memor-code-cli 0.2.0

package/dist/server.js

@@ -0,0 +1,956 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startAppServer = startAppServer;
+const http = __importStar(require("http"));
+const path = __importStar(require("path"));
+const url = __importStar(require("url"));
+const fs = __importStar(require("fs"));
+const child_process_1 = require("child_process");
+const buildFileXRay_1 = require("./analysis/buildFileXRay");
+const llmXRay_1 = require("./analysis/llmXRay");
+const buildDetailedFileXRay_1 = require("./analysis/buildDetailedFileXRay");
+const repoWatcher_1 = require("./watcher/repoWatcher");
+const generateAMForRepo_1 = require("./amGeneration/generateAMForRepo");
+const enrichAMEdges_1 = require("./amGeneration/enrichAMEdges");
+const selectStrategicFiles_1 = require("./amGeneration/selectStrategicFiles");
+const generateFileInsight_1 = require("./analysis/generateFileInsight");
+const extractRouteMap_1 = require("./analysis/extractRouteMap");
+const generateFlows_1 = require("./amGeneration/generateFlows");
+const buildFlowGraph_1 = require("./amGeneration/buildFlowGraph");
+const buildBranchStory_1 = require("./analysis/buildBranchStory");
+// If path is a directory, resolve to its index file so X-Ray doesn't fail on folders.
+function resolveFilePath(absPath) {
+    try {
+        if (fs.statSync(absPath).isDirectory()) {
+            for (const candidate of ["index.ts", "index.tsx", "index.js", "index.mjs"]) {
+                const resolved = path.join(absPath, candidate);
+                if (fs.existsSync(resolved))
+                    return resolved;
+            }
+        }
+    }
+    catch { /* path doesn't exist — let downstream handle it */ }
+    return absPath;
+}
+// Runtime API key — loaded from ~/.memor/config.json on start, updated via /api/set-key
+let runtimeApiKey;
+// No bundled key — AI calls go through api.memor.dev when the user has no personal key.
+const CONFIG_PATH = path.join(process.env.HOME ?? process.env.USERPROFILE ?? ".", ".memor", "config.json");
+function loadSavedKey() {
+    try {
+        const cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
+        if (typeof cfg.apiKey === "string" && cfg.apiKey.length > 10) {
+            runtimeApiKey = cfg.apiKey;
+        }
+    }
+    catch { /* no config yet — fine */ }
+}
+function saveKey(key) {
+    try {
+        const dir = path.dirname(CONFIG_PATH);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        const existing = (() => {
+            try {
+                return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
+            }
+            catch {
+                return {};
+            }
+        })();
+        fs.writeFileSync(CONFIG_PATH, JSON.stringify({ ...existing, apiKey: key }, null, 2), "utf8");
+    }
+    catch { /* ignore write errors */ }
+}
+loadSavedKey();
+function getApiKey() {
+    return runtimeApiKey || process.env.ANTHROPIC_API_KEY || "memor-proxy";
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (c) => chunks.push(c));
+        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        req.on("error", reject);
+    });
+}
+function startAppServer(html, port, onReady, repoRoot) {
+    const server = http.createServer((req, res) => {
+        if (req.url === "/favicon.ico") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        // ── /app-bundle.js — serve frontend bundle fresh from disk ───────────
+        if (req.url === "/app-bundle.js") {
+            res.setHeader("Cache-Control", "no-store");
+            res.setHeader("Content-Type", "application/javascript; charset=utf-8");
+            const candidates = [
+                path.join(__dirname, "app-bundle.js"),
+                path.join(__dirname, "..", "dist", "app-bundle.js"),
+            ];
+            for (const p of candidates) {
+                try {
+                    res.writeHead(200);
+                    res.end(fs.readFileSync(p, "utf-8"));
+                    return;
+                }
+                catch { }
+            }
+            res.writeHead(404);
+            res.end("// bundle not found");
+            return;
+        }
+        // ── /api/am — serve current architecture-map.json ────────────
+        if (req.url === "/api/am") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            (async () => {
+                const amPath = path.join(repoRoot, ".memor", "architecture-map.json");
+                try {
+                    const am = JSON.parse(fs.readFileSync(amPath, "utf8"));
+                    // Attach evidence files to flows deterministically
+                    if (am.flows?.length > 0) {
+                        try {
+                            const routeMap = (0, extractRouteMap_1.extractRouteMap)(repoRoot);
