mover-os 4.7.7 → 4.7.8

package/src/dashboard/server.js

@@ -0,0 +1,2024 @@
+"use strict";
+
+const http = require("http");
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const { execFile, spawn } = require("child_process");
+// v6 serve-flip + Codex W4+W5 fix 1: the legacy ~/.mover/dashboard vanilla
+// HTML is no longer served as a fallback, so dashboardOutDir/dashboardIndexPath
+// are intentionally not imported here — ui/dist is the only served surface.
+const { logEvent: logActivationEvent } = require("./lib/activation-log");
+// v6 W3 — the live work feed (GET /api/feed/tail), read fresh per request.
+const feedParser = require("./lib/feed-parser");
+// Onboarding-engine: AgentSession abstraction — drives the user's own agent as
+// a persistent structured multi-turn session (onboarding-engine-SPEC.md §2 / D1).
+const { AgentSessionManager } = require("./lib/agent-session");
+const { RunRegistry } = require("./lib/run-registry");
+// Onboarding-engine D3/D4/D7 — note ingestion (drag-drop digest), skill
+// recommendation (work → skills), and which agent CLIs are installed/authed.
+const ingestion = require("./lib/ingestion");
+const skillRecommender = require("./lib/skill-recommender");
+const connectRecommender = require("./lib/connect-recommender");
+const { forgeBeats } = require("./lib/onboarding-forge");
+const agentDetect = require("./lib/agent-detect");
+// B5 (Rule S21 made mechanical) — atomic + drift-guarded writes to the user's Daily Notes.
+const { writeWithDriftGuard } = require("./lib/safe-write");
+
+// Per-server CSRF token — issued on /api/health, required on all POST endpoints.
+// Random per-process so dashboard ↔ server pairing is exclusive to this run.
+const STUDIO_TOKEN = crypto.randomBytes(24).toString("hex");
+
+// Engine-presence: has /setup actually run for this vault? Identity_Prime.md and
+// Strategy.md are the only Engine files created exclusively by setup — the
+// structure installer ships everything else as non-empty defaults and ships these
+// two only as *_template.md. Either one present + non-empty => a real Engine
+// exists, so the dashboard's first-open onboarding must NOT re-fire (a terminal
+// /setup user opening the dashboard for the first time). Read-only; mirrors the
+// engine-writer fresh-guard sentinels.
+function engineIsSetUp(vaultDir) {
+  if (!vaultDir) return false;
+  const base = path.join(vaultDir, "02_Areas", "Engine");
+  return ["Identity_Prime.md", "Strategy.md"].some((f) => {
+    try { return fs.statSync(path.join(base, f)).size > 0; } catch (_) { return false; }
+  });
+}
+
+// Origin allowlist for POST requests. Vite dev (5173) + production (3737-3740).
+const ORIGIN_ALLOWLIST = new Set([
+  "http://127.0.0.1:5173", "http://localhost:5173",
+  "http://127.0.0.1:3737", "http://localhost:3737",
+  "http://127.0.0.1:3738", "http://localhost:3738",
+  "http://127.0.0.1:3739", "http://localhost:3739",
+  "http://127.0.0.1:3740", "http://localhost:3740"
+]);
+
+function isOriginAllowed(req) {
+  const origin = req.headers.origin;
+  // Audit H1: previous version allowed any request without Origin header
+  // — intended for same-origin browser fetches, but curl/scripts/Electron
+  // also send no Origin and were getting a pass. Defense-in-depth: only
+  // skip the origin check when the request came over the loopback socket
+  // (127.0.0.1 / ::1 / ::ffff:127.0.0.1). The token check (isTokenValid)
+  // still applies to state-changing endpoints regardless.
+  if (!origin) {
+    const remote = req.socket && req.socket.remoteAddress;
+    if (remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1") return true;
+    return false;
+  }
+  return ORIGIN_ALLOWLIST.has(origin);
+}
+
+// Constant-time token comparison (audit pass 2 #2, 2026-05-24).
+// `===` on hex strings allows timing side-channel inference one char at a time.
+// crypto.timingSafeEqual requires equal-length buffers — short-circuit the
+// length check first so we never pass mismatched-length buffers to it.
+const STUDIO_TOKEN_BUF = Buffer.from(STUDIO_TOKEN, "utf8");
+function isTokenValid(req) {
+  const t = req.headers["x-mover-token"];
+  if (typeof t !== "string") return false;
+  const buf = Buffer.from(t, "utf8");
+  if (buf.length !== STUDIO_TOKEN_BUF.length) return false;
+  try { return crypto.timingSafeEqual(buf, STUDIO_TOKEN_BUF); } catch { return false; }
+}
+
+// Vault-scoped path resolution with symlink protection (audit pass 2 #3).
+// Previously path.resolve() + relative() only — a symlink inside the vault
+// pointing outside would pass the prefix check but I/O would touch the
+// real target. fs.realpathSync resolves all symlinks; comparing realpaths
+// closes the escape. Returns { absPath, relPath } or throws.
+// Note: realpathSync requires the path to exist. For write paths (file
+// not yet created) we realpath the parent dir instead and join.
+// v6 W3 — merge one journal mode's sub-anchors into the `## Journal` section of
+// a Daily Note, PRESERVING the other mode's sub-anchors. The invariant: writing
+// Evening never clobbers Morning and vice-versa. Sub-anchors are identified by
+// their `### Evening`/`### Morning` (+ `alibi`) header; only THIS mode's blocks
+// are replaced. Output format matches parseJournal() (daily-note-resolver.js)
+// for a clean read round-trip. Append-only in spirit: nothing outside the
+// rewritten mode's sub-anchors is touched.
+// v6 W3 round 4: sanitize a single journal answer line for writing under its
+// `### …` sub-anchor. Collapses newlines (each answer is one line), trims, caps
+// length, and — critically — escapes a LEADING '#'. Without the escape, an
+// answer like "## Review later" would be written as its own line and then read
+// back as a markdown heading: it would end the `## Journal` section (or look
+// like a new `###` sub-anchor), so the written answer silently vanishes on the
+// next read. `\#` is the canonical markdown escape (renders as a literal '#').
+function sanitizeJournalLine(v, max) {
+  return String(v == null ? "" : v)
+    .replace(/\r/g, "")
+    .replace(/\n+/g, " ")
+    .trim()
+    .slice(0, max)
+    .replace(/^#/, "\\#");
+}
+
+// B5: every dashboard write to the user's irreplaceable Daily Note funnels through here.
+// `transform(existing)` returns the new file content, or null to skip the write (e.g. a
+// checkbox item that wasn't found). Two guarantees the raw fs.writeFileSync calls lacked:
+//   1. ATOMIC — tmp + rename, so a crash/power-loss mid-write can never leave a truncated note.
+//   2. DRIFT-SAFE — if the file changed under us since we read `existing` (the user typing in
+//      Obsidian, the CLI /log), the concurrent edit is preserved to a `.bak.<ts>` sidecar
+//      before our write lands, instead of being silently clobbered. withFileLock only
+//      serializes in-process; this covers the cross-process window it cannot.
+function writeNoteAtomic(absPath, transform, opts = {}) {
+  let existing = "";
+  try { existing = fs.readFileSync(absPath, "utf8"); } catch (_) { existing = ""; }
+  const next = transform(existing);
+  if (next == null) return { written: false };
+  const r = writeWithDriftGuard(absPath, existing, next, opts);
+  return { written: true, drifted: r.drifted, backupPath: r.backupPath };
+}
+
+function mergeJournalSection(existing, ymd, mode, newBlock) {
+  // Codex W3 fix 2: classify a sub-anchor by its ANCHORED mode prefix, not a
+  // loose keyword scan. `### Evening …` is evening; `### Morning …` is morning;
+  // a bare `### Alibi`/`### Prediction` (legacy/alt naming for the evening
+  // alibi) is evening ONLY when it isn't a Morning header — so an evening write
+  // can never delete a Morning block, and vice-versa.
+  const isThisMode = (headerLine) => {
+    const h = headerLine.toLowerCase();
+    // Codex W3 round 2: ONLY a header that explicitly starts with the mode name
+    // is replaced. A block that merely mentions "alibi"/"prediction" (or any
+    // other user heading) is left untouched — an evening write never deletes a
+    // block it didn't author. The endpoint always writes the alibi as
+    // "### Evening · alibi", so the anchored prefix already covers our own data;
+    // the old loose alibi/prediction fallback was pure data-loss risk.
+    if (mode === "evening") return /^###\s+evening\b/.test(h);
+    return /^###\s+morning\b/.test(h);
+  };
+  const trimTail = (arr) => { const b = arr.slice(); while (b.length && b[b.length - 1].trim() === "") b.pop(); return b; };
+  if (!existing) {
+    return `# Daily - ${ymd}\n\n## Journal\n\n${newBlock}\n`;
+  }
+  const lines = existing.replace(/\r\n/g, "\n").split("\n");
+  // Locate the `## Journal` section.
+  let jStart = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (/^##\s+Journal\s*$/i.test(lines[i])) { jStart = i; break; }
+  }
+  if (jStart === -1) {
+    const sep = existing.endsWith("\n") ? "" : "\n";
+    return `${existing}${sep}\n## Journal\n\n${newBlock}\n`;
+  }
+  // Section runs until the next H1 or H2 header, or EOF (h3 stays inside).
+  // Codex W3 round 3: parseJournal ends the Journal section at the next H1 OR
+  // H2 (/^#{1,2}\s/), so the merge MUST use the same boundary — otherwise a
+  // `# Later` (H1) after `## Journal` lets the merge write the block outside
+  // what the parser reads, and the round-trip silently breaks. `#{1,2}\s` does
+  // not match `### ` (h3), so sub-anchors stay inside the section.
+  let jEnd = lines.length;
+  for (let i = jStart + 1; i < lines.length; i++) {
+    if (/^#{1,2}\s/.test(lines[i])) { jEnd = i; break; }
+  }
+  // Split the section body into `###` sub-blocks; keep those NOT of this mode.
+  // Codex W3 fix 1: freeform prose BEFORE the first `###` is real user content,
+  // not stray blanks — preserve it as a leading block, never drop it.
+  const sectionLines = lines.slice(jStart + 1, jEnd);
+  const kept = [];
+  const preamble = [];
+  let curHeader = null;
+  let curBuf = [];
+  const flush = () => {
+    if (curHeader == null) return;
+    if (!isThisMode(curHeader)) kept.push(`${curHeader}\n${trimTail(curBuf).join("\n")}`);
+    curHeader = null;
+    curBuf = [];
+  };
+  for (const ln of sectionLines) {
+    if (/^###\s+/.test(ln)) { flush(); curHeader = ln; curBuf = []; }
+    else if (curHeader != null) { curBuf.push(ln); }
+    else { preamble.push(ln); } // before the first sub-anchor → user prose
+  }
+  flush();
+  const preText = trimTail(preamble).join("\n").replace(/^\n+/, "").trim();
+  const journalBody = [preText, ...kept, newBlock].filter((b) => b && b.trim()).join("\n\n");
+  const before = lines.slice(0, jStart + 1).join("\n"); // includes `## Journal`
+  const afterArr = lines.slice(jEnd);
+  // trim leading blanks off the trailing content so spacing stays normalized
+  while (afterArr.length && afterArr[0].trim() === "") afterArr.shift();
+  const tail = afterArr.length ? `\n\n${afterArr.join("\n")}` : "\n";
+  return `${before}\n\n${journalBody}${tail}`;
+}
+
+function resolveVaultScoped(vault, filePath, { mustExist = false } = {}) {
+  if (!vault) throw Object.assign(new Error("vault not set"), { code: "EVAULT" });
+  if (!filePath) throw Object.assign(new Error("filePath required"), { code: "EARG" });
+  const vaultAbs = fs.realpathSync(path.resolve(vault));
+  let targetAbs = path.resolve(filePath);
+  // Try realpath; if file missing, realpath the parent and reassemble.
+  try {
+    targetAbs = fs.realpathSync(targetAbs);
+  } catch (err) {
+    if (mustExist || err.code !== "ENOENT") throw err;
+    const parent = fs.realpathSync(path.dirname(targetAbs));
+    targetAbs = path.join(parent, path.basename(targetAbs));
+  }
+  const rel = path.relative(vaultAbs, targetAbs);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw Object.assign(new Error("path escapes vault"), { code: "EESCAPE" });
+  }
+  return { absPath: targetAbs, relPath: rel, vaultAbs };
+}
+
+// Per-file async write queue (audit pass 2 #4, #5, #6).
+// config.json / snoozes.json / pattern-manifest.json all use a
+// read-modify-write pattern. Concurrent writes from two POSTs would
+// load the same baseline, mutate independently, and the second write
+// silently clobbered the first. Each unique file path gets its own
+// promise chain so writes serialize per-file (parallel across files).
