@bamptee/aia-code 2.0.0 → 2.0.2

package/src/services/worktrunk.js

@@ -0,0 +1,197 @@
+import { execSync } from 'node:child_process';
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'fs-extra';
+
+// F1: Validate branch name to prevent command injection
+function validateBranchName(branch) {
+  // Allow only alphanumeric, dash, underscore, slash
+  if (!/^[a-zA-Z0-9_\-/]+$/.test(branch)) {
+    throw new Error(`Invalid branch name: "${branch}". Only alphanumeric characters, dashes, underscores, and slashes are allowed.`);
+  }
+  return branch;
+}
+
+// Find wt binary - check common locations
+let wtBinary = null;
+
+function findWtBinary() {
+  if (wtBinary !== null) return wtBinary;
+
+  const home = os.homedir();
+  const candidates = [
+    'wt', // in PATH
+    path.join(home, '.cargo', 'bin', 'wt'),
+    '/usr/local/bin/wt',
+    '/opt/homebrew/bin/wt',
+  ];
+
+  for (const candidate of candidates) {
+    try {
+      execSync(`${candidate} --version`, { stdio: 'ignore' });
+      wtBinary = candidate;
+      return wtBinary;
+    } catch {
+      // Try next
+    }
+  }
+
+  wtBinary = false;
+  return wtBinary;
+}
+
+function getWtCommand() {
+  const wt = findWtBinary();
+  if (!wt) throw new Error('Worktrunk (wt) CLI not found');
+  return wt;
+}
+
+/**
+ * Check if worktrunk (wt) CLI is installed
+ */
+export function isWtInstalled() {
+  return findWtBinary() !== false;
+}
+
+/**
+ * List all worktrees in a repository
+ * @param {string} cwd - Repository root directory
+ * @returns {Array} List of worktree objects
+ */
+export function listWorktrees(cwd) {
+  try {
+    const wt = getWtCommand();
+    const output = execSync(`${wt} list --format=json`, { cwd, encoding: 'utf-8' });
+    return JSON.parse(output);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Check if a git branch exists
+ * @param {string} branch - Branch name
+ * @param {string} cwd - Repository root directory
+ * @returns {boolean}
+ */
+function branchExists(branch, cwd) {
+  try {
+    execSync(`git show-ref --verify --quiet refs/heads/${branch}`, { cwd, stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Create a worktree for a branch
+ * @param {string} branch - Branch name (e.g., 'feature/my-feature')
+ * @param {string} cwd - Repository root directory
+ */
+export function createWorktree(branch, cwd) {
+  validateBranchName(branch);
+  const wt = getWtCommand();
+
+  // --no-cd: Don't try to change directory (we're in Node.js, not a shell)
+  // --yes: Skip approval prompts
+  // If branch already exists, switch to it (creates worktree)
+  // If branch doesn't exist, create it with -c
+  if (branchExists(branch, cwd)) {
+    execSync(`${wt} switch --no-cd --yes ${branch}`, { cwd, stdio: 'inherit' });
+  } else {
+    execSync(`${wt} switch --no-cd --yes -c ${branch}`, { cwd, stdio: 'inherit' });
+  }
+}
+
+/**
+ * Get the path of a worktree for a branch
+ * @param {string} branch - Branch name
+ * @param {string} cwd - Repository root directory
+ * @returns {string|null} Worktree path or null if not found
+ */
+export function getWorktreePath(branch, cwd) {
+  const list = listWorktrees(cwd);
+  const wt = list.find(w => w.branch === branch || w.branch === `refs/heads/${branch}`);
+  return wt?.path || null;
+}
+
+/**
+ * Check if a worktree exists for a branch
+ * @param {string} branch - Branch name
+ * @param {string} cwd - Repository root directory
+ * @returns {boolean}
+ */
+export function hasWorktree(branch, cwd) {
+  return getWorktreePath(branch, cwd) !== null;
+}
+
+/**
+ * Remove a worktree
+ * @param {string} branch - Branch name
+ * @param {string} cwd - Repository root directory
+ */
+export function removeWorktree(branch, cwd) {
+  validateBranchName(branch);
+  const wt = getWtCommand();
+  execSync(`${wt} remove ${branch}`, { cwd, stdio: 'inherit' });
+}
+
+/**
+ * Get the feature branch name from a feature name
+ * @param {string} featureName - Feature name
+ * @returns {string} Branch name (e.g., 'feature/my-feature')
+ */
+export function getFeatureBranch(featureName) {
+  return `feature/${featureName}`;
+}
+
+/**
+ * Start docker-compose services in a worktree
+ * @param {string} wtPath - Worktree directory path
+ */
+export function startServices(wtPath) {
+  const composePath = path.join(wtPath, 'docker-compose.wt.yml');
+  if (fs.existsSync(composePath)) {
+    execSync('docker-compose -f docker-compose.wt.yml up -d', { cwd: wtPath, stdio: 'inherit' });
+  }
+}
+
+/**
+ * Stop docker-compose services in a worktree
+ * @param {string} wtPath - Worktree directory path
+ */
+export function stopServices(wtPath) {
+  const composePath = path.join(wtPath, 'docker-compose.wt.yml');
+  if (fs.existsSync(composePath)) {
+    execSync('docker-compose -f docker-compose.wt.yml down', { cwd: wtPath, stdio: 'inherit' });
+  }
+}
+
+/**
+ * Check if docker-compose.wt.yml exists in a worktree
+ * @param {string} wtPath - Worktree directory path
+ * @returns {boolean}
+ */
+export function hasDockerServices(wtPath) {
+  if (!wtPath) return false;
+  const composePath = path.join(wtPath, 'docker-compose.wt.yml');
+  return fs.existsSync(composePath);
+}
+
+/**
+ * Get docker services status
+ * @param {string} wtPath - Worktree directory path
+ * @returns {Array} List of service objects with name and status
+ */
+export function getServicesStatus(wtPath) {
+  if (!hasDockerServices(wtPath)) return [];
+  try {
+    const output = execSync('docker-compose -f docker-compose.wt.yml ps --format json', {
+      cwd: wtPath,
+      encoding: 'utf-8',
+    });
+    return JSON.parse(output);
+  } catch {
+    return [];
+  }
+}

