@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/admin/task-routes.js

@@ -0,0 +1,213 @@
+import { logReq, requireSession } from "../http-util.js";
+import { listInFlight, getTask, countInFlight } from "../queue-store.js";
+import { getProject } from "../token-store.js";
+import { buildTaskViews, buildTaskQuota } from "../task-view.js";
+import { globalQueueDepth, globalQueueMax, globalQueuePosition } from "../global-queue.js";
+import { fetchTaskLogs, formatLogBody } from "../task-log.js";
+import { readArchivedLog } from "../run-log.js";
+import { getRunHistoryByTaskSeq } from "../run-history-store.js";
+import { listErrorLogs, getErrorLog, countErrorLogs, clearErrorLogs, listErrorLogFilterOptions } from "../error-log-store.js";
+import { resolveModelForMode, resolveVariantForMode } from "../settings-store.js";
+import { getPlatform } from "../platform/index.js";
+import { stopTask } from "../stop.js";
+import { resolveUsageWindow } from "../usage-stats.js";
+import { parseDateWindow, parseLimit, parseOffset, parsePositiveInt, parseQuery, parseString } from "./query-params.js";
+// Browser link to a project's work item. Resolves the managed project path from
+// the token store and delegates URL shaping to the active driver's Links
+// capability, so both list endpoints agree on the format. Empty when the
+// project is no longer managed.
+function projectWorkItemUrl(projectId, workItemNumber) {
+    return getPlatform().links.workItemUrl(getProject(projectId)?.projectPath ?? "", workItemNumber);
+}
+function parseSeqParam(raw) {
+    const n = Number(Array.isArray(raw) ? raw[0] : raw);
+    return Number.isFinite(n) && Number.isInteger(n) && n > 0 ? n : null;
+}
+// Read-only observability endpoints for the WebUI "Running tasks" panel and its
+// live-log viewer. Returns in-flight rows enriched with the managed project
+// path; run content (prompt, description, repo URL) is stripped by
+// buildTaskViews. Admin-gated via the session cookie like the other /api routes.
+export function mountTaskRoutes(app) {
+    app.get("/api/tasks", requireSession((req, res) => {
+        const limit = parseLimit(req.query.limit, 15, 100);
+        const offset = parseOffset(req.query.offset);
+        const rows = listInFlight(limit, offset);
+        const tasks = buildTaskViews(rows, (projectId) => getProject(projectId)?.projectPath ?? "", (projectId, mode) => {
+            if (mode !== "plan" && mode !== "build")
+                return { model: "", variant: "" };
+            return {
+                model: resolveModelForMode(projectId, mode),
+                variant: resolveVariantForMode(projectId, mode),
+            };
+        }, projectWorkItemUrl, globalQueuePosition);
+        const total = countInFlight();
+        // Concurrency gate snapshot for the panel header: how many slots are held
+        // vs the cap, and how many tasks are waiting on the gate. In-memory depth,
+        // not the DB backlog (per-item queued rows are already in `tasks`).
+        const quota = buildTaskQuota(globalQueueDepth(), globalQueueMax());
+        logReq(req, "debug", "list in-flight tasks", { count: tasks.length, total, limit, offset, quota });
+        return res.json({ tasks, total, quota });
+    }));
+    // Live snapshot of a task's currently-active phase container logs (clone,
+    // sync, auth, run, push, …), not only the opencode `-run` container. Each
+    // phase container is short-lived and named per work item; a queued task has no
+    // container yet (available:false) and a settled task's containers are gone
+    // (`--rm`). A settled task falls back to its archived run-log file (work item
+    // #61) so the viewer does not dead-end the moment a run finishes. The browser
+    // polls this while the modal is open.
+    app.get("/api/tasks/:seq/logs", requireSession(async (req, res) => {
+        const seq = parseSeqParam(req.params.seq ?? "");
+        if (!seq) {
+            logReq(req, "warn", "task logs bad seq", { seq: req.params.seq });
+            return res.status(400).json({ error: "invalid seq" });
+        }
+        const row = getTask(seq);
+        if (row && row.status === "running") {
+            const logs = await fetchTaskLogs(row.work_item_id);
+            logReq(req, "debug", "task logs", { seq, phase: logs.phase, available: logs.available, truncated: logs.truncated });
+            return res.json({ seq, status: row.status, archived: false, ...logs });
+        }
+        // Not running (or already deleted post-settle): serve the archived file when
+        // one exists. A queued task has no history row, so it stays available:false.
