n2n-nexus 0.4.2 → 0.6.0

package/build/daemon/server.js

@@ -1,364 +1,63 @@
 import http from "node:http";
+import net from "node:net";
 import { URL } from "node:url";
 import { StorageManager } from "../storage/index.js";
-import { UnifiedMeetingStore } from "../storage/store.js";
-import { createTask, updateTask, getTask, listTasks, cancelTask, initTasksTable } from "../storage/tasks.js";
+import { SqliteMeetingStore } from "../storage/sqlite-meeting.js";
+import { GlobalMessageStore } from "../storage/global-messages.js";
+import { EventStore } from "../storage/events.js";
+import { runMigrations } from "../storage/migrations.js";
+import { createTask, updateTask, getTask, listTasks, cancelTask } from "../storage/tasks.js";
+import { MAX_BODY_BYTES } from "../constants.js";
+import { ADDRESS_LIMIT_FACTOR, RateLimiter, rateLimitFromEnv } from "./rate-limit.js";
+import { ResultContractError, finalizeResult } from "./tool-outputs.js";
+import { TOOL_DEFINITIONS, isToolName, parseToolArgs, taskUpdateSchema, ToolValidationError } from "./tools.js";
+import { z } from "zod";
+// ---------------------------------------------------------------------------
+// Storage bootstrap
+// ---------------------------------------------------------------------------
 async function initializeStorage() {
     await StorageManager.init();
-    initTasksTable();
-    const info = await UnifiedMeetingStore.getStorageInfo();
-    return {
-        ready: true,
-        storageMode: info.storage_mode,
-        isDegraded: info.is_degraded
-    };
-}
-const sessions = new Map();
-function getSession(instanceId) {
-    if (!sessions.has(instanceId))
-        sessions.set(instanceId, { currentProject: null });
-    return sessions.get(instanceId);
+    SqliteMeetingStore.init();
+    await runMigrations();
 }
 // ---------------------------------------------------------------------------
-// Tool definitions  (served via GET /api/tools)
-// ---------------------------------------------------------------------------
-const TOOL_DEFINITIONS = [
-    // Session
-    {
-        name: "register_session_context",
-        description: "Declare active project. Format: [prefix]_[name] (e.g. 'web_example.com', 'mcp_nexus').",
-        inputSchema: {
-            type: "object",
-            properties: { projectId: { type: "string", description: "Project ID with prefix" } },
-            required: ["projectId"]
-        }
-    },
-    // Project assets
-    {
-        name: "sync_project_assets",
-        description: "[ASYNC] Sync full project manifest + internal docs. Returns taskId.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                manifest: {
-                    type: "object",
-                    description: "Project metadata",
-                    properties: {
-                        id: { type: "string" }, name: { type: "string" },
-                        description: { type: "string" },
-                        techStack: { type: "array", items: { type: "string" } },
-                        relations: { type: "array", items: { type: "object" } },
-                        repositoryUrl: { type: "string" }, localPath: { type: "string" },
-                        endpoints: { type: "array", items: { type: "object" } },
-                        apiSpec: { type: "array", items: { type: "object" } }
-                    },
-                    required: ["id", "name", "description", "techStack", "relations", "repositoryUrl", "localPath", "endpoints", "apiSpec"]
-                },
-                internalDocs: { type: "string", description: "Markdown implementation guide" }
-            },
-            required: ["manifest", "internalDocs"]
-        }
-    },
-    {
-        name: "upload_project_asset",
-        description: "Upload binary file (base64) to active project's asset folder.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                fileName: { type: "string", description: "Safe filename (no path traversal)" },
-                base64Content: { type: "string" }
-            },
-            required: ["fileName", "base64Content"]
-        }
-    },
-    {
-        name: "update_project",
-        description: "Patch project manifest fields (partial update).",
-        inputSchema: {
-            type: "object",
-            properties: {
-                projectId: { type: "string" },
-                patch: { type: "object", description: "Fields to update" }
-            },
-            required: ["projectId", "patch"]
-        }
-    },
-    {
-        name: "rename_project",
-        description: "[ASYNC] Rename project ID with cascading relation updates. Returns taskId.",
-        inputSchema: {
-            type: "object",
-            properties: { oldId: { type: "string" }, newId: { type: "string" } },
-            required: ["oldId", "newId"]
-        }
-    },
-    // Global collaboration
-    {
-        name: "search_projects",
-        description: "Search project registry by name or description.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                query: { type: "string" },
-                limit: { type: "integer", default: 10 }
-            },
-            required: ["query"]
-        }
-    },
-    {
-        name: "get_global_topology",
-        description: "Default: project list + stats. With projectId: detailed subgraph.",
-        inputSchema: {
-            type: "object",
-            properties: { projectId: { type: "string", description: "Focus on specific project (optional)" } }
-        }
-    },
-    {
-        name: "send_message",
-        description: "Post message to active meeting or global chat.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                message: { type: "string" },
-                category: { type: "string", enum: ["MEETING_START", "PROPOSAL", "DECISION", "UPDATE", "CHAT"] }
-            },
-            required: ["message"]
-        }
-    },
-    {
-        name: "read_messages",
-        description: "Read unread messages (auto-incremental per instance).",
-        inputSchema: {
-            type: "object",
-            properties: {
-                count: { type: "integer", default: 10 },
-                meetingId: { type: "string" }
-            }
-        }
-    },
-    {
-        name: "update_global_strategy",
-        description: "Overwrite master strategy document.",
-        inputSchema: {
-            type: "object",
-            properties: { content: { type: "string" } },
-            required: ["content"]
-        }
-    },
-    {
-        name: "sync_global_doc",
-        description: "Create/update a global shared document.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                docId: { type: "string" },
-                title: { type: "string" },
-                content: { type: "string" }
-            },
-            required: ["docId", "title", "content"]
