Function createHttpServer

lib/http-server.js:44–194

()

}

function createHttpServer() {
  return http.createServer((req, res) => {
    const url = req.url.split('?')[0];

    // --- API: Hook approval endpoint ---
    if (req.method === 'POST' && url === '/hook/pre-tool-use') {
      let body = '';
      req.on('data', chunk => (body += chunk));
      req.on('end', () => {
        let data;
        try { data = JSON.parse(body); } catch {
          res.writeHead(400, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ decision: 'ask' }));
          return;
        }

        maybeAttachHookSession(data, 'pre-tool-use');
        const effectiveApprovalMode = recomputeEffectiveApprovalMode('pre-tool-use');

        if (ALWAYS_AUTO_ALLOW.has(data.tool_name)) {
          res.writeHead(200, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ decision: 'allow' }));
          log(`Permission auto-allowed (always): ${data.tool_name}`);
          return;
        }

        if (effectiveApprovalMode === 'all') {
          res.writeHead(200, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ decision: 'allow' }));
          log(`Permission auto-allowed (mode=all): ${data.tool_name}`);
          return;
        }
        if (effectiveApprovalMode === 'partial' && PARTIAL_AUTO_ALLOW.has(data.tool_name)) {
          res.writeHead(200, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ decision: 'allow' }));
          log(`Permission auto-allowed (mode=partial): ${data.tool_name}`);
          return;
        }

        const clients = [...state.wss.clients].filter(isAuthenticatedClient);
        if (clients.length === 0) {
          res.writeHead(200, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ decision: 'ask' }));
          return;
        }

        const id = String(++state.approvalSeq);
        log(`Permission #${id}: ${data.tool_name} → ${clients.length} WebUI client(s)`);

        broadcast({
          type: 'permission_request',
          id,
          toolName: data.tool_name,
          toolInput: data.tool_input,
          permissionMode: data.permission_mode,
        });

        const timer = setTimeout(() => {