@rryando/arcs 3.10.0 → 4.0.0

package/dist/web-server/storage.d.ts

@@ -0,0 +1,17 @@
+/** Lock-safe, atomic filesystem mutations used by the web server. */
+import { type RootMeta } from "../utils/dag.js";
+export { writeTextAtomic } from "../utils/storage-utils.js";
+/** Atomically replace a text file while holding its advisory lock. */
+export declare function writeTextLocked(filePath: string, content: string): Promise<void>;
+/** Remove a file while holding the same advisory lock writers use. */
+export declare function removeFileLocked(filePath: string): Promise<void>;
+/**
+ * Acquire several file locks in deterministic lexical order to avoid deadlock.
+ */
+export declare function withFileLocks<T>(filePaths: string[], fn: () => T | Promise<T>): Promise<T>;
+/**
+ * Read-modify-write root meta.json while holding one lock for the whole
+ * validation and mutation transaction.
+ */
+export declare function mutateRootMetaLocked<T>(dataDir: string, mutate: (rootMeta: RootMeta) => T | Promise<T>): Promise<T>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/web-server/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/web-server/storage.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAIrE,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AAI9D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,sEAAsE;AACtE,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED,sEAAsE;AACtE,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAUhG;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAQZ"}

package/dist/web-server/storage.js

@@ -0,0 +1,42 @@
+/** Lock-safe, atomic filesystem mutations used by the web server. */
+import { unlink } from "node:fs/promises";
+import { resolve } from "node:path";
+import { readRootMeta } from "../utils/dag.js";
+import { withLock } from "../utils/file-lock.js";
+import { writeTextAtomic } from "../utils/storage-utils.js";
+export { writeTextAtomic } from "../utils/storage-utils.js";
+/** Atomically replace a text file while holding its advisory lock. */
+export async function writeTextLocked(filePath, content) {
+    await withLock(filePath, () => writeTextAtomic(filePath, content));
+}
+/** Remove a file while holding the same advisory lock writers use. */
+export async function removeFileLocked(filePath) {
+    await withLock(filePath, () => unlink(filePath).catch(() => { }));
+}
+/**
+ * Acquire several file locks in deterministic lexical order to avoid deadlock.
+ */
+export async function withFileLocks(filePaths, fn) {
+    const ordered = [...new Set(filePaths)].sort();
+    const acquire = async (index) => {
+        const filePath = ordered[index];
+        if (filePath === undefined)
+            return fn();
+        return withLock(filePath, () => acquire(index + 1));
+    };
+    return acquire(0);
+}
+/**
+ * Read-modify-write root meta.json while holding one lock for the whole
+ * validation and mutation transaction.
+ */
+export async function mutateRootMetaLocked(dataDir, mutate) {
+    const rootMetaPath = resolve(dataDir, "meta.json");
+    return withLock(rootMetaPath, async () => {
+        const rootMeta = await readRootMeta(dataDir);
+        const result = await mutate(rootMeta);
+        await writeTextAtomic(rootMetaPath, `${JSON.stringify(rootMeta, null, 2)}\n`);
+        return result;
+    });
+}
+//# sourceMappingURL=storage.js.map

