acdev 1.0.0

package/src/server.js

@@ -0,0 +1,988 @@
+import express from 'express';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Store } from './store.js';
+import { parseIssueUrl, createPr, fetchIssueDetails } from './github.js';
+import {
+  parseJiraIssueRef,
+  resolveJiraCredentials,
+  testJiraConnection,
+  fetchJiraIssue,
+  mapJiraIssueType,
+} from './jira.js';
+import { applyAfterPrOpenedRules } from './afterPrRules.js';
+import {
+  syncBaseBranch,
+  createWorktree,
+  removeWorktree,
+  getDiff,
+  pushBranch,
+  detectIssueType,
+  buildBranchName,
+  sanitizeBranchCommits,
+  listChangedFiles,
+  applyFileExclusions,
+  normalizeExcludedPaths,
+  validateFileSelection,
+  parseChangedFilesFromDiff,
+} from './git.js';
+import {
+  runAgentOnIssue,
+  runAgentOnReviewFeedback,
+  stripAiAttribution,
+} from './agent.js';
+import { publicConfig, updateConfig } from './config.js';
+import { upsertEnvVars } from './env.js';
+import { splitIssueUrls } from './urls.js';
+import { usageFromLogs, withJobUsage } from './usage.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+/** Statuses where clearing a job is refused (safer than force-fail). */
+const IN_FLIGHT_STATUSES = new Set([
+  'running',
+  'syncing',
+  'preparing_worktree',
+  'applying_feedback',
+]);
+
+/** Statuses allowed for DELETE /api/jobs/:id */
+const CLEARABLE_STATUSES = new Set([
+  'queued',
+  'awaiting_review',
+  'pr_opened',
+  'discarded',
+  'failed',
+]);
+
+/**
+ * Worktree directory id: Jira key or GitHub issue number.
+ * @param {{ jiraKey?: string, issueNumber?: number }} job
+ * @returns {string | number | null}
+ */
+function worktreeIdForJob(job) {
+  if (job.jiraKey) return job.jiraKey;
+  if (job.issueNumber != null) return job.issueNumber;
+  return null;
+}
+
+/**
+ * Dedup key for an active job (GitHub URL or Jira key).
+ * @param {{ issueUrl?: string, jiraKey?: string, ticketSource?: string }} job
+ */
+function jobDedupeKey(job) {
+  if (job.ticketSource === 'jira' || job.jiraKey) {
+    return `jira:${String(job.jiraKey || '').toUpperCase()}`;
+  }
+  return `github:${job.issueUrl}`;
+}
+/**
+ * Normalize + validate POST /api/jobs/:id/review body.
+ * @param {unknown} body
+ * @returns {{
+ *   ok: true,
+ *   generalComment: string,
+ *   lineComments: Array<{ path: string, line: number, side: 'LEFT' | 'RIGHT', body: string }>,
+ * } | { ok: false, error: string }}
+ */
+export function normalizeReviewComments(body) {
+  const generalComment =
+    typeof body?.generalComment === 'string' ? body.generalComment.trim() : '';
+
+  if (body?.generalComment != null && typeof body.generalComment !== 'string') {
+    return { ok: false, error: 'generalComment must be a string' };
+  }
+
+  const rawLines = body?.lineComments;
+  if (rawLines != null && !Array.isArray(rawLines)) {
+    return { ok: false, error: 'lineComments must be an array' };
+  }
+
+  /** @type {Array<{ path: string, line: number, side: 'LEFT' | 'RIGHT', body: string }>} */
+  const lineComments = [];
+  for (const item of rawLines || []) {
+    if (!item || typeof item !== 'object') {
+      return { ok: false, error: 'Each line comment must be an object' };
+    }
+    const pathStr = typeof item.path === 'string' ? item.path.trim() : '';
+    const commentBody = typeof item.body === 'string' ? item.body.trim() : '';
+    const side = item.side === 'LEFT' || item.side === 'RIGHT' ? item.side : null;
+    const line = Number(item.line);
