neoctl-web 0.1.9 → 0.1.11

package/server.mjs

@@ -1,8 +1,8 @@
-import http from 'node:http';
-import fs from 'node:fs';
-import fsp from 'node:fs/promises';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
+import http from 'node:http';
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 // Consume the private launcher secret before importing application/runtime modules.
 // Imports can initialize plugins or spawn children; none may inherit this value.
 let desktopControlConfig;
@@ -12,61 +12,61 @@ let desktopControlConfig;
   try { desktopControlConfig = raw ? JSON.parse(raw) : undefined; } catch {}
 }
 
-const { coreRuntimeInfo, createWebRuntime, loadNeoPlugins, runWebServer } = await import('./core-runtime.mjs');
-const { createWebPluginHost } = await import('./plugins.mjs');
-const { createWebPluginSettings } = await import('./plugin-settings.mjs');
-const { createWebToolSettings } = await import('./tool-settings.mjs');
-const { createWorkspaceRuntimeManager } = await import('./runtime-workspaces.mjs');
-const { installRuntimeRouterIdleCleanup } = await import('./runtime-router-cleanup.mjs');
-const { createCpaQuotaMonitor } = await import('./cpa-quota.mjs');
-const { createMemoryMonitor } = await import('./memory-monitor.mjs');
+const { coreRuntimeInfo, createWebRuntime, loadNeoPlugins, runWebServer } = await import('./core-runtime.mjs');
+const { createWebPluginHost } = await import('./plugins.mjs');
+const { createWebPluginSettings } = await import('./plugin-settings.mjs');
+const { createWebToolSettings } = await import('./tool-settings.mjs');
+const { createWorkspaceRuntimeManager } = await import('./runtime-workspaces.mjs');
+const { installRuntimeRouterIdleCleanup } = await import('./runtime-router-cleanup.mjs');
+const { createCpaQuotaMonitor } = await import('./cpa-quota.mjs');
+const { createMemoryMonitor } = await import('./memory-monitor.mjs');
 const { resolveWebStorage } = await import('./platform-paths.mjs');
-const { createControlSync, createLoginApplier, validateControlConfig } = await import('./control-sync.mjs');
-
+const { createControlSync, createLoginApplier, validateControlConfig } = await import('./control-sync.mjs');
+
 const controlConfig = validateControlConfig(desktopControlConfig);
 desktopControlConfig = undefined;
 const controlEnabled = Boolean(controlConfig);
 
-installRuntimeRouterIdleCleanup();
-console.log(`neo core: ${coreRuntimeInfo.source} ${coreRuntimeInfo.version} (${coreRuntimeInfo.location})`);
-process.env.NEO_CORE_VERSION = coreRuntimeInfo.version;
-process.env.NEO_CLIENT_REVISION ||= `${coreRuntimeInfo.version}-${Date.now().toString(36)}`;
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const root = path.resolve(process.env.DIST_DIR || path.join(__dirname, 'dist'));
-const host = process.env.APP_HOST || '0.0.0.0';
-const port = Number(process.env.APP_PORT || process.env.PORT || 5173);
-const runtimeTarget = new URL(process.env.NEO_RUNTIME_TARGET || 'http://127.0.0.1:3101');
-const { dataRoot, workspaceRoot } = resolveWebStorage();
-const promptLibraryFile = path.resolve(process.env.NEO_PROMPT_LIBRARY_FILE || path.join(dataRoot, 'prompt-library.json'));
-const uploadsDir = path.resolve(process.env.NEO_UPLOADS_DIR || path.join(dataRoot, 'uploads'));
-const pluginDir = path.resolve(process.env.NEO_WEB_PLUGIN_DIR || path.join(__dirname, 'plugins'));
-const pluginDataDir = path.resolve(process.env.NEO_WEB_PLUGIN_DATA_DIR || dataRoot);
-const cpaConfigFile = path.resolve(process.env.NEO_CPA_CONFIG_FILE || path.join(dataRoot, 'cpa-config.json'));
-const memoryMonitorFile = path.resolve(process.env.NEO_MEMORY_MONITOR_FILE || path.join(dataRoot, 'memory-monitor.json'));
-const pluginSettingsFile = path.resolve(process.env.NEO_WEB_PLUGIN_SETTINGS_FILE || path.join(dataRoot, 'plugins.json'));
-const toolSettingsFile = path.resolve(process.env.NEO_WEB_TOOL_SETTINGS_FILE || path.join(dataRoot, 'tools.json'));
