@smartmemory/compose 0.2.50-beta → 0.2.51-beta

package/server/qa-scope-routes.js

@@ -0,0 +1,96 @@
+/**
+ * qa-scope-routes.js — Read-only QA-scope REST API (COMP-PARITY-10).
+ *
+ * Route:
+ *   GET /api/qa-scope?featureCode=<CODE> — surfaces `compose qa-scope <CODE>`
+ *     (diff-to-route mapping from COMP-QA) as structured JSON for the cockpit's
+ *     QA Scope view. Maps the feature's recorded filesChanged → affected /
+ *     adjacent routes via lib/qa-scoping.js. Read-only, no side effects.
+ *
+ * Not auth-gated (mirrors GET /api/environment-health): it reads only
+ * feature.json + heuristic route mapping, no host paths leaked, no mutation.
+ *
+ * Degrade-never-fail: a bad feature code or unreadable feature.json returns a
+ * structured { found:false } / empty result, never a 500.
+ *
+ * Reuses (no logic fork):
+ *   - lib/feature-json.js  — readFeature(cwd, code)
+ *   - lib/qa-scoping.js    — mapFilesToRoutes(filesChanged,{cwd}), classifyRoutes(routes,[])
+ */
+import { readFeature as defaultReadFeature } from '../lib/feature-json.js';
+import {
+  mapFilesToRoutes as defaultMapFilesToRoutes,
+  classifyRoutes as defaultClassifyRoutes,
+} from '../lib/qa-scoping.js';
+
+/**
+ * @param {import('express').Express} app
+ * @param {object} [deps]
+ * @param {Function} [deps.readFeature]      — (cwd, code) => FeatureJson|null
+ * @param {Function} [deps.mapFilesToRoutes] — (filesChanged, {cwd}) => {affectedRoutes,unmappedFiles,framework,docsOnly}
+ * @param {Function} [deps.classifyRoutes]   — (routes, allKnown) => {affected,adjacent}
+ */
+export function attachQaScopeRoutes(app, {
+  readFeature = defaultReadFeature,
+  mapFilesToRoutes = defaultMapFilesToRoutes,
+  classifyRoutes = defaultClassifyRoutes,
+} = {}) {
+  app.get('/api/qa-scope', (req, res) => {
+    const featureCode = (req.query.featureCode || '').toString().trim();
+    if (!featureCode) {
+      return res.json({ found: false, error: 'featureCode required' });
+    }
+
+    const root = req.workspace?.root;
+    if (!root) {
+      return res.json({ found: false, error: 'no workspace root', featureCode });
+    }
+
+    let feature;
+    try {
+      feature = readFeature(root, featureCode);
+    } catch {
+      feature = null;
+    }
+    if (!feature) {
+      return res.json({ found: false, featureCode });
+    }
+
+    const filesChanged = feature.filesChanged ?? [];
+    if (filesChanged.length === 0) {
+      // Mirror the CLI's empty-diff guidance (bin/compose.js:2716-2719).
+      return res.json({
+        found: true,
+        featureCode,
+        filesChanged: [],
+        framework: 'unknown',
+        docsOnly: false,
+        affected: [],
+        adjacent: [],
+        unmappedFiles: [],
+        emptyDiff: true,
+      });
+    }
+
+    // Same pipeline as the CLI (bin/compose.js:2722-2724); allKnown=[] (v1: no registry).
+    let result, classified;
+    try {
+      result = mapFilesToRoutes(filesChanged, { cwd: root });
+      classified = classifyRoutes(result.affectedRoutes, []);
+    } catch (e) {
+      return res.json({ found: true, featureCode, error: e?.message || 'qa-scope failed' });
+    }
+
+    res.json({
+      found: true,
+      featureCode,
+      filesChanged,
+      framework: result.framework,
+      docsOnly: result.docsOnly,
+      affected: classified.affected,
+      adjacent: classified.adjacent,
+      unmappedFiles: result.unmappedFiles,
+      emptyDiff: false,
+    });
+  });
+}

