@open-mercato/cezar 0.9.0-pr613.619 → 0.9.0-pr613.643

package/README.md

@@ -434,6 +434,7 @@ Useful environment variables:
 | `CEZ_OPENCODE_BIN=/path/to/opencode` | Override which `opencode` binary is used. |
 | `CEZ_BROWSE_ROOT=~/` | Default root for **Add project → Open local folder…**. The picker cannot navigate above it; a saved workspace value overrides the environment default and must name an existing folder. |
 | `CEZ_PROJECTS_DIR=~/cezar/projects` | Default destination for **Clone from GitHub**. Saved workspace settings override it, and missing directories are created recursively. |
+| `CEZ_SKILLS_AUTO_UPDATE=0` | Disable automatic checks and updates for upstream-CLI-tracked Open Mercato skill installations. On by default; a saved global Skills setting overrides this environment default. Checks are delayed, bounded, cached, and non-blocking. |
 | `GITHUB_TOKEN` | Fallback for GitHub reads/PRs when `gh` isn't authenticated. |
 | `CEZ_ENV_PASSTHROUGH=A,B` | Forward these extra host env vars to spawned agents. By default agents get a least-privilege env (safe shell/toolchain vars + the backend's own auth + `GITHUB_TOKEN` + `CEZ_*`), not your full environment — use this to add a var an agent needs. |
 | `CEZ_AGENT_ENV_FULL=1` | Escape hatch: give spawned agents the full host environment (pre-hardening behavior). Off by default; only set it if you understand that this hands every host secret to the agent process. |

package/dist/server/server.d.ts

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { type ServerType } from '@hono/node-server';
 import { RunnerModelCatalog } from '../core/runner-model-catalog.js';
+import { SkillsUpdateService } from '../skills-update.js';
 import type { RunRecord, RunStatus, RunStore } from '../runs/store.js';
 import type { RunManager } from '../workflows/run.js';
 import { type ProjectListEntry } from '../workspace/projects.js';
@@ -51,6 +52,9 @@ export interface ServerDeps {
     cloneRunner?: CloneRunner;
     /** Host-wide model discovery service. Tests inject a deterministic adapter. */
     modelCatalog?: RunnerModelCatalog;
+    /** Process-wide Open Mercato skills update detector. Injected in tests and
+     * shared by every workspace route/project; createApp owns the default. */
+    skillsUpdate?: SkillsUpdateService;
 }
 /** One row of the mirrored project-route table. */
 export interface ProjectRouteInfo {
@@ -122,6 +126,9 @@ export interface WorkspaceConfigResponse {
     browseRoot: string;
     /** Checkout root for GUI-cloned projects — stored as written (`~` kept). */
     projectsDir: string;
+    /** Stored override; null means inherit CEZ_SKILLS_AUTO_UPDATE, then true. */
+    skillsAutoUpdate: boolean | null;
+    effectiveSkillsAutoUpdate: boolean;
     resources: {
         maxParallel: number;
         memoryLimitMb: number | null;

