@shawnstack/quickforge 1.0.0 → 1.2.0

package/server/index.mjs

@@ -2,47 +2,183 @@
 import { createServer } from 'node:http'
 import { spawn } from 'node:child_process'
 import path from 'node:path'
+import { randomUUID } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { sendJson, sendError } from './utils/response.mjs'
 import { openBrowser } from './utils/platform.mjs'
-import { migrateLegacyDataDirs, ensureStorage, dataDir, storageDir } from './storage.mjs'
+import { ensureStorage, dataDir, configDir, storageDir, cacheDir, logsDir } from './storage.mjs'
 import { setDefaultWorkspaceRoot, initializeActiveProject, readProjectConfig, getActiveProject } from './project-config.mjs'
 import { getWorkspaceRoot } from './utils/workspace.mjs'
 import { handleStorageApi } from './routes/storage.mjs'
 import { handleProjectApi } from './routes/project.mjs'
-import { handleFilesystemApi } from './routes/filesystem.mjs'
-import { handleToolApi } from './routes/tools.mjs'
+import { handleFilesystemApi, setActiveWorkspaceRootForFilesystem } from './routes/filesystem.mjs'
+import { handleToolApi, handleGetTools } from './routes/tools.mjs'
 import { handleInstructionsApi } from './routes/instructions.mjs'
+import { handleSkillsApi } from './routes/skills.mjs'
+import { handleAgentApi } from './routes/agent.mjs'
+import { handleScheduledTasksApi, startScheduledTaskRunner, stopScheduledTaskRunner } from './routes/scheduled-tasks.mjs'
+import { handleBackupApi } from './routes/backup.mjs'
+import { handleSystemApi } from './routes/system.mjs'
+import { handleSharesApi } from './routes/shares.mjs'
+import { handleSharedConversationApi } from './routes/shared-conversation.mjs'
 import { serveStatic } from './routes/static.mjs'
-import { setActiveWorkspaceRootForFilesystem } from './routes/filesystem.mjs'
+import { logger } from './utils/logger.mjs'
+import { isLoopbackAddress, getLanUrls } from './utils/network.mjs'
+import { shutdown as shutdownAgentManager, resetStaleTaskStatuses } from './agent-manager.mjs'
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
 const projectRoot = path.resolve(__dirname, '..')
+const serverScript = path.join(__dirname, 'index.mjs')
+const restartSupervisorScript = path.join(__dirname, 'restart-supervisor.mjs')
+const bootId = randomUUID()
+const startedAt = new Date().toISOString()
 
