chapterhouse 0.6.0 → 0.8.0

package/dist/api/server.js

@@ -1,18 +1,19 @@
 import cors from "cors";
 import express from "express";
 import helmet from "helmet";
-import { existsSync } from "fs";
-import { join, dirname } from "path";
+import { existsSync, readFileSync, statSync, writeFileSync } from "fs";
+import { join, dirname, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { z } from "zod";
-import { sendToOrchestrator, interruptCurrentTurn, enqueueForSse, getAgentInfo, cancelCurrentMessage, interruptSessionTurn, getLastRouteResult, getCurrentSessionKey } from "../copilot/orchestrator.js";
+import { sendToOrchestrator, interruptCurrentTurn, enqueueForSse, cancelCurrentMessage, interruptSessionTurn, getLastRouteResult, getCurrentSessionKey, getPersistentAgentSessionState, reloadPersistentAgent } from "../copilot/orchestrator.js";
 import { agentEventBus } from "../copilot/agent-event-bus.js";
-import { ensureDefaultAgents, getAgentRegistry, loadAgents } from "../copilot/agents.js";
+import { ensureDefaultAgents, getAgent, getAgentRegistry, isBuiltinAgent, loadAgents, notifyAgentSaved, parseAgentMd, parseAgentMdOrThrow, serializeAgentMd, setAgentSaveRuntimeHooks, SLUG_REGEX, } from "../copilot/agents.js";
 import { config, persistModel } from "../config.js";
 import { ModeContext } from "../mode-context.js";
 import { getRouterConfig, updateRouterConfig } from "../copilot/router.js";
 import { searchIndex, parseIndex } from "../wiki/index-manager.js";
 import { createAuthMiddleware, getBootstrapAuthResponse } from "./auth.js";
+import { assertAgentEditAccess } from "./agent-edit-access.js";
 import { createConcurrentConnectionLimiter, createFixedWindowRateLimiter } from "./rate-limit.js";
 import { createTeamRouter } from "./team.js";
 import { writePage, deletePage, pageExists, listPages, ensureWikiStructure, assertPagePath, } from "../wiki/fs.js";
@@ -23,7 +24,7 @@ import { readWikiPage, teamWikiSync } from "../wiki/team-sync.js";
 import { withWikiWrite } from "../wiki/lock.js";
 import { listSkills, removeSkill } from "../copilot/skills.js";
 import { restartDaemon } from "../daemon.js";
-import { API_TOKEN_PATH } from "../paths.js";
+import { AGENTS_DIR, API_TOKEN_PATH } from "../paths.js";
 import { getCurrentRunId, getDb, getSessionMessages, getTaskEvents } from "../store/db.js";
 import { getTaskLogEvents, subscribeTaskLog } from "../copilot/task-event-log.js";
 import { subscribeSession, getSessionEventsFromDb, getSessionMaxSeqFromDb, oldestSessionSeq, } from "../copilot/turn-event-log.js";
@@ -32,8 +33,14 @@ import { formatSseData, formatSseEvent } from "./sse.js";
 import { assertAuthenticationConfigured, createHealthPayload, createPublicConfigPayload, getDisplayHost, resolveApiToken, shouldServeSpaPath, } from "./server-runtime.js";
 import { BadRequestError, ForbiddenError, InternalServerError, NotFoundError, apiNotFoundHandler, asBadRequest, createApiErrorHandler, parseRequest, } from "./errors.js";
 import { childLogger } from "../util/logger.js";
-import { getActiveScope } from "../memory/active-scope.js";
-import { createScope, getScope } from "../memory/scopes.js";
+import { getActiveScope, setActiveScope } from "../memory/active-scope.js";
+import { createScope, getScope, listScopes } from "../memory/scopes.js";
+import { handleGitCommitHook, handlePrMergeHook } from "../memory/hooks.js";
+import { recordObservation } from "../memory/observations.js";
+import { recordDecision } from "../memory/decisions.js";
+import { upsertEntity } from "../memory/entities.js";
+import { getInboxItem, listPendingInboxItems, resolveInboxItem } from "../memory/inbox.js";
+import { listKorgResearchSessions, routeKorgMessage } from "./korg.js";
