@worca/app 1.0.0 → 1.2.0-rc.1

package/src/core/sources.mjs

@@ -7,18 +7,34 @@
 
 import { readFile } from 'node:fs/promises';
 import { readFileSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { join } from 'node:path';
 import { callSource } from './plugin-shim.mjs';
 import { readPluginsLock, pluginCurrentDir } from './plugins-lock.mjs';
+import { listProfiles, DEFAULT_PROFILE } from './plugin-config.mjs';
 import { normalizeManifest } from './plugin-manifest.mjs';
 import { getDb } from './db.mjs';
-import { runDirForRow, readStoreMeta } from './artifacts.mjs';
+import { runDirForRow, readStoreMeta, readPromptFile } from './artifacts.mjs';
 import { RESULTS_FILE } from './results.mjs';
 import { hasGh, findPrForBranch } from './git-info.mjs';
 
-/** Same resolve-against-projectDir semantics as artifacts.mjs#resolveAgainst. */
-function resolveAgainst(base, p) {
-  return isAbsolute(p) ? p : resolve(base, p);
+/** Profile roster for a plugin; never throws — the pane must render even when a
+ *  plugin's data dir is unreadable (it degrades to "no profiles yet"). */
+function safeProfiles(name) {
+  try { return listProfiles(name); } catch { return []; }
+}
+
+/** Whether an installed source declares multiProfile; never throws (an
+ *  uninstalled plugin or broken manifest answers false — the callers below
+ *  degrade to pre-profiles behavior, which is the only thing they could do). */
+function isMultiProfileSource(plugin, sourceId) {
+  try {
+    const dir = pluginCurrentDir(plugin);
+    const norm = normalizeManifest(JSON.parse(readFileSync(join(dir, 'worca-cc-plugin.json'), 'utf8')), { dir });
+    if (!norm.ok) return false;
+    return (norm.manifest.taskSources || []).some((s) => s.id === sourceId && s.multiProfile === true);
+  } catch {
+    return false;
+  }
 }
 
 /**
@@ -50,6 +66,12 @@ export function listTaskSources() {
         sourceId: ts.id,
         displayName: ts.displayName || `${name}/${ts.id}`,
         inputs: ts.inputs || [],
+        // A multi-profile source cannot be used until the pane knows WHICH
+        // configuration to run against, so the roster ships with the listing —
+        // the New Pipeline pane resolves the project's binding against it
+        // without a second round trip.
+        multiProfile: ts.multiProfile === true,
+        profiles: ts.multiProfile === true ? safeProfiles(name) : [],
       });
     }
   }
@@ -68,9 +90,9 @@ function taskPromptText(task) {
 /**
  * Resolve a source descriptor to the pipeline's task input.
  *   { type:'prompt', prompt } | { type:'markdown', promptText?, promptFile? }
- * | { type:'plugin', plugin, sourceId, taskId, inputs? }
+ * | { type:'plugin', plugin, sourceId, taskId, inputs?, profile? }
  * @returns {Promise<{promptText:string, promptFile:string|null,
- *   sourceMeta:{plugin,sourceId,taskId,url,title}|null}>}
+ *   sourceMeta:{plugin,sourceId,taskId,profile,url,title}|null}>}
  */
 export async function resolveTaskInput(source, { projectDir } = {}) {
   const src = source && typeof source === 'object' ? source : { type: 'prompt', prompt: '' };
@@ -82,19 +104,21 @@ export async function resolveTaskInput(source, { projectDir } = {}) {
 
   if (type === 'markdown') {
     if (src.promptFile) {
-      let promptText = '';
-      try {
-        promptText = await readFile(resolveAgainst(projectDir, src.promptFile), 'utf8');
-      } catch {
-        promptText = ''; // exactly the legacy createPipeline catch{} degradation
-      }
+      // A NAMED file that cannot be read is an ERROR, never an empty prompt: the
+      // old catch{} degradation here (and the identical one in createPipeline) ran
+      // a whole pipeline on "" and exited 0. Throws PROMPT_FILE_UNREADABLE — the
+      // CLI fail()s on it and ui/server.mjs answers 400.
+      const promptText = await readPromptFile(projectDir, src.promptFile);
       return { promptText, promptFile: src.promptFile, sourceMeta: null };
     }
     return { promptText: typeof src.promptText === 'string' ? src.promptText : '', promptFile: null, sourceMeta: null };
   }
 
