@weavecode/weave 0.0.0-stage → 0.1.0

package/node_modules/@weavecode/server/dist/daemon/terminal-topology-refresher.d.ts

@@ -0,0 +1,63 @@
+import type { SessionTerminal } from './opener.js';
+import type { DataBus } from './data-bus.js';
+/**
+ * TerminalTopologyRefresher — 终端世界的隐藏刷新面，两个消费方：项目卡「终端」
+ * 角标（每项目窗口数）+ 会话列表分块（会话 → 所在可见屏幕）。
+ *
+ * 为什么需要它：wezterm 不会向我们推送窗口开关，用户手动关一个窗口不产生任何
+ * 事件，只能靠 spawn `wezterm cli list` 反查（见 opener.countOpenTerminals）；
+ * 会话在哪块屏（window/tab）同样只能从那次枚举里读。探测要创建子进程（每存活
+ * socket 一次，实测 wall ~180ms / CPU 62–125ms），所以**永远不在请求关键路径上
+ * 等它**：GET 只回上次快照 + 后台对账，新 SSE 客户端先补上次快照再后台对账，
+ * 探测结果经 push 帧（值变才推）到达。
+ *
+ * 形状与 SyncScheduler 一致（start/stop/tick + running 防重入），不新造抽象。
+ */
+export interface TerminalTopology {
+    /** projectId → 本项目已开终端窗口数（项目卡角标）。 */
+    counts: Record<number, number>;
+    /** sessionId → 所在可见屏幕；null = 反查不到（pane 已关 / 换了 mux），缺 = 该会话没上报过定位。 */
+    terminals: Record<string, SessionTerminal | null>;
+}
+export interface TerminalTopologyRefresherOptions {
+    /** 扫描周期，ms。默认 30s——角标滞后半分钟无感，而每次扫描都要 spawn 子进程。 */
+    intervalMs?: number;
+    /** 是否值得探测（一般为「有 SSE 客户端」）。缺省恒真（测试用）。 */
+    shouldRun?: () => boolean;
+    /**
+     * 启动饱和窗口，ms：daemon 刚起的几秒里 watcher/首轮同步占满事件循环，
+     * 探测的 spawn 排队会把 ~200ms 拖成秒级还抢 CPU——窗口内 tick 直接跳过
+     * （走陈旧值路径），用户动作（refreshNow）不受限。缺省 0（测试用）。
+     */
+    graceMs?: number;
+}
+export declare class TerminalTopologyRefresher {
+    /** 现算一份终端世界（窗口计数 + 会话所在屏幕）。探测失败应 throw，由本类吞掉。 */
+    private readonly snapshot;
+    private readonly bus;
+    private readonly options;
+    private timer;
+    private running;
+    /** 上次成功探测的快照（探测失败保留旧值）；GET 与新客户端首帧的数据源。 */
+    private last;
+    /** 上次推送的取值指纹；相同则不再推（只推变化）。 */
+    private lastFingerprint;
+    private startedAt;
+    constructor(
+    /** 现算一份终端世界（窗口计数 + 会话所在屏幕）。探测失败应 throw，由本类吞掉。 */
+    snapshot: () => Promise<TerminalTopology>, bus: DataBus, options?: TerminalTopologyRefresherOptions);
+    /** 上次成功快照（null = 还没探过）；GET 陈旧值直给用。 */
+    get lastSnapshot(): TerminalTopology | null;
+    start(): void;
+    stop(): void;
+    /** 用户动作（开终端）后立刻对账：不受「没人看」与启动窗口限制，仍只在变化时推。 */
+    refreshNow(): Promise<void>;
+    /**
+     * 新 SSE 客户端接入：立即补一帧上次快照（推送只在变化时发，否则首帧要等
+     * 下一个周期；还没探过就不补），随后后台对一次账——补上陈旧窗口的差量。
+     */
+    onSubscriberJoin(): void;
+    /** 一次扫描。ignoreSubscribers = true 时跳过「没人看」判定（用户动作触发）。 */
+    tick(ignoreSubscribers?: boolean): Promise<void>;
+    private run;
+}

package/node_modules/@weavecode/server/dist/daemon/terminal-topology-refresher.js

@@ -0,0 +1 @@
+export class TerminalTopologyRefresher{snapshot;bus;options;timer;running=!1;last=null;lastFingerprint=null;startedAt=0;constructor(t,i,s={}){this.snapshot=t,this.bus=i,this.options=s}get lastSnapshot(){return this.last}start(){this.timer||(this.startedAt=Date.now(),this.timer=setInterval(()=>{this.tick()},this.options.intervalMs??3e4))}stop(){this.timer&&(clearInterval(this.timer),this.timer=void 0)}async refreshNow(){await this.run(!0,!0)}onSubscriberJoin(){this.last!==null&&(this.lastFingerprint=JSON.stringify(this.last),this.bus.emit({key:"terminalTopology",payload:this.last})),this.tick()}async tick(t=!1){await this.run(t,!1)}async run(t,i){if(this.running)return;const s=this.options.shouldRun;if(!(!t&&s&&!s())&&!(!i&&Date.now()-this.startedAt<(this.options.graceMs??0))){this.running=!0;try{const n=await this.snapshot();this.last=n;const r=JSON.stringify(n);if(r===this.lastFingerprint)return;this.lastFingerprint=r,this.bus.emit({key:"terminalTopology",payload:n})}catch{}finally{this.running=!1}}}}

