@qodeca/xezar 0.11.2 → 0.13.0

package/dist/server/server.js

@@ -1,3 +1,5 @@
+import { EventCorrectionError } from '../runs/event-corrections.js';
+import { validateLegacyHistoryResume } from '../runs/event-history.js';
 import { projectDataDir } from '../project-data-paths.js';
 import { projectKitDir } from '../project-kit-paths.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
@@ -21,13 +23,14 @@ import { z } from 'zod';
 import { setWorkspaceUiStateInputSchema, } from '../contract/index.js';
 // A contract VALUE, like `workspaceUiStateSchema` in workspace/migrations.ts — the request
 // schema this route validates with is the same one the client compiles against.
-import { attachmentInputSchema, modelDiscoveryRunnerSchema, openProjectInSchema, updateProjectInputSchema, } from '../contract/index.js';
+import { attachmentInputSchema, MODEL_DISCOVERY_RUNNERS, modelDiscoveryRunnerSchema, openProjectInSchema, updateProjectInputSchema, } from '../contract/index.js';
 import { detectEnvironment } from '../core/backend-detect.js';
 import { RUNNER_IDS } from '../core/agent-runner.js';
 import { AGENT_MODELS_LOCKED_ERROR, agentModelsLocked } from '../core/agent-model-policy.js';
 import { discoverClaudeModels } from '../core/claude-model-catalog.js';
 import { discoverCodexModels } from '../core/codex-model-catalog.js';
 import { discoverOpencodeModels } from '../core/opencode-model-catalog.js';
+import { discoverPiModels } from '../core/pi-model-catalog.js';
 import { PROVIDER_IDS, ProviderAuthService, providerAuthChecksDisabled, } from '../core/provider-auth.js';
 import { applyProviderEnablement } from '../core/provider-availability.js';
 import { RunnerModelCatalog } from '../core/runner-model-catalog.js';
@@ -56,7 +59,7 @@ import { readAgentModelDefaults } from '../agent-config/models.js';
 import { listAgentConfig } from '../agent-config/service.js';
 import { listConfigFiles } from '../agent-config/catalog.js';
 import { readAccountIdentity } from '../agent-config/account-identity.js';
-import { PROJECT_ID_RE, defaultWorkspaceConfig, effectiveSkillsAutoUpdate, loadWorkspaceConfig, mergeWriteWorkspaceConfig, effectiveComposerDefault, } from '../workspace/config.js';
+import { DEFAULT_MEMORY_LIMIT_MB, PROJECT_ID_RE, defaultWorkspaceConfig, effectiveSkillsAutoUpdate, loadWorkspaceConfig, mergeWriteWorkspaceConfig, effectiveComposerDefault, } from '../workspace/config.js';
 import { CONTROL_CHARS_RE, DEFAULT_AGENT_ACCOUNT_ID, defaultAgentAccountStore, isAbsoluteConfigDir, loadAgentAccounts, mergeWriteAgentAccounts, } from '../workspace/agent-accounts.js';
 import { defaultAgentProfile, listAgentProfiles, profileDirState, resolveProfileEnvForRoot, resolveStoredProfile, sameProfileDir, } from '../workspace/agent-profiles.js';
 import { PROFILE_CAPABLE_PROVIDERS, profileEnv, supportsProfiles } from '../core/agent-profiles.js';
@@ -65,6 +68,7 @@ import { allocateProjectSlug, listProjects, normalizeProjectTags, probeProjectSt
 import { mergeWriteWorkspaceUiState, readWorkspaceUiState } from '../workspace/ui-state.js';
 import { checkoutRepo } from './checkout.js';
 import { ProjectContextError, ProjectContexts } from './project-context.js';
+import { ProjectWriterError } from '../runs/project-writer.js';
 import { reviewGateEnabled } from '../runs/review-gate.js';
 import { readUiState, uiStatePath } from '../ui-state.js';
 import { agentHomePaths, expandTilde } from '../paths.js';
@@ -685,6 +689,9 @@ export function createApp(deps) {
             claude: { discover: () => discoverClaudeModels({ cwd: bootRoot }) },
             codex: { discover: () => discoverCodexModels({ cwd: bootRoot }) },
             opencode: { discover: () => discoverOpencodeModels({ cwd: bootRoot }) },
+            // No `cwd`: pi's catalog is its per-user config, not a project-local answer, so this one
+            // adapter is correct for every project the workspace holds (#152).