-        }
-    },
-    // Meeting management
-    {
-        name: "start_meeting",
-        description: "Start new meeting session. Returns meeting ID.",
-        inputSchema: {
-            type: "object",
-            properties: { topic: { type: "string" } },
-            required: ["topic"]
-        }
-    },
-    {
-        name: "end_meeting",
-        description: "End active meeting. Locks history.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                meetingId: { type: "string" },
-                summary: { type: "string" }
-            }
-        }
-    },
-    {
-        name: "archive_meeting",
-        description: "Archive closed meeting. Read-only after.",
-        inputSchema: {
-            type: "object",
-            properties: { meetingId: { type: "string" } },
-            required: ["meetingId"]
-        }
-    },
-    {
-        name: "reopen_meeting",
-        description: "Reopen closed/archived meeting.",
-        inputSchema: {
-            type: "object",
-            properties: { meetingId: { type: "string" } },
-            required: ["meetingId"]
-        }
-    },
-    // Task management
-    {
-        name: "create_task",
-        description: "[ASYNC] Create background task. Returns taskId for polling.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                source_meeting_id: { type: "string", description: "Link to meeting for traceability" },
-                metadata: { type: "object" },
-                ttl: { type: "integer", description: "TTL in milliseconds" }
-            }
-        }
-    },
-    {
-        name: "get_task",
-        description: "Get task status and progress by ID.",
-        inputSchema: {
-            type: "object",
-            properties: { taskId: { type: "string" } },
-            required: ["taskId"]
-        }
-    },
-    {
-        name: "list_tasks",
-        description: "List tasks with optional status filter.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                status: { type: "string", enum: ["pending", "running", "completed", "failed", "cancelled"] },
-                limit: { type: "integer", default: 50 }
-            }
-        }
-    },
-    {
-        name: "cancel_task",
-        description: "Cancel pending/running task.",
-        inputSchema: {
-            type: "object",
-            properties: { taskId: { type: "string" } },
-            required: ["taskId"]
-        }
-    },
-    // Maintenance
-    {
-        name: "host_maintenance",
-        description: "Manage logs: 'prune' oldest N or 'clear' all.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                action: { type: "string", enum: ["prune", "clear"] },
-                count: { type: "integer", minimum: 0 }
-            },
-            required: ["action", "count"]
-        }
-    },
-    {
-        name: "host_delete_project",
-        description: "[ASYNC] Delete project. Irreversible. Returns taskId.",
-        inputSchema: {
-            type: "object",
-            properties: { projectId: { type: "string" } },
-            required: ["projectId"]
-        }
-    }
-];
-// ---------------------------------------------------------------------------
 // Tool handlers
 // ---------------------------------------------------------------------------
-async function toolRegisterSessionContext(args, instanceId) {
-    if (!args.projectId)
-        throw new Error("projectId is required.");
-    const manifest = await StorageManager.getProjectManifest(args.projectId);
-    if (!manifest) {
-        return { ok: false, message: `Project '${args.projectId}' not found in registry.` };
-    }
-    getSession(instanceId).currentProject = args.projectId;
-    await StorageManager.addGlobalLog("SYSTEM", `Session Context set to Project: ${args.projectId} (instance: ${instanceId})`);
-    return { ok: true, message: `Session context registered for project: ${args.projectId}.` };
-}
 async function toolSyncProjectAssets(args, instanceId) {
-    const m = args.manifest;
-    if (!m?.id)
-        throw new Error("manifest.id is required.");
-    const task = createTask({
-        metadata: { operation: "sync_project_assets", projectId: m.id, initiator: instanceId }
-    });
-    setImmediate(async () => {
-        try {
-            updateTask(task.id, { status: "running", progress: 0.1 });
-            await StorageManager.saveProjectManifest(m);
-            updateTask(task.id, { progress: 0.5 });
-            await StorageManager.saveProjectDocs(m.id, args.internalDocs);
-            updateTask(task.id, { progress: 0.9 });
-            await StorageManager.addGlobalLog("SYSTEM", `[${instanceId}@${m.id}] Asset Sync completed.`);
-            updateTask(task.id, { status: "completed", progress: 1.0, result_uri: `nexus://projects/${m.id}/manifest` });
-        }
-        catch (e) {
-            updateTask(task.id, { status: "failed", error_message: String(e) });
-        }
-    });
-    return { task_id: task.id, status: "pending", message: "Sync task created. Use get_task to poll for completion." };
+    const m = { ...args.manifest, lastUpdated: args.manifest.lastUpdated ?? new Date().toISOString() };
+    await StorageManager.saveProject(m, args.internalDocs);
+    EventStore.record(instanceId, "project.sync", m.id);
+    return { ok: true, projectId: m.id, message: `Project '${m.id}' manifest and docs synced.` };
 }
 async function toolUploadAsset(args, instanceId) {
-    const session = getSession(instanceId);
-    if (!session.currentProject)
-        throw new Error("No active project. Call register_session_context first.");
-    if (!args.fileName || !args.base64Content)
-        throw new Error("fileName and base64Content are required.");
+    if (!await StorageManager.getProjectManifest(args.projectId))
+        throw new Error(`Project '${args.projectId}' not found.`);
     const sanitized = args.fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
     const buf = Buffer.from(args.base64Content, "base64");
-    await StorageManager.saveAsset(session.currentProject, sanitized, buf);
-    return { ok: true, message: `Asset '${sanitized}' saved to project '${session.currentProject}'.` };
+    await StorageManager.saveAsset(args.projectId, sanitized, buf);
+    EventStore.record(instanceId, "project.asset", args.projectId, { fileName: sanitized, bytes: buf.length });
+    return { ok: true, projectId: args.projectId, fileName: sanitized, message: `Asset '${sanitized}' saved to project '${args.projectId}'.` };
 }
 async function toolUpdateProject(args, instanceId) {
-    if (!args.projectId || !args.patch)
-        throw new Error("projectId and patch are required.");
-    if (args.patch.id)
-        throw new Error("Cannot change 'id' via patch. Use rename_project instead.");
-    const task = createTask({
