@tom2012/cc-web 2026.5.14-a → 2026.5.15-a

package/backend/dist/tracks/cross-lock.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Cross-subsystem lock between flows and tracks.
+ *
+ * Both flows/runner.ts and tracks/registry.ts write
+ * <project>/.ccweb/workflow_data.json. Concurrent runs on the same
+ * project would corrupt that file (RMW race). This module exposes a
+ * small registry so each side can ask "is the other currently running
+ * on this project?" without creating an import cycle between
+ * routes/flows.ts and routes/tracks.ts or between flows/runner.ts and
+ * tracks/registry.ts.
+ *
+ * Usage:
+ *   - index.ts constructs `trackRegistry` and calls
+ *     `setTrackRunningProbe((pid) => trackRegistry.isRunning(pid))`
+ *   - routes/flows.ts's run handler calls `isTrackRunning(pid)` before
+ *     starting a flow; rejects with 409 if a track is in flight.
+ *   - routes/tracks.ts's run handler imports flowRunner directly
+ *     (already in the same module graph) and calls
+ *     `flowRunner.isRunning(pid)` before starting a track.
+ *
+ * The asymmetry (flows side uses a probe, tracks side imports
+ * flowRunner) is intentional: flowRunner has been a stable module
+ * singleton since v1; trackRegistry was created later inside index.ts
+ * to avoid leaking PTY infra into module init.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setTrackRunningProbe = setTrackRunningProbe;
+exports.isTrackRunning = isTrackRunning;
+let trackProbe = null;
+function setTrackRunningProbe(fn) {
+    trackProbe = fn;
+}
+function isTrackRunning(projectId) {
+    if (!trackProbe)
+        return false;
+    try {
+        return trackProbe(projectId);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=cross-lock.js.map

package/backend/dist/tracks/cross-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-lock.js","sourceRoot":"","sources":["../../src/tracks/cross-lock.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAMH,oDAEC;AAED,wCAOC;AAbD,IAAI,UAAU,GAAwB,IAAI,CAAA;AAE1C,SAAgB,oBAAoB,CAAC,EAAgB;IACnD,UAAU,GAAG,EAAE,CAAA;AACjB,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,SAAS,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/backend/dist/tracks/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * ccweb "工作轨" (Track) subsystem — public exports.
+ *
+ * Entry points for the rest of the backend:
+ *   - createTrackRunner({ ... }) → run .tr files
+ *   - createCcwebTrainAdapter({ ... }) → train-lang LLMAdapter impl
+ *   - createWorkflowDataWatcher(path) → workflow_data.json file watch
+ *
+ * See ~/Obsidian/Base/cc-web/工作轨重构规划.md for the architecture
+ * design and phase plan.
+ */
+export { createTrackRunner, type TrackRunner, type TrackRunnerDeps, type TrackRunResult, } from './track-runner';
+export { createCcwebTrainAdapter, buildCcwebWriteProtocolHint, type CcwebAdapterDeps, } from './ccweb-train-adapter';
+export { createWorkflowDataWatcher, type WorkflowDataWatcher, type FinishOutcome, } from './workflow-data-watcher';
+export type { WorkflowData, TaskProgressEntry, TrackCallState, TrackRunStatus, TrackRunState, AdapterCallContext, } from './types';
+export { createAskUserBridge, createAskUserBuiltin, type AskUserBridge, type AskUserFieldSpec, type AskUserRequest, type AskUserPushEvent, type AskUserPushFn, } from './ask-user-bridge';
+export { loadTrainCore, makeBuiltinDynamic } from './train-loader';
+export { createTrackRegistry, type TrackRegistry, type TrackRegistryDeps, } from './registry';
+export { listTracks, loadTrack, saveTrack, deleteTrack, resolveTrackPath, sanitizeTrackFilename, listGlobalTracks, loadGlobalTrack, saveGlobalTrack, deleteGlobalTrack, resolveGlobalTrackPath, type TrackFileInfo, } from './store';
+//# sourceMappingURL=index.d.ts.map

package/backend/dist/tracks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tracks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAA;AAEhC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,EACb,kBAAkB,GACnB,MAAM,SAAS,CAAA;AAEhB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAElE,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,aAAa,GACnB,MAAM,SAAS,CAAA"}

