@worca/ui 0.28.0 → 0.30.0

package/app/styles.css

@@ -1978,14 +1978,12 @@ sl-input [slot="prefix"] {
 }
 
 .dispatch-chip-locked {
-  text-decoration: line-through;
   opacity: 0.6;
 }
 
-/* Auto-included meta-tool chips (Skill, Agent) — locked but not crossed-out;
- * the line-through reads as "blocked", but these are present-and-required. */
+/* Auto-included meta-tool chips (Skill, Agent) — locked but visually distinct
+ * via the dashed border; present-and-required rather than blocked. */
 .dispatch-chip-auto {
-  text-decoration: none;
   opacity: 0.75;
   font-style: italic;
   border-style: dashed;
@@ -2005,6 +2003,16 @@ sl-input [slot="prefix"] {
   font-size: 10px;
 }
 
+/* Inherits-defaults placeholder — shown when per-agent entry is an empty
+ * list, which the resolver treats as fall-through to _defaults. Visually
+ * lighter than lockdown so the two states are easy to distinguish. */
+.dispatch-chip-inherits {
+  text-decoration: none;
+  opacity: 0.6;
+  font-style: italic;
+  font-size: 10px;
+}
+
 .dispatch-chip-warn {
   --sl-color-neutral-200: var(--sl-color-warning-200);
   background: var(--sl-color-warning-100);
@@ -2015,6 +2023,21 @@ sl-input [slot="prefix"] {
   margin-bottom: 16px;
 }
 
+/* Header row: optional section title on the left, per-section Reset on the
+ * right. Rendered at the top of each dispatch panel body (visible only when the
+ * sl-details is expanded). */
+.dispatch-section-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  min-height: 28px;
+}
+
+.dispatch-section-reset {
+  margin-left: auto;
+}
+
 .dispatch-section-title {
   font-size: 14px;
   font-weight: 600;
@@ -6450,3 +6473,43 @@ sl-dialog.markdown-dialog::part(body) {
 .conflict-icon {
   color: var(--status-blocked);
 }
+
+/* Graphify cache location — selectable monospace path (W-053 cache relocation) */
+.graphify-codebox {
+  display: block;
+  margin: 0.25rem 0 0.75rem;
+  padding: 0.4rem 0.6rem;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-subtle);
+  border-radius: var(--radius);
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 0.85rem;
+  color: var(--fg);
+  word-break: break-all;
+  user-select: all;
+}
+
+/* A monospace value/command box with a copy button pinned to the right. */
+.graphify-copy-row {
+  display: flex;
+  align-items: center;
+  gap: 0.4rem;
+  margin: 0.25rem 0 0.75rem;
+}
+
+.graphify-copy-row .graphify-codebox {
+  flex: 1;
+  min-width: 0;
+  margin: 0;
+}
+
+/* Shown when the graphify CLI is missing/incompatible. */
+.graphify-not-installed {
+  margin: 0 0 0.75rem;
+}
+
+/* Caution color (action needed: install) on the message text only — not the
+   install-command code box, which keeps normal monospace styling. */
+.graphify-not-installed .settings-tab-description {
+  color: var(--status-paused);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@worca/ui",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Pipeline monitoring UI for worca-cc",
   "license": "MIT",
   "author": "Sinisha Djukic",

package/server/app.js

@@ -2,7 +2,13 @@
 
 import { execFile, execFileSync, spawn } from 'node:child_process';
 import { createHmac, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,13 +16,19 @@ import express from 'express';
 
 import { dbExists, getIssue, listIssues } from './beads-reader.js';
 import { createFleetRouter } from './fleet-routes.js';
+import {
+  _effectiveConfig,
+  clearRepoCache,
+  createGraphifyStatus,
+  snapshotDir,
+} from './graphify-status.js';
 import { RAW_BODY } from './integrations/index.js';
 import { verify } from './integrations/verify.js';
 import { LaunchLock } from './launch-lock.js';
 import { fleetRunsDir, workspaceRunsDir, workspacesDir } from './paths.js';
 import { createPreferencesRouter } from './preferences-routes.js';
 import { ProcessManager } from './process-manager.js';
-import { scanDirectory } from './project-registry.js';
+import { readProjects, scanDirectory } from './project-registry.js';
 import {
   createProjectRoutes,
   createProjectScopedRoutes,
@@ -994,6 +1006,154 @@ export function createApp(options = {}) {
     res.json({ ok: true, path: configPath });
   });
 
