stageflow 0.27.0 → 0.30.0

package/dist/server/http.js

@@ -6,8 +6,17 @@ import { getCredentialSourceSettings, setCredentialSource, } from "../agent/prov
 import { mapProviderAuthError } from "../agent/providerInspect.js";
 import { handleProviderRoutes } from "./providerRoutes.js";
 import { handleProjectMcpRoutes } from "./projectMcpRoutes.js";
+import { handleTriggerRoutes } from "./triggerRoutes.js";
 import { createPipeline, parseCreatePipelineBody } from "../config/createPipeline.js";
 import { createStage, parseCreateStageBody } from "../config/createStage.js";
+import { loadDraftPackage, loadTaskArtifact, parseAttachTaskBody, parseCreateDraftPackageBody, parseDraftPackageBody, parseOpenDraftPackageBody, parseOverwriteDraftPackageBody, validateDraftPackage, } from "../config/draftPackage.js";
+import { publishDraftPackage } from "../config/publishDraftPackage.js";
+import { clearWorkshopAutosave, detectDiskChange, draftPackageDiskRelativePaths, fingerprintPackageFiles, parseWorkshopAutosaveRecord, readWorkshopAutosave, resolveWorkshopAutosaveStoreRoot, workshopAutosaveSlotKey, writeWorkshopAutosave, } from "../workshop/autosave.js";
+import { acceptWorkshopSessionMutation, iterateWorkshopChatStreamFrames, runWorkshopChatTurn, stopWorkshopChatTurn, undoWorkshopSessionMutation, WorkshopChatSessionRegistry, WorkshopSessionStoreError, } from "../workshop/chatTurn.js";
+import { readWorkshopOpenModel, resolveWorkshopModel, } from "../workshop/modelSettings.js";
+import { createWorkshopSession, getWorkshopSession, listWorkshopSessions, resolveWorkshopSessionStoreRoot, updateWorkshopSessionActiveBuildId, } from "../workshop/sessionStore.js";
+import { createWorkshopBuild, focusUnboundWorkshopBuild, getWorkshopBuild, listWorkshopBuilds, listWorkshopPickerRows, resolvePickerCatalogPipelines, resolveWorkshopBuildStoreRoot, updateWorkshopBuild, WorkshopBuildStoreError, } from "../workshop/buildStore.js";
+import { createLiveWorkshopOperatorHost, } from "../operatorAgent/index.js";
 import { listModelsMultiProject, listPipelinesMultiProject, listTasksMultiProject, } from "../config/multiProjectCatalog.js";
 import { catalogPathErrorBody, CatalogPathError, resolveCatalogRelativePath, resolveCatalogStartInput, resolveWritableCatalogRoot, } from "../config/catalogRelativePath.js";
 import { listExtensions } from "../config/listExtensions.js";
@@ -25,7 +34,7 @@ import { globalStageflowHome } from "../project/globalHome.js";
 import { resolveStageflowContext } from "../project/resolveStageflowContext.js";
 import { PipelineValidationError } from "../runtime/pipelineValidationError.js";
 import { PipelinePreflightError } from "../runtime/pipelineRunner.js";
-import { INVALID_SLOT_COUNT_MESSAGE, parseSlotCount, } from "../runtime/settingsFile.js";
+import { INVALID_SLOT_COUNT_MESSAGE, INVALID_WORKSHOP_MODEL_MESSAGE, parseSlotCount, parseWorkshopModelSetting, readFactorySettings, writeFactorySettings, } from "../runtime/settingsFile.js";
 import { isTaskFile } from "../runtime/taskInput.js";
 import { findTokenShapedField, tokenRejectedPayload, } from "../runtime/startPayload.js";
 import { parseAskOperatorAnswer } from "../tools/askOperator.js";
@@ -56,6 +65,28 @@ async function readJsonBody(req) {
         return {};
     return JSON.parse(Buffer.concat(chunks).toString("utf8"));
 }
+function isPlainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readBuildTieField(body, field) {
+    if (!Object.prototype.hasOwnProperty.call(body, field)) {
+        return { ok: true, present: false };
+    }
+    const value = body[field];
+    if (value === null)
+        return { ok: true, present: true, value: null };
+    if (typeof value === "string")
+        return { ok: true, present: true, value };
+    return { ok: false, error: `${field} must be a string or null` };
+}
+/** Raw bytes, unparsed — for callers (webhook signature verification) that need the exact wire body. */
+async function readRawBody(req) {
+    const chunks = [];
+    for await (const chunk of req) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    }
+    return Buffer.concat(chunks);
+}
 function contentTypeFor(filePath) {
     const ext = path.extname(filePath).toLowerCase();
     switch (ext) {
@@ -125,7 +156,15 @@ export function defaultUiDistDir() {
  * API; only the former needs the UI files.
  */
 export function createOperatorRoutes(deps) {
-    const { manager, store, cwd, agentDir, rootDir, providerAuthContext, uiDistDir } = deps;
+    const { manager, store, cwd, agentDir, rootDir, providerAuthContext, uiDistDir, workshopOperatorHost, } = deps;
+    const workshopChatRegistry = deps.workshopChatRegistry ??
+        new WorkshopChatSessionRegistry(workshopOperatorHost ??