+    if (!pathStr) {
+      return { ok: false, error: 'Each line comment requires a non-empty path' };
+    }
+    if (!commentBody) {
+      return { ok: false, error: 'Each line comment requires a non-empty body' };
+    }
+    if (!side) {
+      return { ok: false, error: 'Each line comment side must be LEFT or RIGHT' };
+    }
+    if (!Number.isInteger(line) || line < 1) {
+      return { ok: false, error: 'Each line comment requires a positive integer line' };
+    }
+    lineComments.push({ path: pathStr, line, side, body: commentBody });
+  }
+
+  if (!generalComment && lineComments.length === 0) {
+    return {
+      ok: false,
+      error: 'At least one non-empty generalComment or lineComment is required',
+    };
+  }
+
+  return { ok: true, generalComment, lineComments };
+}
+
+/**
+ * @param {{
+ *   repoRoot: string,
+ *   config: object,
+ *   store: Store,
+ *   useStubAgent?: boolean,
+ *   deps?: {
+ *     pushBranch?: typeof pushBranch,
+ *     createPr?: typeof createPr,
+ *     getDiff?: typeof getDiff,
+ *     listChangedFiles?: typeof listChangedFiles,
+ *     applyFileExclusions?: typeof applyFileExclusions,
+ *     transitionJiraIssue?: Function,
+ *     addIssueLabel?: Function,
+ *     closeIssue?: Function,
+ *     resolveJiraCredentials?: Function,
+ *   },
+ * }} options
+ */
+export function createServer({ repoRoot, config, store, useStubAgent = false, deps = {} }) {
+  const app = express();
+  const publicDir = path.join(__dirname, '..', 'public');
+  app.use(express.json());
+
+  const doPushBranch = deps.pushBranch || pushBranch;
+  const doCreatePr = deps.createPr || createPr;
+  const doGetDiff = deps.getDiff || getDiff;
+  const doListChangedFiles = deps.listChangedFiles || listChangedFiles;
+  const doApplyFileExclusions = deps.applyFileExclusions || applyFileExclusions;
+
+  /** @type {Map<string, Set<import('http').ServerResponse>>} */
+  const subscribers = new Map();
+  let queueRunning = false;
+
+  function emitEvent(jobId, event) {
+    const subs = subscribers.get(jobId);
+    if (!subs) return;
+    const data = JSON.stringify(event);
+    for (const res of subs) {
+      res.write(`data: ${data}\n\n`);
+    }
+  }
+
+  function appendLog(job, type, payload) {
+    const event = {
+      ts: new Date().toISOString(),
+      type,
+      payload,
+    };
+    const logs = [...(job.logs || []), event];
+    return store.updateJob(job.id, { logs });
+  }
+
+  function setStatus(jobId, status, extra = {}) {
+    if (!store.getJob(jobId)) return undefined;
+    const job = store.updateJob(jobId, { status, ...extra });
+    appendLog(job, 'status', status);
+    const updated = store.getJob(jobId);
+    if (updated?.logs?.length) {
+      emitEvent(jobId, updated.logs[updated.logs.length - 1]);
+    }
+    return updated;
+  }
+
+  async function runJob(jobId) {
+    let job = store.getJob(jobId);
+    if (!job) return;
+
+    try {
+      job = setStatus(jobId, 'syncing');
+      if (!job) return;
+      await syncBaseBranch(repoRoot, config.baseBranch);
+
+      job = setStatus(jobId, 'preparing_worktree');
+      if (!job) return;
+
+      const isJira = job.ticketSource === 'jira' || Boolean(job.jiraKey);
+      let issueTitle;
+      let issueType;
+      /** @type {object | undefined} */
+      let jiraIssue;
+
+      if (isJira) {
+        const creds = resolveJiraCredentials({ configBaseUrl: config.jiraBaseUrl });
+        if ('error' in creds) {
