incremnt 0.1.18 → 0.2.0

package/src/sync-service.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 import { capabilities as cliCapabilities, contractVersion, officialCommands } from './contract.js';
 import { executeReadCommand } from './queries.js';
+import { fenceContent, sanitizeHistory, detectSystemPromptLeak } from './prompt-security.js';
 
 const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MB
 const DEFAULT_RATE_LIMIT_WINDOW_MS = 60_000;
@@ -11,6 +12,8 @@ const DEFAULT_RATE_LIMIT_RULES = {
   'vitals-summary-ai': 3,
   'checkpoint-summary-ai': 3,
   'ask-ai': 5,
+  'ai-feedback': 60,
+  'coach-memory': 30,
   'dev-login': 10,
   'device-start': 20,
   'device-poll': 300,
@@ -23,11 +26,70 @@ const DEFAULT_RATE_LIMIT_RULES = {
   'web-auth-callback': 20,
   'session-login': 60,
   'session-refresh': 30,
+  'delete-account': 1,
   'sync-account-preferences': 30,
   'proposals': 30,
-  'proposal-update': 30
+  'proposal-update': 30,
+  'social-invite': 20,
+  'social-groups': 60,
+  'social-group-create': 20,
+  'social-group-update': 20,
+  'social-group-detail': 60,
+  'social-group-invite': 20,
+  'social-group-join': 20,
+  'social-group-leave': 20,
+  'social-group-feed': 60,
+  'social-group-leaderboard': 60,
+  'social-follow': 20,
+  'social-follow-account': 20,
+  'social-unfollow': 20,
+  'social-following': 60,
+  'social-followers': 60,
+  'social-me-profile': 60,
+  'social-profile-update': 20,
+  'social-user-profile': 60,
+  'social-user-search': 60,
+  'social-user-suggestions': 60,
+  'social-user-report': 60,
+  'social-user-exercise-history': 60,
+  'social-user-mute': 20,
+  'social-user-block': 20,
+  'social-report': 20,
+  'social-follow-requests': 60,
+  'social-follow-request-approve': 20,
+  'social-follow-request-decline': 20,
+  'social-media-upload-url': 30,
+  'social-media-complete': 30,
+  'social-media-delete': 30,
+  'social-post-update': 30,
+  'social-notifications': 60,
+  'social-notification-read': 60,
+  'social-notification-read-all': 30,
+  'social-feed': 60,
+  'social-feed-groups': 60,
+  'social-group-add-member': 30,
+  'social-feed-detail': 60,
+  'social-like': 60,
+  'social-unlike': 60,
+  'social-comments': 60,
+  'social-comment-like': 60,
+  'social-comment-unlike': 60,
+  'social-likes': 60,
+  'social-leaderboard': 60,
+  'social-gym-leaderboard': 60,
+  'sync-push-device-register': 30,
+  'sync-push-device-revoke': 30
 };
 
+export function isNoInsightResponse(text) {
+  const normalized = String(text ?? '')
+    .trim()
+    .replace(/^["'`]+|["'`]+$/g, '')
+    .replace(/[.\s]+$/g, '')
+    .toUpperCase();
+  return normalized === 'NO_INSIGHT' || normalized.startsWith('NO_INSIGHT\n');
+}
+
 function json(response, statusCode, payload) {
   response.writeHead(statusCode, { 'content-type': 'application/json' });
   response.end(JSON.stringify(payload));
@@ -49,6 +111,80 @@ function logRequest(request, statusCode, extra = '') {
   console.log(`${method} ${path} ${statusCode}${suffix}`);
 }
 
+function anonymizeAccountId(accountId) {
+  if (typeof accountId !== 'string' || !accountId.trim()) {
+    return 'anon:unknown';
+  }
+  const digest = createHash('sha256')
+    .update(`account:${accountId}`)
+    .digest('hex')
+    .slice(0, 12);
+  return `anon:${digest}`;
+}
+
+function anonymizeSessionToken(sessionToken) {
+  if (typeof sessionToken !== 'string' || !sessionToken.trim()) {
+    return 'sess:unknown';
+  }
+  const digest = createHash('sha256')
+    .update(`token:${sessionToken}`)
+    .digest('hex')
+    .slice(0, 12);
+  return `sess:${digest}`;
+}
+
+function sanitizeSocialLogValue(value) {
+  if (typeof value === 'string') return value;
+  if (typeof value === 'number' || typeof value === 'boolean') return value;
+  if (value == null) return null;
+  return String(value);
+}
+
+function socialLogSuffix(request, accountId, fields = {}) {
+  const safeFields = {
+    aid: anonymizeAccountId(accountId),
+    sid: anonymizeSessionToken(bearerToken(request))
+  };
+  for (const [key, value] of Object.entries(fields)) {
+    safeFields[key] = sanitizeSocialLogValue(value);
+  }
+  return `social-meta ${JSON.stringify(safeFields)}`;
+}
+
+function anonymizeOwnerIds(items, { max = 5 } = {}) {
+  if (!Array.isArray(items) || items.length === 0) {
+    return '';
+  }
+
+  const uniqueIds = [...new Set(
+    items
+      .map((item) => item?.userId)
+      .filter((value) => typeof value === 'string' && value.trim().length > 0)
+  )];
+
+  return uniqueIds
+    .slice(0, max)
+    .map(anonymizeAccountId)
+    .join(',');
+}
+
+function anonymizeRelationIds(items, { max = 5 } = {}) {
+  if (!Array.isArray(items) || items.length === 0) {
+    return '';
+  }
+
+  const uniqueIds = [...new Set(
+    items
+      .map((item) => item?.accountId ?? item?.userId ?? item?.id)
+      .filter((value) => typeof value === 'string' && value.trim().length > 0)
+  )];
+
+  return uniqueIds
+    .slice(0, max)
+    .map(anonymizeAccountId)
+    .join(',');
+}
+
 function unauthorized(response, request) {
   if (request) logRequest(request, 401);
   json(response, 401, { error: 'Unauthorized' });
@@ -62,12 +198,16 @@ function badRequest(response, message) {
   json(response, 400, { error: message });
 }
 
+function forbidden(response, message = 'Forbidden') {
+  json(response, 403, { error: message });
+}
+
 function methodNotAllowed(response, message = 'Method not allowed') {
   json(response, 405, { error: message });
 }
 
 function internalError(response, error, onError) {
-  console.error('Internal error:', error.message);
+  console.error('Internal error:', error.message, error.stack ?? '');
   if (onError) onError(error);
   json(response, 500, { error: 'Internal server error' });
 }
@@ -152,7 +292,7 @@ function createRateLimiter({
   };
 }
 
-function routeRequest(url) {
+function routeRequest(url, method) {
   const pathname = url.pathname;
 
   if (pathname === '/healthz') {
@@ -219,10 +359,30 @@ function routeRequest(url) {
     return { command: 'sync-upload', options: {} };
   }
 
+  if (pathname === '/cli/account') {
+    return { command: 'delete-account', options: {} };
+  }
+
   if (pathname === '/sync/account/preferences') {
     return { command: 'sync-account-preferences', options: {} };
   }
 
+  if (pathname === '/sync/push/device') {
+    return { command: 'sync-push-device', options: {} };
+  }
+
+  {
+    const pushDeviceMatch = pathname.match(/^\/sync\/push\/device\/([^/]+)$/);
+    if (pushDeviceMatch) {
+      return {
+        command: 'sync-push-device-revoke',
+        options: {
+          deviceToken: decodeURIComponent(pushDeviceMatch[1])
+        }
+      };
+    }
+  }
+
   if (pathname === '/cli/sessions') {
     return {
       command: 'session-insights',
@@ -324,11 +484,16 @@ function routeRequest(url) {
     };
   }
 
+  const VALID_TONES = new Set(['default', 'hype', 'numbers-only']);
+  const parseTone = (raw) => VALID_TONES.has(raw) ? raw : undefined;
+
   if (pathname === '/cli/workout-summary/ai') {
     return {
       command: 'workout-summary-ai',
       options: {
-        'session-id': url.searchParams.get('session-id') ?? undefined
+        'session-id': url.searchParams.get('session-id') ?? undefined,
+        'exclude': url.searchParams.get('exclude') ?? undefined,
+        'tone': parseTone(url.searchParams.get('tone'))
       }
     };
   }
@@ -337,13 +502,15 @@ function routeRequest(url) {
     return {
       command: 'cycle-summary-ai',
       options: {
-        'program-id': url.searchParams.get('program-id') ?? undefined
+        'program-id': url.searchParams.get('program-id') ?? undefined,
+        'exclude': url.searchParams.get('exclude') ?? undefined,
+        'tone': parseTone(url.searchParams.get('tone'))
       }
     };
   }
 
   if (pathname === '/cli/vitals-summary/ai') {
-    return { command: 'vitals-summary-ai', options: {} };
+    return { command: 'vitals-summary-ai', options: { 'exclude': url.searchParams.get('exclude') ?? undefined, 'tone': parseTone(url.searchParams.get('tone')) } };
   }
 
   if (pathname === '/cli/checkpoint-summary/ai') {
@@ -351,11 +518,17 @@ function routeRequest(url) {
       command: 'checkpoint-summary-ai',
       options: {
         'program-id': url.searchParams.get('program-id') ?? undefined,
-        'checkpoint-week': url.searchParams.get('checkpoint-week') ?? undefined
+        'checkpoint-week': url.searchParams.get('checkpoint-week') ?? undefined,
+        'exclude': url.searchParams.get('exclude') ?? undefined,
+        'tone': parseTone(url.searchParams.get('tone'))
       }
     };
   }
 