+                            am.flows = (0, generateFlows_1.attachEvidenceFiles)(am.flows, routeMap, repoRoot);
+                        }
+                        catch { /* non-fatal */ }
+                    }
+                    // Strip key_files that don't exist on disk (LLM often hallucinates file paths)
+                    if (am.systems?.length > 0) {
+                        for (const sys of am.systems) {
+                            if (Array.isArray(sys.key_files)) {
+                                sys.key_files = sys.key_files.filter((f) => fs.existsSync(path.join(repoRoot, f)));
+                            }
+                        }
+                    }
+                    // Enrich missing edges deterministically from key_file imports
+                    try {
+                        const manifests = await (0, selectStrategicFiles_1.readWorkspaceManifests)(repoRoot);
+                        const enriched = (0, enrichAMEdges_1.enrichAMEdges)(am, repoRoot, manifests);
+                        res.writeHead(200);
+                        res.end(JSON.stringify(enriched));
+                    }
+                    catch {
+                        res.writeHead(200);
+                        res.end(JSON.stringify(am));
+                    }
+                }
+                catch {
+                    res.writeHead(404);
+                    res.end(JSON.stringify({ error: "No architecture map generated yet" }));
+                }
+            })();
+            return;
+        }
+        // ── /api/branch-story — git diff → spatial change graph ─────────────────
+        if (req.url?.startsWith("/api/branch-story")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const base = parsed.query.base || "main"; // Target: what to diff against
+            const source = parsed.query.source || "working"; // Source: working tree or a branch
+            // Two-phase: ?enrich=1 runs the LLM comprehension layer (role/change/threads).
+            // Without it, the story is purely deterministic and returns at git-status speed.
+            const enrich = parsed.query.enrich === "1";
+            const apiKey = enrich ? getApiKey() : undefined;
+            let am = null;
+            try {
+                am = JSON.parse(fs.readFileSync(path.join(repoRoot, ".memor", "architecture-map.json"), "utf8"));
+            }
+            catch { }
+            (0, buildBranchStory_1.buildBranchStoryForSource)(repoRoot, base, apiKey, am, source)
+                .then(story => { res.writeHead(200); res.end(JSON.stringify(story)); })
+                .catch(e => { res.writeHead(500); res.end(JSON.stringify({ error: String(e) })); });
+            return;
+        }
+        // ── /api/fetch — pull the latest remote refs so peer PR branches are current ──
+        if (req.url === "/api/fetch" && req.method === "POST") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            try {
+                // Read-only network op (updates remote-tracking refs; never touches the working tree).
+                (0, child_process_1.execSync)(`git -C "${repoRoot}" fetch origin --prune`, { stdio: ["pipe", "pipe", "pipe"], timeout: 30000 });
+                res.writeHead(200);
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (e) {
+                res.writeHead(200);
+                res.end(JSON.stringify({ ok: false, error: String(e).slice(0, 200) }));
+            }
+            return;
+        }
+        // ── /api/branches — list local + remote branches for the Source/Target selectors ──
+        if (req.url?.startsWith("/api/branches")) {
+            const wantCounts = url.parse(req.url, true).query.counts === "1";
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            try {
+                const current = (() => {
+                    try {
+                        return (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-parse --abbrev-ref HEAD`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+                    }
+                    catch {
+                        return "";
+                    }
+                })();
+                // The default branch we judge "merged" against (main, else master).
+                const defaultBranch = (() => {
+                    for (const c of ["main", "master"]) {
+                        try {
+                            (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-parse --verify ${c}`, { stdio: "pipe" });
+                            return c;
+                        }
+                        catch { }
+                    }
+                    return current || "main";
+                })();
+                // Branches with commits NOT in the default branch (ahead > 0) — the live/open ones.
+                // `--no-merged` is a single reachability check (fast, no per-branch loop).