+const _fileLocks = new Map();
+function withFileLock(key, fn) {
+  const prev = _fileLocks.get(key) || Promise.resolve();
+  const next = prev.then(fn, fn).finally(() => {
+    if (_fileLocks.get(key) === next) _fileLocks.delete(key);
+  });
+  _fileLocks.set(key, next);
+  return next;
+}
+
+// Atomic JSON write — tmp file + rename. Same filesystem rename is
+// atomic on POSIX and effectively atomic on modern Windows NTFS, so
+// a crash mid-write leaves either the old file or the new file, never
+// a half-written one. (audit pass 2 #4 + find-bugs #8.)
+function atomicWriteJson(filePath, obj) {
+  const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  fs.writeFileSync(tmp, JSON.stringify(obj, null, 2), "utf8");
+  fs.renameSync(tmp, filePath);
+}
+
+// v6 W5 SERVE-FLIP — the SOLE dashboard is the React app in ui/dist (the v6
+// build). The old ui-v2/dist (v5-Rams) + the vanilla ~/.mover/dashboard
+// fallback are retired; ui-v2/ is archived to _archive-v5/. One dist, no
+// fallbacks, no version mixups — this is what fixed the "wrong dashboard".
+// (UI_LEGACY_DIST_* points at ui/dist — the name is historical.)
+const UI_LEGACY_DIST_DIR = path.join(__dirname, "ui", "dist");
+const UI_LEGACY_DIST_INDEX = path.join(UI_LEGACY_DIST_DIR, "index.html");
+function uiDistAvailable() {
+  try { return fs.existsSync(UI_LEGACY_DIST_INDEX); } catch (_) { return false; }
+}
+
+function activeUiDist() {
+  return { dir: UI_LEGACY_DIST_DIR, index: UI_LEGACY_DIST_INDEX };
+}
+
+// Legacy constants kept for any downstream code that imports them — they
+// now point at whichever dist is active.
+const UI_DIST_DIR = activeUiDist().dir;
+const UI_DIST_INDEX = activeUiDist().index;
+
+const PRIMARY_PORT = 3737;
+const PORT_FALLBACKS = [3737, 3738, 3739, 3740];
+
+const MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".woff2": "font/woff2",
+  ".woff": "font/woff",
+  ".ttf": "font/ttf",
+  ".ico": "image/x-icon",
+  ".webmanifest": "application/manifest+json",
+  ".map": "application/json; charset=utf-8"
+};
+
+function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
+  return new Promise((resolve, reject) => {
+    let lastBuild = null;
+    let lastError = null;
+    // Activation log gate — fire dashboard_open ONCE per server process.
+    let activationLogged = false;
+    // Serialize onboarding Engine commits so two concurrent finalizes can't both
+    // pass the fresh-guard and interleave a half-written Engine (Codex r1 MF).
+    let finalizeLock = false;
+    // Build mutex (code-bug-audit H2, 2026-05-24): /api/refresh + /api/
+    // checkbox/toggle + /api/snooze + /api/override all call buildFn()
+    // and write `lastBuild`. Without a lock, concurrent POSTs torn-write
+    // ~/.mover/drift-history.json + ~/.mover/pattern-manifest.json.
+    // Pattern: one in-flight build per process; concurrent callers wait
+    // on the same promise.
+    let buildLock = null;
+    const safeBuild = () => {
+      if (buildLock) return buildLock;
+      buildLock = Promise.resolve(buildFn()).finally(() => { buildLock = null; });
+      return buildLock;
+    };
+
+    // Onboarding-engine session manager. cwd = the user's vault so the agent
+    // reasons in their real context. Killed on shutdown (zombie-process guard).
+    const agentSessions = new AgentSessionManager({ cwd: vault });
+
+    // Run-tab registry — server-held one-shot runs so the Run tab is persistent
+    // (survives navigation + refresh) the same way Chat is. Decouples the child
+    // from the request that started it; killed on shutdown. See lib/run-registry.js.
+    const runRegistry = new RunRegistry();
+
+    const server = http.createServer(async (req, res) => {
+      try {
+        const url = new URL(req.url, `http://${req.headers.host}`);
+        const pathname = url.pathname;
+
+        // API routes
+        if (pathname === "/api/health") {
+          // Health hands out the per-session CSRF token. Same-origin requests
+          // (the React UI on same host) can read it from here.
+          return jsonResponse(res, 200, {
+            ok: true,
+            version,
+            vault,
+            enginePresent: engineIsSetUp(vault),
+            builtAt: lastBuild ? lastBuild.builtAt : null,
+            uptime: process.uptime(),
+            token: STUDIO_TOKEN
+          });
+        }
+
+        // Block POSTs from unknown origins (basic CSRF defense)
+        if (req.method === "POST") {
+          if (!isOriginAllowed(req)) {
+            return jsonResponse(res, 403, { ok: false, error: "Origin not allowed" });
+          }
+          // Token enforcement on all state-changing endpoints.
+          // /api/refresh was previously misclassified as "read-only POST" but
+          // it triggers a full vault rebuild — DoS amplification vector if
+          // hit cross-origin without token (code-bug-audit C2, 2026-05-24).
+          const tokenedRoutes = ["/api/agent/run", "/api/runs/stop", "/api/workflow/run", "/api/workflow/open-in-terminal", "/api/cli/run", "/api/cli/open-in-terminal", "/api/checkbox/toggle", "/api/snooze", "/api/override", "/api/config", "/api/file/open", "/api/refresh", "/api/event", "/api/view/generate", "/api/view/delete", "/api/capture", "/api/journal", "/api/session/start", "/api/session/send", "/api/session/approve", "/api/session/end", "/api/session/finalize", "/api/session/ingest", "/api/setup/recommend", "/api/setup/shortcut"];
+          if (tokenedRoutes.includes(pathname) && !isTokenValid(req)) {
+            return jsonResponse(res, 401, { ok: false, error: "Missing or invalid X-Mover-Token header" });
+          }
+        }
+
+        if (pathname === "/api/state.json") {
+          // V5.0 activation instrumentation (audit pass 2 #7 + find-bugs #1).
+          // Originally fired on /api/health, but the React UI does not call
+          // /api/health on mount — it calls /api/state.json. That meant
+          // dashboard_open never logged on a normal page load, only on the
+          // (rare) explicit refresh that hit /api/health. Moving it here
+          // fires it exactly when the dashboard is actually opened.
+          //
+          // Pass 3 #9 fix: this is a write side-effect on an unauthenticated
+          // GET. Gate behind same-origin signals (Origin header matches an
+          // allowed origin OR sec-fetch-site is 'same-origin') so a cross-
+          // site prefetch / image / iframe can't pollute the activation log.
+          if (!activationLogged) {
+            const origin = req.headers.origin;
+            const fetchSite = req.headers["sec-fetch-site"];
+            const sameOrigin =
+              (origin && ORIGIN_ALLOWLIST.has(origin)) ||
+              fetchSite === "same-origin" ||
+              fetchSite === "none"; // direct navigation (user typed URL)
+            if (sameOrigin) {
+              activationLogged = true;
+              try { logActivationEvent("dashboard_open", { version }); } catch (_) {}
+            }
+          }
+          if (lastBuild && lastBuild.state) return jsonResponse(res, 200, lastBuild.state);
+          return jsonResponse(res, 200, { available: false });
+        }
+
+        // v2 dashboard surface endpoints. Each returns a subset of state.json
+        // for the Library route's Skills / Hooks / CLI sub-tabs — lighter
+        // payload than re-fetching the entire state on every tab switch.
+        if (pathname === "/api/skills/index") {
+          if (lastBuild && lastBuild.state && lastBuild.state.skills) {
+            return jsonResponse(res, 200, lastBuild.state.skills);
+          }
+          return jsonResponse(res, 200, { available: false, count: 0, byCategory: { system: [], specialist: [], domain: [] }, all: [] });
+        }
+        if (pathname === "/api/hooks/index") {
+          if (lastBuild && lastBuild.state && lastBuild.state.hooks) {
+            return jsonResponse(res, 200, lastBuild.state.hooks);
+          }
+          return jsonResponse(res, 200, { available: false, count: 0, byEvent: {}, registered: [], unregistered: [], all: [] });
+        }
+        if (pathname === "/api/cli/usage") {
+          if (lastBuild && lastBuild.state && lastBuild.state.cliUsage) {
+            return jsonResponse(res, 200, lastBuild.state.cliUsage);
+          }
+          return jsonResponse(res, 200, { available: false, commands: [] });
+        }
+        if (pathname === "/api/library/v2") {
+          if (lastBuild && lastBuild.state && lastBuild.state.libraryV2) {
+            return jsonResponse(res, 200, lastBuild.state.libraryV2);
+          }
+          return jsonResponse(res, 200, { available: false });
+        }
+
+        // F37 — OG Image generator. Renders a server-side SVG receipt
+        // suitable for og:image meta tags on shared moveros.dev pages.
+        // Twitter/X, Discord, and Slack render SVG og:images directly.
+        // Formats:
+        //   /api/og              — default 1200×630 (Twitter/LinkedIn)
+        //   /api/og?format=square — 1080×1080 (Instagram)
+        //   /api/og?format=story  — 1080×1920 (Stories)
+        // Query params:
+        //   ?metric=drift|streak|patterns (which number to feature)
+        //   ?title=... (override headline)
+        if (pathname === "/api/og") {
+          try {
+            const state = (lastBuild && lastBuild.state) || {};
+            const format = url.searchParams.get("format") || "default";
+            const metric = url.searchParams.get("metric") || "drift";
+            const titleOverride = url.searchParams.get("title") || undefined;
+            const svg = renderOgSvg(state, { format, metric, title: titleOverride });
+            res.writeHead(200, {
+              "Content-Type": "image/svg+xml; charset=utf-8",
+              "Cache-Control": "no-cache, no-store, must-revalidate",
+              "X-Mover-Og": "1",
+            });
+            res.end(svg);
+            return;
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // GET/POST ~/.mover/config.json — surfaces user-tunable settings
+        // (density, mono mode, preferredAgent, evening_zone_start, etc).
+        // Studio writes here ONLY, never to Engine files.
+        if (pathname === "/api/config") {
+          const os = require("os");
+          const configPath = path.join(os.homedir(), ".mover", "config.json");
+          if (req.method === "GET") {
+            // T242 bug hunt fix — config.json contains vaultPath and any
+            // integration tokens the user has stored. GET previously had
+            // no auth, so any local process or cross-origin browser tab
+            // that bypassed origin checks could dump the user's vault
+            // location. Require same-origin signals OR a valid token,
+            // matching the /api/state.json gate at L222-232.
+            const origin = req.headers.origin;
+            const fetchSite = req.headers["sec-fetch-site"];
+            const sameOrigin =
+              (origin && ORIGIN_ALLOWLIST.has(origin)) ||
+              fetchSite === "same-origin" ||
+              fetchSite === "none";
+            if (!sameOrigin && !isTokenValid(req)) {
+              return jsonResponse(res, 401, { ok: false, error: "Missing or invalid X-Mover-Token header" });
+            }
+            try {
+              const raw = fs.readFileSync(configPath, "utf8");
+              return jsonResponse(res, 200, { ok: true, config: JSON.parse(raw) });
+            } catch (e) {
+              if (e.code === "ENOENT") return jsonResponse(res, 200, { ok: true, config: {} });
+              return jsonResponse(res, 500, { ok: false, error: "config read failed" });
+            }
+          }
+          if (req.method === "POST") {
+            try {
+              const patch = await readJsonBody(req, 16 * 1024);
+              // Serialize concurrent config writes (audit pass 2 #4).
+              const merged = await withFileLock(configPath, () => {
+                let existing = {};
+                try { existing = JSON.parse(fs.readFileSync(configPath, "utf8")); } catch (_) {}
+                // Shallow merge — keys present in patch override, others kept.
+                // Allow nested `studio.<key>` merges via top-level studio object.
+                const out = { ...existing, ...patch };
+                if (existing.studio && patch.studio) {
+                  out.studio = { ...existing.studio, ...patch.studio };
+                }
+                // #112: providerPrefs merges two levels deep (per provider),
+                // so posting { providerPrefs: { codex: { effort } } } cannot
+                // clobber claude-code's model or gemini's approval mode.
+                if (existing.providerPrefs && patch.providerPrefs) {
+                  const pp = { ...existing.providerPrefs };
+                  for (const k of Object.keys(patch.providerPrefs)) {
+                    const prev = pp[k], next = patch.providerPrefs[k];
+                    pp[k] = prev && typeof prev === "object" && next && typeof next === "object"
+                      ? { ...prev, ...next } : next;
+                  }
+                  out.providerPrefs = pp;
+                }
+                fs.mkdirSync(path.dirname(configPath), { recursive: true });
+                atomicWriteJson(configPath, out);
+                return out;
+              });
+              return jsonResponse(res, 200, { ok: true, config: merged });
+            } catch (e) {
+              return jsonResponse(res, 500, { ok: false, error: e.message });
+            }
+          }
+        }
+
+        if (pathname === "/api/refresh") {
+          // POST-only: the origin + token gate above is wrapped in
+          // `if (req.method === "POST")`, so a GET/HEAD would skip both and
+          // still trigger a full vault rebuild (cross-origin DoS amplification
+          // via <img src>). Refuse any other verb before the handler runs.
