hermes-launch 1.1.0 → 2.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hermes-launch",
-  "version": "1.1.0",
-  "description": "One command to launch Hermes Agent — zero-to-AI-agent in seconds",
+  "version": "2.0.0",
+  "description": "Web onboarding wizard for Hermes Agent — install, configure, and launch from your browser",
   "bin": {
     "hermes-launch": "./bin/hermes-launch.js"
   },

package/src/server.js

@@ -0,0 +1,599 @@
+/**
+ * hermes-launch web server — serves the onboarding wizard + API endpoints.
+ * Zero npm deps — uses Node.js built-in http module.
+ */
+
+import http from 'node:http';
+import { execSync, spawn } from 'node:child_process';
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir, platform as osPlatform } from 'node:os';
+import { resolve } from 'node:path';
+
+const PLATFORM = osPlatform();
+const IS_WIN = PLATFORM === 'win32';
+const IS_MAC = PLATFORM === 'darwin';
+const IS_LINUX = PLATFORM === 'linux';
+
+const HERMES_HOME = IS_WIN
+  ? resolve(process.env.USERPROFILE || homedir(), '.hermes')
+  : resolve(homedir(), '.hermes');
+const CONFIG_PATH = resolve(HERMES_HOME, 'config.yaml');
+const INSTALL_URL = 'https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh';
+
+// ——— helpers ———
+
+function run(cmd, opts = {}) {
+  const defaults = { stdio: 'pipe', timeout: opts.timeout || 120_000, shell: IS_WIN };
+  try {
+    const out = execSync(cmd, { ...defaults, ...opts });
+    return { ok: true, out: out?.toString()?.trim() || '', code: 0 };
+  } catch (e) {
+    return { ok: false, out: e.stderr?.toString()?.trim() || e.message, code: e.status || 1 };
+  }
+}
+
+// ——— API handlers ———
+
+const api = {};
+
+api.status = async () => {
+  const py = findPython();
+  const hasHermes = run('hermes --version', { silent: true }).ok;
+  let hermesVersion = '';
+  if (hasHermes) {
+    const r = run('hermes --version', { silent: true });
+    hermesVersion = r.out.split('\n')[0] || 'installed';
+  }
+  const hasConfig = existsSync(CONFIG_PATH);
+  let configOk = false;
+  if (hasConfig) {
+    const raw = readFileSync(CONFIG_PATH, 'utf-8');
+    configOk = /^model:\s*\n/m.test(raw) && !raw.includes('default: ""');
+  }
+
+  // Check dashboard
+  const dashRunning = run('curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:9119/ 2>/dev/null || echo 0', { silent: true }).out === '200';
+
+  const tools = ['web', 'terminal', 'file', 'skills', 'session_search', 'delegate_task', 'memory', 'vision', 'tts', 'clarify'];
+
+  return {
+    platform: PLATFORM,
+    python: py,
+    hermes: { installed: hasHermes, version: hermesVersion },
+    config: { exists: hasConfig, configured: configOk },
+    dashboard: { running: dashRunning, url: 'http://localhost:9119' },
+    tools: tools.map(t => ({
+      name: t,
+      enabled: run(`hermes tools list 2>/dev/null | grep -q "${t}.*enabled" || echo no`, { silent: true }).out.includes('no') === false,
+    })),
+  };
+};
+
+api.install = async () => {
+  if (IS_WIN) {
+    const py = findPython();
+    if (!py.found) return { ok: false, step: 'python', msg: 'Python not found. Install it first.' };
+    run(`${py.bin} -m pip install --upgrade pip`, { silent: true, timeout: 60_000 });
+    const r = run(`${py.bin} -m pip install hermes-agent`, { timeout: 180_000 });
+    if (!r.ok) return { ok: false, step: 'pip', msg: r.out };
+    return { ok: true, msg: 'Hermes installed via pip' };
+  }
+  // macOS / Linux
+  const r = run(`curl -fsSL ${INSTALL_URL} | bash`, { timeout: 180_000 });
+  if (!r.ok) return { ok: false, step: 'install', msg: r.out };
+  return { ok: true, msg: 'Hermes installed successfully' };
+};
+
+api.setupModel = async (model, provider) => {
+  let r;
+  if (provider) {
+    r = run(`hermes config set model.provider "${provider}"`, { silent: true });
+    if (!r.ok) return { ok: false, msg: r.out };
+  }
+  if (model) {
+    r = run(`hermes config set model.default "${model}"`, { silent: true });
+    if (!r.ok) return { ok: false, msg: r.out };
+  }
+  return { ok: true, msg: `Model configured: ${provider || 'default'} / ${model || 'default'}` };
+};
+
+api.listModels = async () => {