   if (type === 'plugin') {
-    const task = await callSource({ plugin: src.plugin, sourceId: src.sourceId, op: 'getTask', args: { id: src.taskId } });
+    const task = await callSource({
+      plugin: src.plugin, sourceId: src.sourceId, op: 'getTask',
+      args: { id: src.taskId }, profile: src.profile,
+    });
     if (!task) {
       throw new Error(`task-source ${src.plugin}/${src.sourceId}: task "${src.taskId}" not found`);
     }
@@ -105,6 +129,14 @@ export async function resolveTaskInput(source, { projectDir } = {}) {
         plugin: src.plugin,
         sourceId: src.sourceId,
         taskId: src.taskId,
+        // Pinned on the ROW, not re-derived at write-back time: the project's
+        // binding may have moved to another tracker by then, and a result must
+        // always be reported to the instance the task actually came from.
+        profile: src.profile || null,
+        // The source-panel inputs at fetch time, pinned for the same reason:
+        // a per-RUN choice (e.g. jira-source's "Write result back") must gate
+        // this run's report with what the user picked when they started it.
+        inputs: src.inputs && typeof src.inputs === 'object' ? src.inputs : null,
         url: task.url ?? null,
         title: task.title ?? null,
       },
@@ -164,31 +196,61 @@ export async function reportResultForPipeline(pipelineRow, resultsBundle) {
     try { ref = pipelineRow.source_ref ? JSON.parse(pipelineRow.source_ref) : null; } catch { ref = null; }
     if (!ref?.plugin || !ref?.sourceId || !ref?.taskId) return { ok: true, skipped: true };
 
-    // Capability probe with a TOLERANT DEFAULT. capabilities() is optional in the
-    // connector contract (§7.1: "defaults: writeBack true"): a connector without
-    // the op makes the child answer { ok:false, error:{ kind:'plugin', message:
-    // 'connector does not implement op "capabilities"' } } -> callSource throws
-    // PluginOpError('plugin') -> we default to writeBack:true. Transport errors
-    // (auth/network/timeout/protocol) ALSO default to true — the reportResult
-    // call below is the one that surfaces the real failure to the caller.
+    // Which profile to report against. Normally the one pinned on the row when
+    // the task was fetched (resolveTaskInput). A row that PREDATES profiles has
+    // none — and if the plugin has since upgraded to multiProfile, refusing to
+    // report would strand the row forever (no code path can attach a profile to
+    // an existing source_ref, so the results-view retry would fail identically
+    // every time). Its task came from the instance whose flat config migrated
+    // into the DEFAULT_PROFILE bucket, so that is exactly where the report
+    // belongs — allowLegacyDefault is the shim's host-internal opt-in for it.
+    const profile = ref.profile || null;
+    const allowLegacyDefault = !profile && isMultiProfileSource(ref.plugin, ref.sourceId);
+    const callRef = {
+      plugin: ref.plugin,
+      sourceId: ref.sourceId,
+      profile: allowLegacyDefault ? DEFAULT_PROFILE : profile,
+      allowLegacyDefault,
+    };
+
+    // Capability probe. capabilities() is optional in the connector contract
+    // (§7.1: "defaults: writeBack true"): a connector without the op makes the
+    // child answer kind 'unimplemented' -> we default to writeBack:true.
+    // The run's pinned source-panel inputs travel to BOTH ops so a connector
+    // can make write-back a per-run choice: the opt-out rides the reserved
+    // input key `writeBack` (jira-source's "Write result back" input;
+    // capabilities({inputs}) answers for THIS run).
+    // Every OTHER probe error — an implemented capabilities() that crashed, a
+    // transport failure (auth/network/timeout/protocol/rate-limit) — means the
+    // connector could not answer, and what happens next depends on whether an
+    // answer could have mattered: a run that pinned no `writeBack` input fails
+    // OPEN (default writeBack:true — a transient rate-limit on the probe must
+    // not silently drop the ticket comment when the report itself would have
+    // succeeded), while a run WITH one fails CLOSED (the opt-out may be 'no'
+    // and we could not hear it; writing would violate it) — the caller
+    // surfaces the error and the results-view retry re-probes.
+    const inputs = ref.inputs && typeof ref.inputs === 'object' ? ref.inputs : {};
     let writeBack = true;
     try {
-      const caps = await callSource({ plugin: ref.plugin, sourceId: ref.sourceId, op: 'capabilities', args: {} });
+      const caps = await callSource({ ...callRef, op: 'capabilities', args: { inputs } });
       if (caps && caps.writeBack === false) writeBack = false;
-    } catch {
+    } catch (err) {
+      if ((err?.kind || 'plugin') !== 'unimplemented' && 'writeBack' in inputs) {
+        return { ok: false, error: `write-back capability probe failed: ${err?.message || String(err)}` };
+      }
       writeBack = true;
     }
     if (!writeBack) return { ok: true, skipped: true };
 
