@worca/app 1.2.0 → 1.3.0

package/src/core/ask/spawn.mjs

@@ -10,6 +10,9 @@
 //    `result` frames); CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1 restores the
 //    foreground shape. It rides modelEnv: merged last over the scrubbed env,
 //    CLAUDE_-prefixed (survives scrub), not a reserved key.
+//  - --add-dir <base> + CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1 loads <base>/.claude/rules/**
+//    (2.1.270, 2026-09-13); without the override the CLI loaded them under `--setting-sources project`
+//    alone (V1) but not under the default sources (V2/V4) — keep the documented override.
 //  - `--tools <list>` keeps ONLY the named built-ins (Task,Read,Grep,Glob — no
 //    Bash/Write/Edit exist); MCP tools survive; `--allowedTools <list>,mcp__worca`
 //    under dontAsk runs them without prompting; a deny rule wins over everything.
@@ -58,6 +61,10 @@ export const ASK_DENY_RULES = Object.freeze([
   'Read(~/.config/gh/**)',
 ]);
 export const ASK_SPAWN_ENV = Object.freeze({ CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '1' });
+// Native-rules revision: the CLI loads `<dir>/.claude/rules` from an --add-dir only under this
+// override (probes J/J2, 2.1.270; the E2 note in claude-runner.mjs). CLAUDE_-prefixed ⇒ survives
+// the scrub, not a reserved key.
+export const ASK_MEMORY_ENV = Object.freeze({ CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD: '1' });
 
 /**
  * The per-thread Read allow rules: the chat's worktrees (P4 §6) and its stored
@@ -82,6 +89,8 @@ export const SANDBOX_NOTE =
   'the worca MCP tools (mcp__worca__*). You cannot run commands, edit files or use the network — do not try. ' +
   "The only view into a repository is this chat's read-only detached worktrees: list_worktrees/open_worktree give the path; Read, Grep and Glob work under that path, and the worca `git` tool serves history and diffs. " +
   'The one other place Read may go is the file path read_attachment returns for an image or PDF attachment of this chat; never read anywhere else on disk. ' +
+  "Never call propose_workflow or propose_run yourself: proposals belong to the assistant's own turn (a sub-agent's call produces no card). " +
+  "Never call remember or forget yourself: saving or removing memory belongs to the assistant's own turn (list_memory and read_memory are fine). " +
   'Answer from tool results only; never invent run data; return a short report.';
 
 /** System-prompt-only mock markers (the runner parses the ask role from the SYSTEM prompt, Task 16). */
@@ -96,9 +105,10 @@ export function buildMockMarkers(card) {
  * @param {{maxTurns:number, maxBudgetUsd:number|null}} o.limits   from askLimits()
  * @param {string} o.mcpConfigPath   the per-turn mcp-<assistantMessageId>.json
  * @param {string} o.scratchDir      join(worcaHome(), 'tmp', 'ask') — ONE empty dir for all threads, never the home
+ * @param {string|null} [o.memoryDir]  refreshAskMemoryMount's base for this turn's scope set; null ⇒ no memory (empty store)
  * @returns {object} runClaude options
  */
-export function buildAskSpawnOptions({ thread = {}, turn = {}, limits = {}, mcpConfigPath, scratchDir } = {}) {
+export function buildAskSpawnOptions({ thread = {}, turn = {}, limits = {}, mcpConfigPath, scratchDir, memoryDir = null } = {}) {
   if (!scratchDir) throw new Error('buildAskSpawnOptions: scratchDir is required');
   if (!mcpConfigPath) throw new Error('buildAskSpawnOptions: mcpConfigPath is required');
   const systemPrompt = String(turn.systemPrompt ?? '') + (turn.mock ? buildMockMarkers(turn.mock.card) : '');
@@ -108,7 +118,7 @@ export function buildAskSpawnOptions({ thread = {}, turn = {}, limits = {}, mcpC
     systemPrompt,
     model: turn.model,
     effort: turn.effort,
-    modelEnv: { ...(turn.modelEnv || {}), ...ASK_SPAWN_ENV },
+    modelEnv: { ...(turn.modelEnv || {}), ...ASK_SPAWN_ENV, ...(memoryDir ? ASK_MEMORY_ENV : {}) },
     permissionMode: ASK_PERMISSION_MODE,
     allowedTools: [...ASK_BUILTIN_TOOLS],
     mcpServerGrants: [...ASK_MCP_GRANTS],
@@ -128,28 +138,35 @@ export function buildAskSpawnOptions({ thread = {}, turn = {}, limits = {}, mcpC
     maxTurns: limits.maxTurns,
     maxBudgetUsd: limits.maxBudgetUsd ?? null,
     appendSubagentSystemPrompt: SANDBOX_NOTE,
+    addDirs: memoryDir ? [memoryDir] : undefined,
     signal: turn.signal,
     onEvent: turn.onEvent,
   };
 }
 
