@loicngr/kobo 1.11.9 → 1.11.11

package/dist/server/services/forge/gitlab/provider.js

@@ -3,6 +3,10 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { deriveReadyToMerge } from '../types.js';
 const execFileAsync = promisify(execFile);
+const CLI_TIMEOUT_MS = 30_000;
+function cliOptions(repoPath) {
+    return { cwd: repoPath, encoding: 'utf-8', timeout: CLI_TIMEOUT_MS };
+}
 /** Map GitLab MR state to the normalised PrSnapshot state. */
 function mapState(state) {
     if (state === 'merged')
@@ -100,10 +104,7 @@ function mapGlabJobToCheck(job) {
  */
 async function fetchGlabCi(repoPath, branch) {
     try {
-        const { stdout } = await execFileAsync('glab', ['ci', 'get', '-b', branch, '-F', 'json'], {
-            cwd: repoPath,
-            encoding: 'utf-8',
-        });
+        const { stdout } = await execFileAsync('glab', ['ci', 'get', '-b', branch, '-F', 'json'], cliOptions(repoPath));
         const raw = stdout.trim();
         if (!raw)
             return { rollup: null, checks: [] };
@@ -138,7 +139,7 @@ export const gitlabProvider = {
     },
     async isAvailable(repoPath) {
         try {
-            await execFileAsync('glab', ['auth', 'status'], { cwd: repoPath, encoding: 'utf-8' });
+            await execFileAsync('glab', ['auth', 'status'], cliOptions(repoPath));
             return { available: true };
         }
         catch (err) {
@@ -147,10 +148,7 @@ export const gitlabProvider = {
     },
     async getPrStatus(repoPath, branch) {
         try {
-            const { stdout } = await execFileAsync('glab', ['mr', 'view', branch, '--output', 'json'], {
-                cwd: repoPath,
-                encoding: 'utf-8',
-            });
+            const { stdout } = await execFileAsync('glab', ['mr', 'view', branch, '--output', 'json'], cliOptions(repoPath));
             const raw = stdout.trim();
             if (!raw)
                 return null;
@@ -176,19 +174,19 @@ export const gitlabProvider = {
             '--description',
             opts.body,
             '--yes',
-        ], { cwd: repoPath, encoding: 'utf-8' });
+        ], cliOptions(repoPath));
         const match = stdout.match(/https?:\/\/[^\s]+\/-\/merge_requests\/(\d+)/);
         if (!match)
             throw new Error('Could not parse MR URL from glab output');
         return { url: match[0], number: Number.parseInt(match[1], 10) };
     },
     async changePrBase(repoPath, base) {
-        await execFileAsync('glab', ['mr', 'update', '--target-branch', base], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('glab', ['mr', 'update', '--target-branch', base], cliOptions(repoPath));
     },
     async mergeRequest(repoPath, number) {
-        await execFileAsync('glab', ['mr', 'merge', String(number), '--yes'], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('glab', ['mr', 'merge', String(number), '--yes'], cliOptions(repoPath));
     },
     async deleteRemoteBranch(repoPath, branch) {
-        await execFileAsync('git', ['push', 'origin', '--delete', branch], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('git', ['push', 'origin', '--delete', branch], cliOptions(repoPath));
     },
 };

package/dist/server/services/git-stats-service.js

@@ -10,13 +10,15 @@ import { resolveForge } from './forge/resolve.js';
  */
 export async function computeGitStats(workspace, prSnapshot) {
     const { worktreePath, sourceBranch, workingBranch, projectPath } = workspace;
-    const commitCount = gitOps.getCommitCount(worktreePath, sourceBranch, workingBranch);
-    const behindCount = gitOps.getCommitsBehind(worktreePath, sourceBranch, workingBranch);
-    const diffStats = gitOps.getStructuredDiffStatsBetween(worktreePath, sourceBranch, workingBranch);
-    const unpushedCount = await gitOps.getUnpushedCountAsync(worktreePath, workingBranch);
-    const workingTree = gitOps.getWorkingTreeStatus(worktreePath);
     const forgeProvider = getForgeProvider(resolveForge(projectPath));
-    const availability = await forgeProvider.isAvailable(worktreePath);
+    const [commitCount, behindCount, diffStats, unpushedCount, workingTree, availability] = await Promise.all([
+        gitOps.getCommitCountAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getCommitsBehindAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getStructuredDiffStatsBetweenAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getUnpushedCountAsync(worktreePath, workingBranch),
+        gitOps.getWorkingTreeStatusAsync(worktreePath),
+        forgeProvider.isAvailable(worktreePath),
+    ]);
     return {
         commitCount,
         behindCount,

