@ordewell/web 0.4.0

package/dist/server/main.js

@@ -0,0 +1,1159 @@
+#!/usr/bin/env node
+'use strict';
+
+var hono = require('hono');
+var cors = require('hono/cors');
+var core = require('@ordewell/core');
+var fs = require('fs');
+var path = require('path');
+var child_process = require('child_process');
+var ws = require('ws');
+var http = require('http');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var fs__namespace = /*#__PURE__*/_interopNamespace(fs);
+var path__namespace = /*#__PURE__*/_interopNamespace(path);
+
+var WebConfig = class extends core.BaseConfig {
+  _provider = null;
+  _enabledRunnersOverride;
+  _providerModelLists;
+  _modelOverride;
+  constructor(opts) {
+    super();
+    this._enabledRunnersOverride = opts?.enabledRunners;
+    this._providerModelLists = opts?.providerModelLists;
+    this._modelOverride = opts?.modelOverride;
+  }
+  setProviderModelLists(lists) {
+    this._providerModelLists = lists;
+    this._provider = null;
+  }
+  get orchestratorModel() {
+    return this._modelOverride || process.env.ORCHESTRATOR_MODEL || "";
+  }
+  get aiProvider() {
+    if (this._provider) return this._provider;
+    const explicit = process.env.AI_PROVIDER;
+    if (explicit && core.isCliProvider(explicit)) {
+      this._provider = explicit;
+      return this._provider;
+    }
+    const model = this._modelOverride || process.env.ORCHESTRATOR_MODEL;
+    if (model && this._providerModelLists) {
+      const resolved = core.resolveProvider(model, this._providerModelLists);
+      if (resolved) {
+        this._provider = resolved;
+        return this._provider;
+      }
+    }
+    this._provider = core.BaseConfig.detectProvider("openrouter");
+    return this._provider;
+  }
+  get apiKey() {
+    return this.getProviderApiKey(this.aiProvider);
+  }
+  get planningModel() {
+    if (this.aiProvider === "google")
+      return core.normalizeGeminiModel(process.env.GEMINI_MODEL || process.env.ORCHESTRATOR_MODEL || super.geminiModel);
+    return process.env.ORCHESTRATOR_MODEL || "";
+  }
+  get enabledRunners() {
+    if (this._enabledRunnersOverride) return this._enabledRunnersOverride;
+    const envRunners = process.env.ORDEWELL_ENABLED_RUNNERS;
+    if (envRunners) {
+      const parsed = envRunners.split(",").map((s) => s.trim()).filter(Boolean);
+      if (parsed.length > 0) return parsed;
+    }
+    const out = [];
+    if (process.env.ORDEWELL_CLAUDE_CODE_ENABLED !== "false" && process.env.ORDEWELL_CLAUDE_CODE_ENABLED !== "0") {
+      out.push("claude-code");
+    }
+    if (process.env.ORDEWELL_CODEX_ENABLED === "true" || process.env.ORDEWELL_CODEX_ENABLED === "1") {
+      out.push("codex");
+    }
+    if (process.env.ORDEWELL_OPENCODE_ENABLED === "true" || process.env.ORDEWELL_OPENCODE_ENABLED === "1") {
+      out.push("opencode");
+    }
+    return out.length > 0 ? out : ["claude-code"];
+  }
+};
+function scanWorkspacesImpl(deps) {
+  const { fsModule, pathModule, cwd, home, projectDir } = deps;
+  const paths = /* @__PURE__ */ new Set();
+  const searchRoots = [
+    cwd,
+    home,
+    pathModule.join(home, "projects"),
+    pathModule.join(home, "dev"),
+    pathModule.join(home, "code"),
+    pathModule.join(home, "src"),
+    pathModule.join(home, "Desktop"),
+    pathModule.join(home, "Documents")
+  ];
+  for (const root of searchRoots) {
+    try {
+      if (fsModule.existsSync(pathModule.join(root, ".ordewell"))) paths.add(root);
+      const entries = fsModule.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory());
+      for (const e of entries.slice(0, 50)) {
+        const sub = pathModule.join(root, e.name);
+        if (fsModule.existsSync(pathModule.join(sub, ".ordewell"))) paths.add(sub);
+      }
+    } catch {
+    }
+  }
+  return [...paths].filter((p) => p !== pathModule.resolve(projectDir)).sort();
+}
+function scanWorkspaces() {
+  return scanWorkspacesImpl({
+    fsModule: fs__namespace,
+    pathModule: path__namespace,
+    cwd: process.cwd(),
+    home: process.env.HOME || "/root",
+    projectDir: path__namespace.resolve(__dirname, "..", "..", "..", "..")
+  });
+}
+var MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+function run(file, args2, opts) {
+  return new Promise((resolve2) => {
+    try {
+      child_process.execFile(file, args2, {
+        cwd: opts.cwd,
+        timeout: opts.timeout,
+        maxBuffer: MAX_OUTPUT_BYTES,
+        encoding: "utf8",
+        shell: opts.shell,
+        env: opts.env
+      }, (err, stdout, stderr) => {
+        const code = err && typeof err.code === "number" ? err.code : err ? 1 : 0;
+        resolve2({ stdout: stdout ?? "", stderr: stderr ?? "", code });
+      });
+    } catch (err) {
+      resolve2({ stdout: "", stderr: err.message, code: null });
+    }
+  });
+}
+
+// server/adapters/PoolFileSystem.ts
+var SEARCH_TIMEOUT_MS = 2e4;
+var BASH_TIMEOUT_MS = 12e4;
+var PoolFileSystem = class extends core.BaseFileSystem {
+  constructor(workspaceRoot) {
+    super();
+    this.workspaceRoot = workspaceRoot;
+  }
+  workspaceRoot;
+  getWorkspaceRoot() {
+    return this.workspaceRoot;
+  }
+  /**
+   * PATH for the search subprocesses. `execFile` starts them with no shell, so
+   * on a Windows box whose POSIX tools live in the Git tree (`grep.exe` beside
+   * the research shell) they are only resolvable with that directory prepended.
