project-knowledge 0.1.0 → 1.0.1

package/_site/server.js

@@ -15,19 +15,30 @@ const { applyDrafts, rejectDrafts, readDraftContent } = require('./lib/draft-app
 const { runJob, makeJob, readJobLog, KNOWN_MODES } = require('./lib/job-orchestrator');
 const { validateKb, buildPrContextPack } = require('./lib/kb-validator');
 const { installHook, uninstallHook, readHookStatus } = require('./lib/hook-manager');
+const { completeText, readConfig: readLlmConfig } = require('./lib/llm-client');
+const claudeCliRunner = require('./lib/claude-cli-runner');
+const promptRegistry = require('./lib/prompt-registry');
+const knowledgeStore = require('./lib/knowledge-store');
+const structuredLogger = require('./lib/structured-logger');
+const supervision = require('./lib/supervision');
+const aiWorkspace = require('./lib/ai-workspace');
+const kbV3 = require('./lib/kb-v3');
 
 const KB_ROOT = path.resolve(__dirname, '..');
 const SITE_ROOT = __dirname;
 const PORT = parseInt(process.env.KB_SITE_PORT || '7777', 10);
 const HOST = process.env.KB_SITE_HOST || '127.0.0.1';
 const TASK_NAME = 'KB-GitCommits-Daily';
-const SCRIPT = 'D:\\SanQian.Xu\\project-knowledge-base\\scripts\\gen-commit-doc.ps1';
-const SAFE_RUNNER = 'D:\\SanQian.Xu\\project-knowledge-base\\_site\\scripts\\safe-runner.js';
-const PROJECT_SCHEMA_VERSION = 'v1';
+const SCRIPT = path.join(KB_ROOT, 'scripts', 'gen-commit-doc.ps1');
+const SAFE_RUNNER = path.join(SITE_ROOT, 'scripts', 'safe-runner.js');
+const PROJECT_SCHEMA_VERSION = 'v3';
 const DEFAULT_AI_PROFILE_ID = 'mock-agent';
 const DEFAULT_KNOWLEDGE_LANGUAGE = 'zh-CN';
+const PROJECTS_PATH = path.join(KB_ROOT, 'projects.json');
 const AI_PROFILES_PATH = path.join(KB_ROOT, 'ai-profiles.json');
 const JOBS_LOG_PATH = path.join(KB_ROOT, '.jobs-log.json');
+const KNOWLEDGE_STORE_PATH = path.join(KB_ROOT, 'knowledge-store.json');
+const LOGGING_CONFIG_PATH = path.join(KB_ROOT, 'logging.json');
 
 // ---- state ----
 let lastRun = { time: null, status: null, slug: null, output: '' };
@@ -36,7 +47,7 @@ const runningJobs = new Map();
 // Read a fresh copy of projects.json (re-loaded on every dispatch so that
 // background jobs see the latest registry state).
 function readProjectsForJob() {
-  return JSON.parse(fs.readFileSync(path.join(KB_ROOT, 'projects.json'), 'utf-8'));
+  return readProjects({ persistMigrations: true });
 }
 
 // ---- helpers ----
@@ -67,9 +78,43 @@ function readJson(p) {
 }
 
 function writeJson(p, obj) {
+  fs.mkdirSync(path.dirname(p), { recursive: true });
   fs.writeFileSync(p, JSON.stringify(obj, null, 2) + '\n', 'utf-8');
 }
 
+function backupInvalidJson(filePath, raw) {
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const backupPath = `${filePath}.invalid-${stamp}.bak`;
+  try {
+    fs.writeFileSync(backupPath, raw, 'utf-8');
+  } catch {}
+  return backupPath;
+}
+
+function readJsonOrDefault(filePath, defaultValue, options = {}) {
+  const { persistDefault = true, backupInvalid = true } = options;
+  let raw = '';
+  try {
+    raw = fs.readFileSync(filePath, 'utf-8');
+  } catch (error) {
+    if (error && error.code !== 'ENOENT') throw error;
+    if (persistDefault) writeJson(filePath, defaultValue);
+    return defaultValue;
+  }
+  if (!raw.trim()) {
+    if (persistDefault) writeJson(filePath, defaultValue);
+    return defaultValue;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    const backupPath = backupInvalid ? backupInvalidJson(filePath, raw) : '';
+    if (persistDefault) writeJson(filePath, defaultValue);
+    console.warn(`[project-knowledge] Recovered invalid JSON at ${filePath}${backupPath ? `; backup: ${backupPath}` : ''}`);
+    return defaultValue;
+  }
+}
+
 function isSafeSlug(s) { return typeof s === 'string' && /^[a-z0-9][a-z0-9-]{0,40}$/.test(s); }
 
 function normalizeKnowledgeLanguage(value) {
@@ -77,7 +122,30 @@ function normalizeKnowledgeLanguage(value) {
 }
 
 function defaultProjectKbPath(slug) {
-  return path.join(KB_ROOT, 'projects', slug);
+  return knowledgeStore.defaultProjectKbPath(slug, KNOWLEDGE_STORE_PATH, KB_ROOT);
+}
+
+function readKnowledgeStore() {
+  return knowledgeStore.readConfig(KNOWLEDGE_STORE_PATH, KB_ROOT);
+}
+
+function readLoggingConfig() {
+  return structuredLogger.readConfig(LOGGING_CONFIG_PATH, KB_ROOT);
+}
+
+function logEvent(level, event, message, meta = {}) {
+  try {
+    structuredLogger.appendLog(LOGGING_CONFIG_PATH, KB_ROOT, {
+      level,
+      event,
+      message,
+      projectSlug: meta.projectSlug || meta.slug || '',
+      source: meta.source || 'server',
+      jobId: meta.jobId || '',
+      runId: meta.runId || '',
+      meta,
+    });
+  } catch {}
 }
 
 function isLegacyKbPath(value) {
@@ -85,19 +153,58 @@ function isLegacyKbPath(value) {
 }
 
 // ---- AI profiles (TASK-005) ----
-function readAiProfiles() {
-  if (!fs.existsSync(AI_PROFILES_PATH)) {
-    return { schema: 'ai-profiles/v1', defaultProfileId: DEFAULT_AI_PROFILE_ID, profiles: listAdapters().map(a => ({
-      id: a.id, name: a.name, description: a.description, enabled: a.id !== 'claude-code-agent', implementation: a.id,
+function defaultAiProfilesConfig() {
+  return { schema: 'ai-profiles/v1', defaultProfileId: DEFAULT_AI_PROFILE_ID, profiles: listAdapters().map(a => ({
+      id: a.id,
+      name: a.name,
+      description: a.description,
+      enabled: a.id !== 'claude-code-agent',
+      implementation: a.id,
+      ...(a.id === 'claude-code-agent' ? {
+        baseUrl: 'https://api.anthropic.com',
+        apiKey: '',
+        model: 'claude-haiku-4-5',
+        version: '2023-06-01',
+        temperature: 0.2,
+        maxTokens: 4096,
+        timeoutMs: 300000,
+      } : {}),
     })) };
-  }
-  return JSON.parse(fs.readFileSync(AI_PROFILES_PATH, 'utf-8'));
+}
+
+function readAiProfiles() {
+  return readJsonOrDefault(AI_PROFILES_PATH, defaultAiProfilesConfig(), {
+    persistDefault: true,
+    backupInvalid: true,
+  });
 }
 
