mouaif 0.3.0

package/src/server-handlers-projects.js

@@ -0,0 +1,289 @@
+'use strict';
+
+// Projects + file editor + file tagging REST handlers. Extracted from
+// the original single-file http-server.js. Shared helpers live in
+// src/server-shared.js.
+
+const os = require('os');
+const path = require('path');
+const {
+  sendJSON,
+  qs,
+  readJsonOr400,
+  errCodeToHttpStatus,
+  settings,
+  projects,
+  chats,
+  files,
+  tags,
+  safeDecode
+} = require('./server-shared.js');
+
+function projectsErrorStatus(err) {
+  return errCodeToHttpStatus(err && err.code, 400);
+}
+
+async function handleProjects(req, res, parsed) {
+  const urlPath = parsed.pathname;
+  const method = req.method;
+  const q = parsed.query || {};
+
+  // File editor (in-app CodeMirror popup). See handleFileEditor for the
+  // contract; dispatched here so /api/file, /api/files, and the
+  // image-preview /api/file-media route all win over the generic
+  // /api/projects routes below.
+  if (urlPath === '/api/file' || urlPath === '/api/files' || urlPath === '/api/file-media') {
+    return handleFileEditor(req, res, parsed);
+  }
+
+  // File tagging (docs/decisions.md §15). Routes live under a
+  // registered project id: /api/projects/:id/tags[/...]. Delegated to
+  // handleTags before the folder-picker / registered-project routes so
+  // the more specific path wins.
+  if (/^\/api\/projects\/[^/]+\/tags(\/.*)?$/.test(urlPath)) {
+    return handleTags(req, res, parsed);
+  }
+
+  // GET /api/projects?dir=<abs>  -> list subdirs
+  if (urlPath === '/api/projects' && method === 'GET') {
+    const dir = typeof q.dir === 'string' && q.dir ? q.dir : os.homedir();
+    try {
+      const result = projects.listDir(dir);
+      return sendJSON(res, 200, result);
+    } catch (e) {
+      return sendJSON(res, projectsErrorStatus(e), { error: e.message, code: e.code, path: e.path || dir });
+    }
+  }
+
+  // GET /api/projects/registered
+  if (urlPath === '/api/projects/registered' && method === 'GET') {
+    return sendJSON(res, 200, { projects: projects.listProjects() });
+  }
+
+  // DELETE /api/projects/registered/:id
+  const delMatch = urlPath.match(/^\/api\/projects\/registered\/([A-Za-z0-9_-]+)$/);
+  if (delMatch && method === 'DELETE') {
+    const ok = projects.removeProject(delMatch[1]);
+    if (!ok) return sendJSON(res, 404, { error: 'Not found', id: delMatch[1] });
+    return sendJSON(res, 200, { ok: true });
+  }
+
+  // PATCH /api/projects/registered/:id  body: { name }
+  if (delMatch && method === 'PATCH') {
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const name = body && typeof body.name === 'string' ? body.name : '';
+    if (!name.trim()) return sendJSON(res, 400, { error: 'name is required' });
+    const updated = projects.renameProject(delMatch[1], name);
+    if (!updated) return sendJSON(res, 404, { error: 'Not found', id: delMatch[1] });
+    return sendJSON(res, 200, { project: updated });
+  }
+
+  // POST /api/projects  body: { action, ... }
+  if (urlPath === '/api/projects' && method === 'POST') {
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const action = body && body.action;
+    try {
+      if (action === 'list') {
+        const dir = typeof body.dir === 'string' && body.dir ? body.dir : os.homedir();
+        return sendJSON(res, 200, projects.listDir(dir));
+      }
+      if (action === 'create') {
+        if (typeof body.parent !== 'string' || typeof body.name !== 'string' || !body.name) {
+          return sendJSON(res, 400, { error: 'parent and name are required' });
+        }
+        const target = path.join(body.parent, body.name);
+        const out = projects.createDir(target);
+        return sendJSON(res, 201, { ...out, parent: body.parent, name: body.name });
+      }
+  if (action === 'register') {
+    if (typeof body.dir !== 'string' || !body.dir) {
+      return sendJSON(res, 400, { error: 'dir is required' });
+    }
+    const row = projects.registerProject(body.dir);
+    // Opt the project into DB-backed settings before seeding the cost so
+    // the working tree is never touched (see project-settings-storage.md).
