vectorforce 0.1.0 → 0.2.0

package/src/mcp/harness-config.js

@@ -1,13 +1,25 @@
 import { join, resolve } from 'node:path';
-import { homedir } from 'node:os';
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, realpathSync } from 'node:fs';
+
+function isTempWorkspace(workspacePath) {
+  if (process.env.VF_NO_GLOBAL_CONFIG === '1' || process.env.NODE_TEST_CONTEXT) return true;
+  try {
+    const realWs = realpathSync(workspacePath);
+    const realTmp = realpathSync(tmpdir());
+    return realWs.startsWith(realTmp);
+  } catch {
+    return workspacePath.startsWith(tmpdir()) || workspacePath.includes('vf-test-') || workspacePath.includes('vf-practical-');
+  }
+}
 
 export class HarnessConfig {
   /**
-   * Get the absolute path to bin/vf.js
+   * Get the absolute path to bin/vf.js (cross-platform: macOS, Linux, Windows)
    */
   static getBinPath() {
-    return resolve(new URL('../../bin/vf.js', import.meta.url).pathname);
+    return fileURLToPath(new URL('../../bin/vf.js', import.meta.url));
   }
 
   /**
@@ -66,6 +78,36 @@ export class HarnessConfig {
       mkdirSync(dir, { recursive: true, mode: 0o755 });
     }
     writeFileSync(filePath, JSON.stringify(mergedContent, null, 2) + '\n', 'utf8');
+
+    if (!isTempWorkspace(workspacePath)) {
+      try {
+        const globalAgyDir = join(homedir(), '.gemini', 'antigravity');
+        if (existsSync(globalAgyDir)) {
+          const globalMcpPath = join(globalAgyDir, 'mcp_config.json');
+          let globalConfig = {};
+          if (existsSync(globalMcpPath)) {
+            try {
+              globalConfig = JSON.parse(readFileSync(globalMcpPath, 'utf8'));
+            } catch {
+              globalConfig = {};
+            }
+          }
+          globalConfig.mcpServers = {
+            ...(globalConfig.mcpServers || {}),
+            vectorforce: {
+              command: 'node',
+              args: [HarnessConfig.getBinPath(), 'mcp', '--workspace', workspacePath],
+              env: {
+                VF_WORKSPACE: workspacePath,
+                VF_DB_PATH: join(workspacePath, '.vectorforce', 'vectorforce.db')
+              }
+            }
+          };
+          writeFileSync(globalMcpPath, JSON.stringify(globalConfig, null, 2) + '\n', 'utf8');
+        }
+      } catch {}
+    }
+
     return filePath;
   }
 
@@ -265,28 +307,30 @@ export class HarnessConfig {
     writeFileSync(filePath, JSON.stringify(mergedContent, null, 2) + '\n', 'utf8');
     writeFileSync(museJsonPath, JSON.stringify(mergedContent, null, 2) + '\n', 'utf8');
 
-    try {
-      const globalMuseDir = join(homedir(), '.config', 'muse');
-      const globalSettingsPath = join(globalMuseDir, 'settings.json');
-      if (existsSync(globalSettingsPath)) {
-        const settings = JSON.parse(readFileSync(globalSettingsPath, 'utf8'));
-        settings.mcp_servers = {
-          ...(settings.mcp_servers || {}),
-          vectorforce: {
-            transport: 'stdio',
-            command: 'node',
-            args: [HarnessConfig.getBinPath(), 'mcp'],
-            env: {
-              VF_HARNESS: 'muse-code',
-              VF_WORKSPACE: workspacePath
-            },
-            mode: 'optional'
-          }
-        };
-        delete settings.mcpServers;
-        writeFileSync(globalSettingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
-      }
-    } catch {}
+    if (!isTempWorkspace(workspacePath)) {
+      try {
+        const globalMuseDir = join(homedir(), '.config', 'muse');
+        const globalSettingsPath = join(globalMuseDir, 'settings.json');
+        if (existsSync(globalSettingsPath)) {
+          const settings = JSON.parse(readFileSync(globalSettingsPath, 'utf8'));
+          settings.mcp_servers = {
+            ...(settings.mcp_servers || {}),
+            vectorforce: {
+              transport: 'stdio',
+              command: 'node',
+              args: [HarnessConfig.getBinPath(), 'mcp'],
+              env: {
+                VF_HARNESS: 'muse-code',
+                VF_WORKSPACE: workspacePath
+              },
+              mode: 'optional'
+            }
+          };
+          delete settings.mcpServers;
+          writeFileSync(globalSettingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+        }
+      } catch {}
+    }
 
