min-agent 0.2.1 → 0.4.0

package/dist/serve.js

@@ -3,42 +3,40 @@
  * Run: min-agent serve [--host 127.0.0.1] [--port 8787]
  */
 import { createServer } from "http";
-import { readFileSync, existsSync } from "fs";
-import path from "path";
-import { initMcp, shutdownMcp, getMcpStatus } from "./mcp.js";
-import { discoverSkills, getSkills } from "./skills.js";
+import { timingSafeEqual } from "crypto";
+import { initMcp, shutdownMcp } from "./mcp.js";
+import { discoverSkills } from "./skills.js";
 import { loadInstructions } from "./instructions.js";
-import { loadConfig, fetchModels, isConfigured } from "./config.js";
+import { isConfigured } from "./config.js";
 import { setAutoApprove } from "./confirm.js";
-import { runOnce, buildUserContent } from "./agent.js";
-import { loadSession, saveSession, listSessions, deleteSession } from "./sessions.js";
-import { loadMemories, addMemory, deleteMemory, searchMemories } from "./memory.js";
-import { scanProject } from "./code-mode.js";
-import { compactMessages } from "./compaction.js";
-import { resolveModel } from "./provider.js";
-import { getContextWindow } from "./context-window.js";
-const MAX_BODY_BYTES = 2 * 1024 * 1024;
-const MAX_TOOL_RESULT_SSE_CHARS = 48_000;
-function packageVersion() {
+import { createApprovalGate } from "./http-approvals.js";
+import { packageVersion, corsEnabled, corsHeaders, sendJson, } from "./serve/common.js";
+import { handleChatRoutes } from "./serve/routes-chat.js";
+import { handleSessionRoutes } from "./serve/routes-sessions.js";
+import { handleMemoryRoutes } from "./serve/routes-memory.js";
+import { handleMcpRoutes } from "./serve/routes-mcp.js";
+import { handleSkillRoutes } from "./serve/routes-skills.js";
+import { handleMetaRoutes } from "./serve/routes-meta.js";
+/**
+ * With CORS enabled and no auth token, arbitrary web pages could drive the
+ * agent. Allow only same-machine origins (localhost) in that configuration;
+ * a token bypasses the origin check entirely.
+ */
+function originAllowed(req) {
+    if (process.env.MIN_AGENT_SERVE_TOKEN?.trim())
+        return true;
+    const origin = req.headers.origin?.trim();
+    if (!origin || origin === "null")
+        return true;
     try {
-        const pkgPath = path.join(process.cwd(), "package.json");
-        if (existsSync(pkgPath)) {
-            const j = JSON.parse(readFileSync(pkgPath, "utf-8"));
-            return j.version ?? "0.0.0";
-        }
+        const host = new URL(origin).hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "[::1]")
+            return true;
     }
-    catch { }
-    return "0.0.0";
-}
-function corsHeaders() {
-    if (process.env.MIN_AGENT_SERVE_CORS === "1" || process.env.MIN_AGENT_SERVE_CORS === "true") {
-        return {
-            "Access-Control-Allow-Origin": "*",
-            "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-            "Access-Control-Allow-Headers": "Content-Type, Authorization",
-        };
+    catch {
+        return false;
     }
-    return {};
+    return false;
 }
 function authOk(req) {
     const token = process.env.MIN_AGENT_SERVE_TOKEN?.trim();
@@ -47,57 +45,9 @@ function authOk(req) {
     const h = req.headers.authorization?.trim();
     if (!h?.startsWith("Bearer "))
         return false;
-    return h.slice(7) === token;
-}
-function sendJson(res, status, body) {
-    const headers = {
-        "Content-Type": "application/json; charset=utf-8",
-        ...corsHeaders(),
-    };
-    res.writeHead(status, headers);
-    res.end(JSON.stringify(body));
-}
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let total = 0;
-        req.on("data", (c) => {
-            total += c.length;
-            if (total > MAX_BODY_BYTES) {
-                reject(new Error("body_too_large"));
-                return;
-            }
-            chunks.push(c);
-        });
-        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-        req.on("error", reject);
-    });
-}
-function sseWrite(res, obj) {
-    try {
-        if (res.writableEnded)
-            return;
-        res.write(`data: ${JSON.stringify(obj)}\n\n`);
-    }
-    catch {
-        /* client gone */
-    }
-}
-function truncateForJson(v, max) {
-    if (typeof v === "string" && v.length > max)
-        return v.slice(0, max) + `\n… [truncated ${v.length - max} chars]`;
-    return v;
-}
-function normalizeMessages(body) {
-    if (body.messages && Array.isArray(body.messages)) {
-        if (body.messages.length === 0)
-            return { ok: false, error: "messages must be non-empty" };
-        return { ok: true, messages: [...body.messages] };
-    }
-    if (typeof body.message === "string" && body.message.length > 0) {
-        return { ok: true, messages: [{ role: "user", content: body.message }] };
-    }
-    return { ok: false, error: "Provide `message` (string) or non-empty `messages` array" };
+    const provided = Buffer.from(h.slice(7));
+    const expected = Buffer.from(token);
+    return provided.length === expected.length && timingSafeEqual(provided, expected);
