@netnodeag/kraftwerk 0.49.0 → 0.50.1

package/README.md

@@ -587,8 +587,13 @@ repos:
 The folder is the registry. Whatever has a `.git` directly under the root is
 a repository, whether the "repositories" screen cloned it, `kraftwerk repos
 add <url>` did, or an agent ran `git clone` there. Every entry is read live
-from git: origin, branch, head, uncommitted changes, ahead/behind. The
-screen clones by url, fetches and fast-forwards clean clones, and removes
+from git: origin, branch, head, uncommitted changes, ahead/behind. Each
+clone has a page (`#/repos/<name>`, the "changes" button) that shows what
+is happening inside: the changed files with their diff against HEAD, the
+line counts, and the recent commits with the unpushed ones marked — click
+a commit for its patch. It polls, so an agent working in the clone is
+watched live. Secrets (`.env`, keys) are never shown, as on the git screen.
+The list clones by url, fetches and fast-forwards clean clones, and removes
 them (refusing while they hold unpushed or uncommitted work). Cloning uses
 your own git credentials and never prompts, so a private remote has to work
 from a terminal first.

package/dist/inspector/chat/acp.js

@@ -476,7 +476,13 @@ export async function startAcpBackend(agent, cwd, hooks, tuning = {}) {
                     _meta: fileChangeReportMeta(randomUUID()),
                 });
                 turns++;
-                return res.stopReason;
+                // A provider condition that ends the turn itself (usage limit, rate
+                // limit, provider error) is not a notification: the adapter settles
+                // the prompt with stopReason "end_turn" and the typed failure in the
+                // response `_meta`. Without reading it here the turn would end
+                // silently — no text, no error (see failureOf).
+                const failure = failureOf(res._meta);
+                return failure ? { stopReason: res.stopReason, failure } : { stopReason: res.stopReason };
             }
             catch (err) {
                 // A resumed session that cannot even take its first prompt (the

package/dist/inspector/chat/backend.d.ts

@@ -1,4 +1,4 @@
-import type { AgentCommand, Attachment, ChatEvent, ConfigOption, ElicitationAnswer, ElicitationField } from "./types.js";
+import type { AgentCommand, Attachment, ChatEvent, ConfigOption, ElicitationAnswer, ElicitationField, SessionFailure } from "./types.js";
 /** An attachment as the backend gets it: where the file is, and what it is. */
 export interface PromptFile extends Attachment {
     path: string;
@@ -46,6 +46,17 @@ export interface BackendTuning {
     /** ACP agents: the session id to continue (from ChatMeta.sessions) instead of opening a new one. */
     resume?: string;
 }
+/**
+ * How a turn ended. `failure` is the typed session failure the agent
+ * attached to the turn's own outcome (a usage limit, a rate limit, a
+ * provider error): ACP hands those back on the prompt response rather
+ * than as a mid-turn notification, and without it the turn would look
+ * like an ordinary empty `end_turn`.
+ */
+export interface TurnEnd {
+    stopReason: string;
+    failure?: SessionFailure;
+}
 export interface ChatBackend {
     /** The agent's own session id, when it has one to resume later (ACP agents). */
     sessionId?: string;
@@ -53,8 +64,8 @@ export interface ChatBackend {
     resumed?: boolean;
     /** The resumed session turned out unusable at its first prompt — its id must not be resumed again. */
     resumeFailed?: boolean;
-    /** Send one user message (plus files dropped into it); resolves with the stop reason at turn end. */
-    prompt(text: string, files?: PromptFile[]): Promise<string>;
+    /** Send one user message (plus files dropped into it); resolves with how the turn ended. */
+    prompt(text: string, files?: PromptFile[]): Promise<TurnEnd>;
     /** Branch the conversation: a new session id with this session's history (ACP agents that offer session/fork). */
     fork?(): Promise<string>;
     /**

package/dist/inspector/chat/pi.js

@@ -87,14 +87,14 @@ export function startPiBackend(cwd, hooks, tuning = {}) {
                     child = null;
                     handleLine(buffer);
                     if (cancelled)
-                        return resolve("cancelled");
+                        return resolve({ stopReason: "cancelled" });
                     if (failure || code !== 0 || !sawAssistant) {
                         reject(new Error(`pi failed (exit ${code})` +
                             (failure ? `: ${failure}` : "") +
                             (stderr.trim() ? `\nstderr: ${stderr.trim().slice(-1000)}` : "")));
                         return;
                     }
-                    resolve("end_turn");
+                    resolve({ stopReason: "end_turn" });
                 });
             });
         },