+            pi: { discover: () => discoverPiModels() },
         },
     });
     const providerAuth = deps.providerAuth ?? new ProviderAuthService();
@@ -788,7 +795,10 @@ export function createApp(deps) {
     };
     // Hosted-mode gate (spec §"Deployment modes") — read per request so
     // XEZ_REMOTE flips take effect live (and tests can toggle it).
-    const capabilities = () => resolveCapabilities(process.env, bindHost);
+    // The stored Inbox setting (F) wins over `XEZ_FOLLOWUPS` when the workspace config sets
+    // one. Read through the shared semaphore's cache so it is live: `refresh()` re-reads it on
+    // every workspace-config PUT, which is the one reload hook this file already fires.
+    const capabilities = () => resolveCapabilities(process.env, bindHost, deps.semaphore?.storedFollowups());
     const singleProjectRefusal = (action) => ({ error: `single-project mode is enabled; ${action} is disabled` });
     // Inbox live updates (spec 007). Opt-in (#471): no capability, no watcher —
     // and since step 2.3 the per-dataDir watch is created lazily by the first
@@ -965,6 +975,8 @@ export function createApp(deps) {
             c.set('project', await contexts.context(raw));
         }
         catch (err) {
+            if (err instanceof ProjectWriterError)
+                return c.json({ error: err.message }, 409);
             if (err instanceof ProjectContextError) {
                 return err.reason === 'missing-root'
                     ? c.json({ error: `project folder not found: ${err.projectId}` }, 409)
@@ -1247,9 +1259,13 @@ export function createApp(deps) {
     // ---- chained family: host model catalog (workspace-level) ----
     const modelsRoutes = new Hono()
         // `modelDiscoveryRunnerSchema` is the contract's own list of the runners with an
-        // authoritative host-local catalog (#794, #784), so the client compiles against exactly what
-        // this validates. A runner absent from it has no discovery path and this 400s.
-        .get('/models', queryZodValidator(z.object({ runner: z.union([z.string(), z.array(z.string()).transform((v) => v[0])]).pipe(modelDiscoveryRunnerSchema) }), { message: 'runner must be claude, codex or opencode' }), async (c) => {
+        // authoritative host-local catalog (#794, #784, #152), so the client compiles against exactly
+        // what this validates. A runner absent from it has no discovery path and this 400s.
+        //
+        // The message is DERIVED from that list, never spelled out. It used to name the three runners
+        // literally, so adding a fourth here would have left it refusing `pi` by a name it no longer
+        // rejected — and a refusal that names the wrong set is worse than a generic one (#152).
+        .get('/models', queryZodValidator(z.object({ runner: z.union([z.string(), z.array(z.string()).transform((v) => v[0])]).pipe(modelDiscoveryRunnerSchema) }), { message: `runner must be one of: ${MODEL_DISCOVERY_RUNNERS.join(', ')}` }), async (c) => {
         const query = { data: c.req.valid('query') };
         return c.json(await modelCatalog.get(query.data.runner));
     });
@@ -2351,6 +2367,17 @@ export function createApp(deps) {
         projectsDir: config.projectsDir,
         skillsAutoUpdate: config.skillsAutoUpdate ?? null,
         effectiveSkillsAutoUpdate: effectiveSkillsAutoUpdate(config),
+        // Tri-state (F): `null` means no stored key, so `XEZ_FOLLOWUPS` decides. The
+        // `effective*` twin is what the pane renders, so "(default)" and the actual state can
+        // both be shown without the client re-implementing the precedence rule.
