@a-t-h-i/bot-lobby 0.6.57 → 0.6.59

package/src/webui/code.ts

@@ -0,0 +1,202 @@
+/**
+ * The code viewer's files: what changed in the project's working tree against
+ * its last commit, one file's text with what the last commit held, and saving
+ * an edit. Every path is jailed to the project folder (resolved with
+ * `realpath`, so a symlink cannot reach out), `.git` is never read or
+ * written, and git runs with arguments only, never a shell.
+ */
+import { execFile } from "node:child_process";
+import { lstat, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { HttpError } from "./api/index.ts";
+import type { CodeChange, CodeChanges, CodeFile, CodeSaved } from "./protocol.ts";
+
+/** Past this many bytes a file is not sent (the page says it is too large). */
+export const CODE_MAX_BYTES = 900_000;
+/** At most this many changed files are listed. */
+const MAX_CHANGES = 500;
+
+function git(root: string, args: string[], maxBuffer = 8_000_000): Promise<string | undefined> {
+  return new Promise((done) => {
+    execFile("git", ["-c", "core.quotepath=off", ...args], { cwd: root, maxBuffer, windowsHide: true, encoding: "utf8" }, (error, stdout) => {
+      done(error ? undefined : stdout);
+    });
+  });
+}
+
+/** Repository-relative with forward slashes, whatever the platform. */
+function slashed(path: string): string {
+  return path.split(sep).join("/");
+}
+
+function insideGitDir(rel: string): boolean {
+  return rel.split("/").includes(".git");
+}
+
+/** A path the page sent, as a project-relative path, or a refusal. Absolute paths must sit inside the project. */
+export function projectPath(root: string, path: string): string {
+  const raw = path.trim().replace(/^file:\/\//, "");
+  if (!raw || raw.includes("\0") || raw.length > 4096) throw new HttpError(400, "bad_request", "name a file in the project");
+  const full = isAbsolute(raw) ? resolve(raw) : resolve(root, raw);
+  const rel = relative(root, full);
+  if (!rel || rel.startsWith("..") || isAbsolute(rel)) throw new HttpError(403, "forbidden", "that file is outside the project");
+  if (insideGitDir(slashed(rel))) throw new HttpError(403, "forbidden", "the .git folder is not shown");
+  return slashed(rel);
+}
+
+/** The file's real path, refused when a link leads it out of the project. */
+async function jailed(root: string, rel: string): Promise<string> {
+  const realRoot = await realpath(root);
+  const target = join(realRoot, rel);
+  let real: string;
+  try {
+    real = await realpath(target);
+  } catch {
+    // A file that does not exist yet: its folder must still be inside.
+    real = join(await realpath(dirname(target)).catch(() => dirname(target)), basename(target));
+  }
+  if (real !== realRoot && !real.startsWith(realRoot + sep)) throw new HttpError(403, "forbidden", "that file is outside the project");
+  if (insideGitDir(slashed(relative(realRoot, real)))) throw new HttpError(403, "forbidden", "the .git folder is not shown");
+  return real;
+}
+
+const STATUS: Record<string, CodeChange["status"]> = { M: "modified", T: "modified", A: "added", D: "deleted", R: "renamed", C: "added", U: "modified" };
+
+/** `git status --porcelain=v1 -z` read into changes (index and working tree folded together). */
+export function parseStatus(out: string): CodeChange[] {
+  const parts = out.split("\0");
+  const changes: CodeChange[] = [];
+  for (let at = 0; at < parts.length; at++) {
+    const entry = parts[at]!;
+    if (entry.length < 4) continue;
+    const code = entry.slice(0, 2);
+    const path = entry.slice(3);
+    if (code === "??") {
+      changes.push({ path, status: "untracked" });
+      continue;
+    }
+    if (code === "!!") continue;
+    const letter = code[1] !== " " ? code[1]! : code[0]!;
+    const renamed = code[0] === "R" || code[0] === "C";
+    const from = renamed ? parts[++at] : undefined;
+    const status = code.includes("D") ? "deleted" : renamed && code[0] === "R" ? "renamed" : STATUS[letter] ?? "modified";
+    changes.push({ path, status, ...(from && status === "renamed" ? { from } : {}) });
+  }
+  return changes;
+}
+
+/** `git diff --numstat -z HEAD` as added and removed lines per path (binary files count none). */
+export function parseNumstat(out: string): Map<string, { additions: number; deletions: number }> {
+  const counts = new Map<string, { additions: number; deletions: number }>();
+  const parts = out.split("\0");
+  for (let at = 0; at < parts.length; at++) {
+    const entry = parts[at]!;
+    const match = /^(-|\d+)\t(-|\d+)\t(.*)$/.exec(entry);
+    if (!match) continue;
+    let path = match[3]!;
+    // A rename names no path on its line; the old and new paths follow.
+    if (!path) {
+      at += 2;
+      path = parts[at] ?? "";
+    }
+    counts.set(path, { additions: Number(match[1]) || 0, deletions: Number(match[2]) || 0 });
+  }
+  return counts;
+}
+
+function lineCount(text: string): number {
+  if (!text) return 0;
+  return text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
+}
+
+/** Every changed file in the working tree against HEAD, with its line counts. */
