min-agent 0.3.0 → 0.4.0

package/dist/serve.js

@@ -3,51 +3,20 @@
  * Run: min-agent serve [--host 127.0.0.1] [--port 8787]
  */
 import { createServer } from "http";
-import { readFileSync } from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
 import { timingSafeEqual } from "crypto";
-import { initMcp, shutdownMcp, getMcpStatus, syncMcpConnections, loadMcpConfigEntries } from "./mcp.js";
-import { discoverSkills, getAllSkills, getSkill, getStaleDisabledSkills, setSkillEnabled } from "./skills.js";
+import { initMcp, shutdownMcp } from "./mcp.js";
+import { discoverSkills } from "./skills.js";
 import { loadInstructions } from "./instructions.js";
-import { loadConfig, fetchModels, isConfigured, getActiveProvider } from "./config.js";
+import { isConfigured } from "./config.js";
 import { setAutoApprove } from "./confirm.js";
-import { runOnce, runOnceWithSystem, buildUserContent } from "./agent.js";
-import { loadSession, saveSession, listSessions, deleteSession, renameSession, sanitizeForStorage } from "./sessions.js";
-import { loadMemories, addMemory, deleteMemory, searchMemories } from "./memory.js";
-import { scanProject, buildCodeSystemPrompt } from "./code-mode.js";
-import { compactMessages, TokenTracker } from "./compaction.js";
-import { resolveModel } from "./provider.js";
-import { getContextWindow } from "./context-window.js";
-import { getModelPrice, estimateCost } from "./pricing.js";
-const MAX_BODY_BYTES = 2 * 1024 * 1024;
-const BODY_TIMEOUT_MS = 30_000;
-const MAX_TOOL_RESULT_SSE_CHARS = 48_000;
-const MAX_CONCURRENT_CHATS = 8;
-let activeChats = 0;
-function packageVersion() {
-    try {
-        const pkgPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../package.json");
-        const j = JSON.parse(readFileSync(pkgPath, "utf-8"));
-        return j.version ?? "0.0.0";
-    }
-    catch { }
-    return "0.0.0";
-}
-function corsEnabled() {
-    const v = process.env.MIN_AGENT_SERVE_CORS;
-    return v === "1" || v === "true";
-}
-function corsHeaders() {
-    if (corsEnabled()) {
-        return {
-            "Access-Control-Allow-Origin": "*",
-            "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-            "Access-Control-Allow-Headers": "Content-Type, Authorization",
-        };
-    }
-    return {};
-}
+import { createApprovalGate } from "./http-approvals.js";
+import { packageVersion, corsEnabled, corsHeaders, sendJson, } from "./serve/common.js";
+import { handleChatRoutes } from "./serve/routes-chat.js";
+import { handleSessionRoutes } from "./serve/routes-sessions.js";
+import { handleMemoryRoutes } from "./serve/routes-memory.js";
+import { handleMcpRoutes } from "./serve/routes-mcp.js";
+import { handleSkillRoutes } from "./serve/routes-skills.js";
+import { handleMetaRoutes } from "./serve/routes-meta.js";
 /**
  * With CORS enabled and no auth token, arbitrary web pages could drive the
  * agent. Allow only same-machine origins (localhost) in that configuration;
@@ -80,192 +49,6 @@ function authOk(req) {
     const expected = Buffer.from(token);
     return provided.length === expected.length && timingSafeEqual(provided, expected);
 }
-function skillPayload(s) {
-    return {
-        name: s.name,
-        description: s.description,
-        location: s.location,
-        enabled: s.enabled,
-        ...(s.disabledScope ? { disabled_scope: s.disabledScope } : {}),
-        ...(s.version ? { version: s.version } : {}),
-        ...(s.allowedTools.length ? { allowed_tools: s.allowedTools } : {}),
-        ...(s.requiredBins.length ? { requires_bins: s.requiredBins } : {}),
-    };
-}
-function sendJson(res, status, body) {
-    const headers = {
-        "Content-Type": "application/json; charset=utf-8",
-        ...corsHeaders(),
-    };
-    res.writeHead(status, headers);
-    res.end(JSON.stringify(body));
-}
-/** Decode a URL path segment without letting malformed escapes become a 500. */
-function decodePathSegment(raw) {
-    try {
-        return decodeURIComponent(raw);
-    }
-    catch {
-        return null;
-    }
-}
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let total = 0;
-        const timer = setTimeout(() => {
-            req.destroy();
-            reject(new Error("body_timeout"));
-        }, BODY_TIMEOUT_MS);
-        req.on("data", (c) => {
-            total += c.length;
-            if (total > MAX_BODY_BYTES) {
-                clearTimeout(timer);
-                req.removeAllListeners("data");
-                req.pause();
-                reject(new Error("body_too_large"));
-                return;
-            }
-            chunks.push(c);
-        });
-        req.on("end", () => {
-            clearTimeout(timer);
-            resolve(Buffer.concat(chunks).toString("utf-8"));
-        });
-        req.on("error", (e) => {
-            clearTimeout(timer);
-            reject(e);
-        });
-    });
-}
-async function readJsonBody(req) {
-    let raw;
-    try {
-        raw = await readBody(req);
-    }
-    catch (e) {
-        if (e?.message === "body_too_large") {
-            return { ok: false, status: 413, error: "payload_too_large" };
-        }
-        if (e?.message === "body_timeout") {
-            return { ok: false, status: 408, error: "payload_timeout" };
-        }
-        throw e;
-    }
-    try {
-        return { ok: true, value: JSON.parse(raw) };
-    }
-    catch {
-        return { ok: false, status: 400, error: "invalid_json" };
-    }
-}
-function sendJsonError(res, e) {
-    if (e.status === 413) {
-        // The request body was abandoned mid-stream; drop keep-alive so the
-        // connection cannot be reused for a second request.
