CVE-2026-76761 (GHSA-V2JJ-5G64-RXP4)

+	"encoding/json"+	"net/http"+	"net/http/httptest"+	"strings"+	"testing"+)++// testManagementServer creates a ManagementServer with a test engine and returns an httptest.Server.+func testManagementServer(t *testing.T, token string) (*ManagementServer, *httptest.Server, *Engine) {+	t.Helper()++	agent := &stubAgent{}+	sm := NewSessionManager("")+	e := NewEngine("test-project", agent, nil, "", LangEnglish)+	e.sessions = sm++	mgmt := NewManagementServer(0, token, nil)+	mgmt.RegisterEngine("test-project", e)++	mux := http.NewServeMux()+	prefix := "/api/v1"+	mux.HandleFunc(prefix+"/status", mgmt.wrap(mgmt.handleStatus))+	mux.HandleFunc(prefix+"/restart", mgmt.wrap(mgmt.handleRestart))+	mux.HandleFunc(prefix+"/reload", mgmt.wrap(mgmt.handleReload))+	mux.HandleFunc(prefix+"/config", mgmt.wrap(mgmt.handleConfig))+	mux.HandleFunc(prefix+"/projects", mgmt.wrap(mgmt.handleProjects))+	mux.HandleFunc(prefix+"/projects/", mgmt.wrap(mgmt.handleProjectRoutes))+	mux.HandleFunc(prefix+"/cron", mgmt.wrap(mgmt.handleCron))+	mux.HandleFunc(prefix+"/cron/", mgmt.wrap(mgmt.handleCronByID))+	mux.HandleFunc(prefix+"/bridge/adapters", mgmt.wrap(mgmt.handleBridgeAdapters))++	ts := httptest.NewServer(mux)+	t.Cleanup(ts.Close)++	return mgmt, ts, e+}++type mgmtResponse struct {+	OK    bool            `json:"ok"`+	Data  json.RawMessage `json:"data,omitempty"`+	Error string          `json:"error,omitempty"`+}++func mgmtGet(t *testing.T, url, token string) mgmtResponse {+	t.Helper()+	req, _ := http.NewRequest("GET", url, nil)+	if token != "" {+		req.Header.Set("Authorization", "Bearer "+token)+	}+	resp, err := http.DefaultClient.Do(req)+	if err != nil {+		t.Fatalf("GET %s: %v", url, err)+	}+	defer resp.Body.Close()+	var r mgmtResponse+	json.NewDecoder(resp.Body).Decode(&r)+	return r+}++func mgmtPost(t *testing.T, url, token string, body any) mgmtResponse {+	t.Helper()+	var buf bytes.Buffer+	if body != nil {+		json.NewEncoder(&buf).Encode(body)+	}+	req, _ := http.NewRequest("POST", url, &buf)+	req.Header.Set("Content-Type", "application/json")+	if token != "" {+		req.Header.Set("Authorization", "Bearer "+token)+	}+	resp, err := http.DefaultClient.Do(req)+	if err != nil {+		t.Fatalf("POST %s: %v", url, err)+	}+	defer resp.Body.Close()+	var r mgmtResponse+	json.NewDecoder(resp.Body).Decode(&r)+	return r+}++func mgmtPatch(t *testing.T, url, token string, body any) mgmtResponse {+	t.Helper()+	var buf bytes.Buffer+	if body != nil {+		json.NewEncoder(&buf).Encode(body)

+	"encoding/json"+	"fmt"+	"log/slog"+	"net/http"+	"strconv"+	"strings"+	"sync"+	"time"+)++// ManagementServer provides an HTTP REST API for external management tools+// (web dashboards, TUI clients, GUI desktop apps, Mac tray apps, etc.).+type ManagementServer struct {+	port        int+	token       string+	corsOrigins []string+	server      *http.Server+	startedAt   time.Time++	mu      sync.RWMutex+	engines map[string]*Engine // project name → engine++	cronScheduler      *CronScheduler+	heartbeatScheduler *HeartbeatScheduler+	bridgeServer       *BridgeServer+	logBuffer          *logRingBuffer+}++// NewManagementServer creates a new management API server.+func NewManagementServer(port int, token string, corsOrigins []string) *ManagementServer {+	return &ManagementServer{+		port:        port,+		token:       token,+		corsOrigins: corsOrigins,+		engines:     make(map[string]*Engine),+		startedAt:   time.Now(),+		logBuffer:   newLogRingBuffer(500),+	}+}++func (m *ManagementServer) RegisterEngine(name string, e *Engine) {+	m.mu.Lock()+	defer m.mu.Unlock()+	m.engines[name] = e+}++func (m *ManagementServer) SetCronScheduler(cs *CronScheduler)           { m.cronScheduler = cs }+func (m *ManagementServer) SetHeartbeatScheduler(hs *HeartbeatScheduler) { m.heartbeatScheduler = hs }+func (m *ManagementServer) SetBridgeServer(bs *BridgeServer)             { m.bridgeServer = bs }++func (m *ManagementServer) Start() {+	mux := http.NewServeMux()+	prefix := "/api/v1"++	// System+	mux.HandleFunc(prefix+"/status", m.wrap(m.handleStatus))+	mux.HandleFunc(prefix+"/restart", m.wrap(m.handleRestart))+	mux.HandleFunc(prefix+"/reload", m.wrap(m.handleReload))+	mux.HandleFunc(prefix+"/config", m.wrap(m.handleConfig))++	// Projects+	mux.HandleFunc(prefix+"/projects", m.wrap(m.handleProjects))+	mux.HandleFunc(prefix+"/projects/", m.wrap(m.handleProjectRoutes))++	// Cron (global)+	mux.HandleFunc(prefix+"/cron", m.wrap(m.handleCron))+	mux.HandleFunc(prefix+"/cron/", m.wrap(m.handleCronByID))++	// Bridge+	mux.HandleFunc(prefix+"/bridge/adapters", m.wrap(m.handleBridgeAdapters))++	m.server = &http.Server{+		Addr:    fmt.Sprintf(":%d", m.port),+		Handler: mux,+	}+	go func() {+		if err := m.server.ListenAndServe(); err != nil && err != http.ErrServerClosed {+			slog.Error("management api server error", "error", err)+		}+	}()+	slog.Info("management api started", "port", m.port)+}++func (m *ManagementServer) Stop() {+	if m.server != nil {

@@ -56,6 +57,14 @@ type BridgeConfig struct { 	Path    string `toml:"path,omitempty"`  // URL path; default "/bridge/ws" } +// ManagementConfig controls the HTTP Management API for external tools.+type ManagementConfig struct {+	Enabled     *bool    `toml:"enabled"`                  // default false+	Port        int      `toml:"port,omitempty"`           // listen port; default 9820+	Token       string   `toml:"token,omitempty"`          // shared secret for authentication; required+	CORSOrigins []string `toml:"cors_origins,omitempty"`   // allowed CORS origins; empty = no CORS+}+ // DisplayConfig controls how intermediate messages (thinking, tool output) are shown. type DisplayConfig struct { 	ThinkingMaxLen  *int `toml:"thinking_max_len"`    // max chars for thinking messages; 0 = no truncation; default 300