@loicngr/kobo 1.7.7 → 1.7.9

package/dist/server/services/agent/engines/codex/server-requests.js

@@ -0,0 +1,99 @@
+export function handleServerRequest(args) {
+    const { method, params, requestId, emit, register, respondError } = args;
+    const p = (params ?? {});
+    const callId = typeof p.callId === 'string' ? p.callId : `srv_${requestId}`;
+    if (method === 'mcpServer/elicitation/request') {
+        // Codex asks an external MCP server's elicitation prompt to be surfaced to
+        // the user. Kōbō doesn't model MCP elicitations yet — respond with a
+        // JSON-RPC "method not supported" error so the server doesn't block.
+        respondError?.(requestId, -32601, 'MCP elicitations not supported by this client');
+        return true;
+    }
+    // v2 and v1 method aliases for the same approval semantics. v1 legacy names
+    // (`execCommandApproval`, `applyPatchApproval`) are kept for compat with
+    // older Codex CLI builds that haven't transitioned to the v2 namespace.
+    if (method === 'item/commandExecution/requestApproval' || method === 'execCommandApproval') {
+        register(callId, { requestId, kind: 'command', payload: p });
+        emit({
+            kind: 'session:user-input-requested',
+            requestKind: 'permission',
+            toolCallId: callId,
+            toolName: 'Bash',
+            payload: { command: p.command, cwd: p.cwd, reason: p.reason },
+        });
+        return true;
+    }
+    if (method === 'item/fileChange/requestApproval' || method === 'applyPatchApproval') {
+        register(callId, { requestId, kind: 'file_change', payload: p });
+        emit({
+            kind: 'session:user-input-requested',
+            requestKind: 'permission',
+            toolCallId: callId,
+            toolName: 'Edit',
+            payload: { changes: p.changes, reason: p.reason },
+        });
+        return true;
+    }
+    if (method === 'item/tool/requestUserInput') {
+        register(callId, { requestId, kind: 'user_input', payload: p });
+        emit({
+            kind: 'session:user-input-requested',
+            requestKind: 'question',
+            toolCallId: callId,
+            toolName: 'AskUserQuestion',
+            payload: { questions: p.questions },
+        });
+        return true;
+    }
+    if (method === 'item/permissions/requestApproval') {
+        register(callId, { requestId, kind: 'permissions', payload: p });
+        emit({
+            kind: 'session:user-input-requested',
+            requestKind: 'permission',
+            toolCallId: callId,
+            toolName: 'Permissions',
+            payload: p,
+        });
+        return true;
+    }
+    return false; // unknown method
+}
+/**
+ * Build the JSON-RPC response Codex expects for a given pending request.
+ *
+ * Decision enum values come from
+ * `codex-rs/protocol/src/approvals.rs:CommandExecutionApprovalDecision`
+ * (and the matching `FileChangeApprovalDecision`): `'accept' | 'acceptForSession' | 'decline' | 'cancel'`.
+ * NOT `'approve' / 'reject'` — those would be silently rejected as unknown
+ * variants, which breaks the strict and interactive permission modes.
+ *
+ * `PermissionsRequestApprovalResponse` has a completely different shape:
+ * `{ permissions, scope, strictAutoReview? }` — no `decision` field. Since
+ * Kōbō doesn't yet model permission grants, we deny the request by sending
+ * an empty permissions response. A future iteration could add a UI for
+ * granular permission grants.
+ */
+export function buildResponseForResolve(pending, response) {
+    if (pending.kind === 'command' || pending.kind === 'file_change') {
+        if (response.kind === 'permission-allow')
+            return { decision: 'accept' };
+        return { decision: 'decline' };
+    }
+    if (pending.kind === 'permissions') {
+        // Codex's PermissionsRequestApprovalResponse shape — not { decision }.
+        // We don't yet model granular permission grants, so deny by returning an
+        // empty permissions object; Codex falls back to the existing turn policy.
+        return { permissions: {}, scope: 'turn' };
+    }
+    if (pending.kind === 'user_input') {
+        if (response.kind === 'question') {
+            const answers = {};
+            for (const [qid, val] of Object.entries(response.answers)) {
+                answers[qid] = { answers: [val] };
+            }
+            return { answers };
+        }
+        return { answers: {} };
+    }
+    return null;
+}