package/dist/inspector/chat/sessions.js

@@ -67,6 +67,10 @@ function lastEventText(state, afterSeq, type) {
             parts.push(e.text);
         if (type === "error" && e.type === "error")
             parts.push(e.message);
+        // A turn the agent ended on a provider failure (usage limit, rate
+        // limit) reports no error event — the failure card is the outcome.
+        if (type === "error" && e.type === "failure" && e.severity === "error")
+            parts.push(e.title);
     }
     const text = parts.join("").trim();
     if (!text)
@@ -790,14 +794,18 @@ export async function postMessage(id, text, opts = {}) {
             // the thread keeps the short form the user typed.
             const body = await expandSkillInvocation(state.meta.scope, text);
             const promptText = context ? `<context>\n${context}\n</context>\n\n${body}` : body;
-            const stopReason = await backend.prompt(promptText, promptFiles(id, attachments));
+            const { stopReason, failure } = await backend.prompt(promptText, promptFiles(id, attachments));
             emit(state, { type: "turn_end", stopReason });
+            // After turn_end, so the card stays live (a turn_end settles the
+            // failures reported before it): this one is why the turn ended.
+            if (failure)
+                emit(state, { type: "failure", ...failure });
             // Routine sessions are one-shot and unattended: release the agent
             // process as soon as the turn ends instead of waiting for the reaper,
             // and tell the bell how it went.
             if (isUnattended(state.meta.scope)) {
                 dropBackend(state);
-                const failed = state.events.some((e) => e.seq > turnStart && e.type === "error");
+                const failed = state.events.some((e) => e.seq > turnStart && (e.type === "error" || (e.type === "failure" && e.severity === "error")));
                 void pushNotification({
                     kind: failed ? "routine_failed" : "routine_done",
                     title: `${chatLabel(state.meta)} ${failed ? "ended with an error" : "finished"}`,
@@ -923,8 +931,10 @@ async function runSeatTurn(state, channel, seat, hops) {
         }
         const prompt = (context ? `<context>\n${context}\n</context>\n\n` : "") +
             (delta ? `New messages in #${channel.slug}:\n\n${delta}` : `You joined #${channel.slug}. Nothing addressed to you yet — reply with one short line saying you are here.`);
-        const stopReason = await backend.prompt(prompt);
+        const { stopReason, failure } = await backend.prompt(prompt);
         emit(state, { type: "turn_end", stopReason }, me);
+        if (failure)
+            emit(state, { type: "failure", ...failure }, me);
         // Handover: agents this one @mentioned get its message, within the hop budget.
         const said = seatTextSince(state, start, seat.key);
         const next = mentionTargets(said, channel, seat.key);

package/dist/inspector/git.d.ts

@@ -1,3 +1,33 @@
+/**
+ * Workspace git sync. Several people run kraftwerk against one git repo, so
+ * knowledge, agents, skills, channels and workflows travel between them like
+ * any other tracked file. The inspector shows what changed, lets a human pick files and
+ * commit them, and pushes on request.
+ *
+ * Deliberate limits, because this runs git on someone's repo from a web UI
+ * that has no authentication of its own:
+ *
+ * - Only the roots kraftwerk.yml already declares are ever staged, never the
+ *   whole repo, and never the output directory (runs and chats are noise).
+ * - DENY matches (.env, keys) are never staged, and `git add -f` is never
+ *   called, so .gitignore keeps its meaning.
+ * - Reads are scoped too: the diff endpoint only shows a path the status
+ *   screen lists as syncable, and status never lists what .gitignore hides,
+ *   so an untracked .env cannot be read through it.
+ * - Commit and push are manual. The background timer only fetches, and pulls
+ *   fast-forward when `autosync: pull` is set, the configured branch is the
+ *   one checked out, and no tracked file is modified.
+ * - A diverged branch is reported, never merged or rebased from here.
+ *
+ * Every git call passes an argument array, so nothing reaches a shell, and
+ * every call is async with a timeout: git runs inside the single-threaded
+ * inspector, so a network operation must never block the event loop, and a
+ * remote asking for credentials must fail instead of waiting forever on a
+ * terminal nobody is watching.
+ */
+/** Files that must never be staged, whatever the scope says. */
+/** Paths whose content is never shown or synced, whichever repo they sit in. */
+export declare const DENY: RegExp[];
 export interface GitFile {
     /** Path relative to the repo root, which is what git speaks. */
     path: string;
@@ -52,8 +82,20 @@ export declare function git(args: string[], cwd: string, timeoutMs?: number, env
 export declare function sshCommandFor(repoRoot: string): Promise<string>;
 /** A git call that may touch the network: longer timeout, non-interactive ssh. */
 export declare function gitNet(args: string[], repoRoot: string): Promise<GitResult>;
+/**
+ * Pathspecs are globs by default, so a file called `note[1].md` would not
+ * match itself. `:(literal)` turns the pattern off.
+ */
+export declare const literal: (p: string) => string;
 /** Repo root for a directory, or null when it is not inside a git repo. */
 export declare function repoRootFor(dir: string): Promise<string | null>;
+/** Label for a porcelain code, using whichever half is set. */
+export declare function label(code: string): string;
+/** Parse `git status --porcelain=v1 -z`, which NUL-separates and doubles up on renames and copies. */
+export declare function parseStatus(out: string): {
+    path: string;
+    code: string;
+}[];
 /**
  * Everything the git screen renders. Each call shells out to git a handful
  * of times, and the nav badge polls it from every open tab, so results are
@@ -68,6 +110,15 @@ export declare function gitStatus(fresh?: boolean): Promise<GitStatus>;
  * Status never lists ignored files, which covers .gitignore too.
  */
 export declare function gitDiff(file: string): Promise<GitDiff>;
+/**
+ * Unified diff of one path in a repo against HEAD, capped. The caller has
+ * checked that the path is a listed, showable change. A repo without
+ * commits yet has nothing for `diff HEAD` to compare with; there, as for an
+ * untracked file, the whole file is the change. Shared by the workspace
+ * diff and the repositories screen so the two never drift.
+ */
+export declare function diffAgainstHead(repoRoot: string, file: string, code: string): Promise<GitDiff>;
+export declare function capDiff(diff: string): GitDiff;
 /** Stage the given repo-relative paths and commit just those. */
 export declare function gitCommit(paths: string[], message: string): Promise<{
     ok: boolean;