package/backend/dist/tracks/index.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * ccweb "工作轨" (Track) subsystem — public exports.
+ *
+ * Entry points for the rest of the backend:
+ *   - createTrackRunner({ ... }) → run .tr files
+ *   - createCcwebTrainAdapter({ ... }) → train-lang LLMAdapter impl
+ *   - createWorkflowDataWatcher(path) → workflow_data.json file watch
+ *
+ * See ~/Obsidian/Base/cc-web/工作轨重构规划.md for the architecture
+ * design and phase plan.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGlobalTrackPath = exports.deleteGlobalTrack = exports.saveGlobalTrack = exports.loadGlobalTrack = exports.listGlobalTracks = exports.sanitizeTrackFilename = exports.resolveTrackPath = exports.deleteTrack = exports.saveTrack = exports.loadTrack = exports.listTracks = exports.createTrackRegistry = exports.makeBuiltinDynamic = exports.loadTrainCore = exports.createAskUserBuiltin = exports.createAskUserBridge = exports.createWorkflowDataWatcher = exports.buildCcwebWriteProtocolHint = exports.createCcwebTrainAdapter = exports.createTrackRunner = void 0;
+var track_runner_1 = require("./track-runner");
+Object.defineProperty(exports, "createTrackRunner", { enumerable: true, get: function () { return track_runner_1.createTrackRunner; } });
+var ccweb_train_adapter_1 = require("./ccweb-train-adapter");
+Object.defineProperty(exports, "createCcwebTrainAdapter", { enumerable: true, get: function () { return ccweb_train_adapter_1.createCcwebTrainAdapter; } });
+Object.defineProperty(exports, "buildCcwebWriteProtocolHint", { enumerable: true, get: function () { return ccweb_train_adapter_1.buildCcwebWriteProtocolHint; } });
+var workflow_data_watcher_1 = require("./workflow-data-watcher");
+Object.defineProperty(exports, "createWorkflowDataWatcher", { enumerable: true, get: function () { return workflow_data_watcher_1.createWorkflowDataWatcher; } });
+var ask_user_bridge_1 = require("./ask-user-bridge");
+Object.defineProperty(exports, "createAskUserBridge", { enumerable: true, get: function () { return ask_user_bridge_1.createAskUserBridge; } });
+Object.defineProperty(exports, "createAskUserBuiltin", { enumerable: true, get: function () { return ask_user_bridge_1.createAskUserBuiltin; } });
+var train_loader_1 = require("./train-loader");
+Object.defineProperty(exports, "loadTrainCore", { enumerable: true, get: function () { return train_loader_1.loadTrainCore; } });
+Object.defineProperty(exports, "makeBuiltinDynamic", { enumerable: true, get: function () { return train_loader_1.makeBuiltinDynamic; } });
+var registry_1 = require("./registry");
+Object.defineProperty(exports, "createTrackRegistry", { enumerable: true, get: function () { return registry_1.createTrackRegistry; } });
+var store_1 = require("./store");
+Object.defineProperty(exports, "listTracks", { enumerable: true, get: function () { return store_1.listTracks; } });
+Object.defineProperty(exports, "loadTrack", { enumerable: true, get: function () { return store_1.loadTrack; } });
+Object.defineProperty(exports, "saveTrack", { enumerable: true, get: function () { return store_1.saveTrack; } });
+Object.defineProperty(exports, "deleteTrack", { enumerable: true, get: function () { return store_1.deleteTrack; } });
+Object.defineProperty(exports, "resolveTrackPath", { enumerable: true, get: function () { return store_1.resolveTrackPath; } });
+Object.defineProperty(exports, "sanitizeTrackFilename", { enumerable: true, get: function () { return store_1.sanitizeTrackFilename; } });
+Object.defineProperty(exports, "listGlobalTracks", { enumerable: true, get: function () { return store_1.listGlobalTracks; } });
+Object.defineProperty(exports, "loadGlobalTrack", { enumerable: true, get: function () { return store_1.loadGlobalTrack; } });
+Object.defineProperty(exports, "saveGlobalTrack", { enumerable: true, get: function () { return store_1.saveGlobalTrack; } });
+Object.defineProperty(exports, "deleteGlobalTrack", { enumerable: true, get: function () { return store_1.deleteGlobalTrack; } });
+Object.defineProperty(exports, "resolveGlobalTrackPath", { enumerable: true, get: function () { return store_1.resolveGlobalTrackPath; } });
+//# sourceMappingURL=index.js.map

