cawdev-cli 1.0.5-beta → 1.0.7-beta

package/lib/agents.mjs

@@ -25,3 +25,41 @@ export function agentOfCommand(command) {
 export function agentLabel(command) {
   return LABELS[agentOfCommand(command)];
 }
+
+/**
+ * Why an agent that needs the whole machine was refused, and what to do about
+ * it — in steps, for THIS machine. Codex and Antigravity have no per-command
+ * allow-list, so a session that writes can only run with everything allowed;
+ * the refusal used to say "turn on allow everything" and nothing about where,
+ * or that the machine must first agree to take rules from the console.
+ *
+ * Pure, so the wording is read in a test rather than found in a failed run.
+ *
+ * @param agent `codex` or `agy`
+ * @param machine `{ name, acceptsConsoleRules, configPath, consoleUrl }`
+ * @param run `{ entryRef, profile }` — what to start again, and how
+ * @param readsWithout whether a read-only session of this agent needs nothing
+ */
+export function needsEverything(agent, machine = {}, run = {}, { readsWithout = true } = {}) {
+  const who = LABELS[agent] ?? agent;
+  const short = agent === 'agy' ? 'agy' : agent;
+  const again = run.entryRef ? `/new ${run.profile === 'PLAN' ? 'plan' : 'dev'} ${run.entryRef}` : '/new …';
+  const lines = [
+    `${who} cannot ${readsWithout ? 'write code' : 'run'} on this machine yet: it has no per-command `
+      + 'permissions, so a session that commits and pushes must be allowed to run anything — and '
+      + 'this machine has not allowed everything.',
+    '',
+    'To allow it:',
+    machine.acceptsConsoleRules
+      ? '  1. ✓ This machine already accepts permission rules from the console.'
+      : '  1. On this machine: in the cawdev terminal press c → "Accept permission rules from the '
+        + `console"${machine.configPath ? ` (or "acceptsRulesFromConsole": true in ${machine.configPath})` : ''}.`,
+    `  2. On cawdev: ${machine.consoleUrl ? `${machine.consoleUrl.replace(/\/+$/, '')}/settings/runners` : 'Settings → Runners'}`
+      + ` → ${machine.name ?? 'this machine'} → tick "Allow everything".`,
+    `  3. Start it again: ${again} --${short}`,
+    '',
+    'Allowing everything lets every unattended session on this machine run any command in its checkouts.',
+    `Or, without it: ${again} --claude${readsWithout && agent === 'codex' && run.entryRef ? ` — or keep ${who} for plans (/new plan ${run.entryRef} --codex)` : ''}.`,
+  ];
+  return lines.join('\n');
+}

