@worca/ui 0.8.1 → 0.9.0-rc.2

package/server/project-routes.js

@@ -20,9 +20,11 @@ import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { Router } from 'express';
 import { dbExists, getIssue, listIssues } from './beads-reader.js';
+import { ensureWebhookForUi } from './ensure-webhook.js';
 import { readPreferences } from './preferences.js';
 import { ProcessManager } from './process-manager.js';
 import {
+  getMaxProjects,
   readProjects,
   removeProject,
   SLUG_RE,
@@ -36,6 +38,8 @@ import {
   readMergedSettings,
 } from './settings-merge.js';
 import { validateSettingsPayload } from './settings-validator.js';
+import { isVersionBehind } from './version-check.js';
+import { getVersionInfo } from './versions.js';
 import { discoverRuns } from './watcher.js';
 import {
   checkWorcaInstalled,
@@ -135,7 +139,12 @@ export function projectResolver({ prefsDir, projectRoot }) {
 /**
  * Router for project CRUD: GET/POST/DELETE /api/projects[/:id]
  */
-export function createProjectRoutes({ prefsDir, projectRoot }) {
+export function createProjectRoutes({
+  prefsDir,
+  projectRoot,
+  serverHost,
+  serverPort,
+}) {
   const router = Router();
 
   // GET /api/projects — list all projects (or synthesized default)
@@ -166,6 +175,17 @@ export function createProjectRoutes({ prefsDir, projectRoot }) {
     }
     try {
       writeProject(prefsDir, entry);
+      // Auto-configure webhook so pipeline events reach this UI server
+      if (serverHost && serverPort) {
+        try {
+          ensureWebhookForUi(entry.path, {
+            host: serverHost,
+            port: serverPort,
+          });
+        } catch {
+          /* best-effort — don't fail project creation */
+        }
+      }
       res.status(201).json({ ok: true, project: entry });
     } catch (err) {
       res.status(400).json({ ok: false, error: err.message });
@@ -182,15 +202,128 @@ export function createProjectRoutes({ prefsDir, projectRoot }) {
     res.json({ ok: true, removed: id });
   });
 
+  // POST /api/projects/batch — register multiple projects atomically
+  router.post('/batch', (req, res) => {
+    const { projects: batch } = req.body || {};
+    if (!Array.isArray(batch) || batch.length === 0) {
+      return res
+        .status(400)
+        .json({ ok: false, error: 'projects must be a non-empty array' });
+    }
+
+    // Validate all entries first (all-or-nothing)
+    const failed = [];
+    for (const entry of batch) {
+      const validation = validateProjectEntry(entry);
+      if (!validation.valid) {
+        failed.push({ name: entry?.name ?? '', error: validation.error });
+        continue;
+      }
+      if (!existsSync(entry.path)) {
+        failed.push({
+          name: entry.name,
+          error: `directory does not exist: ${entry.path}`,
+        });
+      }
+    }
+    if (failed.length > 0) {
+      return res.status(400).json({
+        ok: false,
+        error: `${failed.length} project${failed.length > 1 ? 's' : ''} failed validation`,
+        failed,
+      });
+    }
+
+    // Check for intra-batch duplicate names
+    const batchNames = batch.map((e) => e?.name).filter(Boolean);
+    if (new Set(batchNames).size < batchNames.length) {
+      return res
+        .status(400)
+        .json({ ok: false, error: 'Duplicate names within batch' });
+    }
+
+    // Check for intra-batch duplicate paths
+    const batchPaths = batch.map((e) => e?.path).filter(Boolean);
+    if (new Set(batchPaths).size < batchPaths.length) {
+      return res
+        .status(400)
+        .json({ ok: false, error: 'Duplicate paths within batch' });
+    }
+
+    // Check for duplicate paths against existing projects
+    const existing = readProjects(prefsDir);
+    const existingPaths = new Set(
+      existing.map((p) => p.path.replace(/\/+$/, '')),
+    );
+    const duplicates = batch.filter((entry) =>
+      existingPaths.has(entry.path.replace(/\/+$/, '')),
+    );
+    if (duplicates.length > 0) {
+      return res.status(400).json({
+        ok: false,
+        error: `${duplicates.length} project${duplicates.length > 1 ? 's' : ''} already registered`,
+        failed: duplicates.map((entry) => ({
+          name: entry.name,
+          error: `path already registered: ${entry.path}`,
+        })),
+      });
+    }
+
+    // Check max projects limit
+    const max = getMaxProjects(prefsDir);
+    if (existing.length + batch.length > max) {
+      return res.status(400).json({
+        ok: false,
+        error: `adding ${batch.length} project${batch.length > 1 ? 's' : ''} would exceed the limit of ${max}`,
+      });
+    }
+
+    // Write all projects — roll back on partial failure
+    const written = [];
+    try {
+      for (const entry of batch) {
+        writeProject(prefsDir, entry);
+        written.push(entry.name);
+        if (serverHost && serverPort) {
+          try {
+            ensureWebhookForUi(entry.path, {
+              host: serverHost,
+              port: serverPort,
+            });
+          } catch {
+            /* best-effort */
+          }
+        }
+      }
+      res.status(201).json({ ok: true, projects: batch });
+    } catch (err) {
+      for (const name of written) {
+        try {
+          removeProject(prefsDir, name);
+        } catch {
+          // ignore rollback errors
+        }
+      }
+      res.status(400).json({ ok: false, error: err.message });
+    }
+  });
+
   return router;
 }
 
