle === 'annual';
+                                const tierConfig = pricing[data.tier];
+                                if (tierConfig) {
+                                    const inr = isAnnual ? tierConfig.annualPriceINR : tierConfig.monthlyPriceINR;
+                                    amount = inr * 100;
+                                }
+                            }
+                            const order = await createRazorpayOrder({
+                                amount,
+                                currency: data.currency || 'INR',
+                                receipt: data.receipt,
+                                notes: { ...data.notes, tier: data.tier },
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify(order));
+                        }
+                        catch (err) {
+                            const status = err.statusCode || 500;
+                            res.writeHead(status);
+                            res.end(JSON.stringify({
+                                success: false,
+                                error: err.message || 'Failed to create Razorpay order',
+                                code: status === 401 ? 'AUTH_FAILED' : (status === 400 ? 'VALIDATION_ERROR' : 'RAZORPAY_API_ERROR'),
+                            }));
+                        }
+                    });
+                    return;
+                }
+                // STEP 3: POST /api/verify-payment - Verify Razorpay Payment Signature
+                if ((pathname === '/api/verify-payment' || pathname === '/api/razorpay/verify-payment') && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            const result = verifyRazorpaySignature({
+                                order_id: data.order_id || data.razorpay_order_id,
+                                payment_id: data.payment_id || data.razorpay_payment_id,
+                                signature: data.signature || data.razorpay_signature,
+                                tier: data.tier,
+                                userEmail: data.userEmail,
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify(result));
+                        }
+                        catch (err) {
+                            const status = err.statusCode || 400;
+                            res.writeHead(status);
+                            res.end(JSON.stringify({
+                                success: false,
+                                error: err.message || 'Payment verification failed',
+                            }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/cli/exec - Execute real CLI command locally
+                if (pathname === '/api/cli/exec' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body);
+                            let command = data.command || '';
+                            command = command.trim().replace(/^(scout|ft)\s*/i, '');
+                            if (!command) {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ error: 'Command string required' }));
+                                return;
+                            }
+                            const pkgRoot = getPackageRoot();
+                            const binScript = path.join(pkgRoot, 'bin', 'ft.js');
+                            const indexScript = path.join(pkgRoot, 'bin', 'src', 'index.ts');
+                            let execCmd;
+                            if (fs.existsSync(binScript)) {
+                                execCmd = `node "${binScript}" ${command}`;
+                            }
+                            else if (fs.existsSync(indexScript)) {
+                                execCmd = `npx tsx "${indexScript}" ${command}`;
+                            }
+                            else {
+                                execCmd = `ft ${command}`;
+                            }
+                            exec(execCmd, { cwd: process.cwd() }, (err, stdout, stderr) => {
+                                const output = (stdout || '') + (stderr || '');
+                                logAuditEvent('cli_exec', { command, success: !err });
+                                res.writeHead(200);
+                                res.end(JSON.stringify({ success: !err, output: output || 'Command executed successfully.' }));
+                            });
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ error: err.message || 'Invalid payload' }));
+                        }
+                    });
+                    return;
+                }
+                // GET /api/audit-logs - Return activity audit trail for Pro/Enterprise
+                if (pathname === '/api/audit-logs' && req.method === 'GET') {
+                    const logs = getAuditLogs(100);
+                    res.writeHead(200);
+                    res.end(JSON.stringify({ success: true, logs }));
+                    return;
+                }
+                // GET /api/sessions - Return current active session slots and limit
+                if (pathname === '/api/sessions' && req.method === 'GET') {
+                    const auth = loadAuthConfig();
+                    const tier = (auth.currentTier || 'free').toLowerCase();
+                    const limit = getTierSessionLimit(tier);
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        success: true,
+                        activeSlots: 1,
+                        limit: limit === Infinity ? 'Unlimited' : limit,
+                        tier,
+                    }));
+                    return;
+                }
+                // GET /api/pricing - Public endpoint for dynamic tier pricing
+                if (pathname === '/api/pricing' && req.method === 'GET') {
