@winspan/claude-forge 8.54.3 → 9.2.0

package/dist/web/routes/agent-content.d.ts

@@ -0,0 +1,30 @@
+/**
+ * /api/agents/:name/content — read-only agent markdown viewer for /context.
+ *
+ * BMAD Phase 2 of "Skill / Agent 内容查看 (/context Insights 抽屉)" spec
+ * (docs/design/2026-05-26/2029-skill-agent-content-viewer-spec.md).
+ *
+ * Issue #4 (2026-05-29): expanded to recognise Claude Code built-in (virtual)
+ * subagent_types (Plan, Explore, general-purpose, ...). They previously hit
+ * the lowercase-kebab regex and returned HTTP 400 from the delegation table.
+ *
+ * Endpoint:
+ *   GET /api/agents/:name/content
+ *     → { name, source, body, frontmatter, path, exists, bytes, tools, model, message? }
+ *
+ * Behaviour:
+ *   - `:name` MUST match ^[A-Za-z0-9][A-Za-z0-9-]{0,63}$ — anything else → 400.
+ *   - Local-only (loopback) — defence-in-depth.
+ *   - `source: 'builtin'` for Claude Code built-ins (no .md lookup; 200 + message).
+ *   - `source: 'project'` for everything else (reads .claude/agents/<name>.md).
+ *   - Missing project file (e.g. typo) still returns 200 with `exists: false`
+ *     so the UI shows a friendly Empty (no 404).
+ *   - `tools` and `model` lifted from frontmatter for quick consumption by
+ *     the Drawer header (UI doesn't need to second-parse the YAML).
+ *   - Response carries `Cache-Control: public, max-age=60`.
+ */
+import type { Application } from 'express';
+import type { RouteContext } from './types.js';
+export type AgentSource = 'project' | 'builtin';
+export declare function registerAgentContentRoutes(app: Application, _ctx: RouteContext): void;
+//# sourceMappingURL=agent-content.d.ts.map

package/dist/web/routes/agent-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-content.d.ts","sourceRoot":"","sources":["../../../src/web/routes/agent-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,SAAS,CAAC;AAO9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAwB/C,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAqFhD,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAiBrF"}

package/dist/web/routes/agent-content.js

@@ -0,0 +1,139 @@
+/**
+ * /api/agents/:name/content — read-only agent markdown viewer for /context.
+ *
+ * BMAD Phase 2 of "Skill / Agent 内容查看 (/context Insights 抽屉)" spec
+ * (docs/design/2026-05-26/2029-skill-agent-content-viewer-spec.md).
+ *
+ * Issue #4 (2026-05-29): expanded to recognise Claude Code built-in (virtual)
+ * subagent_types (Plan, Explore, general-purpose, ...). They previously hit
+ * the lowercase-kebab regex and returned HTTP 400 from the delegation table.
+ *
+ * Endpoint:
+ *   GET /api/agents/:name/content
+ *     → { name, source, body, frontmatter, path, exists, bytes, tools, model, message? }
+ *
+ * Behaviour:
+ *   - `:name` MUST match ^[A-Za-z0-9][A-Za-z0-9-]{0,63}$ — anything else → 400.
+ *   - Local-only (loopback) — defence-in-depth.
+ *   - `source: 'builtin'` for Claude Code built-ins (no .md lookup; 200 + message).
+ *   - `source: 'project'` for everything else (reads .claude/agents/<name>.md).
+ *   - Missing project file (e.g. typo) still returns 200 with `exists: false`
+ *     so the UI shows a friendly Empty (no 404).
+ *   - `tools` and `model` lifted from frontmatter for quick consumption by
+ *     the Drawer header (UI doesn't need to second-parse the YAML).
+ *   - Response carries `Cache-Control: public, max-age=60`.
+ */
+import fs from 'node:fs';
+import matter from 'gray-matter';
+import { logger } from '../../core/utils/logger.js';
+import { isBuiltinAgent } from '../../core/utils/cc-builtin-agents.js';
+import { resolveAgentPath } from '../../core/utils/binary-paths.js';
+// Allow uppercase letters so Claude Code built-ins like `Plan` / `Explore`
+// pass validation. Still anchored + length-bounded + dash-only to block
+// path traversal (../foo) and encoded slashes.