package/node_modules/@weavecode/server/dist/daemon/tls.d.ts

@@ -0,0 +1,47 @@
+import https from 'node:https';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** 自签证书目录（`<dataDir>/certs`）。 */
+export declare function daemonCertsDir(): string;
+/** 本机对外 IPv4：全部非 internal 地址（局域网访问面），去重排序求稳定序。 */
+export declare function lanIps(): string[];
+export interface AccessUrl {
+    url: string;
+    protocol: 'http' | 'https';
+    /** local = 本机回环；lan = 局域网其他设备可达。 */
+    scope: 'local' | 'lan';
+}
+/**
+ * 守护进程的全部访问地址（`daemon status` 与设置页同一事实源）：
+ * 每个局域网 IP × 已开协议，外加 localhost。tlsPort 为 0/未开则只有 http。
+ */
+export declare function accessUrls(port: number, tlsPort: number): AccessUrl[];
+export interface DaemonCert {
+    key: string;
+    cert: string;
+}
+/**
+ * 取自签证书：落盘件可直接复用（未过期 + 私钥匹配 + 当前 IP 仍在 SAN 内——
+ * DHCP 换 IP 后重签，手机按旧 IP 授权过的一旦 IP 变更本来就得重新访问）；
+ * 否则重新生成。纯 JS（selfsigned），不依赖 openssl。
+ */
+export declare function ensureDaemonCert(dir?: string, opts?: {
+    ips?: string[];
+    hostname?: string;
+    now?: Date;
+}): Promise<DaemonCert>;
+export interface TlsListener {
+    server: https.Server;
+    /** 实际监听端口（与请求的相同）。 */
+    port: number;
+}
+/**
+ * 起局域网 HTTPS 监听（与 6420 的 HTTP 并存，同一认证/路由面）。
+ * 端口被占等失败**不致命**：警告后放弃 HTTPS（HTTP 不受影响）。
+ */
+export declare function startTlsServer(opts: {
+    port: number;
+    bindHost: string;
+    handler: (req: IncomingMessage, res: ServerResponse) => void;
+    /** 证书目录（测试注入临时目录）；缺省 `<dataDir>/certs`。 */
+    certDir?: string;
+}): Promise<TlsListener | null>;

package/node_modules/@weavecode/server/dist/daemon/tls.js

@@ -0,0 +1 @@
+import v from"node:https";import u from"node:os";import l from"node:path";import{existsSync as f,mkdirSync as w,readFileSync as m,writeFileSync as h}from"node:fs";import{X509Certificate as S,createPrivateKey as k}from"node:crypto";import{generate as D}from"selfsigned";import{getDataDir as $}from"../db/paths.js";export function daemonCertsDir(){return l.join($(),"certs")}export function lanIps(){const e=new Set;for(const t of Object.values(u.networkInterfaces()))for(const r of t??[])r.family==="IPv4"&&!r.internal&&e.add(r.address);return[...e].sort()}export function accessUrls(e,t){const r=[{url:`http://localhost:${e}`,protocol:"http",scope:"local"}];t>0&&r.push({url:`https://localhost:${t}`,protocol:"https",scope:"local"});for(const o of lanIps())r.push({url:`http://${o}:${e}`,protocol:"http",scope:"lan"}),t>0&&r.push({url:`https://${o}:${t}`,protocol:"https",scope:"lan"});return r}function x(e){const t=e.subjectAltName??"",r=new Set;for(const o of t.split(",")){const n=o.trim().match(/^IP Address:(.+)$/);n&&r.add(n[1])}return r}export async function ensureDaemonCert(e=daemonCertsDir(),t={}){const r=t.ips??["127.0.0.1",...lanIps()],o=t.hostname??u.hostname(),n=t.now??new Date,s=l.join(e,"host.key"),a=l.join(e,"host.crt");if(f(s)&&f(a))try{const i=m(s,"utf-8"),p=new S(m(a,"utf-8")),y=r.every(d=>x(p).has(d));if(p.checkPrivateKey(k(i))&&Date.parse(p.validTo)>n.getTime()+7*864e5&&y)return{key:i,cert:m(a,"utf-8")}}catch{}const c=await D([{name:"commonName",value:"weave-daemon"}],{keySize:2048,notAfterDate:new Date(n.getTime()+825*864e5),extensions:[{name:"subjectAltName",altNames:[{type:2,value:"localhost"},{type:2,value:o},...r.map(i=>({type:7,ip:i}))]}]});return w(e,{recursive:!0}),h(s,c.private,{mode:384}),h(a,c.cert),{key:c.private,cert:c.cert}}export async function startTlsServer(e){if(e.port<=0)return null;try{const{key:t,cert:r}=await ensureDaemonCert(e.certDir),o=v.createServer({key:t,cert:r},e.handler);return await new Promise((n,s)=>{o.once("error",s),o.listen(e.port,e.bindHost,()=>{o.off("error",s),n()})}),{server:o,port:e.port}}catch(t){return console.warn(`[weave] https listener disabled (port ${e.port}): ${t instanceof Error?t.message:String(t)}`),null}}

package/node_modules/@weavecode/server/dist/daemon/toolkit-routes.d.ts

@@ -0,0 +1,10 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { WeaveServerDeps } from './server.js';
+/**
+ * 批 10 工具包路由（范式同 hooks-routes）：
+ *   GET  /projects/:id/toolkit                        — 包清单 + 启用态 + 旧副本
+ *   POST /projects/:id/toolkit/:packId/enable|disable — 幂等开关，返回后置状态
+ *   POST /projects/:id/toolkit/legacy-copies/cleanup  — 幂等清理项目插件位旧副本（批 3）
+ * 返回 false 表示未命中，主链继续分发。
+ */
+export declare function handleToolkitRoutes(req: IncomingMessage, res: ServerResponse, deps: WeaveServerDeps, pathname: string, url: URL): Promise<boolean>;

package/node_modules/@weavecode/server/dist/daemon/toolkit-routes.js

@@ -0,0 +1 @@
+import{sendJson as e}from"./http.js";import{ToolkitError as h}from"../hooks/toolkit.js";export async function handleToolkitRoutes(n,o,r,a,f){if(!a.includes("/toolkit"))return!1;if(!r.toolkit)return e(o,503,{error:"Toolkit unavailable"}),!0;const l=t=>{if(t instanceof h){e(o,t.code==="not-found"?404:400,{error:t.message,code:t.code});return}e(o,400,{error:t instanceof Error?t.message:"Toolkit operation failed"})},u=a.match(/^\/projects\/(\d+)\/toolkit$/);if(u){if(n.method!=="GET")return e(o,405,{error:"Method not allowed"}),!0;try{e(o,200,await r.toolkit.list(Number(u[1])))}catch(t){l(t)}return!0}const i=a.match(/^\/projects\/(\d+)\/toolkit\/([^/]+)\/(enable|disable|uninstall)$/);if(i){if(n.method!=="POST")return e(o,405,{error:"Method not allowed"}),!0;const t=Number(i[1]),s=decodeURIComponent(i[2]),m=i[3],c=f.searchParams.get("source");try{const d=m==="enable"?await r.toolkit.enable(t,s,c??void 0):m==="disable"?await r.toolkit.disable(t,s,c??void 0):await r.toolkit.uninstall(t,s,c??void 0);r.dataBus?.emit({key:"toolkit"}),e(o,200,d)}catch(d){l(d)}return!0}const k=a.match(/^\/projects\/(\d+)\/toolkit\/legacy-copies\/cleanup$/);if(k){if(n.method!=="POST")return e(o,405,{error:"Method not allowed"}),!0;try{const t=await r.toolkit.cleanupLegacyCopies(Number(k[1]));r.dataBus?.emit({key:"toolkit"}),e(o,200,t)}catch(t){l(t)}return!0}return!1}