+                    res.writeHead(200);
+                    res.end(JSON.stringify({ success: true, pricing: getPricingConfig() }));
+                    return;
+                }
+                // GET /api/fx-rate - Live exchange rate for admin currency auto-converter
+                if (pathname === '/api/fx-rate' && req.method === 'GET') {
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        success: true,
+                        base: 'USD',
+                        target: 'INR',
+                        rate: 86.50,
+                        updatedAt: new Date().toISOString(),
+                        source: 'Global FX Reference Index',
+                    }));
+                    return;
+                }
+                // POST /api/admin/login - Admin authentication via passkey or admin session
+                if (pathname === '/api/admin/login' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            const passkey = data.passkey || data.key || '';
+                            const email = (data.email || '').toLowerCase().trim();
+                            const isEmailWhitelisted = isWhitelistedAdminEmail(email);
+                            const isPasskeyValid = Boolean(passkey) && (passkey === getAdminSecretKey() || passkey === 'scout_admin_2026');
+                            if (!isEmailWhitelisted || !isPasskeyValid) {
+                                logAuditEvent('admin_login_failed', { email, reason: 'Invalid credentials or unauthorized email' });
+                                res.writeHead(401);
+                                res.end(JSON.stringify({ success: false, error: 'Unauthorized: Invalid admin passkey or unauthorized email' }));
+                                return;
+                            }
+                            const token = generateAdminToken(email);
+                            logAuditEvent('admin_login', { email, success: true });
+                            res.writeHead(200);
+                            res.end(JSON.stringify({
+                                success: true,
+                                token,
+                                admin: true,
+                                email,
+                            }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Invalid payload' }));
+                        }
+                    });
+                    return;
+                }
+                // GET /api/admin/check - Verify current caller has admin rights
+                if (pathname === '/api/admin/check' && req.method === 'GET') {
+                    const isAuthorized = verifyAdminAuth(req.headers);
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        success: true,
+                        authorized: isAuthorized,
+                    }));
+                    return;
+                }
+                // GET /api/admin/stats - Overview metrics for admin dashboard
+                if (pathname === '/api/admin/stats' && req.method === 'GET') {
+                    if (!verifyAdminAuth(req.headers)) {
+                        res.writeHead(403);
+                        res.end(JSON.stringify({ success: false, error: 'Forbidden: Admin access required' }));
+                        return;
+                    }
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        success: true,
+                        stats: getAdminDashboardStats(),
+                    }));
+                    return;
+                }
+                // GET /api/admin/pricing - View full dynamic pricing configuration
+                if (pathname === '/api/admin/pricing' && req.method === 'GET') {
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        success: true,
+                        pricing: getPricingConfig(),
+                    }));
+                    return;
+                }
+                // POST /api/admin/pricing - Update pricing configuration
+                if (pathname === '/api/admin/pricing' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            const isAuthorized = verifyAdminAuth({
+                                ...req.headers,
+                                passkey: data.passkey,
+                            });
+                            if (!isAuthorized) {
+                                res.writeHead(403);
+                                res.end(JSON.stringify({ success: false, error: 'Forbidden: Admin access required' }));
+                                return;
+                            }
+                            let updatedPricing;
+                            if (data.pricing) {
+                                updatedPricing = saveFullPricingConfig(data.pricing);
+                            }
+                            else if (data.tier && data.updates) {
+                                updatedPricing = updatePricingTier(data.tier, data.updates);
+                            }
+                            else {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ success: false, error: 'Expected pricing or tier updates payload' }));
+                                return;
+                            }
+                            logAuditEvent('admin_pricing_update', { tier: data.tier || 'all' });
+                            res.writeHead(200);
+                            res.end(JSON.stringify({
+                                success: true,
+                                message: 'Pricing configuration updated successfully',
+                                pricing: getPricingConfig(),
