@kendoo.agentdesk/agentdesk 0.26.0 → 0.28.0

package/cli/config.mjs

@@ -58,8 +58,13 @@ async function fetchServerConfig(projectName, apiKey, serverUrl) {
   }
 }
 
+// opts.readOnly — return the merged view without the two side effects
+// (auto-heal push to the server, rewrite of .agentdesk.json). Setup wizards
+// use this: they read the config at the top of the flow, before the user has
+// confirmed anything, and must not mutate disk or server state on the way in.
+// Runtime callers (`team`, `daemon`) leave it off so the cache stays fresh.
 export async function loadConfig(dir, opts = {}) {
-  const { apiKey, serverUrl, projectName, silent = false } = opts;
+  const { apiKey, serverUrl, projectName, silent = false, readOnly = false } = opts;
   const configPath = join(dir, ".agentdesk.json");
 
   // Load local .agentdesk.json
@@ -101,7 +106,7 @@ export async function loadConfig(dir, opts = {}) {
   // no row at all or a partial row), push the merged config up so the
   // server catches up. Fire-and-forget — we already have the right
   // answer in `config` for the current caller.
-  const shouldHeal = localConfig && apiKey && serverUrl && projectName && (
+  const shouldHeal = !readOnly && localConfig && apiKey && serverUrl && projectName && (
     !serverConfig || hasFieldsServerLacks(localConfig, serverConfig)
   );
   if (shouldHeal) {
@@ -113,7 +118,7 @@ export async function loadConfig(dir, opts = {}) {
   // actually fetched from the server — offline runs must not silently
   // mutate the user's local file. With mergeNonNull above, we're
   // guaranteed this write never strips existing local fields.
-  if (serverConfig) {
+  if (serverConfig && !readOnly) {
     writeLocalConfig(configPath, config);
   }
 
@@ -137,14 +142,34 @@ function hasFieldsServerLacks(local, server) {
   return false;
 }
 
+// The fields PUT /api/projects/:id/settings accepts. Anything else makes the
+// server reject the whole request with 400 "Unknown fields", and the local
+// merged config carries at least `projectKey` (the project's own id) — so
+// every heal-sync and init push used to fail silently, and the server never
+// learned the Jira project / Linear team the wizard had picked.
+const SETTINGS_FIELDS = [
+  "tracker", "linear", "jira", "github", "team", "commands", "projectAgents",
+  "instructions", "screenshots", "phaseModels", "identityBadge",
+];
+
+export function toSettingsPayload(config) {
+  const clean = stripCredentials(config || {});
+  const out = {};
+  for (const key of SETTINGS_FIELDS) {
+    if (clean[key] !== undefined) out[key] = clean[key];
+  }
+  return out;
+}
+
 // Push a config object to the server. Caller is responsible for deciding when.
+// The payload is reduced to the settings fields the server accepts.
 export async function pushConfig(apiKey, serverUrl, projectName, payload) {
   if (!apiKey || !serverUrl || !projectName) return { ok: false, error: "missing_auth" };
   try {
     const res = await fetch(`${serverUrl}/api/projects/${projectName}/settings`, {
       method: "PUT",
       headers: { "Content-Type": "application/json", "x-api-key": apiKey },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(toSettingsPayload(payload)),
       signal: AbortSignal.timeout(5000),
     });
     if (!res.ok) {

package/cli/daemon.mjs

@@ -1,19 +1,17 @@
 // `agentdesk daemon` — local background daemon for UI-triggered sessions
 
-import { spawn } from "child_process";
 import { existsSync, readFileSync, readdirSync, writeFileSync, mkdirSync } from "fs";
 import { createInterface } from "readline";
 import { join } from "path";
-import { randomUUID } from "crypto";
 import WebSocket from "ws";
 import { detectProject } from "./detect.mjs";
 import { loadConfig } from "./config.mjs";
-import { getStoredApiKey } from "./login.mjs";
-import { resolveTeam, generateTeamPrompt } from "./agents.mjs";
-import { buildPrompt } from "./prompt.mjs";
-import { createStreamParser } from "./stream-parser.mjs";
-import { runOrchestrator, runPhasedOrchestrator } from "./orchestrator.mjs";
-import { getRegisteredProjects, registerLocalProject } from "./projects.mjs";
+import { getStoredApiKey, ensureAccountIdentity } from "./login.mjs";
+import { resolveTeam } from "./agents.mjs";
+import { runSession } from "./engine/session.mjs";
+import { killTree } from "./proc.mjs";
+import { loadDotEnv } from "./dotenv.mjs";
+import { getRegisteredProjects, registerLocalProject, claimLocalProjects } from "./projects.mjs";
 import { buildTrackerUrl } from "./tracker-url.mjs";
 import { fileURLToPath } from "url";
 import { dirname } from "path";
@@ -60,22 +58,6 @@ class RingBuffer {
   get length() { return this.items.length; }
 }
 