package/dist/server/services/image-service.js

@@ -6,6 +6,29 @@ const IMAGES_DIR = '.ai/images';
 const INDEX_FILE = 'index.json';
 // Per-worktree lock to serialize index.json writes
 const locks = new Map();
+function ensureRealImagesDirectory(worktreePath) {
+    const realWorktree = fs.realpathSync(worktreePath);
+    let current = worktreePath;
+    for (const segment of ['.ai', 'images']) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current)) {
+            const stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink())
+                throw new Error(`Symbolic links are not allowed in image storage: ${current}`);
+            if (!stat.isDirectory())
+                throw new Error(`Image storage path is not a directory: ${current}`);
+        }
+        else {
+            fs.mkdirSync(current);
+        }
+        const realCurrent = fs.realpathSync(current);
+        const relative = path.relative(realWorktree, realCurrent);
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            throw new Error('Image storage path escapes the worktree');
+        }
+    }
+    return fs.realpathSync(current);
+}
 function withLock(worktreePath, fn) {
     const prev = locks.get(worktreePath) ?? Promise.resolve();
     // The second argument to .then() means: even if the previous operation in the
@@ -18,6 +41,8 @@ function readIndex(imagesDir) {
     const indexPath = path.join(imagesDir, INDEX_FILE);
     if (!fs.existsSync(indexPath))
         return [];
+    if (fs.lstatSync(indexPath).isSymbolicLink())
+        throw new Error('Symbolic links are not allowed for image index');
     try {
         return JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
     }
@@ -27,7 +52,13 @@ function readIndex(imagesDir) {
     }
 }
 function writeIndex(imagesDir, entries) {
-    fs.writeFileSync(path.join(imagesDir, INDEX_FILE), JSON.stringify(entries, null, 2));
+    const indexPath = path.join(imagesDir, INDEX_FILE);
+    if (fs.existsSync(indexPath) && fs.lstatSync(indexPath).isSymbolicLink()) {
+        throw new Error('Symbolic links are not allowed for image index');
+    }
+    const tempPath = path.join(imagesDir, `.index-${process.pid}.tmp`);
+    fs.writeFileSync(tempPath, JSON.stringify(entries, null, 2));
+    fs.renameSync(tempPath, indexPath);
 }
 /** Save an image buffer to `.ai/images/` and update the index. Returns the UID and relative path. */
 export async function saveImage(worktreePath, fileBuffer, originalName) {
@@ -39,9 +70,7 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
         throw new Error(`Unsupported image extension: '${ext}'. Allowed: ${[...ALLOWED_EXTENSIONS].join(', ')}`);
     }
     const uid = nanoid(10);
-    const imagesDir = path.join(worktreePath, IMAGES_DIR);
-    // mkdirSync is idempotent — safe to call outside the lock
-    fs.mkdirSync(imagesDir, { recursive: true });
+    const imagesDir = ensureRealImagesDirectory(worktreePath);
     const filename = `${uid}.${ext}`;
     await withLock(worktreePath, () => {
         // Write the image file inside the lock so both the file write and index
@@ -55,7 +84,7 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
 }
 /** Delete an image by UID from disk and the index. */
 export async function deleteImage(worktreePath, uid) {
-    const imagesDir = path.join(worktreePath, IMAGES_DIR);
+    const imagesDir = ensureRealImagesDirectory(worktreePath);
     await withLock(worktreePath, () => {
         const entries = readIndex(imagesDir);
         const idx = entries.findIndex((e) => e.uid === uid);