 /**
  * Router for project-scoped sub-routes.
  * The projectResolver middleware must run before this to set req.project.
+ * @param {{ prefsDir?: string|null }} [options] — prefsDir enables active
+ *   worca-cc version lookup for /worca-status' `outdated` flag.
  */
-export function createProjectScopedRoutes() {
+export function createProjectScopedRoutes({
+  prefsDir = null,
+  serverHost,
+  serverPort,
+} = {}) {
   const router = Router({ mergeParams: true });
+  const prefsPath = prefsDir ? join(prefsDir, 'preferences.json') : null;
 
   // Guard: run-related, cost, and pipeline routes require worcaDir
   function requireWorcaDir(req, res, next) {
@@ -1213,10 +1346,35 @@ export function createProjectScopedRoutes() {
     res.json({ ok: true, templates });
   });
 
-  // GET /api/projects/:projectId/worca-status — check worca installation state
-  router.get('/worca-status', (req, res) => {
-    const installed = checkWorcaInstalled(req.project.projectRoot);
-    res.json({ ok: true, installed });
+  // GET /api/projects/:projectId/worca-status — check worca installation state.
+  // `outdated` is true when the project's installed worca-cc version is
+  // strictly behind the active (dev-path or globally-installed) worca-cc.
+  router.get('/worca-status', async (req, res) => {
+    const { projectRoot } = req.project;
+    const installed = checkWorcaInstalled(projectRoot);
+    if (!installed) {
+      return res.json({
+        ok: true,
+        installed: false,
+        version: null,
+        outdated: false,
+      });
+    }
+    const version = readProjectWorcaVersion(projectRoot);
+    let outdated = false;
+    if (version != null) {
+      try {
+        const versionInfo = await getVersionInfo({
+          prefsPath,
+          worcaVersion: req.app.locals.worcaVersion || null,
+        });
+        outdated = isVersionBehind(version, versionInfo.activeWorcaCc);
+      } catch {
+        // Best-effort — if version lookup fails, treat as not outdated
+        outdated = false;
+      }
+    }
+    res.json({ ok: true, installed: true, version, outdated });
   });
 