     return filePath;
   }
@@ -322,16 +366,18 @@ export class HarnessConfig {
       } catch {}
     }
 
-    try {
-      const globalSettingsPath = join(homedir(), '.config', 'muse', 'settings.json');
-      if (existsSync(globalSettingsPath)) {
-        const settings = JSON.parse(readFileSync(globalSettingsPath, 'utf8'));
-        if (settings?.mcp_servers?.vectorforce) {
-          delete settings.mcp_servers.vectorforce;
-          writeFileSync(globalSettingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    if (!isTempWorkspace(workspacePath)) {
+      try {
+        const globalSettingsPath = join(homedir(), '.config', 'muse', 'settings.json');
+        if (existsSync(globalSettingsPath)) {
+          const settings = JSON.parse(readFileSync(globalSettingsPath, 'utf8'));
+          if (settings?.mcp_servers?.vectorforce) {
+            delete settings.mcp_servers.vectorforce;
+            writeFileSync(globalSettingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+          }
         }
-      }
-    } catch {}
+      } catch {}
+    }
 
     return removed;
   }
@@ -355,7 +401,7 @@ export class HarnessConfig {
    * @returns {string} merged TOML
    */
   static _mergeCodexToml(existingToml) {
-    const binPath = HarnessConfig.getBinPath();
+    const binPath = HarnessConfig.getBinPath().replace(/\\/g, '\\\\');
     const serverBlock = `[mcp_servers.vectorforce]\ncommand = "node"\nargs = ["${binPath}", "mcp"]\n[mcp_servers.vectorforce.env]\nVF_HARNESS = "codex"\n`;
 
     if (!existingToml || !existingToml.trim()) {
@@ -434,15 +480,17 @@ export class HarnessConfig {
     writeFileSync(filePath, mergedContent, 'utf8');
     writeFileSync(codexJsonPath, JSON.stringify(mergedJson, null, 2) + '\n', 'utf8');
 
-    try {
-      const globalCodex = join(homedir(), '.codex');
-      if (existsSync(globalCodex)) {
-        const globalTomlPath = join(globalCodex, 'config.toml');
-        const existingGlobal = existsSync(globalTomlPath) ? readFileSync(globalTomlPath, 'utf8') : '';
-        const updatedGlobal = HarnessConfig._mergeCodexToml(existingGlobal);
-        writeFileSync(globalTomlPath, updatedGlobal, 'utf8');
-      }
-    } catch {}
+    if (!isTempWorkspace(workspacePath)) {
+      try {
+        const globalCodex = join(homedir(), '.codex');
+        if (existsSync(globalCodex)) {
+          const globalTomlPath = join(globalCodex, 'config.toml');
+          const existingGlobal = existsSync(globalTomlPath) ? readFileSync(globalTomlPath, 'utf8') : '';
+          const updatedGlobal = HarnessConfig._mergeCodexToml(existingGlobal);
+          writeFileSync(globalTomlPath, updatedGlobal, 'utf8');
+        }
+      } catch {}
+    }
 