+    // Use the REGISTERED path (projects.js canonicalizes it) rather than the
+    // raw request value: a trailing slash or a `..` segment would otherwise
+    // key the DB row under a path nothing else looks up, and the opt-in
+    // would silently do nothing.
+    if (body.dbBacked === true) {
+    settings.setDbBacked(row.path, true);
+    }
+    // Seed persisted chat and project totals once for existing histories.
+    try { chats.recomputeProjectTotalCost(body.dir); } catch { /* non-fatal */ }
+    return sendJSON(res, 200, { project: row, dbBacked: !!body.dbBacked });
+  }
+      return sendJSON(res, 400, { error: 'Unknown action', action });
+    } catch (e) {
+      return sendJSON(res, projectsErrorStatus(e), { error: e.message, code: e.code, path: e.path });
+    }
+  }
+
+  return sendJSON(res, 404, { error: 'Not found', scope: 'projects' });
+}
+
+// ---- File editor API ---------------------------------------------------
+// Read + write text files inside a registered project folder, for the
+// in-app CodeMirror editor popup. All paths are project-relative (or
+// absolute under the project root). Both the project root and every
+// read/write/list path go through files.resolveSafe, so the same
+// home + MOUAIF_ALLOW_ANY_ROOT guard that protects the rest of the
+// server applies here too.
+//
+// Endpoints:
+//   GET  /api/files?projectDir=<abs>&dir=<abs>          -> list a folder
+//   GET  /api/file?projectDir=<abs>&path=<abs|rel>      -> read a text file
+//   PUT  /api/file   body { projectDir, path, content } -> write a text file
+//   GET  /api/file-media?projectDir=<abs>&path=<abs|rel> -> read an image as data URL
+//
+// Errors map to typed codes so the UI can render the right message
+// (EBINARY -> "binary file, cannot edit", ETOOLARGE -> "file too big",
+// EOUTSIDE_PROJECT -> 403, ENOTIMAGE -> "file is not an image", etc.).
+
+function filesErrorStatus(err) {
+  return errCodeToHttpStatus(err && err.code, 400);
+}
+
+async function handleFileEditor(req, res, parsed) {
+  const urlPath = parsed.pathname;
+  const method = req.method;
+  const q = parsed.query || {};
+
+  // GET /api/files?projectDir=<abs>&dir=<abs>  -> list a folder
+  if (urlPath === '/api/files' && method === 'GET') {
+    const projectDir = qs(q, 'projectDir');
+    const dir = qs(q, 'dir');
+    try {
+      return sendJSON(res, 200, files.listDir(projectDir, dir));
+    } catch (e) {
+      return sendJSON(res, filesErrorStatus(e), { error: e.message, code: e.code, path: e.path });
+    }
+  }
+
+  // GET /api/file?projectDir=<abs>&path=<abs|rel>  -> read a text file
+  if (urlPath === '/api/file' && method === 'GET') {
+    const projectDir = qs(q, 'projectDir');
+    const path = qs(q, 'path');
+    try {
+      const out = await files.readFile(projectDir, path);
+      return sendJSON(res, 200, out);
+    } catch (e) {
+      return sendJSON(res, filesErrorStatus(e), { error: e.message, code: e.code, path: e.path, size: e.size, maxBytes: e.maxBytes });
+    }
+  }
+
+  // PUT /api/file  body { projectDir, path, content }  -> write a text file
+  if (urlPath === '/api/file' && method === 'PUT') {
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const projectDir = body && typeof body.projectDir === 'string' ? body.projectDir : '';
+    const path = body && typeof body.path === 'string' ? body.path : '';
+    const content = body && typeof body.content === 'string' ? body.content : null;
+    try {
+      const out = await files.writeFile(projectDir, path, content);
+      return sendJSON(res, 200, out);
+    } catch (e) {
+      return sendJSON(res, filesErrorStatus(e), { error: e.message, code: e.code, path: e.path, size: e.size, maxBytes: e.maxBytes });
+    }
+  }
+
+  // GET /api/file-media?projectDir=<abs>&path=<abs|rel>
+  // Read an image file (or other previewable binary) as a base64
+  // data URL. Used by the file editor popup to render an <img>
+  // preview for .png/.jpg/.gif/.webp/.svg/.bmp/.ico without needing
+  // a separate auth-bearing URL. The data URL is small (<= 1 MiB
+  // cap, same as the text read).