 const log = childLogger("server");
 const modeContext = new ModeContext(config);
 void searchIndex; // re-exported by index-manager; reference here documents the dep
@@ -78,6 +85,22 @@ const autoRequestSchema = z.object({
 const wikiWriteSchema = z.object({
     content: z.string({ error: "Missing 'content' string in request body" }),
 }).strict();
+const agentPatchSchema = z.object({
+    name: requiredString("name must be a non-empty string").optional(),
+    description: requiredString("description must be a non-empty string").optional(),
+    model: requiredString("model must be a non-empty string").optional(),
+    systemPrompt: z.string().optional(),
+}).passthrough().superRefine((value, ctx) => {
+    for (const key of ["slug", "scope", "tools", "skills"]) {
+        if (Object.prototype.hasOwnProperty.call(value, key)) {
+            ctx.addIssue({
+                code: "custom",
+                path: [key],
+                message: `'${key}' is read-only`,
+            });
+        }
+    }
+});
 const projectCreateSchema = z.object({
     slug: requiredString("Missing 'slug' in request body")
         .regex(/^[a-z0-9][a-z0-9-]*$/, "Project slug must be a lowercase slug"),
@@ -90,6 +113,41 @@ const scopeCreateSchema = z.object({
     title: requiredString("Missing 'title' in request body"),
     description: z.string().optional(),
 }).strict();
+const setActiveScopeSchema = z.object({
+    scope: z.string().nullable(),
+});
+const memoryEntriesQuerySchema = z.object({
+    store: z.enum(["observations", "decisions", "entities", "action_items"]).optional(),
+    tier: z.enum(["hot", "warm", "cold"]).optional(),
+});
+const memoryRememberSchema = z.object({
+    content: requiredString("Missing 'content' in request body"),
+    kind: z.enum(["observation", "decision"]).optional(),
+    entity_name: z.string().optional(),
+    entity_kind: z.string().optional(),
+    title: z.string().optional(),
+    decided_at: z.string().optional(),
+    tier: z.enum(["hot", "warm", "cold"]).optional(),
+});
+const inboxRouteSchema = z.object({
+    action: z.enum(["accept", "reject", "route"]),
+    reason: z.string().optional(),
+    target_scope: z.string().optional(),
+});
+const gitCommitHookSchema = z.object({
+    message: requiredString("Missing 'message' in request body"),
+    stat: z.string().optional(),
+});
+const prMergeHookSchema = z.object({
+    number: z.number({ error: "Missing or invalid 'number' in request body" }).int().positive(),
+    title: requiredString("Missing 'title' in request body"),
+    body: z.string().optional(),
+    files_changed: z.array(z.string()).optional(),
+});
+const korgRequestSchema = z.object({
+    message: requiredString("Missing 'message' in request body"),
+    session_id: z.string().trim().min(1).optional(),
+}).strict();
 const projectHardRulesSchema = z.object({
     hardRules: z.object({
         auto_pr: z.boolean({ error: "hardRules.auto_pr must be a boolean" }),
@@ -284,6 +342,18 @@ Create your first page via the wiki UI or by editing files under \`pages/\`.
 const sseClients = new Map();
 const pendingSseMessages = [];
 let connectionCounter = 0;
+function broadcastSsePayload(payload) {
+    for (const [, res] of sseClients) {
+        res.write(formatSseData(payload));
+    }
+}
+setAgentSaveRuntimeHooks({
+    getPersistentSessionState: getPersistentAgentSessionState,
+    reloadPersistentSession: reloadPersistentAgent,
+    emitAgentReloadEvent: (event) => {
+        broadcastSsePayload(event);
+    },
+});
 // ---------------------------------------------------------------------------
 // Bootstrap — hands the API token to the same-origin SPA on first load.
 // Loopback-only by IP / Origin check.