+   * Identity on POSIX, where `utilsDir` is null. Kept in step with
+   * VsCodeFileSystem.searchEnv.
+   */
+  searchEnv() {
+    const resolved = core.researchToolsPath(this.researchShell, process.env.PATH);
+    return resolved === (process.env.PATH ?? "") ? void 0 : core.withPath(process.env, resolved);
+  }
+  rgAvailable = null;
+  hasRg() {
+    this.rgAvailable ??= run("rg", ["--version"], { timeout: 5e3, env: this.searchEnv() }).then((r) => r.code === 0).catch(() => false);
+    return this.rgAvailable;
+  }
+  async readFileImpl(absPath, opts) {
+    try {
+      const stat = await fs.promises.stat(absPath);
+      if (!stat.isFile()) return { success: false, output: `Not a file: ${absPath}`, truncated: false };
+      const maxBytes = opts?.maxBytes ?? 1024;
+      if (stat.size > maxBytes * 1024) {
+        const sizeMB = (stat.size / (1024 * 1024)).toFixed(1);
+        return {
+          success: true,
+          output: `File too large (${sizeMB} MB). Maximum is ${maxBytes} KB. Use grep to search for specific patterns instead.`,
+          truncated: false
+        };
+      }
+      const content = await fs.promises.readFile(absPath, "utf8");
+      const allLines = content.split("\n");
+      if (allLines.length > 0 && allLines[allLines.length - 1] === "") allLines.pop();
+      const totalLines = allLines.length;
+      const startLine = opts?.offset ?? 0;
+      const maxLines = opts?.limit ?? 2e3;
+      if (startLine >= totalLines) return { success: true, output: "", truncated: false };
+      const selectedLines = allLines.slice(startLine, startLine + maxLines);
+      const truncated = startLine + maxLines < totalLines;
+      const lineWidth = String(totalLines).length;
+      let output = selectedLines.map((line, i) => {
+        const lineNum = String(startLine + i + 1).padStart(lineWidth);
+        return `${lineNum}|${line}`;
+      }).join("\n");
+      if (truncated) {
+        const nextOffset = startLine + maxLines;
+        output += `
+
+(File has more lines \u2014 use offset=${nextOffset} to read beyond line ${nextOffset})
+`;
+      }
+      return { success: true, output, truncated };
+    } catch (err) {
+      return { success: false, output: `Error reading ${absPath}: ${err.message}`, truncated: false };
+    }
+  }
+  async globImpl(pattern, absRoot, headLimit) {
+    if (await this.hasRg()) {
+      const anchor = await this.searchAnchor(absRoot);
+      const result2 = await run("rg", core.buildGlobArgs(pattern, absRoot), { timeout: SEARCH_TIMEOUT_MS, cwd: anchor, env: this.searchEnv() });
+      if (result2.code !== 0 && result2.code !== 1 && !result2.stdout) {
+        return { success: false, output: `Glob failed: ${result2.stderr.trim() || "ripgrep error"}`, truncated: false };
+      }
+      const capped2 = core.applyHeadLimit(result2.stdout, headLimit);
+      return {
+        success: true,
+        output: core.formatSearchOutput(capped2, anchor, { emptyMessage: "No files matched.", hint: "Narrow the pattern." }),
+        truncated: capped2.truncated
+      };
+    }
+    const basename = pattern.split("/").pop() || pattern;
+    const excludeArgs = core.SEARCH_EXCLUSIONS.flatMap((dir) => ["-not", "-path", `*/${dir}/*`]);
+    const result = await run("find", [absRoot, "-type", "f", "-name", basename, ...excludeArgs], { timeout: SEARCH_TIMEOUT_MS, env: this.searchEnv() });
+    if (result.code !== 0 && !result.stdout) {
+      return { success: false, output: `Glob failed: ${result.stderr.trim() || "find error"}`, truncated: false };
+    }
+    const capped = core.applyHeadLimit(result.stdout, headLimit);
+    return {
+      success: true,
+      output: core.formatSearchOutput(capped, absRoot, { emptyMessage: "No files matched." }),
+      truncated: capped.truncated
+    };
+  }
+  /**
+   * A directory to anchor a search in. `cwd` exists only so anchored
+   * `--glob`/`--include` patterns resolve against the search root (see
+   * globImpl), and spawn(2) rejects a `cwd` that is a file with ENOTDIR.
+   *
+   * `grep`'s `path` is documented as a directory, but the tool description
+   * tells the model to survey with output_mode="files" and then re-run "on a
+   * narrower path" — and what that survey hands back are files. rg and grep
+   * both search a single file happily, so anchor at the parent rather than
+   * failing a legitimately file-scoped search.