+                const notMerged = new Set();
+                for (const flag of ["", "-r"]) {
+                    try {
+                        const out = (0, child_process_1.execSync)(`git -C "${repoRoot}" branch ${flag} --no-merged ${defaultBranch} --format="%(refname:short)"`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], maxBuffer: 2_000_000 }).trim();
+                        for (const n of out.split("\n").filter(Boolean))
+                            notMerged.add(n.replace(/^origin\//, "").trim());
+                    }
+                    catch { }
+                }
+                // name + committer date (epoch) for local and remote branches, newest first
+                const raw = (0, child_process_1.execSync)(`git -C "${repoRoot}" for-each-ref --sort=-committerdate --format="%(refname:short)|%(committerdate:unix)" refs/heads refs/remotes`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], maxBuffer: 2_000_000 }).trim();
+                const seen = new Set();
+                const branches = raw.split("\n").filter(Boolean).map(l => {
+                    const [name, ts] = l.split("|");
+                    const shortName = name.replace(/^origin\//, "");
+                    // The default branch is the comparison base — never a valid Source. Force merged=true
+                    // so it's hidden from Source (a stale local main can otherwise read as "not merged").
+                    const merged = shortName === defaultBranch ? true : !notMerged.has(shortName);
+                    return { name: shortName, raw: name, lastCommit: Number(ts) || 0, isCurrent: name === current, merged };
+                }).filter(b => {
+                    if (b.raw.endsWith("/HEAD"))
+                        return false; // skip origin/HEAD symref
+                    if (b.name === "origin" || b.name === "HEAD")
+                        return false; // phantom remote noise
+                    if (seen.has(b.name))
+                        return false; // dedupe local/remote of same name
+                    seen.add(b.name);
+                    return true;
+                });
+                // Optional: ahead-count vs the default branch, for the open (non-merged) branches only
+                // — used by the "Review a Pull Request" modal. Computed on demand (?counts=1) to keep
+                // the regular mount fast.
+                let out = branches;
+                if (wantCounts) {
+                    // Count ahead vs the REMOTE default (origin/main) to match the actual review baseline,
+                    // not a possibly-stale local main.
+                    const tgt = (() => {
+                        try {
+                            (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-parse --verify origin/${defaultBranch}`, { stdio: "pipe" });
+                            return `origin/${defaultBranch}`;
+                        }
+                        catch {
+                            return defaultBranch;
+                        }
+                    })();
+                    out = branches.map(b => {
+                        if (b.merged)
+                            return b;
+                        try {
+                            const n = (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-list --count ${tgt}..${b.raw}`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+                            return { ...b, ahead: parseInt(n, 10) || 0 };
+                        }
+                        catch {
+                            return b;
+                        }
+                    });
+                }
+                // When the remote refs were last fetched (FETCH_HEAD mtime) — drives "fetched Xm ago".
+                const fetchedAt = (() => {
+                    try {
+                        return Math.floor(fs.statSync(path.join(repoRoot, ".git", "FETCH_HEAD")).mtimeMs);
+                    }
+                    catch {
+                        return null;
+                    }
+                })();
+                res.writeHead(200);
+                res.end(JSON.stringify({ current, defaultBranch, fetchedAt, branches: out }));
+            }
+            catch (e) {
+                res.writeHead(200);
+                res.end(JSON.stringify({ current: "", branches: [] }));
+            }
+            return;
+        }
+        // ── /api/commit-log — commits between base..HEAD with per-commit file lists ─
+        if (req.url?.startsWith("/api/commit-log")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const base = parsed.query.base || "main";
+            try {
+                // Single pass: pretty header lines interleaved with name-status file lines
+                const raw = (0, child_process_1.execSync)(`git -C "${repoRoot}" log ${base}..HEAD --pretty=format:">>C<<%H<<%s<<%an<<%ai" --name-status`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+                const commits = [];
+                if (raw) {
+                    let current = null;
+                    for (const line of raw.split("\n")) {
+                        if (line.startsWith(">>C<<")) {
+                            if (current)
+                                commits.push(current);
+                            const [, sha, message, author, date] = line.split("<<");
+                            current = { sha, shortSha: sha.slice(0, 7), message: message ?? "", author: author ?? "", date: date ?? "", files: [] };
+                        }
+                        else if (current && line.trim()) {
+                            const parts = line.split("\t");
+                            const s = parts[0]?.[0];
+                            const filePath = parts[parts.length - 1];
+                            if (filePath && s) {
+                                const status = s === "A" ? "added" : s === "D" ? "deleted" : "modified";
+                                current.files.push({ path: filePath, status });
+                            }
+                        }
+                    }
+                    if (current)
+                        commits.push(current);
+                }
+                res.writeHead(200);
+                res.end(JSON.stringify({ commits }));
+            }
+            catch {
+                res.writeHead(200);
+                res.end(JSON.stringify({ commits: [] }));
+            }
+            return;
+        }
+        // ── /api/branch-diff — raw git diff for a single file ────────────────────
+        if (req.url?.startsWith("/api/branch-diff")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const file = parsed.query.file || "";
+            const rawBase = parsed.query.base || "main";
+            const source = parsed.query.source || "working";
+            const isWorking = !source || source === "working";
+            // Prefer origin/<base> over a stale local target (match the branch-story baseline).