+  if (urlPath === '/api/file-media' && method === 'GET') {
+    const projectDir = qs(q, 'projectDir');
+    const path = qs(q, 'path');
+    try {
+      const out = await files.readMedia(projectDir, path);
+      return sendJSON(res, 200, out);
+    } catch (e) {
+      return sendJSON(res, filesErrorStatus(e), { error: e.message, code: e.code, path: e.path, size: e.size, maxBytes: e.maxBytes });
+    }
+  }
+  return sendJSON(res, 404, { error: 'Not found', scope: 'fileEditor' });
+}
+
+// ---- File tagging API ---------------------------------------------------
+// Per-project file tags (docs/decisions.md §15). All routes hang off a
+// registered project id so the UI never has to pass an absolute path:
+//   GET    /api/projects/:id/tags               -> { tags: { ... } }
+//   PUT    /api/projects/:id/tags               body { tags: {...} }
+//   POST   /api/projects/:id/tags/scan          body { exts? }
+//   DELETE /api/projects/:id/tags/files/<relPath>
+// The project id resolves to its absolute dir via projects.getProject.
+// Tag CRUD requires a registered project (404 otherwise). Path escapes
+// return 403 EOUTSIDE_PROJECT.
+
+function tagsErrorStatus(err) {
+  return errCodeToHttpStatus(err && err.code);
+}
+
+async function handleTags(req, res, parsed) {
+  const urlPath = parsed.pathname;
+  const method = req.method;
+
+  // Pull the project id out of the path and resolve to an absolute dir.
+  const idMatch = urlPath.match(/^\/api\/projects\/([^/]+)\/tags/);
+  if (!idMatch) return sendJSON(res, 404, { error: 'Not found', scope: 'tags' });
+  const projectId = safeDecode(idMatch[1]);
+  const project = projects.getProject(projectId);
+  if (!project) return sendJSON(res, 404, { error: 'Project not registered', id: projectId });
+  const dir = project.path;
+
+  const rest = urlPath.slice(idMatch[0].length); // '' | '/scan' | '/files/<rel>'
+
+  // GET /api/projects/:id/tags
+  if (rest === '' && method === 'GET') {
+    try {
+      return sendJSON(res, 200, { tags: tags.getTags(dir) });
+    } catch (e) {
+      return sendJSON(res, tagsErrorStatus(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // PUT /api/projects/:id/tags  body: { tags: { ... } }
+  if (rest === '' && method === 'PUT') {
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const map = body && typeof body.tags === 'object' && body.tags ? body.tags : {};
+    try {
+      return sendJSON(res, 200, { tags: tags.setTags(dir, map) });
+    } catch (e) {
+      return sendJSON(res, tagsErrorStatus(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // POST /api/projects/:id/tags/scan  body: { exts?: [...] }
+  if (rest === '/scan' && method === 'POST') {
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const exts = body && Array.isArray(body.exts) ? body.exts : null;
+    try {
+      return sendJSON(res, 200, { files: tags.scanFiles(dir, exts) });
+    } catch (e) {
+      return sendJSON(res, tagsErrorStatus(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // DELETE /api/projects/:id/tags/files/<relPath>
+  const fileMatch = rest.match(/^\/files\/(.+)$/);
+  if (fileMatch && method === 'DELETE') {
+    const relPath = safeDecode(fileMatch[1]);
+    try {
+      const removed = tags.removeTag(dir, relPath);
+      if (!removed) return sendJSON(res, 404, { error: 'Tag entry not found', path: relPath });
+      return sendJSON(res, 200, { ok: true, removed: relPath });
+    } catch (e) {
+      return sendJSON(res, tagsErrorStatus(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  return sendJSON(res, 404, { error: 'Not found', scope: 'tags' });
+}
+
+module.exports = { handleProjects, handleFileEditor, handleTags };

package/src/server-handlers-prompts.js

@@ -0,0 +1,259 @@
+'use strict';
+// Prompts + agent features + project agents REST handlers. Extracted
+// from the original single-file http-server.js. Shared helpers live in
+// src/server-shared.js.
