@overdeck/desktop 0.45.12 → 0.45.15

package/server/writer-fe1-8iGc.js

@@ -0,0 +1,251 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { a as withBdProcessLock, n as init_bd_process_lock } from "./bd-process-lock-D3S4T4o-.js";
+import { n as init_export, t as exportBeadsJsonl } from "./export-Dx_qJ3h8.js";
+import { join } from "node:path";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region ../../lib/beads/telemetry.ts
+function updateBeadsTelemetry(projectKey, patch) {
+	health.set(projectKey, {
+		...health.get(projectKey) ?? empty(),
+		...patch
+	});
+}
+function recordBeadsPull(projectKey, localHead, remoteHead, at = /* @__PURE__ */ new Date()) {
+	updateBeadsTelemetry(projectKey, {
+		localHead,
+		lastPulledRemoteHead: remoteHead,
+		lastSuccessfulPullAt: at.toISOString(),
+		lastSyncError: null
+	});
+}
+function recordBeadsPush(projectKey, localHead, at = /* @__PURE__ */ new Date()) {
+	updateBeadsTelemetry(projectKey, {
+		localHead,
+		lastSuccessfulPushAt: at.toISOString(),
+		lastConflict: null
+	});
+}
+function recordBeadsSyncError(projectKey, message) {
+	updateBeadsTelemetry(projectKey, { lastSyncError: message });
+}
+function recordBeadsConflict(projectKey, message) {
+	updateBeadsTelemetry(projectKey, { lastConflict: message });
+}
+function parseSchemaVersion(value) {
+	if (!value || typeof value !== "object") return null;
+	const record = value;
+	const raw = record.schema_version ?? record.schemaVersion ?? record.database?.schema_version;
+	const parsed = typeof raw === "number" ? raw : Number(raw);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+async function getBeadsHealth(projectKey, cwd, execute = async (args, directory) => {
+	const { stdout } = await execFileAsync$1("bd", [...args], {
+		cwd: directory,
+		encoding: "utf8",
+		timeout: 1e4
+	});
+	return stdout;
+}) {
+	const state = health.get(projectKey) ?? empty();
+	let schemaVersion = null;
+	try {
+		schemaVersion = parseSchemaVersion(JSON.parse(await execute(["context", "--json"], cwd)));
+	} catch {}
+	return {
+		...state,
+		freshnessAgeMs: state.lastSuccessfulPullAt ? Math.max(0, Date.now() - Date.parse(state.lastSuccessfulPullAt)) : null,
+		schemaVersion,
+		designatedMigrator: process.env.BD_ALLOW_REMOTE_MIGRATE === "1"
+	};
+}
+var execFileAsync$1, health, empty;
+var init_telemetry = __esmMin((() => {
+	execFileAsync$1 = promisify(execFile);
+	health = /* @__PURE__ */ new Map();
+	empty = () => ({
+		localHead: null,
+		lastPulledRemoteHead: null,
+		lastSuccessfulPullAt: null,
+		lastSuccessfulPushAt: null,
+		lastConflict: null,
+		lastSyncError: null
+	});
+}));
+//#endregion
+//#region ../../lib/beads/writer.ts
+function errorText(error) {
+	if (!error || typeof error !== "object") return String(error);
+	const record = error;
+	return [
+		record.stderr,
+		record.message,
+		record.stdout
+	].filter((value) => typeof value === "string").join("\n");
+}
+function errorDiagnosticText(error) {
+	if (!error || typeof error !== "object") return String(error);
+	const record = error;
+	return [record.stderr, record.message].filter((value) => typeof value === "string").join("\n");
+}
+function formatMutationBatchFailure(result) {
+	if (!("cause" in result)) return result.message;
+	const cause = errorText(result.cause).trim();
+	return cause ? `${result.message}\nCause: ${cause}` : result.message;
+}
+function isConflict(error) {
+	return /conflict|non-fast-forward|rejected|diverge/i.test(errorDiagnosticText(error));
+}
+function parseHead(status) {
+	return /^\s*Commit:\s*([0-9a-v]{7,40})\s*$/im.exec(status)?.[1] ?? null;
+}
+async function defaultExecute(args, cwd) {
+	const { stdout } = await execFileAsync("bd", [...args], {
+		cwd,
+		encoding: "utf8",
+		timeout: 12e4,
+		maxBuffer: BD_EXEC_MAX_BUFFER
+	});
+	return stdout;
+}
+async function defaultExportSnapshot(client, cwd) {
+	await exportBeadsJsonl(cwd, { execute: (args) => client.run(args) });
+}
+async function readHead(client) {
+	try {
+		return parseHead(await client.run(["vc", "status"]));