 function writeAiProfiles(cfg) {
   writeJson(AI_PROFILES_PATH, cfg);
 }
 
+function findAiProfile(profileId, cfg = readAiProfiles()) {
+  return (cfg.profiles || []).find(item => item && item.id === profileId) || null;
+}
+
+function profileImplementation(profile) {
+  return profile && (profile.implementation || profile.id);
+}
+
+function validateUsableAiProfile(profileId) {
+  if (!profileId) return { ok: false, status: 400, error: 'aiProfileId required' };
+  const profile = findAiProfile(profileId);
+  if (!profile && profileId === DEFAULT_AI_PROFILE_ID && getAdapter(DEFAULT_AI_PROFILE_ID)) {
+    return { ok: true, profile: { id: DEFAULT_AI_PROFILE_ID, enabled: true, implementation: DEFAULT_AI_PROFILE_ID }, implementation: DEFAULT_AI_PROFILE_ID, adapter: getAdapter(DEFAULT_AI_PROFILE_ID) };
+  }
+  if (!profile) return { ok: false, status: 400, error: `AI profile not configured: ${profileId}` };
+  const implementation = profileImplementation(profile);
+  const adapter = getAdapter(implementation);
+  if (!adapter) return { ok: false, status: 400, error: `unknown adapter: ${implementation}` };
+  if (profile.enabled === false) return { ok: false, status: 400, error: `AI profile disabled: ${profileId}` };
+  return { ok: true, profile, implementation, adapter };
+}
+
 function validateProfileConfig(cfg) {
   const errors = [];
   if (!cfg || typeof cfg !== 'object') return ['not an object'];
@@ -109,9 +216,21 @@ function validateProfileConfig(cfg) {
     if (!p.id) { errors.push(`profiles[${i}] missing id`); continue; }
     if (ids.has(p.id)) errors.push(`duplicate id: ${p.id}`);
     ids.add(p.id);
-    if (!getAdapter(p.id)) errors.push(`unknown adapter id: ${p.id}`);
+    const implementation = profileImplementation(p);
+    if (!implementation || typeof implementation !== 'string') errors.push(`profiles[${i}].implementation must be a string`);
+    else if (!getAdapter(implementation)) errors.push(`unknown adapter implementation: ${implementation}`);
+    if (p.baseUrl && typeof p.baseUrl !== 'string') errors.push(`profiles[${i}].baseUrl must be a string`);
+    if (p.apiKey && typeof p.apiKey !== 'string') errors.push(`profiles[${i}].apiKey must be a string`);
+    if (p.apiKeyEnv && typeof p.apiKeyEnv !== 'string') errors.push(`profiles[${i}].apiKeyEnv must be a string`);
+    if (p.model && typeof p.model !== 'string') errors.push(`profiles[${i}].model must be a string`);
+    if (p.version && typeof p.version !== 'string') errors.push(`profiles[${i}].version must be a string`);
+    if (p.temperature != null && (typeof p.temperature !== 'number' || p.temperature < 0 || p.temperature > 2)) errors.push(`profiles[${i}].temperature must be a number between 0 and 2`);
+    if (p.maxTokens != null && (!Number.isInteger(p.maxTokens) || p.maxTokens < 1)) errors.push(`profiles[${i}].maxTokens must be a positive integer`);
+    if (p.timeoutMs != null && (!Number.isInteger(p.timeoutMs) || p.timeoutMs < 1000)) errors.push(`profiles[${i}].timeoutMs must be an integer >= 1000`);
   }
   if (cfg.defaultProfileId && !ids.has(cfg.defaultProfileId)) errors.push(`defaultProfileId not in profiles: ${cfg.defaultProfileId}`);
+  const defaultProfile = cfg.defaultProfileId ? (cfg.profiles || []).find(p => p && p.id === cfg.defaultProfileId) : null;
+  if (defaultProfile && defaultProfile.enabled === false) errors.push(`defaultProfileId is disabled: ${cfg.defaultProfileId}`);
   return errors;
 }
 
@@ -162,11 +281,13 @@ function normalizeProjects(rawProjects) {
 }
 
 function readProjects(options = {}) {
-  const projectsPath = path.join(KB_ROOT, 'projects.json');
-  const rawProjects = readJson(projectsPath);
+  const rawProjects = readJsonOrDefault(PROJECTS_PATH, {}, {
+    persistDefault: true,
+    backupInvalid: true,
+  });
   const result = normalizeProjects(rawProjects);
   if (options.persistMigrations && result.changed) {
-    writeJson(projectsPath, result.projects);
+    writeJson(PROJECTS_PATH, result.projects);
   }
   return result.projects;
 }
@@ -192,6 +313,82 @@ function listSubTree(root, prefix, depth, max) {
   return out;
 }
 