 const isDev = process.argv.includes('--dev')
-const host = process.env.QUICKFORGE_HOST || process.env.FASTCODE_HOST || '127.0.0.1'
-const port = Number(process.env.QUICKFORGE_PORT || process.env.FASTCODE_PORT || (isDev ? 32176 : 5176))
-const vitePort = Number(process.env.QUICKFORGE_VITE_PORT || process.env.FASTCODE_VITE_PORT || 5176)
+const shareLanEnabled = process.env.QUICKFORGE_SHARE_LAN !== '0'
+const host = process.env.QUICKFORGE_HOST || '0.0.0.0'
+if (!['127.0.0.1', 'localhost'].includes(host) && process.env.QUICKFORGE_ALLOW_REMOTE !== '1' && !shareLanEnabled) {
+  throw new Error('Remote binding is disabled by default. Set QUICKFORGE_ALLOW_REMOTE=1 or keep QUICKFORGE_SHARE_LAN enabled to allow it.')
+}
+const port = Number(process.env.QUICKFORGE_PORT || (isDev ? 32176 : 5176))
+const vitePort = Number(process.env.QUICKFORGE_VITE_PORT || 5176)
+let restartInProgress = false
+
+setDefaultWorkspaceRoot(process.env.QUICKFORGE_WORKSPACE_DIR || projectRoot)
+
+function getRestartSupport() {
+  return { supported: true, reason: null }
+}
+
+async function getSystemStatus() {
+  const config = await readProjectConfig()
+  const restartSupport = getRestartSupport()
+  return {
+    ok: true,
+    mode: isDev ? 'development' : 'production',
+    pid: process.pid,
+    bootId,
+    startedAt,
+    restartSupported: restartSupport.supported,
+    restartUnsupportedReason: restartSupport.reason,
+    dataDir,
+    configDir,
+    storageDir,
+    cacheDir,
+    logsDir,
+    workspaceRoot: getWorkspaceRoot(),
+    host,
+    port,
+    shareLanEnabled,
+    lanUrls: getLanUrls(port),
+    project: getActiveProject(config),
+  }
+}
+
+function spawnRestartSupervisor() {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [
+      restartSupervisorScript,
+      String(process.pid),
+      serverScript,
+      projectRoot,
+      ...process.argv.slice(2),
+    ], {
+      cwd: projectRoot,
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+      shell: false,
+      env: {
+        ...process.env,
+        QUICKFORGE_NO_OPEN: '1',
+      },
+    })
+
+    child.once('error', reject)
+    child.once('spawn', () => {
+      child.unref()
+      resolve(child.pid)
+    })
+  })
+}
+
+function closeHttpServer() {
+  return new Promise((resolve) => {
+    const forceTimer = setTimeout(() => {
+      server.closeAllConnections?.()
+      resolve()
+    }, 1500)
+
+    server.close(() => {
+      clearTimeout(forceTimer)
+      resolve()
+    })
+    server.closeIdleConnections?.()
+  })
+}
+
+async function performRestart() {
+  logger.info('Restart requested from settings UI.')
+  const supervisorPid = await spawnRestartSupervisor()
+  logger.info(`Restart supervisor started (PID ${supervisorPid}).`)
+
+  stopScheduledTaskRunner()
+  stopVite()
+  await shutdownAgentManager()
+  await closeHttpServer()
+  process.exit(0)
+}
+
+async function requestRestart() {
+  if (restartInProgress) {
+    const error = new Error('Restart already in progress')
+    error.statusCode = 423
+    throw error
+  }
+
+  const restartSupport = getRestartSupport()
+  if (!restartSupport.supported) {
+    const error = new Error(restartSupport.reason || 'Restart is not supported')
+    error.statusCode = 409
+    throw error
+  }
 
-setDefaultWorkspaceRoot(process.env.QUICKFORGE_WORKSPACE_DIR || process.env.FASTCODE_WORKSPACE_DIR || projectRoot)
+  restartInProgress = true
+  setTimeout(() => {
+    void performRestart().catch((error) => {
+      logger.error('Failed to restart QuickForge:', error)
+      restartInProgress = false
+    })
+  }, 100)
+
+  return { ok: true, restarting: true, bootId }
+}
 
 // --- Route dispatching ---
 async function handleApi(req, res, url) {
   const pathname = url.pathname
   const parts = pathname.split('/').filter(Boolean)
 
+  // Conversation share routes (management + public LAN access)
+  if (pathname === '/api/shares' || pathname.startsWith('/api/shares/')) {
+    await handleSharesApi(req, res, url, { port })
+    return
+  }
+
+  if (pathname.startsWith('/api/shared/')) {
+    await handleSharedConversationApi(req, res, url)
+    return
+  }
+
   // Health check
   if (req.method === 'GET' && pathname === '/api/health') {
-    const config = await readProjectConfig()
-    sendJson(res, 200, {
-      ok: true,
-      mode: isDev ? 'development' : 'production',
-      dataDir,
-      storageDir,
-      workspaceRoot: getWorkspaceRoot(),
-      project: getActiveProject(config),
-    })
+    sendJson(res, 200, await getSystemStatus())
+    return
+  }
+
+  if (req.method === 'GET' && pathname === '/api/project/commands') {
+    await handleProjectApi(req, res, url)
     return
   }
 
@@ -52,6 +188,12 @@ async function handleApi(req, res, url) {
     return
   }
 
+  // Skills
+  if (pathname === '/api/skills' || pathname.startsWith('/api/skills/')) {
+    await handleSkillsApi(req, res, url)
+    return
+  }
+
   // Project routes
   if (pathname === '/api/project' || pathname.startsWith('/api/project/')) {
     await handleProjectApi(req, res, url)
@@ -64,12 +206,48 @@ async function handleApi(req, res, url) {
     return
   }
 