+  // ─── Graphify endpoints ──────────────────────────────────────────────
+  if (!app.locals.graphifyStatus) {
+    app.locals.graphifyStatus = createGraphifyStatus({});
+  }
+
+  // Resolve the graphify settings for a request. In single-project mode the
+  // server's own projectRoot/settingsPath are used. In global mode there is no
+  // fixed project, so the selected project is passed as ?project=<id> and we
+  // resolve its root + settings.json from the registry — otherwise the endpoint
+  // would be blind to every project and only ever see global settings.
+  function readGraphifySettings(projectId) {
+    const readJson = (p) => {
+      if (!p) return {};
+      try {
+        return JSON.parse(readFileSync(p, 'utf-8'));
+      } catch {
+        return {};
+      }
+    };
+    const globalSettingsPath = prefsDir
+      ? join(prefsDir, 'settings.json')
+      : settingsPath;
+
+    let projectSettingsPath = settingsPath;
+    let root = projectRoot || process.cwd();
+    if (projectId && prefsDir) {
+      const proj = readProjects(prefsDir).find((p) => p.name === projectId);
+      if (proj) {
+        projectSettingsPath =
+          proj.settingsPath || join(proj.path, '.claude', 'settings.json');
+        root = proj.path;
+      }
+    } else if (!projectSettingsPath && projectRoot) {
+      projectSettingsPath = join(projectRoot, '.claude', 'settings.json');
+    }
+
+    return {
+      globalSettings: readJson(globalSettingsPath),
+      projectSettings: readJson(projectSettingsPath),
+      root,
+    };
+  }
+
+  async function graphifyStatusPayload(projectId) {
+    const { globalSettings, projectSettings, root } =
+      readGraphifySettings(projectId);
+    const result = await app.locals.graphifyStatus.getStatus({
+      globalSettings,
+      projectSettings,
+      projectRoot: root,
+    });
+    return { ...result, building: Boolean(app.locals.graphifyBuilding) };
+  }
+
+  app.get('/api/graphify/status', async (req, res) => {
+    try {
+      res.json(await graphifyStatusPayload(req.query.project));
+    } catch (err) {
+      res.status(500).json({ ok: false, error: err.message });
+    }
+  });
+
+  app.post('/api/graphify/recheck', async (req, res) => {
+    try {
+      app.locals.graphifyStatus.invalidate();
+      res.json(await graphifyStatusPayload(req.query.project));
+    } catch (err) {
+      res.status(500).json({ ok: false, error: err.message });
+    }
+  });
+
+  // Build/refresh the current HEAD's cache snapshot (async, long-running).
+  // The lock + .complete publish discipline lives in run_graphify_preflight,
+  // so we drive it via a detached Python process and track a `building` flag
+  // the UI polls through /api/graphify/status.
+  app.post('/api/graphify/build', async (req, res) => {
+    try {
+      const { globalSettings, projectSettings, root } = readGraphifySettings(
+        req.query.project,
+      );
+      const effective = _effectiveConfig(globalSettings, projectSettings);
+      if (!effective.enabled) {
+        return res
+          .status(400)
+          .json({ ok: false, error: 'Graphify is not enabled' });
+      }
+      const detection = await app.locals.graphifyStatus.detect();
+      if (!detection.installed || !detection.compatible) {
+        return res.status(400).json({
+          ok: false,
+          error:
+            detection.error || 'Graphify is not installed or not compatible',
+        });
+      }
+      if (app.locals.graphifyBuilding) {
+        return res.json({ ok: true, status: 'building' });
+      }
+      // Fresh build for the current HEAD: clear its snapshot first.
+      const snap = snapshotDir(root);
+      if (snap) {
+        try {
+          rmSync(snap, { recursive: true, force: true });
+        } catch {}
+      }
+      app.locals.graphifyBuilding = true;
+      const child = spawn(
+        'python3',
+        [
+          '-c',
+          'from worca.scripts.graphify_preflight import run_graphify_preflight as r; r()',
+        ],
+        { cwd: root, stdio: 'ignore' },
+      );
+      const done = () => {
+        app.locals.graphifyBuilding = false;
+        app.locals.graphifyStatus.invalidate();
+      };
+      child.on('exit', done);
+      child.on('error', done);
+      res.json({ ok: true, status: 'building' });
+    } catch (err) {
+      app.locals.graphifyBuilding = false;
+      res.status(500).json({ ok: false, error: err.message });
+    }
+  });
+
+  // Clear ALL cached snapshots for this project's repo.
+  app.post('/api/graphify/clear', async (req, res) => {
+    try {
+      const { root } = readGraphifySettings(req.query.project);
+      const cleared = clearRepoCache(root);
+      app.locals.graphifyStatus.invalidate();
+      res.json({ ok: true, cleared });
+    } catch (err) {
+      res.status(500).json({ ok: false, error: err.message });
+    }
+  });
+
+  app.get('/api/graphify/graph.html', (req, res) => {
+    const { root } = readGraphifySettings(req.query.project);
+    const snap = snapshotDir(root);
+    const htmlPath = snap ? join(snap, 'graphify', 'graph.html') : null;
+    if (!htmlPath || !existsSync(htmlPath)) {
+      return res.status(404).json({ ok: false, error: 'graph.html not found' });
+    }
+    res.sendFile(htmlPath);
+  });
+
   // ─── Dynamic favicon ──────────────────────────────────────────────────
   // Serve mode-specific favicon before express.static so it takes precedence.
   app.get('/favicon.svg', (_req, res) => {

