project-athena 0.2.0 → 0.3.0

package/dist/open-2QSZKKUG.js

@@ -0,0 +1,1259 @@
+#!/usr/bin/env node
+import {
+  configureAgents,
+  listAgents,
+  removeAgents
+} from "./chunk-JY6BFIJJ.js";
+import {
+  getRelevantContext,
+  graphSummary,
+  refreshGraph
+} from "./chunk-CXUTYCZX.js";
+import {
+  runSecurityScan
+} from "./chunk-LMOFZNTQ.js";
+import {
+  reviewChanges
+} from "./chunk-EF6GHOIN.js";
+import {
+  buildStatus
+} from "./chunk-ZB7LC6FP.js";
+import {
+  INSTANCE_FILE,
+  findRunningInstance,
+  runDoctor
+} from "./chunk-PR53DT7I.js";
+import {
+  aiStatus
+} from "./chunk-RXNRMIZP.js";
+import "./chunk-VSYBC3VY.js";
+import {
+  contentHash,
+  docAtRevision,
+  docHistory,
+  getRules,
+  listDocs,
+  readDoc,
+  rulesAdd,
+  rulesRemove,
+  rulesUpdate,
+  saveDoc,
+  searchDocs
+} from "./chunk-LEMPCNAY.js";
+import "./chunk-3IS2X2Z7.js";
+import {
+  ACTIVITY_FILE,
+  activityFile,
+  parseEventLines,
+  readRecentEvents,
+  rotatedActivityFile,
+  summarizeSessions
+} from "./chunk-65TSRDQ3.js";
+import {
+  printHeader
+} from "./chunk-SHKXELUX.js";
+import {
+  watchProject
+} from "./chunk-32PRS2MG.js";
+import {
+  AnalysisScheduler
+} from "./chunk-XB66PZ6Z.js";
+import {
+  c,
+  dim,
+  isJson,
+  json,
+  line,
+  ok,
+  setInterruptMessage,
+  warn
+} from "./chunk-Z6QWMJLK.js";
+import {
+  requireProjectRoot
+} from "./chunk-XFN7UZCS.js";
+import "./chunk-KBO7XRBW.js";
+import {
+  applySync,
+  ignorePlan,
+  staleForCheck
+} from "./chunk-TGJUUB44.js";
+import {
+  projectSession,
+  releaseProjectSession
+} from "./chunk-PDFQ5BFG.js";
+import "./chunk-GR4DL2VM.js";
+import {
+  runPipeline
+} from "./chunk-SJOOXO34.js";
+import {
+  SCAN_FILE,
+  saveScan
+} from "./chunk-PANVPNYF.js";
+import "./chunk-ELKFRTZT.js";
+import {
+  ATHENA_VERSION
+} from "./chunk-2R6PXY6Z.js";
+import "./chunk-PVCIGUIT.js";
+import "./chunk-OLPSEQS5.js";
+import "./chunk-JCGDR4UV.js";
+import "./chunk-2RS6TA3D.js";
+import "./chunk-GHFRQAYT.js";
+import "./chunk-673EPYYH.js";
+import {
+  KNOWLEDGE_DOCS,
+  RELEVANCE_MAP
+} from "./chunk-FQEGEVLY.js";
+import {
+  athenaDir
+} from "./chunk-2DY4PUR4.js";
+import {
+  readTextIfExists
+} from "./chunk-IQQBAWSM.js";
+import {
+  AthenaError,
+  notFound
+} from "./chunk-AD4OZCU2.js";
+import "./chunk-INT3IGMQ.js";
+import "./chunk-XW3MLHI2.js";
+import "./chunk-EUPETUWA.js";
+
+// src/cli/commands/open.ts
+import { execFile } from "child_process";
+
+// src/server/instance.ts
+import { promises as fs6 } from "fs";
+import path4 from "path";
+import { fileURLToPath } from "url";
+
+// src/server/app.ts
+import crypto3 from "crypto";
+import Fastify from "fastify";
+
+// src/server/context.ts
+var STATUS_TTL_MS = 3e3;
+var WATCHED_STATUS_TTL_MS = 3e4;
+function createServerContext(init) {
+  const { root } = init;
+  let statusCache = null;
+  let statusInflight = null;
+  let statusGen = 0;
+  const state = { analysisRunning: false, scanRunning: false, graphBuilding: false, syncBusy: false, currentPlan: null, lastCheckedAt: null, watcher: null };
+  const ctx = {
+    ...init,
+    session: projectSession(root),
+    recentWrites: /* @__PURE__ */ new Map(),
+    state,
+    scheduler: new AnalysisScheduler(root),
+    async getStatus() {
+      const ttl = state.watcher ? WATCHED_STATUS_TTL_MS : STATUS_TTL_MS;
+      if (statusCache && Date.now() - statusCache.at < ttl) return statusCache.report;
+      if (statusInflight && statusInflight.gen === statusGen) return statusInflight.report;
+      const gen = statusGen;
+      const started = Date.now();
+      const inflight = { gen, report: buildStatus(root) };
+      statusInflight = inflight;
+      const report = await inflight.report.finally(() => {
+        if (statusInflight === inflight) statusInflight = null;
+      });
+      if (gen === statusGen) statusCache = { at: started, report };
+      return report;
+    },
+    invalidateStatus() {
+      statusCache = null;
+      statusGen++;
+    },
+    setPlan(plan) {
+      state.lastCheckedAt = (/* @__PURE__ */ new Date()).toISOString();
+      state.currentPlan = plan && !plan.upToDate ? plan : null;
+    },
+    async checkNow() {
+      if (state.watcher) return state.watcher.planNow();
+      const plan = await ctx.scheduler.request({ reason: "check" });
+      ctx.setPlan(plan);
+      return plan;
+    },
+    replanSoon() {
+      if (state.currentPlan) void ctx.checkNow().catch(() => {
+      });
+    }
+  };
+  return ctx;
+}
+
+// src/server/events.ts
+import crypto from "crypto";
+var EventBus = class {
+  constructor(capacity = 500) {
+    this.capacity = capacity;
+  }
+  capacity;
+  buffer = [];
+  listeners = /* @__PURE__ */ new Set();
+  current = { state: "IDLE", actor: "none", task: null, reading: [], since: (/* @__PURE__ */ new Date()).toISOString() };
+  settleTimer = null;
+  emit(e) {
+    const event = { id: e.id ?? crypto.randomUUID(), ts: e.ts ?? (/* @__PURE__ */ new Date()).toISOString(), ...e };
+    this.buffer.push(event);
+    if (this.buffer.length > this.capacity) this.buffer.splice(0, this.buffer.length - this.capacity);
+    for (const l of this.listeners) l(event);
+    return event;
+  }
+  /** Add historical events (e.g. from the agent log) without notifying listeners. */
+  seed(events) {
+    this.buffer.push(...events);
+    this.buffer.sort((a, b) => a.ts.localeCompare(b.ts));
+    if (this.buffer.length > this.capacity) this.buffer.splice(0, this.buffer.length - this.capacity);
+  }
+  has(id) {
+    return this.buffer.some((e) => e.id === id);
+  }
+  recent(limit = 200) {
+    return this.buffer.slice(-limit);
+  }
+  activity() {
+    return this.current;
+  }
+  setActivity(next, settleToIdleMs) {
+    if (this.settleTimer) clearTimeout(this.settleTimer);
+    this.settleTimer = null;
+    this.current = { ...next, since: (/* @__PURE__ */ new Date()).toISOString() };
+    for (const l of this.listeners) l({ type: "__activity", activity: this.current });
+    if (settleToIdleMs) {
+      this.settleTimer = setTimeout(() => this.setActivity({ state: "IDLE", actor: "none", task: null, reading: [] }), settleToIdleMs);
+      this.settleTimer.unref();
+    }
+  }
+  subscribe(l) {
+    this.listeners.add(l);
+    return () => this.listeners.delete(l);
+  }
+  close() {
+    if (this.settleTimer) clearTimeout(this.settleTimer);
+    this.listeners.clear();
+  }
+};
+
+// src/server/routes/activity.ts
+import { promises as fs } from "fs";
+var AGENT_IDLE_MS = 5 * 60 * 1e3;
+function registerActivityRoutes({ app, root, events }) {
+  app.get("/api/activity", async () => {
+    const agents = await listAgents(root);
+    const observing = agents.filter((a) => a.activityObservation === "hooks");
+    return {
+      activity: events.activity(),
+      events: events.recent(),
+      sessions: summarizeSessions(await readRecentEvents(root, 500)),
+      agentObservation: {
+        available: observing.length > 0,
+        agents: observing.map((a) => a.name),
+        reason: observing.length ? "Events below come from hooks the agent fired. Athena sees which tool ran and on which files \u2014 never the agent's reasoning." : "No agent is reporting activity yet. Configure an agent with hooks (Claude Code or Cursor) to see its actions here."
