mango-cms 0.3.34 → 0.3.36

package/default/vite.config.js

@@ -25,9 +25,50 @@ const settingsPath = path.resolve(configPath, 'config/settings.json')
 
 const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'))
 
+/*
+ * Race-safe loader for the regenerated config (Vibe / HAP-1096, HAP-1203).
+ *
+ * `@collections` / `@endpoints` resolve to `mango/config/.collections.json` and
+ * `.endpoints.json`, which mango REWRITES on every rebuild. For a brief window
+ * during that rewrite the file is empty/truncated. The front imports them
+ * (`src/helpers/mango.js`) and the watch plugin below full-reloads on change —
+ * so a reload that lands mid-rewrite makes Vite's `vite:json` throw
+ * "Failed to parse JSON file ... position -1", breaking the module graph and
+ * blanking the app. This `enforce: 'pre'` loader intercepts those two ids before
+ * `vite:json`, caches the last good parse, and serves it whenever the file is
+ * transiently unreadable, so a mid-write read can never break the page. Once the
+ * file settles, the watch -> full-reload re-runs this loader and the fresh
+ * content is picked up. It returns RAW JSON text (not `export default …`) so
+ * vite's built-in `vite:json` transform still converts it to ESM normally —
+ * returning JS here causes a 500 (HAP-1203). Dev/serve only; prod serves a
+ * static `vite build` and is immune.
+ */
+function resilientConfigJson(targets) {
+	const lastGood = new Map() // absolute path -> last successfully parsed value
+	const fallback = (p) => (p === collectionsPath ? [] : {})
+	return {
+		name: 'vibe-resilient-config-json',
+		enforce: 'pre',
+		load(id) {
+			const clean = id.split('?')[0]
+			if (!targets.includes(clean)) return null
+			let value
+			try {
+				value = JSON.parse(fs.readFileSync(clean, 'utf8'))
+				lastGood.set(clean, value)
+			} catch (e) {
+				value = lastGood.has(clean) ? lastGood.get(clean) : fallback(clean)
+				this.warn(`[vibe] ${path.basename(clean)} mid-rewrite/unparseable; served ${lastGood.has(clean) ? 'last-good' : 'empty'} config (${e.message})`)
+			}
+			return JSON.stringify(value)
+		},
+	}
+}
+
 // https://vitejs.dev/config/
 export default defineConfig({
 	plugins: [
+		resilientConfigJson([collectionsPath, endpointsPath]),
 		vue(),
         // VitePWA({
         //     registerType: 'autoUpdate',
@@ -50,6 +91,11 @@ export default defineConfig({
 				server.watcher.add(endpointsPath)
 				server.watcher.on('change', (file) => {
 					if (file === collectionsPath || file === endpointsPath) {
+						// Only reload once the rewrite has SETTLED (file parses). The
+						// 'change' event also fires for the transient empty/truncated
+						// state mid-rewrite; reloading then would just bounce off the
+						// resilient loader's last-good and reload again. Skip those.
+						try { JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return }
 						server.ws.send({
 							type: 'full-reload',
 						})

package/lib/vibe-orchestrator/README.md

@@ -0,0 +1,76 @@
+# Vibe Orchestrator (bundled with Mango · HAP-1253)
+
+The **vibe-orchestrator** ships inside the `mango-cms` package so a Mango project
+can run it **straight from the installed dependency — no copied source**. It turns
+a ⌘K chat prompt into live edits on a branch worktree by driving **Claude Code
+headless** (no Anthropic API key), streams normalized progress back to the drawer
+over SSE, and verifies the owner token that Mango mints.
+
+It is dependency-free (`node:http` only), so it runs in-process from the Mango CLI.
+
+## Running it
+
+From a Mango project root (preferred — picks up `siteName` from `mango/config/settings.json`):
+
+```bash
+mango vibe-orchestrator                 # listens on 127.0.0.1:7130
+mango vibe-orchestrator --port 7130     # explicit port
+```
+
+Or directly from the installed package (e.g. under a process manager / nginx vhost):
+
+```bash
+node node_modules/mango-cms/lib/vibe-orchestrator/server.js
+```
+
+The orchestrator listens on **loopback only**; front it with the staging/site
+nginx vhost (or the Mango staging gateway) for browser access.