+	} catch {
+		return null;
+	}
+}
+async function readRemoteHead(client) {
+	try {
+		const output = await client.run([
+			"dolt",
+			"remote",
+			"show",
+			"origin",
+			"--json"
+		]);
+		const parsed = JSON.parse(output);
+		const head = parsed.head ?? parsed.commit ?? parsed.remote_head;
+		return typeof head === "string" ? head : null;
+	} catch {
+		return null;
+	}
+}
+async function hasExistingEmbeddedDoltStore(cwd) {
+	try {
+		const storePath = join(await resolveBeadsDir(cwd), "embeddeddolt");
+		if (!(await stat(storePath)).isDirectory()) return false;
+		return (await readdir(storePath)).length > 0;
+	} catch {
+		return false;
+	}
+}
+async function resolveBeadsDir(cwd) {
+	const localBeadsDir = join(cwd, ".beads");
+	try {
+		return (await readFile(join(localBeadsDir, "redirect"), "utf8")).trim() || localBeadsDir;
+	} catch {
+		return localBeadsDir;
+	}
+}
+/**
+* The only canonical beads mutation transaction boundary.
+*
+* A batch owns one project lock and one bootstrap/pull/commit/export/push
+* cycle. A failed callback is deliberately left unpushed for operator
+* recovery because bd does not expose a universally safe embedded-mode
+* rollback primitive.
+*/
+async function runMutationBatch(context, mutate, dependencies = {}) {
+	const execute = dependencies.execute ?? defaultExecute;
+	const exportSnapshot = dependencies.exportSnapshot ?? defaultExportSnapshot;
+	const withLock = dependencies.withLock ?? withBdProcessLock;
+	const cwd = context.project.workspacePath;
+	const telemetryKey = context.project.projectKey ?? cwd;
+	const client = {
+		run: (args) => execute(args, cwd),
+		mutate: (args) => execute([
+			...args,
+			"--dolt-auto-commit",
+			"batch"
+		], cwd)
+	};
+	return withLock(`beads mutation: ${context.reason}`, async () => {
+		let value;
+		try {
+			if (!await hasExistingEmbeddedDoltStore(cwd)) await client.run([
+				"bootstrap",
+				"--yes",
+				"--json"
+			]);
+			await client.run(["dolt", "pull"]);
+			recordBeadsPull(telemetryKey, await readHead(client), await readRemoteHead(client));
+			value = await mutate(client);
+			await client.run([
+				"dolt",
+				"commit",
+				"-m",
+				context.reason
+			]);
+			await exportSnapshot(client, cwd);
+		} catch (error) {
+			const localHead = await readHead(client);
+			if (isConflict(error)) {
+				recordBeadsConflict(telemetryKey, errorText(error));
+				return {
+					ok: false,
+					conflict: true,
+					localHead,
+					remoteHead: await readRemoteHead(client),
+					message: "The Dolt histories conflict. Nothing was pushed; pull and reconcile the working set before retrying."
+				};
+			}
+			recordBeadsSyncError(telemetryKey, errorText(error));
+			return {
+				ok: false,
+				needsOperatorRecovery: true,
+				localHead,
+				message: "The mutation batch failed before push. The local working set was preserved for operator recovery and no partial plan was published.",
+				cause: error
+			};
+		}
+		try {
+			await client.run(["dolt", "push"]);
+			const localHead = await readHead(client);
+			recordBeadsPush(telemetryKey, localHead);
+			return {
+				ok: true,
+				value,
+				localHead
+			};
+		} catch (error) {
+			recordBeadsConflict(telemetryKey, errorText(error));
+			return {
+				ok: false,
+				conflict: true,
+				localHead: await readHead(client),
+				remoteHead: await readRemoteHead(client),
+				message: "The Dolt push was rejected. The batch is not durably complete; no force push was attempted."
+			};
+		}
+	}, {
+		...context.lockOptions,
+		workspacePath: cwd
+	});
+}
+var execFileAsync, BD_EXEC_MAX_BUFFER;
+var init_writer = __esmMin((() => {
+	init_bd_process_lock();
+	init_export();
+	init_telemetry();
+	execFileAsync = promisify(execFile);
+	BD_EXEC_MAX_BUFFER = 64 * 1024 * 1024;
+}));
+//#endregion
+export { init_telemetry as a, getBeadsHealth as i, init_writer as n, recordBeadsPull as o, runMutationBatch as r, recordBeadsSyncError as s, formatMutationBatchFailure as t };
+
+//# sourceMappingURL=writer-fe1-8iGc.js.map