+const {
+  sendJSON,
+  qs,
+  readJsonOr400,
+  errCodeToHttpStatus,
+  settings,
+  prompts,
+  chats,
+  agents,
+  agentFeatures,
+  safeDecode
+} = require('./server-shared.js');
+
+// ---- Prompts API ---------------------------------------------------------
+// Custom prompts. Stored in the app SQLite database or in project.prompts.
+// Routes:
+//   GET    /api/prompts[?projectDir=<abs>][&scope=app|project]  -> { prompts }
+//   GET    /api/prompts/:id[?projectDir=<abs>][&scope=app|project] -> { prompt }
+//   POST   /api/prompts   body: { projectDir?, scope?, title?, content, role? } -> { prompt }
+//   PATCH  /api/prompts/:id  body: { projectDir?, scope?, title?, content?, role? } -> { prompt }
+//   DELETE /api/prompts/:id[?projectDir=<abs>][&scope=app|project] -> { ok: true }
+async function handlePrompts(req, res, parsed) {
+  const urlPath = parsed.pathname;
+  const method = req.method;
+  const q = parsed.query || {};
+
+  function projectDirFrom(body) {
+    const fromQuery = qs(q, 'projectDir');
+    const fromBody = body && typeof body.projectDir === 'string' ? body.projectDir : '';
+    return fromQuery || fromBody;
+  }
+
+  function promptError(e) {
+    return errCodeToHttpStatus(e && e.code);
+  }
+
+  // GET /api/prompts[?projectDir=<abs>]
+  if (urlPath === '/api/prompts' && method === 'GET') {
+    const dir = qs(q, 'projectDir');
+    const scope = qs(q, 'scope');
+    try {
+      return sendJSON(res, 200, { prompts: prompts.listPrompts(dir, { scope }) });
+    } catch (e) {
+      return sendJSON(res, promptError(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // GET /api/prompts/:id[?projectDir=<abs>]
+  const getMatch = urlPath.match(/^\/api\/prompts\/([^/]+)$/);
+  if (getMatch && method === 'GET') {
+    const id = safeDecode(getMatch[1]);
+    const dir = qs(q, 'projectDir');
+    const scope = qs(q, 'scope');
+    try {
+      const p = prompts.getPrompt(dir, id, { scope });
+      if (!p) return sendJSON(res, 404, { error: 'Prompt not found', id });
+      return sendJSON(res, 200, { prompt: p });
+    } catch (e) {
+      return sendJSON(res, promptError(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // POST /api/prompts  body: { projectDir?, scope?, title?, content, role? }
+  if (urlPath === '/api/prompts' && method === 'POST') {
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const dir = projectDirFrom(body);
+    const scope = body.scope || (dir ? 'project' : 'app');
+    if (!dir && scope === 'project') {
+      return sendJSON(res, 400, { error: 'projectDir is required for project-scoped prompts' });
+    }
+    try {
+      const p = prompts.createPrompt(dir, body || {});
+      return sendJSON(res, 201, { prompt: p });
+    } catch (e) {
+      return sendJSON(res, promptError(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // PATCH /api/prompts/:id  body: { projectDir?, scope?, title?, content?, role? }
+  if (getMatch && method === 'PATCH') {
+    const id = safeDecode(getMatch[1]);
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const dir = projectDirFrom(body);
+    try {
+      const p = prompts.updatePrompt(dir, id, body || {});
+      if (!p) return sendJSON(res, 404, { error: 'Prompt not found', id });
+      return sendJSON(res, 200, { prompt: p });
+    } catch (e) {
+      return sendJSON(res, promptError(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // DELETE /api/prompts/:id[?projectDir=<abs>]
+  if (getMatch && method === 'DELETE') {
+    const id = safeDecode(getMatch[1]);
+    const dir = qs(q, 'projectDir');
+    const scope = qs(q, 'scope');
+    try {