   // POST /api/projects/:projectId/worca-setup — install or update worca
@@ -1238,6 +1396,17 @@ export function createProjectScopedRoutes() {
 
     try {
       const { pid } = runWorcaSetup(projectRoot, { source });
+      // Auto-configure webhook so pipeline events reach this UI server
+      if (serverHost && serverPort) {
+        try {
+          ensureWebhookForUi(projectRoot, {
+            host: serverHost,
+            port: serverPort,
+          });
+        } catch {
+          /* best-effort */
+        }
+      }
       res.json({ ok: true, pid });
     } catch (err) {
       res.status(500).json({ ok: false, error: err.message });

package/server/settings-validator.js

@@ -323,8 +323,35 @@ export function validateSettingsPayload(body) {
                 continue;
               }
               for (const v of val) {
-                if (!VALID_AGENTS.includes(v)) {
-                  details.push(`Unknown agent "${v}" in dispatch for "${key}"`);
+                if (typeof v !== 'string') {
+                  details.push(`Dispatch entry for "${key}" must be a string`);
+                }
+              }
+            }
+          }
+        }
+        if (g.subagent_dispatch !== undefined) {
+          if (
+            typeof g.subagent_dispatch !== 'object' ||
+            g.subagent_dispatch === null ||
+            Array.isArray(g.subagent_dispatch)
+          ) {
+            details.push('governance.subagent_dispatch must be an object');
+          } else {
+            for (const [key, val] of Object.entries(g.subagent_dispatch)) {
+              if (!VALID_AGENTS.includes(key)) {
+                details.push(`Unknown subagent_dispatch agent: "${key}"`);
+                continue;
+              }
+              if (!Array.isArray(val)) {
+                details.push(`subagent_dispatch for "${key}" must be an array`);
+                continue;
+              }
+              for (const v of val) {
+                if (typeof v !== 'string') {
+                  details.push(
+                    `subagent_dispatch entry for "${key}" must be a string`,
+                  );
                 }
               }
             }
@@ -505,3 +532,253 @@ export function validateSettingsPayload(body) {
 