package/sync-sources/hooks/ask-user-question-hook

@@ -0,0 +1,87 @@
+#!/bin/bash
+# ~/.overdeck/bin/ask-user-question-hook  (PAN-1520)
+#
+# PreToolUse hook on AskUserQuestion — denies the tool call to prevent the
+# upstream Claude Code silent-corruption bug (anthropics/claude-code#10229,
+# #10400) where AskUserQuestion's choice menu does not render under
+# --dangerously-skip-permissions and the harness returns option #1's literal
+# label as the tool_result, fabricating an operator answer that never happened.
+#
+# Until the dashboard surfaces AskUserQuestion options interactively (the rest
+# of PAN-1520), the only safe failure mode is "block until the agent re-asks
+# in plain prose". This hook converts silent corruption -> visible block by
+# returning a deny verdict with the full question text + option labels as
+# additionalContext, so the agent restates the choice to the operator as
+# regular text and waits for a normal response.
+#
+# Never breaks Claude Code: on any error the hook exits 0 silently (which
+# lets the original AskUserQuestion call through — preserving the prior
+# behaviour rather than introducing a new hang).
+
+set +e
+
+INPUT=$(cat 2>/dev/null || echo '{}')
+
+if ! command -v jq >/dev/null 2>&1; then
+  # Without jq we cannot safely parse the question payload. Allow the call.
+  exit 0
+fi
+
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null)
+if [ "$TOOL_NAME" != "AskUserQuestion" ]; then
+  exit 0
+fi
+
+# Emit an awareness event to the dashboard via the standard hook lib so the
+# operator can see the question was asked, even though the tool call is denied.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=pan-hook-lib.sh
+. "$SCRIPT_DIR/pan-hook-lib.sh" 2>/dev/null || true
+if declare -f pan_resolve_agent_id >/dev/null && pan_resolve_agent_id; then
+  TS=$(date -Iseconds)
+  EVENT_BODY=$(echo "$INPUT" | jq --arg ts "$TS" '{
+    kind: "ask_user_question_blocked",
+    timestamp: $ts,
+    questions: (.tool_input.questions // [])
+  }' 2>/dev/null)
+  if [ -n "$EVENT_BODY" ] && declare -f pan_emit_event >/dev/null; then
+    pan_emit_event "$AGENT_ID" "$EVENT_BODY" 2>/dev/null || true
+  fi
+fi
+
+REASON='Your question has been surfaced to the operator in the Overdeck dashboard, where they answer it directly. Restate the question and its options to the operator as a short plain-text message and wait for their reply (it arrives as a normal user message).'
+
+CONTEXT=$(echo "$INPUT" | jq -r '
+  def fmt_option:
+    "  - " + (.label // "(no label)")
+    + (if .description then ": " + .description else "" end);
+  def fmt_question:
+    "Question: " + (.question // "(no question text)")
+    + (if .header then "\nHeader: " + .header else "" end)
+    + "\nOptions:\n" + ((.options // []) | map(fmt_option) | join("\n"));
+  (.tool_input.questions // [])
+  | map(fmt_question)
+  | join("\n\n")
+' 2>/dev/null)
+
+if [ -z "$CONTEXT" ]; then
+  CONTEXT="(failed to parse questions payload — restate your question to the operator as plain text)"
+fi
+
+INSTRUCTION="Restate the following to the operator as a plain-text message, listing the options as a numbered list, and wait for their normal response. Do not call AskUserQuestion again."
+
+jq -n \
+  --arg reason "$REASON" \
+  --arg context "${INSTRUCTION}
+
+${CONTEXT}" \
+  '{
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: $reason,
+      additionalContext: $context
+    }
+  }'
+
+exit 0

