tlc-claude-code 2.0.1 → 2.2.0

package/server/lib/vps-bootstrap.js

@@ -0,0 +1,124 @@
+/**
+ * VPS Bootstrap — idempotent server setup via SSH
+ * Phase 80 Task 5
+ */
+
+const { isValidUsername } = require('./input-sanitizer.js');
+
+/**
+ * Generate idempotent bootstrap bash script
+ * @param {Object} options
+ * @param {string} [options.deployUser=deploy] - Deploy user to create
+ * @returns {string} Bash script
+ */
+function generateBootstrapScript(options = {}) {
+  const deployUser = options.deployUser || 'deploy';
+  if (!isValidUsername(deployUser)) throw new Error(`Invalid deploy user: ${deployUser}`);
+
+  return `#!/bin/bash
+set -e
+
+echo "=== TLC VPS Bootstrap ==="
+echo "Date: $(date)"
+
+# Step 1: Update packages
+echo "[1/7] Updating packages..."
+apt-get update -y && apt-get upgrade -y
+
+# Step 2: Install Docker (idempotent)
+echo "[2/7] Installing Docker..."
+if command -v docker &>/dev/null; then
+  echo "  Docker already installed: $(docker --version)"
+else
+  curl -fsSL https://get.docker.com | sh
+  systemctl enable docker
+  systemctl start docker
+  echo "  Docker installed: $(docker --version)"
+fi
+
+# Install Docker Compose plugin
+if docker compose version &>/dev/null; then
+  echo "  Docker Compose already installed"
+else
+  apt-get install -y docker-compose-plugin
+fi
+
+# Step 3: Install Nginx (idempotent)
+echo "[3/7] Installing Nginx..."
+if command -v nginx &>/dev/null; then
+  echo "  Nginx already installed: $(nginx -v 2>&1)"
+else
+  apt-get install -y nginx
+  systemctl enable nginx
+  systemctl start nginx
+  echo "  Nginx installed"
+fi
+
+# Step 4: Install Certbot (idempotent)
+echo "[4/7] Installing Certbot..."
+if command -v certbot &>/dev/null; then
+  echo "  Certbot already installed: $(certbot --version 2>&1)"
+else
+  apt-get install -y certbot python3-certbot-nginx
+  echo "  Certbot installed"
+fi
+
+# Step 5: Configure UFW firewall
+echo "[5/7] Configuring firewall..."
+apt-get install -y ufw
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow 22/tcp
+ufw allow 80/tcp
+ufw allow 443/tcp
+echo "y" | ufw enable
+echo "  Firewall configured (22, 80, 443)"
+
+# Step 6: Create deploy user (idempotent)
+echo "[6/7] Setting up deploy user..."
+if id "${deployUser}" &>/dev/null; then
+  echo "  User ${deployUser} already exists"
+else
+  useradd -m -s /bin/bash ${deployUser}
+  usermod -aG docker ${deployUser}
+  mkdir -p /home/${deployUser}/.ssh
+  chmod 700 /home/${deployUser}/.ssh
+  # Copy authorized keys from root if available
+  if [ -f /root/.ssh/authorized_keys ]; then
+    cp /root/.ssh/authorized_keys /home/${deployUser}/.ssh/
+    chown -R ${deployUser}:${deployUser} /home/${deployUser}/.ssh
+    chmod 600 /home/${deployUser}/.ssh/authorized_keys
+  fi
+  echo "  User ${deployUser} created and added to docker group"
+fi
+
+# Step 7: Create deployment directories
+echo "[7/7] Setting up deployment directories..."
+mkdir -p /opt/deploys
+chown ${deployUser}:${deployUser} /opt/deploys
+
+echo ""
+echo "=== Bootstrap Complete ==="
+echo "Docker: $(docker --version 2>/dev/null || echo 'not installed')"
+echo "Nginx:  $(nginx -v 2>&1 || echo 'not installed')"
+echo "Certbot: $(certbot --version 2>&1 || echo 'not installed')"
+echo "UFW:    $(ufw status | head -1)"
+echo "User:   ${deployUser}"
+`;
+}
+
+/**
+ * Parse bootstrap status from SSH command outputs
+ * @param {Object} output - { docker, nginx, certbot, ufw }
+ * @returns {Object} { docker, nginx, certbot, firewall }
+ */
+function checkBootstrapStatus(output) {
+  return {
+    docker: !!(output.docker && !output.docker.includes('not found') && output.docker.includes('version')),
+    nginx: !!(output.nginx && !output.nginx.includes('not found') && output.nginx.match(/nginx/i)),
+    certbot: !!(output.certbot && !output.certbot.includes('not found') && output.certbot.match(/certbot/i)),
+    firewall: !!(output.ufw && output.ufw.includes('active') && !output.ufw.includes('inactive')),
+  };
+}
+
+module.exports = { generateBootstrapScript, checkBootstrapStatus };