+  const r = run('hermes model --help 2>/dev/null || echo "picker"', { silent: true });
+  return {
+    providers: [
+      { name: 'opencode-go', label: 'OpenCode Go', models: ['deepseek-v4-flash', 'big-pickle', 'deepseek-v3.1'] },
+      { name: 'openrouter', label: 'OpenRouter', models: ['anthropic/claude-sonnet-4', 'deepseek/deepseek-v4-flash', 'google/gemini-2.5-pro-preview-03-25', 'openai/gpt-5.4'] },
+      { name: 'anthropic', label: 'Anthropic', models: ['claude-sonnet-4-20250514', 'claude-3.5-haiku'] },
+      { name: 'deepseek', label: 'DeepSeek', models: ['deepseek-chat', 'deepseek-reasoner'] },
+    ],
+  };
+};
+
+api.enableTools = async (tools) => {
+  const noop = IS_WIN ? 'ver>nul' : '2>/dev/null || true';
+  const results = [];
+  for (const t of tools) {
+    const r = run(`hermes tools enable ${t} ${noop}`, { silent: true });
+    results.push({ name: t, ok: r.ok });
+  }
+  return { ok: true, results };
+};
+
+api.startDashboard = async () => {
+  const running = run('curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:9119/ 2>/dev/null || echo 0', { silent: true });
+  if (running.out === '200') return { ok: true, alreadyRunning: true, url: 'http://localhost:9119' };
+
+  const proc = spawn('hermes', ['dashboard', '--port', '9119', '--tui', '--no-open', '--skip-build'], {
+    stdio: ['ignore', 'ignore', 'ignore'],
+    detached: true,
+    shell: IS_WIN,
+    env: { ...process.env },
+  });
+  proc.on('error', () => {});
+  if (proc.unref) proc.unref();
+
+  // Wait for it to come up
+  for (let i = 0; i < 15; i++) {
+    await new Promise(r => setTimeout(r, 1000));
+    const check = run('curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:9119/ 2>/dev/null || echo 0', { silent: true });
+    if (check.out === '200') return { ok: true, alreadyRunning: false, url: 'http://localhost:9119' };
+  }
+  return { ok: true, alreadyRunning: false, url: 'http://localhost:9119', note: 'started — may take a moment' };
+};
+
+api.gatewayStatus = async () => {
+  const r = run('hermes gateway status 2>/dev/null || echo not-configured', { silent: true });
+  return { raw: r.out };
+};
+
+api.runCommand = async (cmd) => {
+  const r = run(cmd, { timeout: 60_000 });
+  return { ok: r.ok, out: r.out, code: r.code };
+};
+
+// ——— python detection ———
+
+function findPython() {
+  const candidates = IS_WIN
+    ? ['python', 'py -3', 'python3']
+    : ['python3.14', 'python3.13', 'python3.12', 'python3.11', 'python3.10', 'python3'];
+
+  for (const bin of candidates) {
+    const r = run(`${bin} --version`, { silent: true });
+    if (r.ok) return { found: true, bin, version: r.out };
+  }
+  return { found: false, bin: null, version: null };
+}
+
+// ——— parse request body ———
+
+function parseBody(req) {
+  return new Promise(resolve => {
+    let body = '';
+    req.on('data', c => body += c);
+    req.on('end', () => {
+      try { resolve(JSON.parse(body)); }
+      catch { resolve({}); }
+    });
+  });
+}
+
+// ——— send JSON ———
+
+function json(res, code, data) {
+  const str = JSON.stringify(data);
+  res.writeHead(code, {
+    'Content-Type': 'application/json',
+    'Access-Control-Allow-Origin': '*',
+    'Content-Length': Buffer.byteLength(str),
+  });
+  res.end(str);
+}
+
+function html(res, content) {
+  res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+  res.end(content);
+}
+
+// ——— serve the onboarding page ———
+
+function serveOnboarding() {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Hermes Launch</title>
+<style>
+  :root { --bg: #0a0a0f; --card: #12121a; --border: #1e1e2e; --text: #cdd6f4; --dim: #6c7086; --accent: #89b4fa; --green: #a6e3a1; --yellow: #f9e2af; --red: #f38ba8; --radius: 12px; }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); min-height: 100vh; }
+  .app { max-width: 720px; margin: 0 auto; padding: 32px 16px; }
+  h1 { font-size: 24px; font-weight: 700; margin-bottom: 4px; }
+  .subtitle { color: var(--dim); font-size: 14px; margin-bottom: 32px; }
+  .card { background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); padding: 20px; margin-bottom: 16px; }
+  .card h2 { font-size: 16px; font-weight: 600; margin-bottom: 12px; display: flex; align-items: center; gap: 8px; }