package/dist/web-server/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/web-server/storage.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAiB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAe;IACrE,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,SAAmB,EAAE,EAAwB;IAClF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAc,EAAE;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,MAA8C;IAE9C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,eAAe,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web-server/watcher.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Data-directory watcher for the web server.
+ *
+ * Emits debounced, classified change events over the ARCS data dir so the web
+ * UI can live-refresh when the CLI (or another agent) mutates the DAG.
+ * Uses recursive fs.watch when available (Node >= 20 on Linux), falling back
+ * to per-directory watchers otherwise.
+ */
+export interface ChangeEvent {
+    type: "changed";
+    slug: string | null;
+    area: "root" | "knowledge" | "tasks" | "plans" | "proposals" | "sessions" | "docs" | "meta" | "other";
+    path: string;
+    at: string;
+}
+type Listener = (event: ChangeEvent) => void;
+export declare function onDataChange(listener: Listener): () => void;
+/**
+ * Classifies a data-dir-relative path into a change area + project slug.
+ * Returns null for paths outside the project DAG (e.g. tokens/, config.json).
+ */
+export declare function classifyChange(relativePath: string): {
+    slug: string | null;
+    area: ChangeEvent["area"];
+} | null;
+/**
+ * Starts watching the data dir. Idempotent — safe to call per app instance.
+ */
+export declare function startWatcher(dataDir: string, options?: {
+    forceFallback?: boolean;
+}): "recursive" | "fallback";
+/**
+ * Stops all watchers (test cleanup).
+ */
+export declare function stopWatcher(): void;
+export {};
+//# sourceMappingURL=watcher.d.ts.map

package/dist/web-server/watcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.d.ts","sourceRoot":"","sources":["../../src/web-server/watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EACA,MAAM,GACN,WAAW,GACX,OAAO,GACP,OAAO,GACP,WAAW,GACX,UAAU,GACV,MAAM,GACN,MAAM,GACN,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,KAAK,QAAQ,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;AAY7C,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,IAAI,CAK3D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,GACnB;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,CAkB3D;AAiFD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,WAAW,GAAG,UAAU,CAoB1B;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAgBlC"}