+   */
+  async searchAnchor(absRoot) {
+    try {
+      return (await fs.promises.stat(absRoot)).isDirectory() ? absRoot : path__namespace.dirname(absRoot);
+    } catch {
+      return absRoot;
+    }
+  }
+  async grepImpl(pattern, absRoot, opts) {
+    const headLimit = opts.headLimit ?? 100;
+    const useRg = await this.hasRg();
+    const anchor = await this.searchAnchor(absRoot);
+    const anchoredInclude = !useRg && opts.include?.includes("/") ? opts.include : void 0;
+    const result = useRg ? await run("rg", core.buildGrepArgs(pattern, opts, absRoot).args, { timeout: SEARCH_TIMEOUT_MS, cwd: anchor, env: this.searchEnv() }) : await run("grep", core.buildFallbackGrepArgs(pattern, anchoredInclude ? { ...opts, include: void 0 } : opts, absRoot), { timeout: SEARCH_TIMEOUT_MS, cwd: anchor, env: this.searchEnv() });
+    if (result.code !== 0 && result.code !== 1 && !result.stdout) {
+      return { success: false, output: `Search failed: ${result.stderr.trim() || "search error"}`, truncated: false };
+    }
+    const filteredStdout = anchoredInclude ? core.filterFallbackByAnchoredInclude(result.stdout, anchoredInclude, anchor, opts.outputMode) : result.stdout;
+    const capped = core.applyHeadLimit(filteredStdout, headLimit);
+    const hint = opts.outputMode === "content" ? 'Re-run with output_mode="files" to see the full breadth, or narrow with include/path.' : "Narrow with include/path.";
+    return {
+      success: true,
+      output: core.formatSearchOutput(capped, anchor, { emptyMessage: "No matches found.", hint }),
+      truncated: capped.truncated
+    };
+  }
+  async listDirImpl(absPath, depth) {
+    if (depth > 1) {
+      const result = await run("tree", ["-L", String(depth), "-I", "node_modules|.git|dist|build", absPath], { timeout: 1e4, env: this.searchEnv() });
+      if (result.code === 0 && result.stdout.trim()) {
+        const lines = result.stdout.trim().split("\n");
+        return { success: true, output: lines.slice(0, 300).join("\n"), truncated: lines.length > 300 };
+      }
+    }
+    try {
+      const entries = await fs.promises.readdir(absPath, { withFileTypes: true });
+      const lines = entries.slice(0, 200).map((e) => `${e.isDirectory() ? "D" : "F"} ${e.name}`);
+      return { success: true, output: lines.join("\n") || "(empty directory)", truncated: entries.length > 200 };
+    } catch (err) {
+      return { success: false, output: `Error listing ${absPath}: ${err.message}`, truncated: false };
+    }
+  }
+  async execBashImpl(command) {
+    const { file, args: args2 } = this.researchShell;
+    const result = file === null ? await run(command, [], { cwd: this.workspaceRoot, timeout: BASH_TIMEOUT_MS, shell: true }) : await run(file, [...args2, command], { cwd: this.workspaceRoot, timeout: BASH_TIMEOUT_MS });
+    const out = (result.stdout || "").trim();
+    const err = (result.stderr || "").trim();
+    if (result.code !== 0) {
+      const detail = err || out || `exited with code ${result.code}`;
+      return { success: false, output: `Command exited ${result.code}:
+${detail.slice(0, 2e4)}`, truncated: detail.length > 2e4 };
+    }
+    const combined = err ? `${out}
+[stderr]
+${err}` : out;
+    return { success: true, output: combined || "(no output)", truncated: combined.length > 2e4 };
+  }
+};
+var PoolAwareRunner = class {
+  constructor(sessionId, broadcast, inner) {
+    this.sessionId = sessionId;
+    this.broadcast = broadcast;
+    this.inner = inner ?? new core.HeadlessRunner();
+  }
+  sessionId;
+  broadcast;
+  inner;
+  /**
+   * Sessions this plan spawned. The inner runner may be shared by every plan
+   * in the pool (one tmux session per daemon), so "stop everything" and
+   * "how many are running" must be answered from this set, never delegated —
+   * delegating would let one plan's /stop kill another plan's tasks.
+   */
+  owned = /* @__PURE__ */ new Set();
+  get activeCount() {
+    return this.owned.size;
+  }
+  async spawn(opts) {
+    const session = await this.inner.spawn({ ...opts, planSessionId: this.sessionId });
+    this.owned.add(session.id);
+    session.onExit(() => this.owned.delete(session.id));
+    this.broadcast({ type: "task_started", taskId: opts.taskId, order: opts.order ?? 0, title: opts.title ?? "", runner: opts.runner, modelId: opts.modelId });
+    session.onOutput((text) => {
+      this.broadcast({ type: "task_output", taskId: opts.taskId, text });
+    });
+    return session;
+  }
+  stop(sessionId) {
+    this.inner.stop(sessionId);
+    this.owned.delete(sessionId);
+  }
+  stopAll() {
+    for (const id of this.owned) this.inner.stop(id);
+    this.owned.clear();
+  }
+};
+
+// server/pool/orchestratorPool.ts
+var OrchestratorPool = class {
+  sessions = /* @__PURE__ */ new Map();
+  clients = /* @__PURE__ */ new Map();
+  registry = (() => {
+    const r = new core.RunnerRegistry();
+    r.loadUserPlugins();
+    return r;
+  })();
+  modelResolver = new core.ModelResolver(this.registry, new WebConfig());
+  runnerInstallation = new core.RunnerInstallation(this.registry);
+  enabledRunnerOverride;
+  cachedProviderLists;
+  settingsService = new core.SettingsService();
+  sharedRunner;
+  constructor(deps = {}) {
+    this.sharedRunner = deps.runner;
+  }
+  subscribe(sessionId, ws) {
+    if (!this.clients.has(sessionId)) this.clients.set(sessionId, /* @__PURE__ */ new Set());
+    this.clients.get(sessionId).add(ws);
+    const plan = this.sessions.get(sessionId)?.planState;
+    const history = plan?.conversationHistory ?? [];
+    if (history.length > 0 && ws.readyState === ws.OPEN) {
+      ws.send(JSON.stringify({ type: "chat_backlog", history }));
+    }
+  }
+  unsubscribe(sessionId, ws) {
+    this.clients.get(sessionId)?.delete(ws);
+    if (this.clients.get(sessionId)?.size === 0) this.clients.delete(sessionId);
+  }
+  broadcast(sessionId, msg) {
+    const payload = JSON.stringify(msg);
+    for (const ws of this.clients.get(sessionId) ?? []) {
+      if (ws.readyState === ws.OPEN) ws.send(payload);
+    }
+  }
+  hasSession(sessionId) {
+    return this.sessions.has(sessionId);
+  }
+  /** Answer a planner approval prompt. False means the id was unknown or already settled. */
+  resolveApproval(sessionId, approvalId, granted) {
+    return this.sessions.get(sessionId)?.resolveApproval(approvalId, granted) ?? false;
+  }
+  outstandingApprovals(sessionId) {
+    return this.sessions.get(sessionId)?.outstandingApprovals() ?? [];
+  }
+  approvedScopes(sessionId) {
+    return this.sessions.get(sessionId)?.approvedScopes() ?? [];
+  }
+  isExecuting(sessionId) {
+    return this.sessions.get(sessionId)?.isExecuting ?? false;
+  }
+  getPlan(sessionId) {
+    return this.sessions.get(sessionId)?.planState ?? null;
+  }
+  /**
+   * The plan of a session this process is holding, straight from its store —
+   * null for an id the pool never adopted. Reading it through the saved file
+   * instead answers as if nothing were running.