@@ -316,18 +386,145 @@ const handleHealth = (_req, res) => {
 };
 app.get("/status", handleHealth);
 app.get("/health", handleHealth);
+function getLoadedAgents() {
+    let agents = getAgentRegistry();
+    if (agents.length === 0) {
+        ensureDefaultAgents();
+        agents = loadAgents();
+    }
+    return agents;
+}
+function getAgentLastEdited(slug) {
+    try {
+        return statSync(join(AGENTS_DIR, `${slug}.agent.md`)).mtime.toISOString();
+    }
+    catch {
+        return null;
+    }
+}
 // ---------------------------------------------------------------------------
 // Workers / agents
 // ---------------------------------------------------------------------------
 app.get("/api/agents", (_req, res) => {
-    res.json(getAgentInfo());
+    const agents = getLoadedAgents()
+        .map((agent) => ({
+        name: agent.name,
+        slug: agent.slug,
+        description: agent.description,
+        model: agent.model,
+        scope: agent.scope ?? null,
+        type: isBuiltinAgent(agent.slug) ? "builtin" : "custom",
+        lastEdited: getAgentLastEdited(agent.slug),
+    }))
+        .sort((left, right) => {
+        if (left.type !== right.type) {
+            return left.type === "builtin" ? -1 : 1;
+        }
+        return left.name.localeCompare(right.name);
+    });
+    res.json(agents);
 });
-app.get("/api/channels", (_req, res) => {
-    let agents = getAgentRegistry();
-    if (agents.length === 0) {
-        ensureDefaultAgents();
-        agents = loadAgents();
+app.get("/api/agents/:slug", (req, res, next) => {
+    const slugParam = req.params.slug;
+    const slug = Array.isArray(slugParam) ? slugParam[0] : slugParam;
+    if (slug === "stream") {
+        next();
+        return;
+    }
+    if (!SLUG_REGEX.test(slug)) {
+        res.status(400).json({ error: "Invalid slug" });
+        return;
+    }
+    getLoadedAgents();
+    const filePath = join(AGENTS_DIR, `${slug}.agent.md`);
+    const resolvedAgentsDir = resolve(AGENTS_DIR);
+    const resolvedFilePath = resolve(filePath);
+    if (!(resolvedFilePath === resolvedAgentsDir || resolvedFilePath.startsWith(`${resolvedAgentsDir}${sep}`))) {
+        res.status(403).json({ error: "Access denied" });
+        return;
+    }
+    let content;
+    try {
+        content = readFileSync(filePath, "utf-8");
+    }
+    catch {
+        res.status(404).json({ error: `Agent '${slug}' not found` });
+        return;
+    }
+    const agent = parseAgentMd(content, slug);
+    if (!agent) {
+        res.status(500).json({ error: `Agent '${slug}' could not be parsed` });
+        return;
+    }
+    const builtin = isBuiltinAgent(slug);
+    res.json({
+        name: agent.name,
+        slug: agent.slug,
+        description: agent.description,
+        model: agent.model,
+        scope: agent.scope ?? null,
+        persistent: agent.persistent ?? false,
+        skills: agent.skills ?? [],
+        type: builtin ? "builtin" : "custom",
+        editable: !builtin,
+        systemPrompt: agent.systemMessage,
+    });
+});
+app.patch("/api/agents/:slug", async (req, res) => {
+    const slugParam = req.params.slug;
+    const slug = Array.isArray(slugParam) ? slugParam[0] : slugParam;
+    if (!SLUG_REGEX.test(slug)) {
+        throw new BadRequestError("Invalid slug");
+    }
+    if (modeContext.isTeam() && req.user?.role !== "team-lead") {
+        throw new ForbiddenError("Forbidden");
+    }
+    const patch = parseRequest(agentPatchSchema, req.body ?? {});
+    const filePath = join(AGENTS_DIR, `${slug}.agent.md`);
+    const resolvedAgentsDir = resolve(AGENTS_DIR);
+    const resolvedFilePath = resolve(filePath);
+    if (!(resolvedFilePath === resolvedAgentsDir || resolvedFilePath.startsWith(`${resolvedAgentsDir}${sep}`))) {
+        throw new ForbiddenError("Access denied");
+    }
+    assertAgentEditAccess({ entraAuthEnabled: config.entraAuthEnabled }, req.user);
+    if (isBuiltinAgent(slug)) {
+        throw new ForbiddenError("Built-in agents are read-only");
+    }
+    if (!existsSync(filePath)) {
+        throw new NotFoundError("Agent not found");