package/server/lib/vps-bootstrap.test.js

@@ -0,0 +1,79 @@
+import { describe, it, expect } from 'vitest';
+
+const { generateBootstrapScript, checkBootstrapStatus } = await import('./vps-bootstrap.js');
+
+describe('VPS Bootstrap', () => {
+  describe('generateBootstrapScript', () => {
+    it('returns a valid bash script', () => {
+      const script = generateBootstrapScript({ deployUser: 'deploy' });
+      expect(script).toContain('#!/bin/bash');
+    });
+
+    it('includes Docker install step', () => {
+      const script = generateBootstrapScript({});
+      expect(script).toContain('docker');
+      expect(script).toMatch(/get.docker.com|install.*docker/i);
+    });
+
+    it('includes Nginx install step', () => {
+      const script = generateBootstrapScript({});
+      expect(script).toContain('nginx');
+      expect(script).toMatch(/apt.*install.*nginx|install.*nginx/i);
+    });
+
+    it('includes UFW firewall config (ports 22, 80, 443)', () => {
+      const script = generateBootstrapScript({});
+      expect(script).toContain('ufw');
+      expect(script).toContain('22');
+      expect(script).toContain('80');
+      expect(script).toContain('443');
+    });
+
+    it('includes Certbot install for SSL', () => {
+      const script = generateBootstrapScript({});
+      expect(script).toContain('certbot');
+    });
+
+    it('creates deploy user when specified', () => {
+      const script = generateBootstrapScript({ deployUser: 'deploy' });
+      expect(script).toContain('deploy');
+      expect(script).toMatch(/useradd|adduser/);
+    });
+
+    it('is idempotent (checks before installing)', () => {
+      const script = generateBootstrapScript({});
+      // Should check if Docker already installed
+      expect(script).toMatch(/which docker|command -v docker|docker.*--version/);
+    });
+  });
+
+  describe('checkBootstrapStatus', () => {
+    it('parses installed components from SSH output', () => {
+      const output = {
+        docker: 'Docker version 24.0.0, build abc123',
+        nginx: 'nginx/1.22.1',
+        certbot: 'certbot 2.0.0',
+        ufw: 'Status: active',
+      };
+      const status = checkBootstrapStatus(output);
+      expect(status.docker).toBe(true);
+      expect(status.nginx).toBe(true);
+      expect(status.certbot).toBe(true);
+      expect(status.firewall).toBe(true);
+    });
+
+    it('detects missing components', () => {
+      const output = {
+        docker: 'command not found',
+        nginx: 'command not found',
+        certbot: 'command not found',
+        ufw: 'Status: inactive',
+      };
+      const status = checkBootstrapStatus(output);
+      expect(status.docker).toBe(false);
+      expect(status.nginx).toBe(false);
+      expect(status.certbot).toBe(false);
+      expect(status.firewall).toBe(false);
+    });
+  });
+});

