min-agent 0.2.0 → 0.3.0

package/dist/serve.js

@@ -3,35 +3,43 @@
  * Run: min-agent serve [--host 127.0.0.1] [--port 8787]
  */
 import { createServer } from "http";
-import { readFileSync, existsSync } from "fs";
+import { readFileSync } from "fs";
 import path from "path";
-import { initMcp, shutdownMcp, getMcpStatus } from "./mcp.js";
-import { discoverSkills, getSkills } from "./skills.js";
+import { fileURLToPath } from "url";
+import { timingSafeEqual } from "crypto";
+import { initMcp, shutdownMcp, getMcpStatus, syncMcpConnections, loadMcpConfigEntries } from "./mcp.js";
+import { discoverSkills, getAllSkills, getSkill, getStaleDisabledSkills, setSkillEnabled } from "./skills.js";
 import { loadInstructions } from "./instructions.js";
-import { loadConfig, fetchModels, isConfigured } from "./config.js";
+import { loadConfig, fetchModels, isConfigured, getActiveProvider } from "./config.js";
 import { setAutoApprove } from "./confirm.js";
-import { runOnce, buildUserContent } from "./agent.js";
-import { loadSession, saveSession, listSessions, deleteSession } from "./sessions.js";
+import { runOnce, runOnceWithSystem, buildUserContent } from "./agent.js";
+import { loadSession, saveSession, listSessions, deleteSession, renameSession, sanitizeForStorage } from "./sessions.js";
 import { loadMemories, addMemory, deleteMemory, searchMemories } from "./memory.js";
-import { scanProject } from "./code-mode.js";
-import { compactMessages } from "./compaction.js";
+import { scanProject, buildCodeSystemPrompt } from "./code-mode.js";
+import { compactMessages, TokenTracker } from "./compaction.js";
 import { resolveModel } from "./provider.js";
 import { getContextWindow } from "./context-window.js";
+import { getModelPrice, estimateCost } from "./pricing.js";
 const MAX_BODY_BYTES = 2 * 1024 * 1024;
+const BODY_TIMEOUT_MS = 30_000;
 const MAX_TOOL_RESULT_SSE_CHARS = 48_000;
+const MAX_CONCURRENT_CHATS = 8;
+let activeChats = 0;
 function packageVersion() {
     try {
-        const pkgPath = path.join(process.cwd(), "package.json");
-        if (existsSync(pkgPath)) {
-            const j = JSON.parse(readFileSync(pkgPath, "utf-8"));
-            return j.version ?? "0.0.0";
-        }
+        const pkgPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../package.json");
+        const j = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        return j.version ?? "0.0.0";
     }
     catch { }
     return "0.0.0";
 }
+function corsEnabled() {
+    const v = process.env.MIN_AGENT_SERVE_CORS;
+    return v === "1" || v === "true";
+}
 function corsHeaders() {
-    if (process.env.MIN_AGENT_SERVE_CORS === "1" || process.env.MIN_AGENT_SERVE_CORS === "true") {
+    if (corsEnabled()) {
         return {
             "Access-Control-Allow-Origin": "*",
             "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
@@ -40,6 +48,27 @@ function corsHeaders() {
     }
     return {};
 }
+/**
+ * With CORS enabled and no auth token, arbitrary web pages could drive the
+ * agent. Allow only same-machine origins (localhost) in that configuration;
+ * a token bypasses the origin check entirely.
+ */
+function originAllowed(req) {
+    if (process.env.MIN_AGENT_SERVE_TOKEN?.trim())
+        return true;
+    const origin = req.headers.origin?.trim();
+    if (!origin || origin === "null")
+        return true;
+    try {
+        const host = new URL(origin).hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "[::1]")
+            return true;
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
 function authOk(req) {
     const token = process.env.MIN_AGENT_SERVE_TOKEN?.trim();
     if (!token)
@@ -47,7 +76,21 @@ function authOk(req) {
     const h = req.headers.authorization?.trim();
     if (!h?.startsWith("Bearer "))
         return false;
-    return h.slice(7) === token;
+    const provided = Buffer.from(h.slice(7));
+    const expected = Buffer.from(token);
+    return provided.length === expected.length && timingSafeEqual(provided, expected);
+}
+function skillPayload(s) {
+    return {
+        name: s.name,
+        description: s.description,
+        location: s.location,
+        enabled: s.enabled,
+        ...(s.disabledScope ? { disabled_scope: s.disabledScope } : {}),
+        ...(s.version ? { version: s.version } : {}),
+        ...(s.allowedTools.length ? { allowed_tools: s.allowedTools } : {}),
+        ...(s.requiredBins.length ? { requires_bins: s.requiredBins } : {}),
+    };
 }
 function sendJson(res, status, body) {
     const headers = {
@@ -57,22 +100,73 @@ function sendJson(res, status, body) {
     res.writeHead(status, headers);
     res.end(JSON.stringify(body));
 }
+/** Decode a URL path segment without letting malformed escapes become a 500. */
+function decodePathSegment(raw) {
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        return null;
+    }
+}
 function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
         let total = 0;
+        const timer = setTimeout(() => {
+            req.destroy();
+            reject(new Error("body_timeout"));
+        }, BODY_TIMEOUT_MS);
         req.on("data", (c) => {
             total += c.length;
             if (total > MAX_BODY_BYTES) {
+                clearTimeout(timer);
+                req.removeAllListeners("data");
+                req.pause();
                 reject(new Error("body_too_large"));
                 return;
             }
             chunks.push(c);
         });
-        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-        req.on("error", reject);
+        req.on("end", () => {
+            clearTimeout(timer);
+            resolve(Buffer.concat(chunks).toString("utf-8"));
+        });
+        req.on("error", (e) => {
+            clearTimeout(timer);
+            reject(e);
+        });
     });
 }
+async function readJsonBody(req) {
+    let raw;
+    try {
+        raw = await readBody(req);
+    }
+    catch (e) {
+        if (e?.message === "body_too_large") {
+            return { ok: false, status: 413, error: "payload_too_large" };
+        }
+        if (e?.message === "body_timeout") {
+            return { ok: false, status: 408, error: "payload_timeout" };
+        }
+        throw e;
+    }
+    try {
+        return { ok: true, value: JSON.parse(raw) };
+    }
+    catch {
+        return { ok: false, status: 400, error: "invalid_json" };
+    }
+}
+function sendJsonError(res, e) {
+    if (e.status === 413) {
+        // The request body was abandoned mid-stream; drop keep-alive so the
+        // connection cannot be reused for a second request.