     return filePath;
   }

package/src/providers/llm-provider.js

@@ -9,6 +9,8 @@ export const DEFAULT_OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 export const DEFAULT_OPENROUTER_MODEL = 'deepseek/deepseek-v4.1-flash-1017';
 export const DEFAULT_MUSE_BASE_URL = 'https://api.meta.ai/v1';
 export const DEFAULT_MUSE_MODEL = 'muse-spark-1.3';
+export const DEFAULT_FIREWORKS_BASE_URL = 'https://api.fireworks.ai/inference/v1';
+export const DEFAULT_FIREWORKS_MODEL = 'accounts/fireworks/models/muse-spark-open';
 export const DEFAULT_TIMEOUT_MS = 60000;
 
 function trimTrailingSlash(url) {
@@ -102,10 +104,11 @@ export function resolveLlmConfig(env = process.env, overrides = {}, workspacePat
   const provider = (
     overrides.provider ||
     mergedEnv.VF_LLM_PROVIDER ||
+    (mergedEnv.FIREWORKS_API_KEY || mergedEnv.VF_FIREWORKS_API_KEY ? 'fireworks' :
     (mergedEnv.OPENROUTER_API_KEY || mergedEnv.VF_OPENROUTER_API_KEY ? 'openrouter' :
     (mergedEnv.VF_CODEX_API_KEY ? 'codex' :
     (mergedEnv.MODEL_API_KEY || mergedEnv.MUSE_API_KEY || mergedEnv.VF_MUSE_API_KEY ? 'muse' :
-    (mergedEnv.VF_LLM_API_KEY ? 'openai' : 'ollama'))))
+    (mergedEnv.VF_LLM_API_KEY ? 'openai' : 'ollama')))))
   ).toLowerCase();
   const timeoutMs = overrides.timeoutMs ?? (mergedEnv.VF_LLM_TIMEOUT_MS ? Number(mergedEnv.VF_LLM_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS);
 
@@ -120,6 +123,16 @@ export function resolveLlmConfig(env = process.env, overrides = {}, workspacePat
     };
   }
 
+  if (provider === 'fireworks') {
+    const baseUrl = trimTrailingSlash(overrides.baseUrl || mergedEnv.VF_FIREWORKS_BASE_URL || mergedEnv.FIREWORKS_BASE_URL || mergedEnv.VF_LLM_BASE_URL || DEFAULT_FIREWORKS_BASE_URL);
+    const apiKey = overrides.apiKey ?? mergedEnv.FIREWORKS_API_KEY ?? mergedEnv.VF_FIREWORKS_API_KEY ?? mergedEnv.VF_LLM_API_KEY ?? null;
+    const model = overrides.model || mergedEnv.VF_FIREWORKS_MODEL || mergedEnv.FIREWORKS_MODEL || mergedEnv.VF_LLM_MODEL || DEFAULT_FIREWORKS_MODEL;
+    if (!apiKey) {
+      throw new VectorForceError(ErrorCode.LLM_CONFIG_INVALID, 'Fireworks provider requires FIREWORKS_API_KEY or VF_FIREWORKS_API_KEY');
+    }
+    return { provider: 'fireworks', baseUrl, apiKey, model, timeoutMs };
+  }
+
   if (provider === 'openrouter') {
     const baseUrl = trimTrailingSlash(overrides.baseUrl || mergedEnv.VF_OPENROUTER_BASE_URL || mergedEnv.OPENROUTER_BASE_URL || mergedEnv.VF_LLM_BASE_URL || DEFAULT_OPENROUTER_BASE_URL);
     const apiKey = overrides.apiKey ?? mergedEnv.OPENROUTER_API_KEY ?? mergedEnv.VF_OPENROUTER_API_KEY ?? mergedEnv.VF_LLM_API_KEY ?? null;
@@ -140,10 +153,12 @@ export function resolveLlmConfig(env = process.env, overrides = {}, workspacePat
     return { provider: 'muse', baseUrl, apiKey, model, timeoutMs };
   }
 