+    }
+    try {
+        const current = parseAgentMdOrThrow(readFileSync(filePath, "utf-8"), slug);
+        const updated = {
+            ...current,
+            name: patch.name ?? current.name,
+            description: patch.description ?? current.description,
+            model: patch.model ?? current.model,
+            systemMessage: patch.systemPrompt ?? current.systemMessage,
+        };
+        const nextContent = serializeAgentMd(updated);
+        writeFileSync(filePath, nextContent, "utf-8");
+        await notifyAgentSaved(slug, updated);
+        res.json({
+            name: updated.name,
+            slug: updated.slug,
+            description: updated.description,
+            model: updated.model,
+            scope: updated.scope ?? null,
+            persistent: updated.persistent ?? false,
+            skills: updated.skills ?? [],
+            type: "custom",
+            editable: true,
+            systemPrompt: updated.systemMessage,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new BadRequestError(`Invalid content: ${message}`);
     }
+});
+app.get("/api/channels", (_req, res) => {
+    const agents = getLoadedAgents();
     const persistentAgentChannels = agents
         .filter((agent) => agent.persistent)
         .map((agent) => ({
@@ -650,6 +847,21 @@ app.post("/api/cancel", async (_req, res) => {
     }
     res.json({ status: "ok", cancelled });
 });
+app.post("/api/agents/:slug/reload-confirm", async (req, res) => {
+    const slugParam = Array.isArray(req.params.slug) ? req.params.slug[0] : req.params.slug;
+    const slug = slugParam?.trim() || "";
+    const agent = getAgent(slug);
+    if (!agent?.persistent) {
+        throw new NotFoundError("Agent not found");
+    }
+    const sessionKey = `agent:${agent.slug}`;
+    await interruptSessionTurn(sessionKey);
+    const reloadResult = await reloadPersistentAgent(agent.slug);
+    if (reloadResult === "reloaded") {
+        broadcastSsePayload({ type: "agent_reloaded", slug: agent.slug, reason: "confirmed_restart" });
+    }
+    res.json({ status: "ok" });
+});
 // Cancel the active turn for one session key without touching other channels.
 app.post("/api/session/:sessionKey/interrupt", async (req, res) => {
     const sessionKey = Array.isArray(req.params.sessionKey)
@@ -901,6 +1113,193 @@ app.get("/api/memory/active-scope", (_req, res) => {
         title: activeScope.title,
     });
 });
+app.post("/api/memory/active-scope", (req, res) => {
+    const body = parseRequest(setActiveScopeSchema, req.body ?? {});
+    try {
+        const scope = setActiveScope(body.scope);
+        res.json({ ok: true, scope: scope?.slug ?? null });
+    }
+    catch (err) {
+        res.status(404).json({ error: err instanceof Error ? err.message : String(err) });
+    }
+});
+app.get("/api/memory/scopes", (_req, res) => {
+    const db = getDb();
+    const activeScope = getActiveScope();
+    const scopes = listScopes();
+    const result = scopes.map((scope) => {
+        const counts = {
+            observations: db.prepare(`SELECT COUNT(*) AS count FROM mem_observations WHERE scope_id = ?`).get(scope.id).count,
+            decisions: db.prepare(`SELECT COUNT(*) AS count FROM mem_decisions WHERE scope_id = ?`).get(scope.id).count,
+            entities: db.prepare(`SELECT COUNT(*) AS count FROM mem_entities WHERE scope_id = ?`).get(scope.id).count,
+            action_items: db.prepare(`SELECT COUNT(*) AS count FROM mem_action_items WHERE scope_id = ?`).get(scope.id).count,
+        };
+        return {
+            slug: scope.slug,
+            title: scope.title,
+            description: scope.description,
+            active: activeScope?.slug === scope.slug,
+            counts,
+        };
+    });
+    res.json({ scopes: result });
+});
+app.get("/api/memory/inbox", (_req, res) => {
+    const items = listPendingInboxItems();
+    const result = items.map((item) => ({
+        id: item.id,
+        scope_slug: item.scopeId
+            ? getDb().prepare(`SELECT slug FROM mem_scopes WHERE id = ?`).get(item.scopeId)?.slug ?? null
