@worca/app 1.3.0 → 1.4.0

package/src/core/claude-runner.mjs

@@ -25,6 +25,11 @@
 //                          question there and STOPS (no role side effects); the
 //                          resumed prompt carries no MOCK_ASK, so the role arm
 //                          runs then.
+//   MOCK_ASK_FORM: <json>  a ONE-LINE {"form","data"} payload. When present it is
+//                          written verbatim instead of the canned {questions}
+//                          body — to MOCK_ASK for a producer, to MOCK_OUT for the
+//                          clarify role. Lets an offline mock agent exercise the
+//                          ask-form protocol end to end.
 //
 // Markers are matched leniently: "KEY: value" anywhere at the start of a line,
 // case-sensitive keys, value trimmed. Missing markers degrade gracefully.
@@ -346,9 +351,11 @@ export function mockEnabled(opts) {
  * @param {number} [o.maxTurns]             --max-turns <n> (positive safe integer; else omitted)
  * @param {number|null} [o.maxBudgetUsd]    --max-budget-usd <n> (finite > 0; null/else omitted)
  * @param {string} [o.appendSubagentSystemPrompt] --append-subagent-system-prompt <text> (Task children only)
- * @param {string[]} [o.addDirs]            --add-dir <dir> per entry (Ask Worca's memory mount; the CLI loads <dir>/.claude/rules only with CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1 in the env — memory-deps.mjs / spawn.mjs set it)
+ * @param {string[]} [o.addDirs]            --add-dir <dir> per entry (Ask Worca's memory mount and every pipeline spawn's writable memory copy; the CLI loads <dir>/.claude/rules only with CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1 in the env — memory-deps.mjs / spawn.mjs set it)
  *   All nine are Ask Worca sandbox options (ask-worca-design.md §6.3) and default-off.
  * @param {number} [o.argvInlineLimit]     override ARGV_INLINE_LIMIT (GH #380; tests force the staged path)
+ * @param {string[]} [o.disallowedTools]   --disallowedTools <list>: built-ins withheld from this spawn
+ *   (model bridge §5.3: WebSearch/WebFetch for a translated model). Absent/empty ⇒ flag omitted.
  * @returns {Promise<{text:string, exitCode:number}>}
  */
 export async function runClaude(o = {}) {
@@ -373,6 +380,7 @@ export async function runClaude(o = {}) {
     envScrub,
     envAllowlist,
     modelEnv,
+    disallowedTools,
     workspaceWriteTargets,
     resumeSessionId,
     // Ask Worca sandbox hardening (ask-worca-design.md §6.3/§6.8). All default-off:
@@ -422,6 +430,7 @@ export async function runClaude(o = {}) {
     envScrub,
     envAllowlist,
     modelEnv,
+    disallowedTools,
     tools,
     strictMcpConfig,
     settingSources,
@@ -453,9 +462,10 @@ export async function runClaude(o = {}) {
  *                        (docs/run-root-verification.md, branch (a); argv-attested
  *                        transcript phase0/out/v1a-rerun.jsonl, with a no-grant
  *                        negative control proving the grant is load-bearing).
- *  `--add-dir` carries Ask Worca's memory mount ONLY (`addDirs`): it needs the
- *  CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1 env override to load memory at all
- *  (E2, re-probed 2026-09-13 on 2.1.270), and no pipeline path passes it (§5.3 / §8.18 unchanged). */
+ *  `--add-dir` carries Ask Worca's memory mount (with the
+ *  CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1 override, which is what makes the CLI LOAD rules
+ *  from it) and, since the memory write split, every pipeline spawn's writable memory copy (no
+ *  override: nothing is loaded from it, it is only made editable under acceptEdits). */
 export function buildClaudeArgs({
   prompt, systemPrompt, permissionMode, model, effort, allowedTools, resumeSessionId,
   mcpConfigPath, mcpServerGrants, permissionRules,
@@ -463,7 +473,7 @@ export function buildClaudeArgs({
   // way in because the legacy body below already owns a local `tools` (the
   // --allowedTools union).
   tools: builtinTools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages,
-  maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, hostGuard, addDirs,
+  maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, hostGuard, addDirs, disallowedTools,
 }, delivery = {}) {
   // delivery (GH #380, set only by planClaudeInvocation's staged branch):
   //   promptViaStdin   -> bare `-p`; the prompt is written to the child's stdin
@@ -495,6 +505,12 @@ export function buildClaudeArgs({
   if (tools.length) {
     args.push('--allowedTools', tools.join(','));
   }
+  // Model bridge (model-bridge-design.md §5.3): a translated (openai-chat)
+  // model has no server-side web tools, so the runner withholds them outright —
+  // a deny outranks any allow, frontmatter grant included. Absent/empty ⇒
+  // nothing emitted, so every other argv stays byte-identical.
