heyio 1.13.0 → 3.0.1

package/dist/api/server.js

@@ -1,650 +1,152 @@
-import express from "express";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
-import { existsSync } from "node:fs";
-import { loadConfig, saveConfig } from "../config.js";
-import { createAuthMiddleware } from "./auth.js";
-import { sendToOrchestrator } from "../copilot/orchestrator.js";
-import { listSquads, getSquad, getAgentsForSquad } from "../store/squads.js";
-import { getTasksForSquad, getSquadTaskMetrics } from "../store/tasks.js";
-import { getInstancesForSquad, destroyInstance } from "../store/instances.js";
-import { getAgentEvents } from "../store/agent-events.js";
-import { getAuditLog, countAuditLog } from "../store/audit-log.js";
-import { getFeedItems, markFeedItemRead, deleteFeedItem, getUnreadCount, } from "../store/feed.js";
-import { listSchedules, createSchedule, updateSchedule, deleteSchedule, getSchedule } from "../store/schedules.js";
-import { triggerSchedule } from "../copilot/trigger-schedule.js";
-import { listServers, toggleMcpServer, addMcpServer, removeMcpServer } from "../mcp/index.js";
-import { listSkills, addSkill, createSkill, removeSkill, getSkillContent, updateSkillContent, discoverSkills, installFromSource, fetchRemoteSkillPreview } from "../copilot/skills.js";
-import { readPage, writePage, deletePage, listPages, listTemplates, readTemplate, writeTemplate, deleteTemplate } from "../wiki/fs.js";
-import { searchPages } from "../wiki/search.js";
-import { getBacklinks } from "../wiki/backlinks.js";
-import { saveMessage, getConversation, listConversations, searchConversations, deleteConversation, } from "../store/conversations.js";
-import { getTokenUsageSummary, getTokenUsageBySquad, getTokenUsageByAgent, getDailyTokenUsage, } from "../store/token-usage.js";
-import { DEFAULT_MODEL_PRICING } from "../copilot/token-tracker.js";
-import { randomUUID } from "node:crypto";
-import { validateMessageAttachments } from "../chat/attachments.js";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const sseClients = [];
-function broadcast(event, data) {
-    const payload = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
-    for (const client of sseClients) {
-        if (!client.res.writableEnded) {
-            client.res.write(payload);
-        }
-    }
-}
-export async function startApiServer(config) {
+import { existsSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import express from 'express';
+import { WebSocketServer } from 'ws';
+import { sendMessage } from '../copilot/orchestrator.js';
+import { createChildLogger } from '../logging/logger.js';
+import { authMiddleware, verifyWsToken } from './middleware/auth.js';
+import { initNotifications, subscribeClient, unsubscribeClient } from './notifications.js';
+import { activityRouter } from './routes/activity.js';
+import { attachmentsRouter } from './routes/attachments.js';
+import { configRouter } from './routes/config.js';
+import { conversationsRouter } from './routes/conversations.js';
+import { healthRouter } from './routes/health.js';
+import { inboxRouter } from './routes/inbox.js';
+import { schedulesRouter } from './routes/schedules.js';
+import { skillsRouter } from './routes/skills.js';
+import { squadsRouter } from './routes/squads.js';
+import { usageRouter } from './routes/usage.js';
+import { wikiRouter } from './routes/wiki.js';
+// Connected WebSocket clients keyed by connection ID
+const wsClients = new Map();
+export function createApiServer(config) {
+    const logger = createChildLogger('api');
     const app = express();
-    app.use(express.json({ limit: "30mb" }));
-    // Serve static web frontend
-    const webDistPath = resolve(__dirname, "..", "..", "web-dist");
-    const webIndexPath = join(webDistPath, "index.html");
-    if (existsSync(webDistPath)) {
-        app.use(express.static(webDistPath));
-    }
-    else {
-        console.warn(`[io] Warning: web-dist not found at ${webDistPath}. Web UI will not be available.`);
-    }
-    // Auth middleware for all API routes
-    const auth = createAuthMiddleware(config);
-    // Public endpoint — serves Supabase config to the frontend (no auth required)