+const AGENT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/;
+function isLocalRequest(req) {
+    const ip = req.socket.remoteAddress;
+    if (!ip)
+        return false;
+    return ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+}
+function enforceLocalOnly(req, res) {
+    if (!isLocalRequest(req)) {
+        res.status(403).json({
+            error: 'forbidden',
+            detail: 'agent content is local-only (loopback access required)',
+        });
+        return false;
+    }
+    return true;
+}
+function builtinResponse(name) {
+    return {
+        name,
+        source: 'builtin',
+        exists: false,
+        path: null,
+        bytes: 0,
+        body: '',
+        frontmatter: {},
+        tools: null,
+        model: null,
+        message: 'Claude Code built-in agent; no project-level details available',
+    };
+}
+function loadAgent(name) {
+    // Resolve through the binary-paths helper so user-global agents
+    // (`~/.claude/agents/<name>.md`) and project-local agents
+    // (`<cwd>/.claude/agents/<name>.md`) both resolve — important for daemon
+    // launchd cwd=/ where the cwd fallback alone returns nothing. See spec
+    // docs/design/2026-06-01/0850-decision-cwd-binary-path-audit.md.
+    const filePath = resolveAgentPath(name);
+    if (!filePath) {
+        return {
+            name,
+            source: 'project',
+            exists: false,
+            path: null,
+            bytes: 0,
+            body: '',
+            frontmatter: {},
+            tools: null,
+            model: null,
+        };
+    }
+    const raw = fs.readFileSync(filePath, 'utf-8');
+    let parsed;
+    try {
+        parsed = matter(raw);
+    }
+    catch (err) {
+        logger.warn(`[agent-content] frontmatter parse failed for ${name}: ${err}`);
+        return {
+            name,
+            source: 'project',
+            exists: true,
+            path: filePath,
+            bytes: Buffer.byteLength(raw, 'utf-8'),
+            body: raw,
+            frontmatter: {},
+            tools: null,
+            model: null,
+        };
+    }
+    const data = (parsed.data ?? {});
+    const tools = typeof data.tools === 'string' ? data.tools : null;
+    const model = typeof data.model === 'string' ? data.model : null;
+    return {
+        name,
+        source: 'project',
+        exists: true,
+        path: filePath,
+        bytes: Buffer.byteLength(raw, 'utf-8'),
+        body: parsed.content,
+        frontmatter: data,
+        tools,
+        model,
+    };
+}
+export function registerAgentContentRoutes(app, _ctx) {
+    app.get('/api/agents/:name/content', (req, res) => {
+        if (!enforceLocalOnly(req, res))
+            return;
+        const { name } = req.params;
+        if (!AGENT_NAME_RE.test(name)) {
+            res.status(400).json({ error: 'invalid_name', detail: 'name must match ^[A-Za-z0-9][A-Za-z0-9-]{0,63}$' });
+            return;
+        }
+        try {
+            const result = isBuiltinAgent(name) ? builtinResponse(name) : loadAgent(name);
+            res.set('Cache-Control', 'public, max-age=60');
+            res.json(result);
+        }
+        catch (err) {
+            logger.warn(`[agent-content] /api/agents/${name}/content failed: ${err}`);
+            res.status(500).json({ error: 'agent_content_failed', detail: String(err) });
+        }
+    });
+}
+//# sourceMappingURL=agent-content.js.map

package/dist/web/routes/agent-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-content.js","sourceRoot":"","sources":["../../../src/web/routes/agent-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGpE,2EAA2E;AAC3E,wEAAwE;AACxE,+CAA+C;AAC/C,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;IACpC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,GAAa;IACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,wDAAwD;SACjE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,CAAC;QACR,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,gEAAgE;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,gEAAgE;IAChE,0DAA0D;IAC1D,yEAAyE;IACzE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,EAAE;YACR,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,gDAAgD,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YACtC,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,OAAO;QACpB,WAAW,EAAE,IAAI;QACjB,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAgB,EAAE,IAAkB;IAC7E,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACxC,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAA0B,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC,CAAC;YAC3G,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,+BAA+B,IAAI,oBAAoB,GAAG,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/routes/decisions.d.ts