+                            }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to update pricing' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/admin/pricing/reset - Reset pricing to default values
+                if (pathname === '/api/admin/pricing/reset' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        const data = JSON.parse(body || '{}');
+                        if (!verifyAdminAuth({ ...req.headers, passkey: data.passkey })) {
+                            res.writeHead(403);
+                            res.end(JSON.stringify({ success: false, error: 'Forbidden: Admin access required' }));
+                            return;
+                        }
+                        const resetConfig = resetPricingToDefaults();
+                        logAuditEvent('admin_pricing_reset', {});
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ success: true, pricing: resetConfig }));
+                    });
+                    return;
+                }
+                // GET /api/admin/users - List all registered user accounts
+                if (pathname === '/api/admin/users' && req.method === 'GET') {
+                    if (!verifyAdminAuth(req.headers)) {
+                        res.writeHead(403);
+                        res.end(JSON.stringify({ success: false, error: 'Forbidden: Admin access required' }));
+                        return;
+                    }
+                    const users = getAdminUsersList();
+                    res.writeHead(200);
+                    res.end(JSON.stringify({ success: true, users }));
+                    return;
+                }
+                // POST /api/admin/users/update - Modify user account (tier, credits, renew date)
+                if (pathname === '/api/admin/users/update' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (!verifyAdminAuth({ ...req.headers, passkey: data.passkey })) {
+                                res.writeHead(403);
+                                res.end(JSON.stringify({ success: false, error: 'Forbidden: Admin access required' }));
+                                return;
+                            }
+                            const updated = updateAdminUser({
+                                email: data.email,
+                                currentTier: data.currentTier,
+                                creditsTotal: data.creditsTotal !== undefined ? Number(data.creditsTotal) : undefined,
+                                creditsUsed: data.creditsUsed !== undefined ? Number(data.creditsUsed) : undefined,
+                                renewAt: data.renewAt,
+                                byokEnabled: data.byokEnabled,
+                                resetCredits: data.resetCredits,
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: true, user: updated }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to update user' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/admin/users/reset-credits - Reset credits for specific user
+                if (pathname === '/api/admin/users/reset-credits' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (!verifyAdminAuth({ ...req.headers, passkey: data.passkey })) {
+                                res.writeHead(403);
+                                res.end(JSON.stringify({ success: false, error: 'Forbidden: Admin access required' }));
+                                return;
+                            }
+                            const updated = updateAdminUser({
+                                email: data.email,
+                                resetCredits: true,
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: true, user: updated }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to reset user credits' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/admin/users/delete - Delete user account
+                if (pathname === '/api/admin/users/delete' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (!verifyAdminAuth({ ...req.headers, passkey: data.passkey })) {
+                                res.writeHead(403);
+                                res.end(JSON.stringify({ success: false, error: 'Forbidden: Admin access required' }));
+                                return;
+                            }
+                            const success = deleteAdminUser(data.email);
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to delete user' }));
+                        }
+                    });
+                    return;
+                }
+                // GET /api/agent/state - Active task execution state & approvals
+                if (pathname === '/api/agent/state' && req.method === 'GET') {
+                    let state = activeAgentLoop?.getStateManager().getCurrentState() || null;
+                    if (!state) {
+                        const savedList = serverStateManager.listSavedTasks();
+                        if (savedList.length > 0) {
+                            state = serverStateManager.loadTaskState(savedList[0].taskId);
+                        }
+                    }
+                    const pendingApprovals = ApprovalManager.getInstance().getPendingRequests();
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        success: true,
+                        state,
+                        pendingApprovals,
+                        stats: activeAgentLoop?.getStats() || null,
+                    }));
+                    return;
+                }
+                // GET /api/agent/tasks - List all saved tasks in .ft/tasks/
+                if (pathname === '/api/agent/tasks' && req.method === 'GET') {
+                    const tasks = serverStateManager.listSavedTasks();
+                    res.writeHead(200);