+        const history = getRunHistoryByTaskSeq(seq);
+        if (history) {
+            const archived = readArchivedLog(history.logFile);
+            logReq(req, "debug", "task logs (archived)", { seq, available: archived.available, reason: archived.reason });
+            return res.json({
+                seq,
+                status: history.status,
+                archived: true,
+                available: archived.available,
+                text: archived.text,
+                truncated: archived.truncated,
+                phase: null,
+                phaseLabel: "",
+                reason: archived.reason,
+            });
+        }
+        // Neither an in-flight row nor a history row: the seq never existed (or its
+        // queued row was dropped without ever running). Keep the original 404 so a
+        // client can tell "unknown" from "settled, no archive".
+        if (!row) {
+            logReq(req, "debug", "task logs not found", { seq });
+            return res.status(404).json({ error: "not found" });
+        }
+        logReq(req, "debug", "task logs unavailable", { seq, status: row.status });
+        return res.json({ seq, status: row.status, archived: false, available: false, text: "", truncated: false, phase: null, phaseLabel: "" });
+    }));
+    // Stop one in-flight task from the WebUI. Queued -> row dropped; running ->
+    // durable cancel flag + phase-container kill (runner unwinds as cancelled).
+    // Best-effort stop note in the work item thread. Admin-gated like the rest.
+    app.post("/api/tasks/:seq/stop", requireSession(async (req, res) => {
+        const seq = parseSeqParam(req.params.seq ?? "");
+        if (!seq) {
+            logReq(req, "warn", "stop task bad seq", { seq: req.params.seq });
+            return res.status(400).json({ error: "invalid seq" });
+        }
+        const row = getTask(seq);
+        if (!row) {
+            logReq(req, "debug", "stop task not found", { seq });
+            return res.status(404).json({ error: "not found" });
+        }
+        const result = await stopTask(seq);
+        try {
+            const p = JSON.parse(row.payload);
+            const workItemNumber = p.workItemNumber ?? p.workItemIid;
+            if (typeof p.projectId === "number" && typeof workItemNumber === "number") {
+                await getPlatform().workItems.postComment(p.projectId, workItemNumber, result.message);
+            }
+        }
+        catch (e) {
+            logReq(req, "warn", "stop note failed", { seq, err: e });
+        }
+        logReq(req, "info", "stop task", { seq, ok: result.ok });
+        return res.json({ ok: result.ok, seq });
+    }));
+    // Persisted error logs (newest first, metadata only). The body is fetched
+    // per-row from GET /api/error-logs/:id so the list stays small.
+    app.get("/api/error-logs", requireSession((req, res) => {
+        const limit = parseLimit(req.query.limit);
+        const offset = parseOffset(req.query.offset);
+        const projectId = parsePositiveInt(req.query.projectId);
+        const model = parseString(req.query.model);
+        const mode = parseString(req.query.mode);
+        const title = parseQuery(req.query.q);
+        const { days, from, to } = parseDateWindow(req.query);
+        const window = resolveUsageWindow({ days, ...(from !== undefined ? { from } : {}), ...(to !== undefined ? { to } : {}) }, Date.now());
+        // created_at is epoch seconds: floor the lower bound, ceil the (exclusive)
+        // upper bound so the current second is never dropped.