+  if (pathname === '/cli/coach-memory') {
+    return { command: 'coach-memory', options: {} };
+  }
+
   if (pathname === '/cli/ask') {
     return { command: 'ask-ai', options: {} };
   }
@@ -371,6 +544,10 @@ function routeRequest(url) {
     }
   }
 
+  if (pathname === '/cli/ai/feedback') {
+    return { command: 'ai-feedback', options: {} };
+  }
+
   if (pathname === '/cli/health/ai') {
     return {
       command: 'health-ai',
@@ -391,6 +568,343 @@ function routeRequest(url) {
     return { command: 'training-load', options: {} };
   }
 
+  // --- Social endpoints ---
+  if (pathname === '/cli/social/me/profile') {
+    return { command: 'social-me-profile', options: {} };
+  }
+
+  if (pathname === '/cli/social/users/search') {
+    return {
+      command: 'social-user-search',
+      options: {
+        q: url.searchParams.get('q') ?? undefined,
+        limit: url.searchParams.get('limit') ?? undefined
+      }
+    };
+  }
+
+  if (pathname === '/cli/social/users/suggestions') {
+    return {
+      command: 'social-user-suggestions',
+      options: {
+        limit: url.searchParams.get('limit') ?? undefined
+      }
+    };
+  }
+
+  {
+    const exerciseHistoryMatch = pathname.match(/^\/cli\/social\/users\/([^/]+)\/exercises\/history$/);
+    if (exerciseHistoryMatch) {
+      return {
+        command: 'social-user-exercise-history',
+        options: {
+          accountId: decodeURIComponent(exerciseHistoryMatch[1]),
+          name: url.searchParams.get('name') ?? undefined
+        }
+      };
+    }
+  }
+
+  {
+    const userReportMatch = pathname.match(/^\/cli\/social\/users\/([^/]+)\/report$/);
+    if (userReportMatch) {
+      return {
+        command: 'social-user-report',
+        options: { accountId: decodeURIComponent(userReportMatch[1]) }
+      };
+    }
+  }
+
+  {
+    const userProfileMatch = pathname.match(/^\/cli\/social\/users\/([^/]+)$/);
+    if (userProfileMatch && userProfileMatch[1] !== 'search') {
+      return {
+        command: 'social-user-profile',
+        options: { identifier: decodeURIComponent(userProfileMatch[1]) }
+      };
+    }
+  }
+
+  {
+    const userMuteMatch = pathname.match(/^\/cli\/social\/users\/([^/]+)\/mute$/);
+    if (userMuteMatch) {
+      return {
+        command: 'social-user-mute',
+        options: { userId: decodeURIComponent(userMuteMatch[1]) }
+      };
+    }
+  }
+
+  {
+    const userBlockMatch = pathname.match(/^\/cli\/social\/users\/([^/]+)\/block$/);
+    if (userBlockMatch) {
+      return {
+        command: 'social-user-block',
+        options: { userId: decodeURIComponent(userBlockMatch[1]) }
+      };
+    }
+  }
+
+  if (pathname === '/cli/social/report') {
+    return { command: 'social-report', options: {} };
+  }
+
+  if (pathname === '/cli/social/invite') {
+    return { command: 'social-invite', options: {} };
+  }
+
+  if (pathname === '/cli/social/groups') {
+    return { command: method === 'POST' ? 'social-group-create' : 'social-groups', options: {} };
+  }
+
+  if (pathname === '/cli/social/groups/join') {
+    return { command: 'social-group-join', options: {} };
+  }
+
+  {
+    const socialGroupInviteMatch = pathname.match(/^\/cli\/social\/groups\/([^/]+)\/invite$/);
+    if (socialGroupInviteMatch) {
+      return {
+        command: 'social-group-invite',
+        options: { groupId: decodeURIComponent(socialGroupInviteMatch[1]) }
+      };
+    }
+  }
+
+  {
+    const socialGroupLeaveMatch = pathname.match(/^\/cli\/social\/groups\/([^/]+)\/membership$/);
+    if (socialGroupLeaveMatch) {
+      return {
+        command: 'social-group-leave',
+        options: { groupId: decodeURIComponent(socialGroupLeaveMatch[1]) }
+      };
+    }
+  }
+
+  {
+    const socialGroupFeedMatch = pathname.match(/^\/cli\/social\/groups\/([^/]+)\/feed$/);
+    if (socialGroupFeedMatch) {
+      return {
+        command: 'social-group-feed',
+        options: { groupId: decodeURIComponent(socialGroupFeedMatch[1]), ...Object.fromEntries(url.searchParams) }
+      };
+    }
+  }
+
+  {
+    const socialGroupLeaderboardMatch = pathname.match(/^\/cli\/social\/groups\/([^/]+)\/leaderboard$/);
+    if (socialGroupLeaderboardMatch) {
+      return {
+        command: 'social-group-leaderboard',
+        options: { groupId: decodeURIComponent(socialGroupLeaderboardMatch[1]), ...Object.fromEntries(url.searchParams) }
+      };
+    }
+  }
+
+  {
+    const socialGroupMembersMatch = pathname.match(/^\/cli\/social\/groups\/([^/]+)\/members$/);
+    if (socialGroupMembersMatch) {
+      return {
+        command: 'social-group-add-member',
+        options: { groupId: decodeURIComponent(socialGroupMembersMatch[1]) }
+      };
+    }
+  }
+
+  {
+    const socialGroupDetailMatch = pathname.match(/^\/cli\/social\/groups\/([^/]+)$/);
+    if (socialGroupDetailMatch) {
+      const groupId = decodeURIComponent(socialGroupDetailMatch[1]);
+      return {
+        command: method === 'PATCH' ? 'social-group-update' : 'social-group-detail',
+        options: { groupId }
+      };
+    }
+  }
+
+  if (pathname === '/cli/social/follow') {
+    return { command: 'social-follow', options: {} };
+  }
+
+  if (pathname === '/cli/social/follow/requests') {
+    return {
+      command: 'social-follow-requests',
+      options: {
+        type: url.searchParams.get('type') ?? undefined,
+        status: url.searchParams.get('status') ?? undefined,
+        limit: url.searchParams.get('limit') ?? undefined
+      }
+    };
+  }
+
+  {
+    const requestActionMatch = pathname.match(/^\/cli\/social\/follow\/requests\/([^/]+)\/(approve|decline)$/);
+    if (requestActionMatch) {
+      return {
+        command: requestActionMatch[2] === 'approve'
+          ? 'social-follow-request-approve'
+          : 'social-follow-request-decline',
+        options: {
+          followerId: decodeURIComponent(requestActionMatch[1])
+        }
+      };
+    }
+  }
+
+  {
+    const socialFollowAccountMatch = pathname.match(/^\/cli\/social\/follow\/([^/]+)$/);
+    if (socialFollowAccountMatch) {
+      return {
+        command: 'social-follow-account',
+        options: { accountId: decodeURIComponent(socialFollowAccountMatch[1]) }
+      };
+    }
+  }
+
+  if (pathname === '/cli/social/following') {
+    return { command: 'social-following', options: {} };
+  }
+
+  if (pathname === '/cli/social/followers') {
+    return { command: 'social-followers', options: {} };
+  }
+
+  if (pathname === '/cli/social/leaderboard') {
+    return { command: 'social-leaderboard', options: { ...Object.fromEntries(url.searchParams) } };
+  }
+
+  if (pathname === '/cli/social/gym/leaderboard') {
+    return { command: 'social-gym-leaderboard', options: { ...Object.fromEntries(url.searchParams) } };
+  }
+
+  if (pathname === '/cli/social/media/upload-url') {
+    return { command: 'social-media-upload-url', options: {} };
+  }
+
+  {
+    const mediaCompleteMatch = pathname.match(/^\/cli\/social\/media\/([^/]+)\/complete$/);
+    if (mediaCompleteMatch) {
+      return {
+        command: 'social-media-complete',
+        options: { assetId: decodeURIComponent(mediaCompleteMatch[1]) }
+      };
+    }
+  }
+
+  {
+    const mediaDeleteMatch = pathname.match(/^\/cli\/social\/media\/([^/]+)$/);
+    if (mediaDeleteMatch) {
+      return {
+        command: 'social-media-delete',
+        options: { assetId: decodeURIComponent(mediaDeleteMatch[1]) }
+      };
+    }
+  }
+
+  if (pathname === '/cli/social/notifications') {
+    return {
+      command: 'social-notifications',
+      options: {
+        limit: url.searchParams.get('limit') ?? undefined,
+        before: url.searchParams.get('before') ?? undefined
+      }
+    };
+  }
+
+  if (pathname === '/cli/social/notifications/read-all') {
+    return { command: 'social-notification-read-all', options: {} };
+  }
+
+  {
+    const notificationReadMatch = pathname.match(/^\/cli\/social\/notifications\/([^/]+)\/read$/);
+    if (notificationReadMatch) {
+      return {
+        command: 'social-notification-read',
+        options: { notificationId: decodeURIComponent(notificationReadMatch[1]) }
+      };
+    }
+  }
+
+  if (pathname === '/cli/social/feed') {
+    return {
+      command: 'social-feed',
+      options: {
+        limit: url.searchParams.get('limit') ?? undefined,
+        before: url.searchParams.get('before') ?? undefined
+      }
+    };
+  }
+
+  if (pathname === '/cli/social/feed/groups') {
+    return {
+      command: 'social-feed-groups',
+      options: {
+        limit: url.searchParams.get('limit') ?? undefined,
+        before: url.searchParams.get('before') ?? undefined
+      }
+    };
+  }
+
+  {
+    const feedPostEditMatch = pathname.match(/^\/cli\/social\/feed\/([^/]+)\/post$/);
+    if (feedPostEditMatch) {
+      return { command: 'social-post-update', options: { activityId: decodeURIComponent(feedPostEditMatch[1]) } };
+    }
+  }
+
+  {
+    const feedCommentsMatch = pathname.match(/^\/cli\/social\/feed\/([^/]+)\/comments$/);
+    if (feedCommentsMatch) {
+      return {
+        command: 'social-comments',
+        options: {
+          activityId: decodeURIComponent(feedCommentsMatch[1]),
+          limit: url.searchParams.get('limit') ?? undefined
+        }
+      };
+    }
+  }
+
+  {
+    const feedCommentLikeMatch = pathname.match(/^\/cli\/social\/feed\/([^/]+)\/comments\/([^/]+)\/like$/);
+    if (feedCommentLikeMatch) {
+      return {
+        command: 'social-comment-like',
+        options: {
+          activityId: decodeURIComponent(feedCommentLikeMatch[1]),
+          commentId: decodeURIComponent(feedCommentLikeMatch[2])
+        }
+      };
+    }
+  }
+
+  {
+    const feedDetailMatch = pathname.match(/^\/cli\/social\/feed\/([^/]+)$/);
+    if (feedDetailMatch) {
+      return { command: 'social-feed-detail', options: { activityId: decodeURIComponent(feedDetailMatch[1]) } };
+    }
+  }
+
+  {
+    const feedLikesMatch = pathname.match(/^\/cli\/social\/feed\/([^/]+)\/likes$/);
+    if (feedLikesMatch) {
+      return {
+        command: 'social-likes',
+        options: {
+          activityId: decodeURIComponent(feedLikesMatch[1]),
+          limit: url.searchParams.get('limit') ?? undefined
+        }
+      };
+    }
+  }
+
+  {
+    const feedLikeMatch = pathname.match(/^\/cli\/social\/feed\/([^/]+)\/like$/);
+    if (feedLikeMatch) {
+      return { command: 'social-like', options: { activityId: decodeURIComponent(feedLikeMatch[1]) } };
+    }
+  }
+
   return null;
 }
 