-const maxUploadBytes = Number(process.env.NEO_UPLOAD_MAX_BYTES || 25 * 1024 * 1024);
-const pluginSettings = await createWebPluginSettings(pluginSettingsFile);
-const toolSettings = await createWebToolSettings(toolSettingsFile);
-const pluginEnv = process.env.NEO_WEB_PLUGINS;
-const pluginResources = await loadNeoPlugins({ directories: pluginDir, appDataDir: pluginDataDir });
-const pluginHost = createWebPluginHost({
-  plugins: pluginResources,
-  enabled: pluginEnv?.trim() ? pluginEnv : pluginSettings.globalEnabledIds(),
-  locked: Boolean(pluginEnv?.trim()),
-  settings: pluginSettings,
-});
-const embedRuntime = process.env.NEO_EMBED_RUNTIME !== 'false';
-const cpaQuotaMonitor = createCpaQuotaMonitor({ configFile: cpaConfigFile });
-const memoryMonitor = createMemoryMonitor({
-  storageFile: memoryMonitorFile,
-  sampleMs: process.env.NEO_MEMORY_SAMPLE_MS,
-  retentionMs: process.env.NEO_MEMORY_RETENTION_MS,
-  publicSamples: process.env.NEO_MEMORY_PUBLIC_SAMPLES,
-  maxPersistedSamples: process.env.NEO_MEMORY_MAX_PERSISTED_SAMPLES,
-  maxPersistedBytes: process.env.NEO_MEMORY_MAX_PERSISTED_BYTES,
-});
+installRuntimeRouterIdleCleanup();
+console.log(`neo core: ${coreRuntimeInfo.source} ${coreRuntimeInfo.version} (${coreRuntimeInfo.location})`);
+process.env.NEO_CORE_VERSION = coreRuntimeInfo.version;
+process.env.NEO_CLIENT_REVISION ||= `${coreRuntimeInfo.version}-${Date.now().toString(36)}`;
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(process.env.DIST_DIR || path.join(__dirname, 'dist'));
+const host = process.env.APP_HOST || '0.0.0.0';
+const port = Number(process.env.APP_PORT || process.env.PORT || 5173);
+const runtimeTarget = new URL(process.env.NEO_RUNTIME_TARGET || 'http://127.0.0.1:3101');
+const { dataRoot, workspaceRoot } = resolveWebStorage();
+const promptLibraryFile = path.resolve(process.env.NEO_PROMPT_LIBRARY_FILE || path.join(dataRoot, 'prompt-library.json'));
+const uploadsDir = path.resolve(process.env.NEO_UPLOADS_DIR || path.join(dataRoot, 'uploads'));
+const pluginDir = path.resolve(process.env.NEO_WEB_PLUGIN_DIR || path.join(__dirname, 'plugins'));
+const pluginDataDir = path.resolve(process.env.NEO_WEB_PLUGIN_DATA_DIR || dataRoot);
+const cpaConfigFile = path.resolve(process.env.NEO_CPA_CONFIG_FILE || path.join(dataRoot, 'cpa-config.json'));
+const memoryMonitorFile = path.resolve(process.env.NEO_MEMORY_MONITOR_FILE || path.join(dataRoot, 'memory-monitor.json'));
+const pluginSettingsFile = path.resolve(process.env.NEO_WEB_PLUGIN_SETTINGS_FILE || path.join(dataRoot, 'plugins.json'));
+const toolSettingsFile = path.resolve(process.env.NEO_WEB_TOOL_SETTINGS_FILE || path.join(dataRoot, 'tools.json'));
+const maxUploadBytes = Number(process.env.NEO_UPLOAD_MAX_BYTES || 25 * 1024 * 1024);
+const pluginSettings = await createWebPluginSettings(pluginSettingsFile);
+const toolSettings = await createWebToolSettings(toolSettingsFile);
+const pluginEnv = process.env.NEO_WEB_PLUGINS;
+const pluginResources = await loadNeoPlugins({ directories: pluginDir, appDataDir: pluginDataDir });
+const pluginHost = createWebPluginHost({
+  plugins: pluginResources,
+  enabled: pluginEnv?.trim() ? pluginEnv : pluginSettings.globalEnabledIds(),
+  locked: Boolean(pluginEnv?.trim()),
+  settings: pluginSettings,
+});
+const embedRuntime = process.env.NEO_EMBED_RUNTIME !== 'false';
+const cpaQuotaMonitor = createCpaQuotaMonitor({ configFile: cpaConfigFile });
+const memoryMonitor = createMemoryMonitor({
+  storageFile: memoryMonitorFile,
+  sampleMs: process.env.NEO_MEMORY_SAMPLE_MS,
+  retentionMs: process.env.NEO_MEMORY_RETENTION_MS,
+  publicSamples: process.env.NEO_MEMORY_PUBLIC_SAMPLES,
+  maxPersistedSamples: process.env.NEO_MEMORY_MAX_PERSISTED_SAMPLES,
+  maxPersistedBytes: process.env.NEO_MEMORY_MAX_PERSISTED_BYTES,
+});
 // Weak references do not defeat the existing router's idle-session cleanup.
