@goodandready/dsh-goal 0.2.8 → 0.2.10

package/lib/index.js

@@ -22,6 +22,15 @@ export const Config = z.object({
   maxTokenBudget: z.number().default(0).description('Maximum token budget per goal session (0 to disable)'),
   budgetWarningThreshold: z.number().default(80).description('Percentage of token budget consumed before model warning injection (e.g. 80)'),
   autoCheckpointOnMilestone: z.boolean().default(false).description('Automatically create git commit checkpoint upon milestone completion'),
+  enableLiveActivityFeed: z.boolean().default(true).description('Display compact recent tool and control activity feed in details modal'),
+  enablePreplanning: z.boolean().default(true).description('Generate initial draft plan for approval before launching autonomous turns'),
+  autoBranchOnGoalStart: z.boolean().default(true).description('Automatically create dedicated isolated git branch for goal execution'),
+  enablePostGoalRetrospective: z.boolean().default(true).description('Generate structured retrospective and analytics card upon goal completion'),
+  autoScaleBudgetNearCompletion: z.boolean().default(false).description('Automatically grant token buffer extension if budget reaches 100% near completion'),
+  enableTemplatesDrawer: z.boolean().default(true).description('Provide pre-configured engineering goal templates in UI drawer'),
+  enableMilestoneDependencies: z.boolean().default(true).description('Enforce milestone dependency ordering and block premature execution'),
+  soundScheme: z.string().default('default').description('Audio theme for status and milestone notifications'),
+  enableVoiceAnnouncements: z.boolean().default(false).description('Use Web Speech API for voice announcements on milestone events'),
   storagePath: z.string().default('').description('Custom filesystem path for persistent state storage'),
 });
 
@@ -43,6 +52,15 @@ export function apply(ctx, config = {}) {
     maxTokenBudget: config?.maxTokenBudget ?? 0,
     budgetWarningThreshold: config?.budgetWarningThreshold ?? 80,
     autoCheckpointOnMilestone: config?.autoCheckpointOnMilestone ?? false,
+    enableLiveActivityFeed: config?.enableLiveActivityFeed ?? true,
+    enablePreplanning: config?.enablePreplanning ?? true,
+    autoBranchOnGoalStart: config?.autoBranchOnGoalStart ?? true,
+    enablePostGoalRetrospective: config?.enablePostGoalRetrospective ?? true,
+    autoScaleBudgetNearCompletion: config?.autoScaleBudgetNearCompletion ?? false,
+    enableTemplatesDrawer: config?.enableTemplatesDrawer ?? true,
+    enableMilestoneDependencies: config?.enableMilestoneDependencies ?? true,
+    soundScheme: config?.soundScheme ?? 'default',
+    enableVoiceAnnouncements: config?.enableVoiceAnnouncements ?? false,
     storagePath: config?.storagePath,
   };
 
@@ -60,6 +78,15 @@ export function apply(ctx, config = {}) {
     maxTokenBudget: currentSettings.maxTokenBudget,
     budgetWarningThreshold: currentSettings.budgetWarningThreshold,
     autoCheckpointOnMilestone: currentSettings.autoCheckpointOnMilestone,
+    enableLiveActivityFeed: currentSettings.enableLiveActivityFeed,
+    enablePreplanning: currentSettings.enablePreplanning,
+    autoBranchOnGoalStart: currentSettings.autoBranchOnGoalStart,
+    enablePostGoalRetrospective: currentSettings.enablePostGoalRetrospective,
+    autoScaleBudgetNearCompletion: currentSettings.autoScaleBudgetNearCompletion,
+    enableTemplatesDrawer: currentSettings.enableTemplatesDrawer,
+    enableMilestoneDependencies: currentSettings.enableMilestoneDependencies,
+    soundScheme: currentSettings.soundScheme,
+    enableVoiceAnnouncements: currentSettings.enableVoiceAnnouncements,
     storagePath,
   });
 
@@ -220,6 +247,15 @@ export function apply(ctx, config = {}) {
       maxTokenBudget: live.maxTokenBudget,
       budgetWarningThreshold: live.budgetWarningThreshold,
       autoCheckpointOnMilestone: live.autoCheckpointOnMilestone,
+      enableLiveActivityFeed: live.enableLiveActivityFeed,
+      enablePreplanning: live.enablePreplanning,
+      autoBranchOnGoalStart: live.autoBranchOnGoalStart,
+      enablePostGoalRetrospective: live.enablePostGoalRetrospective,
+      autoScaleBudgetNearCompletion: live.autoScaleBudgetNearCompletion,
+      enableTemplatesDrawer: live.enableTemplatesDrawer,
+      enableMilestoneDependencies: live.enableMilestoneDependencies,
+      soundScheme: live.soundScheme,
+      enableVoiceAnnouncements: live.enableVoiceAnnouncements,
     });
   };
 