package/backend/dist/tracks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tracks/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,+CAKuB;AAJrB,iHAAA,iBAAiB,OAAA;AAMnB,6DAI8B;AAH5B,8HAAA,uBAAuB,OAAA;AACvB,kIAAA,2BAA2B,OAAA;AAI7B,iEAIgC;AAH9B,kIAAA,yBAAyB,OAAA;AAc3B,qDAQ0B;AAPxB,sHAAA,mBAAmB,OAAA;AACnB,uHAAA,oBAAoB,OAAA;AAQtB,+CAAkE;AAAzD,6GAAA,aAAa,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAE1C,uCAImB;AAHjB,+GAAA,mBAAmB,OAAA;AAKrB,iCAagB;AAZd,mGAAA,UAAU,OAAA;AACV,kGAAA,SAAS,OAAA;AACT,kGAAA,SAAS,OAAA;AACT,oGAAA,WAAW,OAAA;AACX,yGAAA,gBAAgB,OAAA;AAChB,8GAAA,qBAAqB,OAAA;AACrB,yGAAA,gBAAgB,OAAA;AAChB,wGAAA,eAAe,OAAA;AACf,wGAAA,eAAe,OAAA;AACf,0GAAA,iBAAiB,OAAA;AACjB,+GAAA,sBAAsB,OAAA"}

package/backend/dist/tracks/registry.d.ts

@@ -0,0 +1,56 @@
+/**
+ * TrackRunnerRegistry — per-project TrackRunner accounting.
+ *
+ * Singleton owned by backend/src/index.ts. Wraps creation of a runner
+ * (with the project's PTY injector + workflow_data path) and exposes
+ * lifecycle calls used by the HTTP route handlers.
+ *
+ * One project can have at most one in-flight track run; starting a
+ * new one while another is running rejects with 'busy'.
+ */
+import { type AskUserFieldSpec } from './ask-user-bridge';
+import type { TrackRunState } from './types';
+export interface TrackRegistryDeps {
+    /** Look up the absolute project folder path by projectId. */
+    getProjectFolder: (projectId: string) => string | null;
+    /** Inject text into the project's active CLI PTY. */
+    injectIntoPty: (projectId: string, text: string) => Promise<void> | void;
+    /** Push a JSON message to all WS clients subscribed to this project. */
+    broadcast: (projectId: string, message: Record<string, unknown>) => void;
+    /** Pino-compatible logger. */
+    logger?: {
+        debug?: (msg: string, ...args: unknown[]) => void;
+        info?: (msg: string, ...args: unknown[]) => void;
+        warn?: (msg: string, ...args: unknown[]) => void;
+        error?: (msg: string, ...args: unknown[]) => void;
+    };
+}
+export interface TrackRegistry {
+    /** Start a track run. */
+    start(projectId: string, absTrackPath: string, trackFilename: string, args?: unknown[]): Promise<{
+        ok: true;
+        runId: string;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Cancel the in-flight run for a project. */
+    abort(projectId: string): boolean;
+    /** Submit user input for a pending ask_user request. */
+    submitInput(projectId: string, requestId: string, data: Record<string, unknown>): {
+        ok: boolean;
+        message?: string;
+    };
+    /** Get the latest state for a project (running or last finished). */
+    getState(projectId: string): TrackRunState | null;
+    /** True if a run is in flight (status === running or paused). */
+    isRunning(projectId: string): boolean;
+    /** Get the pending ask_user request if any. */
+    getPendingAskUser(projectId: string): {
+        runId: string;
+        requestId: string;
+        fields: AskUserFieldSpec[];
+    } | null;
+}
+export declare function createTrackRegistry(deps: TrackRegistryDeps): TrackRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/backend/dist/tracks/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/tracks/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAA2C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,SAAS,CAAA;AAE5D,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACtD,qDAAqD;IACrD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACxE,wEAAwE;IACxE,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACxE,8BAA8B;IAC9B,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;QACjD,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;QAChD,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;QAChD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;KAClD,CAAA;CACF;AAkBD,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,OAAO,EAAE,GACf,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAEvE,8CAA8C;IAC9C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;IAEjC,wDAAwD;IACxD,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAEpC,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAAA;IAEjD,iEAAiE;IACjE,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;IAErC,+CAA+C;IAC/C,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG;QACpC,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,gBAAgB,EAAE,CAAA;KAC3B,GAAG,IAAI,CAAA;CACT;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAqH1E"}

