conductor-oss 0.2.19 → 0.3.0

package/web/.next/standalone/packages/web/src/app/api/auth/session/route.ts

@@ -1,54 +1,6 @@
-import { type NextRequest, NextResponse } from "next/server";
-import {
-  BUILTIN_REMOTE_SESSION_COOKIE,
-  createBuiltinRemoteSessionValue,
-  getBuiltinRemoteSessionCookieOptions,
-  isBuiltinRemoteAuthEnabled,
-  isValidBuiltinAccessToken,
-} from "@/lib/remoteAuth";
+import { openProxyRoute } from "@/lib/proxyRoutes";
 
-type SessionRequestBody = {
-  token?: unknown;
-};
+export const dynamic = "force-dynamic";
 
-function clearSession(response: NextResponse): void {
-  response.cookies.set(BUILTIN_REMOTE_SESSION_COOKIE, "", {
-    ...getBuiltinRemoteSessionCookieOptions(false),
-    maxAge: 0,
-  });
-}
-
-export async function POST(request: NextRequest): Promise<NextResponse> {
-  if (!isBuiltinRemoteAuthEnabled()) {
-    return NextResponse.json({ error: "Built-in remote auth is not enabled" }, { status: 404 });
-  }
-
-  const body = (await request.json().catch(() => null)) as SessionRequestBody | null;
-  const token = typeof body?.token === "string" ? body.token.trim() : "";
-  if (!isValidBuiltinAccessToken(token)) {
-    return NextResponse.json({ error: "Invalid access token" }, { status: 403 });
-  }
-
-  const response = NextResponse.json({ ok: true });
-  response.cookies.set(
-    BUILTIN_REMOTE_SESSION_COOKIE,
-    await createBuiltinRemoteSessionValue(),
-    getBuiltinRemoteSessionCookieOptions(request.nextUrl.protocol === "https:"),
-  );
-  return response;
-}
-
-export async function DELETE(request: NextRequest): Promise<NextResponse> {
-  const response = NextResponse.json({ ok: true });
-  clearSession(response);
-
-  if (!isBuiltinRemoteAuthEnabled()) {
-    return response;
-  }
-
-  response.cookies.set(BUILTIN_REMOTE_SESSION_COOKIE, "", {
-    ...getBuiltinRemoteSessionCookieOptions(request.nextUrl.protocol === "https:"),
-    maxAge: 0,
-  });
-  return response;
-}
+export const POST = openProxyRoute("/api/auth/session");
+export const DELETE = openProxyRoute("/api/auth/session");

package/web/.next/standalone/packages/web/src/app/api/boards/route.ts

@@ -1,520 +1,6 @@
-import { type NextRequest, NextResponse } from "next/server";
-import { createHash } from "node:crypto";
-import { basename, dirname, join, resolve, sep } from "node:path";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import type { OrchestratorConfig } from "@conductor-oss/core";
-import {
-  buildBoardProjectMap,
-  discoverBoards,
-  parseBoardSections,
-  parseChecklistItems,
-  resolveBoardAliasesForPath,
-  resolveColumnsFromBoard,
-} from "@conductor-oss/core";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
-import { getServices } from "@/lib/services";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-type BoardRole = "intake" | "ready" | "dispatching" | "inProgress" | "review" | "done" | "blocked";
-
-type BoardTask = {
-  id: string;
-  text: string;
-  checked: boolean;
-  agent: string | null;
-  project: string | null;
-  type: string | null;
-  priority: string | null;
-  taskRef: string | null;
-  attemptRef: string | null;
-};
-
-type BoardColumn = {
-  role: BoardRole;
-  heading: string;
-  tasks: BoardTask[];
-};
-
-const BOARD_ROLE_ORDER: BoardRole[] = ["intake", "ready", "dispatching", "inProgress", "review", "done", "blocked"];
-const PRIMARY_BOARD_ROLES: BoardRole[] = ["intake", "inProgress", "review", "done"];
-type ProjectConfig = OrchestratorConfig["projects"][string];