@@ -862,9 +1376,16 @@ export function createSyncServiceRequestHandler({
   listProposalsForAccount = null,
   updateProposalForAccount = null,
   updateAnalysisConsentForAccount = null,
+  updateDisplayNameForAccount = null,
   saveAskConversationForAccount = null,
   listAskConversationsForAccount = null,
   getAskConversationForAccount = null,
+  readCoachMemoryForAccount = null,
+  writeCoachMemoryForAccount = null,
+  saveAIFeedbackForAccount = null,
+  deleteAccountForUser = null,
+  // Social
+  social = null,
   onError = null
 }) {
   const rateLimiter = createRateLimiter(rateLimitConfig ?? {});
@@ -881,7 +1402,7 @@ export function createSyncServiceRequestHandler({
       if (corsAllowed) {
         response.setHeader('Access-Control-Allow-Origin', origin);
         response.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
-        response.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, OPTIONS');
+        response.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
       }
 
       if (request.method === 'OPTIONS') {
@@ -891,7 +1412,7 @@ export function createSyncServiceRequestHandler({
       }
 
       const url = new URL(request.url ?? '/', `http://${request.headers.host ?? '127.0.0.1'}`);
-      const route = routeRequest(url);
+      const route = routeRequest(url, request.method);
       if (!route) {
         notFound(response);
         return;
@@ -902,7 +1423,20 @@ export function createSyncServiceRequestHandler({
         return;
       }
 
-      const rateLimitResult = rateLimiter.check(request, route.command);
+      let rateLimitCommand = route.command;
+      if (route.command === 'social-like' && request.method === 'DELETE') {
+        rateLimitCommand = 'social-unlike';
+      } else if (route.command === 'social-comment-like' && request.method === 'DELETE') {
+        rateLimitCommand = 'social-comment-unlike';
+      } else if (route.command === 'social-follow-account' && request.method === 'DELETE') {
+        rateLimitCommand = 'social-unfollow';
+      } else if (route.command === 'social-me-profile' && request.method === 'PUT') {
+        rateLimitCommand = 'social-profile-update';
+      } else if (route.command === 'sync-push-device') {
+        rateLimitCommand = 'sync-push-device-register';
+      }
+
+      const rateLimitResult = rateLimiter.check(request, rateLimitCommand);
       if (!rateLimitResult.allowed) {
         jsonWithHeaders(
           response,
@@ -913,7 +1447,7 @@ export function createSyncServiceRequestHandler({
         return;
       }
 
-      logRequest(request, '-', route.command);
+      logRequest(request, '-', rateLimitCommand);
 
       const providerApprovalAvailable = Boolean(appleAuth?.configured || googleAuth?.configured);
       const manualDeviceApprovalEnabled = allowManualDeviceApproval || !providerApprovalAvailable;
@@ -1507,21 +2041,51 @@ export function createSyncServiceRequestHandler({
       const readAuthenticator = authenticateReadToken ?? authenticateToken;
       const writeAuthenticator = authenticateWriteToken ?? authenticateToken;
 
-      if (route.command === 'proposals') {
-        if (request.method === 'POST') {
-          if (!createProposalForAccount) {
-            methodNotAllowed(response, 'Proposal creation is not enabled for this service mode.');
-            return;
-          }
+      if (route.command === 'delete-account') {
+        if (request.method !== 'DELETE') {
+          methodNotAllowed(response, 'Use DELETE for /cli/account.');
+          return;
+        }
 
-          const proposalAccount = writeAuthenticator
-            ? await writeAuthenticator(requestToken)
-            : requestToken === token
-              ? { id: 'remote-user', email: null }
-              : null;
-          if (!proposalAccount) {
-            unauthorized(response, request);
-            return;
+        if (!deleteAccountForUser) {
+          methodNotAllowed(response, 'Account deletion is not enabled for this service mode.');
+          return;
+        }
+
+        const deleteAccount = writeAuthenticator
+          ? await writeAuthenticator(requestToken)
+          : null;
+        if (!deleteAccount) {
+          unauthorized(response, request);
+          return;
+        }
+
+        try {
+          await deleteAccountForUser(deleteAccount.id);
+          logRequest(request, 200);
+          json(response, 200, { deleted: true });
+          return;
+        } catch (error) {
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (route.command === 'proposals') {
+        if (request.method === 'POST') {
+          if (!createProposalForAccount) {
+            methodNotAllowed(response, 'Proposal creation is not enabled for this service mode.');
+            return;
+          }
+
+          const proposalAccount = writeAuthenticator
+            ? await writeAuthenticator(requestToken)
+            : requestToken === token
+              ? { id: 'remote-user', email: null }
+              : null;
+          if (!proposalAccount) {
+            unauthorized(response, request);
+            return;
           }
 
           try {
@@ -1670,7 +2234,30 @@ export function createSyncServiceRequestHandler({
           }
           const result = await writeSnapshotForAccount(account, snapshot);
           const sessionCount = snapshot.sessions?.length ?? 0;
-          console.log(`snapshot uploaded (${sessionCount} sessions)`);
+          const prevSessionCount = result.prevSessionCount ?? null;
+          const delta = prevSessionCount != null ? sessionCount - prevSessionCount : null;
+
+          const emptySessions = (snapshot.sessions ?? []).filter(s => !s.exercises || s.exercises.length === 0).length;
+          const emptyExercises = (snapshot.sessions ?? []).reduce((count, s) =>
+            count + (s.exercises ?? []).filter(e => !(e.sets ?? []).some(set => set.isComplete)).length, 0);
+          const missingDates = (snapshot.sessions ?? []).filter(s => !s.completedAt && !s.summary?.date && !s.date).length;
+          const duplicateIds = sessionCount - new Set((snapshot.sessions ?? []).map(s => s.id)).size;
+
+          const meta = {
+            aid: anonymizeAccountId(account.id),
+            sessions: sessionCount,
+            ...(delta != null && { delta }),
+            ...(result.activityCount != null && { newEvents: result.activityCount }),
+            appVersion: snapshot.appVersion ?? null,
+            schemaVersion: snapshot.schemaVersion ?? null,
+            programs: snapshot.programs?.length ?? 0,
+            hasProfile: Boolean(snapshot.profile?.name),
+            ...(emptySessions > 0 && { emptySessions }),
+            ...(emptyExercises > 0 && { emptyExercises }),
+            ...(missingDates > 0 && { missingDates }),
+            ...(duplicateIds > 0 && { duplicateIds })
+          };
+          console.log(`snapshot-meta ${JSON.stringify(meta)}`);
           json(response, 200, {
             ok: true,
             userId: account.id,
@@ -1689,7 +2276,7 @@ export function createSyncServiceRequestHandler({
           return;
         }
 