+  const denied = Array.isArray(disallowedTools) ? disallowedTools.filter((s) => typeof s === 'string' && s) : [];
+  if (denied.length) args.push('--disallowedTools', denied.join(','));
   // ── Ask Worca hardening flags (ask-worca-design.md §6.3 / §6.8) ──────────────
   // Every one is default-off: absent / false / invalid ⇒ NOTHING is emitted, so
   // every legacy argv stays byte-identical (test/spawn-args.test.mjs). Appended
@@ -579,7 +595,7 @@ export function stageClaudeInvocation(opts, { bin = DEFAULT_BIN, limit = ARGV_IN
   return { ...plan, dir };
 }
 
-function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, model, effort, onEvent, signal, bin, resumeSessionId, mcpConfigPath, mcpServerGrants, permissionRules, envScrub, envAllowlist, modelEnv, tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages, maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs, argvInlineLimit }) {
+function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, model, effort, onEvent, signal, bin, resumeSessionId, mcpConfigPath, mcpServerGrants, permissionRules, envScrub, envAllowlist, modelEnv, disallowedTools, tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages, maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs, argvInlineLimit }) {
   return new Promise((resolveP, rejectP) => {
     // Per-model routing env (design §4.4), prepared BEFORE argv: reserved keys
     // are re-dropped here defensively — the write path already rejects them, so
@@ -658,7 +674,7 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
         permissionMode, model: wireModel, effort, allowedTools, resumeSessionId,
         mcpConfigPath, mcpServerGrants, permissionRules,
         tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages,
-        maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs,
+        maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs, disallowedTools,
       }, { bin: resolved.bin, limit });
     } catch (err) {
       rejectP(new Error(`Failed to stage the claude prompt files: ${err.message}`));
@@ -946,6 +962,17 @@ function parseMarkers(prompt, systemPrompt) {
   return markers;
 }
 
+/** Parse a MOCK_*_FORM marker's one-line JSON, or null. A malformed marker must
+ *  degrade to the canned body, never throw inside the mock. */
+function tryParseMockJson(raw) {
+  try {
+    const v = JSON.parse(String(raw));
+    return v && typeof v === 'object' ? v : null;
+  } catch {
+    return null;
+  }
+}
+
 async function ensureDir(filePath) {
   await mkdir(dirname(filePath), { recursive: true });
 }
@@ -1085,21 +1112,51 @@ async function mockAsk({ markers, prompt, cwd, onEvent, signal, resumeSessionId
   const wfEvent = /^\s*\[worca event\] workflow card (card_[0-9a-f]{8}) (?:(declined)|saved as (\S+) "([^"]*)"; thenRun=(true|false))/.exec(userText);
   // A metrics-card EVENT, then the metrics trigger — both before the run arm, whose \brun\b would otherwise fire on
   // "include my runs"-style prose (it does not, \b stops at the s, but "propose" would).
-  const tmEvent = /^\s*\[worca event\] metrics card (card_[0-9a-f]{8}) (applied|declined|failed)/.exec(userText);
+  const tmEvent = /^\s*\[worca event\] (?:metrics|policy|model) card (card_[0-9a-f]{8}) (applied|declined|failed)/.exec(userText);
   // The metrics arm wants a CHANGE, not a question: "metrics" plus a verb of intent ("stop recording my metrics",
   // "route ... to the metrics home"). A bare "which workspaces use team metrics?" gets the generic echo answer.
   const metrics = !wfEvent && !tmEvent && /\bmetrics\b/i.test(userText)
     && /\b(?:stop|start|turn|toggle|switch|record\w*|route|change|enable|disable|set)\b/i.test(userText);
-  const workflow = !wfEvent && !tmEvent && !metrics && /\bworkflow\b/i.test(userText);
+  // Scheduled runs (docs/scheduled-runs.md "Ask Worca"): a schedule-card EVENT; a CHANGE to an existing schedule
+  // (its id in the text); or a new run to schedule ("schedule …"). All before the run arm, whose \brun\b would fire.