-    app.get("/api/auth/config", (_req, res) => {
-        res.json({
-            supabaseUrl: config.supabaseUrl ?? null,
-            supabaseAnonKey: config.supabaseAnonKey ?? null,
-        });
-    });
-    app.use("/api", auth);
-    // --- SSE Stream ---
-    app.get("/api/stream", (req, res) => {
-        res.setHeader("Content-Type", "text/event-stream");
-        res.setHeader("Cache-Control", "no-cache");
-        res.setHeader("Connection", "keep-alive");
-        res.flushHeaders();
-        const client = { id: randomUUID(), res };
-        sseClients.push(client);
-        res.write(`event: connected\ndata: ${JSON.stringify({ id: client.id })}\n\n`);
-        req.on("close", () => {
-            const idx = sseClients.indexOf(client);
-            if (idx !== -1)
-                sseClients.splice(idx, 1);
-        });
-    });
-    // --- Chat (SSE-streamed response) ---
-    app.post("/api/message", async (req, res) => {
-        const { prompt, conversationId: clientConvId, attachments: rawAttachments } = req.body;
-        if (!prompt || typeof prompt !== "string") {
-            res.status(400).json({ error: "prompt is required" });
-            return;
-        }
-        const validation = validateMessageAttachments(rawAttachments);
-        if (!validation.ok) {
-            res.status(400).json({ error: validation.error });
-            return;
-        }
-        const attachments = validation.attachments;
-        const conversationId = (typeof clientConvId === "string" && clientConvId) ? clientConvId : randomUUID();
-        // Persist the user message
-        saveMessage(conversationId, "user", prompt, "web", attachments);
-        // Switch to SSE streaming to avoid Cloudflare 524 timeouts
-        res.setHeader("Content-Type", "text/event-stream");
-        res.setHeader("Cache-Control", "no-cache");
-        res.setHeader("Connection", "keep-alive");
-        res.setHeader("X-Accel-Buffering", "no");
-        res.flushHeaders();
-        // Keepalive: send a comment every 30s to keep Cloudflare happy
-        const keepalive = setInterval(() => {
-            if (!finished)
-                res.write(": keepalive\n\n");
-        }, 30_000);
-        let finished = false;
-        req.on("close", () => { finished = true; clearInterval(keepalive); });
-        try {
-            await sendToOrchestrator(prompt, "web", (content, done) => {
-                if (finished)
-                    return;
-                if (done) {
-                    finished = true;
-                    saveMessage(conversationId, "assistant", content, "web");
-                    res.write(`event: done\ndata: ${JSON.stringify({ content, conversationId })}\n\n`);
-                    clearInterval(keepalive);
-                    res.end();
-                }
-                else {
-                    res.write(`event: delta\ndata: ${JSON.stringify({ content })}\n\n`);
-                    // Also broadcast to other SSE listeners (e.g. ChatOverlay)
-                    broadcast("message_delta", { content, done: false });
-                }
-            }, attachments);
-        }
-        catch (err) {
-            if (!finished) {
-                finished = true;
-                const message = err instanceof Error ? err.message : "Unknown error";
-                res.write(`event: error\ndata: ${JSON.stringify({ error: message })}\n\n`);
-                clearInterval(keepalive);
-                res.end();
+    app.use(express.json());
+    // Auth middleware — verifies Supabase JWT if configured
+    app.use('/api', authMiddleware(config));
+    // Routes
+    app.use('/api', healthRouter());
+    app.use('/api', usageRouter());
+    app.use('/api', squadsRouter());
+    app.use('/api', activityRouter());
+    app.use('/api', attachmentsRouter(config.dataDir));
+    app.use('/api', inboxRouter());
+    app.use('/api', schedulesRouter());
+    app.use('/api', conversationsRouter());
+    app.use('/api', configRouter());
+    app.use('/api/wiki', wikiRouter);
+    app.use('/api', skillsRouter);
+    // POST /api/messages — send a message to the orchestrator
