@worca/ui 0.44.0 → 0.45.0

package/server/settings-merge.js

@@ -82,28 +82,75 @@ export function readLocalSettings(settingsPath) {
   }
 }
 
+// Cross-tier merge atomic paths. Entries at these paths replace wholesale
+// when the project tier defines them — they do NOT deep-merge across
+// user-global ↔ project. Within-tier id+env still merges (the settings.json /
+// settings.local.json sibling pair is one logical tier). Mirrors the Python
+// _ATOMIC_LEAF_PATHS list in src/worca/utils/settings.py.
+const ATOMIC_LEAF_PATHS = [
+  ['worca', 'models'],
+  ['worca', 'pricing', 'models'],
+];
+
+function replaceAtomicSubkeys(merged, override, path) {
+  let nodeMerged = merged;
+  let nodeOverride = override;
+  for (const segment of path) {
+    if (
+      !nodeMerged ||
+      typeof nodeMerged !== 'object' ||
+      Array.isArray(nodeMerged) ||
+      !(segment in nodeMerged)
+    )
+      return;
+    if (
+      !nodeOverride ||
+      typeof nodeOverride !== 'object' ||
+      Array.isArray(nodeOverride) ||
+      !(segment in nodeOverride)
+    )
+      return;
+    nodeMerged = nodeMerged[segment];
+    nodeOverride = nodeOverride[segment];
+  }
+  if (
+    !nodeMerged ||
+    typeof nodeMerged !== 'object' ||
+    Array.isArray(nodeMerged) ||
+    !nodeOverride ||
+    typeof nodeOverride !== 'object' ||
+    Array.isArray(nodeOverride)
+  )
+    return;
+  for (const [key, value] of Object.entries(nodeOverride)) {
+    nodeMerged[key] = value;
+  }
+}
+
 /**
  * Read the full effective settings stack the way the Python runtime resolves
  * it: user-global base → user-global .local → project base → project .local.
- * Each layer deep-merges over the previous. Missing files are treated as
- * empty objects. Used by UI surfaces (model alias dropdowns, etc.) that must
- * mirror what `worca.utils.settings.resolve_model` sees at run time.
+ * Each layer deep-merges over the previous, EXCEPT entries under
+ * worca.models.* and worca.pricing.models.* which replace wholesale across
+ * tiers (project shadows user shadows builtin per alias). Missing files are
+ * treated as empty objects.
  *
  * `globalSettingsPath` is passed in so callers can substitute it during
  * tests; production callers thread the result of `paths.globalSettingsPath()`.
  */
 export function readEffectiveSettings(projectSettingsPath, globalSettingsPath) {
-  const layers = [];
+  const userLayers = [];
+  const projectLayers = [];
   if (globalSettingsPath) {
     try {
-      layers.push(JSON.parse(readFileSync(globalSettingsPath, 'utf8')));
+      userLayers.push(JSON.parse(readFileSync(globalSettingsPath, 'utf8')));
     } catch {
       /* missing or invalid — treat as empty */
     }
     const globalLocal = localPathFor(globalSettingsPath);
     if (existsSync(globalLocal)) {
       try {
-        layers.push(JSON.parse(readFileSync(globalLocal, 'utf8')));
+        userLayers.push(JSON.parse(readFileSync(globalLocal, 'utf8')));
       } catch {
         /* invalid — skip */
       }
@@ -111,18 +158,30 @@ export function readEffectiveSettings(projectSettingsPath, globalSettingsPath) {
   }
   if (projectSettingsPath) {
     try {
-      layers.push(JSON.parse(readFileSync(projectSettingsPath, 'utf8')));
+      projectLayers.push(JSON.parse(readFileSync(projectSettingsPath, 'utf8')));
     } catch {
       /* missing or invalid — treat as empty */
     }
     const projectLocal = localPathFor(projectSettingsPath);
     if (existsSync(projectLocal)) {
       try {
-        layers.push(JSON.parse(readFileSync(projectLocal, 'utf8')));
+        projectLayers.push(JSON.parse(readFileSync(projectLocal, 'utf8')));
       } catch {
         /* invalid — skip */
       }
     }
   }
-  return layers.reduce((acc, layer) => deepMerge(acc, layer), {});
+  const userMerged = userLayers.reduce(
+    (acc, layer) => deepMerge(acc, layer),
+    {},
+  );
+  const projectMerged = projectLayers.reduce(
+    (acc, layer) => deepMerge(acc, layer),
+    {},
+  );
+  const merged = deepMerge(userMerged, projectMerged);
+  for (const path of ATOMIC_LEAF_PATHS) {
+    replaceAtomicSubkeys(merged, projectMerged, path);
+  }
+  return merged;
 }