   return details.length ? { valid: false, details } : { valid: true };
 }
+
+const VALID_WEBHOOK_OUT_FORMATS = [
+  'generic-json',
+  'slack-compatible',
+  'discord-compatible',
+  'teams-card',
+  'ntfy',
+  'plain-text',
+];
+
+export function validateIntegrationsConfig(cfg) {
+  const details = [];
+
+  if (cfg.schema_version === undefined || cfg.schema_version !== 1) {
+    details.push('schema_version must be present and equal to 1');
+  }
+
+  if (cfg.enabled !== undefined && typeof cfg.enabled !== 'boolean') {
+    details.push('enabled must be a boolean');
+  }
+
+  if (cfg.webhook_secret_env !== undefined) {
+    if (
+      typeof cfg.webhook_secret_env !== 'string' ||
+      cfg.webhook_secret_env.length === 0
+    ) {
+      details.push('webhook_secret_env must be a non-empty string');
+    }
+  }
+
+  if (cfg.webhook_secrets_env !== undefined) {
+    if (
+      typeof cfg.webhook_secrets_env !== 'string' ||
+      cfg.webhook_secrets_env.length === 0
+    ) {
+      details.push('webhook_secrets_env must be a non-empty string');
+    }
+  }
+
+  if (
+    cfg.strict_inbox_verification !== undefined &&
+    typeof cfg.strict_inbox_verification !== 'boolean'
+  ) {
+    details.push('strict_inbox_verification must be a boolean');
+  }
+
+  // telegram
+  if (cfg.telegram !== undefined) {
+    if (
+      typeof cfg.telegram !== 'object' ||
+      cfg.telegram === null ||
+      Array.isArray(cfg.telegram)
+    ) {
+      details.push('telegram must be an object');
+    } else {
+      const tg = cfg.telegram;
+      if (tg.enabled !== undefined && typeof tg.enabled !== 'boolean') {
+        details.push('telegram.enabled must be a boolean');
+      }
+      const hasTgToken =
+        (typeof tg.bot_token === 'string' && tg.bot_token.length > 0) ||
+        (typeof tg.bot_token_env === 'string' && tg.bot_token_env.length > 0);
+      if (!hasTgToken) {
+        details.push(
+          'telegram requires bot_token or bot_token_env (non-empty string)',
+        );
+      }
+      if (
+        tg.chat_id === undefined ||
+        (typeof tg.chat_id !== 'string' && typeof tg.chat_id !== 'number')
+      ) {
+        details.push('telegram.chat_id must be a string or number');
+      }
+      if (tg.events === undefined || !Array.isArray(tg.events)) {
+        details.push('telegram.events must be an array');
+      } else {
+        for (let i = 0; i < tg.events.length; i++) {
+          if (typeof tg.events[i] !== 'string' || tg.events[i].length === 0) {
+            details.push(`telegram.events[${i}] must be a non-empty string`);
+          }
+        }
+      }
+      if (tg.rate_limit_per_min !== undefined) {
+        if (
+          !Number.isInteger(tg.rate_limit_per_min) ||
+          tg.rate_limit_per_min < 1
+        ) {
+          details.push(
+            'telegram.rate_limit_per_min must be a positive integer',
+          );
+        }
+      }
+    }
+  }
+
+  // discord
+  if (cfg.discord !== undefined) {
+    if (
+      typeof cfg.discord !== 'object' ||
+      cfg.discord === null ||
+      Array.isArray(cfg.discord)
+    ) {
+      details.push('discord must be an object');
+    } else {
+      const dc = cfg.discord;
+      if (dc.enabled !== undefined && typeof dc.enabled !== 'boolean') {
+        details.push('discord.enabled must be a boolean');
+      }
+      const hasDcToken =
+        (typeof dc.bot_token === 'string' && dc.bot_token.length > 0) ||
+        (typeof dc.bot_token_env === 'string' && dc.bot_token_env.length > 0);
+      if (!hasDcToken) {
+        details.push(
+          'discord requires bot_token or bot_token_env (non-empty string)',
+        );
+      }
+      if (
+        dc.channel_id === undefined ||
+        typeof dc.channel_id !== 'string' ||
+        dc.channel_id.length === 0
+      ) {
+        details.push('discord.channel_id must be a non-empty string');
+      }
+      if (dc.events !== undefined && !Array.isArray(dc.events)) {
+        details.push('discord.events must be an array');
+      } else if (Array.isArray(dc.events)) {
+        for (let i = 0; i < dc.events.length; i++) {
+          if (typeof dc.events[i] !== 'string' || dc.events[i].length === 0) {