+
+## Environment contract
+
+| Var | Required | Default | Purpose |
+| --- | --- | --- | --- |
+| `VIBE_ORCH_TOKEN_SECRET` | **yes** | – | HMAC secret **shared with Mango**, which mints per-owner tokens from an authenticated admin session. **Unset ⇒ fails closed**: every gated endpoint returns `503`. |
+| `VIBE_STAGING_ROOT` | recommended | `/root/Staging` | Root dir under which each `<site>` is a clone the orchestrator edits. |
+| `VIBE_ALLOWED_SITES` | recommended | project `siteName` (via `mango vibe-orchestrator`), else `generations-vibe` | Comma-separated allow-list of site slugs. |
+| `CLAUDE_CODE_OAUTH_TOKEN` | one of these | – | Claude OAuth token. If unset, the orchestrator falls back to the Claude CLI's own login at… |
+| `VIBE_CLAUDE_CREDENTIALS` | – | `~/.claude/.credentials.json` | …this auto-refreshing credentials file. One of the two must be present for **live** runs (`/health` reports `canRunLive`). |
+| `VIBE_CLAUDE_BIN` | – | `claude` | Path to the `claude` CLI binary. Point at `scripts/fake-claude.mjs` for a token-free pipeline smoke test. |
+| `VIBE_ORCH_PORT` | – | `7130` | Loopback listen port (`--port` overrides). |
+| `VIBE_MODEL` | – | CLI default | Optional model override (e.g. `claude-opus-4-8`). |
+| `VIBE_TOKEN_CAP` | – | `2000000` | Per-session cumulative token safety cap (`0` = unlimited). |
+| `VIBE_PERMISSION_MODE` | – | `acceptEdits` | Headless permission mode (deliberately **not** `bypassPermissions`). |
+| `VIBE_ALLOWED_ORIGINS` | – | staging/prod site + `localhost:7121` | Browser origins allowed to call cross-origin (CORS). |
+| `VIBE_PUBLISH_*`, `VIBE_PATH_GUARD*`, `VIBE_AUTO_COMMIT`, `VIBE_COST_*`, `VIBE_SESSION_IDLE_MS` | – | see `src/config.js` | Publish, self-protection, cost-mirror and reaper tuning. |
+
+The owner token is HMAC-verified against `VIBE_ORCH_TOKEN_SECRET` — Mango mints it
+(`POST /endpoints/vibe/token`) and the orchestrator verifies it (`src/ownerToken.js`).
+Client-side role flags are never trusted; the Claude credentials are never exposed
+by any endpoint.
+
+## Endpoints
+
+`GET /health` (public liveness, leaks no config) · `GET /health/details` ·
+`GET /sessions` · `POST /prompt` (SSE) · `POST /abort` · `POST /reset` ·
+`GET /publish/diff` · `POST /publish` · `GET /costs` · `GET /costs/rollup` ·
+`GET /recovery/status` · `POST /recovery/revert-last` · `POST /recovery/reset-baseline`.
+
+Every route except `GET /health` requires `Authorization: Bearer <owner-token>`.
+
+## Smoke test (no Claude token)
+
+```bash
+VIBE_ORCH_TOKEN_SECRET=dev-secret \
+VIBE_STAGING_ROOT=/path/to/clones VIBE_ALLOWED_SITES=mysite \
+VIBE_CLAUDE_BIN="$PWD/node_modules/mango-cms/lib/vibe-orchestrator/scripts/fake-claude.mjs" \
+CLAUDE_CODE_OAUTH_TOKEN=dummy \
+mango vibe-orchestrator --port 7130
+# then POST /prompt with a minted bearer token and watch accepted → progress* → end
+```
+
+## Source of truth
+
+The runtime here (`server.js`, `src/`, `scripts/`) is the distributed copy. The
+canonical development tree (with the full test suite) lives in the
+`generations-vibe` repo under `orchestrator/`; this bundle is kept byte-identical
+on release. See `docs/RELEASING.md`.

