agent-standup 0.20.0

package/dist/live-R6WH7ER7.js

@@ -0,0 +1,326 @@
+import {
+  ServiceRuntime,
+  SettingsCache,
+  prismaTransactionRunner
+} from "./chunk-4TIZQTUZ.js";
+import {
+  isBlockingLevel
+} from "./chunk-VBXNDGOD.js";
+
+// src/lib/prisma.ts
+import { PrismaClient } from "@prisma/client";
+
+// src/lib/db-url.ts
+var DEFAULT_CONNECTION_LIMIT = 10;
+var DEFAULT_POOL_TIMEOUT_SECONDS = 10;
+function withPoolDefaults(databaseUrl, defaults = {}) {
+  const url = new URL(databaseUrl);
+  const connectionLimit = defaults.connectionLimit ?? DEFAULT_CONNECTION_LIMIT;
+  const poolTimeoutSeconds = defaults.poolTimeoutSeconds ?? DEFAULT_POOL_TIMEOUT_SECONDS;
+  const toAppend = [];
+  if (!url.searchParams.has("connection_limit")) {
+    toAppend.push(`connection_limit=${connectionLimit}`);
+  }
+  if (!url.searchParams.has("pool_timeout")) {
+    toAppend.push(`pool_timeout=${poolTimeoutSeconds}`);
+  }
+  if (toAppend.length === 0) {
+    return databaseUrl;
+  }
+  const hashIndex = databaseUrl.indexOf("#");
+  const base = hashIndex === -1 ? databaseUrl : databaseUrl.slice(0, hashIndex);
+  const hash = hashIndex === -1 ? "" : databaseUrl.slice(hashIndex);
+  const separator = base.endsWith("?") ? "" : base.includes("?") ? "&" : "?";
+  return `${base}${separator}${toAppend.join("&")}${hash}`;
+}
+
+// src/lib/prisma.ts
+var globalForPrisma = globalThis;
+function createPrismaClient() {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is not set \u2014 see .env.example.");
+  }
+  return new PrismaClient({ datasourceUrl: withPoolDefaults(databaseUrl) });
+}
+var prisma = globalForPrisma.prisma ?? createPrismaClient();
+if (process.env.NODE_ENV !== "production") {
+  globalForPrisma.prisma = prisma;
+}
+
+// src/lib/interventions/digest.ts
+var DEFAULT_DIGEST_INTERVAL_MS = 5 * 60 * 1e3;
+var DEFAULT_SESSION_TTL_MS = 30 * 60 * 1e3;
+function ridesDigest(finding) {
+  if (finding.timing !== "digest") return false;
+  if (finding.level === "nothing") return false;
+  return !isBlockingLevel(finding.level);
+}
+var DigestAccumulator = class {
+  pending = /* @__PURE__ */ new Map();
+  lastDelivered = /* @__PURE__ */ new Map();
+  /**
+   * When each session was last seen, for the TTL sweep.
+   *
+   * A third map rather than a timestamp derived from the other two, because
+   * neither can answer the question. `pending` is deleted outright by
+   * `take`, and `lastDelivered` is only written for a session that has
+   * actually had a batch — so a session that accumulated a few findings and
+   * left, or one whose batch was taken and never came back, is invisible to
+   * both while still holding a key in `lastDelivered`. `lastDelivered` is
+   * in fact the more persistent leak of the two: nothing removed a key from
+   * it, ever, including `forget`.
+   */
+  lastSeen = /* @__PURE__ */ new Map();
+  intervalMs;
+  maxPending;
+  sessionTtlMs;
+  constructor(options = {}) {
+    this.intervalMs = options.intervalMs ?? DEFAULT_DIGEST_INTERVAL_MS;
+    this.sessionTtlMs = options.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS;
+    this.maxPending = options.maxPending ?? 50;
+  }
+  /**
+   * Holds a finding for the next batch. Returns whether it was held.
+   *
+   * `false` for a finding that does not ride the digest — the caller
+   * delivers that one itself — so a call site can route on one call rather
+   * than testing the timing and then adding it. `false` **also** when the
+   * buffer is full, for the same reason: the answer is "not held", and a
+   * caller that believed otherwise would drop it entirely.
+   *
+   * **Deduplicated by id.** The same entry triggering repeatedly within one
+   * window is one finding, and the *first* is kept rather than the last:
+   * the earliest observation is what makes the elapsed time in the batch
+   * honest. A finding that arrives twice with different data is still one
+   * entry saying one thing about one session.
+   */
+  add(sessionId, finding, at) {
+    if (!ridesDigest(finding)) return false;
+    this.touch(sessionId, at);
+    this.sweep(at);
+    const existing = this.pending.get(sessionId) ?? [];
+    if (existing.some((held) => held.finding.id === finding.id)) return true;
+    if (existing.length >= this.maxPending) return false;
+    existing.push({ finding, at });
