codehere 0.4.1 → 0.5.0-alpha.3

package/dist/infrastructure/orchestration/readiness.js

@@ -79,11 +79,8 @@ export function detectReadiness(env = process.env) {
         return {
             state: 'api_key_shadow',
             severity: 'warn',
-            title: 'Using your Claude Code subscription',
-            detail: `ANTHROPIC_API_KEY is set in your environment. ` +
-                `codehere unsets it for spawned tasks so they use your Claude subscription — ` +
-                `the same auth your interactive \`claude\` uses. Remove the key from your shell ` +
-                `config to dismiss this warning.`,
+            title: 'Using Claude subscription auth',
+            detail: '`ANTHROPIC_API_KEY` is set. Spawned tasks ignore it and use your `claude` login instead. Unset it in your shell to hide this.',
             action: {
                 label: 'Where is it set?',
                 command: 'grep -l ANTHROPIC_API_KEY ~/.zshrc ~/.bashrc ~/.zprofile 2>/dev/null',

package/dist/infrastructure/orchestration/session-manager.js

@@ -23,6 +23,7 @@ import { buildConductorAdapter } from './conductor-adapter.js';
 import { seedAgentsConfig } from './agents-config-seed.js';
 import { AUDIT_FILE } from '../hooks/claude-sdk-hook.js';
 import { appendSpawned, appendCompleted, loadRecent } from './session-persistence.js';
+import { generateFinalReport, printFinalReportToTerminal } from '../../application/use-cases/generate-final-report.js';
 // ── Agent registry ─────────────────────────────────────────────────────────────
 // All backends codehere can spawn. Order here drives the default UI dropdown
 // order. Built-in adapters first; user-config-driven ones appended from
@@ -96,6 +97,18 @@ export class SessionManager {
      *  These subprocesses are long-dead; we surface them so the user doesn't lose
      *  their Final reports across restarts. */
     persistedCache = loadRecent(20);
+    /** When a spawned session exits, we capture the completion timestamp here
+     *  so the API layer can show duration on still-in-memory sessions (the
+     *  TaskSession interface intentionally has no completedAt; only PersistedSession
+     *  does, so anything reading session.completedAt got undefined pre-fix).
+     *  Surfaced May 2 by the cold-start dogfood — `duration: NaNs` in /api/tasks
+     *  for completed-but-not-yet-restarted sessions. Bug 2 sister-fix. */
+    completedAtBySession = new Map();
+    /** PM-UX Layer 3 · Final Report cache (iteration 11 MVP, UI-integration iter 12).
+     *  Populated when generateFinalReport resolves in the exit handler. Web UI
+     *  reads via getFinalReport() through the /api/tasks serializer so non-technical
+     *  users see the prose summary without opening a terminal. */
+    finalReportBySession = new Map();
     spawn(prompt, agentId = 'claude-code', options) {
         const adapter = getAdapter(agentId);
         if (!adapter) {
@@ -121,14 +134,50 @@ export class SessionManager {
             if (event.type !== 'exit')
                 return;
             const data = event.data;
+            const completedAt = Date.now();
+            // Surface completedAt to API consumers reading the still-in-memory
+            // session (Bug 2 sister-fix, May 2). Without this, /api/tasks shows
+            // status=completed but no completedAt → NaN duration in the UI.
+            this.completedAtBySession.set(session.sessionId, completedAt);
             appendCompleted({
                 id: session.sessionId,
                 status: session.status,
-                durationMs: Number(data?.durationMs ?? Date.now() - session.startedAt),
-                completedAt: Date.now(),
+                durationMs: Number(data?.durationMs ?? completedAt - session.startedAt),
+                completedAt,
                 steps: session.steps ? [...session.steps] : undefined,
                 artifacts: session.artifacts,
             });
+            // PM-UX Layer 3 · Final Report MVP. Fire-and-forget; the report appears
+            // in the terminal a few seconds after exit. Failure modes return null
+            // silently (claude CLI not installed, timeout, non-zero exit). No SSE,
+            // no UI integration in this MVP — terminal output only so the dogfood
+            // loop sees the artifact immediately. See `generate-final-report.ts`.
+            const reportInput = {
+                sessionId: session.sessionId,
+                prompt: session.prompt,
+                agent: session.agent,
+                status: session.status,
+                durationMs: completedAt - session.startedAt,
+                steps: session.steps ? [...session.steps] : [],
+                artifacts: session.artifacts,
+            };
+            generateFinalReport(reportInput)
+                .then((report) => {
+                if (report) {
+                    // Cache for web UI consumption via /api/tasks (iter 12 — non-technical
+                    // users live in the web UI, not the terminal).
+                    this.finalReportBySession.set(session.sessionId, report);
+                    try {
+                        printFinalReportToTerminal(reportInput, report);
+                    }
+                    catch {
+                        // Don't let a print failure crash the daemon.
+                    }
+                }
+            })
+                .catch(() => {
+                // generateFinalReport never throws by contract; defensive only.
+            });
             unsubscribe();
         });
         return session;
@@ -137,6 +186,20 @@ export class SessionManager {
     listPersisted() {
         return this.persistedCache;
     }
+    /** Completion timestamp for an in-memory session, if it has exited.
+     *  Returns undefined if the session is still running OR was never spawned
+     *  through this manager. Bug 2 sister-fix (May 2): TaskSession itself has
+     *  no completedAt field; this method lets the API layer compute durations. */
+    getCompletedAt(sessionId) {
+        return this.completedAtBySession.get(sessionId);
+    }
+    /** PM-UX Layer 3 · prose Final Report for an in-memory exited session.
+     *  Returns undefined while generation is in flight OR if the provider chain
+     *  failed (no claude-free, no claude, no credit, etc). The web UI reads this
+     *  through the /api/tasks serializer to render the prose summary inline. */
+    getFinalReport(sessionId) {
+        return this.finalReportBySession.get(sessionId);
+    }
     get(sessionId) {
         return this.sessions.get(sessionId);
     }

