@worca/app 1.2.0 → 1.3.0

package/src/core/config.mjs

@@ -14,6 +14,7 @@
 
 import { getDb, prepare, tx } from './db.mjs';
 import { projectKey } from './store.mjs';
+import { AUTO_WORKFLOW_ID } from './graph/builtin-workflows.mjs';
 import { loadAgentRegistry, registryToSteps } from './agent-registry.mjs';
 import { EFFORTS, prepareModelEnv, withTierModelEnv, isSubagentModelValue, subagentModelIssue } from './model-env.mjs';
 import { listGlobalModels, addGlobalModel, removeGlobalModel, hideBuiltinModels } from './settings.mjs';
@@ -136,7 +137,7 @@ function parseJson(text, fallback) {
 function readConfigRow(key) {
   getDb();
   return prepare(
-    'SELECT steps, custom_models, active_workflow_id, extra FROM project_config WHERE project_key = ?'
+    'SELECT steps, custom_models, active_workflow_id, extra, human_in_loop FROM project_config WHERE project_key = ?'
   ).get(key) || null;
 }
 
@@ -838,11 +839,18 @@ export async function readRunConfig(projectDir) {
   const extra = row ? parseJson(row.extra, {}) : {};
   if (extra.webUiTesting && typeof extra.webUiTesting === 'object') out.webUiTesting = extra.webUiTesting;
   // Forward any OTHER unknown keys verbatim too (future-proof, matches "preserve unknown").
+  // prRemotes is the ship-it dialog's own preference (readPrRemotePrefs), not run config.
   for (const [k, v] of Object.entries(extra)) {
-    if (k !== 'webUiTesting' && !(k in out)) out[k] = v;
+    if (k !== 'webUiTesting' && k !== PR_REMOTES_KEY && k !== TEAM_METRICS_KEY && !(k in out)) out[k] = v;
   }
   const active = row && typeof row.active_workflow_id === 'string' ? row.active_workflow_id.trim() : '';
-  if (active) out.activeWorkflowId = active;
+  // Spec §6.1 / D16: a project with no remembered New-pipeline choice starts on Auto.
+  out.activeWorkflowId = active || AUTO_WORKFLOW_ID;
+  // Auto workflow (spec §6.1): the human-in-the-loop switch. ON is the default
+  // and is NOT echoed — the key appears only when the project turned it off, so
+  // every consumer reads `config.humanInLoop ?? true` and the config shape of a
+  // project that never touched it stays otherwise byte-identical.
+  if (row && row.human_in_loop === 0) out.humanInLoop = false;
   return out;
 }
 
@@ -1010,6 +1018,115 @@ export async function setActiveWorkflow(projectDir, workflowId) {
   });
 }
 