+            const base = (() => {
+                if (/^(HEAD|origin\/)/.test(rawBase) || /[~^]/.test(rawBase) || /^[0-9a-f]{7,40}$/.test(rawBase))
+                    return rawBase;
+                for (const c of [`origin/${rawBase}`, rawBase]) {
+                    try {
+                        (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-parse --verify ${c}`, { stdio: "pipe" });
+                        return c;
+                    }
+                    catch { }
+                }
+                return rawBase;
+            })();
+            // Resolve source to a concrete ref. Prefer origin/<branch> over the local branch —
+            // the local copy may be stale (force-pushed, rebased) and produce a different diff
+            // than what the brief was computed from. Matching the brief's baseline is critical
+            // so that chunk indices align and inference points show the right diff slice.
+            const srcRef = isWorking ? "" : (() => {
+                for (const c of [`origin/${source}`, source]) {
+                    try {
+                        (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-parse --verify ${c}`, { stdio: "pipe" });
+                        return c;
+                    }
+                    catch { }
+                }
+                return source;
+            })();
+            // Match the changeset baseline: diff against the merge-base of Target and Source.
+            let diffBase = base;
+            try {
+                const otherRef = isWorking ? "HEAD" : srcRef;
+                diffBase = (0, child_process_1.execSync)(`git -C "${repoRoot}" merge-base ${base} ${otherRef}`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim() || base;
+            }
+            catch {
+                diffBase = (0, buildBranchStory_1.resolveMergeBase)(repoRoot, base) ?? base;
+            }
+            const diff = (0, buildBranchStory_1.getFileDiffRaw)(repoRoot, file, diffBase, srcRef);
+            res.writeHead(200);
+            res.end(JSON.stringify({ diff }));
+            return;
+        }
+        // ── /api/default-branch — detect the repo's default branch ─────────────
+        if (req.url === "/api/default-branch") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            let defaultBranch = "main";
+            if (repoRoot) {
+                try {
+                    // Try the remote HEAD ref first (most reliable)
+                    const ref = (0, child_process_1.execSync)(`git -C "${repoRoot}" symbolic-ref refs/remotes/origin/HEAD`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+                    defaultBranch = ref.replace(/^refs\/remotes\/origin\//, "");
+                }
+                catch {
+                    // Fall back: check which of main/master/develop actually exists
+                    for (const candidate of ["main", "master", "develop", "trunk"]) {
+                        try {
+                            (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-parse --verify ${candidate}`, { stdio: "pipe" });
+                            defaultBranch = candidate;
+                            break;
+                        }
+                        catch { /* try next */ }
+                    }
+                }
+            }
+            res.writeHead(200);
+            res.end(JSON.stringify({ defaultBranch }));
+            return;
+        }
+        // ── /api/am-freshness — how many commits since last AM generation ────────
+        if (req.url === "/api/am-freshness") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            if (!repoRoot) {
+                res.writeHead(200);
+                res.end(JSON.stringify({ commitsBehind: 0 }));
+                return;
+            }
+            try {
+                const amPath = path.join(repoRoot, ".memor", "architecture-map.json");
+                const am = JSON.parse(fs.readFileSync(amPath, "utf8"));
+                const commit = am._meta?.generatedAtCommit;
+                if (!commit) {
+                    // Old map with no stored commit — use file mtime as rough proxy
+                    const stat = fs.statSync(amPath);
+                    const since = stat.mtime.toISOString();
+                    res.writeHead(200);
+                    res.end(JSON.stringify({ commitsBehind: null, generatedAt: since, noCommitStored: true }));
+                    return;
+                }
+                let commitsBehind = 0;
+                try {
