@way_marks/server 2.0.3 → 4.0.0

package/dist/api/events.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attachSubscriber = attachSubscriber;
+exports.emit = emit;
+const subscribers = new Set();
+function attachSubscriber(res) {
+    // SSE headers
+    res.setHeader('Content-Type', 'text/event-stream');
+    res.setHeader('Cache-Control', 'no-cache, no-transform');
+    res.setHeader('Connection', 'keep-alive');
+    res.setHeader('X-Accel-Buffering', 'no');
+    res.flushHeaders?.();
+    const sub = { res, closed: false };
+    subscribers.add(sub);
+    // Initial hello so the client opens onmessage cleanly
+    res.write(`event: hello\ndata: {"ok":true}\n\n`);
+    return () => {
+        sub.closed = true;
+        subscribers.delete(sub);
+    };
+}
+function emit(topic, payload = {}) {
+    const data = JSON.stringify({ topic, ...payload });
+    const frame = `event: ${topic}\ndata: ${data}\n\n`;
+    for (const sub of subscribers) {
+        if (sub.closed)
+            continue;
+        try {
+            sub.res.write(frame);
+        }
+        catch { /* client disconnected; cleanup happens via close handler */ }
+    }
+}
+// Heartbeat keeps proxies / browsers from closing the stream.
+const HEARTBEAT_MS = 25000;
+setInterval(() => {
+    for (const sub of subscribers) {
+        if (sub.closed)
+            continue;
+        try {
+            sub.res.write(`: heartbeat\n\n`);
+        }
+        catch { /* noop */ }
+    }
+}, HEARTBEAT_MS).unref?.();

package/dist/api/server.js

@@ -46,6 +46,7 @@ const engine_1 = require("../policies/engine");
 const handler_1 = require("../approvals/handler");
 const manager_2 = require("../approval/manager");
 const manager_3 = require("../escalation/manager");
+const events_1 = require("./events");
 // Import registry for Phase 2 hub navigation
 const registryPath = path.join(process.env.HOME || process.env.USERPROFILE || '', '.waymark', 'registry.json');
 function getRegistryProjects() {
@@ -59,6 +60,42 @@ function getRegistryProjects() {
         return [];
     }
 }
+function readRegistry() {
+    if (!fs.existsSync(registryPath))
+        return { projects: {}, releasedPorts: [] };
+    try {
+        const r = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+        return { projects: r.projects || {}, releasedPorts: r.releasedPorts || [], lastUpdated: r.lastUpdated };
+    }
+    catch {
+        return { projects: {}, releasedPorts: [] };
+    }
+}
+function writeRegistry(reg) {
+    reg.lastUpdated = new Date().toISOString();
+    fs.writeFileSync(registryPath, JSON.stringify({ version: 1, ...reg }, null, 2) + '\n');
+}
+function mutateRegistryEntry(id, mutator) {
+    const reg = readRegistry();
+    const entry = reg.projects[id];
+    if (!entry)
+        return null;
+    mutator(entry);
+    reg.projects[id] = entry;
+    writeRegistry(reg);
+    return entry;
+}
+function tryKill(pid) {
+    if (!pid)
+        return false;
+    try {
+        process.kill(pid, 'SIGTERM');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 // Phase 4: Garbage collection for registry
 function garbageCollectRegistryFile() {
     try {
@@ -93,12 +130,42 @@ function garbageCollectRegistryFile() {
     }
 }
 const app = (0, express_1.default)();
-const PORT = parseInt(process.env.WAYMARK_PORT || '3001', 10);
+// Fallback only — `waymark start` always passes WAYMARK_PORT explicitly.
+// 47000 is the new default range (47000-47999); 3001 was the legacy default.
+const PORT = parseInt(process.env.WAYMARK_PORT || '47000', 10);
 app.use(express_1.default.json());
 app.use(express_1.default.urlencoded({ extended: true }));
-// Serve UI — path works for both ts-node (src/api/) and compiled (dist/api/)
-const UI_DIR = path.resolve(__dirname, '../../src/ui');
-app.use(express_1.default.static(UI_DIR));
+// Same-machine peer CORS for the Hub view: another Waymark dashboard on a
+// different localhost port may probe this server's /api/* (e.g. /api/stats,
+// /api/hub/*). Allow it without opening up arbitrary remote origins.
+app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    if (typeof origin === 'string' && /^http:\/\/(localhost|127\.0\.0\.1):\d+$/.test(origin)) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE,OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+        if (req.method === 'OPTIONS')
+            return res.sendStatus(204);
+    }
+    next();
+});
+// Serve UI — path works for both ts-node (src/api/) and compiled (dist/api/).