package/node_modules/@weavecode/server/dist/db/db.d.ts

@@ -0,0 +1,3 @@
+import { DatabaseSync } from 'node:sqlite';
+/** Open (creating + migrating if needed) the weave database. */
+export declare function openDatabase(dbPath?: string): DatabaseSync;

package/node_modules/@weavecode/server/dist/db/db.js

@@ -0,0 +1,134 @@
+import{mkdirSync as e}from"node:fs";import s from"node:path";import{DatabaseSync as N}from"node:sqlite";import{getDbPath as t}from"./paths.js";const F=`
+CREATE TABLE IF NOT EXISTS projects (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  path          TEXT NOT NULL UNIQUE,
+  name          TEXT NOT NULL,
+  token         TEXT NOT NULL,
+  source        TEXT NOT NULL DEFAULT 'init',
+  registered_at TEXT NOT NULL,
+  last_seen_at  TEXT,
+  meta          TEXT,
+  sort_order    INTEGER,
+  archived_at   TEXT
+);
+
+CREATE TABLE IF NOT EXISTS hook_events (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id INTEGER NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  source     TEXT NOT NULL,
+  event_type TEXT NOT NULL,
+  session_id TEXT,
+  payload    TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_hook_events_project ON hook_events(project_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_hook_events_session ON hook_events(session_id);
+
+CREATE TABLE IF NOT EXISTS libraries (
+  id       INTEGER PRIMARY KEY AUTOINCREMENT,
+  path     TEXT NOT NULL UNIQUE,
+  kind     TEXT NOT NULL DEFAULT 'skill',
+  added_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS hook_rules (
+  id         TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  enabled    INTEGER NOT NULL DEFAULT 1,
+  priority   INTEGER NOT NULL DEFAULT 0,
+  project_id INTEGER REFERENCES projects(id) ON DELETE CASCADE,
+  source     TEXT NOT NULL,
+  filter     TEXT NOT NULL DEFAULT '{}',
+  handler    TEXT NOT NULL,
+  timeout_ms INTEGER NOT NULL DEFAULT 10000,
+  record     INTEGER NOT NULL DEFAULT 1,
+  origin     TEXT NOT NULL DEFAULT 'user',
+  plugin_id  TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_hook_rules_project ON hook_rules(project_id);
+
+CREATE TABLE IF NOT EXISTS plugin_states (
+  id         TEXT PRIMARY KEY,
+  enabled    INTEGER NOT NULL DEFAULT 1,
+  config     TEXT NOT NULL DEFAULT '{}',
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS hook_dispatches (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  rule_id     TEXT NOT NULL REFERENCES hook_rules(id) ON DELETE CASCADE,
+  event_id    INTEGER REFERENCES hook_events(id) ON DELETE SET NULL,
+  session_id  TEXT,
+  prompt      TEXT NOT NULL,
+  status      TEXT NOT NULL,
+  mode        TEXT NOT NULL DEFAULT 'manual',
+  output      TEXT,
+  error       TEXT,
+  started_at  TEXT NOT NULL,
+  finished_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_hook_dispatches_rule ON hook_dispatches(rule_id, started_at);
+CREATE INDEX IF NOT EXISTS idx_hook_dispatches_status ON hook_dispatches(status);
+
+CREATE TABLE IF NOT EXISTS sessions (
+  session_id    TEXT PRIMARY KEY,
+  project_id    INTEGER REFERENCES projects(id) ON DELETE CASCADE,
+  title         TEXT,
+  pending_title TEXT,
+  last_seen_at  TEXT NOT NULL,
+  created_at    TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_sessions_project ON sessions(project_id, last_seen_at);
+
+-- \u8DE8\u4F1A\u8BDD\u7F16\u6392\uFF08session-orchestration\uFF09\uFF1A\u4F1A\u8BDD\u8BA2\u9605 + \u5E8F\u5217\u8868\u4FDD\u7559\u3002\u70B9\u5BF9\u70B9\u6D88\u606F\u57DF
+-- \u5DF2\u91CD\u5851\u4E3A\u7EAF\u9012\u9001\u7BA1\u9053\uFF08\u672C\u5730\u6587\u4EF6 + \u5185\u5B58\u6001\uFF0C\u4E0D\u843D\u5E93\uFF09\u2014\u2014session_messages \u8868\u9000\u5F79\u3002
+-- on_events = \u89E6\u53D1\u7C7B\u578B\u96C6 JSON\uFF08['idle'] \u7F3A\u7701 | 'turnEnd' | 'messageFailed' \u7684\u7EC4\u5408\uFF09\uFF1B
+-- remaining = \u5269\u4F59\u63D0\u9192\u6B21\u6570\uFF08**\u6240\u6709\u5DF2\u9009\u7C7B\u578B\u5171\u7528\u4E00\u4E2A\u8BA1\u6570**\uFF09\uFF0CNULL = \u6301\u4E45\u5316\uFF08\u4E0D\u5931\u6548\uFF09\u3002
+CREATE TABLE IF NOT EXISTS session_watches (
+  id                 INTEGER PRIMARY KEY AUTOINCREMENT,
+  watcher_session_id TEXT,
+  target_session_id  TEXT NOT NULL,
+  notify             TEXT,
+  on_events          TEXT,
+  remaining          INTEGER,
+  fired_at           TEXT,
+  created_at         TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_session_watches_target ON session_watches(target_session_id, fired_at);