+  const scEvent = /^\s*\[worca event\] schedule card (card_[0-9a-f]{8}) (applied|declined|failed)/.exec(userText);
+  const scId = /\b(sch_[0-9a-f]{8}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/i.exec(userText);
+  const scChange = !wfEvent && !tmEvent && !scEvent && !!scId && /\b(?:run now|move|delete|cancel|edit|change)\b/i.test(userText);
+  const scNew = !wfEvent && !tmEvent && !scEvent && !scChange && /\bschedul/i.test(userText);
+  // The team-policy arm, the metrics rule: "policy" plus a verb of intent ("raise the policy cap to $30").
+  // It proposes an edit of the context project's per-pipeline cap: `$<n>` in the text, else $30.
+  const policy = !wfEvent && !tmEvent && !metrics && !scEvent && !scNew && !scChange && /\bpolicy\b/i.test(userText)
+    && /\b(?:raise|lower|set|change|edit|make|cap)\b/i.test(userText);
+  // A tracker task named by key ("fix jira bug PROJ-123"): the run's task is the issue (mock-source's
+  // fixture plugin), and "auto" asks for the Auto workflow. Folds into the schedule and run arms.
+  const taskKey = !wfEvent && !tmEvent && !scEvent && /\b(?:issue|ticket|bug|task)\b/i.test(userText) ? /\b([A-Z][A-Z0-9]+-\d+)\b/.exec(userText) : null;
+  const wantsAuto = /\bauto\b/i.test(userText);
+  const workflow = !wfEvent && !tmEvent && !metrics && !policy && !scNew && !scChange && !taskKey && /\bworkflow\b/i.test(userText);
   const agents = !wfEvent && !tmEvent && /\bagents?\b/i.test(userText);
-  const propose = !wfEvent && !tmEvent && !workflow && !metrics && /\b(propose|start|run)\b/i.test(userText);
+  // Models (docs/models.md "Ask Worca"): "add a local llama model" proposes a keyless llama.cpp entry; "remove model
+  // <id>" its removal. The parent re-validates the INPUT against the real catalog and mints the card.
+  const modelAdd = !wfEvent && !tmEvent && !scEvent && /\bllama\b/i.test(userText) && /\b(?:add|register)\b/i.test(userText);
+  const modelRemove = !wfEvent && !tmEvent && !scEvent && !modelAdd ? /\bremove model ([A-Za-z0-9._-]+)/i.exec(userText) : null;
+  const propose = !wfEvent && !tmEvent && !scEvent && !workflow && !metrics && !policy && !scNew && !scChange && !modelAdd && !modelRemove && (!!taskKey || /\b(propose|start|run)\b/i.test(userText));
+  // The proposal both arms send: a brief, or the task reference instead of one.
+  const proposal = () => {
+    if (!taskKey) return { ...card, ...(wantsAuto ? { workflowId: 'wf_auto' } : {}) };
+    const { brief: _brief, ...rest } = card;
+    return { ...rest, ...(wantsAuto ? { workflowId: 'wf_auto' } : {}), source: { plugin: 'mock-source', sourceId: 'mock', taskId: taskKey[1] }, note: 'mock: the run reads the issue when it starts' };
+  };
+  const taskFrames = (MSG) => (taskKey ? [
+    atool(MSG, 'toolu_mock_sources', 'mcp__worca__list_task_sources', {}),
+    uresult('toolu_mock_sources', JSON.stringify({ sources: [{ plugin: 'mock-source', sourceId: 'mock', displayName: 'Mock Tasks' }] })),
+    atool(MSG, 'toolu_mock_find', 'mcp__worca__find_tasks', { plugin: 'mock-source', sourceId: 'mock', search: taskKey[1] }),
+    uresult('toolu_mock_find', JSON.stringify({ tasks: [{ id: taskKey[1], title: 'Mock task' }] })),
+  ] : []);
 
   const SID = resumeSessionId || 'mock-session-ask-1';
   const USAGE = { input_tokens: 10, output_tokens: 20, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 };
   const firstLine = userText.split(/\r?\n/).map((l) => l.trim()).find(Boolean) || '';
   const ANSWER = `[mock] ${firstLine.slice(0, 200)}`;
   const init = { type: 'system', subtype: 'init', session_id: SID, cwd, model: 'mock', permissionMode: 'dontAsk',
-    tools: ['Task', 'mcp__worca__list_runs', 'mcp__worca__get_run', 'mcp__worca__propose_run', 'mcp__worca__propose_workflow', 'mcp__worca__propose_metrics_change'],
+    tools: ['Task', 'mcp__worca__list_runs', 'mcp__worca__get_run', 'mcp__worca__propose_run', 'mcp__worca__propose_workflow', 'mcp__worca__propose_metrics_change', 'mcp__worca__propose_policy_change'],