package/lib/vibe-orchestrator/scripts/fake-claude.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+// fake-claude.mjs
+//
+// A stand-in for the real `claude` binary that emits a realistic stream-json
+// sequence. Use it to validate the orchestrator's spawn → parse → SSE pipeline
+// end-to-end WITHOUT a Claude OAuth token (so the live-token dependency does not
+// block integration testing):
+//
+//   VIBE_CLAUDE_BIN="$PWD/scripts/fake-claude.mjs" \
+//   CLAUDE_CODE_OAUTH_TOKEN=dummy node server.js
+//
+// then POST /prompt and watch the SSE events stream back.
+
+const args = process.argv.slice(2)
+const pIdx = args.indexOf('-p')
+const prompt = pIdx >= 0 ? args[pIdx + 1] : '(no prompt)'
+const resumeIdx = args.indexOf('--resume')
+const sessionId = resumeIdx >= 0 ? args[resumeIdx + 1] : 'fake-sess-0001'
+
+const lines = [
+  { type: 'system', subtype: 'init', session_id: sessionId, model: 'fake-model', tools: ['Read', 'Edit', 'Bash'], cwd: process.cwd() },
+  { type: 'assistant', message: { content: [{ type: 'text', text: `Working on: ${prompt}` }], usage: { input_tokens: 1200, output_tokens: 40 } } },
+  { type: 'assistant', message: { content: [{ type: 'tool_use', id: 'tu1', name: 'Edit', input: { file_path: 'src/App.vue' } }], usage: { input_tokens: 1300, output_tokens: 90 } } },
+  { type: 'user', message: { content: [{ type: 'tool_result', tool_use_id: 'tu1', is_error: false, content: 'edited' }] } },
+  { type: 'assistant', message: { content: [{ type: 'text', text: 'Done. The hero heading is now blue.' }], usage: { input_tokens: 1400, output_tokens: 130 } } },
+  { type: 'result', subtype: 'success', session_id: sessionId, total_cost_usd: 0.018, duration_ms: 5200, num_turns: 3, usage: { input_tokens: 1400, output_tokens: 130 }, result: 'Done. The hero heading is now blue.' },
+]
+
+let i = 0
+const tick = () => {
+  if (i >= lines.length) return process.exit(0)
+  process.stdout.write(JSON.stringify(lines[i++]) + '\n')
+  setTimeout(tick, 250)
+}
+tick()

package/lib/vibe-orchestrator/scripts/path-guard-hook.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+// path-guard-hook.mjs
+//
+// PreToolUse hook (HAP-1124, protection #1). Wired into every headless claude
+// run via `--settings` (see claudeRunner.js) so it is enforced SERVER-SIDE,
+// independent of the prompt. Claude invokes this before each Edit/Write/
+// MultiEdit/NotebookEdit with a JSON payload on stdin:
+//
+//   { cwd, tool_name, tool_input: { file_path | notebook_path, ... } }
+//
+// We resolve the target to a repo-root-relative path and, if it hits the
+// protected denylist (or escapes the staging clone), block the tool by exiting
+// with code 2 — the documented PreToolUse "deny" signal: the tool call is
+// stopped and stderr is fed back to Claude as the reason, which it relays to the
+// owner in the drawer. Anything else exits 0 (allow). The hook is fail-safe:
+// any internal error allows the edit rather than wedging the agent, because the
+// post-run git auto-commit + rollback (protection #2) is the backstop.
+
+import path from 'node:path'
+import { isProtectedPath, PROTECTED_MESSAGE } from '../src/pathGuard.js'
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = ''
+    process.stdin.setEncoding('utf8')
+    process.stdin.on('data', (c) => { raw += c })
+    process.stdin.on('end', () => resolve(raw))
+    process.stdin.on('error', () => resolve(raw))
+  })
+}
+
+/** Collect every filesystem path a tool_input may target. */
+function targetPaths(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return []
+  const out = []
+  for (const key of ['file_path', 'notebook_path', 'path']) {
+    if (typeof toolInput[key] === 'string' && toolInput[key]) out.push(toolInput[key])
+  }
+  return out
+}
+
+/** Map an absolute-or-relative tool path to a clone-root-relative POSIX path. */
+function toRel(cwd, p) {
+  const abs = path.isAbsolute(p) ? p : path.resolve(cwd || process.cwd(), p)
+  return path.relative(cwd || process.cwd(), abs)
+}
+
+async function main() {
+  let payload = {}
+  try { payload = JSON.parse((await readStdin()) || '{}') } catch { payload = {} }
+
+  const cwd = payload.cwd || process.cwd()
+  const toolInput = payload.tool_input || payload.toolInput || {}
+
+  for (const raw of targetPaths(toolInput)) {
+    const rel = toRel(cwd, raw)
+    // An edit that resolves outside the staging clone is never legitimate.
