@dyzsasd/dev-loop 0.22.0

package/dist/doctor.js

@@ -0,0 +1,230 @@
+// `dev-loop-hub doctor` — operator health check. READ-ONLY: it never auto-creates a db
+// (a typo'd path reports MISSING, it does not spin an empty one). Backs the §17/§18 promises:
+// data home is machine-local + never committed, the SoR is intact.
+// DL-81: the `doctor` COMMAND additionally runs a service runtime-wiring reconcile (reads the product
+// .mcp.json / daemon runfile / hooks.json + a localhost /api/health GET) — still READ-ONLY (no writes,
+// no auto-create) and NON-FATAL; see serviceReconcile. Library callers (init-service) skip it.
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileSync } from "node:child_process";
+import { DatabaseSync } from "node:sqlite";
+import { loadProjectsConfig, resolveProjectFromCwd } from "./resolve-project.js";
+// DL-81: the `doctor` COMMAND (server.ts / `node src/doctor.ts`) passes { reconcile: true } to ALSO report
+// the service runtime wiring (below). Library callers that only want the DB-integrity verdict (init-service
+// step (d)) call runDoctor(dbPath) with no opts → no reconcile, behavior byte-for-byte unchanged.
+export async function runDoctor(dbPath, opts = {}) {
+    let ok = true;
+    const pass = (m) => console.log("✅ " + m);
+    const fail = (m) => { console.log("❌ " + m); ok = false; };
+    const info = (m) => console.log("•  " + m);
+    console.log(`dev-loop-hub doctor — ${dbPath}`);
+    // 1. Exists (never create on doctor)
+    if (!existsSync(dbPath)) {
+        fail(`db MISSING — nothing to check (create it: node src/seed.ts <key> "<name>" <PREFIX>). NOT auto-creating.`);
+        return false;
+    }
+    // 2. Open the db READ-ONLY. doctor's whole contract is to be non-destructive (§17/§18): it must
+    //    NEVER create or initialize a db. openDb() runs `CREATE TABLE IF NOT EXISTS`, which would
+    //    materialize the full schema into an empty / truncated file (0 → ~200KB) and falsely green a
+    //    destroyed SoR (DL-54). Read-only mode makes create-if-not-exists impossible for ANY input.
+    let db;
+    try {
+        db = new DatabaseSync(dbPath, { readOnly: true });
+        db.exec("PRAGMA busy_timeout=5000");
+        db.exec("PRAGMA foreign_keys=ON");
+    }
+    catch (e) {
+        fail(`db not openable (read-only): ${e.message}`);
+        return false;
+    }
+    // 2b. A 0-byte file IS a valid (empty) SQLite db, so the read-only open above SUCCEEDS on a
+    //     truncated / zeroed / placeholder file — it just carries no schema; a non-SQLite file throws
+    //     on the first read. Either way it is not a system-of-record: report INVALID and write nothing.
+    const HUB_TABLES = ["projects", "tickets", "documents", "topics", "actors", "events"]; // every table step 4 below counts — so a partial/foreign db fails HERE, cleanly, not mid-check
+    let missing;
+    try {
+        const present = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((r) => r.name));
+        missing = HUB_TABLES.filter((t) => !present.has(t));
+    }
+    catch (e) {
+        fail(`db INVALID — not a readable SQLite database: ${e.message}`);
+        db.close();
+        return false;
+    }
+    if (missing.length) {
+        fail(`db INVALID — empty / truncated / non-hub file (missing hub tables: ${missing.join(", ")}); not a system-of-record`);
+        db.close();
+        return false;
+    }
+    pass("db opens read-only and carries the hub schema");
+    // 3. PRAGMAs
+    const jm = db.prepare("PRAGMA journal_mode").get().journal_mode;
+    jm === "wal" ? pass("journal_mode = WAL") : fail(`journal_mode = ${jm} (expected wal)`);
+    const fk = db.prepare("PRAGMA foreign_keys").get().foreign_keys;
+    info(`foreign_keys = ${fk} (set per-connection; informational)`);
+    const qc = db.prepare("PRAGMA quick_check").get();