+        const filter = {
+            ...(projectId !== undefined ? { projectId } : {}),
+            ...(model !== undefined ? { model } : {}),
+            ...(mode !== undefined ? { mode } : {}),
+            ...(title !== undefined ? { title } : {}),
+            sinceSec: Math.floor(window.windowStart / 1000),
+            untilSec: Math.ceil(window.windowEnd / 1000),
+        };
+        const logs = listErrorLogs(limit, offset, filter).map((l) => ({
+            ...l,
+            workItemUrl: projectWorkItemUrl(l.projectId, l.workItemIid),
+            projectPath: getProject(l.projectId)?.projectPath ?? "",
+        }));
+        const total = countErrorLogs(filter);
+        const filterOptions = listErrorLogFilterOptions();
+        const projectPaths = {};
+        for (const p of filterOptions.projects)
+            projectPaths[String(p)] = getProject(p)?.projectPath ?? `#${p}`;
+        logReq(req, "debug", "list error logs", { count: logs.length, total, limit, offset });
+        return res.json({ logs, total, filterOptions, projectPaths });
+    }));
+    app.delete("/api/error-logs", requireSession((req, res) => {
+        const cleared = clearErrorLogs();
+        logReq(req, "info", "clear error logs", { cleared });
+        return res.status(204).end();
+    }));
+    app.get("/api/error-logs/:id", requireSession((req, res) => {
+        const id = parseSeqParam(req.params.id ?? "");
+        if (!id) {
+            logReq(req, "warn", "error log bad id", { id: req.params.id });
+            return res.status(400).json({ error: "invalid id" });
+        }
+        const row = getErrorLog(id);
+        if (!row) {
+            logReq(req, "debug", "error log not found", { id });
+            return res.status(404).json({ error: "not found" });
+        }
+        logReq(req, "debug", "get error log", { id });
+        // Prefer the shared run-log file (work item #61): it holds the full
+        // multi-phase run, redacted + capped + formatted by the same renderer as the
+        // live and history views. Legacy rows (no file) serve their inline body. An
+        // expired file renders the same "logs expired" state as the history page.
+        const archived = row.logFile ? readArchivedLog(row.logFile) : null;
+        if (archived?.available) {
+            return res.json({
+                log: {
+                    ...row,
+                    workItemUrl: projectWorkItemUrl(row.projectId, row.workItemIid),
+                    projectPath: getProject(row.projectId)?.projectPath ?? "",
+                    logs: archived.text,
+                    truncated: archived.truncated,
+                    logAvailable: true,
+                    logReason: "",
+                },
+            });
+        }
+        return res.json({
+            log: {
+                ...row,
+                workItemUrl: projectWorkItemUrl(row.projectId, row.workItemIid),
+                projectPath: getProject(row.projectId)?.projectPath ?? "",
+                // Format the stored body for display: per-line server-local clock derived
+                // from podman timestamps (live) or opencode event timestamps (persisted).
+                // Storage stays raw; only the response is decorated.
+                logs: formatLogBody(row.logs),
+                // A row with no file reference is a legacy/uncaptured row whose inline
+                // body is authoritative; a row WITH a file but no readable file is
+                // expired.
+                logAvailable: row.logFile === "",
+                logReason: archived?.reason ?? "",
+            },
+        });
+    }));
+}
+//# sourceMappingURL=task-routes.js.map

package/dist/admin/task-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-routes.js","sourceRoot":"","sources":["../../src/admin/task-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,yBAAyB,EAAuB,MAAM,uBAAuB,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAExH,gFAAgF;AAChF,yEAAyE;AACzE,yEAAyE;AACzE,gCAAgC;AAChC,SAAS,kBAAkB,CAAC,SAAiB,EAAE,cAAsB;IACnE,OAAO,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,mEAAmE;AACnE,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,EACJ,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE,EACvD,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YAClB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC3E,OAAO;gBACL,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC;gBAC3C,OAAO,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC;aAChD,CAAC;QACJ,CAAC,EACD,kBAAkB,EAClB,mBAAmB,CACpB,CAAC;QACF,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,KAAK,GAAG,cAAc,CAAC,gBAAgB,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC,CAAC;IAEJ,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,sCAAsC;IACtC,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAClE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACpH,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9G,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,GAAG;gBACH,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,wDAAwD;QACxD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3I,CAAC,CAAC,CAAC,CAAC;IAEJ,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjE,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAClE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA6E,CAAC;YAC9G,MAAM,cAAc,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,WAAW,CAAC;YACzD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC1E,MAAM,WAAW,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC,CAAC;IAEJ,0EAA0E;IAC1E,gEAAgE;IAChE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACtF,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,2EAA2E;QAC3E,sDAAsD;QACtD,MAAM,MAAM,GAAmB;YAC7B,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;SAC7C,CAAC;QACF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC;YACJ,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC;YAC3D,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE;SACxD,CAAC,CAAC,CAAC;QACJ,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;QAClD,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ;YAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;QACxG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,oEAAoE;QACpE,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,GAAG,EAAE;oBACH,GAAG,GAAG;oBACN,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;oBAC/D,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE;oBACzD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,EAAE;iBACd;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;YACd,GAAG,EAAE;gBACH,GAAG,GAAG;gBACN,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;gBAC/D,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE;gBACzD,0EAA0E;gBAC1E,0EAA0E;gBAC1E,qDAAqD;gBACrD,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC7B,uEAAuE;gBACvE,mEAAmE;gBACnE,WAAW;gBACX,YAAY,EAAE,GAAG,CAAC,OAAO,KAAK,EAAE;gBAChC,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE;aAClC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/admin/test-routes.js

@@ -0,0 +1,38 @@
+import { log } from "../logger.js";
+import { logReq } from "../http-util.js";
+import { signCookie, SESSION_COOKIE } from "../cookie.js";
+// Test-only auth bypass for the browser E2E harness (scripts/check-ui-e2e.ts).