+    const escapes = rel.startsWith('..') || path.isAbsolute(rel)
+    if (escapes || isProtectedPath(rel)) {
+      process.stderr.write(
+        `${PROTECTED_MESSAGE} (${escapes ? 'outside the staging clone' : rel})`,
+      )
+      process.exit(2) // PreToolUse: block the tool, reason → Claude
+    }
+  }
+
+  process.exit(0) // allow
+}
+
+main().catch(() => process.exit(0)) // fail-open: rollback is the backstop

package/lib/vibe-orchestrator/scripts/vibe-recover.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# vibe-recover.sh — one-command rollback for the Vibe staging clone (HAP-1124).
+#
+# A recovery path usable WITHOUT an engineer. Operates directly on the staging
+# clone's git, so it works even if the orchestrator process is down.
+#
+#   vibe-recover.sh status            # show baseline + recent vibe edits
+#   vibe-recover.sh revert-last       # undo the most recent vibe edit (git revert)
+#   vibe-recover.sh reset-baseline    # hard-reset to the known-good baseline
+#
+# Env (override as needed):
+#   VIBE_STAGING_ROOT  (default /root/Staging)
+#   VIBE_SITE          (default generations-vibe)
+#   VIBE_BASELINE_TAG  (default vibe-baseline)
+set -euo pipefail
+
+ROOT="${VIBE_STAGING_ROOT:-/root/Staging}"
+SITE="${VIBE_SITE:-generations-vibe}"
+TAG="${VIBE_BASELINE_TAG:-vibe-baseline}"
+SETTINGS="mango/config/settings.json"
+DIR="$ROOT/$SITE"
+CMD="${1:-status}"
+
+cd "$DIR" || { echo "staging clone not found: $DIR" >&2; exit 1; }
+
+case "$CMD" in
+  status)
+    echo "site:     $SITE ($DIR)"
+    echo "HEAD:     $(git rev-parse --short HEAD 2>/dev/null || echo '(none)')"
+    if git rev-parse --verify --quiet "${TAG}^{commit}" >/dev/null; then
+      echo "baseline: $TAG -> $(git rev-parse --short "$TAG")"
+    else
+      echo "baseline: (none yet — created on first vibe edit)"
+    fi
+    echo "recent vibe edits:"
+    git log -n 10 --pretty=format:'  %h  %cs  %s' | grep -E '  vibe:' || echo "  (none)"
+    echo
+    ;;
+
+  revert-last)
+    last_msg="$(git log -1 --pretty=format:'%s')"
+    case "$last_msg" in
+      vibe:*) ;;
+      *) echo "the most recent commit is not a vibe edit — nothing to revert" >&2; exit 1 ;;
+    esac
+    git revert --no-edit HEAD
+    echo "reverted last vibe edit; HEAD is now $(git rev-parse --short HEAD)"
+    ;;
+
+  reset-baseline)
+    if ! git rev-parse --verify --quiet "${TAG}^{commit}" >/dev/null; then
+      echo "no baseline tag ($TAG) to reset to" >&2; exit 1
+    fi
+    git reset --hard "$TAG"
+    git clean -fd -e "$SETTINGS"
+    echo "reset clone to baseline $TAG ($(git rev-parse --short "$TAG"))"
+    ;;
+
+  *)
+    echo "usage: vibe-recover.sh {status|revert-last|reset-baseline}" >&2
+    exit 2
+    ;;
+esac

package/lib/vibe-orchestrator/server.js

@@ -0,0 +1,344 @@
+// server.js
+//
+// Orchestrator HTTP entrypoint. Dependency-free (node:http). Exposes:
+//
+//   GET  /health           -> { ok, canRunLive, config summary }
+//   GET  /sessions         -> [ { site, sessionId, cumulativeTokens, status } ]
+//   POST /prompt           -> SSE stream of progress events  body: { site, prompt, pageContext?, attachments? }
+//   POST /abort            -> { ok }                          body: { site }
+//   POST /reset            -> { ok }                          body: { site }
+//   POST /publish          -> { ... }                         body: { site, confirm }
+//
+// Owner auth (HAP-1109): every endpoint except `GET /health` requires a real
+// per-owner token in `Authorization: Bearer <token>`. The token is minted by
+// Mango from an authenticated admin session and verified here against the shared
+// VIBE_ORCH_TOKEN_SECRET (see src/ownerToken.js). Without that secret the server
+// fails CLOSED — gated endpoints return 503, never open access. Client-side role
+// flags are never trusted. The Claude OAuth token is never exposed by any
+// endpoint. Intended to listen on localhost only and be fronted by the staging
+// nginx vhost (see README).