+          throw new Error(creds.error);
+        }
+        const key = job.jiraKey || parseJiraIssueRef(job.issueUrl, { baseUrl: creds.baseUrl }).key;
+        jiraIssue = await fetchJiraIssue(key, creds);
+        issueTitle = jiraIssue.summary;
+        issueType = mapJiraIssueType(jiraIssue.issueType);
+        if (!store.getJob(jobId)) return;
+        // Prefer canonical browse URL from API
+        store.updateJob(jobId, {
+          issueUrl: jiraIssue.browseUrl,
+          jiraKey: jiraIssue.key,
+          ticketSource: 'jira',
+        });
+        job = store.getJob(jobId);
+        if (!job) return;
+      } else {
+        const issueDetails = await fetchIssueDetails(job.issueUrl, repoRoot);
+        issueTitle = issueDetails.title;
+        issueType = detectIssueType(issueDetails);
+      }
+
+      const desiredBranchName = buildBranchName(issueType, issueTitle);
+      const worktreeId = worktreeIdForJob(job);
+      if (worktreeId == null) {
+        throw new Error('Job is missing issueNumber / jiraKey for worktree path');
+      }
+      const { branchName, worktreePath } = await createWorktree(
+        repoRoot,
+        worktreeId,
+        config.baseBranch,
+        desiredBranchName
+      );
+      if (!store.getJob(jobId)) return;
+      store.updateJob(jobId, {
+        branchName,
+        worktreePath,
+        issueTitle,
+        issueType,
+      });
+
+      job = setStatus(jobId, 'running');
+      if (!job) return;
+      const onEvent = (message) => {
+        const current = store.getJob(jobId);
+        if (!current) return;
+        const event = {
+          ts: new Date().toISOString(),
+          type: 'agent_event',
+          payload: message,
+        };
+        const logs = [...(current.logs || []), event];
+        store.updateJob(jobId, { logs });
+        emitEvent(jobId, event);
+      };
+
+      const { prTitle, prBody, usage } = await runAgentOnIssue({
+        issueUrl: job.issueUrl,
+        worktreePath,
+        config,
+        onEvent,
+        stub: useStubAgent,
+        branchName,
+        issueNumber: job.issueNumber,
+        ticketSource: isJira ? 'jira' : 'github',
+        jiraKey: job.jiraKey,
+        jiraIssue,
+      });
+
+      if (!store.getJob(jobId)) return;
+
+      // Safety net: strip Co-Authored-By / Claude trailers before review & push.
+      await sanitizeBranchCommits(worktreePath, config.baseBranch, repoRoot);
+
+      if (!store.getJob(jobId)) return;
+
+      const diff = await doGetDiff(worktreePath, config.baseBranch);
+      const patch = {
+        diff,
+        prTitle: stripAiAttribution(prTitle),
+        prBody: stripAiAttribution(prBody),
+      };
+      if (usage) patch.usage = usage;
+      setStatus(jobId, 'awaiting_review', patch);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const current = store.getJob(jobId);
+      if (!current) return;
+      appendLog(current, 'error', message);
+      const afterLog = store.getJob(jobId);
+      const usage = usageFromLogs(afterLog?.logs);
+      const failPatch = {
+        status: 'failed',
+        error: message,
+      };
+      if (usage) failPatch.usage = usage;
+      store.updateJob(jobId, failPatch);
+      const updated = store.getJob(jobId);
+      if (updated?.logs?.length) {
+        emitEvent(jobId, updated.logs[updated.logs.length - 1]);
+      }
+    }
+  }
+
+  /**
+   * Apply human review feedback on the existing worktree/branch (no sync/recreate).