+    Object.values(qc)[0] === "ok" ? pass("quick_check ok (no corruption)") : fail(`quick_check: ${JSON.stringify(qc)}`);
+    // 4. Counts + per-project, and the unique-prefix integrity check (the real multi-project guard)
+    const c = (sql) => db.prepare(sql).get().c;
+    info(`projects=${c("SELECT count(*) c FROM projects")} tickets=${c("SELECT count(*) c FROM tickets")} docs=${c("SELECT count(*) c FROM documents")} topics=${c("SELECT count(*) c FROM topics")} actors=${c("SELECT count(*) c FROM actors")} events=${c("SELECT count(*) c FROM events")}`);
+    const projects = db.prepare("SELECT id, key, ticket_prefix FROM projects ORDER BY key").all();
+    const countByProject = db.prepare("SELECT count(*) c FROM tickets WHERE project_id = ?");
+    for (const p of projects) {
+        const n = countByProject.get(p.id).c;
+        info(`  project ${p.key} [${p.ticket_prefix}] — ${n} tickets`);
+    }
+    const prefixes = projects.map((p) => p.ticket_prefix);
+    const dupes = prefixes.filter((p, i) => prefixes.indexOf(p) !== i);
+    dupes.length
+        ? fail(`duplicate ticket_prefix across projects: ${[...new Set(dupes)].join(", ")} — ticket ids will collide on the shared db`)
+        : pass(`ticket prefixes unique across projects`);
+    info(`valid DEVLOOP_ACTOR values: ${db.prepare("SELECT handle FROM actors WHERE active=1 ORDER BY handle").all().map((r) => r.handle).join(", ")}`);
+    // 5. §17 secrecy guard — the db must NOT be tracked by git (it's machine-local runtime state)
+    const dir = dirname(dbPath);
+    let inRepo = false;
+    try {
+        inRepo = execFileSync("git", ["-C", dir, "rev-parse", "--is-inside-work-tree"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim() === "true";
+    }
+    catch { /* not a repo */ }
+    if (!inRepo) {
+        pass("data home is outside any git repo (machine-local, never committed)");
+    }
+    else {
+        let leaked = false;
+        for (const f of [dbPath, dbPath + "-wal", dbPath + "-shm"]) {
+            if (!existsSync(f))
+                continue;
+            try {
+                execFileSync("git", ["-C", dir, "check-ignore", "-q", f], { stdio: "ignore" });
+            } // exit 0 = ignored
+            catch {
+                fail(`${f} is INSIDE a git repo and NOT gitignored — the hub DB must never be committed`);
+                leaked = true;
+            }
+        }
+        if (!leaked)
+            pass("db files are inside a repo but gitignored");
+    }
+    db.close();
+    // DL-81: optional, additive service runtime-wiring reconcile (only for the `doctor` COMMAND, not library
+    // callers like init-service). READ-ONLY + NON-FATAL — it never touches `ok`, so the verdict below is still
+    // decided SOLELY by the DB-integrity checks above (§18 SoR contract preserved).
+    if (opts.reconcile)
+        await serviceReconcile(projects.map((p) => p.key), dbPath);
+    console.log(ok ? "\nDOCTOR_OK" : "\nDOCTOR_FAILED");
+    return ok;
+}
+// ── DL-81: service runtime-wiring reconcile ──────────────────────────────────────────────────────────────
+// ADDITIVE, READ-ONLY, NON-FATAL. After the DB-integrity checks (the ONLY hard-fail gate), if this doctor run
+// is for a service-backend project that LIVES IN THE DB WE JUST INSPECTED, ALSO report whether the runtime an
+// operator wired at init (init-service.ts steps (c)/(e) + the DL-42 hook) is still in place — the idempotent
+// "is my service backend wired and up?" reconcile. init already runs doctor (DL-60), so its Step-8 readiness
+// checklist inherits these lines with no SKILL change. Every line is PASS/WARN, NEVER a fail: a stopped daemon
+// / absent .mcp.json / missing hook is operator-actionable info, not a broken SoR. With NO service context
+// this prints NOTHING — the DB-only verdict stays byte-for-byte today's.