+          if (req.method !== "POST") {
+            return jsonResponse(res, 405, { ok: false, error: "Method not allowed" });
+          }
+          try {
+            const newBuild = await safeBuild();
+            lastBuild = newBuild;
+            lastError = null;
+            return jsonResponse(res, 200, { ok: true, builtAt: newBuild.builtAt, sectionCount: newBuild.sectionCount });
+          } catch (e) {
+            lastError = e.message;
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        if (pathname === "/api/agent/run" && req.method === "POST") {
+          const body = await readJsonBody(req, 64 * 1024);
+          return runAgentStream({ req, res, body, vault, runRegistry });
+        }
+
+        // ── Run-tab persistence: the runs the registry is holding ────────────
+        // GET  /api/runs            → list run summaries (rehydrate after refresh)
+        // GET  /api/runs/get?id=    → one run incl. full output (expand a card)
+        // GET  /api/runs/stream?id= → reattach (replay buffer + live tail), same
+        //                             text/plain shape as /api/agent/run
+        // POST /api/runs/stop       → actually stop a run (SIGTERM) [tokened]
+        // Read endpoints are un-tokened, matching /api/session/events (same class
+        // of loopback agent-output stream behind the Origin guard).
+        if (pathname === "/api/runs" && req.method === "GET") {
+          return jsonResponse(res, 200, { ok: true, runs: runRegistry.list() });
+        }
+        if (pathname === "/api/runs/get" && req.method === "GET") {
+          const run = runRegistry.get(url.searchParams.get("id") || "");
+          if (!run) return jsonResponse(res, 404, { ok: false, error: "no such run" });
+          return jsonResponse(res, 200, { ok: true, run });
+        }
+        if (pathname === "/api/runs/stream" && req.method === "GET") {
+          const id = url.searchParams.get("id") || "";
+          if (!runRegistry.has(id)) {
+            res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+            return res.end("no such run\n");
+          }
+          res.writeHead(200, {
+            "Content-Type": "text/plain; charset=utf-8",
+            "Cache-Control": "no-cache",
+            "X-Accel-Buffering": "no",
+          });
+          const unsub = runRegistry.subscribe(id, (ev) => {
+            if (ev.type === "replay" || ev.type === "chunk") { try { res.write(ev.text); } catch (_) {} }
+            else if (ev.type === "end") { try { res.end(); } catch (_) {} }
+          });
+          req.on("close", () => { try { unsub(); } catch (_) {} });
+          return; // hold the stream open
+        }
+        if (pathname === "/api/runs/stop" && req.method === "POST") {
+          const body = await readJsonBody(req, 4 * 1024);
+          const ok = runRegistry.stop(String(body.id || ""));
+          return jsonResponse(res, 200, { ok });
+        }
+
+        // System version + free/major update signal for the dashboard prompt.
+        if (pathname === "/api/version" && req.method === "GET") {
+          return jsonResponse(res, 200, { ok: true, ...versionInfo(version) });
+        }
+
+        // ── Onboarding engine: persistent multi-turn agent sessions ──────────
+        // Drives the user's own agent as a structured stream-json process so the
+        // dashboard runs setup/walkthrough as a real conversation, never the raw
+        // terminal (onboarding-engine-SPEC.md §2). SSE out, POST in.
+        if (pathname === "/api/session/start" && req.method === "POST") {
+          const body = await readJsonBody(req, 8 * 1024);
+          try {
+            // Prepend the user's worldview-lens preamble (config.lens) so the
+            // interview / walkthrough speaks their own language (Phase D).
+            const { DEFAULT_SETUP_SYSTEM, FULL_SETUP_SYSTEM, CHAT_SYSTEM, lensPreamble } = require("./lib/agent-session");
+            let lens = "everyday";
+            try { lens = require("./lib/config-parser").read().lens || "everyday"; } catch (_) {}
+            const isChat = String(body.mode) === "chat";
+            const setupDepth = String(body.setupDepth || "full");
+            const setupSystem = setupDepth === "core" ? DEFAULT_SETUP_SYSTEM : FULL_SETUP_SYSTEM;
+            const base = body.systemPrompt ? String(body.systemPrompt) : (isChat ? CHAT_SYSTEM : setupSystem);
+            const pre = lensPreamble(lens);
+            // R3-C3: per-session model/effort with the same loud-refusal
+            // contract as one-shot runs (cleanToken drops spaces/metachars).
+            const { cleanToken, EFFORTS: SESSION_EFFORTS } = require("./lib/agent-command");
+            const reqModel = body.model != null ? String(body.model).trim() : "";
+            const reqEffort = body.effort != null ? String(body.effort).trim() : "";
+            const model = reqModel ? cleanToken(reqModel, 64) : null;
+            const effort = reqEffort && (SESSION_EFFORTS["claude-code"] || []).includes(reqEffort) ? reqEffort : null;
+            if (reqModel && !model) {
+              return jsonResponse(res, 400, { ok: false, error: `Model "${reqModel}" was rejected: letters, digits, . _ : - only, no spaces.` });
+            }
+            if (reqEffort && !effort) {
+              return jsonResponse(res, 400, { ok: false, error: `Effort "${reqEffort}" is not one of: ${(SESSION_EFFORTS["claude-code"] || []).join(", ")}.` });
+            }
+            const out = agentSessions.start({
+              agent: String(body.agent || "claude-code"),
+              systemPrompt: pre ? (pre + " " + base) : base,
+              model, effort,
+              ...(isChat ? { disallowTools: [], chat: true } : {}), // chat = full tool access + recall/skill hooks; setup stays locked
+            });
+            return jsonResponse(res, 200, { ok: true, ...out });
+          } catch (e) {
+            return jsonResponse(res, 400, { ok: false, error: e.message });
+          }
+        }
+        if (pathname === "/api/session/send" && req.method === "POST") {
+          const body = await readJsonBody(req, 64 * 1024);
+          try {
+            agentSessions.send(String(body.sessionId || ""), String(body.text || ""));
+            return jsonResponse(res, 200, { ok: true });
+          } catch (e) {
+            return jsonResponse(res, 400, { ok: false, error: e.message });
+          }
+        }
+        if (pathname === "/api/session/approve" && req.method === "POST") {
+          const body = await readJsonBody(req, 8 * 1024);
+          try {
+            agentSessions.approve(String(body.sessionId || ""), body.requestId, String(body.decision || "deny"));
+            return jsonResponse(res, 200, { ok: true });
+          } catch (e) {
+            return jsonResponse(res, 400, { ok: false, error: e.message });
+          }
+        }
+        if (pathname === "/api/session/end" && req.method === "POST") {
+          const body = await readJsonBody(req, 4 * 1024);
+          agentSessions.end(String(body.sessionId || ""));
+          return jsonResponse(res, 200, { ok: true });
+        }
+        // A — seed the Engine from a completed setup interview. Body:
+        // { sessionId, targetDir?, dryRun?, force? }. dryRun defaults TRUE
+        // (preview, no write). engine-writer blocks 02_Areas/Engine/ ALWAYS;
+        // omitting targetDir falls back to the dev sandbox (safe for preview).
+        if (pathname === "/api/session/finalize" && req.method === "POST") {
+          const body = await readJsonBody(req, 64 * 1024);
+          const sid = String(body.sessionId || "");
+          const { writeEngine } = require("./lib/engine-writer");
+
+          // Transcript source: a LIVE session ALWAYS wins. Only with no session
+          // do we accept a client-supplied transcript (the no-agent form) — and
+          // then it is role/type-validated, per-item length-capped, count-capped.
+          let transcript;
+          if (sid) {
+            transcript = agentSessions.getTranscript(sid) || [];
+          } else if (Array.isArray(body.transcript) && body.transcript.length) {
+            transcript = body.transcript
+              .slice(0, 200)
+              .filter((t) => t && (t.role === "user" || t.role === "assistant") && typeof t.text === "string")
+              .map((t) => ({ role: t.role, text: t.text.slice(0, 8000) }));
+          } else {
+            return jsonResponse(res, 400, { ok: false, error: "sessionId or a non-empty transcript is required" });
+          }
+          if (!transcript.length) return jsonResponse(res, 400, { ok: false, error: "empty transcript" });
+
+          // The SERVER resolves the target. The client may NOT pass targetDir or
+          // force. Two modes only: commit to THIS vault's Engine (fresh-install
+          // only, never force-overwrite), or a dev-sandbox preview.
+          const toVault = body.toVault === true;
+          const dryRun = body.dryRun !== false;
+          const targetDir = toVault
+            ? path.join(vault, "02_Areas", "Engine")
+            : path.join(__dirname, "..", "..", "dev", "research", "dashboard-direction-2026-06-10", "onboarding-build", "sandbox-engine");
+
+          const runFinalize = () => {
+            try {
+              const result = writeEngine({ transcript, targetDir, dryRun, force: false, allowEngineWrite: toVault });
+              // the synthesis "forge" beats — derived 1:1 from the real files being written,
+              // so the onboarding animation reflects the truth (tested in onboarding-forge).
+              const forge = forgeBeats(result.files.map((f) => f.path));
+              return jsonResponse(res, 200, { ok: true, written: result.written, target: targetDir, fileCount: result.files.length, forge,
+                files: dryRun ? result.files.map((f) => ({ path: f.path, content: f.content })) : result.files.map((f) => ({ path: f.path })) });
+            } catch (e) {
+              const msg = e.message || "";
+              const code = (msg.includes("SAFETY BLOCK") || msg.includes("already exists")) ? 403 : 500;
+              return jsonResponse(res, code, { ok: false, error: String(e && e.message || e) });
+            }
+          };
+
+          // Previews never lock. Real vault commits serialize so two finalizes
+          // can't both pass the fresh-guard and interleave (Codex r1).
+          if (dryRun || !toVault) return runFinalize();
+          if (finalizeLock) return jsonResponse(res, 409, { ok: false, error: "an Engine write is already in progress" });
+          finalizeLock = true;
+          try { return runFinalize(); } finally { finalizeLock = false; }
+        }
+        if (pathname === "/api/session/events" && req.method === "GET") {
+          const sid = url.searchParams.get("id") || "";
+          if (!agentSessions.has(sid)) {
+            res.writeHead(404, { "Content-Type": "text/plain" });
+            return res.end("no such session");
+          }
+          res.writeHead(200, {
+            "Content-Type": "text/event-stream; charset=utf-8",
+            "Cache-Control": "no-cache, no-transform",
+            "Connection": "keep-alive",
+            "X-Accel-Buffering": "no",
+          });
+          res.write(": connected\n\n");
+          const unsub = agentSessions.subscribe(sid, (ev) => {
+            try { res.write(`data: ${JSON.stringify(ev)}\n\n`); } catch (_) {}
+          });
+          const ping = setInterval(() => { try { res.write(": ping\n\n"); } catch (_) {} }, 25000);
+          if (ping.unref) ping.unref();
+          req.on("close", () => { clearInterval(ping); try { unsub(); } catch (_) {} });
+          return; // hold the SSE connection open
+        }
+        // Standalone foundation proof page for the setup turn-loop.
+        if (pathname === "/setup" && req.method === "GET") {
+          try {
+            const html = fs.readFileSync(path.join(__dirname, "static", "setup-poc.html"), "utf8");
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            return res.end(html);
+          } catch (_) {
+            res.writeHead(404, { "Content-Type": "text/plain" });
+            return res.end("setup-poc.html not found");
+          }
+        }
+        // D6 — the WALKTHROUGH proof page (teaches operating the agent). Mirrors
+        // /setup; steps are inlined in the page, served fresh each GET.
+        if (pathname === "/walkthrough" && req.method === "GET") {
+          try {
+            const html = fs.readFileSync(path.join(__dirname, "static", "walkthrough-poc.html"), "utf8");
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            return res.end(html);
+          } catch (_) {
+            res.writeHead(404, { "Content-Type": "text/plain" });
+            return res.end("walkthrough-poc.html not found");
+          }
+        }
+        // D7 — which coding agents are installed + authed + runnable (no
+        // interactive login is ever triggered). Read-only, no token needed.
+        if (pathname === "/api/agents/detect" && req.method === "GET") {
+          try { return jsonResponse(res, 200, { ok: true, agents: await agentDetect.detectAgents() }); }
+          catch (e) { return jsonResponse(res, 500, { ok: false, error: String(e && e.message || e) }); }
+        }
+        // D3 — ingest the user's exported notes into a live setup session as a
+        // framed context turn. Body: { sessionId, files:[{name, content}] }.