-type ProjectEntry = { id: string; project: ProjectConfig };
-
-function asNonEmptyString(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-
-function expandHome(value: string): string {
-  if (value.startsWith("~/")) {
-    return resolve(homedir(), value.slice(2));
-  }
-  return resolve(value);
-}
-
-function constrainToWorkspacePath(workspacePath: string, candidatePath: string): string {
-  const workspaceRoot = resolve(workspacePath);
-  const candidate = resolve(candidatePath);
-  const workspacePrefix = workspaceRoot.endsWith(sep) ? workspaceRoot : `${workspaceRoot}${sep}`;
-  if (candidate !== workspaceRoot && !candidate.startsWith(workspacePrefix)) {
-    throw new Error("Resolved path escapes workspace root");
-  }
-  return candidate;
-}
-
-function normalizeToken(value: string): string {
-  const input = value.trim().toLowerCase();
-  let output = "";
-  let prevDash = false;
-
-  for (const char of input) {
-    const code = char.charCodeAt(0);
-    const isDigit = code >= 48 && code <= 57;
-    const isLowerAlpha = code >= 97 && code <= 122;
-    const isSafeLiteral = char === "." || char === "_" || isDigit || isLowerAlpha;
-
-    if (isSafeLiteral) {
-      output += char;
-      prevDash = false;
-      continue;
-    }
-
-    if (!prevDash && output.length > 0) {
-      output += "-";
-      prevDash = true;
-    }
-  }
-
-  while (output.endsWith("-")) {
-    output = output.slice(0, -1);
-  }
-
-  return output;
-}
-
-function lastPathSegment(value: string): string {
-  const normalized = value.replaceAll("\\", "/");
-  const segments = normalized.split("/").filter(Boolean);
-  return segments[segments.length - 1] ?? "";
-}
-
-function projectDirectorySegment(projectEntry: ProjectEntry): string {
-  const configuredBoardDir = typeof projectEntry.project.boardDir === "string"
-    ? lastPathSegment(projectEntry.project.boardDir)
-    : "";
-  const pathBase = lastPathSegment(basename(projectEntry.project.path));
-  const rawSegment = configuredBoardDir || pathBase || projectEntry.id;
-  const normalized = normalizeToken(rawSegment);
-  return normalized || "project";
-}
-
-function normalizeTag(value: string): string {
-  return normalizeToken(value);
-}
-
-function findProjectEntry(config: OrchestratorConfig, requestedProjectId: string): ProjectEntry | null {
-  for (const [id, project] of Object.entries(config.projects)) {
-    if (id === requestedProjectId) {
-      return { id, project };
-    }
-  }
-  return null;
-}
-
-function resolveWorkspacePath(config: OrchestratorConfig): string {
-  if (process.env["CONDUCTOR_WORKSPACE"]?.trim()) {
-    return expandHome(process.env["CONDUCTOR_WORKSPACE"]);
-  }
-
-  if (config.configPath) {
-    return dirname(config.configPath);
-  }
-
-  return resolve(process.cwd());
-}
-
-function resolveProjectBoardPath(config: OrchestratorConfig, projectEntry: ProjectEntry, workspacePath: string): string {
-  const workspaceRoot = resolve(workspacePath);
-  const boards = discoverBoards(workspaceRoot, config.boards?.length ? config.boards : config);
-  const boardMap = buildBoardProjectMap(boards, config);
-  const mappedPath = boards.find((path) => boardMap.get(path) === projectEntry.id);
-  if (mappedPath) {
-    const safeMappedPath = constrainToWorkspacePath(workspaceRoot, mappedPath);
-    if (existsSync(safeMappedPath)) return safeMappedPath;
-  }
-
-  // Only use a sanitized project-id segment for new board path creation.
-  // Existing custom board files are still handled above via board discovery mapping.