package/dist/server/services/agent/engines/codex/spawn.js

@@ -0,0 +1,27 @@
+import { spawn as nodeSpawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+const requireFn = createRequire(import.meta.url);
+export function resolveCodexBinary() {
+    try {
+        const pkgPath = requireFn.resolve('@openai/codex/package.json');
+        const pkg = requireFn(pkgPath);
+        const binRel = typeof pkg.bin === 'string' ? pkg.bin : pkg.bin?.codex;
+        if (binRel) {
+            const url = new URL(binRel, `file://${pkgPath}`);
+            return url.pathname;
+        }
+    }
+    catch {
+        // fall through to default
+    }
+    return 'codex';
+}
+export function spawnAppServer(opts) {
+    const bin = resolveCodexBinary();
+    return nodeSpawn(bin, ['app-server'], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        cwd: opts.cwd,
+        env: opts.env,
+        signal: opts.signal,
+    });
+}

package/dist/server/services/agent/engines/registry.js

@@ -1,6 +1,8 @@
 import { createClaudeCodeEngine } from './claude-code/engine.js';
+import { createCodexEngine } from './codex/engine.js';
 const ENGINES = {
     'claude-code': createClaudeCodeEngine(),
+    codex: createCodexEngine(),
 };
 export function listEngines() {
     return Object.values(ENGINES);

package/dist/server/services/agent/orchestrator.js

@@ -298,7 +298,7 @@ function readEffectiveSettingsSafe(projectPath) {
     catch (err) {
         console.warn('[orchestrator] Failed to load settings, using defaults:', err);
         return {
-            model: 'claude-opus-4-7',
+            model: 'auto',
             dangerouslySkipPermissions: true,
             prPromptTemplate: '',
             reviewPromptTemplate: '',

package/dist/server/services/auto-loop-service.js

@@ -5,6 +5,7 @@ import { slugifyProjectName } from '../utils/project-slug.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 import * as orchestrator from './agent/orchestrator.js';
 import * as settingsService from './settings-service.js';
+import { getSuitePrompts } from './skill-suite-prompts.js';
 import { emit, emitEphemeral } from './websocket-service.js';
 import { listTasks } from './workspace-service.js';
 const NO_PROGRESS_STALL_THRESHOLD = 3;
@@ -189,7 +190,7 @@ Your job this iteration:
 3. Run the project's quality checks (lint, typecheck, tests). Check \`.ai/.git-conventions.md\` for the exact commands if unclear.
 4. If checks fail, fix until they pass. If blocked, leave the task unchanged and explain in chat.
 5. Commit with a conventional message (\`feat: [short description]\` or similar per repo conventions).
-6. Code review gate — BEFORE marking the task done, dispatch an independent code-reviewer subagent via the Task tool with \`subagent_type: "code-reviewer"\` (or \`"superpowers:code-reviewer"\` / \`"pr-review-toolkit:code-reviewer"\` — use whichever exists in this environment; fall back to \`superpowers:requesting-code-review\` skill if none is available). Brief the reviewer with: what you just implemented, the task title, and the commit SHA (via \`git rev-parse HEAD\`). Ask specifically whether the change matches the task scope, whether edge cases are handled, and whether the commit is clean.
+6. {reviewGate}
 7. Act on the review:
    - If Critical/Important issues: fix them, amend or add a fix-up commit, re-run checks from step 3. Do NOT mark_task_done.
    - If only Minor issues: fix them if trivial (< 2 min), otherwise note them in the chat and proceed.
@@ -199,6 +200,18 @@ Your job this iteration:
 Do NOT modify other tasks' state. Do NOT create a PR. Do NOT skip the checks.
 Do NOT run \`kill\`, \`pkill\`, \`killall\`, \`pgrep -k\`, or any process-killing command — you may tear down the Kōbō server itself or sibling dev servers. If a dev server needs restarting, let the user do it.
 When you're done (success or blocked), end your turn cleanly.`;
+/**
+ * Resolve the active auto-loop review gate sentence (step 6 of the iteration
+ * prompt) for the current global skill suite, honouring any user override in
+ * `custom` mode. On the default `superpowers` suite this returns the same
+ * text that was historically inlined into PROMPT_TEMPLATE.
+ */
+function getActiveAutoLoopReviewGate() {
+    const global = settingsService.getGlobalSettings();
+    return getSuitePrompts(global.skillSuite, {
+        autoLoopReviewGate: global.customAutoLoopReviewGate,
+    }).autoLoopReviewGate;
+}
 function pickNextTask(workspaceId) {
     const pending = listTasks(workspaceId).filter((t) => t.status !== 'done');
     if (pending.length === 0)
@@ -257,7 +270,8 @@ function spawnNextIteration(workspaceId, opts = {}) {
         .replaceAll('{taskId}', task.id)
         .replaceAll('{taskTitle}', task.title)
         .replaceAll('{isAcceptanceCriterion}', String(task.isAcceptanceCriterion))
-        .replaceAll('{overrideBlock}', overrideBlock);
+        .replaceAll('{overrideBlock}', overrideBlock)
+        .replaceAll('{reviewGate}', getActiveAutoLoopReviewGate());
     const globalSettings = settingsService.getGlobalSettings();
     const projectSlug = globalSettings.worktreesPrefixByProject
         ? slugifyProjectName(projectSettings?.displayName ?? '', row.project_path)