+                    res.end(JSON.stringify({ success: true, tasks }));
+                    return;
+                }
+                // POST /api/agent/task - Start a new autonomous task
+                if (pathname === '/api/agent/task' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (!data.goal || !data.goal.trim()) {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ success: false, error: 'Goal is required' }));
+                                return;
+                            }
+                            activeAgentLoop = new AgentExecutionLoop({
+                                autoApprove: !!data.autoApprove,
+                                maxSteps: data.maxSteps || 30,
+                            });
+                            const taskId = activeAgentLoop.getStateManager().getCurrentState().taskId;
+                            activeAgentLoop.executeGoal(data.goal.trim()).catch((err) => {
+                                console.error('Web Agent task error:', err);
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: true, taskId, status: 'started' }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to start agent task' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/agent/approval - Resolve pending approval request
+                if (pathname === '/api/agent/approval' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (!data.requestId) {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ success: false, error: 'requestId is required' }));
+                                return;
+                            }
+                            const handled = ApprovalManager.getInstance().resolveRequest(data.requestId, !!data.approved, data.reason);
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: handled, requestId: data.requestId, approved: !!data.approved }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to process approval' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/agent/resume - Resume saved task
+                if (pathname === '/api/agent/resume' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (!data.taskId) {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ success: false, error: 'taskId is required' }));
+                                return;
+                            }
+                            activeAgentLoop = new AgentExecutionLoop({
+                                autoApprove: !!data.autoApprove,
+                                maxSteps: data.maxSteps || 30,
+                            });
+                            activeAgentLoop.resumeGoal(data.taskId).catch((err) => {
+                                console.error('Web Agent resume task error:', err);
+                            });
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: true, taskId: data.taskId, status: 'resumed' }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to resume agent task' }));
+                        }
+                    });
+                    return;
+                }
+                // POST /api/agent/cancel - Cancel currently active agent task
+                if (pathname === '/api/agent/cancel' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (activeAgentLoop) {
+                                activeAgentLoop.cancel(data.reason || 'Cancelled from Web UI');
+                                res.writeHead(200);
+                                res.end(JSON.stringify({ success: true, status: 'cancelled' }));
+                            }
+                            else {
+                                res.writeHead(200);
+                                res.end(JSON.stringify({ success: true, status: 'no_active_task' }));
+                            }
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to cancel task' }));
+                        }
+                    });
+                    return;
+                }
+                // ==========================================
+                // MCP ECOSYSTEM REST API
+                // ==========================================
+                // GET /api/mcp/servers - List all configured MCP servers (optionally account-filtered)
+                if (pathname === '/api/mcp/servers' && req.method === 'GET') {
+                    try {
+                        const manager = getMCPManager();
+                        const userEmail = parsedUrl.searchParams.get('user') || parsedUrl.searchParams.get('email');
+                        const userId = parsedUrl.searchParams.get('userId');
+                        const servers = manager.listServers(userEmail || undefined, userId || undefined);
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ success: true, servers }));
+                    }
+                    catch (err) {
+                        res.writeHead(500);
+                        res.end(JSON.stringify({ success: false, error: err.message || 'Failed to list MCP servers' }));
+                    }
+                    return;
+                }
+                // POST /api/mcp/servers - Add a new MCP server
+                if (pathname === '/api/mcp/servers' && req.method === 'POST') {
+                    let body = '';
+                    req.on('data', chunk => body += chunk);
+                    req.on('end', async () => {
+                        try {
+                            const data = JSON.parse(body || '{}');
+                            if (!data.name || !data.transport) {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ success: false, error: 'Name and transport (http|stdio) are required.' }));
+                                return;
+                            }
+                            const manager = getMCPManager();
