codehere 0.5.0-alpha.4 → 0.5.0-alpha.6

package/dist/infrastructure/protocols/mcp-server-impl.js

@@ -25,9 +25,13 @@ import { fileURLToPath } from 'url';
 import { collectFilesForMCP, scoreFileForMCP } from './mcp-helpers.js';
 import { scanPayload, calculateRiskScore, AUDIT_FILE } from '../hooks/claude-sdk-hook.js';
 import { getVersion } from '../../utils/version.js';
-import { TASK_HTML, HISTORY_HTML } from './ui-page.js';
+import { TASK_HTML, HISTORY_HTML, THREAD_HTML } from './ui-page.js';
 import { SessionManager, availableAgents, readinessForAllAgents, getAdapter, allAdapters, } from '../orchestration/session-manager.js';
 import { isAbsolute } from 'path';
+import { readCrossToolAgents } from '../storage/cross-tool-agents.js';
+import { listProjects, readProjectThread } from '../storage/project-thread-reader.js';
+import { mirrorReplyToThread } from '../storage/project-thread-mirror.js';
+import { randomUUID } from 'crypto';
 import { installAgent } from '../orchestration/agent-installer.js';
 import { detectReadiness } from '../orchestration/readiness.js';
 // ── Tool definitions ─────────────────────────────────────────────────────────
@@ -81,6 +85,28 @@ const TOOLS = [
 // ── Tool handlers ────────────────────────────────────────────────────────────
 import { homedir } from 'os';
 const AUDIT_FILE_PATH = join(homedir(), '.codehere', 'audit', 'hook-events.jsonl');
+/**
+ * Dev-only behavior-observer injection (v0.6.0 — elu joined the team roster
+ * 2026-05-03 as behavior reviewer). Activated only when CODEHERE_DEV_ELU=1
+ * is set in the founder's local env; never in shipped releases. The script's
+ * public key is meant for client-side embedding (analytics tracking key, not
+ * a secret) so committing the URL is safe.
+ *
+ * Why runtime injection instead of editing TASK_HTML/HISTORY_HTML directly:
+ * the templates stay identical between dev and release builds. The only
+ * delta is the env var. This keeps the release surface clean (zero-telemetry
+ * value per PRD §1.5 #2 stays intact) while letting elu observe founder
+ * dogfood sessions.
+ *
+ * Removal trigger lives in team_roster.md memory: if elu produces zero
+ * unique findings within one month, remove this helper + roster entry.
+ */
+const ELU_DEV_SCRIPT = '<script async src="https://elu.dev/v1/elu_pk_live_HrKo9yFFLx03tz9xuSKFcE2Jpv.js"></script>';
+function withDevElu(html) {
+    if (process.env.CODEHERE_DEV_ELU !== '1')
+        return html;
+    return html.replace('</head>', `${ELU_DEV_SCRIPT}\n</head>`);
+}
 function handleTrust(params) {
     const { filepath, code, verbose } = params;
     let content;
@@ -270,13 +296,19 @@ export function startMCPServer(options = {}) {
         // v0.3 primary UI: task intake + active sessions
         if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(TASK_HTML);
+            res.end(withDevElu(TASK_HTML));
             return;
         }
         // History / audit feed (what we built Day 0; now secondary)
         if (req.method === 'GET' && (req.url === '/history' || req.url === '/history/')) {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(HISTORY_HTML);
+            res.end(withDevElu(HISTORY_HTML));
+            return;
+        }
+        // v0.6.0 M1 — project thread view; consumes /api/projects + /api/projects/:slug
+        if (req.method === 'GET' && (req.url === '/threads' || req.url === '/threads/' || req.url?.startsWith('/threads?'))) {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(withDevElu(THREAD_HTML));
             return;
         }
         // Backwards-compat: /ui used to be the Mission Control audit view — now at /history
@@ -453,8 +485,28 @@ export function startMCPServer(options = {}) {
                 const all = readinessForAllAgents();
                 const auto = all.find((a) => a.id === 'conductor');
                 const agents = all.filter((a) => a.id !== 'conductor');
+                // v0.6.0 M8 — surface cross-tool agent definitions (.opencode/agents/,
+                // .claude/agents/, .codehere/agents/) alongside the built-in adapters.
+                // These don't have a `state` (ready/needs_install) — they're definitions
+                // not runtimes. UI can render them as "available specialists" tagged
+                // with their source format. Best-effort: failures fall back to no
+                // cross-tool agents listed.