 const controlRepls = new Set();
 function activeControlRepls() {
@@ -78,59 +78,59 @@ function activeControlRepls() {
   }
   return active;
 }
-const workspaceRuntime = createWorkspaceRuntimeManager({
-  projectRoot: process.cwd(),
-  workspaceRoot,
-  registryFile: path.join(dataRoot, 'session-workspaces.json'),
-  createRuntime: (runtimeOptions) => createWebRuntime({
-    ...runtimeOptions,
-    ...pluginHost.runtimePlugins(runtimeOptions.sessionId),
-    globalToolOverrides: toolSettings.globalOverrides(),
-    sessionToolOverrides: toolSettings.sessionOverrides(runtimeOptions.sessionId),
-    persistGlobalToolOverrides: (overrides) => toolSettings.setGlobalOverrides(overrides),
-    persistSessionToolOverrides: (sessionId, overrides) => toolSettings.setSessionOverrides(sessionId, overrides),
-    resolveSessionToolOverrides: (sessionId) => toolSettings.sessionOverrides(sessionId),
-  }),
-});
-
-const DEFAULT_APP_PROMPT_LIBRARY = [];
-
-const mime = {
-  '.html': 'text/html; charset=utf-8',
-  '.js': 'text/javascript; charset=utf-8',
-  '.mjs': 'text/javascript; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
-  '.json': 'application/json; charset=utf-8',
-  '.svg': 'image/svg+xml',
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg',
-  '.webp': 'image/webp',
-  '.ico': 'image/x-icon',
-};
-
-function shouldProxy(pathname) {
-  return pathname === '/events' || pathname.startsWith('/api/') || pathname === '/api' || pathname.startsWith('/vendor/');
-}
-
-const server = http.createServer((req, res) => {
-  void routeRequest(req, res);
-});
-
-server.keepAliveTimeout = 70_000;
-server.headersTimeout = 75_000;
-if (embedRuntime) await startEmbeddedRuntime();
-await cpaQuotaMonitor.start();
-await memoryMonitor.start();
-await new Promise((resolve, reject) => {
-  server.once('error', reject);
-  server.listen(port, host, () => {
-    server.off('error', reject);
-    console.log(`neo web listening on http://${host}:${port}, dist=${root}, runtime=${runtimeTarget.href}`);
-    resolve();
-  });
-});
-
+const workspaceRuntime = createWorkspaceRuntimeManager({
+  projectRoot: process.cwd(),
+  workspaceRoot,
+  registryFile: path.join(dataRoot, 'session-workspaces.json'),
+  createRuntime: (runtimeOptions) => createWebRuntime({
+    ...runtimeOptions,
+    ...pluginHost.runtimePlugins(runtimeOptions.sessionId),
+    globalToolOverrides: toolSettings.globalOverrides(),
+    sessionToolOverrides: toolSettings.sessionOverrides(runtimeOptions.sessionId),
+    persistGlobalToolOverrides: (overrides) => toolSettings.setGlobalOverrides(overrides),
+    persistSessionToolOverrides: (sessionId, overrides) => toolSettings.setSessionOverrides(sessionId, overrides),
+    resolveSessionToolOverrides: (sessionId) => toolSettings.sessionOverrides(sessionId),
+  }),
+});
+
+const DEFAULT_APP_PROMPT_LIBRARY = [];
+
+const mime = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.webp': 'image/webp',
+  '.ico': 'image/x-icon',
+};
+
+function shouldProxy(pathname) {
+  return pathname === '/events' || pathname.startsWith('/api/') || pathname === '/api' || pathname.startsWith('/vendor/');
+}
+
+const server = http.createServer((req, res) => {
+  void routeRequest(req, res);
+});
+
+server.keepAliveTimeout = 70_000;
+server.headersTimeout = 75_000;
+if (embedRuntime) await startEmbeddedRuntime();
+await cpaQuotaMonitor.start();
+await memoryMonitor.start();
+await new Promise((resolve, reject) => {
+  server.once('error', reject);
+  server.listen(port, host, () => {
+    server.off('error', reject);
+    console.log(`neo web listening on http://${host}:${port}, dist=${root}, runtime=${runtimeTarget.href}`);
+    resolve();
+  });
+});
+
 // Optional Desktop-only background work starts after HTTP listen and never delays UI.