+      }
+    };
+  });
+}
+function createAgentActivityFeed({ root, events, state }) {
+  let offset = 0;
+  let ino = null;
+  const toAthenaEvent = (e) => ({
+    id: e.id,
+    ts: e.ts,
+    source: "agent",
+    type: `agent.${e.kind}`,
+    level: e.kind === "stop" ? "success" : "info",
+    message: `${e.agent}: ${e.message}`,
+    data: { agent: e.agent, session: e.session, hook: e.hook, files: e.files, command: e.command, tool: e.tool }
+  });
+  const apply = (e, live) => {
+    if (events.has(e.id)) return;
+    if (live) events.emit(toAthenaEvent(e));
+    else events.seed([{ ...toAthenaEvent(e) }]);
+    if (!live) return;
+    if (e.state === "IDLE") {
+      if (events.activity().actor === "agent") events.setActivity({ state: "IDLE", actor: "none", task: null, reading: [] });
+      return;
+    }
+    if (state.analysisRunning) return;
+    events.setActivity({ state: e.state, actor: "agent", task: `${e.agent}: ${e.message}`, reading: e.files.slice(0, 4) }, e.state === "SUCCESS" ? 1e4 : AGENT_IDLE_MS);
+  };
+  const readLinesFrom = async (file, from, size) => {
+    if (size <= from) return from;
+    const handle = await fs.open(file, "r");
+    try {
+      const length = size - from;
+      const buf = Buffer.alloc(length);
+      await handle.read(buf, 0, length, from);
+      const text = buf.toString("utf8");
+      const lastNewline = text.lastIndexOf("\n");
+      if (lastNewline === -1) return from;
+      for (const e of parseEventLines(text.slice(0, lastNewline + 1))) apply(e, true);
+      return from + Buffer.byteLength(text.slice(0, lastNewline + 1));
+    } finally {
+      await handle.close();
+    }
+  };
+  return {
+    async seed() {
+      const history = await readRecentEvents(root, 200);
+      for (const e of history) apply(e, false);
+      const st = await fs.stat(activityFile(root)).catch(() => null);
+      offset = st?.size ?? 0;
+      ino = st?.ino ?? null;
+    },
+    async readNew() {
+      try {
+        const file = activityFile(root);
+        const st = await fs.stat(file).catch(() => null);
+        if (!st) return;
+        if (ino !== null && st.ino !== ino) {
+          const old = await fs.stat(rotatedActivityFile(root)).catch(() => null);
+          if (old && old.ino === ino) await readLinesFrom(rotatedActivityFile(root), offset, old.size).catch(() => {
+          });
+          offset = 0;
+        } else if (st.size < offset) offset = 0;
+        ino = st.ino;
+        offset = await readLinesFrom(file, offset, st.size);
+      } catch {
+      }
+    }
+  };
+}
+
+// src/server/routes/agents.ts
+var agentsBody = { schema: { body: { type: "object", required: ["agents"], additionalProperties: false, properties: { agents: { type: "array", maxItems: 10, items: { type: "string", maxLength: 40 } } } } } };
+function registerAgentRoutes({ app, root, events }) {
+  app.get("/api/agents", async () => listAgents(root));
+  app.post("/api/agents/configure", agentsBody, async (req) => {
+    const r = await configureAgents(root, req.body.agents);
+    events.emit({ source: "web-ui", type: "agents.configured", level: "success", message: `Configured ${r.map((x) => x.id).join(", ")}`, data: { files: r.flatMap((x) => x.files.map((f) => f.path)) } });
+    return listAgents(root);
+  });
+  app.post("/api/agents/remove", agentsBody, async (req) => {
+    const removed = await removeAgents(root, req.body.agents);
+    events.emit({ source: "web-ui", type: "agents.removed", level: "info", message: `Removed ${req.body.agents.join(", ")} integration${removed.length ? ` (${removed.join(", ")})` : ""}` });
+    return listAgents(root);
+  });
+}
+
+// src/server/routes/analysis.ts
+var STAGE_LABELS = { scan: "Scanning files", detect: "Detecting technologies, schema and routes", git: "Reading Git metadata", write: "Writing knowledge", agents: "Updating agent integrations" };
+function registerAnalysisRoutes(ctx) {
+  const { app, root, events, state } = ctx;
+  app.post(
+    "/api/analyze",
+    { schema: { body: { type: "object", additionalProperties: false, properties: { force: { type: "boolean" } } } } },
+    async (req, reply) => {
+      if (state.analysisRunning) throw new AthenaError("An analysis is already running.", void 0, 1, "busy");
+      state.analysisRunning = true;
+      const started = Date.now();
+      events.setActivity({ state: "ANALYZING", actor: "athena", task: "Analyzing project", reading: [] });
+      events.emit({ source: "athena", type: "analysis.started", level: "info", message: "Analysis started (requested from web UI)" });
+      void ctx.scheduler.exclusive(
+        () => runPipeline({
+          root,
+          mode: "analyze",
+          force: req.body?.force,
+          onStage: (stage) => {
+            if (STAGE_LABELS[stage]) events.setActivity({ state: "ANALYZING", actor: "athena", task: STAGE_LABELS[stage], reading: [] });
+          }
+        })
+      ).then((result) => {
+        for (const d of result.docs) ctx.recentWrites.set(d.file, d.contentHash);
+        const changed = result.docs.filter((d) => d.status !== "unchanged").map((d) => d.file);
+        const preserved = result.docs.filter((d) => d.preservedModified.length).map((d) => d.file);
+        ctx.invalidateStatus();
+        state.currentPlan = null;
+        events.emit({
+          source: "athena",
+          type: "analysis.completed",
+          level: "success",
+          message: `Analysis completed in ${((Date.now() - started) / 1e3).toFixed(1)}s \u2014 ${changed.length ? `updated ${changed.join(", ")}` : "knowledge already up to date"}`,
+          data: { changed, preserved, filesScanned: result.analysis.model.stats.filesScanned, warnings: result.analysis.model.warnings.length }
+        });
+        events.setActivity({ state: "SUCCESS", actor: "athena", task: "Analysis complete", reading: [] }, 4e3);
+      }).catch((err) => {
+        events.emit({ source: "athena", type: "analysis.failed", level: "error", message: `Analysis failed: ${err.message}` });