+
+-- \u8DE8\u4F1A\u8BDD\u5E8F\u5217\uFF08\u6279 3\uFF09\uFF1A\u624B\u5DE5\u7F16\u6392\u7684\u591A\u6B65\u94FE\u3002steps JSON = [{to,text,mode,
+-- messageId?}]\uFF0CmessageId \u4E3A\u6B65\u89E6\u53D1\u540E\u56DE\u586B\u7684\u7BA1\u9053\u53D1\u53F7\uFF08\u5185\u5B58\u5173\u8054\uFF09\uFF1B
+-- cursor = \u6B63\u5728\u7B49\u5F85\u5B8C\u6210\u7684\u6B65\u4E0B\u6807\u3002\u5F15\u64CE\u65E0\u5185\u5B58\u6743\u5A01\u6001\uFF0C\u5168\u90E8\u72B6\u6001\u5728\u884C\u3002
+-- \u6D88\u606F\u57DF\u91CD\u5851\uFF08\u6D88\u606F\u57DF\u9000\u5F79\uFF09\uFF1A\u4E0A\u8868 session_messages \u968F\u7BA1\u9053\u5316 DROP\u3002
+CREATE TABLE IF NOT EXISTS session_sequences (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  name       TEXT NOT NULL DEFAULT '',
+  steps      TEXT NOT NULL,
+  status     TEXT NOT NULL,
+  cursor     INTEGER NOT NULL DEFAULT 0,
+  error      TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+-- \u5168\u5C40\u9759\u6001\u914D\u7F6E\uFF08key-value \u5355\u8868\uFF0C\u539F <dataDir>/settings.json \u6587\u4EF6\u2014\u2014\u914D\u7F6E
+-- \u7EDF\u4E00\u843D\u5E93\uFF09\u3002\u914D\u7F6E\u9879\u4EE5\u7EA6\u5B9A key \u843D\u884C\uFF08\u5982 terminal.preset / locale /
+-- hooks.enabled / events.retentionDays\uFF09\uFF0C\u65B0\u589E\u914D\u7F6E\u96F6\u8868\u7ED3\u6784\u8FC1\u79FB\uFF1B
+-- \u503C\u4E3A\u6587\u672C\uFF0C\u8BFB\u65F6\u7ECF mergeDefaults \u5F52\u4E00\u5316\uFF0C\u574F\u503C\u81EA\u6108\u56DE\u843D\u9ED8\u8BA4\u3002
+CREATE TABLE IF NOT EXISTS settings (
+  key   TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+
+-- Web Push \u8BA2\u9605\uFF08\u6BCF\u4E2A\u6D4F\u89C8\u5668\u5B89\u88C5\u4E00\u4EFD\uFF1Bendpoint \u662F\u63A8\u9001\u670D\u52A1\u7684\u7EDD\u5BF9 URL\uFF0C
+-- \u5929\u7136\u552F\u4E00\u952E\uFF09\u3002\u63A8\u9001\u670D\u52A1\u56DE 404/410 = \u8BA2\u9605\u5DF2\u88AB\u6D4F\u89C8\u5668\u7AEF\u64A4\u9500 \u2192 \u53D1\u9001\u4FA7\u5220\u9664\u3002
+CREATE TABLE IF NOT EXISTS push_subscriptions (
+  endpoint   TEXT PRIMARY KEY,
+  p256dh     TEXT NOT NULL,
+  auth       TEXT NOT NULL,
+  user_agent TEXT,
+  created_at TEXT NOT NULL
+);
+`;export function openDatabase(E=t()){E!==":memory:"&&e(s.dirname(E),{recursive:!0});const u=new N(E);return u.exec("PRAGMA journal_mode = WAL"),u.exec("PRAGMA foreign_keys = ON"),u.exec("PRAGMA busy_timeout = 5000"),u.exec(F),u.exec("DROP TABLE IF EXISTS session_messages"),o(u),i(u),L(u),u}function L(E){const u=new Set(E.prepare("PRAGMA table_info(session_watches)").all().map(T=>String(T.name)));u.size!==0&&(u.has("on_events")||E.exec("ALTER TABLE session_watches ADD COLUMN on_events TEXT"),u.has("remaining")||(E.exec("ALTER TABLE session_watches ADD COLUMN remaining INTEGER"),E.exec("UPDATE session_watches SET remaining = 1")))}function i(E){const u=new Set(E.prepare("PRAGMA table_info(projects)").all().map(T=>String(T.name)));u.size!==0&&(u.has("sort_order")||E.exec("ALTER TABLE projects ADD COLUMN sort_order INTEGER"),u.has("archived_at")||E.exec("ALTER TABLE projects ADD COLUMN archived_at TEXT"))}function o(E){const u=new Set(E.prepare("PRAGMA table_info(hook_rules)").all().map(T=>String(T.name)));u.size!==0&&(u.has("origin")||E.exec("ALTER TABLE hook_rules ADD COLUMN origin TEXT NOT NULL DEFAULT 'user'"),u.has("plugin_id")||E.exec("ALTER TABLE hook_rules ADD COLUMN plugin_id TEXT"),E.exec("CREATE INDEX IF NOT EXISTS idx_hook_rules_plugin ON hook_rules(plugin_id)"))}

package/node_modules/@weavecode/server/dist/db/paths.d.ts

@@ -0,0 +1,14 @@
+/** Absolute path to the global weave data directory (`<configDir>/weave`). */
+export declare function getDataDir(): string;
+/** Absolute path to the SQLite database file. */
+export declare function getDbPath(): string;
+/** Absolute path to the daemon state file (`{ pid, port, startedAt }`). */
+export declare function getDaemonStatePath(): string;
+/** Absolute path to the daemon auth file (password hash + secrets, 0600). */
+export declare function getAuthPath(): string;
+/** Absolute path to the one-shot initial-password marker (0600; 首个 CLI 命令领取后即删). */
+export declare function getInitialPasswordPath(): string;
+/** Absolute path to the AI assistant key file (`{ apiKey }`, 0600; 密钥不进 settings 表). */
+export declare function getAiKeyPath(): string;
+/** Absolute path to the Web Push VAPID keypair file (`{ publicKey, privateKey }`, 0600). */
+export declare function getPushKeysPath(): string;