 }
 export async function runServe(opts = {}) {
     if (!isConfigured()) {
@@ -106,13 +56,32 @@ export async function runServe(opts = {}) {
     }
     const host = opts.host ?? process.env.MIN_AGENT_SERVE_HOST ?? "127.0.0.1";
     const port = opts.port ?? parseInt(process.env.MIN_AGENT_SERVE_PORT ?? "8787", 10);
-    console.error("\x1b[33m⚠ min-agent serve: confirmations are auto-approved for this process (same as -y). Dangerous shell commands will run without prompts.\x1b[0m");
+    const isLoopbackHost = host === "127.0.0.1" || host === "::1" || host === "localhost";
+    if (!isLoopbackHost && !process.env.MIN_AGENT_SERVE_TOKEN?.trim()) {
+        console.error("Refusing to serve on a non-loopback address without MIN_AGENT_SERVE_TOKEN. " +
+            "Set the token (Authorization: Bearer <token>) or bind to 127.0.0.1.");
+        process.exit(1);
+    }
+    console.error("\x1b[33m⚠ min-agent serve: confirmations are auto-approved by default (same as -y). Set auto_approve: false with stream: true to require callbacks.\x1b[0m");
     setAutoApprove(true);
     console.error("\x1b[90m⟳ Initializing MCP, skills, instructions…\x1b[0m");
     await initMcp();
     discoverSkills();
-    let instructions = await loadInstructions();
-    const version = packageVersion();
+    const ctx = {
+        host,
+        version: packageVersion(),
+        instructions: await loadInstructions(),
+        approvalGate: createApprovalGate(),
+        activeChats: 0,
+    };
+    const routes = [
+        handleMetaRoutes,
+        handleChatRoutes,
+        handleSessionRoutes,
+        handleMemoryRoutes,
+        handleMcpRoutes,
+        handleSkillRoutes,
+    ];
     const server = createServer(async (req, res) => {
         const c = corsHeaders();
         if (req.method === "OPTIONS") {
@@ -121,560 +90,25 @@ export async function runServe(opts = {}) {
             return;
         }
         if (!authOk(req)) {
-            sendJson(res, 401, { error: "unauthorized", detail: "Set Authorization: Bearer <MIN_AGENT_SERVE_TOKEN> when MIN_AGENT_SERVE_TOKEN is set" });
+            sendJson(res, 401, {
+                error: "unauthorized",
+                detail: "Set Authorization: Bearer <MIN_AGENT_SERVE_TOKEN> when MIN_AGENT_SERVE_TOKEN is set",
+            });
+            return;
+        }
+        if (corsEnabled() && !originAllowed(req)) {
+            sendJson(res, 403, {
+                error: "origin_not_allowed",
+                detail: "CORS is enabled without a token; only localhost origins are allowed. Set MIN_AGENT_SERVE_TOKEN or disable CORS.",
+            });
             return;
         }
         const url = new URL(req.url ?? "/", `http://${host}`);
         const pathname = url.pathname.replace(/\/$/, "") || "/";
         try {
-            if (req.method === "GET" && pathname === "/health") {
-                sendJson(res, 200, { ok: true, service: "min-agent", version });
-                return;
-            }
-            if (req.method === "GET" && pathname === "/v1/meta") {
-                sendJson(res, 200, {
-                    version,
-                    cwd: process.cwd(),
-                    instructions_chars: instructions.join("\n").length,
-                });
-                return;
-            }
-            if (req.method === "GET" && pathname === "/v1/models") {
-                const config = loadConfig();
-                const base = config.provider?.baseURL;
-                const key = config.provider?.apiKey;
-                if (!base || !key) {
-                    sendJson(res, 500, { error: "provider_not_configured" });
-                    return;
-                }
-                const models = await fetchModels(base, key);
-                sendJson(res, 200, {
-                    default_model: config.provider?.defaultModel ?? null,
-                    models,
-                });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/chat/reload-instructions") {
-                instructions = await loadInstructions();
-                sendJson(res, 200, { ok: true, instructions_chars: instructions.join("\n").length });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/chat") {
-                if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-                    sendJson(res, 415, { error: "unsupported_media_type", detail: "Use Content-Type: application/json" });
-                    return;
-                }
-                let raw;
-                try {
-                    raw = await readBody(req);
-                }
-                catch (e) {
-                    if (e?.message === "body_too_large") {
-                        sendJson(res, 413, { error: "payload_too_large", max_bytes: MAX_BODY_BYTES });
-                        return;
-                    }
-                    throw e;
-                }
-                let body;
-                try {
-                    body = JSON.parse(raw);
-                }
-                catch {