package/dist/server/services/pr-watcher-service.js

@@ -2,7 +2,7 @@ import { getPrStatusAsync } from '../utils/git-ops.js';
 import { stopDevServer } from './dev-server-service.js';
 import { destroyTerminal } from './terminal-service.js';
 import { emitEphemeral } from './websocket-service.js';
-import { archiveWorkspace, listWorkspaces, updateWorkspaceSourceBranch } from './workspace-service.js';
+import { archiveWorkspace, getWorkspace, listWorkspaces, updateWorkspaceSourceBranch } from './workspace-service.js';
 // ── PR Watcher ────────────────────────────────────────────────────────────────
 // Polls GitHub every POLL_INTERVAL_MS to detect merged/closed PRs and
 // automatically archive the corresponding workspace.
@@ -14,18 +14,17 @@ import { archiveWorkspace, listWorkspaces, updateWorkspaceSourceBranch } from '.
 const POLL_INTERVAL_MS = 30 * 1000; // 30 seconds
 let timer = null;
 let checking = false;
+/** Tracks the last known PR snapshot per workspace, used to detect transitions
+ *  (state, base, reviewDecision). */
 const lastKnownPr = new Map();
 /**
- * Read-only snapshot of PR states known to the watcher, keyed by workspace id.
- * Used by the drawer to show a small PR-open indicator without N separate
- * `gh pr view` calls per workspace. Only contains entries where a PR has been
- * detected at least once by the watcher since boot; workspaces without a PR
- * are absent from the map.
+ * Read-only snapshot map, keyed by workspace id. Used by the drawer indicator
+ * AND the Git panel. Workspaces without a known PR are absent.
  */
-export function getAllPrStates() {
+export function getAllPrSnapshots() {
     const out = {};
-    for (const [id, known] of lastKnownPr) {
-        out[id] = known.state;
+    for (const [id, snap] of lastKnownPr) {
+        out[id] = snap;
     }
     return out;
 }
@@ -45,9 +44,6 @@ export async function checkPrStatuses() {
         }
     }
     for (const ws of workspaces) {
-        // Only check workspaces that are not actively running an agent
-        if (['extracting', 'brainstorming', 'executing'].includes(ws.status))
-            continue;
         try {
             const pr = await getPrStatusAsync(ws.projectPath, ws.workingBranch);
             if (!pr)
@@ -61,6 +57,13 @@ export async function checkPrStatuses() {
             // Archive on a transition FROM OPEN to CLOSED/MERGED. Skips the
             // base-change detection below — archiving wins.
             if (prev?.state === 'OPEN' && (pr.state === 'MERGED' || pr.state === 'CLOSED')) {
+                if (['extracting', 'brainstorming', 'executing'].includes(ws.status)) {
+                    // Agent is working — update the cache but skip auto-archive.
+                    // (The defensive base preservation from the no-base branch doesn't apply here
+                    // because we ARE in the OPEN→MERGED/CLOSED branch which always has a base.)
+                    lastKnownPr.set(ws.id, pr);
+                    continue;
+                }
                 console.log(`[pr-watcher] PR ${pr.state.toLowerCase()} for workspace '${ws.name}' — archiving`);
                 // Best-effort cleanup (same as manual archive): stop dev server + terminal.
                 // Agent is already not running here (guarded above).
@@ -84,13 +87,32 @@ export async function checkPrStatuses() {
                 });
                 continue; // do not run base-change detection on a workspace we just archived
             }
+            // Review-decision transitions (only on OPEN PRs; first-sight is silent).
+            // Reuses the baseline rule from base-change detection: emits only when we
+            // observe an actual transition between two known states.
+            if (pr.state === 'OPEN' && prev) {
+                if (prev.reviewDecision !== 'CHANGES_REQUESTED' && pr.reviewDecision === 'CHANGES_REQUESTED') {
+                    emitEphemeral(ws.id, 'pr:changes-requested', {
+                        prNumber: pr.number,
+                        prUrl: pr.url,
+                    });
+                }
+                else if (prev.reviewDecision === 'CHANGES_REQUESTED' && pr.reviewDecision === 'APPROVED') {
+                    emitEphemeral(ws.id, 'pr:approved', {
+                        prNumber: pr.number,
+                        prUrl: pr.url,
+                    });
+                }
+            }
             // Base-branch change detection. Only relevant for OPEN PRs — closed/