package/dist/inspector/git.js

@@ -32,7 +32,8 @@ import { getOutputDir, getProjectRoot } from "./context.js";
  * terminal nobody is watching.
  */
 /** Files that must never be staged, whatever the scope says. */
-const DENY = [
+/** Paths whose content is never shown or synced, whichever repo they sit in. */
+export const DENY = [
     /(^|\/)\.env($|\.)/,
     /(^|\/)\.envrc$/,
     new RegExp(`(^|/)${ENV_FILE.replace(/\./g, "\\.")}$`),
@@ -147,7 +148,7 @@ function netArgs(cmd, ...names) {
  * Pathspecs are globs by default, so a file called `note[1].md` would not
  * match itself. `:(literal)` turns the pattern off.
  */
-const literal = (p) => `:(literal)${p}`;
+export const literal = (p) => `:(literal)${p}`;
 /** Repo root for a directory, or null when it is not inside a git repo. */
 export async function repoRootFor(dir) {
     const r = await git(["rev-parse", "--show-toplevel"], dir);
@@ -286,7 +287,7 @@ async function hasLocalChanges(repoRoot) {
     return !(await git(["diff", "--cached", "--quiet"], repoRoot)).ok;
 }
 /** Label for a porcelain code, using whichever half is set. */
-function label(code) {
+export function label(code) {
     if (code === "??")
         return "untracked";
     const c = code.replace(/ /g, "");
@@ -307,7 +308,7 @@ function label(code) {
     return c || "changed";
 }
 /** Parse `git status --porcelain=v1 -z`, which NUL-separates and doubles up on renames and copies. */
-function parseStatus(out) {
+export function parseStatus(out) {
     const parts = out.split("\0").filter((p) => p.length > 0);
     const files = [];
     for (let i = 0; i < parts.length; i++) {
@@ -450,11 +451,18 @@ export async function gitDiff(file) {
         return { diff: "", error: "not shown: not a changed file under the workspace paths" };
     if (!entry.syncable)
         return { diff: "", error: `not shown: ${entry.reason}` };
-    const { repoRoot } = st;
-    // A repo without commits yet has nothing for `diff HEAD` to compare with;
-    // there, as for an untracked file, the whole file is the change.
+    return diffAgainstHead(st.repoRoot, file, entry.code);
+}
+/**
+ * Unified diff of one path in a repo against HEAD, capped. The caller has
+ * checked that the path is a listed, showable change. A repo without
+ * commits yet has nothing for `diff HEAD` to compare with; there, as for an
+ * untracked file, the whole file is the change. Shared by the workspace
+ * diff and the repositories screen so the two never drift.
+ */
+export async function diffAgainstHead(repoRoot, file, code) {
     const hasHead = (await git(["rev-parse", "--verify", "-q", "HEAD"], repoRoot)).ok;
-    if (entry.code === "??" || !hasHead) {
+    if (code === "??" || !hasHead) {
         // --no-index exits 1 when the files differ, which is the normal case here.
         const r = await git(["diff", "--no-index", "--", "/dev/null", file], repoRoot);
         return r.stdout ? capDiff(r.stdout) : { diff: "", error: r.stderr || "no diff available" };
@@ -462,7 +470,7 @@ export async function gitDiff(file) {
     const r = await git(["diff", "HEAD", "--", literal(file)], repoRoot);
     return r.ok ? capDiff(r.stdout) : { diff: "", error: r.stderr || "diff failed" };
 }
-function capDiff(diff) {
+export function capDiff(diff) {
     if (diff.length <= MAX_DIFF)
         return { diff };
     const cut = diff.lastIndexOf("\n", MAX_DIFF);