+        if (pathname === "/api/session/ingest" && req.method === "POST") {
+          const body = await readJsonBody(req, 2 * 1024 * 1024);
+          const sid = String(body.sessionId || "");
+          if (!agentSessions.has(sid)) return jsonResponse(res, 404, { ok: false, error: "no such session" });
+          const files = Array.isArray(body.files) ? body.files : [];
+          let digest = "";
+          try { digest = ingestion.buildDigest(files); }
+          catch (e) { return jsonResponse(res, 400, { ok: false, error: "ingest failed: " + String(e && e.message || e) }); }
+          if (!digest) return jsonResponse(res, 200, { ok: true, injected: false, note: "no usable content" });
+          try { agentSessions.send(sid, ingestion.frameDigest(digest)); }
+          catch (e) { return jsonResponse(res, 500, { ok: false, error: String(e && e.message || e) }); }
+          return jsonResponse(res, 200, { ok: true, injected: true, chars: digest.length });
+        }
+        // D4 — map a work profile to recommended skills/connectors.
+        // Body: { profile:{ work?, domain?, tools?, goals? } }.
+        if (pathname === "/api/setup/recommend" && req.method === "POST") {
+          const body = await readJsonBody(req, 64 * 1024);
+          const profile = (body && typeof body.profile === "object" && body.profile) || body || {};
+          try {
+            return jsonResponse(res, 200, {
+              ok: true,
+              ...skillRecommender.recommend(profile),
+              // personalized "what to feed/connect me" plan (cold-start fix) — honest:
+              // upload sources are ready (real ingest), live OAuth connectors are 'planned'.
+              connectPlan: connectRecommender.connectPlan(profile),
+              // owner ruling 2026-07-07: bundled skills install ALL; the
+              // recommend layer's real job is EXTERNAL awareness — MCP
+              // connectors + CLI tools, profile-matched from the shipped
+              // catalogues, with what's already installed/attached flagged
+              // from the machine itself.
+              skillsPolicy: "install-all",
+              external: require("./lib/tool-awareness").awareness(profile, { vault }),
+            });
+          }
+          catch (e) { return jsonResponse(res, 500, { ok: false, error: String(e && e.message || e) }); }
+        }
+        // D7 — create a double-clickable desktop launcher so the user can reopen
+        // the dashboard from their OS. Body: { name }. Cross-platform (mac .app /
+        // win .lnk / linux .desktop); shortcut.js never throws on a single-platform
+        // failure (returns a skipped reason), so onboarding is never blocked.
+        if (pathname === "/api/setup/shortcut" && req.method === "POST") {
+          const body = await readJsonBody(req, 4 * 1024);
+          const name = String(body.name || "").slice(0, 80);
+          try {
+            const { createShortcut } = require("./shortcut");
+            const result = createShortcut({
+              name,
+              nodeBin: process.execPath,
+              entry: path.join(__dirname, "..", "..", "install.js"),
+            });
+            return jsonResponse(res, 200, { ok: true, ...result });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: String(e && e.message || e) });
+          }
+        }
+
+        // Run a Mover workflow (e.g. /analyse-day) via the user's preferred
+        // agent CLI. Body: { workflow: "/analyse-day", agent?: "claude-code",
+        // model?, effort?, approvalMode? } — tuning fields are per-run (#112);
+        // omitted ones resolve from config providerPrefs inside runAgentStream.
+        if (pathname === "/api/workflow/run" && req.method === "POST") {
+          const body = await readJsonBody(req, 16 * 1024);
+          const workflow = String(body.workflow || "").trim();
+          const agent = String(body.agent || "claude-code").trim();
+          if (!workflow.startsWith("/")) {
+            return jsonResponse(res, 400, { ok: false, error: "workflow must start with /" });
+          }
+          // V5.0 activation event — fires for the streaming workflow runner
+          // path too. Pairs with the open-in-terminal logger below so
+          // "workflow_run" stats reflect both Pattern A and stream usage.
+          try { logActivationEvent("workflow_run", { workflow, agent }); } catch (_) {}
+          return runAgentStream({
+            req, res,
+            body: { agent, prompt: workflow, model: body.model, effort: body.effort, approvalMode: body.approvalMode },
+            vault, runRegistry
+          });
+        }
+
+        // Pattern A: open the user's REAL terminal at the vault root with the
+        // agent's interactive CLI running. The slash command is returned in
+        // the response so the client can copy it to clipboard and the user
+        // pastes it into their own session. No phantom background processes,
+        // no hidden execution, full Ctrl+C control.
+        // Body: { workflow: "/log", agent: "claude-code" }
+        if (pathname === "/api/workflow/open-in-terminal" && req.method === "POST") {
+          const body = await readJsonBody(req, 16 * 1024);
+          const workflow = String(body.workflow || "").trim();
+          const agent = String(body.agent || "claude-code").trim();
+          if (!/^\/[a-z0-9][a-z0-9-]{0,40}$/i.test(workflow)) {
+            return jsonResponse(res, 400, { ok: false, error: "workflow must match /[a-z0-9-]+" });
+          }
+          // Map agent id → interactive CLI command. Only registered agents
+          // are allowed — no raw shell. Validates against the same registry
+          // that runAgentStream uses (agentCommand).
+          const AGENT_INTERACTIVE_CMD = {
+            "claude-code": "claude",
+            "codex": "codex",
+            "gemini": "gemini",
+          };
+          const ALIASES = { "gemini-cli": "gemini", "claude": "claude-code", "codex-cli": "codex" };
+          const resolvedAgent = ALIASES[agent] || agent;
+          const cli = AGENT_INTERACTIVE_CMD[resolvedAgent];
+          if (!cli) {
+            return jsonResponse(res, 400, { ok: false, error: `Unsupported agent: ${agent}` });
+          }
+          try {
+            openInTerminal(cli, vault);
+            // V5.0 activation event (Phase 41.0.3 wiring, Codex #4 finding):
+            // logs the workflow_run event so activation stats can show real
+            // user behavior. Best-effort — never blocks the response.
+            try { logActivationEvent("workflow_run", { workflow, agent: resolvedAgent }); } catch (_) {}
+            return jsonResponse(res, 200, {
+              ok: true,
+              agent: resolvedAgent,
+              cli,
+              workflow,
+              hint: `Terminal opened at vault root running ${cli}. Paste ${workflow} to run.`,
+            });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // Run a Mover CLI command (e.g. moveros doctor, moveros capture).
+        // Body: { cmd: "doctor", args?: ["--verbose"] }
+        if (pathname === "/api/cli/run" && req.method === "POST") {
+          const body = await readJsonBody(req, 16 * 1024);
+          const cmd = String(body.cmd || "").trim();
+          const args = Array.isArray(body.args) ? body.args.map(String).slice(0, 32) : [];
+          if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(cmd)) {
+            return jsonResponse(res, 400, { ok: false, error: "invalid cmd (alphanumeric + dash/underscore only)" });
+          }
+          return runMoverosStream({ req, res, cmd, args, vault });
+        }
+
+        // Open a registered command in the user's REAL terminal app.
+        // Body: { commandId: "doctor", args?: ["--verbose"] }
+        // Codex security audit: never accept raw cmd strings — validate against registry.
+        if (pathname === "/api/cli/open-in-terminal" && req.method === "POST") {
+          const body = await readJsonBody(req, 16 * 1024);
+          const commandId = String(body.commandId || "").trim();
+          const args = Array.isArray(body.args) ? body.args.map(String).slice(0, 32) : [];
+          const reg = getCliIndex().cli.find((c) => c.cmd === commandId);
+          if (!reg) return jsonResponse(res, 400, { ok: false, error: `Unknown commandId: ${commandId}` });
+          // Validate args — alphanumeric + dash + equals + dot only, no shell metachars
+          const ARG_RE = /^[a-zA-Z0-9._=/-]{0,80}$/;
+          for (const a of args) {
+            if (!ARG_RE.test(a)) {
+              return jsonResponse(res, 400, { ok: false, error: `Invalid arg: ${a}` });
+            }
+          }
+          const cmdLine = `moveros ${commandId} ${args.join(" ")}`.trim();
+          try {
+            openInTerminal(cmdLine, vault);
+            return jsonResponse(res, 200, { ok: true, opened: cmdLine });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // List of all runnable commands the dashboard can offer.
+        if (pathname === "/api/cli/index") {
+          return jsonResponse(res, 200, getCliIndex());
+        }
+
+        // Recent Engine writes — "what just changed" for the topbar bell.
+        // Scans 02_Areas/Engine/ (depth 2, to include Dailies/YYYY-MM/) for .md
+        // files, newest mtime first. Returns vault-RELATIVE paths (openFileView
+        // resolves them). Read-only, scoped to the Engine dir.
+        if (pathname === "/api/recent" && req.method === "GET") {
+          try {
+            const limit = Math.min(parseInt(url.searchParams.get("limit") || "12", 10) || 12, 40);
+            const engineDir = path.join(vault, "02_Areas", "Engine");
+            const found = [];
+            const walk = (dir, depth) => {
+              let entries;
+              try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
+              for (const ent of entries) {
+                if (ent.name.startsWith(".")) continue;
+                const full = path.join(dir, ent.name);
+                if (ent.isDirectory()) { if (depth < 2) walk(full, depth + 1); }
+                else if (ent.isFile() && ent.name.endsWith(".md")) {
+                  try { const st = fs.statSync(full); found.push({ p: path.relative(vault, full), n: ent.name, m: st.mtimeMs, s: st.size }); } catch (_) {}
+                }
+              }
+            };
+            walk(engineDir, 0);
+            found.sort((a, b) => b.m - a.m);
+            const files = found.slice(0, limit).map((f) => ({ path: f.p, name: f.n, mtime: new Date(f.m).toISOString(), size: f.s }));
+            return jsonResponse(res, 200, { ok: true, files });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: "recent scan failed" });
+          }
+        }
+
+        // Read a vault-scoped file's contents (for the in-app MD viewer drawer).
+        // Query: ?path=<absolute path under vault>
+        // Returns { ok, content, mtime, size } — capped at 256KB.
+        if (pathname === "/api/file/read" && req.method === "GET") {
+          const filePath = url.searchParams.get("path") || "";
+          let scoped;
+          try {
+            // Realpath-resolved, refuses symlink escapes (audit pass 2 #3).
+            scoped = resolveVaultScoped(vault, filePath, { mustExist: true });
+          } catch (e) {
+            const code = e.code === "EESCAPE" ? 400 : e.code === "ENOENT" ? 404 : 400;
+            // T242 bug hunt fix (B#2): success path returned only relPath
+            // but error path echoed e.message which can contain the
+            // resolved absolute path or the input path (e.g. ENOENT errors
+            // include 'lstat ~/.ssh/id_rsa'). Generic messages instead —
+            // the caller knows which path it sent.
+            const msg = e.code === "EESCAPE" ? "path escapes vault" :
+                        e.code === "ENOENT" ? "file not found" : "invalid path";
+            return jsonResponse(res, code, { ok: false, error: msg });
+          }
+          try {
+            const stat = fs.statSync(scoped.absPath);
+            if (stat.size > 256 * 1024) {
+              return jsonResponse(res, 413, { ok: false, error: "file too large (>256KB) — open in Obsidian" });
+            }
+            const content = fs.readFileSync(scoped.absPath, "utf8");
+            return jsonResponse(res, 200, {
+              ok: true,
+              // Return vault-relative path only (code-bug-audit M1).
+              // Returning targetAbs leaked the user's home/filesystem layout
+              // to any browser context that hit this endpoint.
+              path: scoped.relPath,
+              content,
+              mtime: stat.mtime.toISOString(),
+              size: stat.size,
+            });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: "file read failed" });
+          }
+        }
+
+        // Open a file in the user's default app (Obsidian for .md, etc).
+        // Body: { filePath: "<absolute path under vault>" } — vault-scoped only.
+        if (pathname === "/api/file/open" && req.method === "POST") {
+          const body = await readJsonBody(req, 4 * 1024);
+          const filePath = String(body.filePath || "");
+          let scoped;
+          try {
+            // Realpath-resolved, refuses symlink escapes (audit pass 2 #3).
+            scoped = resolveVaultScoped(vault, filePath, { mustExist: true });
+          } catch (e) {
+            const code = e.code === "EESCAPE" ? 400 : e.code === "ENOENT" ? 404 : 400;
+            return jsonResponse(res, code, { ok: false, error: e.message });
+          }
+          const targetAbs = scoped.absPath;
+          try {
+            const { execFile } = require("child_process");
+            const platform = process.platform;
+            // Simpler approach: always use OS-default opener with the file path.
+            // macOS `open` / Linux `xdg-open` / Windows `start` will dispatch
+            // to whatever app is registered for that file type. If the user has
+            // Obsidian as their default .md handler, it opens in Obsidian; if
+            // they prefer VS Code or another editor, it opens there.