     mcp_servers: [{ name: 'worca', status: 'connected' }], plugins: [], skills: [], slash_commands: [], agents: [], uuid: 'mock-uuid-init' };
   const mstart = (id) => ({ type: 'stream_event', event: { type: 'message_start', message: { id, model: 'mock', role: 'assistant', content: [], usage: USAGE } }, parent_tool_use_id: null, session_id: SID });
   const delta = (t) => ({ type: 'stream_event', event: { type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: t } }, parent_tool_use_id: null, session_id: SID });
@@ -1155,6 +1212,39 @@ async function mockAsk({ markers, prompt, cwd, onEvent, signal, resumeSessionId
         uresult('toolu_mock_metrics', JSON.stringify({ ok: true, card: { type: 'metrics', ...tmInput } })));
       answerMsg = MSG2;
     }
+    if (policy) {
+      const usd = Number((/\$\s*(\d+(?:\.\d+)?)/.exec(userText) || [])[1] || 30);
+      const tpInput = { kind: 'edit', projectKey: card.projectKey || null, set: [{ key: 'cost.pipelineLimitUsd', value: usd, kind: 'soft' }], note: 'mock: change the team per-pipeline cap' };
+      frames.push(delta('[mock] '), delta('proposing '), delta('a policy change'), atext(MSG1, 'Proposing a policy change card.'),
+        atool(MSG1, 'toolu_mock_policy', 'mcp__worca__propose_policy_change', tpInput),
+        uresult('toolu_mock_policy', JSON.stringify({ ok: true, card: { type: 'policy', ...tpInput } })));
+      answerMsg = MSG2;
+    }
+    if (scNew) {
+      // The parent re-validates the INPUT with the real validator: "every" in the text makes a weekday series,
+      // anything else a one-off two minutes out (short enough to watch the server start it).
+      const every = /\bevery\b/i.test(userText);
+      const input = { ...proposal(), ...(every ? { every: 'weekdays 02:00' } : { when: '+2m' }) };
+      frames.push(...taskFrames(MSG1));
+      frames.push(delta('[mock] '), delta('scheduling '), delta('a run'), atext(MSG1, every ? 'Scheduling it every weekday at 02:00.' : 'Scheduling it two minutes from now.'),
+        atool(MSG1, 'toolu_mock_preview', 'mcp__worca__preview_schedule', every ? { every: 'weekdays 02:00' } : { when: '+2m' }),
+        uresult('toolu_mock_preview', JSON.stringify({ ok: true, kind: every ? 'repeat' : 'once' })),
+        atool(MSG1, 'toolu_mock_propose', 'mcp__worca__propose_run', input), uresult('toolu_mock_propose', JSON.stringify({ ok: true })));
+      answerMsg = MSG2;
+    }
+    if (scChange) {
+      const t = userText.toLowerCase();
+      const action = /run now/.test(t) ? 'run_now' : /\bmove\b/.test(t) ? 'move' : /\bdelete\b/.test(t) ? 'delete' : /\bcancel\b/.test(t) ? 'cancel' : 'edit';
+      const input = { id: scId[1], action, ...(action === 'move' ? { when: '+5m' } : action === 'edit' ? { every: 'weekdays 03:00' } : {}), note: 'mock: as asked' };
+      frames.push(delta('[mock] '), delta('proposing '), delta('a schedule change'), atext(MSG1, 'Proposing a schedule change card.'),
+        atool(MSG1, 'toolu_mock_sched', 'mcp__worca__propose_schedule_change', input), uresult('toolu_mock_sched', JSON.stringify({ ok: true })));
+      answerMsg = MSG2;
+    }
+    if (scEvent) {
+      const line = scEvent[2] === 'declined' ? 'Declined — nothing changed.' : scEvent[2] === 'failed' ? 'The change failed; check the error and try again.' : 'Done.';
+      frames.push(delta('[mock] '), delta(scEvent[2]), atext(MSG1, line));
+      answerMsg = MSG2;
+    }
     if (tmEvent) {
       const line = tmEvent[2] === 'declined' ? 'Declined — nothing changed.' : tmEvent[2] === 'failed' ? 'The change failed; check the error and try again.' : 'Applied.';
       frames.push(delta('[mock] '), delta(tmEvent[2]), atext(MSG1, line));
@@ -1173,9 +1263,17 @@ async function mockAsk({ markers, prompt, cwd, onEvent, signal, resumeSessionId
       }
       answerMsg = MSG2;
     }
+    if (modelAdd || modelRemove) {
+      const mInput = modelAdd
