feat: expand HTTP server REST API for remote client access

Add comprehensive REST API endpoints to the HTTP server, enabling iOS app
and other remote clients to manage all codes functionality over HTTP.

New packages:
- internal/chatsession: Claude chat session lifecycle management with
  WebSocket support for real-time I/O streaming

New HTTP endpoints:
- GET/POST /sessions, GET/DELETE /sessions/{id}
- /sessions/{id}/ws (WebSocket), /sessions/{id}/interrupt, /sessions/{id}/resume
- GET /projects, GET /projects/{name}
- GET /profiles, POST /profiles/switch
- GET /stats/summary, /stats/projects, /stats/models, POST /stats/refresh
- GET /workflows, GET/POST /workflows/{name}
- GET/POST /teams, plus extended team/task/agent sub-routes
- POST /dispatch/simple (simplified dispatch variant)

Other improvements:
- Auto-generate and persist auth token if none configured (no manual setup needed)
- Change default listen port from :8080 to :3456
- Add callback URL support for dispatch tasks
- Split handlers into per-domain files (handlers_project, _session, _stats, etc.)

Author: ourines

go.mod

@@ -6,9 +6,11 @@ require (
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/gorilla/websocket v1.5.3
 	github.com/modelcontextprotocol/go-sdk v1.3.0
 	github.com/spf13/cobra v1.10.1
 	golang.org/x/term v0.40.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
@@ -38,6 +40,5 @@ require (
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/text v0.3.8 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	golang.org/x/text v0.34.0 // indirect
 )

go.sum

@@ -35,6 +35,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/jsonschema-go v0.4.2 h1:tmrUohrwoLZZS/P3x7ex0WAVknEkBZM46iALbcqoRA8=
 github.com/google/jsonschema-go v0.4.2/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
@@ -78,10 +80,11 @@ golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
 golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
 golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

internal/chatsession/claude.go

@@ -0,0 +1,63 @@
+package chatsession
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// spawnClaude starts a Claude CLI subprocess in stream-json mode.
+// If resumeSessionID is non-empty, the session is resumed.
+// Returns stdin writer, stdout reader, the command, and any error.
+func spawnClaude(projectPath, model, resumeSessionID string) (io.WriteCloser, io.ReadCloser, *exec.Cmd, error) {
+	args := []string{
+		"--output-format", "stream-json",
+		"--input-format", "stream-json",
+		"--verbose",
+	}
+
+	if model != "" {
+		args = append(args, "--model", model)
+	}
+
+	if resumeSessionID != "" {
+		args = append(args, "--resume", resumeSessionID)
+	}
+
+	cmd := exec.Command("claude", args...)
+	cmd.Dir = projectPath
+
+	// Build clean environment, unsetting CLAUDE_CODE_ENTRYPOINT to avoid nested detection.
+	env := os.Environ()
+	filtered := make([]string, 0, len(env))
+	for _, e := range env {
+		if !strings.HasPrefix(e, "CLAUDE_CODE_ENTRYPOINT=") {
+			filtered = append(filtered, e)
+		}
+	}
+	cmd.Env = filtered
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("stdin pipe: %w", err)
+	}
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		stdin.Close()
+		return nil, nil, nil, fmt.Errorf("stdout pipe: %w", err)
+	}
+
+	// Discard stderr to avoid blocking.
+	cmd.Stderr = io.Discard
+
+	if err := cmd.Start(); err != nil {
+		stdin.Close()
+		stdout.Close()
+		return nil, nil, nil, fmt.Errorf("start claude: %w", err)
+	}
+
+	return stdin, stdout, cmd, nil
+}