-  if (provider === 'openai' || provider === 'codex') {
-    const baseUrl = trimTrailingSlash(overrides.baseUrl || mergedEnv.VF_CODEX_BASE_URL || mergedEnv.OPENAI_BASE_URL || mergedEnv.VF_LLM_BASE_URL || '');
-    const apiKey = overrides.apiKey ?? mergedEnv.VF_CODEX_API_KEY ?? mergedEnv.OPENAI_API_KEY ?? mergedEnv.VF_LLM_API_KEY ?? null;
-    const model = overrides.model || mergedEnv.VF_CODEX_MODEL || mergedEnv.VF_LLM_MODEL || DEFAULT_CLOUD_MODEL;
+  if (provider === 'openai' || provider === 'codex' || provider === 'anthropic' || provider === 'byok') {
+    const defaultBase = provider === 'anthropic' ? 'https://api.anthropic.com/v1' : '';
+    const baseUrl = trimTrailingSlash(overrides.baseUrl || mergedEnv.VF_CODEX_BASE_URL || mergedEnv.OPENAI_BASE_URL || mergedEnv.ANTHROPIC_BASE_URL || mergedEnv.VF_LLM_BASE_URL || defaultBase);
+    const apiKey = overrides.apiKey ?? mergedEnv.VF_CODEX_API_KEY ?? mergedEnv.OPENAI_API_KEY ?? mergedEnv.ANTHROPIC_API_KEY ?? mergedEnv.VF_LLM_API_KEY ?? null;
+    const defaultModel = provider === 'anthropic' ? 'claude-sonnet-4-20250514' : DEFAULT_CLOUD_MODEL;
+    const model = overrides.model || mergedEnv.VF_CODEX_MODEL || mergedEnv.VF_LLM_MODEL || defaultModel;
     if (!baseUrl) {
       throw new VectorForceError(
         ErrorCode.LLM_CONFIG_INVALID,
@@ -158,7 +173,7 @@ export function resolveLlmConfig(env = process.env, overrides = {}, workspacePat
 
   throw new VectorForceError(
     ErrorCode.LLM_CONFIG_INVALID,
-    `Unknown LLM provider '${provider}'. Use 'openrouter', 'muse', 'codex', 'openai' (cloud) or 'ollama' (local).`
+    `Unknown LLM provider '${provider}'. Use 'openrouter', 'muse', 'codex', 'openai', 'anthropic', 'byok' (cloud) or 'ollama' (local).`
   );
 }
 

package/src/studio/server.js

@@ -1,6 +1,8 @@
 import { createServer } from 'node:http';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, extname } from 'node:path';
+import { homedir } from 'node:os';
+import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { SqliteStore } from '../storage/sqlite-store.js';
 import { ProjectService } from '../operations/project-service.js';
@@ -11,6 +13,7 @@ import { ReasoningService } from '../operations/reasoning-service.js';
 import { CodeIndexProvider } from '../providers/code-index-provider.js';
 import { LlmProvider, resolveLlmConfig } from '../providers/llm-provider.js';
 import { GitProvider } from '../providers/git-provider.js';
+import { HarnessConfig } from '../mcp/harness-config.js';
 