+
+import http from 'node:http'
+import { SessionManager } from './src/sessionManager.js'
+import { config, canRunLive } from './src/config.js'
+import { verifyOwnerToken } from './src/ownerToken.js'
+import * as publisher from './src/publisher.js'
+import * as recovery from './src/recovery.js'
+import { readCosts, rollup } from './src/costStore.js'
+
+const manager = new SessionManager()
+
+/** Extract the bearer token from the Authorization header. */
+function bearer(req) {
+  const h = req.headers['authorization'] || ''
+  const m = /^Bearer\s+(.+)$/i.exec(h.trim())
+  return m ? m[1].trim() : ''
+}
+
+/**
+ * Resolve owner auth for a request. Returns the verifyOwnerToken result:
+ * { ok:true, payload } or { ok:false, reason, status }. Fails closed when no
+ * token secret is configured (status 503).
+ */
+function requireOwner(req) {
+  return verifyOwnerToken(bearer(req), {
+    secret: config.tokenSecret,
+    ownerRoles: config.ownerRoles,
+  })
+}
+
+function sendJson(res, status, body) {
+  const data = JSON.stringify(body)
+  res.writeHead(status, { 'content-type': 'application/json' })
+  res.end(data)
+}
+
+/**
+ * Apply CORS headers for an allowed browser origin (HAP-1121). The ⌘K drawer is
+ * served from the site origin (e.g. https://staging-vibe.generations.org) and
+ * calls this orchestrator on the -api origin cross-origin. Without an allow-list
+ * + preflight handling the browser blocks every call and the drawer shows
+ * "Failed to fetch" (a transport failure with no HTTP status). Headers are set
+ * with setHeader so they merge into later writeHead() calls (JSON + SSE alike).
+ * Returns true when the request Origin is allowed.
+ */
+function applyCors(req, res) {
+  const origin = req.headers['origin']
+  if (!origin) return false
+  const list = config.allowedOrigins
+  const allowed = list.length === 0 || list.includes(origin)
+  if (!allowed) return false
+  res.setHeader('Access-Control-Allow-Origin', origin)
+  res.setHeader('Vary', 'Origin')
+  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
+  res.setHeader('Access-Control-Allow-Headers', 'authorization, content-type')
+  res.setHeader('Access-Control-Max-Age', '86400')
+  return true
+}
+
+/**
+ * Resolve a { from, to } ms window from query params (HAP-1123). Each of `from`
+ * and `to` may be epoch-ms or an ISO date (YYYY-MM-DD). With neither present we
+ * default to the current calendar month-to-date so a bare `/costs/rollup` answers
+ * "this month's spend". An ISO date with no time is treated as UTC midnight.
+ */
+function parseRange(params) {
+  const parse = (v) => {
+    if (!v) return undefined
+    if (/^\d+$/.test(v)) return Number.parseInt(v, 10)
+    const t = Date.parse(v)
+    return Number.isNaN(t) ? undefined : t
+  }
+  let from = parse(params.get('from'))
+  let to = parse(params.get('to'))
+  if (from === undefined && to === undefined) {
+    const now = new Date()
+    from = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1)
+  }
+  return { from, to }
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let raw = ''
+    req.on('data', (c) => {
+      raw += c
+      // 80MB ceiling: prompt bodies may carry a base64 viewport screenshot
+      // (HAP-1111) plus up to 5 user attachments of ≤10MB each (HAP-1126). The
+      // per-file size/mime/count guard runs again server-side in attachments.js;
+      // this is just the gross transport cap.
