@worca/ui 0.20.0 → 0.21.0

package/app/styles.css

@@ -4650,3 +4650,167 @@ sl-tooltip.bead-tooltip::part(body) {
   justify-content: flex-end;
   width: 100%;
 }
+
+/* ─── Models tab — model cards + env rows ──────────────────────────── */
+.models-cards {
+  grid-template-columns: repeat(auto-fill, minmax(440px, 1fr));
+}
+
+.model-card {
+  display: flex;
+  flex-direction: column;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease;
+}
+
+.model-card.is-dirty {
+  border-color: var(--status-running, #3b82f6);
+  box-shadow: 0 0 0 1px var(--status-running, #3b82f6);
+}
+
+.model-delete-btn {
+  /* Aligned left in the footer action row via the flex layout (the status
+     span between it and Discard/Save has flex:1 and grows). */
+}
+
+.model-id-input::part(input) {
+  font-family: var(--sl-font-mono);
+  font-size: 12px;
+}
+
+.settings-label-row {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 8px;
+}
+
+.settings-muted-small {
+  font-size: 11px;
+  color: var(--muted);
+  font-weight: 500;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
+.model-env-table {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.model-env-row {
+  display: grid;
+  grid-template-columns: minmax(0, 240px) minmax(0, 1fr) 18px 30px;
+  gap: 6px;
+  align-items: center;
+}
+
+.model-env-key::part(input) {
+  font-family: var(--sl-font-mono);
+  font-size: 12px;
+}
+
+.model-env-key.is-invalid::part(base) {
+  border-color: var(--status-failed, #ef4444);
+}
+
+.model-env-value::part(input) {
+  font-size: 12px;
+}
+
+.model-env-warn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  color: var(--status-failed, #ef4444);
+  font-size: 14px;
+  line-height: 1;
+  cursor: help;
+}
+
+.model-env-warn-spacer {
+  display: inline-block;
+  width: 18px;
+}
+
+.model-env-remove {
+  color: var(--muted);
+  --sl-spacing-medium: 0;
+}
+
+.model-env-add-btn {
+  align-self: flex-start;
+  margin-top: 4px;
+}
+
+.model-card-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 14px;
+  padding-top: 12px;
+  border-top: 1px solid var(--border-subtle);
+}
+
+.model-card-status {
+  flex: 1;
+  font-size: 11px;
+  color: var(--muted);
+  font-style: italic;
+  text-align: center;
+}
+
+.settings-tab-description {
+  font-size: 12px;
+  color: var(--muted);
+  margin: 0 0 16px 0;
+  line-height: 1.5;
+}
+
+.settings-tab-description code {
+  background: var(--bg-tertiary);
+  padding: 1px 5px;
+  border-radius: 3px;
+  font-family: var(--sl-font-mono);
+  font-size: 11px;
+  color: var(--fg);
+}
+
+.models-add-row {
+  margin-top: 24px;
+  padding-top: 16px;
+  border-top: 1px solid var(--border-subtle);
+}
+
+.models-add-controls {
+  display: flex;
+  gap: 8px;
+  align-items: flex-end;
+}
+
+.models-add-controls sl-input {
+  flex: 1;
+}
+
+/* ─── Confirmation dialog — "cannot be undone" warning row ────────── */
+.confirm-warning {
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+  margin: 0.75rem 0 0;
+  padding: 8px 10px;
+  background: rgba(245, 158, 11, 0.08);
+  border-left: 3px solid var(--status-paused, #f59e0b);
+  border-radius: 4px;
+  color: var(--fg);
+  font-size: 13px;
+  font-weight: 500;
+  line-height: 1.4;
+}
+
+.confirm-warning > span:first-child {
+  color: var(--status-paused, #f59e0b);
+  font-size: 15px;
+  line-height: 1.2;
+  flex: 0 0 auto;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@worca/ui",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Pipeline monitoring UI for worca-cc",
   "license": "MIT",
   "author": "Sinisha Djukic",
@@ -25,6 +25,7 @@
     "bin/worca-ui.js",
     "server/**/*.js",
     "server/schemas/keys.json",
+    "server/reserved-env-keys.json",
     "!server/**/*.test.js",
     "!server/test/**",
     "!server/**/test/**",

