pmx-canvas 0.2.7 → 0.3.1

package/src/server/server.ts

@@ -40,50 +40,27 @@ import { existsSync, readFileSync, statSync, writeFileSync, appendFileSync } fro
 import { readFile } from 'node:fs/promises';
 import { basename, extname, join, relative, resolve } from 'node:path';
 import * as marked from 'marked';
-import type {
-  CallToolResult,
-  ListPromptsResult,
-  ListResourcesResult,
-  ListResourceTemplatesResult,
-  ListToolsResult,
-} from '@modelcontextprotocol/sdk/types.js';
-import { type CanvasAnnotation, type CanvasLayout, type CanvasNodeState, IMAGE_MIME_MAP, canvasState } from './canvas-state.js';
-import { buildAxBridge, buildAxStateBridge, buildContentHeightReporter, buildHtmlSurfaceDocument, HTML_SURFACE_SANDBOX, normalizeSurfaceTheme } from './html-surface.js';
+import { type CanvasNodeState, IMAGE_MIME_MAP, canvasState } from './canvas-state.js';
+import {
+  buildAxBridge,
+  buildAxStateBridge,
+  buildContentHeightReporter,
+  buildHtmlSurfaceDocument,
+  HTML_SURFACE_SANDBOX,
+  normalizeSurfaceTheme,
+} from './html-surface.js';
 import { findCanvasExtAppNodeId as findCanvasExtAppNodeIdShared } from './ext-app-lookup.js';
 import { normalizeExtAppToolResult } from './ext-app-tool-result.js';
 import { getMcpAppHostSnapshot } from './mcp-app-host.js';
-import {
-  callMcpAppTool,
-  closeMcpAppSession,
-  closeAllMcpAppSessions,
-  listMcpAppPrompts,
-  listMcpAppResources,
-  listMcpAppResourceTemplates,
-  listMcpAppTools,
-  readMcpAppResource,
-} from './mcp-app-runtime.js';
-import { findOpenCanvasPosition, computeGroupBounds } from './placement.js';
+import { closeMcpAppSession, closeAllMcpAppSessions } from './mcp-app-runtime.js';
+import { findOpenCanvasPosition } from './placement.js';
 import { mutationHistory } from './mutation-history.js';
-import { summarizeCanvasAnnotation } from './canvas-serialization.js';
-import { buildCodeGraphSummary, formatCodeGraph } from './code-graph.js';
-import { buildAgentContextPreamble, serializeNodeForAgentContext } from './agent-context.js';
-import { buildCanvasAxContext, buildCanvasAxSurfaceSnapshot } from './ax-context.js';
-import { applyAxInteraction, resolveNodeAxCapabilities } from './ax-interaction.js';
-import { isAxEvidenceKind, isAxActivityKind } from './ax-state.js';
-import type {
-  PmxAxEvidenceKind,
-  PmxAxPolicy,
-  PmxAxReviewAnchorType,
-  PmxAxReviewKind,
-  PmxAxReviewSeverity,
-  PmxAxSource,
-  PmxAxWorkItemStatus,
-} from './ax-state.js';
+import { buildAgentContextPreamble } from './agent-context.js';
+import { buildCanvasAxSurfaceSnapshot } from './ax-context.js';
+import { resolveNodeAxCapabilities } from './ax-interaction.js';
 import { normalizeCanvasTheme, type CanvasTheme } from './canvas-db.js';
 import { validateLocalImageFile } from './image-source.js';
 import {
-  applyCanvasNodeUpdates,
-  refreshCanvasWebpageNode,
   primeCanvasRuntimeBackends,
   setCanvasLayoutUpdateEmitter,
   syncCanvasRuntimeBackends,
@@ -91,26 +68,9 @@ import {
 import { dispatchOperationRoute, setOperationEventEmitter } from './operations/index.js';
 import { intentRegistry } from './intent-registry.js';
 import { setWebviewRunner } from './operations/webview-runner.js';
-import {
-  closeNodeAppSession,
-  nodeAppSessionId,
-} from './operations/ops/nodes.js';
-import {
-  EXCALIDRAW_READ_CHECKPOINT_TOOL,
-  EXCALIDRAW_SAVE_CHECKPOINT_TOOL,
-  buildExcalidrawCheckpointId,
-  buildExcalidrawRestoreCheckpointToolInput,
-  ensureExcalidrawCheckpointId,
-  getExcalidrawCheckpointIdFromToolResult,
-  isExcalidrawCreateView,
-} from './diagram-presets.js';
+import { closeNodeAppSession, nodeAppSessionId } from './operations/ops/nodes.js';
 import { traceManager } from './trace-manager.js';
-import {
-  buildJsonRenderViewerHtml,
-} from '../json-render/server.js';
-import {
-  normalizeWebpageUrl,
-} from './webpage-node.js';
+import { buildJsonRenderViewerHtml } from '../json-render/server.js';
 import type { JsonRenderSpec } from '../json-render/server.js';
 
 const DEFAULT_HOST = '127.0.0.1';
@@ -294,16 +254,15 @@ export interface CanvasAutomationWebViewStatus {
 }
 
 let canvasAutomationWebView: CanvasWebViewLike | null = null;
-let canvasAutomationWebViewStatus: Omit<CanvasAutomationWebViewStatus, 'supported' | 'active' | 'headlessOnly'> =
-  {
-    url: null,
-    backend: null,
-    width: null,
-    height: null,
-    dataStoreDir: null,
-    startedAt: null,
-    lastError: null,
-  };
+let canvasAutomationWebViewStatus: Omit<CanvasAutomationWebViewStatus, 'supported' | 'active' | 'headlessOnly'> = {
+  url: null,
+  backend: null,
+  width: null,
+  height: null,
+  dataStoreDir: null,
+  startedAt: null,
+  lastError: null,
+};
 let canvasAutomationWebViewQueue: Promise<void> = Promise.resolve();
 
 function sessionDiagLog(tag: string, payload: Record<string, unknown>): void {
@@ -407,9 +366,7 @@ function detectCanvasAutomationWebViewBackendKind(backend: CanvasWebViewBackend)
 
 function getCanvasAutomationWebViewTimeoutMs(): number {
   const raw = Number.parseInt(process.env.PMX_CANVAS_WEBVIEW_TIMEOUT_MS ?? '', 10);
-  return Number.isFinite(raw) && raw > 0
-    ? raw
-    : DEFAULT_CANVAS_AUTOMATION_WEBVIEW_TIMEOUT_MS;
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_CANVAS_AUTOMATION_WEBVIEW_TIMEOUT_MS;
 }
 
 async function withCanvasAutomationWebViewTimeout<T>(task: Promise<T>, action: string): Promise<T> {
@@ -457,7 +414,10 @@ async function closeCanvasAutomationWebViewInternal(): Promise<boolean> {
 
 function runCanvasAutomationWebViewTask<T>(task: () => Promise<T>): Promise<T> {
   const result = canvasAutomationWebViewQueue.then(task);
-  canvasAutomationWebViewQueue = result.then(() => undefined, () => undefined);
+  canvasAutomationWebViewQueue = result.then(
+    () => undefined,
+    () => undefined,
+  );
   return result;
 }
 
@@ -553,7 +513,8 @@ export async function evaluateCanvasAutomationWebView(expression: string): Promi
     withCanvasAutomationWebViewTimeout(
       requireActiveCanvasAutomationWebView().evaluate(expression),
       'evaluating JavaScript in the workbench automation WebView',
-    ));
+    ),
+  );
 }
 
 export function wrapCanvasAutomationScript(script: string): string {
@@ -580,9 +541,7 @@ export async function resizeCanvasAutomationWebView(
   });
 }
 
-export async function screenshotCanvasAutomationWebView(
-  options: Record<string, unknown> = {},
-): Promise<Uint8Array> {
+export async function screenshotCanvasAutomationWebView(options: Record<string, unknown> = {}): Promise<Uint8Array> {
   return runCanvasAutomationWebViewTask(async () => {
     const result = await withCanvasAutomationWebViewTimeout(
       requireActiveCanvasAutomationWebView().screenshot(options),
@@ -621,9 +580,7 @@ export interface PrimaryWorkbenchCanvasPromptRequest {
   contextNodeIds: string[];
 }
 
-type PrimaryWorkbenchCanvasPromptHandler = (
-  request: PrimaryWorkbenchCanvasPromptRequest,
-) => Promise<void>;
+type PrimaryWorkbenchCanvasPromptHandler = (request: PrimaryWorkbenchCanvasPromptRequest) => Promise<void>;
 
 let primaryWorkbenchCanvasPromptHandler: PrimaryWorkbenchCanvasPromptHandler | null = null;
 