package/dist/infrastructure/orchestration/session-persistence.js

@@ -96,7 +96,19 @@ export function loadRecent(limit = 20) {
             prompt: s.prompt,
             cwd: s.cwd,
             startedAt: s.startedAt,
-            status: c.status,
+            // BUG 2 (May 1 2026) — defensive normalization for zombie records.
+            // Pre-fix sessions persisted before commit <THIS> were written with
+            // status='running' even when their completed-record carried real
+            // durationMs/completedAt — the conductor adapter mirrored its status
+            // AFTER emitting the exit event. The fix at the source (conductor-
+            // adapter.ts) prevents new zombies; this normalization repairs old
+            // records on read so the UI doesn't show a "running" badge on a
+            // session that obviously finished. We have no ground truth on what
+            // the actual exit code WAS for these old records, so 'completed' is
+            // the safest default — they'd been displayed as completed in the UI
+            // had this been a session-manager.ts bug. Mark explicitly via a
+            // synthetic note so debug viewers can tell normalization happened.
+            status: c.status === 'running' && c.completedAt > 0 ? 'completed' : c.status,
             durationMs: c.durationMs,
             completedAt: c.completedAt,
             steps: c.steps,

package/dist/infrastructure/protocols/mcp-server-impl.js

@@ -437,10 +437,24 @@ export function startMCPServer(options = {}) {
         // ── E2 · Per-agent readiness (onboarding surface) ─────────────────────────
         // Full registry snapshot: install state + auth state + hints. Powers the
         // setup-aware agent dropdown and the one-click swap flow on auth errors.
+        //
+        // Apr 29: Conductor moved to a separate `auto` field. The web UI IS the
+        // Conductor surface — exposing "conductor" as a peer in the agents array
+        // is the "Gmail asks you to pick 'email' before composing" anti-pattern.
+        // But Conductor's readiness state IS the Auto option's readiness, so the
+        // UI needs it preserved (codex Round 1 caught: fresh install with no
+        // specialists installed would otherwise lose the setup prompt — Auto
+        // gets selected by default, submission fails at /api/task because
+        // conductor.isInstalled() returns false). The separate `auto` field
+        // keeps the setup hint plumbing intact while preventing the dropdown
+        // from showing Conductor as a peer choice.
         if (req.method === 'GET' && req.url === '/api/readiness/agents') {
             try {
+                const all = readinessForAllAgents();
+                const auto = all.find((a) => a.id === 'conductor');
+                const agents = all.filter((a) => a.id !== 'conductor');
                 res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ agents: readinessForAllAgents() }));
+                res.end(JSON.stringify({ agents, auto }));
             }
             catch (e) {
                 res.writeHead(500, { 'Content-Type': 'application/json' });
@@ -485,9 +499,22 @@ export function startMCPServer(options = {}) {
                         // log/spawn. Stops log injection (`agent: "claude-code\n[FAKE]"`),
                         // future-proofs against partial-match exploits, and fails fast
                         // with a clear 400 instead of letting SessionManager.spawn throw.
+                        //
+                        // Apr 29: default flipped from 'claude-code' to 'conductor'. The web
+                        // UI is the Conductor surface; tasks submitted without an explicit
+                        // agent route through the supervisor (rule-based routing today,
+                        // LLM classifier in v0.6). Empty string is treated like undefined
+                        // so the form submitting `agent: ""` (Auto option) hits the same
+                        // path. Specialists remain explicit overrides via the dropdown.
+                        // Type-check is preserved: non-string non-undefined values still 400.
+                        if (agent !== undefined && agent !== null && typeof agent !== 'string') {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'agent must be a string or omitted' }));
+                            return;
+                        }
                         const validAgentIds = new Set(allAdapters().map((a) => a.id));
-                        const agentId = agent ?? 'claude-code';
-                        if (typeof agentId !== 'string' || !validAgentIds.has(agentId)) {
+                        const agentId = (typeof agent === 'string' && agent.length > 0) ? agent : 'conductor';
+                        if (!validAgentIds.has(agentId)) {
                             res.writeHead(400, { 'Content-Type': 'application/json' });
                             res.end(JSON.stringify({