package/backend/dist/tracks/registry.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * TrackRunnerRegistry — per-project TrackRunner accounting.
+ *
+ * Singleton owned by backend/src/index.ts. Wraps creation of a runner
+ * (with the project's PTY injector + workflow_data path) and exposes
+ * lifecycle calls used by the HTTP route handlers.
+ *
+ * One project can have at most one in-flight track run; starting a
+ * new one while another is running rejects with 'busy'.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTrackRegistry = createTrackRegistry;
+const path = __importStar(require("path"));
+const track_runner_1 = require("./track-runner");
+const workflow_data_watcher_1 = require("./workflow-data-watcher");
+const ask_user_bridge_1 = require("./ask-user-bridge");
+function createTrackRegistry(deps) {
+    const projects = new Map();
+    function emit(projectId, kind, payload) {
+        deps.broadcast(projectId, { type: kind, ...payload });
+    }
+    return {
+        async start(projectId, absTrackPath, trackFilename, args = []) {
+            // Synchronous in-flight gate — set BEFORE any await to close the
+            // race window between two concurrent start() calls.
+            const existing = projects.get(projectId);
+            if (existing && (existing.inFlight || existing.lastState?.status === 'running')) {
+                return { ok: false, reason: 'a track is already running for this project' };
+            }
+            const projectFolder = deps.getProjectFolder(projectId);
+            if (!projectFolder) {
+                return { ok: false, reason: 'project not found' };
+            }
+            const runId = `track-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const workflowDataPath = path.join(projectFolder, '.ccweb', 'workflow_data.json');
+            const watcher = (0, workflow_data_watcher_1.createWorkflowDataWatcher)(workflowDataPath);
+            const bridge = (0, ask_user_bridge_1.createAskUserBridge)((event) => {
+                emit(projectId, 'track_ask_user', event);
+            });
+            const runner = (0, track_runner_1.createTrackRunner)({
+                projectId,
+                injector: (text) => deps.injectIntoPty(projectId, text),
+                watcher,
+                logger: deps.logger,
+                askUserBridge: bridge,
+                onState: (state) => {
+                    // Ignore late callbacks from a previous run — only the run
+                    // whose runId matches the entry's current runId is allowed
+                    // to overwrite lastState. (Defense against runner finishing
+                    // after the entry has been replaced.)
+                    const e = projects.get(projectId);
+                    if (!e || e.runId !== runId)
+                        return;
+                    e.lastState = state;
+                    emit(projectId, 'track_status_change', {
+                        state: state,
+                    });
+                },
+            });
+            const entry = {
+                runner,
+                bridge,
+                lastState: null,
+                trackFilename,
+                inFlight: true,
+                runId,
+            };
+            projects.set(projectId, entry);
+            // Fire and forget — the run resolves later; route returns immediately.
+            void runner.run(absTrackPath, args).then((result) => {
+                const e = projects.get(projectId);
+                if (e && e.runId === runId) {
+                    e.inFlight = false;
+                }
+                deps.logger?.info?.('[TrackRegistry] run finished', {
+                    projectId,
+                    runId,
+                    ok: result.ok,
+                    error: result.error,
+                });
+                emit(projectId, 'track_run_complete', {
+                    ok: result.ok,
+                    value: result.value,
+                    error: result.error,
+                });
+            });
+            return { ok: true, runId };
+        },
+        abort(projectId) {
+            const entry = projects.get(projectId);
+            if (!entry)
+                return false;
+            entry.runner.cancel();
+            entry.bridge.cancelAllForRun(entry.runId, 'aborted');
+            return true;
+        },
+        submitInput(projectId, requestId, data) {
+            const entry = projects.get(projectId);
+            if (!entry)
+                return { ok: false, message: 'no track running for project' };
+            // Pass values straight through — bridge.submitInput does per-field
+            // type validation (text/number/bool/enum).
+            return entry.bridge.submitInput(entry.runId, requestId, data);
+        },
+        getState(projectId) {
+            return projects.get(projectId)?.lastState ?? null;
+        },
+        isRunning(projectId) {
+            const entry = projects.get(projectId);
+            if (!entry)
+                return false;
+            // Window 1: inFlight true during start() pre-state phase.
+            // Window 2: lastState.status running/paused after first onState fires.
+            if (entry.inFlight)
+                return true;
+            const running = ['running', 'paused'];
+            return entry.lastState ? running.includes(entry.lastState.status) : false;
+        },
+        getPendingAskUser(projectId) {
+            const entry = projects.get(projectId);
+            if (!entry)
+                return null;
+            return entry.bridge.getPending(entry.runId);
+        },
+    };
+}
+//# sourceMappingURL=registry.js.map