+export async function codeChanges(root: string): Promise<CodeChanges> {
+  const status = await git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  if (status === undefined) return { git: false, files: [], truncated: false };
+  const head = await git(root, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+  const numstat = head ? parseNumstat((await git(root, ["diff", "--numstat", "-z", "-M", "HEAD"])) ?? "") : new Map();
+  const all = parseStatus(status).filter((change) => !insideGitDir(change.path));
+  const files = all.slice(0, MAX_CHANGES);
+  for (const file of files) {
+    const counted = numstat.get(file.path);
+    if (counted) Object.assign(file, counted);
+    else if (file.status === "untracked" || file.status === "added") {
+      try {
+        const real = await jailed(root, file.path);
+        const info = await stat(real);
+        if (info.isFile() && info.size <= CODE_MAX_BYTES) {
+          const text = await readFile(real, "utf8");
+          if (!text.includes("\0")) Object.assign(file, { additions: lineCount(text), deletions: 0 });
+        }
+      } catch {
+        // Counts stay off for a file that cannot be read.
+      }
+    }
+  }
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return { git: true, files, truncated: all.length > files.length };
+}
+
+/** A bare file name (`zen.ts`, as the activity log says it) as the one project file it names, changed files first. */
+async function findByName(root: string, name: string): Promise<string | undefined> {
+  if (name.includes("/") || name.includes("\\")) return undefined;
+  const changed = (await codeChanges(root)).files.filter((file) => file.status !== "deleted" && basename(file.path) === name);
+  if (changed.length > 0) return changed[0]!.path;
+  const listed = await git(root, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], 32_000_000);
+  if (!listed) return undefined;
+  const matches = listed.split("\0").filter((path) => path && basename(path) === name);
+  return matches.length > 0 ? matches.sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b))[0] : undefined;
+}
+
+function looksBinary(buffer: Buffer): boolean {
+  return buffer.subarray(0, 8000).includes(0);
+}
+
+/** What HEAD holds for the file, or undefined when it holds nothing (a new file, no commits, no git). */
+async function headText(root: string, rel: string, from?: string): Promise<string | undefined> {
+  const out = await git(root, ["show", `HEAD:${from ?? rel}`], CODE_MAX_BYTES * 2);
+  return out === undefined || out.includes("\0") ? undefined : out;
+}
+
+/** One file to show: its text (unless binary or too large), its change, and what the last commit held. */
+export async function codeRead(root: string, path: string): Promise<CodeFile> {
+  let rel = projectPath(root, path);
+  let real = await jailed(root, rel);
+  let info = await lstat(real).then(() => stat(real)).catch(() => undefined);
+  if (!info) {
+    const found = await findByName(root, rel);
+    if (found) {
+      rel = found;
+      real = await jailed(root, rel);
+      info = await stat(real).catch(() => undefined);
+    }
+  }
+  const change = (await codeChanges(root)).files.find((file) => file.path === rel);
+  if (!info && change?.status !== "deleted") throw new HttpError(404, "not_found", `${rel} is not in the project`);
+  if (info && !info.isFile()) throw new HttpError(400, "bad_request", `${rel} is not a file`);
+  const original = change && change.status !== "untracked" && change.status !== "added" ? await headText(root, rel, change.from) : undefined;
+  const base: CodeFile = { path: rel, size: info?.size ?? 0, mtimeMs: info?.mtimeMs ?? 0, exists: Boolean(info), ...(change ? { change } : {}), ...(original !== undefined ? { original } : {}) };
+  if (!info) return { ...base, contents: "" };
+  if (info.size > CODE_MAX_BYTES) return { ...base, tooLarge: true };
+  const buffer = await readFile(real);
+  if (looksBinary(buffer)) return { ...base, binary: true };
+  return { ...base, contents: buffer.toString("utf8") };
+}
+
+/**
+ * Save the file. `mtimeMs` is when the page read it: a file changed on disk
+ * since (an agent edited it) is not overwritten unless `force` says so.
+ */
+export async function codeSave(root: string, body: { path: string; contents: string; mtimeMs?: number; force?: boolean }): Promise<CodeSaved> {
+  const rel = projectPath(root, body.path);
+  const real = await jailed(root, rel);
+  const info = await stat(real).catch(() => undefined);
+  if (!info) throw new HttpError(404, "not_found", `${rel} is no longer in the project`);
+  if (!info.isFile()) throw new HttpError(400, "bad_request", `${rel} is not a file`);
+  if (!body.force && body.mtimeMs !== undefined && Math.abs(info.mtimeMs - body.mtimeMs) > 1) {
+    throw new HttpError(409, "conflict", `${rel} changed on disk since you opened it`);
+  }
+  await writeFile(real, body.contents, "utf8");
+  const after = await stat(real);
+  return { path: rel, mtimeMs: after.mtimeMs, notice: `saved ${rel}` };
+}