@@ -698,98 +655,6 @@ function findCanvasExtAppNodeId(toolCallId: string): string | null {
   });
 }
 
-function isCheckpointToolName(toolName: string): boolean {
-  return toolName === EXCALIDRAW_SAVE_CHECKPOINT_TOOL || toolName === EXCALIDRAW_READ_CHECKPOINT_TOOL;
-}
-
-/**
- * Decide whether a fresh `callServerTool` result should *replace* the
- * canvas node's bootstrap-replay `toolResult`.
- *
- * The bootstrap-replay toolResult is what the server re-sends to the
- * widget on reload to restore visible state. We only want to overwrite
- * it when the new result genuinely carries widget state — `isError` or
- * `structuredContent`. A plain-text result (e.g. `read_checkpoint`
- * returning a string status, or any informational message) updates
- * `appModelContext` for the agent's record but should *not* clobber the
- * bootstrap entry, because doing so would replace the widget's restored
- * state with conversational noise on the next reload.
- *
- * This separation is exercised by:
- *   - tests/unit/server-api.test.ts "keeps ext-app model context
- *     separate from the replayed tool result" (text-only result preserves
- *     bootstrap replay)
- *   - tests/unit/server-api.test.ts "app-only text tool results update
- *     model context without replacing bootstrap replay"
- *   - tests/unit/server-api.test.ts "rehydrates Excalidraw checkpoint
- *     replay after server restart" (structured-content result becomes
- *     the new bootstrap replay)
- */
-function shouldReplayAppToolResult(toolName: string, result: CallToolResult): boolean {
-  void toolName;
-  return Boolean(result.isError || result.structuredContent);
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-
-function getExtAppNodeCheckpointId(node: CanvasNodeState): string {
-  const appCheckpoint = isRecord(node.data.appCheckpoint) ? node.data.appCheckpoint : null;
-  const storedCheckpointId = appCheckpoint?.id;
-  if (typeof storedCheckpointId === 'string' && storedCheckpointId.trim().length > 0) {
-    return storedCheckpointId.trim();
-  }
-  return getExcalidrawCheckpointIdFromToolResult(node.data.toolResult) ?? buildExcalidrawCheckpointId(node.id);
-}
-
-function getLocalExcalidrawCheckpointData(
-  node: CanvasNodeState,
-  args: Record<string, unknown> | undefined,
-): string | null {
-  if (!isExcalidrawCreateView(node.data.serverName, node.data.toolName)) return null;
-  if (!isRecord(args) || typeof args.id !== 'string') return null;
-  if (args.id.trim() !== getExtAppNodeCheckpointId(node)) return null;
-  const appCheckpoint = isRecord(node.data.appCheckpoint) ? node.data.appCheckpoint : null;
-  const data = appCheckpoint?.data;
-  return typeof data === 'string' ? data : '';
-}
-
-function persistExcalidrawCheckpointToNode(
-  nodeId: string,
-  node: CanvasNodeState,
-  args: Record<string, unknown> | undefined,
-): boolean {
-  if (!isExcalidrawCreateView(node.data.serverName, node.data.toolName)) return false;
-  if (!isRecord(args) || typeof args.id !== 'string') return false;
-  const checkpointId = getExtAppNodeCheckpointId(node);
-  if (args.id.trim() !== checkpointId) return false;
-
-  const currentToolInput = isRecord(node.data.toolInput) ? node.data.toolInput : {};
-  const nextToolInput = {
-    ...currentToolInput,
-    elements: buildExcalidrawRestoreCheckpointToolInput(checkpointId, args.data),
-  };
-  const currentToolResult = isRecord(node.data.toolResult)
-    ? ensureExcalidrawCheckpointId(node.data.toolResult as CallToolResult, node.id, checkpointId)
-    : undefined;
-
-  canvasState.updateNode(nodeId, {
-    data: {
-      ...node.data,
-      toolInput: nextToolInput,
-      ...(currentToolResult ? { toolResult: currentToolResult } : {}),
-      appCheckpoint: {
-        toolName: EXCALIDRAW_SAVE_CHECKPOINT_TOOL,
-        id: checkpointId,
-        ...(typeof args.data === 'string' ? { data: args.data } : {}),
-        updatedAt: new Date().toISOString(),
-      },
-    },
-  });
-  return true;
-}
-
 function findReusableCanvasExtAppNodeId(serverName: string, toolName: string): string | null {
   for (const node of canvasState.getLayout().nodes) {
     if (
@@ -831,9 +696,7 @@ function extAppEventGeometryPatch(
   const width = typeof payload.width === 'number' ? payload.width : undefined;
   const height = typeof payload.height === 'number' ? payload.height : undefined;
   return {
-    ...(x !== undefined || y !== undefined
-      ? { position: { x: x ?? node.position.x, y: y ?? node.position.y } }
-      : {}),
+    ...(x !== undefined || y !== undefined ? { position: { x: x ?? node.position.x, y: y ?? node.position.y } } : {}),
     ...(width !== undefined || height !== undefined
       ? { size: { width: width ?? node.size.width, height: height ?? node.size.height } }
       : {}),
@@ -888,9 +751,7 @@ export function hasWorkbenchSubscribers(): boolean {
   return workbenchSubscribers.size > 0;
 }
 
-export function setPrimaryWorkbenchCanvasPromptHandler(
-  handler: PrimaryWorkbenchCanvasPromptHandler | null,
-): void {
+export function setPrimaryWorkbenchCanvasPromptHandler(handler: PrimaryWorkbenchCanvasPromptHandler | null): void {
   primaryWorkbenchCanvasPromptHandler = handler;
 }
 
@@ -906,10 +767,7 @@ function enqueuePrimaryWorkbenchIntent(
   };
   pendingWorkbenchIntents.push(intent);
   if (pendingWorkbenchIntents.length > MAX_PENDING_WORKBENCH_INTENTS) {
-    pendingWorkbenchIntents.splice(
-      0,
-      pendingWorkbenchIntents.length - MAX_PENDING_WORKBENCH_INTENTS,
-    );
+    pendingWorkbenchIntents.splice(0, pendingWorkbenchIntents.length - MAX_PENDING_WORKBENCH_INTENTS);
   }
   broadcastWorkbenchEvent('workbench-intent', { ...intent });
   return intent;
@@ -920,7 +778,8 @@ function rotatePrimaryWorkbenchSessionIfNeeded(): void {
   primaryWorkbenchSessionId = `pmx-${Date.now().toString(36)}`;
 }
 
-async function readJson(req: Request): Promise<Record<string, unknown>> {
+/** Null means a non-empty body failed to parse — handlers must 400, not silently no-op. */
+async function readJson(req: Request): Promise<Record<string, unknown> | null> {
   let text = '';
   try {
     text = await req.text();
@@ -937,17 +796,12 @@ async function readJson(req: Request): Promise<Record<string, unknown>> {
     return value as Record<string, unknown>;
   } catch (error) {
     logWorkbenchWarning('readJson', error);
-    return {};
+    return null;
   }
 }
 
-function htmlEscape(value: string): string {
-  return value
-    .replaceAll('&', '&amp;')
-    .replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;')
-    .replaceAll('"', '&quot;')
-    .replaceAll("'", '&#39;');
+function malformedJsonResponse(): Response {
+  return responseJson({ ok: false, error: 'Malformed JSON body.' }, 400);
 }
 
 function toPreferredExcalidrawUrl(raw: string): string {
@@ -977,18 +831,13 @@ function isExcalidrawUrl(url: string): boolean {
 }
 
 function normalizeMarkdownExternalUrls(markdown: string): string {
-  const normalizedLinks = markdown.replace(/https?:\/\/[^\s<>"'`)\]]+/gi, (url) =>
-    toPreferredExcalidrawUrl(url),
-  );
-  return normalizedLinks.replace(
-    /!\[([^\]]*)\]\((https?:\/\/[^)\s]+)\)/gi,
-    (full, altRaw: string, urlRaw: string) => {
-      const url = toPreferredExcalidrawUrl(urlRaw);
-      if (!isExcalidrawUrl(url)) return full;
-      const label = (altRaw || 'Open Excalidraw diagram').trim() || 'Open Excalidraw diagram';
-      return `> Excalidraw diagram: [${label}](${url})`;
-    },
-  );
+  const normalizedLinks = markdown.replace(/https?:\/\/[^\s<>"'`)\]]+/gi, (url) => toPreferredExcalidrawUrl(url));
+  return normalizedLinks.replace(/!\[([^\]]*)\]\((https?:\/\/[^)\s]+)\)/gi, (full, altRaw: string, urlRaw: string) => {
+    const url = toPreferredExcalidrawUrl(urlRaw);
+    if (!isExcalidrawUrl(url)) return full;
+    const label = (altRaw || 'Open Excalidraw diagram').trim() || 'Open Excalidraw diagram';
+    return `> Excalidraw diagram: [${label}](${url})`;
+  });
 }
 