package/dist/server/services/pr-watcher-service.js

@@ -18,8 +18,19 @@ import { purgeWorktree } from './worktree-purge-service.js';
 // it is recorded but NOT acted upon — prevents re-archiving manually
 // unarchived workspaces.
 const POLL_INTERVAL_MS = 30 * 1000; // 30 seconds
+const WORKSPACE_CHECK_CONCURRENCY = 4;
 let timer = null;
 let checking = false;
+async function runBounded(items, concurrency, worker) {
+    let nextIndex = 0;
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+        while (nextIndex < items.length) {
+            const item = items[nextIndex++];
+            await worker(item);
+        }
+    });
+    await Promise.all(workers);
+}
 /** Tracks the last known PR snapshot per workspace, used to detect transitions
  *  (state, base, reviewDecision). */
 const lastKnownPr = new Map();
@@ -110,11 +121,11 @@ export async function checkPrStatuses() {
             lastKnownGitStats.delete(id);
         }
     }
-    for (const ws of workspaces) {
+    await runBounded(workspaces, WORKSPACE_CHECK_CONCURRENCY, async (ws) => {
         // Without this guard, every git/forge spawn below fails with ENOENT and
         // floods the logs when a worktree was deleted externally.
         if (!fs.existsSync(ws.worktreePath))
-            continue;
+            return;
         try {
             // Opt-out: skip the forge call entirely for a workspace with PR-watch
             // disabled — no PR-status fetch, no auto-archive/purge, no PR-derived
@@ -143,7 +154,7 @@ export async function checkPrStatuses() {
                         console.error(`[pr-watcher] updateWorkspaceSourceBranch failed for '${ws.name}':`, err instanceof Error ? err.message : err);
                         // Leave the cache untouched so the next tick retries — and skip
                         // stats too, since they'd be computed against the stale base.
-                        continue;
+                        return;
                     }
                 }
             }
@@ -158,7 +169,7 @@ export async function checkPrStatuses() {
                 console.error(`[pr-watcher] computeGitStats failed for '${ws.name}':`, err instanceof Error ? err.message : err);
             }
             if (!pr)
-                continue;
+                return;
             const prev = lastKnownPr.get(ws.id);
             // We delay updating `lastKnownPr` until after the actions succeed.
             // Setting it eagerly would poison the cache: if updateWorkspaceSourceBranch
@@ -179,13 +190,13 @@ export async function checkPrStatuses() {
                     // (The defensive base preservation from the no-base branch doesn't apply here
                     // because we ARE in the OPEN→MERGED/CLOSED branch which always has a base.)
                     lastKnownPr.set(ws.id, pr);
-                    continue;
+                    return;
                 }
                 console.log(`[pr-watcher] PR ${pr.state.toLowerCase()} for workspace '${ws.name}' — archiving`);
                 // Best-effort cleanup (same as manual archive): stop dev server + terminal.
                 // Agent is already not running here (guarded above).
                 try {
-                    stopDevServer(ws.id);
+                    await stopDevServer(ws.id);
                 }
                 catch (err) {
                     console.error(`[pr-watcher] stopDevServer failed for '${ws.name}':`, err instanceof Error ? err.message : err);
@@ -217,7 +228,7 @@ export async function checkPrStatuses() {
                         console.error(`[pr-watcher] auto-purge guard failed for '${ws.name}':`, err instanceof Error ? err.message : err);
                     }
                 }
-                continue; // do not run base-change detection on a workspace we just archived
+                return; // do not run base-change detection on a workspace we just archived
             }
             // Review, CI, mergeability, and readiness transitions (only on OPEN PRs;
             // first-sight is silent). Each check is independent so simultaneous
@@ -254,7 +265,7 @@ export async function checkPrStatuses() {
             if (pr.state !== 'OPEN' || !pr.base) {
                 const next = pr.base ? pr : { ...pr, base: prev?.base ?? pr.base };
                 lastKnownPr.set(ws.id, next);
-                continue;
+                return;
             }
             lastKnownPr.set(ws.id, pr);
             // Emit the base-change event AFTER the snapshot is committed so a
@@ -272,7 +283,7 @@ export async function checkPrStatuses() {
         catch (err) {
             console.error(`[pr-watcher] Failed to check PR for workspace '${ws.name}':`, err instanceof Error ? err.message : err);
         }
-    }
+    });
 }
 /**
  * On-demand refresh of a single workspace's PR snapshot. Bypasses the 30s tick.