-        if (!updateAnalysisConsentForAccount) {
+        if (!updateAnalysisConsentForAccount && !updateDisplayNameForAccount) {
           methodNotAllowed(response, 'Account preference updates are not enabled for this service mode.');
           return;
         }
@@ -1706,15 +2293,46 @@ export function createSyncServiceRequestHandler({
 
         try {
           const body = await readJsonBody(request);
-          if (typeof body.analysisConsentEnabled !== 'boolean') {
-            badRequest(response, 'analysisConsentEnabled must be a boolean.');
+          if (!body || typeof body !== 'object' || Array.isArray(body)) {
+            badRequest(response, 'Request body must be a JSON object.');
             return;
           }
+          const wantsAnalysisConsent = Object.prototype.hasOwnProperty.call(body, 'analysisConsentEnabled');
+          const wantsDisplayName = Object.prototype.hasOwnProperty.call(body, 'displayName');
+
+          if (!wantsAnalysisConsent && !wantsDisplayName) {
+            badRequest(response, 'Provide analysisConsentEnabled and/or displayName.');
+            return;
+          }
+
+          let updatedAccount = account;
+          if (wantsAnalysisConsent) {
+            if (!updateAnalysisConsentForAccount) {
+              badRequest(response, 'analysis consent updates are not enabled.');
+              return;
+            }
+            if (typeof body.analysisConsentEnabled !== 'boolean') {
+              badRequest(response, 'analysisConsentEnabled must be a boolean.');
+              return;
+            }
+            updatedAccount = await updateAnalysisConsentForAccount(account, {
+              enabled: body.analysisConsentEnabled,
+              version: body.consentVersion ?? 1
+            });
+          }
+
+          if (wantsDisplayName) {
+            if (!updateDisplayNameForAccount) {
+              badRequest(response, 'display name updates are not enabled.');
+              return;
+            }
+            if (typeof body.displayName !== 'string') {
+              badRequest(response, 'displayName must be a string.');
+              return;
+            }
+            updatedAccount = await updateDisplayNameForAccount(updatedAccount, body.displayName);
+          }
 
-          const updatedAccount = await updateAnalysisConsentForAccount(account, {
-            enabled: body.analysisConsentEnabled,
-            version: body.consentVersion ?? 1
-          });
           json(response, 200, {
             ok: true,
             account: updatedAccount
@@ -1726,6 +2344,111 @@ export function createSyncServiceRequestHandler({
         }
       }
 
+      if (route.command === 'sync-push-device') {
+        if (request.method !== 'PUT' && request.method !== 'DELETE') {
+          methodNotAllowed(response, 'Use PUT or DELETE for /sync/push/device.');
+          return;
+        }
+
+        if (request.method === 'PUT' && !social?.registerPushDevice) {
+          methodNotAllowed(response, 'Push device registration is not enabled for this service mode.');
+          return;
+        }
+        if (request.method === 'DELETE' && !social?.revokePushDevice) {
+          methodNotAllowed(response, 'Push device revoke is not enabled for this service mode.');
+          return;
+        }
+
+        const writeAccount = writeAuthenticator
+          ? await writeAuthenticator(requestToken)
+          : requestToken === token
+            ? { id: 'remote-user', email: null }
+            : null;
+        if (!writeAccount) {
+          unauthorized(response, request);
+          return;
+        }
+
+        if (request.method === 'PUT') {
+          try {
+            const body = await readJsonBody(request);
+            const registered = await social.registerPushDevice(writeAccount.id, body ?? {});
+            logRequest(request, 200);
+            json(response, 200, registered);
+            return;
+          } catch (error) {
+            if (
+              error?.message === 'deviceToken is required.' ||
+              error?.message === 'platform must be ios.'
+            ) {
+              badRequest(response, error.message);
+              return;
+            }
+            internalError(response, error, onError);
+            return;
+          }
+        }
+
+        try {
+          const body = await readJsonBody(request);
+          const revoked = await social.revokePushDevice(writeAccount.id, body?.deviceToken);
+          if (!revoked) {
+            notFound(response, 'Push device token not found.');
+            return;
+          }
+          logRequest(request, 200);
+          json(response, 200, revoked);
+          return;
+        } catch (error) {
+          if (error?.message === 'deviceToken is required.') {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (route.command === 'sync-push-device-revoke') {
+        if (request.method !== 'DELETE') {
+          methodNotAllowed(response, 'Use DELETE for /sync/push/device/:token.');
+          return;
+        }
+
+        if (!social?.revokePushDevice) {
+          methodNotAllowed(response, 'Push device revoke is not enabled for this service mode.');
+          return;
+        }
+
+        const writeAccount = writeAuthenticator
+          ? await writeAuthenticator(requestToken)
+          : requestToken === token
+            ? { id: 'remote-user', email: null }
+            : null;
+        if (!writeAccount) {
+          unauthorized(response, request);
+          return;
+        }
+
+        try {
+          const revoked = await social.revokePushDevice(writeAccount.id, route.options.deviceToken);
+          if (!revoked) {
+            notFound(response, 'Push device token not found.');
+            return;
+          }
+          logRequest(request, 200);
+          json(response, 200, revoked);
+          return;
+        } catch (error) {
+          if (error?.message === 'deviceToken is required.') {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
       const account = readAuthenticator
         ? await readAuthenticator(requestToken)
         : requestToken === token
@@ -1744,6 +2467,9 @@ export function createSyncServiceRequestHandler({
       } catch {
         snapshot = { sessions: [], programs: [], activeProgramId: null };
       }
+      // Parse comma-separated exclude param into a Set for AI context builders
+      const parseExclude = (raw) => new Set((raw ?? '').split(',').map((s) => s.trim()).filter(Boolean));
+
       if (route.command === 'workout-summary-ai') {
         const sessionId = route.options['session-id'];
         if (!sessionId) {
@@ -1752,7 +2478,7 @@ export function createSyncServiceRequestHandler({
         }
 
         const { workoutSummaryContext } = await import('./queries.js');
-        const ctx = workoutSummaryContext(snapshot, sessionId);
+        const ctx = workoutSummaryContext(snapshot, sessionId, { exclude: parseExclude(route.options['exclude']) });
         if (!ctx) {
           notFound(response, `Session not found: ${sessionId}`);
           return;
@@ -1766,7 +2492,11 @@ export function createSyncServiceRequestHandler({
 
         try {
           const { generateWorkoutCoachingSummary } = await import('./openrouter.js');
-          const result = await generateWorkoutCoachingSummary(ctx, { apiKey: openrouterKey });
+          const result = await generateWorkoutCoachingSummary(ctx, { apiKey: openrouterKey, tone: route.options['tone'] });
+          if (isNoInsightResponse(result.text)) {
+            response.writeHead(204).end();
+            return;
+          }
           if (result.fallback && onError) {
             const warning = new Error(`AI workout-summary used fallback model ${result.model}`);
             warning.level = 'warning';
@@ -1777,6 +2507,13 @@ export function createSyncServiceRequestHandler({
               fallbackModel: result.model
             });
           }
+          const { SYSTEM_PROMPTS_FOR_LEAK_CHECK: leakPromptsW } = await import('./openrouter.js');
+          if (detectSystemPromptLeak(result.text, leakPromptsW)) {
+            console.error('SECURITY: System prompt leak detected in workout-summary response, blocking');
+            onError?.(new Error('System prompt leak detected in AI response'), { feature: 'workout-summary', security: true });
+            json(response, 200, { summary: null, model: result.model, filtered: true });
+            return;
+          }
           json(response, 200, { summary: result.text, model: result.model });
         } catch (err) {
           console.error('AI workout summary error:', err.message);
@@ -1790,6 +2527,30 @@ export function createSyncServiceRequestHandler({
         return;
       }
 
+      if (route.command === 'coach-memory') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/coach-memory.');
+          return;
+        }
+        if (!readCoachMemoryForAccount) {
+          json(response, 503, { error: 'Coach memory not available' });
+          return;
+        }
+        try {
+          const memory = await readCoachMemoryForAccount(account);
+          if (!memory) {
+            response.writeHead(204);
+            response.end();
+            return;
+          }
+          json(response, 200, { memory: memory.content, version: memory.version, updatedAt: memory.updatedAt });
+        } catch (err) {
+          console.error('Coach memory read error:', err.message);
+          json(response, 500, { error: 'Failed to read coach memory' });
+        }
+        return;
+      }
+
       if (route.command === 'cycle-summary-ai') {
         const programId = route.options['program-id'];
         if (!programId) {
@@ -1798,12 +2559,22 @@ export function createSyncServiceRequestHandler({
         }
 
         const { cycleSummaryContext } = await import('./queries.js');
-        const ctx = cycleSummaryContext(snapshot, programId);
+        const ctx = cycleSummaryContext(snapshot, programId, { exclude: parseExclude(route.options['exclude']) });
         if (!ctx) {
           notFound(response, `No completed cycle found for program: ${programId}`);
           return;
         }
 
+        // Inject coach memory into cycle summary context if available
+        let coachMemory = null;
+        if (readCoachMemoryForAccount) {
+          try {
+            coachMemory = await readCoachMemoryForAccount(account);
+          } catch (memErr) {
+            console.error('Coach memory read error (cycle-summary):', memErr.message);
+          }
+        }
+
         const openrouterKey = process.env.OPENROUTER_API_KEY;
         if (!openrouterKey) {
           json(response, 503, { error: 'AI summaries not configured', code: 'not_configured' });
@@ -1812,7 +2583,10 @@ export function createSyncServiceRequestHandler({
 