-        metadata: { operation: "update_project", projectId: args.projectId, initiator: instanceId }
-    });
-    setImmediate(async () => {
-        try {
-            updateTask(task.id, { status: "running", progress: 0.2 });
-            await StorageManager.patchProjectManifest(args.projectId, args.patch);
-            updateTask(task.id, { status: "completed", progress: 1.0, result_uri: `nexus://projects/${args.projectId}/manifest` });
-        }
-        catch (e) {
-            updateTask(task.id, { status: "failed", error_message: String(e) });
-        }
-    });
-    return { task_id: task.id, status: "pending", message: "Update task created." };
+    await StorageManager.patchProjectManifest(args.projectId, args.patch);
+    EventStore.record(instanceId, "project.update", args.projectId, { fields: Object.keys(args.patch) });
+    return { ok: true, projectId: args.projectId, message: `Project '${args.projectId}' updated.` };
 }
 async function toolRenameProject(args, instanceId) {
-    if (!args.oldId || !args.newId)
-        throw new Error("oldId and newId are required.");
+    if (args.oldId === args.newId)
+        throw new Error("oldId and newId are identical.");
     const exists = await StorageManager.getProjectManifest(args.oldId);
     if (!exists)
         throw new Error(`Project '${args.oldId}' not found.`);
-    const task = createTask({
-        metadata: { operation: "rename_project", oldId: args.oldId, newId: args.newId, initiator: instanceId }
-    });
-    setImmediate(async () => {
-        try {
-            updateTask(task.id, { status: "running", progress: 0.2 });
-            const count = await StorageManager.renameProject(args.oldId, args.newId);
-            await StorageManager.addGlobalLog("SYSTEM", `Project renamed '${args.oldId}' → '${args.newId}' (${count} cascading updates).`);
-            updateTask(task.id, { status: "completed", progress: 1.0, result_uri: `nexus://projects/${args.newId}/manifest` });
-        }
-        catch (e) {
-            updateTask(task.id, { status: "failed", error_message: String(e) });
-        }
-    });
-    return { task_id: task.id, status: "pending", message: "Rename task created." };
+    await StorageManager.renameProject(args.oldId, args.newId);
+    EventStore.record(instanceId, "project.rename", args.newId, { oldId: args.oldId });
+    return { ok: true, oldId: args.oldId, newId: args.newId, message: `Project renamed '${args.oldId}' → '${args.newId}'.` };
 }
 async function toolSearchProjects(args) {
-    if (!args.query)
-        throw new Error("query is required.");
     const registry = await StorageManager.listRegistry();
     const projects = registry.projects;
     const q = args.query.toLowerCase();
-    const limit = args.limit || 10;
+    const limit = args.limit;
     const results = Object.entries(projects)
         .filter(([id, p]) => id.toLowerCase().includes(q) ||
         (p.name && p.name.toLowerCase().includes(q)) ||
@@ -370,12 +69,16 @@ async function toolSearchProjects(args) {
 async function toolGetGlobalTopology(args) {
     return StorageManager.calculateTopology(args.projectId);
 }
+async function toolGetProject(args) {
+    const manifest = await StorageManager.getProjectManifest(args.projectId);
+    if (!manifest)
+        throw new Error(`Project '${args.projectId}' not found.`);
+    return args.includeDocs
+        ? { manifest, internalDocs: await StorageManager.getProjectDocs(args.projectId) }
+        : { manifest };
+}
 async function toolSendMessage(args, instanceId) {
-    if (!args.message)
-        throw new Error("message is required.");
-    const session = getSession(instanceId);
-    const activeMeeting = await UnifiedMeetingStore.getActiveMeeting();
-    const meetingId = (activeMeeting && session.currentProject) ? activeMeeting.id : null;
+    const meetingId = args.meetingId ?? SqliteMeetingStore.getActiveMeetingId();
     if (meetingId) {
         const msg = {
             from: instanceId,
@@ -383,72 +86,87 @@ async function toolSendMessage(args, instanceId) {
             category: args.category,
             timestamp: new Date().toISOString()
         };
-        await UnifiedMeetingStore.addMessage(meetingId, msg);
+        SqliteMeetingStore.addMessage(meetingId, msg);
         return { ok: true, sentTo: "meeting", meetingId, message: `Message sent to meeting ${meetingId}.` };
     }
-    await StorageManager.addGlobalLog(instanceId, args.message, args.category);
-    return { ok: true, sentTo: "global", message: "Message sent to global chat." };
+    const saved = GlobalMessageStore.addMessage(instanceId, args.message, args.category);
+    return { ok: true, sentTo: "global", messageId: saved.id, message: "Message sent to global chat." };
 }
 async function toolReadMessages(args, instanceId) {
-    const count = args.count || 10;
+    const count = args.count;
     if (args.meetingId) {
-        const meeting = await UnifiedMeetingStore.getMeeting(args.meetingId);
+        const meeting = SqliteMeetingStore.getMeeting(args.meetingId);
         if (!meeting)
             throw new Error(`Meeting '${args.meetingId}' not found.`);
-        const messages = await UnifiedMeetingStore.getRecentMessages(count, args.meetingId, instanceId);
+        const messages = SqliteMeetingStore.getRecentMessages(count, args.meetingId, instanceId);
         return { source: "meeting", meetingId: args.meetingId, messages, count: messages.length };
     }
-    const logs = await StorageManager.getRecentLogs(count);
-    return { source: "global", messages: logs, count: logs.length };
+    const messages = GlobalMessageStore.readUnread(instanceId, count);
+    return { source: "global", messages, count: messages.length };
 }
 async function toolUpdateGlobalStrategy(args, instanceId) {
-    if (!args.content)
-        throw new Error("content is required.");
-    await StorageManager.saveGlobalDoc("strategy", "Global Collaboration Strategy", args.content, instanceId);
+    await StorageManager.saveGlobalBlueprint(args.content);
+    EventStore.record(instanceId, "strategy.update");
     return { ok: true, message: "Global strategy updated." };
 }
+async function toolGetGlobalStrategy() {
+    return { content: await StorageManager.getGlobalBlueprint() };
+}
+async function toolListGlobalDocs() {
+    const index = await StorageManager.listGlobalDocs();
+    const docs = Object.entries(index)
+        .map(([docId, entry]) => ({ docId, ...entry }))
+        .sort((a, b) => b.lastUpdated.localeCompare(a.lastUpdated));
+    return { count: docs.length, docs };
+}
+async function toolGetGlobalDoc(args) {
+    const entry = (await StorageManager.listGlobalDocs())[args.docId];
+    if (!entry)
+        throw new Error(`Document '${args.docId}' not found.`);
+    return { docId: args.docId, ...entry, content: await StorageManager.getGlobalDoc(args.docId) };
+}