-  const fallbackSegment = projectDirectorySegment(projectEntry);
-
-  const preferredProjectBoard = constrainToWorkspacePath(
-    workspaceRoot,
-    join(workspaceRoot, "projects", fallbackSegment, "CONDUCTOR.md"),
-  );
-  const localProjectBoard = constrainToWorkspacePath(
-    workspaceRoot,
-    join(workspaceRoot, fallbackSegment, "CONDUCTOR.md"),
-  );
-  if (existsSync(preferredProjectBoard)) return preferredProjectBoard;
-  if (existsSync(localProjectBoard)) return localProjectBoard;
-  return preferredProjectBoard;
-}
-
-function buildStarterBoard(projectId: string, headings: Record<BoardRole, string>): string {
-  const title = projectId.replace(/[-_]+/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
-
-  return [
-    `# ${title} Board`,
-    "",
-    "<!-- Managed by conductor dashboard and Obsidian board watcher -->",
-    "",
-    `## ${headings.intake}`,
-    "",
-    `## ${headings.ready}`,
-    "",
-    `## ${headings.dispatching}`,
-    "",
-    `## ${headings.inProgress}`,
-    "",
-    `## ${headings.review}`,
-    "",
-    `## ${headings.done}`,
-    "",
-    `## ${headings.blocked}`,
-    "",
-  ].join("\n");
-}
-
-async function readOrInitializeBoard(
-  config: OrchestratorConfig,
-  projectEntry: ProjectEntry,
-  workspacePath: string,
-): Promise<{ boardPath: string; content: string; columnsByRole: Record<BoardRole, string> }> {
-  const unresolvedBoardPath = resolveProjectBoardPath(config, projectEntry, workspacePath);
-  const boardPath = constrainToWorkspacePath(workspacePath, unresolvedBoardPath);
-  const aliases = resolveBoardAliasesForPath(config, workspacePath, boardPath);
-
-  let content: string;
-  if (!existsSync(boardPath)) {
-    await mkdir(dirname(boardPath), { recursive: true });
-    const headings = {
-      intake: aliases.intake[0] ?? "Inbox",
-      ready: aliases.ready[0] ?? "Ready to Dispatch",
-      dispatching: aliases.dispatching[0] ?? "Dispatching",
-      inProgress: aliases.inProgress[0] ?? "In Progress",
-      review: aliases.review[0] ?? "Review",
-      done: aliases.done[0] ?? "Done",
-      blocked: aliases.blocked[0] ?? "Blocked",
-    };
-    content = buildStarterBoard(projectEntry.id, headings);
-    await writeFile(boardPath, content, "utf8");
-  } else {
-    content = await readFile(boardPath, "utf8");
-  }
-
-  const resolved = resolveColumnsFromBoard(content, aliases);
-  return {
-    boardPath,
-    content,
-    columnsByRole: resolved.columnsByRole as Record<BoardRole, string>,
-  };
-}
-
-function extractTag(text: string, key: string): string | null {
-  const match = text.match(new RegExp(`#${key}/([\\w.-]+)`, "i"));
-  return match?.[1] ?? null;
-}
-
-function extractMarker(text: string, marker: "task" | "attempt"): string | null {
-  const match = text.match(new RegExp(`\\[${marker}:([^\\]]+)\\]`, "i"));
-  return match?.[1]?.trim() ?? null;
-}
-
-function cleanCardText(text: string): string {
-  return text
-    .replace(/\s*!\[\[[^\]]+\]\]/g, "")
-    .replace(/\s*!\[[^\]]*\]\([^)]+\)/g, "")
-    .replace(/\s*\[\[[^\]]+\]\]/g, "")
-    .replace(/\s*\[[^\]]*\]\([^)]+\)/g, "")
-    .replace(/\s*\[(task|attempt|parent):[^\]]+\]/gi, "")
-    .replace(/\s*#(project|agent|type|priority)\/[\w.-]+/gi, "")
-    .replace(/\s+/g, " ")
-    .trim();
-}
-
-function hashTaskId(seed: string): string {
-  return createHash("sha1").update(seed).digest("hex").slice(0, 12);
-}
-
-function parseColumns(content: string, columnsByRole: Record<BoardRole, string>): BoardColumn[] {
-  const sections = parseBoardSections(content);
-  const byHeading = new Map(sections.map((section) => [section.heading, section]));
-
-  return BOARD_ROLE_ORDER.map((role) => {
-    const heading = columnsByRole[role];
-    const section = byHeading.get(heading);