+    app.post('/api/messages', async (req, res) => {
+        const { content, source, connectionId } = req.body;
+        if (!content) {
+            res.status(400).json({ error: 'content is required' });
+            return;
+        }
+        const ws = connectionId ? wsClients.get(connectionId) : undefined;
+        const onDelta = (accumulated, done) => {
+            if (ws && ws.readyState === ws.OPEN) {
+                ws.send(JSON.stringify({
+                    type: done ? 'message' : 'delta',
+                    content: accumulated,
+                }));
             }
-        }
-    });
-    // --- History ---
-    app.get("/api/history", (req, res) => {
-        const q = req.query.q;
-        const from = req.query.from;
-        const to = req.query.to;
-        const limit = parseInt(req.query.limit) || 50;
-        const offset = parseInt(req.query.offset) || 0;
-        if (q) {
-            res.json(searchConversations(q, { limit, offset, from, to }));
-        }
-        else {
-            res.json(listConversations({ limit, offset, from, to }));
-        }
-    });
-    app.get("/api/history/:id", (req, res) => {
-        const messages = getConversation(req.params.id);
-        if (messages.length === 0) {
-            res.status(404).json({ error: "Conversation not found" });
-            return;
-        }
-        res.json(messages);
-    });
-    app.delete("/api/history/:id", (req, res) => {
-        deleteConversation(req.params.id);
-        res.json({ ok: true });
-    });
-    // --- Squads ---
-    app.get("/api/squads", (_req, res) => {
-        const data = listSquads();
-        const instanceCounts = {};
-        for (const squad of data.squads) {
-            instanceCounts[squad.id] = getInstancesForSquad(squad.id).length;
-        }
-        res.json({ ...data, instanceCounts });
-    });
-    // --- Squad Health Dashboard ---
-    app.get("/api/squads/health", (_req, res) => {
-        const { squads, agents } = listSquads();
-        const health = squads.map((squad) => {
-            const squadAgents = agents.filter((a) => a.squad_id === squad.id);
-            const instances = getInstancesForSquad(squad.id);
-            const metrics = getSquadTaskMetrics(squad.id);
-            return {
-                id: squad.id,
-                name: squad.name,
-                universe: squad.universe,
-                agentCount: squadAgents.length,
-                activeInstanceCount: instances.length,
-                activeInstances: instances.map((inst) => ({
-                    id: inst.id,
-                    branch: inst.branch,
-                    lastActivity: inst.last_activity,
-                })),
-                tasksTotal: metrics.tasksTotal,
-                tasksCompleted: metrics.tasksCompleted,
-                tasksCompletedRecent: metrics.tasksCompletedRecent,
-                tasksPending: metrics.tasksPending,
-                tasksInProgress: metrics.tasksInProgress,
-                tasksFailed: metrics.tasksFailed,
-                avgCycleTimeMinutes: metrics.avgCycleTimeMinutes,
-                isStalled: metrics.isStalled,
-                recentTasks: metrics.recentTasks.map((t) => ({
-                    id: t.id,
-                    description: t.description,
-                    status: t.status,
-                    updatedAt: t.updated_at,
-                })),
-            };
-        });
-        res.json({ health });
-    });
-    app.get("/api/squads/:id", (req, res) => {
-        const squad = getSquad(req.params.id);
-        if (!squad) {
-            res.status(404).json({ error: "Squad not found" });
-            return;
-        }
-        const agents = getAgentsForSquad(req.params.id);
-        const tasks = getTasksForSquad(req.params.id);
-        const instances = getInstancesForSquad(req.params.id);
-        res.json({ squad, agents, tasks, instances });
-    });
-    app.delete("/api/instances/:id", async (req, res) => {
-        try {
-            await destroyInstance(req.params.id);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            const msg = err?.message ?? "Unknown error";