+async function serviceReconcile(dbProjectKeys, dbPath) {
+    const pass = (m) => console.log("✅ " + m);
+    const warn = (m) => console.log("⚠️  " + m);
+    // Resolve the project context exactly as the MCP server / DL-13 launcher do: an explicit DEVLOOP_PROJECT
+    // wins, else match cwd against the configured repo paths. null ⇒ no context.
+    const cfg = loadProjectsConfig();
+    const key = process.env.DEVLOOP_PROJECT?.trim() || (cfg ? resolveProjectFromCwd(process.cwd(), cfg) : null);
+    // The reconcile is about the wiring of a project that lives in the db doctor just checked. A key resolved
+    // from cwd/env but ABSENT from this db (doctor pointed at a temp/other db, or cwd resolved a SIBLING project)
+    // is not this db's context — skip silently, keeping the DB-only verdict byte-for-byte unchanged.
+    if (!key || !dbProjectKeys.includes(key))
+        return;
+    console.log(`\nservice runtime wiring — '${key}' (best-effort; informational, not a hard-fail gate):`);
+    // (1) the product repo .mcp.json registers dev-loop-hub with a real server path + DEVLOOP_ACTOR wiring.
+    const repoPath = cfg?.projects?.[key]?.repoPath;
+    if (!repoPath)
+        warn(`.mcp.json — no repoPath for '${key}' in projects.json; cannot verify the dev-loop-hub registration (set repoPath, or register by hand from config/mcp.example.json)`);
+    else
+        reconcileMcpJson(join(repoPath, ".mcp.json"), pass, warn);
+    // (2) the per-project daemon /api/health is reachable (url from the lifecycle runfile beside the db).
+    await reconcileDaemonHealth(key, dbPath, pass, warn);
+    // (3) the DL-42 SessionStart hook (the steady-state daemon owner) is installed.
+    reconcileSessionStartHook(pass, warn);
+}
+function reconcileMcpJson(mcpJsonPath, pass, warn) {
+    if (!existsSync(mcpJsonPath)) {
+        warn(`.mcp.json — ${mcpJsonPath} not found; dev-loop-hub is not registered (re-run init, or merge from config/mcp.example.json)`);
+        return;
+    }
+    let cfg;
+    try {
+        cfg = JSON.parse(readFileSync(mcpJsonPath, "utf8"));
+    }
+    catch (e) {
+        warn(`.mcp.json — ${mcpJsonPath} is malformed JSON, cannot verify the registration (${e.message})`);
+        return;
+    }
+    const entry = cfg?.mcpServers?.["dev-loop-hub"];
+    if (!entry || typeof entry !== "object") {
+        warn(`.mcp.json — no mcpServers["dev-loop-hub"] entry in ${mcpJsonPath} (re-run init to register it)`);
+        return;
+    }
+    const serverArg = (Array.isArray(entry.args) ? entry.args : []).find((a) => typeof a === "string" && /server\.(ts|js)$/.test(a));
+    const actorWired = !!entry.env && typeof entry.env === "object" && "DEVLOOP_ACTOR" in entry.env;
+    if (!serverArg) {
+        warn(`.mcp.json — the dev-loop-hub entry has no server.ts/.js arg in ${mcpJsonPath} (re-run init to repair)`);
+        return;
+    }
+    if (!existsSync(serverArg)) {
+        warn(`.mcp.json — the dev-loop-hub server path is missing on disk: ${serverArg} (the dev-loop checkout moved? re-run init)`);
+        return;
+    }
+    if (!actorWired) {
+        warn(`.mcp.json — the dev-loop-hub entry has no DEVLOOP_ACTOR env wiring in ${mcpJsonPath} (re-run init to repair)`);
+        return;
+    }
+    pass(`.mcp.json registers dev-loop-hub → ${serverArg} (DEVLOOP_ACTOR wired)`);
+}
+async function reconcileDaemonHealth(key, dbPath, pass, warn) {
+    const runDir = process.env.DEVLOOP_RUN_DIR ?? dirname(dbPath); // mirrors the lifecycle's lcRunDir (DL-41)
+    const runfile = join(runDir, `daemon-${key}.json`);
+    let url;
+    try {
+        url = JSON.parse(readFileSync(runfile, "utf8")).url;
+    }
+    catch { /* no runfile ⇒ not running */ }
+    if (!url) {