package/dist/inspector/repos.d.ts

@@ -1,4 +1,5 @@
 import { type Project } from "../config.js";
+import { type GitDiff } from "./git.js";
 /**
  * Repositories: the git clones an agent works on, kept under one root
  * inside the project (`repos.root` in kraftwerk.yml, default repos/). The
@@ -42,6 +43,36 @@ export interface RepoInfo {
     /** Set when git could not be read for this folder. */
     error?: string;
 }
+/** One changed path in a clone's working tree. */
+export interface RepoFile {
+    path: string;
+    /** Two-letter porcelain code. */
+    code: string;
+    /** modified, added, deleted, renamed, untracked, conflicted. */
+    status: string;
+}
+export interface RepoCommit {
+    hash: string;
+    short: string;
+    subject: string;
+    author: string;
+    committedAt: string;
+    /** On no remote yet: the clone's own work. */
+    local: boolean;
+}
+/**
+ * The detail page's view of a clone: the listing's summary plus what is
+ * happening inside — changed files, line counts against HEAD, the recent
+ * commits with the unpushed ones marked, and the branch's upstream.
+ */
+export interface RepoDetail extends RepoInfo {
+    upstream?: string;
+    files: RepoFile[];
+    commits: RepoCommit[];
+    /** Working tree against HEAD, tracked files only. */
+    insertions: number;
+    deletions: number;
+}
 export interface ReposView {
     enabled: boolean;
     root?: string;
@@ -79,6 +110,22 @@ export declare function openRepos(): Promise<{
     off?: boolean;
     error?: string;
 }>;
+/** What is happening in one clone; null when there is no such clone. */
+export declare function repoDetail(slug: string): Promise<RepoDetail | null>;
+/**
+ * Unified diff of one changed file in a clone, against HEAD (the whole
+ * file for an untracked one). Same rule as the workspace diff: only a path
+ * the status lists is shown, and never a secret — a clone's untracked .env
+ * is the file itself.
+ */
+export declare function repoDiff(slug: string, file: string): Promise<GitDiff>;
+/**
+ * One commit of a clone as a patch: header, stat, then the diff. The
+ * commit's own path list decides what is shown: a denied path (a committed
+ * key, a renamed-in .env) is left out of both the stat and the patch by
+ * pathspec, so no header shape git emits can smuggle it through.
+ */
+export declare function repoCommitDiff(slug: string, hash: string): Promise<GitDiff>;
 /** Every clone under the root, alphabetically. Folders without .git are skipped. */
 export declare function listRepos(): Promise<ReposView>;
 /**

