@goodandready/dsh-goal 0.2.10 → 0.2.11

package/lib/engine-issue-sync.js

@@ -1,3 +1,6 @@
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+
 /**
  * Parse issue identifier from goal title or string
  * @param {string} input 
@@ -64,3 +67,128 @@ export function updateChecklistInMarkdown(markdown, itemText, done) {
     return line;
   }).join('\n');
 }
+
+/**
+ * Resolve Gitea API credentials from options, environment, or agent config
+ * @param {object} [options]
+ * @returns {{ token?: string, baseUrl: string }}
+ */
+export function resolveGiteaAuth(options = {}) {
+  const defaultUrl = options.baseUrl || process.env.GITEA_BASE_URL || 'http://127.0.0.1:3005';
+  if (options.token) {
+    return { token: options.token, baseUrl: defaultUrl };
+  }
+  if (process.env.GITEA_TOKEN) {
+    return { token: process.env.GITEA_TOKEN, baseUrl: defaultUrl };
+  }
+
+  const credPath = process.env.DSH_GITEA_CREDENTIALS || '/mnt/external/Project/DEV/.gitea-agent-credentials.json';
+  try {
+    if (fs.existsSync(credPath)) {
+      const raw = fs.readFileSync(credPath, 'utf8');
+      const creds = JSON.parse(raw);
+      const agent = creds?.agents?.['deepseek-harness'] || creds?.agents?.antigravity;
+      if (agent?.token) {
+        return {
+          token: agent.token,
+          baseUrl: options.baseUrl || agent.http_remote_base || defaultUrl,
+        };
+      }
+    }
+  } catch (err) {
+    // Non-fatal credential read error
+  }
+  return { baseUrl: defaultUrl };
+}
+
+/**
+ * Resolve repository owner and repo name from git remote or options
+ * @param {string} [cwd]
+ * @param {object} [options]
+ * @returns {{ owner: string, repo: string }}
+ */
+export function resolveRepoInfo(cwd = process.cwd(), options = {}) {
+  if (options.owner && options.repo) {
+    return { owner: options.owner, repo: options.repo };
+  }
+  try {
+    const remote = execFileSync('git', ['remote', 'get-url', 'origin'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    const match = remote.match(/(?:[:/])([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (match) {
+      return { owner: match[1], repo: match[2] };
+    }
+  } catch (err) {
+    // Fallback to default repository
+  }
+  return { owner: 'goodandready', repo: 'dsh-goal' };
+}
+
+/**
+ * Actively sync completed milestone checklist item with Gitea issue
+ * @param {object} goal
+ * @param {object} milestone
+ * @param {object} [options]
+ * @returns {Promise<{ synced: boolean, updated?: boolean, issueNumber?: number, error?: string }>}
+ */
+export async function syncMilestoneWithIssue(goal, milestone, options = {}) {
+  if (!goal?.issueRef?.issueNumber || !milestone?.title) {
+    return { synced: false, error: 'No issue reference or milestone title' };
+  }
+
+  const auth = resolveGiteaAuth(options);
+  if (!auth.token) {
+    return { synced: false, error: 'No Gitea API token available' };
+  }
+
+  const repoInfo = resolveRepoInfo(goal.cwd || process.cwd(), options);
+  const issueNum = goal.issueRef.issueNumber;
+  const issueApiUrl = `${auth.baseUrl}/api/v1/repos/${repoInfo.owner}/${repoInfo.repo}/issues/${issueNum}`;
+
+  try {
+    const fetchFn = options.fetch || globalThis.fetch;
+    if (typeof fetchFn !== 'function') {
+      return { synced: false, error: 'Fetch API unavailable' };
+    }
+
+    const getRes = await fetchFn(issueApiUrl, {
+      headers: {
+        'Authorization': `token ${auth.token}`,
+        'Accept': 'application/json',
+      },
+    });
+
+    if (!getRes.ok) {
+      return { synced: false, error: `HTTP ${getRes.status} fetching issue #${issueNum}` };
+    }
+
+    const issueData = await getRes.json();
+    const currentBody = issueData.body || '';
+    const updatedBody = updateChecklistInMarkdown(currentBody, milestone.title, true);
+
+    if (updatedBody === currentBody) {
+      return { synced: true, updated: false, issueNumber: issueNum };
+    }
+
+    const patchRes = await fetchFn(issueApiUrl, {
+      method: 'PATCH',
+      headers: {
+        'Authorization': `token ${auth.token}`,
+        'Content-Type': 'application/json',
+        'Accept': 'application/json',
+      },
+      body: JSON.stringify({ body: updatedBody }),
+    });
+
+    if (!patchRes.ok) {
+      return { synced: false, error: `HTTP ${patchRes.status} updating issue #${issueNum}` };
+    }
+
+    return { synced: true, updated: true, issueNumber: issueNum };
+  } catch (err) {
+    return { synced: false, error: err.message };
+  }
+}

