hyperagents 1.2.3rc5.post3__py3-none-any.whl

hyperclaw/server.py

@@ -0,0 +1,847 @@
+"""
+HyperClaw Production Server
+Fully integrated FastAPI server with all components connected.
+"""
+
+import os
+import sys
+import time
+import asyncio
+import logging
+from contextlib import asynccontextmanager
+from pathlib import Path
+from typing import Optional
+from datetime import datetime
+
+from dotenv import load_dotenv
+from fastapi import FastAPI, HTTPException, Request, WebSocket, WebSocketDisconnect
+from fastapi.staticfiles import StaticFiles
+from fastapi.responses import FileResponse, JSONResponse, StreamingResponse
+from fastapi.middleware.cors import CORSMiddleware
+from pydantic import BaseModel
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
+)
+logger = logging.getLogger("hyperclaw.server")
+
+# Load environment
+HYPERCLAW_ROOT = Path(os.environ.get("HYPERCLAW_ROOT", Path.home() / ".hyperclaw"))
+SECRETS_PATH = HYPERCLAW_ROOT / "workspace" / "secrets"
+
+# Try to load from secrets directory first
+env_path = SECRETS_PATH / ".env"
+if env_path.exists():
+    load_dotenv(env_path)
+else:
+    load_dotenv()
+from hyperclaw.teamsetup.secrets import export_env as _export_secrets  # noqa: E402
+_export_secrets()   # team installs keep keys in the OS secret store
+
+# Add project to path
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from hyperclaw.orchestrator import get_orchestrator, Orchestrator
+from hyperclaw.agent_coordinator import get_coordinator, Task, TaskStatus
+from hyperclaw.model_router import get_model_router, ModelTier
+from hyperclaw.setup import run_setup, HYPERCLAW_ROOT
+
+# ============================================================================
+# GLOBALS
+# ============================================================================
+
+_orchestrator: Optional[Orchestrator] = None
+_db_pool = None
+START_TIME = time.time()
+
+
+# ============================================================================
+# DATABASE CONNECTION
+# ============================================================================
+
+async def create_db_pool():
+    """Create database connection pool."""
+    db_url = os.environ.get("DATABASE_URL")
+    if not db_url:
+        logger.warning("DATABASE_URL not set - running without database")
+        return None
+
+    try:
+        import asyncpg
+        pool = await asyncpg.create_pool(
+            db_url,
+            min_size=1,
+            max_size=10,
+            command_timeout=30
+        )
+        logger.info("Database connection pool created")
+        return pool
+    except ImportError:
+        logger.warning("asyncpg not installed - pip install asyncpg")
+        return None
+    except Exception as e:
+        logger.error(f"Database connection failed: {e}")
+        return None
+
+
+# ============================================================================
+# LIFESPAN MANAGEMENT
+# ============================================================================
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    """Application startup and shutdown."""
+    global _orchestrator, _db_pool
+
+    logger.info("=" * 60)
+    logger.info("  HyperClaw Server Starting")
+    logger.info("=" * 60)
+
+    # Create database pool
+    _db_pool = await create_db_pool()
+
+    # Initialize orchestrator
+    _orchestrator = await get_orchestrator(_db_pool)
+
+    logger.info("HyperClaw Server ONLINE")
+    logger.info(f"  - Model: {os.environ.get('HYPERCLAW_MODEL', 'claude-sonnet-4-6')}")
+    logger.info(f"  - Database: {'Connected' if _db_pool else 'Not configured'}")
+    logger.info(f"  - Workspace: {HYPERCLAW_ROOT}")
+
+    yield
+
+    # Shutdown
+    logger.info("Shutting down HyperClaw Server...")
+    if _orchestrator:
+        await _orchestrator.shutdown()
+    if _db_pool:
+        await _db_pool.close()
+    logger.info("Server shutdown complete")
+
+
+# ============================================================================
+# FASTAPI APP
+# ============================================================================
+
+app = FastAPI(
+    title="HyperClaw",
+    description="AI Assistant Platform with Multi-Agent Orchestration",
+    version="1.0.0",
+    docs_url="/docs",
+    redoc_url="/redoc",
+    lifespan=lifespan,
+)
+
+# ============================================================================
+# EXPOSURE + AUTH (fail closed)
+# ============================================================================
+# - Binds 127.0.0.1 unless HOST says otherwise (warning when not loopback).