+  .step-num { display: inline-flex; align-items: center; justify-content: center; width: 24px; height: 24px; border-radius: 50%; background: var(--border); font-size: 12px; font-weight: 700; }
+  .step-done .step-num { background: var(--green); color: #000; }
+  .step-active .step-num { background: var(--accent); color: #000; }
+  .step-active { border-color: var(--accent); }
+  .step-done { border-color: var(--green); opacity: 0.8; }
+  .status { font-size: 13px; color: var(--dim); margin-bottom: 8px; }
+  .status.ok { color: var(--green); }
+  .status.fail { color: var(--red); }
+  .status.pending { color: var(--yellow); }
+  .btn { display: inline-flex; align-items: center; gap: 6px; padding: 8px 16px; border-radius: 8px; border: 1px solid var(--border); background: var(--card); color: var(--text); font-size: 14px; cursor: pointer; transition: all .15s; }
+  .btn:hover { border-color: var(--accent); background: #1a1a2e; }
+  .btn-primary { background: var(--accent); color: #000; border-color: var(--accent); font-weight: 600; }
+  .btn-primary:hover { background: #9bbafc; }
+  .btn:disabled { opacity: 0.4; cursor: not-allowed; }
+  .btn-group { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 8px; }
+  .log { font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace; font-size: 12px; background: #050508; border-radius: 8px; padding: 12px; max-height: 200px; overflow-y: auto; white-space: pre-wrap; color: var(--dim); margin-top: 8px; }
+  .log .ok { color: var(--green); }
+  .log .fail { color: var(--red); }
+  .log .info { color: var(--accent); }
+  select, input[type="text"] { width: 100%; padding: 8px 12px; border-radius: 8px; border: 1px solid var(--border); background: var(--bg); color: var(--text); font-size: 14px; margin-bottom: 8px; }
+  select { cursor: pointer; }
+  label { display: block; font-size: 13px; color: var(--dim); margin-bottom: 4px; margin-top: 8px; }
+  .grid-2 { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }
+  .tag { display: inline-flex; align-items: center; gap: 4px; padding: 4px 10px; border-radius: 20px; font-size: 12px; background: var(--border); }
+  .tag.enabled { background: #1a3a1a; color: var(--green); border: 1px solid #2a5a2a; }
+  .tag.disabled { background: #3a1a1a; color: var(--red); border: 1px solid #5a2a2a; }
+  .link { color: var(--accent); text-decoration: none; }
+  .link:hover { text-decoration: underline; }
+  .flex { display: flex; align-items: center; gap: 8px; }
+  .spinner { width: 16px; height: 16px; border: 2px solid var(--border); border-top-color: var(--accent); border-radius: 50%; animation: spin .6s linear infinite; display: inline-block; }
+  @keyframes spin { to { transform: rotate(360deg); } }
+  .dash-url { font-family: 'SF Mono', monospace; font-size: 18px; font-weight: 700; color: var(--accent); text-align: center; padding: 16px; background: #050508; border-radius: 8px; margin-top: 8px; }
+  .footer { text-align: center; color: var(--dim); font-size: 13px; margin-top: 32px; }
+</style>
+</head>
+<body>
+<div class="app" id="app">
+  <h1>🐚 Hermes Launch</h1>
+  <p class="subtitle">Set up your AI agent in minutes — no terminal fiddling.</p>
+
+  <div id="steps"></div>
+  <div id="footer" class="footer"></div>
+</div>
+
+<script>
+const $ = s => document.querySelector(s);
+const $$ = s => document.querySelectorAll(s);
+
+async function api(path, body) {
+  const opts = { headers: { 'Accept': 'application/json' } };
+  if (body) { opts.method = 'POST'; opts.headers['Content-Type'] = 'application/json'; opts.body = JSON.stringify(body); }
+  const r = await fetch(path, opts);
+  return r.json();
+}
+
+function log(msg, type = 'info') {
+  const el = document.getElementById('activity-log');
+  if (!el) return;
+  el.innerHTML += '<span class="' + type + '">' + msg.replace(/</g, '&lt;') + '</span>\\n';
+  el.scrollTop = el.scrollHeight;
+}
+
+const STEPS = [
+  { id: 'prereqs', label: 'Checking prerequisites', run: async () => {
+    const s = await api('/api/status');
+    const ok = s.python.found;
+    document.getElementById('prereqs-status').innerHTML = ok
+      ? '<span class="status ok">✅ Python ' + (s.python.version || '') + '</span>'