package/lib/background-shells.mjs

@@ -0,0 +1,108 @@
+/**
+ * The shell commands a Claude Code session started in the BACKGROUND and never
+ * saw the end of — read off its stream-json events.
+ *
+ * A lifecycle stage is one turn (R112): the daemon closes the session the
+ * moment the turn ends. A stage that ran `npm test` with `run_in_background`
+ * and ended its turn to wait for it loses the run — the result never comes
+ * back, nothing is recorded, and the walk marched on to MEMORY and FINISHED
+ * with the work unproven and uncommitted (R15, saasng). So the walk asks this,
+ * at the stage's end, whether anything it started is unfinished or unread;
+ * `walkLifecycle` then fails the stage instead of calling it done, which is
+ * what lets `/continue` pick the run back up at that stage.
+ *
+ * Pure: events in, a list out. Three tool shapes, by name:
+ * - `Bash` with `run_in_background: true` starts one; its result names the id
+ *   ("… running in background with ID: <id>");
+ * - `BashOutput` (or `TaskOutput`) reads one by `bash_id`/`shell_id`/`task_id`;
+ *   the command is over only when a read says a status other than running;
+ * - `KillShell`/`KillBash`/`TaskStop` ends one.
+ * A command whose id cannot be read off its result stays unfinished: failing
+ * loudly and re-running a stage costs a turn, calling unproven work proven
+ * costs somebody's afternoon.
+ *
+ * @author Claude Opus 5.5 (Claude Code)
+ * @author Moez Ben MBarka
+ */
+
+const READS = new Set(['BashOutput', 'TaskOutput']);
+const KILLS = new Set(['KillShell', 'KillBash', 'TaskStop']);
+
+/** The text of a tool_result's content, whichever of its two shapes it came in. */
+function textOf(content) {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) {
+    return content.map((part) => (typeof part?.text === 'string' ? part.text : '')).join('\n');
+  }
+  return '';
+}
+
+function shellIdOf(input) {
+  const id = input?.bash_id ?? input?.shell_id ?? input?.task_id ?? input?.id;
+  return typeof id === 'string' && id ? id : null;
+}
+
+export class BackgroundShells {
+  constructor() {
+    /** tool_use id of each background `Bash` → { command, shellId, done }. */
+    this.started = new Map();
+    /** tool_use id of each read → the shell id it read. */
+    this.reads = new Map();
+  }
+
+  /** One stream-json event. Anything that is not about a shell is ignored. */
+  observe(event) {
+    const parts = event?.message?.content;
+    if (!Array.isArray(parts)) return;
+    if (event.type === 'assistant') {
+      for (const part of parts) {
+        if (part?.type !== 'tool_use') continue;
+        if (part.name === 'Bash' && part.input?.run_in_background === true) {
+          this.started.set(part.id, {
+            command: String(part.input.command ?? '').trim(),
+            shellId: null,
+            done: false,
+          });
+        } else if (READS.has(part.name)) {
+          const id = shellIdOf(part.input);
+          if (id) this.reads.set(part.id, id);
+        } else if (KILLS.has(part.name)) {
+          this.finish(shellIdOf(part.input));
+        }
+      }
+      return;
+    }
+    if (event.type === 'user') {
+      for (const part of parts) {
+        if (part?.type !== 'tool_result') continue;
+        const text = textOf(part.content);
+        const launched = this.started.get(part.tool_use_id);
+        if (launched && !launched.shellId) {
+          const id = /\bID:?\s*([A-Za-z0-9_-]+)/.exec(text);
+          if (id) launched.shellId = id[1];
+          continue;
+        }
+        const read = this.reads.get(part.tool_use_id);
+        if (read) {
+          // Over only when the read says so; a read of a command still going
+          // is the command still going.
+          if (!/<status>\s*running\s*<\/status>|\bstatus:\s*running\b/i.test(text)) {
+            this.finish(read);
+          }
+        }
+      }
+    }
+  }
+
+  finish(shellId) {
+    if (!shellId) return;
+    for (const each of this.started.values()) {
+      if (each.shellId === shellId) each.done = true;
+    }
+  }
+
+  /** The commands started in the background whose end this session never saw. */
+  unfinished() {
+    return [...this.started.values()].filter((each) => !each.done).map((each) => each.command);
+  }
+}

package/lib/codex.mjs

@@ -120,6 +120,11 @@ export function codexArgs({
     if (server.disabledTools?.length) {
       args.push('-c', `${key}.disabled_tools=${tomlValue(server.disabledTools)}`);
     }
+    // How long one call may take before Codex gives up on it — 60 s unless
+    // set, which is shorter than a person answering a question.
+    if (server.toolTimeoutSec) {
+      args.push('-c', `${key}.tool_timeout_sec=${tomlValue(server.toolTimeoutSec)}`);
+    }
     args.push('-c', `${key}.default_tools_approval_mode="approve"`);
   }
   if (resumeId) {

package/lib/roadmap-format.mjs

@@ -255,6 +255,23 @@ export function parseRoadmap(text) {
         entry.afterRefs = tokens.map(({ ref }) => ref);
         continue;
       }
+      const tags = /^Tags:\s*(.+)$/.exec(line.trim());
+      if (tags) {
+        // R315. Already normalised by the server (lowercase, no `#`) by the
+        // time it reaches the file, so a plain split is the whole rule.
+        entry.tags = tags[1].split(/[,\s]+/).map((t) => t.trim()).filter(Boolean);
+        continue;
+      }
+      // R315. Computed, never stored, and never sent by import.mjs — the same
+      // arrangement as `Development:` above. Kept as the exact text so a file
+      // parsed and re-rendered without asking the API again is still a fixed
+      // point; `renderEntry` recomputes the same text from a live `origin`
+      // object when there is one.
+      const origin = /^Origin:\s*(.+)$/.exec(line.trim());
+      if (origin) {
+        entry.origin = origin[1].trim();
+        continue;
+      }
       const sprint = /^Sprint:\s*S(\d+)\s*(.*)$/.exec(line.trim());
       if (sprint) {
         // R257: `Sprint: S1 Notifications` — the sprint's number and its name
@@ -360,6 +377,33 @@ export function renderRoadmap(entries, { preamble, sectionOrder = [] }) {
   return parts.join('\n').replace(/\n+$/, '') + '\n';
 }
 
+/**
+ * The word `Origin:` writes — R315. `entry.origin` is a plain string once it
+ * has round-tripped through the file (see the parser above); freshly off the
+ * API it is `{kind, label, url}`, and this is the one place that turns the
+ * second into the first, so the two paths render identically.
+ */
+function originWord(origin) {
+  if (typeof origin === 'string') {
+    return origin;
+  }
+  if (!origin || origin.kind === 'NONE') {
+    return null;
+  }
+  switch (origin.kind) {
+    case 'SONARQUBE':
+      return 'SonarQube';
+    case 'FEEDBACK':
+      return 'Feedback';
+    case 'APPLICATION':
+      return origin.label ? `An application (${origin.label})` : 'An application';
+    case 'SESSION':
+      return origin.label ? `A session (${origin.label})` : 'A session';
+    default:
+      return null;
+  }
+}
+
 function renderEntry(entry) {
   const lines = [`### ${entryRef(entry)} — ${entry.title}`, ''];
 