         try {
           const { generateCoachingSummary } = await import('./openrouter.js');
-          const result = await generateCoachingSummary(ctx, { apiKey: openrouterKey });
+          if (coachMemory?.content) {
+            ctx.coachMemory = coachMemory.content;
+          }
+          const result = await generateCoachingSummary(ctx, { apiKey: openrouterKey, tone: route.options['tone'] });
           if (result.fallback && onError) {
             const warning = new Error(`AI cycle-summary used fallback model ${result.model}`);
             warning.level = 'warning';
@@ -1823,7 +2597,39 @@ export function createSyncServiceRequestHandler({
               fallbackModel: result.model
             });
           }
+          const { SYSTEM_PROMPTS_FOR_LEAK_CHECK: leakPromptsC } = await import('./openrouter.js');
+          if (detectSystemPromptLeak(result.text, leakPromptsC)) {
+            console.error('SECURITY: System prompt leak detected in cycle-summary response, blocking');
+            onError?.(new Error('System prompt leak detected in AI response'), { feature: 'cycle-summary', security: true });
+            json(response, 200, { summary: null, model: result.model, filtered: true });
+            return;
+          }
           json(response, 200, { summary: result.text, model: result.model });
+
+          // Background: update coach memory after responding
+          if (writeCoachMemoryForAccount && readCoachMemoryForAccount) {
+            setImmediate(async () => {
+              try {
+                const { generateMemoryUpdate } = await import('./openrouter.js');
+                // Build recent context from previous cycle summaries
+                const recentLines = (ctx.previousCycles || [])
+                  .filter((pc) => pc.previousAISummary)
+                  .map((pc) => `Week ${pc.weekNumber}: ${pc.previousAISummary.split('\n')[0].slice(0, 200)}`)
+                  .join('\n');
+                const memResult = await generateMemoryUpdate(
+                  coachMemory?.content || '',
+                  result.text,
+                  recentLines || null,
+                  { apiKey: openrouterKey }
+                );
+                await writeCoachMemoryForAccount(account, memResult.text);
+                console.log(`Coach memory updated for account (v${(coachMemory?.version ?? 0) + 1})`);
+              } catch (memErr) {
+                console.error('Background coach memory update failed:', memErr.message);
+                onError?.(memErr, { feature: 'coach-memory-update' });
+              }
+            });
+          }
         } catch (err) {
           console.error('AI cycle summary error:', err.message);
           onError?.(err, {
@@ -1844,11 +2650,11 @@ export function createSyncServiceRequestHandler({
         }
 
         const { vitalsSummaryContext } = await import('./queries.js');
-        const ctx = vitalsSummaryContext(snapshot);
+        const ctx = vitalsSummaryContext(snapshot, { exclude: parseExclude(route.options['exclude']) });
 
         try {
           const { generateVitalsSummary } = await import('./openrouter.js');
-          const result = await generateVitalsSummary(ctx, { apiKey: openrouterKey });
+          const result = await generateVitalsSummary(ctx, { apiKey: openrouterKey, tone: route.options['tone'] });
           if (result.fallback && onError) {
             const warning = new Error(`AI vitals-summary used fallback model ${result.model}`);
             warning.level = 'warning';
@@ -1859,6 +2665,13 @@ export function createSyncServiceRequestHandler({
               fallbackModel: result.model
             });
           }
+          const { SYSTEM_PROMPTS_FOR_LEAK_CHECK: leakPromptsV } = await import('./openrouter.js');
+          if (detectSystemPromptLeak(result.text, leakPromptsV)) {
+            console.error('SECURITY: System prompt leak detected in vitals-summary response, blocking');
+            onError?.(new Error('System prompt leak detected in AI response'), { feature: 'vitals-summary', security: true });
+            json(response, 200, { summary: null, model: result.model, filtered: true });
+            return;
+          }
           json(response, 200, { summary: result.text, model: result.model });
         } catch (err) {
           console.error('AI vitals summary error:', err.message);
@@ -1885,12 +2698,24 @@ export function createSyncServiceRequestHandler({
         }
 
         const { checkpointContext } = await import('./queries.js');
-        const ctx = checkpointContext(snapshot, programId, checkpointWeek);
+        const ctx = checkpointContext(snapshot, programId, checkpointWeek, { exclude: parseExclude(route.options['exclude']) });
         if (!ctx) {
           notFound(response, 'No strength plan found for program');
           return;
         }
 
+        // Inject coach memory into checkpoint context
+        if (readCoachMemoryForAccount) {
+          try {
+            const mem = await readCoachMemoryForAccount(account);
+            if (mem?.content) {
+              ctx.coachMemory = mem.content;
+            }
+          } catch (memErr) {
+            console.error('Coach memory read error (checkpoint):', memErr.message);
+          }
+        }
+
         const openrouterKey = process.env.OPENROUTER_API_KEY;
         if (!openrouterKey) {
           json(response, 503, { error: 'AI summaries not configured', code: 'not_configured' });
@@ -1899,7 +2724,7 @@ export function createSyncServiceRequestHandler({
 
         try {
           const { generateCheckpointSummary } = await import('./openrouter.js');
-          const result = await generateCheckpointSummary(ctx, { apiKey: openrouterKey });
+          const result = await generateCheckpointSummary(ctx, { apiKey: openrouterKey, tone: route.options['tone'] });
           if (result.fallback && onError) {
             const warning = new Error(`AI checkpoint-summary used fallback model ${result.model}`);
             warning.level = 'warning';
@@ -1910,6 +2735,13 @@ export function createSyncServiceRequestHandler({
               fallbackModel: result.model
             });
           }
+          const { SYSTEM_PROMPTS_FOR_LEAK_CHECK: leakPromptsCP } = await import('./openrouter.js');
+          if (detectSystemPromptLeak(result.text, leakPromptsCP)) {
+            console.error('SECURITY: System prompt leak detected in checkpoint-summary response, blocking');
+            onError?.(new Error('System prompt leak detected in AI response'), { feature: 'checkpoint-summary', security: true });
+            json(response, 200, { summary: null, model: result.model, filtered: true });
+            return;
+          }
           json(response, 200, { summary: result.text, model: result.model });
         } catch (err) {
           console.error('AI checkpoint summary error:', err.message);
@@ -1953,23 +2785,14 @@ export function createSyncServiceRequestHandler({
           return;
         }
 
-        const history = Array.isArray(body?.history) ? body.history : [];
-        const validHistory = history.every(
-          (m) => m && typeof m.role === 'string' && typeof m.content === 'string'
-        );
-        if (!validHistory) {
-          badRequest(response, 'history must be an array of {role, content} objects');
-          return;
-        }
+        const history = sanitizeHistory(body?.history);
         const persistedConversation = getAskConversationForAccount
           ? await getAskConversationForAccount(account, conversationId)
           : null;
         const persistedMessages = Array.isArray(persistedConversation?.messages)
-          ? persistedConversation.messages.filter(
-              (m) => m && typeof m.role === 'string' && typeof m.content === 'string'
-            )
+          ? sanitizeHistory(persistedConversation.messages)
           : null;
-        const canonicalHistory = persistedMessages ?? history;
+        const canonicalHistory = (persistedMessages?.length ? persistedMessages : null) ?? history;
         const priorUserTurns = canonicalHistory.filter((m) => m.role === 'user').length;
         if (priorUserTurns >= MAX_ASK_USER_TURNS) {
           json(response, 400, { error: `Ask Coach supports up to ${MAX_ASK_USER_TURNS} questions per conversation. Start a new conversation.`, code: 'conversation_limit' });
@@ -1982,12 +2805,41 @@ export function createSyncServiceRequestHandler({
           return;
         }
 
-        const { askContext } = await import('./queries.js');
-        const ctx = askContext(snapshot);
+        const queries = await import('./queries.js');
+        const exclude = parseExclude(body?.exclude);
+        let ctx = queries.askContext(snapshot, { exclude });
+
+        // Inject coach memory into ask context
+        if (readCoachMemoryForAccount) {
+          try {
+            const mem = await readCoachMemoryForAccount(account);
+            if (mem?.content) {
+              ctx = ctx + '\n\n' + fenceContent('coach_memory', mem.content);
+            }
+          } catch (memErr) {
+            console.error('Coach memory read error (ask):', memErr.message);
+          }
+        }
+
+        const askTone = ['default', 'hype', 'numbers-only'].includes(body?.tone) ? body.tone : undefined;
 
         try {
           const { generateAskAnswer } = await import('./openrouter.js');
-          const askResult = await generateAskAnswer(ctx, question, { apiKey: openrouterKey, history: canonicalHistory });
+
+          const askResult = await generateAskAnswer(ctx, question, {
+            apiKey: openrouterKey, history: canonicalHistory, tone: askTone
+          });
+
+          // Check for system prompt leakage BEFORE persisting — a leaked
+          // response must never be saved to the conversation history.
+          const { SYSTEM_PROMPTS_FOR_LEAK_CHECK } = await import('./openrouter.js');
+          if (detectSystemPromptLeak(askResult.text, SYSTEM_PROMPTS_FOR_LEAK_CHECK)) {
+            console.error('SECURITY: System prompt leak detected in ask-ai response, blocking');
+            onError?.(new Error('System prompt leak detected in AI response'), { feature: 'ask-coach', security: true });
+            json(response, 200, { answer: 'I can only answer questions about your training. Could you rephrase?', model: askResult.model, filtered: true });
+            return;
+          }
+
           const updatedMessages = [
             ...canonicalHistory,
             { role: 'user', content: question },
@@ -2027,6 +2879,51 @@ export function createSyncServiceRequestHandler({
         return;
       }
 
+      if (route.command === 'ai-feedback') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/ai/feedback.');
+          return;
+        }
+
+        if (!saveAIFeedbackForAccount) {
+          json(response, 503, { error: 'Feedback not available' });
+          return;
+        }
+
+        let body;
+        try {
+          body = await readJsonBody(request);
+        } catch {
+          badRequest(response, 'Invalid request body.');
+          return;
+        }
+
+        const { feedbackKey, choice, reason, surface, model } = body ?? {};
+        if (typeof feedbackKey !== 'string' || !feedbackKey) {
+          badRequest(response, 'feedbackKey is required.');
+          return;
+        }
+        if (typeof choice !== 'string' || !['positive', 'negative'].includes(choice)) {
+          badRequest(response, 'choice must be "positive" or "negative".');
+          return;
+        }
+
+        try {
+          await saveAIFeedbackForAccount(account, {
+            feedbackKey,
+            choice,
+            reason: typeof reason === 'string' ? reason : null,
+            surface: typeof surface === 'string' ? surface : null,
+            model: typeof model === 'string' ? model : null
+          });
+          json(response, 200, { ok: true });
+        } catch (err) {
+          console.error('Failed to save AI feedback:', err.message);
+          json(response, 500, { error: 'Failed to save feedback' });
+        }
+        return;
+      }
+
       if (route.command === 'ask-history') {
         if (request.method !== 'GET') {
           methodNotAllowed(response, 'Use GET for /cli/ask/history.');
@@ -2091,6 +2988,1216 @@ export function createSyncServiceRequestHandler({
         return;
       }
 