+        res.shouldKeepAlive = false;
+    }
+    sendJson(res, e.status, e.status === 413 ? { error: e.error, max_bytes: MAX_BODY_BYTES } : { error: e.error });
+}
 function sseWrite(res, obj) {
     try {
         if (res.writableEnded)
@@ -88,6 +182,79 @@ function truncateForJson(v, max) {
         return v.slice(0, max) + `\n… [truncated ${v.length - max} chars]`;
     return v;
 }
+function sseHeaders(cors) {
+    return {
+        "Content-Type": "text/event-stream; charset=utf-8",
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no",
+        ...cors,
+    };
+}
+function createSseCallbacks(res, messages, opts = {}) {
+    return {
+        onAssistantDisplayDelta(delta) {
+            sseWrite(res, { type: "assistant", text: delta });
+        },
+        onThinkingDelta(delta) {
+            sseWrite(res, { type: "thinking", text: delta });
+        },
+        onToolCall(name, input) {
+            sseWrite(res, { type: "tool_call", name, input: truncateForJson(input, MAX_TOOL_RESULT_SSE_CHARS) });
+        },
+        onToolResult(name, output) {
+            sseWrite(res, { type: "tool_result", name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) });
+        },
+        onCompaction(line) {
+            sseWrite(res, { type: "compaction", line });
+        },
+        onStreamError(message) {
+            sseWrite(res, { type: "error", message });
+        },
+        onRunFinish(info) {
+            let saved;
+            if (opts.sessionId && messages.length > 0) {
+                try {
+                    saved = saveSession(messages, opts.sessionId);
+                }
+                catch {
+                    saved = undefined;
+                }
+            }
+            sseWrite(res, {
+                type: "done",
+                step_count: info.stepCount,
+                usage: info.usage,
+                has_error: info.hasError,
+                aborted: info.aborted,
+                max_steps_reached: info.maxStepsReached,
+                budget_exceeded: info.budgetExceeded ?? false,
+                session_id: saved,
+                messages: sanitizeForStorage(messages),
+                ...(opts.codeMode ? { mode: "code", project: opts.project } : {}),
+            });
+            if (!res.writableEnded)
+                res.end();
+        },
+    };
+}
+function createJsonCallbacks() {
+    const toolCalls = [];
+    const toolResults = [];
+    let finishInfo = null;
+    const callbacks = {
+        onToolCall(name, input) {
+            toolCalls.push({ name, input: truncateForJson(input, MAX_TOOL_RESULT_SSE_CHARS) });
+        },
+        onToolResult(name, output) {
+            toolResults.push({ name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) });
+        },
+        onRunFinish(info) {
+            finishInfo = info;
+        },
+    };
+    return { callbacks, toolCalls, toolResults, finishInfo: () => finishInfo };
+}
 function normalizeMessages(body) {
     if (body.messages && Array.isArray(body.messages)) {
         if (body.messages.length === 0)
@@ -106,6 +273,12 @@ export async function runServe(opts = {}) {
     }
     const host = opts.host ?? process.env.MIN_AGENT_SERVE_HOST ?? "127.0.0.1";
     const port = opts.port ?? parseInt(process.env.MIN_AGENT_SERVE_PORT ?? "8787", 10);
+    const isLoopbackHost = host === "127.0.0.1" || host === "::1" || host === "localhost";
+    if (!isLoopbackHost && !process.env.MIN_AGENT_SERVE_TOKEN?.trim()) {
+        console.error("Refusing to serve on a non-loopback address without MIN_AGENT_SERVE_TOKEN. " +
+            "Set the token (Authorization: Bearer <token>) or bind to 127.0.0.1.");
+        process.exit(1);
+    }
     console.error("\x1b[33m⚠ min-agent serve: confirmations are auto-approved for this process (same as -y). Dangerous shell commands will run without prompts.\x1b[0m");
     setAutoApprove(true);
     console.error("\x1b[90m⟳ Initializing MCP, skills, instructions…\x1b[0m");
@@ -113,6 +286,132 @@ export async function runServe(opts = {}) {
     discoverSkills();
     let instructions = await loadInstructions();
     const version = packageVersion();
+    /** Shared handler for /v1/chat and /v1/code (streaming + JSON). */
+    async function handleChatRequest(req, res, codeMode) {
+        const c = corsHeaders();
+        if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
+            sendJson(res, 415, { error: "unsupported_media_type", detail: "Use Content-Type: application/json" });
+            return;
+        }
+        if (activeChats >= MAX_CONCURRENT_CHATS) {
+            sendJson(res, 429, { error: "too_many_concurrent_requests", detail: `Max ${MAX_CONCURRENT_CHATS} concurrent chats` });
+            return;
+        }
+        activeChats++;
+        try {
+            const parsed = await readJsonBody(req);
+            if (!parsed.ok) {
+                sendJsonError(res, parsed);
+                return;
+            }
+            const body = parsed.value;
+            const modelId = typeof body.model === "string" ? body.model : undefined;
+            const stream = body.stream === true;
+            const sessionId = typeof body.session_id === "string" ? body.session_id : undefined;
+            let messages;
+            if (sessionId) {
+                const session = loadSession(sessionId);
+                if (!session) {
+                    sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
+                    return;
+                }
+                if (typeof body.message !== "string" || !body.message.trim()) {
+                    sendJson(res, 400, {
+                        error: "session_requires_message",
+                        detail: "With `session_id`, send a non-empty `message` for the new user turn",
+                    });
+                    return;
+                }
+                messages = [...session.messages];
+                const content = body.images && body.images.length > 0 ? await buildUserContent(body.message, body.images) : body.message;
+                messages.push({ role: "user", content });
+            }
+            else {
+                const norm = normalizeMessages(body);
+                if (!norm.ok) {
+                    sendJson(res, 400, { error: "invalid_body", detail: norm.error });
+                    return;
+                }
+                messages = norm.messages;
+                if (body.images && body.images.length > 0) {
+                    const last = messages[messages.length - 1];
+                    if (!last || last.role !== "user" || typeof body.message !== "string") {
+                        sendJson(res, 400, {
+                            error: "images_require_message",
+                            detail: "With `images`, send a top-level `message` string for the user turn",
+                        });
+                        return;
+                    }
+                    messages[messages.length - 1] = {
+                        role: "user",
+                        content: await buildUserContent(body.message, body.images),
+                    };
+                }
+            }
+            const abort = new AbortController();
+            res.on("close", () => abort.abort());
+            const tracker = new TokenTracker();
+            const runOptions = {
+                temperature: typeof body.temperature === "number" ? body.temperature : undefined,
+                maxTokens: typeof body.maxTokens === "number" ? body.maxTokens : undefined,