package/src/ui/api/config.js

@@ -2,10 +2,11 @@ import path from 'node:path';
 import fs from 'fs-extra';
 import yaml from 'yaml';
 import { AIA_DIR } from '../../constants.js';
+import { loadGlobalConfig, saveGlobalConfig, getGlobalConfigPath } from '../../services/config.js';
 import { json, error } from '../router.js';
 
 export function registerConfigRoutes(router) {
-  // Get config
+  // Get project config
   router.get('/api/config', async (req, res, { root }) => {
     const configPath = path.join(root, AIA_DIR, 'config.yaml');
     if (!(await fs.pathExists(configPath))) {
@@ -15,7 +16,7 @@ export function registerConfigRoutes(router) {
     json(res, { content, parsed: yaml.parse(content) });
   });
 
-  // Save config
+  // Save project config
   router.put('/api/config', async (req, res, { root, parseBody }) => {
     const body = await parseBody();
     const configPath = path.join(root, AIA_DIR, 'config.yaml');
@@ -23,6 +24,58 @@ export function registerConfigRoutes(router) {
     json(res, { ok: true });
   });
 
+  // Get global user config
+  router.get('/api/user-config', async (req, res) => {
+    try {
+      const config = await loadGlobalConfig();
+      const configPath = getGlobalConfigPath();
+      json(res, { parsed: config, path: configPath });
+    } catch (e) {
+      error(res, e.message, 500);
+    }
+  });
+
+  // Update global user preferences
+  router.patch('/api/user-config', async (req, res, { parseBody }) => {
+    const body = await parseBody();
+
+    try {
+      const config = await loadGlobalConfig();
+
+      // Update only user preference fields
+      if (body.user_name !== undefined) config.user_name = body.user_name;
+      if (body.communication_language !== undefined) config.communication_language = body.communication_language;
+
+      await saveGlobalConfig(config);
+
+      json(res, { ok: true, config });
+    } catch (e) {
+      error(res, e.message, 500);
+    }
+  });
+
+  // Update project preferences (partial update)
+  router.patch('/api/config/project', async (req, res, { root, parseBody }) => {
+    const body = await parseBody();
+    const configPath = path.join(root, AIA_DIR, 'config.yaml');
+
+    if (!(await fs.pathExists(configPath))) {
+      return error(res, 'config.yaml not found', 404);
+    }
+
+    const content = await fs.readFile(configPath, 'utf-8');
+    const config = yaml.parse(content);
+
+    // Update project preference fields
+    if (body.projectName !== undefined) config.projectName = body.projectName;
+    if (body.document_output_language !== undefined) config.document_output_language = body.document_output_language;
+
+    const newContent = yaml.stringify(config);
+    await fs.writeFile(configPath, newContent, 'utf-8');
+
+    json(res, { ok: true, config });
+  });
+
   // List context files
   router.get('/api/context', async (req, res, { root }) => {
     const dir = path.join(root, AIA_DIR, 'context');

package/src/ui/api/constants.js

@@ -7,13 +7,19 @@ export function registerConstantsRoutes(router) {
     json(res, { FEATURE_STEPS, STEP_STATUS, QUICK_STEPS });
   });
 