+const UI_DIR = path.resolve(__dirname, '../../src/ui-dist');
+const UI_INDEX = path.join(UI_DIR, 'index.html');
+const UI_BUILT = fs.existsSync(UI_INDEX);
+if (UI_BUILT) {
+    app.use(express_1.default.static(UI_DIR));
+}
+else {
+    console.warn('[waymark] ui-dist/ not found — dashboard will return a setup banner. ' +
+        'Run `npm run build -w @way_marks/web` to build the dashboard.');
+}
+// GET /api/events — Server-Sent Events stream for live UI updates
+app.get('/api/events', (req, res) => {
+    const detach = (0, events_1.attachSubscriber)(res);
+    req.on('close', detach);
+});
 // GET /api/actions — list all actions (or ?count=true for pending count)
 app.get('/api/actions', (req, res) => {
     try {
@@ -192,6 +259,7 @@ app.post('/api/actions/:action_id/approve', async (req, res) => {
             const status = result.error === 'Action not found' ? 404 : 400;
             return res.status(status).json({ error: result.error });
         }
+        (0, events_1.emit)('actions', { action_id: req.params.action_id, kind: 'approved' });
         res.json(result);
     }
     catch (err) {
@@ -207,6 +275,7 @@ app.post('/api/actions/:action_id/reject', async (req, res) => {
             const status = result.error === 'Action not found' ? 404 : 400;
             return res.status(status).json({ error: result.error });
         }
+        (0, events_1.emit)('actions', { action_id: req.params.action_id, kind: 'rejected' });
         res.json(result);
     }
     catch (err) {
@@ -266,12 +335,14 @@ app.post('/api/actions/:action_id/rollback', (req, res) => {
         if (!action.before_snapshot) {
             fs.unlinkSync(action.target_path);
             (0, database_1.markRolledBack)(action.action_id);
+            (0, events_1.emit)('actions', { action_id: action.action_id, kind: 'rolled_back' });
             return res.json({ success: true, action: 'deleted', message: `Deleted new file: ${action.target_path}` });
         }
         // Restore file to before_snapshot
         fs.mkdirSync(path.dirname(action.target_path), { recursive: true });
         fs.writeFileSync(action.target_path, action.before_snapshot, 'utf8');
         (0, database_1.markRolledBack)(action.action_id);
+        (0, events_1.emit)('actions', { action_id: action.action_id, kind: 'rolled_back' });
         res.json({ success: true, action: 'restored', message: `Restored ${action.target_path} to previous state` });
     }
     catch (err) {
@@ -384,6 +455,8 @@ app.post('/api/sessions/:session_id/rollback', (req, res) => {
                 message: 'Rollback failed',
             });
         }
+        (0, events_1.emit)('sessions', { session_id, kind: 'rolled_back', count: actions.length });
+        (0, events_1.emit)('actions', { session_id, kind: 'session_rolled_back' });
         res.json({
             success: true,
             message: `Rolled back session ${session_id}`,
@@ -427,15 +500,22 @@ app.get('/api/config', (req, res) => {
         res.status(500).json({ error: err.message });
     }
 });
-// GET /api/project — returns project metadata from .waymark/config.json
-app.get('/api/project', (req, res) => {
+// GET /api/project — returns live project metadata for the running server.
+// Source of truth: .waymark/config.json (written by `waymark start`).
+// Falls back to env-only state when running stand-alone (no .waymark/ yet).
+app.get('/api/project', (_req, res) => {
     try {
-        const configPath = path.join(process.env.WAYMARK_PROJECT_ROOT || process.cwd(), '.waymark', 'config.json');
+        const projectRoot = process.env.WAYMARK_PROJECT_ROOT || process.cwd();
+        const configPath = path.join(projectRoot, '.waymark', 'config.json');
         if (!fs.existsSync(configPath)) {
-            return res.json({ projectName: null, port: PORT });
+            return res.json({ projectName: null, port: PORT, projectRoot });
         }
         const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-        res.json({ projectName: cfg.projectName || null, port: cfg.port || PORT });
+        res.json({
+            projectName: cfg.projectName || null,
+            port: cfg.port || PORT,
+            projectRoot: cfg.projectRoot || projectRoot,
+        });
     }
     catch (err) {
         res.status(500).json({ error: err.message });
@@ -462,6 +542,86 @@ app.post('/api/registry/cleanup', (req, res) => {
     }
 });
 // ============================================================================
+// Hub: cross-project mutations driven from any peer's dashboard.
+// All write to ~/.waymark/registry.json the same way the CLI does.