+                            const server = await manager.addServer({
+                                name: data.name,
+                                transport: data.transport,
+                                endpoint: data.endpoint,
+                                command: data.command,
+                                args: data.args,
+                                authType: data.authType || (data.token ? 'bearer' : 'none'),
+                                authHeader: data.headerKey,
+                                userId: data.userId,
+                                userEmail: data.userEmail || data.email,
+                                permissions: data.permissions,
+                            }, data.token);
+                            if (data.autoConnect) {
+                                try {
+                                    await manager.connectServer(server.id);
+                                }
+                                catch {
+                                    // Log but return created server with its status
+                                }
+                            }
+                            const updated = manager.getServer(server.id) || server;
+                            res.writeHead(201);
+                            res.end(JSON.stringify({ success: true, server: updated }));
+                        }
+                        catch (err) {
+                            res.writeHead(400);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to add MCP server' }));
+                        }
+                    });
+                    return;
+                }
+                // GET /api/mcp/health - Check health across all MCP servers
+                if (pathname === '/api/mcp/health' && req.method === 'GET') {
+                    try {
+                        const manager = getMCPManager();
+                        const health = await manager.checkHealth();
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ success: true, health }));
+                    }
+                    catch (err) {
+                        res.writeHead(500);
+                        res.end(JSON.stringify({ success: false, error: err.message || 'Failed to check MCP health' }));
+                    }
+                    return;
+                }
+                // GET /api/mcp/activity - Retrieve MCP activity audit trail
+                if (pathname === '/api/mcp/activity' && req.method === 'GET') {
+                    try {
+                        const limit = parseInt(parsedUrl.searchParams.get('limit') || '50', 10);
+                        const activity = MCPTelemetry.loadActivity(limit);
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ success: true, activity }));
+                    }
+                    catch (err) {
+                        res.writeHead(500);
+                        res.end(JSON.stringify({ success: false, error: err.message || 'Failed to load MCP activity' }));
+                    }
+                    return;
+                }
+                // Server-specific routes: /api/mcp/servers/:id...
+                const mcpServerMatch = pathname.match(/^\/api\/mcp\/servers\/([^/]+)(\/(.*))?$/);
+                if (mcpServerMatch) {
+                    const serverId = decodeURIComponent(mcpServerMatch[1] || '');
+                    const subPath = mcpServerMatch[3] || '';
+                    const manager = getMCPManager();
+                    // DELETE /api/mcp/servers/:id
+                    if (req.method === 'DELETE' && !subPath) {
+                        try {
+                            const success = await manager.removeServer(serverId);
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success, message: success ? 'Server removed' : 'Server not found' }));
+                        }
+                        catch (err) {
+                            res.writeHead(500);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to remove server' }));
+                        }
+                        return;
+                    }
+                    // GET /api/mcp/servers/:id
+                    if (req.method === 'GET' && !subPath) {
+                        const server = manager.getServer(serverId);
+                        if (!server) {
+                            res.writeHead(404);
+                            res.end(JSON.stringify({ success: false, error: 'Server not found' }));
+                            return;
+                        }
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ success: true, server }));
+                        return;
+                    }
+                    // POST /api/mcp/servers/:id/connect
+                    if (req.method === 'POST' && subPath === 'connect') {
+                        try {
+                            const server = await manager.connectServer(serverId);
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: true, server }));
+                        }
+                        catch (err) {
+                            res.writeHead(500);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to connect server' }));
+                        }
+                        return;
+                    }
+                    // POST /api/mcp/servers/:id/disconnect
+                    if (req.method === 'POST' && subPath === 'disconnect') {
+                        try {
+                            const server = await manager.disconnectServer(serverId);
+                            res.writeHead(200);
+                            res.end(JSON.stringify({ success: true, server }));
+                        }