package/dist/web-server/watcher.js

@@ -0,0 +1,181 @@
+/**
+ * Data-directory watcher for the web server.
+ *
+ * Emits debounced, classified change events over the ARCS data dir so the web
+ * UI can live-refresh when the CLI (or another agent) mutates the DAG.
+ * Uses recursive fs.watch when available (Node >= 20 on Linux), falling back
+ * to per-directory watchers otherwise.
+ */
+import { existsSync, readdirSync, watch } from "node:fs";
+import { join } from "node:path";
+const listeners = new Set();
+const watchers = [];
+const watchedDirs = new Set();
+const pending = new Map();
+let started = false;
+let mode = null;
+let fallbackDataDir = null;
+let fallbackRescanTimer = null;
+export function onDataChange(listener) {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+}
+/**
+ * Classifies a data-dir-relative path into a change area + project slug.
+ * Returns null for paths outside the project DAG (e.g. tokens/, config.json).
+ */
+export function classifyChange(relativePath) {
+    const rel = relativePath.replace(/\\/g, "/");
+    if (rel === "meta.json")
+        return { slug: null, area: "root" };
+    const match = rel.match(/^projects\/([^/]+)(?:\/(.*))?$/);
+    if (!match || !match[1])
+        return null;
+    const slug = match[1];
+    const rest = match[2] ?? "";
+    if (rest === "knowledge" || rest.startsWith("knowledge/"))
+        return { slug, area: "knowledge" };
+    if (rest === "tasks" || rest.startsWith("tasks/") || rest === "tasks.md")
+        return { slug, area: "tasks" };
+    if (rest === "plans" || rest.startsWith("plans/"))
+        return { slug, area: "plans" };
+    if (rest === "proposals" || rest.startsWith("proposals/"))
+        return { slug, area: "proposals" };
+    if (rest === "sessions" || rest.startsWith("sessions/"))
+        return { slug, area: "sessions" };
+    if (rest === "meta.json")
+        return { slug, area: "meta" };
+    if (rest.endsWith(".md"))
+        return { slug, area: "docs" };
+    return { slug, area: "other" };
+}
+function emit(relativePath) {
+    const classified = classifyChange(relativePath);
+    if (!classified)
+        return;
+    // Debounce per (slug, area) — a store write touches several files at once.
+    const key = `${classified.slug ?? "_"}:${classified.area}`;
+    const existing = pending.get(key);
+    if (existing)
+        clearTimeout(existing);
+    pending.set(key, setTimeout(() => {
+        pending.delete(key);
+        const event = {
+            type: "changed",
+            slug: classified.slug,
+            area: classified.area,
+            path: relativePath,
+            at: new Date().toISOString(),
+        };
+        for (const listener of listeners) {
+            try {
+                listener(event);
+            }
+            catch {
+                // Listener failures must not break the watcher.
+            }
+        }
+    }, 250));
+}
+function watchDir(absDir, relPrefix) {
+    if (!existsSync(absDir) || watchedDirs.has(absDir))
+        return;
+    try {
+        const watcher = watch(absDir, (eventType, filename) => {
+            if (!filename)
+                return;
+            emit(relPrefix ? `${relPrefix}/${filename}` : filename);
+            if (eventType === "rename" && fallbackDataDir)
+                scheduleFallbackRescan();
+        });
+        watchedDirs.add(absDir);
+        watchers.push(watcher);
+    }
+    catch {
+        // Best-effort watching; ignore individual directory failures.
+    }
+}
+function scheduleFallbackRescan() {
+    if (!fallbackDataDir)
+        return;
+    if (fallbackRescanTimer)
+        clearTimeout(fallbackRescanTimer);
+    fallbackRescanTimer = setTimeout(() => {
+        fallbackRescanTimer = null;
+        if (fallbackDataDir)
+            startFallbackWatchers(fallbackDataDir);
+    }, 100);
+}
+function startFallbackWatchers(dataDir) {
+    fallbackDataDir = dataDir;
+    watchDir(dataDir, "");
+    const projectsRoot = join(dataDir, "projects");
+    watchDir(projectsRoot, "projects");
+    let slugs = [];
+    try {
+        slugs = readdirSync(projectsRoot, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name);
+    }
+    catch {
+        return;
+    }
+    for (const slug of slugs) {
+        const projectAbs = join(projectsRoot, slug);
+        watchDir(projectAbs, `projects/${slug}`);
+        for (const sub of ["knowledge", "tasks", "plans", "proposals", "sessions"]) {
+            watchDir(join(projectAbs, sub), `projects/${slug}/${sub}`);
+        }
+    }
+}
+/**
+ * Starts watching the data dir. Idempotent — safe to call per app instance.
+ */
+export function startWatcher(dataDir, options = {}) {
+    if (started)
+        return mode ?? "fallback";
+    started = true;
+    if (!options.forceFallback) {
+        try {
+            const watcher = watch(dataDir, { recursive: true }, (_eventType, filename) => {
+                if (filename)
+                    emit(filename);
+            });
+            watchers.push(watcher);
+            mode = "recursive";
+            return mode;
+        }
+        catch {
+            // Recursive watch unsupported — fall back to per-directory watchers.
+        }
+    }
+    startFallbackWatchers(dataDir);
+    mode = "fallback";
+    return mode;
+}
+/**
+ * Stops all watchers (test cleanup).
+ */
+export function stopWatcher() {
+    for (const watcher of watchers.splice(0)) {
+        try {
+            watcher.close();
+        }
+        catch {
+            // ignore
+        }
+    }
+    for (const timeout of pending.values())
+        clearTimeout(timeout);
+    if (fallbackRescanTimer)
+        clearTimeout(fallbackRescanTimer);
+    pending.clear();
+    watchedDirs.clear();
+    started = false;
+    mode = null;
+    fallbackDataDir = null;
+    fallbackRescanTimer = null;
+}
+//# sourceMappingURL=watcher.js.map