package/lib/routes.js

@@ -2,17 +2,84 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { MilestoneStatus, detectLanguage, sessionIdOf } from './goal-engine-constants.js';
 import { saveGoalArtifact, rollbackToCheckpoint } from './engine-reports.js';
+import { getTemplatesCatalogue } from './engine-templates.js';
+
+export function isLoopback(value) {
+  if (!value) return false;
+  const address = String(value).toLowerCase().replace(/^\[|\]$/g, '');
+  return Boolean(
+    address === 'localhost' ||
+    address === 'localhost.' ||
+    address === '::1' ||
+    address.startsWith('127.') ||
+    address.startsWith('::ffff:127.')
+  );
+}
+
+export function isTrustedCaller(req) {
+  if (!req) return false;
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || '';
+  if (isLoopback(remote)) return true;
+
+  const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase();
+  if (secSite === 'same-origin' || secSite === 'same-site' || secSite === 'none') return true;
+  if (secSite === 'cross-site') return false;
+
+  const host = String(req.headers?.host || '').toLowerCase();
+  const origin = String(req.headers?.origin || '').trim().toLowerCase();
+  if (origin) {
+    try {
+      const u = new URL(origin);
+      if (u.host === host) return true;
+    } catch (err) { /* invalid url */ }
+    return false;
+  }
+
+  const referer = String(req.headers?.referer || '').trim().toLowerCase();
+  if (referer) {
+    try {
+      const u = new URL(referer);
+      if (u.host === host) return true;
+    } catch (err) { /* invalid url */ }
+    return false;
+  }
+
+  // Fallback for tests or local CLI without socket where host header targets loopback
+  if (!remote && host) {
+    const hostName = host.split(':')[0];
+    if (isLoopback(hostName)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+export function isPathInsideOrEqual(parent, child) {
+  if (!parent || !child) return false;
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return !rel || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
 
-function getSafeCwd(requestedCwd) {
-  if (!requestedCwd || typeof requestedCwd !== 'string') {
-    return process.cwd();
+export function getSafeCwd(requestedCwd, allowedRoots = []) {
+  const defaultRoot = allowedRoots[0] || process.cwd();
+  if (!requestedCwd || typeof requestedCwd !== 'string' || !requestedCwd.trim()) {
+    return defaultRoot;
   }
+
   try {
     const resolved = path.resolve(requestedCwd.trim());
     const st = fs.statSync(resolved);
     if (!st.isDirectory()) {
       return null;
     }
+
+    const roots = allowedRoots.length > 0 ? allowedRoots : [process.cwd()];
+    const isAllowed = roots.some((root) => isPathInsideOrEqual(root, resolved));
+    if (!isAllowed) {
+      return null;
+    }
+
     return resolved;
   } catch (err) {
     return null;
@@ -128,6 +195,12 @@ export function registerRoutes(ctx, {
 
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
 
+        // GET /dsh-goal/templates
+        if (req.method === 'GET' && (pathname === '/dsh-goal/templates' || pathname === '/dsh-goal/templates/')) {
+          res.statusCode = 200;
+          return res.end(JSON.stringify({ ok: true, templates: getTemplatesCatalogue() }));
+        }
+
         // GET /dsh-goal/state
         if (req.method === 'GET' && (pathname === '/dsh-goal/state' || pathname === '/dsh-goal/state/')) {
           const sid = sessionIdOf(req, 'default');
@@ -144,8 +217,8 @@ export function registerRoutes(ctx, {
             return res.end(JSON.stringify({ error: 'Forbidden: cross-site requests are rejected' }));
           }
 
-          const origin = req.headers.origin;
-          const host = req.headers.host;
+          const origin = req.headers?.origin;
+          const host = req.headers?.host;
           if (origin && host) {
             try {
               const originHost = new URL(origin).host;
@@ -159,6 +232,11 @@ export function registerRoutes(ctx, {
             }
           }
 
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
+
           let body = '';
           let bodySize = 0;
           const MAX_PAYLOAD_BYTES = 256 * 1024;
@@ -196,6 +274,7 @@ export function registerRoutes(ctx, {
                     description: typeof description === 'string' ? description.trim() : '',
                     maxIterations: conf.maxIterations || 25,
                     lang: detectedLang,
+                    cwd: data.cwd,
                   }, sid);
 
                   const startPrompt = detectedLang === 'zh'
@@ -309,8 +388,11 @@ export function registerRoutes(ctx, {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'commit hash is required for rollback' }));
                   }
-                  const safeCwd = getSafeCwd(data.cwd);
-                  if (data.cwd && !safeCwd) {
+                  const sessionGoal = engine.getGoal(sid);
+                  const allowedRoots = [process.cwd()];
+                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  const safeCwd = getSafeCwd(data.cwd, allowedRoots);
+                  if (!safeCwd) {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'Invalid or non-existent working directory' }));
                   }
@@ -329,8 +411,11 @@ export function registerRoutes(ctx, {
                     res.statusCode = 404;
                     return res.end(JSON.stringify({ error: 'No active goal to save artifact for' }));
                   }
-                  const safeCwd = getSafeCwd(data.cwd);
-                  if (data.cwd && !safeCwd) {
+                  const sessionGoal = engine.getGoal(sid);
+                  const allowedRoots = [process.cwd()];
+                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  const safeCwd = getSafeCwd(data.cwd, allowedRoots);
+                  if (!safeCwd) {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'Invalid or non-existent working directory' }));
                   }
@@ -343,6 +428,51 @@ export function registerRoutes(ctx, {
                   return res.end(JSON.stringify({ ok: true, artifact, state: snap }));
                 }
 