+            details.push(`discord.events[${i}] must be a non-empty string`);
+          }
+        }
+      }
+    }
+  }
+
+  // slack
+  if (cfg.slack !== undefined) {
+    if (
+      typeof cfg.slack !== 'object' ||
+      cfg.slack === null ||
+      Array.isArray(cfg.slack)
+    ) {
+      details.push('slack must be an object');
+    } else {
+      const sl = cfg.slack;
+      if (sl.enabled !== undefined && typeof sl.enabled !== 'boolean') {
+        details.push('slack.enabled must be a boolean');
+      }
+      const hasSlUrl =
+        (typeof sl.webhook_url === 'string' && sl.webhook_url.length > 0) ||
+        (typeof sl.webhook_url_env === 'string' &&
+          sl.webhook_url_env.length > 0);
+      if (!hasSlUrl) {
+        details.push(
+          'slack requires webhook_url or webhook_url_env (non-empty string)',
+        );
+      }
+      if (sl.events !== undefined && !Array.isArray(sl.events)) {
+        details.push('slack.events must be an array');
+      } else if (Array.isArray(sl.events)) {
+        for (let i = 0; i < sl.events.length; i++) {
+          if (typeof sl.events[i] !== 'string' || sl.events[i].length === 0) {
+            details.push(`slack.events[${i}] must be a non-empty string`);
+          }
+        }
+      }
+    }
+  }
+
+  // webhook_out
+  if (cfg.webhook_out !== undefined) {
+    if (
+      typeof cfg.webhook_out !== 'object' ||
+      cfg.webhook_out === null ||
+      Array.isArray(cfg.webhook_out)
+    ) {
+      details.push('webhook_out must be an object');
+    } else {
+      const wo = cfg.webhook_out;
+      if (wo.enabled !== undefined && typeof wo.enabled !== 'boolean') {
+        details.push('webhook_out.enabled must be a boolean');
+      }
+      if (wo.endpoints !== undefined) {
+        if (!Array.isArray(wo.endpoints)) {
+          details.push('webhook_out.endpoints must be an array');
+        } else {
+          for (let i = 0; i < wo.endpoints.length; i++) {
+            const ep = wo.endpoints[i];
+            const pfx = `webhook_out.endpoints[${i}]`;
+            if (typeof ep !== 'object' || ep === null || Array.isArray(ep)) {
+              details.push(`${pfx} must be an object`);
+              continue;
+            }
+            if (
+              ep.url === undefined ||
+              typeof ep.url !== 'string' ||
+              ep.url.trim().length === 0
+            ) {
+              details.push(`${pfx}.url must be a non-empty string`);
+            } else {
+              try {
+                const parsed = new URL(ep.url);
+                if (
+                  parsed.protocol !== 'http:' &&
+                  parsed.protocol !== 'https:'
+                ) {
+                  details.push(`${pfx}.url must use http or https protocol`);
+                }
+              } catch {
+                details.push(`${pfx}.url is not a valid URL`);
+              }
+            }
+            if (ep.format !== undefined) {
+              if (!VALID_WEBHOOK_OUT_FORMATS.includes(ep.format)) {
+                details.push(
+                  `${pfx}.format must be one of: ${VALID_WEBHOOK_OUT_FORMATS.join(', ')}`,
+                );
+              }
+            }
+            if (ep.headers !== undefined) {
+              if (
+                typeof ep.headers !== 'object' ||
+                ep.headers === null ||
+                Array.isArray(ep.headers)
+              ) {
+                details.push(`${pfx}.headers must be an object`);
+              }
+            }
+            if (ep.events !== undefined && !Array.isArray(ep.events)) {
+              details.push(`${pfx}.events must be an array`);
+            } else if (Array.isArray(ep.events)) {
+              for (let j = 0; j < ep.events.length; j++) {
+                if (
+                  typeof ep.events[j] !== 'string' ||
+                  ep.events[j].length === 0
+                ) {
+                  details.push(
+                    `${pfx}.events[${j}] must be a non-empty string`,
+                  );
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  return details.length ? { valid: false, details } : { valid: true };
+}