package/server/model-env-routes.js

@@ -0,0 +1,189 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { Router } from 'express';
+import { atomicWriteSync } from './atomic-write.js';
+import { localPathFor } from './settings-merge.js';
+
+const require = createRequire(import.meta.url);
+const denylist = require('./reserved-env-keys.json');
+const RESERVED_KEYS = new Set(denylist.keys);
+const RESERVED_PREFIXES = denylist.prefixes;
+
+function isReservedKey(key) {
+  if (RESERVED_KEYS.has(key)) return true;
+  return RESERVED_PREFIXES.some((p) => key.startsWith(p));
+}
+
+function readJsonOr(path, fallback) {
+  if (!existsSync(path)) return fallback;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+export function createModelEnvRouter({ settingsPath: staticPath } = {}) {
+  const router = Router({ mergeParams: true });
+
+  function resolveSettingsPath(req) {
+    return req.project?.settingsPath || staticPath;
+  }
+
+  router.put('/', (req, res) => {
+    const { model, id, env } = req.body || {};
+
+    if (!model || typeof model !== 'string') {
+      return res
+        .status(400)
+        .json({ ok: false, error: 'model name is required' });
+    }
+    if (id != null && typeof id !== 'string') {
+      return res.status(400).json({ ok: false, error: 'id must be a string' });
+    }
+    if (env != null && (typeof env !== 'object' || Array.isArray(env))) {
+      return res
+        .status(400)
+        .json({ ok: false, error: 'env must be an object' });
+    }
+
+    const envIn = env || {};
+    for (const [key, value] of Object.entries(envIn)) {
+      if (typeof key !== 'string' || key === '') {
+        return res
+          .status(400)
+          .json({ ok: false, error: 'env keys must be non-empty strings' });
+      }
+      if (isReservedKey(key)) {
+        return res.status(400).json({
+          ok: false,
+          key,
+          error: `Key "${key}" is reserved and cannot be used as a model env var`,
+        });
+      }
+      if (typeof value !== 'string') {
+        return res.status(400).json({
+          ok: false,
+          key,
+          error: `value for "${key}" must be a string`,
+        });
+      }
+    }
+
+    const settingsPath = resolveSettingsPath(req);
+    if (!settingsPath) {
+      return res
+        .status(501)
+        .json({ ok: false, error: 'settingsPath not configured' });
+    }
+
+    // Storage split (deliberate after the W-051 simplification):
+    //   settings.json       — public model entry: string id or { id }, NEVER env
+    //   settings.local.json — { env } only, NEVER id
+    //
+    // Writing env to local while leaving env behind in settings.json would
+    // let deep-merge resurrect deleted keys (a key removed in the UI but
+    // still present in settings.json would reappear on next load). So PUT
+    // actively strips env from the settings.json entry whenever it writes
+    // env to local, and conversely never lets id leak into local.
+    const localPath = localPathFor(settingsPath);
+    const local = readJsonOr(localPath, {});
+    if (!local.worca) local.worca = {};
+    if (!local.worca.models) local.worca.models = {};
+
+    if (Object.keys(envIn).length === 0) {
+      delete local.worca.models[model];
+    } else {
+      local.worca.models[model] = { env: { ...envIn } };
+    }
+    atomicWriteSync(localPath, `${JSON.stringify(local, null, 2)}\n`);
+
+    // settings.json: keep/update id, drop env entirely. If the model
+    // doesn't exist there and no id was supplied, skip the file. If id is
+    // explicitly an empty string, treat it as "no id" and drop the entry.
+    const base = readJsonOr(settingsPath, {});
+    if (!base.worca) base.worca = {};
+    if (!base.worca.models) base.worca.models = {};
+
+    const baseEntry = base.worca.models[model];
+    let resolvedId = id;
+    if (resolvedId == null) {
+      if (typeof baseEntry === 'string') resolvedId = baseEntry;
+      else if (baseEntry && typeof baseEntry === 'object')
+        resolvedId = baseEntry.id;
+    }
+
+    let baseChanged = false;
+    if (resolvedId) {
+      // Prefer string form when there's no other metadata — keeps JSON minimal.
+      const nextBaseEntry = resolvedId;
+      if (JSON.stringify(baseEntry) !== JSON.stringify(nextBaseEntry)) {
+        base.worca.models[model] = nextBaseEntry;
+        baseChanged = true;
+      }
+    } else if (baseEntry !== undefined) {
+      delete base.worca.models[model];
+      baseChanged = true;
+    }
+    if (baseChanged) {
+      atomicWriteSync(settingsPath, `${JSON.stringify(base, null, 2)}\n`);
+    }
+
+    res.json({ ok: true, model, id: resolvedId || null, env: { ...envIn } });
+  });
+
+  router.delete('/', (req, res) => {
+    const model =
+      req.body?.model ||
+      (typeof req.query?.model === 'string' ? req.query.model : null);
+
+    if (!model) {
+      return res
+        .status(400)
+        .json({ ok: false, error: 'model name is required' });
+    }
+
+    const settingsPath = resolveSettingsPath(req);
+    if (!settingsPath) {
+      return res
+        .status(501)
+        .json({ ok: false, error: 'settingsPath not configured' });
+    }
+
+    // Remove from BOTH files so deep-merge can't resurrect the entry. The
+    // settings POST endpoint deep-merges and cannot remove a key, so we
+    // operate on disk directly. This is intentional — "Delete model" in
+    // the UI means the model goes away, full stop.
+    let removedFromBase = false;
+    let removedFromLocal = false;
+
+    if (existsSync(settingsPath)) {
+      const base = readJsonOr(settingsPath, {});
+      if (base?.worca?.models && model in base.worca.models) {
+        delete base.worca.models[model];
+        atomicWriteSync(settingsPath, `${JSON.stringify(base, null, 2)}\n`);
+        removedFromBase = true;
+      }
+    }
+
+    const localPath = localPathFor(settingsPath);
+    if (existsSync(localPath)) {
+      const local = readJsonOr(localPath, {});
+      if (local?.worca?.models && model in local.worca.models) {
+        delete local.worca.models[model];
+        atomicWriteSync(localPath, `${JSON.stringify(local, null, 2)}\n`);
+        removedFromLocal = true;
+      }
+    }
+
+    res.json({
+      ok: true,
+      model,
+      removed: removedFromBase || removedFromLocal,
+      fromBase: removedFromBase,
+      fromLocal: removedFromLocal,
+    });
+  });
+
+  return router;
+}

