whydid 1.0.0

package/dist/daemon/listen.js

@@ -0,0 +1,26 @@
+/**
+ * Binds an Express app to 127.0.0.1, preferring a specific port if given
+ * (so a restarted daemon can often reclaim its previous URL and let an
+ * already-open dashboard tab reconnect on a plain reload) and falling back
+ * to a random free port — the prior behavior — when that port is taken by
+ * something else, or none was requested.
+ */
+export function listenWithPortReuse(app, preferredPort) {
+    return new Promise((resolve, reject) => {
+        const tryListen = (port, allowFallback) => {
+            const server = app.listen(port, "127.0.0.1");
+            server.once("listening", () => resolve(server));
+            server.once("error", (err) => {
+                if (allowFallback && err.code === "EADDRINUSE") {
+                    tryListen(0, false);
+                }
+                else {
+                    reject(err);
+                }
+            });
+        };
+        const wantsSpecificPort = preferredPort != null && preferredPort > 0;
+        tryListen(wantsSpecificPort ? preferredPort : 0, wantsSpecificPort);
+    });
+}
+//# sourceMappingURL=listen.js.map

package/dist/daemon/pidfile.js

@@ -0,0 +1,36 @@
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+function path(whydidDir) {
+    return join(whydidDir, "daemon.pid.json");
+}
+export function writePidFile(whydidDir, data) {
+    writeFileSync(path(whydidDir), JSON.stringify(data), "utf-8");
+}
+export function readPidFile(whydidDir) {
+    const p = path(whydidDir);
+    if (!existsSync(p))
+        return null;
+    return JSON.parse(readFileSync(p, "utf-8"));
+}
+export function removePidFile(whydidDir) {
+    const p = path(whydidDir);
+    if (existsSync(p))
+        unlinkSync(p);
+}
+// A daemon that dies from an uncaught exception (or SIGKILL) never runs its
+// SIGTERM shutdown handler, so its pidfile is never cleaned up — without
+// this check, `daemon start` trusts that stale file forever and reports a
+// dead process as "already running", refusing to actually start anything.
+// Signal 0 sends nothing; the OS just validates the pid exists.
+export function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM means the process exists but we lack permission to signal it —
+        // still alive. Any other error (ESRCH: no such process) means it's dead.
+        return err.code === "EPERM";
+    }
+}
+//# sourceMappingURL=pidfile.js.map

package/dist/daemon/server.js

@@ -0,0 +1,554 @@
+import express from "express";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
+import { restoreState, restoreFiles, forkState } from "../core/engine.js";
+import { computeFileDiff } from "../core/diff.js";
+import { computeRecap } from "../core/recap.js";
+import { getFileHistory } from "../core/file-history.js";
+import { loadConfig, saveConfig } from "../shared/config.js";
+import { createLLMProvider } from "../llm/factory.js";
+import { FileSecretStore, getSecretStatuses } from "../licensing/secret-store.js";
+import { generateAgentPrompt } from "../llm/agent-prompt.js";
+import { buildExportData, exportAsJson, exportAsMarkdown, exportAsHtml } from "../core/export.js";
+import { resolveModelPricing, PRICING_DISCLAIMER } from "../llm/pricing.js";
+import { loadCommunityPricingCache, refreshCommunityPricing } from "../llm/community-pricing.js";
+import { computeCurrentAiBudget } from "../core/ai-budget.js";
+import { generateAndSaveSocialPost } from "../llm/social-post.js";
+import { askProjectQuestion } from "../llm/chat.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// dist/daemon/server.js -> package root is two levels up (dist/daemon -> dist -> root)
+const PACKAGE_ROOT = join(__dirname, "..", "..");
+export function createDaemonApp(ctx, projectId, token, watcher) {
+    const app = express();
+    app.use(express.json());
+    // A PUT /api/config patch only ever carries the one model being
+    // added, changed, or removed — never the whole map — so this merges
+    // key-by-key rather than replacing pricingOverrides outright. Since JSON
+    // has no "undefined", removal is expressed as an explicit null value for
+    // that key, not by omitting it.