+            createLiveWorkshopOperatorHost({
+                cwd,
+                projectRoot: cwd,
+            }));
+    const workshopSessionStoreRoot = () => resolveWorkshopSessionStoreRoot();
+    const workshopBuildStoreRoot = () => resolveWorkshopBuildStoreRoot();
     const allowedHosts = deps.allowedHosts ?? resolveAllowedHosts();
     const controlTokens = deps.controlTokens ?? loadControlTokens();
     return async ({ req, res, url, pathname, method, boot }) => {
@@ -780,7 +819,12 @@ export function createOperatorRoutes(deps) {
                         json(res, result.status, { error: result.reason });
                         return true;
                     }
-                    json(res, 202, { ok: true });
+                    json(res, 202, {
+                        ok: true,
+                        ...(result.verification !== undefined
+                            ? { verification: result.verification }
+                            : {}),
+                    });
                     return true;
                 }
                 const feedbackDecisionMatch = pathname.match(/^\/api\/runs\/([^/]+)\/stages\/([^/]+)\/feedback-decision$/);
@@ -1007,6 +1051,7 @@ export function createOperatorRoutes(deps) {
                     json(res, 200, {
                         tasks: result.items,
                         root_errors: result.root_errors,
+                        ...(result.tip !== undefined ? { tip: result.tip } : {}),
                     });
                     return true;
                 }
@@ -1029,6 +1074,7 @@ export function createOperatorRoutes(deps) {
                     json(res, 200, {
                         pipelines: result.items,
                         root_errors: result.root_errors,
+                        ...(result.tip !== undefined ? { tip: result.tip } : {}),
                     });
                     return true;
                 }
@@ -1071,9 +1117,9 @@ export function createOperatorRoutes(deps) {
                         return true;
                     }
                     const ctx = await resolveStageflowContext(stageWriteRoot);
-                    if (!ctx.isGitProject) {
+                    if (ctx.manifestStatus !== "ok") {
                         json(res, 400, {
-                            error: "Project root not found; initialize stageflow.yaml in a git repo",
+                            error: "Project root not found; initialize stageflow.yaml",
                         });
                         return true;
                     }
@@ -1118,9 +1164,9 @@ export function createOperatorRoutes(deps) {
                         return true;
                     }
                     const ctx = await resolveStageflowContext(pipelineWriteRoot);
-                    if (!ctx.isGitProject) {
+                    if (ctx.manifestStatus !== "ok") {
                         json(res, 400, {
-                            error: "Project root not found; initialize stageflow.yaml in a git repo",
+                            error: "Project root not found; initialize stageflow.yaml",
                         });
                         return true;
                     }
@@ -1132,65 +1178,233 @@ export function createOperatorRoutes(deps) {
                     json(res, 201, result.pipeline);
                     return true;
                 }
-                if (method === "GET" && pathname === "/api/models") {
-                    const filter = url.searchParams.get("project_root") ?? undefined;
-                    const result = await listModelsMultiProject({
-                        store,
-                        bootCwd: cwd,
-                        projectRootFilter: filter,
+                if (method === "POST" && pathname === "/api/drafts/validate") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const draftParsed = parseDraftPackageBody(body);
+                    if ("ok" in draftParsed) {
+                        json(res, draftParsed.status, { error: draftParsed.error });
+                        return true;
+                    }
+                    const writeRoot = body !== null &&
+                        typeof body === "object" &&
+                        !Array.isArray(body) &&
+                        typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let validateRoot = cwd;
+                    if (writeRoot) {
+                        try {
+                            const { wireRoot: selected } = await resolveWritableCatalogRoot({ store, bootCwd: cwd }, writeRoot);
+                            validateRoot = selected.path;
+                        }
+                        catch (err) {
+                            if (err instanceof CatalogPathError) {
+                                json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                                return true;
+                            }
+                            throw err;
+                        }
+                    }
+                    const ctx = await resolveStageflowContext(validateRoot);
+                    const result = await validateDraftPackage(draftParsed, {
+                        cwd: ctx.projectRoot,
+                        projectRoot: ctx.projectRoot,
+                        strict: true,
                     });
-                    if (result.root_errors.some((e) => e.code === "unknown_project_root") &&
-                        result.items.length === 0) {
+                    json(res, 200, result);
+                    return true;
+                }
+                if (method === "POST" && pathname === "/api/drafts/create") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const writeRoot = body !== null &&
+                        typeof body === "object" &&
+                        !Array.isArray(body) &&
+                        typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let draftWriteRoot;
+                    try {
+                        const { wireRoot: selected } = await resolveWritableCatalogRoot({ store, bootCwd: cwd }, writeRoot);
+                        draftWriteRoot = selected.path;
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const parsed = parseCreateDraftPackageBody(body);
+                    if ("ok" in parsed) {
+                        json(res, parsed.status, { error: parsed.error });
+                        return true;
+                    }
+                    const ctx = await resolveStageflowContext(draftWriteRoot);
+                    if (!ctx.isGitProject) {
                         json(res, 400, {
-                            error: result.root_errors[0].message,
-                            code: "unknown_project_root",
-                            root_errors: result.root_errors,
+                            error: "Project root not found; initialize stageflow.yaml in a git repo",
                         });
                         return true;
                     }
-                    json(res, 200, {
-                        models: result.models,
-                        entries: result.items,
-                        root_errors: result.root_errors,
+                    const result = (await publishDraftPackage(ctx.projectRoot, parsed, "create")).write;
+                    if (!result.ok) {
+                        json(res, result.status, {
+                            error: result.error,
+                            ...(result.findings ? { findings: result.findings } : {}),
+                        });
+                        return true;
+                    }
+                    json(res, 201, {
+                        pipeline: result.pipeline,
+                        pipelinePath: result.pipelinePath,
+                        stagePaths: result.stagePaths,
+                        ...(result.taskPath !== undefined ? { taskPath: result.taskPath } : {}),
                     });
                     return true;
                 }
-                if (await handleProviderRoutes(req, res, {
-                    cwd,
-                    readJsonBody,
-                    json,
-                    providerAuthContext,
