agentwrangler 0.1.1-next.bca85ea → 0.1.1-next.bdce596

package/dist/daemon/router.js

@@ -1,12 +1,6 @@
-/**
- * src/daemon/router.ts — minimal API route dispatcher.
- *
- * Routes /api/* requests to the LocalQueryAPI stubs.
- * WP2 and WP4 replace the stub calls with real implementations.
- *
- * All responses are JSON with no permissive CORS headers.
- */
+import { getReportedWork } from "../query/api/reported-work.js";
 import { getPractices } from "../detector/practice-registry.js";
+import { getBootProgress } from "../ingest/boot-progress.js";
 import { getOAuthStatus } from "../oauth/credentials.js";
 import { getGithubTokenStatus } from "../outcomes/github/credential.js";
 import { manualLink, manualUnlink } from "../outcomes/linker.js";
@@ -17,15 +11,18 @@ import { getDeliveryMetrics } from "../query/api/delivery.js";
 import { EffectRequestError, listEffectEvidence, mutateEffectCycle, trackCompletedChange, } from "../query/api/effect-service.js";
 import { getClosureProxy } from "../query/api/effectiveness.js";
 import { getEfficiencyHeadroom } from "../query/api/efficiency-headroom.js";
+import { getEsfObservations, getSessionEsfObservations } from "../query/api/esf-observations.js";
+import { FeedbackError, deleteFeedbackRoute, getGoalRoute, listFeedbackRoute, resetGoalRoute, setFeedbackRoute, setGoalRoute, undoFeedbackRoute, } from "../query/api/feedback-store.js";
 import { getHeadroomTrend } from "../query/api/headroom-trend.js";
 import { getHotSessions } from "../query/api/hot-sessions.js";
-import { adoptRecommendation, calibrateBytesPerToken, calibrateLimit, confirmApplyJob, dismissRecommendation, getApplyJob, getContextBudget, getContextComposition, getGlobalOverview, getHookConfig, getIdleSessions, getLinkageRate, getLoopGuard, getSession, getSessionDrivers, getSettings, getSuccessRate, getTurnTimeline, getWorkspaceOutcomeDetail, installHookRoute, listLedger, listLiveSessions, listRecommendations, listSessions, listWorkspaceOutcomes, listWorkspaces, openTerminalForRec, resetDatabase, rollbackApplyJob, startApplyJob, uninstallHookRoute, updateHookConfig, updateSettings, } from "../query/api/index.js";
+import { adoptRecommendation, calibrateBytesPerToken, calibrateLimit, confirmApplyJob, dismissRecommendation, getApplyJob, getContextBudget, getContextComposition, getGlobalOverview, getHookConfig, getIdleSessions, getLinkageRate, getLoopGuard, getSession, getSessionDrivers, getSettings, getSuccessRate, getTurnTimeline, getWorkspaceOutcomeDetail, installHookRoute, listLedger, listLiveSessions, listRecommendations, listSessions, listWorkspaceNames, listWorkspaceOutcomes, listWorkspaces, openTerminalForRec, resetDatabase, rollbackApplyJob, startApplyJob, uninstallHookRoute, updateHookConfig, updateSettings, } from "../query/api/index.js";
 import { getOffloadShare } from "../query/api/offload-share.js";
 import { getReport, listReports } from "../query/api/reports.js";
 import { getSelfChurn } from "../query/api/self-churn.js";
 import { getSessionSpendPercentile, getWeeklySelfPercentile, } from "../query/api/self-percentiles.js";
 import { getFlavorDecomposition } from "../query/api/spend-flavor.js";
 import { getCacheWriteTrend, getTrends } from "../query/api/trends.js";
+import { WorkRecordError, attachWorkRecordContextRoute, attachWorkRecordSessionRoute, closeoutWorkRecordRoute, createWorkRecordRoute, deleteWorkRecordRoute, detachWorkRecordContextRoute, detachWorkRecordSessionRoute, editWorkRecordRoute, getWorkAllocation, getWorkAllocationClaimKinds, getWorkRecord, issueWorkRecordId, listWorkRecords, recomputeWorkAllocationRoute, setWorkRecordArchivedRoute, workRecordResponse, } from "../query/api/work-records.js";
 import { getSettingsData } from "../query/settings-store.js";
 import { getScanStatus, isReady } from "./readiness.js";
 function sendJson(res, status, body) {
@@ -36,6 +33,39 @@ function sendJson(res, status, body) {
     });
     res.end(payload);
 }
+function sendFeedbackError(res, error) {
+    if (error instanceof FeedbackError) {
+        sendJson(res, error.status, { error: error.message, code: error.code });
+        return;
+    }
+    // Oversized body (readBody) rejects with EffectRequestError(400, …).