package/server/validate-routes.js

@@ -0,0 +1,70 @@
+/**
+ * validate-routes.js — Read-only cross-artifact validation REST API (COMP-PARITY-6).
+ *
+ * Route:
+ *   GET /api/validate?scope=feature|project&featureCode=<CODE>
+ *     Surfaces `compose validate` (lib/feature-validator.js validateFeature/
+ *     validateProject) as structured JSON for the cockpit Validate view.
+ *     Read-only; local-only (no network xref resolution); degrades, never 500s.
+ *
+ * Deliberately NOT under an auth-allowlisted prefix (mirrors health-routes.js):
+ * non-allowlisted → default-deny in remote mode, open on localhost.
+ *
+ * Reuses (no logic fork): lib/feature-validator.js validateFeature/validateProject.
+ */
+import {
+  validateFeature as defaultValidateFeature,
+  validateProject as defaultValidateProject,
+} from '../lib/feature-validator.js';
+
+const SEVERITIES = ['error', 'warning', 'info'];
+
+/** Group a findings array into { error: n, warning: n, info: n }. */
+export function summarizeFindings(findings = []) {
+  const by = { error: 0, warning: 0, info: 0 };
+  for (const f of findings) {
+    if (by[f?.severity] !== undefined) by[f.severity] += 1;
+  }
+  return by;
+}
+
+/**
+ * @param {import('express').Express} app
+ * @param {object} [deps]
+ * @param {Function} [deps.validateFeature] — injectable (default: lib validator)
+ * @param {Function} [deps.validateProject] — injectable (default: lib validator)
+ */
+export function attachValidateRoutes(app, {
+  validateFeature = defaultValidateFeature,
+  validateProject = defaultValidateProject,
+} = {}) {
+  app.get('/api/validate', async (req, res) => {
+    const root = req.workspace?.root;
+    if (!root) {
+      // No workspace to validate — a guarded failure, not a 500.
+      return res.json({ scope: null, findings: [], bySeverity: summarizeFindings([]), unavailable: true });
+    }
+    const scope = req.query.scope === 'feature' ? 'feature' : 'project';
+    const featureCode = typeof req.query.featureCode === 'string' ? req.query.featureCode : null;
+
+    if (scope === 'feature' && !featureCode) {
+      return res.status(400).json({ error: 'scope=feature requires featureCode' });
+    }
+
+    try {
+      const result = scope === 'feature'
+        ? await validateFeature(root, featureCode)        // local-only; no `external`
+        : await validateProject(root, {});                // local-only; no `external`
+      const findings = Array.isArray(result.findings) ? result.findings : [];
+      // Pass the validator result through verbatim + add the severity rollup.
+      return res.json({ ...result, bySeverity: summarizeFindings(findings) });
+    } catch (err) {
+      // validateCode throws INVALID_INPUT on a malformed feature code → 400.
+      if (err && err.code === 'INVALID_INPUT') {
+        return res.status(400).json({ error: err.message });
+      }
+      // Any other failure degrades to a non-500 unavailable body.
+      return res.json({ scope, feature_code: featureCode, findings: [], bySeverity: summarizeFindings([]), unavailable: true, error: err?.message || 'validate failed' });
+    }
+  });
+}