+        events.setActivity({ state: "ERROR", actor: "athena", task: "Analysis failed", reading: [] }, 8e3);
+      }).finally(() => {
+        state.analysisRunning = false;
+      });
+      return reply.code(202).send({ accepted: true });
+    }
+  );
+}
+
+// src/server/routes/context.ts
+var MAX_CONTEXT_CHARS = 2e5;
+function clampContextChars(raw) {
+  const n = raw ? Number(raw) : NaN;
+  return Number.isFinite(n) ? Math.min(MAX_CONTEXT_CHARS, Math.max(500, Math.floor(n))) : void 0;
+}
+function registerContextRoutes({ app, root }) {
+  app.get("/api/context", async (req) => {
+    const task = String(req.query.task ?? "").slice(0, 500);
+    return getRelevantContext(root, task, { maxChars: clampContextChars(req.query.maxChars) });
+  });
+}
+
+// src/server/routes/docs.ts
+function registerDocsRoutes(ctx) {
+  const { app, root, events } = ctx;
+  app.get("/api/docs", async () => {
+    const [docs, status] = await Promise.all([listDocs(root), ctx.getStatus().catch(() => null)]);
+    const affected = new Map(status?.affectedDocuments.map((a) => [a.file, a.reasons]) ?? []);
+    return docs.map((d) => ({ ...d, sync: syncState(d.id, d.present, affected.get(d.file)), affectedBy: affected.get(d.file) ?? [] }));
+  });
+  const withSync = async (doc) => {
+    const status = await ctx.getStatus().catch(() => null);
+    const reasons = status?.affectedDocuments.find((a) => a.file === doc.file)?.reasons;
+    return { ...doc, sync: syncState(doc.id, true, reasons), affectedBy: reasons ?? [] };
+  };
+  app.get("/api/docs/:id", async (req) => withSync(await readDoc(root, req.params.id)));
+  app.put(
+    "/api/docs/:id",
+    { schema: { body: { type: "object", required: ["content", "baseHash"], additionalProperties: false, properties: { content: { type: "string" }, baseHash: { type: ["string", "null"] } } } } },
+    async (req) => {
+      const doc = await saveDoc(root, req.params.id, req.body.content, req.body.baseHash);
+      ctx.recentWrites.set(doc.file, doc.hash);
+      ctx.invalidateStatus();
+      events.emit({ source: "web-ui", type: "knowledge.saved", level: "success", message: `Saved ${doc.file}`, data: { file: doc.file } });
+      ctx.replanSoon();
+      return withSync(doc);
+    }
+  );
+  app.get("/api/docs/:id/history", async (req) => docHistory(root, req.params.id));
+  app.get("/api/docs/:id/history/:sha", async (req) => ({ content: await docAtRevision(root, req.params.id, req.params.sha) }));
+  app.get("/api/search", async (req) => searchDocs(root, String(req.query.q ?? "").slice(0, 200)));
+}
+function syncState(id, present, affectedReasons) {
+  if (!present) return "missing";
+  if (id === "rules") return "developer-owned";
+  return affectedReasons?.length ? "may-be-outdated" : "synchronized";
+}
+
+// src/server/security.ts
+import crypto2 from "crypto";
+import os from "os";
+function generateToken() {
+  return crypto2.randomBytes(32).toString("base64url");
+}
+function tokensEqual(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  return ab.length === bb.length && crypto2.timingSafeEqual(ab, bb);
+}
+function isLoopbackHost(host) {
+  return host === "127.0.0.1" || host === "::1" || host === "localhost";
+}
+var SECURITY_HEADERS = {
+  // Scripts only from our own origin. Inline styles are required by CodeMirror and Mermaid SVG output.
+  "Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "no-referrer",
+  "Cross-Origin-Opener-Policy": "same-origin",
+  "Cross-Origin-Resource-Policy": "same-origin",
+  "Permissions-Policy": "camera=(), microphone=(), geolocation=()"
+};
+var UNSAFE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function makeGuard(opts) {
+  return async function guard(req, reply) {
+    const host = (req.headers.host ?? "").toLowerCase();
+    if (opts.allowedHosts.size && !opts.allowedHosts.has(host)) {
+      await reply.code(421).send({ error: "Host not allowed" });
+      return;
+    }
+    const url = req.url.split("?")[0];
+    if (!url.startsWith("/api/") || url === "/api/health") return;
+    const auth = req.headers.authorization ?? "";
+    const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+    if (!token || !tokensEqual(token, opts.token)) {
+      await reply.code(401).send({ error: "Unauthorized", hint: "Open the URL printed by `athena open`." });
+      return;
+    }
+    if (UNSAFE_METHODS.has(req.method)) {
+      const origin = req.headers.origin;
+      if (origin && opts.allowedOrigins.size && !opts.allowedOrigins.has(origin.toLowerCase())) {
+        await reply.code(403).send({ error: "Origin not allowed" });
+        return;
+      }
+      const ct = req.headers["content-type"] ?? "";
+      const hasBody = Number(req.headers["content-length"] ?? 0) > 0 || req.headers["transfer-encoding"];
+      if (hasBody && !ct.toLowerCase().startsWith("application/json")) {
+        await reply.code(415).send({ error: "Content-Type must be application/json" });
+        return;
+      }
+    }
+  };
+}
+var LOOPBACK_NAMES = ["127.0.0.1", "localhost", "[::1]"];
+var bracket = (h) => h.includes(":") && !h.startsWith("[") ? `[${h}]` : h;
+function allowedHostsFor(host, port, opts = {}) {
+  const names = new Set(LOOPBACK_NAMES);
+  if (!isLoopbackHost(host)) {
+    if (!opts.remote) names.clear();
+    if (host === "0.0.0.0" || host === "::") {
+      for (const list of Object.values(os.networkInterfaces())) for (const a of list ?? []) names.add(bracket(a.address));
+      names.add(os.hostname());
+    } else names.add(bracket(host));
+  }
+  for (const h of opts.extraHosts ?? []) names.add(bracket(h));
+  return new Set([...names].map((n) => `${n}:${port}`.toLowerCase()));
+}
+function allowedOriginsFor(host, port, opts = {}) {
+  return new Set([...allowedHostsFor(host, port, opts)].map((h) => `http://${h}`));
+}
+var DEFAULT_RATE_LIMIT = { perSecond: 30, burst: 120 };
+function makeRateLimiter(opts, now = Date.now) {
+  const buckets = /* @__PURE__ */ new Map();
+  const MAX_CLIENTS = 1e4;
+  return function take(key) {
+    const t = now();
+    let b = buckets.get(key);
+    if (!b) {