-  // List available models per step from config
+  // List all unique models from config
   router.get('/api/models', async (req, res, { root }) => {
     try {
       const config = await loadConfig(root);
-      json(res, config.models || {});
+      const all = new Set();
+      for (const models of Object.values(config.models || {})) {
+        for (const entry of models) {
+          all.add(entry.model);
+        }
+      }
+      json(res, [...all]);
     } catch (err) {
-      json(res, {});
+      json(res, []);
     }
   });
 }

package/src/ui/api/features.js

@@ -1,11 +1,19 @@
 import path from 'node:path';
 import fs from 'fs-extra';
+import Busboy from 'busboy';
 import { AIA_DIR } from '../../constants.js';
-import { loadStatus, updateStepStatus, resetStep } from '../../services/status.js';
+import { loadStatus, updateStepStatus, resetStep, updateFlowType } from '../../services/status.js';
 import { createFeature, validateFeatureName } from '../../services/feature.js';
 import { runStep } from '../../services/runner.js';
 import { runQuick } from '../../services/quick.js';
+import { suggestFlowType } from '../../services/flow-analyzer.js';
+import { getGuidance } from '../../services/suggestions.js';
+import { callModel } from '../../services/model-call.js';
+import { loadConfig } from '../../models.js';
 import { json, error } from '../router.js';
+import { isWtInstalled, hasWorktree, getFeatureBranch } from '../../services/worktrunk.js';
+
+const MAX_DESCRIPTION_LENGTH = 50000; // 50KB
 
 function sseHeaders(res) {
   res.writeHead(200, {
@@ -20,6 +28,27 @@ function sseSend(res, event, data) {
   res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
 }
 
+// F6: Extracted validation helpers to avoid code duplication
+function validateHistory(rawHistory) {
+  return Array.isArray(rawHistory)
+    ? rawHistory
+        .filter(msg => msg && typeof msg === 'object' && typeof msg.content === 'string')
+        .map(msg => ({
+          role: msg.role === 'agent' ? 'agent' : 'user',
+          content: String(msg.content).slice(0, 50000),
+        }))
+        .slice(-20)
+    : [];
+}
+
+function validateAttachments(rawAttachments) {
+  return Array.isArray(rawAttachments)
+    ? rawAttachments
+        .filter(a => a && typeof a === 'object' && typeof a.path === 'string')
+        .map(a => ({ filename: a.filename || 'unknown', path: a.path }))
+    : [];
+}
+
 export function registerFeatureRoutes(router) {
   // List all features
   router.get('/api/features', async (req, res, { root }) => {
@@ -29,13 +58,15 @@ export function registerFeatureRoutes(router) {
     }
     const entries = await fs.readdir(featuresDir, { withFileTypes: true });
     const features = [];
+    const wtInstalled = isWtInstalled();
     for (const entry of entries) {
       if (entry.isDirectory()) {
         try {
           const status = await loadStatus(entry.name, root);
-          features.push({ name: entry.name, ...status });
+          const hasWt = wtInstalled && hasWorktree(getFeatureBranch(entry.name), root);
+          features.push({ name: entry.name, ...status, hasWorktree: hasWt });
         } catch {
-          features.push({ name: entry.name, error: true });
+          features.push({ name: entry.name, error: true, hasWorktree: false });
         }
       }
     }
@@ -95,10 +126,15 @@ export function registerFeatureRoutes(router) {
     };
 
     try {
+      const validatedHistory = validateHistory(body.history || []);
+      const validatedAttachments = validateAttachments(body.attachments || []);
+
       const output = await runStep(params.step, params.name, {
         description: body.description,
+        history: validatedHistory,
+        attachments: validatedAttachments,
         model: body.model || undefined,
-        verbose: true,
+        verbose: body.verbose !== undefined ? body.verbose : true,
         apply: body.apply || false,
         root,
         onData,
@@ -171,10 +207,15 @@ export function registerFeatureRoutes(router) {
         try { sseSend(res, 'log', { type, text }); } catch {}
       };
 