-        res.shouldKeepAlive = false;
-    }
-    sendJson(res, e.status, e.status === 413 ? { error: e.error, max_bytes: MAX_BODY_BYTES } : { error: e.error });
-}
-function sseWrite(res, obj) {
-    try {
-        if (res.writableEnded)
-            return;
-        res.write(`data: ${JSON.stringify(obj)}\n\n`);
-    }
-    catch {
-        /* client gone */
-    }
-}
-function truncateForJson(v, max) {
-    if (typeof v === "string" && v.length > max)
-        return v.slice(0, max) + `\n… [truncated ${v.length - max} chars]`;
-    return v;
-}
-function sseHeaders(cors) {
-    return {
-        "Content-Type": "text/event-stream; charset=utf-8",
-        "Cache-Control": "no-cache, no-transform",
-        Connection: "keep-alive",
-        "X-Accel-Buffering": "no",
-        ...cors,
-    };
-}
-function createSseCallbacks(res, messages, opts = {}) {
-    return {
-        onAssistantDisplayDelta(delta) {
-            sseWrite(res, { type: "assistant", text: delta });
-        },
-        onThinkingDelta(delta) {
-            sseWrite(res, { type: "thinking", text: delta });
-        },
-        onToolCall(name, input) {
-            sseWrite(res, { type: "tool_call", name, input: truncateForJson(input, MAX_TOOL_RESULT_SSE_CHARS) });
-        },
-        onToolResult(name, output) {
-            sseWrite(res, { type: "tool_result", name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) });
-        },
-        onCompaction(line) {
-            sseWrite(res, { type: "compaction", line });
-        },
-        onStreamError(message) {
-            sseWrite(res, { type: "error", message });
-        },
-        onRunFinish(info) {
-            let saved;
-            if (opts.sessionId && messages.length > 0) {
-                try {
-                    saved = saveSession(messages, opts.sessionId);
-                }
-                catch {
-                    saved = undefined;
-                }
-            }
-            sseWrite(res, {
-                type: "done",
-                step_count: info.stepCount,
-                usage: info.usage,
-                has_error: info.hasError,
-                aborted: info.aborted,
-                max_steps_reached: info.maxStepsReached,
-                budget_exceeded: info.budgetExceeded ?? false,
-                session_id: saved,
-                messages: sanitizeForStorage(messages),
-                ...(opts.codeMode ? { mode: "code", project: opts.project } : {}),
-            });
-            if (!res.writableEnded)
-                res.end();
-        },
-    };
-}
-function createJsonCallbacks() {
-    const toolCalls = [];
-    const toolResults = [];
-    let finishInfo = null;
-    const callbacks = {
-        onToolCall(name, input) {
-            toolCalls.push({ name, input: truncateForJson(input, MAX_TOOL_RESULT_SSE_CHARS) });
-        },
-        onToolResult(name, output) {
-            toolResults.push({ name, output: truncateForJson(output, MAX_TOOL_RESULT_SSE_CHARS) });
-        },
-        onRunFinish(info) {
-            finishInfo = info;
-        },
-    };
-    return { callbacks, toolCalls, toolResults, finishInfo: () => finishInfo };
-}
-function normalizeMessages(body) {
-    if (body.messages && Array.isArray(body.messages)) {
-        if (body.messages.length === 0)
-            return { ok: false, error: "messages must be non-empty" };
-        return { ok: true, messages: [...body.messages] };
-    }
-    if (typeof body.message === "string" && body.message.length > 0) {
-        return { ok: true, messages: [{ role: "user", content: body.message }] };
-    }
-    return { ok: false, error: "Provide `message` (string) or non-empty `messages` array" };
-}
 export async function runServe(opts = {}) {
     if (!isConfigured()) {
         console.error("Not configured. Run: min-agent setup");
@@ -279,139 +62,26 @@ export async function runServe(opts = {}) {
             "Set the token (Authorization: Bearer <token>) or bind to 127.0.0.1.");
         process.exit(1);
     }
-    console.error("\x1b[33m⚠ min-agent serve: confirmations are auto-approved for this process (same as -y). Dangerous shell commands will run without prompts.\x1b[0m");
+    console.error("\x1b[33m⚠ min-agent serve: confirmations are auto-approved by default (same as -y). Set auto_approve: false with stream: true to require callbacks.\x1b[0m");
     setAutoApprove(true);
     console.error("\x1b[90m⟳ Initializing MCP, skills, instructions…\x1b[0m");
     await initMcp();
     discoverSkills();
-    let instructions = await loadInstructions();
-    const version = packageVersion();
-    /** Shared handler for /v1/chat and /v1/code (streaming + JSON). */
-    async function handleChatRequest(req, res, codeMode) {
-        const c = corsHeaders();
-        if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-            sendJson(res, 415, { error: "unsupported_media_type", detail: "Use Content-Type: application/json" });
-            return;
-        }
-        if (activeChats >= MAX_CONCURRENT_CHATS) {
-            sendJson(res, 429, { error: "too_many_concurrent_requests", detail: `Max ${MAX_CONCURRENT_CHATS} concurrent chats` });
-            return;
-        }
-        activeChats++;
-        try {
-            const parsed = await readJsonBody(req);
-            if (!parsed.ok) {
-                sendJsonError(res, parsed);
-                return;
-            }