package/sync-sources/hooks/auto-approve-hook

@@ -0,0 +1,96 @@
+#!/bin/bash
+# ~/.overdeck/bin/auto-approve-hook
+#
+# PreToolUse hook that returns permissionDecision: "allow" — but ONLY for the
+# fully-autonomous, headless pipeline agents that have no human to answer Claude
+# Code's "Do you want to proceed?" prompt. Without this, an unapproved tool call
+# hangs the session forever (PAN-1024's "Interrupted · What should Claude do
+# instead?" loop). This is the replacement for launching those agents with
+# --dangerously-skip-permissions, which Auto-mode (compliance) users forbid.
+#
+# SCOPE (by OVERDECK_AGENT_ID prefix):
+#   agent-*    → AUTO-APPROVE. Work / review / test / ship pipeline agents run
+#                unattended; a prompt would hang them.
+#   flywheel-* → AUTO-APPROVE. The Fix-All Flywheel orchestrator
+#                (OVERDECK_AGENT_ID=flywheel-orchestrator) is fully headless —
+#                a prompt hangs the entire run. It does NOT use an agent-* id.
+#   sequencer-* → AUTO-APPROVE. The Backlog Sequencer
+#                (OVERDECK_AGENT_ID=sequencer-runner) is a headless singleton
+#                runner like the flywheel — it reads issues via `gh` with no human
+#                present, so an approval prompt stalls the whole ranking pass.
+#   strike-* / inspect-* → AUTO-APPROVE. Headless strike (implement+merge) and
+#                per-bead inspect agents, same autonomy as a work agent.
+#   planning-* → AUTO-APPROVE. A planning agent must not be MORE restrictive than
+#                a work agent (which is auto-approved) or a conversation (which
+#                runs under bypass) — otherwise it is the only thing in the system
+#                that stalls on Claude Code's native command gates (e.g. the
+#                "compound command contains cd with output redirection" prompt).
+#                Planning's interactivity is the AskUserQuestion DIALOG (decisions
+#                surface to the operator via ask-user-question-hook), NOT per-command
+#                approval. So its routine research is auto-approved like a work agent.
+#   conv-*     → AUTO-APPROVE. Overdeck conversations run autonomously between
+#                operator turns; they used to rely on Claude Code's `--permission-mode
+#                auto` classifier to avoid per-command prompts, but Claude Code
+#                removed `auto` as a valid interactive mode (we now launch every
+#                Overdeck session with `--permission-mode default`). Without this
+#                the conversation stalls on Claude's native "requires approval"
+#                gate for routine commands (e.g. `pan status`). The operator still
+#                sees every command in the dashboard terminal and steers via
+#                `pan tell`; AskUserQuestion is still excluded below so operator
+#                decisions surface as a dialog.
+#   (unset)    → NOT auto-approved. A human's own plain `claude` session keeps
+#                normal prompts.
+#
+# This hook is wired in the GLOBAL settings.json (frontmatter PreToolUse hooks'
+# permissionDecision is NOT honored by Claude Code — only settings.json hooks can
+# decide permission), so the prefix check above is what keeps it from leaking
+# into interactive/human sessions.
+#
+# AskUserQuestion is also skipped so ask-user-question-hook's deny stands.
+#
+# Never breaks Claude Code: on any error it stays silent (exit 0), which falls
+# back to the normal permission flow rather than forcing a decision.
+
+set +e
+
+LOG_DIR="$HOME/.overdeck/logs"
+mkdir -p "$LOG_DIR" 2>/dev/null || true
+
+INPUT=$(cat 2>/dev/null || echo '{}')
+
+TOOL_NAME=""
+if command -v jq >/dev/null 2>&1; then
+  TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null)
+fi
+
+echo "[$(date -Iseconds)] auto-approve-hook: AGENT=${OVERDECK_AGENT_ID:-unset} tool=${TOOL_NAME:-unknown}" \
+  >> "$LOG_DIR/auto-approve.log" 2>/dev/null || true
+
+# Overdeck pipeline agents (work + planning) AND conversations, which run
+# autonomously between operator turns. Only a plain human `claude` session
+# (OVERDECK_AGENT_ID unset) keeps normal prompts.
+case "${OVERDECK_AGENT_ID:-}" in
+  agent-*|planning-*|flywheel-*|strike-*|inspect-*|sequencer-*|conv-*) : ;;
+  *) exit 0 ;;
+esac
+
+# Let ask-user-question-hook own AskUserQuestion (its deny summons the dialog).
+if [ "$TOOL_NAME" = "AskUserQuestion" ]; then
+  exit 0
+fi
+
+REASON='Overdeck autonomous pipeline agent auto-approve: headless agent-* sessions replace --dangerously-skip-permissions with this scoped PreToolUse allow hook.'
+
+if command -v jq >/dev/null 2>&1; then
+  jq -n --arg reason "$REASON" '{
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow",
+      permissionDecisionReason: $reason
+    }
+  }'
+else
+  printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Overdeck autonomous pipeline agent auto-approve"}}'
+fi
+
+exit 0