+        followups: config.followups ?? null,
+        effectiveFollowups: config.followups ?? process.env.XEZ_FOLLOWUPS === '1',
+        agentEnvPassthrough: config.agentEnvPassthrough ?? null,
+        effectiveAgentEnvPassthrough: config.agentEnvPassthrough ??
+            (process.env.XEZ_ENV_PASSTHROUGH ?? '')
+                .split(',')
+                .map((name) => name.trim())
+                .filter(Boolean),
         composerDefaults: {
             autonomous: config.composerDefaults.autonomous ?? null,
             worktree: config.composerDefaults.worktree ?? null,
@@ -2366,7 +2393,11 @@ export function createApp(deps) {
             maxMonitoringSessions: config.resources.maxMonitoringSessions,
             monitoringWakeIntervalMinutes: config.resources.monitoringWakeIntervalMinutes,
             autoResumeOnUsageLimit: config.resources.autoResumeOnUsageLimit,
+            idleTimeoutMinutes: config.resources.idleTimeoutMinutes,
             memoryLimitMb: config.resources.memoryLimitMb,
+            // Reported, not stored: the settings pane names this machine's derived ceiling so the
+            // user can see what an unset `memoryLimitMb` actually means here (B1).
+            memoryLimitDefaultMb: DEFAULT_MEMORY_LIMIT_MB,
             worktreeRetentionDefault: config.resources.worktreeRetentionDefault,
         },
         // SPREAD, never `runner: maybeUndefined`: hono would type the key as always-present while
@@ -2382,7 +2413,7 @@ export function createApp(deps) {
         .get('/workspace/config', async (c) => c.json(workspaceConfigBody(await loadWorkspaceConfig())))
         .put('/workspace/config', jsonZodValidator(() => workspaceConfigUpdateSchema), async (c) => {
         const parsed = { data: c.req.valid('json') };
-        const { browseRoot, projectsDir, skillsAutoUpdate, composerDefaults, resources, agentDefaults } = parsed.data;
+        const { browseRoot, projectsDir, skillsAutoUpdate, followups, agentEnvPassthrough, composerDefaults, resources, agentDefaults, } = parsed.data;
         for (const [configuredRoot, create] of [
             [browseRoot, false],
             [projectsDir, true],
@@ -2425,6 +2456,16 @@ export function createApp(deps) {
                     delete config.skillsAutoUpdate;
                 else if (skillsAutoUpdate !== undefined)
                     config.skillsAutoUpdate = skillsAutoUpdate;
+                // `null` clears the key back to the env default; `false`/`[]` are real stored
+                // choices and must survive as written (F).
+                if (followups === null)
+                    delete config.followups;
+                else if (followups !== undefined)
+                    config.followups = followups;
+                if (agentEnvPassthrough === null)
+                    delete config.agentEnvPassthrough;
+                else if (agentEnvPassthrough !== undefined)
+                    config.agentEnvPassthrough = agentEnvPassthrough;
                 if (composerDefaults?.autonomous === null)
                     delete config.composerDefaults.autonomous;
                 else if (composerDefaults?.autonomous !== undefined) {
@@ -2446,6 +2487,9 @@ export function createApp(deps) {
                 if (resources?.autoResumeOnUsageLimit !== undefined) {
                     config.resources.autoResumeOnUsageLimit = resources.autoResumeOnUsageLimit;
                 }
+                if (resources?.idleTimeoutMinutes !== undefined) {
+                    config.resources.idleTimeoutMinutes = resources.idleTimeoutMinutes;
+                }
                 if (resources?.memoryLimitMb !== undefined)
                     config.resources.memoryLimitMb = resources.memoryLimitMb;
                 if (resources?.worktreeRetentionDefault !== undefined) {
@@ -2480,8 +2524,11 @@ export function createApp(deps) {
         }
         // A resource change takes effect WITHOUT a restart: refresh the shared
         // semaphore's in-memory snapshot and pump every manager (step 2.5's hook).