+// ── PR remote preferences (project_config.extra.prRemotes) ──────────────────
+// The History "Ship it?" dialog remembers which remote the branch was pushed to
+// and which repo the PR was opened in. Stored inside the free-form `extra` JSON
+// column — the FIRST runtime writer of that column: a read-modify-write of this
+// ONE key inside a tx, leaving every other top-level key of `extra` byte-identical
+// (test/config-db.test.mjs pins that for the sibling writers, which upsert only
+// their own columns and never touch `extra` on conflict).
+const PR_REMOTES_KEY = 'prRemotes';
+
+function sanitizeRemoteName(v) {
+  const s = typeof v === 'string' ? v.trim() : '';
+  return s && s.length <= 200 ? s : null;
+}
+
+/**
+ * Remembered push/base remote names for a project, or null when none.
+ * @param {string} projectDir
+ * @returns {{ pushRemote:(string|null), baseRemote:(string|null) }|null}
+ */
+export function readPrRemotePrefs(projectDir) {
+  const row = readConfigRow(projectKey(projectDir));
+  const extra = row ? parseJson(row.extra, {}) : {};
+  const p = extra[PR_REMOTES_KEY];
+  if (!p || typeof p !== 'object') return null;
+  const pushRemote = sanitizeRemoteName(p.pushRemote);
+  const baseRemote = sanitizeRemoteName(p.baseRemote);
+  return pushRemote || baseRemote ? { pushRemote, baseRemote } : null;
+}
+
+/** Remember the dialog's choice. Only `extra.prRemotes` changes; every other column/key is preserved. */
+export async function setPrRemotePrefs(projectDir, { pushRemote, baseRemote } = {}) {
+  const key = projectKey(projectDir);
+  const next = { pushRemote: sanitizeRemoteName(pushRemote), baseRemote: sanitizeRemoteName(baseRemote) };
+  tx(() => {
+    const row = prepare('SELECT extra FROM project_config WHERE project_key = ?').get(key);
+    const extra = row ? parseJson(row.extra, {}) : {};
+    extra[PR_REMOTES_KEY] = next;
+    prepare(`
+      INSERT INTO project_config (project_key, steps, custom_models, active_workflow_id, extra)
+      VALUES (?, '{}', '[]', NULL, ?)
+      ON CONFLICT(project_key) DO UPDATE SET extra = excluded.extra
+    `).run(key, JSON.stringify(extra));
+  });
+}
+
+// ── Team-metrics preferences (project_config.extra.teamMetrics) ────────────
+// The discovery cache + local enable state for the team-metrics feature (§4.6).
+// Same read-modify-write pattern as prRemotes above, one key of the same `extra` blob.
+export const TEAM_METRICS_KEY = 'teamMetrics';
+
+/**
+ * NOTE THE PARAMETER. Unlike its siblings `readPrRemotePrefs(projectDir)` /
+ * `setPrRemotePrefs(projectDir, …)` above, which take a DIRECTORY and call
+ * `projectKey()` themselves, these two take the KEY. Passing a path is not a type error — it is a
+ * valid SQL parameter that matches no row, so the call silently returns null, which reads as
+ * "not enabled" and drops every record. `assertProjectKey` makes that a loud failure instead.
+ */
+function assertProjectKey(key) {
+  if (typeof key !== 'string' || !/^[a-z0-9][a-z0-9-]*-[0-9a-f]{8}$/.test(key)) {
+    throw new TypeError(`team metrics prefs take a projectKey(), not ${JSON.stringify(key)} — did you pass a directory?`);
+  }
+  return key;
+}
+
+/** @returns {object|null} the cached team-metrics state for a project key */
+export function readTeamMetricsPrefs(key) {
+  assertProjectKey(key);
+  const row = prepare('SELECT extra FROM project_config WHERE project_key = ?').get(key);
+  const extra = row ? parseJson(row.extra, {}) : {};
+  const v = extra[TEAM_METRICS_KEY];
+  return v && typeof v === 'object' && !Array.isArray(v) ? v : null;
+}
+
+/** Shallow-merge `patch` into extra.teamMetrics; returns the merged object. */
+export function writeTeamMetricsPrefs(key, patch) {
+  assertProjectKey(key);
+  let next = null;
+  tx(() => {
+    const row = prepare('SELECT extra FROM project_config WHERE project_key = ?').get(key);
+    const extra = row ? parseJson(row.extra, {}) : {};
+    const cur = extra[TEAM_METRICS_KEY] && typeof extra[TEAM_METRICS_KEY] === 'object' ? extra[TEAM_METRICS_KEY] : {};
+    next = { ...cur, ...patch };
+    extra[TEAM_METRICS_KEY] = next;
+    prepare(`
+      INSERT INTO project_config (project_key, steps, custom_models, active_workflow_id, extra)
+      VALUES (?, '{}', '[]', NULL, ?)
+      ON CONFLICT(project_key) DO UPDATE SET extra = excluded.extra
+    `).run(key, JSON.stringify(extra));
+  });
+  return next;
+}
+
+/**
+ * Set the project's human-in-the-loop switch for Auto runs (spec D15/D20).
+ * @param {string} projectDir
+ * @param {boolean} value
+ */
+export async function setHumanInLoop(projectDir, value) {
+  const key = projectKey(projectDir);
+  const v = value === false ? 0 : 1;
+  tx(() => {
+    prepare(`
+      INSERT INTO project_config (project_key, steps, custom_models, active_workflow_id, extra, human_in_loop)
+      VALUES (?, '{}', '[]', NULL, '{}', ?)
+      ON CONFLICT(project_key) DO UPDATE SET human_in_loop = excluded.human_in_loop
+    `).run(key, v);
+  });
+}
+
 /**
  * Resolve just the run-config for one workflow into { nodes, feedbacks } maps
  * (the inputs resolveWorkflow overlays on the template). Unconfigured => empties.

