@worca/ui 0.26.0 → 0.28.0-rc.1

package/server/dispatch-migration.js

@@ -0,0 +1,132 @@
+/**
+ * Dispatch governance migration — JS port of Python
+ * _migrate_dispatch_governance() in src/worca/cli/init.py (§10.3).
+ *
+ * Mutates worcaConfig in place following the same pattern as
+ * global-keys.js:extractAndStripGlobalKeys().
+ */
+
+import { DISPATCH_DEFAULTS } from './dispatch-defaults.js';
+
+const _DISPATCH_SECTION_KEYS = new Set(['tools', 'skills', 'subagents']);
+
+/**
+ * Returns true if `dispatch` has at least one agent-name key directly at the
+ * top level (the pre-W-038 legacy flat shape, e.g. `{planner: [...]}`),
+ * rather than the W-054 nested shape `{tools, skills, subagents}`.
+ */
+function _isLegacyFlatDispatch(dispatch) {
+  if (!dispatch || typeof dispatch !== 'object' || Array.isArray(dispatch)) {
+    return false;
+  }
+  for (const key of Object.keys(dispatch)) {
+    if (!_DISPATCH_SECTION_KEYS.has(key) && Array.isArray(dispatch[key])) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Strip agent-name keys from `dispatch`, moving their values into
+ * `dispatch.subagents.per_agent_allow` so the legacy flat shape is normalized.
+ */
+function _absorbFlatDispatchKeys(dispatch) {
+  const flatKeys = [];
+  for (const key of Object.keys(dispatch)) {
+    if (!_DISPATCH_SECTION_KEYS.has(key) && Array.isArray(dispatch[key])) {
+      flatKeys.push(key);
+    }
+  }
+  if (flatKeys.length === 0) return false;
+
+  if (!dispatch.subagents) dispatch.subagents = {};
+  if (!dispatch.subagents.per_agent_allow) {
+    dispatch.subagents.per_agent_allow = {};
+  }
+  for (const key of flatKeys) {
+    const incoming = dispatch[key];
+    const existing = dispatch.subagents.per_agent_allow[key];
+    if (!existing || existing.length === 0) {
+      dispatch.subagents.per_agent_allow[key] = incoming;
+    }
+    delete dispatch[key];
+  }
+  return true;
+}
+
+/**
+ * Migrate legacy governance.subagent_dispatch and/or legacy flat
+ * governance.dispatch (agent-keyed) → governance.dispatch.subagents.per_agent_allow.
+ *
+ * Seeds _defaults, adds tools/skills defaults, drops _dispatch_legacy.
+ * Idempotent — returns [] on already-migrated configs.
+ *
+ * @param {object} worcaConfig — the `worca` object from settings (mutated)
+ * @returns {string[]} list of change descriptions (empty = no-op)
+ */
+export function migrateDispatchGovernance(worcaConfig) {
+  const changes = [];
+  const gov = worcaConfig.governance;
+  if (!gov || typeof gov !== 'object') return changes;
+
+  const hasSubagentDispatch = 'subagent_dispatch' in gov;
+  const hasLegacyFlatDispatch = _isLegacyFlatDispatch(gov.dispatch);
+
+  if (!hasSubagentDispatch && !hasLegacyFlatDispatch) return changes;
+
+  if (!gov.dispatch || Array.isArray(gov.dispatch)) gov.dispatch = {};
+  const dispatch = gov.dispatch;
+
+  // Absorb legacy flat shape (pre-W-038) first so subagent_dispatch values
+  // take precedence below.
+  if (hasLegacyFlatDispatch) {
+    _absorbFlatDispatchKeys(dispatch);
+    changes.push(
+      'governance.dispatch (flat agent-keyed) -> governance.dispatch.subagents (W-054)',
+    );
+  }
+
+  if (hasSubagentDispatch) {
+    const old = gov.subagent_dispatch;
+    delete gov.subagent_dispatch;
+    if (!dispatch.subagents) dispatch.subagents = {};
+    if (!dispatch.subagents.per_agent_allow) {
+      dispatch.subagents.per_agent_allow = {};
+    }
+    Object.assign(dispatch.subagents.per_agent_allow, old);
+    changes.push(
+      'governance.subagent_dispatch -> governance.dispatch.subagents (W-054)',
+    );
+  }
+
+  if (!dispatch.subagents) dispatch.subagents = {};
+  const subagents = dispatch.subagents;
+
+  if (!subagents.per_agent_allow) subagents.per_agent_allow = {};
+  if (!('_defaults' in subagents.per_agent_allow)) {
+    subagents.per_agent_allow._defaults = [
+      ...DISPATCH_DEFAULTS.subagents.per_agent_allow._defaults,
+    ];
+  }
+
+  if (!subagents.always_disallowed) {
+    subagents.always_disallowed = [
+      ...DISPATCH_DEFAULTS.subagents.always_disallowed,
+    ];
+  }
+  if (!subagents.default_denied) {
+    subagents.default_denied = [...DISPATCH_DEFAULTS.subagents.default_denied];
+  }
+
+  if (!dispatch.tools) {
+    dispatch.tools = structuredClone(DISPATCH_DEFAULTS.tools);
+  }
+  if (!dispatch.skills) {
+    dispatch.skills = structuredClone(DISPATCH_DEFAULTS.skills);
+  }
+
+  delete gov._dispatch_legacy;
+
+  return changes;
+}