 async function toolSyncGlobalDoc(args, instanceId) {
-    if (!args.docId || !args.title || !args.content)
-        throw new Error("docId, title, and content are required.");
     await StorageManager.saveGlobalDoc(args.docId, args.title, args.content, instanceId);
+    EventStore.record(instanceId, "doc.sync", args.docId, { title: args.title });
     return { ok: true, message: `Global document '${args.title}' (${args.docId}) synchronized.` };
 }
+async function toolListMeetings(args) {
+    const meetings = SqliteMeetingStore.listMeetings(args.status, args.limit);
+    return { count: meetings.length, activeMeetingId: SqliteMeetingStore.getActiveMeetingId(), meetings };
+}
 async function toolStartMeeting(args, instanceId) {
-    if (!args.topic)
-        throw new Error("topic is required.");
-    const meeting = await UnifiedMeetingStore.startMeeting(args.topic, instanceId);
+    const meeting = SqliteMeetingStore.startMeeting(args.topic, instanceId);
+    EventStore.record(instanceId, "meeting.start", meeting.id, { topic: meeting.topic });
     return { ok: true, meetingId: meeting.id, topic: meeting.topic, status: meeting.status };
 }
 async function toolEndMeeting(args, instanceId) {
-    let id = args.meetingId;
-    if (!id) {
-        const active = await UnifiedMeetingStore.getActiveMeeting();
-        if (active)
-            id = active.id;
-    }
+    const id = args.meetingId ?? SqliteMeetingStore.getActiveMeetingId();
     if (!id)
         throw new Error("No active meeting found to end.");
-    const result = await UnifiedMeetingStore.endMeeting(id, args.summary, instanceId);
-    if (args.summary) {
-        await StorageManager.addGlobalLog("SYSTEM", `Meeting ended: ${result.meeting.topic}. Summary: ${args.summary}`);
-    }
-    return { ok: true, meetingId: id, status: "closed", summary: result.meeting.summary };
+    const meeting = SqliteMeetingStore.endMeeting(id, args.summary, instanceId);
+    EventStore.record(instanceId, "meeting.end", id, { topic: meeting.topic, summary: args.summary });
+    return { ok: true, meetingId: id, status: "closed", summary: meeting.summary };
 }
 async function toolArchiveMeeting(args, instanceId) {
-    const meeting = await UnifiedMeetingStore.getMeeting(args.meetingId);
+    const meeting = SqliteMeetingStore.getMeeting(args.meetingId);
     if (!meeting)
         throw new Error(`Meeting '${args.meetingId}' not found.`);
-    await UnifiedMeetingStore.archiveMeeting(args.meetingId, instanceId);
+    SqliteMeetingStore.archiveMeeting(args.meetingId, instanceId);
+    EventStore.record(instanceId, "meeting.archive", args.meetingId);
     return { ok: true, meetingId: args.meetingId, status: "archived" };
 }
 async function toolReopenMeeting(args, instanceId) {
-    const meeting = await UnifiedMeetingStore.getMeeting(args.meetingId);
+    const meeting = SqliteMeetingStore.getMeeting(args.meetingId);
     if (!meeting)
         throw new Error(`Meeting '${args.meetingId}' not found.`);
-    await UnifiedMeetingStore.reopenMeeting(args.meetingId, instanceId);
+    SqliteMeetingStore.reopenMeeting(args.meetingId, instanceId);
+    EventStore.record(instanceId, "meeting.reopen", args.meetingId);
     return { ok: true, meetingId: args.meetingId, status: "active" };
 }
 async function toolCreateTask(args) {
+    if (args.source_meeting_id && !SqliteMeetingStore.getMeeting(args.source_meeting_id)) {
+        throw new Error(`Meeting '${args.source_meeting_id}' not found.`);
+    }
     const task = createTask({ source_meeting_id: args.source_meeting_id, metadata: args.metadata, ttl: args.ttl });
     return { task_id: task.id, status: task.status, message: "Task created.", task };
 }
@@ -459,7 +177,7 @@ async function toolGetTask(args) {
     return task;
 }
 async function toolListTasks(args) {
-    const tasks = listTasks(args.status, args.limit || 50);
+    const tasks = listTasks(args.status, args.limit);
     return { count: tasks.length, tasks };
 }
 async function toolCancelTask(args) {
@@ -468,112 +186,253 @@ async function toolCancelTask(args) {
         throw new Error(`Task '${args.taskId}' not found or cannot be cancelled.`);
     return { ok: true, taskId: args.taskId, message: "Task cancelled." };
 }
-async function toolHostMaintenance(args) {
-    if (args.action === "clear") {
-        await StorageManager.clearGlobalLogs();
-        return { ok: true, message: "All logs cleared." };
-    }
-    await StorageManager.pruneGlobalLogs(args.count);
-    return { ok: true, message: `Pruned oldest ${args.count} log entries.` };
+async function toolHostMaintenance(args, instanceId) {
+    const removed = args.action === "clear"
+        ? GlobalMessageStore.clear()
+        : GlobalMessageStore.pruneOldest(args.count);
+    EventStore.record(instanceId, `maintenance.${args.action}`, undefined, { removed });
+    return { ok: true, removed, remaining: GlobalMessageStore.count(), message: `Removed ${removed} global messages.` };
+}
+async function toolListEvents(args) {
+    const events = EventStore.list(args.limit, args.action);
+    return { count: events.length, events };
 }
 async function toolHostDeleteProject(args, instanceId) {
     const exists = await StorageManager.getProjectManifest(args.projectId);
     if (!exists)
         throw new Error(`Project '${args.projectId}' not found.`);
-    const task = createTask({
-        metadata: { operation: "delete_project", projectId: args.projectId, initiator: instanceId }
-    });
-    setImmediate(async () => {
-        try {
-            updateTask(task.id, { status: "running", progress: 0.3 });
-            await StorageManager.deleteProject(args.projectId);
-            await StorageManager.addGlobalLog("SYSTEM", `Project deleted: '${args.projectId}' by ${instanceId}.`);
-            updateTask(task.id, { status: "completed", progress: 1.0 });
-        }
-        catch (e) {
-            updateTask(task.id, { status: "failed", error_message: String(e) });
-        }
-    });
-    return { task_id: task.id, status: "pending", message: "Delete task created." };
+    await StorageManager.deleteProject(args.projectId);
+    EventStore.record(instanceId, "project.delete", args.projectId);
+    return { ok: true, projectId: args.projectId, message: `Project '${args.projectId}' deleted.` };
 }
 // ---------------------------------------------------------------------------
 // Tool dispatcher
 // ---------------------------------------------------------------------------
-async function dispatchTool(name, args, instanceId) {
-    const u = args;
+async function dispatchTool(name, rawArgs, instanceId) {
     switch (name) {
-        case "register_session_context": return toolRegisterSessionContext(u, instanceId);
-        case "sync_project_assets": return toolSyncProjectAssets(u, instanceId);
-        case "upload_project_asset": return toolUploadAsset(u, instanceId);