+   */
+  getPlanState(sessionId) {
+    return this.sessions.get(sessionId)?.currentPlanState ?? null;
+  }
+  getGoal(sessionId) {
+    return this.sessions.get(sessionId)?.currentGoal ?? "";
+  }
+  runtimeSettings() {
+    return core.sessionRuntimeSettings(this.settingsService.getAll());
+  }
+  createSessionFor(sessionId, workspace, modelOverride) {
+    const config = new WebConfig({
+      enabledRunners: this.enabledRunnerOverride,
+      modelOverride,
+      providerModelLists: this.cachedProviderLists
+    });
+    const fsAdapter = new PoolFileSystem(workspace);
+    const broadcast = (msg) => this.broadcast(sessionId, msg);
+    const runner = new PoolAwareRunner(sessionId, broadcast, this.sharedRunner);
+    return new core.Session({
+      config,
+      notifications: { info() {
+      }, warn() {
+      }, error() {
+      }, async confirm() {
+        return void 0;
+      } },
+      runner,
+      registry: this.registry,
+      workspaceRoot: () => workspace,
+      fsAdapter,
+      broadcast,
+      modelResolver: this.modelResolver,
+      settings: () => this.runtimeSettings(),
+      sessionId
+    });
+  }
+  setRunnerEnabled(id, enabled) {
+    if (this.enabledRunnerOverride === void 0) {
+      this.enabledRunnerOverride = new WebConfig().enabledRunners;
+    }
+    if (enabled && !this.enabledRunnerOverride.includes(id)) {
+      this.enabledRunnerOverride.push(id);
+    } else if (!enabled) {
+      this.enabledRunnerOverride = this.enabledRunnerOverride.filter((r) => r !== id);
+    }
+  }
+  getSettings() {
+    const config = new WebConfig({ enabledRunners: this.enabledRunnerOverride });
+    const userSettings = this.settingsService.getAll();
+    return {
+      orchestratorModel: config.orchestratorModel,
+      // Who plans (ADR-0009) — a vendor id, or one of the three harness
+      // planners. Surfaces need it to render the planner picker and to know
+      // whether the planner model comes from a runner catalog or a vendor one.
+      aiProvider: config.aiProvider,
+      // A harness planner's thinking effort (ADR-0009). Surfaces need it back
+      // to render the current level; without it the picker shows "default"
+      // for a planner that is running at "high".
+      plannerThinkingEffort: config.plannerThinkingEffort ?? "",
+      grillMe: userSettings.grillMe,
+      tdd: userSettings.tdd,
+      prd: userSettings.prd,
+      review: userSettings.review,
+      verification: userSettings.verification,
+      researchSubagents: userSettings.researchSubagents,
+      modelAllowlist: userSettings.modelAllowlist
+    };
+  }
+  updateSettings(changes) {
+    if (typeof changes.orchestratorModel === "string") {
+      process.env.ORCHESTRATOR_MODEL = changes.orchestratorModel;
+    }
+    if (typeof changes.plannerThinkingEffort === "string") {
+      process.env.ORDEWELL_PLANNER_EFFORT = changes.plannerThinkingEffort;
+    }
+    if (changes.grillMe && typeof changes.grillMe.enabled === "boolean") {
+      this.settingsService.setGrillMe(changes.grillMe.enabled);
+    }
+    if (changes.tdd && typeof changes.tdd.enabled === "boolean") {
+      this.settingsService.setTdd(changes.tdd.enabled);
+    }
+    if (changes.prd && typeof changes.prd.enabled === "boolean") {
+      this.settingsService.setPrd(changes.prd.enabled);
+    }
+    if (changes.review && typeof changes.review.enabled === "boolean") {
+      this.settingsService.setReview(changes.review.enabled);
+    }
+    if (changes.verification && typeof changes.verification.enabled === "boolean") {
+      this.settingsService.setVerification(changes.verification.enabled);
+    }
+    if (changes.researchSubagents && typeof changes.researchSubagents.enabled === "boolean") {
+      this.settingsService.setResearchSubagents(changes.researchSubagents.enabled);
+    }
+    if (changes.env && typeof changes.env === "object" && !Array.isArray(changes.env)) {
+      const env = changes.env;
+      let touched = false;
+      for (const [key, value] of Object.entries(env)) {
+        if (typeof value === "string" && /^[A-Z_]+$/.test(key)) {
+          process.env[key] = value;
+          touched = true;
+        }
+      }
+      if (touched) {
+        this.modelResolver.invalidate();
+        this.modelResolver.refreshRunnerModels();
+      }
+    }
+    if (changes.modelAllowlist && typeof changes.modelAllowlist === "object") {
+      const allowlist = changes.modelAllowlist;
+      for (const [runner, ids] of Object.entries(allowlist)) {
+        if (Array.isArray(ids)) {
+          this.settingsService.setModelAllowlist(runner, ids.map(String));
+        } else if (ids === null) {
+          this.settingsService.setModelAllowlist(runner, void 0);
+        }
+      }
+    }
+    return this.getSettings();
+  }
+  setOrchestratorModel(model) {
+    process.env.ORCHESTRATOR_MODEL = model;
+    return model;
+  }
+  async getProviderModels() {
+    const config = new WebConfig();
+    const runnerIds = this.registry.list().map((p) => p.manifest.name);
+    const [runnerModels, providerLists] = await Promise.all([
+      this.modelResolver.modelsForRunners(runnerIds),
+      this.modelResolver.refresh()
+    ]);
+    const orchestratorModels = await this.modelResolver.pickerOptions();
+    const providerErrors = this.modelResolver.getDiscoveryErrors();
+    this.cachedProviderLists = providerLists;
+    const allModels = [];
+    const seen = /* @__PURE__ */ new Set();
+    const modelsByRunner = {};
+    for (const id of runnerIds) {
+      modelsByRunner[id] = runnerModels[id] ?? [];
+      for (const m of modelsByRunner[id]) {
+        if (!seen.has(m.modelId)) {
+          seen.add(m.modelId);
+          allModels.push(m);
+        }
+      }
+    }
+    const providers = [];
+    for (const provider of core.PROVIDER_PRIORITY) {
+      if (provider === "openai_compatible") {
+        if (config.openaiCompatibleBaseUrl) providers.push(provider);
+      } else if (provider === "openrouter") {
+        if (config.openrouterKey) providers.push(provider);
+      } else if (provider === "google") {
+        if (config.geminiKey) providers.push(provider);
+      } else if (config.getProviderApiKey(provider)) {
+        providers.push(provider);
+      }
+    }
+    return {
+      models: allModels,
+      modelsByRunner,
+      modesByRunner: core.runnerModesFrom(this.registry, runnerIds),
+      orchestratorModel: process.env.ORCHESTRATOR_MODEL || "",
+      providers,
+      orchestratorModels,
+      providerErrors
+    };
+  }
+  getRunnerState() {
+    const config = new WebConfig({ enabledRunners: this.enabledRunnerOverride });
+    return { enabledRunners: config.enabledRunners, orchestratorModel: config.orchestratorModel };
+  }
+  /**
+   * Runners whose CLI is actually installed on the host, with display name and
+   * enabled state. Only these should be offered for selection — an uninstalled
+   * runner can't be spawned.