package/dist/inspector/repos.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { gitignoreHas, ignoreEntryFor, reposRootFor, resolveProject } from "../config.js";
 import { getProjectRoot } from "./context.js";
 import { newestMtime } from "./mtime.js";
-import { git, gitNet, sshCommandFor } from "./git.js";
+import { capDiff, DENY, diffAgainstHead, git, gitNet, label, literal, parseStatus, sshCommandFor } from "./git.js";
 /**
  * A clone is the one call here that can legitimately take long: a large
  * repository on a slow link is minutes, not seconds. Prompts are already
@@ -63,7 +63,8 @@ async function inspect(root, slug) {
     const dir = path.join(root, slug);
     const info = { slug, path: dir, dirty: 0 };
     const [status, log, origin, newest] = await Promise.all([
-        git(["status", "--porcelain=v2", "--branch", "--untracked-files=normal"], dir),
+        // Every untracked file counts, so the listing's "N changed" and the page's file list agree.
+        git(["status", "--porcelain=v2", "--branch", "--untracked-files=all"], dir),
         git(["log", "-1", "--format=%h%x00%s%x00%cI"], dir),
         git(["remote", "get-url", "origin"], dir),
         newestMtime(dir),
@@ -111,6 +112,124 @@ async function inspect(root, slug) {
     }
     return info;
 }
+const COMMITS = 40;
+async function cloneDir(slug) {
+    safeRepoSlug(slug);
+    const opened = await openRepos();
+    if (!opened.root)
+        throw new Error(opened.error ?? "repositories are off");
+    const dir = path.join(opened.root, slug);
+    if (!(await fs.stat(path.join(dir, ".git")).catch(() => null)))
+        throw new Error(`no repository "${slug}"`);
+    return { root: opened.root, dir };
+}
+/** What is happening in one clone; null when there is no such clone. */
+export async function repoDetail(slug) {
+    let root;
+    let dir;
+    try {
+        ({ root, dir } = await cloneDir(slug));
+    }
+    catch (err) {
+        if (/^no repository/.test(err.message))
+            return null;
+        throw err;
+    }
+    const info = await inspect(root, slug);
+    const detail = { ...info, files: [], commits: [], insertions: 0, deletions: 0 };
+    if (info.error)
+        return detail;
+    const [status, log, local, stat, upstream] = await Promise.all([
+        git(["status", "--porcelain=v1", "-z", "--untracked-files=all"], dir),
+        git(["log", `-${COMMITS}`, "--format=%H%x00%h%x00%s%x00%an%x00%cI"], dir),
+        // Bounded like the log: the local commits among the newest N are a prefix of the first N non-remote ones.
+        git(["rev-list", `-n`, String(COMMITS), "HEAD", "--not", "--remotes"], dir),
+        git(["diff", "HEAD", "--shortstat"], dir),
+        git(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"], dir),
+    ]);
+    if (status.ok)
+        detail.files = parseStatus(status.stdout).map((f) => ({ path: f.path, code: f.code, status: label(f.code) }));
+    if (log.ok) {
+        const localSet = new Set(local.ok ? local.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : []);
+        detail.commits = log.stdout
+            .split("\n")
+            .filter((l) => l.trim())
+            .map((l) => {
+            const [hash, short, subject, author, committedAt] = l.split("\0");
+            return { hash, short, subject, author, committedAt, local: localSet.has(hash) };
+        });
+    }
+    if (stat.ok) {
+        const ins = /(\d+) insertion/.exec(stat.stdout);
+        const del = /(\d+) deletion/.exec(stat.stdout);
+        detail.insertions = ins ? Number(ins[1]) : 0;
+        detail.deletions = del ? Number(del[1]) : 0;
+    }
+    if (upstream.ok && upstream.stdout.trim())
+        detail.upstream = upstream.stdout.trim();
+    return detail;
+}
+/**
+ * Unified diff of one changed file in a clone, against HEAD (the whole
+ * file for an untracked one). Same rule as the workspace diff: only a path
+ * the status lists is shown, and never a secret — a clone's untracked .env
+ * is the file itself.
+ */
+export async function repoDiff(slug, file) {
+    if (!file || file.includes("\0") || path.isAbsolute(file) || file.split("/").includes(".."))
+        return { diff: "", error: "invalid path" };
+    const { dir } = await cloneDir(slug);
+    if (DENY.some((re) => re.test(file)))
+        return { diff: "", error: "not shown: secret or key" };
+    const status = await git(["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", literal(file)], dir);
+    const entry = status.ok ? parseStatus(status.stdout).find((f) => f.path === file) : undefined;
+    if (!entry)
+        return { diff: "", error: "not shown: not a changed file in this repository" };
+    return diffAgainstHead(dir, file, entry.code);
+}
+/**
+ * One commit of a clone as a patch: header, stat, then the diff. The
+ * commit's own path list decides what is shown: a denied path (a committed
+ * key, a renamed-in .env) is left out of both the stat and the patch by
+ * pathspec, so no header shape git emits can smuggle it through.
+ */
+export async function repoCommitDiff(slug, hash) {
+    if (!/^[0-9a-f]{7,40}$/.test(hash))
+        return { diff: "", error: "invalid commit" };
+    const { dir } = await cloneDir(slug);
+    if (!(await git(["rev-parse", "--verify", "-q", `${hash}^{commit}`], dir)).ok)
+        return { diff: "", error: "no such commit" };
+    // Post-image paths of the commit: "M\0path\0", renames and copies as "R100\0old\0new\0".
+    const tree = await git(["diff-tree", "-r", "-M", "-z", "--root", "--name-status", hash], dir);
+    if (!tree.ok)
+        return { diff: "", error: tree.stderr || "git diff-tree failed" };
+    const parts = tree.stdout.split("\0");
+    const paths = [];
+    for (let i = 0; i < parts.length; i++) {
+        const status = parts[i];
+        if (!status || /^[0-9a-f]{40}$/.test(status))
+            continue; // the leading hash line of --root
+        const two = /^[RC]/.test(status);
+        const file = two ? parts[i + 2] : parts[i + 1];
+        if (file)
+            paths.push(file);
+        i += two ? 2 : 1;
+    }
+    const kept = paths.filter((f) => !DENY.some((re) => re.test(f)));
+    const hidden = paths.length - kept.length;
+    const format = "--format=commit %H%nAuthor: %an <%ae>%nDate:   %cI%n%n    %s%n";
+    if (kept.length === 0 && paths.length > 0) {
+        const head = await git(["show", "--no-patch", format, hash], dir);
+        return { diff: `${head.stdout}\n(${hidden} file${hidden === 1 ? "" : "s"} not shown: secret or key)\n` };
+    }
+    const r = await git(["show", "--stat", "--patch", format, hash, "--", ...kept.map(literal)], dir);
+    if (!r.ok)
+        return { diff: "", error: r.stderr || "git show failed" };
+    const out = capDiff(r.stdout);
+    if (hidden > 0)
+        out.diff += `\n(${hidden} file${hidden === 1 ? "" : "s"} not shown: secret or key)\n`;
+    return out;
+}
 /** Every clone under the root, alphabetically. Folders without .git are skipped. */
 export async function listRepos() {
     const opened = await openRepos();