+            //
+            // Previous version used obsidian:// URI scheme which silently failed
+            // when the vault name didn't match (basename != Obsidian vault name).
+            // OS-default dispatch sidesteps that entirely (E2E audit feedback).
+            const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+            const args = platform === "win32" ? ["/c", "start", "", targetAbs] : [targetAbs];
+            execFile(cmd, args, () => {});
+            return jsonResponse(res, 200, { ok: true, opened: targetAbs });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // Toggle a checkbox in a Health protocol .md file.
+        // Body: { filePath: "<absolute path under vault>", itemText: "<exact item text>", checked: true }
+        // Re-reads the protocol file, rewrites the matching `- [ ]`/`- [x]` line, refreshes state.
+        if (pathname === "/api/checkbox/toggle" && req.method === "POST") {
+          const body = await readJsonBody(req, 16 * 1024);
+          const filePath = String(body.filePath || "");
+          const itemText = String(body.itemText || "").trim();
+          const checked = !!body.checked;
+          if (!filePath || !itemText) {
+            return jsonResponse(res, 400, { ok: false, error: "filePath + itemText required" });
+          }
+          // Safety: must be a markdown file. Realpath protects against
+          // symlink escape; vault-scope check enforced by resolveVaultScoped.
+          if (!filePath.endsWith(".md")) {
+            return jsonResponse(res, 400, { ok: false, error: "filePath must be a .md under the vault" });
+          }
+          let scoped;
+          try {
+            scoped = resolveVaultScoped(vault, filePath, { mustExist: true });
+          } catch (e) {
+            const code = e.code === "EESCAPE" ? 400 : e.code === "ENOENT" ? 404 : 400;
+            return jsonResponse(res, code, { ok: false, error: e.message });
+          }
+          const targetAbs = scoped.absPath;
+          try {
+            // T242 bug hunt fix (B#4): the prior read-mutate-write was
+            // unprotected. Two concurrent toggles against the same file
+            // could each parse, then race on writeFileSync — last write
+            // wins, first write's edit lost. Other JSON endpoints use
+            // withFileLock for serialization; markdown writes were
+            // skipped. Wrap in the same mutex.
+            const result = await withFileLock(targetAbs, () => {
+              let found = false;
+              writeNoteAtomic(targetAbs, (text) => {
+                const lines = text.split("\n");
+                let hit = -1;
+                for (let i = 0; i < lines.length; i++) {
+                  const m = lines[i].match(/^([\s-*]+\[)([ xX])(\]\s+)(.+)$/);
+                  if (m && m[4].trim() === itemText) { hit = i; break; }
+                }
+                if (hit < 0) return null; // item not found → leave the file untouched
+                found = true;
+                const mark = checked ? "x" : " ";
+                lines[hit] = lines[hit].replace(/^([\s-*]+\[)([ xX])(\])/, `$1${mark}$3`);
+                return lines.join("\n");
+              });
+              return { found };
+            });
+            if (!result.found) {
+              return jsonResponse(res, 404, { ok: false, error: "item not found in file" });
+            }
+            // Trigger rebuild so dashboard reflects the change
+            try { const newBuild = await safeBuild(); lastBuild = newBuild; } catch (_) {}
+            return jsonResponse(res, 200, { ok: true, filePath, itemText, checked });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: "checkbox write failed" });
+          }
+        }
+
+        // QuickLog capture — append a timestamped line to today's Daily Note.
+        // Body: { text: "<single line>", tag?: "<single tag, no #>" }
+        // Writes to {vault}/02_Areas/Engine/Dailies/YYYY-MM/Daily - YYYY-MM-DD.md
+        // under the `## Log` section (created if missing). Sibling to /log,
+        // but inline — no workflow shell-out, no terminal.
+        if (pathname === "/api/capture" && req.method === "POST") {
+          const body = await readJsonBody(req, 8 * 1024);
+          const text = String(body.text || "").trim();
+          // tag is optional — accept "work" or "#work", strip the hash.
+          // Multi-tag input arrives as comma- or space-separated; normalise
+          // each token, drop empties, cap at 6 to keep the line scannable.
+          const rawTag = body.tag == null ? "" : String(body.tag);
+          const tags = rawTag
+            .split(/[\s,]+/)
+            .map(t => t.replace(/^#+/, "").trim())
+            .filter(t => /^[A-Za-z0-9_-]{1,32}$/.test(t))
+            .slice(0, 6);
+          if (!text) {
+            return jsonResponse(res, 400, { ok: false, error: "text required" });
+          }
+          if (text.length > 500) {
+            return jsonResponse(res, 400, { ok: false, error: "text too long (max 500 chars)" });
+          }
+          if (!vault) {
+            return jsonResponse(res, 500, { ok: false, error: "vault not set" });
+          }
+          try {
+            // Compose YYYY-MM-DD in local time so the Daily Note matches what
+            // the user sees on their calendar (UTC drift would file morning
+            // entries under yesterday in late-night timezones).
+            const now = new Date();
+            const yyyy = String(now.getFullYear());
+            const mm = String(now.getMonth() + 1).padStart(2, "0");
+            const dd = String(now.getDate()).padStart(2, "0");
+            const hh = String(now.getHours()).padStart(2, "0");
+            const mi = String(now.getMinutes()).padStart(2, "0");
+            const ymd = `${yyyy}-${mm}-${dd}`;
+            const ymo = `${yyyy}-${mm}`;
+            const hhmm = `${hh}:${mi}`;
+
+            const dailyDir = path.join(vault, "02_Areas", "Engine", "Dailies", ymo);
+            const dailyPath = path.join(dailyDir, `Daily - ${ymd}.md`);
+
+            // Vault-scope safety. Realpath the parent on missing files
+            // (resolveVaultScoped handles the ENOENT case internally).
+            let scoped;
+            try {
+              fs.mkdirSync(dailyDir, { recursive: true });
+              scoped = resolveVaultScoped(vault, dailyPath, { mustExist: false });
+            } catch (e) {
+              const code = e.code === "EESCAPE" ? 400 : 500;
+              return jsonResponse(res, code, { ok: false, error: e.message });
+            }
+            const targetAbs = scoped.absPath;
+
+            const tagSuffix = tags.length ? " " + tags.map(t => `#${t}`).join(" ") : "";
+            const line = `- [${hhmm}] ${text}${tagSuffix}`;
+
+            // T242 bug hunt fix (B#4 cont.): wrap the read-modify-write in
+            // withFileLock so two concurrent captures don't clobber each
+            // other's edits on the same Daily Note.
+            await withFileLock(targetAbs, () => {
+              // Read existing file (or start fresh). If `## Log` exists, append
+              // the new line under the next existing line break; otherwise
+              // append the section at the bottom.
+              writeNoteAtomic(targetAbs, (existing) => {
+                const hasLogSection = /(^|\n)##\s+Log\s*(\n|$)/.test(existing);
+                if (!existing) {
+                  return `# Daily - ${ymd}\n\n## Log\n\n${line}\n`;
+                }
+                if (!hasLogSection) {
+                  const sep = existing.endsWith("\n") ? "" : "\n";
+                  return `${existing}${sep}\n## Log\n\n${line}\n`;
+                }
+                const lines = existing.split("\n");
+                let logIdx = -1;
+                for (let i = 0; i < lines.length; i++) {
+                  if (/^##\s+Log\s*$/.test(lines[i])) { logIdx = i; break; }
+                }
+                let insertAt = lines.length;
+                for (let i = logIdx + 1; i < lines.length; i++) {
+                  if (/^##\s/.test(lines[i])) { insertAt = i; break; }
+                }
+                while (insertAt - 1 > logIdx && lines[insertAt - 1].trim() === "") {
+                  insertAt--;
+                }
+                const before = lines.slice(0, insertAt);
+                const after = lines.slice(insertAt);
+                const blockTail = after.length && after[0].trim() === "" ? after : ["", ...after];
+                return [...before, line, ...blockTail].join("\n");
+              });
+            });
+            // Trigger rebuild so any dashboard surfaces that read Daily
+            // contents (DayRing, ExecutionProtocol) refresh in the next tick.
+            try { const newBuild = await safeBuild(); lastBuild = newBuild; } catch (_) {}
+            return jsonResponse(res, 200, { ok: true, filePath: targetAbs, line });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: "capture write failed" });
+          }
+        }
+
+        // v6 W3 — Journal close write. Body { mode:'evening'|'morning', answers }.
+        // Writes the mode's `### Evening/Morning · <field>` sub-anchors under
+        // `## Journal` in today's Daily Note (session-day rule: before 05:00 the
+        // day is still yesterday's note). Cross-mode safe — writing Evening
+        // preserves any Morning sub-anchors and vice-versa. Only non-empty
+        // fields are written; an absent field stays absent (parseJournal returns
+        // null — never a fabricated value).
+        if (pathname === "/api/journal" && req.method === "POST") {
+          const body = await readJsonBody(req, 16 * 1024);
+          const mode = String(body.mode || "").trim();
+          const answers = body.answers && typeof body.answers === "object" ? body.answers : null;
+          if (mode !== "evening" && mode !== "morning") {
+            return jsonResponse(res, 400, { ok: false, error: "mode must be 'evening' or 'morning'" });
+          }
+          if (!answers) {
+            return jsonResponse(res, 400, { ok: false, error: "answers required" });
+          }
+          if (!vault) {
+            return jsonResponse(res, 500, { ok: false, error: "vault not set" });
+          }
+          const clip = sanitizeJournalLine; // escapes a leading '#' (round 4)
+          const intInRange = (v) => (Number.isFinite(v) ? Math.max(1, Math.min(10, Math.round(v))) : null);
+          // Build [header, body] pairs for the non-empty fields only.
+          const subAnchors = [];
+          if (mode === "evening") {
+            const score = intInRange(answers.score);
+            const scoreWhy = clip(answers.scoreWhy, 400);
+            const win = clip(answers.winAvoidance, 600);
+            const worked = clip(answers.workedDidnt, 600);
+            const diff = clip(answers.doDifferently, 600);
+            const alibi = clip(answers.alibi, 400);
+            if (score != null) subAnchors.push(["### Evening · score", scoreWhy ? `${score} — ${scoreWhy}` : `${score}`]);
+            if (win) subAnchors.push(["### Evening · win / avoidance", win]);
+            if (worked) subAnchors.push(["### Evening · what worked / what didn't", worked]);
+            if (diff) subAnchors.push(["### Evening · do differently", diff]);
+            if (alibi) subAnchors.push(["### Evening · alibi", alibi]);
+          } else {
+            const wantVsShould = clip(answers.wantVsShould, 600);
+            const energy = intInRange(answers.energy);
+            const grateful = clip(answers.grateful, 600);
+            const picture = clip(answers.picture, 600);
+            if (wantVsShould) subAnchors.push(["### Morning · want vs should", wantVsShould]);
+            if (energy != null) subAnchors.push(["### Morning · energy", `${energy}`]);
+            if (grateful) subAnchors.push(["### Morning · grateful", grateful]);
+            if (picture) subAnchors.push(["### Morning · picture", picture]);
+          }
+          if (!subAnchors.length) {
+            return jsonResponse(res, 400, { ok: false, error: "all answers empty" });
+          }
+          try {
+            // Session-day rule (matches daily-note-resolver): before 05:00 local
+            // the active day is still yesterday's note.
+            const now = new Date();
+            const sessionDay = new Date(now);
+            if (now.getHours() < 5) sessionDay.setDate(sessionDay.getDate() - 1);
+            const yyyy = String(sessionDay.getFullYear());
+            const mm = String(sessionDay.getMonth() + 1).padStart(2, "0");
+            const dd = String(sessionDay.getDate()).padStart(2, "0");
+            const ymd = `${yyyy}-${mm}-${dd}`;
+            const ymo = `${yyyy}-${mm}`;
+            const dailyDir = path.join(vault, "02_Areas", "Engine", "Dailies", ymo);
+            const dailyPath = path.join(dailyDir, `Daily - ${ymd}.md`);
+            let scoped;
+            try {
+              // Codex W3 fix 4: validate vault scope BEFORE creating the month
+              // directory. resolveVaultScoped realpaths the nearest existing
+              // ancestor; if a symlinked ancestor escapes the vault it throws
+              // here, so mkdir never follows it out of the vault.
+              scoped = resolveVaultScoped(vault, dailyPath, { mustExist: false });
+              fs.mkdirSync(dailyDir, { recursive: true });
+            } catch (e) {
+              const code = e.code === "EESCAPE" ? 400 : 500;
+              return jsonResponse(res, code, { ok: false, error: e.message });
+            }
+            const targetAbs = scoped.absPath;
+            const newBlock = subAnchors.map(([h, b]) => `${h}\n${b}`).join("\n\n");
+            // Serialize concurrent journal writes on the same note so a near-
+            // simultaneous evening+morning save can't clobber each other.