+  // Tool definitions (canonical)
+  if (req.method === 'GET' && pathname === '/api/tools') {
+    await handleGetTools(req, res)
+    return
+  }
+
   // Tool routes
   if (pathname.startsWith('/api/tools/') || (parts[0] === 'api' && parts[1] === 'projects' && parts[3] === 'tools')) {
     await handleToolApi(req, res, url)
     return
   }
 
+  // Agent routes
+  if (parts[0] === 'api' && parts[1] === 'agents') {
+    await handleAgentApi(req, res, url)
+    return
+  }
+
+  // Scheduled task routes
+  if (pathname === '/api/scheduled-tasks' || pathname.startsWith('/api/scheduled-tasks/')) {
+    await handleScheduledTasksApi(req, res, url)
+    return
+  }
+
+  // Backup / import-export routes
+  if (pathname === '/api/backup/export' || pathname === '/api/backup/import') {
+    await handleBackupApi(req, res, url)
+    return
+  }
+
+  // System routes
+  if (pathname === '/api/system/status' || pathname === '/api/system/restart' || pathname === '/api/system/network') {
+    await handleSystemApi(req, res, url, {
+      getSystemStatus,
+      requestRestart,
+      host,
+      port,
+      remoteEnabled: host !== '127.0.0.1' && host !== 'localhost',
+    })
+    return
+  }
+
   // Storage routes (catch-all)
   if (parts[0] === 'api' && parts[1] === 'storage') {
     await handleStorageApi(req, res, url)
@@ -82,64 +260,178 @@ async function handleApi(req, res, url) {
 }
 
 // --- Vite dev server ---
+let viteChild = null
+
 function startVite() {
   const viteCli = path.join(projectRoot, 'node_modules', 'vite', 'bin', 'vite.js')
-  const child = spawn(process.execPath, [viteCli, '--host', '127.0.0.1', '--port', String(vitePort), '--strictPort'], {
+  viteChild = spawn(process.execPath, [viteCli, '--host', '127.0.0.1', '--port', String(vitePort), '--strictPort'], {
     cwd: projectRoot,
     stdio: 'inherit',
     shell: false,
     env: { ...process.env, QUICKFORGE_SERVER_PORT: String(port) },
   })
-  child.on('exit', (code) => {
+  viteChild.on('exit', (code) => {
     if (code && code !== 0) process.exitCode = code
   })
-  process.on('exit', () => child.kill())
-  process.on('SIGINT', () => {
-    child.kill('SIGINT')
-    process.exit(0)
-  })
-  process.on('SIGTERM', () => {
-    child.kill('SIGTERM')
-    process.exit(0)
-  })
+}
+
+function stopVite() {
+  if (viteChild) {
+    viteChild.kill('SIGTERM')
+    viteChild = null
+  }
+}
+
+function isAllowedCorsOrigin(origin) {
+  try {
+    const parsed = new URL(origin)
+    if (!['http:', 'https:'].includes(parsed.protocol)) return false
+    if (!['localhost', '127.0.0.1'].includes(parsed.hostname)) return false
+    const originPort = parsed.port || (parsed.protocol === 'https:' ? '443' : '80')
+    return originPort === String(port) || originPort === String(vitePort)
+  } catch {
+    return false
+  }
+}
+
+function parseHostHeader(value) {
+  if (!value) return null
+  try {
+    const parsed = new URL(`http://${value}`)
+    return { hostname: parsed.hostname, port: parsed.port }
+  } catch {
+    return null
+  }
+}
+
+function isAllowedHostHeader(value) {
+  const parsed = parseHostHeader(value)
+  if (!parsed) return false
+  const allowedHosts = new Set(['localhost', '127.0.0.1', host])
+  if (process.env.QUICKFORGE_ALLOW_REMOTE === '1' || shareLanEnabled) {
+    allowedHosts.add('0.0.0.0')
+    allowedHosts.add(parsed.hostname)
+  }
+  const expectedPort = String(port)
+  const hostPort = parsed.port || '80'
+  return allowedHosts.has(parsed.hostname) && hostPort === expectedPort
 }
 