+function dirStats(root) {
+  const result = { fileCount: 0, kbSizeBytes: 0 };
+  if (!root || !fs.existsSync(root)) return result;
+  const walk = (dir) => {
+    let entries = [];
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile()) {
+        result.fileCount += 1;
+        try { result.kbSizeBytes += fs.statSync(full).size; } catch {}
+      }
+    }
+  };
+  walk(root);
+  return result;
+}
+
+function hasRunningProjectJob(slug) {
+  for (const job of runningJobs.values()) {
+    if (!job || job.status !== 'running') continue;
+    if (job.slug === slug || job.slug === 'ALL') return true;
+  }
+  return false;
+}
+
+function allowedKbDeletionRootPaths() {
+  const cfg = readKnowledgeStore();
+  return [
+    path.join(KB_ROOT, 'projects'),
+    cfg.rootPath,
+  ].filter(Boolean).map(p => path.resolve(p));
+}
+
+function validateKbDeletionPath(kbPath) {
+  if (!kbPath || typeof kbPath !== 'string') return { ok: false, error: 'kbPath is required' };
+  if (!path.isAbsolute(kbPath)) return { ok: false, error: 'kbPath must be absolute' };
+  const resolved = path.resolve(kbPath);
+  const roots = allowedKbDeletionRootPaths();
+  for (const root of roots) {
+    if (resolved !== root && knowledgeStore.isInside(resolved, root)) {
+      return { ok: true, path: resolved, root };
+    }
+  }
+  return { ok: false, path: resolved, error: 'kbPath is outside configured knowledge roots' };
+}
+
+function removeKnowledgeStoreProjectOverride(slug) {
+  if (!fs.existsSync(KNOWLEDGE_STORE_PATH)) return;
+  let cfg;
+  try { cfg = JSON.parse(fs.readFileSync(KNOWLEDGE_STORE_PATH, 'utf-8')); } catch { return; }
+  if (cfg && cfg.projectOverrides && Object.prototype.hasOwnProperty.call(cfg.projectOverrides, slug)) {
+    delete cfg.projectOverrides[slug];
+    writeJson(KNOWLEDGE_STORE_PATH, cfg);
+  }
+}
+
+function projectRemovePreview(slug, cfg) {
+  const kbPath = path.resolve(cfg.kbPath || defaultProjectKbPath(slug));
+  const stats = dirStats(kbPath);
+  const hook = readHookStatus({ repoPath: cfg.gitPath || cfg.localPath || '' });
+  return {
+    slug,
+    displayName: cfg.displayName || slug,
+    kbPath,
+    kbExists: fs.existsSync(kbPath),
+    kbSizeBytes: stats.kbSizeBytes,
+    fileCount: stats.fileCount,
+    hasRunningJobs: hasRunningProjectJob(slug),
+    hookInstalled: hook.installed === true,
+    kbManagedHook: hook.kbManaged === true,
+    isReference: cfg.isReference === true,
+  };
+}
+
 function shellEscape(s) {
   return '"' + String(s).replace(/"/g, '""').replace(/`/g, '``') + '"';
 }
@@ -308,6 +505,7 @@ function startJob({ mode, slug }) {
   if (!KNOWN_MODES.has(mode)) return { ok: false, status: 400, error: `unknown mode: ${mode}` };
   const job = makeJob({ mode, slug: slug || 'ALL' });
   runningJobs.set(job.jobId, job);
+  logEvent('info', 'job_started', `${job.mode} job started`, { source: 'job-orchestrator', jobId: job.jobId, projectSlug: job.slug, mode: job.mode });
   // Run the job in the background so the HTTP request returns immediately.
   // The job orchestrator updates `job` in place; the route handler returns
   // just the jobId so the UI can poll.
@@ -320,14 +518,18 @@ function startJob({ mode, slug }) {
         projectsPath: path.join(KB_ROOT, 'projects.json'),
         jobsLogPath: JOBS_LOG_PATH,
         writeProjects: () => writeJson(path.join(KB_ROOT, 'projects.json'), projects),
+        defaultProjectKbPath,
+        log: (level, event, message, meta = {}) => logEvent(level, event, message, { ...meta, source: meta.source || 'job-orchestrator', jobId: job.jobId, projectSlug: meta.projectSlug || job.slug }),
       });
     } catch (e) {
       job.status = 'failed';
       job.endTime = new Date().toISOString();
       job.exitCode = 1;
       job.output += `\n[dispatch error] ${e.message}\n${e.stack || ''}`;
+      logEvent('error', 'job_dispatch_failed', e.message, { source: 'job-orchestrator', jobId: job.jobId, projectSlug: job.slug });
     } finally {
       lastRun = { time: job.endTime, status: job.status, slug: job.slug, mode: job.mode, output: (job.output || '').slice(-6000) };
+      logEvent(job.status === 'success' ? 'info' : 'warn', 'job_finished', `${job.mode} job ${job.status}`, { source: 'job-orchestrator', jobId: job.jobId, projectSlug: job.slug, mode: job.mode, status: job.status });
       // Keep the live record for 10 minutes so the UI can poll completion.
       setTimeout(() => runningJobs.delete(job.jobId), 10 * 60 * 1000);
     }
@@ -431,6 +633,203 @@ async function validateAndPersistProject(slug, projects) {
   return { ok: true, slug, inspection };
 }
 