-            const status = msg.toLowerCase().includes("not found") ? 404 : 500;
-            res.status(status).json({ error: msg });
-        }
-    });
-    // --- Task Events ---
-    app.get("/api/tasks/:taskId/events", (req, res) => {
-        const events = getAgentEvents(req.params.taskId);
-        res.json(events);
-    });
-    // --- Stop Task ---
-    app.post("/api/tasks/:taskId/stop", async (req, res) => {
+        };
         try {
-            const { stopTask } = await import("../copilot/agents.js");
-            await stopTask(req.params.taskId);
-            res.json({ ok: true });
+            const response = await sendMessage(content, source ?? 'web', onDelta);
+            res.json({ status: 'ok', content: response });
         }
         catch (err) {
-            const msg = err?.message ?? "Unknown error";
-            const isNotRunning = msg.toLowerCase().includes("not currently running") || msg.toLowerCase().includes("already completed");
-            res.status(isNotRunning ? 404 : 500).json({ error: msg });
+            logger.error({ err }, 'Error processing message');
+            res.status(500).json({ error: 'Failed to process message' });
         }
     });
-    // --- Audit Log ---
-    app.get("/api/audit-log", (req, res) => {
-        const squad_id = req.query.squad_id;
-        const agent_id = req.query.agent_id;
-        const action_type = req.query.action_type;
-        const from = req.query.from;
-        const to = req.query.to;
-        const limit = parseInt(req.query.limit) || 50;
-        const offset = parseInt(req.query.offset) || 0;
-        const filters = { squad_id, agent_id, action_type, from, to, limit, offset };
-        res.json({
-            entries: getAuditLog(filters),
-            total: countAuditLog(filters),
-        });
-    });
-    // --- Feed ---
-    app.get("/api/feed", (req, res) => {
-        const unreadOnly = req.query.unread === "true";
-        const source = req.query.source;
-        const limit = parseInt(req.query.limit) || 50;
-        const offset = parseInt(req.query.offset) || 0;
-        res.json({
-            items: getFeedItems({ unreadOnly, source, limit, offset }),
-            unreadCount: getUnreadCount(),
+    // Serve web frontend static files (production build)
+    const __dirname = fileURLToPath(new URL('.', import.meta.url));
+    const webDistPath = resolve(__dirname, '../../../web/dist');
+    if (existsSync(webDistPath)) {
+        app.use(express.static(webDistPath));
+        // SPA fallback: serve index.html for any non-API route
+        app.get('*', (_req, res) => {
+            res.sendFile(join(webDistPath, 'index.html'));
         });
-    });
-    app.post("/api/feed/:id/read", (req, res) => {
-        markFeedItemRead(req.params.id);
-        res.json({ ok: true });
-    });
-    app.delete("/api/feed/:id", (req, res) => {
-        deleteFeedItem(req.params.id);
-        res.json({ ok: true });
-    });
-    // --- MCP Servers ---
-    app.get("/api/mcp", (_req, res) => {
-        res.json(listServers());
-    });
-    app.post("/api/mcp", (req, res) => {
-        const server = { id: randomUUID(), ...req.body, enabled: true };
-        addMcpServer(server);
-        res.json(server);
-    });
-    app.put("/api/mcp/:id", (req, res) => {
-        const { enabled } = req.body;
-        if (typeof enabled === "boolean") {
-            toggleMcpServer(req.params.id, enabled);
-        }
-        res.json({ ok: true });
-    });
-    app.delete("/api/mcp/:id", (req, res) => {
-        removeMcpServer(req.params.id);
-        res.json({ ok: true });
-    });
-    // --- Skills ---
-    app.get("/api/skills", async (_req, res) => {
-        const skills = await listSkills();
-        res.json(skills);
-    });
-    app.get("/api/skills/discover", async (req, res) => {
-        const source = req.query.source;
-        if (source !== "awesome-copilot" && source !== "skillssh") {
-            res.status(400).json({ error: "source must be 'awesome-copilot' or 'skillssh'" });
-            return;
-        }
-        const q = req.query.q;