 // ── Canvas SPA HTML ────────────────────────────────────────────
@@ -1228,6 +1077,7 @@ function addFrameDocument(html: string, sandbox: string): string {
 
 async function handleCreateFrameDocument(req: Request): Promise<Response> {
   const body = await readJson(req);
+  if (body === null) return malformedJsonResponse();
   const html = body.html;
   if (typeof html !== 'string' || !html) {
     return responseJson({ ok: false, error: 'Frame document requires non-empty html.' }, 400);
@@ -1302,18 +1152,17 @@ function handleNodeSurface(pathname: string, url: URL): Response {
   const theme = normalizeSurfaceTheme(url.searchParams.get('theme'));
 
   if (node.type === 'html') {
-    const html = typeof node.data.html === 'string'
-      ? node.data.html
-      : typeof node.data.content === 'string'
-        ? node.data.content
-        : '';
+    const html =
+      typeof node.data.html === 'string'
+        ? node.data.html
+        : typeof node.data.content === 'string'
+          ? node.data.content
+          : '';
     if (!html) return responseText('HTML node has no content', 404);
     const present = url.searchParams.get('present') === '1';
     const axCaps = resolveNodeAxCapabilities(node);
     const axEnabled = axCaps.enabled && axCaps.allowed.length > 0;
-    const surfaceTitle = typeof node.data.title === 'string' && node.data.title.trim()
-      ? node.data.title
-      : node.id;
+    const surfaceTitle = typeof node.data.title === 'string' && node.data.title.trim() ? node.data.title : node.id;
     const doc = buildHtmlSurfaceDocument(html, {
       theme,
       title: surfaceTitle,
@@ -1326,7 +1175,9 @@ function handleNodeSurface(pathname: string, url: URL): Response {
       // Seed the read-side bridge with the current AX state (only for AX surfaces).
       ...(axEnabled ? { axState: buildCanvasAxSurfaceSnapshot() } : {}),
       // Content-height reporter nonce (lets an html node grow to fit its content).
-      ...(url.searchParams.get('frameToken') ? { contentHeightToken: url.searchParams.get('frameToken') as string } : {}),
+      ...(url.searchParams.get('frameToken')
+        ? { contentHeightToken: url.searchParams.get('frameToken') as string }
+        : {}),
     });
     return surfaceHtmlResponse(doc, HTML_SURFACE_SANDBOX);
   }
@@ -1368,124 +1219,11 @@ function handleNodeSurface(pathname: string, url: URL): Response {
   return responseText('Node type cannot be opened as a site', 404);
 }
 
-async function handleCanvasUpdate(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const updates = Array.isArray(body.updates) ? body.updates : [];
-  const result = body.recordHistory === false
-    ? (() => {
-        let suppressedResult: ReturnType<typeof applyCanvasNodeUpdates> = { applied: 0, skipped: updates.length };
-        canvasState.withSuppressedRecording(() => {
-          suppressedResult = applyCanvasNodeUpdates(updates);
-        });
-        return suppressedResult;
-      })()
-    : applyCanvasNodeUpdates(updates);
-  if (result.applied > 0) {
-    emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  }
-  return responseJson({ ok: true, ...result });
-}
-
-async function handleCanvasViewport(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const next = {
-    x: typeof body.x === 'number' ? body.x : canvasState.viewport.x,
-    y: typeof body.y === 'number' ? body.y : canvasState.viewport.y,
-    scale: typeof body.scale === 'number' ? body.scale : canvasState.viewport.scale,
-  };
-  if (body.recordHistory === false) {
-    canvasState.withSuppressedRecording(() => {
-      canvasState.setViewport(next);
-    });
-  } else {
-    canvasState.setViewport(next);
-  }
-  emitPrimaryWorkbenchEvent('canvas-viewport-update', { viewport: canvasState.viewport });
-  return responseJson({ ok: true });
-}
-
-function annotationBounds(points: CanvasAnnotation['points']): CanvasAnnotation['bounds'] {
-  const xs = points.map((point) => point.x);
-  const ys = points.map((point) => point.y);
-  const minX = Math.min(...xs);
-  const minY = Math.min(...ys);
-  const maxX = Math.max(...xs);
-  const maxY = Math.max(...ys);
-  return { x: minX, y: minY, width: maxX - minX, height: maxY - minY };
-}
-
-function textAnnotationBounds(point: CanvasAnnotation['points'][number], text: string, width: number): CanvasAnnotation['bounds'] {
-  return {
-    x: point.x,
-    y: point.y - width,
-    width: Math.max(width, text.length * width * 0.62),
-    height: width * 1.2,
-  };
-}
-
-function parseAnnotationPoints(value: unknown): CanvasAnnotation['points'] {
-  if (!Array.isArray(value)) return [];
-  return value
-    .map((point) => {
-      if (!point || typeof point !== 'object' || Array.isArray(point)) return null;
-      const record = point as Record<string, unknown>;
-      if (typeof record.x !== 'number' || typeof record.y !== 'number') return null;
-      if (!Number.isFinite(record.x) || !Number.isFinite(record.y)) return null;
-      return { x: record.x, y: record.y };
-    })
-    .filter((point): point is CanvasAnnotation['points'][number] => point !== null);
-}
-
-async function handleCanvasAddAnnotation(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const type = body.type === 'text' ? 'text' : 'freehand';
-  const points = parseAnnotationPoints(body.points);
-  if (points.length < (type === 'text' ? 1 : 2)) {
-    return responseJson({ ok: false, error: type === 'text' ? 'Text annotation requires a valid point.' : 'Annotation requires at least two valid points.' }, 400);
-  }
-
-  const defaultWidth = type === 'text' ? 24 : 4;
-  const maxWidth = type === 'text' ? 96 : 24;
-  const width = typeof body.width === 'number' && Number.isFinite(body.width)
-    ? Math.min(maxWidth, Math.max(1, body.width))
-    : defaultWidth;
-  const color = typeof body.color === 'string' && (body.color === 'currentColor' || /^#[0-9a-fA-F]{6}$/.test(body.color))
-    ? body.color
-    : 'currentColor';
-  const label = typeof body.label === 'string' && body.label.trim().length > 0
-    ? body.label.trim().slice(0, 160)
-    : undefined;
-  const text = type === 'text' && typeof body.text === 'string' && body.text.trim().length > 0
-    ? body.text.trim().slice(0, 240)
-    : undefined;
-  if (type === 'text' && !text) {
-    return responseJson({ ok: false, error: 'Text annotation requires text.' }, 400);
-  }
-  const id = typeof body.id === 'string' && body.id.trim().length > 0
-    ? body.id.trim().slice(0, 120)
-    : `ann-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-  const annotation: CanvasAnnotation = {
-    id,
-    type,
-    points,
-    bounds: type === 'text' ? textAnnotationBounds(points[0]!, text!, width) : annotationBounds(points),
-    color,
-    width,
-    ...(text ? { text } : {}),
-    ...(label ?? text ? { label: label ?? text } : {}),
-    createdAt: new Date().toISOString(),
-  };
-
-  canvasState.addAnnotation(annotation);
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson({ ok: true, annotation: summarizeCanvasAnnotation(annotation) });
-}
-
 // ── Serve image file for image nodes ─────────────────────────
 async function handleCanvasImage(pathname: string): Promise<Response> {
   const nodeId = pathname.replace('/api/canvas/image/', '');
   const node = canvasState.getNode(nodeId);
-  if (!node || node.type !== 'image') {
+  if (node?.type !== 'image') {
     return responseText('Image node not found', 404);
   }
   const src = (node.data.path as string) || (node.data.src as string) || '';
@@ -1517,43 +1255,6 @@ async function handleCanvasImage(pathname: string): Promise<Response> {
   });
 }
 