+    if (error instanceof EffectRequestError) {
+        sendJson(res, error.status, { error: error.message, code: "INVALID_REQUEST" });
+        return;
+    }
+    sendJson(res, 500, { error: "Internal error" });
+}
+/** Read + JSON-parse a write body, then run `run` and send its enveloped result. */
+function withJsonBody(req, res, run) {
+    readBody(req, 4096)
+        .then((raw) => {
+        let body;
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            sendJson(res, 400, { error: "Invalid JSON body", code: "INVALID_REQUEST" });
+            return;
+        }
+        try {
+            sendJson(res, 200, run(body));
+        }
+        catch (error) {
+            sendFeedbackError(res, error);
+        }
+    })
+        .catch((error) => sendFeedbackError(res, error));
+}
 function readBody(req, maxBytes) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -134,10 +164,96 @@ function jobRoute(pathname) {
     const action = m[2] === "confirm" || m[2] === "rollback" ? m[2] : "get";
     return { jobId: decodeURIComponent(m[1]), action };
 }
+function workRecordId(pathname) {
+    const match = pathname.match(/^\/api\/work-records\/([^/]+)$/);
+    return match?.[1] === undefined ? null : decodeURIComponent(match[1]);
+}
+function listSavedCostReports(db, workspaceId) {
+    return db
+        .prepare(`SELECT r.allocation_revision_id, r.created_at, r.cohort_from, r.cohort_to,
+      SUM(CASE WHEN a.disposition = 'OWNED' THEN 1 ELSE 0 END) AS allocated_session_count,
+      COUNT(a.session_id) AS eligible_session_count
+    FROM work_allocation_revisions r
+    LEFT JOIN work_session_allocations a ON a.allocation_revision_id = r.allocation_revision_id
+    WHERE r.workspace_id = ?
+    GROUP BY r.allocation_revision_id
+    ORDER BY r.created_at DESC, r.allocation_revision_id DESC`)
+        .all(workspaceId);
+}
+function workRecordAction(pathname) {
+    const match = pathname.match(/^\/api\/work-records\/([^/]+)\/(edit|closeout|archive|reopen|sessions|contexts|delete)(?:\/([^/]+)\/detach)?$/);
+    if (match?.[1] === undefined || match[2] === undefined)
+        return null;
+    const result = { recordId: decodeURIComponent(match[1]), action: match[2] };
+    return match[3] === undefined ? result : { ...result, relatedId: decodeURIComponent(match[3]) };
+}
+function workRecordBody(raw, recordId, related) {
+    let body;
+    try {
+        body = JSON.parse(raw);
+    }
+    catch {
+        throw new WorkRecordError(400, "INVALID_REQUEST", "Invalid JSON body");
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        throw new WorkRecordError(400, "INVALID_REQUEST", "request body must be an object");
+    }
+    const result = { ...body };
+    if (recordId !== undefined) {
+        if (result.work_record_id !== undefined && result.work_record_id !== recordId) {
+            throw new WorkRecordError(400, "INVALID_REQUEST", "work_record_id must match the route");
+        }
+        result.work_record_id = recordId;
+    }
+    if (related !== undefined) {
+        if (result[related.key] !== undefined && result[related.key] !== related.value) {
+            throw new WorkRecordError(400, "INVALID_REQUEST", `${related.key} must match the route`);
+        }
+        result[related.key] = related.value;
+    }
+    return result;
+}
+function sendWorkRecordError(res, error) {
+    if (error instanceof EffectRequestError) {
+        sendJson(res, error.status, { error: error.message, code: "INVALID_REQUEST" });
+        return;
+    }
+    if (error instanceof WorkRecordError) {
+        sendJson(res, error.status, { error: error.message, code: error.code });
+        return;
+    }
+    sendJson(res, 500, { error: "Internal error" });
+}
 export function handleApiRequest(_db, req, res, method, url) {
     // Strip query string for routing.