+      if (raw.length > 80_000_000) reject(new Error('body too large'))
+    })
+    req.on('end', () => {
+      if (!raw) return resolve({})
+      try { resolve(JSON.parse(raw)) } catch { reject(new Error('invalid JSON body')) }
+    })
+    req.on('error', reject)
+  })
+}
+
+function startSse(res, { onPing } = {}) {
+  res.writeHead(200, {
+    'content-type': 'text/event-stream',
+    'cache-control': 'no-cache',
+    connection: 'keep-alive',
+    'x-accel-buffering': 'no', // disable nginx proxy buffering
+  })
+  const write = (event, data) => {
+    res.write(`event: ${event}\n`)
+    res.write(`data: ${JSON.stringify(data)}\n\n`)
+  }
+  // keepalive comment ping so idle proxies don't drop the connection. The ping
+  // also counts as session activity (HAP-1110) so an actively-read but idle
+  // session is kept warm rather than reaped mid-read.
+  const ping = setInterval(() => {
+    res.write(': ping\n\n')
+    onPing?.()
+  }, 15000)
+  if (ping.unref) ping.unref()
+  return { write, close: () => clearInterval(ping) }
+}
+
+async function handlePrompt(req, res) {
+  let body
+  try { body = await readBody(req) } catch (e) { return sendJson(res, 400, { error: e.message }) }
+  const { site, prompt, pageContext, attachments } = body
+
+  let handle
+  try {
+    handle = manager.submit(site, prompt, { pageContext, attachments })
+  } catch (e) {
+    return sendJson(res, 400, { error: e.message })
+  }
+
+  // Track this connection as an active reader and keep the session warm on ping.
+  manager.addReader(site)
+  const sse = startSse(res, { onPing: () => manager.touch(site) })
+  sse.write('accepted', { site })
+
+  handle.emitter.on('event', (ev) => sse.write('progress', ev))
+  handle.emitter.on('error', (err) => sse.write('error', { message: err.message }))
+  handle.emitter.on('end', (summary) => {
+    sse.write('end', summary)
+    sse.close()
+    manager.removeReader(site)
+    res.end()
+  })
+
+  // If the client disconnects, abort the run to free the slot.
+  req.on('close', () => {
+    if (!res.writableEnded) {
+      handle.abort()
+      manager.removeReader(site)
+    }
+    sse.close()
+  })
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url, 'http://localhost')
+  const route = `${req.method} ${url.pathname}`
+
+  // CORS (HAP-1121): set allow-origin headers for an allowed browser origin and
+  // answer the preflight BEFORE the auth gate. Browsers never send the
+  // Authorization header on an OPTIONS preflight, so gating it on auth returned
+  // 401 and the whole cross-origin call failed in-browser as "Failed to fetch".
+  applyCors(req, res)
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204)
+    return res.end()
+  }
+
+  // `GET /health` is the only unauthenticated route: a minimal liveness probe
+  // for ops/nginx that leaks no config. Everything else requires an owner token.
+  if (route === 'GET /health') {
+    return sendJson(res, 200, { ok: true, ownerAuth: !!config.tokenSecret })
+  }
+
+  // Real per-owner gate. 401 = no/invalid token, 403 = valid but not an owner,
+  // 503 = server not configured for owner auth (fails closed).
+  const auth = requireOwner(req)
+  if (!auth.ok) return sendJson(res, auth.status || 401, { error: auth.reason || 'unauthorized' })
+  req.owner = auth.payload
+
+  try {
+    switch (route) {
+      case 'GET /health/details':
+        return sendJson(res, 200, {
+          ok: true,
+          canRunLive: canRunLive(),
+          stagingRoot: config.stagingRoot,
+          allowedSites: config.allowedSites,
+          tokenCap: config.tokenCap,
+          permissionMode: config.permissionMode,
+          publishEnabled: config.publishEnabled,
+          publishRemote: config.publishRemote,
+          settingsPath: config.settingsPath,
+        })
+
+      case 'GET /sessions':
+        return sendJson(res, 200, { sessions: manager.list() })
+
+      // ---- Cost tracking (HAP-1123) ----
+      // GET /costs         — raw per-turn records in a window (for export/audit)
+      // GET /costs/rollup  — summed totals (by day/session/model) to invoice from
+      // Both default to the current calendar month when no range is given, and
+      // accept ?from / ?to as epoch-ms or YYYY-MM-DD, plus an optional ?site.