-async function handleCanvasRefreshWebpageNode(nodeId: string, req: Request): Promise<Response> {
-  const existing = canvasState.getNode(nodeId);
-  if (!existing || existing.type !== 'webpage') {
-    return responseJson({ ok: false, error: `Webpage node "${nodeId}" not found.` }, 404);
-  }
-
-  const body = await readJson(req);
-  const rawUrl = typeof body.url === 'string' ? body.url : undefined;
-  let url: string | undefined;
-  if (rawUrl && rawUrl.trim().length > 0) {
-    try {
-      url = normalizeWebpageUrl(rawUrl);
-    } catch (error) {
-      return responseJson({ ok: false, error: error instanceof Error ? error.message : 'Invalid webpage URL.' }, 400);
-    }
-  }
-
-  const result = await refreshCanvasWebpageNode(nodeId, { ...(url ? { url } : {}) });
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson(result, result.ok ? 200 : 400);
-}
-
-// handleCanvasBuildWebArtifact migrated to the operation registry
-// (plan-008 Wave 4): src/server/operations/ops/app.ts (webartifact.build).
-
-async function handleCanvasThemeUpdate(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const theme = normalizeCanvasTheme(body.theme, canvasState.theme);
-  const next = canvasState.setTheme(theme);
-  broadcastWorkbenchEvent('theme-changed', {
-    theme: next,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, theme: next });
-}
-
 async function handleJsonRenderView(url: URL): Promise<Response> {
   const nodeId = url.searchParams.get('nodeId') ?? '';
   if (!nodeId) return responseText('Missing nodeId', 400);
@@ -1574,22 +1275,18 @@ async function handleJsonRenderView(url: URL): Promise<Response> {
 
   const themeValue = url.searchParams.get('theme');
   const theme =
-    themeValue === 'dark' || themeValue === 'light' || themeValue === 'high-contrast'
-      ? themeValue
-      : undefined;
+    themeValue === 'dark' || themeValue === 'light' || themeValue === 'high-contrast' ? themeValue : undefined;
   const title = (node.data.title as string) || node.id;
   // Devtools panel is double-gated: the operator must opt in via the env flag
   // AND the request must carry ?devtools=1. Off by default in all normal runs.
   const devtoolsEnabled =
-    process.env.PMX_CANVAS_JSON_RENDER_DEVTOOLS === '1' &&
-    url.searchParams.get('devtools') === '1';
+    process.env.PMX_CANVAS_JSON_RENDER_DEVTOOLS === '1' && url.searchParams.get('devtools') === '1';
   const axToken = url.searchParams.get('axToken');
   const axEnabled = resolveNodeAxCapabilities(node).enabled;
   const frameToken = url.searchParams.get('frameToken');
   const displayParam = url.searchParams.get('display');
-  const display = displayParam === 'expanded' ? 'expanded' as const
-    : displayParam === 'site' ? 'site' as const
-    : undefined;
+  const display =
+    displayParam === 'expanded' ? ('expanded' as const) : displayParam === 'site' ? ('site' as const) : undefined;
   // A standalone "site" tab fills the viewport; content-fit (grow-to-content for the
   // in-canvas iframe) would fight that, so it's ignored in site mode (#65).
   const fitContent = url.searchParams.get('fit') === 'content' && display !== 'site';
@@ -1671,9 +1368,7 @@ function handleArtifactView(url: URL): Response {
         const safeNodeId = node.id.replace(/[^A-Za-z0-9_-]/g, '').slice(0, 80);
         const stateJson = JSON.stringify(buildCanvasAxSurfaceSnapshot()).replace(/</g, '\\u003c');
         const bridge = `${buildAxBridge(safeToken, safeNodeId)}${buildAxStateBridge(safeToken, stateJson)}`;
-        content = content.includes('</head>')
-          ? content.replace('</head>', `${bridge}</head>`)
-          : `${bridge}${content}`;
+        content = content.includes('</head>') ? content.replace('</head>', `${bridge}</head>`) : `${bridge}${content}`;
       }
     }
     // Content-height reporter so a web-artifact node grows to fit its app (#48).
@@ -1700,7 +1395,8 @@ function handleArtifactView(url: URL): Response {
       ? `<article class="markdown-body">${marked.parse(content) as string}</article>`
       : `<pre class="artifact-code"><code>${escapeHtml(content)}</code></pre>`;
 
-  return new Response(`<!doctype html>
+  return new Response(
+    `<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8" />
@@ -1798,12 +1494,14 @@ function handleArtifactView(url: URL): Response {
     <section class="panel">${body}</section>
   </main>
 </body>
-</html>`, {
-    headers: {
-      'Content-Type': 'text/html; charset=utf-8',
-      'Cache-Control': 'no-store',
+</html>`,
+    {
+      headers: {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Cache-Control': 'no-store',
+      },
     },
-  });
+  );
 }
 
 function handleRead(pathLike: string): Response {
@@ -1821,173 +1519,6 @@ function handleRead(pathLike: string): Response {
   });
 }
 
-async function handleExtAppCallTool(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const sessionId = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
-  const toolName = typeof body.toolName === 'string' ? body.toolName.trim() : '';
-  if (!sessionId || !toolName) {
-    return responseJson({ ok: false, error: 'Missing sessionId or toolName.' }, 400);
-  }
-
-  const args =
-    body.arguments && typeof body.arguments === 'object' && !Array.isArray(body.arguments)
-      ? body.arguments as Record<string, unknown>
-      : undefined;
-  const nodeId = typeof body.nodeId === 'string' ? body.nodeId.trim() : '';
-
-  try {
-    const requestedNode = nodeId ? canvasState.getNode(nodeId) : undefined;
-    const canReadLocalCheckpoint =
-      requestedNode?.type === 'mcp-app' &&
-      requestedNode.data.mode === 'ext-app' &&
-      requestedNode.data.appSessionId === sessionId;
-    const localCheckpointData = canReadLocalCheckpoint && toolName === EXCALIDRAW_READ_CHECKPOINT_TOOL
-      ? getLocalExcalidrawCheckpointData(requestedNode, args)
-      : null;
-    const result = localCheckpointData === null
-      ? await callMcpAppTool(sessionId, toolName, args)
-      : { content: [{ type: 'text', text: localCheckpointData }] } satisfies CallToolResult;
-    if (nodeId) {
-      const node = canvasState.getNode(nodeId);
-      if (node?.type === 'mcp-app' && node.data.mode === 'ext-app' && node.data.appSessionId === sessionId) {
-        let changed = false;
-        if (toolName === EXCALIDRAW_SAVE_CHECKPOINT_TOOL && persistExcalidrawCheckpointToNode(nodeId, node, args)) {
-          // Checkpoint saves are replayed through toolInput.elements instead of
-          // replacing the original create_view result with a generic "ok".
-          changed = true;
-        } else if (!(isExcalidrawCreateView(node.data.serverName, node.data.toolName) && isCheckpointToolName(toolName))) {
-          const nextData: Record<string, unknown> = { ...node.data };
-          if (shouldReplayAppToolResult(toolName, result)) nextData.toolResult = result;
-          const nextModelContext: Record<string, unknown> = {};
-          if (Array.isArray(result.content)) {
-            nextModelContext.content = result.content;
-          }
-          if (result.structuredContent && typeof result.structuredContent === 'object' && !Array.isArray(result.structuredContent)) {
-            nextModelContext.structuredContent = result.structuredContent;
-          }
-          if (Object.keys(nextModelContext).length > 0) {
-            nextData.appModelContext = {
-              ...nextModelContext,
-              updatedAt: new Date().toISOString(),
-            };
-          }
-          canvasState.updateNode(nodeId, {
-            data: nextData,
-          });
-          changed = true;
-        }
-        if (changed) {
-          broadcastWorkbenchEvent('canvas-layout-update', {
-            layout: canvasState.getLayout(),
-            sessionId: primaryWorkbenchSessionId,
-            timestamp: new Date().toISOString(),
-          });
-        }
-      }
-    }
-    return responseJson({ ok: true, result });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-  }
-}
-
-async function handleExtAppReadResource(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const sessionId = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
-  const uri = typeof body.uri === 'string' ? body.uri.trim() : '';
-  if (!sessionId || !uri) {
-    return responseJson({ ok: false, error: 'Missing sessionId or uri.' }, 400);
-  }
-
-  try {
-    const result = await readMcpAppResource(sessionId, uri);
-    return responseJson({ ok: true, result });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-  }
-}
-
-async function handleExtAppListTools(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const sessionId = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
-  if (!sessionId) return responseJson({ ok: false, error: 'Missing sessionId.' }, 400);
-
-  try {
-    const result: ListToolsResult = await listMcpAppTools(sessionId);
-    return responseJson({ ok: true, result });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-  }
-}
-
-async function handleExtAppListResources(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const sessionId = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
-  if (!sessionId) return responseJson({ ok: false, error: 'Missing sessionId.' }, 400);
-
-  try {
-    const result: ListResourcesResult = await listMcpAppResources(sessionId);
-    return responseJson({ ok: true, result });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-  }
-}
-
-async function handleExtAppListResourceTemplates(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const sessionId = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
-  if (!sessionId) return responseJson({ ok: false, error: 'Missing sessionId.' }, 400);
-
-  try {
-    const result: ListResourceTemplatesResult = await listMcpAppResourceTemplates(sessionId);
-    return responseJson({ ok: true, result });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-  }
-}
-
-async function handleExtAppListPrompts(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const sessionId = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
-  if (!sessionId) return responseJson({ ok: false, error: 'Missing sessionId.' }, 400);
-
-  try {
-    const result: ListPromptsResult = await listMcpAppPrompts(sessionId);
-    return responseJson({ ok: true, result });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-  }
-}
-
-async function handleExtAppModelContext(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const nodeId = typeof body.nodeId === 'string' ? body.nodeId.trim() : '';
-  if (!nodeId) return responseJson({ ok: false, error: 'Missing nodeId.' }, 400);
-
-  const node = canvasState.getNode(nodeId);
-  if (!node) return responseJson({ ok: false, error: `Node "${nodeId}" not found.` }, 404);
-
-  canvasState.updateNode(nodeId, {
-    data: {
-      ...node.data,
-      appModelContext: {
-        ...(Array.isArray(body.content) ? { content: body.content } : {}),
-        ...(body.structuredContent && typeof body.structuredContent === 'object' && !Array.isArray(body.structuredContent)
-          ? { structuredContent: body.structuredContent }
-          : {}),
-        updatedAt: new Date().toISOString(),
-      },
-    },
-  });
-
-  broadcastWorkbenchEvent('canvas-layout-update', {
-    layout: canvasState.getLayout(),
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true });
-}
-
 function handleWorkbenchState(): Response {
   const mcpAppHost = getMcpAppHostSnapshot();
   if (!primaryWorkbenchPath) {
@@ -2033,9 +1564,8 @@ function currentWorkbenchUrl(): string | null {
 