+                topP: typeof body.topP === "number" ? body.topP : undefined,
+                providerName: typeof body.provider === "string" ? body.provider : undefined,
+            };
+            let codeSystemPrompt;
+            let project;
+            if (codeMode) {
+                project = scanProject();
+                codeSystemPrompt = buildCodeSystemPrompt(project, instructions);
+            }
+            const run = (callbacks) => codeMode
+                ? runOnceWithSystem(messages, codeSystemPrompt, modelId, abort.signal, callbacks, tracker, runOptions)
+                : runOnce(messages, instructions, modelId, abort.signal, callbacks, tracker, runOptions);
+            if (stream) {
+                res.writeHead(200, sseHeaders(c));
+                res.flushHeaders?.();
+                const callbacks = createSseCallbacks(res, messages, { sessionId, codeMode, project });
+                try {
+                    await run(callbacks);
+                }
+                catch (err) {
+                    if (!res.writableEnded) {
+                        sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
+                        res.end();
+                    }
+                }
+                return;
+            }
+            const { callbacks, toolCalls, toolResults, finishInfo } = createJsonCallbacks();
+            await run(callbacks);
+            const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
+            let savedSession;
+            if (sessionId && messages.length > 0) {
+                try {
+                    savedSession = saveSession(messages, sessionId);
+                }
+                catch {
+                    savedSession = undefined;
+                }
+            }
+            const fi = finishInfo();
+            sendJson(res, 200, {
+                messages: sanitizeForStorage(messages),
+                assistant: lastAssistant ?? null,
+                tool_calls: toolCalls,
+                tool_results: toolResults,
+                session_id: savedSession,
+                step_count: fi?.stepCount ?? 0,
+                usage: fi?.usage ?? null,
+                has_error: fi?.hasError ?? false,
+                aborted: fi?.aborted ?? false,
+                max_steps_reached: fi?.maxStepsReached ?? false,
+                ...(codeMode ? { mode: "code", project } : {}),
+            });
+        }
+        finally {
+            activeChats--;
+        }
+    }
     const server = createServer(async (req, res) => {
         const c = corsHeaders();
         if (req.method === "OPTIONS") {
@@ -124,6 +423,13 @@ export async function runServe(opts = {}) {
             sendJson(res, 401, { error: "unauthorized", detail: "Set Authorization: Bearer <MIN_AGENT_SERVE_TOKEN> when MIN_AGENT_SERVE_TOKEN is set" });
             return;
         }
+        if (corsEnabled() && !originAllowed(req)) {
+            sendJson(res, 403, {
+                error: "origin_not_allowed",
+                detail: "CORS is enabled without a token; only localhost origins are allowed. Set MIN_AGENT_SERVE_TOKEN or disable CORS.",
+            });
+            return;
+        }
         const url = new URL(req.url ?? "/", `http://${host}`);
         const pathname = url.pathname.replace(/\/$/, "") || "/";
         try {
@@ -141,15 +447,16 @@ export async function runServe(opts = {}) {
             }
             if (req.method === "GET" && pathname === "/v1/models") {
                 const config = loadConfig();
-                const base = config.provider?.baseURL;
-                const key = config.provider?.apiKey;
+                const provider = getActiveProvider(config);
+                const base = provider?.baseURL;
+                const key = provider?.apiKey;
                 if (!base || !key) {
                     sendJson(res, 500, { error: "provider_not_configured" });
                     return;
                 }
                 const models = await fetchModels(base, key);
                 sendJson(res, 200, {
-                    default_model: config.provider?.defaultModel ?? null,
+                    default_model: provider?.defaultModel ?? null,
                     models,
                 });
                 return;
@@ -159,178 +466,8 @@ export async function runServe(opts = {}) {
                 sendJson(res, 200, { ok: true, instructions_chars: instructions.join("\n").length });
                 return;
             }
-            if (req.method === "POST" && pathname === "/v1/chat") {
-                if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-                    sendJson(res, 415, { error: "unsupported_media_type", detail: "Use Content-Type: application/json" });
-                    return;
-                }
-                let raw;
-                try {
-                    raw = await readBody(req);
-                }
-                catch (e) {
-                    if (e?.message === "body_too_large") {
-                        sendJson(res, 413, { error: "payload_too_large", max_bytes: MAX_BODY_BYTES });
-                        return;
-                    }
-                    throw e;
-                }
-                let body;
-                try {
-                    body = JSON.parse(raw);
-                }
-                catch {
-                    sendJson(res, 400, { error: "invalid_json" });
-                    return;
-                }
-                const modelId = typeof body.model === "string" ? body.model : undefined;
-                const stream = body.stream === true;
-                const sessionId = typeof body.session_id === "string" ? body.session_id : undefined;
-                let messages;
-                if (sessionId) {
-                    const session = loadSession(sessionId);
-                    if (!session) {
-                        sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
-                        return;
-                    }
-                    if (typeof body.message !== "string" || !body.message.trim()) {
-                        sendJson(res, 400, {
-                            error: "session_requires_message",
-                            detail: "With `session_id`, send a non-empty `message` for the new user turn",
-                        });
-                        return;
-                    }
-                    messages = [...session.messages];
-                    const content = body.images && body.images.length > 0 ? await buildUserContent(body.message, body.images) : body.message;
-                    messages.push({ role: "user", content });
-                }
-                else {
-                    const norm = normalizeMessages(body);
-                    if (!norm.ok) {
-                        sendJson(res, 400, { error: "invalid_body", detail: norm.error });
-                        return;
-                    }
-                    messages = norm.messages;
-                    if (body.images && body.images.length > 0) {
-                        const last = messages[messages.length - 1];
-                        if (!last || last.role !== "user" || typeof body.message !== "string") {
-                            sendJson(res, 400, {
-                                error: "images_require_message",
-                                detail: "With `images`, send a top-level `message` string for the user turn",
-                            });
-                            return;
-                        }
-                        messages[messages.length - 1] = {