-    const tasks: BoardTask[] = section
-      ? parseChecklistItems(section).map((item) => {
-          const taskRef = extractMarker(item.text, "task");
-          const attemptRef = extractMarker(item.text, "attempt");
-          const cleaned = cleanCardText(item.text);
-          const seed = `${role}:${section.heading}:${item.lineOffset}:${item.text}`;
-
-          return {
-            id: taskRef ?? hashTaskId(seed),
-            text: cleaned,
-            checked: item.checked,
-            agent: extractTag(item.text, "agent"),
-            project: extractTag(item.text, "project"),
-            type: extractTag(item.text, "type"),
-            priority: extractTag(item.text, "priority"),
-            taskRef,
-            attemptRef,
-          };
-        })
-      : [];
-
-    return {
-      role,
-      heading,
-      tasks,
-    };
-  });
-}
-
-function insertTaskLine(content: string, heading: string, line: string): string {
-  const lines = content.split("\n");
-  const sections = parseBoardSections(content);
-  const target = sections.find((section) => section.heading === heading);
-
-  if (!target) {
-    const trimmed = content.trimEnd();
-    if (trimmed.length === 0) {
-      return `## ${heading}\n\n${line}\n`;
-    }
-    return `${trimmed}\n\n## ${heading}\n\n${line}\n`;
-  }
-
-  const insertIndex = target.bodyStartLine;
-  lines.splice(insertIndex, 0, line);
-  return lines.join("\n");
-}
-
-function normalizeAttachmentPath(value: string): string | null {
-  if (!value.trim()) return null;
-  let normalized = value.trim();
-
-  if (normalized.startsWith("![[") && normalized.endsWith("]]")) {
-    normalized = normalized.slice(3, -2).trim();
-  } else if (normalized.startsWith("[[") && normalized.endsWith("]]")) {
-    normalized = normalized.slice(2, -2).trim();
-  }
-
-  if (!normalized) return null;
-  if (
-    normalized.startsWith("/")
-    || normalized.startsWith("~")
-    || normalized.startsWith("obsidian://")
-    || /^[a-z][a-z0-9+.-]*:\/\//i.test(normalized)
-  ) {
-    return null;
-  }
-
-  normalized = normalized.replace(/\\/g, "/").replace(/^\.\/+/, "").trim();
-  const pipeIndex = normalized.indexOf("|");
-  if (pipeIndex >= 0) normalized = normalized.slice(0, pipeIndex).trim();
-  const hashIndex = normalized.indexOf("#");
-  if (hashIndex >= 0) normalized = normalized.slice(0, hashIndex).trim();
-
-  const parts = normalized.split("/").map((segment) => segment.trim()).filter(Boolean);
-  if (parts.length === 0) return null;
-  if (parts.some((segment) => segment === "." || segment === "..")) return null;
-  return parts.join("/");
-}
-
-function parseAttachmentPaths(value: unknown): string[] {
-  if (!Array.isArray(value)) return [];
-  const out: string[] = [];
-  const seen = new Set<string>();
-  for (const entry of value) {
-    if (typeof entry !== "string") continue;
-    const normalized = normalizeAttachmentPath(entry);
-    if (!normalized || seen.has(normalized)) continue;
-    seen.add(normalized);
-    out.push(normalized);
-    if (out.length >= 24) break;
-  }
-  return out;
-}
-
-function buildTaskLine(params: {
-  title: string;
-  description: string | null;
-  contextNotes: string | null;
-  attachments: string[];
-  projectId: string;
-  agent: string;
-  type: string | null;
-  priority: string | null;
-}): string {
-  const detailsParts = [params.title];
-  if (params.description) detailsParts.push(params.description);
-  if (params.contextNotes) detailsParts.push(`Context: ${params.contextNotes}`);
-  const details = detailsParts.join(" - ");
-
-  const tags = [
-    `#project/${normalizeTag(params.projectId)}`,
-    `#agent/${normalizeTag(params.agent)}`,
-  ];
-
-  if (params.type) tags.push(`#type/${normalizeTag(params.type)}`);