package/dist/server/server.js

@@ -16,6 +16,7 @@ import { WORKFLOWS_DIR, loadWorkflows } from '../workflows/load.js';
 import { QUICK_TASK_WORKFLOW, normalizeWorkflowDoc, skillStackOf, skillsToSteps, stepsIssue, workflowFileSchema, workflowStepSchema, } from '../workflows/types.js';
 import { planChain, slugify } from '../planner.js';
 import { discoverSkills } from '../skills.js';
+import { SkillsUpdateConflictError, SkillsUpdateCoordinator, SkillsUpdateService } from '../skills-update.js';
 import { getTeamSkillsCached, refreshTeamSkills, waitForTeamSkills } from '../skills-remote.js';
 import { appendHandoffHeartbeat, handoffProgressExcerpt, readHandoff } from '../handoff.js';
 import { markStarted, onTodosChanged, readTodos, removeTodo, todoTaskText } from '../todos.js';
@@ -28,7 +29,7 @@ import { gatedSkillsRepos, loadConfig, resolveWorktreeRetention } from '../confi
 import { findConfigFile } from '../agent-config/catalog.js';
 import { readConfigFile, writeConfigFile } from '../agent-config/files.js';
 import { listAgentConfig } from '../agent-config/service.js';
-import { PROJECT_ID_RE, defaultWorkspaceConfig, loadWorkspaceConfig, mergeWriteWorkspaceConfig, } from '../workspace/config.js';
+import { PROJECT_ID_RE, defaultWorkspaceConfig, effectiveSkillsAutoUpdate, loadWorkspaceConfig, mergeWriteWorkspaceConfig, } from '../workspace/config.js';
 import { allocateProjectSlug, listProjects, probeProjectStatus, registerProject, removeProject, shouldRegisterProject, } from '../workspace/projects.js';
 import { mergeWriteWorkspaceUiState, readWorkspaceUiState } from '../workspace/ui-state.js';
 import { checkoutRepo } from './checkout.js';
@@ -477,6 +478,7 @@ export function createApp(deps) {
     const modelCatalog = deps.modelCatalog ?? new RunnerModelCatalog({
         adapters: { codex: { discover: () => discoverCodexModels({ cwd: bootRoot }) } },
     });
+    const skillsUpdate = deps.skillsUpdate ?? new SkillsUpdateService();
     // ---- workspace boot-project identity (multi-project spec) ----------------
     // The boot flow (`initWorkspace` in src/index.ts) registers the boot repo
     // and plumbs its registry id in via `deps.bootProjectId`. Legacy callers and
@@ -1053,6 +1055,64 @@ export function createApp(deps) {
         const body = { removed: true, id };
         return c.json(body);
     });
+    // Workspace-level by design: update state spans project and global installs,
+    // but the selected registered project supplies the safe, server-owned cwd.
+    const skillsUpdateInputSchema = z.object({ projectId: projectIdSchema }).strict();
+    const resolveSkillsUpdateRoot = async (raw) => {
+        if (!projectIdSchema.safeParse(raw).success)
+            return { status: 404, error: `unknown project: ${raw}` };
+        const bootId = await resolveBootProject();
+        if (raw === 'default' || raw === bootId)
+            return { root: bootRoot };
+        const project = (await loadWorkspaceConfig()).projects.find((entry) => entry.id === raw);
+        if (!project)
+            return { status: 404, error: `unknown project: ${raw}` };
+        if ((await probeProjectStatus(project.root)).status === 'missing') {
+            return { status: 409, error: `project folder not found: ${raw}` };
+        }
+        return { root: project.root };
+    };
+    const skillsUpdateResponse = async (state) => {
+        const config = await loadWorkspaceConfig();
+        return { ...state, autoUpdateEnabled: effectiveSkillsAutoUpdate(config), inherited: config.skillsAutoUpdate === undefined };
+    };
+    app.get('/api/workspace/skills-update', async (c) => {
+        const parsed = skillsUpdateInputSchema.safeParse({ projectId: c.req.query('projectId') });
+        if (!parsed.success)
+            return c.json({ error: 'projectId is required' }, 400);
+        const resolved = await resolveSkillsUpdateRoot(parsed.data.projectId);
+        if ('error' in resolved)
+            return c.json({ error: resolved.error }, resolved.status);
+        const state = skillsUpdate.snapshot(resolved.root);
+        void skillsUpdate.check(resolved.root).catch(() => { });
+        return c.json(await skillsUpdateResponse(state));
+    });
+    app.post('/api/workspace/skills-update/check', async (c) => {
+        const parsed = skillsUpdateInputSchema.safeParse(await c.req.json().catch(() => null));
+        if (!parsed.success)
+            return c.json({ error: 'body must contain only projectId' }, 400);
+        const resolved = await resolveSkillsUpdateRoot(parsed.data.projectId);
+        if ('error' in resolved)
+            return c.json({ error: resolved.error }, resolved.status);
+        return c.json(await skillsUpdateResponse(await skillsUpdate.check(resolved.root, true)));
+    });
+    app.post('/api/workspace/skills-update/apply', async (c) => {
+        const parsed = skillsUpdateInputSchema.safeParse(await c.req.json().catch(() => null));
+        if (!parsed.success)
+            return c.json({ error: 'body must contain only projectId' }, 400);
+        const resolved = await resolveSkillsUpdateRoot(parsed.data.projectId);