+    function mergePricingOverrides(current, patch) {
+        if (!patch)
+            return current;
+        const next = { ...current };
+        for (const [model, rate] of Object.entries(patch)) {
+            if (rate === null)
+                delete next[model];
+            else
+                next[model] = rate;
+        }
+        return next;
+    }
+    // A state's turnId points at whatever turn was active when it was
+    // checkpointed — cheap indexed PK lookup, not a join, since most states
+    // have no turn at all (manual/CLI checkpoints) or an ordinary one.
+    function resumedFromCompaction(turnId) {
+        return turnId != null && ctx.db.getTurn(turnId)?.kind === "compact_resume";
+    }
+    app.get("/api/health", (_req, res) => res.json({ ok: true }));
+    app.use("/api", (req, res, next) => {
+        if (req.query.token !== token) {
+            res.status(401).json({ error: "Unauthorized" });
+            return;
+        }
+        next();
+    });
+    app.get("/api/states", (req, res) => {
+        const limit = req.query.limit != null ? Math.max(1, Math.min(200, Number(req.query.limit))) : undefined;
+        const offset = req.query.offset != null ? Math.max(0, Number(req.query.offset)) : 0;
+        const search = typeof req.query.search === "string" ? req.query.search : undefined;
+        const risk = typeof req.query.risk === "string" && req.query.risk !== "all" ? req.query.risk : undefined;
+        const filterOpts = { search, risk };
+        const total = ctx.db.countStates(projectId, filterOpts);
+        const states = ctx.db.listStates(projectId, { ...filterOpts, limit, offset }).map((s) => {
+            const changes = ctx.db.getFileChanges(s.id);
+            const annotation = ctx.db.getAnnotation(s.id) ?? null;
+            return {
+                ...s,
+                fileCount: changes.length,
+                linesAdded: changes.reduce((sum, c) => sum + c.linesAdded, 0),
+                linesRemoved: changes.reduce((sum, c) => sum + c.linesRemoved, 0),
+                annotation,
+                resumedFromCompaction: resumedFromCompaction(s.turnId),
+            };
+        });
+        res.json({ states, total, offset, limit: limit ?? total });
+    });
+    app.get("/api/milestones", (_req, res) => {
+        res.json({ milestones: ctx.db.listMilestones(projectId) });
+    });
+    // created_at is always stored as a UTC ISO string (new Date().toISOString()),
+    // and getDailyCheckpointCounts buckets by substr(created_at, 1, 10) — the
+    // UTC calendar date. Day-boundary math here has to stay in UTC too, or the
+    // zero-filled day list drifts by a day against what the DB actually grouped
+    // (as it would using local-time methods like setHours/setDate in a non-UTC
+    // timezone).
+    const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+    function utcMidnightDaysAgo(days) {
+        const now = new Date();
+        return Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() - (days - 1));
+    }
+    app.get("/api/recap", (req, res) => {
+        const days = req.query.days != null ? Math.max(1, Math.min(90, Number(req.query.days))) : 1;
+        res.json(computeRecap(ctx.db, projectId, new Date(utcMidnightDaysAgo(days)).toISOString()));
+    });
+    // Every point where a coding agent's own conversation context ran out and
+    // got auto-compacted mid-session — the moment whydid's real, on-disk
+    // checkpoint history matters most, since that's exactly when an agent's
+    // own memory of the session is a lossy summary rather than the real
+    // thing. For each one, a real recap (computeRecap) of everything that
+    // actually happened since, so a resumed session's claims can be checked
+    // against real file changes instead of taken on faith.