-        try {
-            const skills = await discoverSkills(source, q);
-            res.json(skills);
-        }
-        catch (err) {
-            res.status(502).json({ error: err.message });
-        }
-    });
-    app.get("/api/skills/preview", async (req, res) => {
-        const source = req.query.source;
-        const slug = req.query.slug;
-        if (source !== "awesome-copilot" && source !== "skillssh") {
-            res.status(400).json({ error: "source must be 'awesome-copilot' or 'skillssh'" });
-            return;
-        }
-        if (!slug) {
-            res.status(400).json({ error: "slug is required" });
-            return;
-        }
-        try {
-            const sourceRepo = req.query.sourceRepo;
-            const content = await fetchRemoteSkillPreview(source, slug, sourceRepo);
-            res.json({ content });
-        }
-        catch (err) {
-            res.status(502).json({ error: err.message });
-        }
-    });
-    app.post("/api/skills", async (req, res) => {
-        try {
-            const { url, source, slug, content, sourceRepo } = req.body;
-            if (source && slug) {
-                if (source !== "awesome-copilot" && source !== "skillssh") {
-                    res.status(400).json({ error: "source must be 'awesome-copilot' or 'skillssh'" });
-                    return;
+        logger.info({ path: webDistPath }, 'Serving web frontend');
+    }
+    const server = createServer(app);
+    // WebSocket server for streaming
+    const wss = new WebSocketServer({ server, path: '/ws' });
+    wss.on('connection', (ws, req) => {
+        // Verify token from query string if auth is configured
+        const url = new URL(req.url ?? '', `http://${req.headers.host}`);
+        const token = url.searchParams.get('token');
+        if (!verifyWsToken(config, token)) {
+            ws.close(4001, 'Unauthorized');
+            return;
+        }
+        const connectionId = crypto.randomUUID();
+        wsClients.set(connectionId, ws);
+        subscribeClient(connectionId, ws);
+        logger.info({ connectionId }, 'WebSocket client connected');
+        // Send the connection ID to the client
+        ws.send(JSON.stringify({ type: 'connected', connectionId }));
+        ws.on('message', (data) => {
+            try {
+                const parsed = JSON.parse(data.toString());
+                if (parsed.type === 'message' && parsed.content) {
+                    const source = parsed.source ?? 'tui';
+                    const onDelta = (accumulated, done) => {
+                        if (ws.readyState === ws.OPEN) {
+                            ws.send(JSON.stringify({
+                                type: done ? 'message' : 'delta',
+                                content: accumulated,
+                            }));
+                        }
+                    };
+                    sendMessage(parsed.content, source, onDelta).catch((err) => {
+                        logger.error({ err }, 'Error processing WebSocket message');
+                        if (ws.readyState === ws.OPEN) {
+                            ws.send(JSON.stringify({ type: 'error', content: 'Failed to process message' }));
+                        }
+                    });
                 }
-                await installFromSource(source, slug, sourceRepo);
-            }
-            else if (url && typeof url === "string") {
-                // Git-clone method
-                await addSkill(url);
-            }
-            else if (slug && typeof slug === "string" && content && typeof content === "string") {
-                // Direct-creation method
-                await createSkill(slug, content);
             }
-            else {
-                res.status(400).json({ error: "Provide 'url' (git clone), 'source' + 'slug' (community install), or 'slug' + 'content' (direct create)" });
-                return;
+            catch (err) {
+                logger.error({ err }, 'Failed to parse WebSocket message');
             }
-            res.status(201).json({ ok: true });
-        }
-        catch (err) {