 async function handleWorkbenchWebViewScreenshot(req: Request): Promise<Response> {
   const body = await readJson(req);
-  const format = body.format === 'jpeg' || body.format === 'webp' || body.format === 'png'
-    ? body.format
-    : 'png';
+  if (body === null) return malformedJsonResponse();
+  const format = body.format === 'jpeg' || body.format === 'webp' || body.format === 'png' ? body.format : 'png';
   const quality = typeof body.quality === 'number' ? body.quality : undefined;
 
   try {
@@ -2044,11 +1574,7 @@ async function handleWorkbenchWebViewScreenshot(req: Request): Promise<Response>
       ...(quality !== undefined ? { quality } : {}),
     });
     const responseBytes = Uint8Array.from(bytes);
-    const mimeType = format === 'jpeg'
-      ? 'image/jpeg'
-      : format === 'webp'
-        ? 'image/webp'
-        : 'image/png';
+    const mimeType = format === 'jpeg' ? 'image/jpeg' : format === 'webp' ? 'image/webp' : 'image/png';
     return new Response(responseBytes.buffer, {
       headers: {
         'Content-Type': mimeType,
@@ -2063,6 +1589,7 @@ async function handleWorkbenchWebViewScreenshot(req: Request): Promise<Response>
 
 async function handleWorkbenchOpen(req: Request): Promise<Response> {
   const body = await readJson(req);
+  if (body === null) return malformedJsonResponse();
   const pathLike = typeof body.path === 'string' ? body.path : '';
   const safePath = resolveWorkspaceMarkdownPath(pathLike);
   if (!safePath) return responseText('Invalid path', 400);
@@ -2074,6 +1601,7 @@ async function handleWorkbenchOpen(req: Request): Promise<Response> {
 
 async function handleWorkbenchIntent(req: Request): Promise<Response> {
   const body = await readJson(req);
+  if (body === null) return malformedJsonResponse();
   const rawType = typeof body.type === 'string' ? body.type.trim() : '';
   if (!rawType) return responseText('Missing intent type', 400);
   if (!ALLOWED_WORKBENCH_INTENTS.has(rawType as PrimaryWorkbenchIntent['type'])) {
@@ -2081,10 +1609,7 @@ async function handleWorkbenchIntent(req: Request): Promise<Response> {
   }
 
   const rawPayload = body.payload;
-  const payload =
-    rawPayload && typeof rawPayload === 'object'
-      ? (rawPayload as PrimaryWorkbenchEventPayload)
-      : {};
+  const payload = rawPayload && typeof rawPayload === 'object' ? (rawPayload as PrimaryWorkbenchEventPayload) : {};
 
   // Handle trace intents directly on the server
   if (rawType === 'trace-toggle') {
@@ -2234,6 +1759,7 @@ function handleWorkbenchEvents(req: Request): Response {
 
 async function handleSave(req: Request): Promise<Response> {
   const body = await readJson(req);
+  if (body === null) return malformedJsonResponse();
   const pathLike = typeof body.path === 'string' ? body.path : '';
   const safePath = resolveWorkspaceMarkdownPath(pathLike);
   if (!safePath) return responseText('Invalid path', 400);
@@ -2250,6 +1776,7 @@ async function handleSave(req: Request): Promise<Response> {
 
 async function handleRender(req: Request): Promise<Response> {
   const body = await readJson(req);
+  if (body === null) return malformedJsonResponse();
   const markdown = typeof body.markdown === 'string' ? body.markdown : '';
   const html =
     (marked.parse(normalizeMarkdownExternalUrls(markdown), {
@@ -2271,6 +1798,7 @@ function buildSelectionContextPreamble(contextNodeIds: string[]): string {
 
 async function handleCanvasPrompt(req: Request): Promise<Response> {
   const body = await readJson(req);
+  if (body === null) return malformedJsonResponse();
   const text = typeof body.text === 'string' ? body.text.trim() : '';
   if (!text) return responseText('Missing prompt text', 400);
 
@@ -2279,10 +1807,7 @@ async function handleCanvasPrompt(req: Request): Promise<Response> {
   const parentNodeId = typeof body.parentNodeId === 'string' ? body.parentNodeId : undefined;
   const MAX_CONTEXT_NODES = 20;
   let contextNodeIds = Array.isArray(body.contextNodeIds)
-    ? (body.contextNodeIds.filter((id: unknown) => typeof id === 'string') as string[]).slice(
-        0,
-        MAX_CONTEXT_NODES,
-      )
+    ? (body.contextNodeIds.filter((id: unknown) => typeof id === 'string') as string[]).slice(0, MAX_CONTEXT_NODES)
     : [];
 
   if (contextNodeIds.length === 0 && canvasState.contextPinnedNodeIds.size > 0) {
@@ -2341,9 +1866,7 @@ async function handleCanvasPrompt(req: Request): Promise<Response> {
     }
 
     const MAX_THREAD_TURNS = 100;
-    const existingTurnCount = Array.isArray(threadNode.data.turns)
-      ? (threadNode.data.turns as unknown[]).length
-      : 0;
+    const existingTurnCount = Array.isArray(threadNode.data.turns) ? (threadNode.data.turns as unknown[]).length : 0;
     if (existingTurnCount >= MAX_THREAD_TURNS) {
       return responseText('Thread has reached the maximum number of turns', 400);
     }
@@ -2418,9 +1941,7 @@ async function handleCanvasPrompt(req: Request): Promise<Response> {
   const suffix = Math.random().toString(36).slice(2, 8);
   const nodeId = `prompt-${Date.now()}-${suffix}`;
 
-  const promptCount = canvasState
-    .getLayout()
-    .nodes.filter((n) => n.type === 'prompt' || n.type === 'response').length;
+  const promptCount = canvasState.getLayout().nodes.filter((n) => n.type === 'prompt' || n.type === 'response').length;
   const pos = position ?? { x: 380 + promptCount * 30, y: 1260 + promptCount * 30 };
 
   let enrichedText = text;
@@ -2514,134 +2035,6 @@ async function handleCanvasPrompt(req: Request): Promise<Response> {
   return responseJson({ ok: true, nodeId });
 }
 