+// ============================================================================
+// POST /api/hub/projects/:id/pause — flip status to paused (port retained)
+app.post('/api/hub/projects/:id/pause', (req, res) => {
+    try {
+        const { id } = req.params;
+        const updated = mutateRegistryEntry(id, (e) => {
+            e.status = 'paused';
+            e.pausedAt = new Date().toISOString();
+        });
+        if (!updated)
+            return res.status(404).json({ error: `Project not found: ${id}` });
+        res.json({ success: true, project: updated });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/hub/projects/:id/resume — flip status back to running
+app.post('/api/hub/projects/:id/resume', (req, res) => {
+    try {
+        const { id } = req.params;
+        const updated = mutateRegistryEntry(id, (e) => {
+            e.status = 'running';
+            delete e.pausedAt;
+        });
+        if (!updated)
+            return res.status(404).json({ error: `Project not found: ${id}` });
+        res.json({ success: true, project: updated });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/hub/projects/:id/stop — SIGTERM the peer's mcp+api, mark stopped,
+// release the port for reuse. Mirrors `waymark stop` behaviour without needing
+// the user to cd into the other project.
+app.post('/api/hub/projects/:id/stop', (req, res) => {
+    try {
+        const { id } = req.params;
+        const reg = readRegistry();
+        const entry = reg.projects[id];
+        if (!entry)
+            return res.status(404).json({ error: `Project not found: ${id}` });
+        const killedApi = tryKill(entry.api_pid);
+        const killedMcp = tryKill(entry.mcp_pid);
+        entry.status = 'stopped';
+        entry.stoppedAt = new Date().toISOString();
+        reg.projects[id] = entry;
+        // Release port for reuse (mirrors registry.releasePort behaviour).
+        if (entry.port && Array.isArray(reg.releasedPorts)) {
+            reg.releasedPorts.push(entry.port);
+        }
+        else {
+            reg.releasedPorts = [entry.port];
+        }
+        writeRegistry(reg);
+        res.json({
+            success: true,
+            project: entry,
+            killed: { api: killedApi, mcp: killedMcp },
+            message: killedApi || killedMcp ? `Stopped ${id}.` : `${id} was not running (registry cleaned).`,
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/hub/gc — alias of /api/registry/cleanup; convenient from the Hub UI.
+app.post('/api/hub/gc', (_req, res) => {
+    try {
+        const removed = garbageCollectRegistryFile();
+        res.json({ success: true, removed, message: `Garbage collected ${removed} stale entries` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// ============================================================================
 // PHASE 2: Team Approval Routing Endpoints
 // ============================================================================
 // GET /api/team/members — list all team members
@@ -488,6 +648,7 @@ app.post('/api/team/members', (req, res) => {
             return res.status(400).json({ error: `Email ${email} already in use` });
         }
         (0, database_1.addTeamMember)(member_id, name, email, added_by, slack_id);
+        (0, events_1.emit)('team', { member_id, kind: 'added' });
         res.json({ success: true, member_id, message: `Added team member: ${name}` });
     }
     catch (err) {
@@ -503,6 +664,7 @@ app.delete('/api/team/members/:member_id', (req, res) => {
             return res.status(404).json({ error: `Team member ${member_id} not found` });
         }
         (0, database_1.removeTeamMember)(member_id);
+        (0, events_1.emit)('team', { member_id, kind: 'removed' });
         res.json({ success: true, message: `Removed team member: ${member.name}` });
     }
     catch (err) {
@@ -528,6 +690,7 @@ app.post('/api/approval-routes', (req, res) => {
             return res.status(400).json({ error: 'Missing required fields: route_id, name, approver_ids (array)' });
         }
         (0, database_1.addApprovalRoute)(route_id, name, approver_ids, created_by, description, condition_type, condition_json);
+        (0, events_1.emit)('approval-routes', { route_id, kind: 'added' });
         res.json({ success: true, route_id, message: `Created approval route: ${name}` });
     }
     catch (err) {
@@ -544,6 +707,7 @@ app.put('/api/approval-routes/:route_id', (req, res) => {
             return res.status(404).json({ error: `Approval route ${route_id} not found` });
         }
         (0, database_1.updateApprovalRoute)(route_id, { name, description, approver_ids });
+        (0, events_1.emit)('approval-routes', { route_id, kind: 'updated' });
         res.json({ success: true, message: `Updated approval route: ${route_id}` });
     }
     catch (err) {
@@ -559,6 +723,7 @@ app.delete('/api/approval-routes/:route_id', (req, res) => {
             return res.status(404).json({ error: `Approval route ${route_id} not found` });