-            res.status(400).json({ error: err.message });
-        }
-    });
-    app.delete("/api/skills/:slug", async (req, res) => {
-        try {
-            await removeSkill(req.params.slug);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            res.status(404).json({ error: err.message });
-        }
-    });
-    app.get("/api/skills/:slug/content", async (req, res) => {
-        try {
-            const content = await getSkillContent(req.params.slug);
-            res.json({ content });
-        }
-        catch (err) {
-            res.status(404).json({ error: err.message });
-        }
-    });
-    app.put("/api/skills/:slug/content", async (req, res) => {
-        try {
-            const { content } = req.body;
-            await updateSkillContent(req.params.slug, content);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            res.status(404).json({ error: err.message });
-        }
-    });
-    // --- Wiki ---
-    app.get("/api/wiki/pages", async (_req, res) => {
-        const pages = await listPages();
-        res.json(pages);
-    });
-    app.get("/api/wiki/page/*path", async (req, res) => {
-        try {
-            const raw = req.params.path;
-            const pagePath = Array.isArray(raw) ? raw.join("/") : raw;
-            const content = await readPage(pagePath);
-            res.json({ path: pagePath, content });
-        }
-        catch (err) {
-            res.status(404).json({ error: err.message });
-        }
-    });
-    app.put("/api/wiki/page/*path", async (req, res) => {
-        const raw = req.params.path;
-        const pagePath = Array.isArray(raw) ? raw.join("/") : raw;
-        const { content } = req.body;
-        await writePage(pagePath, content);
-        res.json({ ok: true });
-    });
-    app.delete("/api/wiki/page/*path", async (req, res) => {
-        try {
-            const raw = req.params.path;
-            const pagePath = Array.isArray(raw) ? raw.join("/") : raw;
-            await deletePage(pagePath);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            res.status(404).json({ error: err.message });
-        }
-    });
-    app.get("/api/wiki/search", async (req, res) => {
-        const query = req.query.q;
-        if (!query) {
-            res.status(400).json({ error: "q is required" });
-            return;
-        }
-        const results = await searchPages(query);
-        res.json(results);
-    });
-    app.get("/api/wiki/backlinks/*path", async (req, res) => {
-        const raw = req.params.path;
-        const pagePath = Array.isArray(raw) ? raw.join("/") : raw;
-        const backlinks = await getBacklinks(pagePath);
-        res.json(backlinks);
-    });
-    // --- Wiki Templates ---
-    app.get("/api/wiki/templates/squad", async (_req, res) => {
-        const files = await listTemplates();
-        res.json(files);
-    });
-    app.get("/api/wiki/template/squad/*path", async (req, res) => {
-        try {
-            const raw = req.params.path;
-            const templatePath = Array.isArray(raw) ? raw.join("/") : raw;
-            const content = await readTemplate(templatePath);
-            res.json({ path: templatePath, content });
-        }
-        catch (err) {
-            res.status(404).json({ error: err.message });
-        }
-    });
-    app.put("/api/wiki/template/squad/*path", async (req, res) => {
-        const raw = req.params.path;
-        const templatePath = Array.isArray(raw) ? raw.join("/") : raw;
-        const { content } = req.body;
-        await writeTemplate(templatePath, content);
-        res.json({ ok: true });
-    });
-    app.delete("/api/wiki/template/squad/*path", async (req, res) => {
-        try {
-            const raw = req.params.path;
-            const templatePath = Array.isArray(raw) ? raw.join("/") : raw;
-            await deleteTemplate(templatePath);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            res.status(404).json({ error: err.message });
-        }
-    });
-    // --- Schedules ---
-    app.get("/api/schedules", (_req, res) => {
-        const type = undefined; // return all
-        res.json(listSchedules(type));