+      if (buckets.size >= MAX_CLIENTS) {
+        for (const [k, v] of buckets) if (v.tokens + (t - v.at) / 1e3 * opts.perSecond >= opts.burst) buckets.delete(k);
+        if (buckets.size >= MAX_CLIENTS) buckets.delete(buckets.keys().next().value);
+      }
+      b = { tokens: opts.burst, at: t };
+      buckets.set(key, b);
+    }
+    b.tokens = Math.min(opts.burst, b.tokens + (t - b.at) / 1e3 * opts.perSecond);
+    b.at = t;
+    if (b.tokens < 1) return false;
+    b.tokens -= 1;
+    return true;
+  };
+}
+
+// src/server/routes/events.ts
+function registerEventRoutes(app, hub) {
+  app.addHook("preClose", async () => {
+    hub.close();
+  });
+  app.get("/api/events", (req, reply) => {
+    if (hub.full) {
+      reply.header("Retry-After", "5");
+      reply.code(503).send({ error: "Too many open event streams", hint: "Close other Athena tabs and reload." });
+      return;
+    }
+    reply.hijack();
+    const res = reply.raw;
+    res.writeHead(200, { ...SECURITY_HEADERS, "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-store", Connection: "keep-alive", "X-Accel-Buffering": "no" });
+    const detach = hub.add({
+      write: (chunk) => res.write(chunk),
+      once: (event, listener) => res.once(event, listener),
+      end: () => {
+        res.end();
+        res.socket?.destroy();
+      }
+    });
+    req.raw.on("close", detach);
+  });
+}
+
+// src/server/routes/graph.ts
+function registerGraphRoutes({ app, root, events, state }) {
+  app.get("/api/graph", async () => ({ ...await graphSummary(root), building: state.graphBuilding }));
+  app.post("/api/graph/build", async () => {
+    if (state.graphBuilding) throw new AthenaError("The graph is already being built.", void 0, 1, "busy");
+    state.graphBuilding = true;
+    try {
+      const graph = await refreshGraph(root);
+      events.emit({ source: "web-ui", type: "graph.built", level: "success", message: `Project graph built: ${graph.stats.nodes} nodes, ${graph.stats.edges} relationships` });
+      return { built: true, builtAt: graph.builtAt, stats: graph.stats };
+    } finally {
+      state.graphBuilding = false;
+    }
+  });
+}
+
+// src/server/routes/review.ts
+function registerReviewRoutes({ app, root, scheduler }) {
+  app.get("/api/review", async (req) => {
+    const base = typeof req.query.base === "string" && req.query.base ? req.query.base : void 0;
+    return reviewChanges(root, { base, checkSync: async () => staleForCheck(await scheduler.request({ reason: "review" })).length === 0 });
+  });
+}
+
+// src/server/routes/rules.ts
+function registerRulesRoutes({ app, root, events, recentWrites }) {
+  const ruleAfter = (message) => {
+    events.emit({ source: "web-ui", type: "rules.changed", level: "success", message });
+  };
+  app.get("/api/rules", async () => getRules(root));
+  app.post(
+    "/api/rules",
+    { schema: { body: { type: "object", required: ["section", "text"], additionalProperties: false, properties: { section: { type: "string", maxLength: 200 }, text: { type: "string", maxLength: 1e3 }, baseHash: { type: "string" } } } } },
+    async (req) => {
+      const v = await rulesAdd(root, req.body.baseHash, req.body.section, req.body.text);
+      recentWrites.set("rules.md", v.hash);
+      ruleAfter(`Added rule to "${req.body.section}"`);
+      return v;
+    }
+  );
+  app.patch(
+    "/api/rules/:index",
+    { schema: { body: { type: "object", required: ["baseHash"], additionalProperties: false, properties: { text: { type: "string", maxLength: 1e3 }, enabled: { type: "boolean" }, baseHash: { type: "string" } } } } },
+    async (req) => {
+      const index = parseIndex(req.params.index);
+      const v = await rulesUpdate(root, req.body.baseHash, index, { text: req.body.text, enabled: req.body.enabled });
+      recentWrites.set("rules.md", v.hash);
+      ruleAfter(req.body.enabled === void 0 ? `Edited rule #${index}` : `${req.body.enabled ? "Enabled" : "Disabled"} rule #${index}`);
+      return v;
+    }
+  );
+  app.delete("/api/rules/:index", async (req) => {
+    const index = parseIndex(req.params.index);
+    if (!req.query.baseHash) throw new AthenaError("baseHash is required");
+    const v = await rulesRemove(root, req.query.baseHash, index);
+    recentWrites.set("rules.md", v.hash);
+    ruleAfter(`Deleted rule #${index}`);
+    return v;
+  });
+}
+function parseIndex(raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) throw new AthenaError(`Invalid rule index: ${raw.slice(0, 20)}`);
+  return n;
+}
+
+// src/server/routes/security.ts
+function registerSecurityRoutes(ctx) {
+  const { app, root, events, state, session } = ctx;
+  app.get("/api/security", async () => ({ scan: await session.scan(), running: state.scanRunning }));
+  app.post(
+    "/api/security/scan",
+    { schema: { body: { type: "object", additionalProperties: false, properties: { skipAudit: { type: "boolean" } } } } },
+    async (req, reply) => {
+      if (state.scanRunning) throw new AthenaError("A security scan is already running.", void 0, 1, "busy");
+      state.scanRunning = true;
+      let handedOff = false;
+      try {
+        const model = await session.requireModel();
+        events.emit({ source: "web-ui", type: "security.started", level: "info", message: "Security scan started" });
+        events.setActivity({ state: "REVIEWING", actor: "athena", task: "Scanning dependencies", reading: [] });
+        handedOff = true;
+        void runSecurityScan(root, model, { skipAudit: req.body?.skipAudit, onTool: (tool) => events.setActivity({ state: "REVIEWING", actor: "athena", task: `Running ${tool}`, reading: [] }) }).then(async (scan) => {
+          await saveScan(root, scan);
+          await session.remember(SCAN_FILE, scan);
+          const findings = scan.tools.reduce((n, t) => n + t.findings.length, 0);
+          events.emit({
+            source: "athena",
+            type: "security.completed",
+            level: findings || scan.secrets.count ? "warn" : "success",
+            message: `Security scan finished \u2014 ${findings} dependency finding(s), ${scan.secrets.count} potential secret(s)`,