package/node_modules/@weavecode/server/dist/db/paths.js

@@ -0,0 +1 @@
+import t from"node:path";import{detectPlatform as n}from"@weavecode/core";export function getDataDir(){return t.join(n().configDir,"weave")}export function getDbPath(){return t.join(getDataDir(),"weave.db")}export function getDaemonStatePath(){return t.join(getDataDir(),"daemon.json")}export function getAuthPath(){return t.join(getDataDir(),"auth.json")}export function getInitialPasswordPath(){return t.join(getDataDir(),"initial-password")}export function getAiKeyPath(){return t.join(getDataDir(),"ai.json")}export function getPushKeysPath(){return t.join(getDataDir(),"push.json")}

package/node_modules/@weavecode/server/dist/hooks/adapter.d.ts

@@ -0,0 +1,21 @@
+import type { Harness } from '@weavecode/core';
+import type { HookEventInput } from '../repositories/hook-events.js';
+import type { HookReport } from './types.js';
+/**
+ * Normalizes a raw hook report from a specific agent into the unified
+ * {@link HookEventInput} shape for persistence.
+ *
+ * 批 4b 兼容类型：实现已迁入 `@weavecode/harness`（ClaudeEventSource），本接口保留
+ * 具体签名（HookReport → HookEventInput）供既有注入方使用——与 harness 的
+ * `EventSource` 结构兼容（normalize 参数放宽为 unknown、返回收窄为具体行，
+ * 方法双变下 HookAdapter 是 EventSource 的结构子类型）。
+ */
+export interface HookAdapter {
+    readonly source: Harness;
+    normalize(report: HookReport, projectId: number): HookEventInput;
+}
+/**
+ * 旧名保留（批 4b 迁出）：构造与行为与原 ClaudeCodeAdapter 完全一致，
+ * `new ClaudeCodeAdapter()` 等价于 `new ClaudeEventSource()`。
+ */
+export { ClaudeEventSource as ClaudeCodeAdapter } from '@weavecode/harness';

package/node_modules/@weavecode/server/dist/hooks/adapter.js

@@ -0,0 +1 @@
+export{ClaudeEventSource as ClaudeCodeAdapter}from"@weavecode/harness";

package/node_modules/@weavecode/server/dist/hooks/answer-keys.d.ts

@@ -0,0 +1,29 @@
+import type { BlockingQuestion } from '@weavecode/harness';
+/**
+ * 阻塞问答的作答拼装：整 call 一次提交——面顺序（= 宿主 tab 顺序）逐问把选项
+ * 键序接成**原子序列**，由 deliverer 逐个打进 pane。
+ *
+ * 键序形态全归 harness 规格（选项 keys / textFocus / textTail），这里只做三件
+ * 结构判断（都是实机口径）：
+ * - 未作答的问题要补一记 Tab 走过去——宿主允许空作答，但不走开的话下一个问题的
+ *   数字会落在上一个 tab 上；
+ * - 多选勾选不推进焦点（单选数字自带推进、输入行尾键自带推进），故多选答完也要 Tab；
+ * - `chat` 行与收尾屏（Submit）结束整 call，后面的键不能再打（会落进聊天输入框）；
+ * - 预览模式的选项键只挪高亮，提交靠选项自己的 `commit`（没选输入行时补在键序尾）。
+ */
+/** 一问的作答（web 只送下标与文本，键序由服务端按面拼）。 */
+export interface AnswerPick {
+    questionKey: string;
+    /** 选中的选项下标（面顺序，空 = 未作答）。 */
+    options: number[];
+    /** 自定义输入行的文本（仅当选中了 `input` 行）。 */
+    text?: string;
+}
+export type ComposeResult = {
+    ok: true;
+    atoms: string[];
+} | {
+    ok: false;
+    error: string;
+};
+export declare function composeAnswerAtoms(questions: readonly BlockingQuestion[], picks: readonly AnswerPick[]): ComposeResult;

package/node_modules/@weavecode/server/dist/hooks/answer-keys.js

@@ -0,0 +1 @@
+const l="	";export function composeAnswerAtoms(i,p){if(i.every(o=>o.options.length===0))return{ok:!1,error:"Question face has no answerable options"};const u=new Map(p.map(o=>[o.questionKey,o]));for(const o of u.keys())if(!i.some(s=>s.key===o))return{ok:!1,error:`Unknown question: ${o}`};const n=[];for(const o of i){const s=u.get(o.key),t=(s?.options??[]).map(e=>o.options[e]);if(t.some(e=>!e))return{ok:!1,error:`Invalid option index: ${o.key}`};if(o.submit&&t.length!==1)return{ok:!1,error:"Submit choice required to finish the call"};const c=t.filter(e=>!e.input);if(!o.multiSelect&&c.length>1)return{ok:!1,error:`Single-select question got ${c.length} options: ${o.key}`};const f=s?.text?.trim()??"",r=t.find(e=>e.input);if(r&&!f)return{ok:!1,error:`Text required for this option: ${o.key}`};for(const e of t)n.push(...e.keys);if(r)n.push(...r.textFocus??[],f,...r.textTail??["\r"]);else for(const e of t)n.push(...e.commit??[]);if(o.submit||t.some(e=>e.chat))break;!r&&(o.multiSelect||t.length===0)&&n.push("	")}return{ok:!0,atoms:n}}