+        warn(`daemon — not running (no lifecycle runfile ${runfile}); start it with \`dev-loop-hub daemon up\` from the repo`);
+        return;
+    }
+    try {
+        const ac = new AbortController();
+        const t = setTimeout(() => ac.abort(), 1500); // short bound — doctor is a one-shot liveness probe, never a wait
+        const r = await fetch(`${url}/api/health`, { signal: ac.signal }).finally(() => clearTimeout(t));
+        const b = r.status === 200 ? (await r.json().catch(() => null)) : null;
+        if (b && b.ok === true && b.project === key)
+            pass(`daemon /api/health reachable → ${url} (project '${key}')`);
+        else
+            warn(`daemon — ${url}/api/health did not return {ok:true} for '${key}' (wedged/restarting? \`dev-loop-hub daemon up\`)`);
+    }
+    catch {
+        warn(`daemon — ${url}/api/health unreachable (not running?); start it with \`dev-loop-hub daemon up\``);
+    }
+}
+function reconcileSessionStartHook(pass, warn) {
+    const here = dirname(fileURLToPath(import.meta.url)); // hub/src (dev) | dist (published)
+    const pluginRoot = process.env.DEVLOOP_PLUGIN_ROOT ?? join(here, "..", ".."); // the repo/plugin root holds hooks/
+    const hookFile = join(pluginRoot, "hooks", "hooks.json");
+    try {
+        const j = JSON.parse(readFileSync(hookFile, "utf8"));
+        const cmds = (j.hooks?.SessionStart ?? []).flatMap((e) => (e.hooks ?? []).map((h) => h.command ?? ""));
+        if (cmds.some((c) => /daemon\s+up/.test(c)))
+            pass(`DL-42 SessionStart hook installed → ${hookFile} (daemon auto-starts each session)`);
+        else
+            warn(`DL-42 SessionStart hook — ${hookFile} has no \`daemon up\` SessionStart command; re-sync/reinstall the dev-loop plugin`);
+    }
+    catch {
+        warn(`DL-42 SessionStart hook — ${hookFile} not found/readable; re-sync/reinstall the dev-loop plugin so the daemon auto-starts`);
+    }
+}
+// CLI: node src/doctor.ts  (or `dev-loop-hub doctor` via server.ts dispatch / `npm run doctor`)
+if (import.meta.url === `file://${process.argv[1]}`) {
+    const dbPath = process.env.DEVLOOP_HUB_DB ?? `${process.env.HOME}/.dev-loop/hub.db`;
+    process.exit((await runDoctor(dbPath, { reconcile: true })) ? 0 : 1);
+}

package/dist/init-service.js

@@ -0,0 +1,206 @@
+// DL-60 — `dev-loop-hub init-service <key> "<name>" <PREFIX> [--dry-run]`: the idempotent CODE that
+// init's "Step 0.5 — choose your ticket system" flow INVOKES for a backend:"service" project. (The SKILL
+// prose that calls it is DL-53, operator-applied — agents never self-edit a SKILL, §17.) It PERFORMS
+// (not prints) the turnkey service-backend bootstrap by ORCHESTRATING the existing pieces — no
+// re-implementation of any of them:
+//   (a) `npm install` in the hub if node_modules is absent
+//   (b) seed the project row + the agent/operator actors + the §4 labels (ensureSeed — idempotent on
+//       key; a duplicate PREFIX hard-throws, surfaced as a clear "pick a unique prefix" error, never
+//       swallowed — seed.ts:42-47)
+//   (c) merge (never clobber) the dev-loop-hub server into the PRODUCT repo's .mcp.json, env-name-only
+//       (DL-61's mergeMcpServer; skipped cleanly when the project config carries no repoPath)
+//   (d) `runDoctor(dbPath)` → assert DOCTOR_OK (doctor.ts — read-only, never auto-creates a db)
+//   (e) one-shot `daemon up` (the shipped DL-41 lifecycle) → confirm `/api/health {ok:true}` → report
+//       the board URL
+// then VERIFY the DL-42 `hooks/hooks.json` SessionStart hook is present — the STEADY-STATE lifecycle
+// owner (C1-mustFix-2). init's `daemon up` above is a one-time CURRENT-SESSION bootstrap convenience
+// only; if the hook is absent we WARN (tell the operator to re-sync/reinstall the plugin) and NEVER
+// install a competing lifecycle path.