+// The UI is gated behind forge OAuth (requireSession) and the session cookie is
+// httpOnly + Secure (PUBLIC_URL must be https), so a local http:// test server
+// cannot set it via document.cookie or complete the real OAuth flow. This route
+// signs a session directly and sets a non-Secure cookie.
+//
+// SECURITY: mounted ONLY when DEVBOT_TEST_AUTH === "1". Production never sets
+// that var, so these routes do not exist in a normal deployment. Do not enable
+// it on a public host.
+export function mountTestRoutes(app) {
+    if (process.env.DEVBOT_TEST_AUTH !== "1")
+        return;
+    log.warn("test-auth routes enabled (DEVBOT_TEST_AUTH=1) — never enable in production");
+    app.get("/test/login", (req, res) => {
+        const userId = Number(process.env.DEVBOT_TEST_USER_ID ?? "1");
+        const username = process.env.DEVBOT_TEST_USERNAME ?? "e2e-admin";
+        const exp = Math.floor(Date.now() / 1000) + 3600;
+        const payload = { accessToken: "test-access-token", userId, username, exp };
+        res.cookie(SESSION_COOKIE, signCookie(payload), {
+            httpOnly: true,
+            secure: false,
+            sameSite: "lax",
+            path: "/",
+            maxAge: 3600 * 1000,
+        });
+        logReq(req, "info", "test login", { userId, username });
+        return res.status(204).end();
+    });
+    app.get("/test/logout", (req, res) => {
+        res.clearCookie(SESSION_COOKIE, { path: "/" });
+        logReq(req, "info", "test logout");
+        return res.status(204).end();
+    });
+}
+//# sourceMappingURL=test-routes.js.map

package/dist/admin/test-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-routes.js","sourceRoot":"","sources":["../../src/admin/test-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AAE/E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG;QAAE,OAAO;IAEjD,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IAEvF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACjD,MAAM,OAAO,GAAmB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC5F,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE;YAC9C,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI,GAAG,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/admin/volume-routes.js

@@ -0,0 +1,82 @@
+import { logReq, requireSession } from "../http-util.js";
+import { listVolumeViews, deleteVolumeForWebUi, filterVolumeViews, } from "../volume-manage.js";
+import { parseLimit, parseOffset, parsePositiveInt, parseQuery } from "./query-params.js";
+// WebUI volume management (work item #64): list per-work-item volumes with
+// their GC state, and delete one. Session-gated like the other /api routes.
+// Filtering by GC state/project and searching the work item title was added in
+// work item #88.
+function parseWorkItemIdParam(raw) {
+    const n = Number(Array.isArray(raw) ? raw[0] : raw);
+    return Number.isFinite(n) && Number.isInteger(n) && n > 0 ? n : null;
+}
+const VOLUME_STATES = ["expiring", "eligible", "missing", "untracked", "unmapped"];
+function parseVolumeState(raw) {
+    const v = Array.isArray(raw) ? raw[0] : raw;
+    return typeof v === "string" && VOLUME_STATES.includes(v) ? v : undefined;
+}
+// Project options come from the full list (ignoring the active filters) so a
+// selected project can always be cleared. The 0 id (untracked/unmapped rows)
+// is not offered — those are reached via the GC state filter.