package/src/core/db.mjs

@@ -54,7 +54,7 @@ const OPEN_BACKOFF_MS = 15;
 /** Latest schema version. Bump + append a new migration step when the DDL grows.
  *  Exported so migration tests assert "reached the module's current version"
  *  instead of hardcoding the number — a schema bump then touches no test file. */
-export const SCHEMA_VERSION = 27;
+export const SCHEMA_VERSION = 30;
 
 /** Absolute path to the database file: <worcaHome>/worca-cc.db. */
 export function dbPath() {
@@ -166,6 +166,9 @@ CREATE UNIQUE INDEX idx_projects_name ON projects (name COLLATE NOCASE);
 
 -- workspaces: named sets of 2+ projects (was workspaces.json header fields).
 -- id is the frozen workspaceKey (wks-<slug>-<sha1[:8]>). name is CI-unique.
+-- metrics_project (v30, added via INCREMENTAL_COLUMNS/ladder, NOT in this base
+-- DDL — matches diff_comments.parent_id) holds the team-metrics home: one
+-- member's absolute path, or NULL for no home configured.
 CREATE TABLE workspaces (
   id          TEXT PRIMARY KEY,
   name        TEXT NOT NULL COLLATE NOCASE,
@@ -752,8 +755,12 @@ const INCREMENTAL_COLUMNS = {
   workflows:              { domain: 'TEXT', origin: 'TEXT', graph: 'TEXT', archived_at: 'TEXT' },
   config_workflow_nodes:  { ask_questions: 'INTEGER', subagent_model: 'TEXT' },  // v25: sub-agent model policy
   ask_run_links:          { comment_ids: 'TEXT' },        // v22: JSON array of dc_ ids pending at launch
+  artifacts:              { step_key: 'TEXT', node_id: 'TEXT', cycle: 'INTEGER', created_at: 'TEXT' }, // per-step attribution
   ask_attachments:        { kind: "TEXT NOT NULL DEFAULT 'text'",  // v27: text | image | binary (#398)
                             mime: 'TEXT' },               // v27: sniffed mime; NULL on pre-v27 rows (= text)
+  project_config:         { human_in_loop: 'INTEGER NOT NULL DEFAULT 1' },   // v28: the Auto entry's human-in-the-loop switch
+  diff_comments:          { parent_id: 'TEXT REFERENCES diff_comments(id) ON DELETE CASCADE' },  // v29: reply threads; NULL = thread root
+  workspaces:             { metrics_project: 'TEXT' },  // v30: team-metrics home (member absolute path); NULL = no home
 };
 
 /** v23: per-loop-wire cycle budgets, the graph-engine twin of
@@ -1117,6 +1124,39 @@ function applySchemaV27(db) {
   repairSchemaGaps(db, schemaGaps(db));
 }
 