-        case "update_project": return toolUpdateProject(u, instanceId);
-        case "rename_project": return toolRenameProject(u, instanceId);
-        case "search_projects": return toolSearchProjects(u);
-        case "get_global_topology": return toolGetGlobalTopology(u);
-        case "send_message": return toolSendMessage(u, instanceId);
-        case "read_messages": return toolReadMessages(u, instanceId);
-        case "update_global_strategy": return toolUpdateGlobalStrategy(u, instanceId);
-        case "sync_global_doc": return toolSyncGlobalDoc(u, instanceId);
-        case "start_meeting": return toolStartMeeting(u, instanceId);
-        case "end_meeting": return toolEndMeeting(u, instanceId);
-        case "archive_meeting": return toolArchiveMeeting(u, instanceId);
-        case "reopen_meeting": return toolReopenMeeting(u, instanceId);
-        case "create_task": return toolCreateTask(u);
-        case "get_task": return toolGetTask(u);
-        case "list_tasks": return toolListTasks(u);
-        case "cancel_task": return toolCancelTask(u);
-        case "host_maintenance": return toolHostMaintenance(u);
-        case "host_delete_project": return toolHostDeleteProject(u, instanceId);
-        default:
-            throw new Error(`Unknown tool: '${name}'`);
+        case "sync_project_assets": return toolSyncProjectAssets(parseToolArgs(name, rawArgs), instanceId);
+        case "upload_project_asset": return toolUploadAsset(parseToolArgs(name, rawArgs), instanceId);
+        case "update_project": return toolUpdateProject(parseToolArgs(name, rawArgs), instanceId);
+        case "rename_project": return toolRenameProject(parseToolArgs(name, rawArgs), instanceId);
+        case "search_projects": return toolSearchProjects(parseToolArgs(name, rawArgs));
+        case "get_global_topology": return toolGetGlobalTopology(parseToolArgs(name, rawArgs));
+        case "get_project": return toolGetProject(parseToolArgs(name, rawArgs));
+        case "send_message": return toolSendMessage(parseToolArgs(name, rawArgs), instanceId);
+        case "read_messages": return toolReadMessages(parseToolArgs(name, rawArgs), instanceId);
+        case "list_events": return toolListEvents(parseToolArgs(name, rawArgs));
+        case "get_global_strategy":
+            parseToolArgs(name, rawArgs);
+            return toolGetGlobalStrategy();
+        case "update_global_strategy": return toolUpdateGlobalStrategy(parseToolArgs(name, rawArgs), instanceId);
+        case "list_global_docs":
+            parseToolArgs(name, rawArgs);
+            return toolListGlobalDocs();
+        case "get_global_doc": return toolGetGlobalDoc(parseToolArgs(name, rawArgs));
+        case "sync_global_doc": return toolSyncGlobalDoc(parseToolArgs(name, rawArgs), instanceId);
+        case "list_meetings": return toolListMeetings(parseToolArgs(name, rawArgs));
+        case "start_meeting": return toolStartMeeting(parseToolArgs(name, rawArgs), instanceId);
+        case "end_meeting": return toolEndMeeting(parseToolArgs(name, rawArgs), instanceId);
+        case "archive_meeting": return toolArchiveMeeting(parseToolArgs(name, rawArgs), instanceId);
+        case "reopen_meeting": return toolReopenMeeting(parseToolArgs(name, rawArgs), instanceId);
+        case "create_task": return toolCreateTask(parseToolArgs(name, rawArgs));
+        case "get_task": return toolGetTask(parseToolArgs(name, rawArgs));
+        case "list_tasks": return toolListTasks(parseToolArgs(name, rawArgs));
+        case "cancel_task": return toolCancelTask(parseToolArgs(name, rawArgs));
+        case "host_maintenance": return toolHostMaintenance(parseToolArgs(name, rawArgs), instanceId);
+        case "host_delete_project": return toolHostDeleteProject(parseToolArgs(name, rawArgs), instanceId);
     }
 }
 // ---------------------------------------------------------------------------
 // HTTP helpers
 // ---------------------------------------------------------------------------
-function jsonResponse(res, status, body) {
+function jsonResponse(res, status, body, headers = {}) {
     const payload = JSON.stringify(body);
-    res.writeHead(status, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) });
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(payload),
+        ...(status === 413 ? { Connection: "close" } : {}),
+        ...headers
+    });
     res.end(payload);
 }
-async function parseBody(req) {
+class HttpError extends Error {
+    status;
+    headers;
+    constructor(status, message, headers = {}) {
+        super(message);
+        this.status = status;
+        this.headers = headers;
+    }
+}
+function rateLimited(retryAfterSec, scope) {
+    return new HttpError(429, `Rate limit exceeded for ${scope}; retry after ${retryAfterSec}s.`, { "Retry-After": String(retryAfterSec) });
+}
+/**
+ * Run a tool for an HTTP request. Validation failures and handler rejections
+ * are the caller's fault and surface as 400, not as daemon errors.
+ */
+async function callTool(name, args, instanceId) {
+    try {
+        return finalizeResult(name, await dispatchTool(name, args, instanceId));
+    }
+    catch (e) {
+        if (e instanceof HttpError)
+            throw e;
+        if (e instanceof ResultContractError) {
+            // A daemon-side defect (or unreadable stored data), not the caller's fault.
+            console.error("[n2n-nexus daemon]", e.message);
+            throw new HttpError(500, e.message);
+        }
+        throw new HttpError(400, e instanceof Error ? e.message : String(e));
+    }
+}
+/** Instance id recorded for requests that do not name one. */
+const UNKNOWN_INSTANCE = "unknown";
+function actor(body) {
+    return typeof body.instanceId === "string" && body.instanceId ? body.instanceId : UNKNOWN_INSTANCE;
+}
+/** Query-string parameters as tool arguments; `numeric` names are converted to numbers. */
+function queryArgs(url, numeric) {
+    const args = {};
+    for (const [key, value] of url.searchParams) {
+        if (key === "instanceId")
+            continue;
+        args[key] = numeric.includes(key) ? Number(value) : value;
+    }
+    return args;
+}
+async function parseRequestBody(req, maxBytes) {
+    const declared = Number(req.headers["content-length"]);
+    if (declared > maxBytes)
+        throw new HttpError(413, `Request body exceeds ${maxBytes} bytes`);
     return new Promise((resolve, reject) => {
-        let data = "";
-        req.on("data", chunk => { data += chunk; });
+        const chunks = [];
+        let received = 0;
+        let tooLarge = false;
+        req.on("data", (chunk) => {
+            if (tooLarge)
+                return;
+            received += chunk.length;
+            if (received > maxBytes) {
+                // Keep draining so the 413 can still be written; the response closes the connection.