package/dist/web-server/watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.js","sourceRoot":"","sources":["../../src/web-server/watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAkB,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAqBjC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAY,CAAC;AACtC,MAAM,QAAQ,GAAgB,EAAE,CAAC;AACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;AAEjE,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,IAAI,IAAI,GAAoC,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,mBAAmB,GAAyC,IAAI,CAAC;AAErE,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB;IAEpB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9F,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,UAAU;QACtE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACjC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9F,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC3F,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,YAAoB;IAChC,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,2EAA2E;IAC3E,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,IAAI,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ;QAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IAErC,OAAO,CAAC,GAAG,CACT,GAAG,EACH,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,KAAK,GAAgB;YACzB,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,YAAY;YAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC;QACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC,EAAE,GAAG,CAAC,CACR,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,SAAiB;IACjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAC3D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;YACpD,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,SAAS,KAAK,QAAQ,IAAI,eAAe;gBAAE,sBAAsB,EAAE,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,CAAC,eAAe;QAAE,OAAO;IAC7B,IAAI,mBAAmB;QAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC3D,mBAAmB,GAAG,UAAU,CAAC,GAAG,EAAE;QACpC,mBAAmB,GAAG,IAAI,CAAC;QAC3B,IAAI,eAAe;YAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,eAAe,GAAG,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAEnC,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACvD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC5C,QAAQ,CAAC,UAAU,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,YAAY,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,UAAuC,EAAE;IAEzC,IAAI,OAAO;QAAE,OAAO,IAAI,IAAI,UAAU,CAAC;IACvC,OAAO,GAAG,IAAI,CAAC;IAEf,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAC3E,IAAI,QAAQ;oBAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,GAAG,WAAW,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,UAAU,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE;QAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,mBAAmB;QAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,OAAO,GAAG,KAAK,CAAC;IAChB,IAAI,GAAG,IAAI,CAAC;IACZ,eAAe,GAAG,IAAI,CAAC;IACvB,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC"}

package/dist/web-server/web-auth.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `X-ARCS-Token` gate for mutating API routes.
+ *
+ * Layered on top of (never instead of) the global loopback-only
+ * `secureLocalRequest`: loopback proves the caller is on this machine, the
+ * token proves it is a page this server itself served (see web-token.ts).
+ *
+ * Deny-by-default across `/api/*` rather than an allowlist of known paths: a
+ * mutating route added later is gated the moment it is registered, with exactly
+ * one exemption — `/api/hook/*`, whose caller is a Claude Code hook subprocess
+ * and not the browser, and which carries its own independent bearer token
+ * (hook-auth.ts). Reads are untouched: every GET/HEAD/OPTIONS passes straight
+ * through, so `/api/events` and the whole read surface behave exactly as before.
+ */
+import type { MiddlewareHandler } from "hono";
+export declare const requireWebToken: MiddlewareHandler;
+//# sourceMappingURL=web-auth.d.ts.map

package/dist/web-server/web-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-auth.d.ts","sourceRoot":"","sources":["../../src/web-server/web-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAc9C,eAAO,MAAM,eAAe,EAAE,iBAW7B,CAAC"}

package/dist/web-server/web-auth.js

@@ -0,0 +1,33 @@
+/**
+ * `X-ARCS-Token` gate for mutating API routes.
+ *
+ * Layered on top of (never instead of) the global loopback-only
+ * `secureLocalRequest`: loopback proves the caller is on this machine, the
+ * token proves it is a page this server itself served (see web-token.ts).
+ *
+ * Deny-by-default across `/api/*` rather than an allowlist of known paths: a
+ * mutating route added later is gated the moment it is registered, with exactly
+ * one exemption — `/api/hook/*`, whose caller is a Claude Code hook subprocess
+ * and not the browser, and which carries its own independent bearer token
+ * (hook-auth.ts). Reads are untouched: every GET/HEAD/OPTIONS passes straight
+ * through, so `/api/events` and the whole read surface behave exactly as before.
+ */
+import { fail } from "./respond.js";
+import { verifyWebToken } from "./web-token.js";
+/** Mirrors the mutation set in security.ts. */
+const MUTATION_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+/** The one prefix that authenticates with its own bearer token instead. */
+const HOOK_PREFIX = "/api/hook/";
+function needsWebToken(method, path) {
+    return MUTATION_METHODS.has(method.toUpperCase()) && !path.startsWith(HOOK_PREFIX);
+}
+export const requireWebToken = async (c, next) => {
+    if (needsWebToken(c.req.method, c.req.path) &&
+        !verifyWebToken(c.req.header("x-arcs-token") ?? "")) {
+        // A clean typed refusal, not a throw: respond.ts only maps DagError, and a
+        // missing token is an auth answer rather than a DAG failure.
+        return c.json(fail("web_unauthorized", "Missing or invalid ARCS web token"), 401);
+    }
+    await next();
+};
+//# sourceMappingURL=web-auth.js.map