package/src/webui/dev/fake-service.ts

@@ -8,6 +8,7 @@ import { resolveConfig, type BotLobbyConfig } from "../../schemas/configuration.
 import { LobbyFeed } from "../../lobby/feed.ts";
 import { promptHub } from "../../lobby/prompt-hub.ts";
 import { lobbyTopics } from "../../lobby/topics.ts";
+import { CHAT_AGENT_SOURCES, parseLobbyCommand, parseMention } from "../../lobby/prompts.ts";
 import type { BackgroundSession, DialogAnswer, SessionDialog } from "../../lobby/sessions.ts";
 import { cleanSessionName } from "../../lobby/sessions.ts";
 import type { PlanComment } from "../../state/comments.ts";
@@ -65,32 +66,6 @@ function defaultPlanner(): NonNullable<ScenarioFixture["mockPlanner"]> {
   return { seats: ["backend", "designer", "qa", "researcher"], members: [], messages: [], questions: [], notes: [], round: 0, retryable: false };
 }
 
-interface FakeQuickFixJob {
-  id: string;
-  prompt: string;
-  status: string;
-  createdAt: number;
-  steps: Array<{ at: number; text: string; pending: boolean }>;
-  tools: number;
-  turns: number;
-  note?: string;
-  report?: string;
-}
-
-function fakeQuickFixJobs(entries: Array<Record<string, unknown>>): FakeQuickFixJob[] {
-  return entries.map((job, index) => ({
-    id: typeof job.id === "string" ? job.id : `QF-${index + 1}`,
-    prompt: typeof job.prompt === "string" ? job.prompt : "",
-    status: typeof job.status === "string" ? job.status : "success",
-    createdAt: typeof job.createdAt === "number" ? job.createdAt : Date.now(),
-    steps: [],
-    tools: 0,
-    turns: 0,
-    ...(typeof job.note === "string" ? { note: job.note } : {}),
-    ...(typeof job.report === "string" ? { report: job.report } : {}),
-  }));
-}
-
 const DETAIL_ONLY = ["body", "state", "mergeable", "files", "notes", "comments"] as const;
 