+/** Server-side knobs the MCP child's NESTED classifier spawn needs (P3 propose_workflow, task mode). The chat's claude is
+ *  spawned env-scrubbed, so nothing WORCA_* reaches the child unless it rides mcpServers.env. Forwarded only when set. */
+export const MCP_FORWARD_ENV = Object.freeze(['WORCA_CLAUDE_BIN', 'ORCH_CLAUDE_BIN', 'WORCA_AUTO_MODEL']);
+
 /**
  * The per-turn --mcp-config document (spec §6.4). `homeBase` is the RAW base
  * (path.resolve(process.env.WORCA_HOME) or dirname(worcaHome())) — never
  * worcaHome() itself. The argv twins make the child independent of env forwarding.
  */
-export function buildMcpConfig({ homeBase, threadId, execPath = process.execPath, serverPath }) {
+export function buildMcpConfig({ homeBase, threadId, execPath = process.execPath, serverPath, env = process.env }) {
   if (!serverPath) throw new Error('buildMcpConfig: serverPath is required');
   if (typeof homeBase !== 'string' || !homeBase.trim()) throw new Error('buildMcpConfig: homeBase is required');
   const base = resolvePath(homeBase);
   const thread = String(threadId ?? '');
+  const forwarded = {};
+  for (const k of MCP_FORWARD_ENV) if (env && typeof env[k] === 'string' && env[k] !== '') forwarded[k] = env[k];
   return {
     mcpServers: {
       worca: {
         type: 'stdio',
         command: execPath,
         args: ['--disable-warning=ExperimentalWarning', serverPath, '--home', base, '--thread', thread],
-        env: { WORCA_HOME: base, WORCA_ASK_THREAD_ID: thread },
+        env: { WORCA_HOME: base, WORCA_ASK_THREAD_ID: thread, ...forwarded },
       },
     },
   };

package/src/core/ask/store.mjs

@@ -261,22 +261,30 @@ export function findCard(threadId, cardId) {
   return null;
 }
 
-const CARD_PATCH_KEYS = ['state', 'runId', 'error'];
+const CARD_PATCH_KEYS = ['state', 'runId', 'error', 'workflowId'];
 
-/** Patch ⊆ {state, runId, error} on one card block; the 'proposed' precondition is the caller's (route) business. */
+/** Patch ⊆ {state, runId, error, workflowId} on one card block. A WORKFLOW card (card.type === 'workflow') and a
+ *  METRICS card (card.type === 'metrics', whose `result` lands at Apply) also take a SHALLOW `card` sub-patch; a run
+ *  card's `card` is never touched (its key set is pinned). The 'proposed' precondition is the caller's (route) business. */
 export function updateCardBlock(threadId, cardId, patch = {}) {
   return tx(() => {
     const found = findCard(threadId, cardId);
     if (!found) return null;
     const allowed = {};
     for (const k of CARD_PATCH_KEYS) if (Object.prototype.hasOwnProperty.call(patch, k)) allowed[k] = patch[k];
-    const blocks = found.message.blocks.map((b) => (b && b.kind === 'card' && b.id === cardId ? { ...b, ...allowed } : b));
+    const sub = patch.card && typeof patch.card === 'object' && !Array.isArray(patch.card) ? patch.card : null;
+    const blocks = found.message.blocks.map((b) => {
+      if (!(b && b.kind === 'card' && b.id === cardId)) return b;
+      const subPatchable = !!(b.card && (b.card.type === 'workflow' || b.card.type === 'metrics'));
+      return { ...b, ...allowed, ...(sub && subPatchable ? { card: { ...(b.card || {}), ...sub } } : {}) };
+    });
     prepare('UPDATE ask_messages SET blocks = ? WHERE id = ?').run(JSON.stringify(blocks), found.message.id);
     return blocks.find((b) => b && b.kind === 'card' && b.id === cardId);
   });
 }
 