-// --- Dot-env loader ---
-
-function loadDotEnv(dir) {
-  const envPath = join(dir, ".env");
-  if (!existsSync(envPath)) return {};
-  const vars = {};
-  for (const line of readFileSync(envPath, "utf-8").split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq === -1) continue;
-    vars[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
-  }
-  return vars;
-}
-
 // --- Metadata logger ---
 
 function logSessionMetadata(sessionId, metadata) {
@@ -150,46 +132,100 @@ export async function runDaemon() {
     process.exit(1);
   }
 
-  // 2. Load registered projects — local registry first, then server fallback
+  // 2. Load registered projects, scoped to the logged-in account (AD-64).
+  // The local registry is machine-global — it accumulates projects from
+  // every account ever used on this machine — so the server's per-account
+  // project list is the authority on what this account may see.
   const agentdeskServer = process.env.AGENTDESK_SERVER || "https://agentdesk.live";
-  let allProjects = getRegisteredProjects();
+  const creds = await ensureAccountIdentity();
+  const accountId = creds?.accountId || null;
 
-  // Fallback: fetch from server if local registry is empty (pre-0.7.0 projects)
-  if (allProjects.length === 0) {
-    try {
-      const res = await fetch(`${agentdeskServer}/api/projects`, {
-        headers: { "x-api-key": apiKey },
-        signal: AbortSignal.timeout(5000),
-      });
-      if (res.ok) {
-        const serverProjects = await res.json();
-        if (Array.isArray(serverProjects) && serverProjects.length > 0) {
-          console.log(`  ${dim}Syncing ${serverProjects.length} project(s) from server...${reset}`);
-          for (const sp of serverProjects) {
+  let serverIds = null;
+  try {
+    const res = await fetch(`${agentdeskServer}/api/projects`, {
+      headers: { "x-api-key": apiKey },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (res.ok) {
+      const serverProjects = await res.json();
+      if (Array.isArray(serverProjects)) {
+        serverIds = new Set(serverProjects.map(sp => sp.id || sp.name));
+
+        // Untagged local entries with no server row — either they predate
+        // server-side registration or were initialized under another login.
+        // Offer them to the server: it accepts free ids and silently no-ops
+        // ids owned by another account (AD-23), so re-fetching the list
+        // tells us which ones are actually ours.
+        const unclaimed = getRegisteredProjects().filter(p =>
+          !p.accountId && !serverIds.has(p.id) &&
+          existsSync(p.path) && existsSync(join(p.path, ".agentdesk.json")));
+        if (unclaimed.length > 0) {
+          for (const p of unclaimed) {
+            try {
+              await fetch(`${agentdeskServer}/api/projects`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", "x-api-key": apiKey },
+                body: JSON.stringify({ id: p.id, name: p.name, path: p.path }),
+                signal: AbortSignal.timeout(5000),
+              });
+            } catch {}
+          }
+          try {
+            const recheck = await fetch(`${agentdeskServer}/api/projects`, {
+              headers: { "x-api-key": apiKey },
+              signal: AbortSignal.timeout(5000),
+            });
+            if (recheck.ok) {
+              const confirmed = await recheck.json();
+              if (Array.isArray(confirmed)) {
+                serverIds = new Set(confirmed.map(sp => sp.id || sp.name));
+              }
+            }
+          } catch {}
+          for (const p of unclaimed) {
+            if (!serverIds.has(p.id)) {
+              console.log(`  ${yellow}Skipping ${p.name}${reset} ${dim}— registered to a different AgentDesk account${reset}`);
+            }
+          }
+        }
+
+        // Claim legacy untagged local entries the server confirmed as ours
+        claimLocalProjects([...serverIds], accountId);
+
+        // Sync server projects missing from the local registry (pre-0.7.0
+        // setups, or projects initialized on another machine)
+        const localIds = new Set(getRegisteredProjects().map(p => p.id));
+        const missing = serverProjects.filter(sp => !localIds.has(sp.id || sp.name));
+        if (missing.length > 0) {
+          console.log(`  ${dim}Syncing ${missing.length} project(s) from server...${reset}`);
+          for (const sp of missing) {
             const projectName = sp.id || sp.name;
             // If server has a valid path, use it
             if (sp.path && existsSync(sp.path)) {
-              registerLocalProject(projectName, sp.name, sp.path);
+              registerLocalProject(projectName, sp.name, sp.path, accountId);
               continue;
             }
             // Server has empty path — try to find the project locally
             const found = findProjectLocally(projectName);
             if (found) {
               console.log(`  ${dim}Found ${projectName} at ${found}${reset}`);
-              registerLocalProject(projectName, sp.name, found);
+              registerLocalProject(projectName, sp.name, found, accountId);
             } else {
               console.log(`  ${yellow}Could not find ${projectName} locally.${reset} Run ${cyan}agentdesk init${reset} in its directory.`);
             }
           }
-          allProjects = getRegisteredProjects();
         }
       }
-    } catch {
-      // Server not reachable — continue with local only
     }
+  } catch {
+    // Server not reachable — fall back to account-tagged local entries
   }
 