+    this.pending.set(sessionId, existing);
+    return true;
+  }
+  /** How many findings are held for a session. */
+  pendingCount(sessionId) {
+    return this.pending.get(sessionId)?.length ?? 0;
+  }
+  /**
+   * Whether a batch is due for this session.
+   *
+   * Two conditions, both required: something is pending, and the interval
+   * has elapsed since the last delivery. A session that has never had one
+   * is measured from its earliest pending finding rather than from process
+   * start — otherwise the first digest of a long-lived process would be due
+   * instantly, reporting a single finding as though it were a batch, which
+   * is the drip this exists to avoid wearing a batch's name.
+   */
+  isDue(sessionId, now) {
+    const held = this.pending.get(sessionId);
+    if (held === void 0 || held.length === 0) return false;
+    const last = this.lastDelivered.get(sessionId);
+    const since = last ?? Math.min(...held.map((entry) => entry.at));
+    return now - since >= this.intervalMs;
+  }
+  /**
+   * Takes the batch, clearing what it contained.
+   *
+   * `null` when nothing is due, so a caller asks once rather than testing
+   * and then taking — two calls between which the answer could change.
+   *
+   * Clearing on take is what stops a delivered finding being delivered
+   * again. It is re-detected on the next call that triggers it, which is
+   * the correct behaviour for a situation that is still true: it reappears
+   * in the *next* digest rather than being repeated in every one until
+   * somebody fixes it.
+   */
+  take(sessionId, now) {
+    if (!this.isDue(sessionId, now)) return null;
+    const held = this.pending.get(sessionId);
+    if (held === void 0 || held.length === 0) return null;
+    this.pending.delete(sessionId);
+    this.lastDelivered.set(sessionId, now);
+    this.touch(sessionId, now);
+    return {
+      findings: held.map((entry) => entry.finding),
+      from: Math.min(...held.map((entry) => entry.at)),
+      to: now
+    };
+  }
+  /**
+   * Drops everything held for a session that has ended.
+   *
+   * **All three maps, including `lastDelivered`.** An earlier version
+   * cleared only `pending`, reasoning that a session id that came back
+   * would otherwise be instantly due again. That reasoning does not survive
+   * contact with what a session id is: they are not reused, so the returning
+   * session it protected against does not exist, and the effect was a key
+   * that was never removed by anything — the leak this method appeared to
+   * be the answer to. The protection it was after is real but belongs to
+   * live sessions, and `isDue` already provides it by measuring from the
+   * earliest pending finding when there is no `lastDelivered` — so a
+   * genuinely returning id gets a fresh window rather than an instant batch.
+   */
+  forget(sessionId) {
+    this.pending.delete(sessionId);
+    this.lastDelivered.delete(sessionId);
+    this.lastSeen.delete(sessionId);
+  }
+  /** Records that a session is active, for the TTL sweep. */
+  touch(sessionId, at) {
+    this.lastSeen.set(sessionId, at);
+  }
+  /**
+   * Drops every session not seen within the TTL. Returns how many went.
+   *
+   * Called from `add` and `take` rather than from a timer, deliberately: a
+   * timer would keep a handle alive for the life of the process and would
+   * run in tests that never asked for it, and this module's whole contract
+   * is that time is an argument and nothing here reads a clock. Sweeping on
+   * activity means the map is tidied by the same traffic that grows it,
+   * and an idle process does no work — the case where its size is already
+   * not changing.
+   *
+   * A session is judged by `lastSeen` alone. Judging by the pending
+   * findings' own timestamps would miss exactly the sessions that leak:
+   * one whose batch was taken has no pending findings at all, yet still
+   * holds keys in `lastDelivered` and here.
+   */
+  sweep(now) {
+    let dropped = 0;
+    for (const [sessionId, seen] of this.lastSeen) {
+      if (now - seen > this.sessionTtlMs) {
+        this.pending.delete(sessionId);
+        this.lastDelivered.delete(sessionId);
+        this.lastSeen.delete(sessionId);
+        dropped += 1;
+      }
+    }
+    return dropped;
+  }