+# - No cross-origin access unless HYPERCLAW_CORS_ORIGINS lists origins.
+# - Endpoints that act on the outside world (send a Telegram message, the
+#   Telegram webhook) are OFF unless their secret is configured, and then
+#   require it on every request.
+
+LOOPBACK_HOSTS = {"127.0.0.1", "localhost", "::1"}
+
+
+def bind_host() -> str:
+    """The address to bind: HOST if set, else loopback only."""
+    return (os.environ.get("HOST") or "").strip() or "127.0.0.1"
+
+
+def is_loopback(host: str) -> bool:
+    return host in LOOPBACK_HOSTS or host.startswith("127.")
+
+
+def cors_origins() -> list:
+    """Explicit allow-list from HYPERCLAW_CORS_ORIGINS (comma separated);
+    empty by default. A bare "*" is ignored: never allow every origin."""
+    raw = os.environ.get("HYPERCLAW_CORS_ORIGINS", "")
+    return [o.strip() for o in raw.split(",") if o.strip() and o.strip() != "*"]
+
+
+def _secret_ok(provided: Optional[str], env_name: str) -> bool:
+    """Constant-time compare against a configured secret. Unset secret ->
+    always False (the endpoint is disabled)."""
+    import hmac
+    expected = os.environ.get(env_name, "").strip()
+    if not expected or not provided:
+        return False
+    return hmac.compare_digest(provided.strip().encode(), expected.encode())
+
+
+def _bearer(request: Request) -> Optional[str]:
+    auth = request.headers.get("authorization", "")
+    return auth[7:] if auth.lower().startswith("bearer ") else None
+
+
+_CORS = cors_origins()
+if _CORS:
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=_CORS,
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+# Static files
+ROOT_DIR = Path(__file__).parent.parent
+DASHBOARD_DIR = ROOT_DIR / "ui" / "control_center"
+if DASHBOARD_DIR.exists():
+    app.mount("/static", StaticFiles(directory=str(DASHBOARD_DIR)), name="static")
+
+
+# ============================================================================
+# REQUEST MODELS
+# ============================================================================
+
+class ChatRequest(BaseModel):
+    message: str
+    session_id: Optional[str] = "default"
+    stream: Optional[bool] = False
+
+
+class ChatResponse(BaseModel):
+    response: str
+    session_id: str
+    timestamp: str
+
+
+class MemoryRequest(BaseModel):
+    content: str
+    memory_type: Optional[str] = "episode"
+    domain: Optional[str] = None
+    importance: Optional[float] = 0.5
+    is_core: Optional[bool] = False
+
+
+class RecallRequest(BaseModel):
+    query: str
+    limit: Optional[int] = 5
+    memory_type: Optional[str] = None
+
+
+# ============================================================================
+# CORE ROUTES
+# ============================================================================
+
+@app.get("/")
+async def root():
+    """Serve dashboard or API info."""
+    dashboard_path = DASHBOARD_DIR / "index.html"
+    if dashboard_path.exists():
+        return FileResponse(dashboard_path)
+    return JSONResponse({
+        "name": "HyperClaw",
+        "version": "1.0.0",
+        "status": "operational",
+        "docs": "/docs",
+    })
+
+
+@app.get("/health")
+async def health():
+    """Health check endpoint."""
+    uptime = time.time() - START_TIME
+
+    health_data = {
+        "status": "healthy",
+        "uptime_seconds": round(uptime, 1),
+        "timestamp": datetime.now().isoformat(),
+        "components": {
+            "api": True,
+            "orchestrator": _orchestrator is not None and _orchestrator._initialized,
+            "database": _db_pool is not None,
+            "memory": _orchestrator._memory is not None if _orchestrator else False,
+        }
+    }
+
+    # Check if any critical component is down
+    if not health_data["components"]["orchestrator"]:
+        health_data["status"] = "degraded"
+
+    return health_data
+
+
+@app.get("/status")
+async def status():
+    """Detailed system status."""