package/dist/inspector/server.js

@@ -19,7 +19,7 @@ import { deleteAgentSkill, getSkill, listAgentSkills, listSkills, readSkill, sav
 import { discoverWorkspaces, forgetWorkspace, listWorkspacesDetailed, markWorkspaceStopped, registerInstance, registerWorkspace, startWorkspace, stopWorkspace, tildify, unregisterInstance, } from "./instances.js";
 import { gitCommit, gitDiff, gitFetch, gitPull, gitPush, gitStatus, startGitSync, } from "./git.js";
 import { getSettings, saveSettings } from "./settings.js";
-import { addRepo, listRepos, openRepos, removeRepo, updateRepo } from "./repos.js";
+import { addRepo, listRepos, openRepos, removeRepo, repoCommitDiff, repoDetail, repoDiff, updateRepo, } from "./repos.js";
 import { createVibeable, deleteVibeable, disposeAllDevs, listVibeables, openVibeables, proxyUpgrade, resolveVibeable, serveVibeable, startDev, stopDev, subscribeVibeable, vibeableStatus, } from "./vibeables.js";
 import { searchAgents } from "./search.js";
 import { appendProjectLog, createProject, deleteProject, getProject, linkProject, listProjects, openProjects, saveProject, } from "./projects.js";
@@ -583,6 +583,43 @@ async function handleApi(req, res, url) {
             return json(res, body, status);
         }
     }
+    const repoError = (err) => {
+        const msg = err.message;
+        return [/^no repository/.test(msg) ? 404 : /are off/.test(msg) ? 409 : 400, { error: msg }];
+    };
+    // GET /api/repos/<slug> — what is happening in the clone: changed files, line counts, recent commits (unpushed marked)
+    if (seg.length === 3 && seg[1] === "repos" && method === "GET") {
+        try {
+            const detail = await repoDetail(seg[2]);
+            return detail ? json(res, detail) : json(res, { error: `no repository "${seg[2]}"` }, 404);
+        }
+        catch (err) {
+            const [status, body] = repoError(err);
+            return json(res, body, status);
+        }
+    }
+    // GET /api/repos/<slug>/diff?path= — unified diff of one changed file against HEAD
+    if (seg.length === 4 && seg[1] === "repos" && seg[3] === "diff" && method === "GET") {
+        try {
+            const d = await repoDiff(seg[2], url.searchParams.get("path") ?? "");
+            return json(res, d, d.error ? (/^not shown/.test(d.error) ? 404 : 400) : 200);
+        }
+        catch (err) {
+            const [status, body] = repoError(err);
+            return json(res, body, status);
+        }
+    }
+    // GET /api/repos/<slug>/commits/<hash> — one commit as a patch
+    if (seg.length === 5 && seg[1] === "repos" && seg[3] === "commits" && method === "GET") {
+        try {
+            const d = await repoCommitDiff(seg[2], seg[4]);
+            return json(res, d, d.error ? (/^no such commit/.test(d.error) ? 404 : 400) : 200);
+        }
+        catch (err) {
+            const [status, body] = repoError(err);
+            return json(res, body, status);
+        }
+    }
     // POST /api/repos/<slug>/update — fetch, fast-forward when clean
     if (seg.length === 4 && seg[1] === "repos" && seg[3] === "update" && method === "POST") {
         try {

package/inspector/dist/assets/dist-BB5opUKX.js

@@ -0,0 +1 @@
+import{a as e}from"./editor-B5WUiag9.js";export{e as markdown};