 // --- Bootstrap ---
 const server = createServer(async (req, res) => {
+  const startedAt = Date.now()
+  res.on('finish', () => {
+    const durationMs = Date.now() - startedAt
+    logger.info(`${req.method} ${req.url} ${res.statusCode} ${durationMs}ms`)
+  })
+
+  if (!isAllowedHostHeader(req.headers.host)) {
+    res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ error: 'Forbidden host' }))
+    return
+  }
+
+  // Allow direct browser connections to the API server (e.g. SSE from dev mode
+  // where the Vite proxy on :5176 would otherwise consume HTTP/1.1 connections).
+  const origin = req.headers.origin
+  if (origin && isAllowedCorsOrigin(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin)
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
+    res.setHeader('Access-Control-Allow-Headers', 'content-type, x-quickforge-action')
+    res.setHeader('Access-Control-Max-Age', '86400')
+  }
+  if (req.method === 'OPTIONS') {
+    res.writeHead(origin && !isAllowedCorsOrigin(origin) ? 403 : 204)
+    res.end()
+    return
+  }
   try {
     const url = new URL(req.url || '/', `http://${req.headers.host || `${host}:${port}`}`)
+    const remoteAddress = req.socket.remoteAddress
+    if (
+      url.pathname.startsWith('/api/') &&
+      !isLoopbackAddress(remoteAddress) &&
+      shareLanEnabled &&
+      !(url.pathname.startsWith('/api/shared/') || url.pathname === '/api/health')
+    ) {
+      res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ error: 'Remote API access is limited to shared conversation endpoints.' }))
+      return
+    }
+
     if (url.pathname.startsWith('/api/')) {
       await handleApi(req, res, url)
       return
     }
 
+    if (url.pathname.startsWith('/share/')) {
+      await serveStatic(req, res, url)
+      return
+    }
+
+    if (
+      url.pathname.startsWith('/assets/') ||
+      url.pathname === '/favicon.svg' ||
+      url.pathname === '/vite.svg'
+    ) {
+      await serveStatic(req, res, url)
+      return
+    }
+
+    if (!isLoopbackAddress(remoteAddress) && shareLanEnabled) {
+      res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ error: 'Remote access is limited to shared conversation links.' }))
+      return
+    }
+
     if (isDev) {
       res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' })
-      res.end('QuickForge local API server is running. Open the Vite app at http://127.0.0.1:5176')
+      res.end(`QuickForge local API server is running. Open the Vite app at http://127.0.0.1:${vitePort}`)
       return
     }
 
     await serveStatic(req, res, url)
   } catch (error) {
-    console.error(error)
+    logger.error(error)
     sendError(res, error)
   }
 })
 
-await migrateLegacyDataDirs()
 await ensureStorage()
+await resetStaleTaskStatuses()
 await initializeActiveProject()
 setActiveWorkspaceRootForFilesystem(getWorkspaceRoot())
+startScheduledTaskRunner()
 
 server.listen(port, host, () => {
-  console.log(`QuickForge local API: http://${host}:${port}`)
-  console.log(`QuickForge data dir: ${dataDir}`)
-  console.log(`QuickForge project: ${getWorkspaceRoot()}`)
+  logger.info(`QuickForge local API: http://${host}:${port}`)
+  if (shareLanEnabled) {
+    const lanUrls = getLanUrls(port)
+    logger.info(`QuickForge LAN sharing is enabled. Share pages are available at: ${lanUrls.length ? lanUrls.join(', ') : `http://<your-lan-ip>:${port}`}`)
+    logger.info('Remote non-share API routes are restricted while QUICKFORGE_SHARE_LAN=1.')
+  }
+  logger.info(`QuickForge data dir: ${dataDir}`)
+  logger.info(`QuickForge project: ${getWorkspaceRoot()}`)
 