-            const body = parsed.value;
-            const modelId = typeof body.model === "string" ? body.model : undefined;
-            const stream = body.stream === true;
-            const sessionId = typeof body.session_id === "string" ? body.session_id : undefined;
-            let messages;
-            if (sessionId) {
-                const session = loadSession(sessionId);
-                if (!session) {
-                    sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
-                    return;
-                }
-                if (typeof body.message !== "string" || !body.message.trim()) {
-                    sendJson(res, 400, {
-                        error: "session_requires_message",
-                        detail: "With `session_id`, send a non-empty `message` for the new user turn",
-                    });
-                    return;
-                }
-                messages = [...session.messages];
-                const content = body.images && body.images.length > 0 ? await buildUserContent(body.message, body.images) : body.message;
-                messages.push({ role: "user", content });
-            }
-            else {
-                const norm = normalizeMessages(body);
-                if (!norm.ok) {
-                    sendJson(res, 400, { error: "invalid_body", detail: norm.error });
-                    return;
-                }
-                messages = norm.messages;
-                if (body.images && body.images.length > 0) {
-                    const last = messages[messages.length - 1];
-                    if (!last || last.role !== "user" || typeof body.message !== "string") {
-                        sendJson(res, 400, {
-                            error: "images_require_message",
-                            detail: "With `images`, send a top-level `message` string for the user turn",
-                        });
-                        return;
-                    }
-                    messages[messages.length - 1] = {
-                        role: "user",
-                        content: await buildUserContent(body.message, body.images),
-                    };
-                }
-            }
-            const abort = new AbortController();
-            res.on("close", () => abort.abort());
-            const tracker = new TokenTracker();
-            const runOptions = {
-                temperature: typeof body.temperature === "number" ? body.temperature : undefined,
-                maxTokens: typeof body.maxTokens === "number" ? body.maxTokens : undefined,
-                topP: typeof body.topP === "number" ? body.topP : undefined,
-                providerName: typeof body.provider === "string" ? body.provider : undefined,
-            };
-            let codeSystemPrompt;
-            let project;
-            if (codeMode) {
-                project = scanProject();
-                codeSystemPrompt = buildCodeSystemPrompt(project, instructions);
-            }
-            const run = (callbacks) => codeMode
-                ? runOnceWithSystem(messages, codeSystemPrompt, modelId, abort.signal, callbacks, tracker, runOptions)
-                : runOnce(messages, instructions, modelId, abort.signal, callbacks, tracker, runOptions);
-            if (stream) {
-                res.writeHead(200, sseHeaders(c));
-                res.flushHeaders?.();
-                const callbacks = createSseCallbacks(res, messages, { sessionId, codeMode, project });
-                try {
-                    await run(callbacks);
-                }
-                catch (err) {
-                    if (!res.writableEnded) {
-                        sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
-                        res.end();
-                    }
-                }
-                return;
-            }
-            const { callbacks, toolCalls, toolResults, finishInfo } = createJsonCallbacks();
-            await run(callbacks);
-            const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-            let savedSession;
-            if (sessionId && messages.length > 0) {
-                try {
-                    savedSession = saveSession(messages, sessionId);
-                }
-                catch {
-                    savedSession = undefined;
-                }
-            }
-            const fi = finishInfo();
-            sendJson(res, 200, {
-                messages: sanitizeForStorage(messages),
-                assistant: lastAssistant ?? null,
-                tool_calls: toolCalls,
-                tool_results: toolResults,
-                session_id: savedSession,
-                step_count: fi?.stepCount ?? 0,
-                usage: fi?.usage ?? null,
-                has_error: fi?.hasError ?? false,
-                aborted: fi?.aborted ?? false,
-                max_steps_reached: fi?.maxStepsReached ?? false,
-                ...(codeMode ? { mode: "code", project } : {}),
-            });
-        }
-        finally {
-            activeChats--;
-        }
-    }
+    const ctx = {
+        host,
+        version: packageVersion(),
+        instructions: await loadInstructions(),
+        approvalGate: createApprovalGate(),
+        activeChats: 0,
+    };
+    const routes = [
+        handleMetaRoutes,
+        handleChatRoutes,
+        handleSessionRoutes,
+        handleMemoryRoutes,
+        handleMcpRoutes,
+        handleSkillRoutes,