+            data: { findings, secrets: scan.secrets.count }
+          });
+          events.setActivity({ state: "SUCCESS", actor: "athena", task: "Security scan complete", reading: [] }, 4e3);
+          ctx.replanSoon();
+        }).catch((err) => {
+          events.emit({ source: "athena", type: "security.failed", level: "error", message: `Security scan failed: ${err.message}` });
+          events.setActivity({ state: "ERROR", actor: "athena", task: "Security scan failed", reading: [] }, 8e3);
+        }).finally(() => {
+          state.scanRunning = false;
+        });
+      } finally {
+        if (!handedOff) state.scanRunning = false;
+      }
+      return reply.code(202).send({ accepted: true });
+    }
+  );
+}
+
+// src/services/overview.ts
+async function getOverview(root) {
+  const session = projectSession(root);
+  const st = await session.state();
+  if (st.kind === "missing") throw new AthenaError("Athena is not initialized in this project.", "Run `athena init`.", 3);
+  if (st.kind === "corrupted") throw new AthenaError(`.athena/state.json is corrupted (${st.reason}).`, "Run `athena analyze` to rebuild it.");
+  const state = st.state;
+  const model = await session.model();
+  const uniq = (xs) => [...new Set(xs)];
+  return {
+    athenaVersion: ATHENA_VERSION,
+    project: { name: state.projectName, description: model?.description ?? null, root },
+    analyzedAt: state.analyzedAt,
+    analysisDurationMs: state.analysisDurationMs,
+    git: { isRepo: state.git.isRepo, branch: state.git.branch ?? null, head: state.git.head ?? null },
+    summary: model && {
+      filesAnalyzed: model.stats.filesScanned,
+      languages: model.languages.slice(0, 6).map((l) => ({ name: l.name, files: l.files })),
+      frameworks: model.frameworks.map((f) => ({ name: f.name, category: f.category, root: f.root, status: f.provenance.status, confidence: f.provenance.confidence })),
+      monorepo: { isMonorepo: model.workspace.isMonorepo, tool: model.workspace.tool ?? null, packages: model.workspace.packages.length },
+      databases: uniq(model.databases.map((d) => d.name)),
+      entities: model.dbEntities.length,
+      migrations: model.migrations.reduce((n, m) => n + m.count, 0),
+      routes: model.routes.length,
+      apiSpecs: model.apiSpecs.length,
+      auth: uniq(model.auth.map((a) => a.name)),
+      testFrameworks: uniq(model.tests.frameworks.map((t) => t.name)),
+      testFiles: model.tests.testFileCount,
+      ci: uniq(model.ci.map((c2) => c2.system)),
+      containers: model.containers.dockerfiles.length + model.containers.services.length,
+      hosting: uniq(model.infrastructure.filter((i) => i.kind === "hosting").map((i) => i.name)),
+      envVars: model.env.vars.length,
+      potentialSecrets: model.security.secrets.length,
+      securityControls: model.security.controls.length,
+      warnings: model.warnings
+    }
+  };
+}
+
+// src/server/routes/session.ts
+function registerSessionRoutes({ app, root, instanceId, getStatus }) {
+  app.get("/api/health", async () => ({ ok: true, instanceId, version: ATHENA_VERSION }));
+  app.get("/api/session", async () => ({ ok: true, instanceId, version: ATHENA_VERSION, root, docs: KNOWLEDGE_DOCS, relevanceMap: RELEVANCE_MAP }));
+  app.get("/api/overview", async () => getOverview(root));
+  app.get("/api/status", async () => getStatus());
+  app.get("/api/doctor", async () => runDoctor(root));
+  app.get("/api/ai", async () => aiStatus(root));
+}
+
+// src/server/routes/static.ts
+import { promises as fs3 } from "fs";
+
+// src/server/static.ts
+import { promises as fs2 } from "fs";
+import path from "path";
+var TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".json": "application/json; charset=utf-8",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8",
+  ".map": "application/json; charset=utf-8"
+};
+async function buildAssetMap(webDir) {
+  try {
+    await fs2.access(path.join(webDir, "index.html"));
+  } catch {
+    return null;
+  }
+  const map = /* @__PURE__ */ new Map();
+  async function walk(dir) {
+    for (const ent of await fs2.readdir(dir, { withFileTypes: true })) {
+      const abs = path.join(dir, ent.name);
+      if (ent.isDirectory()) await walk(abs);
+      else if (ent.isFile()) {
+        const ext = path.extname(ent.name).toLowerCase();
+        const type = TYPES[ext];
+        if (!type) continue;
+        const urlPath = `/${path.relative(webDir, abs).split(path.sep).join("/")}`;
+        map.set(urlPath, { abs, type, immutable: urlPath.startsWith("/assets/") });
+      }
+    }
+  }
+  await walk(webDir);
+  return map;
+}
+var MISSING_UI_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Athena</title></head>
+<body style="font-family:system-ui;background:#0b0d10;color:#e6e8eb;padding:48px">
+<h1>Athena web UI assets not found</h1>
+<p>The API is running, but the UI has not been built. From the Athena repository run <code>npm run build</code>.</p>
+</body></html>`;
+
+// src/server/routes/static.ts
+function registerStaticRoutes(app, assets) {
+  const sendAsset = async (reply, urlPath) => {
+    if (!assets) return reply.code(503).type("text/html; charset=utf-8").send(MISSING_UI_HTML);
+    const asset = assets.get(urlPath) ?? assets.get("/index.html");
+    const body = await fs3.readFile(asset.abs);
+    reply.header("Cache-Control", asset.immutable ? "public, max-age=31536000, immutable" : "no-cache");
+    return reply.type(asset.type).send(body);
+  };
+  app.route({
+    method: "GET",
+    url: "/*",
+    handler: async (req, reply) => {
+      let urlPath;
+      try {
+        urlPath = decodeURIComponent(req.url.split("?")[0]);
+      } catch {
+        return reply.code(400).send("Bad request");
+      }
+      if (urlPath.startsWith("/api/")) return reply.code(404).send({ error: "Not found" });
+      if (assets && !assets.has(urlPath) && /\.[a-z0-9]+$/i.test(urlPath)) return reply.code(404).send("Not found");
+      return sendAsset(reply, urlPath === "/" ? "/index.html" : urlPath);