-/** Boot sweep (spec §6.2): a turn the previous server process never finished. */
+/** Boot sweep (spec §6.2): a turn the previous server process never finished. A workflow card still
+ *  `building` in such a row can never flip (its turn is gone) — it fails with the same text. */
 export function sweepStreamingMessages({ text = 'interrupted by restart' } = {}) {
   return tx(() => {
     const rows = prepare("SELECT id, blocks FROM ask_messages WHERE status = 'streaming'").all();
@@ -284,7 +292,8 @@ export function sweepStreamingMessages({ text = 'interrupted by restart' } = {})
       // The whole sweep is ONE tx(): a TypeError on a single poisoned row would roll
       // back every other row's fix, and would do so again on every later boot.
       const prev = parse(r.blocks, []);
-      const blocks = Array.isArray(prev) ? prev : [];
+      const blocks = (Array.isArray(prev) ? prev : [])
+        .map((b) => (b && b.kind === 'card' && b.state === 'building' ? { ...b, state: 'failed', error: text } : b));
       blocks.push({ kind: 'notice', text });
       prepare("UPDATE ask_messages SET status = 'error', blocks = ? WHERE id = ?").run(JSON.stringify(blocks), r.id);
     }

package/src/core/ask/tool-deps.mjs

@@ -5,13 +5,14 @@
 import { readFile, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import {
-  listAllPipelines, lookupPipelineRow, findPipelineRowById, totalsFor, readStoreMeta, runDirForRow,
+  listAllPipelines, lookupPipelineRow, findPipelineRowById, totalsFor, readStoreMeta, runDirForRow, readMemoryLedger,
+  listRunArtifacts, readRunProgress, resolveIndexedArtifactForRow,
 } from '../artifacts.mjs';
 import { DIFF_PATCH_FILE } from '../results.mjs';
 import { GUARDRAIL_PRESETS } from '../guardrails.mjs';
 import { buildCatalog } from './catalog.mjs';
 import { validateProposal } from './proposal.mjs';
-import { readAttachmentText, getAttachment, attachmentPath, getThread } from './store.mjs';
+import { readAttachmentText, getAttachment, attachmentPath, getThread, listAttachments } from './store.mjs';
 import { redactAskText } from './redact.mjs';
 import { ASK_LIMITS } from './limits.mjs';
 
@@ -35,6 +36,17 @@ export async function hasDiffPatch(row) {
   }
 }
 
+/** The run's memory changes from its ledger (artifacts.mjs#readMemoryLedger) as { changes, totals },
+ *  or null when the run has none — get_run then carries no `memory` key at all. The mount path is
+ *  dropped: it is a directory of THIS machine, never something the model should see. Read-only. */
+export async function readRunMemory(row) {
+  try {
+    const ledger = await readMemoryLedger(await runDirForRow(row));
+    if (!ledger || !ledger.changes.length) return null;
+    return { changes: ledger.changes, totals: ledger.totals };
+  } catch { return null; }
+}
+
 /**
  * @param {{threadId:string}} opts  attachments are readable only for this thread (spec §6.4 read_attachment)
  */
@@ -48,6 +60,10 @@ export function defaultToolDeps({ threadId }) {
     readStoreMeta,
     readDiffPatch,
     hasDiffPatch,
+    readRunMemory,
+    listRunArtifacts: (row, filter) => listRunArtifacts(row.id, filter),
+    readRunArtifact: (row, rel) => resolveIndexedArtifactForRow(row, rel), // {rel, text}|null
+    readRunProgress: (row) => readRunProgress(row.id),
     readAttachment: (id) => {
       const row = threadId ? getAttachment(threadId, id) : null;
       if (!row) return null;
@@ -64,6 +80,14 @@ export function defaultToolDeps({ threadId }) {
       return path ? { name: row.name, kind: row.kind, mime: row.mime, bytes: row.bytes, path } : null;
     },
     validateProposal,
+    // The run card's attachment pills (propose_run attachmentIds): the ledger of
+    // the owning thread only — never another thread's files. An unreadable DB means
+    // "no attachments", never an error: tools.call does not catch handler throws, so
+    // a locked store would otherwise make the model unable to propose at all.
+    listAttachments: () => {
+      if (!threadId) return [];
+      try { return listAttachments(threadId); } catch { return []; }
+    },
     // #397: the user-pinned scope of the owning thread — {projectKey}|{workspaceId}|
     // null — read fresh from the thread row per call, so a selector change lands on
     // the very next tool call. A missing thread or an unreadable DB means "nothing