+    ];
     const server = createServer(async (req, res) => {
         const c = corsHeaders();
         if (req.method === "OPTIONS") {
@@ -420,7 +90,10 @@ export async function runServe(opts = {}) {
             return;
         }
         if (!authOk(req)) {
-            sendJson(res, 401, { error: "unauthorized", detail: "Set Authorization: Bearer <MIN_AGENT_SERVE_TOKEN> when MIN_AGENT_SERVE_TOKEN is set" });
+            sendJson(res, 401, {
+                error: "unauthorized",
+                detail: "Set Authorization: Bearer <MIN_AGENT_SERVE_TOKEN> when MIN_AGENT_SERVE_TOKEN is set",
+            });
             return;
         }
         if (corsEnabled() && !originAllowed(req)) {
@@ -433,532 +106,9 @@ export async function runServe(opts = {}) {
         const url = new URL(req.url ?? "/", `http://${host}`);
         const pathname = url.pathname.replace(/\/$/, "") || "/";
         try {
-            if (req.method === "GET" && pathname === "/health") {
-                sendJson(res, 200, { ok: true, service: "min-agent", version });
-                return;
-            }
-            if (req.method === "GET" && pathname === "/v1/meta") {
-                sendJson(res, 200, {
-                    version,
-                    cwd: process.cwd(),
-                    instructions_chars: instructions.join("\n").length,
-                });
-                return;
-            }
-            if (req.method === "GET" && pathname === "/v1/models") {
-                const config = loadConfig();
-                const provider = getActiveProvider(config);
-                const base = provider?.baseURL;
-                const key = provider?.apiKey;
-                if (!base || !key) {
-                    sendJson(res, 500, { error: "provider_not_configured" });
-                    return;
-                }
-                const models = await fetchModels(base, key);
-                sendJson(res, 200, {
-                    default_model: provider?.defaultModel ?? null,
-                    models,
-                });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/chat/reload-instructions") {
-                instructions = await loadInstructions();
-                sendJson(res, 200, { ok: true, instructions_chars: instructions.join("\n").length });
-                return;
-            }
-            if (req.method === "POST" && (pathname === "/v1/chat" || pathname === "/v1/code")) {
-                await handleChatRequest(req, res, pathname === "/v1/code");
-                return;
-            }
-            // ─── Sessions ──────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/sessions") {
-                const sessions = listSessions();
-                sendJson(res, 200, { sessions });
-                return;
-            }
-            if (req.method === "DELETE" && pathname.startsWith("/v1/sessions/")) {
-                const id = decodePathSegment(pathname.slice("/v1/sessions/".length));
-                if (!id) {
-                    sendJson(res, 400, { error: "missing_session_id" });
-                    return;
-                }
-                const ok = deleteSession(id);
-                if (!ok) {
-                    sendJson(res, 404, { error: "session_not_found", session_id: id });
-                    return;
-                }
-                sendJson(res, 200, { ok: true, deleted: id });
-                return;
-            }
-            if (req.method === "GET" && pathname.startsWith("/v1/sessions/")) {
-                const id = decodePathSegment(pathname.slice("/v1/sessions/".length));
-                if (!id) {
-                    sendJson(res, 400, { error: "missing_session_id" });
-                    return;
-                }
-                const session = loadSession(id);
-                if (!session) {
-                    sendJson(res, 404, { error: "session_not_found", session_id: id });
-                    return;
-                }
-                sendJson(res, 200, { session });
-                return;
-            }
-            if (req.method === "POST" && pathname.startsWith("/v1/sessions/") && pathname.endsWith("/rename")) {
-                const id = decodePathSegment(pathname.slice("/v1/sessions/".length, -"/rename".length));
-                if (!id) {
-                    sendJson(res, 400, { error: "missing_session_id" });
-                    return;
-                }
-                const parsed = await readJsonBody(req);
-                if (!parsed.ok) {
-                    sendJsonError(res, parsed);
-                    return;
-                }
-                const title = parsed.value.title?.trim();
-                if (!title) {
-                    sendJson(res, 400, { error: "missing_title" });
-                    return;
-                }
-                if (!renameSession(id, title)) {
-                    sendJson(res, 404, { error: "session_not_found", session_id: id });
-                    return;
-                }
-                sendJson(res, 200, { ok: true, session_id: id, title });
-                return;
-            }
-            // ─── Memory ────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/memory") {
-                const memories = loadMemories();
-                sendJson(res, 200, { memories });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/memory") {