+  /** How many sessions this accumulator holds. For tests and diagnostics. */
+  sessionCount() {
+    return this.lastSeen.size;
+  }
+};
+
+// src/lib/interventions/delivery.ts
+function partitionFindings(findings) {
+  const immediate = [];
+  const deferred = [];
+  for (const finding of findings) {
+    if (ridesDigest(finding)) deferred.push(finding);
+    else immediate.push(finding);
+  }
+  return { immediate, deferred };
+}
+function decideDelivery(accumulator, options) {
+  const { immediate, deferred } = partitionFindings(options.findings ?? []);
+  const sessionId = options.sessionId;
+  if (sessionId === void 0) {
+    return immediate.length === 0 ? {} : { findings: immediate };
+  }
+  const nowDelivered = [...immediate];
+  for (const finding of deferred) {
+    if (!accumulator.add(sessionId, finding, options.now)) nowDelivered.push(finding);
+  }
+  const digest = accumulator.take(sessionId, options.now);
+  return {
+    ...nowDelivered.length === 0 ? {} : { findings: nowDelivered },
+    ...digest === null ? {} : { digest }
+  };
+}
+function hasAnything(payload) {
+  const findings = payload.findings;
+  if (findings !== void 0 && findings.length > 0) return true;
+  const digest = payload.digest;
+  return digest !== void 0 && digest.findings.length > 0;
+}
+function attachInterventions(result, payload) {
+  if (!hasAnything(payload)) return result;
+  return { result, interventions: payload };
+}
+
+// src/lib/interventions/service-delivery.ts
+function createServiceDeliverer(options = {}) {
+  const accumulator = options.accumulator ?? new DigestAccumulator();
+  const clock = options.now ?? Date.now;
+  const deliver = (result, caller) => {
+    const sessionId = caller.sessionId;
+    if (sessionId === void 0) return result;
+    const payload = decideDelivery(accumulator, { sessionId, now: clock() });
+    return attachInterventions(result, payload);
+  };
+  deliver.hold = (sessionId, findings, at) => {
+    const refused = [];
+    for (const finding of findings) {
+      if (!accumulator.add(sessionId, finding, at)) refused.push(finding);
+    }
+    return refused;
+  };
+  deliver.forget = (sessionId) => accumulator.forget(sessionId);
+  deliver.pendingCount = (sessionId) => accumulator.pendingCount(sessionId);
+  deliver.sessionCount = () => accumulator.sessionCount();
+  return deliver;
+}
+
+// src/lib/service/live.ts
+var prismaSettingsSource = {
+  async readRevision() {
+    const rows = await prisma.$queryRawUnsafe(
+      `SELECT "revision" FROM "settings_revision" WHERE "id" = 1`
+    );
+    return rows[0]?.revision ?? 0n;
+  },
+  async readOverrides() {
+    return prisma.$transaction(async (tx) => {
+      const rows = await tx.$queryRawUnsafe(
+        `SELECT "key", "value" FROM "settings"`
+      );
+      const revisionRows = await tx.$queryRawUnsafe(
+        `SELECT "revision" FROM "settings_revision" WHERE "id" = 1`
+      );
+      return {
+        overrides: rows.map((row) => ({ key: row.key, value: row.value })),
+        revision: revisionRows[0]?.revision ?? 0n
+      };
+    });
+  }
+};
+var settingsCache = new SettingsCache({ source: prismaSettingsSource });
+var SETTINGS_WRITE_OPERATIONS = /* @__PURE__ */ new Set([
+  "put_setting",
+  "delete_setting",
+  "patch_settings",
+  // Removing a stored override whose key this build does not declare is a
+  // settings change like any other: it bumps the revision, so the held
+  // snapshot is stale the moment it commits. This entry was added because
+  // the test below demanded it rather than because anyone remembered to —
+  // which is the whole reason that test derives the list from the source.
+  "remove_unrecognised_setting"
+]);
+var SettingsInvalidatingRuntime = class extends ServiceRuntime {
+  async call(name, input, options) {
+    const result = await super.call(name, input, options);
+    if (SETTINGS_WRITE_OPERATIONS.has(name)) settingsCache.invalidate();
+    return result;
+  }
+};
+var interventionDeliverer = createServiceDeliverer();
+var service = new SettingsInvalidatingRuntime({
+  transaction: prismaTransactionRunner(prisma),
+  resolveSnapshot: () => settingsCache.get(),
+  deliverInterventions: interventionDeliverer
+});
+export {
+  SETTINGS_WRITE_OPERATIONS,
+  interventionDeliverer,
+  prismaSettingsSource,
+  service,
+  settingsCache
+};