+                    const out = (0, child_process_1.execSync)(`git -C "${repoRoot}" rev-list --count ${commit}..HEAD`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+                    commitsBehind = parseInt(out) || 0;
+                }
+                catch { /* git not available or commit not found */ }
+                res.writeHead(200);
+                res.end(JSON.stringify({ commitsBehind, generatedAt: am._meta?.generatedAt }));
+            }
+            catch {
+                // No architecture map at all — not stale, just missing
+                res.writeHead(200);
+                res.end(JSON.stringify({ commitsBehind: 0 }));
+            }
+            return;
+        }
+        // ── /api/xray-detail?file=relative/path — typed AST signatures ───
+        if (req.url?.startsWith("/api/xray-detail")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const fileRel = parsed.query.file;
+            if (!fileRel) {
+                res.writeHead(400);
+                res.end(JSON.stringify({ error: "Missing ?file= parameter" }));
+                return;
+            }
+            const absPath = path.resolve(repoRoot, fileRel);
+            if (!absPath.startsWith(path.resolve(repoRoot))) {
+                res.writeHead(403);
+                res.end(JSON.stringify({ error: "Path traversal not allowed" }));
+                return;
+            }
+            try {
+                const detail = (0, buildDetailedFileXRay_1.buildDetailedFileXRay)(absPath, repoRoot);
+                res.writeHead(200);
+                res.end(JSON.stringify(detail));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: String(e) }));
+            }
+            return;
+        }
+        // ── /api/xray?file=relative/path/to/file.ts ──────────────────
+        if (req.url?.startsWith("/api/xray") && !req.url.startsWith("/api/xray-llm")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const fileRel = parsed.query.file;
+            if (!fileRel) {
+                res.writeHead(400);
+                res.end(JSON.stringify({ error: "Missing ?file= parameter" }));
+                return;
+            }
+            // Safety: resolve and ensure file is under repoRoot
+            const absPath = path.resolve(repoRoot, fileRel);
+            if (!absPath.startsWith(path.resolve(repoRoot))) {
+                res.writeHead(403);
+                res.end(JSON.stringify({ error: "Path traversal not allowed" }));
+                return;
+            }
+            try {
+                const xray = (0, buildFileXRay_1.buildFileXRay)(absPath, repoRoot);
+                res.writeHead(200);
+                res.end(JSON.stringify(xray));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: String(e) }));
+            }
+            return;
+        }
+        // ── /api/events — SSE stream for live code-change notifications ──
+        if (req.url === "/api/events") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "text/event-stream");
+            res.setHeader("Cache-Control", "no-cache");
+            res.setHeader("Connection", "keep-alive");
+            res.writeHead(200);
+            res.write("data: {\"type\":\"connected\"}\n\n");
+            (0, repoWatcher_1.addSSEClient)(res);
+            return;
+        }
+        // ── /api/repo-root — return the repo root path ───────────────
+        if (req.url === "/api/repo-root" && req.method === "GET") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.writeHead(200);
+            res.end(JSON.stringify({ repoRoot: repoRoot ?? "" }));
+            return;
+        }
+        // ── /api/key-status — check if API key is available ──────────
+        if (req.url === "/api/key-status" && req.method === "GET") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.writeHead(200);
+            const source = runtimeApiKey ? "runtime" : process.env.ANTHROPIC_API_KEY ? "env" : "none";
+            res.end(JSON.stringify({ hasKey: source !== "none", source }));
+            return;
+        }
+        // ── /api/set-key — store API key in memory for this session ───
+        if (req.url === "/api/set-key" && req.method === "POST") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            readBody(req).then((raw) => {
+                try {
+                    const { key } = JSON.parse(raw);
+                    if (typeof key === "string" && key.trim().length > 10) {
+                        runtimeApiKey = key.trim();
+                        saveKey(runtimeApiKey);
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ ok: true }));
+                    }