+                let crossTool = [];
+                try {
+                    const result = readCrossToolAgents(process.cwd());
+                    crossTool = result.agents.map((a) => ({
+                        name: a.name,
+                        description: a.description.length > 240 ? a.description.slice(0, 237) + '…' : a.description,
+                        sourceFormat: a.sourceFormat,
+                        mode: a.mode,
+                        sourcePath: a.sourcePath,
+                    }));
+                }
+                catch {
+                    // best-effort; ignore parse failures
+                }
                 res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ agents, auto }));
+                res.end(JSON.stringify({ agents, auto, crossTool }));
             }
             catch (e) {
                 res.writeHead(500, { 'Content-Type': 'application/json' });
@@ -475,6 +527,49 @@ export function startMCPServer(options = {}) {
             }
             return;
         }
+        // ── v0.6.0 M1 project thread routes ──────────────────────────────────────
+        // GET /api/projects           — list all known projects (slug, cwd, title, taskCount, lastActivityAt)
+        // GET /api/projects/:slug     — single project thread (meta + tasks merged by sessionId)
+        // Reader source of truth: ~/.codehere/projects/<slug>/thread.jsonl (per-project append-only log
+        // populated by migration + forward-mirror). Drives the new thread-view UI.
+        if (req.method === 'GET' && req.url === '/api/projects') {
+            try {
+                const projects = listProjects();
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ projects }));
+            }
+            catch (e) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'list_projects_failed', detail: String(e) }));
+            }
+            return;
+        }
+        if (req.method === 'GET' && req.url?.startsWith('/api/projects/')) {
+            try {
+                // Slug is the segment after /api/projects/. Strip optional query string.
+                const slug = req.url.replace('/api/projects/', '').split('?')[0];
+                // Slug shape is sha1[:12] (12 hex chars) OR the literal 'unknown' bucket.
+                // Reject anything else to keep the surface tight (and stop ../ traversal).
+                if (!/^([a-f0-9]{12}|unknown)$/.test(slug)) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'invalid_slug' }));
+                    return;
+                }
+                const thread = readProjectThread(slug);
+                if (!thread) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'project_not_found', slug }));
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ thread }));
+            }
+            catch (e) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'read_project_failed', detail: String(e) }));
+            }
+            return;
+        }
         // ── F1 task orchestration routes ─────────────────────────────────────────
         // POST /api/task               — { prompt, cwd? } → { sessionId }
         // GET  /api/tasks              — list all sessions
@@ -560,6 +655,7 @@ export function startMCPServer(options = {}) {
                     // in completedAtBySession map (populated when exit event fires).
                     const completedAt = manager.getCompletedAt(s.sessionId);
                     const finalReport = manager.getFinalReport(s.sessionId);
+                    const cwd = manager.getCwd(s.sessionId);
                     return {
                         sessionId: s.sessionId,
                         prompt: s.prompt,
@@ -573,6 +669,10 @@ export function startMCPServer(options = {}) {
                         // Iter 12 — surface canAppendMessage so the UI knows whether to
                         // render the reply input or a disabled "follow-up unsupported" state.
                         canAppendMessage: s.canAppendMessage === true,
+                        // v0.6.x Slack-shape spike — surface cwd so the dashboard's
+                        // "Continue thread" intake button can find the most recent
+                        // in-memory session for the current folder.
+                        ...(cwd !== undefined ? { cwd } : {}),
                         provenance: 'spawned',
                     };
                 });
@@ -650,7 +750,32 @@ export function startMCPServer(options = {}) {
                                 res.end(JSON.stringify({ error: 'text is required' }));
                                 return;
                             }
+                            const replyStartedAt = Date.now();
                             const out = await session.appendMessage(text);
+                            const replyCompletedAt = Date.now();
+                            // v0.6.x — forward-mirror the reply turn into the project thread
+                            // so /threads sees follow-ups as visible chronological turns
+                            // (not just the original spawn). Best-effort: mirror failures
+                            // never break the reply path.
+                            try {
+                                const replyCwd = manager.getCwd(sessionId);
+                                if (replyCwd) {
+                                    mirrorReplyToThread({
+                                        parentSessionId: sessionId,
+                                        replySessionId: randomUUID(),
+                                        agent: session.agent,
+                                        prompt: text,
+                                        cwd: replyCwd,
+                                        startedAt: replyStartedAt,
+                                        completedAt: replyCompletedAt,
+                                        durationMs: out.durationMs,
+                                        result: out.result,
+                                    });
+                                }
+                            }
+                            catch {
+                                /* mirror is best-effort */
+                            }
                             res.writeHead(200, { 'Content-Type': 'application/json' });
                             res.end(JSON.stringify({ sessionId, ...out }));
                         }