package/server/lib/vps-monitor.js

@@ -0,0 +1,126 @@
+/**
+ * VPS Monitor — server metrics collection and alerting
+ * Phase 80 Task 9
+ */
+
+const { isValidDomain } = require('./input-sanitizer.js');
+
+/**
+ * Create VPS monitor
+ * @param {Object} options
+ * @param {Object} options.sshClient - SSH client instance
+ * @returns {Object} VPS monitor API
+ */
+function createVpsMonitor({ sshClient }) {
+
+  /**
+   * Collect server metrics via SSH
+   * @param {Object} sshConfig
+   * @returns {Promise<Object>} metrics
+   */
+  async function getServerMetrics(sshConfig) {
+    const [dfResult, freeResult, cpuResult, uptimeResult, dockerResult] = await Promise.all([
+      sshClient.exec(sshConfig, "df -h / | tail -1"),
+      sshClient.exec(sshConfig, "free -k | head -2"),
+      sshClient.exec(sshConfig, "cat /proc/stat | head -1"),
+      sshClient.exec(sshConfig, "uptime"),
+      sshClient.exec(sshConfig, "docker ps --format json 2>/dev/null || echo '[]'"),
+    ]);
+
+    // Parse disk
+    const dfParts = dfResult.stdout.trim().split(/\s+/);
+    const diskPercent = parseInt((dfParts[4] || '0').replace('%', ''), 10);
+
+    // Parse memory
+    const memLines = freeResult.stdout.trim().split('\n');
+    const memParts = (memLines[1] || '').trim().split(/\s+/);
+    const totalKb = parseInt(memParts[1] || '0', 10);
+    const usedKb = parseInt(memParts[2] || '0', 10);
+
+    // Parse CPU
+    const cpuParts = cpuResult.stdout.trim().split(/\s+/).slice(1).map(Number);
+    const cpuTotal = cpuParts.reduce((a, b) => a + b, 0);
+    const cpuIdle = cpuParts[3] || 0;
+    const cpuPercent = cpuTotal > 0 ? Math.round(((cpuTotal - cpuIdle) / cpuTotal) * 100) : 0;
+
+    // Parse containers
+    let containers = [];
+    try {
+      const dockerOut = dockerResult.stdout.trim();
+      if (dockerOut.startsWith('[')) {
+        containers = JSON.parse(dockerOut);
+      } else if (dockerOut.startsWith('{')) {
+        containers = dockerOut.split('\n').filter(Boolean).map(l => JSON.parse(l));
+      }
+    } catch {}
+
+    return {
+      disk: { usedPercent: diskPercent, raw: dfResult.stdout.trim() },
+      memory: { totalKb, usedKb, usedPercent: totalKb > 0 ? Math.round((usedKb / totalKb) * 100) : 0 },
+      cpu: { usedPercent: cpuPercent },
+      uptime: uptimeResult.stdout.trim(),
+      containers: containers.map(c => ({
+        name: c.Names || c.name || '',
+        state: c.State || c.state || 'unknown',
+        status: c.Status || c.status || '',
+      })),
+      timestamp: new Date().toISOString(),
+    };
+  }
+
+  /**
+   * Check for alert conditions
+   * @param {Object} metrics
+   * @returns {Array} alerts
+   */
+  function checkAlerts(metrics) {
+    const alerts = [];
+
+    // Disk alerts
+    if (metrics.disk && metrics.disk.usedPercent > 90) {
+      alerts.push({ type: 'disk', level: 'critical', message: `Disk ${metrics.disk.usedPercent}% full` });
+    } else if (metrics.disk && metrics.disk.usedPercent > 80) {
+      alerts.push({ type: 'disk', level: 'warning', message: `Disk ${metrics.disk.usedPercent}% full` });
+    }
+
+    // Memory alerts
+    if (metrics.memory && metrics.memory.usedPercent > 90) {
+      alerts.push({ type: 'memory', level: 'warning', message: `Memory ${metrics.memory.usedPercent}% used` });
+    }
+
+    // Container alerts
+    if (metrics.containers) {
+      for (const c of metrics.containers) {
+        if (c.state === 'exited' && c.exitCode !== undefined && c.exitCode !== 0) {
+          alerts.push({ type: 'container', level: 'critical', message: `Container ${c.name} crashed (exit code ${c.exitCode})` });
+        }
+      }
+    }
+
+    return alerts;
+  }
+
+  /**
+   * Check SSL certificate expiry
+   * @param {Object} sshConfig
+   * @param {string} domain
+   * @returns {Promise<Object>}
+   */
+  async function checkSslExpiry(sshConfig, domain) {
+    if (!isValidDomain(domain)) throw new Error(`Invalid domain: ${domain}`);
+    const result = await sshClient.exec(
+      sshConfig,
+      `openssl x509 -enddate -noout -in /etc/letsencrypt/live/${domain}/fullchain.pem 2>/dev/null || echo "not found"`
+    );
+
+    const match = result.stdout.match(/notAfter=(.+)/);
+    const expiresAt = match ? match[1].trim() : null;
+    const daysLeft = expiresAt ? Math.floor((new Date(expiresAt) - new Date()) / 86400000) : null;
+
+    return { domain, expiresAt, daysLeft, warning: daysLeft !== null && daysLeft < 14 };
+  }
+
+  return { getServerMetrics, checkAlerts, checkSslExpiry };
+}
+
+module.exports = { createVpsMonitor };