-                    sendJson(res, 400, { error: "invalid_json" });
-                    return;
-                }
-                const modelId = typeof body.model === "string" ? body.model : undefined;
-                const stream = body.stream === true;
-                const sessionId = typeof body.session_id === "string" ? body.session_id : undefined;
-                let messages;
-                if (sessionId) {
-                    const session = loadSession(sessionId);
-                    if (!session) {
-                        sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
-                        return;
-                    }
-                    if (typeof body.message !== "string" || !body.message.trim()) {
-                        sendJson(res, 400, {
-                            error: "session_requires_message",
-                            detail: "With `session_id`, send a non-empty `message` for the new user turn",
-                        });
-                        return;
-                    }
-                    messages = [...session.messages];
-                    const content = body.images && body.images.length > 0 ? await buildUserContent(body.message, body.images) : body.message;
-                    messages.push({ role: "user", content });
-                }
-                else {
-                    const norm = normalizeMessages(body);
-                    if (!norm.ok) {
-                        sendJson(res, 400, { error: "invalid_body", detail: norm.error });
-                        return;
-                    }
-                    messages = norm.messages;
-                    if (body.images && body.images.length > 0) {
-                        const last = messages[messages.length - 1];
-                        if (!last || last.role !== "user" || typeof body.message !== "string") {
-                            sendJson(res, 400, {
-                                error: "images_require_message",
-                                detail: "With `images`, send a top-level `message` string for the user turn",
-                            });
-                            return;
-                        }
-                        messages[messages.length - 1] = {
-                            role: "user",
-                            content: await buildUserContent(body.message, body.images),
-                        };
-                    }
-                }
-                const abort = new AbortController();
-                req.on("close", () => abort.abort());
-                if (stream) {
-                    res.writeHead(200, {
-                        "Content-Type": "text/event-stream; charset=utf-8",
-                        "Cache-Control": "no-cache, no-transform",
-                        Connection: "keep-alive",
-                        "X-Accel-Buffering": "no",
-                        ...c,
-                    });
-                    res.flushHeaders?.();
-                    const toolCalls = [];
-                    const toolResults = [];
-                    const callbacks = {
-                        onAssistantDisplayDelta(delta) {
-                            sseWrite(res, { type: "assistant", text: delta });
-                        },
-                        onThinkingDelta(delta) {
-                            sseWrite(res, { type: "thinking", text: delta });
-                        },
-                        onToolCall(name, input) {
-                            toolCalls.push({ name, input });
-                            sseWrite(res, { type: "tool_call", name, input });
-                        },
-                        onToolResult(name, output) {
-                            const out = truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS);
-                            toolResults.push({ name, output: out });
-                            sseWrite(res, { type: "tool_result", name, output: out });
-                        },
-                        onCompaction(line) {
-                            sseWrite(res, { type: "compaction", line });
-                        },
-                        onStreamError(message) {
-                            sseWrite(res, { type: "error", message });
-                        },
-                        onRunFinish(info) {
-                            let saved;
-                            if (sessionId && messages.length > 0) {
-                                try {
-                                    saved = saveSession(messages, sessionId);
-                                }
-                                catch {
-                                    saved = undefined;
-                                }
-                            }
-                            sseWrite(res, {
-                                type: "done",
-                                step_count: info.stepCount,
-                                usage: info.usage,
-                                has_error: info.hasError,
-                                aborted: info.aborted,