+      let clearedChats = 0;
+      const removed = prompts.deletePrompt(dir, id, {
+        scope,
+        onRemoved: (deletedId) => {
+          if (dir) {
+            clearedChats = chats.clearPromptId(dir, deletedId);
+          } else {
+            try {
+              const allProjects = require('./projects.js').listProjects();
+              for (const prj of allProjects) {
+                if (prj && prj.path) {
+                  clearedChats += chats.clearPromptId(prj.path, deletedId);
+                }
+              }
+            } catch { /* non-fatal */ }
+          }
+        }
+      });
+      if (!removed) return sendJSON(res, 404, { error: 'Prompt not found', id });
+      return sendJSON(res, 200, { ok: true, removed: id, clearedChats });
+    } catch (e) {
+      return sendJSON(res, promptError(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  return sendJSON(res, 404, { error: 'Not found', scope: 'prompts' });
+}
+
+// ---- Agent features API ------------------------------------------------
+// Structured state of every mouaif feature for a project. Returns the
+// same data the `list_features` tool provides, without requiring a chat.
+// Routes:
+//   GET /api/features?projectDir=<abs>        -> { features: { ... } }
+async function handleFeatures(req, res, parsed) {
+  const dir = (parsed.query && parsed.query.projectDir || '').trim();
+  if (!dir) return sendJSON(res, 400, { error: 'projectDir query param is required' });
+  try {
+    const project = require('./settings.js').getProject(dir);
+    let authz = null;
+    try { authz = require('./tools/authorization.js').getAuthorization(dir); } catch { /* safe default */ }
+    let mcpServers = null;
+    try { mcpServers = require('./mcp.js').listServers(dir); } catch { /* safe default */ }
+    const featureContent = agentFeatures.buildFeatureSummary({ projectDir: dir, project, authz, mcpServers });
+    const jsonState = await agentFeatures.dispatchListFeatures({}, { projectDir: dir });
+    sendJSON(res, 200, {
+      features: (jsonState && jsonState.result) || {},
+      summary: featureContent
+    });
+  } catch (e) {
+    sendJSON(res, 500, { error: e.message, code: 'EINTERNAL' });
+  }
+}
+
+// ---- Project agents API -----------------------------------------------
+// Project-scoped named personas stored in .mouaif.json under `agents`.
+// Each agent = { name, content, tools?, modelId? } — a delegation target
+// for the native `subagent` tool, nothing else. See docs/features/agents.md.
+// Routes:
+//   GET    /api/agents?projectDir=<abs>          -> { agents }
+//   POST   /api/agents  body: { projectDir, name, content, tools?, modelId? }
+//   GET    /api/agents/:name?projectDir=<abs>    -> { agent } | 404
+//   PATCH  /api/agents/:name  body: { projectDir, name?, content?, tools?, modelId? }
+//   DELETE /api/agents/:name?projectDir=<abs>
+async function handleAgents(req, res, parsed) {
+  const urlPath = parsed.pathname;
+  const method = req.method;
+  const q = parsed.query || {};
+
+  function agentDirFrom(body) {
+    const fromQuery = qs(q, 'projectDir');
+    const fromBody = body && typeof body.projectDir === 'string' ? body.projectDir : '';
+    return fromQuery || fromBody;
+  }
+
+  function agentError(e) {
+    return errCodeToHttpStatus(e && e.code);
+  }
+
+  if (method !== 'GET' && method !== 'POST' && method !== 'PATCH' && method !== 'DELETE') {
+    return sendJSON(res, 405, { error: 'Method not allowed' });
+  }
+
+  // GET/DELETE carry projectDir in the query string; POST/PATCH carry
+  // it in the JSON body. Only the query-string routes can 400 up front.