+    app.get("/api/continuity", (_req, res) => {
+        const resumes = ctx.db.listCompactResumeTurns(projectId).map((turn) => ({
+            turnId: turn.id,
+            sessionId: turn.sessionId,
+            startedAt: turn.startedAt,
+            summary: turn.prompt,
+            recap: computeRecap(ctx.db, projectId, turn.startedAt),
+        }));
+        res.json({ resumes });
+    });
+    app.get("/api/usage", (req, res) => {
+        const days = req.query.days != null ? Math.max(1, Math.min(90, Number(req.query.days))) : 14;
+        const sinceMs = utcMidnightDaysAgo(days);
+        const byDay = new Map(ctx.db.getDailyCheckpointCounts(projectId, new Date(sinceMs).toISOString()).map((d) => [d.date, d.count]));
+        const daily = [];
+        for (let i = 0; i < days; i++) {
+            const key = new Date(sinceMs + i * ONE_DAY_MS).toISOString().slice(0, 10);
+            daily.push({ date: key, count: byDay.get(key) ?? 0 });
+        }
+        const totals = ctx.db.getProjectTotals(projectId);
+        const project = ctx.db.getProject(projectId);
+        res.json({ daily, ...totals, projectCreatedAt: project?.createdAt ?? null });
+    });
+    // Shared by /api/ai-cost and /api/ai-budget (via computeCurrentAiBudget)
+    // so a model's price — and which source it came from — can never
+    // disagree between the two.
+    function buildPricingLookup() {
+        return { overrides: loadConfig(ctx.whydidDir).pricingOverrides, community: loadCommunityPricingCache(ctx.whydidDir)?.models };
+    }
+    app.get("/api/ai-cost", (req, res) => {
+        const days = req.query.days != null ? Math.max(1, Math.min(90, Number(req.query.days))) : 14;
+        const sinceMs = utcMidnightDaysAgo(days);
+        const byDay = new Map(ctx.db.getDailyTokenUsage(projectId, new Date(sinceMs).toISOString()).map((d) => [d.date, d]));
+        const daily = [];
+        for (let i = 0; i < days; i++) {
+            const key = new Date(sinceMs + i * ONE_DAY_MS).toISOString().slice(0, 10);
+            const found = byDay.get(key);
+            daily.push({ date: key, inputTokens: found?.inputTokens ?? 0, outputTokens: found?.outputTokens ?? 0 });
+        }
+        // Cost is only ever computed per-model (rates differ per model) then
+        // summed — never blended across models at the day level, which would
+        // silently misstate cost on any day usage was split across models.
+        const lookup = buildPricingLookup();
+        const byModel = ctx.db.getTokenUsageByModel(projectId).map((m) => {
+            const resolved = resolveModelPricing(m.model, lookup);
+            return {
+                ...m,
+                estimatedCostUsd: resolved ? (m.inputTokens / 1_000_000) * resolved.inputPerMillion + (m.outputTokens / 1_000_000) * resolved.outputPerMillion : null,
+                pricingSource: resolved?.source ?? null,
+            };
+        });
+        const totalInputTokens = byModel.reduce((sum, m) => sum + m.inputTokens, 0);
+        const totalOutputTokens = byModel.reduce((sum, m) => sum + m.outputTokens, 0);
+        const pricedModels = byModel.filter((m) => m.estimatedCostUsd !== null);
+        const totalEstimatedCostUsd = pricedModels.length > 0 ? pricedModels.reduce((sum, m) => sum + (m.estimatedCostUsd ?? 0), 0) : null;
+        const hasUnpricedUsage = byModel.some((m) => m.estimatedCostUsd === null);
+        res.json({ daily, byModel, totalInputTokens, totalOutputTokens, totalEstimatedCostUsd, hasUnpricedUsage, pricingDisclaimer: PRICING_DISCLAIMER });
+    });
+    app.get("/api/pricing/community-status", (_req, res) => {
+        const cache = loadCommunityPricingCache(ctx.whydidDir);
+        res.json({ fetchedAt: cache?.fetchedAt ?? null, modelCount: cache ? Object.keys(cache.models).length : 0 });
+    });
+    app.post("/api/pricing/community-refresh", async (_req, res) => {
+        try {
+            const cache = await refreshCommunityPricing(ctx.whydidDir);
+            res.json({ fetchedAt: cache.fetchedAt, modelCount: Object.keys(cache.models).length });
+        }
+        catch (e) {
+            res.status(502).json({ error: e instanceof Error ? e.message : "Failed to refresh community pricing" });
+        }
+    });
+    app.get("/api/ai-budget", (_req, res) => {
+        const config = loadConfig(ctx.whydidDir);
+        const budget = computeCurrentAiBudget(ctx, projectId, config);
+        res.json({ ...budget, pricingDisclaimer: PRICING_DISCLAIMER });
+    });
+    app.get("/api/context", (_req, res) => {
+        res.json(ctx.db.listContextFiles(projectId));
+    });
+    app.get("/api/social-posts", (_req, res) => {
+        res.json(ctx.db.listSocialPosts(projectId));