+   * @param {string} jobId
+   */
+  async function runFeedbackJob(jobId) {
+    let job = store.getJob(jobId);
+    if (!job || job.status !== 'applying_feedback') return;
+
+    const feedback = job.pendingReviewFeedback;
+    if (!feedback || (!feedback.generalComment && !(feedback.lineComments || []).length)) {
+      const message = 'Missing review feedback payload';
+      appendLog(job, 'error', message);
+      store.updateJob(jobId, { status: 'failed', error: message, pendingReviewFeedback: undefined });
+      return;
+    }
+
+    if (!job.worktreePath) {
+      const message = 'Job has no worktree; cannot apply review feedback';
+      appendLog(job, 'error', message);
+      store.updateJob(jobId, { status: 'failed', error: message, pendingReviewFeedback: undefined });
+      return;
+    }
+
+    try {
+      const onEvent = (message) => {
+        const current = store.getJob(jobId);
+        if (!current) return;
+        const event = {
+          ts: new Date().toISOString(),
+          type: 'agent_event',
+          payload: message,
+        };
+        const logs = [...(current.logs || []), event];
+        store.updateJob(jobId, { logs });
+        emitEvent(jobId, event);
+      };
+
+      const { prTitle, prBody, usage } = await runAgentOnReviewFeedback({
+        issueUrl: job.issueUrl,
+        worktreePath: job.worktreePath,
+        config,
+        generalComment: feedback.generalComment || '',
+        lineComments: feedback.lineComments || [],
+        onEvent,
+        stub: useStubAgent,
+        branchName: job.branchName,
+        issueNumber: job.issueNumber,
+        ticketSource: job.ticketSource === 'jira' || job.jiraKey ? 'jira' : 'github',
+        jiraKey: job.jiraKey,
+      });
+
+      if (!store.getJob(jobId)) return;
+
+      await sanitizeBranchCommits(job.worktreePath, config.baseBranch, repoRoot);
+
+      if (!store.getJob(jobId)) return;
+
+      const diff = await doGetDiff(job.worktreePath, config.baseBranch);
+      const patch = {
+        diff,
+        prTitle: stripAiAttribution(prTitle),
+        prBody: stripAiAttribution(prBody),
+        pendingReviewFeedback: undefined,
+      };
+      if (usage) patch.usage = usage;
+      setStatus(jobId, 'awaiting_review', patch);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const current = store.getJob(jobId);
+      if (!current) return;
+      appendLog(current, 'error', message);
+      const afterLog = store.getJob(jobId);
+      const usage = usageFromLogs(afterLog?.logs);
+      const failPatch = {
+        status: 'failed',
+        error: message,
+        pendingReviewFeedback: undefined,
+      };
+      if (usage) failPatch.usage = usage;
+      store.updateJob(jobId, failPatch);
+      const updated = store.getJob(jobId);
+      if (updated?.logs?.length) {
+        emitEvent(jobId, updated.logs[updated.logs.length - 1]);
+      }
+    }
+  }
+
+  async function processQueue() {
+    if (queueRunning) return;
+    queueRunning = true;
+    try {
+      while (true) {
+        // Prefer review-feedback rework over new queued issues (same mutex).
+        const feedback = store.getJobs().find((j) => j.status === 'applying_feedback');
+        if (feedback) {
+          await runFeedbackJob(feedback.id);
+          continue;
+        }
+        const queued = store.getJobs().find((j) => j.status === 'queued');
+        if (!queued) break;
+        await runJob(queued.id);
+      }
+    } catch (err) {
+      console.error('[acdev] Queue runner error:', err);
+    } finally {
+      queueRunning = false;
+    }
+  }
+
+  app.get('/api/jobs', (_req, res) => {
+    try {
+      // Backfill usage from logs for older jobs that never got a first-class field.