+            await withFileLock(targetAbs, () => {
+              writeNoteAtomic(targetAbs, (existing) => mergeJournalSection(existing, ymd, mode, newBlock));
+            });
+            try { const newBuild = await safeBuild(); lastBuild = newBuild; } catch (_) {}
+            return jsonResponse(res, 200, { ok: true, filePath: targetAbs, mode });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: "journal write failed" });
+          }
+        }
+
+        // v6 W3 — live work feed tail. Same-origin GET (loopback, no token, like
+        // /api/state.json): reads ~/.claude/history.jsonl + sessions fresh per
+        // request for near-real-time polling. Honest shape — NO cost, NO diff.
+        if (pathname === "/api/feed/tail" && req.method === "GET") {
+          if (!vault) return jsonResponse(res, 200, { available: false, caption: "", events: [], activeSessions: [] });
+          const limParam = parseInt(url.searchParams.get("limit"), 10);
+          const limit = Number.isFinite(limParam) ? Math.max(1, Math.min(100, limParam)) : 40;
+          try {
+            const feed = feedParser.compute({ vault, limit });
+            return jsonResponse(res, 200, feed);
+          } catch (e) {
+            return jsonResponse(res, 200, { available: false, caption: "", events: [], activeSessions: [] });
+          }
+        }
+
+        // Snooze a workflow until N hours/days from now.
+        // Body: { workflow: "/log", hours?: 24, reason?: "..." }
+        if (pathname === "/api/snooze" && req.method === "POST") {
+          const body = await readJsonBody(req, 8 * 1024);
+          const workflow = String(body.workflow || "").trim();
+          const hours = Number.isFinite(body.hours) ? Math.max(1, Math.min(168, body.hours)) : 24;
+          const reason = String(body.reason || "").slice(0, 200);
+          if (!workflow.startsWith("/")) {
+            return jsonResponse(res, 400, { ok: false, error: "workflow must start with /" });
+          }
+          try {
+            const os = require("os");
+            const moverDir = path.join(os.homedir(), ".mover", "dashboard");
+            fs.mkdirSync(moverDir, { recursive: true });
+            const snoozePath = path.join(moverDir, "snoozes.json");
+            // Serialize concurrent snooze writes (audit pass 2 #5).
+            const until = await withFileLock(snoozePath, () => {
+              let snoozes = [];
+              try { snoozes = JSON.parse(fs.readFileSync(snoozePath, "utf8")); } catch (_) {}
+              if (!Array.isArray(snoozes)) snoozes = [];
+              // Drop any existing snooze for this workflow, then add new
+              snoozes = snoozes.filter(s => s.workflow !== workflow);
+              const untilIso = new Date(Date.now() + hours * 3600 * 1000).toISOString();
+              snoozes.push({ workflow, until: untilIso, reason: reason || undefined });
+              atomicWriteJson(snoozePath, snoozes);
+              return untilIso;
+            });
+            try { const newBuild = await safeBuild(); lastBuild = newBuild; } catch (_) {}
+            return jsonResponse(res, 200, { ok: true, workflow, until });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // View Generator MVP — wishlist #64. POST /api/view/generate accepts
+        // a prompt, returns a structured view definition. GET /api/views
+        // lists saved views. POST /api/view/delete?slug=... removes one.
+        if (pathname === "/api/views" && req.method === "GET") {
+          try {
+            const { list } = require("./lib/view-generator");
+            return jsonResponse(res, 200, { ok: true, views: list() });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+        if (pathname === "/api/view/generate" && req.method === "POST") {
+          try {
+            const body = await readJsonBody(req, 4 * 1024);
+            const prompt = String(body.prompt || "").slice(0, 400).trim();
+            if (!prompt) return jsonResponse(res, 400, { ok: false, error: "prompt required" });
+            const { generate } = require("./lib/view-generator");
+            const result = generate({ prompt, save: true });
+            return jsonResponse(res, result.ok ? 200 : 400, result);
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+        if (pathname === "/api/view/delete" && req.method === "POST") {
+          try {
+            const body = await readJsonBody(req, 1024);
+            const slug = String(body.slug || "").trim();
+            if (!slug || !/^[a-z0-9-]+$/i.test(slug)) {
+              return jsonResponse(res, 400, { ok: false, error: "valid slug required" });
+            }
+            const { remove } = require("./lib/view-generator");
+            return jsonResponse(res, 200, { ok: remove(slug) });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // V5.0 activation event sink (Phase 41.0.x — UI-triggered events).
+        // Body: { type: "onboarding_finished" | "file_edit_in_obsidian" |
+        //         "referral_mentioned" | "log_completed",
+        //         meta?: object }
+        // Validates against the EVENT_TYPES list in activation-log.js;
+        // unknown types return 400. Caps meta at 4KB to keep the log lean.
+        if (pathname === "/api/event" && req.method === "POST") {
+          try {
+            const body = await readJsonBody(req, 4 * 1024);
+            const type = String(body.type || "").trim();
+            // Pass 3 #7 regression fix: arrays and primitives both fail
+            // the "typeof === object && !null" intent. Explicitly reject
+            // arrays so meta can't be a list (would silently break any
+            // future `meta.field` lookup in readStats consumers).
+            const meta = (body.meta && typeof body.meta === "object" && !Array.isArray(body.meta))
+              ? body.meta : undefined;
+            if (!type) return jsonResponse(res, 400, { ok: false, error: "type required" });
+            const ok = logActivationEvent(type, meta);
+            if (!ok) return jsonResponse(res, 400, { ok: false, error: `Unknown or rejected event type: ${type}` });
+            return jsonResponse(res, 200, { ok: true, type });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // Log an override decision into the pattern-manifest override_history.
+        // Body: { what: "...", over: "...", reason: "..." }
+        if (pathname === "/api/override" && req.method === "POST") {
+          const body = await readJsonBody(req, 8 * 1024);
+          const what = String(body.what || "").slice(0, 200).trim();
+          const over = String(body.over || "").slice(0, 200).trim();
+          const reason = String(body.reason || "").slice(0, 500).trim();
+          if (!what || !reason) {
+            return jsonResponse(res, 400, { ok: false, error: "what + reason required" });
+          }
+          try {
+            const os = require("os");
+            const manifestPath = path.join(os.homedir(), ".mover", "pattern-manifest.json");
+            // Serialize concurrent override writes (audit pass 2 #6).
+            // Without this lock, two overrides logged in quick succession
+            // (e.g. user clicking twice while server slow) lose one entry.
+            const entry = await withFileLock(manifestPath, () => {
+              let manifest = {};
+              try { manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8")); } catch (_) {}
+              if (!Array.isArray(manifest.override_history)) manifest.override_history = [];
+              const ent = {
+                id: `ov-${Date.now()}`,
+                timestamp: new Date().toISOString(),
+                what, over, reason
+              };
+              manifest.override_history.push(ent);
+              // Keep last 50
+              if (manifest.override_history.length > 50) {
+                manifest.override_history = manifest.override_history.slice(-50);
+              }
+              atomicWriteJson(manifestPath, manifest);
+              return ent;
+            });
+            try { const newBuild = await safeBuild(); lastBuild = newBuild; } catch (_) {}
+            return jsonResponse(res, 200, { ok: true, entry });
+          } catch (e) {
+            return jsonResponse(res, 500, { ok: false, error: e.message });
+          }
+        }
+
+        // Static file serving — ui/dist (the React UI) is the ONE canonical
+        // dashboard. v6 serve-flip + Codex W4+W5 fix 1: there is NO legacy
+        // fallback. A missing ui/dist/index.html means the UI was never built
+        // — fail loudly with a 503 rather than silently serving a different,
+        // retired dashboard, which is exactly the version-mixup this guards.
+        const safePath = pathname.replace(/^\/+/, "").replace(/\.\.\//g, "");
+        if (!uiDistAvailable()) {
+          res.writeHead(503, { "Content-Type": "text/plain" });
+          return res.end(
+            "Mover Studio UI is not built (ui/dist missing). Build it with " +
+              "`npm --prefix src/dashboard/ui run build`, then restart the server."
+          );
+        }
+        let filePath;
+        let isHtmlEntry = false;
+
+        // SPA routing — every non-asset path falls back to index.html.
+        // Vite emits content-hashed assets under /assets/.
+        const isAsset = /^assets\/|^sw\.js$|^workbox|^registerSW\.js$|\.(js|css|woff2?|svg|png|ico|json|map|webmanifest)$/.test(safePath);
+        if (pathname === "/" || pathname === "/index.html" || !isAsset) {
+          filePath = UI_DIST_INDEX;
+          isHtmlEntry = true;
+        } else {
+          filePath = path.join(UI_DIST_DIR, safePath);
+          // Containment guard: the string-strip above is single-pass, so split
+          // sequences like "....//" re-form "../" after one replace and climb
+          // out of ui/dist. Resolve, then verify the result is still inside the
+          // dist root — the same realpath-contain contract the vault routes use,
+          // which this static surface otherwise bypasses entirely.
+          const rel = path.relative(UI_DIST_DIR, path.resolve(filePath));
+          if (rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel)) {
+            res.writeHead(404, { "Content-Type": "text/plain" });
+            return res.end("Not found");
+          }
+        }
+
+        if (!fs.existsSync(filePath)) {
+          // SPA fallback — unknown non-asset routes serve index.html; a
+          // genuinely missing asset under /assets/ is a real 404.
+          if (!isHtmlEntry) {
+            filePath = UI_DIST_INDEX;
+            isHtmlEntry = true;
+            if (!fs.existsSync(filePath)) {
+              res.writeHead(404, { "Content-Type": "text/plain" });
+              return res.end("Not found");
+            }
+          } else {
+            res.writeHead(404, { "Content-Type": "text/plain" });
+            return res.end("Not found");
+          }
+        }
+
+        const stat = fs.statSync(filePath);
+        if (stat.isDirectory()) {
+          res.writeHead(403);
+          return res.end("Forbidden");
+        }
+
+        const ext = path.extname(filePath).toLowerCase();
+        const mime = MIME[ext] || "application/octet-stream";
+
+        // Content-hashed assets in /assets/ are immutable — cache them hard.
+        // HTML entry stays no-cache so version bumps land immediately.
+        const isImmutable = /^\/assets\//.test(pathname);
+        res.writeHead(200, {
+          "Content-Type": mime,
+          "Cache-Control": isImmutable
+            ? "public, max-age=31536000, immutable"
+            : "no-cache",
+          "X-Mover-Os-Version": version || "unknown",
+          "X-Mover-Os-Mode": "studio-react"
+        });
+        fs.createReadStream(filePath).pipe(res);
+      } catch (e) {
+        res.writeHead(500, { "Content-Type": "text/plain" });
+        res.end(`Server error: ${e.message}`);
+      }
+    });
+
+    function jsonResponse(res, code, obj) {
+      res.writeHead(code, { "Content-Type": "application/json; charset=utf-8" });
+      res.end(JSON.stringify(obj));
+    }
+
+    // Stream `moveros <cmd> <args>` output back to the client over a
+    // chunked HTTP response. Reuses the same SSE-style transport as agents.
+    function runMoverosStream({ req, res, cmd, args, vault }) {
+      res.writeHead(200, {
+        "Content-Type": "text/plain; charset=utf-8",
+        "Cache-Control": "no-cache",
+        "Transfer-Encoding": "chunked"
+      });
+      const exe = process.argv[1] || "moveros";
+      const child = spawn(process.execPath, [exe, cmd, ...args], {
+        cwd: vault,
+        env: { ...process.env, MOVER_DASHBOARD_INVOKED: "1" },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      child.stdout.on("data", (d) => res.write(d));
+      child.stderr.on("data", (d) => res.write(d));
+      child.on("error", (e) => { try { res.write(`\n[error] ${e.message}\n`); } catch (_) {} });
+      child.on("close", (code) => {
+        try { res.write(`\n[exit ${code}]\n`); } catch (_) {}
+        res.end();
+      });
+      req.on("close", () => {
+        try { child.kill("SIGTERM"); } catch (_) {}
+      });
+    }
+
+    // Cross-platform: open a command in the user's REAL terminal app.
+    // macOS: AppleScript-driven Terminal.app. Windows: cmd /k. Linux: best-effort.
+    //
+    // Security: vault path (cwd) is user-controlled via ~/.mover/config.json.
+    // Audit C1/C3 (2026-05-24): previous version escaped only `"` and embedded
+    // the path directly into AppleScript / cmd.exe / bash -c strings, allowing
+    // shell injection via a vault path containing backtick, $, ', |, &, etc.
+    // Fix: build a single shell command via shellEscape() and pass it through
+    // each platform's launcher using SAFE arg-passing (no `shell: true`, no
+    // raw interpolation into shell strings).