package/inspector/dist/assets/{dist-CFvGR87v.js → dist-BV28M6sp.js}

@@ -1 +1 @@
-import{L as e,R as t,Ut as n,i as r,r as i,s as a,u as o}from"./dist-H3rerbMg.js";import{n as s}from"./dist-BIvcKBWo.js";import{r as c}from"./dist-tfmgozDB.js";var l=i.deserialize({version:14,states:"%pOVOWOOObQPOOOpOSO'#C_OOOO'#Cp'#CpQVOWOOQxQPOOO!TQQOOQ!YQPOOOOOO,58y,58yO!_OSO,58yOOOO-E6n-E6nO!dQQO'#CqQ{QPOOO!iQPOOQ{QPOOO!qQPOOOOOO1G.e1G.eOOQO,59],59]OOQO-E6o-E6oO!yOpO'#CiO#RO`O'#CiQOQPOOO#ZO#tO'#CmO#fO!bO'#CmOOQO,59T,59TO#qOpO,59TO#vO`O,59TOOOO'#Cr'#CrO#{O#tO,59XOOQO,59X,59XOOOO'#Cs'#CsO$WO!bO,59XOOQO1G.o1G.oOOOO-E6p-E6pOOQO1G.s1G.sOOOO-E6q-E6q",stateData:"$g~OjOS~OQROUROkQO~OWTOXUOZUO`VO~OSXOTWO~OXUO[]OlZO~OY^O~O[_O~OT`O~OYaO~OmcOodO~OmfOogO~O^iOnhO~O_jOphO~ObkOqkOrmO~OcnOsnOtmO~OnpO~OppO~ObkOqkOrrO~OcnOsnOtrO~OWX`~",goto:`!^hPPPiPPPPPPPPPmPPPpPPsy!Q!WTROSRe]Re_QSORYSS[T^Rb[QlfRqlQogRso`,nodeNames:`⚠ Content Text Interpolation InterpolationContent }} Entity Attribute VueAttributeName : Identifier @ Is ScriptAttributeValue AttributeScript AttributeScript AttributeName AttributeValue Entity Entity`,maxTerm:36,nodeProps:[[`isolate`,-3,3,13,17,``]],skippedNodes:[0],repeatNodeCount:4,tokenData:"'y~RdXY!aYZ!a]^!apq!ars!rwx!w}!O!|!O!P#t!Q![#y![!]$s!_!`%g!b!c%l!c!}#y#R#S#y#T#j#y#j#k%q#k#o#y%W;'S#y;'S;:j$m<%lO#y~!fSj~XY!aYZ!a]^!apq!a~!wOm~~!|Oo~!b#RX`!b}!O!|!Q![!|![!]!|!c!}!|#R#S!|#T#o!|%W;'S!|;'S;:j#n<%lO!|!b#qP;=`<%l!|~#yOl~%W$QXY#t`!b}!O!|!Q![#y![!]!|!c!}#y#R#S#y#T#o#y%W;'S#y;'S;:j$m<%lO#y%W$pP;=`<%l#y~$zXX~`!b}!O!|!Q![!|![!]!|!c!}!|#R#S!|#T#o!|%W;'S!|;'S;:j#n<%lO!|~%lO[~~%qOZ~%W%xXY#t`!b}!O&e!Q![#y![!]!|!c!}#y#R#S#y#T#o#y%W;'S#y;'S;:j$m<%lO#y!b&jX`!b}!O!|!Q![!|![!]!|!c!}'V#R#S!|#T#o'V%W;'S!|;'S;:j#n<%lO!|!b'^XW!b`!b}!O!|!Q![!|![!]!|!c!}'V#R#S!|#T#o'V%W;'S!|;'S;:j#n<%lO!|",tokenizers:[6,7,new r(`b~RP#q#rU~XP#q#r[~aOT~~`,17,4),new r("!k~RQvwX#o#p!_~^TU~Opmq!]m!^;'Sm;'S;=`!X<%lOm~pUOpmq!]m!]!^!S!^;'Sm;'S;=`!X<%lOm~!XOU~~![P;=`<%lm~!bP#o#p!e~!jOk~~",72,2),new r(`[~RPwxU~ZOp~~`,11,15),new r(`[~RPrsU~ZOn~~`,11,14),new r("!e~RQvwXwx!_~^Tc~Opmq!]m!^;'Sm;'S;=`!X<%lOm~pUOpmq!]m!]!^!S!^;'Sm;'S;=`!X<%lOm~!XOc~~![P;=`<%lm~!dOt~~",66,35),new r("!e~RQrsXvw^~^Or~~cTb~Oprq!]r!^;'Sr;'S;=`!^<%lOr~uUOprq!]r!]!^!X!^;'Sr;'S;=`!^<%lOr~!^Ob~~!aP;=`<%lr~",66,33)],topRules:{Content:[0,1],Attribute:[1,7]},tokenPrec:157}),u=c.parser.configure({top:`SingleExpression`}),d=l.configure({props:[e({Text:t.content,Is:t.definitionOperator,AttributeName:t.attributeName,VueAttributeName:t.keyword,Identifier:t.variableName,"AttributeValue ScriptAttributeValue":t.attributeValue,Entity:t.character,"{{ }}":t.brace,"@ :":t.punctuation})]}),f={parser:u},p=d.configure({wrap:n((e,t)=>e.name==`InterpolationContent`?f:null)}),m=d.configure({wrap:n((e,t)=>e.name==`AttributeScript`?f:null),top:`Attribute`}),h={parser:p},g={parser:m},_=s();function v(e){return e.configure({dialect:`selfClosing`,wrap:n(b)},`vue`)}var y=v(_.language);function b(e,t){switch(e.name){case`Attribute`:return/^(@|:|v-)/.test(t.read(e.from,e.from+2))?g:null;case`Text`:return h}return null}function x(e={}){let t=_;if(e.base){if(e.base.language.name!=`html`||!(e.base.language instanceof a))throw RangeError(`The base option must be the result of calling html(...)`);t=e.base}return new o(t.language==_.language?y:v(t.language),[t.support,t.language.data.of({closeBrackets:{brackets:[`{`,`"`]}})])}export{x as vue};