+      res.json(store.getJobs().map(withJobUsage));
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.get('/api/config', (_req, res) => {
+    try {
+      res.json(publicConfig(config, { repoRoot }));
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.patch('/api/config', (req, res) => {
+    try {
+      const patch = req.body || {};
+
+      // Jira secrets → .env (never persisted in config.json)
+      /** @type {Record<string, string | null>} */
+      const envPatch = {};
+      if (patch.jiraEmail !== undefined) {
+        const email =
+          typeof patch.jiraEmail === 'string' ? patch.jiraEmail.trim() : '';
+        envPatch.JIRA_EMAIL = email || null;
+      }
+      if (patch.jiraApiToken !== undefined) {
+        const token =
+          typeof patch.jiraApiToken === 'string' ? patch.jiraApiToken.trim() : '';
+        // Empty string means "leave unchanged" when token already set — only clear if null
+        if (patch.jiraApiToken === null) {
+          envPatch.JIRA_API_TOKEN = null;
+        } else if (token) {
+          envPatch.JIRA_API_TOKEN = token;
+        }
+      }
+      if (patch.jiraBaseUrl !== undefined && typeof patch.jiraBaseUrl === 'string') {
+        // Also mirror base URL into env for convenience when set via Settings
+        const trimmed = patch.jiraBaseUrl.trim();
+        if (trimmed) {
+          envPatch.JIRA_BASE_URL = trimmed;
+        }
+      }
+      if (Object.keys(envPatch).length > 0) {
+        upsertEnvVars(repoRoot, envPatch);
+      }
+
+      const {
+        jiraEmail: _e,
+        jiraApiToken: _t,
+        ...configPatch
+      } = patch;
+      updateConfig(repoRoot, config, configPatch);
+      res.json(publicConfig(config, { repoRoot }));
+    } catch (err) {
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  app.post('/api/jira/test', async (req, res) => {
+    try {
+      const body = req.body || {};
+      const creds = resolveJiraCredentials({
+        baseUrl: body.baseUrl || body.jiraBaseUrl,
+        email: body.email || body.jiraEmail,
+        apiToken: body.apiToken || body.jiraApiToken,
+        configBaseUrl: config.jiraBaseUrl,
+      });
+      if ('error' in creds) {
+        return res.status(400).json({ ok: false, error: creds.error });
+      }
+      const result = await testJiraConnection(creds);
+      if (!result.ok) {
+        return res.status(400).json(result);
+      }
+      res.json(result);
+    } catch (err) {
+      res.status(500).json({ ok: false, error: err.message });
+    }
+  });
+
+  app.post('/api/issues', (req, res) => {
+    try {
+      const urls = splitIssueUrls(req.body?.urls);
+      if (urls.length === 0) {
+        return res.status(400).json({
+          error:
+            'Request body must include a non-empty "urls" array (or a comma/newline-separated string).',
+        });
+      }
+
+      const ticketSource =
+        req.body?.ticketSource === 'jira' || req.body?.ticketSource === 'github'
+          ? req.body.ticketSource
+          : config.ticketSource === 'jira'
+            ? 'jira'
+            : 'github';
+
+      if (ticketSource === 'jira') {
+        const creds = resolveJiraCredentials({ configBaseUrl: config.jiraBaseUrl });
+        if ('error' in creds) {
+          return res.status(400).json({
+            error: creds.error,
+            code: 'jira_not_configured',
+          });
+        }
+      }
+
+      const invalidUrls = [];
+      /** @type {Array<{ url: string, ticketSource: 'github' | 'jira', number?: number, jiraKey?: string }>} */
+      const parsed = [];
+
+      for (const raw of urls) {
+        try {
+          if (ticketSource === 'jira') {
+            const ref = parseJiraIssueRef(raw, {
+              baseUrl: config.jiraBaseUrl || process.env.JIRA_BASE_URL,
+            });
+            parsed.push({
+              url: ref.browseUrl.startsWith('http') ? ref.browseUrl : ref.key,
+              ticketSource: 'jira',
+              jiraKey: ref.key,
+            });
+          } else {
+            // Auto-detect Jira-looking refs even when source is github? Prefer strict
+            // per ticketSource, but allow obvious browse URLs if they look like Jira.