-  const projects = allProjects.filter(p => {
+  const projects = getRegisteredProjects(accountId).filter(p => {
+    // Server reachable → it is authoritative: hide entries it doesn't own,
+    // even legacy untagged ones (they may belong to another account).
+    // Offline → tagged + untagged entries from getRegisteredProjects().
+    if (serverIds && !serverIds.has(p.id) && !(accountId && p.accountId === accountId)) return false;
     if (!existsSync(p.path)) return false;
     if (!existsSync(join(p.path, ".agentdesk.json"))) return false;
     return true;
@@ -350,7 +386,7 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
 
   // 4. Session handling
 
-  async function handleStartSession({ sessionId, projectId, taskId: remoteTaskId, prompt, phased, screenshots: screenshotsOverride }) {
+  async function handleStartSession({ sessionId, projectId, taskId: remoteTaskId, prompt, screenshots: screenshotsOverride }) {
     // Validate project against local allowlist
     const project = projects.find(p => p.id === projectId);
     if (!project) {
@@ -381,7 +417,16 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
       return;
     }
     // Claim the slot immediately (before any await) to prevent race conditions
-    activeSession = { sessionId, projectId, child: null, startedAt: Date.now(), filePathsTouched: new Set() };
+    activeSession = {
+      sessionId, projectId,
+      child: null,
+      // Cancelling must stop the whole phase pipeline, not just the child that
+      // happens to be running: killing one phase's child would otherwise let
+      // the loop advance and spawn the next phase.
+      abort: new AbortController(),
+      startedAt: Date.now(),
+      filePathsTouched: new Set(),
+    };
 
     console.log(`  ${green}Starting session${reset} ${dim}${sessionId}${reset}`);
     console.log(`  Project: ${project.name} ${dim}(${project.path})${reset}`);
@@ -406,25 +451,31 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
       // Build task link (only when a real tracker task ID was provided)
       const taskLink = remoteTaskId ? buildTrackerUrl({ tracker, config, taskId: remoteTaskId }) : null;
 
-      // Resolve team
       const team = resolveTeam(config);
-      const teamSections = generateTeamPrompt(team, { tracker, config });
 
       const sessionUrl = `${agentdeskServer}/sessions/${sessionId}`;
 
-      // Run orchestrator
-      const orchestrate = phased ? runPhasedOrchestrator : runOrchestrator;
-      const result = await orchestrate({
+      // Run the engine (real subagents, one query per phase). The server may
+      // still send `phased`; every session is phased now.
+      const sessionAbort = activeSession.abort;
+      const result = await runSession({
         taskId, taskLink,
         description: prompt || "",
         createTask: !remoteTaskId && !!prompt && !!tracker,
         tracker, config,
-        project: detected, team, teamSections,
+        project: detected, team,
         sessionUrl,
         sessionId,
         cwd: project.path,
         apiKey,
         serverUrl: agentdeskServer,
+        abortSignal: sessionAbort.signal,
+        // Hand the live child up so cancel/shutdown can actually kill it.
+        // This was never wired: activeSession.child stayed null forever, so
+        // every cancel reported "stopped" while Claude kept writing to the repo.
+        onChild: (child) => {
+          if (activeSession?.sessionId === sessionId) activeSession.child = child;
+        },
         onEvent: (() => {
           // Stagger agent messages for real-time feel, flush on non-message events
           const MSG_STAGGER_MS = 400;
@@ -450,6 +501,9 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
 