+    });
+    app.post("/api/social-posts/generate", async (req, res) => {
+        const sessionId = req.body?.sessionId;
+        const platform = req.body?.platform;
+        if (!sessionId || !ctx.db.getSession(sessionId)) {
+            res.status(404).json({ error: "Unknown session" });
+            return;
+        }
+        if (platform !== "x" && platform !== "linkedin") {
+            res.status(400).json({ error: 'platform must be "x" or "linkedin"' });
+            return;
+        }
+        const config = loadConfig(ctx.whydidDir);
+        const provider = await createLLMProvider(config.ai, new FileSecretStore(ctx.whydidDir));
+        if (provider.id === "noop") {
+            res.status(422).json({ error: "No LLM provider configured — set ai.provider and the matching *_API_KEY." });
+            return;
+        }
+        try {
+            const result = await generateAndSaveSocialPost(ctx, provider, projectId, sessionId, platform, "manual", config.buildInPublic.retentionDays);
+            if (!result.saved) {
+                res.status(200).json({ saved: false, post: null, message: "This session doesn't look substantial enough for a post — try a different session, or continue working first." });
+                return;
+            }
+            res.json({ saved: true, post: result.post });
+        }
+        catch (err) {
+            res.status(502).json({ error: err instanceof Error ? err.message : "Post generation failed" });
+        }
+    });
+    app.post("/api/social-posts/:id/pin", (req, res) => {
+        const post = ctx.db.getSocialPost(req.params.id);
+        if (!post) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        const pinned = Boolean(req.body?.pinned);
+        ctx.db.setSocialPostPinned(req.params.id, pinned);
+        res.json({ ...post, pinned });
+    });
+    app.delete("/api/social-posts/:id", (req, res) => {
+        const post = ctx.db.getSocialPost(req.params.id);
+        if (!post) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        ctx.db.deleteSocialPost(req.params.id);
+        res.json({ ok: true });
+    });
+    app.get("/api/chat/conversations", (_req, res) => {
+        res.json(ctx.db.listChatConversations(projectId));
+    });
+    app.post("/api/chat/conversations", (_req, res) => {
+        const id = randomUUID();
+        ctx.db.insertChatConversation({ id, projectId, title: "New conversation" });
+        res.json(ctx.db.getChatConversation(id));
+    });
+    app.get("/api/chat/conversations/:id", (req, res) => {
+        const conversation = ctx.db.getChatConversation(req.params.id);
+        if (!conversation || conversation.projectId !== projectId) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        res.json({ ...conversation, messages: ctx.db.listChatMessages(conversation.id) });
+    });
+    app.post("/api/chat/conversations/:id/messages", async (req, res) => {
+        const conversation = ctx.db.getChatConversation(req.params.id);
+        if (!conversation || conversation.projectId !== projectId) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        const question = req.body?.question;
+        if (!question || !question.trim()) {
+            res.status(400).json({ error: "question is required" });
+            return;
+        }
+        const config = loadConfig(ctx.whydidDir);
+        const provider = await createLLMProvider(config.ai, new FileSecretStore(ctx.whydidDir));
+        if (provider.id === "noop") {
+            res.status(422).json({ error: "No LLM provider configured — set ai.provider and the matching *_API_KEY." });
+            return;
+        }
+        try {
+            const result = await askProjectQuestion(ctx, provider, projectId, conversation.id, question.trim());
+            res.json(result);
+        }
+        catch (err) {
+            res.status(502).json({ error: err instanceof Error ? err.message : "Failed to answer that question" });
+        }
+    });
+    app.delete("/api/chat/conversations/:id", (req, res) => {
+        const conversation = ctx.db.getChatConversation(req.params.id);
+        if (!conversation || conversation.projectId !== projectId) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        ctx.db.deleteChatConversation(req.params.id);
+        res.json({ ok: true });
+    });
+    app.get("/api/context/file", (req, res) => {
+        const filePath = typeof req.query.path === "string" ? req.query.path : null;
+        // Only ever read a path this project's own context_files table already
+        // knows about — never an arbitrary query-string path — so this can't be
+        // used to read anything else off disk.