-                                session_id: saved,
-                                messages,
-                            });
-                            if (!res.writableEnded)
-                                res.end();
-                        },
-                    };
-                    try {
-                        await runOnce(messages, instructions, modelId, abort.signal, callbacks);
-                    }
-                    catch (err) {
-                        if (!res.writableEnded) {
-                            sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
-                            res.end();
-                        }
-                    }
+            for (const route of routes) {
+                if (await route(req, res, ctx, url, pathname))
                     return;
-                }
-                const toolCalls = [];
-                const toolResults = [];
-                const finishBox = { info: null };
-                await runOnce(messages, instructions, modelId, abort.signal, {
-                    onToolCall(name, input) {
-                        toolCalls.push({ name, input });
-                    },
-                    onToolResult(name, output) {
-                        toolResults.push({ name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) });
-                    },
-                    onRunFinish(info) {
-                        finishBox.info = info;
-                    },
-                });
-                const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-                let savedSession;
-                if (sessionId && messages.length > 0) {
-                    try {
-                        savedSession = saveSession(messages, sessionId);
-                    }
-                    catch {
-                        savedSession = undefined;
-                    }
-                }
-                const fi = finishBox.info;
-                sendJson(res, 200, {
-                    messages,
-                    assistant: lastAssistant ?? null,
-                    tool_calls: toolCalls,
-                    tool_results: toolResults,
-                    session_id: savedSession,
-                    step_count: fi?.stepCount ?? 0,
-                    usage: fi?.usage ?? null,
-                    has_error: fi?.hasError ?? false,
-                    aborted: fi?.aborted ?? false,
-                });
-                return;
-            }
-            // ─── Sessions ──────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/sessions") {
-                const sessions = listSessions();
-                sendJson(res, 200, { sessions });
-                return;
-            }
-            if (req.method === "DELETE" && pathname.startsWith("/v1/sessions/")) {
-                const id = pathname.slice("/v1/sessions/".length);
-                if (!id) {
-                    sendJson(res, 400, { error: "missing_session_id" });
-                    return;
-                }
-                const ok = deleteSession(id);
-                if (!ok) {
-                    sendJson(res, 404, { error: "session_not_found", session_id: id });
-                    return;
-                }
-                sendJson(res, 200, { ok: true, deleted: id });
-                return;
-            }
-            // ─── Memory ────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/memory") {
-                const memories = loadMemories();
-                sendJson(res, 200, { memories });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/memory") {
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
-                if (!body.content) {
-                    sendJson(res, 400, { error: "missing_content" });
-                    return;
-                }
-                const memory = addMemory(body.content, body.tags ?? []);
-                sendJson(res, 201, { ok: true, memory });
-                return;
-            }
-            if (req.method === "GET" && pathname === "/v1/memory/search") {
-                const query = url.searchParams.get("q") ?? "";
-                if (!query) {
-                    sendJson(res, 400, { error: "missing_query_param_q" });
-                    return;
-                }
-                const results = searchMemories(query);
-                sendJson(res, 200, { results });
-                return;
-            }
-            if (req.method === "DELETE" && pathname.startsWith("/v1/memory/")) {
-                const idx = parseInt(pathname.slice("/v1/memory/".length));
-                if (isNaN(idx)) {
-                    sendJson(res, 400, { error: "invalid_index" });
-                    return;
-                }
-                const ok = deleteMemory(idx - 1);
-                if (!ok) {
-                    sendJson(res, 404, { error: "memory_not_found", index: idx });
-                    return;
-                }
-                sendJson(res, 200, { ok: true, deleted: idx });
-                return;