 /** A list row: the detail fixture without the fields only a detail carries. */
@@ -331,6 +306,9 @@ function streamReply(service: object, feed: LobbyFeed, fixture: ScenarioFixture)
   }
 }
 
+/** How long a scripted @ mention reply takes, so the page shows the agent at work first. */
+const ANSWER_MS = 1500;
+
 /** A `LobbyService` answering from the `name` scenario's fixtures. */
 export function createFixtureService(name: string, feed = new LobbyFeed()): LobbyService {
   const fixture = loadScenario(name);
@@ -343,6 +321,8 @@ export function createFixtureService(name: string, feed = new LobbyFeed()): Lobb
   const auto = new Set(fixture.autoTasks ?? []);
   const comments = new Map<string, Array<Record<string, unknown>>>(Object.entries(fixture.taskComments ?? {}));
   const backgrounds = (fixture.backgroundSessions ?? []).map(fakeBackground);
+  // The agent other than the oracle answering an @ mention, for as long as its scripted reply takes.
+  let answering: string | undefined;
   const archivedBackgrounds: BackgroundSession[] = [];
   let sessionName = fixture.status.sessionName;
   let planning = fakePlanner(fixture.mockPlanner ?? defaultPlanner());
@@ -365,44 +345,12 @@ export function createFixtureService(name: string, feed = new LobbyFeed()): Lobb
     comment: () => "note saved — every agent reads it under this entry",
     unnote: () => "note removed",
   };
-  const qfJobs = fakeQuickFixJobs(fixture.mockQuickfix ?? []);
-  let qfCounter = qfJobs.length;
-  const quickfix = {
-    jobs: qfJobs,
-    get running() {
-      return qfJobs.find((job) => job.status === "running");
-    },
-    submit(prompt: string) {
-      const job: FakeQuickFixJob = { id: `QF-${(qfCounter += 1)}`, prompt: prompt.trim(), status: "queued", createdAt: Date.now(), steps: [], tools: 0, turns: 0 };
-      qfJobs.push(job);
-      return job;
-    },
-    cancel(id: string): boolean {
-      const job = qfJobs.find((entry) => entry.id === id);
-      if (!job || (job.status !== "queued" && job.status !== "running")) return false;
-      job.status = "cancelled";
-      return true;
-    },
-    runAnyway(id: string): boolean {
-      const job = qfJobs.find((entry) => entry.id === id);
-      if (!job || job.status !== "held") return false;
-      job.status = "queued";
-      delete job.note;
-      return true;
-    },
-    movedToTask(id: string): boolean {
-      const job = qfJobs.find((entry) => entry.id === id);
-      if (!job || job.status !== "held") return false;
-      job.status = "cancelled";
-      job.note = "started as a task in a new session";
-      return true;
-    },
-  };
   let commentSeq = 0;
   const service = {
     sessionId: () => fixture.status.sessionId,
     sessionName: () => sessionName,
-    masterBusy: () => fixture.status.busy,
+    masterBusy: () => fixture.status.busy || answering !== undefined,
+    answering: () => answering,
     config: () => config,
     linters: () => fixture.settings?.linters ?? [{ tool: "ESLint", folder: "", installed: true }, { tool: "Ruff", folder: "services/api", installed: false }],
     saveConfig: (next: BotLobbyConfig) => {
@@ -441,7 +389,26 @@ export function createFixtureService(name: string, feed = new LobbyFeed()): Lobb
     zen: () => ({ ...(fixture.zen.task ? { task: { ...fixture.zen.task } } : {}), runs: [...fixture.zen.runs] }),
     feed,
     toOracle: (text: string) => {
-      feed.say("you", text);
+      const command = parseLobbyCommand(text);
+      if (command?.command === "plan") return { notice: "planning on the Plan tab", open: "plan" as const };
+      if (command) return "starting a task — the oracle takes it from here";
+      const mention = parseMention(text);
+      if (mention && mention.agent !== "master") {
+        const source = CHAT_AGENT_SOURCES[mention.agent];
+        answering = source;
+        feed.say("you", mention.rest, Date.now(), { to: source });
+        lobbyTopics.bump("lobby");
+        lobbyTopics.bump("status");
+        const reply = setTimeout(() => {
+          answering = undefined;
+          feed.say("oracle", `${source} here: looked into it, and it is done.`, Date.now(), { agent: source });
+          lobbyTopics.bump("lobby");
+          lobbyTopics.bump("status");
+        }, ANSWER_MS);
+        unref(reply);
+        return undefined;
+      }
+      feed.say("you", mention?.rest || text);
       streamReply(service, feed, fixture);
       return undefined;
     },
@@ -593,7 +560,6 @@ export function createFixtureService(name: string, feed = new LobbyFeed()): Lobb
     },
     defaultPanel: () => ["backend", "designer", "qa", "researcher"],
     planningRounds: () => 5,
-    quickfix,
     pulls: fakePulls(fixture.mockPulls ?? []),
     reviews: fakeReviews(fixture.mockReviews ?? [], fixture.mockReads ?? []),
     issues: fakeIssues((fixture.mockIssues ?? []).map((issue) => ({ ...issue }))),