+async function projectImportPreflight({ localPath, gitPath }) {
+  const targetPath = gitPath || localPath;
+  const result = {
+    ok: false,
+    localPath: localPath || '',
+    gitPath: targetPath || '',
+    exists: false,
+    canImport: false,
+    needsGitInit: false,
+    canInitGit: false,
+    inspection: null,
+    error: null,
+  };
+  if (!targetPath) {
+    result.error = 'localPath or gitPath is required';
+    return result;
+  }
+  result.exists = fs.existsSync(targetPath);
+  if (!result.exists) {
+    result.error = `path not found: ${targetPath}`;
+    return result;
+  }
+  const stat = fs.statSync(targetPath);
+  if (!stat.isDirectory()) {
+    result.error = `path is not a directory: ${targetPath}`;
+    return result;
+  }
+  const inspection = await inspectGit(targetPath);
+  result.inspection = inspection;
+  result.canImport = ['ok', 'empty'].includes(inspection.repoStatus);
+  result.needsGitInit = inspection.repoStatus === 'not-git';
+  result.canInitGit = result.needsGitInit;
+  result.ok = result.canImport || result.canInitGit;
+  if (!result.ok) result.error = inspection.error || 'project cannot be imported';
+  return result;
+}
+
+async function initializeLocalGit({ repoPath, createInitialCommit = false, remoteUrl = '' }) {
+  const result = {
+    ok: false,
+    repoPath: repoPath || '',
+    initialized: false,
+    initialCommit: false,
+    remoteConfigured: false,
+    inspection: null,
+    steps: [],
+    error: null,
+  };
+  if (!repoPath || !fs.existsSync(repoPath) || !fs.statSync(repoPath).isDirectory()) {
+    result.error = 'repoPath must be an existing directory';
+    return result;
+  }
+  let inspection = await inspectGit(repoPath);
+  if (inspection.repoStatus === 'not-git') {
+    const init = await execGit(repoPath, ['init']);
+    result.steps.push({ step: 'git init', ok: init.ok, stderr: init.stderr });
+    if (!init.ok) {
+      result.error = init.stderr || init.error || 'git init failed';
+      return result;
+    }
+    result.initialized = true;
+  }
+  await execGit(repoPath, ['config', 'user.name', 'Project Knowledge Base']);
+  await execGit(repoPath, ['config', 'user.email', 'project-knowledge-base@example.local']);
+  await execGit(repoPath, ['config', 'commit.gpgsign', 'false']);
+
+  inspection = await inspectGit(repoPath);
+  if (createInitialCommit && inspection.repoStatus === 'empty') {
+    const add = await execGit(repoPath, ['add', '-A'], 30000);
+    result.steps.push({ step: 'git add -A', ok: add.ok, stderr: add.stderr });
+    if (!add.ok) {
+      result.error = add.stderr || add.error || 'git add failed';
+      return result;
+    }
+    const commit = await execGit(repoPath, ['commit', '-m', 'chore: initial import'], 30000);
+    result.steps.push({ step: 'git commit', ok: commit.ok, stderr: commit.stderr });
+    if (!commit.ok) {
+      result.error = commit.stderr || commit.error || 'git commit failed';
+      return result;
+    }
+    result.initialCommit = true;
+  }
+
+  if (remoteUrl && String(remoteUrl).trim()) {
+    const remote = await execGit(repoPath, ['remote', 'get-url', 'origin']);
+    const args = remote.ok ? ['remote', 'set-url', 'origin', remoteUrl.trim()] : ['remote', 'add', 'origin', remoteUrl.trim()];
+    const setRemote = await execGit(repoPath, args);
+    result.steps.push({ step: args.join(' '), ok: setRemote.ok, stderr: setRemote.stderr });
+    if (!setRemote.ok) {
+      result.error = setRemote.stderr || setRemote.error || 'git remote setup failed';
+      return result;
+    }
+    result.remoteConfigured = true;
+  }
+
+  result.inspection = await inspectGit(repoPath);
+  result.ok = ['ok', 'empty'].includes(result.inspection.repoStatus);
+  if (!result.ok) result.error = result.inspection.error || 'git initialization did not produce a usable repository';
+  return result;
+}
+
+async function runKnowledgeUpdate(slug) {
+  const projects = readProjects({ persistMigrations: true });
+  if (!projects[slug]) return { ok: false, status: 404, error: 'Slug not in projects.json' };
+  const project = projects[slug];
+  const kbPath = project.kbPath || defaultProjectKbPath(slug);
+  if (!fs.existsSync(kbPath) || !fs.existsSync(path.join(kbPath, 'README.md'))) {
+    const init = initProjectDirs(slug, kbPath);
+    project.kbSchemaVersion = init.kbSchemaVersion || 'v3';
+    logEvent('info', 'kb_initialized', 'Knowledge base initialized before update.', { source: 'knowledge-update', projectSlug: slug, kbPath });
+    init.created = init.created || [];
+  }
+
+  const scanResult = await scanAndPersistProject(slug, projects, { maxCommits: 200 });
+  if (!scanResult.ok) return scanResult;
+  const scan = scanResult.scan;
+  if (scan.repoStatus !== 'ok') {
+    writeJson(path.join(KB_ROOT, 'projects.json'), projects);
+    logEvent('error', 'knowledge_update_blocked', `Knowledge update blocked: git status ${scan.repoStatus}`, { source: 'knowledge-update', projectSlug: slug, repoStatus: scan.repoStatus, error: scan.error });
+    return { ok: false, status: 400, slug, stage: 'scan', scan, error: scan.error || `git status ${scan.repoStatus}` };
+  }
+
+  const isV3 = project.kbSchemaVersion === 'v3' || fs.existsSync(path.join(kbPath, 'GOAL.md'));
+  const goalPath = path.join(kbPath, isV3 ? 'GOAL.md' : 'project-goal.md');
+  const needsInitial = project.goalStatus !== 'accepted' || !fs.existsSync(goalPath) || !project.lastAnalyzedCommit;
+  let analysis = null;
+  let applyResult = null;
+  let validation = null;
+  let reviewRequired = false;
+  let reviewReason = '';
+
+  if (needsInitial) {
+    analysis = await runInitialAnalysis({ slug, ...project, kbPath });
+    reviewRequired = true;
+    reviewReason = 'initial analysis may create or update project-goal.md';
+    logEvent(analysis.ok ? 'warn' : 'error', analysis.ok ? 'initial_analysis_review_required' : 'initial_analysis_failed', analysis.ok ? 'Initial analysis produced drafts that require review.' : analysis.error, { source: 'knowledge-update', projectSlug: slug, runId: analysis.runId || '' });
+  } else if ((scan.pendingCount || 0) > 0) {
+    analysis = await runCommitAnalysis({ slug, ...project, kbPath });
+    if (analysis.ok && !analysis.noop && analysis.runId) {
+      const drafts = listDrafts(kbPath, analysis.runId);
+      const safeDrafts = [];
+      const blocked = [];
+      for (const draft of drafts) {
+        if (draft.path === 'project-goal.md' || draft.path === 'GOAL.md' || draft.path === 'ARCHITECTURE.md') {
+          blocked.push(draft.path);
+          continue;
+        }
+        const content = readDraftContent(kbPath, analysis.runId, draft.path);
+        if (content != null) safeDrafts.push({ path: draft.path, content });
+      }
+      if (safeDrafts.length) {
+        applyResult = applyDrafts({
+          kbPath,
+          slug,
+          runId: analysis.runId,
+          drafts: safeDrafts,
+          allowGoalEdit: false,
+          headCommitAtRun: analysis.runRecord && analysis.runRecord.headCommitAtRun,
+        });
+        if (applyResult.ok && analysis.runRecord && analysis.runRecord.headCommitAtRun) {
+          projects[slug].lastAnalyzedCommit = analysis.runRecord.headCommitAtRun;
+        } else if (!applyResult.ok) {
+          reviewRequired = true;
+          reviewReason = applyResult.error || 'auto apply failed';
+        }
+      }
+      if (blocked.length) {
+        reviewRequired = true;
+        reviewReason = `blocked goal-related drafts: ${blocked.join(', ')}`;
+      }
+      logEvent(applyResult && applyResult.ok ? 'info' : 'warn', 'commit_analysis_auto_apply', applyResult && applyResult.ok ? 'Commit analysis drafts auto-applied.' : 'Commit analysis requires review.', { source: 'knowledge-update', projectSlug: slug, runId: analysis.runId, applied: applyResult && applyResult.applied || [], reviewRequired });
+    } else if (analysis.ok && analysis.noop) {
+      logEvent('info', 'knowledge_update_noop', 'No pending commits to analyze.', { source: 'knowledge-update', projectSlug: slug });
+    } else if (!analysis.ok) {
+      logEvent('error', 'commit_analysis_failed', analysis.error, { source: 'knowledge-update', projectSlug: slug, runId: analysis.runId || '' });
+    }
+  } else {
+    analysis = { ok: true, noop: true, message: 'no pending commits' };
+    logEvent('info', 'knowledge_update_noop', 'No knowledge update needed.', { source: 'knowledge-update', projectSlug: slug });
+  }
+
+  validation = validateKb(kbPath);
+  writeJson(path.join(KB_ROOT, 'projects.json'), projects);
+  return {
+    ok: !!(analysis && analysis.ok) && validation.ok !== false,
+    status: validation.ok === false ? validation.status || 422 : 200,
+    slug,
+    kbPath,
+    scan,
+    analysis,
+    applyResult,
+    validation,
+    reviewRequired,
+    reviewReason,
+  };
+}
+
 // ---- project init (create dir structure) ----
 const V2_DIRS = [
   'architecture', 'modules', 'commits', 'operations', 'references',
@@ -452,8 +851,12 @@ function todayIso() {
   return new Date().toISOString().slice(0, 10);
 }
 
-function initProjectDirs(slug) {
-  const base = path.join(KB_ROOT, 'projects', slug);
+function initProjectDirs(slug, kbPath = null) {
+  return kbV3.initV3ProjectDirs(slug, kbPath || defaultProjectKbPath(slug));
+}
+
+function initProjectDirsV2(slug, kbPath = null) {
+  const base = kbPath || defaultProjectKbPath(slug);
   const created = [];
   for (const sub of V2_DIRS) {
     const p = path.join(base, sub);
@@ -509,8 +912,8 @@ function initProjectDirs(slug) {
 }
 
 // Idempotently add v2 layout to an existing project. Used by migration endpoint.
-function ensureV2Layout(slug) {
-  return initProjectDirs(slug);
+function ensureV2Layout(slug, kbPath = null) {
+  return initProjectDirsV2(slug, kbPath);
 }
 