+      : '<span class="status fail">❌ Python not found</span>';
+    return ok;
+  }},
+  { id: 'install', label: 'Install Hermes Agent', run: async () => {
+    const s = await api('/api/status');
+    if (s.hermes.installed) {
+      document.getElementById('install-status').innerHTML = '✅ Already installed <span class="tag">' + (s.hermes.version || '') + '</span>';
+      return true;
+    }
+    const btn = document.getElementById('install-btn');
+    const st = document.getElementById('install-status');
+    if (btn) btn.disabled = true;
+    st.innerHTML = '⏳ Installing... <span class="spinner"></span>';
+    const r = await api('/api/install');
+    st.innerHTML = r.ok ? '✅ Installed successfully' : '❌ Failed: ' + r.msg;
+    if (r.ok && btn) btn.style.display = 'none';
+    return r.ok;
+  }},
+  { id: 'config', label: 'Configure model & provider', run: async () => {
+    const s = await api('/api/status');
+    if (s.config.configured) {
+      document.getElementById('config-status').innerHTML = '✅ Already configured';
+      document.getElementById('config-area').style.display = 'none';
+      return true;
+    }
+    document.getElementById('config-area').style.display = 'block';
+    return null; // wait for user
+  }},
+  { id: 'tools', label: 'Enable tools', run: async () => {
+    const s = await api('/api/status');
+    const toolEl = document.getElementById('tools-area');
+    const allOn = s.tools.every(t => t.enabled);
+    if (allOn) {
+      document.getElementById('tools-status').innerHTML = '✅ All enabled';
+      return true;
+    }
+    toolEl.style.display = 'block';
+    renderTools(s.tools);
+    return null;
+  }},
+  { id: 'dashboard', label: 'Start web dashboard', run: async () => {
+    const s = await api('/api/status');
+    if (s.dashboard.running) {
+      document.getElementById('dash-status').innerHTML = '✅ Running at <a href="http://localhost:9119" class="link" target="_blank">localhost:9119</a>';
+      document.getElementById('dash-url').textContent = 'http://localhost:9119';
+      document.getElementById('dash-area').style.display = 'block';
+      return true;
+    }
+    const btn = document.getElementById('dash-btn');
+    const st = document.getElementById('dash-status');
+    if (btn) btn.disabled = true;
+    st.innerHTML = '⏳ Starting dashboard... <span class="spinner"></span>';
+    const r = await api('/api/start-dashboard');
+    st.innerHTML = '✅ Running at <a href="http://localhost:9119" class="link" target="_blank">localhost:9119</a>';
+    document.getElementById('dash-url').textContent = 'http://localhost:9119';
+    document.getElementById('dash-area').style.display = 'block';
+    return true;
+  }},
+];
+
+async function renderSteps() {
+  const container = document.getElementById('steps');
+  container.innerHTML = '';
+  for (let i = 0; i < STEPS.length; i++) {
+    const step = STEPS[i];
+    const card = document.createElement('div');
+    card.className = 'card';
+    card.id = 'card-' + step.id;
+    card.innerHTML = '<h2><span class="step-num">' + (i + 1) + '</span>' + step.label + '</h2>'
+      + '<div id="' + step.id + '-status" class="status pending">⏳ pending</div>'
+      + '<div id="' + step.id + '-area" style="display:none"></div>';
+    container.appendChild(card);
+  }
+
+  // Config area
+  const configArea = document.getElementById('config-area');
+  configArea.innerHTML = '<label>Provider</label><select id="provider-select"></select>'
+    + '<label>Model</label><select id="model-select"></select>'
+    + '<div class="btn-group"><button class="btn btn-primary" onclick="saveConfig()">Save Configuration</button><button class="btn" onclick="skipConfig()">Skip</button></div>'
+    + '<div id="config-result"></div>'
+    + '<div class="log" id="activity-log" style="margin-top:12px"></div>';
+
+  // Tools area
+  document.getElementById('tools-area').innerHTML = '<div id="tools-grid" class="grid-2"></div>'
+    + '<div class="btn-group"><button class="btn btn-primary" onclick="saveTools()">Enable Selected</button><button class="btn" onclick="enableAllTools()">Enable All</button><button class="btn" onclick="skipTools()">Skip</button></div>'