package/node_modules/@weavecode/server/dist/hooks/bus.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Hook 分发事件总线（WatchService 的 EventEmitter + subscribe 形态）。
+ * 供 SSE /events 订阅推给 dashboard——与文件资产变更（watch）语义分离，
+ * 各自独立 emitter，handleSse 双订阅。
+ */
+export type HookBusMessage = {
+    kind: 'event.ingested';
+    eventId: number;
+    projectId: number;
+    sessionId: string | null;
+    eventType: string;
+    /** 事件源子 agent（raw.agent_id；SubagentStop 时 = 刚结束的那个子 agent）。 */
+    agentId?: string;
+    /** 出生信号：PostToolUse(Agent, isAsync) 的 tool_response.agentId（后台子 agent）。 */
+    spawnAgentId?: string;
+    /** Stop/SubagentStop 携带的后台任务快照（status 全为 running）——存活集权威对账源。 */
+    backgroundTasks?: Array<{
+        id: string;
+        status: string;
+    }>;
+    at: string;
+} | {
+    kind: 'rule.matched';
+    ruleId: string;
+    eventId: number;
+    sessionId: string | null;
+    at: string;
+} | {
+    kind: 'dispatch.created';
+    ruleId: string;
+    dispatchId: number;
+    status: string;
+    mode: string;
+    sessionId: string | null;
+    at: string;
+} | {
+    kind: 'dispatch.started';
+    ruleId: string;
+    dispatchId: number;
+    sessionId: string | null;
+    at: string;
+} | {
+    kind: 'dispatch.finished';
+    ruleId: string;
+    dispatchId: number;
+    status: 'succeeded' | 'failed' | 'timeout';
+    sessionId: string | null;
+    at: string;
+} | {
+    kind: 'plugin.reloaded';
+    pluginId: string;
+    status: 'active' | 'rejected' | 'disabled';
+    ruleCount: number;
+    /** true = 插件目录被移除/不再发现，规则已级联删除。 */
+    removed?: boolean;
+    at: string;
+} | {
+    kind: 'plugin.toggled';
+    pluginId: string;
+    enabled: boolean;
+    at: string;
+}
+/** 更名生效确认：reported title 落库（pending 清除）后广播，dashboard 据此
+ *  把「改名待生效」徽标切换为已生效的新名字。 */
+ | {
+    kind: 'session.renamed';
+    sessionId: string;
+    title: string;
+    at: string;
+} | {
+    kind: 'message.created';
+    messageId: string;
+    sessionId: string;
+    mode: string;
+    at: string;
+} | {
+    kind: 'message.delivered';
+    messageId: string;
+    sessionId: string;
+    at: string;
+}
+/** 投递回执：目标会话自己的 UserPromptSubmit 与在途条目匹配上了（真到达）。 */
+ | {
+    kind: 'message.acknowledged';
+    messageId: string;
+    sessionId: string;
+    at: string;
+}
+/** 队列暂停闸置位：未回执超窗（unacked）或投递失败（failed）——该会话后续队列
+ *  暂停冲洗，手动重发或回执解除；成因消息带 stalled 标记常驻在途视图。 */
+ | {
+    kind: 'message.stalled';
+    messageId: string;
+    sessionId: string;
+    reason: 'unacked' | 'failed';
+    at: string;
+} | {
+    kind: 'message.finished';
+    messageId: string;
+    sessionId: string;
+    status: 'succeeded' | 'failed' | 'timeout';
+    at: string;
+}
+/** 在途/终态消息行被删除（dashboard 在途视图的「删除」）：该行不再出现在
+ * 会话的对话尾巴上（历史仍在目标会话自己的转录里）。 */
+ | {
+    kind: 'message.dismissed';
+    messageId: string;
+    sessionId: string;
+    at: string;
+} | {
+    kind: 'watch.fired';
+    watchId: number;
+    targetSessionId: string;
+    watcherSessionId: string | null;
+    reason: 'idle' | 'turnEnd' | 'messageFailed';
+    at: string;
+} | {
+    kind: 'question.pending';
+    sessionId: string;
+    harness: string;
+    count: number;
+    at: string;
+} | {
+    kind: 'sequence.step';
+    sequenceId: number;
+    cursor: number;
+    at: string;
+} | {
+    kind: 'sequence.finished';
+    sequenceId: number;
+    status: 'done' | 'failed' | 'cancelled';
+    error: string | null;
+    at: string;
+};
+export declare class HookEventBus {
+    private readonly emitter;
+    constructor();
+    emit(message: HookBusMessage): void;
+    /** 返回退订函数（与 WatchService.subscribe 一致）。 */
+    subscribe(listener: (message: HookBusMessage) => void): () => void;
+}

package/node_modules/@weavecode/server/dist/hooks/bus.js

@@ -0,0 +1 @@
+import{EventEmitter as t}from"node:events";export class HookEventBus{emitter=new t;constructor(){this.emitter.setMaxListeners(100)}emit(e){this.emitter.emit("change",e)}subscribe(e){return this.emitter.on("change",e),()=>this.emitter.off("change",e)}}