package/server/dispatch-defaults.js

@@ -18,7 +18,22 @@ export const DISPATCH_DEFAULTS = {
       'fewer-permission-prompts',
       'loop',
       'schedule',
-      'worca-*',
+      // worca-* dev skills that genuinely must stay off-limits to pipeline
+      // agents: release/publish, PR merges, cross-repo sync, installation,
+      // agent/governance override (privilege escalation), pipeline launch
+      // (recursion), and autonomous issue/plan creation. The rest of the
+      // worca-* dev tooling (precommit, coverage, ui/event scaffolding,
+      // webhook-test, issue read) is allowed via the per-agent '*' wildcard.
+      'worca-release',
+      'worca-rc',
+      'worca-pr-prep',
+      'worca-install',
+      'worca-sync',
+      'worca-sync-commit',
+      'worca-sync-pr',
+      'worca-agent-override',
+      'worca-analyze',
+      'worca-plan-new',
       'update-config',
       'hookify:hookify',
       'hookify:configure',

package/server/dispatch-migration.js

@@ -55,12 +55,141 @@ function _absorbFlatDispatchKeys(dispatch) {
   return true;
 }
 
+// --- One-time dispatch-default normalization (W-054 follow-up) -------------
+//
+// Mirror of normalize_dispatch_defaults() in src/worca/hooks/tracking.py.
+// Bumped when a new one-time normalization is added; stamped onto
+// governance.dispatch_migration_version so it runs exactly once per config.
+export const DISPATCH_MIGRATION_VERSION = 1;
+
+// Pre-W-054 (W-038-era) shipped subagent default: every pipeline agent capped
+// to Explore-only. coordinator:[] / empty lists fall through to _defaults and
+// are ignored in the comparison.
+const _LEGACY_EXPLORE_SUBAGENT_DEFAULT = {
+  planner: ['Explore'],
+  implementer: ['Explore'],
+  tester: ['Explore'],
+  guardian: ['Explore'],
+  reviewer: ['Explore'],
+  plan_reviewer: ['Explore'],
+  learner: ['Explore'],
+};
+
+// Pre-narrowing skills denylist (carried the broad `worca-*` glob).
+const _LEGACY_SKILLS_ALWAYS_DISALLOWED = new Set([
+  'batch',
+  'fewer-permission-prompts',
+  'loop',
+  'schedule',
+  'worca-*',
+  'update-config',
+  'hookify:hookify',
+  'hookify:configure',
+  'hookify:list',
+  'hookify:writing-rules',
+  'init',
+]);
+
+function _canonicalPerAgent(perAgent) {
+  const out = {};
+  for (const [agent, allow] of Object.entries(perAgent)) {
+    if (agent === '_defaults') continue;
+    if (!Array.isArray(allow) || allow.length === 0) continue;
+    out[agent] = [...allow].sort();
+  }
+  return out;
+}
+
+function _sameStringMap(a, b) {
+  const ak = Object.keys(a);
+  const bk = Object.keys(b);
+  if (ak.length !== bk.length) return false;
+  for (const k of ak) {
+    const av = a[k];
+    const bv = b[k];
+    if (!Array.isArray(bv) || av.length !== bv.length) return false;
+    for (let i = 0; i < av.length; i++) {
+      if (av[i] !== bv[i]) return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * Collapse a stale Explore-only per_agent_allow to the new `_defaults: ["*"]`
+ * default. Only fires on the untouched W-038 shape with an unset/wildcard
+ * _defaults. Returns true if changed.
+ */
+export function adoptStaleSubagentDefault(subagentsCfg) {
+  if (!subagentsCfg || typeof subagentsCfg !== 'object') return false;
+  const pa = subagentsCfg.per_agent_allow;
+  if (!pa || typeof pa !== 'object' || Array.isArray(pa)) return false;
+  const def = pa._defaults;
+  const defOk =