+    + '<div id="tools-result"></div>';
+
+  // Dashboard area
+  document.getElementById('dash-area').innerHTML = '<div class="dash-url" id="dash-url">starting...</div>'
+    + '<div class="btn-group"><a href="http://localhost:9119" class="btn btn-primary" target="_blank">Open Dashboard</a></div>';
+
+  // Load providers
+  try {
+    const models = await api('/api/models');
+    const prov = document.getElementById('provider-select');
+    models.providers.forEach(p => {
+      const opt = document.createElement('option');
+      opt.value = p.name;
+      opt.textContent = p.label;
+      prov.appendChild(opt);
+    });
+    updateModels();
+    prov.onchange = updateModels;
+  } catch (e) {
+    document.getElementById('config-area').innerHTML = '<div class="status fail">Failed to load model list: ' + e.message + '</div>';
+  }
+
+  // Run through steps
+  runSteps();
+}
+
+async function updateModels() {
+  const sel = document.getElementById('provider-select');
+  const modelSel = document.getElementById('model-select');
+  modelSel.innerHTML = '';
+  const models = await api('/api/models');
+  const prov = models.providers.find(p => p.name === sel.value);
+  if (prov) {
+    prov.models.forEach(m => {
+      const opt = document.createElement('option');
+      opt.value = m;
+      opt.textContent = m;
+      modelSel.appendChild(opt);
+    });
+  }
+}
+
+async function saveConfig() {
+  const provider = document.getElementById('provider-select').value;
+  const model = document.getElementById('model-select').value;
+  const result = document.getElementById('config-result');
+  result.innerHTML = '⏳ Saving... <span class="spinner"></span>';
+  const r = await api('/api/setup-model', { model, provider });
+  result.innerHTML = r.ok ? '✅ Saved!' : '❌ ' + r.msg;
+  document.getElementById('config-status').innerHTML = '✅ Configured: ' + provider + ' / ' + model;
+  const card = document.getElementById('card-config');
+  card.classList.remove('step-active');
+  card.classList.add('step-done');
+  setTimeout(() => runSteps(), 500);
+}
+
+function skipConfig() {
+  document.getElementById('config-status').innerHTML = '⏭️ Skipped — configure later with \`hermes model\`';
+  document.getElementById('config-area').style.display = 'none';
+  const card = document.getElementById('card-config');
+  card.classList.remove('step-active');
+  card.classList.add('step-done');
+  setTimeout(() => runSteps(), 300);
+}
+
+function renderTools(tools) {
+  const grid = document.getElementById('tools-grid');
+  grid.innerHTML = '';
+  tools.forEach(t => {
+    const div = document.createElement('div');
+    div.className = 'tag ' + (t.enabled ? 'enabled' : 'disabled');
+    div.style.cursor = 'pointer';
+    div.style.justifyContent = 'center';
+    div.style.padding = '8px';
+    div.dataset.name = t.name;
+    div.dataset.enabled = t.enabled;
+    div.innerHTML = (t.enabled ? '✅' : '➕') + ' ' + t.name;
+    div.onclick = () => {
+      div.dataset.enabled = div.dataset.enabled === 'true' ? 'false' : 'true';
+      div.className = 'tag ' + (div.dataset.enabled === 'true' ? 'enabled' : 'disabled');
+      div.innerHTML = (div.dataset.enabled === 'true' ? '✅' : '➕') + ' ' + t.name;
+    };
+    grid.appendChild(div);
+  });
+}
+
+async function saveTools() {
+  const enabled = [...document.querySelectorAll('#tools-grid .tag')]
+    .filter(el => el.dataset.enabled === 'true')
+    .map(el => el.dataset.name);
+  const result = document.getElementById('tools-result');
+  result.innerHTML = '⏳ Enabling... <span class="spinner"></span>';
+  const r = await api('/api/enable-tools', { tools: enabled });
+  result.innerHTML = r.ok ? '✅ ' + r.results.filter(x => x.ok).length + ' tools enabled' : '❌ Failed';
+  document.getElementById('tools-status').innerHTML = '✅ ' + r.results.filter(x => x.ok).length + ' tools enabled';
+  setTimeout(() => runSteps(), 300);
+}
+
+async function enableAllTools() {
+  const names = [...document.querySelectorAll('#tools-grid .tag')].map(el => el.dataset.name);
+  const result = document.getElementById('tools-result');
+  result.innerHTML = '⏳ Enabling all... <span class="spinner"></span>';