+//
+// Idempotent: a re-run is a clean no-op (seed idempotent-on-key, daemon already-up detected). Honors
+// config: a NON-"service" backend → exit-0 no-op (back-compat — the DL-41/42 safety contract); a
+// `mode:"dry-run"` project (or `--dry-run`) prints every step and performs NONE. §16: localhost-only;
+// identity by env-var NAME; no secrets. §17: this is CODE only — it never edits skills/init/SKILL.md
+// (DL-53) and can never name/write a SKILL/conventions/code file.
+import { existsSync, readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { openDb } from "./db.js";
+import { ensureSeed } from "./seed.js";
+import { runDoctor } from "./doctor.js";
+import { loadProjectsConfig } from "./resolve-project.js";
+import { mergeMcpServer } from "./mcp-merge.js";
+const log = (m) => console.log(m);
+// Resolve the project's backend + mode from projects.json (honors DEVLOOP_PROJECTS_JSON, which tests set,
+// via the shared §11 locator in resolve-project.ts). §18: a missing `backend` ⇒ "linear". A key ABSENT
+// from config ⇒ the explicit `init-service` invocation is taken as service intent (init invokes this only
+// when setting up a service project); a key PRESENT with a non-"service" backend is honored as a no-op.
+function resolveProjectCfg(key) {
+    const cfg = loadProjectsConfig();
+    const proj = cfg?.projects?.[key];
+    if (!proj)
+        return { backend: "service", mode: "live" };
+    return { backend: proj.backend ?? "linear", mode: proj.mode ?? "live", repoPath: proj.repoPath };
+}
+// DL-42 (C1-mustFix-2): the SessionStart hook is the STEADY-STATE lifecycle owner; init only VERIFIES it
+// ships (a `daemon up` SessionStart command in hooks/hooks.json) and WARNS if absent — it must never
+// install a competing lifecycle path.
+function sessionStartHookPresent(pluginRoot) {
+    try {
+        const j = JSON.parse(readFileSync(join(pluginRoot, "hooks", "hooks.json"), "utf8"));
+        const cmds = (j.hooks?.SessionStart ?? []).flatMap((e) => (e.hooks ?? []).map((h) => h.command ?? ""));
+        return cmds.some((c) => /daemon\s+up/.test(c));
+    }
+    catch {
+        return false;
+    }
+}
+export async function runInitService(opts) {
+    const { key, name, prefix, dbPath } = opts;
+    const here = dirname(fileURLToPath(import.meta.url)); // hub/src (dev) | dist (published)
+    // Resolve the server entry by THIS file's own extension — .ts in-repo (zero-build dev), .js when run
+    // from the compiled npm package (node won't type-strip under node_modules; the published build is dist/*.js).
+    const selfExt = fileURLToPath(import.meta.url).endsWith(".js") ? ".js" : ".ts";
+    const hubDir = opts.hubDir ?? join(here, "..");
+    const pluginRoot = opts.pluginRoot ?? process.env.DEVLOOP_PLUGIN_ROOT ?? join(here, "..", "..");
+    const serverEntry = opts.serverEntry ?? join(here, `server${selfExt}`);
+    const { backend, mode, repoPath } = resolveProjectCfg(key);
+    const dryRun = !!opts.dryRun || mode === "dry-run";
+    log(`dev-loop-hub init-service — project '${key}' (prefix ${prefix}), backend '${backend}'${dryRun ? " [dry-run]" : ""}`);
+    // ── Back-compat: a non-"service" backend is a clean no-op (the DL-41/42 safety contract). ──
+    if (backend !== "service") {
+        log(`•  backend is '${backend}', not 'service' — nothing to bootstrap (no-op).`);
+        return 0;
+    }
+    // ── (a) `npm install` if the hub deps are absent ──
+    if (existsSync(join(hubDir, "node_modules"))) {
+        log("✅ hub dependencies present (node_modules) — skipping install");
+    }
+    else if (dryRun) {
+        log(`[dry-run] would: npm install (in ${hubDir})`);
+    }
+    else {
+        log(`•  installing hub dependencies (npm install in ${hubDir}) …`);
+        const r = spawnSync("npm", ["install"], { cwd: hubDir, encoding: "utf8", stdio: "inherit" });
+        if (r.status !== 0) {
+            log(`❌ npm install failed (exit ${r.status}) — install the hub deps and re-run`);
+            return 1;
+        }
+        log("✅ hub dependencies installed");
+    }
+    // ── (b) seed the project row + actors + labels (idempotent on key; a prefix clash → a clear error) ──
+    if (dryRun) {
+        log(`[dry-run] would: seed project '${key}' ("${name}", prefix ${prefix}) + actors + labels in ${dbPath}`);
+    }
+    else {
+        try {
+            const db = openDb(dbPath);
+            try {
+                ensureSeed(db, key, name, prefix);
+            }
+            finally {
+                db.close();
+            }
+            log(`✅ project '${key}' seeded (idempotent on key) + actors + labels in ${dbPath}`);
+        }
+        catch (e) {
+            // ensureProject hard-throws on a duplicate prefix — its message already says "pick a unique prefix".