package/lib/goal-engine.js

@@ -5,7 +5,7 @@ import { buildStatePromptInjection } from './engine-prompt.js';
 import { matchMilestone, parseMilestoneItems, applyMilestoneUpdate, toggleMilestoneChecklistItem } from './engine-milestones.js';
 import { applyIntervention, recordActivity, processTokenBudget } from './engine-intervention.js';
 import { createGoalBranch, sanitizeBranchSlug, getCurrentGitBranch, mergeGoalBranch, discardGoalBranch } from './engine-git-branch.js';
-import { parseIssueRef } from './engine-issue-sync.js';
+import { parseIssueRef, syncMilestoneWithIssue } from './engine-issue-sync.js';
 import { generateRetrospectiveData } from './engine-retrospective.js';
 import { generatePreplanDraft } from './engine-templates.js';
 import { pruneInactiveSessions, addNudgeToGoal, consumeGoalNudge, extendGoalBudget } from './engine-sessions.js';
@@ -378,11 +378,22 @@ export class GoalEngine {
     const prevStatus = res.prevStatus;
     recordActivity(goal, { type: 'milestone', tool: 'updateMilestone', status: 'success', details: `${id} -> ${status}` });
 
-    if (target.status === MilestoneStatus.COMPLETED && prevStatus !== MilestoneStatus.COMPLETED && this.autoCheckpointOnMilestone) {
-      const commitHash = createMilestoneCheckpoint(target, sid);
-      if (commitHash) {
-        target.checkpointCommit = commitHash;
-        goal.logs.push({ timestamp: Date.now(), type: 'info', message: `Git checkpoint saved for [${target.title}]: ${commitHash}` });
+    if (target.status === MilestoneStatus.COMPLETED && prevStatus !== MilestoneStatus.COMPLETED) {
+      if (this.autoCheckpointOnMilestone) {
+        const commitHash = createMilestoneCheckpoint(target, sid);
+        if (commitHash) {
+          target.checkpointCommit = commitHash;
+          goal.logs.push({ timestamp: Date.now(), type: 'info', message: `Git checkpoint saved for [${target.title}]: ${commitHash}` });
+        }
+      }
+      if (goal.issueRef) {
+        syncMilestoneWithIssue(goal, target).then((syncRes) => {
+          if (syncRes?.updated) {
+            goal.logs.push({ timestamp: Date.now(), type: 'info', message: `Synced checklist for issue #${syncRes.issueNumber}` });
+            recordActivity(goal, { type: 'issue', tool: 'syncIssueChecklist', status: 'success', details: `Issue #${syncRes.issueNumber} updated` });
+            this.emit(sid);
+          }
+        }).catch(() => {});
       }
     }
 