+function volumeFilterOptions(views) {
+    const projects = new Set();
+    for (const v of views)
+        if (v.projectId > 0)
+            projects.add(v.projectId);
+    return { projects: [...projects].sort((a, b) => a - b) };
+}
+export function mountVolumeRoutes(app) {
+    app.get("/api/volumes", requireSession(async (req, res) => {
+        const limit = parseLimit(req.query.limit);
+        const offset = parseOffset(req.query.offset);
+        const projectId = parsePositiveInt(req.query.projectId);
+        const state = parseVolumeState(req.query.state);
+        const title = parseQuery(req.query.q);
+        try {
+            const result = await listVolumeViews();
+            const filterOptions = volumeFilterOptions(result.volumes);
+            const projectPaths = {};
+            for (const v of result.volumes) {
+                if (v.projectId > 0)
+                    projectPaths[String(v.projectId)] = v.projectPath || `#${v.projectId}`;
+            }
+            const filtered = filterVolumeViews(result.volumes, {
+                ...(state !== undefined ? { state } : {}),
+                ...(projectId !== undefined ? { projectId } : {}),
+                ...(title !== undefined ? { title } : {}),
+            });
+            const volumes = filtered.slice(offset, offset + limit);
+            logReq(req, "debug", "list volumes", {
+                count: volumes.length, total: filtered.length, gcEnabled: result.gcEnabled, podmanAvailable: result.podmanAvailable,
+            });
+            return res.json({
+                volumes,
+                total: filtered.length,
+                gcEnabled: result.gcEnabled,
+                ttlMs: result.ttlMs,
+                podmanAvailable: result.podmanAvailable,
+                filterOptions,
+                projectPaths,
+            });
+        }
+        catch (e) {
+            logReq(req, "error", "list volumes failed", { err: e });
+            return res.status(500).json({ error: "failed to list volumes" });
+        }
+    }));
+    // DELETE /api/volumes/:workItemId — remove a work item's volumes (workspace +
+    // siblings) and drop its ledger row. Posts a note to an open work item;
+    // closed/deleted items and untracked volumes are removed silently. Mirrors the
+    // stop route: a failed teardown still returns 200 with ok:false so the UI can
+    // surface the message.
+    app.delete("/api/volumes/:workItemId", requireSession(async (req, res) => {
+        const workItemId = parseWorkItemIdParam(req.params.workItemId ?? "");
+        if (!workItemId) {
+            logReq(req, "warn", "delete volume bad id", { id: req.params.workItemId });
+            return res.status(400).json({ error: "invalid work item id" });
+        }
+        const result = await deleteVolumeForWebUi(workItemId, req.session.username);
+        logReq(req, "info", "delete volume", { workItemId, ok: result.ok, notePosted: result.notePosted });
+        return res.json(result);
+    }));
+}
+//# sourceMappingURL=volume-routes.js.map

package/dist/admin/volume-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"volume-routes.js","sourceRoot":"","sources":["../../src/admin/volume-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE1F,2EAA2E;AAC3E,4EAA4E;AAC5E,+EAA+E;AAC/E,iBAAiB;AAEjB,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,aAAa,GAAoB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAEpG,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,aAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,8DAA8D;AAC9D,SAAS,mBAAmB,CAAC,KAAmB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAC9F,CAAC;YACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE;gBACjD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE;gBACnC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;aACpH,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,OAAO;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa;gBACb,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;YACjE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IAEJ,8EAA8E;IAC9E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,uBAAuB;IACvB,GAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvE,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/admin/webhook-routes.js

@@ -0,0 +1,174 @@
+import { z } from "zod";
+import { logReq, requireSession } from "../http-util.js";
+import { getProject } from "../token-store.js";
+import { GLOBAL_SCOPE_ID } from "../types/global-settings.js";
+import { listWebhooks, getWebhook, upsertWebhook, deleteWebhook, newWebhookSecret, listDeliveries, countDeliveries, getDelivery, replayDelivery, } from "../outbound-webhook-store.js";
+import { testDelivery } from "../outbound-webhook.js";
+import { WebhookEndpointSchema, WEBHOOK_NAME_RE, WEBHOOK_NAME_MAX, } from "../types/outbound-webhook.js";
+// Outbound webhook admin routes. Per-project (/api/projects/:id/webhooks) and
+// global (/api/settings/webhooks); both use the same handler factory. Global
+// endpoints reuse the GLOBAL_SCOPE_ID sentinel, exactly like global MCP.
+function parseProjectIdParam(raw) {
+    const id = Number(Array.isArray(raw) ? raw[0] : raw);
+    return Number.isFinite(id) && Number.isInteger(id) && id > 0 ? id : null;
+}
+function parseWebhookName(raw) {
+    return typeof raw === "string" && WEBHOOK_NAME_RE.test(raw) && raw.length <= WEBHOOK_NAME_MAX ? raw : null;
+}
+// Keep a stored header value when the incoming one is empty (the browser only
+// ever receives masked values, so an empty field means "leave unchanged").