+    def === undefined ||
+    (Array.isArray(def) && def.length === 1 && def[0] === '*');
+  if (!defOk) return false;
+  const expected = _canonicalPerAgent(_LEGACY_EXPLORE_SUBAGENT_DEFAULT);
+  if (!_sameStringMap(_canonicalPerAgent(pa), expected)) return false;
+  subagentsCfg.per_agent_allow = { _defaults: ['*'] };
+  return true;
+}
+
+/**
+ * Widen an untouched skills denylist (broad `worca-*`) to the current set.
+ * Exact-match (set) guarded. Returns true if changed.
+ */
+export function adoptNarrowedSkillsDenylist(skillsCfg) {
+  if (!skillsCfg || typeof skillsCfg !== 'object') return false;
+  const current = skillsCfg.always_disallowed;
+  if (!Array.isArray(current)) return false;
+  if (current.length !== _LEGACY_SKILLS_ALWAYS_DISALLOWED.size) return false;
+  for (const item of current) {
+    if (!_LEGACY_SKILLS_ALWAYS_DISALLOWED.has(item)) return false;
+  }
+  skillsCfg.always_disallowed = [...DISPATCH_DEFAULTS.skills.always_disallowed];
+  return true;
+}
+
+/**
+ * Apply one-time dispatch-default normalizations, gated by a version stamp.
+ * Brings an *untouched* config up to current shipped defaults for the two
+ * things that changed after W-054 (subagent per_agent_allow, skills denylist).
+ * Mutates governanceCfg; returns change descriptions.
+ */
+export function normalizeDispatchDefaults(governanceCfg) {
+  const changes = [];
+  if (!governanceCfg || typeof governanceCfg !== 'object') return changes;
+  let stamp = governanceCfg.dispatch_migration_version;
+  if (!Number.isInteger(stamp)) stamp = 0;
+  if (stamp >= DISPATCH_MIGRATION_VERSION) return changes;
+  const dispatch = governanceCfg.dispatch;
+  if (!dispatch || typeof dispatch !== 'object' || Array.isArray(dispatch)) {
+    return changes;
+  }
+  if (adoptStaleSubagentDefault(dispatch.subagents)) {
+    changes.push(
+      'governance.dispatch.subagents: adopted new default (_defaults:["*"]) for config pinned to legacy Explore-only set',
+    );
+  }
+  if (adoptNarrowedSkillsDenylist(dispatch.skills)) {
+    changes.push(
+      'governance.dispatch.skills.always_disallowed: narrowed legacy "worca-*" glob to the current must-disallow set',
+    );
+  }
+  governanceCfg.dispatch_migration_version = DISPATCH_MIGRATION_VERSION;
+  return changes;
+}
+
 /**
  * Migrate legacy governance.subagent_dispatch and/or legacy flat
- * governance.dispatch (agent-keyed) → governance.dispatch.subagents.per_agent_allow.
+ * governance.dispatch (agent-keyed) → governance.dispatch.subagents.per_agent_allow,
+ * then apply the one-time dispatch-default normalization.
  *
- * Seeds _defaults, adds tools/skills defaults, drops _dispatch_legacy.
- * Idempotent — returns [] on already-migrated configs.
+ * Seeds _defaults, adds tools/skills defaults, drops _dispatch_legacy. The
+ * normalization runs even with no legacy shape so already-migrated configs
+ * pinned to the stale Explore-only subagent default (or the broad `worca-*`
+ * skills glob) self-heal on next save. Gated by a version stamp → idempotent.
  *
  * @param {object} worcaConfig — the `worca` object from settings (mutated)
  * @returns {string[]} list of change descriptions (empty = no-op)
@@ -73,60 +202,64 @@ export function migrateDispatchGovernance(worcaConfig) {
   const hasSubagentDispatch = 'subagent_dispatch' in gov;
   const hasLegacyFlatDispatch = _isLegacyFlatDispatch(gov.dispatch);
 