     await callSource({
-      plugin: ref.plugin,
-      sourceId: ref.sourceId,
+      ...callRef,
       op: 'reportResult',
       args: {
         id: ref.taskId,
         status: statusToResult(pipelineRow.status),
         summary: buildResultSummary(pipelineRow, resultsBundle),
         links: buildResultLinks(resultsBundle),
+        inputs,
       },
     });
     return { ok: true };

package/src/core/stats.mjs

@@ -3,9 +3,9 @@
 // archive exists so these numbers survive history cleanup (spec §6.9). Pure
 // synchronous DB reads; no gh, no git, offline-correct.
 //
-// Attribution: money = cost_ledger by event timestamp (exact); runs, time,
-// and PRs = cohort by started_at (a run belongs to the bucket its start falls
-// in, with its CURRENT status). 'today' differs: its totals count runs whose
+// Attribution: money = cost_ledger + ask_cost_ledger by event timestamp
+// (exact); runs, time, and PRs = cohort by started_at (a run belongs to the
+// bucket its start falls in, with its CURRENT status). 'today' differs: its totals count runs whose
 // lifespan [started_at, updated_at] overlaps the day ("active today"), and its
 // hourly bars attribute terminal outcomes to the hour of the terminal write
 // (updated_at). 'all' money/time use the fallback-aware pipelines sums so
@@ -14,6 +14,7 @@
 import { prepare } from './db.mjs';
 import {
   budgetStatus, costWindowStart, costWindowEnd, allTimeTotals, roundUsd,
+  askWindowedSpendUsd,
 } from './cost-budget.mjs';
 
 const RANGES = ['today', 'week', 'month', 'all'];
@@ -84,6 +85,18 @@ function ledgerSpend(fromMs, toMs) {
   return roundUsd(row?.s || 0);
 }
 