-                            role: "user",
-                            content: await buildUserContent(body.message, body.images),
-                        };
-                    }
-                }
-                const abort = new AbortController();
-                req.on("close", () => abort.abort());
-                if (stream) {
-                    res.writeHead(200, {
-                        "Content-Type": "text/event-stream; charset=utf-8",
-                        "Cache-Control": "no-cache, no-transform",
-                        Connection: "keep-alive",
-                        "X-Accel-Buffering": "no",
-                        ...c,
-                    });
-                    res.flushHeaders?.();
-                    const toolCalls = [];
-                    const toolResults = [];
-                    const callbacks = {
-                        onAssistantDisplayDelta(delta) {
-                            sseWrite(res, { type: "assistant", text: delta });
-                        },
-                        onThinkingDelta(delta) {
-                            sseWrite(res, { type: "thinking", text: delta });
-                        },
-                        onToolCall(name, input) {
-                            toolCalls.push({ name, input });
-                            sseWrite(res, { type: "tool_call", name, input });
-                        },
-                        onToolResult(name, output) {
-                            const out = truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS);
-                            toolResults.push({ name, output: out });
-                            sseWrite(res, { type: "tool_result", name, output: out });
-                        },
-                        onCompaction(line) {
-                            sseWrite(res, { type: "compaction", line });
-                        },
-                        onStreamError(message) {
-                            sseWrite(res, { type: "error", message });
-                        },
-                        onRunFinish(info) {
-                            let saved;
-                            if (sessionId && messages.length > 0) {
-                                try {
-                                    saved = saveSession(messages, sessionId);
-                                }
-                                catch {
-                                    saved = undefined;
-                                }
-                            }
-                            sseWrite(res, {
-                                type: "done",
-                                step_count: info.stepCount,
-                                usage: info.usage,
-                                has_error: info.hasError,
-                                aborted: info.aborted,
-                                session_id: saved,
-                                messages,
-                            });
-                            if (!res.writableEnded)
-                                res.end();
-                        },
-                    };
-                    try {
-                        await runOnce(messages, instructions, modelId, abort.signal, callbacks);
-                    }
-                    catch (err) {
-                        if (!res.writableEnded) {
-                            sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
-                            res.end();
-                        }
-                    }
-                    return;
-                }
-                const toolCalls = [];
-                const toolResults = [];
-                const finishBox = { info: null };
-                await runOnce(messages, instructions, modelId, abort.signal, {
-                    onToolCall(name, input) {
-                        toolCalls.push({ name, input });
-                    },
-                    onToolResult(name, output) {
-                        toolResults.push({ name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) });
-                    },
-                    onRunFinish(info) {
-                        finishBox.info = info;
-                    },
-                });
-                const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-                let savedSession;
-                if (sessionId && messages.length > 0) {
-                    try {
-                        savedSession = saveSession(messages, sessionId);
-                    }
-                    catch {
-                        savedSession = undefined;
-                    }
-                }
-                const fi = finishBox.info;
-                sendJson(res, 200, {
-                    messages,
-                    assistant: lastAssistant ?? null,
-                    tool_calls: toolCalls,
-                    tool_results: toolResults,
-                    session_id: savedSession,
-                    step_count: fi?.stepCount ?? 0,
-                    usage: fi?.usage ?? null,
-                    has_error: fi?.hasError ?? false,
-                    aborted: fi?.aborted ?? false,
-                });
+            if (req.method === "POST" && (pathname === "/v1/chat" || pathname === "/v1/code")) {
+                await handleChatRequest(req, res, pathname === "/v1/code");
                 return;
             }
             // ─── Sessions ──────────────────────────────────────────────────────
@@ -340,7 +477,7 @@ export async function runServe(opts = {}) {
                 return;
             }
             if (req.method === "DELETE" && pathname.startsWith("/v1/sessions/")) {
-                const id = pathname.slice("/v1/sessions/".length);
+                const id = decodePathSegment(pathname.slice("/v1/sessions/".length));
                 if (!id) {
                     sendJson(res, 400, { error: "missing_session_id" });
                     return;
@@ -353,6 +490,43 @@ export async function runServe(opts = {}) {
                 sendJson(res, 200, { ok: true, deleted: id });
                 return;
             }
+            if (req.method === "GET" && pathname.startsWith("/v1/sessions/")) {
+                const id = decodePathSegment(pathname.slice("/v1/sessions/".length));
+                if (!id) {
+                    sendJson(res, 400, { error: "missing_session_id" });
+                    return;
+                }
+                const session = loadSession(id);
+                if (!session) {
+                    sendJson(res, 404, { error: "session_not_found", session_id: id });
+                    return;
+                }
+                sendJson(res, 200, { session });
+                return;
+            }
+            if (req.method === "POST" && pathname.startsWith("/v1/sessions/") && pathname.endsWith("/rename")) {
+                const id = decodePathSegment(pathname.slice("/v1/sessions/".length, -"/rename".length));
+                if (!id) {
+                    sendJson(res, 400, { error: "missing_session_id" });
+                    return;
+                }
+                const parsed = await readJsonBody(req);
+                if (!parsed.ok) {
+                    sendJsonError(res, parsed);
+                    return;
+                }
+                const title = parsed.value.title?.trim();
+                if (!title) {
+                    sendJson(res, 400, { error: "missing_title" });
+                    return;
+                }
+                if (!renameSession(id, title)) {