package/server/vision-routes.js

@@ -44,6 +44,8 @@ function getSchemaValidator() {
 import { randomUUID } from 'node:crypto';
 import { getTargetRoot, resolveProjectPath } from './project-root.js';
 import { resolveFeaturesPathFromConfig } from '../lib/project-paths.js';
+import { getCompletions } from '../lib/completion-writer.js';
+import { isFeatureCode } from '../lib/feature-code.js';
 import { anchorBoundary } from '../lib/checkpoint/checkpoint-writer.js';
 import { appendGateLogEntry, readGateLog, mapResolveOutcomeToSchema } from './gate-log-store.js';
 import { addOpenLoop, resolveOpenLoop, listOpenLoops } from './open-loops-store.js';
@@ -93,6 +95,33 @@ export function attachVisionRoutes(app, { store, scheduleBroadcast, broadcastMes
   const guardAuthEnabled = capabilities?.guardAuth === true;
   const guardAuth = (req, res, next) =>
     guardAuthEnabled ? requireSensitiveToken(req, res, next) : next();
+
+  // PARITY-5: GET /api/completions — read-only recorded-completion log for a
+  // feature. Reads are open (not guardAuth-wrapped); wraps the same
+  // getCompletions() the CLI uses so the cockpit and CLI agree byte-for-byte.
+  app.get('/api/completions', (req, res) => {
+    try {
+      const opts = {};
+      const fc = req.query.featureCode;
+      if (typeof fc === 'string' && fc) {
+        // This route is open (no auth) and feature_code is join()'d into a
+        // filesystem path downstream (feature-json.js#readFeature). Reject
+        // anything that isn't a canonical feature code so `../`-style traversal
+        // can't read feature.json outside the features dir.
+        if (!isFeatureCode(fc)) {
+          return res.status(400).json({ error: 'invalid featureCode' });
+        }
+        opts.feature_code = fc;
+      }
+      const rawLimit = parseInt(req.query.limit, 10);
+      if (Number.isFinite(rawLimit)) opts.limit = rawLimit;
+      const result = getCompletions(getTargetRoot(), opts);
+      res.json(result);
+    } catch (err) {
+      res.status(400).json({ error: err.message || String(err) });
+    }
+  });
+
   // GET /api/vision/items — full state (optional ?group= filter)
   app.get('/api/vision/items', (req, res) => {
     let state = store.getState();

package/server/vision-server.js

@@ -27,11 +27,15 @@ import { attachSessionRoutes } from './session-routes.js';
 import { attachActivityRoutes } from './activity-routes.js';
 import { SettingsStore } from './settings-store.js';
 import { attachSettingsRoutes } from './settings-routes.js';
+import { attachHealthRoutes } from './health-routes.js';
+import { attachValidateRoutes } from './validate-routes.js';
+import { attachQaScopeRoutes } from './qa-scope-routes.js';
 import { attachDesignRoutes } from './design-routes.js';
 import { DesignSessionManager } from './design-session.js';
 import { attachPipelineRoutes } from './pipeline-routes.js';
 import { attachIdeaboxRoutes } from './ideabox-routes.js';
 import { attachBuildRoutes } from './build-routes.js';
+import { attachFeatureScaffoldRoutes } from './feature-scaffold-routes.js';
 import { attachJournalRoutes } from './journal-routes.js';
 import { CoalescingBuffer } from './coalescing-buffer.js';
 /** Settings defaults (previously derived from contracts/lifecycle.json). */
@@ -85,6 +89,19 @@ export class VisionServer {
       broadcastMessage: (msg) => this.broadcastMessage(msg),
     });
 
+    // ── Environment-health route (COMP-PARITY-3) ──────────────────────────
+    // Read-only GET /api/environment-health; resolves its own compose package
+    // root + composeBin/Node defaults, reads hooks off req.workspace.
+    attachHealthRoutes(app);
+
+    // ── Cross-artifact validation findings (COMP-PARITY-6) ─────────────────
+    // Read-only GET /api/validate; reads workspace off req.workspace.
+    attachValidateRoutes(app);
+
+    // ── QA-scope affected-routes panel (COMP-PARITY-10) ────────────────────
+    // Read-only GET /api/qa-scope?featureCode=…; reads off req.workspace.
+    attachQaScopeRoutes(app);
+
     // ── Vision CRUD + lifecycle routes ─────────────────────────────────────
     attachVisionRoutes(app, {
       store: this.store,
@@ -152,6 +169,10 @@ export class VisionServer {
     // ── Build start/abort routes (sensitive) ───────────────────────────────
     attachBuildRoutes(app);
 
+    // ── Feature scaffolding (COMP-PARITY-9, sensitive) ─────────────────────
+    // POST /api/features/scaffold — writes feature.json + a ROADMAP row.
+    attachFeatureScaffoldRoutes(app, { getProjectRoot: () => getTargetRoot() });
+
     // ── Build state hydration ─────────────────────────────────────────────
     app.get('/api/build/state', (_req, res) => {
       const buildPath = path.join(getDataDir(), 'active-build.json');