-  if (params.priority) tags.push(`#priority/${normalizeTag(params.priority)}`);
-
-  const attachments = params.attachments.map((item) => `![[${item}]]`);
-  const parts = [`- [ ] ${details}`];
-  if (attachments.length > 0) parts.push(attachments.join(" "));
-  parts.push(tags.join(" "));
-  return parts.join(" ").trim();
-}
-
-/** GET /api/boards?projectId=<id> -- Return parsed kanban board for a project. */
-export async function GET(request: NextRequest) {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  const projectId = asNonEmptyString(request.nextUrl.searchParams.get("projectId"));
-
-  try {
-    const { config } = await getServices();
-
-    // If no projectId specified, return a summary of all boards
-    if (!projectId) {
-      const boards = Object.entries(config.projects).map(([id, project]) => ({
-        projectId: id,
-        repo: project.repo ?? null,
-        agent: project.agent ?? config.defaults.agent,
-      }));
-      return NextResponse.json({ boards });
-    }
-
-    const projectEntry = findProjectEntry(config, projectId);
-    if (!projectEntry) {
-      return NextResponse.json({ error: `Unknown project: ${projectId}` }, { status: 404 });
-    }
-    const canonicalProjectId = projectEntry.id;
-
-    const workspacePath = resolveWorkspacePath(config);
-    const { boardPath, content, columnsByRole } = await readOrInitializeBoard(
-      config,
-      projectEntry,
-      workspacePath,
-    );
-    const columns = parseColumns(content, columnsByRole);
-
-    return NextResponse.json({
-      projectId: canonicalProjectId,
-      boardPath,
-      workspacePath,
-      columns,
-      primaryRoles: PRIMARY_BOARD_ROLES,
-      watcherHint: "Move cards to Ready to Dispatch to let Obsidian watcher spawn agents.",
-    });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to load board" },
-      { status: 500 },
-    );
-  }
-}
-
-/**
- * POST /api/boards -- Add a task card to a project board.
- * Body: { projectId, title, description?, contextNotes?, attachments?, agent, role?, type?, priority? }
- */
-export async function POST(request: NextRequest) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const body = (await request.json().catch(() => null)) as Record<string, unknown> | null;
-  if (!body) {
-    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
-  }
-
-  const projectId = asNonEmptyString(body.projectId);
-  const title = asNonEmptyString(body.title);
-  const description = asNonEmptyString(body.description);
-  const contextNotes = asNonEmptyString(body.contextNotes)?.replace(/\s+/g, " ").trim() ?? null;
-  const attachments = parseAttachmentPaths(body.attachments);
-  const agent = asNonEmptyString(body.agent);
-  const requestedRole = asNonEmptyString(body.role);
-  const type = asNonEmptyString(body.type);
-  const priority = asNonEmptyString(body.priority);
-
-  if (!projectId) {
-    return NextResponse.json({ error: "projectId is required" }, { status: 400 });
-  }
-  if (!title) {
-    return NextResponse.json({ error: "title is required" }, { status: 400 });
-  }
-  if (!agent) {
-    return NextResponse.json({ error: "agent is required" }, { status: 400 });
-  }
-
-  const role = (requestedRole && BOARD_ROLE_ORDER.includes(requestedRole as BoardRole)
-    ? requestedRole
-    : "intake") as BoardRole;
-
-  try {
-    const { config } = await getServices();
-    const projectEntry = findProjectEntry(config, projectId);
-    if (!projectEntry) {
-      return NextResponse.json({ error: `Unknown project: ${projectId}` }, { status: 404 });
-    }
-    const canonicalProjectId = projectEntry.id;
-
-    const workspacePath = resolveWorkspacePath(config);
-    const { boardPath, content, columnsByRole } = await readOrInitializeBoard(