 // ---- routing ----
@@ -559,7 +962,133 @@ const server = http.createServer(async (req, res) => {
         }
       }
       const schedule = await getScheduleInfo();
-      return send(res, 200, { projects, schedule, lastRun, kbRoot: KB_ROOT, projectSchemaVersion: PROJECT_SCHEMA_VERSION });
+      return send(res, 200, {
+        projects,
+        schedule,
+        lastRun,
+        kbRoot: KB_ROOT,
+        knowledgeStore: readKnowledgeStore(),
+        logging: readLoggingConfig(),
+        projectSchemaVersion: PROJECT_SCHEMA_VERSION,
+      });
+    }
+
+    // GET /api/knowledge-store/config
+    if (m === 'GET' && p === '/api/knowledge-store/config') {
+      const cfg = readKnowledgeStore();
+      const validation = knowledgeStore.validateRoot(cfg.rootPath);
+      return send(res, 200, { ok: validation.ok, config: cfg, validation });
+    }
+
+    // PUT /api/knowledge-store/config
+    if (m === 'PUT' && p === '/api/knowledge-store/config') {
+      const body = JSON.parse(await readBody(req));
+      const validation = knowledgeStore.validateRoot(body.rootPath);
+      if (!validation.ok) return send(res, 400, { ok: false, error: validation.error, validation });
+      const cfg = knowledgeStore.writeConfig(KNOWLEDGE_STORE_PATH, KB_ROOT, body);
+      logEvent('info', 'knowledge_store_config_updated', 'Knowledge store configuration updated.', { source: 'knowledge-store', rootPath: cfg.rootPath });
+      return send(res, 200, { ok: true, config: cfg, validation });
+    }
+
+    // POST /api/knowledge-store/migrate { execute?, overwrite?, move? }
+    if (m === 'POST' && p === '/api/knowledge-store/migrate') {
+      const body = await readBody(req).catch(() => '{}');
+      const parsed = (() => { try { return JSON.parse(body); } catch { return {}; } })();
+      const projects = readProjects({ persistMigrations: true });
+      const storeConfig = readKnowledgeStore();
+      if (!parsed.execute) {
+        const plan = knowledgeStore.buildMigrationPlan({ projects, appRoot: KB_ROOT, storeConfig });
+        return send(res, 200, { ok: true, execute: false, plan });
+      }
+      const result = knowledgeStore.migrateProjects({
+        projects,
+        appRoot: KB_ROOT,
+        storeConfig,
+        overwrite: parsed.overwrite === true,
+        move: parsed.move === true,
+      });
+      writeJson(path.join(KB_ROOT, 'projects.json'), projects);
+      logEvent('info', 'knowledge_store_migrated', 'Knowledge store migration executed.', { source: 'knowledge-store', count: result.migrated.length });
+      return send(res, 200, { ok: true, execute: true, ...result });
+    }
+
+    // GET /api/logging/config
+    if (m === 'GET' && p === '/api/logging/config') {
+      const cfg = readLoggingConfig();
+      return send(res, 200, { ok: true, config: cfg });
+    }
+
+    // PUT /api/logging/config
+    if (m === 'PUT' && p === '/api/logging/config') {
+      const body = JSON.parse(await readBody(req));
+      const cfg = structuredLogger.writeConfig(LOGGING_CONFIG_PATH, KB_ROOT, body);
+      logEvent('info', 'logging_config_updated', 'Logging configuration updated.', { source: 'logging', rootPath: cfg.rootPath });
+      return send(res, 200, { ok: true, config: cfg });
+    }
+
+    // GET /api/logs
+    if (m === 'GET' && p === '/api/logs') {
+      const logs = structuredLogger.readLogs(LOGGING_CONFIG_PATH, KB_ROOT, {
+        dateFrom: url.searchParams.get('dateFrom') || '',
+        dateTo: url.searchParams.get('dateTo') || '',
+        level: url.searchParams.get('level') || '',
+        projectSlug: url.searchParams.get('projectSlug') || '',
+        source: url.searchParams.get('source') || '',
+        q: url.searchParams.get('q') || '',
+        limit: Number(url.searchParams.get('limit') || 500),
+      });
+      return send(res, 200, { ok: true, logs, config: readLoggingConfig() });
+    }
+
+    // GET /api/supervision/issues
+    if (m === 'GET' && p === '/api/supervision/issues') {
+      const projects = readProjects({ persistMigrations: false });
+      const history = readJobLog(JOBS_LOG_PATH);
+      const issues = [];
+      for (const [slug, cfg] of Object.entries(projects)) {
+        issues.push(...supervision.projectIssues(slug, cfg, cfg.kbPath || defaultProjectKbPath(slug)));
+      }
+      issues.push(...supervision.jobIssues(history));
+      return send(res, 200, { ok: true, issues });
+    }
+
+    // GET /api/supervision/pending-commits
+    if (m === 'GET' && p === '/api/supervision/pending-commits') {
+      const projects = readProjects({ persistMigrations: false });
+      const items = await supervision.pendingCommits(projects, (slug, cfg) => cfg.kbPath || defaultProjectKbPath(slug));
+      return send(res, 200, { ok: true, items });
+    }
+
+    // GET /api/supervision/summary
+    if (m === 'GET' && p === '/api/supervision/summary') {
+      const projects = readProjects({ persistMigrations: false });
+      const history = readJobLog(JOBS_LOG_PATH);
+      const issues = [
+        ...Object.entries(projects).flatMap(([slug, cfg]) => supervision.projectIssues(slug, cfg, cfg.kbPath || defaultProjectKbPath(slug))),
+        ...supervision.jobIssues(history),
+      ];
+      return send(res, 200, { ok: true, summary: supervision.summary(projects, [...runningJobs.values()], issues), issues });
+    }
+
+    // POST /api/projects/import-preflight { localPath, gitPath? }
+    if (m === 'POST' && p === '/api/projects/import-preflight') {
+      const body = await readBody(req).catch(() => '{}');
+      const parsed = (() => { try { return JSON.parse(body); } catch { return {}; } })();
+      const result = await projectImportPreflight({ localPath: parsed.localPath, gitPath: parsed.gitPath });
+      return send(res, result.ok ? 200 : 400, result);
+    }
+
+    // POST /api/git/init { path, createInitialCommit?, remoteUrl? }
+    if (m === 'POST' && p === '/api/git/init') {
+      const body = await readBody(req).catch(() => '{}');
+      const parsed = (() => { try { return JSON.parse(body); } catch { return {}; } })();
+      const result = await initializeLocalGit({
+        repoPath: parsed.path || parsed.repoPath,
+        createInitialCommit: parsed.createInitialCommit === true,
+        remoteUrl: parsed.remoteUrl || '',
+      });
+      logEvent(result.ok ? 'info' : 'error', result.ok ? 'git_initialized' : 'git_init_failed', result.ok ? 'Local Git repository is ready.' : result.error, { source: 'git-import', repoPath: result.repoPath });
+      return send(res, result.ok ? 200 : 400, result);
     }
 
     // GET /api/projects
@@ -576,6 +1105,16 @@ const server = http.createServer(async (req, res) => {
         if (typeof body.config !== 'object' || body.config === null) {
           return send(res, 400, { error: 'Invalid config' });
         }
+        const importOptions = body.importOptions && typeof body.importOptions === 'object' ? body.importOptions : {};
+        const targetPathBeforeImport = body.config.gitPath || body.config.localPath;
+        if (importOptions.initGit === true) {
+          const gitInit = await initializeLocalGit({
+            repoPath: targetPathBeforeImport,
+            createInitialCommit: importOptions.createInitialCommit === true,
+            remoteUrl: importOptions.remoteUrl || '',
+          });
+          if (!gitInit.ok) return send(res, 400, { ok: false, error: gitInit.error, gitInit });
+        }
         projects[body.slug] = normalizeProjectConfig(body.slug, body.config).config;
         // Auto-validate git on add/update — populates repoStatus, headCommit, etc.
         const targetPath = projects[body.slug].gitPath || projects[body.slug].localPath;
@@ -592,17 +1131,81 @@ const server = http.createServer(async (req, res) => {
       return send(res, 400, { error: 'Need { slug, config } or { projects }' });
     }
 