     const pathname = url.split("?")[0] ?? url;
     try {
+        if (method === "GET" && pathname === "/api/work-records/summary") {
+            const params = new URLSearchParams(url.split("?")[1] ?? "");
+            sendJson(res, 200, getReportedWork(_db, params.get("workspace_id") || null));
+            return;
+        }
+        // GET /api/esf/observations — complete selected-turn accounting cohort.
+        if (method === "GET" && pathname === "/api/esf/observations") {
+            const params = new URLSearchParams(url.split("?")[1] ?? "");
+            const window = resolveWindow(parseWindowFilter(url));
+            if (Date.parse(window.from) >= Date.parse(window.to)) {
+                sendJson(res, 400, { error: "from must precede to" });
+                return;
+            }
+            sendJson(res, 200, getEsfObservations(_db, {
+                workspaceId: params.get("workspace_id") || null,
+                ...window,
+            }));
+            return;
+        }
+        // Full-session aggregate: never derive this from a paginated timeline.
+        const sessionObservationId = pathname.match(/^\/api\/esf\/session-observations\/([^/]+)$/)?.[1];
+        if (method === "GET" && sessionObservationId !== undefined) {
+            const evidence = getSessionEsfObservations(_db, decodeURIComponent(sessionObservationId));
+            sendJson(res, evidence.data === null ? 404 : 200, evidence);
+            return;
+        }
         // GET /api/esf/effects — independently keyset-paged versioned and legacy evidence.
         if (method === "GET" && pathname === "/api/esf/effects") {
             const params = new URLSearchParams(url.split("?")[1] ?? "");
@@ -179,6 +295,172 @@ export function handleApiRequest(_db, req, res, method, url) {
             }));
             return;
         }
+        // ESF3 work records are local-only, structured records.  The HTTP token gate
+        // in http.ts covers every mutation and ID issuance route below.
+        if (method === "GET" && pathname === "/api/work-records") {
+            const params = new URLSearchParams(url.split("?")[1] ?? "");
+            const workspaceId = params.get("workspace_id");
+            const includeArchived = params.get("include_archived");
+            if (workspaceId === null ||
+                workspaceId.length === 0 ||
+                (includeArchived !== null && includeArchived !== "true" && includeArchived !== "false")) {
+                sendJson(res, 400, { error: "workspace_id and include_archived are invalid" });
+                return;
+            }
+            const records = listWorkRecords(_db, workspaceId, includeArchived === "true");
+            sendJson(res, 200, workRecordResponse(records, { n: records.length, workspaceId }));
+            return;
+        }
+        if (method === "GET" && pathname === "/api/work-records/allocations") {
+            const workspaceId = new URLSearchParams(url.split("?")[1] ?? "").get("workspace_id");
+            if (workspaceId === null || workspaceId.length === 0) {
+                sendJson(res, 400, { error: "workspace_id is required" });
+                return;
+            }
+            const reports = listSavedCostReports(_db, workspaceId);
+            sendJson(res, 200, workRecordResponse(reports, { n: reports.length, workspaceId }));
+            return;
+        }
+        if (method === "GET" && pathname.startsWith("/api/work-records/allocations/")) {
+            const allocationId = pathname.slice("/api/work-records/allocations/".length);
+            if (allocationId.length === 0 || allocationId.includes("/")) {
+                sendJson(res, 404, { error: "Not found" });
+                return;
+            }
+            try {
+                const allocation = getWorkAllocation(_db, decodeURIComponent(allocationId));
+                sendJson(res, 200, workRecordResponse(allocation, {
+                    n: allocation.eligible_session_count,
+                    workspaceId: allocation.workspace_id,
+                    claimKind: "EXPERIMENTAL",
+                    meta: {
+                        window: { from: allocation.cohort_from, to: allocation.cohort_to },
+                        qualification: {
+                            provisional_excluded: true,
+                            unpriced_turns: allocation.unpriced_turn_count,
+                            claim_kinds_count: getWorkAllocationClaimKinds(_db, allocation.allocation_revision_id),