package/backend/dist/tracks/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/tracks/registry.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EH,kDAqHC;AA7LD,2CAA4B;AAE5B,iDAAoE;AACpE,mEAAmE;AACnE,uDAAkG;AAoElG,SAAgB,mBAAmB,CAAC,IAAuB;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAA;IAEhD,SAAS,IAAI,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAgC;QAC7E,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,GAAG,EAAE;YAC3D,iEAAiE;YACjE,oDAAoD;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACxC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;YAC7E,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAA;YACtD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;YACnD,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;YAE7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;YACjF,MAAM,OAAO,GAAG,IAAA,iDAAyB,EAAC,gBAAgB,CAAC,CAAA;YAC3D,MAAM,MAAM,GAAG,IAAA,qCAAmB,EAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,KAA2C,CAAC,CAAA;YAChF,CAAC,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,IAAA,gCAAiB,EAAC;gBAC/B,SAAS;gBACT,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC;gBACvD,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,MAAM;gBACrB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,2DAA2D;oBAC3D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,sCAAsC;oBACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;oBACjC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;wBAAE,OAAM;oBACnC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAA;oBACnB,IAAI,CAAC,SAAS,EAAE,qBAAqB,EAAE;wBACrC,KAAK,EAAE,KAA2C;qBACnD,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC,CAAA;YAEF,MAAM,KAAK,GAAiB;gBAC1B,MAAM;gBACN,MAAM;gBACN,SAAS,EAAE,IAAI;gBACf,aAAa;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK;aACN,CAAA;YACD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAE9B,uEAAuE;YACvE,KAAK,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACjC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBAC3B,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,8BAA8B,EAAE;oBAClD,SAAS;oBACT,KAAK;oBACL,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAA;gBACF,IAAI,CAAC,SAAS,EAAE,oBAAoB,EAAE;oBACpC,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC;QAED,KAAK,CAAC,SAAS;YACb,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAA;YACxB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;YACrB,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAA;YACzE,mEAAmE;YACnE,2CAA2C;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,IAA6B,CAAC,CAAA;QACxF,CAAC;QAED,QAAQ,CAAC,SAAS;YAChB,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,SAAS,IAAI,IAAI,CAAA;QACnD,CAAC;QAED,SAAS,CAAC,SAAS;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAA;YACxB,0DAA0D;YAC1D,uEAAuE;YACvE,IAAI,KAAK,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAC/B,MAAM,OAAO,GAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;YACvD,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC3E,CAAC;QAED,iBAAiB,CAAC,SAAS;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC"}