-                const parsed = await readJsonBody(req);
-                if (!parsed.ok) {
-                    sendJsonError(res, parsed);
-                    return;
-                }
-                const body = parsed.value;
-                if (!body.content) {
-                    sendJson(res, 400, { error: "missing_content" });
-                    return;
-                }
-                const memory = addMemory(body.content, body.tags ?? []);
-                sendJson(res, 201, { ok: true, memory });
-                return;
-            }
-            if (req.method === "GET" && pathname === "/v1/memory/search") {
-                const query = url.searchParams.get("q") ?? "";
-                if (!query) {
-                    sendJson(res, 400, { error: "missing_query_param_q" });
-                    return;
-                }
-                const results = searchMemories(query);
-                sendJson(res, 200, { results });
-                return;
-            }
-            if (req.method === "DELETE" && pathname.startsWith("/v1/memory/")) {
-                const idx = parseInt(pathname.slice("/v1/memory/".length));
-                if (isNaN(idx)) {
-                    sendJson(res, 400, { error: "invalid_index" });
-                    return;
-                }
-                const ok = deleteMemory(idx - 1);
-                if (!ok) {
-                    sendJson(res, 404, { error: "memory_not_found", index: idx });
-                    return;
-                }
-                sendJson(res, 200, { ok: true, deleted: idx });
-                return;
-            }
-            // ─── MCP ───────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/mcp") {
-                const status = getMcpStatus();
-                sendJson(res, 200, { servers: status });
-                return;
-            }
-            // ─── Skills ────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/skills") {
-                const all = getAllSkills();
-                sendJson(res, 200, {
-                    count: all.length,
-                    enabled_count: all.filter((s) => s.enabled).length,
-                    stale_disabled: getStaleDisabledSkills(),
-                    skills: all.map(skillPayload),
-                });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/skills/reload") {
-                discoverSkills({ silent: true });
-                const all = getAllSkills();
-                sendJson(res, 200, {
-                    ok: true,
-                    count: all.length,
-                    enabled_count: all.filter((s) => s.enabled).length,
-                    stale_disabled: getStaleDisabledSkills(),
-                    skills: all.map(skillPayload),
-                });
-                return;
-            }
-            const skillDetail = pathname.match(/^\/v1\/skills\/([^/]+)$/);
-            if (req.method === "GET" && skillDetail) {
-                const name = decodePathSegment(skillDetail[1]);
-                if (!name) {
-                    sendJson(res, 400, { error: "invalid_skill_name" });
-                    return;
-                }
-                const skill = getSkill(name);
-                if (!skill) {
-                    sendJson(res, 404, { error: "skill_not_found", name, available: getAllSkills().map((s) => s.name) });
-                    return;
-                }
-                sendJson(res, 200, { skill: { ...skillPayload(skill), content: skill.content } });
-                return;
-            }
-            const skillToggle = pathname.match(/^\/v1\/skills\/([^/]+)\/(enable|disable)$/);
-            if (req.method === "POST" && skillToggle) {
-                const name = decodePathSegment(skillToggle[1]);
-                if (!name) {
-                    sendJson(res, 400, { error: "invalid_skill_name" });
-                    return;
-                }
-                const enabled = skillToggle[2] === "enable";
-                if (!getSkill(name)) {
-                    sendJson(res, 404, { error: "skill_not_found", name, available: getAllSkills().map((s) => s.name) });
-                    return;
-                }
-                const parsed = await readJsonBody(req);
-                const scope = parsed.ok ? parsed.value.scope : undefined;
-                if (scope !== undefined && scope !== "global" && scope !== "project") {
-                    sendJson(res, 400, { error: "invalid_scope", allowed: ["global", "project"] });
-                    return;
-                }
-                const [result] = setSkillEnabled([name], enabled, scope ?? "global");
-                sendJson(res, 200, {
-                    ok: true,
-                    name,
-                    enabled: result.enabled,
-                    scope: scope ?? "global",
-                    ...(result.blockedBy ? { blocked_by: result.blockedBy } : {}),
-                });
-                return;
-            }
-            // ─── Rules ─────────────────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/rules") {
-                sendJson(res, 200, {
-                    count: instructions.length,
-                    rules: instructions.map((inst) => {
-                        const firstLine = inst.split("\n")[0] ?? "";
-                        return { source: firstLine.replace("Instructions from: ", ""), chars: inst.length };
-                    }),
-                });