package/src/webui/dev/fixtures.ts

@@ -46,7 +46,7 @@ export interface ScenarioFixture {
   };
   zen: { task?: Partial<SnapshotTask> & { id: string; title: string; state: string; plan?: string }; runs: unknown[] };
   feed: {
-    chat: Array<{ role: ChatRole; text: string }>;
+    chat: Array<{ role: ChatRole; text: string; agent?: string; to?: string }>;
     activity: Array<{ source: string; text: string; kind: "info" | "success" | "warning" | "error"; pending: boolean }>;
     /** `live` thoughts are still streaming, as an agent thinking now. */
     thoughts: Array<{ source: string; text: string; live?: boolean }>;
@@ -91,8 +91,6 @@ export interface ScenarioFixture {
     round: number;
     retryable: boolean;
   };
-  /** Quick-fix jobs for the `quickfix.*` calls, oldest first (absent means none). */
-  mockQuickfix?: Array<Record<string, unknown>>;
   /** Metric records for `metrics.get` (absent means none). */
   mockMetrics?: Array<Record<string, unknown>>;
   /** Classifier records for `metrics.get` (absent means none). */
@@ -164,7 +162,6 @@ export function loadScenario(name: string | undefined): ScenarioFixture {
     liveSessions: Array.isArray(parsed.liveSessions) ? (parsed.liveSessions as ScenarioFixture["liveSessions"]) : [],
     mockPreviousPlans: Array.isArray(parsed.mockPreviousPlans) ? (parsed.mockPreviousPlans as ScenarioFixture["mockPreviousPlans"]) : [],
     mockPlanner: isRecord(parsed.mockPlanner) ? (parsed.mockPlanner as unknown as ScenarioFixture["mockPlanner"]) : undefined,
-    mockQuickfix: Array.isArray(parsed.mockQuickfix) ? (parsed.mockQuickfix as ScenarioFixture["mockQuickfix"]) : [],
     mockMetrics: Array.isArray(parsed.mockMetrics) ? (parsed.mockMetrics as ScenarioFixture["mockMetrics"]) : [],
     mockClassifierMetrics: Array.isArray(parsed.mockClassifierMetrics) ? (parsed.mockClassifierMetrics as ScenarioFixture["mockClassifierMetrics"]) : [],
     mockKnowledge: Array.isArray(parsed.mockKnowledge) ? (parsed.mockKnowledge as ScenarioFixture["mockKnowledge"]) : [],