           return (event) => {
             if (!activeSession || activeSession.sessionId !== sessionId) return;
+            // A cancelled session already sent its terminal event; the
+            // orchestrator's own unwind must not send a second one.
+            if (activeSession.cancelled) return;
 
             if (event.type === "agent:message") {
               msgQueue.push(event);
@@ -474,12 +528,21 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
         })(),
       });
 
-      console.log(`  ${green}Session complete${reset} ${dim}${sessionId}${reset} (${result.duration}, ${result.steps} steps)`);
+      const outcome = result.status || (result.handoff ? "handoff" : "complete");
+      const clean = outcome === "complete";
+      console.log(
+        `  ${clean ? green : yellow}Session ${outcome}${reset} ${dim}${sessionId}${reset} (${result.duration}, ${result.steps} steps)`
+      );
 
       logSessionMetadata(sessionId, {
         sessionId, projectId,
         startedAt, endedAt: Date.now(),
-        duration: result.duration, exitCode: 0, steps: result.steps,
+        duration: result.duration,
+        // Was hardcoded to 0, so the metadata log claimed every session
+        // exited cleanly regardless of what actually happened.
+        exitCode: clean ? 0 : 1,
+        status: outcome,
+        steps: result.steps,
         filePathsTouched: [...filePathsTouched],
       });
 
@@ -493,24 +556,43 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
     }
   }
 
-  function killChild(child) {
-    if (!child) return;
-    try { child.kill("SIGTERM"); } catch {}
-    // Force kill if SIGTERM doesn't work within 5 seconds
-    setTimeout(() => {
-      try { if (!child.killed) child.kill("SIGKILL"); } catch {}
-    }, 5000);
+  // Tear down a session's work: signal the orchestrator loop to stop enqueuing
+  // phases, then kill the running child's whole process group. Both halves are
+  // required — killing the child alone just makes the loop start the next phase.
+  function stopSessionWork(session) {
+    if (!session) return;
+    try { session.abort?.abort(); } catch {}
+    killTree(session.child);
   }
 
   function handleCancelSession({ sessionId }) {
     if (activeSession?.sessionId === sessionId) {
       console.log(`  ${yellow}Cancelling session${reset} ${dim}${sessionId}${reset}`);
       const duration = `${((Date.now() - activeSession.startedAt) / 1000).toFixed(1)}s`;
-      killChild(activeSession.child);
-      // Clear active session BEFORE sending session:end — this prevents
-      // the orchestrator's onEvent callback from sending a duplicate
-      activeSession = null;
+
+      // Mark rather than clear. Nulling activeSession here would free the
+      // concurrency slot immediately — while the child is still inside its
+      // SIGTERM grace period — letting a second session start against the same
+      // working tree. The slot is released where it always was: after the
+      // orchestrator await unwinds, which cancellation now guarantees.
+      activeSession.cancelled = true;
+      stopSessionWork(activeSession);
+
+      // The `cancelled` flag also suppresses the orchestrator's own
+      // session:end, so this stays the single terminal event for the session.
       sendBuffered(sessionId, { type: "session:end", duration, steps: 0, inputTokens: 0, outputTokens: 0, status: "stopped" });
+
+      // Safety valve: if the child somehow never dies, don't wedge the daemon
+      // into rejecting every future session.
+      const wedged = activeSession;
+      const timer = setTimeout(() => {
+        if (activeSession === wedged) {
+          console.log(`  ${red}Cancelled session did not exit — releasing slot${reset}`);
+          killTree(wedged.child, { graceMs: 0 });
+          activeSession = null;
+        }
+      }, 30000);
+      timer.unref?.();
     }
   }
 