package/dist/server/services/search-service.js

@@ -1,6 +1,6 @@
 import { getDb } from '../db/index.js';
 /** Event types that carry user-authored or assistant-authored readable text. */
-const SEARCHABLE_TYPES = ['user:message', 'agent:output'];
+const SEARCHABLE_TYPES = ['user:message', 'agent:event', 'agent:output'];
 const SNIPPET_CONTEXT = 100; // chars on each side of the match
 /**
  * Extract the readable text content of a ws_events payload, or `null` when
@@ -29,6 +29,9 @@ function extractReadableText(type, payload) {
             return parts.length > 0 ? parts.join('\n') : null;
         }
     }
+    if (type === 'agent:event' && p.kind === 'message:text') {
+        return typeof p.text === 'string' ? p.text : null;
+    }
     return null;
 }
 function buildSnippet(text, matchIndex, query) {
@@ -56,49 +59,59 @@ export function searchEvents(query, options = {}) {
     const db = getDb();
     const typePlaceholders = SEARCHABLE_TYPES.map(() => '?').join(', ');
     const archiveFilter = includeArchived ? '' : 'AND w.archived_at IS NULL';
-    const likePattern = `%${trimmed}%`;
-    // Over-fetch a bit so post-filter rejects don't shrink us below `limit` on
-    // realistic datasets, without scanning the entire table.
-    const dbLimit = Math.max(limit * 3, 100);
-    const rows = db
-        .prepare(`SELECT e.id, e.workspace_id, e.session_id, e.type, e.created_at, e.payload,
-              w.name AS workspace_name, w.archived_at
-       FROM ws_events e
-       JOIN workspaces w ON e.workspace_id = w.id
-       WHERE e.type IN (${typePlaceholders})
-         AND e.payload LIKE ?
-         ${archiveFilter}
-       ORDER BY e.created_at DESC
-       LIMIT ?`)
-        .all(...SEARCHABLE_TYPES, likePattern, dbLimit);
+    const escapedQuery = trimmed.replace(/[\\%_]/g, '\\$&');
+    const likePattern = `%${escapedQuery}%`;
     const needle = trimmed.toLowerCase();
     const results = [];
-    for (const row of rows) {
-        let parsed;
-        try {
-            parsed = JSON.parse(row.payload);
-        }
-        catch {
-            continue;
+    const batchSize = Math.min(Math.max(limit * 3, 100), 500);
+    const statement = db.prepare(`SELECT e.id, e.workspace_id, e.session_id, e.type, e.created_at, e.payload,
+            w.name AS workspace_name, w.archived_at
+     FROM ws_events e
+     JOIN workspaces w ON e.workspace_id = w.id
+     WHERE e.type IN (${typePlaceholders})
+       AND e.payload LIKE ? ESCAPE '\\'
+       ${archiveFilter}
+       AND (? IS NULL OR e.created_at < ? OR (e.created_at = ? AND e.id < ?))
+     ORDER BY e.created_at DESC, e.id DESC
+     LIMIT ?`);
+    let cursorCreatedAt = null;
+    let cursorId = null;
+    while (results.length < limit) {
+        const rows = statement.all(...SEARCHABLE_TYPES, likePattern, cursorCreatedAt, cursorCreatedAt, cursorCreatedAt, cursorId, batchSize);
+        for (const row of rows) {
+            let parsed;
+            try {
+                parsed = JSON.parse(row.payload);
+            }
+            catch {
+                continue;
+            }
+            const text = extractReadableText(row.type, parsed);
+            if (!text)
+                continue;
+            const idx = text.toLowerCase().indexOf(needle);
+            if (idx < 0)
+                continue;
+            results.push({
+                eventId: row.id,
+                sessionId: row.session_id,
+                workspaceId: row.workspace_id,
+                workspaceName: row.workspace_name,
+                archived: row.archived_at !== null,
+                type: row.type,
+                timestamp: row.created_at,
+                snippet: buildSnippet(text, idx, trimmed),
+            });
+            if (results.length >= limit)
+                break;
         }
-        const text = extractReadableText(row.type, parsed);
-        if (!text)
-            continue;
-        const idx = text.toLowerCase().indexOf(needle);
-        if (idx < 0)
-            continue;
-        results.push({
-            eventId: row.id,
-            sessionId: row.session_id,
-            workspaceId: row.workspace_id,
-            workspaceName: row.workspace_name,
-            archived: row.archived_at !== null,
-            type: row.type,
-            timestamp: row.created_at,
-            snippet: buildSnippet(text, idx, trimmed),
-        });
-        if (results.length >= limit)
+        if (rows.length < batchSize)
+            break;
+        const last = rows.at(-1);
+        if (!last)
             break;
+        cursorCreatedAt = last.created_at;
+        cursorId = last.id;
     }
     return results;
 }