 export function createStudioServer({
   dbPath,
@@ -319,13 +322,75 @@ export function createStudioServer({
         req.on('end', async () => {
           try {
             const data = JSON.parse(body || '{}');
+            const project = projectService.getProjectForWorkspace(workspacePath);
+            const allTasks = store.listTasks(project.project_id);
+
+            let resolvedTaskId = data.taskId;
+            if (!resolvedTaskId || !allTasks.some(t => t.task_id === resolvedTaskId)) {
+              const activeTask = allTasks.find(t => t.status === 'active') || allTasks[0];
+              if (activeTask) {
+                resolvedTaskId = activeTask.task_id;
+              }
+            }
+
+            let resolvedCheckpointId = data.checkpointId || undefined;
+            if (!resolvedCheckpointId && resolvedTaskId) {
+              const leaves = store.getLeafCheckpoints(project.project_id, resolvedTaskId);
+              if (leaves.length > 1) {
+                const sorted = [...leaves].sort((a, b) => new Date(b.timestamp) - new Date(a.timestamp));
+                resolvedCheckpointId = sorted[0].checkpoint_id;
+              }
+            }
+
             const result = handoffService.exportHandoff({
               workspacePath,
-              taskId: data.taskId || 'phase-5-pilot',
-              checkpointId: data.checkpointId || undefined,
+              taskId: resolvedTaskId || 'phase-5-pilot',
+              checkpointId: resolvedCheckpointId,
               recipient: data.recipient || 'Collaborator',
               destinationHarness: data.destinationHarness || 'any'
             });
+
+            const bundle = {
+              schema_version: 'vectorforce/handoff-bundle/v1',
+              package_id: result.package_id,
+              created_at: result.handoff?.created_at || new Date().toISOString(),
+              manifest: result.manifest,
+              handoff: result.handoff
+            };
+
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ...result, bundle }));
+          } catch (err) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
+      if (pathname === '/api/handoff/import' && req.method === 'POST') {
+        let body = '';
+        req.on('data', chunk => { body += chunk; });
+        req.on('end', async () => {
+          try {
+            const data = JSON.parse(body || '{}');
+            let targetBundlePath = data.bundlePath;
+
+            if (!targetBundlePath && data.bundleContent) {
+              const handoffsDir = join(homedir(), '.vectorforce', 'handoffs');
+              mkdirSync(handoffsDir, { recursive: true, mode: 0o700 });
+              const rawStr = typeof data.bundleContent === 'string'
+                ? data.bundleContent
+                : JSON.stringify(data.bundleContent, null, 2);
+              targetBundlePath = join(handoffsDir, `import-${randomUUID().slice(0, 8)}.vfhandoff.json`);
+              writeFileSync(targetBundlePath, rawStr, 'utf8');
+            }
+
+            const result = handoffService.importHandoff({
+              workspacePath,
+              bundlePath: targetBundlePath,
+              targetTaskId: data.targetTaskId || undefined
+            });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(result));
           } catch (err) {
@@ -380,7 +445,7 @@ export function createStudioServer({
               requestedDocuments: data.requestedDocuments || [],
               includeGit: data.includeGit !== false,
               authorName: data.authorName || 'developer',
-              authorHarness: 'studio'
+              authorHarness: data.authorHarness || 'studio'
             });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(result));
@@ -392,6 +457,249 @@ export function createStudioServer({
         return;
       }
 