-    });
-    app.post("/api/schedules", (req, res) => {
-        const { type, cron, squad_id, agenda, prompt } = req.body ?? {};
-        if (type !== "squad" && type !== "io") {
-            res.status(400).json({ error: "type must be 'squad' or 'io'" });
-            return;
-        }
-        if (!cron || typeof cron !== "string") {
-            res.status(400).json({ error: "cron is required" });
-            return;
-        }
-        if (!squad_id || typeof squad_id !== "string" || !squad_id.trim()) {
-            res.status(400).json({ error: "squad_id is required" });
-            return;
-        }
-        const schedule = createSchedule({ type, cron, squad_id, agenda, prompt });
-        res.json(schedule);
-    });
-    app.put("/api/schedules/:id", (req, res) => {
-        const schedule = getSchedule(req.params.id);
-        if (!schedule) {
-            res.status(404).json({ error: "Schedule not found" });
-            return;
-        }
-        const { enabled, cron, agenda, prompt } = req.body ?? {};
-        const updated = updateSchedule(req.params.id, {
-            cron: typeof cron === "string" ? cron : undefined,
-            agenda: typeof agenda === "string" ? agenda : undefined,
-            prompt: typeof prompt === "string" ? prompt : undefined,
-            enabled: typeof enabled === "boolean" ? enabled : undefined,
-        });
-        res.json(updated);
-    });
-    app.post("/api/schedules/:id/trigger", (req, res) => {
-        const schedule = triggerSchedule(req.params.id);
-        if (!schedule) {
-            res.status(404).json({ error: "Schedule not found" });
-            return;
-        }
-        res.json({ ok: true, schedule });
-    });
-    app.delete("/api/schedules/:id", (req, res) => {
-        deleteSchedule(req.params.id);
-        res.json({ ok: true });
-    });
-    // --- Settings ---
-    app.get("/api/settings", (_req, res) => {
-        const current = loadConfig();
-        // Don't expose full Supabase key — mask it
-        res.json({
-            defaultModel: current.defaultModel,
-            port: current.port,
-            telegramEnabled: current.telegramEnabled,
-            telegramBotToken: current.telegramBotToken ? "••••••••" : "",
-            authorizedUserId: current.authorizedUserId ?? null,
-            supabaseUrl: current.supabaseUrl ?? "",
-            supabaseAnonKey: current.supabaseAnonKey ? "••••••••" : "",
-            authorizedEmail: current.authorizedEmail ?? "",
-            backgroundNotifyMode: current.backgroundNotifyMode,
-            backgroundNotifyTelegram: current.backgroundNotifyTelegram,
-            selfEditEnabled: current.selfEditEnabled,
-            watchdogEnabled: current.watchdogEnabled,
-        });
-    });
-    app.put("/api/settings", (req, res) => {
-        const updates = {};
-        const body = req.body;
-        // Only apply fields that are explicitly provided and not masked
-        if (body.defaultModel !== undefined)
-            updates.defaultModel = body.defaultModel;
-        if (body.port !== undefined)
-            updates.port = body.port;
-        if (body.telegramEnabled !== undefined)
-            updates.telegramEnabled = body.telegramEnabled;
-        if (body.telegramBotToken && body.telegramBotToken !== "••••••••")
-            updates.telegramBotToken = body.telegramBotToken;
-        if (body.authorizedUserId !== undefined)
-            updates.authorizedUserId = body.authorizedUserId;
-        if (body.supabaseUrl !== undefined)
-            updates.supabaseUrl = body.supabaseUrl;
-        if (body.supabaseAnonKey && body.supabaseAnonKey !== "••••••••")
-            updates.supabaseAnonKey = body.supabaseAnonKey;
-        if (body.authorizedEmail !== undefined)
-            updates.authorizedEmail = body.authorizedEmail;
-        if (body.backgroundNotifyMode !== undefined)
-            updates.backgroundNotifyMode = body.backgroundNotifyMode;
-        if (body.backgroundNotifyTelegram !== undefined)
-            updates.backgroundNotifyTelegram = body.backgroundNotifyTelegram;
-        if (body.selfEditEnabled !== undefined)