 if (controlEnabled) {
   const controlSync = createControlSync({
@@ -141,351 +141,351 @@ if (controlEnabled) {
   server.once('close', () => { void controlSync.stop(); });
 }
 
-async function startEmbeddedRuntime() {
-  const runtimeHost = runtimeTarget.hostname || '127.0.0.1';
-  const runtimePort = runtimeTarget.port || '3101';
-  await runWebServer(['--host', runtimeHost, '--port', runtimePort], {
-    createRuntime: workspaceRuntime.createRuntime,
+async function startEmbeddedRuntime() {
+  const runtimeHost = runtimeTarget.hostname || '127.0.0.1';
+  const runtimePort = runtimeTarget.port || '3101';
+  await runWebServer(['--host', runtimeHost, '--port', runtimePort], {
+    createRuntime: workspaceRuntime.createRuntime,
     createRepl(runtime) {
       const repl = workspaceRuntime.createRepl(runtime);
       if (controlEnabled) controlRepls.add(new WeakRef(repl));
       return repl;
-    },
-  });
-}
-
-async function routeRequest(req, res) {
-  const url = new URL(req.url || '/', 'http://localhost');
-  try {
-    if (await pluginHost.route(req, res, url, { readJsonBody, sendJson })) return;
-    if (req.method === 'GET' && url.pathname === '/api/prompt-library') {
-      return sendJson(res, { items: await readPromptLibrary() });
-    }
-    if (req.method === 'GET' && url.pathname === '/api/cpa-quota') {
-      return sendJson(res, cpaQuotaMonitor.getPublicState());
-    }
-    if (req.method === 'GET' && url.pathname === '/api/memory') {
-      return sendJson(res, memoryMonitor.getPublicState());
-    }
-    if (req.method === 'POST' && url.pathname === '/api/cpa-config') {
-      const body = await readJsonBody(req);
-      const current = cpaQuotaMonitor.getPublicState();
-      const password = body?.preservePassword && current.config.hasPassword
-        ? undefined
-        : String(body?.password || '');
-      return sendJson(res, { ok: true, ...(await cpaQuotaMonitor.updateConfig({
-        url: body?.url,
-        password,
-        preservePassword: body?.preservePassword,
-      })) });
-    }
-    if (req.method === 'POST' && url.pathname === '/api/prompt-library') {
-      const body = await readJsonBody(req);
-      const item = normalizePromptItem(body?.item);
-      if (!item) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'invalid prompt item' }, 400);
-      const items = await readPromptLibrary();
-      const index = items.findIndex((entry) => entry.id === item.id);
-      if (index >= 0) items.splice(index, 1, item);
-      else items.unshift(item);
-      await writePromptLibrary(items);
-      return sendJson(res, { ok: true, item, items });
-    }
-    if (req.method === 'POST' && url.pathname === '/api/prompt-library/delete') {
-      const body = await readJsonBody(req);
-      const id = String(body?.id || '').trim();
-      if (!id) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'missing prompt id' }, 400);
-      const items = await readPromptLibrary();
-      const nextItems = items.filter((entry) => entry.id !== id);
-      await writePromptLibrary(nextItems);
-      return sendJson(res, { ok: true, items: nextItems });
-    }
-    if (req.method === 'POST' && url.pathname === '/api/prompt-library/reorder') {
-      const body = await readJsonBody(req);
-      const ids = Array.isArray(body?.ids) ? body.ids.map((id) => String(id || '').trim()).filter(Boolean) : [];
-      if (!ids.length || new Set(ids).size !== ids.length) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'invalid prompt order' }, 400);
-      const items = await readPromptLibrary();
-      const byId = new Map(items.map((item) => [item.id, item]));
-      if (ids.some((id) => !byId.has(id))) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'prompt order contains unknown id' }, 400);
-      const ordered = ids.map((id) => byId.get(id));
-      const included = new Set(ids);
-      ordered.push(...items.filter((item) => !included.has(item.id)));
-      await writePromptLibrary(ordered);
-      return sendJson(res, { ok: true, items: ordered });
-    }
-    if (req.method === 'GET' && url.pathname.startsWith('/api/uploads/')) {
-      const storedName = decodeURIComponent(url.pathname.slice('/api/uploads/'.length));
-      return serveUploadedFile(res, storedName);
-    }
-    if (req.method === 'GET' && url.pathname.startsWith('/api/local-images/')) {
-      const encodedPath = decodeURIComponent(url.pathname.slice('/api/local-images/'.length));
-      return serveLocalImage(res, encodedPath);
-    }
-    if (req.method === 'POST' && url.pathname === '/api/uploads') {
-      const body = await readJsonBody(req);
-      const file = await storeUploadedFile(body);
-      return sendJson(res, { ok: true, file });
-    }
-    if (shouldProxy(url.pathname)) {
-      return proxy(req, res);
-    }
-    return serveStatic(res, url);
-  } catch (error) {
-    sendJson(res, { errorCode: 'WEB_REQUEST_FAILED', error: error instanceof Error ? error.message : String(error) }, 500);
-  }
-}
-
-async function proxy(req, res) {
-  const target = new URL(req.url || '/', runtimeTarget);
-  target.protocol = runtimeTarget.protocol;