package/server/git-helpers.js

@@ -0,0 +1,32 @@
+import { execFileSync } from 'node:child_process';
+
+const CACHE_TTL_MS = 30_000;
+const cache = new Map();
+
+function _resolveDefaultBranch(projectRoot) {
+  try {
+    const out = execFileSync(
+      'git',
+      ['symbolic-ref', 'refs/remotes/origin/HEAD', '--short'],
+      { cwd: projectRoot, encoding: 'utf8', timeout: 5000 },
+    );
+    const branch = out.trim().replace(/^origin\//, '');
+    if (branch) return branch;
+  } catch {
+    // no symbolic-ref configured — fall through
+  }
+  return 'main';
+}
+
+export function getDefaultBranch(projectRoot) {
+  const now = Date.now();
+  const hit = cache.get(projectRoot);
+  if (hit && hit.expiresAt > now) return hit.value;
+  const value = _resolveDefaultBranch(projectRoot);
+  cache.set(projectRoot, { value, expiresAt: now + CACHE_TTL_MS });
+  return value;
+}
+
+export function _clearDefaultBranchCache() {
+  cache.clear();
+}

package/server/known-skills.json

@@ -0,0 +1,31 @@
+[
+  { "name": "batch", "group": "Built-in" },
+  { "name": "claude-api", "group": "Built-in" },
+  { "name": "debug", "group": "Built-in" },
+  { "name": "fewer-permission-prompts", "group": "Built-in" },
+  { "name": "init", "group": "Built-in" },
+  { "name": "loop", "group": "Built-in" },
+  { "name": "review", "group": "Built-in" },
+  { "name": "schedule", "group": "Built-in" },
+  { "name": "security-review", "group": "Built-in" },
+  { "name": "simplify", "group": "Built-in" },
+  { "name": "update-config", "group": "Built-in" },
+  { "name": "hookify:hookify", "group": "Plugin" },
+  { "name": "hookify:configure", "group": "Plugin" },
+  { "name": "hookify:list", "group": "Plugin" },
+  { "name": "hookify:writing-rules", "group": "Plugin" },
+  { "name": "feature-dev:feature-dev", "group": "Plugin" },
+  { "name": "feature-dev:code-reviewer", "group": "Plugin" },
+  { "name": "feature-dev:code-architect", "group": "Plugin" },
+  { "name": "feature-dev:code-explorer", "group": "Plugin" },
+  { "name": "claude-md-management:revise-claude-md", "group": "Plugin" },
+  { "name": "claude-md-management:claude-md-improver", "group": "Plugin" },
+  { "name": "worca-install", "group": "Worca" },
+  { "name": "worca-rc", "group": "Worca" },
+  { "name": "worca-release", "group": "Worca" },
+  { "name": "worca-sync", "group": "Worca" },
+  { "name": "worca-sync-pr", "group": "Worca" },
+  { "name": "worca-sync-commit", "group": "Worca" },
+  { "name": "worca-analyze", "group": "Worca" },
+  { "name": "worca-agent-override", "group": "Worca" }
+]