-            updates.selfEditEnabled = body.selfEditEnabled;
-        if (body.watchdogEnabled !== undefined)
-            updates.watchdogEnabled = body.watchdogEnabled;
-        saveConfig(updates);
-        res.json({ ok: true });
-    });
-    // --- Token Usage ---
-    app.get("/api/token-usage/summary", (req, res) => {
-        const since = req.query.since;
-        res.json(getTokenUsageSummary({ since }));
-    });
-    app.get("/api/token-usage/by-squad", (req, res) => {
-        const since = req.query.since;
-        res.json(getTokenUsageBySquad({ since }));
-    });
-    app.get("/api/token-usage/by-agent", (req, res) => {
-        const since = req.query.since;
-        const squadId = req.query.squad_id;
-        res.json(getTokenUsageByAgent({ since, squadId }));
-    });
-    app.get("/api/token-usage/daily", (req, res) => {
-        const days = parseInt(req.query.days) || 30;
-        res.json(getDailyTokenUsage(days));
-    });
-    app.get("/api/token-usage/pricing", (_req, res) => {
-        const config = loadConfig();
-        const merged = { ...DEFAULT_MODEL_PRICING, ...(config.modelPricing ?? {}) };
-        res.json(merged);
-    });
-    app.put("/api/token-usage/pricing", (req, res) => {
-        const pricing = req.body;
-        if (typeof pricing !== "object" || pricing === null) {
-            res.status(400).json({ error: "Expected object body" });
-            return;
-        }
-        saveConfig({ modelPricing: pricing });
-        res.json({ ok: true });
-    });
-    app.get("/api/token-usage/alert-threshold", (_req, res) => {
-        const config = loadConfig();
-        res.json({ tokenAlertThreshold: config.tokenAlertThreshold ?? null });
-    });
-    app.put("/api/token-usage/alert-threshold", (req, res) => {
-        const { tokenAlertThreshold } = req.body;
-        if (tokenAlertThreshold !== null && typeof tokenAlertThreshold !== "number") {
-            res.status(400).json({ error: "tokenAlertThreshold must be a number or null" });
-            return;
-        }
-        saveConfig({ tokenAlertThreshold: tokenAlertThreshold ?? undefined });
-        res.json({ ok: true });
-    });
-    // --- Health (unauthenticated) ---
-    app.get("/health", (_req, res) => {
-        res.json({
-            status: "ok",
-            version: process.env.npm_package_version ?? "unknown",
-            webUi: existsSync(webIndexPath),
-            webDistPath,
         });
-    });
-    // SPA fallback — serve index.html for non-API routes
-    app.get("*splat", (req, res) => {
-        if (req.path.startsWith("/api/")) {
-            res.status(404).json({ error: "Not found" });
-            return;
-        }
-        if (existsSync(webIndexPath)) {
-            res.sendFile(webIndexPath);
-        }
-        else {
-            res.status(503).send("Web UI not available — web-dist not found.");
-        }
-    });
-    return new Promise((resolvePromise, reject) => {
-        const server = app.listen(config.port, () => {
-            resolvePromise();
+        ws.on('close', () => {
+            wsClients.delete(connectionId);
+            unsubscribeClient(connectionId);
+            logger.info({ connectionId }, 'WebSocket client disconnected');
         });
-        server.on("error", reject);
     });
+    return {
+        async start() {
+            return new Promise((resolve) => {
+                server.listen(config.apiPort, () => {
+                    logger.info({ port: config.apiPort }, 'API server listening');
+                    resolve();
+                });
+            });
+        },
+        async stop() {
+            return new Promise((resolve, reject) => {
+                for (const ws of wsClients.values()) {
+                    ws.close();
+                }
+                wsClients.clear();
+                wss.close();
+                server.close((err) => {
+                    if (err)
+                        reject(err);
+                    else
+                        resolve();
+                });
+            });
+        },
+    };
 }
-export { broadcast };
 //# sourceMappingURL=server.js.map