         }
         (0, database_1.deleteApprovalRoute)(route_id);
+        (0, events_1.emit)('approval-routes', { route_id, kind: 'deleted' });
         res.json({ success: true, message: `Deleted approval route: ${route_id}` });
     }
     catch (err) {
@@ -608,6 +773,7 @@ app.post('/api/approvals/:request_id/approve', (req, res) => {
             return res.status(400).json({ error: 'Missing required field: approver_id' });
         }
         const status = (0, manager_2.submitApprovalDecision)(request_id, approver_id, 'approve', reason);
+        (0, events_1.emit)('approvals', { request_id, kind: 'approve', approver_id });
         res.json({
             success: true,
             message: `Approved by ${approver_id}`,
@@ -627,6 +793,7 @@ app.post('/api/approvals/:request_id/reject', (req, res) => {
             return res.status(400).json({ error: 'Missing required field: approver_id' });
         }
         const status = (0, manager_2.submitApprovalDecision)(request_id, approver_id, 'reject', reason);
+        (0, events_1.emit)('approvals', { request_id, kind: 'reject', approver_id });
         res.json({
             success: true,
             message: `Rejected by ${approver_id}`,
@@ -674,6 +841,7 @@ app.post('/api/escalations/rules', (req, res) => {
             return res.status(400).json({ error: 'Missing required fields: rule_id, name, escalation_targets (array)' });
         }
         (0, database_1.addEscalationRule)(rule_id, name, escalation_targets, created_by, description, timeout_hours);
+        (0, events_1.emit)('escalation-rules', { rule_id, kind: 'added' });
         res.json({ success: true, rule_id, message: `Created escalation rule: ${name}` });
     }
     catch (err) {
@@ -690,6 +858,7 @@ app.put('/api/escalations/rules/:rule_id', (req, res) => {
             return res.status(404).json({ error: `Escalation rule ${rule_id} not found` });
         }
         (0, database_1.updateEscalationRule)(rule_id, { name, description, escalation_targets, timeout_hours });
+        (0, events_1.emit)('escalation-rules', { rule_id, kind: 'updated' });
         res.json({ success: true, message: `Updated escalation rule: ${rule_id}` });
     }
     catch (err) {
@@ -705,6 +874,7 @@ app.delete('/api/escalations/rules/:rule_id', (req, res) => {
             return res.status(404).json({ error: `Escalation rule ${rule_id} not found` });
         }
         (0, database_1.deleteEscalationRule)(rule_id);
+        (0, events_1.emit)('escalation-rules', { rule_id, kind: 'deleted' });
         res.json({ success: true, message: `Deleted escalation rule: ${rule_id}` });
     }
     catch (err) {
@@ -756,6 +926,8 @@ app.post('/api/escalations/:request_id/decide', (req, res) => {
             return res.status(400).json({ error: 'Decision must be "proceed" or "block"' });
         }
         const status = (0, manager_3.submitEscalationDecision)(request_id, target_id, decision, reason);
+        (0, events_1.emit)('escalations', { request_id, kind: 'decided', decision, target_id });
+        (0, events_1.emit)('approvals', { request_id, kind: 'escalation_decided' });
         res.json({
             success: true,
             message: `${target_id} decided to ${decision}`,
@@ -958,9 +1130,20 @@ app.delete('/api/remediation/policies/:policy_id', (req, res) => {
         res.status(500).json({ error: err.message });
     }
 });
-// Fallback: serve UI for any unmatched route
-app.get('*', (req, res) => {
-    res.sendFile(path.join(UI_DIR, 'index.html'));
+// Fallback: serve UI for any unmatched route. If the dashboard hasn't been
+// built yet, emit a friendly setup banner instead of a 404.
+app.get('*', (_req, res) => {
+    if (UI_BUILT) {
+        return res.sendFile(UI_INDEX);
+    }
+    res.status(503).type('html').send(`<!doctype html>
+<html><head><meta charset="utf-8"/><title>Waymark — dashboard not built</title>
+<style>body{font:14px/1.5 -apple-system,system-ui,sans-serif;color:#1d2126;background:#fafaf8;display:grid;place-items:center;min-height:100vh;margin:0}main{max-width:520px;padding:32px}h1{margin:0 0 8px;font-size:18px}code{background:#ebebe8;padding:2px 6px;border-radius:4px;font-family:ui-monospace,Menlo,monospace}</style>
+</head><body><main>
+<h1>Dashboard not built</h1>
+<p>The Waymark API is running, but the React dashboard hasn't been built yet.</p>
+<p>Run <code>npm run build -w @way_marks/web</code> from the project root, then refresh.</p>
+</main></body></html>`);
 });
 app.listen(PORT, () => {
     console.log(`Waymark UI + API running at http://localhost:${PORT}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@way_marks/server",
-  "version": "2.0.3",
+  "version": "4.0.0",
   "description": "Waymark MCP server and dashboard",
   "author": "Waymark <hello@waymarks.dev>",
   "license": "MIT",
@@ -27,7 +27,7 @@
   },
   "files": [
     "dist/**",
-    "src/ui/**"
+    "src/ui-dist/**"
   ],
   "scripts": {
     "build": "tsc",