package/backend/dist/tracks/store.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Track storage — read/write .tr files under <project>/.ccweb/tracks/.
+ *
+ * Mirrors backend/src/flows/store.ts but for .tr source files instead
+ * of FlowDef JSON. Each track is a plain UTF-8 text file (train-lang
+ * source). No schema validation here — parse errors surface from
+ * train-lang when the track is run.
+ */
+export interface TrackFileInfo {
+    filename: string;
+    size: number;
+    mtime: number;
+}
+/**
+ * sanitize a user-provided filename: forbid path separators, ensure
+ * .tr extension. Returns null if input is unsafe.
+ */
+export declare function sanitizeTrackFilename(input: unknown): string | null;
+export declare function listTracks(projectFolder: string): TrackFileInfo[];
+/**
+ * Read a track. Refuses to follow symlinks — if the on-disk entry is a
+ * symlink, returns null. This prevents an attacker with write access to
+ * `.ccweb/tracks/` from planting `attack.tr -> /etc/passwd` and reading
+ * arbitrary files via the GET endpoint. Symmetric guard in saveTrack
+ * (rejects writing to a path whose existing target is a symlink).
+ */
+export declare function loadTrack(projectFolder: string, filename: string): string | null;
+export declare function saveTrack(projectFolder: string, filename: string, source: string): boolean;
+export declare function deleteTrack(projectFolder: string, filename: string): boolean;
+/** Absolute path used by TrackRunner when starting a run. */
+export declare function resolveTrackPath(projectFolder: string, filename: string): string;
+export declare function listGlobalTracks(username: string): TrackFileInfo[];
+export declare function loadGlobalTrack(username: string, filename: string): string | null;
+export declare function saveGlobalTrack(username: string, filename: string, source: string): boolean;
+export declare function deleteGlobalTrack(username: string, filename: string): boolean;
+export declare function resolveGlobalTrackPath(username: string, filename: string): string;
+//# sourceMappingURL=store.d.ts.map

package/backend/dist/tracks/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/tracks/store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYnE;AAUD,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,EAAE,CAgBjE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAaf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAqBT;AAED,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS5E;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAYD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAgBlE;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAaf;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAkBT;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS7E;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER"}