+/** Ask Worca window aggregate (ask-cost-statistics-design.md D5/D6): spend,
+ *  DISTINCT sessions, turns. A thread is a session in every window it has a
+ *  costed turn in. */
+function askTotals(fromMs, toMs) {
+  const row = prepare(`
+    SELECT COALESCE(SUM(amount_usd), 0) AS s,
+           COUNT(DISTINCT thread_id)    AS sessions,
+           COUNT(*)                     AS turns
+    FROM ask_cost_ledger WHERE ts >= ? AND ts < ?`).get(fromMs, toMs);
+  return { spendUsd: roundUsd(row?.s || 0), sessions: row?.sessions || 0, turns: row?.turns || 0 };
+}
+
 /** Build zero-filled buckets [{startMs, endMs}] from windowStart through `now`. */
 function buildBuckets(windowStart, now, bucket) {
   const out = [];
@@ -137,8 +150,11 @@ export function getStats({ range = 'month', now = new Date() } = {}) {
   const windowTotalsFn = range === 'today' ? activeTotals : cohortTotals;
   const shapeTotals = (fromMs, toMs) => {
     const c = windowTotalsFn(fromMs, toMs);
+    const pipelineSpendUsd = ledgerSpend(fromMs, toMs);
+    const ask = askTotals(fromMs, toMs);
     return {
-      spentUsd: ledgerSpend(fromMs, toMs),
+      spentUsd: roundUsd(pipelineSpendUsd + ask.spendUsd),
+      pipelineSpendUsd, ask,
       workedMs: c.workedMs,
       runs: c.runs, finished: c.finished, stopped: c.stopped, failed: c.failed,
       paused: c.paused, running: c.running,
@@ -150,8 +166,11 @@ export function getStats({ range = 'month', now = new Date() } = {}) {
   if (range === 'all') {
     const at = allTimeTotals();
     const c = cohortTotals(0, windowEnd.getTime());
+    const ask = askTotals(0, windowEnd.getTime());
     totals = {
-      spentUsd: at.spendUsd, workedMs: at.activeMs,
+      spentUsd: roundUsd(at.spendUsd + ask.spendUsd),
+      pipelineSpendUsd: at.spendUsd, ask,
+      workedMs: at.activeMs,
       runs: c.runs, finished: c.finished, stopped: c.stopped, failed: c.failed,
       paused: c.paused, running: c.running,
       prsOpened: c.prsOpened, prsMerged: c.prsMerged,
@@ -169,7 +188,7 @@ export function getStats({ range = 'month', now = new Date() } = {}) {
     const c = bucketTotalsFn(startMs, endMs);
     return {
       bucketStartMs: startMs,
-      spentUsd: ledgerSpend(startMs, endMs),
+      spentUsd: roundUsd(ledgerSpend(startMs, endMs) + askWindowedSpendUsd(startMs, endMs)),
       finished: c.finished, stopped: c.stopped, failed: c.failed,
     };
   });

package/src/core/title.mjs

@@ -11,6 +11,8 @@ const SYSTEM = [
   'You write a SHORT, human-readable title for a software task.',
   'Rules: 3–8 words, Title Case-ish, no trailing period, no quotes, no markdown,',
   'no preamble. Output ONLY the title on a single line.',
+  'Never ask questions, never ask for more context, never apologize or explain.',
+  'If the task is vague or conversational, still output your best-guess topic title.',
 ].join(' ');
 
 /** Normalize raw model output into a safe single-line title (pure, exported for tests). */
@@ -21,14 +23,45 @@ export function sanitizeTitle(raw) {
   t = t.replace(/^(?:title|task)\s*[:\-]\s*/i, '');                      // strip "Title:"/"Task:" label
   t = t.replace(/^["'“”`]+|["'“”`]+$/g, '').trim();                      // strip wrapping quotes/backticks
   t = t.replace(/\s+/g, ' ').replace(/\.+$/, '').trim();                 // collapse ws, drop trailing dots
-  return t.slice(0, MAX_LEN).trim();
+  if (t.length > MAX_LEN) {
+    // Cut at a word boundary instead of mid-word ("…you'd li"). The window is
+    // MAX_LEN+1 so a word ending exactly at the cap survives; a boundary too
+    // close to the start (or none at all — one unbroken run) hard-slices.
+    const cut = t.slice(0, MAX_LEN + 1);
+    const sp = cut.lastIndexOf(' ');
+    t = (sp >= 30 ? cut.slice(0, sp) : t.slice(0, MAX_LEN)).replace(/[\s,;:–—-]+$/, '');
+  }
+  return t.trim();
+}
+
+// A title that is really a clarifying question / refusal ("I need more context
+// to write a title…"). First-person or plea openers, a trailing question mark,
+// or prose far beyond the 3–8-word instruction all mean the model did not
+// title the task — the caller should keep its provisional title instead.
+// Narrow on purpose (review of PR #376): bare `what`/`which`/`unable`/`please`
+// openers dropped legitimate titles ("What's New Page Redesign", "Which Tab Is
+// Active Indicator", "Unable To Login Error Fix", "Please Wait Spinner Timing").
+// A question is caught by its trailing `?` above; `unable`/`please` count only
+// with the verbs a refusal actually uses.
+const REFUSAL_OPENER_RE =
+  /^(?:i(?:['’](?:m|d|ll|ve))?\s|sorry\b|apolog|unfortunately\b|unable to (?:determine|identify|generate|create|provide|write|title|summari[sz]e|infer|tell|help|assist)\b|please (?:provide|share|clarify|give|specify|tell|include|describe|let me know)\b|could you\b|can you\b|tell me\b|what(?:['’]s)? (?:is|are|was|were|do|does|did|would|should|task|work)\b|which (?:task|one|of)\b|help me\b)/i;
+const MAX_WORDS = 12;
+
+/** True when sanitized model output looks like a refusal/question, not a title (pure, exported for tests). */
+export function isRefusalTitle(t) {
+  if (!t || typeof t !== 'string') return false;
+  if (/\?$/.test(t)) return true;
+  if (REFUSAL_OPENER_RE.test(t)) return true;
+  return t.split(' ').length > MAX_WORDS;
 }
 