+            log(`❌ seed failed: ${e.message}`);
+            return 1;
+        }
+    }
+    // ── (c) [DL-61] merge the dev-loop-hub server into the PRODUCT repo's .mcp.json, env-name-only (never
+    //        clobbering other servers). Needs the product repoPath (from config); absent ⇒ skip cleanly.
+    //        A malformed product .mcp.json is reported (left untouched) but does NOT abort the bootstrap. ──
+    if (!repoPath) {
+        log("•  no repoPath in config — skipping .mcp.json registration (register dev-loop-hub by hand from config/mcp.example.json)");
+    }
+    else if (dryRun) {
+        log(`[dry-run] would: merge the dev-loop-hub MCP server into ${join(repoPath, ".mcp.json")} (env-name-only, preserving any other servers)`);
+    }
+    else {
+        const m = mergeMcpServer({ mcpJsonPath: join(repoPath, ".mcp.json"), hubServerPath: serverEntry, projectKey: key });
+        if (m.ok)
+            log(`✅ .mcp.json ${m.action}: dev-loop-hub registered in ${join(repoPath, ".mcp.json")} (servers: ${m.servers.join(", ")})`);
+        else
+            log(`⚠️  .mcp.json registration skipped: ${m.error}\n   register dev-loop-hub by hand from config/mcp.example.json, then re-run.`);
+    }
+    // ── (d) doctor → assert DOCTOR_OK ──
+    if (dryRun) {
+        log(`[dry-run] would: run doctor on ${dbPath} and assert DOCTOR_OK`);
+    }
+    else if (!(await runDoctor(dbPath))) {
+        log("❌ doctor did not report DOCTOR_OK — the SoR is not healthy; not starting the daemon");
+        return 1;
+    }
+    else {
+        log("✅ doctor: DOCTOR_OK");
+    }
+    // ── (e) one-shot `daemon up` (DL-41) → confirm `/api/health {ok:true}` → report the board URL ──
+    let boardUrl = null;
+    if (dryRun) {
+        log(`[dry-run] would: start the daemon once (${serverEntry} daemon up) and confirm /api/health {ok:true}, then report the board URL`);
+    }
+    else {
+        const r = spawnSync(process.execPath, [serverEntry, "daemon", "up"], {
+            encoding: "utf8",
+            env: { ...process.env, DEVLOOP_HUB_DB: dbPath, DEVLOOP_PROJECT: key, DEVLOOP_ACTOR: "operator" },
+        });
+        if (r.status !== 0) {
+            log(`❌ daemon up failed (exit ${r.status})${r.stderr ? "\n   " + r.stderr.trim() : ""}`);
+            return 1;
+        }
+        const out = (r.stdout ?? "").trim();
+        if (out)
+            log(out.split("\n").map((l) => "   " + l).join("\n"));
+        // Confirm health + learn the URL from the runfile the lifecycle just wrote (runDir mirrors lcRunDir).