package/server/model-validation.js

@@ -0,0 +1,13 @@
+const DEFAULT_MODELS = ['opus', 'sonnet', 'haiku'];
+
+export function deriveValidModels(worcaObj) {
+  const configuredModels =
+    worcaObj?.models &&
+    typeof worcaObj.models === 'object' &&
+    !Array.isArray(worcaObj.models)
+      ? Object.keys(worcaObj.models)
+      : [];
+  return [...new Set([...DEFAULT_MODELS, ...configuredModels])];
+}
+
+export { DEFAULT_MODELS };

package/server/preferences-routes.js

@@ -1,9 +1,9 @@
 import { join } from 'node:path';
 import { Router } from 'express';
+import { deriveValidModels } from './model-validation.js';
 import { readGlobalSettings, writeGlobalSettings } from './settings-reader.js';
 
 const VALID_CLEANUP_POLICIES = ['never', 'on-success', 'manual-only'];
-const VALID_MODELS = ['opus', 'sonnet', 'haiku'];
 const MIN_DISK_BYTES = 500_000_000;
 const MAX_DISK_BYTES = 50_000_000_000;
 
@@ -73,9 +73,10 @@ export function validateGlobalSettingsPayload(body) {
       ) {
         details.push('worca.circuit_breaker must be an object');
       } else if (w.circuit_breaker.classifier_model !== undefined) {
-        if (!VALID_MODELS.includes(w.circuit_breaker.classifier_model)) {
+        const validModels = deriveValidModels(w);
+        if (!validModels.includes(w.circuit_breaker.classifier_model)) {
           details.push(
-            `classifier_model must be one of: ${VALID_MODELS.join(', ')}`,
+            `classifier_model must be one of: ${validModels.join(', ')}`,
           );
         }
       }

package/server/project-routes.js

@@ -27,6 +27,7 @@ import { dispatchExternal } from './dispatch-external.js';
 import { ensureWebhookForUi } from './ensure-webhook.js';
 import { extractAndStripGlobalKeys } from './global-keys.js';
 import { LaunchLock } from './launch-lock.js';
+import { createModelEnvRouter } from './model-env-routes.js';
 import { readPreferences } from './preferences.js';
 import { ProcessManager } from './process-manager.js';
 import { countRunningPipelinesAcrossProjects } from './process-registry.js';
@@ -430,6 +431,9 @@ export function createProjectScopedRoutes({
     res.json({ ok: true, files });
   });
 