package/lib/index.js

@@ -202,35 +202,19 @@ export function apply(ctx, config = {}) {
   const getConfig = () => {
     if (settingsScope) {
       const snap = typeof settingsScope.getSnapshot === 'function' ? settingsScope.getSnapshot() : null;
+      let live = null;
       if (snap) {
-        if (snap.status === 'ready' || snap.status === undefined) {
-          const live = snap.value || (typeof settingsScope.get === 'function' ? settingsScope.get() : null);
-          if (live && typeof live === 'object') {
-            return {
-              maxIterations: typeof live.maxIterations === 'number' ? live.maxIterations : currentSettings.maxIterations,
-              autoDrive: typeof live.autoDrive === 'boolean' ? live.autoDrive : currentSettings.autoDrive,
-              enableSound: typeof live.enableSound === 'boolean' ? live.enableSound : currentSettings.enableSound,
-              showQuickLaunchButton: typeof live.showQuickLaunchButton === 'boolean' ? live.showQuickLaunchButton : currentSettings.showQuickLaunchButton,
-              consecutiveToolFailureLimit: typeof live.consecutiveToolFailureLimit === 'number' ? live.consecutiveToolFailureLimit : currentSettings.consecutiveToolFailureLimit,
-              enableBrowserNotifications: typeof live.enableBrowserNotifications === 'boolean' ? live.enableBrowserNotifications : currentSettings.enableBrowserNotifications,
-              maxTokenBudget: typeof live.maxTokenBudget === 'number' ? live.maxTokenBudget : currentSettings.maxTokenBudget,
-              budgetWarningThreshold: typeof live.budgetWarningThreshold === 'number' ? live.budgetWarningThreshold : currentSettings.budgetWarningThreshold,
-              autoCheckpointOnMilestone: typeof live.autoCheckpointOnMilestone === 'boolean' ? live.autoCheckpointOnMilestone : currentSettings.autoCheckpointOnMilestone,
-              storagePath: typeof live.storagePath === 'string' ? live.storagePath : currentSettings.storagePath,
-            };
-          }
+        if (snap.status === 'ready' || snap.status === 'writable' || snap.status === undefined) {
+          live = snap.value || (typeof settingsScope.get === 'function' ? settingsScope.get() : null);
         }
       } else if (typeof settingsScope.get === 'function') {
-        const live = settingsScope.get();
-        if (live && typeof live === 'object') {
-          return {
-            maxIterations: typeof live.maxIterations === 'number' ? live.maxIterations : currentSettings.maxIterations,
-            autoDrive: typeof live.autoDrive === 'boolean' ? live.autoDrive : currentSettings.autoDrive,
-            enableSound: typeof live.enableSound === 'boolean' ? live.enableSound : currentSettings.enableSound,
-            showQuickLaunchButton: typeof live.showQuickLaunchButton === 'boolean' ? live.showQuickLaunchButton : currentSettings.showQuickLaunchButton,
-            storagePath: typeof live.storagePath === 'string' ? live.storagePath : currentSettings.storagePath,
-          };
-        }
+        live = settingsScope.get();
+      }
+      if (live && typeof live === 'object') {
+        return {
+          ...currentSettings,
+          ...live,
+        };
       }
     }
     return currentSettings;
@@ -316,7 +300,9 @@ export function apply(ctx, config = {}) {
     try {
       if (typeof pctx.systemPrompt?.section === 'function') {
         const globalSections = pctx.systemPrompt.layers?.global?.sections;
+        let displacedPromptSection = null;
         if (globalSections?.data instanceof Map && globalSections.data.has('tool:goal')) {
+          displacedPromptSection = globalSections.data.get('tool:goal');
           globalSections.data.delete('tool:goal');
         }
 
@@ -334,7 +320,12 @@ export function apply(ctx, config = {}) {
         });
 
         if (typeof unregisterSection === 'function') {
-          pctx.effect(() => () => unregisterSection(), 'dsh-goal: system prompt section');
+          pctx.effect(() => () => {
+            unregisterSection();
+            if (displacedPromptSection && globalSections?.data instanceof Map) {
+              globalSections.data.set('tool:goal', displacedPromptSection);
+            }
+          }, 'dsh-goal: system prompt section');
         }
       }
     } catch (err) {

package/lib/routes.js

@@ -21,10 +21,6 @@ export function isTrustedCaller(req) {
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || '';
   if (isLoopback(remote)) return true;
 
-  const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase();
-  if (secSite === 'same-origin' || secSite === 'same-site' || secSite === 'none') return true;
-  if (secSite === 'cross-site') return false;
-
   const host = String(req.headers?.host || '').toLowerCase();
   const origin = String(req.headers?.origin || '').trim().toLowerCase();
   if (origin) {
@@ -167,6 +163,11 @@ export function registerRoutes(ctx, {
 
         // GET /dsh-goal/events: Server-Sent Events realtime snapshot stream
         if (req.method === 'GET' && (pathname === '/dsh-goal/events' || pathname === '/dsh-goal/events/')) {
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            res.setHeader('Content-Type', 'application/json; charset=utf-8');
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
           const sid = sessionIdOf(req, 'default');
           res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -197,12 +198,20 @@ export function registerRoutes(ctx, {
 
         // GET /dsh-goal/templates
         if (req.method === 'GET' && (pathname === '/dsh-goal/templates' || pathname === '/dsh-goal/templates/')) {
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
           res.statusCode = 200;
           return res.end(JSON.stringify({ ok: true, templates: getTemplatesCatalogue() }));
         }
 