+        const tracked = filePath ? ctx.db.listContextFiles(projectId).find((f) => f.filePath === filePath) : undefined;
+        if (!tracked) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        try {
+            const content = readFileSync(join(ctx.projectRoot, tracked.filePath), "utf-8");
+            res.json({ ...tracked, content });
+        }
+        catch {
+            res.status(404).json({ error: "Context file is tracked but missing on disk" });
+        }
+    });
+    app.get("/api/project", (_req, res) => {
+        const project = ctx.db.getProject(projectId);
+        if (!project) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        res.json(project);
+    });
+    app.get("/api/config", async (_req, res) => {
+        const config = loadConfig(ctx.whydidDir);
+        const provider = await createLLMProvider(config.ai, new FileSecretStore(ctx.whydidDir));
+        res.json({ config, resolvedProvider: provider.id });
+    });
+    app.put("/api/config", async (req, res) => {
+        const current = loadConfig(ctx.whydidDir);
+        const patch = req.body ?? {};
+        const next = {
+            ...current,
+            ai: { ...current.ai, ...(patch.ai ?? {}) },
+            privacy: { ...current.privacy, ...(patch.privacy ?? {}) },
+            contextTree: { ...current.contextTree, ...(patch.contextTree ?? {}) },
+            buildInPublic: { ...current.buildInPublic, ...(patch.buildInPublic ?? {}) },
+            aiBudget: { ...current.aiBudget, ...(patch.aiBudget ?? {}) },
+            pricingOverrides: mergePricingOverrides(current.pricingOverrides, patch.pricingOverrides),
+            test: patch.test !== undefined ? patch.test : current.test,
+        };
+        saveConfig(ctx.whydidDir, next);
+        const provider = await createLLMProvider(next.ai, new FileSecretStore(ctx.whydidDir));
+        // Apply immediately to the running watcher so a Settings change takes
+        // effect on the very next checkpoint instead of silently waiting for a
+        // daemon restart the user has no reason to know is needed.
+        watcher?.setLLMProvider(provider);
+        watcher?.setPrivacy(next.privacy);
+        watcher?.setContextTreeEnabled(next.contextTree.enabled);
+        watcher?.setBuildInPublic(next.buildInPublic);
+        res.json({ config: next, resolvedProvider: provider.id });
+    });
+    app.get("/api/secrets/status", async (_req, res) => {
+        const store = new FileSecretStore(ctx.whydidDir);
+        res.json({ providers: await getSecretStatuses(store) });
+    });
+    app.put("/api/secrets", async (req, res) => {
+        const provider = typeof req.body?.provider === "string" ? req.body.provider.trim().toLowerCase() : "";
+        const value = typeof req.body?.key === "string" ? req.body.key.trim() : "";
+        if (!provider) {
+            res.status(400).json({ error: "provider is required" });
+            return;
+        }
+        if (!value) {
+            res.status(400).json({ error: "key is required" });
+            return;
+        }
+        const store = new FileSecretStore(ctx.whydidDir);
+        await store.set(provider, value);
+        // Same reasoning as PUT /api/config: apply immediately to the running
+        // watcher so saving a key here takes effect on the very next checkpoint,
+        // not only after a daemon restart — but only when it's actually the
+        // provider currently selected in config; saving a key for a provider
+        // you're not using shouldn't silently switch what's active.