+    if not _orchestrator:
+        return {"error": "Orchestrator not initialized"}
+    return _orchestrator.get_status()
+
+
+# ============================================================================
+# CHAT ENDPOINTS
+# ============================================================================
+
+@app.post("/chat", response_model=ChatResponse)
+async def chat(request: ChatRequest):
+    """Main chat endpoint."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    response = await _orchestrator.chat(
+        message=request.message,
+        session_id=request.session_id,
+        channel="api",
+        stream=False
+    )
+
+    return ChatResponse(
+        response=response,
+        session_id=request.session_id,
+        timestamp=datetime.now().isoformat()
+    )
+
+
+@app.post("/chat/stream")
+async def chat_stream(request: ChatRequest):
+    """Streaming chat endpoint."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    async def generate():
+        async for chunk in await _orchestrator.chat(
+            message=request.message,
+            session_id=request.session_id,
+            channel="api",
+            stream=True
+        ):
+            yield f"data: {chunk}\n\n"
+        yield "data: [DONE]\n\n"
+
+    return StreamingResponse(
+        generate(),
+        media_type="text/event-stream"
+    )
+
+
+@app.websocket("/ws/chat")
+async def websocket_chat(websocket: WebSocket):
+    """WebSocket chat endpoint for real-time streaming."""
+    await websocket.accept()
+    session_id = f"ws_{int(time.time())}"
+
+    try:
+        while True:
+            data = await websocket.receive_text()
+            message = data
+
+            if not _orchestrator:
+                await websocket.send_text("[Error: Orchestrator not initialized]")
+                continue
+
+            # Stream response
+            async for chunk in await _orchestrator.chat(
+                message=message,
+                session_id=session_id,
+                channel="websocket",
+                stream=True
+            ):
+                await websocket.send_text(chunk)
+
+            # Send end marker
+            await websocket.send_text("\n[END]")
+
+    except WebSocketDisconnect:
+        logger.info(f"WebSocket disconnected: {session_id}")
+    except Exception as e:
+        logger.error(f"WebSocket error: {e}")
+        await websocket.close()
+
+
+@app.post("/reset")
+async def reset_session(session_id: str = "default"):
+    """Reset a conversation session."""
+    if _orchestrator and _orchestrator._memory:
+        _orchestrator._memory._conversation_history.pop(session_id, None)
+    return {"status": "reset", "session_id": session_id}
+
+
+# ============================================================================
+# MEMORY ENDPOINTS
+# ============================================================================
+
+@app.post("/api/memory/remember")
+async def remember(request: MemoryRequest):
+    """Store a memory explicitly."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    from hyperclaw.taint import TaintedInput
+    try:
+        memory_id = await _orchestrator.remember(
+            content=request.content,
+            memory_type=request.memory_type,
+            domain=request.domain,
+            importance=request.importance,
+            is_core=request.is_core
+        )
+    except TaintedInput as e:  # connector content: refused, and the reason is given
+        raise HTTPException(status_code=403, detail=e.user_message)
+
+    return {"status": "stored", "memory_id": memory_id}
+
+
+@app.post("/api/memory/recall")
+async def recall(request: RecallRequest):
+    """Recall relevant memories."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    memories = await _orchestrator.recall(
+        query=request.query,
+        limit=request.limit,
+        memory_type=request.memory_type
+    )
+
+    return {
+        "query": request.query,
+        "count": len(memories),
+        "memories": [
+            {
+                "id": m.id,
+                "content": m.content,
+                "type": m.memory_type,
+                "domain": m.domain,
+                "importance": m.importance,
+            }
+            for m in memories
+        ]
+    }
+
+
+@app.get("/api/memory/context")
+async def get_context():
+    """Get current system context."""
+    if not _orchestrator or not _orchestrator._memory:
+        raise HTTPException(status_code=503, detail="Memory not initialized")
+
+    return {
+        "system_context": _orchestrator._memory.get_system_context(),
+        "working_memory": _orchestrator._memory.get_working_memory(),
+    }
+
+
+# ============================================================================
+# AGENT ENDPOINTS
+# ============================================================================
+
+@app.get("/api/agents")
+async def list_agents():
+    """List all available agents."""