+                    sendJson(res, 404, { error: "session_not_found", session_id: id });
+                    return;
+                }
+                sendJson(res, 200, { ok: true, session_id: id, title });
+                return;
+            }
             // ─── Memory ────────────────────────────────────────────────────────
             if (req.method === "GET" && pathname === "/v1/memory") {
                 const memories = loadMemories();
@@ -360,8 +534,12 @@ export async function runServe(opts = {}) {
                 return;
             }
             if (req.method === "POST" && pathname === "/v1/memory") {
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
+                const parsed = await readJsonBody(req);
+                if (!parsed.ok) {
+                    sendJsonError(res, parsed);
+                    return;
+                }
+                const body = parsed.value;
                 if (!body.content) {
                     sendJson(res, 400, { error: "missing_content" });
                     return;
@@ -402,9 +580,67 @@ export async function runServe(opts = {}) {
             }
             // ─── Skills ────────────────────────────────────────────────────────
             if (req.method === "GET" && pathname === "/v1/skills") {
-                const skills = getSkills();
+                const all = getAllSkills();
                 sendJson(res, 200, {
-                    skills: skills.map((s) => ({ name: s.name, description: s.description, location: s.location })),
+                    count: all.length,
+                    enabled_count: all.filter((s) => s.enabled).length,
+                    stale_disabled: getStaleDisabledSkills(),
+                    skills: all.map(skillPayload),
+                });
+                return;
+            }
+            if (req.method === "POST" && pathname === "/v1/skills/reload") {
+                discoverSkills({ silent: true });
+                const all = getAllSkills();
+                sendJson(res, 200, {
+                    ok: true,
+                    count: all.length,
+                    enabled_count: all.filter((s) => s.enabled).length,
+                    stale_disabled: getStaleDisabledSkills(),
+                    skills: all.map(skillPayload),
+                });
+                return;
+            }
+            const skillDetail = pathname.match(/^\/v1\/skills\/([^/]+)$/);
+            if (req.method === "GET" && skillDetail) {
+                const name = decodePathSegment(skillDetail[1]);
+                if (!name) {
+                    sendJson(res, 400, { error: "invalid_skill_name" });
+                    return;
+                }
+                const skill = getSkill(name);
+                if (!skill) {
+                    sendJson(res, 404, { error: "skill_not_found", name, available: getAllSkills().map((s) => s.name) });
+                    return;
+                }
+                sendJson(res, 200, { skill: { ...skillPayload(skill), content: skill.content } });
+                return;
+            }
+            const skillToggle = pathname.match(/^\/v1\/skills\/([^/]+)\/(enable|disable)$/);
+            if (req.method === "POST" && skillToggle) {
+                const name = decodePathSegment(skillToggle[1]);
+                if (!name) {
+                    sendJson(res, 400, { error: "invalid_skill_name" });
+                    return;
+                }
+                const enabled = skillToggle[2] === "enable";
+                if (!getSkill(name)) {
+                    sendJson(res, 404, { error: "skill_not_found", name, available: getAllSkills().map((s) => s.name) });
+                    return;
+                }
+                const parsed = await readJsonBody(req);
+                const scope = parsed.ok ? parsed.value.scope : undefined;
+                if (scope !== undefined && scope !== "global" && scope !== "project") {
+                    sendJson(res, 400, { error: "invalid_scope", allowed: ["global", "project"] });
+                    return;
+                }
+                const [result] = setSkillEnabled([name], enabled, scope ?? "global");
+                sendJson(res, 200, {
+                    ok: true,
+                    name,
+                    enabled: result.enabled,
+                    scope: scope ?? "global",
+                    ...(result.blockedBy ? { blocked_by: result.blockedBy } : {}),
                 });
                 return;
             }
@@ -426,124 +662,22 @@ export async function runServe(opts = {}) {
                 return;
             }
             // ─── Code mode chat ────────────────────────────────────────────────
-            if (req.method === "POST" && pathname === "/v1/code") {
+            // ─── MCP management ────────────────────────────────────────────────
+            if (req.method === "POST" && pathname === "/v1/paste") {
                 if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
                     sendJson(res, 415, { error: "unsupported_media_type" });
                     return;
                 }
-                let raw;
-                try {
-                    raw = await readBody(req);
-                }
-                catch {
-                    sendJson(res, 413, { error: "payload_too_large" });
+                if (activeChats >= MAX_CONCURRENT_CHATS) {
+                    sendJson(res, 429, { error: "too_many_concurrent_requests", detail: `Max ${MAX_CONCURRENT_CHATS} concurrent chats` });
                     return;
                 }
-                let body;
-                try {
-                    body = JSON.parse(raw);
-                }
-                catch {
-                    sendJson(res, 400, { error: "invalid_json" });
+                const parsed = await readJsonBody(req);
+                if (!parsed.ok) {
+                    sendJsonError(res, parsed);
                     return;
                 }
-                const modelId = typeof body.model === "string" ? body.model : undefined;
-                const stream = body.stream === true;
-                const sessionId = typeof body.session_id === "string" ? body.session_id : undefined;
-                // Build code-mode system prompt
-                const { buildCodeSystemPrompt } = await import("./code-mode.js");
-                const project = scanProject();
-                const codeSystemPrompt = buildCodeSystemPrompt(project, instructions);
-                let messages;
-                if (sessionId) {
-                    const session = loadSession(sessionId);
-                    if (!session) {
-                        sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
-                        return;
-                    }
-                    if (!body.message) {
-                        sendJson(res, 400, { error: "session_requires_message" });
-                        return;
-                    }
-                    messages = [...session.messages];
-                    const content = body.images?.length ? await buildUserContent(body.message, body.images) : body.message;
-                    messages.push({ role: "user", content });
-                }
-                else {
-                    const norm = normalizeMessages(body);
-                    if (!norm.ok) {
-                        sendJson(res, 400, { error: "invalid_body", detail: norm.error });
-                        return;
-                    }
-                    messages = norm.messages;
-                }