+    }
+  });
+}
+
+// src/server/routes/sync.ts
+import { promises as fs4 } from "fs";
+import path2 from "path";
+function summarizePlan(plan) {
+  if (!plan) return null;
+  return { ...plan, documents: plan.documents.map(({ diff: _diff, ...rest }) => rest) };
+}
+var DOC_IDS = new Set(KNOWLEDGE_DOCS.map((d) => d.id));
+var planIdSchema = { schema: { body: { type: "object", required: ["planId"], additionalProperties: false, properties: { planId: { type: "string", pattern: "^[a-f0-9]{16}$" } } } } };
+var docParamsSchema = {
+  schema: {
+    params: { type: "object", required: ["doc"], additionalProperties: false, properties: { doc: { type: "string", pattern: "^[a-z][a-z-]{0,39}$" } } },
+    querystring: { type: "object", additionalProperties: false, properties: { planId: { type: "string", pattern: "^[a-f0-9]{16}$" } } }
+  }
+};
+function registerSyncRoutes(ctx) {
+  const { app, root, events, state } = ctx;
+  app.get("/api/sync", async () => ({ watching: Boolean(state.watcher), lastCheckedAt: state.lastCheckedAt, plan: summarizePlan(state.currentPlan) }));
+  app.get("/api/sync/:doc", docParamsSchema, async (req) => {
+    const id = req.params.doc;
+    if (!DOC_IDS.has(id)) throw notFound(`Unknown document: ${id}`);
+    const plan = state.currentPlan;
+    if (req.query.planId && plan?.id !== req.query.planId) throw new AthenaError("This proposal is out of date.", "Check for changes again and review the new proposal.", 1, "conflict");
+    const doc = plan?.documents.find((d) => d.id === id);
+    if (!plan || !doc) throw notFound(`No proposed update for ${id}.`);
+    return { planId: plan.id, id: doc.id, file: doc.file, diff: doc.diff, diffTruncated: doc.diffTruncated, additions: doc.additions, deletions: doc.deletions };
+  });
+  app.post("/api/sync/check", async () => {
+    const plan = await ctx.checkNow();
+    if (!state.watcher) ctx.setPlan(plan);
+    return { watching: Boolean(state.watcher), lastCheckedAt: state.lastCheckedAt, plan: state.currentPlan, upToDate: plan?.upToDate ?? true };
+  });
+  app.post("/api/sync/apply", planIdSchema, async (req) => {
+    if (!state.currentPlan || state.currentPlan.id !== req.body.planId) throw new AthenaError("This proposal is out of date.", "Check for changes again and review the new proposal.", 1, "conflict");
+    if (state.syncBusy || state.analysisRunning) throw new AthenaError("Another update is in progress.", void 0, 1, "busy");
+    state.syncBusy = true;
+    const plan = state.currentPlan;
+    try {
+      const result = await ctx.scheduler.exclusive(() => applySync(root, plan));
+      for (const d of plan.documents) {
+        const text = await fs4.readFile(path2.join(athenaDir(root), d.file), "utf8").catch(() => null);
+        if (text !== null) ctx.recentWrites.set(d.file, contentHash(text));
+      }
+      state.currentPlan = null;
+      state.lastCheckedAt = (/* @__PURE__ */ new Date()).toISOString();
+      ctx.invalidateStatus();
+      events.emit({ source: "web-ui", type: "sync.applied", level: "success", message: `Knowledge updated: ${result.applied.join(", ")}`, data: { files: result.applied, preserved: result.preserved } });
+      events.setActivity({ state: "SUCCESS", actor: "athena", task: "Knowledge synchronized", reading: [] }, 4e3);
+      return result;
+    } catch (err) {
+      if (err instanceof AthenaError && err.kind === "conflict") ctx.replanSoon();
+      throw err;
+    } finally {
+      state.syncBusy = false;
+    }
+  });
+  app.post("/api/sync/ignore", planIdSchema, async (req) => {
+    if (!state.currentPlan || state.currentPlan.id !== req.body.planId) throw new AthenaError("This proposal is out of date.", void 0, 1, "conflict");
+    await ignorePlan(root, req.body.planId);
+    state.currentPlan = { ...state.currentPlan, ignored: true };
+    events.emit({ source: "web-ui", type: "sync.ignored", level: "info", message: `Ignored proposed update to ${state.currentPlan.documents.map((d) => d.file).join(", ")}` });
+    return { ok: true };
+  });
+}
+
+// src/server/sse.ts
+var SSE_DEFAULTS = {
+  coalesceMs: 250,
+  maxClients: 16,
+  maxPending: 100,
+  maxPendingBytes: 256 * 1024,
+  heartbeatMs: 2e4
+};
+var sseFrame = (event, data) => `event: ${event}
+data: ${JSON.stringify(data)}
+
+`;
+var SseHub = class {
+  constructor(bus, opts = {}) {
+    this.bus = bus;
+    this.opts = { ...SSE_DEFAULTS, ...opts };
+    this.unsubscribe = bus.subscribe((e) => {
+      if (e.type === "__activity") this.enqueue(sseFrame("activity", e.activity), true);
+      else this.enqueue(sseFrame("event", e), false);
+    });
+    this.heartbeat = setInterval(() => {
+      for (const c2 of this.clients.values()) if (!c2.congested) this.write(c2, ": ping\n\n");
+    }, this.opts.heartbeatMs);
+    this.heartbeat.unref();
+  }
+  bus;
+  clients = /* @__PURE__ */ new Map();
+  opts;
+  flushTimer = null;
+  heartbeat;
+  unsubscribe;
+  get size() {
+    return this.clients.size;
+  }
+  get full() {
+    return this.clients.size >= this.opts.maxClients;
+  }
+  /** Start streaming to `sink` (the current activity is sent immediately). Returns a function that detaches it. */
+  add(sink) {
+    const client = { sink, pending: [], pendingBytes: 0, activity: null, dropped: 0, congested: false };
+    this.clients.set(sink, client);
+    this.write(client, sseFrame("activity", this.bus.activity()));
+    return () => {
+      this.clients.delete(sink);
+    };
+  }
+  /** Write everything queued now (normally done by the coalescing timer). */
+  flush() {
+    if (this.flushTimer) clearTimeout(this.flushTimer);
+    this.flushTimer = null;
+    for (const c2 of this.clients.values()) if (!c2.congested) this.send(c2);
+  }
+  /** End every stream and stop listening to the bus. */
+  close() {
+    if (this.flushTimer) clearTimeout(this.flushTimer);
+    this.flushTimer = null;
+    clearInterval(this.heartbeat);
+    this.unsubscribe();
+    for (const c2 of this.clients.values()) c2.sink.end();
+    this.clients.clear();
+  }