package/dist/web-server/web-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-auth.js","sourceRoot":"","sources":["../../src/web-server/web-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErE,2EAA2E;AAC3E,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,SAAS,aAAa,CAAC,MAAc,EAAE,IAAY;IACjD,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAClE,IACE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACvC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EACnD,CAAC;QACD,2EAA2E;QAC3E,6DAA6D;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC"}

package/dist/web-server/web-token.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Per-server auth token for the browser-facing mutating API.
+ *
+ * The loopback + Origin checks in security.ts stop remote and cross-site
+ * callers, but they authenticate a NETWORK LOCATION, not a process: every other
+ * program on this machine shares localhost, and the mutating routes now spawn
+ * `claude` subprocesses. This token proves the caller is a page THIS server
+ * served — it is minted fresh at every server start and injected into the
+ * served index.html (see static.ts), so the SPA holds it from first paint and
+ * no other local process can guess it.
+ *
+ * Deliberately per-SERVER, not per-project (unlike hook-token-store, which
+ * authenticates a per-project hook install): it authenticates the browser tab,
+ * and one tab drives every project. Verification always reads the in-memory
+ * value, never the file, so a second server started against the same data dir
+ * cannot authorize requests to this one — it only replaces the on-disk copy.
+ * Exactly one token is live per PROCESS: a second createApp in the same process
+ * rotates it and every app then verifies against the newest value. ARCS runs
+ * one server per process, so that is a test-only nuance.
+ *
+ * The file exists for out-of-band consumers (scripts, tests) and is written
+ * 0o600: the token is never passed on an argv or in an env var a `ps` can read.
+ */
+export declare function webTokenPath(): string;
+/**
+ * Mints this server's token, replacing any previous one, and persists it 0o600.
+ * Called once from createApp, before any route can be served: the middleware
+ * and the index.html transform both read the value it installs.
+ */
+export declare function mintWebToken(): string;
+/** This server's live token, or undefined before mintWebToken() has run. */
+export declare function currentWebToken(): string | undefined;
+/**
+ * Constant-time token comparison. Returns false when no token has been minted
+ * yet, so a request that arrives before startup finished cannot be authorized
+ * by an empty header.
+ */
+export declare function verifyWebToken(candidate: string): boolean;
+//# sourceMappingURL=web-token.d.ts.map

package/dist/web-server/web-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-token.d.ts","sourceRoot":"","sources":["../../src/web-server/web-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkBH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAerC;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOzD"}