-            }
-            // ─── MCP ───────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/mcp") {
-                const status = getMcpStatus();
-                sendJson(res, 200, { servers: status });
-                return;
-            }
-            // ─── Skills ────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/skills") {
-                const skills = getSkills();
-                sendJson(res, 200, {
-                    skills: skills.map((s) => ({ name: s.name, description: s.description, location: s.location })),
-                });
-                return;
-            }
-            // ─── Rules ─────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/rules") {
-                sendJson(res, 200, {
-                    count: instructions.length,
-                    rules: instructions.map((inst) => {
-                        const firstLine = inst.split("\n")[0] ?? "";
-                        return { source: firstLine.replace("Instructions from: ", ""), chars: inst.length };
-                    }),
-                });
-                return;
-            }
-            // ─── Project (code mode scan) ──────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/project") {
-                const project = scanProject();
-                sendJson(res, 200, { project });
-                return;
-            }
-            // ─── Code mode chat ────────────────────────────────────────────────
-            if (req.method === "POST" && pathname === "/v1/code") {
-                if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-                    sendJson(res, 415, { error: "unsupported_media_type" });
-                    return;
-                }
-                let raw;
-                try {
-                    raw = await readBody(req);
-                }
-                catch {
-                    sendJson(res, 413, { error: "payload_too_large" });
-                    return;
-                }
-                let body;
-                try {
-                    body = JSON.parse(raw);
-                }
-                catch {
-                    sendJson(res, 400, { error: "invalid_json" });
-                    return;
-                }
-                const modelId = typeof body.model === "string" ? body.model : undefined;
-                const stream = body.stream === true;
-                const sessionId = typeof body.session_id === "string" ? body.session_id : undefined;
-                // Build code-mode system prompt
-                const { buildCodeSystemPrompt } = await import("./code-mode.js");
-                const project = scanProject();
-                const codeSystemPrompt = buildCodeSystemPrompt(project, instructions);
-                let messages;
-                if (sessionId) {
-                    const session = loadSession(sessionId);
-                    if (!session) {
-                        sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
-                        return;
-                    }
-                    if (!body.message) {
-                        sendJson(res, 400, { error: "session_requires_message" });
-                        return;
-                    }
-                    messages = [...session.messages];
-                    const content = body.images?.length ? await buildUserContent(body.message, body.images) : body.message;
-                    messages.push({ role: "user", content });
-                }
-                else {
-                    const norm = normalizeMessages(body);
-                    if (!norm.ok) {
-                        sendJson(res, 400, { error: "invalid_body", detail: norm.error });
-                        return;
-                    }
-                    messages = norm.messages;
-                }
-                const abort = new AbortController();
-                req.on("close", () => abort.abort());
-                // Use runOnce with code system prompt override
-                const { runOnceWithSystem } = await import("./agent.js");
-                if (stream) {
-                    res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache", Connection: "keep-alive", ...c });
-                    res.flushHeaders?.();
-                    const callbacks = {
-                        onAssistantDisplayDelta(delta) { sseWrite(res, { type: "assistant", text: delta }); },
-                        onThinkingDelta(delta) { sseWrite(res, { type: "thinking", text: delta }); },
-                        onToolCall(name, input) { sseWrite(res, { type: "tool_call", name, input }); },
-                        onToolResult(name, output) { sseWrite(res, { type: "tool_result", name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) }); },
-                        onCompaction(line) { sseWrite(res, { type: "compaction", line }); },
-                        onStreamError(message) { sseWrite(res, { type: "error", message }); },
-                        onRunFinish(info) {
-                            let saved;