                                 error: `Unknown agent: ${typeof agentId === 'string' ? agentId.slice(0, 64) : '<non-string>'}`,
@@ -521,16 +548,29 @@ export function startMCPServer(options = {}) {
                 return;
             }
             if (req.method === 'GET' && req.url === '/api/tasks') {
-                const spawned = manager.list().map((s) => ({
-                    sessionId: s.sessionId,
-                    prompt: s.prompt,
-                    startedAt: s.startedAt,
-                    status: s.status,
-                    agent: s.agent,
-                    steps: s.steps ?? [],
-                    artifacts: s.artifacts,
-                    provenance: 'spawned',
-                }));
+                const spawned = manager.list().map((s) => {
+                    // Bug 2 sister-fix (May 2): include completedAt for in-memory exited
+                    // sessions so the UI can compute duration. TaskSession interface
+                    // intentionally lacks completedAt; SessionManager tracks it separately
+                    // in completedAtBySession map (populated when exit event fires).
+                    const completedAt = manager.getCompletedAt(s.sessionId);
+                    const finalReport = manager.getFinalReport(s.sessionId);
+                    return {
+                        sessionId: s.sessionId,
+                        prompt: s.prompt,
+                        startedAt: s.startedAt,
+                        status: s.status,
+                        agent: s.agent,
+                        steps: s.steps ?? [],
+                        artifacts: s.artifacts,
+                        ...(completedAt !== undefined ? { completedAt, durationMs: completedAt - s.startedAt } : {}),
+                        ...(finalReport !== undefined ? { finalReport } : {}),
+                        // Iter 12 — surface canAppendMessage so the UI knows whether to
+                        // render the reply input or a disabled "follow-up unsupported" state.
+                        canAppendMessage: s.canAppendMessage === true,
+                        provenance: 'spawned',
+                    };
+                });
                 const activeAgents = manager.listActiveAgents();
                 const persisted = manager.listPersisted();
                 // Layer 7: timestamp of most recent hook-audit line (= "last edit on this machine")
@@ -554,7 +594,7 @@ export function startMCPServer(options = {}) {
                 return;
             }
             // /api/task/:id/events  or  /api/task/:id/kill
-            const m = req.url.match(/^\/api\/task\/([^/]+)\/(events|kill)$/);
+            const m = req.url.match(/^\/api\/task\/([^/]+)\/(events|kill|message)$/);
             if (m) {
                 const [, sessionId, verb] = m;
                 const session = manager.get(sessionId);
@@ -585,6 +625,38 @@ export function startMCPServer(options = {}) {
                     res.end(JSON.stringify({ sessionId, status: session.status }));
                     return;
                 }
+                // Iter 12 — POST /api/task/:id/message — follow-up message to a
+                // completed session. The reply-to-thread surface in the web UI calls
+                // this. Body: { text }. Response: { result, durationMs }.
+                if (verb === 'message' && req.method === 'POST') {
+                    if (!session.canAppendMessage || !session.appendMessage) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: `Agent ${session.agent} does not support follow-up messages yet.` }));
+                        return;
+                    }
+                    let body = '';
+                    req.on('data', (c) => { body += c.toString('utf-8'); });
+                    req.on('end', async () => {
+                        try {
+                            const parsed = JSON.parse(body || '{}');
+                            const text = (parsed.text ?? '').trim();
+                            if (!text) {
+                                res.writeHead(400, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: 'text is required' }));
+                                return;
+                            }
+                            const out = await session.appendMessage(text);
+                            res.writeHead(200, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ sessionId, ...out }));
+                        }
+                        catch (err) {
+                            const msg = err instanceof Error ? err.message : String(err);
+                            res.writeHead(500, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: msg }));
+                        }
+                    });
+                    return;
+                }
             }
             res.writeHead(405, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Method not allowed for this path' }));