+   */
+  async getInstalledRunners() {
+    const config = new WebConfig({ enabledRunners: this.enabledRunnerOverride });
+    const enabled = new Set(config.enabledRunners);
+    const plugins = this.registry.list();
+    const installedIds = new Set(
+      await this.runnerInstallation.filterInstalled(plugins.map((p) => p.manifest.name))
+    );
+    return plugins.filter((p) => installedIds.has(p.manifest.name)).map((p) => ({
+      id: p.manifest.name,
+      name: p.manifest.displayName,
+      enabled: enabled.has(p.manifest.name)
+    }));
+  }
+  async generatePlan(sessionId, goal, runners, workspace, modelOverride) {
+    const session = this.createSessionFor(sessionId, workspace, modelOverride);
+    this.sessions.set(sessionId, session);
+    const plan = await session.generatePlan(goal, runners);
+    return core.migratePlanState(plan);
+  }
+  /**
+   * Conversational planning (ADR-0002): start the planner dialogue for a
+   * session. Returns the current plan state — a committed plan when the
+   * planner had enough context, otherwise the dialogue so far (last
+   * assistant message lives in conversationHistory).
+   */
+  async startPlanning(sessionId, goal, runners, workspace, modelOverride) {
+    const session = this.createSessionFor(sessionId, workspace, modelOverride);
+    this.sessions.set(sessionId, session);
+    const plan = await session.startPlanning(goal, runners);
+    return plan;
+  }
+  /** Continue the planner dialogue with the user's reply. */
+  async continuePlanning(sessionId, message) {
+    return this.session(sessionId).continueConversation(message);
+  }
+  /**
+   * Register a session persisted on disk so its plan becomes executable and
+   * editable. Only sessions planned in this process are otherwise addressable,
+   * which left a restored plan readable but inert — every task endpoint
+   * answered "Session not found".
+   *
+   * No LLM call happens here: the plan is adopted as saved, and the planner is
+   * only contacted when the user next sends a message.
+   */
+  adoptSavedSession(sessionId, workspace) {
+    const live = this.sessions.get(sessionId);
+    if (live?.planState) return live.planState;
+    const saved = core.loadSession(sessionId, workspace);
+    if (!saved) throw new Error("Session not found");
+    const session = this.createSessionFor(sessionId, workspace);
+    session.loadPlan(saved.plan, saved.meta.goal, workspace, { sessionId: saved.meta.id });
+    this.sessions.set(sessionId, session);
+    return session.planState ?? saved.plan;
+  }
+  /**
+   * Direct access to a session's interface — routes call the Session; the
+   * pool only registers sessions and fans broadcasts out to WS clients.
+   */
+  session(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) throw new Error("Session not found");
+    return session;
+  }
+  destroy(sessionId) {
+    this.sessions.get(sessionId)?.destroy();
+    this.sessions.delete(sessionId);
+  }
+  destroyAll() {
+    for (const id of this.sessions.keys()) this.destroy(id);
+  }
+};
+var scanWorkspaces2 = scanWorkspaces;
+function getSessionList(workspace) {
+  return core.listSessions(workspace);
+}
+function removeSession(sessionId, workspace) {
+  return core.deleteSession(sessionId, workspace);
+}
+function sessionsRoute(pool2) {
+  const router = new hono.Hono();
+  router.get("/", (c) => {
+    const ws = c.req.query("workspace") || process.cwd();
+    const sessions = getSessionList(ws);
+    return c.json(sessions);
+  });
+  router.get("/:id", (c) => {
+    const ws = c.req.query("workspace") || process.cwd();
+    const id = c.req.param("id");
+    const saved = core.loadSessionPlanState(id, ws);
+    if (!saved) return c.json({ error: "Session not found" }, 404);
+    return c.json({ meta: saved.meta, plan: pool2.getPlanState(id) ?? saved.plan });
+  });
+  router.post("/:id/load", (c) => {
+    const ws = c.req.query("workspace") || process.cwd();
+    try {
+      const id = c.req.param("id");
+      const plan = pool2.adoptSavedSession(id, ws);
+      return c.json({ ok: true, plan, goal: pool2.getGoal(id) });
+    } catch (err) {
+      const status = err?.message === "Session not found" ? 404 : 500;
+      return c.json({ error: err?.message ?? "Failed to load session" }, status);
+    }
+  });
+  router.delete("/:id", (c) => {
+    const ws = c.req.query("workspace") || process.cwd();
+    const ok = removeSession(c.req.param("id"), ws);
+    return c.json({ ok });
+  });
+  router.post("/:id/close", (c) => {
+    pool2.destroy(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  return router;
+}
+function plansRoute(pool2) {
+  const router = new hono.Hono();
+  router.post("/:sessionId/generate", async (c) => {
+    try {
+      const { goal, runners, workspace, model } = await c.req.json();
+      if (!goal) return c.json({ error: "goal is required" }, 400);
+      const ws = workspace || c.req.query("workspace") || process.cwd();
+      const queryRunners = c.req.query("runners");
+      const runnerList = Array.isArray(runners) ? runners : runners ? [runners] : queryRunners ? queryRunners.split(",").map((s) => s.trim()).filter(Boolean) : pool2.getRunnerState().enabledRunners;
+      const plan = await pool2.generatePlan(c.req.param("sessionId"), goal, runnerList, ws, model);
+      const { models, modelsByRunner } = await pool2.getProviderModels();
+      return c.json({ plan, models, modelsByRunner });
+    } catch (err) {
+      console.error("[plans] generate failed:", err);
+      return c.json({ error: err instanceof Error ? err.message : "Plan generation failed" }, 500);