-        if (resources !== undefined)
+        // `followups` and `agentEnvPassthrough` are cached by the same semaphore snapshot
+        // (F), so they refresh through the same hook rather than a second reload path.
+        if (resources !== undefined || followups !== undefined || agentEnvPassthrough !== undefined) {
             await deps.semaphore?.refresh();
+        }
         return c.json(workspaceConfigBody(written));
     })
         // Global GUI state (`~/.xezar/ui-state.json`) — same parse/key-cap/shallow-
@@ -2514,6 +2561,12 @@ export function createApp(deps) {
         browseRoot: z.string().trim().min(1).max(4096).optional(),
         projectsDir: z.string().trim().min(1).max(4096).optional(),
         skillsAutoUpdate: z.boolean().nullable().optional(),
+        followups: z.boolean().nullable().optional(),
+        agentEnvPassthrough: z
+            .array(z.string().trim().min(1).max(200))
+            .max(64)
+            .nullable()
+            .optional(),
         composerDefaults: z
             .object({
             autonomous: z.boolean().nullable().optional(),
@@ -2526,6 +2579,7 @@ export function createApp(deps) {
             maxMonitoringSessions: z.number().int().min(0).max(16).optional(),
             monitoringWakeIntervalMinutes: z.number().int().min(1).max(60).nullable().optional(),
             autoResumeOnUsageLimit: z.boolean().optional(),
+            idleTimeoutMinutes: z.number().int().min(1).max(1440).nullable().optional(),
             memoryLimitMb: z.number().int().min(0).max(1_048_576).nullable().optional(),
             worktreeRetentionDefault: z.number().int().min(0).max(1000).optional(),
         })
@@ -3165,6 +3219,8 @@ export function createApp(deps) {
         catch (error) {
             if (error instanceof HistoryCursorError)
                 return c.json({ error: error.message }, error.status);
+            if (error instanceof EventCorrectionError)
+                return c.json({ error: error.message }, 409);
             throw error;
         }
     })
@@ -3173,7 +3229,14 @@ export function createApp(deps) {
         const { id } = c.req.valid('param');
         if (!store.getRun(id))
             return c.json({ error: 'not found' }, 404);
-        return c.json(await deriveRunContextEvents(join(dataDir, 'runs', `${id}.ndjson`)));
+        try {
+            return c.json(await deriveRunContextEvents(join(dataDir, 'runs', `${id}.ndjson`)));
+        }
+        catch (error) {
+            if (error instanceof EventCorrectionError)
+                return c.json({ error: error.message }, 409);
+            throw error;
+        }
     })
         // Editable titles (#389). The UI displays `titleSummary ?? title`, so a
         // user edit sets BOTH: `title` (the record's own name — the raw task stops
@@ -4103,11 +4166,25 @@ export function createApp(deps) {
             catch (error) {
                 if (error instanceof HistoryCursorError)
                     return c.json({ error: error.message }, error.status);
+                if (error instanceof EventCorrectionError)
+                    return c.json({ error: error.message }, 409);
                 throw error;
             }
         }
         const lastEventId = Number.parseInt(c.req.header('Last-Event-ID') ?? '', 10);
         const requestedAfter = Math.max(query.afterSeq ?? 0, Number.isSafeInteger(lastEventId) && lastEventId >= 0 ? lastEventId : 0);
+        if (!query.cursor) {
+            try {
+                validateLegacyHistoryResume(eventsPath, requestedAfter);
+            }
+            catch (error) {
+                if (error instanceof HistoryCursorError)
+                    return c.json({ error: error.message }, error.status);
+                if (error instanceof EventCorrectionError)
+                    return c.json({ error: error.message }, 409);
+                throw error;
+            }
+        }
         return streamSSENoBuffer(c, async (stream) => {
             let replaying = true;
             let maxSeq = requestedAfter;
@@ -4599,6 +4676,13 @@ export function createApp(deps) {
             // Optional review gate (#489): tri-state — null means "no config key, the
             // XEZ_REVIEW_GATE env default (OFF) decides".
             reviewGate: config.reviewGate ?? null,
+            // Planner/namer models and team skill sources (E). Declared in the file schema since
+            // spec 008 but absent from this answer and from `setConfigSchema`, so the only way to
+            // change them was to hand-edit `.xezar/config.json`. All three are `.default()`ed by
+            // the file schema, so they are always materialized here — never tri-state.