-function handleGetPinnedContext(): Response {
-  const pinnedIds = Array.from(canvasState.contextPinnedNodeIds);
-  const preamble = pinnedIds.length > 0 ? buildSelectionContextPreamble(pinnedIds) : '';
-  const nodes = pinnedIds
-    .map((id) => canvasState.getNode(id))
-    .filter((node): node is CanvasNodeState => node !== undefined)
-    .map((node) => serializeNodeForAgentContext(node, {
-      defaultTextLength: 700,
-      webpageTextLength: 1600,
-      includePosition: true,
-    }));
-  return responseJson({ preamble, nodeIds: pinnedIds, count: pinnedIds.length, nodes });
-}
-
-function normalizeAxNodeIds(value: unknown): string[] {
-  if (!Array.isArray(value)) return [];
-  return value.filter((id): id is string => typeof id === 'string');
-}
-
-function normalizeAxSource(value: unknown, fallback: PmxAxSource): PmxAxSource {
-  return value === 'agent' ||
-    value === 'api' ||
-    value === 'browser' ||
-    value === 'cli' ||
-    value === 'codex' ||
-    value === 'copilot' ||
-    value === 'mcp' ||
-    value === 'sdk' ||
-    value === 'system'
-    ? value
-    : fallback;
-}
-
-function handleGetAxContext(url: URL): Response {
-  // Optional ?consumer= filters the compact `delivery` lead block (loop-safe — a
-  // consumer never sees steering/activity it originated), so a host adapter can
-  // inject its own un-truncated pending block per turn (report #54 hardening).
-  const consumer = url.searchParams.get('consumer') ?? undefined;
-  return responseJson(buildCanvasAxContext(consumer));
-}
-
-function isReviewSeverity(v: unknown): v is PmxAxReviewSeverity {
-  return v === 'info' || v === 'warning' || v === 'error';
-}
-function isReviewKind(v: unknown): v is PmxAxReviewKind {
-  return v === 'comment' || v === 'finding';
-}
-function isReviewAnchor(v: unknown): v is PmxAxReviewAnchorType {
-  return v === 'node' || v === 'file' || v === 'region';
-}
-
-// Validate untrusted activity `reactions` from an HTTP body into the typed override
-// shape ingestActivity expects. `false` suppresses a default reaction; an object
-// overrides its fields (invalid fields are dropped, not stored raw).
-function normalizeActivityReactions(input: Record<string, unknown>): {
-  workItem?: false | { status?: PmxAxWorkItemStatus; detail?: string | null };
-  evidence?: false | { kind?: PmxAxEvidenceKind; body?: string | null };
-  review?: false | { severity?: PmxAxReviewSeverity; kind?: PmxAxReviewKind; anchorType?: PmxAxReviewAnchorType; nodeId?: string | null };
-} {
-  const out: ReturnType<typeof normalizeActivityReactions> = {};
-  if (input.workItem === false) out.workItem = false;
-  else if (isRecord(input.workItem)) {
-    const status = normalizeAxWorkItemStatus(input.workItem.status);
-    out.workItem = {
-      ...(status ? { status } : {}),
-      ...(typeof input.workItem.detail === 'string' ? { detail: input.workItem.detail } : {}),
-    };
-  }
-  if (input.evidence === false) out.evidence = false;
-  else if (isRecord(input.evidence)) {
-    out.evidence = {
-      ...(isAxEvidenceKind(input.evidence.kind) ? { kind: input.evidence.kind } : {}),
-      ...(typeof input.evidence.body === 'string' ? { body: input.evidence.body } : {}),
-    };
-  }
-  if (input.review === false) out.review = false;
-  else if (isRecord(input.review)) {
-    out.review = {
-      ...(isReviewSeverity(input.review.severity) ? { severity: input.review.severity } : {}),
-      ...(isReviewKind(input.review.kind) ? { kind: input.review.kind } : {}),
-      ...(isReviewAnchor(input.review.anchorType) ? { anchorType: input.review.anchorType } : {}),
-      ...(typeof input.review.nodeId === 'string' ? { nodeId: input.review.nodeId } : {}),
-    };
-  }
-  return out;
-}
-
-// Report primitive A: ingest a harness-forwarded agent activity; the board auto-reacts.
-async function handleAxActivityIngest(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (!isAxActivityKind(body.kind)) {
-    return responseJson({ ok: false, error: "activity requires a valid 'kind': one of tool-start, tool-result, failure, error, session-start, session-end, command, note." }, 400);
-  }
-  if (typeof body.title !== 'string' || !body.title.trim()) {
-    return responseJson({ ok: false, error: 'activity requires a title.' }, 400);
-  }
-  const result = canvasState.ingestActivity(
-    {
-      kind: body.kind,
-      title: body.title,
-      ...(typeof body.summary === 'string' ? { summary: body.summary } : {}),
-      ...(body.outcome === 'success' || body.outcome === 'failure' ? { outcome: body.outcome } : {}),
-      ...(typeof body.ref === 'string' ? { ref: body.ref } : {}),
-      ...(Array.isArray(body.nodeIds) ? { nodeIds: normalizeAxNodeIds(body.nodeIds) } : {}),
-      ...(isRecord(body.data) ? { data: body.data } : {}),
-      ...(isRecord(body.reactions) ? { reactions: normalizeActivityReactions(body.reactions) } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  const meta = { sessionId: primaryWorkbenchSessionId, timestamp: new Date().toISOString() };
-  broadcastWorkbenchEvent('ax-event-created', { event: result.event, ...meta });
-  if (result.workItem) broadcastWorkbenchEvent('ax-state-changed', { workItem: result.workItem, ...meta });
-  if (result.evidence) broadcastWorkbenchEvent('ax-event-created', { evidence: result.evidence, ...meta });
-  if (result.review) broadcastWorkbenchEvent('ax-state-changed', { reviewAnnotation: result.review, ...meta });
-  return responseJson({ ok: true, ...result });
-}
-
-// Report primitive D single-item gate reads (GET /api/canvas/ax/{approval,
-// elicitation,mode}/:id) with the optional ?waitMs= long-poll migrated to the
-// operation registry (plan-007 Slice B wave 4):
-// src/server/operations/ops/ax-await.ts.
-
-// Compact AX state for surfaces (the same shape seeded into AX-enabled iframes).
-// The client fetches this and pushes it to surfaces over the ax-update channel.
-function handleGetAxSurfaceSnapshot(): Response {
-  return responseJson(buildCanvasAxSurfaceSnapshot());
-}
-
 // Open a node's surface in the user's real system browser (for hosts whose
 // embedded browser makes window.open('_blank') feel in-place, e.g. Codex).
 // Accepts ONLY { nodeId, url? } and opens this server's own surface URL — never
@@ -2650,6 +2043,7 @@ function handleGetAxSurfaceSnapshot(): Response {
 // safe presentation query params like the current theme.
 async function handleOpenExternalSurface(req: Request): Promise<Response> {
   const body = await readJson(req);
+  if (body === null) return malformedJsonResponse();
   const nodeId = typeof body.nodeId === 'string' ? body.nodeId : '';
   if (!nodeId) return responseJson({ ok: false, error: 'nodeId is required.' }, 400);
   const node = canvasState.getNode(nodeId);
@@ -2668,106 +2062,6 @@ async function handleOpenExternalSurface(req: Request): Promise<Response> {
   return responseJson({ ok: true, opened, url: surfacePath });
 }
 
-async function handleAxInteraction(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const { result, events } = applyAxInteraction(canvasState, body, normalizeAxSource(body.source, 'api'));
-  for (const e of events) {
-    broadcastWorkbenchEvent(e.event, {
-      ...e.payload,
-      sessionId: primaryWorkbenchSessionId,
-      timestamp: new Date().toISOString(),
-    });
-  }
-  return responseJson(result, result.ok ? 200 : result.status);
-}
-
-// handleAxDeliveryPending / handleAxDeliveryMark migrated to the operation
-// registry (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
-
-function handleAxElicitationList(): Response {
-  return responseJson({ ok: true, elicitations: canvasState.getElicitations() });
-}
-
-// handleAxElicitationRequest / handleAxElicitationRespond migrated to the
-// operation registry (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
-
-function handleAxModeList(): Response {
-  return responseJson({ ok: true, modeRequests: canvasState.getModeRequests() });
-}
-
-// handleAxModeRequest / handleAxModeResolve migrated to the operation registry
-// (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
-
-function handleAxCommandList(): Response {
-  return responseJson({ ok: true, commands: canvasState.getCommandRegistry() });
-}
-
-// handleAxCommandInvoke migrated to the operation registry (plan-007 Slice B
-// wave 3): src/server/operations/ops/ax-timeline.ts.
-
-function handleAxPolicyGet(): Response {
-  return responseJson({ ok: true, policy: canvasState.getPolicy() });
-}
-
-async function handleAxStatePatch(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (!body.focus || typeof body.focus !== 'object' || Array.isArray(body.focus)) {
-    return responseJson({ ok: false, error: 'PATCH /api/canvas/ax currently requires a focus object.' }, 400);
-  }
-  const focusInput = body.focus as Record<string, unknown>;
-  const focus = canvasState.setAxFocus(normalizeAxNodeIds(focusInput.nodeIds), {
-    source: normalizeAxSource(focusInput.source, 'api'),
-  });
-  broadcastWorkbenchEvent('ax-state-changed', {
-    focus,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, state: canvasState.getAxState() });
-}
-
-// handleAxEventAdd / handleAxSteer / handleAxTimelineGet migrated to the
-// operation registry (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
-
-const AX_WORK_STATUSES = new Set(['todo', 'in-progress', 'blocked', 'done', 'cancelled']);
-
-function normalizeAxWorkItemStatus(value: unknown): 'todo' | 'in-progress' | 'blocked' | 'done' | 'cancelled' | undefined {
-  return typeof value === 'string' && AX_WORK_STATUSES.has(value)
-    ? value as 'todo' | 'in-progress' | 'blocked' | 'done' | 'cancelled'
-    : undefined;
-}
-
-function handleAxWorkList(): Response {
-  return responseJson({ ok: true, workItems: canvasState.getWorkItems() });
-}
-
-// handleAxWorkAdd / handleAxWorkUpdate migrated to the operation registry
-// (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
-
-function handleAxApprovalList(): Response {
-  return responseJson({ ok: true, approvalGates: canvasState.getApprovalGates() });
-}
-
-// handleAxApprovalRequest / handleAxApprovalResolve migrated to the operation
-// registry (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
-
-// handleAxEvidenceAdd migrated to the operation registry (plan-007 Slice B
-// wave 3): src/server/operations/ops/ax-timeline.ts.
-
-// The AX review normalize helpers + their constant sets moved with the
-// migrated handlers (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
-
-function handleAxReviewList(): Response {
-  return responseJson({ ok: true, reviewAnnotations: canvasState.getReviewAnnotations() });
-}
-
-// handleAxReviewAdd / handleAxReviewUpdate migrated to the operation registry
-// (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
-
-function handleAxHostCapabilityGet(): Response {
-  return responseJson({ ok: true, host: canvasState.getHostCapability() });
-}
-
 // ── Port resolution ───────────────────────────────────────────
 