             // merged PRs don't accept base changes. Skip if the GitHub response
             // didn't include a baseRefName (defensive against malformed data).
             if (pr.state !== 'OPEN' || !pr.base) {
                 // Still update the cache for the state — keeps the OPEN→CLOSED/MERGED
-                // archiving logic working on the next tick.
-                lastKnownPr.set(ws.id, { state: pr.state, base: prev?.base });
+                // archiving logic working on the next tick. Preserve the previous
+                // `base` if the fresh snapshot is missing one (defensive).
+                const next = pr.base ? pr : { ...pr, base: prev?.base ?? pr.base };
+                lastKnownPr.set(ws.id, next);
                 continue;
             }
             // Comparison baseline:
@@ -100,8 +122,8 @@ export async function checkPrStatuses() {
             //    that happened while Kobo was offline.
             const previousBase = prev?.base ?? ws.sourceBranch;
             if (previousBase === pr.base) {
-                // No-op path: still record the base so subsequent ticks have a baseline.
-                lastKnownPr.set(ws.id, { state: pr.state, base: pr.base });
+                // No-op path: still record the snapshot so subsequent ticks have a baseline.
+                lastKnownPr.set(ws.id, pr);
                 continue;
             }
             console.log(`[pr-watcher] PR base changed for workspace '${ws.name}': ${previousBase} → ${pr.base}`);
@@ -116,7 +138,7 @@ export async function checkPrStatuses() {
             }
             // Both the persistence and the emit are part of "we successfully
             // observed a base change" — only NOW commit the new state to the cache.
-            lastKnownPr.set(ws.id, { state: pr.state, base: pr.base });
+            lastKnownPr.set(ws.id, pr);
             emitEphemeral(ws.id, 'pr:base-changed', {
                 oldBase: previousBase,
                 newBase: pr.base,
@@ -128,24 +150,49 @@ export async function checkPrStatuses() {
         }
     }
 }
+/**
+ * On-demand refresh of a single workspace's PR snapshot. Bypasses the 30s tick.
+ * No side effects beyond cache update — no archive, no transition emits. The
+ * user is watching the UI; we don't replay events for state they're already
+ * looking at.
+ *
+ * Returns the fresh snapshot, or null if the workspace has no PR (cache entry
+ * cleared in that case). Throws if the workspace doesn't exist.
+ */
+export async function refreshPrSnapshot(workspaceId) {
+    const ws = getWorkspace(workspaceId);
+    if (!ws)
+        throw new Error(`Workspace '${workspaceId}' not found`);
+    const snap = await getPrStatusAsync(ws.projectPath, ws.workingBranch);
+    if (snap === null) {
+        lastKnownPr.delete(workspaceId);
+        return null;
+    }
+    lastKnownPr.set(workspaceId, snap);
+    return snap;
+}
+/**
+ * Runs a single check while honouring the `checking` re-entrancy guard. Used
+ * both by the immediate boot-time kick-off and by the periodic timer tick.
+ */
+async function runOneCheck() {
+    if (checking)
+        return;
+    checking = true;
+    try {
+        await checkPrStatuses();
+    }
+    catch (err) {
+        console.error('[pr-watcher] Unexpected error in checkPrStatuses:', err);
+    }
+    finally {
+        checking = false;
+    }
+}
 function scheduleNext() {
     timer = setTimeout(async () => {
-        if (checking) {
-            // Previous run still in progress — skip and reschedule
-            scheduleNext();
-            return;
-        }
-        checking = true;
-        try {
-            await checkPrStatuses();
-        }
-        catch (err) {
-            console.error('[pr-watcher] Unexpected error in checkPrStatuses:', err);
-        }
-        finally {
-            checking = false;
-            scheduleNext();
-        }
+        await runOneCheck();
+        scheduleNext();
     }, POLL_INTERVAL_MS);
     timer.unref?.();
 }
@@ -153,6 +200,10 @@ function scheduleNext() {
 export function startPrWatcher() {
     if (timer)
         return;
+    // Kick off an immediate check so the front-end has fresh PR data on boot
+    // without waiting for the first 30s tick. Fire-and-forget; the recurring
+    // loop is scheduled independently and the `checking` guard prevents overlap.
+    void runOneCheck();
     scheduleNext();
 }
 /** Stop the PR watcher polling loop. */