-  if (!hasSubagentDispatch && !hasLegacyFlatDispatch) return changes;
+  if (hasSubagentDispatch || hasLegacyFlatDispatch) {
+    if (!gov.dispatch || Array.isArray(gov.dispatch)) gov.dispatch = {};
+    const dispatch = gov.dispatch;
 
-  if (!gov.dispatch || Array.isArray(gov.dispatch)) gov.dispatch = {};
-  const dispatch = gov.dispatch;
+    // Absorb legacy flat shape (pre-W-038) first so subagent_dispatch values
+    // take precedence below.
+    if (hasLegacyFlatDispatch) {
+      _absorbFlatDispatchKeys(dispatch);
+      changes.push(
+        'governance.dispatch (flat agent-keyed) -> governance.dispatch.subagents (W-054)',
+      );
+    }
 
-  // Absorb legacy flat shape (pre-W-038) first so subagent_dispatch values
-  // take precedence below.
-  if (hasLegacyFlatDispatch) {
-    _absorbFlatDispatchKeys(dispatch);
-    changes.push(
-      'governance.dispatch (flat agent-keyed) -> governance.dispatch.subagents (W-054)',
-    );
-  }
+    if (hasSubagentDispatch) {
+      const old = gov.subagent_dispatch;
+      delete gov.subagent_dispatch;
+      if (!dispatch.subagents) dispatch.subagents = {};
+      if (!dispatch.subagents.per_agent_allow) {
+        dispatch.subagents.per_agent_allow = {};
+      }
+      Object.assign(dispatch.subagents.per_agent_allow, old);
+      changes.push(
+        'governance.subagent_dispatch -> governance.dispatch.subagents (W-054)',
+      );
+    }
 
-  if (hasSubagentDispatch) {
-    const old = gov.subagent_dispatch;
-    delete gov.subagent_dispatch;
     if (!dispatch.subagents) dispatch.subagents = {};
-    if (!dispatch.subagents.per_agent_allow) {
-      dispatch.subagents.per_agent_allow = {};
-    }
-    Object.assign(dispatch.subagents.per_agent_allow, old);
-    changes.push(
-      'governance.subagent_dispatch -> governance.dispatch.subagents (W-054)',
-    );
-  }
+    const subagents = dispatch.subagents;
 
-  if (!dispatch.subagents) dispatch.subagents = {};
-  const subagents = dispatch.subagents;
+    if (!subagents.per_agent_allow) subagents.per_agent_allow = {};
+    if (!('_defaults' in subagents.per_agent_allow)) {
+      subagents.per_agent_allow._defaults = [
+        ...DISPATCH_DEFAULTS.subagents.per_agent_allow._defaults,
+      ];
+    }
 
-  if (!subagents.per_agent_allow) subagents.per_agent_allow = {};
-  if (!('_defaults' in subagents.per_agent_allow)) {
-    subagents.per_agent_allow._defaults = [
-      ...DISPATCH_DEFAULTS.subagents.per_agent_allow._defaults,
-    ];
-  }
+    if (!subagents.always_disallowed) {
+      subagents.always_disallowed = [
+        ...DISPATCH_DEFAULTS.subagents.always_disallowed,
+      ];
+    }
+    if (!subagents.default_denied) {
+      subagents.default_denied = [
+        ...DISPATCH_DEFAULTS.subagents.default_denied,
+      ];
+    }
 
-  if (!subagents.always_disallowed) {
-    subagents.always_disallowed = [
-      ...DISPATCH_DEFAULTS.subagents.always_disallowed,
-    ];
-  }
-  if (!subagents.default_denied) {
-    subagents.default_denied = [...DISPATCH_DEFAULTS.subagents.default_denied];
-  }
+    if (!dispatch.tools) {
+      dispatch.tools = structuredClone(DISPATCH_DEFAULTS.tools);
+    }
+    if (!dispatch.skills) {
+      dispatch.skills = structuredClone(DISPATCH_DEFAULTS.skills);
+    }
 
-  if (!dispatch.tools) {
-    dispatch.tools = structuredClone(DISPATCH_DEFAULTS.tools);
-  }
-  if (!dispatch.skills) {
-    dispatch.skills = structuredClone(DISPATCH_DEFAULTS.skills);
+    delete gov._dispatch_legacy;
   }
 
-  delete gov._dispatch_legacy;
+  changes.push(...normalizeDispatchDefaults(gov));
 
   return changes;
 }