-  target.hostname = runtimeTarget.hostname;
-  target.port = runtimeTarget.port;
-
-  const method = req.method || 'GET';
-  const requestBody = method === 'GET' || method === 'HEAD' ? undefined : await readRequestBody(req);
-  const requestHeaders = new Headers();
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value === undefined) continue;
-    if (['host', 'content-length', 'connection', 'expect'].includes(key.toLowerCase())) continue;
-    requestHeaders.set(key, Array.isArray(value) ? value.join(', ') : value);
-  }
-
-  let upstream;
-  try {
-    upstream = await fetch(target, {
-      method,
-      headers: requestHeaders,
-      body: requestBody,
-    });
-
-    const responseHeaders = {};
-    for (const [key, value] of upstream.headers.entries()) {
-      if (['connection', 'content-length', 'transfer-encoding'].includes(key.toLowerCase())) continue;
-      responseHeaders[key] = value;
-    }
-    res.writeHead(upstream.status, responseHeaders);
-    if (!upstream.body) {
-      res.end();
-      return;
-    }
-
-    res.on('close', () => {
-      upstream.body?.cancel().catch(() => {});
-    });
-
-    for await (const chunk of upstream.body) {
-      if (res.destroyed) break;
-      if (!res.write(chunk) && !await waitForDrainOrClose(res)) break;
-    }
-    if (!res.writableEnded) res.end();
-  } catch (error) {
-    const isTerminatedSocket =
-      error?.name === 'TypeError' &&
-      error?.message === 'terminated' &&
-      error?.cause?.code === 'UND_ERR_SOCKET';
-    if (error?.name === 'AbortError' || isTerminatedSocket || res.destroyed) return;
-    throw error;
-  }
-}
-
-function waitForDrainOrClose(res) {
-  if (res.destroyed) return Promise.resolve(false);
-  return new Promise((resolve) => {
-    const cleanup = () => {
-      res.off('drain', onDrain);
-      res.off('close', onClose);
-      res.off('error', onClose);
-    };
-    const onDrain = () => {
-      cleanup();
-      resolve(true);
-    };
-    const onClose = () => {
-      cleanup();
-      resolve(false);
-    };
-    res.once('drain', onDrain);
-    res.once('close', onClose);
-    res.once('error', onClose);
-  });
-}
-
-async function serveStatic(res, url) {
-  let pathname = decodeURIComponent(url.pathname);
-  if (pathname === '/') pathname = '/index.html';
-  let filePath = path.resolve(root, `.${pathname}`);
-  if (!filePath.startsWith(root + path.sep) && filePath !== root) {
-    res.writeHead(403);
-    res.end('forbidden');
-    return;
-  }
-  try {
-    const stat = await fsp.stat(filePath);
-    if (stat.isDirectory()) filePath = path.join(filePath, 'index.html');
-  } catch {
-    filePath = path.join(root, 'index.html');
-  }
-
-  try {
-    const body = await fsp.readFile(filePath);
-    const ext = path.extname(filePath).toLowerCase();
-    const cache = filePath.includes(`${path.sep}assets${path.sep}`) ? 'public, max-age=31536000, immutable' : 'no-store';
-    res.writeHead(200, { 'Content-Type': mime[ext] || 'application/octet-stream', 'Cache-Control': cache });
-    res.end(body);
-  } catch {
-    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
-    res.end('not found');
-  }
-}
-
-async function readPromptLibrary() {
-  try {
-    const raw = await fsp.readFile(promptLibraryFile, 'utf8');
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) throw new Error('prompt library file must contain an array');
-    return parsed.map(normalizePromptItem).filter(Boolean);
-  } catch (error) {
-    if (error?.code !== 'ENOENT') throw error;
-    const items = DEFAULT_APP_PROMPT_LIBRARY.map(clonePromptItem);
-    await writePromptLibrary(items);
-    return items;
-  }
-}
-
-async function writePromptLibrary(items) {
-  await fsp.mkdir(path.dirname(promptLibraryFile), { recursive: true });
-  await fsp.writeFile(promptLibraryFile, `${JSON.stringify(items, null, 2)}\n`, 'utf8');
-}
-
-function normalizePromptItem(item) {
-  if (!item || typeof item !== 'object') return null;
-  const title = String(item.title || '').trim();
-  const content = String(item.content || '').trim();
-  if (!title || !content) return null;
-  return {
-    id: String(item.id || createPromptId()).trim(),
-    title,
-    content,
-    usage: String(item.usage || '').trim(),
-  };
-}
-
-function clonePromptItem(item) {
-  return { ...item };
-}
-
-function createPromptId() {
-  return `prompt-${Math.random().toString(36).slice(2, 10)}`;
-}
-
-async function storeUploadedFile(payload) {
-  const name = sanitizeUploadName(payload?.name);
-  if (!name) throw new Error('invalid upload name');
-  const data = String(payload?.data || '').trim();
-  if (!data) throw new Error('missing upload data');
-  const buffer = Buffer.from(data, 'base64');
-  if (!buffer.length) throw new Error('empty upload data');
-  if (buffer.length > maxUploadBytes) throw new Error(`upload too large: max ${maxUploadBytes} bytes`);
-  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-  const random = Math.random().toString(36).slice(2, 8);
-  const storedName = `${stamp}-${random}-${name}`;
-  await fsp.mkdir(uploadsDir, { recursive: true });