@@ -522,7 +604,7 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
     clearTimeout(reconnectTimer);
 
     if (activeSession) {
-      killChild(activeSession.child);
+      stopSessionWork(activeSession);
     }
 
     send({ type: "daemon:disconnect" });

package/cli/dotenv.mjs

@@ -1,22 +1,105 @@
-// Minimal .env reader used by orchestrator + preflight. Does not interpret
-// quotes or escapes — matches the pre-existing behavior of the duplicated
-// loaders in cli/team.mjs, cli/init.mjs, and cli/daemon.mjs (which we are
-// NOT consolidating in this PR — out of scope).
+// The one .env reader/writer for the CLI.
+//
+// There used to be five copies of the loader (here, setup-helpers, bootstrap,
+// daemon, team) and two of the writer. None stripped quotes, so a perfectly
+// conventional line like
+//
+//     GITHUB_TOKEN="ghp_abc123"
+//
+// produced a token with literal quote characters in it and a baffling 401 from
+// GitHub. A fix had to be applied five times to land. Every caller now imports
+// from here.
+//
+// Deliberately minimal: quotes are stripped, `export KEY=…` is tolerated,
+// comments and blanks are skipped. Escape sequences and `${VAR}` interpolation
+// are NOT interpreted — a token is an opaque string and must round-trip as-is.
 
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, chmodSync } from "fs";
 import { join } from "path";
 
+export function parseDotEnv(text) {
+  const vars = {};
+  for (const rawLine of String(text ?? "").split(/\r?\n/)) {
+    let line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    if (line.startsWith("export ")) line = line.slice(7).trim();
+
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+
+    const key = line.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+
+    let value = line.slice(eq + 1).trim();
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.length >= 2 && value.endsWith(quote)) {
+      value = value.slice(1, -1);
+    }
+    vars[key] = value;
+  }
+  return vars;
+}
+
 export function loadDotEnv(dir) {
   if (!dir) return {};
   const envPath = join(dir, ".env");
   if (!existsSync(envPath)) return {};
-  const vars = {};
-  for (const line of readFileSync(envPath, "utf-8").split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq === -1) continue;
-    vars[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
+  try {
+    return parseDotEnv(readFileSync(envPath, "utf-8"));
+  } catch {
+    return {};
   }
-  return vars;
+}
+
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// Upsert KEY=value in <dir>/.env, preserving every other line verbatim.
+//
+// The file ends up mode 0600 whether it was just created or already existed —
+// `writeFileSync`'s `mode` option only applies on creation, so an existing
+// world-readable .env would otherwise stay world-readable after we drop a
+// GitHub token into it.
+export function saveEnvVar(dir, key, value) {
+  const envPath = join(dir, ".env");
+  let content = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
+  const re = new RegExp(`^(?:export\\s+)?${escapeRegex(key)}=.*$`, "m");
+  const entry = `${key}=${value}`;
+  if (re.test(content)) {
+    content = content.replace(re, entry);
+  } else {
+    content += `${content && !content.endsWith("\n") ? "\n" : ""}${entry}\n`;
+  }
+  writeFileSync(envPath, content, { mode: 0o600 });
+  try { chmodSync(envPath, 0o600); } catch {}
+  return envPath;
+}
+
+// Make sure each of `entries` is listed in <dir>/.gitignore. Returns the
+// entries that had to be added (empty when everything was already covered).
+//
+// Matching is deliberately loose about the forms people actually write —
+// `.env`, `/.env`, `.agentdesk`, `.agentdesk/` — and deliberately NOT clever
+// about globs: `.env*` is not treated as covering `.env`, because a rule we
+// can't reason about is a rule we shouldn't rely on for a credential file.
+export function ensureGitignored(dir, entries) {
+  const path = join(dir, ".gitignore");
+  const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
+  const present = new Set(
+    existing.split(/\r?\n/).map(l => l.trim().replace(/^\//, "").replace(/\/$/, "")).filter(Boolean)
+  );
+
+  const added = [];
+  for (const entry of entries) {
+    const norm = entry.replace(/^\//, "").replace(/\/$/, "");
+    if (present.has(norm)) continue;
+    added.push(entry);
+    present.add(norm);
+  }
+  if (added.length === 0) return added;
+
+  const nl = existing && !existing.endsWith("\n") ? "\n" : "";
+  writeFileSync(path, `${existing}${nl}${added.join("\n")}\n`);
+  return added;
 }