服务器 API
CLI-JAW 暴露 201 个 route handler（包含根页面），其中 200 个是跨已拆分 route module 和 mounted sub-router 的 API/媒体端点。
基础 URL
http://localhost:3457 # Core server (jaw serve)
http://localhost:24576 # Manager dashboard (jaw dashboard serve)身份验证
本地 loopback 请求无需 Bearer token。远程/private-network 请求需要 Bearer token，除非显式启用可信 LAN bypass。可从同源页面或 CLI 上下文通过 GET /api/auth/token 引导获取 token。
Route Groups
| 分组 | 代表端点 |
|---|---|
| Core/system | GET /api/health, GET /api/session, GET /api/runtime, GET /api/auth/token |
| Messages/sessions | GET /api/messages, GET /api/messages/count, GET /api/messages/search, GET|POST /api/chat-sessions, POST /api/chat-sessions/:id/switch |
| Events | GET /api/events SSE channel with replay cursor support |
| Commands | POST /api/command, GET /api/commands, POST /api/message |
| Orchestration | GET /api/orchestrate/state, PUT /api/orchestrate/state, POST /api/orchestrate/dispatch, POST /api/orchestrate/dispatch/batch, GET /api/orchestrate/worker-progress |
| Goals/tasks | GET /api/goal, GET /api/goal/history, POST /api/goal, GET|POST /api/task |
| Settings/runtime | GET|PUT /api/settings, GET /api/cli-registry, GET /api/cli-status, GET /api/quota |
| MCP/skills | GET|PUT /api/mcp, POST /api/mcp/sync, POST /api/mcp/install, GET /api/skills, POST /api/skills/enable |
| Memory | GET /api/jaw-memory/search, GET /api/jaw-memory/context, POST /api/jaw-memory/save, GET /api/memory/status |
| Browser/CDP | POST /api/browser/start, GET /api/browser/status, GET /api/browser/snapshot, POST /api/browser/act, POST /api/browser/web-ai/code, POST /api/browser/web-ai/code-extract 以及其他 /api/browser/web-ai/* |
| Messaging/media | POST /api/upload, POST /api/voice, POST /api/channel/send, GET /media/:filename |
| Dashboard sub-routes | /api/dashboard/board/*, /api/dashboard/schedule/*, manager server 上的 dashboard memory/chat/git/connector routes |
准确来源
准确的 route count、mutation guard 和 WebSocket/SSE event 名称以 structure/server_api.md 为准。bash structure/check-doc-drift.sh 会把该 source-of-truth 表与本地源码进行校验。