-      const output = await runStep(params.step, params.name, {
+      const validatedHistory = validateHistory(body.history || []);
+      const validatedAttachments = validateAttachments(body.attachments || []);
+
+      await runStep(params.step, params.name, {
         instructions: body.instructions,
+        history: validatedHistory,
+        attachments: validatedAttachments,
         model: body.model || undefined,
-        verbose: true,
+        verbose: body.verbose !== undefined ? body.verbose : true,
         apply: body.apply || false,
         root,
         onData,
@@ -195,4 +236,258 @@ export function registerFeatureRoutes(router) {
       error(res, err.message, 400);
     }
   });
+
+  // Initialize feature with description, enrich with agent, and get flow suggestion
+  router.post('/api/features/:name/init', async (req, res, { params, root, parseBody }) => {
+    const body = await parseBody();
+    const { description } = body;
+
+    if (!description) {
+      return error(res, 'Description is required', 400);
+    }
+
+    if (description.length > MAX_DESCRIPTION_LENGTH) {
+      return error(res, `Description too long (${description.length} chars, max ${MAX_DESCRIPTION_LENGTH})`, 400);
+    }
+
+    sseHeaders(res);
+    sseSend(res, 'status', { status: 'enriching', message: 'Structuring your description...' });
+
+    const onData = ({ type, text }) => {
+      try { sseSend(res, 'log', { type, text }); } catch {}
+    };
+
+    try {
+      // Load config to get user preferences
+      const config = await loadConfig(root);
+
+      // Build enrichment prompt
+      const enrichPrompt = `You are helping structure a feature description for a development project.
+
+USER INPUT:
+${description}
+
+TASK:
+Transform this input into a well-structured feature specification document in Markdown format.
+
+OUTPUT FORMAT:
+# ${params.name}
+
+## Summary
+(1-2 sentence summary of what this feature does)
+
+## Problem Statement
+(What problem does this solve? Why is it needed?)
+
+## Requirements
+(List the key functional requirements as bullet points)
+
+## Constraints
+(Any technical constraints, limitations, or considerations)
+
+## Success Criteria
+(How do we know this feature is complete and working?)
+
+IMPORTANT:
+- Keep it concise but complete
+- Don't add requirements that weren't mentioned or implied
+- If the input is vague, make reasonable assumptions and note them
+- Output ONLY the markdown document, no explanations
+- Write the ENTIRE document in ${config.document_output_language || 'English'} regardless of the input language`;
+
+      // Call model to enrich (use brief model config or default)
+      const model = config.models?.brief?.[0]?.model || 'claude-default';
+
+      sseSend(res, 'status', { status: 'generating', message: 'AI is structuring the feature...' });
+
+      const enrichedContent = await callModel(model, enrichPrompt, {
+        verbose: false,
+        apply: false,
+        onData
+      });
+
+      // Save enriched content to init.md
+      const initPath = path.join(root, AIA_DIR, 'features', params.name, 'init.md');
+      await fs.writeFile(initPath, enrichedContent.trim(), 'utf-8');
+
+      // Analyze and suggest flow type based on enriched content
+      const suggestion = suggestFlowType(enrichedContent);
+
+      sseSend(res, 'done', { ok: true, suggestion, content: enrichedContent.trim() });
+    } catch (err) {
+      sseSend(res, 'error', { message: err.message });
+    }
+    res.end();
+  });
+
+  // Get guidance for a step
+  router.get('/api/features/:name/guidance/:step', async (req, res, { params, root }) => {
+    const config = await loadConfig(root);
+    const language = config.communication_language || 'English';
+    const guidance = getGuidance(params.step, language);
+    if (!guidance) {
+      return error(res, `No guidance for step "${params.step}"`, 404);
+    }
+    json(res, guidance);
+  });
+
+  // Upload attachments (multipart/form-data)
+  router.post('/api/features/:name/attachments', async (req, res, { params, root }) => {
+    const attachDir = path.join(root, AIA_DIR, 'features', params.name, 'attachments');
+    await fs.ensureDir(attachDir);
+
+    const busboy = Busboy({
+      headers: req.headers,
+      limits: { fileSize: 10 * 1024 * 1024 }, // 10MB per file
+    });
+
+    const files = [];
+    const writtenFiles = []; // F12: Track all written files for cleanup
+    let totalSize = 0;
+    const maxTotalSize = 50 * 1024 * 1024; // 50MB total
+    let hasError = false;
+
+    // F12: Cleanup function to remove all written files on error
+    const cleanupFiles = async () => {
+      for (const filepath of writtenFiles) {
+        await fs.unlink(filepath).catch(() => {});
+      }
+    };
+