package/src/webui/protocol.ts

@@ -14,19 +14,25 @@ import type { PlanComment } from "../state/comments.ts";
 import type { BotLobbyConfig, PanelMember } from "../schemas/configuration.ts";
 import type { QaRiskAssessment } from "../schemas/task.ts";
 import type { MemberState, PanelNote, PanelQuestion, PlannerMessage } from "../lobby/planner.ts";
-import type { QuickFixJob } from "../lobby/quickfix.ts";
 import type { HarnessStatus } from "../harness/status.ts";
 import type { HarnessModel } from "../harness/catalog.ts";
 
 export interface ProjectInfo { id: string; name: string; cwd: string; port: number }
 export interface FolderListing { path: string; parent?: string; folders: Array<{ name: string; path: string }>; truncated: boolean }
 
+/** A file changed in the working tree against HEAD (`code.changes`); counts are lines, absent for binary files. */
+export interface CodeChange { path: string; status: "modified" | "added" | "deleted" | "renamed" | "untracked"; from?: string; additions?: number; deletions?: number }
+export interface CodeChanges { git: boolean; files: CodeChange[]; truncated: boolean }
+/** One file for the code viewer (`code.read`): its text unless binary or too large, its change, and HEAD's text when it had one. */
+export interface CodeFile { path: string; size: number; mtimeMs: number; exists: boolean; contents?: string; binary?: boolean; tooLarge?: boolean; change?: CodeChange; original?: string }
+export interface CodeSaved { path: string; mtimeMs: number; notice: string }
+
 export type { WebPrompt };
 export type { LobbyTopic };
 export type { DialogAnswer, SessionDialog, TaskRow, PlanComment };
 export type { LiveSession };
 export type { HarnessStatus, HarnessModel };
-export type { PanelMember, MemberState, PanelNote, PanelQuestion, PlannerMessage, QuickFixJob, BotLobbyConfig };
+export type { PanelMember, MemberState, PanelNote, PanelQuestion, PlannerMessage, BotLobbyConfig };
 
 /** Every API answer: the result, or why not. */
 export type ApiReply<T> = { ok: true; result: T } | { ok: false; error: string; code: ErrorCode };
@@ -155,7 +161,9 @@ export interface LobbySnapshot {
   task?: SnapshotTask;
   runs: unknown[];
   /** Newest chat messages (at most 100), oldest first. */
-  chat: Array<{ id: number; at: number; role: string; text: string }>;
+  chat: Array<{ id: number; at: number; role: string; text: string; agent?: string; to?: string }>;
+  /** The agent (other than the oracle) answering in the chat now: `DESIGN`, `DEV`, …; absent when none is. */
+  answering?: string;
   /** The oracle's reply while it streams; absent between replies. */
   reply?: string;
   /** Newest activity entries (at most 400), oldest first. */
@@ -553,7 +561,7 @@ export interface Api {
   "status.get": { request: Record<string, never>; result: StatusInfo };
   "lobby.snapshot": { request: Record<string, never>; result: LobbySnapshot };
   "lobby.history": { request: { before?: number }; result: { entries: unknown[]; hasOlder: boolean } };
-  "lobby.send": { request: { text: string; attachments?: string[] }; result: { notice?: string } };
+  "lobby.send": { request: { text: string; attachments?: string[] }; result: { notice?: string; open?: "plan" } };
   "lobby.abort": { request: Record<string, never>; result: Record<string, never> };
   "tasks.list": { request: Record<string, never>; result: { rows: TaskRow[] } };
   "tasks.archived": { request: Record<string, never>; result: { rows: TaskRow[] } };
@@ -609,11 +617,9 @@ export interface Api {
   "planner.previousDelete": { request: { id: string }; result: { notice: string } };
   "planner.previousOpen": { request: { id: string }; result: { notice: string } };
   "planner.save": { request: Record<string, never>; result: { notice: string } };
-  "quickfix.list": { request: Record<string, never>; result: { jobs: QuickFixJob[] } };
-  "quickfix.submit": { request: { text: string; attachments?: string[] }; result: { notice: string; id: string } };
-  "quickfix.cancel": { request: { id: string }; result: { notice: string } };
-  "quickfix.runAnyway": { request: { id: string }; result: { notice: string } };
-  "quickfix.movedToTask": { request: { id: string }; result: { notice: string; key?: string } };
+  "code.changes": { request: Record<string, never>; result: CodeChanges };
+  "code.read": { request: { path: string }; result: CodeFile };
+  "code.save": { request: { path: string; contents: string; mtimeMs?: number; force?: boolean }; result: CodeSaved };
   "projects.browse": { request: { path?: string }; result: FolderListing };
   "projects.open": { request: { path: string }; result: { project: ProjectInfo } };
   "knowledge.files": { request: Record<string, never>; result: { files: KnowledgeFileInfo[]; models?: Partial<Record<KnowledgeAgentName, string>> } };