-                const abort = new AbortController();
-                req.on("close", () => abort.abort());
-                // Use runOnce with code system prompt override
-                const { runOnceWithSystem } = await import("./agent.js");
-                if (stream) {
-                    res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache", Connection: "keep-alive", ...c });
-                    res.flushHeaders?.();
-                    const callbacks = {
-                        onAssistantDisplayDelta(delta) { sseWrite(res, { type: "assistant", text: delta }); },
-                        onThinkingDelta(delta) { sseWrite(res, { type: "thinking", text: delta }); },
-                        onToolCall(name, input) { sseWrite(res, { type: "tool_call", name, input }); },
-                        onToolResult(name, output) { sseWrite(res, { type: "tool_result", name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) }); },
-                        onCompaction(line) { sseWrite(res, { type: "compaction", line }); },
-                        onStreamError(message) { sseWrite(res, { type: "error", message }); },
-                        onRunFinish(info) {
-                            let saved;
-                            if (sessionId && messages.length > 0) {
-                                try {
-                                    saved = saveSession(messages, sessionId);
-                                }
-                                catch { }
-                            }
-                            sseWrite(res, { type: "done", step_count: info.stepCount, usage: info.usage, has_error: info.hasError, session_id: saved, messages, mode: "code", project });
-                            if (!res.writableEnded)
-                                res.end();
-                        },
-                    };
-                    try {
-                        await runOnceWithSystem(messages, codeSystemPrompt, modelId, abort.signal, callbacks);
-                    }
-                    catch (err) {
-                        if (!res.writableEnded) {
-                            sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
-                            res.end();
-                        }
-                    }
-                }
-                else {
-                    const toolCalls = [];
-                    const toolResults = [];
-                    const finishBox = { info: null };
-                    await runOnceWithSystem(messages, codeSystemPrompt, modelId, abort.signal, {
-                        onToolCall(name, input) { toolCalls.push({ name, input }); },
-                        onToolResult(name, output) { toolResults.push({ name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) }); },
-                        onRunFinish(info) { finishBox.info = info; },
-                    });
-                    const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-                    let saved;
-                    if (sessionId && messages.length > 0) {
-                        try {
-                            saved = saveSession(messages, sessionId);
-                        }
-                        catch { }
-                    }
-                    const fi = finishBox.info;
-                    sendJson(res, 200, { mode: "code", project, messages, assistant: lastAssistant ?? null, tool_calls: toolCalls, tool_results: toolResults, session_id: saved, step_count: fi?.stepCount ?? 0, usage: fi?.usage ?? null, has_error: fi?.hasError ?? false });
-                }
-                return;
-            }
-            // ─── MCP management ────────────────────────────────────────────────
-            if (req.method === "POST" && pathname === "/v1/paste") {
-                if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-                    sendJson(res, 415, { error: "unsupported_media_type" });
-                    return;
-                }
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
+                const body = parsed.value;
                 if (!body.image_base64) {
                     sendJson(res, 400, { error: "missing_image_base64" });
                     return;
@@ -554,111 +688,229 @@ export async function runServe(opts = {}) {
                 const modelId = body.model;
                 const sessionId = body.session_id;
                 const stream = body.stream === true;
+                const codeMode = body.code === true;
                 let messages = [];
                 if (sessionId) {
                     const session = loadSession(sessionId);
-                    if (session)
-                        messages = [...session.messages];
+                    if (!session) {
+                        sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
+                        return;
+                    }
+                    messages = [...session.messages];
                 }
-                const content = [
-                    { type: "text", text },
-                    { type: "image", image: imageBuffer, mimeType },
-                ];
-                messages.push({ role: "user", content });
-                const abort = new AbortController();
-                req.on("close", () => abort.abort());
-                if (stream) {
-                    res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache", Connection: "keep-alive", ...c });
-                    res.flushHeaders?.();
-                    const callbacks = {
-                        onAssistantDisplayDelta(delta) { sseWrite(res, { type: "assistant", text: delta }); },
-                        onThinkingDelta(delta) { sseWrite(res, { type: "thinking", text: delta }); },
-                        onToolCall(name, input) { sseWrite(res, { type: "tool_call", name, input }); },
-                        onToolResult(name, output) { sseWrite(res, { type: "tool_result", name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) }); },
-                        onStreamError(message) { sseWrite(res, { type: "error", message }); },
-                        onRunFinish(info) {
-                            let saved;
-                            if (sessionId) {
-                                try {
-                                    saved = saveSession(messages, sessionId);
-                                }
-                                catch { }
-                            }
-                            sseWrite(res, { type: "done", step_count: info.stepCount, usage: info.usage, session_id: saved });
-                            if (!res.writableEnded)
-                                res.end();
-                        },
+                activeChats++;
+                try {
+                    const content = [
+                        { type: "text", text },
+                        { type: "image", image: imageBuffer, mimeType },
+                    ];
+                    messages.push({ role: "user", content });
+                    const abort = new AbortController();
+                    res.on("close", () => abort.abort());
+                    const tracker = new TokenTracker();
+                    const runOptions = {
+                        temperature: typeof body.temperature === "number" ? body.temperature : undefined,
+                        maxTokens: typeof body.maxTokens === "number" ? body.maxTokens : undefined,
+                        topP: typeof body.topP === "number" ? body.topP : undefined,
+                        providerName: typeof body.provider === "string" ? body.provider : undefined,