package/dist/server/services/review-template-service.js

@@ -1,35 +1,28 @@
 import path from 'node:path';
-export const DEFAULT_REVIEW_PROMPT_TEMPLATE = `You are reviewing code changes on workspace "{{workspace_name}}" in project {{project_name}}.
-
-Branch: {{branch_name}}  (base: {{source_branch}})
-Base commit: {{base_commit}}
-
-If a code-review skill is available (e.g. superpowers:requesting-code-review), invoke it to drive this review. Otherwise follow the steps below directly.
-
-## Scope
-
-Review ALL changes — both committed and uncommitted in the working tree:
-- \`git diff {{base_commit}}..HEAD\` — committed changes on this branch
-- \`git status\` and \`git diff\` — uncommitted changes (staged + unstaged)
-
-## Diff summary
-{{diff_stats}}
-
-## Commits
-{{commits}}
-
-## Additional instructions
-{{additional_instructions}}
-
-## Output
-
-If no review skill is available, structure your reply as:
-1. Summary — what changed and why
-2. Issues — bugs, regressions, security or perf concerns (with file:line)
-3. Suggestions — refactor / improvement opportunities
-4. Tests — coverage gaps
-5. Verdict — ship / fix-then-ship / blocked
-`;
+import { getGlobalSettings } from './settings-service.js';
+import { getSuitePrompts, SUPERPOWERS_PROMPTS } from './skill-suite-prompts.js';
+/**
+ * Back-compat alias for the legacy review-template default. The canonical
+ * default now lives in `SUPERPOWERS_PROMPTS.reviewTemplate`; this export is
+ * kept so existing seed/migration paths in `settings-service.ts` and
+ * `routes/settings.ts` (the "reset to default" endpoint) keep working
+ * without being rewritten. Runtime readers should call
+ * `getActiveReviewTemplate()` instead, which respects the user's
+ * `skillSuite` choice.
+ */
+export const DEFAULT_REVIEW_PROMPT_TEMPLATE = SUPERPOWERS_PROMPTS.reviewTemplate;
+/**
+ * Resolve the review prompt template active for this user right now:
+ * read the global `skillSuite` and, in `custom` mode, the
+ * `customReviewTemplate` override. On the default `superpowers` suite this
+ * returns the same text as the legacy `DEFAULT_REVIEW_PROMPT_TEMPLATE`.
+ */
+export function getActiveReviewTemplate() {
+    const global = getGlobalSettings();
+    return getSuitePrompts(global.skillSuite, {
+        reviewTemplate: global.customReviewTemplate,
+    }).reviewTemplate;
+}
 function buildVariableMap(ctx) {
     return {
         project_name: path.basename(ctx.workspace.projectPath),