package/src/webui/static.ts

@@ -46,11 +46,14 @@ export function freshNonce(): string {
   return randomBytes(16).toString("base64");
 }
 
-/** The page loads nothing from anywhere else, so model Markdown cannot pull in a tracker or a script. */
+/**
+ * The page loads nothing from anywhere else, so model Markdown cannot pull in a tracker or a script.
+ * `'wasm-unsafe-eval'` lets the code viewer's highlighter compile its own bundled WebAssembly; it allows no `eval` of script.
+ */
 export function cspHeader(nonce: string): string {
   return [
     "default-src 'self'",
-    `script-src 'self' 'nonce-${nonce}'`,
+    `script-src 'self' 'nonce-${nonce}' 'wasm-unsafe-eval'`,
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' data: blob:",
     "connect-src 'self'",

package/src/workflow/track.ts

@@ -13,7 +13,6 @@
  * `action=track`; the user can force either path with `--fast` or `--full`.
  * Once work is under way a track only gets stricter.
  */
-import type { Domain } from "../schemas/agent.ts";
 import type { Task, TaskTrack, TaskTriage, TrackMember, TrackPath, TriageSize } from "../schemas/task.ts";
 
 export const TRACK_MEMBERS: readonly TrackMember[] = ["designer", "backend", "qa", "researcher"];
@@ -266,7 +265,7 @@ export function readRequest(request: string): RequestReading {
 const YES = 0.5;
 /** Below this the classifier's size is a guess, and the rules' size stands. */
 const SIZE_CONFIDENCE = 0.6;
-/** The classifier's "one engineer can do it alone" taken as a yes (`classifier.thresholds.quickFixAt`'s default). */
+/** The classifier's "one engineer can do it alone" taken as a yes. */
 const SOLO_YES = 0.7;
 
 export interface TrackOptions {
@@ -354,56 +353,6 @@ export function satOut(task: Task, member: TrackMember): boolean {
   return Boolean(task.track?.satOut?.includes(member));
 }
 