package/server/lib/vps-monitor.test.js

@@ -0,0 +1,98 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+const { createVpsMonitor } = await import('./vps-monitor.js');
+
+function createMockSsh() {
+  return {
+    exec: vi.fn().mockResolvedValue({ stdout: '', stderr: '', exitCode: 0 }),
+  };
+}
+
+describe('VPS Monitor', () => {
+  let monitor;
+  let mockSsh;
+
+  beforeEach(() => {
+    mockSsh = createMockSsh();
+    monitor = createVpsMonitor({ sshClient: mockSsh });
+  });
+
+  describe('getServerMetrics', () => {
+    it('parses disk usage from df output', async () => {
+      mockSsh.exec.mockImplementation(async (config, cmd) => {
+        if (cmd.includes('df')) return { stdout: '/dev/sda1 50G 20G 28G 42% /', stderr: '', exitCode: 0 };
+        if (cmd.includes('free')) return { stdout: '              total        used        free\nMem:        8000000     4000000     3000000', stderr: '', exitCode: 0 };
+        if (cmd.includes('nproc')) return { stdout: '4', stderr: '', exitCode: 0 };
+        if (cmd.includes('/proc/stat')) return { stdout: 'cpu  1000 200 300 7000 100 0 0 0', stderr: '', exitCode: 0 };
+        if (cmd.includes('uptime')) return { stdout: ' 12:00:00 up 30 days', stderr: '', exitCode: 0 };
+        if (cmd.includes('docker')) return { stdout: '[]', stderr: '', exitCode: 0 };
+        return { stdout: '', stderr: '', exitCode: 0 };
+      });
+
+      const metrics = await monitor.getServerMetrics({ host: '1.2.3.4', username: 'deploy' });
+      expect(metrics.disk).toBeDefined();
+      expect(metrics.disk.usedPercent).toBe(42);
+    });
+
+    it('parses memory from free output', async () => {
+      mockSsh.exec.mockImplementation(async (config, cmd) => {
+        if (cmd.includes('df')) return { stdout: '/dev/sda1 50G 20G 28G 42% /', stderr: '', exitCode: 0 };
+        if (cmd.includes('free')) return { stdout: '              total        used        free\nMem:        8000000     4000000     3000000', stderr: '', exitCode: 0 };
+        if (cmd.includes('nproc')) return { stdout: '4', stderr: '', exitCode: 0 };
+        if (cmd.includes('/proc/stat')) return { stdout: 'cpu  1000 200 300 7000 100 0 0 0', stderr: '', exitCode: 0 };
+        if (cmd.includes('uptime')) return { stdout: ' 12:00:00 up 30 days', stderr: '', exitCode: 0 };
+        if (cmd.includes('docker')) return { stdout: '[]', stderr: '', exitCode: 0 };
+        return { stdout: '', stderr: '', exitCode: 0 };
+      });
+
+      const metrics = await monitor.getServerMetrics({ host: '1.2.3.4', username: 'deploy' });
+      expect(metrics.memory).toBeDefined();
+      expect(metrics.memory.totalKb).toBe(8000000);
+      expect(metrics.memory.usedKb).toBe(4000000);
+    });
+  });
+
+  describe('checkAlerts', () => {
+    it('returns warning for disk > 80%', () => {
+      const alerts = monitor.checkAlerts({ disk: { usedPercent: 85 }, memory: { usedPercent: 50 }, containers: [] });
+      expect(alerts.some(a => a.level === 'warning' && a.type === 'disk')).toBe(true);
+    });
+
+    it('returns critical for disk > 90%', () => {
+      const alerts = monitor.checkAlerts({ disk: { usedPercent: 95 }, memory: { usedPercent: 50 }, containers: [] });
+      expect(alerts.some(a => a.level === 'critical' && a.type === 'disk')).toBe(true);
+    });
+
+    it('returns alert for crashed container', () => {
+      const alerts = monitor.checkAlerts({
+        disk: { usedPercent: 30 },
+        memory: { usedPercent: 50 },
+        containers: [{ name: 'myapp', state: 'exited', exitCode: 1 }],
+      });
+      expect(alerts.some(a => a.type === 'container')).toBe(true);
+    });
+
+    it('returns no alerts when everything is healthy', () => {
+      const alerts = monitor.checkAlerts({
+        disk: { usedPercent: 30 },
+        memory: { usedPercent: 50 },
+        containers: [{ name: 'myapp', state: 'running', exitCode: 0 }],
+      });
+      expect(alerts).toHaveLength(0);
+    });
+  });
+
+  describe('checkSslExpiry', () => {
+    it('parses cert expiry date', async () => {
+      mockSsh.exec.mockResolvedValue({
+        stdout: 'notAfter=Mar 15 00:00:00 2026 GMT',
+        stderr: '',
+        exitCode: 0,
+      });
+
+      const expiry = await monitor.checkSslExpiry({ host: '1.2.3.4', username: 'deploy' }, 'myapp.dev');
+      expect(expiry.domain).toBe('myapp.dev');
+      expect(expiry.expiresAt).toBeTruthy();
+    });
+  });
+});