package/server/subagents-discovery.js

@@ -0,0 +1,116 @@
+/**
+ * Subagent discovery for the settings dispatch-rule editor.
+ *
+ * Walks three sources (built-ins, user-global, plugin cache) and returns a
+ * deduplicated list matching the shape used by `worca-ui/app/views/
+ * dispatch-tag-state.js` (`{name, label, group}`).
+ *
+ * The three sources:
+ *   1. Built-ins — hardcoded Claude Code types that are not on disk.
+ *   2. User — `<userDir>/*.md`, one file per subagent.
+ *   3. Plugins — `<pluginCacheDir>/<marketplace>/<plugin>/<version>/agents/*.md`.
+ *      Deduped by the qualified name `<plugin>:<agent>` — first file wins
+ *      across versions (the set of agents within a plugin is stable in
+ *      practice; when two versions disagree we prefer filesystem order for
+ *      determinism rather than trying to parse semver from directory names).
+ */
+
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { basename, join } from 'node:path';
+
+// Built-in Claude Code subagents — shipped with a factory CC install, no
+// plugins required. Mirror this list in worca-ui/app/views/
+// dispatch-tag-state.js (KNOWN_TYPES) so the UI falls back to the same set
+// when the /api/subagents fetch fails.
+export const BUILTINS = [
+  { name: 'Explore', label: '(built-in)', group: 'Built-in' },
+  { name: 'general-purpose', label: '(built-in)', group: 'Built-in' },
+  { name: 'Plan', label: '(built-in)', group: 'Built-in' },
+  { name: 'statusline-setup', label: '(built-in)', group: 'Built-in' },
+  { name: 'claude-code-guide', label: '(built-in)', group: 'Built-in' },
+];
+
+function listMarkdownBasenames(dir) {
+  if (!dir || !existsSync(dir)) return [];
+  try {
+    return readdirSync(dir)
+      .filter((n) => n.endsWith('.md'))
+      .map((n) => basename(n, '.md'));
+  } catch {
+    return [];
+  }
+}
+
+function listSubdirs(dir) {
+  if (!existsSync(dir)) return [];
+  try {
+    return readdirSync(dir).filter((n) => {
+      try {
+        return statSync(join(dir, n)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Discover all subagent types reachable from the given directories.
+ *
+ * @param {object} options
+ * @param {Array<{name:string,label:string,group:string}>} [options.builtins]
+ * @param {string} [options.userDir]           e.g. ~/.claude/agents
+ * @param {string} [options.pluginCacheDir]    e.g. ~/.claude/plugins/cache
+ * @param {string} [options.projectAgentsDir]  e.g. <project>/.claude/agents
+ * @returns {Array<{name:string,label:string,group:string}>}
+ */
+export function discoverSubagents({
+  builtins = BUILTINS,
+  userDir,
+  pluginCacheDir,
+  projectAgentsDir,
+} = {}) {
+  const result = [...builtins];
+  const seen = new Set(result.map((t) => t.name));
+
+  for (const name of listMarkdownBasenames(userDir)) {
+    if (!seen.has(name)) {
+      seen.add(name);
+      result.push({ name, label: '(user)', group: 'User' });
+    }
+  }
+
+  if (pluginCacheDir && existsSync(pluginCacheDir)) {
+    for (const marketplace of listSubdirs(pluginCacheDir)) {
+      const marketplaceDir = join(pluginCacheDir, marketplace);
+      for (const plugin of listSubdirs(marketplaceDir)) {
+        const pluginDir = join(marketplaceDir, plugin);
+        for (const version of listSubdirs(pluginDir)) {
+          const agentsDir = join(pluginDir, version, 'agents');
+          for (const agent of listMarkdownBasenames(agentsDir)) {
+            const qualified = `${plugin}:${agent}`;
+            if (!seen.has(qualified)) {
+              seen.add(qualified);
+              result.push({
+                name: qualified,
+                label: '(plugin)',
+                group: 'Plugin',
+              });
+            }
+          }
+        }
+      }
+    }
+  }
+
+  for (const name of listMarkdownBasenames(projectAgentsDir)) {
+    if (!seen.has(name)) {
+      seen.add(name);
+      result.push({ name, label: '(project)', group: 'Project' });
+    }
+  }
+
+  return result;
+}

package/server/version-check.js

@@ -40,6 +40,41 @@ export function meetsMinimum(installed, minimum) {
   return true; // equal
 }
 
+/**
+ * Parse a version string into comparable parts, tracking RC suffixes.
+ * "0.6.0rc7" → { parts: [0, 6, 0], rc: 7 }
+ * "0.6.0"    → { parts: [0, 6, 0], rc: Infinity } (stable > any rc)
+ * "0.1.0-rc.5" → { parts: [0, 1, 0], rc: 5 }
+ */
+export function parseVersion(v) {
+  if (!v) return { parts: [], rc: Infinity };
+  const rcMatch = v.match(/^(.+?)[-.]?rc\.?(\d+)$/);
+  const base = rcMatch ? rcMatch[1] : v;
+  const rc = rcMatch ? parseInt(rcMatch[2], 10) : Infinity;
+  const parts = base.split('.').map((s) => parseInt(s, 10) || 0);
+  return { parts, rc };
+}
+
+/**
+ * Returns true if `project` version is strictly behind `active`.
+ * RC-aware: "0.6.0rc3" is behind "0.6.0". Returns false if either arg is falsy.
+ */
+export function isVersionBehind(project, active) {
+  if (!project || !active) return false;
+  const p = parseVersion(project);
+  const a = parseVersion(active);
+  const len = Math.max(p.parts.length, a.parts.length);
+  for (let i = 0; i < len; i++) {
+    const pv = p.parts[i] || 0;
+    const av = a.parts[i] || 0;
+    if (pv < av) return true;
+    if (pv > av) return false;
+  }
+  // Same base version — compare RC numbers
+  if (p.rc < a.rc) return true;
+  return false;
+}
+
 /**
  * Run `worca --version` and check compatibility.
  * @returns {Promise<{ok: boolean, installed: string|null, minimum: string, message: string}>}