package/node_modules/@weavecode/server/dist/hooks/dispatcher.d.ts

@@ -0,0 +1,95 @@
+import { type Harness } from '@weavecode/core';
+import type { NormalizedHookPayload } from './types.js';
+import type { HookRuleRegistry } from './registry.js';
+import type { PluginHost } from './plugin-loader.js';
+import type { HookDispatchRepository } from '../repositories/hook-dispatches.js';
+import type { SessionRepository } from '../repositories/sessions.js';
+import type { HookEventBus } from './bus.js';
+import type { ProjectRepository, ProjectRow } from '../repositories/projects.js';
+import type { PluginStateRepository } from '../repositories/plugin-states.js';
+export interface IngestContext {
+    /** 本次 ingest 写入 hook_events 的行 id。 */
+    eventId: number;
+    project: ProjectRow;
+    sessionId: string | null;
+    payload: NormalizedHookPayload;
+    /** 事件来源 harness（server.ts 传入 input.source）；规则 harness 过滤按此比对。 */
+    source: Harness;
+    /** hook-handler 的改名交付回执：随响应实际下发的 sessionTitle（未下发 = null）。 */
+    deliveredTitle?: string | null;
+}
+/**
+ * ingest 的注入产出。响应体通道已随 POST /hooks 移除（hook 文件化后注入走
+ * mirror 本地渲染），本接口保留为消费侧的产出形态：additionalContext 仍是全部
+ * 注入片段（语义不变），deferred 是 hook 无法当场交付的部分（plugin 产出、
+ * crossProjectOnly 等未镜像规则），由消费侧写 outbox 顺延给下一次事件。
+ */
+export interface IngestOutcome {
+    additionalContext?: string;
+    sessionTitle?: string;
+    deferred?: string;
+}
+/**
+ * 事件分发器：ingest 后同步匹配（纯内存索引）并按 handler 分发。
+ *
+ * - log：只发 bus 事件，不落 dispatch 行（高频防写放大）
+ * - manual：入池 status=pending（等 dashboard 复制/拖拽执行）
+ * - inject：入池 status=injected；注入本体由 hook 经 mirror 本地渲染交付
+ *   （镜像外规则进 deferred → outbox 顺延）
+ * - webhook：入池 status=running 后异步出站，信号量限并发
+ * - plugin：可注入事件在消费路径上同步执行、产出进 deferred（outbox 顺延），
+ *   整段共享预算；不可注入事件（PreToolUse/Notification 等）与 webhook 同款
+ *   fire-and-forget——prompt 照常入池，只是晚一步落库
+ *
+ * 一切异常在内部吞掉并降级为「无动作」——分发失败永不影响 ingest。
+ */
+export declare class HookDispatcher {
+    private readonly deps;
+    private readonly runningWebhooks;
+    private readonly recentPool;
+    private activeWebhooks;
+    private readonly pendingWebhooks;
+    private activePlugins;
+    private readonly pendingPlugins;
+    constructor(deps: {
+        registry: HookRuleRegistry;
+        dispatches: HookDispatchRepository;
+        bus: HookEventBus;
+        projects: ProjectRepository;
+        /** 会话标题双向 rename（session_title diff + pending 下发）。 */
+        sessions: SessionRepository;
+        /** 插件宿主（plugin-loader）；缺省时 plugin 规则按无动作跳过。 */
+        plugins?: PluginHost;
+        /** D3 项目启用门控的全局回落源（plugin_states 行）；缺省不门控（现状语义）。 */
+        pluginStates?: Pick<PluginStateRepository, 'get'>;
+        /** 测试注入；缺省用全局 fetch。 */
+        fetchImpl?: typeof fetch;
+    });
+    onIngest(ctx: IngestContext): Promise<IngestOutcome>;
+    /** 入池 + 广播 dispatch.created（inject/manual/webhook/plugin 四路共用的建池路径）。 */
+    private createDispatch;
+    /** 同 rule × session 60s 去重：true = 应跳过本规则（防注入指令再触发事件的递归风暴）。 */
+    private dedupe;
+    /** 候选规则：事件索引（启用+priority 降序）→ 项目归属 → 过滤条件。 */
+    private match;
+    /** 该事件能否把插件的 additionalContext 交给会话（白名单按 harness 分表）。 */
+    private injectable;
+    /**
+     * 执行插件处理器：timeoutMs 竞速超时（`budgetMs` = 本次可用预算，取两者更小者），
+     * 任何异常/超时返回 undefined（不注入不入池）。并发闸的排队时间计入同一次竞速，
+     * 排到后照常执行，超时被弃的那次由自己 finally 释放槽位（不会漏槽）。
+     */
+    private runPluginHandler;
+    /** 不可注入事件的插件执行：fire-and-forget，prompt 照常入池（晚一步落库）。 */
+    private runPluginDetached;
+    private summary;
+    private runWebhookAsync;
+    /** 全局并发闸（默认 4）：超出则排队等待。 */
+    private acquireWebhookSlot;
+    private releaseWebhookSlot;
+    /** 插件执行并发闸（默认 4）：超出则排队等待。 */
+    private acquirePluginSlot;
+    private releasePluginSlot;
+    /** 去重窗口 map 清理：只留窗口内条目，防长期运行无限增长。 */
+    private trimDedupe;
+}