+                    else {
+                        res.writeHead(400);
+                        res.end(JSON.stringify({ error: "invalid key" }));
+                    }
+                }
+                catch {
+                    res.writeHead(400);
+                    res.end(JSON.stringify({ error: "bad request" }));
+                }
+            }).catch(() => { res.writeHead(500); res.end("{}"); });
+            return;
+        }
+        // ── /api/generate-am — trigger AM (re)generation ──────────────
+        if (req.url === "/api/generate-am" && req.method === "POST") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const apiKey = getApiKey();
+            if (!apiKey) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "ANTHROPIC_API_KEY not set" }));
+                return;
+            }
+            // Respond immediately — generation runs in background
+            res.writeHead(202);
+            res.end(JSON.stringify({ status: "generating" }));
+            (0, generateAMForRepo_1.generateAMForRepo)(repoRoot, apiKey, (step) => {
+                if (step.startsWith("am-intel:")) {
+                    try {
+                        (0, repoWatcher_1.broadcast)({ type: "am-intel", data: JSON.parse(step.slice(9)) });
+                    }
+                    catch { }
+                }
+                else {
+                    (0, repoWatcher_1.broadcast)({ type: "am-progress", step });
+                }
+            })
+                .then(() => (0, repoWatcher_1.broadcast)({ type: "am-ready" }))
+                .catch((e) => {
+                console.error("[memor] AM generation failed:", e.message);
+                (0, repoWatcher_1.broadcast)({ type: "am-error", error: e.message });
+            });
+            return;
+        }
+        // ── /api/xray-llm?file=relative/path — LLM narrative X-Ray ──
+        if (req.url?.startsWith("/api/xray-llm")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const fileRel = parsed.query.file;
+            if (!fileRel) {
+                res.writeHead(400);
+                res.end(JSON.stringify({ error: "Missing ?file= parameter" }));
+                return;
+            }
+            const absPath = resolveFilePath(path.resolve(repoRoot, fileRel));
+            if (!absPath.startsWith(path.resolve(repoRoot))) {
+                res.writeHead(403);
+                res.end(JSON.stringify({ error: "Path traversal not allowed" }));
+                return;
+            }
+            (0, llmXRay_1.generateLLMXRay)(absPath, repoRoot)
+                .then((xray) => {
+                res.writeHead(200);
+                res.end(JSON.stringify(xray));
+            })
+                .catch((e) => {
+                const status = e.message.includes("ANTHROPIC_API_KEY") ? 503
+                    : e.message.includes("too large") || e.message.includes("only supports") ? 400
+                        : 500;
+                res.writeHead(status);
+                res.end(JSON.stringify({ error: e.message }));
+            });
+            return;
+        }
+        // ── /api/generate-flows — deterministic route map → Haiku → patch AM ────
+        if (req.url === "/api/generate-flows" && req.method === "POST") {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const apiKey = getApiKey();
+            if (!apiKey) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "ANTHROPIC_API_KEY not set" }));
+                return;
+            }
+            const amPath = path.join(repoRoot, ".memor", "architecture-map.json");
+            let am;
+            try {
+                am = JSON.parse(fs.readFileSync(amPath, "utf8"));
+            }
+            catch {
+                res.writeHead(404);
+                res.end(JSON.stringify({ error: "No architecture map found — generate AM first" }));
+                return;
+            }
+            // Respond immediately, run in background
+            res.writeHead(202);
+            res.end(JSON.stringify({ status: "generating" }));
+            Promise.resolve().then(async () => {
+                try {
+                    const systemIds = (am.systems ?? []).map((s) => s.id);
+                    const externalIds = (am.external ?? []).map((e) => e.id);
+                    // L1–L4 deterministic pipeline
+                    const candidates = await (0, buildFlowGraph_1.buildFlowGraph)(repoRoot, am, (step) => {
+                        (0, repoWatcher_1.broadcast)({ type: "flows-progress", step });
+                    });
+                    if (candidates.length === 0) {