+            plannerModel: config.plannerModel,
+            namerModel: config.namerModel,
+            skillsRepos: config.skillsRepos,
         };
     };
     // ---- chained family: per-repo config (project-scoped) ----
@@ -4672,6 +4756,26 @@ export function createApp(deps) {
                 raw.memoryLimitMb = parsed.data.memoryLimitMb;
             }
         }
+        if (parsed.data.plannerModel !== undefined) {
+            if (parsed.data.plannerModel === null)
+                delete raw.plannerModel;
+            else
+                raw.plannerModel = parsed.data.plannerModel;
+        }
+        if (parsed.data.namerModel !== undefined) {
+            if (parsed.data.namerModel === null)
+                delete raw.namerModel;
+            else
+                raw.namerModel = parsed.data.namerModel;
+        }
+        if (parsed.data.skillsRepos !== undefined) {
+            // `null` clears back to the default catalog; `[]` is stored, because an empty list
+            // is how a repo turns team skills OFF (`gatedSkillsRepos` reads the key's presence).
+            if (parsed.data.skillsRepos === null)
+                delete raw.skillsRepos;
+            else
+                raw.skillsRepos = parsed.data.skillsRepos;
+        }
         if (parsed.data.defaultModels !== undefined) {
             // Per-runner merge, so setting codex's preset never clobbers claude's.
             const current = raw.defaultModels && typeof raw.defaultModels === 'object'
@@ -4697,6 +4801,13 @@ export function createApp(deps) {
         catch (err) {
             return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
         }
+        // B2: the per-repo `memoryLimitMb` is enforced again, and enforcement reads it from
+        // the semaphore's cached snapshot — so this write has to refresh that snapshot, the
+        // same way `PUT /api/v1/workspace/config` and `PATCH /api/v1/projects/:id` do. Without
+        // it the key would save and do nothing until the next boot, which is the exact defect
+        // B2 exists to fix.
+        if (parsed.data.memoryLimitMb !== undefined)
+            await deps.semaphore?.refresh();
         // Pre-R6 answer shape ({baseBranch, defaultRunner}) + additive R6 fields.
         return c.json(await configAnswer(repoRoot, await loadConfig(repoRoot)));
     });
@@ -4732,6 +4843,19 @@ export function createApp(deps) {
         // Optional review gate toggle (Settings → Agents, #489): null clears the key
         // back to the env-default behavior (OFF).
         reviewGate: z.boolean().nullable().optional(),
+        // Planner/namer models and team skill sources (E). `null` clears each key back to its
+        // schema default; `skillsRepos: []` is a real value that disables team skills, which is
+        // why the empty array is stored rather than treated as a clear.
+        plannerModel: z.string().trim().min(1).max(200).nullable().optional(),
+        namerModel: z.string().trim().min(1).max(200).nullable().optional(),
+        skillsRepos: z
+            .array(z.object({
+            repo: z.string().trim().min(1).max(500),
+            ref: z.string().trim().min(1).max(200).optional(),
+        }))
+            .max(32)
+            .nullable()
+            .optional(),
     });
     const setAgentConfigSchema = z.object({
         content: z.string().max(2_000_000),
@@ -4849,8 +4973,38 @@ export function createApp(deps) {
         }
         return numbers;
     };
-    const runIndexEntry = (projectId, run) => {
+    /**
+     * How many DISTINCT backends a run's recorded steps used. A step that never ran recorded no
+     * backend and is not counted — absent is "nothing happened here", never a second backend.