-                })) {
-                    return true;
-                }
-                if (await handleProjectMcpRoutes(req, res, {
-                    projectRoot: rootDir,
-                    json,
-                })) {
-                    return true;
-                }
-                if (method === "GET" && pathname === "/api/skills") {
-                    json(res, 200, await listSkills({ cwd, agentDir }));
-                    return true;
-                }
-                if (method === "GET" && pathname === "/api/extensions") {
-                    json(res, 200, await listExtensions({ cwd, agentDir }));
-                    return true;
-                }
-                if (method === "GET" && pathname === "/api/health") {
-                    await handleApiHealth(req, res, boot);
+                if (method === "POST" && pathname === "/api/drafts/overwrite") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const writeRoot = body !== null &&
+                        typeof body === "object" &&
+                        !Array.isArray(body) &&
+                        typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let draftWriteRoot;
+                    try {
+                        const { wireRoot: selected } = await resolveWritableCatalogRoot({ store, bootCwd: cwd }, writeRoot);
+                        draftWriteRoot = selected.path;
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const parsed = parseOverwriteDraftPackageBody(body);
+                    if ("ok" in parsed) {
+                        json(res, parsed.status, { error: parsed.error });
+                        return true;
+                    }
+                    const ctx = await resolveStageflowContext(draftWriteRoot);
+                    if (!ctx.isGitProject) {
+                        json(res, 400, {
+                            error: "Project root not found; initialize stageflow.yaml in a git repo",
+                        });
+                        return true;
+                    }
+                    const result = (await publishDraftPackage(ctx.projectRoot, parsed, "overwrite")).write;
+                    if (!result.ok) {
+                        json(res, result.status, {
+                            error: result.error,
+                            ...(result.findings ? { findings: result.findings } : {}),
+                        });
+                        return true;
+                    }
+                    json(res, 200, {
+                        pipeline: result.pipeline,
+                        pipelinePath: result.pipelinePath,
+                        stagePaths: result.stagePaths,
+                        ...(result.taskPath !== undefined ? { taskPath: result.taskPath } : {}),
+                    });
                     return true;
                 }
-                if (method === "GET" && pathname === "/api/settings") {
-                    const health = manager.getHealth();
-                    const credential = getCredentialSourceSettings(cwd);
+                if (method === "POST" && pathname === "/api/drafts/open") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const parsed = parseOpenDraftPackageBody(body);
+                    if ("ok" in parsed) {
+                        json(res, parsed.status, { error: parsed.error });
+                        return true;
+                    }
+                    const writeRoot = body !== null &&
+                        typeof body === "object" &&
+                        !Array.isArray(body) &&
+                        typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let wireRoot;
+                    let roots;
+                    try {
+                        ({ wireRoot, roots } = await resolveCatalogStartInput({ store, bootCwd: cwd }, writeRoot));
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    let pipelineRel;
+                    let taskRel;
+                    try {
+                        pipelineRel = resolveCatalogRelativePath({
+                            inputPath: parsed.path,
+                            projectRoot: writeRoot,
+                            roots,
+                            fieldName: "path",
+                        }).relativePath;
+                        if (parsed.taskPath) {
+                            taskRel = resolveCatalogRelativePath({
+                                inputPath: parsed.taskPath,
+                                projectRoot: writeRoot,
+                                roots,
+                                fieldName: "task",
+                            }).relativePath;
+                        }
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const ctx = await resolveStageflowContext(wireRoot.path);
+                    const result = await loadDraftPackage(ctx.projectRoot, pipelineRel, {
+                        ...(taskRel !== undefined ? { taskPath: taskRel } : {}),
+                    });
+                    if (!result.ok) {
+                        json(res, result.status, { error: result.error });
+                        return true;
+                    }
                     json(res, 200, {
-                        maxConcurrent: health.maxConcurrent,
-                        ...credential,
+                        draft: result.draft,
+                        destination: result.destination,
+                        pipelinePath: result.pipelinePath,
+                        ...(result.taskPath !== undefined ? { taskPath: result.taskPath } : {}),
                     });
                     return true;
                 }
-                if (method === "POST" && pathname === "/api/settings") {
+                if (method === "POST" && pathname === "/api/drafts/attach-task") {
                     let body;
                     try {
                         body = await readJsonBody(req);
@@ -1199,40 +1413,1000 @@ export function createOperatorRoutes(deps) {
                         json(res, 400, { error: "Invalid JSON body" });
                         return true;
                     }
-                    const record = body !== null && typeof body === "object" && !Array.isArray(body)
-                        ? body
-                        : {};
-                    const hasMax = Object.prototype.hasOwnProperty.call(record, "maxConcurrent");
-                    const hasCredentialSource = Object.prototype.hasOwnProperty.call(record, "credentialSource");
-                    if (!hasMax && !hasCredentialSource) {
-                        json(res, 400, {
-                            error: "maxConcurrent or credentialSource is required",
-                        });
+                    const parsed = parseAttachTaskBody(body);
+                    if ("ok" in parsed) {
+                        json(res, parsed.status, { error: parsed.error });
                         return true;
                     }
-                    let health = manager.getHealth();
-                    if (hasMax) {
-                        const n = parseSlotCount(record.maxConcurrent);
-                        if (n === undefined) {
-                            json(res, 400, { error: INVALID_SLOT_COUNT_MESSAGE });
+                    const writeRoot = body !== null &&
+                        typeof body === "object" &&
+                        !Array.isArray(body) &&
+                        typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let wireRoot;
+                    let roots;
+                    try {
+                        ({ wireRoot, roots } = await resolveCatalogStartInput({ store, bootCwd: cwd }, writeRoot));
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
                             return true;
                         }
-                        health = manager.setMaxConcurrent(n);
+                        throw err;
                     }
-                    let credential = getCredentialSourceSettings(cwd);
-                    if (hasCredentialSource) {
-                        try {
-                            credential = setCredentialSource(cwd, record.credentialSource);