+      // --- Social endpoints ---
+      if (social && route.command === 'social-me-profile') {
+        if (request.method === 'GET') {
+          const profile = await social.getMyProfile(account.id);
+          if (!profile) {
+            notFound(response, 'Social profile not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            hasUsername: Boolean(profile.username),
+            hasDisplayName: Boolean(profile.displayName),
+            privacy: profile.privacy ?? null
+          }));
+          json(response, 200, profile);
+          return;
+        }
+
+        if (request.method === 'PUT') {
+          const body = await readJsonBody(request);
+          try {
+            const profile = await social.updateMyProfile(account.id, body ?? {});
+            if (!profile) {
+              notFound(response, 'Social profile not found.');
+              return;
+            }
+            logRequest(request, 200, socialLogSuffix(request, account.id, {
+              cmd: route.command,
+              hasUsername: Boolean(profile.username),
+              hasDisplayName: Boolean(profile.displayName),
+              privacy: profile.privacy ?? null
+            }));
+            json(response, 200, profile);
+            return;
+          } catch (error) {
+            if (error?.message === 'username is already taken.') {
+              json(response, 409, { error: error.message });
+              return;
+            }
+            if (
+              error?.message?.startsWith('Provide at least one of') ||
+              error?.message?.startsWith('displayName') ||
+              error?.message?.startsWith('username') ||
+              error?.message?.startsWith('privacy') ||
+              error?.message?.startsWith('avatarUrl')
+            ) {
+              badRequest(response, error.message);
+              return;
+            }
+            internalError(response, error, onError);
+            return;
+          }
+        }
+
+        methodNotAllowed(response, 'Use GET or PUT for /cli/social/me/profile.');
+        return;
+      }
+
+      if (social && route.command === 'social-user-search') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/users/search.');
+          return;
+        }
+        const query = route.options.q ?? '';
+        const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 20;
+        const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 50) : 20;
+        const users = await social.searchUsers(account.id, {
+          query,
+          limit
+        });
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: users.length,
+          limit,
+          queryLen: query.length,
+          queryHasAt: query.includes('@'),
+          queryHasSpace: /\s/.test(query)
+        }));
+        json(response, 200, { users });
+        return;
+      }
+
+      if (social && route.command === 'social-user-suggestions') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/users/suggestions.');
+          return;
+        }
+        const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 10;
+        const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 20) : 10;
+        const users = await social.suggestUsers(account.id, {
+          limit
+        });
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: users.length,
+          limit
+        }));
+        json(response, 200, { users });
+        return;
+      }
+
+      if (social && route.command === 'social-user-profile') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/users/:identifier.');
+          return;
+        }
+        const user = await social.getUserProfile(account.id, route.options.identifier);
+        if (!user) {
+          notFound(response, 'User not found.');
+          return;
+        }
+        logRequest(request, 200);
+        json(response, 200, user);
+        return;
+      }
+
+      if (social && route.command === 'social-user-report') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/users/:accountId/report.');
+          return;
+        }
+        const report = await social.getUserReport(account.id, route.options.accountId);
+        if (!report) {
+          notFound(response, 'User report not found.');
+          return;
+        }
+        logRequest(request, 200);
+        json(response, 200, report);
+        return;
+      }
+
+      if (social && route.command === 'social-user-exercise-history') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/users/:accountId/exercises/history?name=...');
+          return;
+        }
+        if (!route.options.name) {
+          json(response, 400, { ok: false, error: 'name query parameter is required' });
+          return;
+        }
+        const result = await social.getExerciseHistory(account.id, route.options.accountId, route.options.name);
+        if (result.error === 'forbidden') {
+          json(response, 403, { ok: false, error: 'Access denied' });
+          return;
+        }
+        if (result.error === 'not_found') {
+          notFound(response, 'No exercise history found.');
+          return;
+        }
+        logRequest(request, 200);
+        json(response, 200, result);
+        return;
+      }
+
+      if (social && route.command === 'social-invite') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/invite.');
+          return;
+        }
+        try {
+          const result = await social.createFollowInvite(account.id);
+          logRequest(request, 200);
+          json(response, 200, result);
+        } catch (err) {
+          internalError(response, err, onError);
+        }
+        return;
+      }
+
+      if (social && route.command === 'social-groups') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/groups.');
+          return;
+        }
+        const groups = await social.listGroups(account.id);
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: groups.length
+        }));
+        json(response, 200, { groups });
+        return;
+      }
+
+      if (social && route.command === 'social-group-create') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/groups.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          const group = await social.createGroup(account.id, body ?? {});
+          logRequest(request, 201, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            groupId: group?.id ?? null
+          }));
+          json(response, 201, group);
+          return;
+        } catch (error) {
+          const message = error?.message ?? '';
+          if (message.startsWith('name ') || message.startsWith('description ')) {
+            badRequest(response, message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-group-detail') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/groups/:groupId.');
+          return;
+        }
+        const group = await social.getGroupDetail(account.id, route.options.groupId);
+        if (!group) {
+          notFound(response, 'Group not found.');
+          return;
+        }
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          groupId: group.id
+        }));
+        json(response, 200, group);
+        return;
+      }
+
+      if (social && route.command === 'social-group-update') {
+        if (request.method !== 'PATCH') {
+          methodNotAllowed(response, 'Use PATCH for /cli/social/groups/:groupId.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          const group = await social.updateGroup(account.id, route.options.groupId, body ?? {});
+          if (!group) {
+            notFound(response, 'Group not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            groupId: group.id
+          }));
+          json(response, 200, group);
+          return;
+        } catch (error) {
+          const message = error?.message ?? '';
+          if (
+            message === 'Request body is required.' ||
+            message === 'Invalid JSON in request body.' ||
+            message === 'Request body too large.' ||
+            message.startsWith('name ') ||
+            message.startsWith('description ')
+          ) {
+            badRequest(response, message);
+            return;
+          }
+          if (message === 'Group not found.') {
+            notFound(response, message);
+            return;
+          }
+          if (message === 'Only group owners can edit the group.') {
+            forbidden(response, message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-group-add-member') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/groups/:groupId/members.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          const accountId = body?.accountId;
+          if (!accountId) {
+            badRequest(response, 'accountId is required.');
+            return;
+          }
+          const group = await social.addMember(account.id, route.options.groupId, accountId);
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            groupId: route.options.groupId,
+            targetAccountId: accountId
+          }));
+          json(response, 200, group);
+          return;
+        } catch (error) {
+          const message = error?.message ?? '';
+          if (message === 'Group not found.' || message === 'User not found.') {
+            notFound(response, message);
+            return;
+          }
+          if (message === 'Only group owners can add members.') {
+            forbidden(response, message);
+            return;
+          }
+          if (message === 'Already a member of this group.') {
+            badRequest(response, message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-group-invite') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/groups/:groupId/invite.');
+          return;
+        }
+        try {
+          const invite = await social.createGroupInvite(account.id, route.options.groupId);
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            groupId: route.options.groupId
+          }));
+          json(response, 200, invite);
+          return;
+        } catch (error) {
+          if (
+            error?.message === 'Group not found.' ||
+            error?.message === 'Only group owners can invite members.'
+          ) {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-group-join') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/groups/join.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (!body?.inviteCode) {
+            badRequest(response, 'inviteCode is required.');
+            return;
+          }
+          const group = await social.joinGroup(account.id, body.inviteCode);
+          if (!group) {
+            notFound(response, 'Group invite not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            groupId: group.id
+          }));
+          json(response, 200, group);
+          return;
+        } catch (error) {
+          if (error?.message === 'Already a member of this group.') {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-group-leave') {
+        if (request.method !== 'DELETE') {
+          methodNotAllowed(response, 'Use DELETE for /cli/social/groups/:groupId/membership.');
+          return;
+        }
+        try {
+          const left = await social.leaveGroup(account.id, route.options.groupId);
+          if (!left) {
+            notFound(response, 'Group membership not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            groupId: route.options.groupId
+          }));
+          json(response, 200, { ok: true });
+          return;
+        } catch (error) {
+          if (error?.message === 'Group owners cannot leave their group.') {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-group-feed') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/groups/:groupId/feed.');
+          return;
+        }
+        const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 20;
+        const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 100) : 20;
+        const before = route.options.before ?? null;
+        const result = await social.getGroupFeed(account.id, route.options.groupId, { limit, before });
+        if (result === null) {
+          notFound(response, 'Group not found or you are not a member.');
+          return;
+        }
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          groupId: route.options.groupId,
+          count: result.length,
+          limit,
+          hasBefore: Boolean(before)
+        }));
+        json(response, 200, { items: result });
+        return;
+      }
+
+      if (social && route.command === 'social-group-leaderboard') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/groups/:groupId/leaderboard.');
+          return;
+        }
+        const result = await social.weeklyGroupLeaderboard(account.id, route.options.groupId, { weekOffset: route.options.week });
+        if (result === null) {
+          notFound(response, 'Group not found or you are not a member.');
+          return;
+        }
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          groupId: route.options.groupId,
+          count: result.length
+        }));
+        json(response, 200, { leaderboard: result });
+        return;
+      }
+