+                tooLarge = true;
+                chunks.length = 0;
+                return;
+            }
+            chunks.push(chunk);
+        });
         req.on("end", () => {
-            if (!data)
+            if (tooLarge)
+                return reject(new HttpError(413, `Request body exceeds ${maxBytes} bytes`));
+            if (received === 0)
                 return resolve({});
+            let parsed;
             try {
-                resolve(JSON.parse(data));
+                parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
             }
             catch {
-                reject(new Error("Invalid JSON"));
+                return reject(new HttpError(400, "Invalid JSON"));
+            }
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                return reject(new HttpError(400, "Request body must be a JSON object"));
             }
+            resolve(parsed);
         });
         req.on("error", reject);
     });
 }
+/** Host names (without port) that may address the daemon besides IP literals. */
+const DEFAULT_ALLOWED_HOSTS = ["localhost", "host.docker.internal"];
+export function allowedHostsFromEnv(env = process.env) {
+    const extra = (env.NEXUS_ALLOWED_HOSTS || "").split(",").map(h => h.trim().toLowerCase()).filter(Boolean);
+    return [...DEFAULT_ALLOWED_HOSTS, ...extra];
+}
+/** Hostname part of a Host header: strips the port and IPv6 brackets. */
+function hostName(header) {
+    const m = header.match(/^\[([^\]]+)\](?::\d+)?$/);
+    if (m)
+        return m[1].toLowerCase();
+    return header.replace(/:\d+$/, "").toLowerCase();
+}
+/**
+ * The daemon has no authentication, so it must not be callable from a web
+ * page the user happens to have open. Browsers attach Origin / Sec-Fetch-*
+ * headers to cross-site requests and only send JSON bodies after a CORS
+ * preflight, which the daemon never grants; MCP adapters and scripts send
+ * neither header and use application/json. A DNS-rebinding page reaches the
+ * daemon as a same-origin request under its own host name, so the Host
+ * header must be an IP literal or a known local name.
+ */
+function rejectBrowserRequest(req, allowedHosts) {
+    const host = req.headers.host;
+    if (!host)
+        return new HttpError(400, "Host header is required");
+    const name = hostName(host);
+    if (!net.isIP(name) && !allowedHosts.includes(name)) {
+        return new HttpError(403, `Host '${name}' is not allowed; use an IP address or add it to NEXUS_ALLOWED_HOSTS`);
+    }
+    if (req.headers.origin !== undefined) {
+        return new HttpError(403, "Requests from browser origins are not allowed");
+    }
+    const site = req.headers["sec-fetch-site"];
+    if (typeof site === "string" && site !== "none" && site !== "same-origin") {
+        return new HttpError(403, "Cross-site browser requests are not allowed");
+    }
+    if (req.method === "POST") {
+        const type = String(req.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+        if (type !== "application/json") {
+            return new HttpError(415, "Content-Type must be application/json");
+        }
+    }
+    return null;
+}
 // ---------------------------------------------------------------------------
 // Server factory
 // ---------------------------------------------------------------------------
 export async function createDaemonServer(options) {
-    const storageInfo = await initializeStorage();
+    await initializeStorage();
+    const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
+    const allowedHosts = options.allowedHosts ?? allowedHostsFromEnv();
+    const limit = options.rateLimit ?? rateLimitFromEnv();
+    const instanceLimiter = new RateLimiter(limit.perSecond, limit.burst);
+    const addressLimiter = new RateLimiter(limit.perSecond * ADDRESS_LIMIT_FACTOR, limit.burst * ADDRESS_LIMIT_FACTOR);
+    /**
+     * Tool calls from HTTP routes, counted against the calling instance's budget.
+     * Requests that name no instance ("unknown") are only limited per address:
+     * pooling them in one shared bucket let any client exhaust it for all others.
+     */
+    const call = (name, args, instanceId) => {
+        if (instanceId !== UNKNOWN_INSTANCE) {
+            const wait = instanceLimiter.take(`instance:${instanceId}`);
+            if (wait)
+                throw rateLimited(wait, `instance '${instanceId}'`);
+        }
+        return callTool(name, args, instanceId);
+    };
     const server = http.createServer(async (req, res) => {
         const method = req.method || "GET";
         const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
         const path = url.pathname;
+        const parseBody = (r) => parseRequestBody(r, maxBodyBytes);
         try {
+            const guard = rejectBrowserRequest(req, allowedHosts);
+            if (guard) {
+                req.resume();
+                return jsonResponse(res, guard.status, { ok: false, error: guard.message });
+            }
+            // Health and the tool list stay reachable so adapters can tell "busy" from "down".