+    // GET /api/projects/:slug/remove-preview
+    if (m === 'GET' && p.startsWith('/api/projects/') && p.endsWith('/remove-preview')) {
+      const slug = p.split('/')[3];
+      if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
+      const projects = readProjects({ persistMigrations: false });
+      if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
+      return send(res, 200, { ok: true, preview: projectRemovePreview(slug, projects[slug]) });
+    }
+
+    // POST /api/projects/:slug/remove { deleteKb?, reason? }
+    if (m === 'POST' && p.startsWith('/api/projects/') && p.endsWith('/remove')) {
+      const slug = p.split('/')[3];
+      if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
+      const body = await readBody(req).catch(() => '{}');
+      const parsed = (() => { try { return JSON.parse(body); } catch { return {}; } })();
+      const projects = readProjects({ persistMigrations: false });
+      if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
+      if (hasRunningProjectJob(slug)) return send(res, 409, { ok: false, error: 'project has a running job' });
+      const cfg = projects[slug];
+      const kbPath = path.resolve(cfg.kbPath || defaultProjectKbPath(slug));
+      const deleteKb = parsed.deleteKb === true;
+      let removedKb = false;
+      let hookResult = null;
+      if (deleteKb) {
+        const safe = validateKbDeletionPath(kbPath);
+        if (!safe.ok) return send(res, 400, { ok: false, error: safe.error, kbPath: safe.path || kbPath });
+      }
+      try {
+        hookResult = uninstallHook({ repoPath: cfg.gitPath || cfg.localPath || '' });
+      } catch (e) {
+        hookResult = { ok: false, warning: e.message };
+      }
+      delete projects[slug];
+      writeJson(path.join(KB_ROOT, 'projects.json'), projects);
+      removeKnowledgeStoreProjectOverride(slug);
+      if (deleteKb && fs.existsSync(kbPath)) {
+        fs.rmSync(kbPath, { recursive: true, force: true });
+        removedKb = true;
+      }
+      logEvent('info', 'project_removed', `Project removed: ${slug}`, {
+        source: 'project-remove',
+        projectSlug: slug,
+        kbPath,
+        deleteKb,
+        removedKb,
+        reason: parsed.reason || '',
+        hookResult,
+      });
+      return send(res, 200, { ok: true, slug, kbPath, removedKb, hookResult });
+    }
+
     // POST /api/projects/:slug/init
     if (m === 'POST' && p.startsWith('/api/projects/') && p.endsWith('/init')) {
       const slug = p.split('/')[3];
       if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
       const projects = readProjects({ persistMigrations: true });
       if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
-      const result = initProjectDirs(slug);
-      // Mark project as v2 after init
-      projects[slug].kbSchemaVersion = 'v2';
+      const result = initProjectDirs(slug, projects[slug].kbPath || defaultProjectKbPath(slug));
+      // Mark project as v3 after init
+      projects[slug].kbSchemaVersion = 'v3';
       writeJson(path.join(KB_ROOT, 'projects.json'), projects);
-      return send(res, 200, { ok: true, ...result, kbSchemaVersion: 'v2' });
+      return send(res, 200, { ok: true, ...result, kbSchemaVersion: 'v3' });
+    }
+
+    // POST /api/projects/:slug/migrate-v3
+    if (m === 'POST' && p.startsWith('/api/projects/') && p.endsWith('/migrate-v3')) {
+      const slug = p.split('/')[3];
+      if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
+      const projects = readProjects({ persistMigrations: true });
+      if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
+      const result = kbV3.migrateToV3({ slug, kbPath: projects[slug].kbPath || defaultProjectKbPath(slug), preserveLegacyAI: false });
+      projects[slug].kbSchemaVersion = 'v3';
+      writeJson(path.join(KB_ROOT, 'projects.json'), projects);
+      logEvent('info', 'kb_v3_migrated', 'Knowledge base migrated to v3.', { source: 'kb-v3', projectSlug: slug, kbPath: result.kbPath });
+      return send(res, 200, { ok: true, ...result });
     }
 
     // POST /api/projects/:slug/migrate-v2 — add v2 layout to an existing project
@@ -611,7 +1214,7 @@ const server = http.createServer(async (req, res) => {
       if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
       const projects = readProjects({ persistMigrations: true });
       if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
-      const result = ensureV2Layout(slug);
+      const result = ensureV2Layout(slug, projects[slug].kbPath || defaultProjectKbPath(slug));
       projects[slug].kbSchemaVersion = 'v2';
       writeJson(path.join(KB_ROOT, 'projects.json'), projects);
       return send(res, 200, { ok: true, ...result, kbSchemaVersion: 'v2' });
@@ -700,6 +1303,13 @@ const server = http.createServer(async (req, res) => {
     }
 
     // POST /api/scan-all — scan every enabled project
+    if (m === 'POST' && p.startsWith('/api/projects/') && p.endsWith('/knowledge-update')) {
+      const slug = p.split('/')[3];
+      if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
+      const result = await runKnowledgeUpdate(slug);
+      return send(res, result.status || (result.ok ? 200 : 500), result);
+    }
+
     if (m === 'POST' && p === '/api/scan-all') {
       const projects = readProjects({ persistMigrations: false });
       const results = [];
@@ -726,13 +1336,56 @@ const server = http.createServer(async (req, res) => {
       return send(res, 200, { ok: true });
     }
 
+    // POST /api/ai-profiles/test { profileId, prompt? }
+    if (m === 'POST' && p === '/api/ai-profiles/test') {
+      const body = await readBody(req).catch(() => '{}');
+      const parsed = (() => { try { return JSON.parse(body); } catch { return {}; } })();
+      const cfg = readAiProfiles();
+      const profileId = parsed.profileId || cfg.defaultProfileId || DEFAULT_AI_PROFILE_ID;
+      const profile = (cfg.profiles || []).find(item => item && item.id === profileId);
+      if (!profile) return send(res, 404, { ok: false, error: `profile not found: ${profileId}` });
+      const implementation = profileImplementation(profile);
+      if (!getAdapter(implementation)) return send(res, 400, { ok: false, error: `unknown adapter: ${implementation}` });
+
+      const prompt = parsed.prompt || 'what model are you?';
+      if (implementation === 'mock-agent') {
+        return send(res, 200, {
+          ok: true,
+          profileId,
+          model: 'mock-agent',
+          text: `[mock-agent] received: ${prompt}`,
+          usage: null,
+        });
+      }
+
+      try {
+        const llmCfg = readLlmConfig({ profileId });
+        const result = await completeText({
+          profileId,
+          user: prompt,
+          maxTokens: Math.min(Number(profile.testMaxTokens || 128), 512),
+          temperature: profile.testTemperature != null ? Number(profile.testTemperature) : 0,
+        });
+        return send(res, 200, {
+          ok: true,
+          profileId,
+          model: result.model || llmCfg.model,
+          baseUrl: llmCfg.baseUrl,
+          text: result.text,
+          usage: result.usage,
+        });
+      } catch (e) {
+        return send(res, 400, { ok: false, profileId, error: e.message });
+      }
+    }
+
     // PUT /api/projects/:slug/ai-profile — set a project's AI profile
     if (m === 'PUT' && p.startsWith('/api/projects/') && p.endsWith('/ai-profile')) {
       const slug = p.split('/')[3];
       if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
       const body = JSON.parse(await readBody(req));
-      if (!body.aiProfileId) return send(res, 400, { error: 'aiProfileId required' });
-      if (!getAdapter(body.aiProfileId)) return send(res, 400, { error: `unknown adapter: ${body.aiProfileId}` });
+      const profileCheck = validateUsableAiProfile(body.aiProfileId);
+      if (!profileCheck.ok) return send(res, profileCheck.status, { error: profileCheck.error });
       const projects = readProjects({ persistMigrations: true });
       if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
       projects[slug].aiProfileId = body.aiProfileId;
@@ -749,8 +1402,8 @@ const server = http.createServer(async (req, res) => {
       if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
 