@@ -0,0 +1,15 @@
+/**
+ * /api/decisions — decision lifecycle API (decision-flow-overhaul 2026-05-28)
+ *
+ * Routes:
+ *   GET /api/decisions          — list decisions (filter: ?status=&session_id=&limit=)
+ *   GET /api/decisions/:id      — single decision with related routing_events
+ *   POST /api/decisions/:id/approve — approve a decision (status → resolved)
+ *
+ * Spec § 5.4: "new route GET /api/decisions?session_id=&status=&limit= → 列表"
+ *             "new route GET /api/decisions/:id → 含 decisions 行 + 关联 routing_events"
+ */
+import type { Application } from 'express';
+import type { RouteContext } from './types.js';
+export declare function registerDecisionsRoutes(app: Application, ctx: RouteContext): void;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/web/routes/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../../src/web/routes/decisions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,SAAS,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA4E/C,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI,CAwGjF"}

package/dist/web/routes/decisions.js

@@ -0,0 +1,181 @@
+/**
+ * /api/decisions — decision lifecycle API (decision-flow-overhaul 2026-05-28)
+ *
+ * Routes:
+ *   GET /api/decisions          — list decisions (filter: ?status=&session_id=&limit=)
+ *   GET /api/decisions/:id      — single decision with related routing_events
+ *   POST /api/decisions/:id/approve — approve a decision (status → resolved)
+ *
+ * Spec § 5.4: "new route GET /api/decisions?session_id=&status=&limit= → 列表"
+ *             "new route GET /api/decisions/:id → 含 decisions 行 + 关联 routing_events"
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const VALID_STATUSES = new Set(['pending', 'resolved', 'bypassed', 'expired']);
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 200;
+/**
+ * Does the changelog text explicitly declare a `Decision: <id>` association?
+ * Looks at a structured header/frontmatter marker rather than an arbitrary
+ * substring, so a changelog that intentionally links a decision is reliably
+ * matched (the old full-text `includes` missed most changelogs because their
+ * body rarely embeds the raw id). Recognised forms (case-insensitive on the
+ * `decision` keyword), scanned only in the file's leading region:
+ *   > Decision: <id>            (markdown blockquote header)
+ *   Decision: <id>              (plain header line)
+ *   decision: <id>              (YAML frontmatter key)
+ */
+function hasDecisionHeader(text, id) {
+    // Bound the scan to the header region (frontmatter + opening lines) so we
+    // don't pay for full-file regex on large changelogs.
+    const head = text.slice(0, 2000);
+    // Optional leading "> " blockquote / list marker, then `decision:` (any case),
+    // optional whitespace, then the id as a whole token.
+    const re = new RegExp(`^\\s*>?\\s*decision\\s*:\\s*${id}(?![0-9a-zA-Z_-])`, 'im');
+    return re.test(head);
+}
+/**
+ * Find implementation changelogs that reference this decision id. Fail-silent +
+ * bounded (docs/implementation/<date>/*.md, two levels). Returns repo-relative
+ * paths. Used by GET /api/decisions/:id so the detail drawer's "related
+ * changelogs" section has data instead of crashing on undefined.
+ *
+ * Matching strategy (T2 changelog-surfacing, decision 75344363):
+ *   1. PRIMARY — a structured `Decision: <id>` header/frontmatter marker
+ *      (see hasDecisionHeader). This is the reliable path that standardized
+ *      agent changelogs now emit.
+ *   2. FALLBACK — legacy full-text substring `includes(id)`, so older
+ *      changelogs that embed the raw id anywhere still surface.
+ * Header matches are listed first (higher confidence), fallback matches after.