+            const exempt = method === "GET" && (path === "/health" || path === "/api/tools");
+            if (!exempt) {
+                const wait = addressLimiter.take(`address:${req.socket.remoteAddress ?? "unknown"}`);
+                if (wait) {
+                    req.resume();
+                    const e = rateLimited(wait, "this client address");
+                    return jsonResponse(res, e.status, { ok: false, error: e.message }, e.headers);
+                }
+            }
             // Health
             if (method === "GET" && path === "/health") {
-                return jsonResponse(res, 200, {
-                    ok: true, version: options.version,
-                    storageMode: storageInfo.storageMode,
-                    isDegraded: storageInfo.isDegraded,
-                    ready: storageInfo.ready
-                });
-            }
-            // Storage info
-            if (method === "GET" && path === "/api/storage/info") {
-                return jsonResponse(res, 200, storageInfo);
+                return jsonResponse(res, 200, { ok: true, version: options.version });
             }
             // Tool definitions
             if (method === "GET" && path === "/api/tools") {
@@ -584,93 +443,50 @@ export async function createDaemonServer(options) {
                 const body = await parseBody(req);
                 const toolName = body.tool;
                 const args = (body.args || {});
-                const instanceId = body.instanceId || "unknown";
+                const instanceId = body.instanceId || UNKNOWN_INSTANCE;
                 if (!toolName)
                     return jsonResponse(res, 400, { ok: false, error: "tool is required" });
-                const result = await dispatchTool(toolName, args, instanceId);
-                return jsonResponse(res, 200, { ok: true, result });
+                if (!isToolName(toolName)) {
+                    return jsonResponse(res, 404, { ok: false, error: `Unknown tool: '${toolName}'` });
+                }
+                return jsonResponse(res, 200, { ok: true, result: await call(toolName, args, instanceId) });
             }
             // Messages
             if (method === "POST" && path === "/api/messages/send") {
                 const body = await parseBody(req);
-                if (!body.message)
-                    return jsonResponse(res, 400, { ok: false, error: "message is required" });
-                const instanceId = body.instanceId || "unknown";
-                const meetingId = body.meetingId;
-                const source = body.source;
-                // Direct meetingId routing (bypasses session currentProject check)
-                if (meetingId || source === "meeting") {
-                    const targetMeetingId = meetingId || (await UnifiedMeetingStore.getActiveMeeting())?.id || null;
-                    if (!targetMeetingId) {
-                        return jsonResponse(res, 200, { ok: false, sentTo: "global", message: "No active meeting found." });
-                    }
-                    const msg = {
-                        from: instanceId, text: body.message,
-                        category: body.category || "CHAT",
-                        timestamp: new Date().toISOString()
-                    };
-                    await UnifiedMeetingStore.addMessage(targetMeetingId, msg);
-                    return jsonResponse(res, 200, { ok: true, sentTo: "meeting", meetingId: targetMeetingId, message: `Message sent to meeting ${targetMeetingId}.` });
-                }
-                const result = await toolSendMessage({ message: body.message, category: body.category }, instanceId);
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("send_message", body, actor(body)));
             }
             if (method === "GET" && path === "/api/messages/unread") {
-                const count = Number(url.searchParams.get("count")) || 10;
-                const meetingId = url.searchParams.get("meetingId") || undefined;
-                const instanceId = url.searchParams.get("instanceId") || "unknown";
-                const result = await toolReadMessages({ count, meetingId }, instanceId);
+                const result = await call("read_messages", queryArgs(url, ["count"]), url.searchParams.get("instanceId") || UNKNOWN_INSTANCE);
                 return jsonResponse(res, 200, result);
             }
             // Projects
             if (method === "POST" && path === "/api/projects/sync") {
                 const body = await parseBody(req);
-                if (!body.manifest)
-                    return jsonResponse(res, 400, { ok: false, error: "manifest is required" });
-                const result = await toolSyncProjectAssets({ manifest: body.manifest, internalDocs: body.internalDocs || "" }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, { ok: true, ...result });
+                return jsonResponse(res, 200, await call("sync_project_assets", { internalDocs: "", ...body }, actor(body)));
             }
             if (method === "POST" && path === "/api/projects/update") {
                 const body = await parseBody(req);
-                if (!body.projectId || !body.patch)
-                    return jsonResponse(res, 400, { ok: false, error: "projectId and patch are required" });
-                const result = await toolUpdateProject({ projectId: body.projectId, patch: body.patch }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, { ok: true, ...result });
+                return jsonResponse(res, 200, await call("update_project", body, actor(body)));
             }
             if (method === "POST" && path === "/api/projects/rename") {
                 const body = await parseBody(req);
-                if (!body.oldId || !body.newId)
-                    return jsonResponse(res, 400, { ok: false, error: "oldId and newId are required" });
-                const result = await toolRenameProject({ oldId: body.oldId, newId: body.newId }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, { ok: true, ...result });
+                return jsonResponse(res, 200, await call("rename_project", body, actor(body)));
             }
             if (method === "POST" && path === "/api/projects/delete") {
                 const body = await parseBody(req);
-                if (!body.projectId)
-                    return jsonResponse(res, 400, { ok: false, error: "projectId is required" });
-                const result = await toolHostDeleteProject({ projectId: body.projectId }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, { ok: true, ...result });
+                return jsonResponse(res, 200, await call("host_delete_project", body, actor(body)));
             }
             if (method === "GET" && path === "/api/projects/search") {
-                const query = url.searchParams.get("query") || "";
-                const limit = Number(url.searchParams.get("limit")) || 10;
-                if (!query)
-                    return jsonResponse(res, 400, { ok: false, error: "query is required" });
-                const result = await toolSearchProjects({ query, limit });
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("search_projects", queryArgs(url, ["limit"]), UNKNOWN_INSTANCE));
             }
-            if (method === "GET" && path === "/api/projects/topology") {
-                const projectId = url.searchParams.get("projectId") || undefined;
-                const result = await toolGetGlobalTopology({ projectId });
-                return jsonResponse(res, 200, result);
+            const projectMatch = path.match(/^\/api\/projects\/([^/]+)$/);
+            if (method === "GET" && projectMatch && !["search", "topology"].includes(projectMatch[1])) {
+                const includeDocs = url.searchParams.get("includeDocs") !== "false";
+                return jsonResponse(res, 200, await call("get_project", { projectId: decodeURIComponent(projectMatch[1]), includeDocs }, UNKNOWN_INSTANCE));
             }
-            // Session
-            if (method === "POST" && path === "/api/session/register") {
-                const body = await parseBody(req);
-                if (!body.projectId)
-                    return jsonResponse(res, 400, { ok: false, error: "projectId is required" });
-                const result = await toolRegisterSessionContext({ projectId: body.projectId }, body.instanceId || "unknown");