internal/chatsession/manager.go

@@ -0,0 +1,161 @@
+package chatsession
+
+import (
+	"crypto/rand"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+// DefaultManager is the global session registry.
+var DefaultManager = NewSessionManager()
+
+// NewSessionManager creates an empty SessionManager.
+func NewSessionManager() *SessionManager {
+	return &SessionManager{
+		sessions: make(map[string]*ChatSession),
+	}
+}
+
+// Create allocates a new ChatSession in "creating" state.
+// The caller must call session.Start(firstMessage) or session.Resume(id) to activate it.
+func (m *SessionManager) Create(projectName, projectPath, model string) (*ChatSession, error) {
+	if projectPath == "" {
+		return nil, fmt.Errorf("projectPath is required")
+	}
+
+	id := generateID()
+
+	session := &ChatSession{
+		ID:           id,
+		ProjectName:  projectName,
+		ProjectPath:  projectPath,
+		Model:        model,
+		Status:       StatusCreating,
+		CreatedAt:    time.Now(),
+		LastActiveAt: time.Now(),
+		clients:      make(map[*websocket.Conn]bool),
+	}
+
+	m.mu.Lock()
+	m.sessions[id] = session
+	m.mu.Unlock()
+
+	return session, nil
+}
+
+// Get returns a session by ID, or false if not found.
+func (m *SessionManager) Get(id string) (*ChatSession, bool) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	s, ok := m.sessions[id]
+	return s, ok
+}
+
+// List returns all active sessions.
+func (m *SessionManager) List() []*ChatSession {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	result := make([]*ChatSession, 0, len(m.sessions))
+	for _, s := range m.sessions {
+		result = append(result, s)
+	}
+	return result
+}
+
+// Delete closes and removes a session.
+func (m *SessionManager) Delete(id string) error {
+	m.mu.Lock()
+	s, ok := m.sessions[id]
+	if !ok {
+		m.mu.Unlock()
+		return fmt.Errorf("session %s not found", id)
+	}
+	delete(m.sessions, id)
+	m.mu.Unlock()
+
+	return s.Close()
+}
+
+// Resume creates a new ChatSession that resumes a previous Claude session.
+func (m *SessionManager) Resume(claudeSessionID, projectName, projectPath, model string) (*ChatSession, error) {
+	session, err := m.Create(projectName, projectPath, model)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := session.Resume(claudeSessionID); err != nil {
+		// Clean up on failure.
+		m.mu.Lock()
+		delete(m.sessions, session.ID)
+		m.mu.Unlock()
+		return nil, err
+	}
+
+	return session, nil
+}
+
+// generateID produces a unique session identifier.
+func generateID() string {
+	var b [4]byte
+	_, _ = rand.Read(b[:])
+	return fmt.Sprintf("cs-%d-%x", time.Now().UnixNano(), b)
+}
+
+// Snapshot returns a read-only snapshot of a session's public state.
+// This avoids exposing the mutex to callers.
+func (s *ChatSession) Snapshot() SessionInfo {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return SessionInfo{
+		ID:              s.ID,
+		ProjectName:     s.ProjectName,
+		ProjectPath:     s.ProjectPath,
+		Model:           s.Model,
+		ClaudeSessionID: s.ClaudeSessionID,
+		Status:          s.Status,
+		CreatedAt:       s.CreatedAt,
+		LastActiveAt:    s.LastActiveAt,
+		CostUSD:         s.CostUSD,
+		TurnCount:       s.TurnCount,
+		ClientCount:     len(s.clients),
+	}
+}
+
+// SessionInfo is a read-only view of a ChatSession (safe to serialize).
+type SessionInfo struct {
+	ID              string        `json:"id"`
+	ProjectName     string        `json:"projectName,omitempty"`
+	ProjectPath     string        `json:"projectPath"`
+	Model           string        `json:"model,omitempty"`
+	ClaudeSessionID string        `json:"claudeSessionId,omitempty"`
+	Status          SessionStatus `json:"status"`
+	CreatedAt       time.Time     `json:"createdAt"`
+	LastActiveAt    time.Time     `json:"lastActiveAt"`
+	CostUSD         float64       `json:"costUsd"`
+	TurnCount       int           `json:"turnCount"`
+	ClientCount     int           `json:"clientCount"`
+}
+
+// CloseAll shuts down every session. Used during server shutdown.
+func (m *SessionManager) CloseAll() {
+	m.mu.Lock()
+	ids := make([]string, 0, len(m.sessions))
+	for id := range m.sessions {
+		ids = append(ids, id)
+	}
+	m.mu.Unlock()
+
+	var wg sync.WaitGroup
+	for _, id := range ids {
+		wg.Add(1)
+		go func(sid string) {
+			defer wg.Done()
+			m.Delete(sid)
+		}(id)
+	}
+	wg.Wait()
+}