-  const absolutePath = path.join(uploadsDir, storedName);
-  await fsp.writeFile(absolutePath, buffer);
-  return {
-    id: `upload-${random}`,
-    name,
-    storedName,
-    size: buffer.length,
-    mimeType: normalizeMimeType(payload?.mimeType),
-    absolutePath,
-    relativePath: path.relative(__dirname, absolutePath) || storedName,
-    url: `/api/uploads/${encodeURIComponent(storedName)}`,
-  };
-}
-
-async function serveUploadedFile(res, storedName) {
-  const safeName = path.basename(String(storedName || '').trim());
-  if (!safeName || safeName !== storedName) {
-    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
-    res.end('invalid upload name');
-    return;
-  }
-  const uploadRoot = path.resolve(uploadsDir);
-  const filePath = path.resolve(uploadRoot, safeName);
-  if (!filePath.startsWith(uploadRoot + path.sep)) {
-    res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
-    res.end('forbidden');
-    return;
-  }
-  try {
-    const body = await fsp.readFile(filePath);
-    res.writeHead(200, {
-      'Content-Type': mime[path.extname(filePath).toLowerCase()] || 'application/octet-stream',
-      'Cache-Control': 'public, max-age=31536000, immutable',
-    });
-    res.end(body);
-  } catch {
-    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
-    res.end('not found');
-  }
-}
-
-async function serveLocalImage(res, encodedPath) {
-  let filePath = '';
-  try {
-    filePath = Buffer.from(encodedPath, 'base64url').toString('utf8');
-  } catch {
-    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
-    res.end('invalid image path');
-    return;
-  }
-  const absolutePath = path.resolve(filePath);
-  const contentType = mime[path.extname(absolutePath).toLowerCase()] || 'application/octet-stream';
-  if (!contentType.startsWith('image/')) {
-    res.writeHead(415, { 'Content-Type': 'text/plain; charset=utf-8' });
-    res.end('not an image');
-    return;
-  }
-  try {
-    const fileStat = await fsp.stat(absolutePath);
-    if (!fileStat.isFile()) throw new Error('not a file');
-    res.writeHead(200, {
-      'Content-Type': contentType,
-      'Content-Length': String(fileStat.size),
-      'Cache-Control': 'no-store',
-    });
-    fs.createReadStream(absolutePath)
-      .on('error', () => res.destroy())
-      .pipe(res);
-  } catch {
-    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
-    res.end('not found');
-  }
-}
-
-function sanitizeUploadName(value) {
-  const base = path.basename(String(value || '').trim()).replace(/[<>:"/\\|?*\u0000-\u001f]+/g, '-');
-  return base.replace(/\s+/g, ' ').trim().slice(0, 180);
-}
-
-function normalizeMimeType(value) {
-  const mimeType = String(value || '').trim();
-  return mimeType || 'application/octet-stream';
-}
-
-async function readJsonBody(req) {
-  const body = await readRequestBody(req);
-  if (!body.length) return {};
-  return JSON.parse(body.toString('utf8'));
-}
-
-async function readRequestBody(req) {
-  const chunks = [];
-  for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-  return Buffer.concat(chunks);
-}
-
-function sendJson(res, value, status = 200) {
-  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
-  res.end(JSON.stringify(value));
-}
+    },
+  });
+}
+
+async function routeRequest(req, res) {
+  const url = new URL(req.url || '/', 'http://localhost');
+  try {
+    if (await pluginHost.route(req, res, url, { readJsonBody, sendJson })) return;
+    if (req.method === 'GET' && url.pathname === '/api/prompt-library') {
+      return sendJson(res, { items: await readPromptLibrary() });
+    }
+    if (req.method === 'GET' && url.pathname === '/api/cpa-quota') {
+      return sendJson(res, cpaQuotaMonitor.getPublicState());
+    }
+    if (req.method === 'GET' && url.pathname === '/api/memory') {
+      return sendJson(res, memoryMonitor.getPublicState());
+    }
+    if (req.method === 'POST' && url.pathname === '/api/cpa-config') {
+      const body = await readJsonBody(req);
+      const current = cpaQuotaMonitor.getPublicState();
+      const password = body?.preservePassword && current.config.hasPassword
+        ? undefined
+        : String(body?.password || '');
+      return sendJson(res, { ok: true, ...(await cpaQuotaMonitor.updateConfig({
+        url: body?.url,
+        password,
+        preservePassword: body?.preservePassword,
+      })) });
+    }
+    if (req.method === 'POST' && url.pathname === '/api/prompt-library') {
+      const body = await readJsonBody(req);
+      const item = normalizePromptItem(body?.item);
+      if (!item) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'invalid prompt item' }, 400);
+      const items = await readPromptLibrary();
+      const index = items.findIndex((entry) => entry.id === item.id);
+      if (index >= 0) items.splice(index, 1, item);
+      else items.unshift(item);
+      await writePromptLibrary(items);
+      return sendJson(res, { ok: true, item, items });
+    }
+    if (req.method === 'POST' && url.pathname === '/api/prompt-library/delete') {
+      const body = await readJsonBody(req);
+      const id = String(body?.id || '').trim();