+            if (/atlassian\.net\/browse\//i.test(raw) || /^[A-Z][A-Z0-9]+-\d+$/i.test(raw.trim())) {
+              invalidUrls.push(raw);
+              continue;
+            }
+            const gh = parseIssueUrl(raw);
+            parsed.push({
+              url: raw,
+              ticketSource: 'github',
+              number: gh.number,
+            });
+          }
+        } catch {
+          invalidUrls.push(raw);
+        }
+      }
+
+      if (invalidUrls.length > 0) {
+        return res.status(400).json({
+          error:
+            ticketSource === 'jira'
+              ? 'One or more values are not valid Jira issue keys or browse URLs.'
+              : 'One or more URLs are not valid GitHub issue URLs. Switch ticket source to Jira in Settings to enqueue Jira issues.',
+          invalidUrls,
+        });
+      }
+
+      const existing = store.getJobs();
+      const activeStatuses = new Set([
+        'queued',
+        'syncing',
+        'preparing_worktree',
+        'running',
+        'applying_feedback',
+        'awaiting_review',
+        'pr_opened',
+      ]);
+      const skipped = [];
+      const created = [];
+
+      for (const item of parsed) {
+        const key = jobDedupeKey({
+          issueUrl: item.url,
+          jiraKey: item.jiraKey,
+          ticketSource: item.ticketSource,
+        });
+        const duplicate = existing.find(
+          (j) =>
+            activeStatuses.has(j.status) &&
+            jobDedupeKey(j) === key
+        );
+        if (duplicate) {
+          skipped.push(item.jiraKey || item.url);
+          continue;
+        }
+        const job = store.addJob({
+          issueUrl: item.url,
+          issueNumber: item.number,
+          ticketSource: item.ticketSource,
+          jiraKey: item.jiraKey,
+        });
+        created.push(job);
+      }
+
+      res.json({ jobs: created, skipped });
+      processQueue().catch((err) => console.error('[acdev] processQueue failed:', err));
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.get('/api/jobs/:id/events', (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+
+      res.setHeader('Content-Type', 'text/event-stream');
+      res.setHeader('Cache-Control', 'no-cache');
+      res.setHeader('Connection', 'keep-alive');
+      res.flushHeaders?.();
+
+      for (const event of job.logs || []) {
+        res.write(`data: ${JSON.stringify(event)}\n\n`);
+      }
+
+      if (!subscribers.has(job.id)) {
+        subscribers.set(job.id, new Set());
+      }
+      subscribers.get(job.id).add(res);
+
+      req.on('close', () => {
+        subscribers.get(job.id)?.delete(res);
+      });
+    } catch (err) {
+      if (!res.headersSent) {
+        res.status(500).json({ error: err.message });
+      }
+    }
+  });
+
+  app.get('/api/jobs/:id/files', async (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+
+      let files = [];
+      if (job.worktreePath) {
+        try {
+          files = await doListChangedFiles(job.worktreePath, config.baseBranch);
+        } catch (err) {
+          // Fall back to parsing the stored unified diff.