package/dist/server/services/skill-suite-prompts.js

@@ -1,4 +1,4 @@
-import { AGNOSTIC_AUTO_LOOP_GROOMING_INTRO, AGNOSTIC_AUTO_LOOP_REVIEW_GATE, AGNOSTIC_BRAINSTORMING_INSTRUCTION, AGNOSTIC_QA_PROMPT_TEMPLATE, AGNOSTIC_REVIEW_TEMPLATE, GROOMING_INTRO_COMBINED, GROOMING_INTRO_GSTACK, GROOMING_INTRO_SUPERPOWERS, } from '../../shared/skill-suite-prompts.js';
+import { AGNOSTIC_AUTO_LOOP_GROOMING_INTRO, AGNOSTIC_AUTO_LOOP_REVIEW_GATE, AGNOSTIC_BRAINSTORMING_INSTRUCTION, AGNOSTIC_QA_PROMPT_TEMPLATE, AGNOSTIC_REVIEW_TEMPLATE, GROOMING_INTRO_ALL, GROOMING_INTRO_COMBINED, GROOMING_INTRO_ECC, GROOMING_INTRO_GSTACK, GROOMING_INTRO_SUPERPOWERS, } from '../../shared/skill-suite-prompts.js';
 // Headers and body shared with the agnostic baseline. We reconstruct them
 // locally here so the suite-specific text can sit between header and body
 // in the same shape across all 3 suites.
@@ -73,6 +73,19 @@ For reproducible regression coverage that runs on every PR, prefer **Cypress** s
         '3. If you need fine control (e.g. skip a step, run one in isolation), invoke the individual skills instead: `/plan-ceo-review`, `/plan-eng-review`, `/plan-design-review`, `/plan-devex-review`.\n' +
         '4. Wait for explicit user approval on the final plan before announcing brainstorming is done.',
 };
+export const ECC_PROMPTS = {
+    reviewTemplate: REVIEW_HEADER +
+        'If a code-review skill is available (e.g. `ecc:code-review`, or dispatch a subagent via the Task tool with `subagent_type: "ecc:code-reviewer"`), invoke it to drive this review. Otherwise follow the steps below directly.\n\n' +
+        REVIEW_BODY,
+    autoLoopReviewGate: 'Code review gate — BEFORE marking the task done, dispatch an independent code-reviewer subagent via the Task tool with `subagent_type: "ecc:code-reviewer"` (or run the `ecc:code-review` / `ecc:quality-gate` skill if you prefer a driven workflow over a bare subagent). Brief the reviewer with: what you just implemented, the task title, and the commit SHA (via `git rev-parse HEAD`). Ask specifically whether the change matches the task scope, whether edge cases are handled, and whether the commit is clean.',
+    autoLoopGroomingIntro: GROOMING_INTRO_ECC,
+    qaPromptTemplate: 'QA pass for workspace "{{workspace_name}}" in project {{project_name}}.\n\nBranch: {{branch_name}}\nStaging URL: {{staging_url}}\n\nIf a QA-style skill is available in this environment (e.g. `ecc:browser-qa`, or dispatch a subagent via the Task tool with `subagent_type: "ecc:e2e-runner"`), use it to exercise the staging URL. Otherwise, fall back to manually scripting the smoke checks and recording your findings as a bug report.',
+    brainstormingInstruction: 'Brainstorm the implementation approach using the ECC pipeline:\n' +
+        '1. Run the `ecc:plan` skill (or dispatch a subagent via the Task tool with `subagent_type: "ecc:planner"`) — it expands the request into a full spec with features, sprints, and evaluation criteria before any code. Ask clarifying questions and wait for explicit user approval on the design before moving on.\n' +
+        '2. Use `ecc:tdd-workflow` to shape the approved design into a test-first implementation plan.\n' +
+        '3. If you encounter a bug or unexpected behaviour during exploration, dispatch a subagent via the Task tool with `subagent_type: "ecc:architect"` (or the relevant language-specific `ecc:*-reviewer` agent) rather than guessing.\n' +
+        "Do NOT skip the skills or rationalise around them — that's how the rigour gets lost.",
+};
 export const AGNOSTIC_PROMPTS = {
     reviewTemplate: AGNOSTIC_REVIEW_TEMPLATE,
     autoLoopReviewGate: AGNOSTIC_AUTO_LOOP_REVIEW_GATE,
@@ -132,6 +145,60 @@ For reproducible regression coverage that runs on every PR, prefer **Cypress** s
         '   - Apply any changes the reviews recommend before moving on.\n' +
         '5. Wait for explicit user approval on the final reviewed plan before announcing brainstorming is done.',
 };
+// ── Triple combo: superpowers + gstack + ecc ─────────────────────────────────
+// For users who install all three suites. Extends the two-suite COMBINED_PROMPTS
+// "pick by intent" pattern with a third branch per field.
+export const ALL_THREE_PROMPTS = {
+    reviewTemplate: REVIEW_HEADER +
+        'Three complementary review paths are available — pick by intent:\n' +
+        '- `/review` (gstack Staff Engineer) for tactical bug-hunting that finds issues passing CI but blowing up in production. Auto-fixes the obvious ones.\n' +
+        '- `superpowers:requesting-code-review` for principles-level critique — silent failures, test-design soundness, surface-area discipline.\n' +
+        "- `ecc:code-review` (or a Task-dispatched `ecc:code-reviewer` subagent) for ECC's structured multi-agent review pass.\n" +
+        'You can run more than one on the same diff if the change is large. If none is available, fall back to the manual checklist below.\n\n' +
+        REVIEW_BODY,
+    autoLoopReviewGate: 'Code review gate — BEFORE marking the task done, pick the appropriate review path (three are installed):\n' +
+        '- Default to `/review` (gstack Staff Engineer) for tactical code-level bugs and auto-fixes.\n' +