+                    let taskRel;
+                    try {
+                        taskRel = resolveCatalogRelativePath({
+                            inputPath: parsed.taskPath,
+                            projectRoot: writeRoot,
+                            roots,
+                            fieldName: "task",
+                        }).relativePath;
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, 400, catalogPathErrorBody(err));
+                            return true;
                         }
-                        catch (err) {
-                            const mapped = mapProviderAuthError(err);
-                            json(res, mapped.status, mapped.body);
+                        throw err;
+                    }
+                    const ctx = await resolveStageflowContext(wireRoot.path);
+                    const result = await loadTaskArtifact(ctx.projectRoot, taskRel);
+                    if (!result.ok) {
+                        json(res, result.status, { error: result.error });
+                        return true;
+                    }
+                    json(res, 200, {
+                        task: result.task,
+                        taskPath: result.taskPath,
+                    });
+                    return true;
+                }
+                if (method === "GET" &&
+                    pathname === "/api/workshop/autosave") {
+                    const keyParam = url.searchParams.get("key");
+                    const key = workshopAutosaveSlotKey(keyParam);
+                    const writeRoot = url.searchParams.get("project_root") ?? undefined;
+                    let storeRoot;
+                    try {
+                        if (writeRoot) {
+                            const { wireRoot } = await resolveCatalogStartInput({ store, bootCwd: cwd }, writeRoot);
+                            const ctx = await resolveStageflowContext(wireRoot.path);
+                            storeRoot = resolveWorkshopAutosaveStoreRoot({
+                                projectRoot: ctx.projectRoot,
+                                isGitProject: ctx.isGitProject,
+                            });
+                        }
+                        else {
+                            const ctx = await resolveStageflowContext(cwd);
+                            storeRoot = resolveWorkshopAutosaveStoreRoot({
+                                projectRoot: ctx.isGitProject ? ctx.projectRoot : null,
+                                isGitProject: ctx.isGitProject,
+                            });
+                        }
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const record = readWorkshopAutosave(storeRoot, key);
+                    json(res, 200, { key, autosave: record });
+                    return true;
+                }
+                if (method === "PUT" &&
+                    pathname === "/api/workshop/autosave") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const key = workshopAutosaveSlotKey(typeof body.key === "string" ? body.key : undefined);
+                    const writeRoot = typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let storeRoot;
+                    try {
+                        if (writeRoot) {
+                            const { wireRoot } = await resolveWritableCatalogRoot({ store, bootCwd: cwd }, writeRoot);
+                            const ctx = await resolveStageflowContext(wireRoot.path);
+                            storeRoot = resolveWorkshopAutosaveStoreRoot({
+                                projectRoot: ctx.projectRoot,
+                                isGitProject: ctx.isGitProject,
+                            });
+                        }
+                        else {
+                            const ctx = await resolveStageflowContext(cwd);
+                            storeRoot = resolveWorkshopAutosaveStoreRoot({
+                                projectRoot: ctx.isGitProject ? ctx.projectRoot : null,
+                                isGitProject: ctx.isGitProject,
+                            });
+                        }
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const candidate = {
+                        version: 1,
+                        key,
+                        updatedAt: typeof body.updatedAt === "string" && body.updatedAt
+                            ? body.updatedAt
+                            : new Date().toISOString(),
+                        draft: body.draft,
+                        messages: body.messages,
+                        autoApply: Boolean(body.autoApply),
+                        ...(body.sessionModelOverride === null ||
+                            typeof body.sessionModelOverride === "string"
+                            ? { sessionModelOverride: body.sessionModelOverride }
+                            : {}),
+                        ...(body.destination !== undefined
+                            ? {
+                                destination: body.destination,
+                            }
+                            : {}),
+                        ...(body.savedPath === null || typeof body.savedPath === "string"
+                            ? { savedPath: body.savedPath }
+                            : {}),
+                        ...(body.savedTaskPath === null ||
+                            typeof body.savedTaskPath === "string"
+                            ? { savedTaskPath: body.savedTaskPath }
+                            : {}),
+                        ...(isPlainObject(body.diskFingerprints)
+                            ? {
+                                diskFingerprints: body.diskFingerprints,
+                            }
+                            : {}),
+                    };
+                    const parsed = parseWorkshopAutosaveRecord(candidate);
+                    if (!parsed) {
+                        json(res, 400, { error: "Invalid workshop autosave payload" });
+                        return true;
+                    }
+                    const written = writeWorkshopAutosave(storeRoot, parsed);
+                    json(res, 200, { autosave: written });
+                    return true;
+                }
+                if (method === "DELETE" &&
+                    pathname === "/api/workshop/autosave") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const key = workshopAutosaveSlotKey(typeof body.key === "string" ? body.key : undefined);
+                    const writeRoot = typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let storeRoot;
+                    try {
+                        if (writeRoot) {
+                            const { wireRoot } = await resolveWritableCatalogRoot({ store, bootCwd: cwd }, writeRoot);
+                            const ctx = await resolveStageflowContext(wireRoot.path);
+                            storeRoot = resolveWorkshopAutosaveStoreRoot({
+                                projectRoot: ctx.projectRoot,
+                                isGitProject: ctx.isGitProject,
+                            });
+                        }
+                        else {
+                            const ctx = await resolveStageflowContext(cwd);
+                            storeRoot = resolveWorkshopAutosaveStoreRoot({
+                                projectRoot: ctx.isGitProject ? ctx.projectRoot : null,
+                                isGitProject: ctx.isGitProject,
+                            });
+                        }
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const cleared = clearWorkshopAutosave(storeRoot, key);
+                    json(res, 200, { key, cleared });
+                    return true;
+                }
+                if (method === "GET" && pathname === "/api/workshop/picker") {
+                    const filter = url.searchParams.get("project_root") ?? undefined;
+                    const result = await listPipelinesMultiProject({
+                        store,
+                        bootCwd: cwd,
+                        projectRootFilter: filter,
+                    });