         // GET /dsh-goal/state
         if (req.method === 'GET' && (pathname === '/dsh-goal/state' || pathname === '/dsh-goal/state/')) {
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
           const sid = sessionIdOf(req, 'default');
           res.statusCode = 200;
           return res.end(JSON.stringify(engine.getSnapshot(sid)));
@@ -268,13 +277,26 @@ export function registerRoutes(ctx, {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'Goal title cannot be empty' }));
                   }
+                  const trustedRoots = [process.cwd()];
+                  if (process.env.DSH_WORKSPACE_ROOT) {
+                    trustedRoots.push(process.env.DSH_WORKSPACE_ROOT);
+                  }
+                  let safeStartCwd = undefined;
+                  if (data.cwd) {
+                    const validated = getSafeCwd(data.cwd, trustedRoots);
+                    if (!validated) {
+                      res.statusCode = 400;
+                      return res.end(JSON.stringify({ error: 'Invalid or unauthorized working directory' }));
+                    }
+                    safeStartCwd = validated;
+                  }
                   const detectedLang = data.lang || detectLanguage(cleanTitle);
                   const conf = typeof getConfig === 'function' ? getConfig() : { maxIterations: 25 };
                   result = engine.startGoal(cleanTitle, {
                     description: typeof description === 'string' ? description.trim() : '',
                     maxIterations: conf.maxIterations || 25,
                     lang: detectedLang,
-                    cwd: data.cwd,
+                    cwd: safeStartCwd,
                   }, sid);
 
                   const startPrompt = detectedLang === 'zh'
@@ -390,7 +412,15 @@ export function registerRoutes(ctx, {
                   }
                   const sessionGoal = engine.getGoal(sid);
                   const allowedRoots = [process.cwd()];
-                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  if (process.env.DSH_WORKSPACE_ROOT) {
+                    allowedRoots.push(process.env.DSH_WORKSPACE_ROOT);
+                  }
+                  if (sessionGoal?.cwd) {
+                    const isCwdAllowed = allowedRoots.some((root) => isPathInsideOrEqual(root, sessionGoal.cwd));
+                    if (isCwdAllowed) {
+                      allowedRoots.push(sessionGoal.cwd);
+                    }
+                  }
                   const safeCwd = getSafeCwd(data.cwd, allowedRoots);
                   if (!safeCwd) {
                     res.statusCode = 400;
@@ -413,7 +443,15 @@ export function registerRoutes(ctx, {
                   }
                   const sessionGoal = engine.getGoal(sid);
                   const allowedRoots = [process.cwd()];
-                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  if (process.env.DSH_WORKSPACE_ROOT) {
+                    allowedRoots.push(process.env.DSH_WORKSPACE_ROOT);
+                  }
+                  if (sessionGoal?.cwd) {
+                    const isCwdAllowed = allowedRoots.some((root) => isPathInsideOrEqual(root, sessionGoal.cwd));
+                    if (isCwdAllowed) {
+                      allowedRoots.push(sessionGoal.cwd);
+                    }
+                  }
                   const safeCwd = getSafeCwd(data.cwd, allowedRoots);
                   if (!safeCwd) {
                     res.statusCode = 400;

package/lib/tools.js

@@ -46,16 +46,23 @@ export function registerTools(ctx, { engine, resumeActiveAgent }) {
   ctx.inject(['tools'], (tctx) => {
     if (!tctx.tools?.register) return;
 
+    const displacedTools = new Map();
     const safeRegister = (definition) => {
       try {
         const name = definition.name;
         const globalTools = tctx.tools.layers?.global?.tools;
         if (globalTools?.data instanceof Map && globalTools.data.has(name)) {
+          displacedTools.set(name, globalTools.data.get(name));
           globalTools.data.delete(name);
         }
         const unregister = tctx.tools.register(definition);
         if (typeof unregister === 'function') {
-          tctx.effect(() => () => unregister(), `dsh-goal: tool ${name}`);
+          tctx.effect(() => () => {
+            unregister();
+            if (displacedTools.has(name) && globalTools?.data instanceof Map) {
+              globalTools.data.set(name, displacedTools.get(name));
+            }
+          }, `dsh-goal: tool ${name}`);
         }
       } catch (err) {
         console.warn(`[dsh-goal] Tool ${definition.name} registration skipped:`, err.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "Autonomous Goal Execution & Multi-Turn Task Tracking Engine with Sticky Header for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",