+          files = parseChangedFilesFromDiff(job.diff || '');
+          if (files.length === 0) {
+            const message = err instanceof Error ? err.message : String(err);
+            return res.status(500).json({ error: message });
+          }
+        }
+      } else {
+        files = parseChangedFilesFromDiff(job.diff || '');
+      }
+
+      res.json({ files, baseBranch: config.baseBranch });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post('/api/jobs/:id/review', (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+      if (job.status !== 'awaiting_review') {
+        return res.status(400).json({
+          error: `Job is not awaiting review (status: ${job.status})`,
+        });
+      }
+      if (!job.worktreePath) {
+        return res.status(400).json({
+          error: 'Job has no worktree; cannot apply review feedback',
+        });
+      }
+
+      const normalized = normalizeReviewComments(req.body);
+      if (!normalized.ok) {
+        return res.status(400).json({ error: normalized.error });
+      }
+
+      const batch = {
+        generalComment: normalized.generalComment,
+        lineComments: normalized.lineComments,
+        submittedAt: new Date().toISOString(),
+      };
+      const history = [...(job.reviewComments || []), batch];
+
+      const updated = setStatus(job.id, 'applying_feedback', {
+        pendingReviewFeedback: {
+          generalComment: normalized.generalComment,
+          lineComments: normalized.lineComments,
+        },
+        latestReviewComments: batch,
+        reviewComments: history,
+      });
+
+      res.json(withJobUsage(updated));
+      processQueue().catch((err) => console.error('[acdev] processQueue failed:', err));
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post('/api/jobs/:id/approve', async (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+      if (job.status !== 'awaiting_review') {
+        return res.status(400).json({ error: `Job is not awaiting review (status: ${job.status})` });
+      }
+
+      const prTitle = stripAiAttribution(req.body?.prTitle ?? job.prTitle ?? '');
+      const prBody = stripAiAttribution(req.body?.prBody ?? job.prBody ?? '');
+      // Default true preserves prior draft-PR behavior when clients omit `draft`.
+      const draft = req.body?.draft !== false && req.body?.draft !== 'false';
+
+      const excludedNorm = normalizeExcludedPaths(req.body?.excludedPaths);
+      if (!excludedNorm.ok) {
+        return res.status(400).json({ error: excludedNorm.error });
+      }
+
+      try {
+        let working = job;
+
+        if (excludedNorm.paths.length > 0) {
+          if (!job.worktreePath) {
+            return res.status(400).json({
+              error: 'Job has no worktree; cannot apply file exclusions',
+            });
+          }
+
+          let changedFiles;
+          try {
+            changedFiles = await doListChangedFiles(job.worktreePath, config.baseBranch);
+          } catch {
+            changedFiles = parseChangedFilesFromDiff(job.diff || '');
+          }
+
+          const selection = validateFileSelection(changedFiles, excludedNorm.paths);
+          if (!selection.ok) {
+            return res.status(400).json({ error: selection.error });
+          }
+
+          if (selection.excluded.length > 0) {
+            await doApplyFileExclusions(
+              job.worktreePath,
+              config.baseBranch,
+              selection.excluded
+            );
+            const diff = await doGetDiff(job.worktreePath, config.baseBranch);
+            working = store.updateJob(job.id, { diff });
+          }
+        }
+
+        await doPushBranch(working.worktreePath, working.branchName);
+        const prUrl = await doCreatePr({
+          worktreePath: working.worktreePath,
+          branchName: working.branchName,
+          baseBranch: config.baseBranch,
+          title: prTitle,
+          body: prBody,
+          draft,
+        });
+        const updated = store.updateJob(working.id, {
+          status: 'pr_opened',
+          prUrl,
+          prTitle,
+          prBody,
+          prDraft: draft,
+        });
+        appendLog(updated, 'status', 'pr_opened');
+
+        // Best-effort ticket rules — never fail approve after PR success
+        try {
+          await applyAfterPrOpenedRules({
+            job: store.getJob(updated.id) || updated,
+            config,
+            repoRoot,
+            appendLog: (j, type, payload) => appendLog(j, type, payload),
+            deps: {
+              transitionJiraIssue: deps.transitionJiraIssue,
+              addIssueLabel: deps.addIssueLabel,
+              closeIssue: deps.closeIssue,
+              resolveJiraCredentials: deps.resolveJiraCredentials,
+            },
+          });
+        } catch (ruleErr) {
+          const message =
+            ruleErr instanceof Error ? ruleErr.message : String(ruleErr);
+          console.warn(
+            `[acdev] Post-PR rule unexpected error (PR still opened): ${message}`
+          );
+          appendLog(
+            store.getJob(updated.id) || updated,
+            'warn',
+            `Post-PR ticket rule failed (PR still opened): ${message}`
+          );
+        }
+
+        res.json(store.getJob(updated.id) || updated);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        store.updateJob(job.id, { status: 'failed', error: message });
+        res.status(500).json({ error: message });
+      }
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post('/api/jobs/:id/reject', async (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+
+      if (job.status === 'discarded') {
+        return res.json(job);
+      }
+
+      const wtId = worktreeIdForJob(job);
+      if (wtId != null) {
+        await removeWorktree(repoRoot, wtId, job.branchName);
+      }
+
+      const updated = store.updateJob(job.id, { status: 'discarded' });
+      appendLog(updated, 'status', 'discarded');
+      res.json(store.getJob(job.id));
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  /**
+   * Wipe a job from history (unlike Reject, which keeps a discarded record).