+    }
+  });
+  router.post("/:sessionId/execute", async (c) => {
+    try {
+      await pool2.session(c.req.param("sessionId")).executePlan();
+      return c.json({ status: "running" });
+    } catch (err) {
+      const e = err;
+      const status = e.message === "Session not found" ? 404 : e.message === "No plan to execute" ? 400 : e.message === "Session already executing" ? 409 : 500;
+      return c.json({ error: e.message }, status);
+    }
+  });
+  router.post("/:sessionId/stop", (c) => {
+    if (pool2.hasSession(c.req.param("sessionId"))) pool2.session(c.req.param("sessionId")).stopExecution();
+    return c.json({ status: "stopped" });
+  });
+  router.post("/:sessionId/tasks/:taskId/complete", async (c) => {
+    try {
+      await pool2.session(c.req.param("sessionId")).markTaskComplete(c.req.param("taskId"));
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : "Not found" }, 404);
+    }
+  });
+  router.post("/:sessionId/tasks/:taskId/uncomplete", async (c) => {
+    try {
+      await pool2.session(c.req.param("sessionId")).markTaskIncomplete(c.req.param("taskId"));
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : "Not found" }, 404);
+    }
+  });
+  for (const [segment, run2] of [
+    ["run", (s, id) => s.runTask(id)],
+    ["force-start", (s, id) => s.forceStartTask(id)],
+    ["retry", (s, id) => s.retryTask(id)],
+    ["cancel", (s, id) => s.cancelTask(id)]
+  ]) {
+    router.post(`/:sessionId/tasks/:taskId/${segment}`, async (c) => {
+      try {
+        await run2(pool2.session(c.req.param("sessionId")), c.req.param("taskId"));
+        return c.json({ ok: true });
+      } catch (err) {
+        const status = err.message === "Session not found" ? 404 : 500;
+        return c.json({ error: err.message }, status);
+      }
+    });
+  }
+  router.put("/:sessionId/tasks/:taskId", async (c) => {
+    try {
+      const { assignedRunner, dependencies, ...rest } = await c.req.json();
+      const session = pool2.session(c.req.param("sessionId"));
+      const taskId = c.req.param("taskId");
+      const hasRunner = typeof assignedRunner === "string";
+      const hasDeps = Array.isArray(dependencies);
+      let result = null;
+      if (hasRunner) result = await session.setTaskRunner(taskId, assignedRunner);
+      if (hasDeps) {
+        try {
+          result = session.setTaskDependencies(taskId, dependencies.map(String));
+        } catch (err) {
+          return c.json({ error: err.message }, 400);
+        }
+      }
+      if (Object.keys(rest).length > 0 || !hasRunner && !hasDeps) result = session.updateTask(taskId, rest);
+      if (!result) return c.json({ error: "Task not found" }, 404);
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : "Internal error" }, 500);
+    }
+  });
+  router.delete("/:sessionId/tasks/:taskId", (c) => {
+    const result = pool2.session(c.req.param("sessionId")).removeTask(c.req.param("taskId"));
+    if (!result) return c.json({ error: "Task not found" }, 404);
+    return c.json({ ok: true });
+  });
+  router.post("/:sessionId/tasks", async (c) => {
+    try {
+      const body = await c.req.json();
+      const result = await pool2.session(c.req.param("sessionId")).addTask(body);
+      if (!result) return c.json({ error: "Session not found" }, 404);
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : "Internal error" }, 500);
+    }
+  });
+  router.post("/:sessionId/review/approve", async (c) => {
+    try {
+      const plan = await pool2.session(c.req.param("sessionId")).approveReview();
+      return c.json({ plan });
+    } catch (err) {
+      const e = err;
+      const status = e.message === "Session not found" ? 404 : e.message === "No plan to review" ? 400 : 500;
+      return c.json({ error: e.message }, status);
+    }
+  });
+  router.post("/:sessionId/tasks/merge", async (c) => {
+    try {
+      const { taskIds } = await c.req.json();
+      if (!taskIds || !Array.isArray(taskIds) || taskIds.length < 2) {
+        return c.json({ error: "taskIds array with at least two ids is required" }, 400);
+      }
+      const plan = await pool2.session(c.req.param("sessionId")).requestMerge(taskIds);
+      return c.json({ plan });
+    } catch (err) {
+      const e = err;
+      const status = e.message === "Session not found" ? 404 : 400;
+      return c.json({ error: e.message }, status);
+    }
+  });
+  router.post("/:sessionId/tasks/:taskId/split", async (c) => {
+    try {
+      const plan = await pool2.session(c.req.param("sessionId")).requestSplit(c.req.param("taskId"));
+      return c.json({ plan });
+    } catch (err) {
+      const e = err;
+      const status = e.message === "Session not found" ? 404 : 400;
+      return c.json({ error: e.message }, status);
+    }
+  });
+  router.post("/:sessionId/converse/start", async (c) => {
+    try {
+      const { goal, runners, workspace, model } = await c.req.json();
+      if (!goal) return c.json({ error: "goal is required" }, 400);
+      const ws = workspace || c.req.query("workspace") || process.cwd();
+      const runnerList = Array.isArray(runners) ? runners : runners ? [runners] : pool2.getRunnerState().enabledRunners;
+      const plan = await pool2.startPlanning(c.req.param("sessionId"), goal, runnerList, ws, model);
+      return c.json({ plan });
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : "Planning failed" }, 500);
+    }
+  });
+  router.post("/:sessionId/converse/message", async (c) => {
+    try {
+      const { message } = await c.req.json();
+      if (!message) return c.json({ error: "message is required" }, 400);