+      case 'GET /costs': {
+        const range = parseRange(url.searchParams)
+        const site = url.searchParams.get('site') || undefined
+        return sendJson(res, 200, { ...range, site: site || null, records: readCosts({ ...range, site }) })
+      }
+
+      case 'GET /costs/rollup': {
+        const range = parseRange(url.searchParams)
+        const site = url.searchParams.get('site') || undefined
+        return sendJson(res, 200, rollup({ ...range, site }))
+      }
+
+      case 'POST /prompt':
+        return await handlePrompt(req, res)
+
+      case 'GET /publish/diff': {
+        const site = url.searchParams.get('site') || config.allowedSites[0]
+        try {
+          const d = await publisher.diff(site)
+          return sendJson(res, 200, d)
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /publish': {
+        let body
+        try { body = await readBody(req) } catch (e) { return sendJson(res, 400, { error: e.message }) }
+        const { site, message, confirm } = body
+        try {
+          const result = await publisher.publish(site || config.allowedSites[0], { message, confirm })
+          return sendJson(res, 200, result)
+        } catch (e) {
+          // 409 ⇒ merge conflict publishing the branch into the deploy branch;
+          // surface the conflicting files so the owner can resolve them.
+          return sendJson(res, e.statusCode || 500, {
+            error: e.message,
+            steps: e.steps,
+            conflicts: e.conflicts,
+            deployBranch: e.deployBranch,
+          })
+        }
+      }
+
+      // ---- Recovery / rollback (HAP-1124) ----
+      // GET  /recovery/status        — baseline + recent vibe commits + what's available
+      // POST /recovery/revert-last   — undo the most recent vibe edit (git revert)
+      // POST /recovery/reset-baseline— hard-reset to the known-good baseline (confirm:true)
+      // A recovery path usable without an engineer; also wrapped by scripts/vibe-recover.sh.
+      case 'GET /recovery/status': {
+        const site = url.searchParams.get('site') || config.allowedSites[0]
+        try {
+          return sendJson(res, 200, await recovery.status(site))
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /recovery/revert-last': {
+        const { site } = await readBody(req)
+        const target = site || config.allowedSites[0]
+        if (manager.get(target)?.status === 'running') {
+          return sendJson(res, 409, { error: 'cannot recover while a run is in progress' })
+        }
+        try {
+          return sendJson(res, 200, await recovery.revertLast(target))
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /recovery/reset-baseline': {
+        const { site, confirm } = await readBody(req)
+        const target = site || config.allowedSites[0]
+        if (confirm !== true) {
+          return sendJson(res, 400, { error: 'reset to baseline requires explicit confirm:true' })
+        }
+        if (manager.get(target)?.status === 'running') {
+          return sendJson(res, 409, { error: 'cannot recover while a run is in progress' })
+        }
+        try {
+          return sendJson(res, 200, await recovery.resetToBaseline(target))
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /abort': {
+        const { site } = await readBody(req)
+        manager.abort(site)
+        return sendJson(res, 200, { ok: true })
+      }
+
+      case 'POST /reset': {
+        const { site } = await readBody(req)
+        try { manager.reset(site) } catch (e) { return sendJson(res, 409, { error: e.message }) }
+        return sendJson(res, 200, { ok: true })
+      }
+
+      default:
+        return sendJson(res, 404, { error: 'not found' })
+    }
+  } catch (e) {
+    if (!res.headersSent) sendJson(res, 500, { error: e.message })
+  }
+})
+
+// Listen on loopback only; nginx terminates TLS and proxies.
+server.listen(config.port, '127.0.0.1', () => {
+  // eslint-disable-next-line no-console
+  console.log(`[vibe-orchestrator] listening on 127.0.0.1:${config.port} (live=${canRunLive()}, ownerAuth=${!!config.tokenSecret})`)
+  if (!config.tokenSecret) {
+    // eslint-disable-next-line no-console
+    console.warn('[vibe-orchestrator] WARNING: VIBE_ORCH_TOKEN_SECRET is unset — owner auth is NOT configured; all gated endpoints will return 503 (fail closed).')
+  }
+})
+
+export { server }