+    # Try to load from agent config
+    try:
+        import yaml
+        from hyperclaw.api_utils import find_config
+        agents_config = find_config("agents.yaml")
+        if agents_config.exists():
+            with open(agents_config) as f:
+                config = yaml.safe_load(f)
+                agents = config.get("agents", [])
+                return {
+                    "count": len(agents),
+                    "agents": [
+                        {
+                            "id": a.get("id", "unknown"),
+                            "name": a.get("name", a.get("id", "Unknown")),
+                            "domain": a.get("domain", "general"),
+                            "role": a.get("role", ""),
+                        }
+                        for a in agents
+                    ]
+                }
+    except Exception as e:
+        logger.warning(f"Failed to load agents config: {e}")
+
+    return {
+        "count": 0,
+        "agents": [],
+        "message": "Agent configuration not loaded"
+    }
+
+
+@app.post("/api/agents/{agent_id}/dispatch")
+async def dispatch_to_agent(agent_id: str, task: str):
+    """Dispatch a task to a specific agent."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    result = await _orchestrator.dispatch_task(goal=task, agent_id=agent_id)
+    return {
+        "task_id": result.id,
+        "agent_id": result.assigned_to,
+        "status": result.status.value,
+    }
+
+
+# ============================================================================
+# TASK ENDPOINTS
+# ============================================================================
+
+class TaskRequest(BaseModel):
+    goal: str
+    domain: Optional[str] = None
+    task_type: Optional[str] = None
+    agent_id: Optional[str] = None
+    priority: Optional[int] = 5
+
+
+@app.post("/api/tasks")
+async def create_task(request: TaskRequest):
+    """Create and queue a new task."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    task = await _orchestrator.dispatch_task(
+        goal=request.goal,
+        domain=request.domain,
+        task_type=request.task_type,
+        agent_id=request.agent_id,
+        priority=request.priority,
+    )
+
+    return {
+        "task_id": task.id,
+        "goal": task.goal,
+        "domain": task.domain,
+        "task_type": task.task_type,
+        "assigned_to": task.assigned_to,
+        "status": task.status.value,
+    }
+
+
+@app.get("/api/tasks/{task_id}")
+async def get_task(task_id: str):
+    """Get task status and result."""
+    if not _orchestrator or not _orchestrator._coordinator:
+        raise HTTPException(status_code=503, detail="Coordinator not initialized")
+
+    task = _orchestrator._coordinator.tasks.get(task_id)
+    if not task:
+        raise HTTPException(status_code=404, detail=f"Task {task_id} not found")
+
+    return {
+        "task_id": task.id,
+        "goal": task.goal,
+        "domain": task.domain,
+        "task_type": task.task_type,
+        "assigned_to": task.assigned_to,
+        "status": task.status.value,
+        "result": task.result,
+        "error": task.error,
+        "created_at": task.created_at.isoformat(),
+        "completed_at": task.completed_at.isoformat() if task.completed_at else None,
+    }
+
+
+@app.post("/api/tasks/{task_id}/execute")
+async def execute_task(task_id: str):
+    """Execute a specific task immediately."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    result = await _orchestrator.execute_task(task_id)
+    return {"task_id": task_id, "result": result}
+
+
+@app.get("/api/tasks")
+async def list_tasks(status: Optional[str] = None, limit: int = 50):
+    """List all tasks, optionally filtered by status."""
+    if not _orchestrator or not _orchestrator._coordinator:
+        raise HTTPException(status_code=503, detail="Coordinator not initialized")
+
+    tasks = list(_orchestrator._coordinator.tasks.values())
+
+    if status:
+        tasks = [t for t in tasks if t.status.value == status]
+
+    # Sort by created_at descending
+    tasks.sort(key=lambda t: t.created_at, reverse=True)
+
+    return {
+        "count": len(tasks[:limit]),
+        "tasks": [
+            {
+                "task_id": t.id,
+                "goal": t.goal[:100],
+                "domain": t.domain,
+                "assigned_to": t.assigned_to,
+                "status": t.status.value,
+                "created_at": t.created_at.isoformat(),
+            }
+            for t in tasks[:limit]
+        ]
+    }
+
+
+class CoordinateRequest(BaseModel):
+    goal: str
+    context: Optional[dict] = None
+    max_agents: Optional[int] = 3
+
+
+@app.post("/api/coordinate")
+async def coordinate_goal(request: CoordinateRequest):
+    """Coordinate multiple agents to accomplish a complex goal."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    result = await _orchestrator.coordinate_goal(
+        goal=request.goal,
+        context=request.context,
+    )
+
+    return result
+
+
+# ============================================================================
+# COST MANAGEMENT ENDPOINTS
+# ============================================================================
+
+@app.get("/api/costs")
+async def get_costs():
+    """Get current cost statistics."""