+      // --- Interactive Studio Configuration & Task/To-Do Endpoints ---
+
+      if (pathname === '/api/config/llm' && req.method === 'GET') {
+        let activeCfg = null;
+        let error = null;
+        try {
+          activeCfg = resolveLlmConfig(process.env, {}, workspacePath);
+        } catch (err) {
+          error = err.message;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          provider: activeCfg?.provider || 'ollama',
+          model: activeCfg?.model || 'llama3.3',
+          baseUrl: activeCfg?.baseUrl || 'http://127.0.0.1:11434',
+          hasApiKey: Boolean(activeCfg?.apiKey),
+          error
+        }));
+        return;
+      }
+
+      if (pathname === '/api/config/llm' && req.method === 'POST') {
+        let body = '';
+        req.on('data', chunk => { body += chunk; });
+        req.on('end', () => {
+          try {
+            const data = JSON.parse(body || '{}');
+            const provider = String(data.provider || 'ollama').toLowerCase().trim();
+            const model = String(data.model || '').trim();
+            const baseUrl = String(data.baseUrl || '').trim();
+            const apiKey = String(data.apiKey || '').trim();
+
+            const vfDir = join(workspacePath, '.vectorforce');
+            mkdirSync(vfDir, { recursive: true, mode: 0o700 });
+            const cfgPath = join(vfDir, 'config.json');
+            let existing = {};
+            if (existsSync(cfgPath)) {
+              try { existing = JSON.parse(readFileSync(cfgPath, 'utf8')); } catch {}
+            }
+
+            existing.VF_LLM_PROVIDER = provider;
+            if (provider === 'fireworks') {
+              if (apiKey) existing.FIREWORKS_API_KEY = apiKey;
+              existing.VF_FIREWORKS_MODEL = model || 'accounts/fireworks/models/muse-spark-open';
+              if (baseUrl) existing.VF_FIREWORKS_BASE_URL = baseUrl;
+            } else if (provider === 'muse') {
+              if (apiKey) existing.MODEL_API_KEY = apiKey;
+              existing.VF_MUSE_MODEL = model || 'muse-spark-1.3';
+              if (baseUrl) existing.VF_MUSE_BASE_URL = baseUrl;
+            } else if (provider === 'openrouter') {
+              if (apiKey) existing.OPENROUTER_API_KEY = apiKey;
+              existing.VF_OPENROUTER_MODEL = model || 'meta/muse-spark-open';
+            } else if (provider === 'ollama') {
+              existing.VF_OLLAMA_MODEL = model || 'llama3.3';
+              existing.VF_OLLAMA_BASE_URL = baseUrl || 'http://127.0.0.1:11434';
+            } else if (provider === 'openai' || provider === 'codex') {
+              if (apiKey) existing.VF_LLM_API_KEY = apiKey;
+              existing.VF_LLM_MODEL = model || 'gpt-4.1';
+              existing.VF_LLM_BASE_URL = baseUrl || 'https://api.openai.com/v1';
+            } else if (provider === 'anthropic') {
+              if (apiKey) existing.ANTHROPIC_API_KEY = apiKey;
+              existing.VF_ANTHROPIC_MODEL = model || 'claude-sonnet-4-5';
+              if (baseUrl) existing.VF_ANTHROPIC_BASE_URL = baseUrl;
+            } else if (provider === 'byok') {
+              if (apiKey) existing.VF_LLM_API_KEY = apiKey;
+              if (model) existing.VF_LLM_MODEL = model;
+              if (baseUrl) existing.VF_LLM_BASE_URL = baseUrl;
+            }
+
+            writeFileSync(cfgPath, JSON.stringify(existing, null, 2) + '\n', 'utf8');
+
+            // Hot-reload reasoningService LLM provider
+            let resolved = null;
+            let resolveErr = null;
+            try {
+              resolved = resolveLlmConfig(process.env, {}, workspacePath);
+              reasoningService.llmProvider = new LlmProvider(resolved);
+            } catch (err) {
+              resolveErr = err.message;
+            }
+
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+              ok: true,
+              provider: resolved?.provider || provider,
+              model: resolved?.model || model,
+              baseUrl: resolved?.baseUrl || baseUrl,
+              hasApiKey: Boolean(resolved?.apiKey || apiKey),
+              error: resolveErr
+            }));
+          } catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
+      if (pathname === '/api/policy' && req.method === 'POST') {
+        let body = '';
+        req.on('data', chunk => { body += chunk; });
+        req.on('end', () => {
+          try {
+            const data = JSON.parse(body || '{}');
+            const project = projectService.initProject(workspacePath);
+            const current = store.getDocumentPolicy(project.project_id);
+            let nextList = [...current];
+            if (Array.isArray(data.allowedDocuments)) {
+              nextList = data.allowedDocuments;
+            } else if (data.action === 'remove' && data.path) {
+              nextList = current.filter(p => p !== data.path);
+            } else if (data.path) {
+              if (!nextList.includes(data.path)) nextList.push(data.path);
+            }