-                return jsonResponse(res, result.ok ? 200 : 404, result);
+            if (method === "GET" && path === "/api/projects/topology") {
+                return jsonResponse(res, 200, await call("get_global_topology", queryArgs(url, []), UNKNOWN_INSTANCE));
             }
             // Global docs
             if (method === "GET" && path === "/api/global/docs") {
@@ -688,52 +504,41 @@ export async function createDaemonServer(options) {
                 }
                 if (method === "POST") {
                     const body = await parseBody(req);
-                    if (!body.title || !body.content)
-                        return jsonResponse(res, 400, { ok: false, error: "title and content are required" });
-                    const instanceId = body.instanceId || "unknown";
-                    await StorageManager.saveGlobalDoc(docId, body.title, body.content, instanceId);
+                    await call("sync_global_doc", { ...body, docId }, actor(body));
                     return jsonResponse(res, 200, { ok: true, docId });
                 }
             }
+            if (method === "GET" && path === "/api/global/strategy") {
+                return jsonResponse(res, 200, { content: await StorageManager.getGlobalBlueprint() });
+            }
             if (method === "POST" && path === "/api/global/strategy") {
                 const body = await parseBody(req);
-                if (!body.content)
-                    return jsonResponse(res, 400, { ok: false, error: "content is required" });
-                const instanceId = body.instanceId || "unknown";
-                const result = await toolUpdateGlobalStrategy({ content: body.content }, instanceId);
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("update_global_strategy", body, actor(body)));
             }
             // Meetings
+            if (method === "GET" && path === "/api/meetings") {
+                return jsonResponse(res, 200, await call("list_meetings", queryArgs(url, ["limit"]), UNKNOWN_INSTANCE));
+            }
             if (method === "POST" && path === "/api/meetings/start") {
                 const body = await parseBody(req);
-                if (!body.topic)
-                    return jsonResponse(res, 400, { ok: false, error: "topic is required" });
-                const result = await toolStartMeeting({ topic: body.topic }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("start_meeting", body, actor(body)));
             }
             if (method === "POST" && path === "/api/meetings/end") {
                 const body = await parseBody(req);
-                const result = await toolEndMeeting({ meetingId: body.meetingId, summary: body.summary }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("end_meeting", body, actor(body)));
             }
             if (method === "POST" && path === "/api/meetings/archive") {
                 const body = await parseBody(req);
-                if (!body.meetingId)
-                    return jsonResponse(res, 400, { ok: false, error: "meetingId is required" });
-                const result = await toolArchiveMeeting({ meetingId: body.meetingId }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("archive_meeting", body, actor(body)));
             }
             if (method === "POST" && path === "/api/meetings/reopen") {
                 const body = await parseBody(req);
-                if (!body.meetingId)
-                    return jsonResponse(res, 400, { ok: false, error: "meetingId is required" });
-                const result = await toolReopenMeeting({ meetingId: body.meetingId }, body.instanceId || "unknown");
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("reopen_meeting", body, actor(body)));
             }
             const meetingMatch = path.match(/^\/api\/meetings\/(.+)$/);
             if (meetingMatch && method === "GET") {
                 const meetingId = decodeURIComponent(meetingMatch[1]);
-                const meeting = await UnifiedMeetingStore.getMeeting(meetingId);
+                const meeting = SqliteMeetingStore.getMeeting(meetingId);
                 if (!meeting)
                     return jsonResponse(res, 404, { ok: false, error: `Meeting '${meetingId}' not found.` });
                 return jsonResponse(res, 200, meeting);
@@ -741,51 +546,53 @@ export async function createDaemonServer(options) {
             // Tasks
             if (method === "POST" && path === "/api/tasks") {
                 const body = await parseBody(req);
-                const result = await toolCreateTask(body);
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("create_task", body, actor(body)));
             }
             if (method === "GET" && path === "/api/tasks") {
-                const status = url.searchParams.get("status");
-                const limit = Number(url.searchParams.get("limit")) || 50;
-                const result = await toolListTasks({ status: status || undefined, limit });
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("list_tasks", queryArgs(url, ["limit"]), UNKNOWN_INSTANCE));
             }
             const taskMatch = path.match(/^\/api\/tasks\/([^/]+)(\/(.+))?$/);
             if (taskMatch) {
                 const taskId = decodeURIComponent(taskMatch[1]);
                 const action = taskMatch[3];
                 if (method === "GET" && !action) {
-                    const result = await toolGetTask({ taskId });
-                    return jsonResponse(res, 200, result);
+                    return jsonResponse(res, 200, await call("get_task", { taskId }, UNKNOWN_INSTANCE));
                 }
                 if (method === "POST" && action === "update") {
                     const body = await parseBody(req);
-                    const task = getTask(taskId);
-                    if (!task)
+                    const update = taskUpdateSchema.safeParse(body);
+                    if (!update.success)
+                        return jsonResponse(res, 400, { ok: false, error: `Invalid task update:\n${z.prettifyError(update.error)}` });
+                    if (!getTask(taskId))
                         return jsonResponse(res, 404, { ok: false, error: `Task '${taskId}' not found.` });
-                    const updated = updateTask(taskId, body);
-                    return jsonResponse(res, 200, { ok: true, task: updated });
+                    return jsonResponse(res, 200, { ok: true, task: updateTask(taskId, update.data) });
                 }
                 if (method === "POST" && action === "cancel") {
-                    const result = await toolCancelTask({ taskId });
-                    return jsonResponse(res, 200, result);
+                    return jsonResponse(res, 200, await call("cancel_task", { taskId }, UNKNOWN_INSTANCE));
                 }
             }
             // Maintenance
             if (method === "POST" && path === "/api/maintenance/logs") {
                 const body = await parseBody(req);
-                if (!body.action)
-                    return jsonResponse(res, 400, { ok: false, error: "action is required" });
-                const result = await toolHostMaintenance({ action: body.action, count: body.count || 0 });
-                return jsonResponse(res, 200, result);
+                return jsonResponse(res, 200, await call("host_maintenance", body, actor(body)));
+            }
+            // Events
+            if (method === "GET" && path === "/api/events") {
+                return jsonResponse(res, 200, await call("list_events", queryArgs(url, ["limit"]), UNKNOWN_INSTANCE));
             }
             jsonResponse(res, 404, { ok: false, error: "Not found" });
         }
         catch (e) {
             const message = e instanceof Error ? e.message : String(e);
+            if (e instanceof HttpError) {
+                return jsonResponse(res, e.status, { ok: false, error: message }, e.headers);
+            }
+            if (e instanceof ToolValidationError || e instanceof z.ZodError) {
+                return jsonResponse(res, 400, { ok: false, error: e instanceof z.ZodError ? z.prettifyError(e) : message });
+            }
             console.error("[n2n-nexus daemon] Error:", message);
             jsonResponse(res, 500, { ok: false, error: message });
         }
     });
-    return { server, storageInfo };
+    return { server };
 }