@ordewell/web 0.10.11 → 0.11.0

package/AUTHORS.md

@@ -0,0 +1,37 @@
+# Authors
+
+Ordewell is copyright 2026 Alessandro Costanzo Ciano and the Ordewell
+contributors, and is released under the Apache License 2.0 (see [LICENSE](LICENSE)).
+
+This repository starts from a single commit. The project was developed over a
+longer private history, and that history is not published — so this file is the
+record of who built what, rather than `git log`.
+
+## Author and maintainer
+
+- **Alessandro Costanzo Ciano** ([@ac-ciano](https://github.com/ac-ciano)) —
+  author, maintainer and copyright owner. Wrote the core, the planner, the
+  orchestrator, the verification engine, the VS Code extension, the terminal UI
+  and the API server.
+
+## Contributors
+
+- **Luca Palumbo** ([@LucaPalumbo](https://github.com/LucaPalumbo)) — strict
+  typing across the monorepo, the ESLint configuration, and the original CI
+  workflow.
+- [@directsol](https://github.com/directsol) — verified the Codex transcript
+  reader against a live rollout store (#16) and made the VS Code chat panel
+  follow light themes (#20).
+- **Mayuri** ([@mayuriphad](https://github.com/mayuriphad)) — diagnosed and fixed the
+  planner's duplicated usage-limit message (#79, #96).
+- [@haltingstate](https://github.com/haltingstate) — made the terminal UI's
+  stepper say what a saved step does next, instead of encoding it in a
+  sentinel index (#123).
+
+Thank you. Contributions are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Acknowledgements
+
+The deep-interview planning workflows — `grill-me`, PRD drafting, and TDD task
+augmentation — are adapted from
+[Matt Pocock's skills](https://github.com/mattpocock/skills) (MIT).

package/NOTICE

@@ -0,0 +1,71 @@
+Ordewell
+Copyright 2026 Alessandro Costanzo Ciano and the Ordewell contributors
+
+This product includes software developed by Alessandro Costanzo Ciano and the
+Ordewell contributors, licensed under the Apache License, Version 2.0. See the
+LICENSE file for the full terms, and AUTHORS.md for who contributed.
+
+--------------------------------------------------------------------------------
+TRADEMARKS AND BRAND ASSETS
+--------------------------------------------------------------------------------
+
+The Apache License grants rights to the *software*. It does not grant rights to
+the project's identity, and Section 6 of that License explicitly withholds them.
+
+The name "Ordewell", the Ordewell wordmark, and the Ordewell logos — including
+the image files distributed in `assets/readme/` and `packages/vscode/media/` —
+are not licensed under Apache-2.0 and remain the property of Alessandro
+Costanzo Ciano.
+
+You may:
+
+  - Use the name and logos to refer to this project accurately, including in
+    articles, talks, comparisons, and package listings.
+  - Redistribute the project unmodified, brand assets included.
+
+You may not, without written permission:
+
+  - Use the name or logos for a modified or derivative distribution in a way
+    that suggests it is the official Ordewell, or that it is endorsed by or
+    affiliated with this project.
+  - Use them as, or as part of, your own product name, company name, domain
+    name, or logo.
+
+If you fork and rebrand, replace the assets in `assets/readme/` and
+`packages/vscode/media/`. If you are unsure whether a use is fine, ask —
+the answer is usually yes.
+
+--------------------------------------------------------------------------------
+THIRD-PARTY ATTRIBUTION
+--------------------------------------------------------------------------------
+
+The deep-interview planning workflows (`grill-me`, PRD drafting, and TDD task
+augmentation) are adapted from Matt Pocock's skills
+(https://github.com/mattpocock/skills), licensed MIT, and rebuilt as prompt
+blocks inside Ordewell's planner and runner prompts. The MIT licence requires
+its notice to travel with derivative works, so it is reproduced in full here:
+
+    MIT License
+
+    Copyright (c) 2026 Matt Pocock
+
+    Permission is hereby granted, free of charge, to any person obtaining a
+    copy of this software and associated documentation files (the "Software"),
+    to deal in the Software without restriction, including without limitation
+    the rights to use, copy, modify, merge, publish, distribute, sublicense,
+    and/or sell copies of the Software, and to permit persons to whom the
+    Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+    DEALINGS IN THE SOFTWARE.
+
+Runtime dependencies carry their own licences; see the `node_modules` tree of
+an installed copy, or each package's entry on npm.

package/README.md

@@ -1,8 +1,9 @@
 # @ordewell/web
 
 The local API server for **[Ordewell](https://ordewell.ai)**: a Hono HTTP +
-WebSocket daemon bound to `127.0.0.1:3742` that the Ordewell CLI, terminal UI
-and VS Code extension all drive.
+WebSocket daemon bound to `127.0.0.1:3742` that the Ordewell CLI and terminal UI
+drive. The VS Code extension does not use it: it runs core's `Session`
+in-process, and the two share the saved-session store in `.ordewell/sessions/`.
 
 **This is not a website, and it has no frontend.** It serves JSON. Opening the
 port in a browser will show you an API response, not a dashboard. A browser UI
@@ -14,23 +15,30 @@ starts it on demand.
 
 ```bash
 ordewell web            # foreground
-ordewell web --daemon   # background; logs to ~/.config/ordewell/server.log
+ordewell web --daemon   # background; logs to ~/.ordewell/server.log
 ```
 
 ## Routes
 
 `/api/sessions`, `/api/plans`, `/api/runners`, `/api/models`, `/api/settings`,
 `/api/commands`, `/api/workspaces`, `/api/approvals`, plus a WebSocket stream
-for live planner and execution events.
+for live planner and execution events. Execution controls (run, stop or retry a
+task, skip, mark complete, message) are one `POST /api/plans/:id/execute-command`
+whose body is core's `ExecutionCommand`. Mark complete and Mark not done on an
+AI or script task are refused while a run could advance the task, and otherwise
+need `"confirmed": true`, the user's yes (with `"seen"`, the task status they
+were asked about); a manual task's sign-off needs neither.
 
 Skills are read by the planner and the task orchestrator, not served as a
 route; the format is in [Writing skills](https://github.com/ordewell/ordewell/blob/main/docs/skills.md).
 
 ## Security
 
-The server is **unauthenticated by design** and binds the loopback interface
-only, on the assumption that local access is trusted. Do not expose it to a
-network. If you find a way to reach it off-host, or from a browser page, that's
+The server binds the loopback interface only, and admits a request only when it
+carries the bearer token minted at startup (clients read it from
+`~/.ordewell/server-<port>.token`), names a loopback `Host` at the daemon's own
+port, and carries no `Origin` header. Local access is **not** assumed to be
+trusted. If you find a way to reach it off-host, or from a browser page, that's
 a vulnerability; see
 [SECURITY.md](https://github.com/ordewell/ordewell/blob/main/SECURITY.md).