+                    if (result.root_errors.some((e) => e.code === "unknown_project_root") &&
+                        result.items.length === 0) {
+                        json(res, 400, {
+                            error: result.root_errors[0].message,
+                            code: "unknown_project_root",
+                            root_errors: result.root_errors,
+                        });
+                        return true;
+                    }
+                    json(res, 200, {
+                        rows: listWorkshopPickerRows(workshopBuildStoreRoot(), resolvePickerCatalogPipelines(result.items, result.roots), result.roots),
+                        root_errors: result.root_errors,
+                        ...(result.tip !== undefined ? { tip: result.tip } : {}),
+                    });
+                    return true;
+                }
+                if (method === "POST" && pathname === "/api/workshop/focus") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (typeof body.projectRoot !== "string" ||
+                        typeof body.relativePath !== "string") {
+                        json(res, 400, { error: "project root and path are required" });
+                        return true;
+                    }
+                    let projectRoot = body.projectRoot;
+                    try {
+                        const { wireRoot } = await resolveCatalogStartInput({ store, bootCwd: cwd }, body.projectRoot);
+                        projectRoot = wireRoot.path;
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, 400, { error: err.message });
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const focused = await focusUnboundWorkshopBuild(workshopBuildStoreRoot(), {
+                        projectRoot,
+                        relativePath: body.relativePath,
+                    });
+                    if (!focused.ok) {
+                        json(res, focused.status, { error: focused.error });
+                        return true;
+                    }
+                    json(res, focused.created ? 201 : 200, { build: focused.build });
+                    return true;
+                }
+                if (method === "GET" &&
+                    pathname === "/api/workshop/builds") {
+                    json(res, 200, {
+                        builds: listWorkshopBuilds(workshopBuildStoreRoot()),
+                    });
+                    return true;
+                }
+                if (method === "POST" &&
+                    pathname === "/api/workshop/builds") {
+                    let body = {};
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const draftParsed = parseDraftPackageBody(body);
+                    if ("ok" in draftParsed) {
+                        json(res, draftParsed.status, { error: draftParsed.error });
+                        return true;
+                    }
+                    const projectRoot = readBuildTieField(body, "projectRoot");
+                    if (!projectRoot.ok) {
+                        json(res, 400, { error: projectRoot.error });
+                        return true;
+                    }
+                    const relativePath = readBuildTieField(body, "relativePath");
+                    if (!relativePath.ok) {
+                        json(res, 400, { error: relativePath.error });
+                        return true;
+                    }
+                    const build = createWorkshopBuild(workshopBuildStoreRoot(), {
+                        draft: draftParsed,
+                        ...(typeof body.id === "string" ? { id: body.id } : {}),
+                        ...(projectRoot.present ? { projectRoot: projectRoot.value } : {}),
+                        ...(relativePath.present
+                            ? { relativePath: relativePath.value }
+                            : {}),
+                    });
+                    json(res, 201, { build });
+                    return true;
+                }
+                const workshopBuildMatch = pathname.match(/^\/api\/workshop\/builds\/([^/]+)$/);
+                if (method === "GET" && workshopBuildMatch) {
+                    const buildId = decodeURIComponent(workshopBuildMatch[1] ?? "");
+                    try {
+                        const build = getWorkshopBuild(workshopBuildStoreRoot(), buildId);
+                        json(res, 200, { build });
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopBuildStoreError &&
+                            err.code === "workshop_build_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                buildId: err.buildId,
+                            });
+                            return true;
+                        }
+                        throw err;
+                    }
+                    return true;
+                }
+                if (method === "PUT" && workshopBuildMatch) {
+                    const buildId = decodeURIComponent(workshopBuildMatch[1] ?? "");
+                    let body = {};
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    let draft;
+                    if (body.draft !== undefined) {
+                        const draftParsed = parseDraftPackageBody({ draft: body.draft });
+                        if ("ok" in draftParsed) {
+                            json(res, draftParsed.status, { error: draftParsed.error });
+                            return true;
+                        }
+                        draft = draftParsed;
+                    }
+                    const projectRoot = readBuildTieField(body, "projectRoot");
+                    if (!projectRoot.ok) {
+                        json(res, 400, { error: projectRoot.error });
+                        return true;
+                    }
+                    const relativePath = readBuildTieField(body, "relativePath");
+                    if (!relativePath.ok) {
+                        json(res, 400, { error: relativePath.error });
+                        return true;
+                    }
+                    try {
+                        const build = updateWorkshopBuild(workshopBuildStoreRoot(), buildId, {
+                            ...(draft ? { draft } : {}),
+                            ...(projectRoot.present
+                                ? { projectRoot: projectRoot.value }
+                                : {}),
+                            ...(relativePath.present
+                                ? { relativePath: relativePath.value }
+                                : {}),
+                        });
+                        json(res, 200, { build });
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopBuildStoreError &&
+                            err.code === "workshop_build_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                buildId: err.buildId,
+                            });
+                            return true;
+                        }
+                        throw err;
+                    }
+                    return true;
+                }
+                if (method === "GET" &&
+                    pathname === "/api/workshop/sessions") {
+                    const sessions = listWorkshopSessions(workshopSessionStoreRoot());
+                    json(res, 200, { sessions });
+                    return true;
+                }
+                if (method === "POST" &&
+                    pathname === "/api/workshop/sessions") {
+                    let body = {};
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const record = createWorkshopSession(workshopSessionStoreRoot(), {
+                        ...(typeof body.id === "string" ? { id: body.id } : {}),
+                    });
+                    json(res, 201, { session: record });
+                    return true;
+                }
+                const workshopSessionGetMatch = pathname.match(/^\/api\/workshop\/sessions\/([^/]+)$/);
+                if (method === "GET" && workshopSessionGetMatch) {
+                    const sessionId = decodeURIComponent(workshopSessionGetMatch[1] ?? "");
+                    try {
