Ghostly Architecture: How the Engine Fits Together

{
  "apiKey": "<uuid-or-hex-token>",
  "apiUrl": "http://localhost:4000",
  "llm": {
    "provider": "openai-compatible",
    "model": "gpt-4o",
    "apiKey": "<your-llm-api-key>",
    "baseUrl": "https://api.openai.com/v1"
  }
}

POST   /v1/auth/login              # Issue a JWT for a dashboard user
POST   /v1/auth/register           # Register a new user (admin only)
GET    /v1/auth/me                 # Current authenticated user info

POST   /v1/run                     # Start a new run (direct or assisted)
GET    /v1/runs                    # List runs for the authenticated user
GET    /v1/runs/:id                # Get a single run by ID
POST   /v1/runs/:id/cancel         # Cancel a running test

GET    /v1/runs/:id/events/stream  # SSE stream of run events

POST   /v1/plan                    # Request a step plan from the LLM strategist

GET    /v1/projects                # List projects for the authenticated user
POST   /v1/projects                # Create a new project
DELETE /v1/projects/:id            # Delete a project

GET    /v1/api-keys                # List API keys for the authenticated user
POST   /v1/api-keys                # Create a new API key
DELETE /v1/api-keys/:id            # Delete an API key

GET    /v1/settings/llm            # Read per-user LLM settings
PUT    /v1/settings/llm            # Update per-user LLM settings
GET    /v1/settings/llm/providers  # List available LLM providers
GET    /v1/settings/llm/models     # List available models for current provider
POST   /v1/settings/llm/test       # Test the current LLM configuration

GET    /health                     # Liveness probe → { "status": "ok" }
GET    /v1/ping                    # Auth + LLM config probe

const DEFAULT_RUN_GUARDRAILS = {
  maxSteps: 25,
  maxTimeoutMs: 120_000,
  enforceSameOrigin: true,
};