+/** v28 (Auto workflow, spec §6.1 / D16): project_config.human_in_loop (additive,
+ *  declared in INCREMENTAL_COLUMNS — this repairSchemaGaps call CREATES it on the
+ *  ladder path; reconcileSchema covers a DB another build stamped past 28, adding
+ *  the column but NEVER repeating the flip) and the ONE-TIME flip of every project's
+ *  remembered New-pipeline choice to the Auto entry. The flip lives on the ladder
+ *  only: a later choice is never overwritten by a reopen. */
+function applySchemaV28(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+  if (hasSqliteTable(db, 'project_config')) {
+    db.prepare("UPDATE project_config SET active_workflow_id = 'wf_auto'").run();
+  }
+}
+
+/** v29 (diff-comment reply threads): diff_comments.parent_id — a plain additive
+ *  column declared in INCREMENTAL_COLUMNS, applySchemaV27's shape: this
+ *  repairSchemaGaps call CREATES it on the ladder path (a DB stamped exactly 28),
+ *  reconcileSchema covers the fast path. The type string carries the REFERENCES
+ *  clause verbatim into `ALTER TABLE … ADD COLUMN`, which SQLite accepts under
+ *  foreign_keys=ON because the default is NULL. Every existing row stays NULL = a
+ *  thread root; nothing is backfilled. */
+function applySchemaV29(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+}
+
+/** v30 (team metrics home): workspaces.metrics_project — a plain additive column
+ *  declared in INCREMENTAL_COLUMNS, applySchemaV29's shape: this repairSchemaGaps
+ *  call CREATES it on the ladder path (a DB stamped exactly 29), reconcileSchema
+ *  covers the fast path (a DB already stamped >= 30 by a divergent ladder). NULL
+ *  on every existing row = no team-metrics home configured yet. */
+function applySchemaV30(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+}
+
 /** Move every stored pin on model id `from` (lower-case) to `to`. Each table
  *  is guarded like V24's: hand-seeded upgrade fixtures (and a DB from before the
  *  fs->db import) reach this step without some of them. */
@@ -1500,6 +1540,9 @@ export function migrate(db) {
     if (current < 25) applySchemaV25(db);            // sub-agent model policy + recorded child model
     if (current < 26) applySchemaV26(db);            // Fable 5 pins -> Fable 5.1 (catalog swap)
     if (current < 27) applySchemaV27(db);            // ask_attachments.kind/mime (#398)
+    if (current < 28) applySchemaV28(db);            // Auto workflow: human_in_loop + flip to wf_auto
+    if (current < 29) applySchemaV29(db);            // diff-comment reply threads: parent_id
+    if (current < 30) applySchemaV30(db);            // team metrics: workspaces.metrics_project
     db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
     db.exec('COMMIT');
   } catch (err) {

package/src/core/diff-comments.mjs

@@ -1,5 +1,6 @@
 // src/core/diff-comments.mjs
-// Internal, line-anchored comments on a run's persisted diff (diff_comments, v22).
+// Internal, line-anchored comments on a run's persisted diff (diff_comments, v22;
+// reply threads via parent_id, v29).
 // The ONE mutation module: the REST routes in ui/server.mjs and the Ask MCP tools
 // (through src/core/ask/comment-deps.mjs) both write through here, so anchor
 // validation, the protected-path floor, the body cap and the change notification
@@ -35,6 +36,7 @@ function rowToComment(r) {
     body: r.body, author: r.author,
     resolved: !!r.resolved, resolvedAt: r.resolved_at ?? null,
     sentRunId: r.sent_run_id ?? null, createdAt: r.created_at,
+    parentId: r.parent_id ?? null,
   };
 }
 
@@ -89,7 +91,8 @@ export function listDiffComments(storeKey, pipelineId, { status = 'all', path =
                   ORDER BY path, line_no, rowid`).all(...vals).map(rowToComment);
 }
 
-/** Unresolved counts keyed "<storeKey>/<pipelineId>", newest-commented first and
+/** Unresolved counts keyed "<storeKey>/<pipelineId>" — roots only: a reply is part
+ *  of its thread, not an item. Newest-commented first and
  *  hard-capped: the endpoint fans out to every open tab on every poke, and an
  *  unbounded row-per-commented-run response is the one part of it that grows with
  *  history. 5000 is a backstop, not a paging story — /api/history is itself
@@ -98,7 +101,7 @@ export function unresolvedCounts() {
   getDb();
   const out = {};
   for (const r of prepare(`SELECT store_key, pipeline_id, count(*) AS n, max(rowid) AS last
-                           FROM diff_comments WHERE resolved = 0
+                           FROM diff_comments WHERE resolved = 0 AND parent_id IS NULL
                            GROUP BY store_key, pipeline_id
                            ORDER BY last DESC LIMIT 5000`).all()) {
     out[`${r.store_key}/${r.pipeline_id}`] = r.n;
@@ -108,6 +111,14 @@ export function unresolvedCounts() {
 