+        const config = loadConfig(ctx.whydidDir);
+        if (config.ai.provider === provider) {
+            watcher?.setLLMProvider(await createLLMProvider(config.ai, store));
+        }
+        res.json({ providers: await getSecretStatuses(store) });
+    });
+    app.delete("/api/secrets/:provider", async (req, res) => {
+        const provider = req.params.provider.toLowerCase();
+        const store = new FileSecretStore(ctx.whydidDir);
+        await store.delete(provider);
+        const config = loadConfig(ctx.whydidDir);
+        if (config.ai.provider === provider) {
+            watcher?.setLLMProvider(await createLLMProvider(config.ai, store));
+        }
+        res.json({ providers: await getSecretStatuses(store) });
+    });
+    app.get("/api/sessions", (req, res) => {
+        const limit = req.query.limit != null ? Math.max(1, Math.min(200, Number(req.query.limit))) : undefined;
+        const offset = req.query.offset != null ? Math.max(0, Number(req.query.offset)) : 0;
+        const total = ctx.db.countSessions(projectId);
+        const sessions = ctx.db.listSessions(projectId, { limit, offset }).map((s) => {
+            const turns = ctx.db.listTurns(s.id);
+            const lastTurn = turns[turns.length - 1];
+            return { ...s, turnCount: turns.length, lastPrompt: lastTurn?.prompt ?? null, lastTurnKind: lastTurn?.kind ?? "prompt" };
+        });
+        res.json({ sessions, total, offset, limit: limit ?? total });
+    });
+    app.get("/api/sessions/:id", (req, res) => {
+        const session = ctx.db.getSession(req.params.id);
+        if (!session) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        const turns = ctx.db.listTurns(session.id).map((t) => ({
+            ...t,
+            states: ctx.db.getStatesForTurn(t.id).map((s) => ({ id: s.id, label: s.label, stateType: s.stateType, createdAt: s.createdAt })),
+        }));
+        res.json({ ...session, turns });
+    });
+    app.get("/api/export", (req, res) => {
+        const format = req.query.format ?? "json";
+        const project = ctx.db.getProject(projectId);
+        if (!project) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        const data = buildExportData(ctx.db, project);
+        const table = {
+            json: { content: exportAsJson(data), contentType: "application/json", ext: "json" },
+            markdown: { content: exportAsMarkdown(data), contentType: "text/markdown", ext: "md" },
+            html: { content: exportAsHtml(data), contentType: "text/html", ext: "html" },
+        };
+        const chosen = table[format];
+        if (!chosen) {
+            res.status(400).json({ error: "format must be json, markdown, or html" });
+            return;
+        }
+        res.setHeader("Content-Disposition", `attachment; filename="whydid-export.${chosen.ext}"`);
+        res.type(chosen.contentType).send(chosen.content);
+    });
+    app.get("/api/states/:id", (req, res) => {
+        const state = ctx.db.getState(req.params.id);
+        if (!state) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        res.json({
+            ...state,
+            fileChanges: ctx.db.getFileChanges(state.id),
+            annotation: ctx.db.getAnnotation(state.id) ?? null,
+            resumedFromCompaction: resumedFromCompaction(state.turnId),
+        });
+    });
+    app.get("/api/states/:id/diff/*", (req, res) => {
+        const filePath = req.params[0];
+        const changes = ctx.db.getFileChanges(req.params.id);
+        const change = changes.find((c) => c.filePath === filePath);
+        if (!change) {
+            res.status(404).json({ error: "No such file change in this state" });
+            return;
+        }
+        res.json(computeFileDiff(ctx.store, change));
+    });
+    app.put("/api/states/:id/milestone", (req, res) => {
+        const state = ctx.db.getState(req.params.id);
+        if (!state) {
+            res.status(404).json({ error: "Not found" });
+            return;
+        }
+        const label = req.body?.label;
+        if (label !== null && typeof label !== "string") {
+            res.status(400).json({ error: "label must be a string or null" });
+            return;
+        }
+        if (typeof label === "string" && label.trim() === "") {
+            res.status(400).json({ error: "label must not be empty — pass null to clear it" });
+            return;
+        }
+        ctx.db.setStateMilestone(req.params.id, label);
+        res.json({ stateId: req.params.id, milestoneLabel: label });