-                return;
-            }
-            // ─── Project (code mode scan) ──────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/project") {
-                const project = scanProject();
-                sendJson(res, 200, { project });
-                return;
-            }
-            // ─── Code mode chat ────────────────────────────────────────────────
-            // ─── MCP management ────────────────────────────────────────────────
-            if (req.method === "POST" && pathname === "/v1/paste") {
-                if (req.headers["content-type"]?.split(";")[0]?.trim() !== "application/json") {
-                    sendJson(res, 415, { error: "unsupported_media_type" });
-                    return;
-                }
-                if (activeChats >= MAX_CONCURRENT_CHATS) {
-                    sendJson(res, 429, { error: "too_many_concurrent_requests", detail: `Max ${MAX_CONCURRENT_CHATS} concurrent chats` });
-                    return;
-                }
-                const parsed = await readJsonBody(req);
-                if (!parsed.ok) {
-                    sendJsonError(res, parsed);
-                    return;
-                }
-                const body = parsed.value;
-                if (!body.image_base64) {
-                    sendJson(res, 400, { error: "missing_image_base64" });
-                    return;
-                }
-                const imageBuffer = Buffer.from(body.image_base64, "base64");
-                const mimeType = body.mime_type ?? "image/png";
-                const text = body.message ?? "What's in this image?";
-                const modelId = body.model;
-                const sessionId = body.session_id;
-                const stream = body.stream === true;
-                const codeMode = body.code === true;
-                let messages = [];
-                if (sessionId) {
-                    const session = loadSession(sessionId);
-                    if (!session) {
-                        sendJson(res, 404, { error: "session_not_found", session_id: sessionId });
-                        return;
-                    }
-                    messages = [...session.messages];
-                }
-                activeChats++;
-                try {
-                    const content = [
-                        { type: "text", text },
-                        { type: "image", image: imageBuffer, mimeType },
-                    ];
-                    messages.push({ role: "user", content });
-                    const abort = new AbortController();
-                    res.on("close", () => abort.abort());
-                    const tracker = new TokenTracker();
-                    const runOptions = {
-                        temperature: typeof body.temperature === "number" ? body.temperature : undefined,
-                        maxTokens: typeof body.maxTokens === "number" ? body.maxTokens : undefined,
-                        topP: typeof body.topP === "number" ? body.topP : undefined,
-                        providerName: typeof body.provider === "string" ? body.provider : undefined,
-                    };
-                    if (stream) {
-                        res.writeHead(200, sseHeaders(c));
-                        res.flushHeaders?.();
-                        const callbacks = createSseCallbacks(res, messages, { sessionId });
-                        try {
-                            if (codeMode) {
-                                const project = scanProject();
-                                const system = buildCodeSystemPrompt(project, instructions);
-                                await runOnceWithSystem(messages, system, modelId, abort.signal, callbacks, tracker, runOptions);
-                            }
-                            else {
-                                await runOnce(messages, instructions, modelId, abort.signal, callbacks, tracker, runOptions);
-                            }
-                        }
-                        catch (err) {
-                            if (!res.writableEnded) {
-                                sseWrite(res, { type: "fatal", message: err?.message ?? String(err) });
-                                res.end();
-                            }
-                        }
-                    }
-                    else {
-                        const { callbacks, toolCalls, toolResults, finishInfo } = createJsonCallbacks();
-                        let project;
-                        if (codeMode) {
-                            project = scanProject();
-                            const system = buildCodeSystemPrompt(project, instructions);
-                            await runOnceWithSystem(messages, system, modelId, abort.signal, callbacks, tracker, runOptions);
-                        }
-                        else {
-                            await runOnce(messages, instructions, modelId, abort.signal, callbacks, tracker, runOptions);
-                        }
-                        const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
-                        let saved;
-                        if (sessionId) {
-                            try {
-                                saved = saveSession(messages, sessionId);
-                            }
-                            catch { }
-                        }
-                        const fi = finishInfo();