package/node_modules/@weavecode/server/dist/hooks/dispatcher.js

@@ -0,0 +1,8 @@
+import{INJECTABLE_EVENTS as I,TITLE_EFFECTIVE_EVENTS as y,hookSourceHarness as b}from"@weavecode/core";import{createPluginLogger as P}from"./plugin-loader.js";import{readHooksEnabled as S}from"../daemon/settings.js";import{effective as v,pluginsStateOf as k}from"./plugin-project-state.js";import{runWebhook as w}from"./handlers/webhook.js";import{DISPATCH_MARKER as h,extractFilePath as c,isCrossProjectPath as j,matchesAnyGlob as T,projectLabel as D,renderTemplate as W,templateVars as E}from"./match.js";const m=6e4,N=4,O=4,C=3e3;export class HookDispatcher{deps;runningWebhooks=new Set;recentPool=new Map;activeWebhooks=0;pendingWebhooks=[];activePlugins=0;pendingPlugins=[];constructor(t){this.deps=t}async onIngest(t){try{if(!S())return{};this.deps.plugins?.notifyEvent?.(t.payload.eventType,t.payload,t.sessionId);const e={};if(t.sessionId){const s=H(t.payload);s!==null&&this.deps.sessions.applyReportedTitle(t.sessionId,s)&&this.deps.bus.emit({kind:"session.renamed",sessionId:t.sessionId,title:s,at:new Date().toISOString()});const o=this.deps.sessions.getBySessionId(t.sessionId)?.pendingTitle;if(o){e.sessionTitle=o;const l=y[t.source].includes(t.payload.eventType);(t.deliveredTitle===o&&l||s!==null)&&this.deps.sessions.confirmPendingTitle(t.sessionId,o)&&this.deps.bus.emit({kind:"session.renamed",sessionId:t.sessionId,title:o,at:new Date().toISOString()})}}const a=this.match(t);if(a.length===0)return e;const n=[],i=[],r=Date.now(),d=r+C;for(const s of a)if(this.deps.bus.emit({kind:"rule.matched",ruleId:s.id,eventId:t.eventId,sessionId:t.sessionId,at:new Date(r).toISOString()}),s.handler.type!=="log"){if(s.handler.type==="manual"||s.handler.type==="inject"){if(this.dedupe(s,t,r))continue;const o=W(s.handler.template,E({event:t.payload.eventType,tool:t.payload.toolName,filePath:c(t.payload.toolInput),cwd:t.payload.cwd,session:t.sessionId,project:D(t.project.path),rule:s.name}))+`
+${h}`,l=s.handler.type==="inject"?"injected":"pending";this.createDispatch(s,t,{prompt:o,status:l,mode:s.handler.type==="inject"?"auto":"manual"}),s.handler.type==="inject"&&(s.filter.crossProjectOnly?i.push(o):n.push(o));continue}if(s.handler.type==="webhook"){if(this.runningWebhooks.has(s.id))continue;this.runningWebhooks.add(s.id);const o=this.createDispatch(s,t,{prompt:`webhook ${s.handler.url}`,status:"running",mode:"auto"});this.deps.bus.emit({kind:"dispatch.started",ruleId:s.id,dispatchId:o.id,sessionId:t.sessionId,at:new Date().toISOString()}),this.runWebhookAsync(s,this.summary(s,t),o.id);continue}if(s.handler.type==="plugin"){const o=this.deps.plugins;if(!o)continue;const l=o.getHandler(s.handler.pluginId,s.handler.handlerType);if(!l||this.dedupe(s,t,r))continue;if(!this.injectable(t)){this.runPluginDetached(s,t,o,l);continue}const u=d-Date.now();if(u<=0)continue;const p=await this.runPluginHandler(s,t,o,l,u);if(!p)continue;p.prompt&&this.createDispatch(s,t,{prompt:p.prompt+`
+${h}`,status:"pending",mode:"auto"}),p.additionalContext&&i.push(p.additionalContext)}}return(n.length>0||i.length>0)&&(e.additionalContext=[...n,...i].join(`
+
+`)),i.length>0&&(e.deferred=i.join(`
+
+`)),e}catch{return{}}}createDispatch(t,e,a){const n=this.deps.dispatches.insert({ruleId:t.id,eventId:e.eventId,sessionId:e.sessionId,...a});return this.deps.bus.emit({kind:"dispatch.created",ruleId:t.id,dispatchId:n.id,status:a.status,mode:n.mode,sessionId:e.sessionId,at:n.startedAt}),n}dedupe(t,e,a){const n=`${t.id}:${e.sessionId??""}`,i=this.recentPool.get(n);return i!==void 0&&a-i<m?!0:(this.recentPool.set(n,a),this.trimDedupe(a),!1)}match(t){const e=this.deps.pluginStates,a=e?k(t.project.meta).enabled:null;let n=null;return this.deps.registry.candidates(t.payload.eventType,e?{includeDisabled:!0}:void 0).filter(i=>{const r=b(i.source);if(r!==null&&r!=="any"&&r!==t.source||i.projectId!==null&&i.projectId!==t.project.id)return!1;if(i.pluginId!==null){if(!i.enabled&&a?.[i.pluginId]!==!0||e&&!v(t.project,i.pluginId,{states:e}))return!1}else if(!i.enabled)return!1;const d=i.filter;if(d.toolNames?.length&&(!t.payload.toolName||!d.toolNames.includes(t.payload.toolName)))return!1;if(d.pathGlobs?.length){const s=c(t.payload.toolInput);if(!s||!T(s,d.pathGlobs))return!1}if(d.crossProjectOnly){const s=c(t.payload.toolInput)??t.payload.cwd;if(!s||(n??=this.deps.projects.list().map(o=>o.path).filter(o=>o!==t.project.path),!j(s,t.project.path,n)))return!1}return!0})}injectable(t){const e=t.payload.eventType;return e!==null&&I[t.source].includes(e)}async runPluginHandler(t,e,a,n,i){if(t.handler.type!=="plugin")return;const{pluginId:r}=t.handler,d=P(r),s=i===void 0?t.timeoutMs:Math.min(t.timeoutMs,i);let o;try{const l=(async()=>{await this.acquirePluginSlot();try{return await n.execute({event:e.payload,rule:t,config:a.getConfig(r),logger:d})}finally{this.releasePluginSlot()}})(),u=await Promise.race([l,new Promise((p,f)=>{o=setTimeout(()=>f(new Error("plugin handler timeout")),s)})]);return u&&typeof u=="object"?u:void 0}catch{return}finally{o&&clearTimeout(o)}}async runPluginDetached(t,e,a,n){try{const i=await this.runPluginHandler(t,e,a,n);if(!i?.prompt)return;this.createDispatch(t,e,{prompt:i.prompt+`
+${h}`,status:"pending",mode:"auto"})}catch{}}summary(t,e){return{ruleId:t.id,ruleName:t.name,projectId:e.project.id,sessionId:e.sessionId,event:e.payload.eventType,toolName:e.payload.toolName,filePath:c(e.payload.toolInput),cwd:e.payload.cwd,at:new Date().toISOString()}}async runWebhookAsync(t,e,a){await this.acquireWebhookSlot();try{const n=await w(t,e,this.deps.fetchImpl);this.deps.dispatches.updateStatus(a,{status:n.status,output:n.output??null,error:n.error??null,finished:!0}),this.deps.bus.emit({kind:"dispatch.finished",ruleId:t.id,dispatchId:a,status:n.status,sessionId:e.sessionId,at:new Date().toISOString()})}catch(n){this.deps.dispatches.updateStatus(a,{status:"failed",error:String(n),finished:!0}),this.deps.bus.emit({kind:"dispatch.finished",ruleId:t.id,dispatchId:a,status:"failed",sessionId:e.sessionId,at:new Date().toISOString()})}finally{this.runningWebhooks.delete(t.id),this.releaseWebhookSlot()}}acquireWebhookSlot(){return this.activeWebhooks<N?(this.activeWebhooks++,Promise.resolve()):new Promise(t=>{this.pendingWebhooks.push(()=>{this.activeWebhooks++,t()})})}releaseWebhookSlot(){this.activeWebhooks--;const t=this.pendingWebhooks.shift();t&&t()}acquirePluginSlot(){return this.activePlugins<O?(this.activePlugins++,Promise.resolve()):new Promise(t=>{this.pendingPlugins.push(()=>{this.activePlugins++,t()})})}releasePluginSlot(){this.activePlugins--;const t=this.pendingPlugins.shift();t&&t()}trimDedupe(t){if(!(this.recentPool.size<1e3))for(const[e,a]of this.recentPool)t-a>=m&&this.recentPool.delete(e)}}function H(g){const t=g.raw;if(typeof t!="object"||t===null)return null;const e=t.session_title;return typeof e=="string"&&e.length>0?e:null}