+    function shellEscape(s) {
+      // POSIX single-quote wrap: '...' (literal), '\'' for embedded apostrophes
+      return "'" + String(s).replace(/'/g, "'\\''") + "'";
+    }
+    function aplEscape(s) {
+      // AppleScript double-quoted string: escape " and \
+      return String(s).replace(/[\\"]/g, '\\$&');
+    }
+    function openInTerminal(cmdLine, cwd) {
+      // cmdLine is always our own slash-command (e.g. "/morning"), but we
+      // still treat it as untrusted to make this function safe by default.
+      const cwdAbs = String(cwd || process.cwd());
+      const cmdRaw = String(cmdLine);
+      // Build a safely-escaped shell command line for any platform that
+      // ultimately runs `bash -c`. POSIX-quoted both pieces.
+      const posixCmd = `cd ${shellEscape(cwdAbs)} && ${cmdRaw}`;
+
+      if (process.platform === "darwin") {
+        // AppleScript: embed the already-shell-escaped command as a string.
+        // Two layers of escaping: shell (above) + AppleScript (here).
+        const script = `tell application "Terminal" to do script "${aplEscape(posixCmd)}"`;
+        const child = spawn("osascript", ["-e", script], { detached: true, stdio: "ignore" });
+        child.unref();
+        spawn("osascript", ["-e", 'tell application "Terminal" to activate'], { detached: true, stdio: "ignore" }).unref();
+      } else if (process.platform === "win32") {
+        // Windows cmd.exe doesn't accept POSIX-quoted args. Drop `shell: true`
+        // (which was passing through cmd.exe's metacharacter parsing) and use
+        // explicit arg arrays + start's TitleArg + cwd via /D flag.
+        // Note: Windows path quoting uses double-quotes; backtick/dollar are
+        // literal in cmd. The remaining risk vector (& | > %) is suppressed
+        // by passing pieces as separate args, not embedded in a /C string.
+        // We still wrap cwd in literal quotes for `cd /d`.
+        const winCwd = cwdAbs.replace(/"/g, ''); // strip embedded quotes; refuse rather than escape
+        const startArgs = ["/c", "start", "", "cmd", "/k", `cd /d "${winCwd}" && ${cmdRaw}`];
+        spawn("cmd", startArgs, { detached: true, stdio: "ignore" }).unref();
+      } else {
+        // Linux: prefer the launchers that accept --working-directory (no
+        // shell interpolation needed for cwd). For x-terminal-emulator and
+        // xterm fallbacks, pass the already-POSIX-escaped command.
+        const candidates = [
+          ["gnome-terminal", ["--working-directory", cwdAbs, "--", "bash", "-c", `${cmdRaw}; exec bash`]],
+          ["konsole",        ["--workdir", cwdAbs, "-e", "bash", "-c", `${cmdRaw}; exec bash`]],
+          ["x-terminal-emulator", ["-e", "bash", "-c", `${posixCmd}; exec bash`]],
+          ["xterm",          ["-e", "bash", "-c", `${posixCmd}; exec bash`]],
+        ];
+        for (const [bin, args] of candidates) {
+          try {
+            const child = spawn(bin, args, { detached: true, stdio: "ignore" });
+            child.unref();
+            return;
+          } catch (_) { /* try next */ }
+        }
+        throw new Error("No supported terminal emulator found (tried gnome-terminal, konsole, x-terminal-emulator, xterm)");
+      }
+    }
+
+    // Authoritative list of CLI commands the dashboard can run as buttons.
+    // Keep in sync with install.js CLI_HANDLERS table.
+    function getCliIndex() {
+      return {
+        cli: [
+          { cmd: "pulse",    label: "Open Studio",    risk: "LOW",    description: "Launch Mover Studio dashboard." },
+          { cmd: "status",   label: "Status",         risk: "LOW",    description: "Full system state: vault, agents, version." },
+          { cmd: "doctor",   label: "Doctor",         risk: "LOW",    description: "Health check across hooks, links, Engine files." },
+          { cmd: "capture",  label: "Capture",        risk: "LOW",    description: "Quick inbox capture from CLI." },
+          { cmd: "who",      label: "Who is...",      risk: "LOW",    description: "Entity lookup across Library/Entities." },
+          { cmd: "diff",     label: "Engine Diff",    risk: "LOW",    description: "Git history of Engine files." },
+          { cmd: "replay",   label: "Replay Session", risk: "LOW",    description: "Print today's Session Log + progress." },
+          { cmd: "context",  label: "Agent Context",  risk: "LOW",    description: "Debug what each installed agent sees." },
+          { cmd: "sync",     label: "Sync Agents",    risk: "LOW",    description: "Re-sync rules/hooks/skills across installed agents." },
+          { cmd: "settings", label: "Settings",       risk: "LOW",    description: "View or edit ~/.mover/config.json." },
+          { cmd: "backup",   label: "Backup",         risk: "LOW",    description: "Tar-snapshot ~/.mover/." },
+          { cmd: "restore",  label: "Restore",        risk: "HIGH",   description: "Restore from a Mover OS backup." },
+          { cmd: "prayer",   label: "Prayer Times",   risk: "LOW",    description: "Show today's prayer times (if configured)." },
+          { cmd: "help",     label: "Help",           risk: "LOW",    description: "Interactive guide to Mover OS." },
+          { cmd: "install",  label: "Install",        risk: "MEDIUM", description: "Fresh install wizard." },
+          { cmd: "update",   label: "Update",         risk: "MEDIUM", description: "Pull latest Mover OS payload + migrate." },
+          { cmd: "uninstall", label: "Uninstall",     risk: "HIGH",   description: "Remove Mover OS from vault and agents." },
+        ]
+      };
+    }
+
+    function tryListen(idx) {
+      if (idx >= PORT_FALLBACKS.length) {
+        return reject(new Error("All dashboard ports 3737-3740 in use. Try `lsof -i :3737` to find the process."));
+      }
+      const port = PORT_FALLBACKS[idx];
+      server.once("error", err => {
+        if (err.code === "EADDRINUSE") {
+          server.close();
+          tryListen(idx + 1);
+        } else {
+          reject(err);
+        }
+      });
+      server.listen(port, "127.0.0.1", async () => {
+        const url = `http://127.0.0.1:${port}`;
+        // Initial build
+        try {
+          lastBuild = await safeBuild();
+        } catch (e) {
+          lastError = e.message;
+          console.error(`[mover-dashboard] initial build failed: ${e.message}`);
+        }
+        console.log(`\n  Mover OS Dashboard\n  ${url}\n`);
+        if (openBrowser) tryOpenBrowser(url);
+        // F21 — register the running marker so agent hooks can surface the URL
+        writeRunningMarker(url);
+        // Phase 41.0.7 — expose the per-process CSRF token to local-only
+        // external scripts (workflow Bash steps, Stop hooks, capture wire-up)
+        // so they can POST /api/event for log_completed, referral_mentioned,
+        // etc. File perms 0o600 so other users can't read it. Loopback-only
+        // server means this is the same trust boundary as the file system.
+        try {
+          const os = require("os");
+          const tokenDir = path.join(os.homedir(), ".mover", "dashboard");
+          fs.mkdirSync(tokenDir, { recursive: true });
+          const tokenFile = path.join(tokenDir, ".token");
+          fs.writeFileSync(tokenFile, JSON.stringify({ token: STUDIO_TOKEN, url, pid: process.pid, startedAt: new Date().toISOString() }, null, 2), { encoding: "utf8", mode: 0o600 });
+        } catch (e) {
+          console.warn(`[mover-dashboard] could not write token file: ${e.message}`);
+        }
+        // T245 — periodic rebuild. Previously the server only rebuilt
+        // state.json on (a) initial start, (b) write endpoints (config
+        // save, checkbox toggle, capture, snooze, override), and (c)
+        // explicit /api/refresh POST. With no writes for an hour the
+        // state goes hours-stale — user reports "NextSteps are severely
+        // outdated" because the parser snapshot was hours old. Now: a
+        // 60s heartbeat rebuild keeps the surface live. safeBuild()'s
+        // mutex prevents overlap with write-triggered rebuilds.
+        const REBUILD_INTERVAL_MS = 60 * 1000;
+        const rebuildTimer = setInterval(async () => {
+          try {
+            const fresh = await safeBuild();
+            if (fresh) lastBuild = fresh;
+          } catch (e) {
+            console.warn(`[mover-dashboard] periodic rebuild failed: ${e.message}`);
+          }
+        }, REBUILD_INTERVAL_MS);
+        // Keep the timer from blocking process exit on SIGINT.
+        if (typeof rebuildTimer.unref === "function") rebuildTimer.unref();
+
+        // SIGINT cleanup
+        const shutdown = async () => {
+          console.log("\n  Shutting down dashboard...");
+          clearInterval(rebuildTimer);
+          // Wait for agent children to actually die before the hard-exit timer
+          // below (Codex MF1: exit fired at 2s but SIGKILL escalation at 3s, so
+          // a stubborn child could survive). shutdownAll resolves on child close.
+          try { await agentSessions.shutdownAll(); } catch (_) { /* best-effort */ }
+          try { runRegistry.shutdownAll(); } catch (_) { /* best-effort */ }
+          clearRunningMarker();
+          // Clear the token file so stale scripts don't try to POST against
+          // a dead server.
+          try {
+            const os = require("os");
+            const tokenFile = path.join(os.homedir(), ".mover", "dashboard", ".token");
+            if (fs.existsSync(tokenFile)) fs.unlinkSync(tokenFile);
+          } catch (_) { /* best-effort */ }
+          server.close(() => process.exit(0));
+          setTimeout(() => process.exit(0), 2000);
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+        resolve({ server, port, url });
+      });
+    }
+
+    tryListen(0);
+  });
+}
+
+// F21 — write the auto-running marker on startup so the dashboard-url hook
+// can find it and surface the dashboard URL to agents on key events.
+function writeRunningMarker(url) {
+  try {
+    const os = require("os");
+    const dir = path.join(os.homedir(), ".mover", "dashboard");
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, "auto-running"), url, "utf8");
+  } catch (_) { /* non-fatal */ }
+}
+function clearRunningMarker() {
+  try {
+    const os = require("os");
+    const p = path.join(os.homedir(), ".mover", "dashboard", "auto-running");
+    if (fs.existsSync(p)) fs.unlinkSync(p);
+  } catch (_) {}
+}
+
+function tryOpenBrowser(url) {
+  const platform = process.platform;
+  let cmd, args;
+  if (platform === "darwin") {
+    cmd = "open"; args = [url];
+  } else if (platform === "win32") {
+    cmd = "cmd"; args = ["/c", "start", "", url];
+  } else {
+    cmd = "xdg-open"; args = [url];
+  }
+  try {
+    execFile(cmd, args, () => { /* swallow */ });
+  } catch {
+    // Fall through silently — URL was already printed
+  }
+}
+
+function readJsonBody(req, maxBytes) {
+  return new Promise((resolve, reject) => {
+    // Audit H3: guard against double-resolution. The previous version
+    // called reject() then req.destroy(), which emits 'error' → second
+    // reject. Node ignores native-promise double-rejects but the second
+    // event arrives via an already-resolved Promise's catch chain.
+    let done = false;
+    const settle = (fn, val) => { if (done) return; done = true; fn(val); };
+    let raw = "";
+    req.setEncoding("utf8");
+    req.on("data", chunk => {
+      raw += chunk;
+      if (raw.length > maxBytes) {
+        settle(reject, new Error("Request body too large"));
+        try { req.destroy(); } catch (_) {}
+      }
+    });
+    req.on("end", () => {
+      try {
+        settle(resolve, raw ? JSON.parse(raw) : {});
+      } catch {
+        settle(reject, new Error("Invalid JSON body"));
+      }
+    });
+    req.on("error", (e) => settle(reject, e));
+  });
+}
+
+// ── version / update check (server side, for the dashboard "Update ready"
+// prompt) ─────────────────────────────────────────────────────────────────
+// Cached, ASYNC npm check (execFile, never execSync — a sync npm call would
+// block the single-threaded server for seconds). Returns last-known instantly;
+// refreshes in the background at most every 30 min. Offline → latest stays null
+// → updateAvailable false (graceful). The free/major split is the v4→v5 seam:
+// a same-major bump (v4.x → v4.y) is a FREE update; a new major (v4 → v5) is a
+// paid upgrade, surfaced differently and gated server-side at /api/download.