+export function mergeHeaders(existing, incoming) {
+    const out = {};
+    for (const [k, v] of Object.entries(incoming)) {
+        out[k] = v === "" && existing[k] !== undefined ? existing[k] : v;
+    }
+    return out;
+}
+// Browser-facing shape: header values are masked as hasValue (they may carry
+// bearer tokens). The signing secret is not returned here; it is readable via
+// GET .../:name/secret so the admin can paste it into the receiver.
+export function toWebhookSummary(w) {
+    return {
+        name: w.name,
+        url: w.url,
+        events: w.events,
+        headers: Object.entries(w.headers).map(([name, value]) => ({ name, hasValue: value !== "" })),
+        enabled: w.enabled,
+        hasSecret: w.secret.length > 0,
+        createdAt: w.createdAt,
+        updatedAt: w.updatedAt,
+    };
+}
+// PUT body for an endpoint. `secret` is optional: omit to keep the stored one,
+// or send "rotate" to mint a new secret (also minted on first create).
+const WebhookMutationSchema = z.object({
+    url: z.string().url(),
+    events: z.array(z.string()).min(1),
+    headers: z.record(z.string(), z.string()).optional(),
+    enabled: z.boolean().optional(),
+    secret: z.string().optional(),
+});
+function upsertFromBody(scopeId, name, body) {
+    const raw = WebhookMutationSchema.safeParse(body);
+    if (!raw.success)
+        return { ok: false, status: 400, issues: raw.error.issues };
+    const existing = getWebhook(scopeId, name);
+    const mergedHeaders = mergeHeaders(existing?.headers ?? {}, raw.data.headers ?? {});
+    const parsed = WebhookEndpointSchema.safeParse({
+        url: raw.data.url,
+        events: raw.data.events,
+        headers: mergedHeaders,
+        enabled: raw.data.enabled ?? true,
+    });
+    if (!parsed.success)
+        return { ok: false, status: 400, issues: parsed.error.issues };
+    const secret = raw.data.secret === "rotate" || !existing ? newWebhookSecret() : existing.secret;
+    upsertWebhook(scopeId, name, parsed.data, secret);
+    return { ok: true, summary: toWebhookSummary(getWebhook(scopeId, name)) };
+}
+export function mountWebhookRoutes(app) {
+    registerScope(app, "/api/projects/:id/webhooks", (req, res) => {
+        const projectId = parseProjectIdParam(req.params.id ?? "");
+        if (!projectId) {
+            logReq(req, "warn", "webhook route bad id", { id: req.params.id });
+            res.status(400).json({ error: "invalid project id" });
+            return null;
+        }
+        if (!getProject(projectId)) {
+            logReq(req, "warn", "webhook route not managed", { projectId });
+            res.status(404).json({ error: "not managed" });
+            return null;
+        }
+        return projectId;
+    });
+    registerScope(app, "/api/settings/webhooks", () => GLOBAL_SCOPE_ID);
+}
+function registerScope(app, base, resolveScope) {
+    function route(needsName, handler) {
+        return requireSession((req, res) => {
+            const scopeId = resolveScope(req, res);
+            if (scopeId === null)
+                return; // resolver already responded
+            let name = "";
+            if (needsName) {
+                const parsed = parseWebhookName(String(req.params.name ?? ""));
+                if (!parsed) {
+                    logReq(req, "warn", "webhook route bad name", { scopeId, name: req.params.name });
+                    return res.status(400).json({ error: "invalid name" });
+                }
+                name = parsed;
+            }
+            return handler({ scopeId, name }, req, res);
+        });
+    }
+    // GET base — list endpoints (secret + header values masked).
+    app.get(base, route(false, ({ scopeId }, req, res) => {
+        const webhooks = listWebhooks(scopeId).map(toWebhookSummary);
+        logReq(req, "debug", "list outbound webhooks", { scopeId, count: webhooks.length });
+        return res.json({ webhooks });
+    }));
+    // PUT base/:name — upsert.
+    app.put(`${base}/:name`, route(true, ({ scopeId, name }, req, res) => {
+        const result = upsertFromBody(scopeId, name, req.body);
+        if (!result.ok)
+            return res.status(result.status).json({ error: "bad request", issues: result.issues });
+        logReq(req, "info", "upsert outbound webhook", { scopeId, name });
+        return res.json({ ok: true, webhook: result.summary });
+    }));
+    // DELETE base/:name — remove.