+  enqueue(frame, isActivity) {
+    if (!this.clients.size) return;
+    for (const c2 of this.clients.values()) {
+      if (isActivity) {
+        c2.activity = frame;
+        continue;
+      }
+      c2.pending.push(frame);
+      c2.pendingBytes += frame.length;
+      while (c2.pending.length > this.opts.maxPending || c2.pendingBytes > this.opts.maxPendingBytes && c2.pending.length > 1) {
+        c2.pendingBytes -= c2.pending.shift().length;
+        c2.dropped++;
+      }
+    }
+    this.flushTimer ??= setTimeout(() => this.flush(), this.opts.coalesceMs);
+  }
+  send(c2) {
+    let out = "";
+    if (c2.dropped) {
+      out += sseFrame("resync", { dropped: c2.dropped });
+      c2.dropped = 0;
+    }
+    if (c2.pending.length) out += c2.pending.join("");
+    if (c2.activity) out += c2.activity;
+    c2.pending = [];
+    c2.pendingBytes = 0;
+    c2.activity = null;
+    if (out) this.write(c2, out);
+  }
+  write(c2, chunk) {
+    if (c2.sink.write(chunk)) return;
+    c2.congested = true;
+    c2.sink.once("drain", () => {
+      c2.congested = false;
+      if (this.clients.get(c2.sink) === c2) this.send(c2);
+    });
+  }
+};
+
+// src/server/watchers.ts
+import { promises as fs5, watch } from "fs";
+import path3 from "path";
+function watchKnowledgeDir(ctx, feed) {
+  const { events, recentWrites } = ctx;
+  let docsWatcher = null;
+  const pending = /* @__PURE__ */ new Map();
+  try {
+    const dir = athenaDir(ctx.root);
+    docsWatcher = watch(dir, { persistent: false }, (_type, filename) => {
+      const name = filename?.toString();
+      if (name === ACTIVITY_FILE) {
+        void feed.readNew();
+        return;
+      }
+      if (name === "state.json") {
+        ctx.invalidateStatus();
+        return;
+      }
+      if (!name || !KNOWLEDGE_DOCS.some((d) => d.file === name)) return;
+      clearTimeout(pending.get(name));
+      pending.set(
+        name,
+        setTimeout(async () => {
+          pending.delete(name);
+          const text = await fs5.readFile(path3.join(dir, name), "utf8").catch(() => null);
+          const hash = text === null ? null : contentHash(text);
+          if (hash && recentWrites.get(name) === hash) return;
+          ctx.invalidateStatus();
+          events.emit({ source: "filesystem", type: "knowledge.external-change", level: "info", message: text === null ? `${name} was deleted on disk` : `${name} changed on disk`, data: { file: name, hash } });
+        }, 150)
+      );
+    });
+    docsWatcher.on("error", () => {
+    });
+  } catch {
+    docsWatcher = null;
+  }
+  return () => {
+    docsWatcher?.close();
+    for (const t of pending.values()) clearTimeout(t);
+  };
+}
+async function watchProjectFiles(ctx, debounceMs) {
+  const { events, state } = ctx;
+  try {
+    state.watcher = await watchProject(ctx.root, {
+      debounceMs,
+      scheduler: ctx.scheduler,
+      onEvent: (e) => {
+        switch (e.type) {
+          case "changes":
+            ctx.invalidateStatus();
+            break;
+          case "planning":
+            if (!state.analysisRunning) events.setActivity({ state: "ANALYZING", actor: "athena", task: e.paths?.length ? `Checking ${e.paths.length} changed file${e.paths.length === 1 ? "" : "s"}` : "Checking for changes", reading: [] });
+            break;
+          case "plan": {
+            const plan = e.plan;
+            const prevId = state.currentPlan?.id;
+            ctx.setPlan(plan);
+            if (!state.analysisRunning) events.setActivity({ state: "IDLE", actor: "none", task: null, reading: [] });
+            if (!plan.upToDate && !plan.ignored && plan.id !== prevId) {
+              events.emit({ source: "athena", type: "sync.proposed", level: "warn", message: `Knowledge update proposed for ${plan.documents.map((d) => d.file).join(", ")}`, data: { planId: plan.id, files: plan.documents.map((d) => d.file) } });
+            }
+            if (plan.upToDate && prevId) events.emit({ source: "athena", type: "sync.up-to-date", level: "info", message: "Proposal no longer needed \u2014 knowledge is up to date" });
+            break;
+          }
+          case "refreshed":
+            ctx.setPlan(null);
+            ctx.invalidateStatus();
+            if (!state.analysisRunning) events.setActivity({ state: "IDLE", actor: "none", task: null, reading: [] });
+            events.emit({ source: "athena", type: "sync.up-to-date", level: "info", message: "Files changed \u2014 knowledge already up to date (index refreshed)" });
+            break;
+          case "git-head":
+            ctx.invalidateStatus();
+            events.emit({ source: "filesystem", type: "git.head", level: "info", message: `Git HEAD moved ${e.head?.from?.slice(0, 8) ?? "?"} \u2192 ${e.head?.to?.slice(0, 8) ?? "?"}` });
+            break;
+          case "error":
+            if (!state.analysisRunning) events.setActivity({ state: "ERROR", actor: "athena", task: "Change check failed", reading: [] }, 6e3);
+            events.emit({ source: "athena", type: "sync.error", level: "error", message: `Change check failed: ${e.error?.message ?? "unknown error"}` });
+            break;
+          default:
+            break;
+        }
+      }
+    });
+    void state.watcher.planNow();
+  } catch (err) {
+    events.emit({ source: "athena", type: "sync.error", level: "error", message: `File watching unavailable: ${err.message}` });
+  }
+}
+
+// src/server/app.ts
+var STATUS = {
+  invalid: 400,
+  "not-found": 404,
+  conflict: 409,
+  "not-initialized": 409,
+  busy: 423,
+  unprocessable: 422,
+  forbidden: 403,
+  internal: 500
+};
+async function createServer(opts) {
+  const root = opts.root;
+  const events = new EventBus();
+  const instanceId = crypto3.randomUUID();
+  const app = Fastify({
+    logger: opts.logger ?? false,
+    bodyLimit: 2 * 1024 * 1024,
+    trustProxy: false,
+    // Hijacked SSE responses would otherwise keep close() waiting forever.
+    forceCloseConnections: true,
+    // Strict validation: no type coercion, reject (don't silently strip) unknown fields.