+      const plan = await pool2.continuePlanning(c.req.param("sessionId"), message);
+      return c.json({ plan });
+    } catch (err) {
+      const e = err;
+      const status = e.message === "Session not found" ? 404 : 500;
+      return c.json({ error: e.message }, status);
+    }
+  });
+  router.post("/:sessionId/process-queued", async (c) => {
+    try {
+      await pool2.session(c.req.param("sessionId")).processQueuedMessages();
+      return c.json({ ok: true });
+    } catch (err) {
+      const e = err;
+      const status = e.message === "Session not found" ? 404 : 500;
+      return c.json({ error: e.message }, status);
+    }
+  });
+  router.get("/:sessionId/prd", (c) => {
+    const plan = pool2.getPlan(c.req.param("sessionId"));
+    if (!plan?.prdMarkdown) return c.json({ error: "No PRD found" }, 404);
+    return c.json({ prdMarkdown: plan.prdMarkdown });
+  });
+  return router;
+}
+function runnersRoute(pool2) {
+  const router = new hono.Hono();
+  router.get("/", async (c) => {
+    const state = pool2.getRunnerState();
+    const runners = await pool2.getInstalledRunners();
+    return c.json({
+      runners,
+      orchestratorModel: state.orchestratorModel
+    });
+  });
+  router.put("/:id", async (c) => {
+    const id = c.req.param("id");
+    const body = await c.req.json();
+    pool2.setRunnerEnabled(id, body.enabled);
+    return c.json({ ok: true });
+  });
+  return router;
+}
+function modelsRoute(pool2) {
+  const router = new hono.Hono();
+  router.get("/", async (c) => {
+    const result = await pool2.getProviderModels();
+    return c.json(result);
+  });
+  return router;
+}
+function workspacesRoute() {
+  const router = new hono.Hono();
+  router.get("/", (c) => {
+    const workspaces = scanWorkspaces2();
+    return c.json({ workspaces });
+  });
+  return router;
+}
+function approvalsRoute(pool2) {
+  const router = new hono.Hono();
+  router.get("/:sessionId", (c) => {
+    const sessionId = c.req.param("sessionId");
+    if (!pool2.hasSession(sessionId)) return c.json({ error: `Unknown session: ${sessionId}` }, 404);
+    return c.json({
+      pending: pool2.outstandingApprovals(sessionId),
+      approvedScopes: pool2.approvedScopes(sessionId)
+    });
+  });
+  router.post("/:sessionId/:approvalId", async (c) => {
+    const sessionId = c.req.param("sessionId");
+    const approvalId = c.req.param("approvalId");
+    if (!pool2.hasSession(sessionId)) return c.json({ error: `Unknown session: ${sessionId}` }, 404);
+    const body = await c.req.json().catch(() => ({}));
+    const granted = body?.granted === true;
+    if (!pool2.resolveApproval(sessionId, approvalId, granted)) {
+      return c.json({ error: "Approval is no longer outstanding \u2014 it timed out or was already answered." }, 409);
+    }
+    return c.json({ ok: true, granted });
+  });
+  return router;
+}
+function settingsRoute(pool2) {
+  const router = new hono.Hono();
+  router.get("/", (c) => {
+    return c.json(pool2.getSettings());
+  });
+  router.patch("/", async (c) => {
+    const body = await c.req.json();
+    if (!body || typeof body !== "object" || Object.keys(body).length === 0) {
+      return c.json({ error: "At least one setting field is required" }, 400);
+    }
+    const result = pool2.updateSettings(body);
+    return c.json(result);
+  });
+  return router;
+}
+var COMMANDS = [
+  { name: "grill-me", description: "Toggle Grill-Me challenge mode (on|off|status)" },
+  { name: "tdd", description: "Toggle Test-Driven Development mode (on|off|status)" },
+  { name: "prd", description: "Toggle PRD mode \u2014 planner writes a markdown PRD before the plan (on|off|status)" },
+  { name: "review", description: "Toggle review mode \u2014 adds a final opinion-review task (human sign-off) to the plan (on|off|status)" },
+  { name: "verify", description: "Toggle verification mode \u2014 adds a final evidence-based verification task that runs the full suite (on|off|status)" },
+  { name: "research-subagents", description: "Toggle parallel research subagents \u2014 the planner may fan out read-only research agents during planning (on|off|status)" }
+];
+function commandsRoute(pool2) {
+  const router = new hono.Hono();
+  router.get("/", (c) => {
+    return c.json({ commands: COMMANDS });
+  });
+  router.post("/:name", async (c) => {
+    const name = c.req.param("name");
+    const body = await c.req.json().catch(() => ({}));
+    const args2 = body?.args || {};
+    const command = COMMANDS.find((cmd) => cmd.name === name);
+    if (!command) {
+      return c.json({ error: `Unknown command: ${name}` }, 404);
+    }
+    if (name === "grill-me") {
+      const action = args2.action || "status";
+      if (action === "on") {
+        pool2.updateSettings({ grillMe: { enabled: true } });
+      } else if (action === "off") {
+        pool2.updateSettings({ grillMe: { enabled: false } });
+      }
+      return c.json({ ok: true, settings: pool2.getSettings() });
+    }
+    if (name === "tdd") {
+      const action = args2.action || "status";
+      if (action === "on") {
+        pool2.updateSettings({ tdd: { enabled: true } });
+      } else if (action === "off") {
+        pool2.updateSettings({ tdd: { enabled: false } });
+      }
+      return c.json({ ok: true, settings: pool2.getSettings() });
+    }
+    if (name === "prd") {
+      const action = args2.action || "status";
+      if (action === "on") {
+        pool2.updateSettings({ prd: { enabled: true } });
+      } else if (action === "off") {
+        pool2.updateSettings({ prd: { enabled: false } });