+    app.delete(`${base}/:name`, route(true, ({ scopeId, name }, req, res) => {
+        const existed = deleteWebhook(scopeId, name);
+        if (!existed)
+            return res.status(404).json({ error: "not found" });
+        logReq(req, "info", "delete outbound webhook", { scopeId, name });
+        return res.status(204).end();
+    }));
+    // GET base/:name/secret — reveal the signing secret for receiver setup.
+    app.get(`${base}/:name/secret`, route(true, ({ scopeId, name }, _req, res) => {
+        const w = getWebhook(scopeId, name);
+        if (!w)
+            return res.status(404).json({ error: "not found" });
+        return res.json({ secret: w.secret });
+    }));
+    // POST base/:name/test — synchronous probe delivery.
+    app.post(`${base}/:name/test`, route(true, async ({ scopeId, name }, req, res) => {
+        const w = getWebhook(scopeId, name);
+        if (!w)
+            return res.status(404).json({ error: "not found" });
+        const result = await testDelivery(w);
+        logReq(req, "info", "test outbound webhook", { scopeId, name, ok: result.ok, status: result.status });
+        return res.json({ ok: result.ok, status: result.status, error: result.error });
+    }));
+    // GET base/:name/deliveries — paged metadata.
+    app.get(`${base}/:name/deliveries`, route(true, ({ scopeId, name }, req, res) => {
+        const limit = Math.min(Math.max(Number(req.query.limit) || 20, 1), 100);
+        const offset = Math.max(Number(req.query.offset) || 0, 0);
+        const deliveries = listDeliveries(scopeId, name, limit, offset);
+        return res.json({ deliveries, total: countDeliveries(scopeId, name) });
+    }));
+    // GET base/:name/deliveries/:deliveryId — payload + response snippet.
+    app.get(`${base}/:name/deliveries/:deliveryId`, route(true, ({ scopeId, name }, req, res) => {
+        const deliveryId = Number(req.params.deliveryId ?? "");
+        if (!Number.isInteger(deliveryId) || deliveryId <= 0)
+            return res.status(400).json({ error: "invalid params" });
+        const row = getDelivery(deliveryId);
+        if (!row || row.projectId !== scopeId || row.webhookName !== name) {
+            return res.status(404).json({ error: "not found" });
+        }
+        return res.json({ delivery: row });
+    }));
+    // POST base/:name/deliveries/:deliveryId/replay — re-queue for delivery.
+    app.post(`${base}/:name/deliveries/:deliveryId/replay`, route(true, ({ scopeId, name }, req, res) => {
+        const deliveryId = Number(req.params.deliveryId ?? "");
+        if (!Number.isInteger(deliveryId) || deliveryId <= 0)
+            return res.status(400).json({ error: "invalid params" });
+        const row = getDelivery(deliveryId);
+        if (!row || row.projectId !== scopeId || row.webhookName !== name) {
+            return res.status(404).json({ error: "not found" });
+        }
+        replayDelivery(deliveryId);
+        logReq(req, "info", "replay outbound webhook delivery", { scopeId, name, deliveryId });
+        return res.json({ ok: true });
+    }));
+}
+//# sourceMappingURL=webhook-routes.js.map

package/dist/admin/webhook-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-routes.js","sourceRoot":"","sources":["../../src/admin/webhook-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,WAAW,EACX,cAAc,GAEf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GAEjB,MAAM,8BAA8B,CAAC;AAEtC,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AAEzE,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AACD,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7G,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAC1B,QAAgC,EAChC,QAAgC;IAEhC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,CAAgB;IAC/C,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,uEAAuE;AACvE,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,SAAS,cAAc,CACrB,OAAe,EACf,IAAY,EACZ,IAAa;IAEb,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC;QAC7C,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG;QACjB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;QACvB,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACpF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChG,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAMD,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,aAAa,CACX,GAAG,EACH,4BAA4B,EAC5B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACX,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;IACF,aAAa,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,GAAoB,EAAE,IAAY,EAAE,YAA2B;IAEpF,SAAS,KAAK,CAAC,SAAkB,EAAE,OAA2E;QAC5G,OAAO,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,CAAC,6BAA6B;YAC3D,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;oBAClF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,IAAI,GAAG,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC,CAAC;IAEJ,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC,CAAC;IAEJ,8BAA8B;IAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC,CAAC;IAEJ,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,eAAe,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3E,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC,CAAC;IAEJ,qDAAqD;IACrD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC,CAAC;IAEJ,8CAA8C;IAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,mBAAmB,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC,CAAC;IAEJ,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,+BAA+B,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/G,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC,CAAC;IAEJ,yEAAyE;IACzE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClG,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/G,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,cAAc,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,kCAAkC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/agents.js

@@ -0,0 +1,48 @@
+import { log } from "./logger.js";
+import { getPlatform } from "./platform/index.js";
+import { destroyWorkItemVolume } from "./runner.js";
+import { deleteVolumeRow } from "./volume-store.js";
+import { deleteBaseBranch } from "./base-branch-store.js";
+// ponytail: one-way edge agents.ts → runner.ts (no cycle — runner.ts never
+//   imports agents.ts). Reaching into the runner's cleanup for a volume reset
+//   is a minor coupling smell; inject destroyWorkItemVolume as a param only if
+//   this edge ever grows into a cycle or runner.ts gets a second caller.