+ */
+function findRelatedChangelogs(projectPath, id) {
+    if (!projectPath || !id)
+        return [];
+    const headerMatches = [];
+    const fallbackMatches = [];
+    try {
+        const implRoot = join(projectPath, 'docs', 'implementation');
+        for (const dateDir of readdirSync(implRoot, { withFileTypes: true })) {
+            if (!dateDir.isDirectory())
+                continue;
+            const dirPath = join(implRoot, dateDir.name);
+            for (const f of readdirSync(dirPath, { withFileTypes: true })) {
+                if (!f.isFile() || !f.name.endsWith('.md'))
+                    continue;
+                const full = join(dirPath, f.name);
+                try {
+                    const text = readFileSync(full, 'utf8');
+                    const rel = `docs/implementation/${dateDir.name}/${f.name}`;
+                    if (hasDecisionHeader(text, id)) {
+                        headerMatches.push(rel);
+                    }
+                    else if (text.includes(id)) {
+                        fallbackMatches.push(rel);
+                    }
+                }
+                catch {
+                    /* skip unreadable file */
+                }
+            }
+        }
+    }
+    catch {
+        /* impl dir missing / unreadable — fail-silent, return what we have */
+    }
+    return [...headerMatches, ...fallbackMatches];
+}
+export function registerDecisionsRoutes(app, ctx) {
+    const { storage } = ctx;
+    // ── GET /api/decisions ─────────────────────────────────────────────────
+    app.get('/api/decisions', (req, res) => {
+        try {
+            const status = typeof req.query.status === 'string' ? req.query.status : undefined;
+            const session_id = typeof req.query.session_id === 'string' ? req.query.session_id : undefined;
+            const limitRaw = typeof req.query.limit === 'string' ? req.query.limit : undefined;
+            if (status && !VALID_STATUSES.has(status)) {
+                res.status(400).json({ error: 'invalid_status', valid: Array.from(VALID_STATUSES) });
+                return;
+            }
+            const limit = limitRaw
+                ? Math.min(Math.max(parseInt(limitRaw, 10) || DEFAULT_LIMIT, 1), MAX_LIMIT)
+                : DEFAULT_LIMIT;
+            const rows = storage.listDecisions({
+                status: status,
+                session_id,
+                limit,
+            });
+            res.json(rows);
+        }
+        catch (err) {
+            res.status(500).json({ error: 'internal_error', detail: String(err) });
+        }
+    });
+    // ── GET /api/decisions/:id ─────────────────────────────────────────────
+    app.get('/api/decisions/:id', (req, res) => {
+        try {
+            const { id } = req.params;
+            if (!id || typeof id !== 'string' || id.length !== 8) {
+                res.status(400).json({ error: 'invalid_id' });
+                return;
+            }
+            const decision = storage.getDecision(id);
+            if (!decision) {
+                res.status(404).json({ error: 'not_found', id });
+                return;
+            }
+            // Fetch related routing_events that have this decision_id
+            // (populated when main thread spawns agents with <!-- decision-id: X -->)
+            let relatedSpawns = [];
+            try {
+                const routingRows = storage.queryRoutingEvents({ session_id: decision.session_id, limit: 200 });
+                relatedSpawns = routingRows
+                    .filter(r => r['decision_id'] === id)
+                    .map(r => ({
+                    id: r.id,
+                    routed_to_name: r.routed_to_name ?? null,
+                    ts: r.ts,
+                    obeyed: r.obeyed ?? null,
+                }));
+            }
+            catch {
+                // Fail-silent — related spawn data is supplemental
+            }
+            const relatedChangelogs = findRelatedChangelogs(decision.project_path, id);
+            res.json({
+                ...decision,
+                related_spawns: relatedSpawns,
+                spawn_count: relatedSpawns.length,
+                related_changelogs: relatedChangelogs,
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: 'internal_error', detail: String(err) });
+        }
+    });
+    // ── POST /api/decisions/:id/approve ───────────────────────────────────
+    app.post('/api/decisions/:id/approve', (req, res) => {
+        try {
+            const { id } = req.params;
+            if (!id || typeof id !== 'string') {
+                res.status(400).json({ error: 'invalid_id' });
+                return;
+            }
+            const decision = storage.getDecision(id);
+            if (!decision) {
+                res.status(404).json({ error: 'not_found', id });
+                return;
+            }
+            if (decision.status === 'resolved') {
+                res.json({ ok: true, already_approved: true, id });
+                return;
+            }
+            storage.approveDecision(id, 'user');
+            const updated = storage.getDecision(id);
+            res.json({ ok: true, id, status: updated?.status ?? 'resolved', approved_at: updated?.approved_at });
+        }
+        catch (err) {
+            res.status(500).json({ error: 'internal_error', detail: String(err) });
+        }
+    });
+}
+//# sourceMappingURL=decisions.js.map