+      }
+      return c.json({ ok: true, settings: pool2.getSettings() });
+    }
+    if (name === "review") {
+      const action = args2.action || "status";
+      if (action === "on") {
+        pool2.updateSettings({ review: { enabled: true } });
+      } else if (action === "off") {
+        pool2.updateSettings({ review: { enabled: false } });
+      }
+      return c.json({ ok: true, settings: pool2.getSettings() });
+    }
+    if (name === "verify") {
+      const action = args2.action || "status";
+      if (action === "on") {
+        pool2.updateSettings({ verification: { enabled: true } });
+      } else if (action === "off") {
+        pool2.updateSettings({ verification: { enabled: false } });
+      }
+      return c.json({ ok: true, settings: pool2.getSettings() });
+    }
+    if (name === "research-subagents") {
+      const action = args2.action || "status";
+      if (action === "on") {
+        pool2.updateSettings({ researchSubagents: { enabled: true } });
+      } else if (action === "off") {
+        pool2.updateSettings({ researchSubagents: { enabled: false } });
+      }
+      return c.json({ ok: true, settings: pool2.getSettings() });
+    }
+    return c.json({ error: `Unknown command: ${name}` }, 404);
+  });
+  return router;
+}
+function createWsHandler(pool2) {
+  const wss = new ws.WebSocketServer({ noServer: true });
+  wss.on("connection", (ws, request) => {
+    const url = new URL(request.url ?? "", `http://${request.headers.host}`);
+    const sessionId = url.pathname.split("/").pop() || "";
+    ws.on("close", () => {
+      pool2.unsubscribe(sessionId, ws);
+    });
+    ws.on("error", () => {
+      pool2.unsubscribe(sessionId, ws);
+    });
+    ws.send(JSON.stringify({ type: "connected", sessionId }));
+    pool2.subscribe(sessionId, ws);
+  });
+  return (request, socket, head) => {
+    wss.handleUpgrade(request, socket, head, (ws) => {
+      wss.emit("connection", ws, request);
+    });
+  };
+}
+
+// server/app.ts
+function createApp(pool2) {
+  const app2 = new hono.Hono();
+  app2.use("*", cors.cors({
+    origin: ["http://localhost:5173", "http://127.0.0.1:5173", "http://localhost:3742", "http://127.0.0.1:3742"],
+    allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    allowHeaders: ["Content-Type"]
+  }));
+  app2.route("/api/sessions", sessionsRoute(pool2));
+  app2.route("/api/plans", plansRoute(pool2));
+  app2.route("/api/runners", runnersRoute(pool2));
+  app2.route("/api/models", modelsRoute(pool2));
+  app2.route("/api/settings", settingsRoute(pool2));
+  app2.route("/api/commands", commandsRoute(pool2));
+  app2.route("/api/workspaces", workspacesRoute());
+  app2.route("/api/approvals", approvalsRoute(pool2));
+  return app2;
+}
+function attachWsHandler(server2, pool2) {
+  const handler = createWsHandler(pool2);
+  server2.on("upgrade", (request, socket, head) => {
+    const url = new URL(request.url ?? "", `http://${request.headers.host}`);
+    if (url.pathname.startsWith("/ws/session/")) {
+      handler(request, socket, head);
+    } else {
+      socket.destroy();
+    }
+  });
+}
+var args = process.argv.slice(2);
+var port = 3742;
+var portIdx = args.indexOf("--port");
+if (portIdx !== -1 && args[portIdx + 1]) {
+  port = parseInt(args[portIdx + 1], 10) || 3742;
+}
+var tmuxRunner = core.hasTmux() ? new core.TmuxRunner({ port }) : void 0;
+if (tmuxRunner) {
+  tmuxRunner.ensureSession().catch((err) => {
+    console.error(`[web] tmux session setup failed (will retry on next task spawn): ${err?.message ?? err}`);
+  });
+}
+var pool = new OrchestratorPool({ runner: tmuxRunner });
+var app = createApp(pool);
+pool.getProviderModels().catch((err) => {
+  console.error(`[web] model discovery warmup failed: ${err?.message ?? err}`);
+});
+app.get("/", (c) => c.json({ message: "Ordewell API", docs: "/api/workspaces" }));
+var server = http.createServer(async (req, res) => {
+  const bufs = [];
+  for await (const chunk of req) bufs.push(chunk);
+  const body = bufs.length > 0 ? Buffer.concat(bufs).toString() : void 0;
+  const url = `http://${req.headers.host || "localhost"}${req.url}`;
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (v) {
+      if (Array.isArray(v)) v.forEach((vv) => headers.append(k, vv));
+      else headers.set(k, v);
+    }
+  }
+  if (body && !headers.has("content-type")) headers.set("content-type", "application/json");
+  const webReq = new Request(url, {
+    method: req.method || "GET",
+    headers,
+    body: req.method !== "GET" && req.method !== "HEAD" ? body : void 0
+  });
+  try {
+    const webRes = await app.fetch(webReq);
+    res.writeHead(webRes.status, Object.fromEntries(webRes.headers.entries()));
+    if (webRes.body) {
+      const reader = webRes.body.getReader();
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        res.write(value);
+      }
+    }
+    res.end();
+  } catch (err) {
+    if (!res.headersSent) {
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: err instanceof Error ? err.message : "Internal server error" }));
+    }
+  }
+});
+attachWsHandler(server, pool);
+server.listen(port, "127.0.0.1", () => {
+  console.error(`[web] Ordewell API server: http://localhost:${port}`);
+});
+async function shutdown() {
+  pool.destroyAll();
+  if (tmuxRunner) await tmuxRunner.killSession().catch(() => {
+  });
+  server.close();
+  process.exit(0);
+}
+process.on("SIGINT", () => {
+  shutdown();
+});
+process.on("SIGTERM", () => {
+  shutdown();
+});
+process.on("SIGHUP", () => {
+  shutdown();
+});
+//# sourceMappingURL=main.js.map
+//# sourceMappingURL=main.js.map