+    ajv: { customOptions: { coerceTypes: false, removeAdditional: false, allErrors: false } }
+  });
+  const assets = await buildAssetMap(opts.webDir);
+  const takeToken = makeRateLimiter(opts.rateLimit ?? DEFAULT_RATE_LIMIT);
+  app.addHook("onRequest", async (req, reply) => {
+    if (!req.url.startsWith("/api/")) return;
+    if (!takeToken(req.ip || "unknown")) {
+      reply.header("Retry-After", "1");
+      await reply.code(429).send({ error: "Too many requests" });
+    }
+  });
+  app.addHook("onRequest", makeGuard({
+    token: opts.token,
+    allowedHosts: allowedHostsFor(opts.host, opts.port, { remote: opts.allowRemote }),
+    allowedOrigins: allowedOriginsFor(opts.host, opts.port, { remote: opts.allowRemote })
+  }));
+  app.addHook("onSend", async (req, reply, payload) => {
+    for (const [k, v] of Object.entries(SECURITY_HEADERS)) reply.header(k, v);
+    if (req.url.startsWith("/api/")) reply.header("Cache-Control", "no-store");
+    return payload;
+  });
+  app.setErrorHandler((err, _req, reply) => {
+    if (err instanceof AthenaError) {
+      return reply.code(STATUS[err.kind]).send({ error: err.message, hint: err.hint, kind: err.kind, details: err.details });
+    }
+    const e = err;
+    if (e.statusCode && e.statusCode < 500) return reply.code(e.statusCode).send({ error: e.message });
+    app.log.error(err);
+    return reply.code(500).send({ error: "Internal error" });
+  });
+  const ctx = createServerContext({ app, root, events, instanceId });
+  const feed = createAgentActivityFeed(ctx);
+  const hub = new SseHub(events, opts.sse);
+  registerSessionRoutes(ctx);
+  registerDocsRoutes(ctx);
+  registerRulesRoutes(ctx);
+  registerAgentRoutes(ctx);
+  registerAnalysisRoutes(ctx);
+  registerSyncRoutes(ctx);
+  registerSecurityRoutes(ctx);
+  registerReviewRoutes(ctx);
+  registerContextRoutes(ctx);
+  registerGraphRoutes(ctx);
+  registerActivityRoutes(ctx);
+  registerEventRoutes(app, hub);
+  registerStaticRoutes(app, assets);
+  const stopDocsWatcher = watchKnowledgeDir(ctx, feed);
+  await feed.seed();
+  if (opts.watch) await watchProjectFiles(ctx, opts.watchDebounceMs);
+  return {
+    app,
+    events,
+    instanceId,
+    scheduler: ctx.scheduler,
+    async close() {
+      await ctx.state.watcher?.close();
+      ctx.state.watcher = null;
+      ctx.scheduler.close();
+      stopDocsWatcher();
+      events.close();
+      await app.close();
+      hub.close();
+      releaseProjectSession(root);
+    }
+  };
+}
+
+// src/server/port.ts
+import net from "net";
+var DEFAULT_PORT = 7432;
+function isPortFree(port, host) {
+  return new Promise((resolve) => {
+    const srv = net.createServer();
+    srv.unref();
+    srv.once("error", () => resolve(false));
+    srv.listen({ port, host, exclusive: true }, () => srv.close(() => resolve(true)));
+  });
+}
+async function findAvailablePort(host, start = DEFAULT_PORT, attempts = 100) {
+  for (let p = start; p < start + attempts && p <= 65535; p++) {
+    if (await isPortFree(p, host)) return p;
+  }
+  throw new Error(`No free port found in ${start}-${start + attempts - 1} on ${host}`);
+}
+
+// src/server/instance.ts
+function defaultWebDir() {
+  const here = path4.dirname(fileURLToPath(import.meta.url));
+  return path4.basename(here) === "dist" ? path4.join(here, "web") : path4.resolve(here, "../../dist/web");
+}
+function browserUrl(info) {
+  const host = info.host.includes(":") ? `[${info.host}]` : info.host;
+  return `http://${host}:${info.port}/#token=${info.token}`;
+}
+async function startServer(opts) {
+  const host = opts.host ?? "127.0.0.1";
+  if (!isLoopbackHost(host) && !opts.allowRemote) {
+    throw new Error(`Refusing to bind to non-loopback address ${host} without --allow-remote.`);
+  }
+  const port = opts.port ?? await findAvailablePort(host, DEFAULT_PORT);
+  const token = generateToken();
+  const server = await createServer({ root: opts.root, token, host, port, webDir: opts.webDir ?? defaultWebDir(), allowRemote: opts.allowRemote, watch: opts.watch ?? true });
+  await server.app.listen({ host, port });
+  const info = { pid: process.pid, host, port, instanceId: server.instanceId, token, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const file = path4.join(athenaDir(opts.root), INSTANCE_FILE);
+  await fs6.writeFile(file, `${JSON.stringify(info, null, 2)}
+`, { mode: 384 });
+  await ensureGitignored(opts.root, INSTANCE_FILE);
+  return {
+    server,
+    info,
+    url: browserUrl(info),
+    async close() {
+      const current = await readTextIfExists(file);
+      if (current && current.includes(server.instanceId)) await fs6.rm(file, { force: true });
+      await server.close();
+    }
+  };
+}
+async function ensureGitignored(root, entry) {
+  const file = path4.join(athenaDir(root), ".gitignore");
+  const text = await readTextIfExists(file) ?? "";
+  if (text.split(/\r?\n/).includes(entry)) return;
+  await fs6.writeFile(file, `${text}${text.endsWith("\n") || !text ? "" : "\n"}${entry}
+`);
+}
+
+// src/cli/commands/open.ts
+function openBrowser(url) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  const child = execFile(cmd, args, { windowsHide: true }, () => {
+  });
+  child.on("error", () => {
+  });
+  child.unref();
+}
+async function openCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  const shouldOpen = opts.open !== false;
+  const existing = await findRunningInstance(root);
+  if (existing) {
+    const url = browserUrl(existing);
+    if (isJson()) json({ running: true, reused: true, url, port: existing.port, pid: existing.pid });
+    else {
+      ok(`Athena is already running for this project ${dim(`(pid ${existing.pid})`)}`);
+      line();
+      line(`Local: ${c.cyan(url)}`);
+    }
+    if (shouldOpen) openBrowser(url);
+    return;
+  }
+  let port;
+  if (opts.port !== void 0) {
+    port = Number(opts.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new AthenaError(`Invalid port: ${opts.port}`);
+  }
+  const host = opts.host ?? "127.0.0.1";
+  let running;
+  try {
+    running = await startServer({ root, host, port, allowRemote: opts.allowRemote, watch: opts.watch !== false });
+  } catch (err) {
+    const e = err;
+    if (e.code === "EADDRINUSE") throw new AthenaError(`Port ${port} is already in use.`, "Omit --port to pick a free port automatically.");
+    throw new AthenaError(e.message);
+  }
+  if (isJson()) json({ running: true, reused: false, url: running.url, port: running.info.port, pid: process.pid });
+  else {
+    printHeader();
+    line(c.bold(c.green("Athena is running")));
+    line();
+    line(`Local: ${c.cyan(running.url)}`);
+    if (opts.allowRemote) {
+      warn(c.yellow(`Bound to ${host} \u2014 reachable from other machines. The access token in the URL is required for every API call.`));
+      warn(c.yellow("This is plain HTTP: the token and your project knowledge cross the network unencrypted. Use it only on a network you trust, or put a TLS proxy / SSH tunnel in front. Requests must use this machine's address (Host header allowlist)."));
+    }
+    line();
+    line(dim(opts.watch === false ? "File watching is off." : "Watching for changes \u2014 knowledge updates are proposed in the UI, never applied without your review."));
+    line(dim("The link contains a private access token. Press Ctrl+C to stop."));
+  }
+  if (shouldOpen) openBrowser(running.url);
+  setInterruptMessage("Stopping Athena server...");
+  await new Promise((resolve) => {
+    if (opts.signal.aborted) resolve();
+    opts.signal.addEventListener("abort", () => resolve(), { once: true });
+  });
+  await running.close();
+  if (!isJson()) line(dim("Athena server stopped."));
+}
+export {
+  openBrowser,
+  openCommand
+};
+//# sourceMappingURL=open-2QSZKKUG.js.map