package/server/lib/workspace-api.js

@@ -16,6 +16,8 @@ const { createTestInventory } = require('./test-inventory');
 const { createRoadmapApi } = require('./roadmap-api');
 const { createPlanWriter } = require('./plan-writer');
 const { createBugWriter } = require('./bug-writer');
+const { createMemoryStoreAdapter } = require('./memory-store-adapter');
+const { createCaptureGuard } = require('./capture-guard');
 
 /**
  * Encode a project path to a URL-safe project ID
@@ -62,6 +64,7 @@ function readProjectStatus(projectPath) {
     phaseName: null,
     totalPhases: 0,
     completedPhases: 0,
+    coverage: null,
   };
 
   if (!status.exists) {
@@ -128,6 +131,19 @@ function readProjectStatus(projectPath) {
     }
   }
 
+  // Read coverage from Istanbul coverage-summary.json
+  const coveragePath = path.join(projectPath, 'coverage', 'coverage-summary.json');
+  if (fs.existsSync(coveragePath)) {
+    try {
+      const covData = JSON.parse(fs.readFileSync(coveragePath, 'utf-8'));
+      if (covData.total && covData.total.lines && typeof covData.total.lines.pct === 'number') {
+        status.coverage = covData.total.lines.pct;
+      }
+    } catch {
+      // Malformed coverage file — leave as null
+    }
+  }
+
   return status;
 }
 
@@ -292,7 +308,7 @@ function readProjectBugs(projectPath) {
  * @returns {express.Router} Express router with workspace endpoints
  */
 function createWorkspaceRouter(options = {}) {
-  const { globalConfig, projectScanner } = options;
+  const { globalConfig, projectScanner, memoryApi, memoryDeps = {} } = options;
 
   if (!globalConfig) {
     throw new Error('globalConfig is required');
@@ -302,6 +318,7 @@ function createWorkspaceRouter(options = {}) {
   }
 
   const router = express.Router();
+  const captureGuard = createCaptureGuard();
 
   // =========================================================================
   // GET /config - Returns workspace configuration
@@ -805,6 +822,170 @@ function createWorkspaceRouter(options = {}) {
     }
   });
 