package/dist/web-server/web-token.js

@@ -0,0 +1,71 @@
+/**
+ * Per-server auth token for the browser-facing mutating API.
+ *
+ * The loopback + Origin checks in security.ts stop remote and cross-site
+ * callers, but they authenticate a NETWORK LOCATION, not a process: every other
+ * program on this machine shares localhost, and the mutating routes now spawn
+ * `claude` subprocesses. This token proves the caller is a page THIS server
+ * served — it is minted fresh at every server start and injected into the
+ * served index.html (see static.ts), so the SPA holds it from first paint and
+ * no other local process can guess it.
+ *
+ * Deliberately per-SERVER, not per-project (unlike hook-token-store, which
+ * authenticates a per-project hook install): it authenticates the browser tab,
+ * and one tab drives every project. Verification always reads the in-memory
+ * value, never the file, so a second server started against the same data dir
+ * cannot authorize requests to this one — it only replaces the on-disk copy.
+ * Exactly one token is live per PROCESS: a second createApp in the same process
+ * rotates it and every app then verifies against the newest value. ARCS runs
+ * one server per process, so that is a test-only nuance.
+ *
+ * The file exists for out-of-band consumers (scripts, tests) and is written
+ * 0o600: the token is never passed on an argv or in an env var a `ps` can read.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getDataDir } from "../utils/paths.js";
+import { nowISO } from "../utils/storage-utils.js";
+const TOKEN_BYTES = 32;
+let currentToken;
+export function webTokenPath() {
+    return join(getDataDir(), "web-token.json");
+}
+/**
+ * Mints this server's token, replacing any previous one, and persists it 0o600.
+ * Called once from createApp, before any route can be served: the middleware
+ * and the index.html transform both read the value it installs.
+ */
+export function mintWebToken() {
+    const token = randomBytes(TOKEN_BYTES).toString("hex");
+    const file = { token, createdAt: nowISO() };
+    const path = webTokenPath();
+    mkdirSync(dirname(path), { recursive: true });
+    // The `mode` option only applies when writeFileSync CREATES the file, so an
+    // existing token file keeps whatever mode it had — chmod unconditionally.
+    // A world-readable token file is the exact failure this whole module exists
+    // to avoid.
+    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+    chmodSync(path, 0o600);
+    currentToken = token;
+    return token;
+}
+/** This server's live token, or undefined before mintWebToken() has run. */
+export function currentWebToken() {
+    return currentToken;
+}
+/**
+ * Constant-time token comparison. Returns false when no token has been minted
+ * yet, so a request that arrives before startup finished cannot be authorized
+ * by an empty header.
+ */
+export function verifyWebToken(candidate) {
+    if (!currentToken || !candidate)
+        return false;
+    const expected = Buffer.from(currentToken, "utf-8");
+    const actual = Buffer.from(candidate, "utf-8");
+    if (expected.length !== actual.length)
+        return false;
+    return timingSafeEqual(expected, actual);
+}
+//# sourceMappingURL=web-token.js.map

package/dist/web-server/web-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-token.js","sourceRoot":"","sources":["../../src/web-server/web-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAQnD,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,IAAI,YAAgC,CAAC;AAErC,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,gBAAgB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,IAAI,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,YAAY;IACZ,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEvB,YAAY,GAAG,KAAK,CAAC;IACrB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/opencode/arcs/bundle-runtime.json

@@ -9,9 +9,6 @@
       "scripts/start-server.sh",
       "scripts/stop-server.sh"
     ],
-    "code-agent": [
-      "SKILL.md"
-    ],
     "deep-pr-review": [
       "SKILL.md",
       "review-template.md",
@@ -21,17 +18,13 @@
       "SKILL.md"
     ],
     "executing-plans": [
-      "SKILL.md",
-      "code-quality-reviewer-prompt.md",
-      "implementer-prompt.md",
-      "spec-reviewer-prompt.md"
+      "SKILL.md"
     ],
-    "quick-dev": [
+    "implementation": [
       "SKILL.md"
     ],
-    "requesting-code-review": [
-      "SKILL.md",
-      "code-reviewer.md"
+    "install-claude-code-hook": [
+      "SKILL.md"
     ],
     "systematic-debugging": [
       "SKILL.md",
@@ -66,8 +59,7 @@
     "bundle-runtime.json",
     ".opencode/plugins/arcs.js",
     "skills/caveman-commit/SKILL.md",
-    "skills/init-project/SKILL.md",
-    "skills/the-ladder/SKILL.md"
+    "skills/init-project/SKILL.md"
   ],
   "excludePatterns": [
     "**/references/**",