@@ -425,6 +469,14 @@ function renderEntry(entry) {
       .map(({ ref }) => ref);
     lines.push(`After: ${written.join(', ')}`);
   }
+  if (entry.tags?.length) {
+    // R315. Sorted, so the export does not churn on the set's own order.
+    lines.push(`Tags: ${[...entry.tags].sort().join(', ')}`);
+  }
+  const origin = originWord(entry.origin);
+  if (origin) {
+    lines.push(`Origin: ${origin}`);
+  }
   if (entry.sprint) {
     // R257. A line on the card and never a heading: the section is where the
     // file groups, and a sprint is a set a person opened across sections. The

package/mcp/server.mjs

@@ -665,6 +665,13 @@ const TOOLS = [
             'Cards this one starts coding after — it waits in the queue until every one of ' +
             'them is MERGED or SHIPPED. Refs, as `related`. Same project, must exist, never itself.',
         },
+        tags: {
+          type: 'array',
+          items: { type: 'string' },
+          description:
+            'Free words — lowercase, letters/digits/./_/-, up to 32 characters, at least one ' +
+            'letter, at most 12. The leading # is optional and stripped.',
+        },
       },
       required: ['title'],
     },
@@ -674,7 +681,7 @@ const TOOLS = [
         method: 'POST',
         body: pick(args, [
           'title', 'body', 'status', 'branch', 'merge', 'version', 'reason', 'section', 'related',
-          'after', 'sprint',
+          'after', 'sprint', 'tags',
         ]),
       });
       return `Created ${refOf(entry)} in ${slug}.\n\n${formatEntry(entry, {})}`;
@@ -734,6 +741,13 @@ const TOOLS = [
           items: { type: ['string', 'integer'] },
           description: 'Refs — R12, i15; a bare number is a roadmap card (R221).',
         },
+        tags: {
+          type: 'array',
+          items: { type: 'string' },
+          description:
+            'Free words — lowercase, letters/digits/./_/-, up to 32 characters, at least one ' +
+            'letter, at most 12. The leading # is optional and stripped.',
+        },
       },
       required: ['title', 'severity'],
     },
@@ -741,7 +755,7 @@ const TOOLS = [
       const slug = await resolveProject(config, args.project);
       const issue = await api(config, `/api/projects/${slug}/issues`, {
         method: 'POST',
-        body: pick(args, ['title', 'body', 'severity', 'status', 'related']),
+        body: pick(args, ['title', 'body', 'severity', 'status', 'related', 'tags']),
       });
       return `Filed ${refOf(issue)} in ${slug}.\n\n${formatEntry(issue, {})}`;
     },
@@ -779,7 +793,7 @@ const TOOLS = [
   {
     name: 'roadmap_update',
     description:
-      'Edit an entry\'s title, body, section, sprint, related refs or the cards it starts ' +
+      'Edit an entry\'s title, body, section, sprint, tags, related refs or the cards it starts ' +
       'after. Use roadmap_set_status to move it.',
     inputSchema: {
       type: 'object',
@@ -813,6 +827,12 @@ const TOOLS = [
             'them is MERGED or SHIPPED. Refs, as `related`. Same project, must exist, never ' +
             'itself. [] clears it.',
         },
+        tags: {
+          type: 'array',
+          items: { type: 'string' },
+          description:
+            'Free words — same rule as roadmap_create. Leave out to leave them alone; [] clears them.',
+        },
       },
       required: ['number'],
     },
@@ -821,7 +841,7 @@ const TOOLS = [
       const entry = await api(config, `/api/projects/${slug}/roadmap/${args.number}`, {
         method: 'PATCH',
         // pick keeps a present 0, which is how a card leaves its sprint.
-        body: pick(args, ['title', 'body', 'section', 'related', 'after', 'sprint']),
+        body: pick(args, ['title', 'body', 'section', 'related', 'after', 'sprint', 'tags']),
       });
       return `Updated ${refOf(entry)}.\n\n${formatEntry(entry, {})}`;
     },
@@ -1631,9 +1651,13 @@ async function decide(config, args) {
     }
     // EXPIRED, or the poll gave up before the platform expired it. Same answer
     // either way, and the difference is on the run for whoever reads it later.
+    // R339: a person may still allow it late, and if they do the session is
+    // sent a message saying so — so this says to carry on, not to stop.
     return deny(
-      `Nobody answered this permission request in time. Do not retry it in a loop: report ` +
-        `blocked, say exactly what you needed to run and why, and let a person allow it.`,
+      `Nobody answered this permission request in time. Do not retry it in a loop. Carry on ` +
+        `with whatever does not need it; if a person allows it later you will be sent a ` +
+        `message saying so, and may run it then. If nothing else can be done without it, ` +
+        `report blocked and say exactly what you needed to run and why.`,
     );
   } catch (failure) {
     return deny(
@@ -1786,9 +1810,10 @@ function skillServers() {
 /**
  * Waits for somebody to decide, for as long as the platform will hold it open.
  *
- * Bounded a little beyond the platform's own expiry so the two cannot both be
- * waiting on each other: if the sweep is late, this gives up and denies, which
- * is the same answer the sweep would have produced.
+ * R339: the platform's wait is the project's setting now, and may be never,
+ * so this has no deadline of its own: it returns when the request stops being
+ * PENDING — allowed, refused, or expired by the platform's sweep. A test may
+ * still bound it.
  */
 async function pollForDecision(config, project, runId, approvalId) {
   const deadline = Date.now() + approvalTimeoutSeconds() * 1000;
@@ -1811,10 +1836,10 @@ async function pollForDecision(config, project, runId, approvalId) {
   return null;
 }
 