   if (isDev) {
     startVite()
     setTimeout(() => openBrowser(`http://localhost:${vitePort}`), 1000)
+  } else if (shareLanEnabled) {
+    const lanUrls = getLanUrls(port)
+    openBrowser(lanUrls[0] || `http://localhost:${port}`)
   } else {
     openBrowser(`http://localhost:${port}`)
   }
 })
+
+// Graceful shutdown
+async function gracefulShutdown(signal) {
+  logger.info(`Received ${signal}, shutting down gracefully...`)
+  stopScheduledTaskRunner()
+  stopVite()
+  await shutdownAgentManager()
+  process.exit(0)
+}
+
+process.on('SIGINT', (signal) => gracefulShutdown(signal))
+process.on('SIGTERM', (signal) => gracefulShutdown(signal))

package/server/project-config.mjs

@@ -1,8 +1,9 @@
 import path from 'node:path'
 import { randomUUID } from 'node:crypto'
-import { ensureStorage, projectConfigFile, dataDir } from './storage.mjs'
+import { ensureProjectCache, readProjectConfigData, atomicProjectConfigUpdate, dataDir } from './storage.mjs'
 import { promises as fs } from 'node:fs'
 import { setWorkspaceRoot, getWorkspaceRoot, assertDirectory } from './utils/workspace.mjs'
+import { loadSelectedGlobalSkills, loadSelectedProjectSkills, mergeSkills } from './skills.mjs'
 
 let defaultWorkspaceRoot = ''
 
@@ -15,41 +16,24 @@ function projectNameFromPath(dir) {
 }
 
 function defaultProjectConfig() {
-  const now = new Date().toISOString()
-  const id = 'default'
   return {
-    activeProjectId: id,
-    projects: [
-      {
-        id,
-        name: projectNameFromPath(defaultWorkspaceRoot),
-        path: defaultWorkspaceRoot,
-        lastOpenedAt: now,
-      },
-    ],
+    activeProjectId: null,
+    globalSkills: [],
+    projects: [],
   }
 }
 
-export async function readProjectConfig() {
-  await ensureStorage()
-  const file = projectConfigFile()
-  try {
-    const text = await fs.readFile(file, 'utf8')
-    const parsed = text.trim() ? JSON.parse(text) : defaultProjectConfig()
-    if (!Array.isArray(parsed.projects) || parsed.projects.length === 0) return defaultProjectConfig()
-    return parsed
-  } catch (error) {
-    if (error?.code === 'ENOENT') return defaultProjectConfig()
-    throw error
+function normalizeProjectConfig(config) {
+  if (!config || typeof config !== 'object') return defaultProjectConfig()
+  return {
+    activeProjectId: typeof config.activeProjectId === 'string' ? config.activeProjectId : null,
+    globalSkills: Array.isArray(config.globalSkills) ? config.globalSkills : [],
+    projects: Array.isArray(config.projects) ? config.projects : [],
   }
 }
 
-export async function writeProjectConfig(config) {
-  await ensureStorage()
-  const file = projectConfigFile()
-  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`
-  await fs.writeFile(tmp, `${JSON.stringify(config, null, 2)}\n`, 'utf8')
-  await fs.rename(tmp, file)
+export async function readProjectConfig() {
+  return normalizeProjectConfig(await readProjectConfigData())
 }
 
 export function getActiveProject(config) {
@@ -60,28 +44,34 @@ export async function setActiveProjectPath(inputPath) {
   const resolved = path.resolve(String(inputPath || ''))
   await assertDirectory(resolved)
 