+let _verCache = { at: 0, latest: null, checking: false };
+function _verParts(s) { return String(s == null ? "" : s).split(".").map((n) => parseInt(n, 10) || 0); }
+function compareSemver(a, b) {
+  const A = _verParts(a), B = _verParts(b);
+  for (let i = 0; i < Math.max(A.length, B.length); i++) { const x = A[i] || 0, y = B[i] || 0; if (x !== y) return x > y ? 1 : -1; }
+  return 0;
+}
+function sameMajor(a, b) { return (_verParts(a)[0] || 0) === (_verParts(b)[0] || 0); }
+function npmLatestVersion() {
+  return new Promise((resolve) => {
+    try {
+      require("child_process").execFile("npm", ["view", "mover-os", "version"], { timeout: 8000 }, (err, stdout) => {
+        resolve(err ? null : (String(stdout).trim() || null));
+      });
+    } catch (_) { resolve(null); }
+  });
+}
+function refreshVersionCache() {
+  if (_verCache.checking) return;
+  if (_verCache.latest != null && Date.now() - _verCache.at < 30 * 60 * 1000) return; // still fresh
+  _verCache.checking = true;
+  npmLatestVersion().then((latest) => { _verCache = { at: Date.now(), latest, checking: false }; })
+                    .catch(() => { _verCache.checking = false; });
+}
+function versionInfo(current) {
+  refreshVersionCache(); // fire-and-forget; this call uses whatever is cached
+  const cur = String(current || "unknown");
+  const latest = _verCache.latest;
+  let updateAvailable = false, isFreeUpgrade = false, major = false;
+  if (latest && cur !== "unknown" && compareSemver(latest, cur) > 0) {
+    updateAvailable = true;
+    isFreeUpgrade = sameMajor(cur, latest); // v4.x → v4.y = free for existing buyers
+    major = !isFreeUpgrade;                 // v4 → v5 = new major (paid; gating deferred to v5 launch)
+  }
+  return { current: cur, latest, updateAvailable, isFreeUpgrade, major, checking: _verCache.checking };
+}
+
+function runAgentStream({ req, res, body, vault, runRegistry }) {
+  // #112: per-run choice first (body.model/effort/approvalMode from the Run
+  // picker); omitted fields fall back to config providerPrefs so the fixed
+  // call sites (Say-it, X-Ray) inherit the user's choice without client edits.
+  let prefs = {};
+  let cfgAgent = null;
+  try {
+    const cfg = require("./lib/config-parser").read();
+    prefs = (cfg && cfg.providerPrefs) || {};
+    cfgAgent = (cfg && cfg.preferredAgent) || null;
+  } catch (_) {}
+  const agent = String(body.agent || cfgAgent || "claude-code");
+  const prompt = String(body.prompt || "").trim();
+  const workflow = String(body.workflow || "").trim();
+  const canonical = AGENT_ALIASES[agent] || agent;
+  const perProvider = (prefs && prefs[canonical]) || {};
+  const command = agentCommand(agent, {
+    model: body.model != null ? body.model : perProvider.model,
+    effort: body.effort != null ? body.effort : perProvider.effort,
+    approvalMode: body.approvalMode != null ? body.approvalMode : perProvider.approvalMode,
+  });
+
+  if (!prompt && !workflow) {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    return res.end("Missing prompt or workflow.\n");
+  }
+  if (!command) {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    return res.end(`Unsupported agent: ${agent}\n`);
+  }
+
+  // R2: a rejected model/effort must refuse loudly, never silently run the
+  // provider default while the user believes their pick applied (cleanToken
+  // drops strings with spaces or shell metacharacters; the old behavior was a
+  // quiet fallback the run preamble alone had to expose).
+  const apChk = command.applied || {};
+  const reqModel = String(body.model != null ? body.model : (perProvider.model || "")).trim();
+  if (reqModel && !apChk.model) {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    return res.end(`Model "${reqModel}" was rejected: letters, digits, . _ : - only, no spaces. The run was not started.\n`);
+  }
+  const reqEffort = String(body.effort != null ? body.effort : (perProvider.effort || "")).trim();
+  if (reqEffort && !apChk.effort && (AGENT_EFFORTS[canonical] || []).length) {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    return res.end(`Effort "${reqEffort}" is not one of: ${AGENT_EFFORTS[canonical].join(", ")}. The run was not started.\n`);
+  }
+
+  const repoRoot = path.join(__dirname, "..", "..");
+  const finalPrompt = buildAgentPrompt({ prompt, workflow, vault, repoRoot });
+
+  // The run lives in the RUN REGISTRY, decoupled from this HTTP request. If the
+  // client navigates away or refreshes, the child keeps running and its output
+  // is retained, so the Run tab can reattach (GET /api/runs/stream) — this is
+  // what makes Run persistent like Chat. cwd = the VAULT (Engine/PARA context,
+  // not the bundle dev root); MOVER_STUDIO_RUN=1 mutes the lifecycle hooks
+  // (Stop log-cascade, engine-auto-commit, engine-health) — see src/hooks/*.sh.
+  // The preamble lines are seeded into the buffer (not just written to res) so a
+  // reattach replays an identical view, and the existing client keeps parsing
+  // the exit tail. Audit M10: cwd is aliased — never leak the absolute repo path.
+  const ap = command.applied || {};
+  const tune = [ap.model ? `model=${ap.model}` : "", ap.effort ? `effort=${ap.effort}` : "", ap.approvalMode && ap.approvalMode !== "yolo" ? `approval=${ap.approvalMode}` : ""].filter(Boolean).join(" ");
+  const preamble = `[mover-studio] agent=${agent}${tune ? " " + tune : ""}\n[mover-studio] cwd=<bundle-root>\n\n`;
+  const run = runRegistry.start({
+    agent,
+    label: (workflow || prompt || "task").slice(0, 200),
+    cmd: command.cmd,
+    args: command.args(finalPrompt),
+    stdin: command.stdin,
+    finalPrompt,
+    cwd: vault || repoRoot,
+    env: { ...process.env, MOVER_STUDIO_RUN: "1" },
+    preamble,
+  });
+
+  res.writeHead(200, {
+    "Content-Type": "text/plain; charset=utf-8",
+    "Cache-Control": "no-cache",
+    "X-Accel-Buffering": "no",
+    "X-Mover-Run-Id": run.id,
+  });
+
+  // Stream this run to the response by subscribing (replay buffer + live). On
+  // client disconnect we ONLY unsubscribe — the run is not killed (an explicit
+  // stop is POST /api/runs/stop). Same handler shape as /api/runs/stream.
+  const unsub = runRegistry.subscribe(run.id, (ev) => {
+    if (ev.type === "replay" || ev.type === "chunk") { try { res.write(ev.text); } catch (_) {} }
+    else if (ev.type === "end") { try { res.end(); } catch (_) {} }
+  });
+  req.on("close", () => { try { unsub(); } catch (_) {} });
+}
+
+// #112: argv assembly moved to lib/agent-command.js (pure, unit-tested in
+// test/agent-command.test.mjs) so model/effort/approval flags are one matrix.
+const { agentCommand, ALIASES: AGENT_ALIASES, EFFORTS: AGENT_EFFORTS } = require("./lib/agent-command");
+
+function buildAgentPrompt({ prompt, workflow, vault, repoRoot }) {
+  const task = workflow
+    ? `Run or simulate the Mover OS workflow "${workflow}" from this local project.`
+    : prompt;
+  return [
+    "You are being invoked from Mover Studio, a local browser UI for Mover OS.",
+    `Workspace: ${repoRoot}`,
+    `Vault: ${vault || "unknown"}`,
+    "Use local files as source of truth. Be concise, cite files when possible, and do not make network calls unless the workflow genuinely requires them.",
+    "",
+    workflow ? `${task}\nUser context/prompt: ${prompt || "No additional prompt."}` : task
+  ].join("\n");
+}
+
+// F37 — OG Image SVG renderer. Pure-SVG (no canvas dep) so it works on
+// any platform without extra binaries. Returns an SVG string sized for
+// the requested format. Modern social platforms render SVG og:images
+// directly (Twitter X, Discord, Slack); older ones may not.
+function renderOgSvg(state, opts = {}) {
+  const { format = "default", metric = "drift", title } = opts;
+  const dims = {
+    default: { w: 1200, h: 630 },
+    square:  { w: 1080, h: 1080 },
+    story:   { w: 1080, h: 1920 },
+  };
+  const { w, h } = dims[format] || dims.default;
+
+  const drift = state.driftScore || {};
+  const streak = state.streak || {};
+  const patterns = (state.activeContext && state.activeContext.activePatterns) || [];
+  const singleTest = (state.strategy && state.strategy.singleTest) || (state.activeContext && state.activeContext.singleTest && state.activeContext.singleTest.text) || "Mover OS — your AI that remembers";
+  const version = state.version || "4.7";
+
+  const headline = title || singleTest;
+  const escaped = String(headline).replace(/[&<>]/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" })[c]);
+
+  // Pick featured value
+  let bigValue = "—";
+  let bigLabel = "DRIFT SCORE";
+  let bigSub = "/100";
+  if (metric === "streak") {
+    bigValue = String(streak.currentStreak ?? streak.streakThroughYesterday ?? 0);
+    bigLabel = "DAILY NOTE STREAK";
+    bigSub = "DAYS";
+  } else if (metric === "patterns") {
+    bigValue = String(patterns.length);
+    bigLabel = "ACTIVE PATTERNS";
+    bigSub = "tracked";
+  } else {
+    bigValue = String(drift.value ?? "—");
+  }
+
+  const isStory = format === "story";
+  const padX = isStory ? 80 : 80;
+  const padY = isStory ? 200 : 80;
+  const bigSize = isStory ? 320 : 200;
+  const bigY = isStory ? h * 0.4 : h * 0.55;
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="${w}" height="${h}" viewBox="0 0 ${w} ${h}">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0%" stop-color="#0a0a0c" />
+      <stop offset="100%" stop-color="#141416" />
+    </linearGradient>
+    <radialGradient id="halo" cx="80%" cy="20%" r="60%">
+      <stop offset="0%" stop-color="#d97a3c" stop-opacity="0.18" />
+      <stop offset="60%" stop-color="#d97a3c" stop-opacity="0.05" />
+      <stop offset="100%" stop-color="#d97a3c" stop-opacity="0" />
+    </radialGradient>
+    <pattern id="grid" x="0" y="0" width="40" height="40" patternUnits="userSpaceOnUse">
+      <path d="M 40 0 L 0 0 0 40" fill="none" stroke="rgba(255,255,255,0.025)" stroke-width="1"/>
+    </pattern>
+  </defs>
+  <rect width="${w}" height="${h}" fill="url(#bg)"/>
+  <rect width="${w}" height="${h}" fill="url(#grid)"/>
+  <rect width="${w}" height="${h}" fill="url(#halo)"/>
+
+  <!-- Eyebrow -->
+  <text x="${padX}" y="${padY}" font-family="ui-monospace, monospace" font-size="${isStory ? 22 : 18}" fill="#d97a3c" letter-spacing="4">
+    MOVER · OS · PUBLIC PROOF
+  </text>
+
+  <!-- Headline -->
+  <text x="${padX}" y="${padY + (isStory ? 70 : 60)}" font-family="Inter, sans-serif" font-size="${isStory ? 56 : 44}" fill="#f5f5f5" font-weight="500">
+    <tspan x="${padX}" dy="0">${escaped.slice(0, isStory ? 32 : 50)}</tspan>
+    ${escaped.length > (isStory ? 32 : 50) ? `<tspan x="${padX}" dy="${isStory ? 68 : 56}">${escaped.slice(isStory ? 32 : 50, isStory ? 64 : 100)}</tspan>` : ''}
+  </text>
+
+  <!-- Big metric -->
+  <text x="${padX}" y="${bigY}" font-family="ui-monospace, monospace" font-size="${bigSize}" fill="#f5f5f5" font-weight="400" letter-spacing="-6">
+    ${bigValue}
+  </text>
+  <text x="${padX + (bigValue.length * (bigSize * 0.55))}" y="${bigY}" font-family="ui-monospace, monospace" font-size="${bigSize * 0.18}" fill="#828282">
+    ${bigSub}
+  </text>
+
+  <!-- Big metric label -->
+  <text x="${padX}" y="${bigY + (bigSize * 0.18)}" font-family="ui-monospace, monospace" font-size="${isStory ? 22 : 18}" fill="#a8a8a8" letter-spacing="4">
+    ${bigLabel}
+  </text>
+
+  <!-- Watermark -->
+  <text x="${padX}" y="${h - 40}" font-family="ui-monospace, monospace" font-size="${isStory ? 18 : 14}" fill="#828282" letter-spacing="3">
+    LOCAL · SCREEN OFF · TELEMETRY NEVER · v${version}
+  </text>
+
+  <!-- Corner crosshairs (top-right + bottom-left) -->
+  <path d="M ${w - 40} 20 L ${w - 20} 20 L ${w - 20} 40" stroke="#d97a3c" stroke-width="1.5" fill="none"/>
+  <path d="M 20 ${h - 40} L 20 ${h - 20} L 40 ${h - 20}" stroke="#d97a3c" stroke-width="1.5" fill="none"/>
+</svg>`;
+}
+
+module.exports = { startServer, mergeJournalSection, sanitizeJournalLine, writeNoteAtomic };