+    });
+    app.post("/api/states/:id/restore", async (req, res) => {
+        const result = await restoreState(ctx, projectId, req.params.id);
+        res.json(result);
+    });
+    app.post("/api/states/:id/restore-files", async (req, res) => {
+        const filePaths = req.body?.filePaths;
+        if (!Array.isArray(filePaths) || filePaths.length === 0 || !filePaths.every((p) => typeof p === "string")) {
+            res.status(400).json({ error: "filePaths must be a non-empty array of strings" });
+            return;
+        }
+        try {
+            const result = await restoreFiles(ctx, projectId, req.params.id, filePaths);
+            res.json(result);
+        }
+        catch (err) {
+            res.status(400).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    app.post("/api/states/:id/fork", async (req, res) => {
+        const name = req.body?.name;
+        if (!name) {
+            res.status(400).json({ error: "name is required" });
+            return;
+        }
+        const result = await forkState(ctx, projectId, req.params.id, name);
+        res.json(result);
+    });
+    app.get("/api/files/*/history", (req, res) => {
+        const filePath = req.params[0];
+        res.json(getFileHistory(ctx.db, projectId, filePath));
+    });
+    app.post("/api/files/*/agent-prompt", async (req, res) => {
+        const filePath = req.params[0];
+        const mode = (req.body?.mode ?? "revert");
+        const stateId = req.body?.stateId;
+        const continueInstruction = req.body?.instruction;
+        if (mode !== "revert" && mode !== "continue") {
+            res.status(400).json({ error: 'mode must be "revert" or "continue"' });
+            return;
+        }
+        if (mode === "continue" && !continueInstruction) {
+            res.status(400).json({ error: "instruction is required for mode continue" });
+            return;
+        }
+        const history = getFileHistory(ctx.db, projectId, filePath);
+        if (history.length === 0) {
+            res.status(404).json({ error: "No recorded history for this file" });
+            return;
+        }
+        const targetIndex = stateId ? history.findIndex((h) => h.stateId === stateId) : history.length - 1;
+        if (targetIndex === -1) {
+            res.status(404).json({ error: "That state did not change this file" });
+            return;
+        }
+        const targetEntry = history[targetIndex];
+        const laterEntries = history.slice(targetIndex + 1);
+        const config = loadConfig(ctx.whydidDir);
+        const provider = await createLLMProvider(config.ai, new FileSecretStore(ctx.whydidDir));
+        if (provider.id === "noop") {
+            res.status(422).json({ error: "No LLM provider configured — set ai.provider and the matching *_API_KEY." });
+            return;
+        }
+        const change = ctx.db.getFileChanges(targetEntry.stateId).find((c) => c.filePath === filePath);
+        const targetDiff = change ? computeFileDiff(ctx.store, change).unified : "(diff unavailable)";
+        try {
+            const prompt = await generateAgentPrompt(provider, { filePath, targetEntry, laterEntries, targetDiff, mode, continueInstruction });
+            res.json({ prompt });
+        }
+        catch (err) {
+            res.status(502).json({ error: err instanceof Error ? err.message : "Prompt generation failed" });
+        }
+    });
+    // A request under /api/ that didn't match any route above is a real 404 —
+    // it must never fall through to the SPA catch-all below, which would
+    // otherwise silently hand back index.html for it. The dashboard's fetch
+    // wrapper always calls res.json() on the response; getting HTML back
+    // produces exactly the "Unexpected token '<'" parse error this guards
+    // against, for literally any endpoint typo or stale client/server mismatch.
+    app.use("/api", (_req, res) => {
+        res.status(404).json({ error: "Not found" });
+    });
+    const dashboardDist = join(PACKAGE_ROOT, "dashboard", "dist");
+    if (existsSync(dashboardDist)) {
+        app.use(express.static(dashboardDist));
+        app.get("*", (_req, res) => res.sendFile(join(dashboardDist, "index.html")));
+    }
+    else {
+        app.get("/", (_req, res) => {
+            res.type("html").send("<h1>whydid</h1><p>Dashboard not built yet — run <code>npm run dashboard:build</code>.</p>");
+        });
+    }
+    return app;
+}
+//# sourceMappingURL=server.js.map