+import{L as e,R as t,Ut as n,i as r,r as i,s as a,u as o}from"./dist-H3rerbMg.js";import{n as s}from"./dist-Ca8OxgWP.js";import{r as c}from"./dist-DkEzjj-j.js";var l=i.deserialize({version:14,states:"%pOVOWOOObQPOOOpOSO'#C_OOOO'#Cp'#CpQVOWOOQxQPOOO!TQQOOQ!YQPOOOOOO,58y,58yO!_OSO,58yOOOO-E6n-E6nO!dQQO'#CqQ{QPOOO!iQPOOQ{QPOOO!qQPOOOOOO1G.e1G.eOOQO,59],59]OOQO-E6o-E6oO!yOpO'#CiO#RO`O'#CiQOQPOOO#ZO#tO'#CmO#fO!bO'#CmOOQO,59T,59TO#qOpO,59TO#vO`O,59TOOOO'#Cr'#CrO#{O#tO,59XOOQO,59X,59XOOOO'#Cs'#CsO$WO!bO,59XOOQO1G.o1G.oOOOO-E6p-E6pOOQO1G.s1G.sOOOO-E6q-E6q",stateData:"$g~OjOS~OQROUROkQO~OWTOXUOZUO`VO~OSXOTWO~OXUO[]OlZO~OY^O~O[_O~OT`O~OYaO~OmcOodO~OmfOogO~O^iOnhO~O_jOphO~ObkOqkOrmO~OcnOsnOtmO~OnpO~OppO~ObkOqkOrrO~OcnOsnOtrO~OWX`~",goto:`!^hPPPiPPPPPPPPPmPPPpPPsy!Q!WTROSRe]Re_QSORYSS[T^Rb[QlfRqlQogRso`,nodeNames:`⚠ Content Text Interpolation InterpolationContent }} Entity Attribute VueAttributeName : Identifier @ Is ScriptAttributeValue AttributeScript AttributeScript AttributeName AttributeValue Entity Entity`,maxTerm:36,nodeProps:[[`isolate`,-3,3,13,17,``]],skippedNodes:[0],repeatNodeCount:4,tokenData:"'y~RdXY!aYZ!a]^!apq!ars!rwx!w}!O!|!O!P#t!Q![#y![!]$s!_!`%g!b!c%l!c!}#y#R#S#y#T#j#y#j#k%q#k#o#y%W;'S#y;'S;:j$m<%lO#y~!fSj~XY!aYZ!a]^!apq!a~!wOm~~!|Oo~!b#RX`!b}!O!|!Q![!|![!]!|!c!}!|#R#S!|#T#o!|%W;'S!|;'S;:j#n<%lO!|!b#qP;=`<%l!|~#yOl~%W$QXY#t`!b}!O!|!Q![#y![!]!|!c!}#y#R#S#y#T#o#y%W;'S#y;'S;:j$m<%lO#y%W$pP;=`<%l#y~$zXX~`!b}!O!|!Q![!|![!]!|!c!}!|#R#S!|#T#o!|%W;'S!|;'S;:j#n<%lO!|~%lO[~~%qOZ~%W%xXY#t`!b}!O&e!Q![#y![!]!|!c!}#y#R#S#y#T#o#y%W;'S#y;'S;:j$m<%lO#y!b&jX`!b}!O!|!Q![!|![!]!|!c!}'V#R#S!|#T#o'V%W;'S!|;'S;:j#n<%lO!|!b'^XW!b`!b}!O!|!Q![!|![!]!|!c!}'V#R#S!|#T#o'V%W;'S!|;'S;:j#n<%lO!|",tokenizers:[6,7,new r(`b~RP#q#rU~XP#q#r[~aOT~~`,17,4),new r("!k~RQvwX#o#p!_~^TU~Opmq!]m!^;'Sm;'S;=`!X<%lOm~pUOpmq!]m!]!^!S!^;'Sm;'S;=`!X<%lOm~!XOU~~![P;=`<%lm~!bP#o#p!e~!jOk~~",72,2),new r(`[~RPwxU~ZOp~~`,11,15),new r(`[~RPrsU~ZOn~~`,11,14),new r("!e~RQvwXwx!_~^Tc~Opmq!]m!^;'Sm;'S;=`!X<%lOm~pUOpmq!]m!]!^!S!^;'Sm;'S;=`!X<%lOm~!XOc~~![P;=`<%lm~!dOt~~",66,35),new r("!e~RQrsXvw^~^Or~~cTb~Oprq!]r!^;'Sr;'S;=`!^<%lOr~uUOprq!]r!]!^!X!^;'Sr;'S;=`!^<%lOr~!^Ob~~!aP;=`<%lr~",66,33)],topRules:{Content:[0,1],Attribute:[1,7]},tokenPrec:157}),u=c.parser.configure({top:`SingleExpression`}),d=l.configure({props:[e({Text:t.content,Is:t.definitionOperator,AttributeName:t.attributeName,VueAttributeName:t.keyword,Identifier:t.variableName,"AttributeValue ScriptAttributeValue":t.attributeValue,Entity:t.character,"{{ }}":t.brace,"@ :":t.punctuation})]}),f={parser:u},p=d.configure({wrap:n((e,t)=>e.name==`InterpolationContent`?f:null)}),m=d.configure({wrap:n((e,t)=>e.name==`AttributeScript`?f:null),top:`Attribute`}),h={parser:p},g={parser:m},_=s();function v(e){return e.configure({dialect:`selfClosing`,wrap:n(b)},`vue`)}var y=v(_.language);function b(e,t){switch(e.name){case`Attribute`:return/^(@|:|v-)/.test(t.read(e.from,e.from+2))?g:null;case`Text`:return h}return null}function x(e={}){let t=_;if(e.base){if(e.base.language.name!=`html`||!(e.base.language instanceof a))throw RangeError(`The base option must be the result of calling html(...)`);t=e.base}return new o(t.language==_.language?y:v(t.language),[t.support,t.language.data.of({closeBrackets:{brackets:[`{`,`"`]}})])}export{x as vue};