+      if (!id) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'missing prompt id' }, 400);
+      const items = await readPromptLibrary();
+      const nextItems = items.filter((entry) => entry.id !== id);
+      await writePromptLibrary(nextItems);
+      return sendJson(res, { ok: true, items: nextItems });
+    }
+    if (req.method === 'POST' && url.pathname === '/api/prompt-library/reorder') {
+      const body = await readJsonBody(req);
+      const ids = Array.isArray(body?.ids) ? body.ids.map((id) => String(id || '').trim()).filter(Boolean) : [];
+      if (!ids.length || new Set(ids).size !== ids.length) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'invalid prompt order' }, 400);
+      const items = await readPromptLibrary();
+      const byId = new Map(items.map((item) => [item.id, item]));
+      if (ids.some((id) => !byId.has(id))) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'prompt order contains unknown id' }, 400);
+      const ordered = ids.map((id) => byId.get(id));
+      const included = new Set(ids);
+      ordered.push(...items.filter((item) => !included.has(item.id)));
+      await writePromptLibrary(ordered);
+      return sendJson(res, { ok: true, items: ordered });
+    }
+    if (req.method === 'GET' && url.pathname.startsWith('/api/uploads/')) {
+      const storedName = decodeURIComponent(url.pathname.slice('/api/uploads/'.length));
+      return serveUploadedFile(res, storedName);
+    }
+    if (req.method === 'GET' && url.pathname.startsWith('/api/local-images/')) {
+      const encodedPath = decodeURIComponent(url.pathname.slice('/api/local-images/'.length));
+      return serveLocalImage(res, encodedPath);
+    }
+    if (req.method === 'POST' && url.pathname === '/api/uploads') {
+      const body = await readJsonBody(req);
+      const file = await storeUploadedFile(body);
+      return sendJson(res, { ok: true, file });
+    }
+    if (shouldProxy(url.pathname)) {
+      return proxy(req, res);
+    }
+    return serveStatic(res, url);
+  } catch (error) {
+    sendJson(res, { errorCode: 'WEB_REQUEST_FAILED', error: error instanceof Error ? error.message : String(error) }, 500);
+  }
+}
+
+async function proxy(req, res) {
+  const target = new URL(req.url || '/', runtimeTarget);
+  target.protocol = runtimeTarget.protocol;
+  target.hostname = runtimeTarget.hostname;
+  target.port = runtimeTarget.port;
+
+  const method = req.method || 'GET';
+  const requestBody = method === 'GET' || method === 'HEAD' ? undefined : await readRequestBody(req);
+  const requestHeaders = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === undefined) continue;
+    if (['host', 'content-length', 'connection', 'expect'].includes(key.toLowerCase())) continue;
+    requestHeaders.set(key, Array.isArray(value) ? value.join(', ') : value);
+  }
+
+  let upstream;
+  try {
+    upstream = await fetch(target, {
+      method,
+      headers: requestHeaders,
+      body: requestBody,
+    });
+
+    const responseHeaders = {};
+    for (const [key, value] of upstream.headers.entries()) {
+      if (['connection', 'content-length', 'transfer-encoding'].includes(key.toLowerCase())) continue;
+      responseHeaders[key] = value;
+    }
+    res.writeHead(upstream.status, responseHeaders);
+    if (!upstream.body) {
+      res.end();
+      return;
+    }
+
+    res.on('close', () => {
+      upstream.body?.cancel().catch(() => {});
+    });
+
+    for await (const chunk of upstream.body) {
+      if (res.destroyed) break;
+      if (!res.write(chunk) && !await waitForDrainOrClose(res)) break;
+    }
+    if (!res.writableEnded) res.end();
+  } catch (error) {
+    const isTerminatedSocket =
+      error?.name === 'TypeError' &&
+      error?.message === 'terminated' &&
+      error?.cause?.code === 'UND_ERR_SOCKET';
+    if (error?.name === 'AbortError' || isTerminatedSocket || res.destroyed) return;
+    throw error;
+  }
+}
+
+function waitForDrainOrClose(res) {
+  if (res.destroyed) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      res.off('drain', onDrain);
+      res.off('close', onClose);
+      res.off('error', onClose);
+    };
+    const onDrain = () => {
+      cleanup();
+      resolve(true);
+    };
+    const onClose = () => {
+      cleanup();
+      resolve(false);
+    };
+    res.once('drain', onDrain);
+    res.once('close', onClose);
+    res.once('error', onClose);
+  });
+}
+
+async function serveStatic(res, url) {
+  let pathname = decodeURIComponent(url.pathname);
+  if (pathname === '/') pathname = '/index.html';
+  let filePath = path.resolve(root, `.${pathname}`);
+  if (!filePath.startsWith(root + path.sep) && filePath !== root) {
+    res.writeHead(403);
+    res.end('forbidden');
+    return;
+  }
+  try {
+    const stat = await fsp.stat(filePath);
+    if (stat.isDirectory()) filePath = path.join(filePath, 'index.html');
+  } catch {
+    filePath = path.join(root, 'index.html');
+  }
+
+  try {
+    const body = await fsp.readFile(filePath);
+    const ext = path.extname(filePath).toLowerCase();
+    const cache = filePath.includes(`${path.sep}assets${path.sep}`) ? 'public, max-age=31536000, immutable' : 'no-store';