+                            note: "Frozen ESF3 allocation; unpriced turns are not zero cost.",
+                        },
+                    },
+                }));
+            }
+            catch (error) {
+                sendWorkRecordError(res, error);
+            }
+            return;
+        }
+        const recordId = workRecordId(pathname);
+        if (method === "GET" && recordId !== null) {
+            try {
+                const record = getWorkRecord(_db, recordId);
+                sendJson(res, 200, workRecordResponse(record, { workspaceId: record.workspace_id }));
+            }
+            catch (error) {
+                sendWorkRecordError(res, error);
+            }
+            return;
+        }
+        if (method === "POST" && pathname === "/api/work-records/ids") {
+            readBody(req, 1024)
+                .then((raw) => {
+                try {
+                    sendJson(res, 200, workRecordResponse(issueWorkRecordId(_db, workRecordBody(raw))));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/work-records") {
+            readBody(req, 4096)
+                .then((raw) => {
+                try {
+                    const result = createWorkRecordRoute(_db, workRecordBody(raw));
+                    sendJson(res, 200, workRecordResponse(result, { workspaceId: result.record.workspace_id }));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/work-records/allocations/recompute") {
+            readBody(req, 4096)
+                .then((raw) => {
+                try {
+                    const result = recomputeWorkAllocationRoute(_db, workRecordBody(raw));
+                    sendJson(res, 200, workRecordResponse(result, {
+                        n: result.allocation.eligible_session_count,
+                        workspaceId: result.allocation.workspace_id,
+                        claimKind: "EXPERIMENTAL",
+                        meta: {
+                            window: {
+                                from: result.allocation.cohort_from,
+                                to: result.allocation.cohort_to,
+                            },
+                            qualification: {
+                                provisional_excluded: true,
+                                unpriced_turns: result.allocation.unpriced_turn_count,
+                                claim_kinds_count: getWorkAllocationClaimKinds(_db, result.allocation.allocation_revision_id),
+                                note: "Frozen ESF3 allocation; unpriced turns are not zero cost.",
+                            },
+                        },
+                    }));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
+        const recordAction = workRecordAction(pathname);
+        if (recordAction !== null &&
+            ((method === "POST" && recordAction.action !== "delete") ||
+                (method === "DELETE" && recordAction.action === "delete"))) {
+            readBody(req, 4096)
+                .then((raw) => {
+                try {
+                    const related = recordAction.relatedId === undefined
+                        ? undefined
+                        : {
+                            key: recordAction.action === "contexts" ? "context_ref_id" : "session_id",
+                            value: recordAction.relatedId,
+                        };
+                    const body = workRecordBody(raw, recordAction.recordId, related);
+                    const result = recordAction.action === "edit"
+                        ? editWorkRecordRoute(_db, body)
+                        : recordAction.action === "closeout"
+                            ? closeoutWorkRecordRoute(_db, body)
+                            : recordAction.action === "archive"
+                                ? setWorkRecordArchivedRoute(_db, body, true)
+                                : recordAction.action === "reopen"
+                                    ? setWorkRecordArchivedRoute(_db, body, false)
+                                    : recordAction.action === "sessions" && recordAction.relatedId === undefined
+                                        ? attachWorkRecordSessionRoute(_db, body)
+                                        : recordAction.action === "sessions"
+                                            ? detachWorkRecordSessionRoute(_db, body)
+                                            : recordAction.action === "contexts" &&