-                        sendJson(res, 200, {
-                            messages: sanitizeForStorage(messages),
-                            assistant: lastAssistant ?? null,
-                            tool_calls: toolCalls,
-                            tool_results: toolResults,
-                            session_id: saved,
-                            step_count: fi?.stepCount ?? 0,
-                            usage: fi?.usage ?? null,
-                            has_error: fi?.hasError ?? false,
-                            aborted: fi?.aborted ?? false,
-                            max_steps_reached: fi?.maxStepsReached ?? false,
-                            ...(codeMode ? { mode: "code", project } : {}),
-                        });
-                    }
-                }
-                finally {
-                    activeChats--;
-                }
-                return;
-            }
-            // ─── MCP management (continued) ───────────────────────────────────
-            if (req.method === "POST" && pathname === "/v1/mcp") {
-                const parsed = await readJsonBody(req);
-                if (!parsed.ok) {
-                    sendJsonError(res, parsed);
-                    return;
-                }
-                const body = parsed.value;
-                if (!body.name) {
-                    sendJson(res, 400, { error: "missing_name" });
-                    return;
-                }
-                if (body.remoteTransport && !["streamable-http", "sse", "auto"].includes(body.remoteTransport)) {
-                    sendJson(res, 400, { error: "invalid_remote_transport", allowed: ["streamable-http", "sse", "auto"] });
-                    return;
-                }
-                const scope = body.project ? "project" : "global";
-                const { loadMcpConfigFile, saveMcpConfig } = await import("./mcp.js");
-                const config = loadMcpConfigFile(scope);
-                const common = {
-                    ...(body.environment ? { environment: body.environment } : {}),
-                    ...(body.headers ? { headers: body.headers } : {}),
-                    ...(body.remoteTransport ? { remoteTransport: body.remoteTransport } : {}),
-                    ...(body.timeout !== undefined ? { timeout: body.timeout } : {}),
-                    ...(body.connectTimeout !== undefined ? { connectTimeout: body.connectTimeout } : {}),
-                    ...(body.callTimeout !== undefined ? { callTimeout: body.callTimeout } : {}),
-                    enabled: body.enabled !== false,
-                };
-                if (body.url) {
-                    config.mcpServers[body.name] = { url: body.url, ...(body.token ? { token: body.token } : {}), ...common };
-                }
-                else if (typeof body.command === "string" && body.command.length > 0) {
-                    config.mcpServers[body.name] = { command: body.command, ...(body.args ? { args: body.args } : {}), ...common };
-                }
-                else if (Array.isArray(body.command) && body.command.length > 0) {
-                    config.mcpServers[body.name] = { command: body.command, ...common };
-                }
-                else {
-                    sendJson(res, 400, { error: "provide command or url" });
-                    return;
-                }
-                saveMcpConfig(config, scope);
-                await syncMcpConnections();
-                const status = getMcpStatus()[body.name];
-                sendJson(res, 201, {
-                    ok: true,
-                    name: body.name,
-                    scope,
-                    connected: status?.connected ?? false,
-                    ...(status?.error ? { error: status.error } : {}),
-                    ...(status?.tools?.length ? { tools: status.tools } : {}),
-                });
-                return;
-            }
-            if (req.method === "DELETE" && pathname.startsWith("/v1/mcp/")) {
-                const name = decodePathSegment(pathname.slice("/v1/mcp/".length));
-                if (!name) {
-                    sendJson(res, 400, { error: "missing_name" });
-                    return;
-                }
-                const scope = url.searchParams.get("project") === "1" ? "project" : "global";
-                const { loadMcpConfigFile, saveMcpConfig } = await import("./mcp.js");
-                const config = loadMcpConfigFile(scope);
-                if (!config.mcpServers[name]) {
-                    sendJson(res, 404, { error: "mcp_not_found", name, scope, available: Object.keys(config.mcpServers) });
-                    return;
-                }
-                delete config.mcpServers[name];
-                saveMcpConfig(config, scope);
-                await syncMcpConnections();
-                sendJson(res, 200, { ok: true, deleted: name, scope });
-                return;
-            }
-            const mcpToggle = pathname.match(/^\/v1\/mcp\/([^/]+)\/(enable|disable)$/);
-            if (req.method === "POST" && mcpToggle) {
-                const name = decodePathSegment(mcpToggle[1]);
-                if (!name) {
-                    sendJson(res, 400, { error: "missing_name" });
-                    return;
-                }
-                const enabled = mcpToggle[2] === "enable";
-                const parsed = await readJsonBody(req);