package/sync-sources/hooks/codex-notify-hook

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+// ~/.overdeck/bin/codex-notify-hook  (PAN-1574)
+//
+// Fires via Codex CLI notify mechanism on agent-turn-complete.
+// Codex passes the event JSON as stdin or as a JSON argv argument.
+//
+// Writes ~/.overdeck/agents/<id>/heartbeat.json so codex.ts getHeartbeat
+// can detect turn-end activity. Also writes a `completed` marker used by
+// the recovery path to detect agent idle state.
+
+'use strict';
+
+const { join } = require('node:path');
+const { homedir } = require('node:os');
+const { writeFileSync, mkdirSync, existsSync } = require('node:fs');
+
+const agentId = process.env.OVERDECK_AGENT_ID;
+if (!agentId) process.exit(0); // Not a Overdeck-managed agent
+
+// Read event JSON from stdin (Codex delivers via stdin by default).
+let eventData = {};
+try {
+  const chunks = [];
+  process.stdin.setEncoding('utf8');
+  for (const chunk of []) { chunks.push(chunk); }
+  // Synchronous stdin read — Codex provides the event before invoking the shim.
+  const raw = require('node:fs').readFileSync('/dev/stdin', 'utf8').trim();
+  if (raw) eventData = JSON.parse(raw);
+} catch {
+  // Ignore parse errors — best-effort heartbeat.
+}
+
+const overdeckHome = process.env.OVERDECK_HOME || join(homedir(), '.overdeck');
+const heartbeatsDir = join(overdeckHome, 'heartbeats');
+const agentDir = join(overdeckHome, 'agents', agentId);
+
+try {
+  mkdirSync(heartbeatsDir, { recursive: true });
+  mkdirSync(agentDir, { recursive: true });
+} catch { /* ignore */ }
+
+const timestamp = new Date().toISOString();
+const lastAction = typeof eventData['last-assistant-message'] === 'string'
+  ? eventData['last-assistant-message'].slice(0, 200)
+  : undefined;
+
+const heartbeat = {
+  timestamp,
+  tool_name: 'agent-turn-complete',
+  last_action: lastAction,
+  thread_id: eventData['thread-id'],
+};
+
+// Write heartbeat.json for the 3-tier ladder (tier 1 = active heartbeat <60s).
+try {
+  writeFileSync(join(heartbeatsDir, `${agentId}.json`), JSON.stringify(heartbeat) + '\n');
+} catch { /* ignore */ }
+
+// Write completed marker so recovery path knows the agent finished a turn.
+try {
+  writeFileSync(join(agentDir, 'turn-completed'), timestamp + '\n');
+} catch { /* ignore */ }

package/sync-sources/hooks/gh-issue-trailer-hook

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+exec node "$SCRIPT_DIR/gh-issue-trailer-hook.js"

package/sync-sources/hooks/gh-issue-trailer-hook.d.ts

@@ -0,0 +1,7 @@
+//#region gh-issue-trailer-hook.d.ts
+type HookEnv = Record<string, string | undefined>;
+declare function rewriteGhIssueCreateCommand(command: string, env?: HookEnv): string | null;
+declare function runGhIssueTrailerHook(input: string, env?: HookEnv): string;
+//#endregion
+export { rewriteGhIssueCreateCommand, runGhIssueTrailerHook };
+//# sourceMappingURL=gh-issue-trailer-hook.d.ts.map

package/sync-sources/hooks/gh-issue-trailer-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh-issue-trailer-hook.d.ts","names":[],"sources":["gh-issue-trailer-hook.ts"],"mappings":";KAoBK,OAAA,GAAU,MAAA;AAAA,iBA+OC,2BAAA,CAA4B,OAAA,UAAiB,GAAA,GAAK,OAAA;AAAA,iBAiBlD,qBAAA,CAAsB,KAAA,UAAe,GAAA,GAAK,OAAA"}