+                        const session = getWorkshopSession(workshopSessionStoreRoot(), sessionId);
+                        json(res, 200, { session });
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopSessionStoreError &&
+                            err.code === "workshop_session_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                sessionId: err.sessionId,
+                            });
+                            return true;
+                        }
+                        throw err;
+                    }
+                    return true;
+                }
+                const workshopSessionPatchMatch = pathname.match(/^\/api\/workshop\/sessions\/([^/]+)$/);
+                if (method === "PATCH" && workshopSessionPatchMatch) {
+                    const sessionId = decodeURIComponent(workshopSessionPatchMatch[1] ?? "");
+                    let body = {};
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!Object.prototype.hasOwnProperty.call(body, "activeBuildId")) {
+                        json(res, 400, { error: "activeBuildId is required" });
+                        return true;
+                    }
+                    const activeBuildId = body.activeBuildId;
+                    if (activeBuildId !== null && typeof activeBuildId !== "string") {
+                        json(res, 400, { error: "activeBuildId must be a string or null" });
+                        return true;
+                    }
+                    try {
+                        const session = updateWorkshopSessionActiveBuildId(workshopSessionStoreRoot(), sessionId, activeBuildId);
+                        json(res, 200, { session });
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopSessionStoreError &&
+                            err.code === "workshop_session_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                sessionId: err.sessionId,
+                            });
+                            return true;
+                        }
+                        throw err;
+                    }
+                    return true;
+                }
+                const workshopSessionUndoMatch = pathname.match(/^\/api\/workshop\/sessions\/([^/]+)\/undo$/);
+                if (method === "POST" && workshopSessionUndoMatch) {
+                    const sessionId = decodeURIComponent(workshopSessionUndoMatch[1] ?? "");
+                    let body = {};
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const draftParsed = parseDraftPackageBody(body);
+                    if ("ok" in draftParsed) {
+                        json(res, draftParsed.status, { error: draftParsed.error });
+                        return true;
+                    }
+                    try {
+                        const result = await undoWorkshopSessionMutation({
+                            sessionId,
+                            draft: draftParsed,
+                            ...(typeof body.mutationId === "string"
+                                ? { mutationId: body.mutationId }
+                                : {}),
+                            registry: workshopChatRegistry,
+                            storeRoot: workshopSessionStoreRoot(),
+                        });
+                        json(res, result.ok ? 200 : 409, result);
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopSessionStoreError &&
+                            err.code === "workshop_session_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                sessionId: err.sessionId,
+                            });
+                            return true;
+                        }
+                        json(res, 400, {
+                            error: err instanceof Error ? err.message : String(err),
+                        });
+                    }
+                    return true;
+                }
+                const workshopSessionAcceptMatch = pathname.match(/^\/api\/workshop\/sessions\/([^/]+)\/accept$/);
+                if (method === "POST" && workshopSessionAcceptMatch) {
+                    const sessionId = decodeURIComponent(workshopSessionAcceptMatch[1] ?? "");
+                    let body = {};
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const draftParsed = parseDraftPackageBody(body);
+                    if ("ok" in draftParsed) {
+                        json(res, draftParsed.status, { error: draftParsed.error });
+                        return true;
+                    }
+                    try {
+                        const result = await acceptWorkshopSessionMutation({
+                            sessionId,
+                            draft: draftParsed,
+                            ...(typeof body.mutationId === "string"
+                                ? { mutationId: body.mutationId }
+                                : {}),
+                            registry: workshopChatRegistry,
+                            storeRoot: workshopSessionStoreRoot(),
+                        });
+                        json(res, result.ok ? 200 : 409, result);
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopSessionStoreError &&
+                            err.code === "workshop_session_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                sessionId: err.sessionId,
+                            });
+                            return true;
+                        }
+                        json(res, 400, {
+                            error: err instanceof Error ? err.message : String(err),
+                        });
+                    }
+                    return true;
+                }
+                if (method === "POST" && pathname === "/api/workshop/chat/stop") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (typeof body.sessionId !== "string" || !body.sessionId.trim()) {
+                        json(res, 400, { error: "sessionId is required" });
+                        return true;
+                    }
+                    const stopped = await stopWorkshopChatTurn(workshopChatRegistry, body.sessionId);
+                    json(res, 200, { ok: true, ...stopped });
+                    return true;
+                }
+                if (method === "POST" && pathname === "/api/workshop/chat") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (typeof body.sessionId !== "string" || !body.sessionId.trim()) {
+                        json(res, 400, { error: "sessionId is required" });
+                        return true;
+                    }
+                    if (typeof body.message !== "string" || !body.message.trim()) {
+                        json(res, 400, { error: "message is required" });
+                        return true;
+                    }
+                    const sessionId = body.sessionId;
+                    const draftParsed = parseDraftPackageBody(body);
+                    if ("ok" in draftParsed) {
+                        json(res, draftParsed.status, { error: draftParsed.error });
+                        return true;
+                    }
+                    const settingsDefault = await readWorkshopOpenModel(cwd);
+                    const accept = String(req.headers.accept ?? "");
+                    const wantsStream = body.stream === true ||
+                        accept.includes("application/x-ndjson") ||
+                        accept.includes("text/event-stream");
+                    const chatTurnBase = {
+                        sessionId: body.sessionId,
+                        draft: draftParsed,
+                        message: body.message,
+                        autoApply: body.autoApply === true,
+                        model: typeof body.model === "string" || body.model === null
+                            ? body.model
+                            : undefined,
+                        settingsDefault: settingsDefault ?? null,
+                        registry: workshopChatRegistry,
+                        storeRoot: workshopSessionStoreRoot(),
+                    };
+                    // Fail closed on missing sessions before opening an NDJSON body.