                     };
-                    await runOnce(messages, instructions, modelId, abort.signal, callbacks);
-                }
-                else {
-                    await runOnce(messages, instructions, modelId, abort.signal);
-                    const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-                    let saved;
-                    if (sessionId) {
+                    if (stream) {
+                        res.writeHead(200, sseHeaders(c));
+                        res.flushHeaders?.();
+                        const callbacks = createSseCallbacks(res, messages, { sessionId });
                         try {
-                            saved = saveSession(messages, sessionId);
+                            if (codeMode) {
+                                const project = scanProject();
+                                const system = buildCodeSystemPrompt(project, instructions);
+                                await runOnceWithSystem(messages, system, modelId, abort.signal, callbacks, tracker, runOptions);
+                            }
+                            else {
+                                await runOnce(messages, instructions, modelId, abort.signal, callbacks, tracker, runOptions);
+                            }
+                        }
+                        catch (err) {
+                            if (!res.writableEnded) {
+                                sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
+                                res.end();
+                            }
+                        }
+                    }
+                    else {
+                        const { callbacks, toolCalls, toolResults, finishInfo } = createJsonCallbacks();
+                        let project;
+                        if (codeMode) {
+                            project = scanProject();
+                            const system = buildCodeSystemPrompt(project, instructions);
+                            await runOnceWithSystem(messages, system, modelId, abort.signal, callbacks, tracker, runOptions);
+                        }
+                        else {
+                            await runOnce(messages, instructions, modelId, abort.signal, callbacks, tracker, runOptions);
+                        }
+                        const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
+                        let saved;
+                        if (sessionId) {
+                            try {
+                                saved = saveSession(messages, sessionId);
+                            }
+                            catch { }
                         }
-                        catch { }
+                        const fi = finishInfo();
+                        sendJson(res, 200, {
+                            messages: sanitizeForStorage(messages),
+                            assistant: lastAssistant ?? null,
+                            tool_calls: toolCalls,
+                            tool_results: toolResults,
+                            session_id: saved,
+                            step_count: fi?.stepCount ?? 0,
+                            usage: fi?.usage ?? null,
+                            has_error: fi?.hasError ?? false,
+                            aborted: fi?.aborted ?? false,
+                            max_steps_reached: fi?.maxStepsReached ?? false,
+                            ...(codeMode ? { mode: "code", project } : {}),
+                        });
                     }
-                    sendJson(res, 200, { messages, assistant: lastAssistant ?? null, session_id: saved });
+                }
+                finally {
+                    activeChats--;
                 }
                 return;
             }
             // ─── MCP management (continued) ───────────────────────────────────
             if (req.method === "POST" && pathname === "/v1/mcp") {
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
+                const parsed = await readJsonBody(req);
+                if (!parsed.ok) {
+                    sendJsonError(res, parsed);
+                    return;
+                }
+                const body = parsed.value;
                 if (!body.name) {
                     sendJson(res, 400, { error: "missing_name" });
                     return;
                 }
-                const { loadMcpConfig, saveMcpConfig } = await import("./mcp.js");
-                const config = loadMcpConfig();
+                if (body.remoteTransport && !["streamable-http", "sse", "auto"].includes(body.remoteTransport)) {
+                    sendJson(res, 400, { error: "invalid_remote_transport", allowed: ["streamable-http", "sse", "auto"] });
+                    return;
+                }
+                const scope = body.project ? "project" : "global";
+                const { loadMcpConfigFile, saveMcpConfig } = await import("./mcp.js");
+                const config = loadMcpConfigFile(scope);
+                const common = {
+                    ...(body.environment ? { environment: body.environment } : {}),
+                    ...(body.headers ? { headers: body.headers } : {}),
+                    ...(body.remoteTransport ? { remoteTransport: body.remoteTransport } : {}),
+                    ...(body.timeout !== undefined ? { timeout: body.timeout } : {}),
+                    ...(body.connectTimeout !== undefined ? { connectTimeout: body.connectTimeout } : {}),
+                    ...(body.callTimeout !== undefined ? { callTimeout: body.callTimeout } : {}),
+                    enabled: body.enabled !== false,
+                };
                 if (body.url) {
-                    config.mcpServers[body.name] = { url: body.url, token: body.token, enabled: body.enabled !== false };
+                    config.mcpServers[body.name] = { url: body.url, ...(body.token ? { token: body.token } : {}), ...common };
+                }
+                else if (typeof body.command === "string" && body.command.length > 0) {
+                    config.mcpServers[body.name] = { command: body.command, ...(body.args ? { args: body.args } : {}), ...common };
                 }
-                else if (body.command && body.command.length > 0) {
-                    config.mcpServers[body.name] = { command: body.command, enabled: body.enabled !== false };
+                else if (Array.isArray(body.command) && body.command.length > 0) {
+                    config.mcpServers[body.name] = { command: body.command, ...common };
                 }
                 else {
-                    sendJson(res, 400, { error: "provide command[] or url" });
+                    sendJson(res, 400, { error: "provide command or url" });
                     return;
                 }
-                saveMcpConfig(config);
-                sendJson(res, 201, { ok: true, name: body.name });
+                saveMcpConfig(config, scope);
+                await syncMcpConnections();
+                const status = getMcpStatus()[body.name];
+                sendJson(res, 201, {
+                    ok: true,
+                    name: body.name,
+                    scope,
+                    connected: status?.connected ?? false,
+                    ...(status?.error ? { error: status.error } : {}),
+                    ...(status?.tools?.length ? { tools: status.tools } : {}),
+                });
                 return;
             }
             if (req.method === "DELETE" && pathname.startsWith("/v1/mcp/")) {