+                                                recordAction.relatedId === undefined
+                                                ? attachWorkRecordContextRoute(_db, body)
+                                                : recordAction.action === "contexts"
+                                                    ? detachWorkRecordContextRoute(_db, body)
+                                                    : deleteWorkRecordRoute(_db, body);
+                    const workspaceId = "record" in result ? result.record.workspace_id : undefined;
+                    sendJson(res, 200, workspaceId === undefined
+                        ? workRecordResponse(result)
+                        : workRecordResponse(result, { workspaceId }));
+                }
+                catch (error) {
+                    sendWorkRecordError(res, error);
+                }
+            })
+                .catch((error) => sendWorkRecordError(res, error));
+            return;
+        }
         // GET /api/overview
         if (method === "GET" && pathname === "/api/overview") {
             sendJson(res, 200, getGlobalOverview(parseWindowFilter(url)));
@@ -275,6 +557,11 @@ export function handleApiRequest(_db, req, res, method, url) {
             sendJson(res, 200, listWorkspaces(parseWindowFilter(url)));
             return;
         }
+        // GET /api/workspace-names  (unwindowed naming metadata for all workspaces — UIR-8)
+        if (method === "GET" && pathname === "/api/workspace-names") {
+            sendJson(res, 200, listWorkspaceNames());
+            return;
+        }
         // GET /api/delivery (delivery proxy metrics across all workspaces)
         if (method === "GET" && pathname === "/api/delivery") {
             const { from, to } = resolveWindow(parseWindowFilter(url));
@@ -574,6 +861,46 @@ export function handleApiRequest(_db, req, res, method, url) {
                 .catch(() => sendJson(res, 500, { error: "Internal error reading request body" }));
             return;
         }
+        // ── RIQ3 relevance feedback + goal preference (migration 021) ──────────
+        // Local, enum-only, SEC-101. Writes are CSRF + session-token gated in http.ts.
+        if (method === "GET" && pathname === "/api/recommendations/feedback") {
+            const scopeKey = new URLSearchParams(url.split("?")[1] ?? "").get("scope_key");
+            if (!scopeKey) {
+                sendJson(res, 400, { error: "scope_key is required", code: "INVALID_REQUEST" });
+                return;
+            }
+            sendJson(res, 200, listFeedbackRoute(_db, scopeKey));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/feedback") {
+            withJsonBody(req, res, (body) => setFeedbackRoute(_db, body));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/feedback/undo") {
+            withJsonBody(req, res, (body) => undoFeedbackRoute(_db, body));
+            return;
+        }
+        if (method === "DELETE" && pathname === "/api/recommendations/feedback") {
+            withJsonBody(req, res, (body) => deleteFeedbackRoute(_db, body));
+            return;
+        }
+        if (method === "GET" && pathname === "/api/recommendations/goal") {
+            const scopeKey = new URLSearchParams(url.split("?")[1] ?? "").get("scope_key");
+            if (!scopeKey) {
+                sendJson(res, 400, { error: "scope_key is required", code: "INVALID_REQUEST" });
+                return;
+            }
+            sendJson(res, 200, getGoalRoute(_db, scopeKey));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/goal") {
+            withJsonBody(req, res, (body) => setGoalRoute(_db, body));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/goal/reset") {
+            withJsonBody(req, res, (body) => resetGoalRoute(_db, body));
+            return;
+        }
         // GET /api/settings
         if (method === "GET" && pathname === "/api/settings") {
             sendJson(res, 200, getSettings());
@@ -796,6 +1123,9 @@ export function handleApiRequest(_db, req, res, method, url) {
                 files_parsed: parser_health.files_parsed,
                 lines_quarantined: parser_health.lines_quarantined,
                 ...getScanStatus(),
+                // BOOT-1: boot-progress fields exist ONLY pre-ready; the steady-state
+                // /api/status shape is unchanged (UI fixtures must not require them).
+                ...(isReady() ? {} : getBootProgress()),
             });
             return;
         }