+                    try {
+                        getWorkshopSession(workshopSessionStoreRoot(), body.sessionId);
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopSessionStoreError &&
+                            err.code === "workshop_session_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                sessionId: err.sessionId,
+                            });
+                            return true;
+                        }
+                        throw err;
+                    }
+                    if (wantsStream) {
+                        res.writeHead(200, {
+                            "Content-Type": "application/x-ndjson; charset=utf-8",
+                            "Cache-Control": "no-store",
+                        });
+                        const resolvedModel = resolveWorkshopModel({
+                            sessionOverride: typeof body.model === "string" || body.model === null
+                                ? body.model
+                                : undefined,
+                            settingsDefault: settingsDefault ?? null,
+                        });
+                        const writeFrame = async (frame) => {
+                            if (req.aborted || res.writableEnded || res.destroyed)
+                                return;
+                            const line = `${JSON.stringify(frame)}\n`;
+                            if (!res.write(line)) {
+                                await new Promise((resolve) => {
+                                    const onDrain = () => {
+                                        cleanup();
+                                        resolve();
+                                    };
+                                    const onAbort = () => {
+                                        cleanup();
+                                        if (!res.writableEnded && !res.destroyed) {
+                                            res.destroy();
+                                        }
+                                        resolve();
+                                    };
+                                    const cleanup = () => {
+                                        res.off("drain", onDrain);
+                                        req.off("aborted", onAbort);
+                                        req.off("close", onAbort);
+                                        res.off("close", onAbort);
+                                        res.off("error", onAbort);
+                                    };
+                                    res.once("drain", onDrain);
+                                    req.once("aborted", onAbort);
+                                    req.once("close", onAbort);
+                                    res.once("close", onAbort);
+                                    res.once("error", onAbort);
+                                    if (req.aborted || res.writableEnded || res.destroyed) {
+                                        onAbort();
+                                    }
+                                });
+                            }
+                        };
+                        let streamedDelta = false;
+                        let writeChain = Promise.resolve();
+                        let turnFinished = false;
+                        const enqueueFrame = (frame) => {
+                            writeChain = writeChain.then(() => writeFrame(frame));
+                        };
+                        const stopIfClientLeft = () => {
+                            if (turnFinished || res.writableEnded)
+                                return;
+                            void workshopChatRegistry.abortTurn(sessionId);
+                        };
+                        res.once("close", stopIfClientLeft);
+                        try {
+                            const turn = await runWorkshopChatTurn({
+                                ...chatTurnBase,
+                                onDelta: (text) => {
+                                    streamedDelta = true;
+                                    enqueueFrame({ type: "delta", text });
+                                },
+                                onActivity: (update) => {
+                                    enqueueFrame({ type: "activity", ...update });
+                                },
+                                onPointerChange: (frame) => {
+                                    enqueueFrame({
+                                        type: "pointer-change",
+                                        buildId: frame.buildId,
+                                        draft: frame.draft,
+                                    });
+                                },
+                            });
+                            turnFinished = true;
+                            await writeChain;
+                            for (const frame of iterateWorkshopChatStreamFrames(turn, {
+                                chunkAssistantText: !streamedDelta,
+                            })) {
+                                await writeFrame(frame);
+                            }
+                            if (!res.writableEnded && !res.destroyed) {
+                                res.end();
+                            }
+                        }
+                        catch (err) {
+                            turnFinished = true;
+                            await writeChain.catch(() => undefined);
+                            const message = err instanceof Error ? err.message : String(err);
+                            const errorEvent = { type: "error", message };
+                            await writeFrame({
+                                type: "event",
+                                event: errorEvent,
+                            });
+                            await writeFrame({
+                                type: "done",
+                                sessionId: body.sessionId,
+                                events: [errorEvent],
+                                draft: draftParsed,
+                                pending: null,
+                                autoApply: false,
+                                model: resolvedModel,
+                                buildId: workshopChatRegistry.getPinnedBuildId(body.sessionId),
+                            });
+                            if (!res.writableEnded && !res.destroyed) {
+                                res.end();
+                            }
+                        }
+                        return true;
+                    }
+                    let turn;
+                    try {
+                        turn = await runWorkshopChatTurn(chatTurnBase);
+                    }
+                    catch (err) {
+                        if (err instanceof WorkshopSessionStoreError &&
+                            err.code === "workshop_session_not_found") {
+                            json(res, 404, {
+                                error: err.message,
+                                code: err.code,
+                                sessionId: err.sessionId,
+                            });
+                            return true;
+                        }
+                        json(res, 400, {
+                            error: err instanceof Error ? err.message : String(err),
+                        });
+                        return true;
+                    }
+                    json(res, 200, turn);
+                    return true;
+                }
+                if (method === "POST" &&
+                    pathname === "/api/workshop/disk-change") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (!isPlainObject(body)) {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    if (typeof body.pipelinePath !== "string" || !body.pipelinePath.trim()) {
+                        json(res, 400, { error: "pipelinePath is required" });
+                        return true;
+                    }
+                    const draftParsed = parseDraftPackageBody(body);
+                    if ("ok" in draftParsed) {
+                        json(res, draftParsed.status, { error: draftParsed.error });
+                        return true;
+                    }
+                    const writeRoot = typeof body.project_root === "string"