-                const name = decodeURIComponent(pathname.slice("/v1/mcp/".length));
+                const name = decodePathSegment(pathname.slice("/v1/mcp/".length));
                 if (!name) {
                     sendJson(res, 400, { error: "missing_name" });
                     return;
                 }
-                const { loadMcpConfig, saveMcpConfig } = await import("./mcp.js");
-                const config = loadMcpConfig();
+                const scope = url.searchParams.get("project") === "1" ? "project" : "global";
+                const { loadMcpConfigFile, saveMcpConfig } = await import("./mcp.js");
+                const config = loadMcpConfigFile(scope);
                 if (!config.mcpServers[name]) {
-                    sendJson(res, 404, { error: "mcp_not_found", name });
+                    sendJson(res, 404, { error: "mcp_not_found", name, scope, available: Object.keys(config.mcpServers) });
                     return;
                 }
                 delete config.mcpServers[name];
-                saveMcpConfig(config);
-                sendJson(res, 200, { ok: true, deleted: name });
+                saveMcpConfig(config, scope);
+                await syncMcpConnections();
+                sendJson(res, 200, { ok: true, deleted: name, scope });
+                return;
+            }
+            const mcpToggle = pathname.match(/^\/v1\/mcp\/([^/]+)\/(enable|disable)$/);
+            if (req.method === "POST" && mcpToggle) {
+                const name = decodePathSegment(mcpToggle[1]);
+                if (!name) {
+                    sendJson(res, 400, { error: "missing_name" });
+                    return;
+                }
+                const enabled = mcpToggle[2] === "enable";
+                const parsed = await readJsonBody(req);
+                const scope = parsed.ok && parsed.value.scope === "project" ? "project" : "global";
+                const { loadMcpConfigFile, saveMcpConfig } = await import("./mcp.js");
+                const config = loadMcpConfigFile(scope);
+                if (!config.mcpServers[name]) {
+                    const known = loadMcpConfigEntries().some((e) => e.name === name);
+                    sendJson(res, 404, {
+                        error: "mcp_not_found",
+                        name,
+                        scope,
+                        ...(known ? { hint: `server exists in another scope; pass the matching scope` } : { available: Object.keys(config.mcpServers) }),
+                    });
+                    return;
+                }
+                config.mcpServers[name].enabled = enabled;
+                saveMcpConfig(config, scope);
+                await syncMcpConnections();
+                sendJson(res, 200, { ok: true, name, enabled, scope, connected: getMcpStatus()[name]?.connected ?? false });
                 return;
             }
             // ─── Context / Compact ─────────────────────────────────────────────
             if (req.method === "GET" && pathname === "/v1/context") {
                 const config = loadConfig();
-                const ctxWindow = await getContextWindow(config.provider?.defaultModel);
+                const provider = getActiveProvider(config);
+                const ctxWindow = await getContextWindow(provider?.defaultModel);
                 sendJson(res, 200, {
                     context_window: ctxWindow,
-                    model: config.provider?.defaultModel ?? null,
+                    model: provider?.defaultModel ?? null,
                 });
                 return;
             }
+            if (req.method === "GET" && pathname === "/v1/cost") {
+                const config = loadConfig();
+                const provider = getActiveProvider(config);
+                const modelId = url.searchParams.get("model") ?? provider?.defaultModel ?? null;
+                const inputRaw = url.searchParams.get("input");
+                const outputRaw = url.searchParams.get("output");
+                const input = inputRaw ? parseInt(inputRaw, 10) : 0;
+                const output = outputRaw ? parseInt(outputRaw, 10) : 0;
+                if (Number.isNaN(input) || Number.isNaN(output) || input < 0 || output < 0) {
+                    sendJson(res, 400, { error: "invalid_tokens", detail: "input/output must be non-negative integers" });
+                    return;
+                }
+                const price = modelId ? await getModelPrice(modelId) : null;
+                const cost = price ? estimateCost({ inputTokens: input, outputTokens: output }, price) : null;
+                sendJson(res, 200, { model: modelId, price, cost_usd: cost });
+                return;
+            }
             if (req.method === "POST" && pathname === "/v1/chat/compact") {
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
+                const parsed = await readJsonBody(req);
+                if (!parsed.ok) {
+                    sendJsonError(res, parsed);
+                    return;
+                }
+                const body = parsed.value;
                 if (!body.session_id) {
                     sendJson(res, 400, { error: "missing_session_id" });
                     return;
@@ -676,6 +928,38 @@ export async function runServe(opts = {}) {
                 sendJson(res, 200, { ok: true, compacted: result.compacted, message_count: result.messages.length });
                 return;
             }
+            if (req.method === "POST" && pathname === "/v1/chat/undo") {
+                const parsed = await readJsonBody(req);
+                if (!parsed.ok) {
+                    sendJsonError(res, parsed);
+                    return;
+                }
+                const body = parsed.value;
+                if (!body.session_id) {
+                    sendJson(res, 400, { error: "missing_session_id" });
+                    return;
+                }
+                const session = loadSession(body.session_id);
+                if (!session) {
+                    sendJson(res, 404, { error: "session_not_found" });
+                    return;
+                }
+                let userIdx = -1;
+                for (let i = session.messages.length - 1; i >= 0; i--) {
+                    if (session.messages[i].role === "user") {
+                        userIdx = i;
+                        break;
+                    }
+                }
+                if (userIdx === -1) {
+                    sendJson(res, 400, { error: "no_user_message" });
+                    return;
+                }
+                session.messages = session.messages.slice(0, userIdx + 1);
+                saveSession(session.messages, body.session_id);
+                sendJson(res, 200, { ok: true, message_count: session.messages.length, messages: session.messages });
+                return;
+            }
             sendJson(res, 404, { error: "not_found", path: pathname });
         }
         catch (err) {
@@ -689,11 +973,16 @@ export async function runServe(opts = {}) {
             resolve();
         });
     });
-    const shutdown = async () => {
+    const closeServer = async () => {
         await shutdownMcp();
-        server.close();
+        server.closeAllConnections?.();
+        await new Promise((resolve) => server.close(() => resolve()));
+    };
+    const shutdown = async () => {
+        await closeServer();
         process.exit(0);
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
+    return { close: closeServer };
 }