 function buildPortCandidates(preferredPort: number): number[] {
@@ -2902,11 +2196,9 @@ export function buildMacBrowserOpenScript(appName: string, url: string): string
 }
 
 function resolveWindowsBrowserForCanvas(): { name: string; exe: string } | null {
-  const envDirs = [
-    process.env.PROGRAMFILES,
-    process.env['PROGRAMFILES(X86)'],
-    process.env.LOCALAPPDATA,
-  ].filter((d): d is string => Boolean(d));
+  const envDirs = [process.env.PROGRAMFILES, process.env['PROGRAMFILES(X86)'], process.env.LOCALAPPDATA].filter(
+    (d): d is string => Boolean(d),
+  );
 
   const browsers = [
     { name: 'Edge', subpath: join('Microsoft', 'Edge', 'Application', 'msedge.exe') },
@@ -2967,8 +2259,7 @@ function syncContextNodeToCanvasState(
     mergedData.messagesLength !== undefined ||
     mergedData.utilization !== undefined ||
     mergedData.nearLimit !== undefined;
-  const shouldCreate =
-    options.forceCreate === true || cards.length > 0 || auxTabs.length > 0 || hasUsage;
+  const shouldCreate = options.forceCreate === true || cards.length > 0 || auxTabs.length > 0 || hasUsage;
 
   if (!existing) {
     if (!shouldCreate) return;
@@ -3077,16 +2368,17 @@ function syncEventToCanvasState(event: string, payload: PrimaryWorkbenchEventPay
   } else if (event === 'ext-app-open') {
     const toolCallId = payload.toolCallId as string;
     if (!toolCallId) return;
-    const id = typeof payload.nodeId === 'string' && payload.nodeId.length > 0
-      ? payload.nodeId
-      : toolCallId.startsWith('ext-app-') ? toolCallId : `ext-app-${toolCallId}`;
+    const id =
+      typeof payload.nodeId === 'string' && payload.nodeId.length > 0
+        ? payload.nodeId
+        : toolCallId.startsWith('ext-app-')
+          ? toolCallId
+          : `ext-app-${toolCallId}`;
     const dataPatch = {
       mode: 'ext-app',
       toolCallId,
       nodeId: id,
-      ...(typeof payload.title === 'string' && payload.title.trim().length > 0
-        ? { title: payload.title.trim() }
-        : {}),
+      ...(typeof payload.title === 'string' && payload.title.trim().length > 0 ? { title: payload.title.trim() } : {}),
       html: payload.html,
       toolInput: payload.toolInput,
       serverName: payload.serverName,
@@ -3196,18 +2488,14 @@ function syncEventToCanvasState(event: string, payload: PrimaryWorkbenchEventPay
               success: typeof payload.success === 'boolean' ? payload.success : undefined,
               error: typeof payload.error === 'string' ? payload.error : undefined,
               content: typeof payload.content === 'string' ? payload.content : undefined,
-              detailedContent:
-                typeof payload.detailedContent === 'string' ? payload.detailedContent : undefined,
+              detailedContent: typeof payload.detailedContent === 'string' ? payload.detailedContent : undefined,
             }),
           },
         });
       }
     });
   } else if (event === 'context-cards') {
-    syncContextNodeToCanvasState(
-      { cards: Array.isArray(payload.cards) ? payload.cards : [] },
-      { forceCreate: true },
-    );
+    syncContextNodeToCanvasState({ cards: Array.isArray(payload.cards) ? payload.cards : [] }, { forceCreate: true });
   } else if (event === 'context-usage') {
     syncContextNodeToCanvasState({
       currentTokens: payload.currentTokens,
@@ -3230,9 +2518,7 @@ function syncEventToCanvasState(event: string, payload: PrimaryWorkbenchEventPay
       return;
     }
     const auxTabs = Array.isArray(existing.data.auxTabs)
-      ? (existing.data.auxTabs as Array<Record<string, unknown>>).filter(
-          (tab) => tab.id !== payload.id,
-        )
+      ? (existing.data.auxTabs as Array<Record<string, unknown>>).filter((tab) => tab.id !== payload.id)
       : [];
     syncContextNodeToCanvasState({ auxTabs });
   } else if (event === 'canvas-status' || event === 'execution-phase') {
@@ -3377,10 +2663,7 @@ function syncEventToCanvasState(event: string, payload: PrimaryWorkbenchEventPay
   }
 }
 
-export function emitPrimaryWorkbenchEvent(
-  event: string,
-  payload: PrimaryWorkbenchEventPayload = {},
-): void {
+export function emitPrimaryWorkbenchEvent(event: string, payload: PrimaryWorkbenchEventPayload = {}): void {
   rotatePrimaryWorkbenchSessionIfNeeded();
   const envelope = {
     ...payload,
@@ -3457,10 +2740,7 @@ function ensureCanvasBrowserOpen(): void {
   canvasBrowserOpening = false;
 }
 
-export function openPrimaryWorkbenchPath(
-  pathLike: string,
-  workspaceRoot = process.cwd(),
-): string | null {
+export function openPrimaryWorkbenchPath(pathLike: string, workspaceRoot = process.cwd()): string | null {
   const safePath = resolve(pathLike);
   if (!isMarkdownFile(safePath)) return null;
   if (!existsSync(safePath)) return null;
@@ -3524,11 +2804,12 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
   rotatePrimaryWorkbenchSessionIfNeeded();
 
   const preferredPort = options.port ?? Number(process.env.PMX_WEB_CANVAS_PORT ?? DEFAULT_PORT);
-  const portCandidates = options.port === 0
-    ? [0]
-    : options.allowPortFallback === false
-    ? [preferredPort > 0 ? Math.floor(preferredPort) : DEFAULT_PORT]
-    : buildPortCandidates(preferredPort);
+  const portCandidates =
+    options.port === 0
+      ? [0]
+      : options.allowPortFallback === false
+        ? [preferredPort > 0 ? Math.floor(preferredPort) : DEFAULT_PORT]
+        : buildPortCandidates(preferredPort);
 
   for (const portCandidate of portCandidates) {
     try {
@@ -3605,14 +2886,14 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleWorkbenchIntent(req);
           }
 
-          // Webview automation routes (plan-008 Wave 3): status / start /
-          // evaluate / resize / stop are now registered operations served by the
-          // registry. A null return falls through (e.g. the screenshot route
-          // below, which stays hand-written — it returns a binary image, not a
-          // JSON wire body).
-          if (url.pathname.startsWith('/api/workbench/webview')) {
-            const webviewResponse = await dispatchOperationRoute(req, url);
-            if (webviewResponse) return webviewResponse;
+          // Operation registry routes (plan-005): every registered operation is
+          // dispatched here — webview automation, /api/canvas/*, /api/ext-app/*,
+          // theme/update/viewport/annotation/refresh (plan-009 C1 slices 1-3). A
+          // null return falls through to the remaining hand-written routes
+          // (SSE, binary, HTML/static serving, and the server-coupled handlers).
+          if (url.pathname.startsWith('/api/')) {
+            const operationResponse = await dispatchOperationRoute(req, url);
+            if (operationResponse) return operationResponse;
           }
 
           if (url.pathname === '/api/workbench/webview/screenshot' && req.method === 'POST') {
@@ -3627,194 +2908,22 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleRender(req);
           }
 