-/* ------------------------------------------------------------ quick fix or task */
-
-/** Where a new request goes before any task exists: one agent now (the lobby's quick fix), or the team. */
-export interface RequestRoute {
-  to: "quickfix" | "task";
-  size: TriageSize;
-  /** The domain that would build it: a quick feature (medium or larger) runs on its model, thinking and time limit. */
-  builder: Domain;
-  /** Why, a few words each. */
-  reasons: string[];
-  source: "classifier" | "rules";
-}
-
-/**
- * Whether one agent can do a new request alone, right away. The classifier's
- * "one engineer, alone, now" answer decides when it is on and sure either way
- * (`quickFixAt`); the rules decide otherwise: small and in one area, or
- * self-contained (one file, one page) even when rich. Anything serious,
- * unclear, large, spread across frontend and backend, or needing outside
- * facts goes to the team. The oracle confirms a quick fix before it runs.
- */
-export function chooseRoute(request: string, triage: TaskTriage | undefined, quickFixAt = SOLO_YES): RequestRoute {
-  const rules = readRequest(request);
-  const building = rules.roster.filter((member) => member === "designer" || member === "backend");
-  const against = [
-    rules.risk ? `serious: touches ${rules.risk}` : "",
-    rules.unclear ? `unclear: ${rules.unclear}` : "",
-    rules.size === "large" ? rules.reasons[0]! : "",
-    rules.size === "medium" && !rules.solo ? rules.reasons[0]! : "",
-    building.length > 1 ? "touches frontend and backend" : "",
-    rules.roster.includes("researcher") ? "needs outside facts (the researcher)" : "",
-  ].filter(Boolean);
-  const size = triage && triage.sizeConfidence >= SIZE_CONFIDENCE ? triage.size : rules.size;
-  const frontend = triage ? (triage.domains.designer ?? 0) >= Math.max(YES, triage.domains.backend ?? 0) : building.length === 1 && building[0] === "designer";
-  const builder: Domain = frontend ? "designer" : "backend";
-  const one = building.length === 1 ? (building[0] === "designer" ? "frontend" : "backend") : "one place";
-  const base = { size, builder };
-  const ruled: RequestRoute = against.length > 0
-    ? { ...base, to: "task", reasons: against, source: "rules" }
-    : { ...base, to: "quickfix", reasons: [rules.solo ? `self-contained (${rules.solo}): one agent can build it end to end` : `${rules.reasons[0]}, in ${one}`], source: "rules" };
-  const solo = triage?.solo;
-  if (!triage || solo === undefined) return ruled;
-  // Serious is serious, whatever the classifier makes of the work itself.
-  if (rules.risk) return { ...base, to: "task", reasons: [`serious: touches ${rules.risk}`], source: "rules" };
-  if (triage.ambiguous >= YES) return { ...base, to: "task", reasons: [`the classifier reads it as ambiguous (${triage.ambiguous.toFixed(2)})`], source: "classifier" };
-  if (solo >= quickFixAt) return { ...base, to: "quickfix", reasons: [`the classifier: one engineer can do it alone (${solo.toFixed(2)})`], source: "classifier" };
-  if (solo <= 1 - quickFixAt) return { ...base, to: "task", reasons: [`the classifier: it needs the team (one engineer alone: ${solo.toFixed(2)})`], source: "classifier" };
-  return { ...ruled, reasons: [...ruled.reasons, `the classifier is unsure (${solo.toFixed(2)})`] };
-}
-
 /* ------------------------------------------------------------ what a track asks of the engine */
 
 export function onFastTrack(task: Task): boolean {

package/src/workflow/workflow.ts

@@ -914,7 +914,7 @@ function provenanceNote(files: readonly FileProvenance[] | undefined): string {
   const kinds = new Set(files.flatMap((file) => file.kinds));
   return [
     `Changed files: ${provenanceSummary(files)}.`,
-    kinds.has("quickfix") ? "The user asked for the quick fixes directly: never revert them or send them back as fixes." : "",
+    kinds.has("chat") ? "The user asked for the lobby chat's changes directly: never revert them or send them back as fixes." : "",
     kinds.has("pre-existing") || kinds.has("other-task") ? "Pre-existing changes and other tasks' are not this task's to review or revert." : "",
     kinds.has("unattributed") ? "No agent recorded the unattributed edits: ask the user before counting them in or reverting them." : "",
   ]
@@ -1369,7 +1369,7 @@ function qaReport(header: string, result: ReviewResult, decision: LoopDecision,
     .join("\n");
 }
 
-/** Changes of this task's own: its agents' (or nobody's on record), not quick fixes, other tasks' or what was there before. */
+/** Changes of this task's own: its agents' (or nobody's on record), not the lobby chat's, other tasks' or what was there before. */
 const TASKS_OWN = new Set(["planned", "unattributed"]);
 
 /**