+                        // Fallback to legacy route-map path
+                        (0, repoWatcher_1.broadcast)({ type: "flows-progress", step: "No entry points found — falling back to route map…" });
+                        const routeMap = (0, extractRouteMap_1.extractRouteMap)(repoRoot);
+                        (0, repoWatcher_1.broadcast)({ type: "flows-progress", step: `Found ${routeMap.apiRoutes.length} routes — narrating with LLM…` });
+                        const flows = await (0, generateFlows_1.generateFlows)(routeMap, systemIds, externalIds, apiKey, repoRoot);
+                        am.flows = flows;
+                        fs.writeFileSync(amPath, JSON.stringify(am, null, 2), "utf8");
+                        (0, repoWatcher_1.broadcast)({ type: "flows-ready", count: flows.length });
+                        return;
+                    }
+                    (0, repoWatcher_1.broadcast)({ type: "flows-progress", step: `Narrating ${candidates.length} flows with LLM…` });
+                    const flows = await (0, generateFlows_1.generateFlows)(candidates, systemIds, externalIds, apiKey, repoRoot);
+                    am.flows = flows;
+                    fs.writeFileSync(amPath, JSON.stringify(am, null, 2), "utf8");
+                    (0, repoWatcher_1.broadcast)({ type: "flows-ready", count: flows.length });
+                }
+                catch (e) {
+                    console.error("[memor] Flow generation failed:", e.message);
+                    (0, repoWatcher_1.broadcast)({ type: "flows-error", error: e.message });
+                }
+            });
+            return;
+        }
+        // ── /api/ai-file-insight?file=relative/path — description + suggestions ──
+        if (req.url?.startsWith("/api/ai-file-insight")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const apiKey = getApiKey();
+            if (!apiKey) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "ANTHROPIC_API_KEY not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const fileRel = parsed.query.file;
+            if (!fileRel) {
+                res.writeHead(400);
+                res.end(JSON.stringify({ error: "Missing ?file= parameter" }));
+                return;
+            }
+            const absPath = resolveFilePath(path.resolve(repoRoot, fileRel));
+            if (!absPath.startsWith(path.resolve(repoRoot))) {
+                res.writeHead(403);
+                res.end(JSON.stringify({ error: "Path traversal not allowed" }));
+                return;
+            }
+            // Build the deterministic X-Ray first, then feed its structured summary to LLM
+            // (covers the whole file with far fewer tokens than raw lines)
+            let xrayData;
+            try {
+                xrayData = (0, buildDetailedFileXRay_1.buildDetailedFileXRay)(absPath, repoRoot);
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: `X-Ray failed: ${String(e)}` }));
+                return;
+            }
+            (0, generateFileInsight_1.generateFileInsight)(absPath, repoRoot, apiKey, xrayData)
+                .then(insight => { res.writeHead(200); res.end(JSON.stringify(insight)); })
+                .catch((e) => { res.writeHead(500); res.end(JSON.stringify({ error: e.message })); });
+            return;
+        }
+        // ── /api/git-changes — staged + working-tree changes ─────────
+        if (req.url?.startsWith("/api/git-changes")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            try {
+                const parseFiles = (out) => out.split("\n").map((l) => l.trim()).filter(Boolean);
+                let files = [];
+                try {
+                    const staged = parseFiles((0, child_process_1.execSync)("git diff --name-only --cached", { cwd: repoRoot, encoding: "utf-8" }));
+                    files.push(...staged);
+                }
+                catch { }
+                try {
+                    const unstaged = parseFiles((0, child_process_1.execSync)("git diff --name-only", { cwd: repoRoot, encoding: "utf-8" }));
+                    files.push(...unstaged);
+                }
+                catch { }
+                // Deduplicate and filter to JS/TS source files
+                const sourceRe = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+                const unique = [...new Set(files)].filter((f) => sourceRe.test(f));
+                res.writeHead(200);
+                res.end(JSON.stringify({ files: unique }));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: String(e) }));