package/dist/web/routes/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../../../src/web/routes/decisions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAKjC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AACvF,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,EAAU;IACjD,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjC,+EAA+E;IAC/E,qDAAqD;IACrD,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,+BAA+B,EAAE,mBAAmB,EACpD,IAAI,CACL,CAAC;IACF,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,qBAAqB,CAAC,WAAmB,EAAE,EAAU;IAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC7D,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;gBAAE,SAAS;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBACxC,MAAM,GAAG,GAAG,uBAAuB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC5D,IAAI,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;wBAChC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;yBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC7B,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,eAAe,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAgB,EAAE,GAAiB;IACzE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAExB,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,MAAM,UAAU,GACd,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAEnF,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ;gBACpB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;gBAC3E,CAAC,CAAC,aAAa,CAAC;YAElB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;gBACjC,MAAM,EAAE,MAAoC;gBAC5C,UAAU;gBACV,KAAK;aACN,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YAED,0DAA0D;YAC1D,0EAA0E;YAC1E,IAAI,aAAa,GAA4F,EAAE,CAAC;YAChH,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChG,aAAa,GAAG,WAAW;qBACxB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,CAAwC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;qBAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACT,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;oBACxC,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;iBACzB,CAAC,CAAC,CAAC;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;YAED,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAE3E,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,QAAQ;gBACX,cAAc,EAAE,aAAa;gBAC7B,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,kBAAkB,EAAE,iBAAiB;aACtC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACvG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/routes/diagnostics.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Diagnostics API — `GET /api/diagnostics` + `POST /api/diagnostics/fix`.
+ *
+ * GET returns the latest doctor report (30s in-memory cache to avoid running
+ * SQLite integrity_check on every poll). POST spawns `cf fix --apply --yes`
+ * after verifying `confirm: true` body field (idempotent client-side guard
+ * + 5 second rate limit).
+ *
+ * spec 1a41b43a (2026-06-01): original CLI Web surface.
+ * spec e5b845c4 (2026-06-01): project-context aware:
+ *   - GET picks "most recent project" from sessions.last_event_time and
+ *     surfaces it in `meta.current_project_path`. When no project is known
+ *     (fresh install), checks 5/6 emit `skip` instead of FAIL.
+ *   - POST `/fix` spawns `cf fix` with explicit `cwd = current_project_path`
+ *     to prevent the daemon's cwd from being polluted with project files.
+ *     **P0 safety**: fix is refused when no project is known.
+ */
+import type { Application } from 'express';
+import type { RouteContext } from './types.js';
+import { type DoctorReport } from '../../core/diagnostics/checks.js';
+import type { SQLiteStorage } from '../../core/storage/sqlite.js';
+export declare function _resetDiagnosticsCache(): void;
+/** Picks the most-recently-active project from sessions (spec e5b845c4 OQ#1). */
+export declare function pickCurrentProject(storage: Pick<SQLiteStorage, 'queryLastEventAtPerProject'>): {
+    path: string | null;
+    source: 'recent-event' | 'none';
+};
+export interface DiagnosticsMeta {
+    current_project_path: string | null;
+    project_source: 'recent-event' | 'none';
+}
+export interface DiagnosticsResponseBody extends DoctorReport {
+    meta: DiagnosticsMeta;
+}
+export declare function _resetFixRateLimit(): void;
+export interface SpawnResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}
+export interface SpawnOptions {
+    /** spec e5b845c4: explicit working dir for `cf fix` so project init commands
+     *  (`cf project init`, `cf knowledge init`) materialize in the right project. */
+    cwd?: string;
+}
+export type Spawner = (cmd: string, args: string[], opts?: SpawnOptions) => Promise<SpawnResult>;
+export interface DiagnosticsRouteOptions {
+    /** Override subprocess spawner (tests). */
+    spawn?: Spawner;
+    /** Override report generator (tests). */
+    buildReport?: (forceRefresh?: boolean) => Promise<DiagnosticsResponseBody>;
+    /** Override `cf` binary name (tests / dev). */
+    cfBin?: string;
+    /** Override current-project picker (tests). Defaults to {@link pickCurrentProject}. */
+    pickProject?: () => {
+        path: string | null;
+        source: 'recent-event' | 'none';
+    };
+}
+export declare function registerDiagnosticsRoutes(app: Application, ctx: RouteContext, opts?: DiagnosticsRouteOptions): void;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/web/routes/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../../src/web/routes/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAYlE,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,4BAA4B,CAAC,GACzD;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAA;CAAE,CAmB1D;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,cAAc,EAAE,cAAc,GAAG,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,uBAAwB,SAAQ,YAAY;IAC3D,IAAI,EAAE,eAAe,CAAC;CACvB;AAgCD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAID,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B;qFACiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,WAAW,CAAC,CAAC;AAqD1B,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3E,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,YAAY,EACjB,IAAI,GAAE,uBAA4B,GACjC,IAAI,CAiFN"}

package/dist/web/routes/diagnostics.js

@@ -0,0 +1,203 @@
+/**
+ * Diagnostics API — `GET /api/diagnostics` + `POST /api/diagnostics/fix`.