+  const dir = qs(q, 'projectDir');
+
+  // GET /api/agents?projectDir=...
+  if (urlPath === '/api/agents' && method === 'GET') {
+    if (!dir) return sendJSON(res, 400, { error: 'projectDir query param is required' });
+    try {
+      return sendJSON(res, 200, { agents: agents.list(dir) });
+    } catch (e) {
+      return sendJSON(res, agentError(e), { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // POST /api/agents  body: { projectDir, name, content, tools? }
+  if (urlPath === '/api/agents' && method === 'POST') {
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const projectDir = agentDirFrom(body);
+    if (!projectDir) return sendJSON(res, 400, { error: 'projectDir is required' });
+    try {
+      const agent = agents.create(projectDir, body || {});
+      return sendJSON(res, 201, { agent });
+    } catch (e) {
+      const status = e.code === 'EBADINPUT' ? 400 : 500;
+      return sendJSON(res, status, { error: e.message, code: e.code || 'INTERNAL' });
+    }
+  }
+
+  // GET|PATCH|DELETE /api/agents/:name
+  let getMatch = urlPath.match(/^\/api\/agents\/([^/]+)$/);
+  if (getMatch) {
+    const name = safeDecode(getMatch[1]);
+    if (method === 'GET') {
+      if (!dir) return sendJSON(res, 400, { error: 'projectDir query param is required' });
+      try {
+        const agent = agents.get(dir, name);
+        if (!agent) return sendJSON(res, 404, { error: 'Agent not found', name });
+        return sendJSON(res, 200, { agent });
+      } catch (e) {
+        return sendJSON(res, agentError(e), { error: e.message, code: e.code || 'INTERNAL' });
+      }
+    }
+    if (method === 'PATCH') {
+      const body = await readJsonOr400(req, res);
+      if (!body) return;
+      const patchDir = dir || (body && typeof body.projectDir === 'string' ? body.projectDir : '');
+      if (!patchDir) return sendJSON(res, 400, { error: 'projectDir is required' });
+      try {
+        const agent = agents.update(patchDir, name, body || {});
+        if (!agent) return sendJSON(res, 404, { error: 'Agent not found', name });
+        return sendJSON(res, 200, { agent });
+      } catch (e) {
+        return sendJSON(res, agentError(e), { error: e.message, code: e.code || 'INTERNAL' });
+      }
+    }
+    if (method === 'DELETE') {
+      if (!dir) return sendJSON(res, 400, { error: 'projectDir query param is required' });
+      try {
+        const ok = agents.remove(dir, name);
+        if (!ok) return sendJSON(res, 404, { error: 'Agent not found', name });
+        return sendJSON(res, 200, { ok: true, removed: name });
+      } catch (e) {
+        return sendJSON(res, agentError(e), { error: e.message, code: e.code || 'INTERNAL' });
+      }
+    }
+    return sendJSON(res, 405, { error: 'Method not allowed' });
+  }
+
+  return sendJSON(res, 404, { error: 'Not found', scope: 'agents' });
+}
+
+module.exports = { handlePrompts, handleFeatures, handleAgents };

package/src/server-handlers-push.js

@@ -0,0 +1,102 @@
+'use strict';
+
+// Browser push notification REST handlers. Extracted from the original
+// single-file http-server.js. Shared helpers live in src/server-shared.js.
+
+const { sendJSON, readJsonOr400, push } = require('./server-shared.js');
+
+async function handlePush(req, res, parsed, sessionToken, servedOrigin) {
+  const urlPath = parsed.pathname;
+  const method = req.method;
+  const sid = push.sessionIdFromToken(sessionToken);
+
+  // GET /api/push/vapid-public-key
+  if (urlPath === '/api/push/vapid-public-key' && method === 'GET') {
+    const publicKey = push.getVapidPublicKey();
+    if (!publicKey) return sendJSON(res, 500, { error: 'VAPID keys not initialised', code: 'ENOVAPID' });
+    return sendJSON(res, 200, { publicKey });
+  }
+
+  // GET /api/push/config — safe notification configuration. Opening the
+  // settings screen also repairs a missing VAPID pair. The private key never
+  // leaves the server.