+        ? { kind: 'add_model', model: { id: 'local-llama', label: 'Local llama', upstream: { provider: 'openai', api: 'openai-chat', model: 'qwen', baseUrl: 'http://127.0.0.1:8080/v1', capabilities: { maxPromptTokens: 65536, maxOutputTokens: 8192 } } }, note: 'mock: a local llama.cpp server' }
+        : { kind: 'remove_model', id: modelRemove[1], note: 'mock: as asked' };
+      frames.push(delta('[mock] '), delta('proposing '), delta('a model change'), atext(MSG1, 'Proposing a model change card.'),
+        atool(MSG1, 'toolu_mock_model', 'mcp__worca__propose_model_change', mInput), uresult('toolu_mock_model', JSON.stringify({ ok: true })));
+      answerMsg = MSG2;
+    }
     if (propose) {
-      frames.push(delta('[mock] '), delta('preparing '), delta('a run'), atext(MSG1, 'Preparing a run card.'),
-        atool(MSG1, 'toolu_mock_propose', 'mcp__worca__propose_run', card), uresult('toolu_mock_propose', JSON.stringify({ ok: true })));
+      frames.push(delta('[mock] '), delta('preparing '), delta('a run'), atext(MSG1, 'Preparing a run card.'), ...taskFrames(MSG1),
+        atool(MSG1, 'toolu_mock_propose', 'mcp__worca__propose_run', proposal()), uresult('toolu_mock_propose', JSON.stringify({ ok: true })));
       answerMsg = MSG2;
     }
     if (answerMsg !== MSG1) frames.push(mstart(answerMsg));
@@ -1246,12 +1344,17 @@ async function runMock({ cwd, systemPrompt, prompt, onEvent, signal, resumeSessi
   // session event above already fired, so the resume has a session id.
   if (m.MOCK_ASK && permissionMode !== 'dontAsk') {   // belt and braces: dontAsk already took the ask arm above
     await ensureDir(m.MOCK_ASK);
-    await writeFile(m.MOCK_ASK, JSON.stringify({
+    // MOCK_ASK_FORM (ask-forms §4): a one-line {"form","data"} payload, written
+    // verbatim. Unparseable => the canned questions body, so a typo degrades to
+    // today's behaviour instead of writing garbage the gate then refuses.
+    const formBody = m.MOCK_ASK_FORM ? tryParseMockJson(m.MOCK_ASK_FORM) : null;
+    const body = formBody || {
       questions: [{ id: 'q1', question: `Mock question from ${role}?`, options: ['Option A', 'Option B'], allowFreeText: true }],
-    }, null, 2) + '\n', 'utf8');
+    };
+    await writeFile(m.MOCK_ASK, JSON.stringify(body, null, 2) + '\n', 'utf8');
     safeEmit(onEvent, { type: 'tool_use', text: `wrote ${m.MOCK_ASK}`, raw: { mock: true, file: m.MOCK_ASK } });
     safeEmit(onEvent, { type: 'result', costUsd: 0, raw: { mock: true, type: 'result', total_cost_usd: 0 } });
-    await emitLog(onEvent, `[mock] questions written; stopping for answers (role=${role})`);
+    await emitLog(onEvent, `[mock] ${formBody ? 'form ask' : 'questions'} written; stopping for answers (role=${role})`);
     return { text: '[mock] asked questions', exitCode: 0 };
   }
 
@@ -1344,7 +1447,11 @@ async function mockClarify(m, cycle, onEvent) {
   // orchestrator's clarify loop terminates naturally. This mirrors the real fix:
   // the loop converges because answers are returned to the planner.
   const hasPrior = Number(m.MOCK_PRIOR || '0') > 0;
-  const payload = hasPrior
+  // MOCK_ASK_FORM (ask-forms §4): a one-line {"form","data"} payload, written VERBATIM
+  // to the answers port instead of the canned questions — the clarifier's half of the
+  // marker (the producer's half is the MOCK_ASK arm in runMock). Unparseable => canned.
+  const formBody = m.MOCK_ASK_FORM ? tryParseMockJson(m.MOCK_ASK_FORM) : null;
+  const payload = formBody || (hasPrior
     ? { questions: [] }
     : {
         questions: [
@@ -1367,10 +1474,10 @@ async function mockClarify(m, cycle, onEvent) {
             allowFreeText: true,
           },
         ],
-      };
+      });
   await emitLog(
     onEvent,
-    hasPrior
+    formBody ? '[mock] clarifier asking with a form' : hasPrior
       ? '[mock] planner has no further questions'
       : '[mock] planner asking one clarifying question',
   );