+      if (social && route.command === 'social-follow') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/follow.');
+          return;
+        }
+        const body = await readJsonBody(request);
+        if (!body?.inviteCode) {
+          badRequest(response, 'inviteCode is required.');
+          return;
+        }
+        let result;
+        try {
+          result = await social.acceptFollowInvite(account.id, body.inviteCode.toUpperCase());
+        } catch (error) {
+          if (error?.message === 'Cannot follow yourself.') {
+            logRequest(request, 400, socialLogSuffix(request, account.id, {
+              cmd: route.command,
+              outcome: 'self_blocked'
+            }));
+            badRequest(response, error.message);
+            return;
+          }
+          if (error?.message === 'Already following this user.') {
+            logRequest(request, 409, socialLogSuffix(request, account.id, {
+              cmd: route.command,
+              outcome: 'already_following'
+            }));
+            json(response, 409, { error: error.message });
+            return;
+          }
+          if (error?.message === 'Follow invite has already been used.') {
+            logRequest(request, 409, socialLogSuffix(request, account.id, {
+              cmd: route.command,
+              outcome: 'invite_already_used'
+            }));
+            json(response, 409, { error: error.message });
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+        if (!result) {
+          logRequest(request, 404, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            outcome: 'invite_not_found'
+          }));
+          notFound(response, 'Invite code not found or expired.');
+          return;
+        }
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          followStatus: result.status ?? null,
+          targetAid: anonymizeAccountId(result.followingId)
+        }));
+        json(response, 200, result);
+        return;
+      }
+
+      if (social && route.command === 'social-follow-account') {
+        if (request.method === 'POST') {
+          const targetAid = anonymizeAccountId(route.options.accountId);
+          try {
+            const result = await social.followUserByAccountId(account.id, route.options.accountId);
+            if (!result) {
+              logRequest(request, 404, socialLogSuffix(request, account.id, {
+                cmd: route.command,
+                targetAid,
+                outcome: 'target_not_found'
+              }));
+              notFound(response, 'User not found.');
+              return;
+            }
+            logRequest(request, 200, socialLogSuffix(request, account.id, {
+              cmd: route.command,
+              followStatus: result.status ?? null,
+              targetAid
+            }));
+            json(response, 200, result);
+            return;
+          } catch (error) {
+            if (error?.message === 'Cannot follow yourself.') {
+              logRequest(request, 400, socialLogSuffix(request, account.id, {
+                cmd: route.command,
+                targetAid,
+                outcome: 'self_blocked'
+              }));
+              badRequest(response, error.message);
+              return;
+            }
+            if (error?.message === 'Already following this user.') {
+              logRequest(request, 409, socialLogSuffix(request, account.id, {
+                cmd: route.command,
+                targetAid,
+                outcome: 'already_following'
+              }));
+              json(response, 409, { error: error.message });
+              return;
+            }
+            if (error?.message === 'Account not found.') {
+              logRequest(request, 404, socialLogSuffix(request, account.id, {
+                cmd: route.command,
+                targetAid,
+                outcome: 'target_not_found'
+              }));
+              notFound(response, error.message);
+              return;
+            }
+            internalError(response, error, onError);
+            return;
+          }
+        }
+
+        if (request.method === 'DELETE') {
+          const targetAid = anonymizeAccountId(route.options.accountId);
+          const result = await social.unfollowUser(account.id, route.options.accountId);
+          if (!result) {
+            logRequest(request, 404, socialLogSuffix(request, account.id, {
+              cmd: 'social-unfollow',
+              targetAid,
+              outcome: 'relationship_not_found'
+            }));
+            notFound(response, 'Follow relationship not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: 'social-unfollow',
+            targetAid
+          }));
+          json(response, 200, { ok: true });
+          return;
+        }
+
+        methodNotAllowed(response, 'Use POST or DELETE for /cli/social/follow/:accountId.');
+        return;
+      }
+
+      if (social && route.command === 'social-following') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/following.');
+          return;
+        }
+        const result = await social.listFollowing(account.id);
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: result.length,
+          targets: anonymizeRelationIds(result)
+        }));
+        json(response, 200, { following: result });
+        return;
+      }
+
+      if (social && route.command === 'social-followers') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/followers.');
+          return;
+        }
+        const result = await social.listFollowers(account.id);
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: result.length,
+          followers: anonymizeRelationIds(result)
+        }));
+        json(response, 200, { followers: result });
+        return;
+      }
+
+      if (social && route.command === 'social-leaderboard') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/leaderboard.');
+          return;
+        }
+        const leaderboard = await social.weeklyLeaderboard(account.id, { weekOffset: route.options.week });
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: leaderboard.length
+        }));
+        json(response, 200, { leaderboard });
+        return;
+      }
+
+      if (social && route.command === 'social-gym-leaderboard') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/gym/leaderboard.');
+          return;
+        }
+        const leaderboard = await social.weeklyGymLeaderboard(account.id, { weekOffset: route.options.week });
+        if (leaderboard === null) {
+          json(response, 200, { leaderboard: [] });
+          return;
+        }
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: leaderboard.length
+        }));
+        json(response, 200, { leaderboard });
+        return;
+      }
+
+      if (social && route.command === 'social-feed') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/feed.');
+          return;
+        }
+        const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 20;
+        const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 100) : 20;
+        const before = route.options.before ?? null;
+        const result = await social.getFeedActivities(account.id, { limit, before });
+        const firstItem = result[0] ?? null;
+        const includesOwn = result.some((item) => item?.userId === account.id);
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: result.length,
+          owners: anonymizeOwnerIds(result),
+          limit,
+          hasBefore: Boolean(before),
+          hasMoreCandidate: result.length === limit,
+          includesOwn,
+          firstOwnerAid: firstItem?.userId ? anonymizeAccountId(firstItem.userId) : null,
+          firstEventType: firstItem?.eventType ?? null
+        }));
+        json(response, 200, { items: result });
+        return;
+      }
+
+      if (social && route.command === 'social-feed-groups') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/feed/groups.');
+          return;
+        }
+        const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 20;
+        const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 100) : 20;
+        const before = route.options.before ?? null;
+        const result = await social.getAllGroupsFeed(account.id, { limit, before });
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          count: result.length,
+          limit,
+          hasBefore: Boolean(before)
+        }));
+        json(response, 200, { items: result });
+        return;
+      }
+
+      if (social && route.command === 'social-feed-detail') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/feed/:activityId.');
+          return;
+        }
+        const result = await social.getActivityDetail(account.id, route.options.activityId);
+        if (!result) {
+          notFound(response, 'Activity not found.');
+          return;
+        }
+        logRequest(request, 200, socialLogSuffix(request, account.id, {
+          cmd: route.command,
+          ownerAid: anonymizeAccountId(result.userId),
+          eventType: result.eventType ?? null
+        }));
+        json(response, 200, result);
+        return;
+      }
+
+      if (social && route.command === 'social-like') {
+        if (request.method === 'POST') {
+          const result = await social.likeActivity(account.id, route.options.activityId);
+          if (!result) {
+            notFound(response, 'Activity not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            activityIdPresent: Boolean(route.options.activityId)
+          }));
+          json(response, 200, { liked: true });
+          return;
+        }
+        if (request.method === 'DELETE') {
+          const result = await social.unlikeActivity(account.id, route.options.activityId);
+          if (!result) {
+            notFound(response, 'Activity not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: 'social-unlike',
+            activityIdPresent: Boolean(route.options.activityId)
+          }));
+          json(response, 200, { liked: false });
+          return;
+        }
+        methodNotAllowed(response, 'Use POST or DELETE for /cli/social/feed/:activityId/like.');
+        return;
+      }
+
+      if (social && route.command === 'social-likes') {
+        if (request.method === 'GET') {
+          const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 50;
+          const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 100) : 50;
+          const likes = await social.listActivityLikes(account.id, route.options.activityId, { limit });
+          if (!likes) {
+            notFound(response, 'Activity not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            count: likes.length,
+            limit
+          }));
+          json(response, 200, { likes });
+          return;
+        }
+        methodNotAllowed(response, 'Use GET for /cli/social/feed/:activityId/likes.');
+        return;
+      }
+
+      if (social && route.command === 'social-comments') {
+        if (request.method === 'GET') {
+          const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 50;
+          const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 100) : 50;
+          const comments = await social.listActivityComments(account.id, route.options.activityId, { limit });
+          if (!comments) {
+            notFound(response, 'Activity not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            count: comments.length,
+            limit
+          }));
+          json(response, 200, { comments });
+          return;
+        }
+
+        if (request.method === 'POST') {
+          const body = await readJsonBody(request);
+          if (typeof body?.text !== 'string' || !body.text.trim()) {
+            badRequest(response, 'text is required.');
+            return;
+          }
+          try {
+            const comment = await social.createActivityComment(account.id, route.options.activityId, body.text);
+            if (!comment) {
+              notFound(response, 'Activity not found.');
+              return;
+            }
+            logRequest(request, 201, socialLogSuffix(request, account.id, {
+              cmd: route.command,
+              created: true
+            }));
+            json(response, 201, comment);
+            return;
+          } catch (error) {
+            if (error?.message === 'Comment text is required.' ||
+                error?.message === 'Comment must be 280 characters or fewer.') {
+              badRequest(response, error.message);
+              return;
+            }
+            internalError(response, error, onError);
+            return;
+          }
+        }
+
+        methodNotAllowed(response, 'Use GET or POST for /cli/social/feed/:activityId/comments.');
+        return;
+      }
+
+      if (social && route.command === 'social-comment-like') {
+        if (request.method === 'POST') {
+          const result = await social.likeComment(account.id, route.options.commentId);
+          if (!result) {
+            notFound(response, 'Comment not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            activityIdPresent: Boolean(route.options.activityId),