+            const updated = store.setDocumentPolicy(project.project_id, nextList);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, allowedDocuments: updated }));
+          } catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
+      if (pathname === '/api/config/harnesses' && req.method === 'POST') {
+        try {
+          const agy = HarnessConfig.installAntigravity(workspacePath);
+          const cmd = HarnessConfig.installCommandCode(workspacePath);
+          const muse = HarnessConfig.installMuseCode(workspacePath);
+          const codex = HarnessConfig.installCodex(workspacePath);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            ok: true,
+            installed: [
+              { harness: 'Google Antigravity', path: agy },
+              { harness: 'Claude Code & Command Code', path: cmd },
+              { harness: 'Meta Muse', path: muse },
+              { harness: 'OpenAI Codex CLI', path: codex }
+            ]
+          }));
+        } catch (err) {
+          res.writeHead(500, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: err.message }));
+        }
+        return;
+      }
+
+      if (pathname === '/api/tasks' && req.method === 'POST') {
+        let body = '';
+        req.on('data', chunk => { body += chunk; });
+        req.on('end', () => {
+          try {
+            const data = JSON.parse(body || '{}');
+            if (data.action === 'status' && data.taskId && data.status) {
+              const updated = projectService.updateTaskStatus(workspacePath, data.taskId, data.status);
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ ok: true, task: updated }));
+              return;
+            }
+            const taskId = String(data.taskId || '').trim();
+            const title = String(data.title || taskId).trim();
+            if (!taskId) throw new Error('taskId is required');
+            const created = projectService.createTask(workspacePath, taskId, title);
+            res.writeHead(201, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, task: created }));
+          } catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
+      if (pathname === '/api/todos' && (req.method === 'GET' || req.method === 'POST')) {
+        const vfDir = join(workspacePath, '.vectorforce');
+        mkdirSync(vfDir, { recursive: true, mode: 0o700 });
+        const todosPath = join(vfDir, 'todos.json');
+
+        const loadTodos = () => {
+          if (existsSync(todosPath)) {
+            try { return JSON.parse(readFileSync(todosPath, 'utf8')); } catch {}
+          }
+          // Auto-seed from latest checkpoint next_steps & goals
+          const project = projectService.initProject(workspacePath);
+          const cps = store.getCheckpoints(project.project_id, { limit: 10 });
+          const latest = cps[cps.length - 1];
+          const seeded = [];
+          if (latest?.claims?.next_steps) {
+            for (const step of latest.claims.next_steps) {
+              seeded.push({
+                id: `todo-${Math.random().toString(36).slice(2, 9)}`,
+                text: step,
+                taskId: latest.task_id,
+                done: false,
+                createdAt: latest.timestamp
+              });
+            }
+          }
+          if (seeded.length > 0) {
+            writeFileSync(todosPath, JSON.stringify(seeded, null, 2) + '\n', 'utf8');
+          }
+          return seeded;
+        };
+
+        if (req.method === 'GET') {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ todos: loadTodos() }));
+          return;
+        }
+
+        let body = '';
+        req.on('data', chunk => { body += chunk; });
+        req.on('end', () => {
+          try {
+            const data = JSON.parse(body || '{}');
+            let todos = loadTodos();
+            if (data.action === 'add' && data.text) {
+              todos.unshift({
+                id: `todo-${Date.now().toString(36)}`,
+                text: String(data.text).trim(),
+                taskId: data.taskId || 'main',
+                done: false,
+                createdAt: new Date().toISOString()
+              });
+            } else if (data.action === 'toggle' && data.id) {
+              todos = todos.map(t => t.id === data.id ? { ...t, done: !t.done } : t);
+            } else if (data.action === 'delete' && data.id) {
+              todos = todos.filter(t => t.id !== data.id);
+            } else if (Array.isArray(data.todos)) {
+              todos = data.todos;
+            }
+            writeFileSync(todosPath, JSON.stringify(todos, null, 2) + '\n', 'utf8');
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, todos }));
+          } catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
       // Serve static assets from studio/dist for standalone Studio UI
       const bundledDist = fileURLToPath(new URL('../../studio/dist', import.meta.url));
       const workspaceDist = join(workspacePath, 'studio', 'dist');