package/backend/dist/tracks/store.js

@@ -0,0 +1,254 @@
+"use strict";
+/**
+ * Track storage — read/write .tr files under <project>/.ccweb/tracks/.
+ *
+ * Mirrors backend/src/flows/store.ts but for .tr source files instead
+ * of FlowDef JSON. Each track is a plain UTF-8 text file (train-lang
+ * source). No schema validation here — parse errors surface from
+ * train-lang when the track is run.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeTrackFilename = sanitizeTrackFilename;
+exports.listTracks = listTracks;
+exports.loadTrack = loadTrack;
+exports.saveTrack = saveTrack;
+exports.deleteTrack = deleteTrack;
+exports.resolveTrackPath = resolveTrackPath;
+exports.listGlobalTracks = listGlobalTracks;
+exports.loadGlobalTrack = loadGlobalTrack;
+exports.saveGlobalTrack = saveGlobalTrack;
+exports.deleteGlobalTrack = deleteGlobalTrack;
+exports.resolveGlobalTrackPath = resolveGlobalTrackPath;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const TRACK_EXT = '.tr';
+const TRACKS_DIRNAME = 'tracks';
+/**
+ * sanitize a user-provided filename: forbid path separators, ensure
+ * .tr extension. Returns null if input is unsafe.
+ */
+function sanitizeTrackFilename(input) {
+    if (typeof input !== 'string')
+        return null;
+    const trimmed = input.trim();
+    if (!trimmed)
+        return null;
+    // No path separators or relative parents
+    if (/[\\/]/.test(trimmed) || trimmed.includes('..'))
+        return null;
+    // No control bytes
+    if (/[\x00-\x1f]/.test(trimmed))
+        return null;
+    // Ensure .tr extension
+    const withExt = trimmed.endsWith(TRACK_EXT) ? trimmed : trimmed + TRACK_EXT;
+    if (withExt.length > 200)
+        return null;
+    return withExt;
+}
+function tracksDir(projectFolder) {
+    return path.join(projectFolder, '.ccweb', TRACKS_DIRNAME);
+}
+function trackPath(projectFolder, filename) {
+    return path.join(tracksDir(projectFolder), filename);
+}
+function listTracks(projectFolder) {
+    const dir = tracksDir(projectFolder);
+    if (!fs.existsSync(dir))
+        return [];
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    const out = [];
+    for (const e of entries) {
+        if (!e.isFile() || !e.name.endsWith(TRACK_EXT))
+            continue;
+        const full = path.join(dir, e.name);
+        try {
+            const st = fs.statSync(full);
+            out.push({ filename: e.name, size: st.size, mtime: st.mtimeMs });
+        }
+        catch {
+            // skip unreadable
+        }
+    }
+    return out.sort((a, b) => a.filename.localeCompare(b.filename));
+}
+/**
+ * Read a track. Refuses to follow symlinks — if the on-disk entry is a
+ * symlink, returns null. This prevents an attacker with write access to
+ * `.ccweb/tracks/` from planting `attack.tr -> /etc/passwd` and reading
+ * arbitrary files via the GET endpoint. Symmetric guard in saveTrack
+ * (rejects writing to a path whose existing target is a symlink).
+ */
+function loadTrack(projectFolder, filename) {
+    const p = trackPath(projectFolder, filename);
+    try {
+        const st = fs.lstatSync(p);
+        if (!st.isFile())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    try {
+        return fs.readFileSync(p, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function saveTrack(projectFolder, filename, source) {
+    const dir = tracksDir(projectFolder);
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+        const p = trackPath(projectFolder, filename);
+        // Reject if the target already exists and is a symlink — same
+        // guard as loadTrack. Without this, an attacker who can write the
+        // symlink could redirect saves to arbitrary FS locations.
+        try {
+            const st = fs.lstatSync(p);
+            if (st.isSymbolicLink())
+                return false;
+        }
+        catch {
+            // ENOENT — fine, we'll create a new file
+        }
+        const tmp = p + '.tmp-' + process.pid;
+        fs.writeFileSync(tmp, source, 'utf8');
+        fs.renameSync(tmp, p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function deleteTrack(projectFolder, filename) {
+    const p = trackPath(projectFolder, filename);
+    if (!fs.existsSync(p))
+        return false;
+    try {
+        fs.unlinkSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Absolute path used by TrackRunner when starting a run. */
+function resolveTrackPath(projectFolder, filename) {
+    return trackPath(projectFolder, filename);
+}
+// ── Global tracks (per-user templates) ──────────────────────────────────
+function globalTracksDir(username) {
+    return path.join(os.homedir(), '.ccweb', 'users', username, TRACKS_DIRNAME);
+}
+function globalTrackPath(username, filename) {
+    return path.join(globalTracksDir(username), filename);
+}
+function listGlobalTracks(username) {
+    const dir = globalTracksDir(username);
+    if (!fs.existsSync(dir))
+        return [];
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    const out = [];
+    for (const e of entries) {
+        if (!e.isFile() || !e.name.endsWith(TRACK_EXT))
+            continue;
+        const full = path.join(dir, e.name);
+        try {
+            const st = fs.statSync(full);
+            out.push({ filename: e.name, size: st.size, mtime: st.mtimeMs });
+        }
+        catch {
+            // skip
+        }
+    }
+    return out.sort((a, b) => a.filename.localeCompare(b.filename));
+}
+function loadGlobalTrack(username, filename) {
+    const p = globalTrackPath(username, filename);
+    try {
+        const st = fs.lstatSync(p);
+        if (!st.isFile())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    try {
+        return fs.readFileSync(p, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function saveGlobalTrack(username, filename, source) {
+    const dir = globalTracksDir(username);
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+        const p = globalTrackPath(username, filename);
+        try {
+            const st = fs.lstatSync(p);
+            if (st.isSymbolicLink())
+                return false;
+        }
+        catch {
+            // ENOENT — fine
+        }
+        const tmp = p + '.tmp-' + process.pid;
+        fs.writeFileSync(tmp, source, 'utf8');
+        fs.renameSync(tmp, p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function deleteGlobalTrack(username, filename) {
+    const p = globalTrackPath(username, filename);
+    if (!fs.existsSync(p))
+        return false;
+    try {
+        fs.unlinkSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolveGlobalTrackPath(username, filename) {
+    return globalTrackPath(username, filename);
+}
+//# sourceMappingURL=store.js.map