+    busboy.on('file', (fieldname, file, info) => {
+      const { filename, mimeType } = info;
+
+      // Validate mime type
+      const allowedTypes = ['image/', 'application/pdf', 'text/'];
+      const isAllowed = allowedTypes.some(t => mimeType.startsWith(t));
+      if (!isAllowed) {
+        file.resume(); // Drain the stream
+        return;
+      }
+
+      const safeFilename = `${Date.now()}-${filename.replace(/[^a-zA-Z0-9._-]/g, '_')}`;
+      const filepath = path.join(attachDir, safeFilename);
+      const writeStream = fs.createWriteStream(filepath);
+      writtenFiles.push(filepath); // F12: Track for cleanup
+
+      // F7: Handle writeStream errors
+      writeStream.on('error', async (err) => {
+        hasError = true;
+        file.resume(); // Stop reading
+        await cleanupFiles();
+        if (!res.headersSent) {
+          error(res, `Write error: ${err.message}`, 500);
+        }
+      });
+
+      let fileSize = 0;
+      file.on('data', (data) => {
+        fileSize += data.length;
+        totalSize += data.length;
+
+        // F3: Check total size during upload, not after
+        if (totalSize > maxTotalSize) {
+          hasError = true;
+          file.resume(); // Stop reading this file
+        }
+      });
+
+      file.pipe(writeStream);
+
+      file.on('end', () => {
+        if (!hasError && fileSize > 0) {
+          files.push({
+            filename: safeFilename,
+            originalName: filename,
+            path: filepath,
+            mimeType,
+            size: fileSize,
+          });
+        }
+      });
+
+      file.on('limit', () => {
+        fs.unlink(filepath).catch(() => {});
+        // Remove from writtenFiles since we're handling it here
+        const idx = writtenFiles.indexOf(filepath);
+        if (idx > -1) writtenFiles.splice(idx, 1);
+      });
+    });
+
+    busboy.on('finish', async () => {
+      if (hasError) {
+        // F12: Clean up all files if we hit an error
+        await cleanupFiles();
+        if (!res.headersSent) {
+          error(res, `Total size exceeds ${maxTotalSize / 1024 / 1024}MB limit`, 413);
+        }
+        return;
+      }
+      json(res, { ok: true, files });
+    });
+
+    busboy.on('error', async (err) => {
+      await cleanupFiles();
+      if (!res.headersSent) {
+        error(res, err.message, 500);
+      }
+    });
+
+    req.pipe(busboy);
+  });
+
+  // List attachments
+  router.get('/api/features/:name/attachments', async (req, res, { params, root }) => {
+    const attachDir = path.join(root, AIA_DIR, 'features', params.name, 'attachments');
+    if (!(await fs.pathExists(attachDir))) {
+      return json(res, []);
+    }
+
+    const entries = await fs.readdir(attachDir);
+    const files = await Promise.all(
+      entries.map(async (filename) => {
+        const filepath = path.join(attachDir, filename);
+        const stat = await fs.stat(filepath);
+        return {
+          filename,
+          path: filepath,
+          size: stat.size,
+        };
+      })
+    );
+    json(res, files);
+  });
+
+  // Delete an attachment
+  router.delete('/api/features/:name/attachments/:filename', async (req, res, { params, root }) => {
+    // F1: Prevent path traversal attacks
+    const filename = path.basename(params.filename);
+    if (filename !== params.filename || filename.includes('..')) {
+      return error(res, 'Invalid filename', 400);
+    }
+
+    const filepath = path.join(root, AIA_DIR, 'features', params.name, 'attachments', filename);
+    if (!(await fs.pathExists(filepath))) {
+      return error(res, 'Attachment not found', 404);
+    }
+    await fs.remove(filepath);
+    json(res, { ok: true });
+  });
+
+  // Update flow type (quick/full)
+  router.patch('/api/features/:name/flow', async (req, res, { params, root, parseBody }) => {
+    const body = await parseBody();
+    const { flow } = body;
+
+    if (!flow || !['quick', 'full'].includes(flow)) {
+      return error(res, 'Invalid flow type. Must be "quick" or "full"', 400);
+    }
+
+    try {
+      await updateFlowType(params.name, flow, root);
+      json(res, { ok: true, flow });
+    } catch (err) {
+      error(res, err.message, 400);
+    }
+  });
 }

package/src/ui/api/index.js

@@ -2,10 +2,12 @@ import { registerFeatureRoutes } from './features.js';
 import { registerConfigRoutes } from './config.js';
 import { registerLogRoutes } from './logs.js';
 import { registerConstantsRoutes } from './constants.js';
+import { registerWorktrunkRoutes } from './worktrunk.js';
 
 export function registerApiRoutes(router, root) {
   registerFeatureRoutes(router);
   registerConfigRoutes(router);
   registerLogRoutes(router);
   registerConstantsRoutes(router);
+  registerWorktrunkRoutes(router);
 }