package/dist/plugin/.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "agent-standup",
+  "version": "0.20.0",
+  "description": "Task tracking for coding agents: the MCP server, the tool-call hook, and the standup command line.",
+  "dependencies": {
+    "agent-standup": "0.20.0"
+  },
+  "hookProtocolVersion": 1
+}

package/dist/plugin/.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "agent-standup": {
+      "type": "http",
+      "url": "${STANDUP_URL}/api/mcp"
+    }
+  }
+}

package/dist/plugin/hooks/hooks.json

@@ -0,0 +1,35 @@
+{
+  "PreToolUse": [
+    {
+      "matcher": "*",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "npx --no-install -p agent-standup standup-hook"
+        }
+      ]
+    }
+  ],
+  "PostToolUse": [
+    {
+      "matcher": "*",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "npx --no-install -p agent-standup standup-hook"
+        }
+      ]
+    }
+  ],
+  "Stop": [
+    {
+      "matcher": "*",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "npx --no-install -p agent-standup standup-hook"
+        }
+      ]
+    }
+  ]
+}

package/dist/plugin/skills/setup-agent-standup/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: setup-agent-standup
+description: Register this machine's Agent Standup poller and prove it works. Run it after installing the plugin, and re-run it any time to health-check the installation.
+---
+
+# Set up Agent Standup on this machine
+
+The plugin carries the MCP server, the hook and the command line. One thing it
+cannot carry is the operating system's scheduler entry, because no plugin can
+write one. This skill adds it — and then proves it.
+
+## Registering is not the finish line
+
+Verify, do not just install. A scheduled task can register successfully and
+never fire: a principal that cannot attach to the logon session, a command that
+does not resolve on this machine, an execution policy that refuses it. Every one
+of those leaves a registered task, a success message, and a machine that polls
+nothing. That is the state this skill exists to make impossible, so **do not
+report success until a call has reached the server and the server has answered.**
+
+## Steps
+
+1. **Check the configuration.** `STANDUP_URL` must resolve, and this session
+   needs an id and a machine name. Without them there is nothing to verify
+   against, so nothing should be registered — a host changed by a run that could
+   never have succeeded is worse than a run that stopped early.
+
+2. **Register the task** `AgentStandupPoller`, running `npx --no-install -p agent-standup standup sweep` every
+   5 minutes, with logon type `Interactive` and run
+   level `Limited`. That principal attaches to the existing logon session,
+   so it keeps firing while the machine is locked, and it needs no elevation and
+   stores no credential. The variant that survives a full logoff runs without a
+   desktop and is a different tool, not a safer one.
+
+3. **Prove it.** Register this session with the server and read the reply. A
+   reply naming a hook variant and a protocol version is the proof; anything
+   else is not.
+
+4. **Report what happened**, in these terms: the task name, the interval, and
+   whether a call reached the server. If registration succeeded and the proof did
+   not, say exactly that and leave the task in place — it may be correct and the
+   server merely unreachable, and re-running this skill is safe.
+
+## Re-running it is the health check
+
+Registration is idempotent and the proof is a live call, so running this a
+second time answers "is this machine still wired up" without changing anything
+that was already right.
+
+## Removing it
+
+Unregister the task named `AgentStandupPoller`. Nothing else on the machine is
+changed by this skill; the plugin itself is removed the way it was installed.