+  // =========================================================================
+  // Memory API routes (Phase 77, fixed per-project in Phase 78)
+  // =========================================================================
+  if (memoryApi) {
+    router.get('/projects/:projectId/memory/decisions', async (req, res) => {
+      try {
+        const roots = globalConfig.getRoots();
+        const project = findProjectById(projectScanner, roots, req.params.projectId);
+        if (!project) return res.status(404).json({ error: 'Project not found' });
+        const adapter = createMemoryStoreAdapter(project.path);
+        const decisions = await adapter.listDecisions();
+        res.json({ decisions });
+      } catch (err) {
+        res.status(500).json({ error: err.message });
+      }
+    });
+
+    router.get('/projects/:projectId/memory/gotchas', async (req, res) => {
+      try {
+        const roots = globalConfig.getRoots();
+        const project = findProjectById(projectScanner, roots, req.params.projectId);
+        if (!project) return res.status(404).json({ error: 'Project not found' });
+        const adapter = createMemoryStoreAdapter(project.path);
+        const gotchas = await adapter.listGotchas();
+        res.json({ gotchas });
+      } catch (err) {
+        res.status(500).json({ error: err.message });
+      }
+    });
+
+    router.get('/projects/:projectId/memory/stats', async (req, res) => {
+      try {
+        const roots = globalConfig.getRoots();
+        const project = findProjectById(projectScanner, roots, req.params.projectId);
+        if (!project) return res.status(404).json({ error: 'Project not found' });
+        const adapter = createMemoryStoreAdapter(project.path);
+        const stats = await adapter.getStats();
+        res.json(stats);
+      } catch (err) {
+        res.status(500).json({ error: err.message });
+      }
+    });
+  }
+
+  // =========================================================================
+  // Memory capture endpoint (Phase 79 Task 5)
+  // =========================================================================
+  router.post('/projects/:projectId/memory/capture', async (req, res) => {
+    try {
+      const projectId = req.params.projectId;
+
+      // Rate limit check
+      const rateCheck = captureGuard.checkRateLimit(projectId);
+      if (!rateCheck.ok) {
+        return res.status(rateCheck.status).json({ error: rateCheck.error });
+      }
+
+      // Payload validation (size + structure)
+      const validation = captureGuard.validate(req.body, projectId);
+      if (!validation.ok) {
+        return res.status(validation.status).json({ error: validation.error });
+      }
+
+      const roots = globalConfig.getRoots();
+      const project = findProjectById(projectScanner, roots, projectId);
+      if (!project) return res.status(404).json({ error: 'Project not found' });
+
+      // Deduplicate exchanges
+      const exchanges = captureGuard.deduplicate(req.body.exchanges, projectId);
+
+      if (exchanges.length === 0) {
+        return res.json({ captured: 0, deduplicated: true });
+      }
+
+      // Process in background — respond immediately
+      let captured = 0;
+      const { observeAndRemember, vectorIndexer } = memoryDeps;
+
+      for (const exchange of exchanges) {
+        try {
+          if (typeof observeAndRemember === 'function') {
+            await observeAndRemember(project.path, exchange);
+          }
+          if (vectorIndexer && typeof vectorIndexer.indexChunk === 'function') {
+            await vectorIndexer.indexChunk(exchange);
+          }
+          captured++;
+        } catch {
+          // Individual exchange failures don't stop the batch
+        }
+      }
+
+      res.json({ captured });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // =========================================================================
+  // Memory search endpoint (Phase 79 Task 6)
+  // =========================================================================
+  router.get('/projects/:projectId/memory/search', async (req, res) => {
+    try {
+      const roots = globalConfig.getRoots();
+      const project = findProjectById(projectScanner, roots, req.params.projectId);
+      if (!project) return res.status(404).json({ error: 'Project not found' });
+
+      const query = req.query.q;
+      if (!query) {
+        return res.status(400).json({ error: 'Query parameter q is required' });
+      }
+
+      const { semanticRecall } = memoryDeps;
+
+      // Try vector-based semantic recall first
+      if (semanticRecall && typeof semanticRecall.recall === 'function') {
+        try {
+          const results = await semanticRecall.recall(query, { projectRoot: project.path });
+          return res.json({ results: results || [], source: 'vector' });
+        } catch {
+          // Fall through to file-based search
+        }
+      }
+
+      // Fallback: file-based text search
+      try {
+        const { searchMemory } = require('./memory-reader');
+        const results = await searchMemory(project.path, query);
+        return res.json({ results: results || [], source: 'file' });
+      } catch {
+        return res.json({ results: [], source: 'file' });
+      }
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // =========================================================================
+  // Project file endpoint (Phase 77)
+  // =========================================================================
+  router.get('/projects/:projectId/files/:filename', (req, res) => {
+    try {
+      const roots = globalConfig.getRoots();
+      const project = findProjectById(projectScanner, roots, req.params.projectId);
+      if (!project) return res.status(404).json({ error: 'Project not found' });
+
+      const filename = req.params.filename;
+      // Reject path traversal
+      if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+        return res.status(400).json({ error: 'Invalid filename' });
+      }
+
+      const filePath = path.join(project.path, '.planning', filename);
+      if (!fs.existsSync(filePath)) {
+        return res.status(404).json({ error: 'File not found' });
+      }
+
+      const content = fs.readFileSync(filePath, 'utf-8');
+      res.json({ filename, content });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
   return router;
 }