+        const runDir = process.env.DEVLOOP_RUN_DIR ?? dirname(dbPath);
+        try {
+            const run = JSON.parse(readFileSync(join(runDir, `daemon-${key}.json`), "utf8"));
+            const h = (await fetch(`${run.url}/api/health`).then((x) => x.json()).catch(() => null));
+            if (!h || h.ok !== true) {
+                log(`❌ daemon started but /api/health is not ok at ${run.url}`);
+                return 1;
+            }
+            boardUrl = run.url;
+            log("✅ daemon healthy → /api/health {ok:true}");
+        }
+        catch (e) {
+            log(`❌ could not confirm daemon health: ${e.message}`);
+            return 1;
+        }
+    }
+    // ── DL-42 hook presence: VERIFY (don't install — C1-mustFix-2) ──
+    if (sessionStartHookPresent(pluginRoot)) {
+        log("✅ DL-42 SessionStart hook present — the per-project daemon auto-starts each session (steady-state owner)");
+    }
+    else {
+        log("⚠️  DL-42 SessionStart hook NOT found in hooks/hooks.json — re-sync / reinstall the dev-loop plugin so the daemon auto-starts on session start. (The `daemon up` above was a one-time current-session bootstrap; init never installs a competing lifecycle path.)");
+    }
+    // ── report ──
+    if (dryRun)
+        log("\n[dry-run] init-service preview complete — no changes made.");
+    else
+        log(`\n✅ service backend ready for '${key}'.${boardUrl ? `  Board: ${boardUrl}` : ""}`);
+    return 0;
+}
+// CLI: `node src/init-service.ts <key> "<name>" <PREFIX> [--dry-run]` (also `npm run init-service -- …`).
+// A standalone entry, deliberately NOT wired into the `dev-loop-hub` (server.ts) subcommand surface — the
+// ticket fences server.ts off, and the init SKILL (DL-53) invokes the mechanics generically, so this needs
+// no server.ts dispatch. Importing this module is side-effect-free — the guard keys on argv[1].
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    const rest = process.argv.slice(2);
+    const dryRun = rest.includes("--dry-run");
+    const [key, name, prefix] = rest.filter((a) => a !== "--dry-run");
+    if (!key || !name || !prefix) {
+        console.error(`[hub] usage: dev-loop-hub init-service <key> "<name>" <PREFIX> [--dry-run]`);
+        process.exit(2);
+    }
+    const code = await runInitService({
+        key, name, prefix, dryRun,
+        dbPath: process.env.DEVLOOP_HUB_DB ?? join(homedir(), ".dev-loop", "hub.db"),
+    });
+    process.exit(code);
+}

package/dist/labelstore.js

@@ -0,0 +1,34 @@
+// Shared label/project metadata store (DL-68) — the trivial "label/project ops" the MCP server (server.ts)
+// and the daemon op-API (agentops.ts) both serve: list_issue_labels / create_issue_label / get_project. These
+// are thin project-scoped DB reads + one guarded insert, so this module is small — but it is the SINGLE shared
+// source for `create_issue_label`'s LABEL_KINDS + empty-name reject (the DL-22 regression class: a bad kind
+// silently dropping the row while returning ok{}), and for the read SELECTs (so the two paths can't drift on a
+// column list / order → the differential-parity AC). The docstore/topicstore/channelstore precedent: one impl,
+// no drift. §17 firewall (structural): every write is an INSERT on the `labels` DB table — no filesystem path,
+// no external effect; a label can never name a SKILL/conventions/code file.
+import { randomUUID } from "node:crypto";
+// The kinds the labels.kind CHECK constraint allows (db.ts). Validated UP FRONT so INSERT OR IGNORE can only
+// ever ignore a genuine duplicate name — never silently swallow a CHECK(kind) violation and then masquerade as
+// success (DL-22). The SINGLE shared source: server.ts + the op-API both import this, so they can't drift.
+export const LABEL_KINDS = ["marker", "type", "owner", "subtype", "workflow", "repo"];
+// list_issue_labels — the project's labels (no event; a read).
+export function listLabels(db, projectId) {
+    return db.prepare("SELECT name,kind FROM labels WHERE project_id=? ORDER BY kind,name").all(projectId);
+}
+// create_issue_label — validate (DL-22: empty-name + LABEL_KINDS, UP FRONT) then INSERT OR IGNORE (idempotent
+// on UNIQUE(project_id,name)). Returns the {name,kind} on success. NO event here — the op-API wrapper logs an
+// attributed `label.create` (the identity win) while server.ts's tool stays byte-identical (it never logged one).