+        '- Use `superpowers:requesting-code-review` instead when the task introduces tests, refactors, or design decisions worth a principles-level critique.\n' +
+        "- Use a Task-dispatched `ecc:code-reviewer` subagent (or the `ecc:quality-gate` skill) when you want ECC's structured multi-agent pass.\n\n" +
+        'Brief the chosen reviewer with: what you just implemented, the task title, and the commit SHA (via `git rev-parse HEAD`). Ask specifically whether the change matches the task scope, whether edge cases are handled, and whether the commit is clean. If the reviewer auto-fixes minor issues, accept the fixes via an amend or fix-up commit, then re-run step 3 checks.',
+    autoLoopGroomingIntro: GROOMING_INTRO_ALL,
+    qaPromptTemplate: `QA pass for workspace "{{workspace_name}}" in project {{project_name}}.
+
+Branch: {{branch_name}}
+Staging URL: {{staging_url}}
+
+Pick the right tool for the situation. gstack covers interactive QA, ECC covers structured/automated QA, superpowers covers low-level browser control as a fallback.
+
+gstack QA toolkit (preferred for interactive QA):
+- \`/browse\` — Headless navigation: URL → interactions → screenshots. Use for quick dogfooding a flow or sanity-checking a PR.
+- \`/qa {{staging_url}}\` — Systematic QA with automatic bug fixing. Three tiers (invoke as \`/qa Quick\`, \`/qa Standard\`, or \`/qa Exhaustive\`):
+  - **Quick** — critical and high-severity bugs only.
+  - **Standard** — adds medium-severity bugs.
+  - **Exhaustive** — adds cosmetic issues.
+- \`/qa-only {{staging_url}}\` — Same methodology as \`/qa\` but report only, no code changes.
+- \`/design-review\` — Visual audit (consistency, spacing, hierarchy, AI slop). Commits atomic fixes with before/after screenshots.
+
+ECC toolkit:
+- \`ecc:browser-qa\` skill — structured browser-driven QA pass.
+- Task-dispatched \`ecc:e2e-runner\` subagent — generates, maintains, and runs E2E tests; manages flaky-test quarantine and artifact capture.
+
+Superpowers alternative (low-level browser control):
+- \`superpowers-chrome:browsing\` — Direct Chrome DevTools Protocol control over an existing Chrome session: multi-tab management, form automation, content extraction. Use when you need fine-grained control beyond what \`/browse\` exposes.
+
+For reproducible regression coverage that runs on every PR, prefer **Cypress** specs in \`test/cypress/\` instead of any interactive QA skill. Reserve the tools above for exploration, dogfooding, and one-shot visual debugging.`,
+    brainstormingInstruction: 'Brainstorm using all three suites — each plays to its strength:\n' +
+        '1. Early product framing: prefer gstack `/office-hours` for product-shaped work (six forcing questions + design doc), or `ecc:plan` (or `subagent_type: "ecc:planner"`) for ECC-style spec expansion (features, sprints, evaluation criteria). Fall back to `superpowers:brainstorming` for purely infra/refactor work where neither product lens applies.\n' +
+        '2. Plan construction — pick whichever fits the work better:\n' +
+        '   - gstack `/autoplan` for the chained CEO/design/eng/DX pipeline (auto-detects which apply).\n' +
+        '   - `superpowers:writing-plans` for a TDD-shaped multi-step plan that maps cleanly onto subagent dispatch.\n' +
+        '   - `ecc:tdd-workflow` when the project follows ECC conventions and you want its test-first shaping.\n' +
+        '3. For debugging during exploration, prefer `/investigate` (gstack — root-cause methodology), `superpowers:systematic-debugging`, or a Task-dispatched `ecc:architect` subagent — whichever you reach for first.\n' +
+        '4. Plan review gate (MANDATORY before announcing brainstorming is done): once the plan is ready, it MUST pass the gstack plan-review skills before you proceed.\n' +
+        '   - If you built the plan via `/autoplan`, you have ALREADY passed the chained reviews — skip this step.\n' +
+        '   - Otherwise (plan came from `superpowers:writing-plans`, `ecc:tdd-workflow`, or any other path), run `/autoplan` now on the existing plan to chain the reviews, OR invoke the relevant ones individually: `/plan-ceo-review` (scope challenge), `/plan-eng-review` (architecture / edge cases / tests), `/plan-design-review` (UI / AI slop, when there is UI scope), `/plan-devex-review` (when the work has developer-facing surface).\n' +
+        '   - Apply any changes the reviews recommend before moving on.\n' +
+        '5. Wait for explicit user approval on the final reviewed plan before announcing brainstorming is done.',
+};
 /**
  * Resolve the suite prompts to use right now, given the global `skillSuite`
  * and the four user-editable `custom*` fields (only consulted in `custom` mode).
@@ -142,8 +209,12 @@ export function getSuitePrompts(suite, overrides) {
         return SUPERPOWERS_PROMPTS;
     if (suite === 'gstack')
         return GSTACK_PROMPTS;
+    if (suite === 'ecc')
+        return ECC_PROMPTS;
     if (suite === 'superpowers+gstack')
         return COMBINED_PROMPTS;
+    if (suite === 'superpowers+gstack+ecc')
+        return ALL_THREE_PROMPTS;
     // custom mode: per-field fallback to AGNOSTIC when the override is missing/blank
     const pick = (k) => {
         const value = overrides[k];