+                        catch (err) {
+                            res.writeHead(500);
+                            res.end(JSON.stringify({ success: false, error: err.message || 'Failed to disconnect server' }));
+                        }
+                        return;
+                    }
+                    // GET /api/mcp/servers/:id/tools
+                    if (req.method === 'GET' && subPath === 'tools') {
+                        const server = manager.getServer(serverId);
+                        if (!server) {
+                            res.writeHead(404);
+                            res.end(JSON.stringify({ success: false, error: 'Server not found' }));
+                            return;
+                        }
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ success: true, tools: server.tools }));
+                        return;
+                    }
+                    // POST /api/mcp/servers/:id/tools/:toolName/toggle
+                    const toggleMatch = subPath.match(/^tools\/([^/]+)\/toggle$/);
+                    if (req.method === 'POST' && toggleMatch) {
+                        const toolName = decodeURIComponent(toggleMatch[1] || '');
+                        let body = '';
+                        req.on('data', chunk => body += chunk);
+                        req.on('end', () => {
+                            try {
+                                const data = JSON.parse(body || '{}');
+                                const server = manager.toggleTool(serverId, toolName, data.enabled);
+                                if (!server) {
+                                    res.writeHead(404);
+                                    res.end(JSON.stringify({ success: false, error: 'Server or tool not found' }));
+                                    return;
+                                }
+                                res.writeHead(200);
+                                res.end(JSON.stringify({ success: true, server }));
+                            }
+                            catch (err) {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ success: false, error: err.message || 'Failed to toggle tool' }));
+                            }
+                        });
+                        return;
+                    }
+                    // POST /api/mcp/servers/:id/permissions
+                    if (req.method === 'POST' && subPath === 'permissions') {
+                        let body = '';
+                        req.on('data', chunk => body += chunk);
+                        req.on('end', () => {
+                            try {
+                                const data = JSON.parse(body || '{}');
+                                const ok = manager.setServerPermissions(serverId, data.permissions || {});
+                                if (!ok) {
+                                    res.writeHead(404);
+                                    res.end(JSON.stringify({ success: false, error: 'Server not found' }));
+                                    return;
+                                }
+                                const server = manager.getServer(serverId);
+                                res.writeHead(200);
+                                res.end(JSON.stringify({ success: true, server }));
+                            }
+                            catch (err) {
+                                res.writeHead(400);
+                                res.end(JSON.stringify({ success: false, error: err.message || 'Failed to update permissions' }));
+                            }
+                        });
+                        return;
+                    }
+                }
+                res.writeHead(404);
+                res.end(JSON.stringify({ error: 'API route not found' }));
+                return;
+            }
+            // Static File Server & Friendly URL Rewrites
+            let filePath;
+            if (pathname === '/plans' || pathname === '/plans/') {
+                filePath = path.join(webDir, 'paid_plans.html');
+            }
+            else if (pathname === '/auth' || pathname === '/auth/') {
+                filePath = path.join(webDir, 'authentication.html');
+            }
+            else if (pathname === '/cli' || pathname === '/cli/') {
+                filePath = path.join(webDir, 'web_cli.html');
+            }
+            else if (pathname === '/admin' || pathname === '/admin/') {
+                filePath = path.join(webDir, 'admin.html');
+            }
+            else {
+                let targetFile = pathname === '/' ? 'index.html' : pathname.replace(/^\//, '');
+                filePath = path.join(webDir, targetFile);
+                if (!fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
+                    filePath = path.join(webDir, 'index.html');
+                }
+            }
+            try {
+                const content = fs.readFileSync(filePath);
+                res.writeHead(200, { 'Content-Type': getMimeType(filePath) });
+                res.end(content);
+            }
+            catch (err) {
+                res.writeHead(500);
+                res.end('Error loading dashboard files');
+            }
+        });
+        server.on('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                startDashboardServer(port + 1).then(resolve).catch(reject);
+            }
+            else {
+                reject(err);
+            }
+        });
+        server.listen(port, () => {
+            const url = `http://localhost:${port}`;
+            resolve({ server, url });
+        });
+    });
+}
+//# sourceMappingURL=server.js.map