+                        ? body.project_root
+                        : undefined;
+                    let projectRoot;
+                    try {
+                        const { wireRoot } = await resolveCatalogStartInput({ store, bootCwd: cwd }, writeRoot);
+                        const ctx = await resolveStageflowContext(wireRoot.path);
+                        projectRoot = ctx.projectRoot;
+                    }
+                    catch (err) {
+                        if (err instanceof CatalogPathError) {
+                            json(res, err.code === "catalog_root_read_only" ? 403 : 400, catalogPathErrorBody(err));
+                            return true;
+                        }
+                        throw err;
+                    }
+                    const relativePaths = draftPackageDiskRelativePaths({
+                        pipelinePath: body.pipelinePath,
+                        draft: draftParsed,
+                        taskPath: typeof body.taskPath === "string" ? body.taskPath : null,
+                    });
+                    const current = fingerprintPackageFiles(projectRoot, relativePaths);
+                    const baseline = isPlainObject(body.baseline) &&
+                        Object.values(body.baseline).every((v) => typeof v === "string")
+                        ? body.baseline
+                        : null;
+                    const detection = detectDiskChange({ baseline, current });
+                    json(res, 200, {
+                        fingerprints: current,
+                        changed: detection.changed,
+                        changedPaths: detection.changedPaths,
+                    });
+                    return true;
+                }
+                if (method === "GET" && pathname === "/api/models") {
+                    const filter = url.searchParams.get("project_root") ?? undefined;
+                    const result = await listModelsMultiProject({
+                        store,
+                        bootCwd: cwd,
+                        projectRootFilter: filter,
+                    });
+                    if (result.root_errors.some((e) => e.code === "unknown_project_root") &&
+                        result.items.length === 0) {
+                        json(res, 400, {
+                            error: result.root_errors[0].message,
+                            code: "unknown_project_root",
+                            root_errors: result.root_errors,
+                        });
+                        return true;
+                    }
+                    json(res, 200, {
+                        models: result.models,
+                        entries: result.items,
+                        root_errors: result.root_errors,
+                    });
+                    return true;
+                }
+                if (await handleProviderRoutes(req, res, {
+                    cwd,
+                    readJsonBody,
+                    json,
+                    providerAuthContext,
+                })) {
+                    return true;
+                }
+                if (await handleProjectMcpRoutes(req, res, {
+                    projectRoot: rootDir,
+                    json,
+                })) {
+                    return true;
+                }
+                if (await handleTriggerRoutes(req, res, {
+                    cwd,
+                    manager,
+                    store,
+                    json,
+                    readJsonBody,
+                    readRawBody,
+                    auditLog,
+                })) {
+                    return true;
+                }
+                if (method === "GET" && pathname === "/api/skills") {
+                    json(res, 200, await listSkills({ cwd, agentDir }));
+                    return true;
+                }
+                if (method === "GET" && pathname === "/api/extensions") {
+                    json(res, 200, await listExtensions({ cwd, agentDir }));
+                    return true;
+                }
+                if (method === "GET" && pathname === "/api/health") {
+                    await handleApiHealth(req, res, boot);
+                    return true;
+                }
+                if (method === "GET" && pathname === "/api/settings") {
+                    const health = manager.getHealth();
+                    const credential = getCredentialSourceSettings(cwd);
+                    const factory = readFactorySettings(cwd);
+                    const defaultModel = await readWorkshopOpenModel(cwd);
+                    json(res, 200, {
+                        maxConcurrent: health.maxConcurrent,
+                        ...credential,
+                        ...(factory.workshopModel !== undefined
+                            ? { workshopModel: factory.workshopModel }
+                            : {}),
+                        defaultModel,
+                    });
+                    return true;
+                }
+                if (method === "POST" && pathname === "/api/settings") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        json(res, 400, { error: "Invalid JSON body" });
+                        return true;
+                    }
+                    const record = body !== null && typeof body === "object" && !Array.isArray(body)
+                        ? body
+                        : {};
+                    const hasMax = Object.prototype.hasOwnProperty.call(record, "maxConcurrent");
+                    const hasCredentialSource = Object.prototype.hasOwnProperty.call(record, "credentialSource");
+                    const hasWorkshopModel = Object.prototype.hasOwnProperty.call(record, "workshopModel");
+                    if (!hasMax && !hasCredentialSource && !hasWorkshopModel) {
+                        json(res, 400, {
+                            error: "maxConcurrent, credentialSource, or workshopModel is required",
+                        });
+                        return true;
+                    }
+                    let health = manager.getHealth();
+                    if (hasMax) {
+                        const n = parseSlotCount(record.maxConcurrent);
+                        if (n === undefined) {
+                            json(res, 400, { error: INVALID_SLOT_COUNT_MESSAGE });
+                            return true;
+                        }
+                        health = manager.setMaxConcurrent(n);
+                    }
+                    let credential = getCredentialSourceSettings(cwd);
+                    if (hasCredentialSource) {
+                        try {
+                            credential = setCredentialSource(cwd, record.credentialSource);
+                        }
+                        catch (err) {
+                            const mapped = mapProviderAuthError(err);
+                            json(res, mapped.status, mapped.body);
+                            return true;
+                        }
+                    }
+                    let workshopModel = readFactorySettings(cwd).workshopModel;
+                    if (hasWorkshopModel) {
+                        const parsed = parseWorkshopModelSetting(record.workshopModel);
+                        if (parsed === undefined) {
+                            json(res, 400, { error: INVALID_WORKSHOP_MODEL_MESSAGE });
                             return true;
                         }
+                        writeFactorySettings(cwd, { workshopModel: parsed });
+                        workshopModel = parsed;
                     }
                     json(res, 200, {
                         ...health,
                         ...credential,
+                        ...(workshopModel !== undefined ? { workshopModel } : {}),
+                        defaultModel: await readWorkshopOpenModel(cwd),
                     });
                     return true;
                 }
@@ -1284,6 +2458,9 @@ export async function startUiServer(options) {
             allowedHosts,
             controlTokens,
             getShutdown: () => shutdown,
+            ...(options.workshopOperatorHost
+                ? { workshopOperatorHost: options.workshopOperatorHost }
+                : {}),
         });
     const envelope = await createHttpHost({
         boot,