+ *
+ * GET returns the latest doctor report (30s in-memory cache to avoid running
+ * SQLite integrity_check on every poll). POST spawns `cf fix --apply --yes`
+ * after verifying `confirm: true` body field (idempotent client-side guard
+ * + 5 second rate limit).
+ *
+ * spec 1a41b43a (2026-06-01): original CLI Web surface.
+ * spec e5b845c4 (2026-06-01): project-context aware:
+ *   - GET picks "most recent project" from sessions.last_event_time and
+ *     surfaces it in `meta.current_project_path`. When no project is known
+ *     (fresh install), checks 5/6 emit `skip` instead of FAIL.
+ *   - POST `/fix` spawns `cf fix` with explicit `cwd = current_project_path`
+ *     to prevent the daemon's cwd from being polluted with project files.
+ *     **P0 safety**: fix is refused when no project is known.
+ */
+import { spawn } from 'node:child_process';
+import { runDoctorReport } from '../../core/diagnostics/checks.js';
+const CACHE_TTL_MS = 30_000;
+let cached = null;
+export function _resetDiagnosticsCache() {
+    cached = null;
+}
+/** Picks the most-recently-active project from sessions (spec e5b845c4 OQ#1). */
+export function pickCurrentProject(storage) {
+    try {
+        const map = storage.queryLastEventAtPerProject();
+        let bestPath = null;
+        let bestTs = -Infinity;
+        for (const [path, lastEventAt] of map) {
+            if (!lastEventAt)
+                continue;
+            const ts = Date.parse(lastEventAt);
+            if (Number.isNaN(ts))
+                continue;
+            if (ts > bestTs) {
+                bestTs = ts;
+                bestPath = path;
+            }
+        }
+        if (bestPath)
+            return { path: bestPath, source: 'recent-event' };
+        return { path: null, source: 'none' };
+    }
+    catch {
+        return { path: null, source: 'none' };
+    }
+}
+async function getReport(storage, forceRefresh = false) {
+    if (!forceRefresh && cached && Date.now() - cached.ts < CACHE_TTL_MS) {
+        return cached.report;
+    }
+    const project = pickCurrentProject(storage);
+    // Pass `null` explicitly when there is no project so checks 5/6 emit SKIP
+    // instead of falsely FAILing against the daemon's cwd.
+    // spec 8cbecdb4 / OQ #3: Web `/api/diagnostics` runs inside the daemon
+    // process, so check 1 must use in-process self-status to avoid false
+    // FAILs when the pidfile is briefly stale after a launchd respawn.