+//
+//   Agent discovery/validation moved to the runner after syncing configured
+//   agent repos (work item #63); this module now only owns reset handling.
+// ponytail: skips the per-work-item queue — reset is one podman rm -f + volume rm,
+//   ~100ms, no opencode spawn. Matches the close handler's precedent (also calls
+//   destroyWorkItemVolume outside the queue). Bypasses queue ordering: a reset
+//   mid-run kills the runner's container; the runner's runPodmanCapture sees
+//   non-zero exit and posts ERROR_REPLY, then this posts the reset result. Both
+//   notes appear in the thread — intentional, no suppression flag. The queue's
+//   per-work-item Promise chain keeps ordering so a queued follow-up won't start
+//   until the killed task's promise settles.
+//
+// Authorization (the configured trigger policy — author/assignee gate plus
+// minimum role, refined by per-project rules) is enforced by the general
+// trigger gate in webhook.ts before this is called; no local check here.
+// triggeringNoteId: the note id that carried the /reset mention, used to reply
+// in-thread on failure; undefined on the work-item-creation path (no note).
+export async function handleResetNote(projectId, workItemNumber, workItemId, triggeringNoteId) {
+    try {
+        const result = await destroyWorkItemVolume(workItemId);
+        // Drop the ledger row so the GC sweep doesn't re-visit the freed volume.
+        //   Best-effort; a stray row is harmless (sweep no-ops on a gone volume).
+        deleteVolumeRow(workItemId);
+        // Clear any /base choice so a post-reset re-mention with /base sets a fresh
+        //   value (first-write-wins would otherwise keep the pre-reset base).
+        try {
+            deleteBaseBranch(workItemId);
+        }
+        catch (e) {
+            log.warn("reset base-branch delete failed", { workItemId, err: e });
+        }
+        await getPlatform().workItems.postComment(projectId, workItemNumber, result.message).catch((e) => log.warn("reset-result note failed", e));
+    }
+    catch (e) {
+        log.warn("reset failed", { workItemId, err: e });
+        await getPlatform().workItems.postErrorReply(projectId, workItemNumber, triggeringNoteId, "⚠️ Reset failed; see logs.").catch((e) => log.warn("reset-error note failed", e));
+    }
+}
+//# sourceMappingURL=agents.js.map

package/dist/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,yEAAyE;AACzE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAE3E,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,6CAA6C;AAC7C,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,cAAsB,EACtB,UAAkB,EAClB,gBAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,yEAAyE;QACzE,0EAA0E;QAC1E,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,CAAC;YACH,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,WAAW,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/F,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;QAC1D,MAAM,WAAW,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAClI,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,CACvC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/assignee-value.js

@@ -0,0 +1,6 @@
+// Shared, dependency-free assignee value rules. Imported by the server schemas
+// and (through the @server alias) by the two WebUI validators so the username
+// shape has exactly one definition per build graph.
+export const ASSIGNEE_RE = /^[A-Za-z0-9._-]{1,255}$/;
+export const ASSIGNEE_NONE = "none";
+//# sourceMappingURL=assignee-value.js.map

package/dist/assignee-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee-value.js","sourceRoot":"","sources":["../src/assignee-value.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC"}