+        if ('error' in resolved)
+            return c.json({ error: resolved.error }, resolved.status);
+        try {
+            return c.json(await skillsUpdateResponse(await skillsUpdate.update(resolved.root, true)));
+        }
+        catch (error) {
+            if (error instanceof SkillsUpdateConflictError) {
+                return c.json({ error: 'another skills update operation is running', state: await skillsUpdateResponse(skillsUpdate.snapshot(resolved.root)) }, 409);
+            }
+            throw error;
+        }
+    });
     // ---- GUI clone (multi-project spec, step 4.3) ----------------------------
     // "Add project → Clone from GitHub": clone into the checkout root, then
     // register the result through `registerFolder` above (same guards, same
@@ -1110,6 +1170,8 @@ export function createApp(deps) {
     const workspaceConfigBody = (config) => ({
         browseRoot: config.browseRoot,
         projectsDir: config.projectsDir,
+        skillsAutoUpdate: config.skillsAutoUpdate ?? null,
+        effectiveSkillsAutoUpdate: effectiveSkillsAutoUpdate(config),
         resources: {
             maxParallel: config.resources.maxParallel,
             memoryLimitMb: config.resources.memoryLimitMb,
@@ -1123,6 +1185,7 @@ export function createApp(deps) {
     const workspaceConfigUpdateSchema = z.object({
         browseRoot: z.string().trim().min(1).max(4096).optional(),
         projectsDir: z.string().trim().min(1).max(4096).optional(),
+        skillsAutoUpdate: z.boolean().nullable().optional(),
         resources: z
             .object({
             maxParallel: z.number().int().min(1).max(16).optional(),
@@ -1136,7 +1199,7 @@ export function createApp(deps) {
         if (!parsed.success) {
             return c.json({ error: parsed.error.issues.map((i) => i.message).join('; ') }, 400);
         }
-        const { browseRoot, projectsDir, resources } = parsed.data;
+        const { browseRoot, projectsDir, skillsAutoUpdate, resources } = parsed.data;
         for (const [configuredRoot, create] of [
             [browseRoot, false],
             [projectsDir, true],
@@ -1175,6 +1238,10 @@ export function createApp(deps) {
                     config.browseRoot = browseRoot;
                 if (projectsDir !== undefined)
                     config.projectsDir = projectsDir;
+                if (skillsAutoUpdate === null)
+                    delete config.skillsAutoUpdate;
+                else if (skillsAutoUpdate !== undefined)
+                    config.skillsAutoUpdate = skillsAutoUpdate;
                 if (resources?.maxParallel !== undefined)
                     config.resources.maxParallel = resources.maxParallel;
                 if (resources?.memoryLimitMb !== undefined)
@@ -2836,17 +2903,42 @@ export function createApp(deps) {
     return app;
 }
 export function startServer(deps, port) {
-    const app = createApp(deps);
+    const workspaceEvents = deps.workspaceEvents ?? new WorkspaceEventBus();
+    const skillsUpdate = deps.skillsUpdate ?? new SkillsUpdateService({ invalidateCatalog: refreshTeamSkills });
+    const app = createApp({ ...deps, workspaceEvents, skillsUpdate });
     // SECURITY: default to loopback. This server executes agents locally and its endpoints are
     // same-origin-trusted (only /api/health is CORS-open); binding to a non-loopback host would
     // expose an agent-executing box to the network. `bindHost` exists only for a deliberate
     // hosted/VPS deployment (which also flips CEZ_REMOTE to gate the local-handoff endpoints) —
     // src/index.ts never passes it, so the loopback guarantee holds for the normal CLI.
-    return serve({
+    const server = serve({
         fetch: app.fetch,
         port,
         hostname: deps.bindHost ?? '127.0.0.1',
     });
+    const coordinator = new SkillsUpdateCoordinator(skillsUpdate, async () => effectiveSkillsAutoUpdate(await loadWorkspaceConfig()));
+    const unsubscribe = workspaceEvents.on((event, data) => {
+        if (event === 'project-added') {
+            const project = data.project;
+            if (project && typeof project.id === 'string' && typeof project.root === 'string' && project.status !== 'missing') {
+                coordinator.add(project.id, project.root);
+            }
+        }
+        else if (event === 'project-removed') {
+            const id = data.id;
+            if (typeof id === 'string')
+                coordinator.remove(id);
+        }
+    });
+    server.once('listening', () => {
+        void listProjects().then((projects) => {
+            const all = projects.some((project) => project.root === deps.repoRoot)
+                ? projects : [{ id: deps.bootProjectId ?? 'default', root: deps.repoRoot, status: 'ok' }, ...projects];
+            coordinator.start(all);
+        }).catch(() => undefined);
+    });
+    server.once('close', () => { unsubscribe(); coordinator.stop(); });
+    return server;
 }
 /** The bare hostname of a `Host` header — see `normalizeHostname`. `''` when the
  *  header is absent, which no allowlist matches. */