package/server/templates-routes.js

@@ -404,6 +404,7 @@ function _baseImportArgs(
   dstTier,
   resolutionsPath,
   onModelConflict,
+  bundleLabel,
 ) {
   const args = [
     'import',
@@ -419,9 +420,31 @@ function _baseImportArgs(
   if (onModelConflict) {
     args.push('--on-model-conflict', onModelConflict);
   }
+  if (bundleLabel) {
+    // Pass the user-visible filename so `_imported_from` is stamped with
+    // (e.g.) `feature-glm-ds-bundle.zip` instead of the server-side temp
+    // name `bundle.zip`. Optional — falls back to source basename in CLI.
+    args.push('--bundle-label', bundleLabel);
+  }
   return args;
 }
 
+// Bundle filename is forwarded by the UI as an HTTP header so the
+// imported-from attribution badge shows the user-facing name rather than
+// the server-side temp `bundle.zip`. Sanitize lightly: reject paths /
+// slashes / oversized values to keep argv hygiene.
+const _BUNDLE_LABEL_HEADER = 'x-bundle-filename';
+function _readBundleLabel(req) {
+  const raw = req.headers[_BUNDLE_LABEL_HEADER];
+  if (typeof raw !== 'string' || raw.length === 0 || raw.length > 256) {
+    return null;
+  }
+  if (raw.includes('/') || raw.includes('\\') || raw.includes('\0')) {
+    return null;
+  }
+  return raw;
+}
+
 function handleZipImport(req, res) {
   const dstTier = req.query.dst_tier;
   if (!isValidTier(dstTier)) {
@@ -435,6 +458,7 @@ function handleZipImport(req, res) {
   const zipBuffer = req.body;
   const resolutions = _parseResolutionsHeader(req);
   const onModelConflict = req.query.on_model_conflict || null;
+  const bundleLabel = _readBundleLabel(req);
   const dir = mkdtempSync(join(tmpdir(), 'worca-import-'));
   const tmpPath = join(dir, 'bundle.zip');
   try {
@@ -442,7 +466,13 @@ function handleZipImport(req, res) {
     const resolutionsPath = _writeResolutionsFile(dir, resolutions);
     const stdout = runWorcaTemplates(
       req.project.projectRoot,
-      _baseImportArgs(tmpPath, dstTier, resolutionsPath, onModelConflict),
+      _baseImportArgs(
+        tmpPath,
+        dstTier,
+        resolutionsPath,
+        onModelConflict,
+        bundleLabel,
+      ),
       { timeout: 60000 },
     );
     const imported = [];
@@ -538,10 +568,12 @@ function handleJsonImport(req, res) {
     });
   }
   if (rejectBuiltinWrite(res, dstTier, 'import to')) return;
+  const bundleLabel = _readBundleLabel(req);
   try {
     const result = importBundle(req.project.projectRoot, bundle, dstTier, {
       resolutions,
       onModelConflict,
+      bundleLabel,
     });
     res.json({ ok: true, ...result });
   } catch (err) {
@@ -555,7 +587,7 @@ function importBundle(projectRoot, bundle, tier, opts = {}) {
   if (!bundle || !Array.isArray(bundle.templates)) {
     throw new Error('Bundle must contain a "templates" array');
   }
-  const { resolutions, onModelConflict } = opts;
+  const { resolutions, onModelConflict, bundleLabel } = opts;
   const dir = mkdtempSync(join(tmpdir(), 'worca-import-'));
   const bundlePath = join(dir, 'bundle.json');
   try {
@@ -563,7 +595,13 @@ function importBundle(projectRoot, bundle, tier, opts = {}) {
     const resolutionsPath = _writeResolutionsFile(dir, resolutions);
     runWorcaTemplates(
       projectRoot,
-      _baseImportArgs(bundlePath, tier, resolutionsPath, onModelConflict),
+      _baseImportArgs(
+        bundlePath,
+        tier,
+        resolutionsPath,
+        onModelConflict,
+        bundleLabel,
+      ),
       { timeout: 60000 },
     );
     const targetDir = dirForTier(projectRoot, tier);