+export function createLabel(db, projectId, a) {
+    const nm = a.name.trim();
+    if (!nm)
+        return { ok: false, error: "label name required (non-empty, non-whitespace)" }; // DL-22: reject empty/whitespace, no junk row
+    const k = a.kind ?? "workflow";
+    if (!LABEL_KINDS.includes(k))
+        return { ok: false, error: `invalid kind '${k}'; one of ${LABEL_KINDS.join("/")}` }; // DL-22: clean err, never a fake success
+    db.prepare("INSERT OR IGNORE INTO labels(id,project_id,name,kind) VALUES (?,?,?,?)").run(randomUUID(), projectId, nm, k);
+    return { ok: true, data: { name: nm, kind: k } }; // idempotent: UNIQUE(project_id,name) → re-create of an existing name is a no-op, still ok
+}
+// get_project — the active project row (no event; a read). Same column list/shape on both paths.
+export function getProject(db, projectId) {
+    return db.prepare("SELECT id,key,name,ticket_prefix,mode,autonomy FROM projects WHERE id=?").get(projectId);
+}

package/dist/linear.js

@@ -0,0 +1,60 @@
+const timeoutMs = () => Number(process.env.DEVLOOP_MIRROR_TIMEOUT_MS) || 10_000;
+// The endpoint defaults to the real Linear; DEVLOOP_LINEAR_API_URL overrides it (an integration-test /
+// self-hosted seam). §16 is unaffected — the token is still a function arg, never placed in the URL —
+// and env is already the trust boundary for the token, so this adds no new exposure. Read at call time.
+const endpoint = () => process.env.DEVLOOP_LINEAR_API_URL || "https://api.linear.app/graphql";
+async function gql(fetchImpl, token, query, variables) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs());
+    try {
+        const res = await fetchImpl(endpoint(), {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: token }, // Linear personal API key (no "Bearer")
+            body: JSON.stringify({ query, variables }),
+            signal: ctl.signal,
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (res.status !== 200)
+            throw new Error(`linear http ${res.status}`); // status only — never the body/token
+        const errors = body.errors;
+        if (errors?.length)
+            throw new Error(`linear error: ${String(errors[0].message ?? "unknown").slice(0, 80)}`);
+        return (body.data ?? {});
+    }
+    catch (e) {
+        if (e.name === "AbortError")
+            throw new Error("linear network error: timeout");
+        throw e;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// reconcile-by-marker: find a previously-mirrored issue by the `[hub:<id>]` marker in its title,
+// so a crash between issueCreate and recording the mapping never double-creates on retry.
+export async function findByMarker(fetchImpl, token, marker) {
+    const d = await gql(fetchImpl, token, "query($q:String!){ issues(filter:{ title:{ containsIgnoreCase:$q } }, first:1){ nodes{ id } } }", { q: marker });
+    const nodes = (d.issues?.nodes ?? []);
+    return nodes[0]?.id ?? null;
+}
+export async function createIssue(fetchImpl, token, teamId, projectId, issue) {
+    const input = { teamId, title: issue.title, description: issue.description };
+    if (projectId)
+        input.projectId = projectId;
+    if (issue.stateId)
+        input.stateId = issue.stateId;
+    const d = await gql(fetchImpl, token, "mutation($i:IssueCreateInput!){ issueCreate(input:$i){ success issue{ id } } }", { i: input });
+    const r = d.issueCreate;
+    if (!r?.success || !r.issue?.id)
+        throw new Error("linear issueCreate failed");
+    return r.issue.id;
+}
+export async function updateIssue(fetchImpl, token, id, issue) {
+    const input = { title: issue.title, description: issue.description };
+    if (issue.stateId)
+        input.stateId = issue.stateId;
+    const d = await gql(fetchImpl, token, "mutation($id:String!,$i:IssueUpdateInput!){ issueUpdate(id:$id, input:$i){ success } }", { id, i: input });
+    const r = d.issueUpdate;
+    if (!r?.success)
+        throw new Error("linear issueUpdate failed");
+}