-/** A little past the platform's own fifteen-minute expiry. Overridable for tests. */
+/** For ever: the platform decides when nobody is coming (R339). Overridable for tests. */
 function approvalTimeoutSeconds() {
   const configured = Number(process.env.CAWDEV_APPROVAL_TIMEOUT_SECONDS);
-  return Number.isFinite(configured) && configured > 0 ? configured : 960;
+  return Number.isFinite(configured) && configured > 0 ? configured : Infinity;
 }
 
 // There is no roadmap_delete or changelog_delete, and there will not be. The
@@ -2065,6 +2090,23 @@ function refOf(entry) {
   return entry.ref ?? ((entry.kind === 'ISSUE' ? 'i' : 'R') + entry.number);
 }
 
+/**
+ * The word `formatEntry` prints for a card's origin — R315. Never stored,
+ * always the object shape `{kind, label, url}` off the API — unlike
+ * `roadmap-format.mjs`'s own copy, which also has to read one back out of a
+ * file.
+ */
+function originWord(origin) {
+  if (!origin || origin.kind === 'NONE') return null;
+  switch (origin.kind) {
+    case 'SONARQUBE': return 'SonarQube';
+    case 'FEEDBACK': return 'Feedback';
+    case 'APPLICATION': return origin.label ? `an application (${origin.label})` : 'an application';
+    case 'SESSION': return origin.label ? `a session (${origin.label})` : 'a session';
+    default: return null;
+  }
+}
+
 function formatEntry(entry, { brief, comments, plan }) {
   const lines = [`${refOf(entry)} — ${entry.title}`, `  status: ${entry.statusDisplay}`];
   if (entry.branch) lines.push(`  branch: ${entry.branch}`);
@@ -2072,6 +2114,9 @@ function formatEntry(entry, { brief, comments, plan }) {
   if (entry.version) lines.push(`  version: ${entry.version}`);
   if (entry.declinedReason) lines.push(`  declined because: ${entry.declinedReason}`);
   if (entry.section) lines.push(`  section: ${entry.section}`);
+  // R315. Sorted for the same reason the export is: a reader's shape must not
+  // depend on the set's own insertion order.
+  if (entry.tags?.length) lines.push(`  tags: ${[...entry.tags].sort().map((t) => `#${t}`).join(' ')}`);
   // R257. Always printed when the card has one, so a reader's shape does not
   // depend on which tool printed the card; a closed sprint says so.
   if (entry.sprint) {
@@ -2108,6 +2153,12 @@ function formatEntry(entry, { brief, comments, plan }) {
     lines.push(`  written by: a ${entry.createdBy.profile} session, `
       + `under ${entry.createdBy.startedByEmail}`);
   }
+  // R315. Never null on the wire — NONE is a person at the console — so only
+  // ever printed when it says something. Beside `written by` rather than
+  // instead of it: origin says the DOOR, and the session line above already
+  // says who and what kind, when the door was a session.
+  const origin = originWord(entry.origin);
+  if (origin) lines.push(`  origin: ${origin}`);
   if (!brief && entry.body) lines.push('', entry.body);
   // R124, between the body and the discussion — the order they are read in:
   // what we want, how we mean to get it, and the argument about both.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cawdev-cli",
-  "version": "1.0.5-beta",
+  "version": "1.0.7-beta",
   "description": "cawdev's terminal client and runner daemon — zero dependencies, on purpose",
   "type": "module",
   "bin": {