 // ── writes ──────────────────────────────────────────────────────────────────
 
+/** Trimmed body, or a DiffCommentError — the one place the cap is enforced. */
+function cleanBody(body) {
+  const text = typeof body === 'string' ? body.trim() : '';
+  if (!text) throw new DiffCommentError('body is required');
+  if (text.length > COMMENT_BODY_MAX) throw new DiffCommentError(`body exceeds ${COMMENT_BODY_MAX} characters`);
+  return text;
+}
+
 /**
  * Create one comment. `patchText` is the run's diff-patch.patch as READ BY THE
  * CALLER (the server through readRunArtifactText, the MCP bundle through
@@ -123,9 +134,7 @@ export function addDiffComment({
     throw new DiffCommentError('this run has no stored diff — comments cannot be created on it');
   }
   if (!COMMENT_AUTHORS.includes(author)) throw new DiffCommentError('author must be "user" or "ask"');
-  const text = typeof body === 'string' ? body.trim() : '';
-  if (!text) throw new DiffCommentError('body is required');
-  if (text.length > COMMENT_BODY_MAX) throw new DiffCommentError(`body exceeds ${COMMENT_BODY_MAX} characters`);
+  const text = cleanBody(body);
 
   let anchor;
   try {
@@ -147,14 +156,46 @@ export function addDiffComment({
   return getDiffComment(id);
 }
 
-/** Toggle. Returns the updated comment, or null when the id is unknown. */
+/**
+ * Reply inside a thread (D1–D3). The parent must be a ROOT; the reply copies the
+ * root's anchor and its resolved state, so every reader keeps working without a
+ * join: ordering (same path/line, later rowid), the status filters, the
+ * protected-path guard (same path/old_path) and the line_text snapshot.
+ * No patch is needed — a reply anchors to nothing new, so there is no anchor to
+ * resolve and nothing to resolve it against. (Not an archived-run affordance:
+ * archiving deletes a run's comments, pipeline-delete.mjs.)
+ * @throws {DiffCommentError}
+ */
+export function addDiffCommentReply({ parentId, body, author } = {}) {
+  const parent = getDiffComment(parentId);
+  if (!parent) throw new DiffCommentError('comment not found');
+  if (parent.parentId) throw new DiffCommentError('replies cannot be nested — reply to the thread\'s first comment');
+  if (!COMMENT_AUTHORS.includes(author)) throw new DiffCommentError('author must be "user" or "ask"');
+  const text = cleanBody(body);
+  const id = newCommentId();
+  const ts = now();
+  getDb();
+  prepare(`INSERT INTO diff_comments
+    (id, store_key, pipeline_id, project_key, path, old_path, side, line_no, line_text,
+     body, author, resolved, resolved_at, sent_run_id, source, external_url, created_at, parent_id)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, ?, ?)`)
+    .run(id, parent.storeKey, parent.pipelineId, parent.projectKey, parent.path, parent.oldPath,
+      parent.side, parent.line, parent.lineText, text, author,
+      parent.resolved ? 1 : 0, parent.resolvedAt, ts, parent.id);
+  notify(parent.storeKey, parent.pipelineId);
+  return getDiffComment(id);
+}
+
+/** Toggle a THREAD (D2). Returns the updated root, or null when the id is unknown.
+ *  @throws {DiffCommentError} when `id` is a reply — replies mirror their root. */
 export function setDiffCommentResolved(id, resolved = true) {
   const before = getDiffComment(id);
   if (!before) return null;
+  if (before.parentId) throw new DiffCommentError('replies cannot be resolved on their own — resolve the thread\'s first comment');
   const on = resolved !== false;
   getDb();
-  prepare('UPDATE diff_comments SET resolved = ?, resolved_at = ? WHERE id = ?')
-    .run(on ? 1 : 0, on ? now() : null, id);
+  prepare('UPDATE diff_comments SET resolved = ?, resolved_at = ? WHERE id = ? OR parent_id = ?')
+    .run(on ? 1 : 0, on ? now() : null, id, id);
   notify(before.storeKey, before.pipelineId);
   return getDiffComment(id);
 }
@@ -216,6 +257,11 @@ export function stampSentRunId(commentIds, pipelineId) {
  * Delete every comment of a run. NO transaction of its own — the CALLER owns it
  * (db.mjs tx() is not re-entrant and throws on nesting, and archivePipeline calls
  * this from inside its own tx). Used only by the archive path.
+ * @returns {number} rows the DELETE removed DIRECTLY. Since v29 a root takes its
+ *   replies with it through the parent_id cascade, and SQLite does not count
+ *   cascaded rows in `.changes` — so this UNDER-counts a run with threads and is
+ *   not the number of comments that went away. No caller reads it; do not start
+ *   without switching to a `SELECT count(*)` taken first.
  */
 export function deleteCommentsForRun(pipelineId) {
   getDb();