-                            if (sessionId && messages.length > 0) {
-                                try {
-                                    saved = saveSession(messages, sessionId);
-                                }
-                                catch { }
-                            }
-                            sseWrite(res, { type: "done", step_count: info.stepCount, usage: info.usage, has_error: info.hasError, session_id: saved, messages, mode: "code", project });
-                            if (!res.writableEnded)
-                                res.end();
-                        },
-                    };
-                    try {
-                        await runOnceWithSystem(messages, codeSystemPrompt, modelId, abort.signal, callbacks);
-                    }
-                    catch (err) {
-                        if (!res.writableEnded) {
-                            sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
-                            res.end();
-                        }
-                    }
-                }
-                else {
-                    const toolCalls = [];
-                    const toolResults = [];
-                    const finishBox = { info: null };
-                    await runOnceWithSystem(messages, codeSystemPrompt, modelId, abort.signal, {
-                        onToolCall(name, input) { toolCalls.push({ name, input }); },
-                        onToolResult(name, output) { toolResults.push({ name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) }); },
-                        onRunFinish(info) { finishBox.info = info; },
-                    });
-                    const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-                    let saved;
-                    if (sessionId && messages.length > 0) {
-                        try {
-                            saved = saveSession(messages, sessionId);
-                        }
-                        catch { }
-                    }
-                    const fi = finishBox.info;
-                    sendJson(res, 200, { mode: "code", project, messages, assistant: lastAssistant ?? null, tool_calls: toolCalls, tool_results: toolResults, session_id: saved, step_count: fi?.stepCount ?? 0, usage: fi?.usage ?? null, has_error: fi?.hasError ?? false });
-                }
-                return;
-            }
-            // ─── MCP management ────────────────────────────────────────────────
-            if (req.method === "POST" && pathname === "/v1/paste") {
-                if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-                    sendJson(res, 415, { error: "unsupported_media_type" });
-                    return;
-                }
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
-                if (!body.image_base64) {
-                    sendJson(res, 400, { error: "missing_image_base64" });
-                    return;
-                }
-                const imageBuffer = Buffer.from(body.image_base64, "base64");
-                const mimeType = body.mime_type ?? "image/png";
-                const text = body.message ?? "What's in this image?";
-                const modelId = body.model;
-                const sessionId = body.session_id;
-                const stream = body.stream === true;
-                let messages = [];
-                if (sessionId) {
-                    const session = loadSession(sessionId);
-                    if (session)
-                        messages = [...session.messages];
-                }
-                const content = [
-                    { type: "text", text },
-                    { type: "image", image: imageBuffer, mimeType },
-                ];
-                messages.push({ role: "user", content });
-                const abort = new AbortController();
-                req.on("close", () => abort.abort());
-                if (stream) {
-                    res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache", Connection: "keep-alive", ...c });
-                    res.flushHeaders?.();
-                    const callbacks = {
-                        onAssistantDisplayDelta(delta) { sseWrite(res, { type: "assistant", text: delta }); },
-                        onThinkingDelta(delta) { sseWrite(res, { type: "thinking", text: delta }); },
-                        onToolCall(name, input) { sseWrite(res, { type: "tool_call", name, input }); },
-                        onToolResult(name, output) { sseWrite(res, { type: "tool_result", name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) }); },
-                        onStreamError(message) { sseWrite(res, { type: "error", message }); },
-                        onRunFinish(info) {
-                            let saved;
-                            if (sessionId) {
-                                try {
-                                    saved = saveSession(messages, sessionId);
-                                }
-                                catch { }