+            }
+            return;
+        }
+        // ── /api/file-slice?file=rel/path&from=N&to=N — raw source lines ─
+        if (req.url?.startsWith("/api/file-slice")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            const parsed = url.parse(req.url, true);
+            const fileRel = parsed.query.file;
+            const from = Math.max(1, parseInt(parsed.query.from ?? "1", 10));
+            const to = parseInt(parsed.query.to ?? "0", 10);
+            if (!fileRel || !to) {
+                res.writeHead(400);
+                res.end(JSON.stringify({ error: "Missing ?file=, ?from=, ?to= params" }));
+                return;
+            }
+            const absPath = path.resolve(repoRoot, fileRel);
+            if (!absPath.startsWith(path.resolve(repoRoot))) {
+                res.writeHead(403);
+                res.end(JSON.stringify({ error: "Path traversal not allowed" }));
+                return;
+            }
+            try {
+                const lines = fs.readFileSync(absPath, "utf8").split("\n");
+                const sliced = lines.slice(from - 1, Math.min(to, from + 299)).join("\n"); // max 300 lines
+                res.writeHead(200);
+                res.end(JSON.stringify({ code: sliced, from, to: Math.min(to, from + 299) }));
+            }
+            catch {
+                res.writeHead(404);
+                res.end(JSON.stringify({ error: "File not found" }));
+            }
+            return;
+        }
+        // ── /api/git-head — files changed in HEAD commit ──────────────
+        if (req.url?.startsWith("/api/git-head")) {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            if (!repoRoot) {
+                res.writeHead(503);
+                res.end(JSON.stringify({ error: "repoRoot not set" }));
+                return;
+            }
+            try {
+                const out = (0, child_process_1.execSync)("git diff-tree --no-commit-id -r --name-only HEAD", {
+                    cwd: repoRoot, encoding: "utf-8",
+                });
+                const sourceRe = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+                const files = out.split("\n").map((l) => l.trim()).filter(Boolean).filter((f) => sourceRe.test(f));
+                res.writeHead(200);
+                res.end(JSON.stringify({ files }));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: String(e) }));
+            }
+            return;
+        }
+        // ── /tIcons/* — serve tech stack SVG icons ────────────────────
+        if (req.url?.startsWith("/tIcons/")) {
+            const iconName = req.url.slice("/tIcons/".length).replace(/[^a-zA-Z0-9_.\-]/g, "");
+            const iconPath = path.join(__dirname, "..", "public", "tIcons", iconName);
+            try {
+                const svg = fs.readFileSync(iconPath, "utf8");
+                res.writeHead(200, { "Content-Type": "image/svg+xml", "Cache-Control": "public, max-age=86400" });
+                res.end(svg);
+            }
+            catch {
+                res.writeHead(404);
+                res.end("");
+            }
+            return;
+        }
+        // ── Main app HTML ─────────────────────────────────────────────
+        res.writeHead(200, {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store",
+        });
+        res.end(html);
+    });
+    const BASE_PORT = port;
+    let currentPort = port;
+    function tryListen() {
+        server.listen(currentPort, () => {
+            if (currentPort !== BASE_PORT) {
+                console.log(`  Port ${BASE_PORT} was in use — started on ${currentPort} instead.`);
+            }
+            onReady(`http://localhost:${currentPort}`);
+            if (repoRoot)
+                (0, repoWatcher_1.startRepoWatcher)(repoRoot);
+        });
+    }
+    server.on("error", (err) => {
+        if (err.code === "EADDRINUSE") {
+            if (currentPort < BASE_PORT + 4) {
+                currentPort++;
+                server.close(() => tryListen());
+            }
+            else {
+                console.error(`\n  ✗ Ports ${BASE_PORT}–${BASE_PORT + 4} are all in use.`);
+                console.error(`    Kill the other memor instance, or run with --port <number>.\n`);
+                process.exit(1);
+            }
+            return;
+        }
+        throw err;
+    });
+    tryListen();
+    process.on("SIGINT", () => {
+        server.close();
+        console.log("\n  Memor stopped.");
+        process.exit(0);
+    });
+}
+//# sourceMappingURL=server.js.map