package/src/core/frontmatter.mjs

@@ -0,0 +1,75 @@
+// The ONE reader of an agent .md's leading YAML frontmatter. Four private copies
+// existed (agent-registry's description reader, workflows.mjs' and plugin-store's
+// tools readers, workflow-export's fence matcher); the three READERS now share
+// this. Deliberately NOT a YAML parser: subagent frontmatter is `key: value`
+// single-line scalars (name / description / tools / model) — block scalars
+// degrade to '' (the indicator is never stored), unknown keys ride `fields`.
+import { openSync, readSync, closeSync } from 'node:fs';
+
+/** Bytes read from the HEAD of an agent file. Every shipped frontmatter is < 2 KB;
+ *  a fence that does not close inside the window reads as "no frontmatter" — the
+ *  body (a 4–8 KB prompt) is never read by a frontmatter consumer. */
+export const FRONTMATTER_HEAD_BYTES = 8192;
+
+/** Leading fence: optional BOM, `---`, newline (LF or CRLF), inner YAML, newline,
+ *  `---`, then end of line or end of text. m[1] = the inner YAML. */
+export const FRONTMATTER_RE = /^\uFEFF?---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;
+
+const KEY_LINE_RE = /^([A-Za-z][A-Za-z0-9_-]*)[ \t]*:[ \t]*(.*)$/;
+const BLOCK_SCALAR_RE = /^[>|][+-]?$/;
+
+function scalar(raw) {
+  const v = raw.trim();
+  if (BLOCK_SCALAR_RE.test(v)) return '';                                   // folded/literal indicator, not the text
+  if (v.length >= 2 && ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))) {
+    return v.slice(1, -1).trim();
+  }
+  return v;
+}
+
+/**
+ * @param {unknown} text the file text (or its head)
+ * @returns {{name:string, description:string, tools:string[], model:string, fields:Record<string,string>}|null}
+ *   null when the text carries no leading fence (or the fence never closes).
+ */
+export function parseFrontmatter(text) {
+  if (typeof text !== 'string') return null;
+  const m = FRONTMATTER_RE.exec(text);
+  if (!m) return null;
+  const fields = {};
+  for (const line of m[1].split(/\r?\n/)) {
+    const kv = KEY_LINE_RE.exec(line);
+    if (!kv || Object.hasOwn(fields, kv[1])) continue;                      // continuation lines / repeats are skipped
+    fields[kv[1]] = scalar(kv[2]);
+  }
+  const tools = (fields.tools || '').split(',').map((s) => s.trim()).filter(Boolean);
+  return { name: fields.name || '', description: fields.description || '', tools, model: fields.model || '', fields };
+}
+
+/** Everything after the fence; the whole text when there is none. */
+export function stripFrontmatter(text) {
+  const s = typeof text === 'string' ? text : '';
+  const m = FRONTMATTER_RE.exec(s);
+  return m ? s.slice(m[0].length) : s;
+}
+
+/**
+ * Read + parse the frontmatter of a file, touching at most `maxBytes` of its
+ * head. Synchronous (the registry loader is synchronous). Missing file,
+ * unreadable file, no fence ⇒ null — never throws.
+ * @param {string} path
+ * @param {number} [maxBytes]
+ */
+export function readFrontmatterSync(path, maxBytes = FRONTMATTER_HEAD_BYTES) {
+  let fd = null;
+  try {
+    fd = openSync(path, 'r');
+    const buf = Buffer.alloc(maxBytes);
+    const n = readSync(fd, buf, 0, maxBytes, 0);
+    return parseFrontmatter(buf.subarray(0, n).toString('utf8'));
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) { try { closeSync(fd); } catch { /* ignore */ } }
+  }
+}