-                            }
-                            sseWrite(res, { type: "done", step_count: info.stepCount, usage: info.usage, session_id: saved });
-                            if (!res.writableEnded)
-                                res.end();
-                        },
-                    };
-                    await runOnce(messages, instructions, modelId, abort.signal, callbacks);
-                }
-                else {
-                    await runOnce(messages, instructions, modelId, abort.signal);
-                    const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-                    let saved;
-                    if (sessionId) {
-                        try {
-                            saved = saveSession(messages, sessionId);
-                        }
-                        catch { }
-                    }
-                    sendJson(res, 200, { messages, assistant: lastAssistant ?? null, session_id: saved });
-                }
-                return;
-            }
-            // ─── MCP management (continued) ───────────────────────────────────
-            if (req.method === "POST" && pathname === "/v1/mcp") {
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
-                if (!body.name) {
-                    sendJson(res, 400, { error: "missing_name" });
-                    return;
-                }
-                const { loadMcpConfig, saveMcpConfig } = await import("./mcp.js");
-                const config = loadMcpConfig();
-                if (body.url) {
-                    config.mcpServers[body.name] = { url: body.url, token: body.token, enabled: body.enabled !== false };
-                }
-                else if (body.command && body.command.length > 0) {
-                    config.mcpServers[body.name] = { command: body.command, enabled: body.enabled !== false };
-                }
-                else {
-                    sendJson(res, 400, { error: "provide command[] or url" });
-                    return;
-                }
-                saveMcpConfig(config);
-                sendJson(res, 201, { ok: true, name: body.name });
-                return;
-            }
-            if (req.method === "DELETE" && pathname.startsWith("/v1/mcp/")) {
-                const name = decodeURIComponent(pathname.slice("/v1/mcp/".length));
-                if (!name) {
-                    sendJson(res, 400, { error: "missing_name" });
-                    return;
-                }
-                const { loadMcpConfig, saveMcpConfig } = await import("./mcp.js");
-                const config = loadMcpConfig();
-                if (!config.mcpServers[name]) {
-                    sendJson(res, 404, { error: "mcp_not_found", name });
-                    return;
-                }
-                delete config.mcpServers[name];
-                saveMcpConfig(config);
-                sendJson(res, 200, { ok: true, deleted: name });
-                return;
-            }
-            // ─── Context / Compact ─────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/context") {
-                const config = loadConfig();
-                const ctxWindow = await getContextWindow(config.provider?.defaultModel);
-                sendJson(res, 200, {
-                    context_window: ctxWindow,
-                    model: config.provider?.defaultModel ?? null,
-                });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/chat/compact") {
-                const raw = await readBody(req);
-                const body = JSON.parse(raw);
-                if (!body.session_id) {
-                    sendJson(res, 400, { error: "missing_session_id" });
-                    return;
-                }
-                const session = loadSession(body.session_id);
-                if (!session) {
-                    sendJson(res, 404, { error: "session_not_found" });
-                    return;
-                }
-                const model = resolveModel();
-                const result = await compactMessages(session.messages, model, { autoContinue: false });
-                if (result.compacted) {
-                    saveSession(result.messages, body.session_id);
-                }
-                sendJson(res, 200, { ok: true, compacted: result.compacted, message_count: result.messages.length });
-                return;
             }
             sendJson(res, 404, { error: "not_found", path: pathname });
         }
@@ -689,11 +123,16 @@ export async function runServe(opts = {}) {
             resolve();
         });
     });
-    const shutdown = async () => {
+    const closeServer = async () => {
         await shutdownMcp();
-        server.close();
+        server.closeAllConnections?.();
+        await new Promise((resolve) => server.close(() => resolve()));
+    };
+    const shutdown = async () => {
+        await closeServer();
         process.exit(0);
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
+    return { close: closeServer };
 }