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    return _orchestrator.get_cost_stats()
+
+
+@app.post("/api/costs/budget")
+async def set_budget(budget_usd: float, request: Request):
+    """Set the daily cost cap. An operator action: disabled unless
+    HYPERCLAW_API_TOKEN is set; then requires "Authorization: Bearer <token>"."""
+    if not _secret_ok(_bearer(request), "HYPERCLAW_API_TOKEN"):
+        raise HTTPException(status_code=403, detail="Forbidden")
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    _orchestrator.set_daily_budget(budget_usd)
+    return {"status": "ok", "daily_budget_usd": budget_usd}
+
+
+@app.get("/api/models")
+async def list_models():
+    """List available models and their costs."""
+    router = get_model_router()
+
+    return {
+        "models": [
+            {
+                "id": m.id,
+                "name": m.name,
+                "tier": m.tier.value,
+                "provider": m.provider,
+                "cost_per_1k_input": m.cost_per_1k_input,
+                "cost_per_1k_output": m.cost_per_1k_output,
+                "max_tokens": m.max_tokens,
+                "latency_ms": m.latency_ms,
+                "capabilities": m.capabilities,
+            }
+            for m in router.models.values()
+        ],
+        "prefer_cheap": router._prefer_cheap,
+        "daily_budget_usd": router._daily_budget,
+    }
+
+
+# ============================================================================
+# INTEGRATION ENDPOINTS
+# ============================================================================
+
+@app.get("/api/integrations")
+async def list_integrations():
+    """List configured integrations."""
+    if not _orchestrator:
+        return {"integrations": {}}
+
+    return {"integrations": _orchestrator._integrations}
+
+
+@app.post("/api/integrations/telegram/send")
+async def send_telegram(chat_id: str, message: str, request: Request):
+    """Send a Telegram message. Disabled unless HYPERCLAW_API_TOKEN is set;
+    then requires "Authorization: Bearer <token>"."""
+    if not _secret_ok(_bearer(request), "HYPERCLAW_API_TOKEN"):
+        raise HTTPException(status_code=403, detail="Forbidden")
+    if not _orchestrator:
+        raise HTTPException(status_code=503, detail="Orchestrator not initialized")
+
+    success = await _orchestrator.send_telegram(chat_id, message)
+    return {"success": success}
+
+
+# ============================================================================
+# APPROVALS (Send / Edit / Cancel for queued actions)
+# ============================================================================
+# Owner only: disabled unless HYPERCLAW_API_TOKEN is set, then the bearer
+# token is the owner's credential. Send must name the payload hash shown on
+# the card; a changed payload is refused and nothing runs.
+
+class ApprovalDecision(BaseModel):
+    payload_hash: str = ""
+    content: str = ""
+
+
+def _approval_owner(request: Request):
+    if not _secret_ok(_bearer(request), "HYPERCLAW_API_TOKEN"):
+        raise HTTPException(status_code=403, detail="Forbidden")
+    from hyperclaw.tools.approval import Actor
+    return Actor("owner", "api-token", "server")
+
+
+def _approval_view(item) -> dict:
+    from hyperclaw.tools.approval import render
+    return {"id": item.id, "tool": item.tool, "status": item.status, "kind": item.kind,
+            "reason": item.reason, "requester": item.requester,
+            "payload_hash": item.short_hash, "created": item.created, "expires": item.expires,
+            "card": render(item)}
+
+
+@app.get("/api/approvals")
+async def list_approvals(request: Request):
+    _approval_owner(request)
+    from hyperclaw.tools.approval import get_queue
+    return {"pending": [_approval_view(i) for i in get_queue().pending()]}
+
+
+@app.post("/api/approvals/{action_id}/send")
+async def approval_send(action_id: str, decision: ApprovalDecision, request: Request):
+    actor = _approval_owner(request)
+    from hyperclaw.tools import approval as ap
+    loop = asyncio.get_running_loop()
+    env = await loop.run_in_executor(None, lambda: ap.send(action_id, decision.payload_hash, actor))
+    return env.to_dict()
+
+
+@app.post("/api/approvals/{action_id}/edit")
+async def approval_edit(action_id: str, decision: ApprovalDecision, request: Request):
+    actor = _approval_owner(request)
+    from hyperclaw.tools import approval as ap
+    try:
+        item = ap.edit(action_id, decision.content, actor)
+    except ap.ApprovalError as e:
+        raise HTTPException(status_code=409, detail=str(e))
+    return _approval_view(item)
+
+
+@app.post("/api/approvals/{action_id}/cancel")
+async def approval_cancel(action_id: str, request: Request):
+    actor = _approval_owner(request)
+    from hyperclaw.tools import approval as ap
+    return ap.cancel(action_id, actor).to_dict()
+
+
+# ============================================================================
+# SETUP ENDPOINT
+# ============================================================================
+
+@app.post("/api/setup")
+async def setup_hyperclaw(init_db: bool = False):
+    """Run HyperClaw setup."""