+    const report = await runDoctorReport({ cwd: project.path, selfMode: true });
+    const body = {
+        ...report,
+        meta: {
+            current_project_path: project.path,
+            project_source: project.source,
+        },
+    };
+    cached = { ts: Date.now(), report: body };
+    return body;
+}
+// ─── Rate limit (5s) ──────────────────────────────────────────────────────
+let lastFixAt = 0;
+const FIX_RATE_LIMIT_MS = 5_000;
+export function _resetFixRateLimit() {
+    lastFixAt = 0;
+}
+function defaultSpawner(cmd, args, opts) {
+    return new Promise((resolve) => {
+        const spawnOpts = {
+            stdio: ['ignore', 'pipe', 'pipe'],
+        };
+        if (opts?.cwd) {
+            spawnOpts.cwd = opts.cwd;
+        }
+        const child = spawn(cmd, args, spawnOpts);
+        const stdout = [];
+        const stderr = [];
+        child.stdout?.on('data', (d) => stdout.push(d));
+        child.stderr?.on('data', (d) => stderr.push(d));
+        let resolved = false;
+        const timer = setTimeout(() => {
+            if (resolved)
+                return;
+            resolved = true;
+            child.kill('SIGTERM');
+            resolve({
+                code: null,
+                stdout: Buffer.concat(stdout).toString('utf-8'),
+                stderr: Buffer.concat(stderr).toString('utf-8') + '\n[timeout after 90s]',
+            });
+        }, 90_000);
+        child.on('close', (code) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timer);
+            resolve({
+                code,
+                stdout: Buffer.concat(stdout).toString('utf-8'),
+                stderr: Buffer.concat(stderr).toString('utf-8'),
+            });
+        });
+        child.on('error', (err) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timer);
+            resolve({
+                code: null,
+                stdout: Buffer.concat(stdout).toString('utf-8'),
+                stderr: `${err.message}\n${Buffer.concat(stderr).toString('utf-8')}`,
+            });
+        });
+    });
+}
+export function registerDiagnosticsRoutes(app, ctx, opts = {}) {
+    const spawner = opts.spawn ?? defaultSpawner;
+    const pickProject = opts.pickProject ?? (() => pickCurrentProject(ctx.storage));
+    const buildReport = opts.buildReport ?? ((force) => getReport(ctx.storage, force));
+    const cfBin = opts.cfBin ?? 'cf';
+    app.get('/api/diagnostics', async (req, res) => {
+        try {
+            const force = req.query.refresh === '1';
+            const report = await buildReport(force);
+            res.json(report);
+        }
+        catch (err) {
+            res.status(500).json({
+                error: 'diagnostics-failed',
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+    app.post('/api/diagnostics/fix', async (req, res) => {
+        const body = (req.body ?? {});
+        if (body.confirm !== true) {
+            return res.status(400).json({
+                error: 'confirm-required',
+                message: 'POST /api/diagnostics/fix requires body `{ "confirm": true }`',
+            });
+        }
+        // spec e5b845c4 P0: refuse to spawn when no project is known. Otherwise
+        // `cf project init` / `cf knowledge init` would materialize into the
+        // daemon's cwd (typically `/` or `$HOME` under launchd), polluting the
+        // user's home with project files.
+        const project = pickProject();
+        if (!project.path) {
+            return res.status(400).json({
+                error: 'no-project-context',
+                message: 'No project context available — open Claude Code in a project first ' +
+                    'so the daemon records events, then retry.',
+            });
+        }
+        const now = Date.now();
+        if (now - lastFixAt < FIX_RATE_LIMIT_MS) {
+            const waitMs = FIX_RATE_LIMIT_MS - (now - lastFixAt);
+            return res.status(429).json({
+                error: 'rate-limited',
+                message: `wait ${Math.ceil(waitMs / 1000)}s before retrying`,
+            });
+        }
+        lastFixAt = now;
+        // Build args.
+        const args = ['fix', '--apply', '--yes'];
+        if (Array.isArray(body.check_ids) && body.check_ids.length > 0) {
+            const ids = body.check_ids
+                .filter((n) => typeof n === 'number' && Number.isInteger(n))
+                .join(',');
+            if (ids)
+                args.push('--check', ids);
+        }
+        try {
+            const result = await spawner(cfBin, args, { cwd: project.path });
+            // Invalidate cache so the next GET reflects the new state.
+            _resetDiagnosticsCache();
+            res.json({
+                ok: result.code === 0,
+                exit_code: result.code,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                command: `${cfBin} ${args.join(' ')}`,
+                cwd: project.path,
+            });
+        }
+        catch (err) {
+            res.status(500).json({
+                error: 'fix-spawn-failed',
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+}
+//# sourceMappingURL=diagnostics.js.map