+   * Refuses while the job is in-flight.
+   */
+  app.delete('/api/jobs/:id', async (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+
+      if (IN_FLIGHT_STATUSES.has(job.status)) {
+        return res.status(409).json({
+          error: `Cannot clear job while it is in progress (status: ${job.status}). Wait for it to finish or fail first.`,
+        });
+      }
+
+      if (!CLEARABLE_STATUSES.has(job.status)) {
+        return res.status(409).json({
+          error: `Cannot clear job with status: ${job.status}`,
+        });
+      }
+
+      const wtId = worktreeIdForJob(job);
+      if (wtId != null) {
+        try {
+          await removeWorktree(repoRoot, wtId, job.branchName);
+        } catch (err) {
+          console.warn(
+            `[acdev] removeWorktree during clear failed for job ${job.id}:`,
+            err instanceof Error ? err.message : err
+          );
+        }
+      }
+
+      store.deleteJob(job.id);
+      subscribers.delete(job.id);
+      res.json({ ok: true, id: job.id });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post('/api/jobs/:id/retry', (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+      if (job.status !== 'failed' && job.status !== 'discarded') {
+        return res.status(400).json({
+          error: `Retry is only allowed for failed or discarded jobs (status: ${job.status})`,
+        });
+      }
+
+      let updated = store.updateJob(job.id, {
+        status: 'queued',
+        error: undefined,
+        diff: undefined,
+        prUrl: undefined,
+        branchName: undefined,
+        worktreePath: undefined,
+        prTitle: undefined,
+        prBody: undefined,
+        usage: undefined,
+        pendingReviewFeedback: undefined,
+        latestReviewComments: undefined,
+      });
+      updated = appendLog(updated, 'status', 'retry queued');
+      res.json(updated);
+      processQueue().catch((err) => console.error('[acdev] processQueue failed:', err));
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // Unknown /api/* must return JSON — never Express HTML or the SPA shell.
+  app.use('/api', (req, res) => {
+    res.status(404).json({ error: `Cannot ${req.method} ${req.originalUrl}` });
+  });
+
+  // Static + SPA after API routes so /api never falls through to index.html.
+  app.use(express.static(publicDir));
+  app.get('*', (_req, res) => {
+    res.sendFile(path.join(publicDir, 'index.html'));
+  });
+
+  // JSON body / unexpected errors on API paths.
+  app.use((err, req, res, next) => {
+    if (!req.path?.startsWith('/api') && !req.originalUrl?.startsWith('/api')) {
+      return next(err);
+    }
+    const status = err.status || err.statusCode || 500;
+    res.status(status).json({ error: err.message || 'Internal Server Error' });
+  });
+
+  return { app, processQueue };
+}
+
+/**
+ * @param {import('http').Server} server
+ * @param {number} port
+ */
+export function listen(server, port) {
+  return new Promise((resolve, reject) => {
+    server.on('error', (err) => {
+      if (err.code === 'EADDRINUSE') {
+        reject(
+          new Error(
+            `Port ${port} is already in use. Try: ACDEV_PORT=${port + 1} acdev`
+          )
+        );
+      } else {
+        reject(err);
+      }
+    });
+    server.listen(port, () => resolve(undefined));
+  });
+}