package/server/known-tools.json

@@ -0,0 +1,18 @@
+[
+  { "name": "Agent", "group": "Core" },
+  { "name": "Bash", "group": "Core" },
+  { "name": "Edit", "group": "Core" },
+  { "name": "Glob", "group": "Core" },
+  { "name": "Grep", "group": "Core" },
+  { "name": "Read", "group": "Core" },
+  { "name": "Write", "group": "Core" },
+  { "name": "Skill", "group": "Core" },
+  { "name": "WebFetch", "group": "Core" },
+  { "name": "WebSearch", "group": "Core" },
+  { "name": "NotebookEdit", "group": "Core" },
+  { "name": "EnterPlanMode", "group": "Mode" },
+  { "name": "EnterWorktree", "group": "Mode" },
+  { "name": "TodoWrite", "group": "Task" },
+  { "name": "TaskCreate", "group": "Task" },
+  { "name": "TaskUpdate", "group": "Task" }
+]

package/server/model-env-routes.js

@@ -115,8 +115,13 @@ export function createModelEnvRouter({ settingsPath: staticPath } = {}) {
 
     let baseChanged = false;
     if (resolvedId) {
-      // Prefer string form when there's no other metadata — keeps JSON minimal.
-      const nextBaseEntry = resolvedId;
+      // When env exists in local, base MUST use the object form `{id}` so
+      // deepMerge({id}, {env}) preserves the id. With the string form,
+      // deepMerge would see a non-object base and discard it, dropping the id
+      // entirely — the bug behind empty Model ID after Duplicate/Paste.
+      // String form stays the default when there's no env, to keep JSON minimal.
+      const hasEnv = Object.keys(envIn).length > 0;
+      const nextBaseEntry = hasEnv ? { id: resolvedId } : resolvedId;
       if (JSON.stringify(baseEntry) !== JSON.stringify(nextBaseEntry)) {
         base.worca.models[model] = nextBaseEntry;
         baseChanged = true;

package/server/project-routes.js

@@ -23,7 +23,9 @@ import { actionAllowed } from '../app/utils/state-actions.js';
 import { atomicWriteSync } from './atomic-write.js';
 import { dbExists, getIssue, listIssues } from './beads-reader.js';
 import { dispatchExternal } from './dispatch-external.js';
+import { migrateDispatchGovernance } from './dispatch-migration.js';
 import { ensureWebhookForUi } from './ensure-webhook.js';
+import { getDefaultBranch } from './git-helpers.js';
 import { extractAndStripGlobalKeys } from './global-keys.js';
 import { LaunchLock } from './launch-lock.js';
 import { createModelEnvRouter } from './model-env-routes.js';
@@ -361,7 +363,8 @@ export function createProjectScopedRoutes({
   router.get('/runs', requireWorcaDir, (req, res) => {
     try {
       const runs = discoverRuns(req.project.worcaDir);
-      const response = { ok: true, runs };
+      const default_branch = getDefaultBranch(req.project.projectRoot);
+      const response = { ok: true, runs, default_branch };
       // Include settings so multi-project clients can use loop limits, etc.
       const { settingsPath } = req.project;
       if (settingsPath && existsSync(settingsPath)) {
@@ -478,7 +481,18 @@ export function createProjectScopedRoutes({
       });
     }
 