-  const config = await readProjectConfig()
   const now = new Date().toISOString()
-  let project = config.projects.find((item) => path.resolve(item.path) === resolved)
-  if (!project) {
-    project = {
-      id: randomUUID(),
-      name: projectNameFromPath(resolved),
-      path: resolved,
-      lastOpenedAt: now,
+  let project
+
+  const updated = await atomicProjectConfigUpdate((config) => {
+    project = config.projects.find((item) => path.resolve(item.path) === resolved)
+    if (!project) {
+      project = {
+        id: randomUUID(),
+        name: projectNameFromPath(resolved),
+        path: resolved,
+        lastOpenedAt: now,
+        skills: [],
+      }
+      config.projects.unshift(project)
+    } else {
+      project.name = projectNameFromPath(resolved)
+      project.path = resolved
+      project.lastOpenedAt = now
     }
-    config.projects.unshift(project)
-  } else {
-    project.name = projectNameFromPath(resolved)
-    project.path = resolved
-    project.lastOpenedAt = now
-  }
 
-  config.activeProjectId = project.id
-  config.projects = [project, ...config.projects.filter((item) => item.id !== project.id)].slice(0, 20)
-  await writeProjectConfig(config)
+    config.activeProjectId = project.id
+    config.projects = [project, ...config.projects.filter((item) => item.id !== project.id)].slice(0, 20)
+    return config
+  })
+
+  await ensureProjectCache(project.id)
   setWorkspaceRoot(resolved)
-  return { project, projects: config.projects }
+  return { project, projects: updated.projects }
 }
 
 export async function initializeActiveProject() {
@@ -90,6 +80,7 @@ export async function initializeActiveProject() {
   if (activeProject?.path) {
     try {
       await assertDirectory(activeProject.path)
+      await ensureProjectCache(activeProject.id)
       setWorkspaceRoot(path.resolve(activeProject.path))
       return
     } catch {
@@ -97,8 +88,7 @@ export async function initializeActiveProject() {
     }
   }
 
-  const fallback = await setActiveProjectPath(defaultWorkspaceRoot)
-  setWorkspaceRoot(path.resolve(fallback.project.path))
+  // No project configured — leave workspace unset, user will be prompted to add one.
 }
 
 export async function projectContextFromId(projectId) {
@@ -111,15 +101,55 @@ export async function projectContextFromId(projectId) {
   }
 
   await assertDirectory(project.path)
+  await ensureProjectCache(project.id)
   return { project, workspaceRoot: path.resolve(project.path) }
 }
 
 export async function readInstructionsFile(filePath) {
-  try {
-    const content = await fs.readFile(filePath, 'utf8')
-    const trimmed = content.trim()
-    return trimmed || null
-  } catch {
-    return null
+  const candidates = filePath.endsWith('AGENTS.md')
+    ? [filePath, path.join(path.dirname(filePath), 'agents.md')]
+    : [filePath]
+
+  for (const candidate of candidates) {
+    try {
+      const content = await fs.readFile(candidate, 'utf8')
+      const trimmed = content.trim()
+      if (trimmed) return trimmed
+    } catch {
+      // try next candidate
+    }
+  }
+  return null
+}
+
+export async function buildInstructionsPayload(projectId) {
+  const config = await readProjectConfig()
+  let projectInstructions = null
+  let project = projectId ? config.projects.find((item) => item.id === projectId) ?? null : null
+
+  if (projectId) {
+    try {
+      const context = await projectContextFromId(projectId)
+      project = context.project
+      projectInstructions = await readInstructionsFile(path.join(context.workspaceRoot, 'AGENTS.md'))
+    } catch {
+      // project not found or inaccessible — leave projectInstructions null
+    }
+  }
+
+  const globalInstructions = await readInstructionsFile(path.join(dataDir, 'AGENTS.md'))
+  const globalSkills = await loadSelectedGlobalSkills(config.globalSkills)
+  const projectSkills = project?.skills && project?.path
+    ? await loadSelectedProjectSkills(project.skills, project.path)
+    : []
+  const activeSkills = mergeSkills(globalSkills, projectSkills)
+  const stripRuntimeFields = ({ rootDir: _rootDir, instructions: _instructions, location: _location, ...skill }) => skill
+
+  return {
+    global: globalInstructions,
+    project: projectInstructions,
+    globalSkills: globalSkills.map(stripRuntimeFields),
+    projectSkills: projectSkills.map(stripRuntimeFields),
+    skills: activeSkills.map(stripRuntimeFields),
   }
 }