-                const scope = parsed.ok && parsed.value.scope === "project" ? "project" : "global";
-                const { loadMcpConfigFile, saveMcpConfig } = await import("./mcp.js");
-                const config = loadMcpConfigFile(scope);
-                if (!config.mcpServers[name]) {
-                    const known = loadMcpConfigEntries().some((e) => e.name === name);
-                    sendJson(res, 404, {
-                        error: "mcp_not_found",
-                        name,
-                        scope,
-                        ...(known ? { hint: `server exists in another scope; pass the matching scope` } : { available: Object.keys(config.mcpServers) }),
-                    });
-                    return;
-                }
-                config.mcpServers[name].enabled = enabled;
-                saveMcpConfig(config, scope);
-                await syncMcpConnections();
-                sendJson(res, 200, { ok: true, name, enabled, scope, connected: getMcpStatus()[name]?.connected ?? false });
-                return;
-            }
-            // ─── Context / Compact ─────────────────────────────────────────────
-            if (req.method === "GET" && pathname === "/v1/context") {
-                const config = loadConfig();
-                const provider = getActiveProvider(config);
-                const ctxWindow = await getContextWindow(provider?.defaultModel);
-                sendJson(res, 200, {
-                    context_window: ctxWindow,
-                    model: provider?.defaultModel ?? null,
-                });
-                return;
-            }
-            if (req.method === "GET" && pathname === "/v1/cost") {
-                const config = loadConfig();
-                const provider = getActiveProvider(config);
-                const modelId = url.searchParams.get("model") ?? provider?.defaultModel ?? null;
-                const inputRaw = url.searchParams.get("input");
-                const outputRaw = url.searchParams.get("output");
-                const input = inputRaw ? parseInt(inputRaw, 10) : 0;
-                const output = outputRaw ? parseInt(outputRaw, 10) : 0;
-                if (Number.isNaN(input) || Number.isNaN(output) || input < 0 || output < 0) {
-                    sendJson(res, 400, { error: "invalid_tokens", detail: "input/output must be non-negative integers" });
-                    return;
-                }
-                const price = modelId ? await getModelPrice(modelId) : null;
-                const cost = price ? estimateCost({ inputTokens: input, outputTokens: output }, price) : null;
-                sendJson(res, 200, { model: modelId, price, cost_usd: cost });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/chat/compact") {
-                const parsed = await readJsonBody(req);
-                if (!parsed.ok) {
-                    sendJsonError(res, parsed);
-                    return;
-                }
-                const body = parsed.value;
-                if (!body.session_id) {
-                    sendJson(res, 400, { error: "missing_session_id" });
-                    return;
-                }
-                const session = loadSession(body.session_id);
-                if (!session) {
-                    sendJson(res, 404, { error: "session_not_found" });
-                    return;
-                }
-                const model = resolveModel();
-                const result = await compactMessages(session.messages, model, { autoContinue: false });
-                if (result.compacted) {
-                    saveSession(result.messages, body.session_id);
-                }
-                sendJson(res, 200, { ok: true, compacted: result.compacted, message_count: result.messages.length });
-                return;
-            }
-            if (req.method === "POST" && pathname === "/v1/chat/undo") {
-                const parsed = await readJsonBody(req);
-                if (!parsed.ok) {
-                    sendJsonError(res, parsed);
-                    return;
-                }
-                const body = parsed.value;
-                if (!body.session_id) {
-                    sendJson(res, 400, { error: "missing_session_id" });
-                    return;
-                }
-                const session = loadSession(body.session_id);
-                if (!session) {
-                    sendJson(res, 404, { error: "session_not_found" });
-                    return;
-                }
-                let userIdx = -1;
-                for (let i = session.messages.length - 1; i >= 0; i--) {
-                    if (session.messages[i].role === "user") {
-                        userIdx = i;
-                        break;
-                    }
-                }
-                if (userIdx === -1) {
-                    sendJson(res, 400, { error: "no_user_message" });
+            for (const route of routes) {
+                if (await route(req, res, ctx, url, pathname))
                     return;
-                }
-                session.messages = session.messages.slice(0, userIdx + 1);
-                saveSession(session.messages, body.session_id);
-                sendJson(res, 200, { ok: true, message_count: session.messages.length, messages: session.messages });
-                return;
             }
             sendJson(res, 404, { error: "not_found", path: pathname });
         }