+  const r = await api('/api/enable-tools', { tools: names });
+  result.innerHTML = r.ok ? '✅ All enabled' : '❌ Failed';
+  document.getElementById('tools-status').innerHTML = '✅ All tools enabled';
+  document.getElementById('tools-grid').querySelectorAll('.tag').forEach(el => {
+    el.dataset.enabled = 'true';
+    el.className = 'tag enabled';
+    el.innerHTML = '✅ ' + el.dataset.name;
+  });
+  setTimeout(() => runSteps(), 300);
+}
+
+function skipTools() {
+  document.getElementById('tools-status').innerHTML = '⏭️ Skipped — enable later with \`hermes tools\`';
+  document.getElementById('tools-area').style.display = 'none';
+  const card = document.getElementById('card-tools');
+  card.classList.remove('step-active');
+  card.classList.add('step-done');
+  setTimeout(() => runSteps(), 300);
+}
+
+async function runSteps() {
+  for (const step of STEPS) {
+    const card = document.getElementById('card-' + step.id);
+    const st = document.getElementById(step.id + '-status');
+
+    if (st.textContent.startsWith('✅') || st.textContent.startsWith('⏭️')) continue;
+
+    card.classList.add('step-active');
+    const result = await step.run();
+    if (result === true) {
+      card.classList.remove('step-active');
+      card.classList.add('step-done');
+    }
+  }
+
+  // Show footer with next steps
+  document.getElementById('footer').innerHTML = 'Hermes Agent is ready. '
+    + 'Run <code>hermes</code> in your terminal or open the <a href="http://localhost:9119" class="link" target="_blank">web dashboard</a>. '
+    + '<br><span style="font-size:12px">This window can remain open — the setup server will keep running.</span>';
+}
+
+document.addEventListener('DOMContentLoaded', renderSteps);
+</script>
+</body>
+</html>`;
+}
+
+// ——— server ———
+
+export function startServer(port = 5050) {
+  const srv = http.createServer(async (req, res) => {
+    // CORS preflight
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, {
+        'Access-Control-Allow-Origin': '*',
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type',
+      });
+      res.end();
+      return;
+    }
+
+    const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
+    const path = url.pathname;
+
+    try {
+      // Serve onboarding page
+      if (path === '/' || path === '/index.html') {
+        html(res, serveOnboarding());
+        return;
+      }
+
+      // API endpoints
+      switch (path) {
+        case '/api/status':
+          json(res, 200, await api.status());
+          return;
+        case '/api/install': {
+          const body = await parseBody(req);
+          json(res, 200, await api.install());
+          return;
+        }
+        case '/api/setup-model': {
+          const body = await parseBody(req);
+          json(res, 200, await api.setupModel(body.model, body.provider));
+          return;
+        }
+        case '/api/models':
+          json(res, 200, await api.listModels());
+          return;
+        case '/api/enable-tools': {
+          const body = await parseBody(req);
+          json(res, 200, await api.enableTools(body.tools));
+          return;
+        }
+        case '/api/start-dashboard':
+          json(res, 200, await api.startDashboard());
+          return;
+        case '/api/gateway-status':
+          json(res, 200, await api.gatewayStatus());
+          return;
+        case '/api/exec': {
+          const body = await parseBody(req);
+          json(res, 200, await api.runCommand(body.cmd));
+          return;
+        }
+        default:
+          json(res, 404, { error: 'not found' });
+      }
+    } catch (e) {
+      json(res, 500, { error: e.message });
+    }
+  });
+
+  return new Promise((resolve, reject) => {
+    srv.listen(port, '127.0.0.1', () => {
+      console.log(`  → Setup wizard at http://127.0.0.1:${port}`);
+      resolve(srv);
+    });
+    srv.on('error', reject);
+  });
+}
+
+// ——— auto-start when run directly ———
+const port = parseInt(process.argv.find(a => a.startsWith('--port='))?.split('=')[1] || 5050);
+startServer(port).catch(e => {
+  console.error('Failed to start server:', e);
+  process.exit(1);
+});