+            : null,
+        kind: item.kind,
+        payload: item.payload,
+        source_agent: item.sourceAgent,
+        created_at: item.createdAt,
+    }));
+    res.json({ items: result, total: result.length });
+});
+app.post("/api/memory/inbox/:id/route", (req, res) => {
+    const id = Number(req.params.id);
+    if (!Number.isInteger(id) || id <= 0) {
+        res.status(400).json({ error: "Invalid inbox item id" });
+        return;
+    }
+    const body = parseRequest(inboxRouteSchema, req.body ?? {});
+    const item = getInboxItem(id);
+    if (!item) {
+        res.status(404).json({ error: `Inbox item '${id}' not found` });
+        return;
+    }
+    if (item.status !== "pending") {
+        res.status(409).json({ error: `Inbox item '${id}' is already resolved` });
+        return;
+    }
+    const status = body.action === "accept" ? "accepted" : "rejected";
+    const reason = body.reason ?? (body.action === "accept" ? "Accepted via web UI" : "Rejected via web UI");
+    resolveInboxItem(id, status, reason);
+    log.info({ id, action: body.action }, "inbox item routed via web UI");
+    res.json({ ok: true });
+});
+app.get("/api/memory/:scope", (req, res) => {
+    const scopeSlug = String(req.params.scope);
+    const scope = getScope(scopeSlug);
+    if (!scope) {
+        res.status(404).json({ error: `Memory scope '${scopeSlug}' not found` });
+        return;
+    }
+    const query = parseRequest(memoryEntriesQuerySchema, req.query);
+    const store = query.store ?? "observations";
+    const tier = query.tier;
+    const db = getDb();
+    let entries;
+    let total;
+    if (store === "observations") {
+        if (tier) {
+            entries = db.prepare(`SELECT id, content, source, tier, entity_id, created_at FROM mem_observations WHERE scope_id = ? AND tier = ? AND archived_at IS NULL ORDER BY id DESC LIMIT 100`).all(scope.id, tier);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_observations WHERE scope_id = ? AND tier = ? AND archived_at IS NULL`).get(scope.id, tier).n;
+        }
+        else {
+            entries = db.prepare(`SELECT id, content, source, tier, entity_id, created_at FROM mem_observations WHERE scope_id = ? AND archived_at IS NULL ORDER BY id DESC LIMIT 100`).all(scope.id);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_observations WHERE scope_id = ? AND archived_at IS NULL`).get(scope.id).n;
+        }
+    }
+    else if (store === "decisions") {
+        if (tier) {
+            entries = db.prepare(`SELECT id, title, rationale, tier, entity_id, decided_at, created_at FROM mem_decisions WHERE scope_id = ? AND tier = ? AND archived_at IS NULL ORDER BY decided_at DESC, id DESC LIMIT 100`).all(scope.id, tier);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_decisions WHERE scope_id = ? AND tier = ? AND archived_at IS NULL`).get(scope.id, tier).n;
+        }
+        else {
+            entries = db.prepare(`SELECT id, title, rationale, tier, entity_id, decided_at, created_at FROM mem_decisions WHERE scope_id = ? AND archived_at IS NULL ORDER BY decided_at DESC, id DESC LIMIT 100`).all(scope.id);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_decisions WHERE scope_id = ? AND archived_at IS NULL`).get(scope.id).n;
+        }
+    }
+    else if (store === "entities") {
+        if (tier) {
+            entries = db.prepare(`SELECT id, kind, name, summary, tier, created_at, updated_at FROM mem_entities WHERE scope_id = ? AND tier = ? ORDER BY updated_at DESC, id DESC LIMIT 100`).all(scope.id, tier);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_entities WHERE scope_id = ? AND tier = ?`).get(scope.id, tier).n;
+        }
+        else {
+            entries = db.prepare(`SELECT id, kind, name, summary, tier, created_at, updated_at FROM mem_entities WHERE scope_id = ? ORDER BY updated_at DESC, id DESC LIMIT 100`).all(scope.id);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_entities WHERE scope_id = ?`).get(scope.id).n;
+        }
+    }
+    else {
+        if (tier) {