       if (body.aiProfileId != null) {
-        if (!body.aiProfileId) return send(res, 400, { error: 'aiProfileId required' });
-        if (!getAdapter(body.aiProfileId)) return send(res, 400, { error: `unknown adapter: ${body.aiProfileId}` });
+        const profileCheck = validateUsableAiProfile(body.aiProfileId);
+        if (!profileCheck.ok) return send(res, profileCheck.status, { error: profileCheck.error });
         projects[slug].aiProfileId = body.aiProfileId;
       }
 
@@ -795,12 +1448,47 @@ const server = http.createServer(async (req, res) => {
     }
 
     // POST /api/projects/:slug/analyze/initial — run initial analysis (TASK-007)
+    // ?mode=cli → spawn Claude Code subprocess and return sessionId for SSE streaming
     if (m === 'POST' && p.startsWith('/api/projects/') && p.endsWith('/analyze/initial')) {
       const slug = p.split('/')[3];
       if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
       const projects = readProjects({ persistMigrations: false });
       if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
       const kbPath = projects[slug].kbPath || defaultProjectKbPath(slug);
+
+      // CLI mode: kick off Claude Code subprocess, return sessionId immediately
+      if (url.searchParams.get('mode') === 'cli') {
+        const projectPath = projects[slug].gitPath || projects[slug].localPath;
+        if (!projectPath) return send(res, 400, { error: 'Project has no gitPath/localPath' });
+        const aiProfileId = projects[slug].aiProfileId || readAiProfiles().defaultProfileId || DEFAULT_AI_PROFILE_ID;
+        const profileCheck = validateUsableAiProfile(aiProfileId);
+        if (!profileCheck.ok) return send(res, profileCheck.status, { ok: false, error: profileCheck.error });
+        if (profileCheck.implementation !== 'claude-code-agent') {
+          return send(res, 400, { ok: false, error: `Claude terminal requires claude-code-agent implementation, got ${profileCheck.implementation}` });
+        }
+        const runner = url.searchParams.get('runner') === 'sdk' || profileCheck.profile.runner === 'sdk' ? 'sdk' : 'cli';
+        try {
+          const { sessionId } = claudeCliRunner.startSession({
+            slug,
+            projectPath,
+            kbPath,
+            promptKey: 'initial-analysis',
+            aiProfile: profileCheck.profile,
+            runner,
+            vars: {
+              SLUG: slug,
+              PROJECT_PATH: projectPath,
+              KB_PATH: kbPath,
+              PRIMARY_LANGUAGE: projects[slug].primaryLanguage || '',
+              KNOWLEDGE_LANGUAGE: projects[slug].knowledgeLanguage || 'zh-CN',
+            },
+          });
+          return send(res, 200, { ok: true, slug, sessionId, mode: 'cli', runner, aiProfileId, pendingPermission: claudeCliRunner.getState(sessionId)?.pendingPermission || null });
+        } catch (e) {
+          return send(res, 500, { ok: false, error: e.message });
+        }
+      }
+
       const result = await runInitialAnalysis({ slug, ...projects[slug], kbPath });
       if (!result.ok) {
         return send(res, result.status, { ok: false, error: result.error, runId: result.runId, run: result.runRecord });
@@ -808,6 +1496,137 @@ const server = http.createServer(async (req, res) => {
       return send(res, 200, { ok: true, slug, runId: result.runId, run: result.runRecord });
     }
 