-      config,
-      projectEntry,
-      workspacePath,
-    );
-    const heading = columnsByRole[role];
-    const line = buildTaskLine({
-      title,
-      description,
-      contextNotes,
-      attachments,
-      projectId: canonicalProjectId,
-      agent,
-      type,
-      priority,
-    });
-
-    const updated = insertTaskLine(content, heading, line);
-    await writeFile(boardPath, updated, "utf8");
-
-    const columns = parseColumns(updated, columnsByRole);
-    return NextResponse.json({
-      projectId: canonicalProjectId,
-      boardPath,
-      columns,
-      primaryRoles: PRIMARY_BOARD_ROLES,
-      created: {
-        role,
-        heading,
-        line,
-      },
-    }, { status: 201 });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to create board task" },
-      { status: 500 },
-    );
-  }
-}
+export const GET = guardedProxyRoute("/api/boards", { role: "viewer" });
+export const POST = guardedProxyRoute("/api/boards", { role: "operator", requireActionGuard: true });

package/web/.next/standalone/packages/web/src/app/api/config/route.ts

@@ -1,81 +1,5 @@
-import { NextResponse } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
-import { existsSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-function resolveBoardFile(
-  workspacePath: string,
-  boardDir: string | undefined,
-  projectPath: string | undefined,
-): string {
-  const candidates: string[] = [];
-
-  if (boardDir && boardDir.trim().length > 0) {
-    const trimmed = boardDir.trim();
-    if (trimmed.endsWith(".md")) {
-      candidates.push(trimmed);
-      candidates.push(join("projects", trimmed));
-    } else {
-      candidates.push(join(trimmed, "CONDUCTOR.md"));
-      candidates.push(join("projects", trimmed, "CONDUCTOR.md"));
-    }
-  }
-
-  if (projectPath && projectPath.trim().length > 0) {
-    const name = basename(projectPath.trim());
-    if (name) {
-      candidates.push(join(name, "CONDUCTOR.md"));
-      candidates.push(join("projects", name, "CONDUCTOR.md"));
-    }
-  }
-
-  const uniqueCandidates = [...new Set(candidates)];
-  for (const rel of uniqueCandidates) {
-    if (existsSync(join(workspacePath, rel))) {
-      return rel;
-    }
-  }
-
-  return uniqueCandidates[0] ?? "CONDUCTOR.md";
-}
-
-/** GET /api/config -- Return configured projects and their board paths. */
-export async function GET() {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-  try {
-    const { config } = await getServices();
-    const workspacePath =
-      process.env["CONDUCTOR_WORKSPACE"] ??
-      dirname(config.configPath) ??
-      `${process.env["HOME"]}/.conductor/workspace`;
-
-    const projects = Object.entries(config.projects).map(([id, project]) => {
-      const boardDir = (project as { boardDir?: string }).boardDir ?? id;
-      return {
-        id,
-        repo: (project as { repo?: string }).repo ?? null,
-        iconUrl: (project as { iconUrl?: string }).iconUrl ?? null,
-        boardDir,
-        boardFile: resolveBoardFile(
-          workspacePath,
-          boardDir,
-          (project as { path?: string }).path,
-        ),
-        description: (project as { description?: string }).description ?? null,
-        agent: (project as { agent?: string }).agent ?? "claude-code",
-        agentModel: (project as { agentConfig?: { model?: string } }).agentConfig?.model ?? null,
-        agentReasoningEffort: (project as { agentConfig?: { reasoningEffort?: string } }).agentConfig?.reasoningEffort ?? null,
-      };
-    });
-    return NextResponse.json({ projects });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to load config" },
-      { status: 500 },
-    );
-  }
-}
+export const GET = guardedProxyRoute("/api/config", { role: "viewer" });