+            entries = db.prepare(`SELECT id, title, detail, status, tier, due_at, entity_id, created_at FROM mem_action_items WHERE scope_id = ? AND tier = ? ORDER BY created_at DESC, id DESC LIMIT 100`).all(scope.id, tier);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_action_items WHERE scope_id = ? AND tier = ?`).get(scope.id, tier).n;
+        }
+        else {
+            entries = db.prepare(`SELECT id, title, detail, status, tier, due_at, entity_id, created_at FROM mem_action_items WHERE scope_id = ? ORDER BY created_at DESC, id DESC LIMIT 100`).all(scope.id);
+            total = db.prepare(`SELECT COUNT(*) AS n FROM mem_action_items WHERE scope_id = ?`).get(scope.id).n;
+        }
+    }
+    res.json({ entries, total });
+});
+app.post("/api/memory/:scope/remember", (req, res) => {
+    const scopeSlug = String(req.params.scope);
+    const scope = getScope(scopeSlug);
+    if (!scope) {
+        res.status(404).json({ error: `Memory scope '${scopeSlug}' not found` });
+        return;
+    }
+    const body = parseRequest(memoryRememberSchema, req.body ?? {});
+    if (body.entity_name && !body.entity_kind) {
+        res.status(400).json({ error: "entity_kind is required when entity_name is provided" });
+        return;
+    }
+    const kind = body.kind ?? "observation";
+    const entity = body.entity_name
+        ? upsertEntity({
+            scope_id: scope.id,
+            kind: body.entity_kind,
+            name: body.entity_name,
+            tier: body.tier ?? "warm",
+        })
+        : undefined;
+    if (kind === "decision") {
+        if (!body.title) {
+            res.status(400).json({ error: "title is required when kind='decision'" });
+            return;
+        }
+        const decision = recordDecision({
+            scope_id: scope.id,
+            entity_id: entity?.id,
+            title: body.title,
+            rationale: body.content,
+            decided_at: body.decided_at ?? new Date().toISOString().slice(0, 10),
+            tier: body.tier ?? "warm",
+        });
+        log.info({ id: decision.id, scope: scopeSlug, kind }, "memory written via web UI");
+        res.json({ ok: true, id: String(decision.id) });
+        return;
+    }
+    const observation = recordObservation({
+        scope_id: scope.id,
+        entity_id: entity?.id,
+        content: body.content,
+        source: "agent:web-ui",
+        tier: body.tier ?? "warm",
+    });
+    log.info({ id: observation.id, scope: scopeSlug, kind }, "memory written via web UI");
+    res.json({ ok: true, id: String(observation.id) });
+});
+app.post("/api/memory/hooks/git-commit", authMiddleware, (req, res, next) => {
+    const body = parseRequest(gitCommitHookSchema, req.body ?? {});
+    handleGitCommitHook({ message: body.message, stat: body.stat })
+        .then((result) => res.json({ ok: true, observation_id: result.observation_id }))
+        .catch(next);
+});
+app.post("/api/memory/hooks/pr-merge", authMiddleware, (req, res, next) => {
+    const body = parseRequest(prMergeHookSchema, req.body ?? {});
+    handlePrMergeHook({
+        number: body.number,
+        title: body.title,
+        body: body.body,
+        files_changed: body.files_changed,
+    })
+        .then((result) => res.json({ ok: true, observation_id: result.observation_id }))
+        .catch(next);
+});
 app.post("/api/scopes", (req, res) => {
     const body = parseRequest(scopeCreateSchema, req.body ?? {});
     if (getScope(body.slug)) {
@@ -1095,6 +1494,14 @@ app.delete("/api/wiki/page", async (req, res) => {
     const removed = await withWikiWrite(() => deletePage(path));
     res.json({ ok: removed, path });
 });
+app.post("/api/wiki/korg", authMiddleware, async (req, res) => {
+    const body = parseRequest(korgRequestSchema, req.body ?? {});
+    const result = await routeKorgMessage(body);
+    res.json(result);
+});
+app.get("/api/wiki/korg/sessions", authMiddleware, (_req, res) => {
+    res.json({ sessions: listKorgResearchSessions(getDb()) });
+});
 // ---------------------------------------------------------------------------
 // Skills
 // ---------------------------------------------------------------------------