+                case 'intervene': {
+                  result = engine.intervene(data, sid);
+                  if (data.resume) {
+                    engine.resume(sid);
+                    const prompt = engine.getStatePromptInjection(sid);
+                    if (typeof resumeActiveAgent === 'function') {
+                      resumeActiveAgent(prompt, sid);
+                    }
+                  }
+                  break;
+                }
+
+                case 'preplan_approve': {
+                  result = engine.approvePreplan(sid);
+                  const prompt = engine.getStatePromptInjection(sid);
+                  if (typeof resumeActiveAgent === 'function') {
+                    resumeActiveAgent(prompt, sid);
+                  }
+                  break;
+                }
+
+                case 'branch_action': {
+                  const op = String(data.operation || data.branchOperation || 'merge').toLowerCase();
+                  const targetBranch = String(data.targetBranch || 'main');
+                  if (op === 'merge') {
+                    const ok = engine.mergeGoalBranch(targetBranch, sid);
+                    if (!ok) {
+                      res.statusCode = 500;
+                      return res.end(JSON.stringify({ error: `Failed to merge goal branch into ${targetBranch}` }));
+                    }
+                  } else if (op === 'discard') {
+                    const ok = engine.discardGoalBranch(targetBranch, sid);
+                    if (!ok) {
+                      res.statusCode = 500;
+                      return res.end(JSON.stringify({ error: 'Failed to discard goal branch' }));
+                    }
+                  }
+                  result = engine.getSnapshot(sid);
+                  break;
+                }
+
+                case 'templates':
+                  res.statusCode = 200;
+                  return res.end(JSON.stringify({ ok: true, templates: getTemplatesCatalogue() }));
+
                 default:
                   res.statusCode = 400;
                   return res.end(JSON.stringify({ error: `Unknown action: ${action}` }));

package/lib/tools.js

@@ -195,6 +195,9 @@ export function registerTools(ctx, { engine, resumeActiveAgent }) {
     const handleSetMilestones = async ({ milestones }, toolCtx) => {
       const sid = sessionIdOf(toolCtx, 'default');
       const snap = engine.setMilestones(milestones, sid);
+      if (typeof engine.recordToolActivity === 'function') {
+        engine.recordToolActivity('goal_set_milestones', 'success', 'Defined milestones', sid);
+      }
       return {
         success: true,
         count: snap.milestones?.length || 0,
@@ -215,6 +218,7 @@ export function registerTools(ctx, { engine, resumeActiveAgent }) {
               properties: {
                 id: { type: 'string', description: 'Short identifier, e.g. M1, step-1' },
                 title: { type: 'string', description: 'Concise actionable title' },
+                dependsOn: { type: 'array', items: { type: 'string' }, description: 'Prerequisite milestone IDs' },
               },
               required: ['id', 'title'],
             },
@@ -231,7 +235,10 @@ export function registerTools(ctx, { engine, resumeActiveAgent }) {
     // Tool 5: goal_update_progress
     const handleUpdateProgress = async ({ milestone_id, status, notes, checklist }, toolCtx) => {
       const sid = sessionIdOf(toolCtx, 'default');
-      engine.updateMilestone(milestone_id, status, notes, sid, checklist);
+      const ok = engine.updateMilestone(milestone_id, status, notes, sid, checklist);
+      if (typeof engine.recordToolActivity === 'function') {
+        engine.recordToolActivity('goal_update_progress', ok ? 'success' : 'error', String(milestone_id) + ' -> ' + String(status), sid);
+      }
       const snap = engine.getSnapshot(sid);
       const targetMilestone = snap.milestones?.find((m) => m.id === String(milestone_id) || m.id.toLowerCase().replace(/[^a-z0-9]/g, '') === String(milestone_id).toLowerCase().replace(/[^a-z0-9]/g, '') || m.id.toLowerCase().replace(/[^0-9]/g, '') === String(milestone_id).toLowerCase().replace(/[^0-9]/g, ''));
       return {
@@ -282,6 +289,9 @@ export function registerTools(ctx, { engine, resumeActiveAgent }) {
     const handleGoalFinish = async ({ summary }, toolCtx) => {
       const sid = sessionIdOf(toolCtx, 'default');
       const snap = engine.completeGoal(summary, sid);
+      if (typeof engine.recordToolActivity === 'function') {
+        engine.recordToolActivity('goal_finish', 'success', summary ? summary.slice(0, 80) : 'Goal finished', sid);
+      }
       return {
         success: true,
         completed: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Autonomous Goal Execution & Multi-Turn Task Tracking Engine with Sticky Header for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",