-          // Operation registry routes (plan-005): registered operations are
-          // dispatched here; a null return falls through to the legacy routes.
-          if (url.pathname.startsWith('/api/canvas/')) {
-            const operationResponse = await dispatchOperationRoute(req, url);
-            if (operationResponse) return operationResponse;
-          }
-
-          if (url.pathname === '/api/canvas/theme' && req.method === 'GET') {
-            return responseJson({ ok: true, theme: canvasState.theme });
-          }
-
-          if (url.pathname === '/api/canvas/theme' && req.method === 'POST') {
-            return handleCanvasThemeUpdate(req);
-          }
-
-          if (url.pathname === '/api/canvas/update' && req.method === 'POST') {
-            return handleCanvasUpdate(req);
-          }
-
-          // POST /api/canvas/batch migrated to the operation registry
-          // (plan-008 Wave 2): src/server/operations/ops/batch.ts.
-
-          if (url.pathname === '/api/canvas/viewport' && req.method === 'POST') {
-            return handleCanvasViewport(req);
-          }
-
-          if (url.pathname === '/api/canvas/annotation' && req.method === 'POST') {
-            return handleCanvasAddAnnotation(req);
-          }
-
-          // POST /api/canvas/mcp-app/open, /api/canvas/diagram, and
-          // /api/canvas/web-artifact migrated to the operation registry
-          // (plan-008 Wave 4): src/server/operations/ops/app.ts.
-
-          // Individual node GET/PATCH/DELETE
-          if (url.pathname.startsWith('/api/canvas/node/') && url.pathname.endsWith('/refresh') && req.method === 'POST') {
-            const nodeId = url.pathname.slice('/api/canvas/node/'.length, -'/refresh'.length);
-            return handleCanvasRefreshWebpageNode(nodeId, req);
-          }
-
           if (url.pathname.startsWith('/api/canvas/image/') && req.method === 'GET') {
             return await handleCanvasImage(url.pathname);
           }
 
-          if (url.pathname === '/api/canvas/pinned-context' && req.method === 'GET') {
-            return handleGetPinnedContext();
-          }
-
-          // GET /api/canvas/ax migrated to the operation registry (plan-007 Slice B.1).
-
-          if (url.pathname === '/api/canvas/ax' && req.method === 'PATCH') {
-            return handleAxStatePatch(req);
-          }
-
-          if (url.pathname === '/api/canvas/ax/context' && req.method === 'GET') {
-            return handleGetAxContext(url);
-          }
-
-          if (url.pathname === '/api/canvas/ax/activity' && req.method === 'POST') {
-            return handleAxActivityIngest(req);
-          }
-
-          if (url.pathname === '/api/canvas/ax/surface-snapshot' && req.method === 'GET') {
-            return handleGetAxSurfaceSnapshot();
-          }
-
           if (url.pathname === '/api/canvas/open-external' && req.method === 'POST') {
             return handleOpenExternalSurface(req);
           }
 
-          // POST /api/canvas/ax/focus migrated to the operation registry (plan-007 Slice B.1).
-
-          // POST /api/canvas/ax/event + POST /api/canvas/ax/steer + GET
-          // /api/canvas/ax/timeline migrated to the operation registry
-          // (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
-
-          if (url.pathname === '/api/canvas/ax/work' && req.method === 'GET') {
-            return handleAxWorkList();
-          }
-
-          // POST /api/canvas/ax/work + PATCH /api/canvas/ax/work/:id migrated to
-          // the operation registry (plan-007 Slice B wave 2).
-
-          if (url.pathname === '/api/canvas/ax/approval' && req.method === 'GET') {
-            return handleAxApprovalList();
-          }
-
-          // POST /api/canvas/ax/approval + POST /api/canvas/ax/approval/:id/resolve
-          // migrated to the operation registry (plan-007 Slice B wave 2).
-
-          // GET /api/canvas/ax/approval/:id (single-item read + ?waitMs long-poll)
-          // migrated to the operation registry (plan-007 Slice B wave 4).
-
-          // POST /api/canvas/ax/evidence migrated to the operation registry
-          // (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
-
-          if (url.pathname === '/api/canvas/ax/review' && req.method === 'GET') {
-            return handleAxReviewList();
-          }
-
-          // POST /api/canvas/ax/review + PATCH /api/canvas/ax/review/:id migrated
-          // to the operation registry (plan-007 Slice B wave 2).
-
-          if (url.pathname === '/api/canvas/ax/host-capability' && req.method === 'GET') {
-            return handleAxHostCapabilityGet();
-          }
-
-          // PUT /api/canvas/ax/host-capability migrated to the operation registry (plan-007 Slice B.1).
-
-          if (url.pathname === '/api/canvas/ax/interaction' && req.method === 'POST') {
-            return handleAxInteraction(req);
-          }
-
-          // GET /api/canvas/ax/delivery/pending + POST /api/canvas/ax/delivery/:id/mark
-          // migrated to the operation registry (plan-007 Slice B wave 3):
-          // src/server/operations/ops/ax-timeline.ts.
-
-          if (url.pathname === '/api/canvas/ax/elicitation' && req.method === 'GET') {
-            return handleAxElicitationList();
-          }
-
-          // POST /api/canvas/ax/elicitation + POST /api/canvas/ax/elicitation/:id/respond
-          // migrated to the operation registry (plan-007 Slice B wave 2).
-
-          // GET /api/canvas/ax/elicitation/:id (single-item read + ?waitMs long-poll)
-          // migrated to the operation registry (plan-007 Slice B wave 4).
-
-          if (url.pathname === '/api/canvas/ax/mode' && req.method === 'GET') {
-            return handleAxModeList();
-          }
-
-          // POST /api/canvas/ax/mode + POST /api/canvas/ax/mode/:id/resolve migrated
-          // to the operation registry (plan-007 Slice B wave 2).
-
-          // GET /api/canvas/ax/mode/:id (single-item read + ?waitMs long-poll)
-          // migrated to the operation registry (plan-007 Slice B wave 4).
-
-          if (url.pathname === '/api/canvas/ax/command' && req.method === 'GET') {
-            return handleAxCommandList();
-          }
-
-          // POST /api/canvas/ax/command migrated to the operation registry
-          // (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
-
-          if (url.pathname === '/api/canvas/ax/policy' && req.method === 'GET') {
-            return handleAxPolicyGet();
-          }
-
-          // POST /api/canvas/ax/policy migrated to the operation registry (plan-007 Slice B.1).
-
-          // Code graph API
-          if (url.pathname === '/api/canvas/code-graph' && req.method === 'GET') {
-            const summary = buildCodeGraphSummary();
-            return responseJson(summary);
-          }
+          // Every other /api/canvas/ax* route, pinned-context, and code-graph is
+          // registry-served (plan-007 slices; plan-009 C1 slice 2 folded the GET
+          // reads + activity/interaction/PATCH): src/server/operations/ops/ax-*.ts.
 
           if (url.pathname === '/api/canvas/prompt' && req.method === 'POST') {
             return handleCanvasPrompt(req);
           }
 
-          if (url.pathname === '/api/ext-app/call-tool' && req.method === 'POST') {
-            return handleExtAppCallTool(req);
-          }
-
-          if (url.pathname === '/api/ext-app/read-resource' && req.method === 'POST') {
-            return handleExtAppReadResource(req);
-          }
-
-          if (url.pathname === '/api/ext-app/list-tools' && req.method === 'POST') {
-            return handleExtAppListTools(req);
-          }
-
-          if (url.pathname === '/api/ext-app/list-resources' && req.method === 'POST') {
-            return handleExtAppListResources(req);
-          }
-
-          if (url.pathname === '/api/ext-app/list-resource-templates' && req.method === 'POST') {
-            return handleExtAppListResourceTemplates(req);
-          }
-
-          if (url.pathname === '/api/ext-app/list-prompts' && req.method === 'POST') {
-            return handleExtAppListPrompts(req);
-          }
-
-          if (url.pathname === '/api/ext-app/model-context' && req.method === 'POST') {
-            return handleExtAppModelContext(req);
-          }
-
           // Static files for canvas SPA bundle
           if (url.pathname.startsWith('/canvas/')) {
             const staticResponse = serveCanvasStatic(url.pathname);