+     *
+     * Derived HERE because the index row carries no `steps[]` by design (see the schema's header).
+     * The cockpit's `stepBackendCount` applies the identical rule to the fat record on the
+     * per-project table; keep the two the same.
+     */
+    const distinctStepBackends = (run) => new Set(run.steps.flatMap((step) => (step.backend ? [step.backend] : []))).size;
+    /**
+     * The runner a run RAN AS, in order of how good the evidence is — `undefined` only when the run
+     * carries none, which means it never started.
+     *
+     * `RunRecord.runner` is not "what the caller asked for": `execute` writes the resolved backend
+     * onto the record the moment a run begins (`workflows/run.ts`), so for anything that ever ran it
+     * is a fact. A record written before run-level backend affinity existed still has step backends,
+     * stamped at spawn — and resolving one of THOSE against today's `defaultRunner` would name a
+     * backend the run never touched.
+     */
+    const recordedRunner = (run) => {
+        if (run.runner)
+            return run.runner;
+        for (let index = run.steps.length - 1; index >= 0; index -= 1) {
+            const backend = run.steps[index]?.backend;
+            if (backend)
+                return backend;
+        }
+        return undefined;
+    };
+    const runIndexEntry = (projectId, run, runner) => {
         const usage = currentUsage(run.id);
+        const backends = distinctStepBackends(run);
         return {
             projectId,
             id: run.id,
@@ -4865,6 +5019,15 @@ export function createApp(deps) {
             archived: run.archived,
             ...(run.autoResumeAt !== undefined ? { autoResumeAt: run.autoResumeAt } : {}),
             workflow: run.workflow,
+            // Resolved HERE because rows span projects: the browser would need one config request per
+            // project to finish it. `inherited` marks the one case that is not history — a run carrying
+            // no evidence at all has not started, so the value is what it WOULD run as.
+            runner: runner.runner,
+            ...(runner.inherited ? { runnerInherited: true } : {}),
+            ...(run.model !== undefined ? { model: run.model } : {}),
+            // Only when it says something: 0 or 1 backend is every ordinary run, and a key nobody reads
+            // is exactly the weight this slim row exists to refuse.
+            ...(backends > 1 ? { stepBackends: backends } : {}),
             ...(run.branch !== undefined ? { branch: run.branch } : {}),
             ...(run.startedAt !== undefined ? { startedAt: run.startedAt } : {}),
             // The tracker-reference inputs, verbatim — the cockpit's `taskReference()` owns the rule
@@ -4933,9 +5096,30 @@ export function createApp(deps) {
             const recent = (owned ? owned.store.listRuns() : readRunIndexFromDisk(projectDataDir(project.root))).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
             if (recent.length > RUNS_INDEX_PER_PROJECT)
                 truncated.push(project.id);
+            // LAZY, and at most once per project. This route is polled every 15s and invalidated on a
+            // 400ms debounce during a run, so a config read per project per request would be dozens of
+            // file reads a second on a large registry. Almost every row answers for itself — a started
+            // run carries its own resolved `runner` — so in practice this never runs at all.
+            let projectDefault;
+            const defaultRunnerFor = async () => {
+                if (projectDefault === undefined) {
+                    try {
+                        projectDefault = (await loadConfig(project.root)).defaultRunner;
+                    }
+                    catch {
+                        // Documented contract: this read degrades to fewer or plainer rows, never a 500.
+                        projectDefault = 'claude';
+                    }
+                }
+                return projectDefault;
+            };
             const mentioned = [];
             for (const run of recent.slice(0, RUNS_INDEX_PER_PROJECT)) {
-                runs.push(runIndexEntry(project.id, run));
+                const recorded = recordedRunner(run);
+                const runner = recorded
+                    ? { runner: recorded, inherited: false }
+                    : { runner: await defaultRunnerFor(), inherited: true };
+                runs.push(runIndexEntry(project.id, run, runner));
                 mentioned.push(...mentionedReferenceNumbers(run));
             }
             if (mentioned.length > 0) {