package/dist/server/services/websocket-service.js

@@ -109,16 +109,18 @@ export function handleConnection(ws) {
 export function emit(workspaceId, type, payload, sessionId) {
     const id = nanoid();
     const createdAt = new Date().toISOString();
+    let replayable = false;
     // Best-effort persist — don't let FK violation (deleted workspace) break the broadcast
     try {
         const db = getDb();
         db.prepare('INSERT INTO ws_events (id, workspace_id, type, payload, session_id, created_at) VALUES (?, ?, ?, ?, ?, ?)').run(id, workspaceId, type, JSON.stringify(payload), sessionId ?? null, createdAt);
+        replayable = true;
     }
     catch (err) {
         console.error(`[websocket-service] Failed to persist event (workspace=${workspaceId}, type=${type}):`, err);
     }
     // Build the event object to send
-    const event = { id, workspaceId, type, payload, sessionId, createdAt };
+    const event = { id, workspaceId, type, payload, sessionId, createdAt, replayable };
     const message = JSON.stringify(event);
     // Broadcast to subscribed clients. Wrap `.send` in try/catch so a dropped
     // client doesn't throw and abort delivery to the remaining subscribers.
@@ -145,7 +147,7 @@ export function emit(workspaceId, type, payload, sessionId) {
 export function emitEphemeral(workspaceId, type, payload) {
     const id = nanoid();
     const createdAt = new Date().toISOString();
-    const event = { id, workspaceId, type, payload, createdAt };
+    const event = { id, workspaceId, type, payload, createdAt, replayable: false };
     const message = JSON.stringify(event);
     let sendErrorLogged = false;
     for (const [ws, subs] of clients) {
@@ -188,12 +190,14 @@ export function handleSyncRequest(ws, lastEventId, workspaceIds) {
     // up. This keeps first-paint fast on long-lived workspaces with tens of
     // thousands of events without ever deleting anything from the DB.
     const INITIAL_WINDOW = 300;
+    let mode = 'snapshot';
     if (lastEventId) {
         // Resume path: replay every event strictly after the cursor (delta
         // since last seen). If the cursor is stale/unknown, fall back to the
         // recent window rather than streaming the entire history.
         const lastRow = db.prepare('SELECT rowid FROM ws_events WHERE id = ?').get(lastEventId);
         if (lastRow) {
+            mode = 'delta';
             rows = db
                 .prepare(`SELECT * FROM ws_events WHERE workspace_id IN (${placeholders}) AND rowid > ? ORDER BY rowid ASC`)
                 .all(...resolvedIds, lastRow.rowid);
@@ -232,9 +236,10 @@ export function handleSyncRequest(ws, lastEventId, workspaceIds) {
             payload: parsedPayload,
             sessionId: row.session_id ?? undefined,
             createdAt: row.created_at,
+            replayable: true,
         };
     });
-    ws.send(JSON.stringify({ type: 'sync:response', payload: { events } }));
+    ws.send(JSON.stringify({ type: 'sync:response', payload: { events, mode } }));
 }
 // ── Utilities ──────────────────────────────────────────────────────────────────
 /**