+    res.writeHead(200, { 'Content-Type': mime[ext] || 'application/octet-stream', 'Cache-Control': cache });
+    res.end(body);
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  }
+}
+
+async function readPromptLibrary() {
+  try {
+    const raw = await fsp.readFile(promptLibraryFile, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) throw new Error('prompt library file must contain an array');
+    return parsed.map(normalizePromptItem).filter(Boolean);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    const items = DEFAULT_APP_PROMPT_LIBRARY.map(clonePromptItem);
+    await writePromptLibrary(items);
+    return items;
+  }
+}
+
+async function writePromptLibrary(items) {
+  await fsp.mkdir(path.dirname(promptLibraryFile), { recursive: true });
+  await fsp.writeFile(promptLibraryFile, `${JSON.stringify(items, null, 2)}\n`, 'utf8');
+}
+
+function normalizePromptItem(item) {
+  if (!item || typeof item !== 'object') return null;
+  const title = String(item.title || '').trim();
+  const content = String(item.content || '').trim();
+  if (!title || !content) return null;
+  return {
+    id: String(item.id || createPromptId()).trim(),
+    title,
+    content,
+    usage: String(item.usage || '').trim(),
+  };
+}
+
+function clonePromptItem(item) {
+  return { ...item };
+}
+
+function createPromptId() {
+  return `prompt-${Math.random().toString(36).slice(2, 10)}`;
+}
+
+async function storeUploadedFile(payload) {
+  const name = sanitizeUploadName(payload?.name);
+  if (!name) throw new Error('invalid upload name');
+  const data = String(payload?.data || '').trim();
+  if (!data) throw new Error('missing upload data');
+  const buffer = Buffer.from(data, 'base64');
+  if (!buffer.length) throw new Error('empty upload data');
+  if (buffer.length > maxUploadBytes) throw new Error(`upload too large: max ${maxUploadBytes} bytes`);
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const random = Math.random().toString(36).slice(2, 8);
+  const storedName = `${stamp}-${random}-${name}`;
+  await fsp.mkdir(uploadsDir, { recursive: true });
+  const absolutePath = path.join(uploadsDir, storedName);
+  await fsp.writeFile(absolutePath, buffer);
+  return {
+    id: `upload-${random}`,
+    name,
+    storedName,
+    size: buffer.length,
+    mimeType: normalizeMimeType(payload?.mimeType),
+    absolutePath,
+    relativePath: path.relative(__dirname, absolutePath) || storedName,
+    url: `/api/uploads/${encodeURIComponent(storedName)}`,
+  };
+}
+
+async function serveUploadedFile(res, storedName) {
+  const safeName = path.basename(String(storedName || '').trim());
+  if (!safeName || safeName !== storedName) {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('invalid upload name');
+    return;
+  }
+  const uploadRoot = path.resolve(uploadsDir);
+  const filePath = path.resolve(uploadRoot, safeName);
+  if (!filePath.startsWith(uploadRoot + path.sep)) {
+    res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('forbidden');
+    return;
+  }
+  try {
+    const body = await fsp.readFile(filePath);
+    res.writeHead(200, {
+      'Content-Type': mime[path.extname(filePath).toLowerCase()] || 'application/octet-stream',
+      'Cache-Control': 'public, max-age=31536000, immutable',
+    });
+    res.end(body);
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  }
+}
+
+async function serveLocalImage(res, encodedPath) {
+  let filePath = '';
+  try {
+    filePath = Buffer.from(encodedPath, 'base64url').toString('utf8');
+  } catch {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('invalid image path');
+    return;
+  }
+  const absolutePath = path.resolve(filePath);
+  const contentType = mime[path.extname(absolutePath).toLowerCase()] || 'application/octet-stream';
+  if (!contentType.startsWith('image/')) {
+    res.writeHead(415, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not an image');
+    return;
+  }
+  try {
+    const fileStat = await fsp.stat(absolutePath);
+    if (!fileStat.isFile()) throw new Error('not a file');
+    res.writeHead(200, {
+      'Content-Type': contentType,
+      'Content-Length': String(fileStat.size),
+      'Cache-Control': 'no-store',
+    });
+    fs.createReadStream(absolutePath)
+      .on('error', () => res.destroy())
+      .pipe(res);
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  }
+}
+
+function sanitizeUploadName(value) {
+  const base = path.basename(String(value || '').trim()).replace(/[<>:"/\\|?*\u0000-\u001f]+/g, '-');
+  return base.replace(/\s+/g, ' ').trim().slice(0, 180);
+}
+
+function normalizeMimeType(value) {
+  const mimeType = String(value || '').trim();
+  return mimeType || 'application/octet-stream';
+}
+
+async function readJsonBody(req) {
+  const body = await readRequestBody(req);
+  if (!body.length) return {};
+  return JSON.parse(body.toString('utf8'));
+}
+
+async function readRequestBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}
+
+function sendJson(res, value, status = 200) {
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
+  res.end(JSON.stringify(value));
+}