+    // GET /api/claude/sessions — list active sessions
+    if (m === 'GET' && p === '/api/claude/sessions') {
+      const slug = url.searchParams.get('slug');
+      if (slug && !isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
+      return send(res, 200, { sessions: claudeCliRunner.listSessions({ projectSlug: slug || null }) });
+    }
+
+    // GET /api/claude/sessions/:id — session state
+    if (m === 'GET' && p.startsWith('/api/claude/sessions/') && !p.includes('/')) {
+      // skipped — path has slashes; handled by next branch
+    }
+    if (m === 'GET' && p.startsWith('/api/claude/sessions/') && p.split('/').length === 5) {
+      // /api/claude/sessions/:id  →  parts = ['', 'api', 'claude', 'sessions', '<id>']
+      const sessionId = p.split('/')[4];
+      const st = claudeCliRunner.getState(sessionId);
+      if (!st) return send(res, 404, { error: 'session not found' });
+      return send(res, 200, st);
+    }
+
+    // GET /api/claude/sessions/:id/stream — SSE stream of events
+    if (m === 'GET' && p.startsWith('/api/claude/sessions/') && p.endsWith('/stream')) {
+      const sessionId = p.split('/')[4];
+      if (!claudeCliRunner.getSession(sessionId)) return send(res, 404, { error: 'session not found' });
+      res.writeHead(200, {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-store, no-transform',
+        'Connection': 'keep-alive',
+        'Access-Control-Allow-Origin': '*',
+        'X-Accel-Buffering': 'no',
+      });
+      res.write(`event: claude/hello\ndata: ${JSON.stringify({ sessionId, time: new Date().toISOString() })}\n\n`);
+      const unsubscribe = claudeCliRunner.subscribe(sessionId, (event) => {
+        try {
+          res.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+        } catch (e) {
+          // client gone
+        }
+      });
+      const heartbeat = setInterval(() => {
+        try { res.write(`: keepalive ${Date.now()}\n\n`); } catch {}
+      }, 15000);
+      const cleanup = () => {
+        clearInterval(heartbeat);
+        try { unsubscribe(); } catch {}
+      };
+      req.on('close', cleanup);
+      req.on('error', cleanup);
+      return;  // do NOT call send() — connection stays open
+    }
+
+    // POST /api/claude/sessions/:id/input — send follow-up prompt (uses --resume)
+    if (m === 'POST' && p.startsWith('/api/claude/sessions/') && p.endsWith('/input')) {
+      const sessionId = p.split('/')[4];
+      if (!claudeCliRunner.getSession(sessionId)) return send(res, 404, { error: 'session not found' });
+      let body;
+      try { body = JSON.parse(await readBody(req)); } catch { return send(res, 400, { error: 'invalid JSON body' }); }
+      if (!body || typeof body.text !== 'string' || !body.text.trim()) {
+        return send(res, 400, { error: 'body.text (non-empty string) required' });
+      }
+      try {
+        const st = claudeCliRunner.getState(sessionId);
+        const projects = readProjects({ persistMigrations: false });
+        const project = st && st.projectSlug && projects[st.projectSlug] ? projects[st.projectSlug] : null;
+        let profile = null;
+        let runner = st && st.runner === 'sdk' ? 'sdk' : null;
+        if (project) {
+          const aiProfileId = project.aiProfileId || readAiProfiles().defaultProfileId || DEFAULT_AI_PROFILE_ID;
+          const profileCheck = validateUsableAiProfile(aiProfileId);
+          if (!profileCheck.ok) return send(res, profileCheck.status, { ok: false, error: profileCheck.error });
+          if (profileCheck.implementation !== 'claude-code-agent') {
+            return send(res, 400, { ok: false, error: `Claude workbench requires claude-code-agent implementation, got ${profileCheck.implementation}` });
+          }
+          profile = profileCheck.profile;
+          runner = body.runner === 'sdk' || profile.runner === 'sdk' || runner === 'sdk' ? 'sdk' : 'cli';
+        }
+        const result = await claudeCliRunner.sendInput(sessionId, body.text, profile, runner);
+        return send(res, 200, { ok: true, sessionId, pendingPermission: result && result.pendingPermission || null });
+      } catch (e) {
+        return send(res, 400, { ok: false, error: e.message });
+      }
+    }
+
+    // POST /api/claude/sessions/:id/permission
+    if (m === 'POST' && p.startsWith('/api/claude/sessions/') && p.endsWith('/permission')) {
+      const sessionId = p.split('/')[4];
+      if (!claudeCliRunner.getSession(sessionId)) return send(res, 404, { error: 'session not found' });
+      let body;
+      try { body = JSON.parse(await readBody(req)); } catch { return send(res, 400, { error: 'invalid JSON body' }); }
+      if (!body || typeof body.requestId !== 'string') {
+        return send(res, 400, { error: 'body.requestId required' });
+      }
+      try {
+        const result = claudeCliRunner.resolvePermission(sessionId, body.requestId, {
+          allow: body.allow === true,
+          message: typeof body.message === 'string' ? body.message : '',
+        });
+        return send(res, 200, { ok: true, sessionId, ...result });
+      } catch (e) {
+        return send(res, 400, { ok: false, error: e.message });
+      }
+    }
+
+    // POST /api/claude/sessions/:id/abort — terminate current subprocess
+    if (m === 'POST' && p.startsWith('/api/claude/sessions/') && p.endsWith('/abort')) {
+      const sessionId = p.split('/')[4];
+      if (!claudeCliRunner.getSession(sessionId)) return send(res, 404, { error: 'session not found' });
+      try {
+        claudeCliRunner.abort(sessionId);
+        return send(res, 200, { ok: true, sessionId });
+      } catch (e) {
+        return send(res, 400, { ok: false, error: e.message });
+      }
+    }
+
+    // GET /api/prompts — read prompt registry
+    if (m === 'GET' && p === '/api/prompts') {
+      return send(res, 200, promptRegistry.readPrompts());
+    }
+
+    // PUT /api/prompts — write prompt registry
+    if (m === 'PUT' && p === '/api/prompts') {
+      let body;
+      try { body = JSON.parse(await readBody(req)); } catch { return send(res, 400, { error: 'invalid JSON body' }); }
+      try {
+        const written = promptRegistry.writePrompts(body);
+        return send(res, 200, { ok: true, prompts: written });
+      } catch (e) {
+        return send(res, 400, { ok: false, error: e.message });
+      }
+    }
+
     // POST /api/projects/:slug/analyze/commits — run incremental commit analysis (TASK-008)
     if (m === 'POST' && p.startsWith('/api/projects/') && p.endsWith('/analyze/commits')) {
       const slug = p.split('/')[3];
@@ -859,6 +1678,27 @@ const server = http.createServer(async (req, res) => {
     }
 
     // GET /api/projects/:slug/drafts/:runId/raw?path=... — read a single draft's text
+    if (m === 'GET' && p.match(/^\/api\/projects\/[a-z0-9-]+\/drafts-by-branch$/)) {
+      const slug = p.split('/')[3];
+      if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
+      const branch = url.searchParams.get('branch') || '';
+      const status = url.searchParams.get('status') || 'pending';
+      const projects = readProjects({ persistMigrations: false });
+      if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
+      const kbPath = projects[slug].kbPath || defaultProjectKbPath(slug);
+      const runs = listRuns(kbPath);
+      const drafts = [];
+      for (const run of runs) {
+        if (status === 'pending' && (run.applyStatus === 'applied' || run.applyStatus === 'rejected')) continue;
+        const sourceBranch = run.sourceBranch ?? 'unknown (pre-TASK-016)';
+        if (branch && sourceBranch !== branch) continue;
+        for (const draft of listDrafts(kbPath, run.runId)) {
+          drafts.push({ ...draft, runId: run.runId, runStatus: run.status, applyStatus: run.applyStatus || 'pending', sourceBranch });
+        }
+      }
+      return send(res, 200, { ok: true, slug, branch: branch || null, status, drafts });
+    }
+
     if (m === 'GET' && p.match(/^\/api\/projects\/[a-z0-9-]+\/drafts\/[A-Za-z0-9_-]+\/raw$/)) {
       const parts = p.split('/');
       const slug = parts[3];
@@ -1023,7 +1863,9 @@ const server = http.createServer(async (req, res) => {
     if (m === 'GET' && p.startsWith('/api/dirs/')) {
       const slug = p.split('/')[3];
       if (!isSafeSlug(slug)) return send(res, 400, { error: 'Invalid slug' });
-      const kbPath = path.join(KB_ROOT, 'projects', slug);
+      const projects = readProjects({ persistMigrations: false });
+      if (!projects[slug]) return send(res, 404, { error: 'Slug not in projects.json' });
+      const kbPath = projects[slug].kbPath || defaultProjectKbPath(slug);
       if (!fs.existsSync(kbPath)) return send(res, 404, { error: 'Project KB not initialized' });
       return send(res, 200, listSubTree(kbPath, '', 0, 3));
     }
@@ -1044,6 +1886,21 @@ const server = http.createServer(async (req, res) => {
       return send(res, 200, { type: 'file', content: buf.toString('utf-8'), size: stat.size }, 'text/plain');
     }
 
+    // Static vendor assets (Vue / Tailwind browser bundles)
+    if (m === 'GET' && p.startsWith('/vendor/')) {
+      const rel = decodeURIComponent(p.slice('/vendor/'.length));
+      if (rel.includes('..') || path.isAbsolute(rel)) return send(res, 400, { error: 'bad path' });
+      const vendorRoot = path.join(SITE_ROOT, 'vendor');
+      const abs = path.resolve(vendorRoot, rel);
+      if (!abs.startsWith(vendorRoot + path.sep)) return send(res, 403, { error: 'outside vendor' });
+      if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) return send(res, 404, { error: 'not found' });
+      const text = fs.readFileSync(abs, 'utf-8');
+      const ct = abs.endsWith('.js') ? 'application/javascript'
+        : abs.endsWith('.css') ? 'text/css'
+        : 'application/octet-stream';
+      return send(res, 200, text, ct);
+    }
+
     send(res, 404, { error: 'Not found', path: p });
   } catch (e) {
     console.error('[server error]', e);