-    const validation = validateSettingsPayload(body);
+    let existingForValidation = {};
+    try {
+      if (existsSync(settingsPath)) {
+        existingForValidation = JSON.parse(readFileSync(settingsPath, 'utf8'));
+      }
+    } catch {
+      existingForValidation = {};
+    }
+
+    const validation = validateSettingsPayload(body, {
+      existing: existingForValidation,
+    });
     if (!validation.valid) {
       return res.status(400).json({
         error: {
@@ -504,22 +518,15 @@ export function createProjectScopedRoutes({
         if (!base.worca || typeof base.worca !== 'object') base.worca = {};
         base.worca = deepMerge(base.worca, body.worca);
 
-        if (
-          body.worca.governance &&
-          typeof body.worca.governance === 'object' &&
-          body.worca.governance.subagent_dispatch !== undefined &&
-          base.worca.governance &&
-          typeof base.worca.governance === 'object' &&
-          'dispatch' in base.worca.governance
-        ) {
-          delete base.worca.governance.dispatch;
-        }
         baseChanged = true;
       }
 
       // STEP 1: extract misplaced global keys + inert milestone keys
       const autoMigrated = extractAndStripGlobalKeys(base);
 
+      // STEP 1a: migrate legacy subagent_dispatch → dispatch.subagents (W-054)
+      if (base.worca) migrateDispatchGovernance(base.worca);
+
       // STEP 2: write extracted global keys to ~/.worca/settings.json
       const globalSettingsPath = prefsDir
         ? join(prefsDir, 'settings.json')
@@ -558,12 +565,43 @@ export function createProjectScopedRoutes({
         atomicWriteSync(settingsPath, `${JSON.stringify(base, null, 2)}\n`);
       }
 
+      // STEP 3a: strip shadowed worca keys from settings.local.json. Local is
+      // deep-merged over base on read, so a stale `worca.<key>` copy in local
+      // would resurrect after the user saves a new value. `models` is excluded
+      // because its env-portion lives in local by design (see model-env-routes).
+      const lp = localPathFor(settingsPath);
+      let localChanged = false;
+      const localForPrune = readLocalSettings(settingsPath);
+      if (
+        body.worca &&
+        typeof body.worca === 'object' &&
+        localForPrune.worca &&
+        typeof localForPrune.worca === 'object'
+      ) {
+        for (const key of Object.keys(body.worca)) {
+          if (key === 'models') continue;
+          if (key in localForPrune.worca) {
+            delete localForPrune.worca[key];
+            localChanged = true;
+          }
+        }
+        if (localChanged && Object.keys(localForPrune.worca).length === 0) {
+          delete localForPrune.worca;
+        }
+      }
+
       if (body.permissions !== undefined) {
-        const lp = localPathFor(settingsPath);
-        const local = readLocalSettings(settingsPath);
-        local.permissions = body.permissions;
+        localForPrune.permissions = body.permissions;
+        localChanged = true;
+      }
+
+      if (localChanged) {
         mkdirSync(dirname(lp), { recursive: true });
-        writeFileSync(lp, `${JSON.stringify(local, null, 2)}\n`, 'utf8');
+        writeFileSync(
+          lp,
+          `${JSON.stringify(localForPrune, null, 2)}\n`,
+          'utf8',
+        );
       }
 
       const merged = readMergedSettings(settingsPath);

package/server/settings-validator.js

@@ -36,8 +36,12 @@ const VALID_PRICING_FIELDS = [
   'cache_read_per_mtok',
 ];
 