+  // --- Model env endpoints (writes wholesale to settings.local.json) ---
+  router.use('/settings/model-env', createModelEnvRouter());
+
   // --- Project-scoped settings endpoints ---
 
   // GET /api/projects/:projectId/settings
@@ -578,6 +582,7 @@ export function createProjectScopedRoutes({
   // DELETE /api/projects/:projectId/settings/:section
   const SECTION_KEYS = {
     agents: { worca: ['agents'] },
+    models: { worca: ['models'] },
     pipeline: { worca: ['stages', 'loops', 'plan_path_template', 'defaults'] },
     governance: { worca: ['governance'], top: ['permissions'] },
     pricing: { worca: ['pricing'] },

package/server/reserved-env-keys.json

@@ -0,0 +1,19 @@
+{
+  "keys": [
+    "PATH",
+    "CLAUDECODE",
+    "WORCA_AGENT",
+    "WORCA_PROJECT_ROOT",
+    "WORCA_RUN_ID",
+    "WORCA_RUN_DIR",
+    "WORCA_PLAN_FILE",
+    "WORCA_EVENTS_PATH",
+    "WORCA_TARGET_BRANCH",
+    "WORCA_COVERAGE",
+    "WORCA_SKIP_BEADS",
+    "WORCA_CLAUDE_BIN"
+  ],
+  "prefixes": [
+    "WORCA_"
+  ]
+}

package/server/settings-validator.js

@@ -1,6 +1,7 @@
 // server/settings-validator.js
 import { STAGE_ORDER } from '../app/utils/stage-order.js';
 import { GLOBAL_ONLY_KEYS } from './keys-schema.js';
+import { DEFAULT_MODELS, deriveValidModels } from './model-validation.js';
 
 const VALID_AGENTS = [
   'planner',
@@ -13,7 +14,7 @@ const VALID_AGENTS = [
   'learner',
 ];
 const VALID_STAGES = STAGE_ORDER;
-export const VALID_MODELS = ['opus', 'sonnet', 'haiku'];
+export const VALID_MODELS = DEFAULT_MODELS;
 const VALID_LOOPS = [
   'implement_test',
   'pr_changes',
@@ -27,7 +28,7 @@ const VALID_GUARDS = [
   'block_force_push',
   'restrict_git_commit',
 ];
-const VALID_PRICING_MODELS = ['opus', 'sonnet'];
+const DEFAULT_PRICING_MODELS = ['opus', 'sonnet'];
 const VALID_PRICING_FIELDS = [
   'input_per_mtok',
   'output_per_mtok',
@@ -48,6 +49,7 @@ export function validateSettingsPayload(body) {
       return { valid: false, details };
     }
     const w = body.worca;
+    const validModels = deriveValidModels(w);
 
     // agents
     if (w.agents !== undefined) {
@@ -63,7 +65,7 @@ export function validateSettingsPayload(body) {
             details.push(`Unknown agent name: "${name}"`);
             continue;
           }
-          if (cfg.model !== undefined && !VALID_MODELS.includes(cfg.model)) {
+          if (cfg.model !== undefined && !validModels.includes(cfg.model)) {
             details.push(`Invalid model "${cfg.model}" for agent "${name}"`);
           }
           if (cfg.max_turns !== undefined) {
@@ -192,6 +194,9 @@ export function validateSettingsPayload(body) {
         details.push('pricing must be an object');
       } else {
         const p = w.pricing;
+        const validPricingModels = [
+          ...new Set([...DEFAULT_PRICING_MODELS, ...validModels]),
+        ];
         if (p.models !== undefined) {
           if (
             typeof p.models !== 'object' ||
@@ -201,7 +206,7 @@ export function validateSettingsPayload(body) {
             details.push('pricing.models must be an object');
           } else {
             for (const [model, costs] of Object.entries(p.models)) {
-              if (!VALID_PRICING_MODELS.includes(model)) {
+              if (!validPricingModels.includes(model)) {
                 details.push(`Unknown pricing model: "${model}"`);
                 continue;
               }
@@ -864,12 +869,13 @@ export function validateGlobalSettings(prefs) {
     }
   }
 