 /**
  * Produce a concise LLM title for a prompt. Never throws — returns '' on any
  * failure/abort/empty input so the caller keeps the provisional title.
+ * `permissionMode` (default 'acceptEdits') exists for Ask Worca: its title call
+ * passes 'dontAsk' so the mock dispatcher can never reach a file-writing role.
  * @param {string} prompt
- * @param {{cwd:string, signal?:AbortSignal, model?:string, bin?:string, envScrub?:boolean, envAllowlist?:string[]}} opts
+ * @param {{cwd:string, signal?:AbortSignal, model?:string, bin?:string, mock?:boolean, envScrub?:boolean, envAllowlist?:string[], tools?:string[], strictMcpConfig?:boolean, settingSources?:string[], disableSlashCommands?:boolean, mcpConfigPath?:string, permissionMode?:string}} opts
  * @returns {Promise<string>}
  */
 export async function generateTitle(prompt, opts = {}) {
@@ -45,18 +78,32 @@ export async function generateTitle(prompt, opts = {}) {
       // env everywhere the id is used.
       modelEnv: resolveModelEnv(opts.model || DEFAULT_TITLE_MODEL),
       effort: 'low',
-      permissionMode: 'acceptEdits',
+      permissionMode: opts.permissionMode || 'acceptEdits',
       allowedTools: [],            // empty → no --allowedTools flag → claude defaults; pure text gen
       signal: opts.signal,
       // Title generation runs DURING a pipeline run, so it must honor the same
       // guardrails as the run itself. All three are undefined when absent, and
       // runClaude treats undefined as "not passed" — existing callers are unchanged.
       bin: opts.bin,
+      // A run configured with claude:{mock:true} (tests, `--mock`) must title
+      // through runMock too: runClaude decides mock-vs-real from THIS field or
+      // WORCA_MOCK, and the 29 test files that only pass the option spawned the
+      // developer's real binary 157x per `npm test` (2026-08-30).
+      mock: opts.mock,
       envScrub: opts.envScrub,
       envAllowlist: opts.envAllowlist,
+      // Ask Worca (ask-worca-design.md §6.8): sandbox hardening pass-through for the
+      // chat's background title call. All undefined for every existing caller, and
+      // runClaude emits nothing for undefined — pipeline title argv is unchanged.
+      tools: opts.tools,
+      strictMcpConfig: opts.strictMcpConfig,
+      settingSources: opts.settingSources,
+      disableSlashCommands: opts.disableSlashCommands,
+      mcpConfigPath: opts.mcpConfigPath,
       onEvent: () => {},
     });
-    return sanitizeTitle(out);
+    const title = sanitizeTitle(out);
+    return isRefusalTitle(title) ? '' : title;
   } catch (err) {
     if (err && err.name === 'AbortError') return ''; // run was stopped — caller keeps provisional
     return '';