-export function validateSettingsPayload(body) {
+export function validateSettingsPayload(body, options = {}) {
   const details = [];
+  const existingWorca =
+    options.existing && typeof options.existing === 'object'
+      ? options.existing.worca || {}
+      : {};
 
   if (body.worca !== undefined) {
     if (
@@ -49,7 +53,16 @@ export function validateSettingsPayload(body) {
       return { valid: false, details };
     }
     const w = body.worca;
-    const validModels = deriveValidModels(w);
+    // Sections like agents/pricing reference model keys that may live in another
+    // section saved earlier. Merge persisted models with body-supplied models so
+    // a single-section save (e.g. agents-only) doesn't reject custom models.
+    const mergedModels = {
+      ...(existingWorca.models && typeof existingWorca.models === 'object'
+        ? existingWorca.models
+        : {}),
+      ...(w.models && typeof w.models === 'object' ? w.models : {}),
+    };
+    const validModels = deriveValidModels({ models: mergedModels });
 
     // agents
     if (w.agents !== undefined) {
@@ -383,19 +396,91 @@ export function validateSettingsPayload(body) {
           ) {
             details.push('governance.dispatch must be an object');
           } else {
+            const DISPATCH_SECTIONS = ['tools', 'skills', 'subagents'];
             for (const [key, val] of Object.entries(g.dispatch)) {
-              if (!VALID_AGENTS.includes(key)) {
-                details.push(`Unknown dispatch agent: "${key}"`);
-                continue;
-              }
-              if (!Array.isArray(val)) {
-                details.push(`Dispatch for "${key}" must be an array`);
-                continue;
-              }
-              for (const v of val) {
-                if (typeof v !== 'string') {
-                  details.push(`Dispatch entry for "${key}" must be a string`);
+              if (DISPATCH_SECTIONS.includes(key)) {
+                // W-054 nested shape: dispatch.{tools,skills,subagents}
+                if (
+                  typeof val !== 'object' ||
+                  val === null ||
+                  Array.isArray(val)
+                ) {
+                  details.push(`governance.dispatch.${key} must be an object`);
+                  continue;
+                }
+                for (const tierKey of ['always_disallowed', 'default_denied']) {
+                  if (val[tierKey] === undefined) continue;
+                  if (!Array.isArray(val[tierKey])) {
+                    details.push(
+                      `governance.dispatch.${key}.${tierKey} must be an array`,
+                    );
+                    continue;
+                  }
+                  for (const entry of val[tierKey]) {
+                    if (typeof entry !== 'string') {
+                      details.push(
+                        `governance.dispatch.${key}.${tierKey} entries must be strings`,
+                      );
+                    }
+                  }
+                }
+                if (val.per_agent_allow !== undefined) {
+                  if (
+                    typeof val.per_agent_allow !== 'object' ||
+                    val.per_agent_allow === null ||
+                    Array.isArray(val.per_agent_allow)
+                  ) {
+                    details.push(
+                      `governance.dispatch.${key}.per_agent_allow must be an object`,
+                    );
+                  } else {
+                    for (const [agent, allowList] of Object.entries(
+                      val.per_agent_allow,
+                    )) {
+                      if (
+                        agent !== '_defaults' &&
+                        !VALID_AGENTS.includes(agent) &&
+                        agent !== 'workspace_planner'
+                      ) {
+                        details.push(
+                          `governance.dispatch.${key}.per_agent_allow: unknown agent "${agent}"`,
+                        );
+                        continue;
+                      }
+                      if (!Array.isArray(allowList)) {
+                        details.push(
+                          `governance.dispatch.${key}.per_agent_allow.${agent} must be an array`,
+                        );
+                        continue;
+                      }
+                      for (const entry of allowList) {
+                        if (typeof entry !== 'string') {
+                          details.push(
+                            `governance.dispatch.${key}.per_agent_allow.${agent} entries must be strings`,
+                          );
+                        }
+                      }
+                    }
+                  }
+                }
+              } else if (
+                VALID_AGENTS.includes(key) ||
+                key === 'workspace_planner'
+              ) {
+                // Pre-W-054 legacy flat shape — tolerated for migration.
+                if (!Array.isArray(val)) {
+                  details.push(`Dispatch for "${key}" must be an array`);
+                  continue;
+                }
+                for (const v of val) {
+                  if (typeof v !== 'string') {
+                    details.push(
+                      `Dispatch entry for "${key}" must be a string`,
+                    );
+                  }
                 }
+              } else {
+                details.push(`Unknown dispatch key: "${key}"`);
               }
             }
           }