package/dist/server/services/workspace-service.js

@@ -165,20 +165,29 @@ export function updateWorkspaceStatus(id, status) {
     return getWorkspace(id);
 }
 const WORKSPACE_NAME_MAX_LENGTH = 200;
-/** Update a workspace's display name. */
-export function updateWorkspaceName(id, name) {
-    // Strip control characters (incl. newlines) and collapse whitespace
+function sanitizeWorkspaceName(name) {
     const noControl = Array.from(name, (c) => {
         const code = c.charCodeAt(0);
         return code < 32 || code === 127 ? ' ' : c;
     }).join('');
     const sanitized = noControl.replace(/\s+/g, ' ').trim();
-    if (!sanitized) {
+    if (!sanitized)
         throw new Error('Workspace name cannot be empty');
-    }
     if (sanitized.length > WORKSPACE_NAME_MAX_LENGTH) {
         throw new Error(`Workspace name cannot exceed ${WORKSPACE_NAME_MAX_LENGTH} characters`);
     }
+    return sanitized;
+}
+function normalizeWorkspaceDescription(description) {
+    const trimmed = description == null ? null : description.trim();
+    if (trimmed !== null && trimmed.length > 200) {
+        throw new Error(`Description must be 200 characters or fewer (got ${trimmed.length})`);
+    }
+    return trimmed && trimmed.length > 0 ? trimmed : null;
+}
+/** Update a workspace's display name. */
+export function updateWorkspaceName(id, name) {
+    const sanitized = sanitizeWorkspaceName(name);
     const db = getDb();
     const now = new Date().toISOString();
     const result = db.prepare('UPDATE workspaces SET name = ?, updated_at = ? WHERE id = ?').run(sanitized, now, id);
@@ -311,11 +320,7 @@ export function updateAgentPermissionMode(id, mode) {
  *   does not exist.
  */
 export function updateWorkspaceDescription(id, description) {
-    const trimmed = description == null ? null : description.trim();
-    if (trimmed !== null && trimmed.length > 200) {
-        throw new Error(`Description must be 200 characters or fewer (got ${trimmed.length})`);
-    }
-    const stored = trimmed && trimmed.length > 0 ? trimmed : null;
+    const stored = normalizeWorkspaceDescription(description);
     const db = getDb();
     const result = db
         .prepare('UPDATE workspaces SET description = ?, updated_at = ? WHERE id = ?')
@@ -326,6 +331,72 @@ export function updateWorkspaceDescription(id, description) {
     emitEphemeral(id, 'workspace:description-updated', { description: stored });
     return getWorkspace(id);
 }
+/** Validate and persist a multi-field API update with one atomic SQL statement. */
+export function updateWorkspaceFields(id, fields) {
+    const workspace = getWorkspace(id);
+    if (!workspace)
+        throw new Error(`Workspace '${id}' not found`);
+    const assignments = [];
+    const values = [];
+    if (fields.model !== undefined) {
+        if (typeof fields.model !== 'string' || !fields.model.trim())
+            throw new Error('model must be a non-empty string');
+        assignments.push('model = ?');
+        values.push(fields.model.trim());
+    }
+    if (fields.reasoningEffort !== undefined) {
+        if (typeof fields.reasoningEffort !== 'string' || !fields.reasoningEffort.trim()) {
+            throw new Error('reasoningEffort must be a non-empty string');
+        }
+        assignments.push('reasoning_effort = ?');
+        values.push(fields.reasoningEffort.trim());
+    }
+    if (fields.agentPermissionMode !== undefined) {
+        if (!['plan', 'bypass', 'strict', 'interactive'].includes(fields.agentPermissionMode)) {
+            throw new Error('Invalid agentPermissionMode');
+        }
+        const legacyMode = fields.agentPermissionMode === 'plan' ? 'plan' : 'auto-accept';
+        const legacyProfile = fields.agentPermissionMode === 'plan' ? 'bypass' : fields.agentPermissionMode;
+        assignments.push('agent_permission_mode = ?', 'permission_mode = ?', 'permission_profile = ?');
+        values.push(fields.agentPermissionMode, legacyMode, legacyProfile);
+    }
+    if (fields.status !== undefined) {
+        const allowed = VALID_TRANSITIONS[workspace.status];
+        if (!allowed || (fields.status !== workspace.status && !allowed.includes(fields.status))) {
+            throw new Error(`Invalid status transition from '${workspace.status}' to '${fields.status}'. Allowed: ${allowed?.join(', ') ?? ''}`);
+        }
+        assignments.push('status = ?');
+        values.push(fields.status);
+    }
+    if (fields.name !== undefined) {
+        if (typeof fields.name !== 'string')
+            throw new Error('name must be a string');
+        assignments.push('name = ?');
+        values.push(sanitizeWorkspaceName(fields.name));
+    }
+    const hasDescription = Object.hasOwn(fields, 'description');
+    let storedDescription;
+    if (hasDescription) {
+        if (fields.description !== null && typeof fields.description !== 'string') {
+            throw new Error('description must be a string or null');
+        }
+        storedDescription = normalizeWorkspaceDescription(fields.description ?? null);
+        assignments.push('description = ?');
+        values.push(storedDescription);
+    }
+    if (assignments.length === 0)
+        return workspace;
+    assignments.push('updated_at = ?');
+    values.push(new Date().toISOString(), id);
+    const result = getDb()
+        .prepare(`UPDATE workspaces SET ${assignments.join(', ')} WHERE id = ?`)
+        .run(...values);
+    if (result.changes === 0)
+        throw new Error(`Workspace '${id}' not found`);
+    if (hasDescription)
+        emitEphemeral(id, 'workspace:description-updated', { description: storedDescription ?? null });
+    return getWorkspace(id);
+}
 /**
  * Update a workspace's agent-side description (≤ 200 chars after trim).
  * Empty string (after trim) or `null` clears the column.