+    result = await run_setup(init_db=init_db)
+    return result.to_dict()
+
+
+# ============================================================================
+# WEBHOOK ENDPOINTS (for integrations)
+# ============================================================================
+
+@app.post("/webhook/telegram")
+async def telegram_webhook(request: Request):
+    """Handle Telegram webhook updates.
+
+    Disabled unless HYPERCLAW_TELEGRAM_WEBHOOK_SECRET is set; then every
+    request must carry it in X-Telegram-Bot-Api-Secret-Token (the header
+    Telegram sends when setWebhook is given secret_token), and only allowed
+    chats are answered. The polling bot (hyperclaw-telegram) needs none of
+    this and opens no listening socket."""
+    if not _secret_ok(request.headers.get("x-telegram-bot-api-secret-token"),
+                      "HYPERCLAW_TELEGRAM_WEBHOOK_SECRET"):
+        raise HTTPException(status_code=403, detail="Forbidden")
+    try:
+        data = await request.json()
+
+        # Extract message
+        message = data.get("message", {})
+        text = message.get("text", "")
+        chat_id = message.get("chat", {}).get("id")
+
+        from hyperclaw.telegram_bot import _allowed_chat_ids
+        if chat_id not in _allowed_chat_ids():
+            logger.warning("Telegram webhook: update from a chat that is not allowed; ignored")
+            return {"ok": True}
+
+        if text and chat_id and _orchestrator:
+            # Process through orchestrator
+            # Guest fence: only the configured owner chat gets owner context.
+            from hyperclaw.chat_scope import scope_for
+            response = await _orchestrator.chat(
+                message=text,
+                session_id=f"telegram_{chat_id}",
+                channel="telegram",
+                scope=scope_for("telegram", chat_id),
+            )
+
+            # Send response back
+            await _orchestrator.send_telegram(str(chat_id), response)
+
+        return {"ok": True}
+
+    except Exception as e:
+        # Internal error text stays in the log, never in the response.
+        logger.error(f"Telegram webhook error: {type(e).__name__}")
+        return {"ok": False}
+
+
+# ============================================================================
+# UTILITY ENDPOINTS
+# ============================================================================
+
+@app.get("/api/config")
+async def get_config():
+    """Get non-sensitive configuration."""
+    return {
+        "hyperclaw_root": str(HYPERCLAW_ROOT),
+        "model": os.environ.get("HYPERCLAW_MODEL", "claude-sonnet-4-6"),
+        "max_tokens": int(os.environ.get("HYPERCLAW_MAX_TOKENS", 4096)),
+        "database_configured": bool(os.environ.get("DATABASE_URL")),
+        "integrations_configured": list(_orchestrator._integrations.keys()) if _orchestrator else [],
+    }
+
+
+# ============================================================================
+# MAIN
+# ============================================================================
+
+def main():
+    """Run the server."""
+    import uvicorn
+    from hyperclaw.updates import on_startup
+    on_startup("server")
+
+    host = bind_host()
+    port = int(os.environ.get("PORT", 8001))
+    if not is_loopback(host):
+        logger.warning(f"HyperClaw server is bound to {host}, a NON-loopback address: it is "
+                       f"reachable from other machines. Unset HOST to bind 127.0.0.1 only.")
+        if not os.environ.get("HYPERCLAW_API_TOKEN", "").strip():
+            logger.warning("HYPERCLAW_API_TOKEN is not set: the chat/memory API has no "
+                           "authentication. Do not expose it beyond a trusted network.")
+
+    uvicorn.run(
+        "hyperclaw.server:app",
+        host=host,
+        port=port,
+        reload=os.environ.get("RELOAD", "").lower() == "true",
+        log_level="info"
+    )
+
+
+if __name__ == "__main__":
+    main()