+  if (urlPath === '/api/push/config' && method === 'GET') {
+    try {
+      return sendJSON(res, 200, push.getPushConfig(servedOrigin));
+    } catch (e) {
+      return sendJSON(res, 500, { error: e.message, code: 'EVAPID' });
+    }
+  }
+
+  // POST /api/push/subscribe
+  if (urlPath === '/api/push/subscribe' && method === 'POST') {
+    if (!sid) return sendJSON(res, 401, { error: 'No session', code: 'ESESSION' });
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    if (!body.subscription || !body.subscription.endpoint) {
+      return sendJSON(res, 400, { error: 'subscription with endpoint is required', code: 'EBADINPUT' });
+    }
+    const { endpoint, keys } = body.subscription;
+    if (!keys || !keys.p256dh || !keys.auth) {
+    return sendJSON(res, 400, { error: 'subscription must include keys.p256dh and keys.auth', code: 'EBADINPUT' });
+    }
+    // How this device presents a notification. The status bar is sized from
+    // these facts (src/statusBar.js): `chars` is the measured body line,
+    // `viewportWidth` keeps a measurement honest and scales the fallback,
+    // and `os` + `osVersion` pick how many lines the platform previews and
+    // the platform's own fallback width. `style` is 'collapsed' or
+    // 'expanded' so a one-line presentation puts the bar and message on one
+    // row. All optional; an omitted field keeps whatever this device
+    // reported last. `statusBarMaxChars` is the older, bare-count shape and
+    // stays supported.
+    const statusBarMaxChars = Number(body.subscription.statusBarMaxChars);
+    const statusBarProfile = body.subscription.statusBarProfile;
+    try {
+    const result = push.addSubscription({
+      sessionId: sid,
+      endpoint,
+      p256dh: keys.p256dh,
+      auth: keys.auth,
+      origin: servedOrigin || null,
+      statusBarMaxChars: Number.isFinite(statusBarMaxChars) && statusBarMaxChars > 0 ? statusBarMaxChars : null,
+      statusBarProfile
+    });
+    return sendJSON(res, 200, { ok: true, id: result.id });
+    } catch (e) {
+    return sendJSON(res, 500, { error: e.message, code: 'EDB' });
+    }
+  }
+
+  // DELETE /api/push/subscribe  body: { endpoint }
+  if (urlPath === '/api/push/subscribe' && method === 'DELETE') {
+    if (!sid) return sendJSON(res, 401, { error: 'No session', code: 'ESESSION' });
+    const body = await readJsonOr400(req, res);
+    if (!body) return;
+    const endpoint = body && body.endpoint;
+    if (!endpoint) return sendJSON(res, 400, { error: 'endpoint is required', code: 'EBADINPUT' });
+    const removed = push.removeSubscription(endpoint, sid);
+    return sendJSON(res, 200, { ok: true, removed });
+  }
+
+  // GET /api/push/subscriptions
+  if (urlPath === '/api/push/subscriptions' && method === 'GET') {
+    if (!sid) return sendJSON(res, 200, { subscriptions: [] });
+    return sendJSON(res, 200, { subscriptions: push.listSubscriptions(sid) });
+  }
+
+  // POST /api/push/test
+  if (urlPath === '/api/push/test' && method === 'POST') {
+    if (!sid) return sendJSON(res, 401, { error: 'No session', code: 'ESESSION' });
+    push.sendPushToSession(sid, {
+      title: 'mouaif notifications',
+      body: 'Notifications are ready on this browser.',
+      tag: 'mouaif-notification-test',
+      data: { kind: 'test', url: '/#/settings/notifications' }
+    });
+    return sendJSON(res, 200, { ok: true });
+  }
+
+  return sendJSON(res, 404, { error: 'Not found', scope: 'push' });
+}
+
+module.exports = { handlePush };