package/server/watcher.js

@@ -157,6 +157,7 @@ export function discoverRuns(worcaDir) {
               ...status,
               worktree_worca_dir: join(reg.worktree_path, '.worca'),
               is_worktree_run: true,
+              head_branch: reg.branch || null,
               fleet_id: reg.fleet_id || null,
               workspace_id: reg.workspace_id || null,
               group_type: reg.group_type || null,
@@ -311,6 +312,7 @@ export async function discoverRunsAsync(worcaDir) {
         ...status,
         worktree_worca_dir: join(reg.worktree_path, '.worca'),
         is_worktree_run: true,
+        head_branch: reg.branch || null,
         fleet_id: reg.fleet_id || null,
         workspace_id: reg.workspace_id || null,
         group_type: reg.group_type || null,

package/server/worktrees-routes.js

@@ -20,6 +20,7 @@ import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import { join } from 'node:path';
 import { Router } from 'express';
+import { getDefaultBranch } from './git-helpers.js';
 import { pruneWorktrees, removeWorktree } from './worktree-ops.js';
 
 const CLEANUP_CONCURRENCY = 4;
@@ -362,6 +363,7 @@ async function _listWorktrees(worcaDir) {
     started_at: m.reg.started_at || null,
     status: m.status,
     removable: m.status !== 'running',
+    target_branch: m.reg.target_branch || null,
     fleet_id: m.reg.fleet_id || null,
     workspace_id: m.reg.workspace_id || null,
     group_type: m.reg.group_type || null,
@@ -399,9 +401,11 @@ export function createWorktreesRouter() {
     }
     try {
       const worktrees = await _listWorktrees(worcaDir);
+      const default_branch = getDefaultBranch(req.project?.projectRoot);
       res.json({
         ok: true,
         worktrees,
+        default_branch,
         // Documents the semantics shift in `disk_bytes` (project files only).
         // Clients can render this as a caveat next to disk totals.
         disk_walk_skip_dirs: [...WALK_SKIP_DIRS],

package/server/ws-message-router.js

@@ -682,14 +682,32 @@ export function createMessageRouter({
         ws.send(JSON.stringify(makeOk(req, { issues: [], runId })));
         return;
       }
-      const issues = await listIssuesByLabel(beadsDbPath, `run:${runId}`);
-      console.log(
-        '[list-beads-by-run] runId=%s count=%d statuses=%o',
-        runId,
-        issues.length,
-        issues.map((i) => i.status),
-      );
-      ws.send(JSON.stringify(makeOk(req, { issues, runId })));
+      try {
+        const issues = await listIssuesByLabel(beadsDbPath, `run:${runId}`);
+        console.log(
+          '[list-beads-by-run] runId=%s count=%d statuses=%o',
+          runId,
+          issues.length,
+          issues.map((i) => i.status),
+        );
+        ws.send(JSON.stringify(makeOk(req, { issues, runId })));
+      } catch (err) {
+        // Don't return empty issues on failure — the UI would treat that as
+        // "all beads deleted" and tear down the open <sl-details> panel. Let
+        // the client keep its last-known-good state until the next poll.
+        console.warn(
+          `[list-beads-by-run] runId=${runId} failed: ${err?.message || err}`,
+        );
+        ws.send(
+          JSON.stringify(
+            makeError(
+              req,
+              'beads_unavailable',
+              `bd query failed: ${err?.message || err}`,
+            ),
+          ),
+        );
+      }
       return;
     }