+            commentIdPresent: Boolean(route.options.commentId)
+          }));
+          json(response, 200, { liked: true });
+          return;
+        }
+        if (request.method === 'DELETE') {
+          const result = await social.unlikeComment(account.id, route.options.commentId);
+          if (!result) {
+            notFound(response, 'Comment not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: 'social-comment-unlike',
+            activityIdPresent: Boolean(route.options.activityId),
+            commentIdPresent: Boolean(route.options.commentId)
+          }));
+          json(response, 200, { liked: false });
+          return;
+        }
+        methodNotAllowed(response, 'Use POST or DELETE for /cli/social/feed/:activityId/comments/:commentId/like.');
+        return;
+      }
+
+      if (social && route.command === 'social-follow-requests') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/follow/requests.');
+          return;
+        }
+        try {
+          const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 50;
+          const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 100) : 50;
+          const requests = await social.listFollowRequests(account.id, {
+            type: route.options.type ?? 'incoming',
+            status: route.options.status ?? 'pending',
+            limit
+          });
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            count: requests.length,
+            type: route.options.type ?? 'incoming',
+            status: route.options.status ?? 'pending',
+            limit
+          }));
+          json(response, 200, { requests });
+          return;
+        } catch (error) {
+          if (
+            error?.message === 'type must be incoming or outgoing.' ||
+            error?.message?.startsWith('status must be one of:')
+          ) {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-follow-request-approve') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/follow/requests/:followerId/approve.');
+          return;
+        }
+        try {
+          const approved = await social.approveFollowRequest(account.id, route.options.followerId);
+          if (!approved) {
+            notFound(response, 'Pending follow request not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            followerAid: anonymizeAccountId(route.options.followerId)
+          }));
+          json(response, 200, approved);
+          return;
+        } catch (error) {
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-follow-request-decline') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/follow/requests/:followerId/decline.');
+          return;
+        }
+        try {
+          const declined = await social.declineFollowRequest(account.id, route.options.followerId);
+          if (!declined) {
+            notFound(response, 'Pending follow request not found.');
+            return;
+          }
+          logRequest(request, 200, socialLogSuffix(request, account.id, {
+            cmd: route.command,
+            followerAid: anonymizeAccountId(route.options.followerId)
+          }));
+          json(response, 200, declined);
+          return;
+        } catch (error) {
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-media-upload-url') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/media/upload-url.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          const intent = await social.createMediaUploadUrl(account.id, body ?? {});
+          logRequest(request, 200);
+          json(response, 200, intent);
+          return;
+        } catch (error) {
+          const message = error?.message ?? '';
+          if (
+            message === 'Social media storage is not configured.' ||
+            message.startsWith('kind must be') ||
+            message.startsWith('mimeType must be') ||
+            message.startsWith('byteSize must be') ||
+            message === 'objectKey is required.' ||
+            message === 'publicUrl is required.'
+          ) {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-media-complete') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/media/:assetId/complete.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          const uploadToken = body?.uploadToken ?? null;
+          const asset = await social.completeMediaUpload(account.id, route.options.assetId, uploadToken);
+          logRequest(request, 200);
+          json(response, 200, asset);
+          return;
+        } catch (error) {
+          if (
+            error?.message === 'assetId is required.' ||
+            error?.message === 'uploadToken is required.'
+          ) {
+            badRequest(response, error.message);
+            return;
+          }
+          if (
+            error?.message === 'Upload intent already completed.' ||
+            error?.message === 'Uploaded media object not found.'
+          ) {
+            json(response, 409, { error: error.message });
+            return;
+          }
+          if (error?.message === 'Upload intent expired.') {
+            json(response, 410, { error: error.message });
+            return;
+          }
+          if (
+            error?.message === 'Upload intent not found.' ||
+            error?.message === 'Media asset not found.'
+          ) {
+            notFound(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-media-delete') {
+        if (request.method !== 'DELETE') {
+          methodNotAllowed(response, 'Use DELETE for /cli/social/media/:assetId.');
+          return;
+        }
+        try {
+          const deleted = await social.deleteMediaAsset(account.id, route.options.assetId);
+          if (!deleted) {
+            notFound(response, 'Media asset not found.');
+            return;
+          }
+          logRequest(request, 200);
+          json(response, 200, deleted);
+          return;
+        } catch (error) {
+          if (error?.message === 'assetId is required.') {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-post-update') {
+        if (request.method !== 'PUT') {
+          methodNotAllowed(response, 'Use PUT for /cli/social/feed/:activityId/post.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          const post = await social.updateActivityPost(account.id, route.options.activityId, body ?? {});
+          if (!post) {
+            notFound(response, 'Activity not found.');
+            return;
+          }
+          logRequest(request, 200);
+          json(response, 200, post);
+          return;
+        } catch (error) {
+          if (error?.message === 'Only the activity owner can edit this post.') {
+            json(response, 403, { error: error.message });
+            return;
+          }
+          if (
+            error?.message === 'activityId is required.' ||
+            error?.message === 'Provide at least one of caption or mediaAssetIds.' ||
+            error?.message === 'Only workout_completed activities are editable.' ||
+            error?.message === 'caption must be a string.' ||
+            error?.message?.startsWith('caption must be') ||
+            error?.message === 'mediaAssetIds must be an array.' ||
+            error?.message?.startsWith('mediaAssetIds must contain at most') ||
+            error?.message === 'One or more mediaAssetIds are invalid.'
+          ) {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-notifications') {
+        if (request.method !== 'GET') {
+          methodNotAllowed(response, 'Use GET for /cli/social/notifications.');
+          return;
+        }
+        const parsedLimit = route.options.limit ? parseInt(route.options.limit, 10) : 50;
+        const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 100) : 50;
+        try {
+          const payload = await social.listNotifications(account.id, {
+            limit,
+            before: route.options.before ?? null
+          });
+          logRequest(request, 200);
+          json(response, 200, payload);
+          return;
+        } catch (error) {
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-notification-read') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/notifications/:id/read.');
+          return;
+        }
+        try {
+          const notification = await social.markNotificationRead(account.id, route.options.notificationId);
+          if (!notification) {
+            notFound(response, 'Notification not found.');
+            return;
+          }
+          logRequest(request, 200);
+          json(response, 200, notification);
+          return;
+        } catch (error) {
+          if (error?.message === 'notificationId is required.') {
+            badRequest(response, error.message);
+            return;
+          }
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-notification-read-all') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/notifications/read-all.');
+          return;
+        }
+        try {
+          const result = await social.markAllNotificationsRead(account.id);
+          logRequest(request, 200);
+          json(response, 200, result);
+          return;
+        } catch (error) {
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
+      if (social && route.command === 'social-user-mute') {
+        if (request.method === 'POST') {
+          try {
+            const result = await social.muteUser(account.id, route.options.userId);
+            logRequest(request, 200);
+            json(response, 200, result);
+            return;
+          } catch (error) {
+            if (error?.message === 'Cannot moderate yourself.' || error?.message === 'Account not found.') {
+              const statusCode = error.message === 'Account not found.' ? 404 : 400;
+              json(response, statusCode, { error: error.message });
+              return;
+            }
+            internalError(response, error, onError);
+            return;
+          }
+        }
+        if (request.method === 'DELETE') {
+          try {
+            const result = await social.unmuteUser(account.id, route.options.userId);
+            logRequest(request, 200);
+            json(response, 200, result);
+            return;
+          } catch (error) {
+            internalError(response, error, onError);
+            return;
+          }
+        }
+        methodNotAllowed(response, 'Use POST or DELETE for /cli/social/users/:userId/mute.');
+        return;
+      }
+
+      if (social && route.command === 'social-user-block') {
+        if (request.method === 'POST') {
+          try {
+            const result = await social.blockUser(account.id, route.options.userId);
+            logRequest(request, 200);
+            json(response, 200, result);
+            return;
+          } catch (error) {
+            if (error?.message === 'Cannot moderate yourself.' || error?.message === 'Account not found.') {
+              const statusCode = error.message === 'Account not found.' ? 404 : 400;
+              json(response, statusCode, { error: error.message });
+              return;
+            }
+            internalError(response, error, onError);
+            return;
+          }
+        }
+        if (request.method === 'DELETE') {
+          try {
+            const result = await social.unblockUser(account.id, route.options.userId);
+            logRequest(request, 200);
+            json(response, 200, result);
+            return;
+          } catch (error) {
+            internalError(response, error, onError);
+            return;
+          }
+        }
+        methodNotAllowed(response, 'Use POST or DELETE for /cli/social/users/:userId/block.');
+        return;
+      }
+
+      if (social && route.command === 'social-report') {
+        if (request.method !== 'POST') {
+          methodNotAllowed(response, 'Use POST for /cli/social/report.');
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (!body?.targetType || !body?.targetId || !body?.reason) {
+            badRequest(response, 'targetType, targetId, and reason are required.');
+            return;
+          }
+          const validTypes = ['activity', 'comment', 'user'];
+          if (!validTypes.includes(body.targetType)) {
+            badRequest(response, `targetType must be one of: ${validTypes.join(', ')}.`);
+            return;
+          }
+          const validReasons = ['spam', 'harassment', 'inappropriate', 'other'];
+          if (!validReasons.includes(body.reason)) {
+            badRequest(response, `reason must be one of: ${validReasons.join(', ')}.`);
+            return;
+          }
+          const result = await social.createReport(account.id, {
+            targetType: body.targetType,
+            targetId: body.targetId,
+            reason: body.reason,
+            detail: body.detail ?? null
+          });
+          logRequest(request, 200);
+          json(response, 200, result);
+          return;
+        } catch (error) {
+          internalError(response, error, onError);
+          return;
+        }
+      }
+
       const result = executeReadCommand(snapshot, route.command, route.options);
       if (!result.ok) {
         if (result.error.startsWith('Session not found')) {