+  const globalValidModels = deriveValidModels(w);
   if (
     w.circuit_breaker?.classifier_model !== undefined &&
-    !VALID_MODELS.includes(w.circuit_breaker.classifier_model)
+    !globalValidModels.includes(w.circuit_breaker.classifier_model)
   ) {
     details.push(
-      `circuit_breaker.classifier_model must be one of: ${VALID_MODELS.join(', ')}`,
+      `circuit_breaker.classifier_model must be one of: ${globalValidModels.join(', ')}`,
     );
   }
 

package/server/worktree-ops.js

@@ -2,33 +2,37 @@
  * Shared worktree operations — single owner of `git worktree remove` shell-out.
  */
 
-import { execFileSync } from 'node:child_process';
-import {
-  existsSync,
-  lstatSync,
-  readFileSync,
-  rmSync,
-  unlinkSync,
-} from 'node:fs';
+import { execFile } from 'node:child_process';
+import { existsSync, lstatSync } from 'node:fs';
+import { readFile, rm, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
 
 /**
  * Remove a worktree and its registry entry.
  * Mirrors WorktreeSource.remove from src/worca/cli/cleanup.py:
  *   1. Attempt `git worktree remove --force <path>` from the project root
- *   2. On failure (e.g. non-worktree temp dir in tests), fall back to rmSync
+ *   2. On failure (e.g. non-worktree temp dir in tests), fall back to rm (async)
  *   3. Run `git worktree prune` so git's metadata (`.git/worktrees/<id>/`)
  *      drops the entry even when the directory was removed manually
+ *      (skipped when skipPrune is true — caller is responsible for pruning later)
  *   4. Delete the registry file
  */
-export function removeWorktree(worcaDir, runId) {
+export async function removeWorktree(
+  worcaDir,
+  runId,
+  { skipPrune = false } = {},
+) {
   const regFile = join(worcaDir, 'multi', 'pipelines.d', `${runId}.json`);
   const projectRoot = join(worcaDir, '..');
   let worktreePath = null;
 
   if (existsSync(regFile)) {
     try {
-      const reg = JSON.parse(readFileSync(regFile, 'utf8'));
+      const content = await readFile(regFile, 'utf8');
+      const reg = JSON.parse(content);
       worktreePath = reg.worktree_path || null;
     } catch {
       /* ignore */
@@ -37,11 +41,15 @@ export function removeWorktree(worcaDir, runId) {
 
   if (worktreePath && existsSync(worktreePath)) {
     try {
-      execFileSync('git', ['worktree', 'remove', '--force', worktreePath], {
-        cwd: projectRoot,
-        stdio: 'pipe',
-        timeout: 30_000,
-      });
+      await execFileAsync(
+        'git',
+        ['worktree', 'remove', '--force', worktreePath],
+        {
+          cwd: projectRoot,
+          stdio: 'pipe',
+          timeout: 30_000,
+        },
+      );
     } catch {
       let isRealDir = false;
       try {
@@ -51,13 +59,36 @@ export function removeWorktree(worcaDir, runId) {
         /* ignore */
       }
       if (isRealDir) {
-        rmSync(worktreePath, { recursive: true, force: true });
+        await rm(worktreePath, { recursive: true, force: true });
       }
     }
   }
 
+  if (!skipPrune) {
+    try {
+      await execFileAsync('git', ['worktree', 'prune'], {
+        cwd: projectRoot,
+        stdio: 'pipe',
+        timeout: 30_000,
+      });
+    } catch {
+      /* non-fatal */
+    }
+  }
+
+  if (existsSync(regFile)) {
+    await unlink(regFile);
+  }
+}
+
+/**
+ * Run `git worktree prune` once for the project at worcaDir.
+ * Use after a batch of removeWorktree({ skipPrune: true }) calls.
+ */
+export async function pruneWorktrees(worcaDir) {
+  const projectRoot = join(worcaDir, '..');
   try {
-    execFileSync('git', ['worktree', 'prune'], {
+    await execFileAsync('git', ['worktree', 'prune'], {
       cwd: projectRoot,
       stdio: 'pipe',
       timeout: 30_000,
@@ -65,8 +96,4 @@ export function removeWorktree(worcaDir, runId) {
   } catch {
     /* non-fatal */
   }
-
-  if (existsSync(regFile)) {
-    unlinkSync(regFile);
-  }
 }