coxpit 4.5.0 → 4.7.0

package/src/server.ts

@@ -1,7 +1,7 @@
-import { readFile, readdir } from 'node:fs/promises';
+import { readFile, readdir, realpath, stat } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolve as presolve, dirname as pdirname, join as pjoin } from 'node:path';
+import { resolve as presolve, dirname as pdirname, join as pjoin, sep as psep } from 'node:path';
 import { createRequire } from 'node:module';
 import { randomBytes } from 'node:crypto';
 import Fastify, { type FastifyInstance } from 'fastify';
@@ -13,7 +13,7 @@ import { db } from './db';
 import { machines, repos, tasks, agentRuns, agentEvents, designCaptures, shareLinks, taskGroups } from './db/schema';
 import { BOOKMARKLET_JS } from './design';
 import { runShellOn, shq } from './exec';
-import { launchRun, cleanupRun, stopRun, getRunDiff, loadRunDocs, mergeRun, getRunTermInfo, steerRun, exportRun, prRun, integrateRuns, planFanout, reviewTask, syncRun, openWorkbench, spawnSubtasks, listSubtasks, resolveAgentToken, taskCloseRisk } from './orchestrator';
+import { launchRun, cleanupRun, stopRun, getRunDiff, loadRunDocs, mergeRun, getRunTermInfo, steerRun, exportRun, prRun, integrateRuns, planFanout, reviewTask, syncRun, openWorkbench, spawnSubtasks, listSubtasks, resolveAgentToken, taskCloseRisk, launchGroupTask, isRunLive, askGroupCoordinator, computeRunOutputs, normalizeOutputs, listReclaimableWorktrees, pruneWorktrees } from './orchestrator';
 import { openTerm } from './term';
 import { addSink, removeSink, broadcast } from './hub';
 import { getProvider, listProviders } from './providers';
@@ -50,6 +50,19 @@ function mdLiteHTML(src: string): string {
   return s;
 }
 
+/** 확장자 → content-type 추론(파일 미리보기용). 미지 = octet-stream. */
+function contentTypeFor(path: string): string {
+  const ext = (path.split('.').pop() ?? '').toLowerCase();
+  const map: Record<string, string> = {
+    png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif',
+    webp: 'image/webp', svg: 'image/svg+xml', bmp: 'image/bmp', ico: 'image/x-icon',
+    avif: 'image/avif', pdf: 'application/pdf', txt: 'text/plain; charset=utf-8',
+    md: 'text/plain; charset=utf-8', json: 'application/json', csv: 'text/csv; charset=utf-8',
+    html: 'text/html; charset=utf-8', htm: 'text/html; charset=utf-8',
+  };
+  return map[ext] ?? 'application/octet-stream';
+}
+
 /** 공유 페이지 Documents 섹션 — md 는 mdLiteHTML, html 은 sandbox iframe. */
 function shareDocsHTML(docs: Array<{ path: string; kind: string; content: string }>): string {
   if (!docs.length) return '';
@@ -242,6 +255,23 @@ export async function buildServer(): Promise<FastifyInstance> {
     return { total: total0, rows };
   });
 
+  // 회수 가능한 고아 worktree — closed task 또는 failed/error/stopped run 의 worktree 만.
+  // running/preparing/pending/done 은 절대 포함 안 됨(활성·성공-미머지 보호). authGate 뒤.
+  app.get('/api/worktrees', async () => {
+    const items = await listReclaimableWorktrees();
+    const totalKb = items.reduce((s, w) => s + (w.sizeKb || 0), 0);
+    return { items, totalKb };
+  });
+
+  // 회수 실행 — body.runIds(선택 부분집합) 또는 전체. cleanupRun 재사용 + git worktree prune.
+  app.post('/api/worktrees/prune', async (req) => {
+    const b = (req.body ?? {}) as { runIds?: number[] };
+    const runIds = Array.isArray(b.runIds)
+      ? b.runIds.map((n) => Number(n)).filter((n) => Number.isInteger(n))
+      : undefined;
+    return pruneWorktrees(runIds);
+  });
+
   // ─── 머신 레지스트리 ────────────────────────────────────────────
   app.get('/api/machines', async () => ({ machines: await db.select().from(machines) }));
 
@@ -481,13 +511,19 @@ export async function buildServer(): Promise<FastifyInstance> {
     const q = (req.query ?? {}) as { path?: string };
     const start = q.path && q.path.startsWith('/') ? q.path : homedir();
     const p = presolve(start);
-    let dirs: Array<{ name: string; isRepo: boolean }> = [];
+    let dirs: Array<{ name: string; isRepo: boolean; isEmpty: boolean }> = [];
     let error: string | undefined;
     try {
       const entries = await readdir(p, { withFileTypes: true });
       for (const e of entries) {
         if (!e.isDirectory() || e.name.startsWith('.')) continue;
-        dirs.push({ name: e.name, isRepo: existsSync(pjoin(p, e.name, '.git')) });
+        const full = pjoin(p, e.name);
+        const isRepo = existsSync(pjoin(full, '.git'));
+        // 빈 폴더면 greenfield "Start here" 대상 — 서버 EMPTYDIR 판정(ls -A)과 동일하게
+        // 모든 엔트리(닷파일 포함) 0개일 때만. repo 폴더는 Register 로 다루므로 계산 생략.
+        let isEmpty = false;
+        if (!isRepo) { try { isEmpty = (await readdir(full)).length === 0; } catch { isEmpty = false; } }
+        dirs.push({ name: e.name, isRepo, isEmpty });
         if (dirs.length >= 300) break;
       }
       dirs.sort((a, b) => (b.isRepo ? 1 : 0) - (a.isRepo ? 1 : 0) || a.name.localeCompare(b.name));
@@ -572,7 +608,7 @@ export async function buildServer(): Promise<FastifyInstance> {
   });
 
   app.post('/api/tasks', async (req, reply) => {
-    const b = (req.body ?? {}) as { repoId?: number; title?: string; prompt?: string; designCaptureId?: number };
+    const b = (req.body ?? {}) as { repoId?: number; title?: string; prompt?: string; designCaptureId?: number; outputs?: unknown };
     const repoId = Number(b.repoId);
     const title = (b.title ?? '').trim();
     if (!repoId || !title) return reply.code(400).send({ error: 'repoId and title required' });
@@ -584,7 +620,9 @@ export async function buildServer(): Promise<FastifyInstance> {
       if (!dc[0]) return reply.code(404).send({ error: 'design capture not found' });
       designCaptureId = dc[0].id;
     }
-    const ins = await db.insert(tasks).values({ repoId, title, prompt: b.prompt ?? '', designCaptureId }).returning();
+    // 산출물 계약(선택) — {answer,code,doc,page,file} 만 허용, 중복 제거, JSON 문자열로 저장.
+    const outputs = normalizeOutputs(b.outputs);
+    const ins = await db.insert(tasks).values({ repoId, title, prompt: b.prompt ?? '', designCaptureId, outputs: JSON.stringify(outputs) }).returning();
     return reply.code(201).send({ ok: true, task: ins[0] });
   });
 
@@ -755,6 +793,115 @@ export async function buildServer(): Promise<FastifyInstance> {
     return reply.code(202).send(res);
   });
 
+  // ─── Goal workroom (v4.6 L1) — 한 그룹(goal/swarm)을 한 방에서 몰기 ────────
+  // steerable = 정착(done/failed/stopped) + sessionId 보유 + worktree 살아있음.
+  // (steerRun 전제 그대로 — 라이브 run 은 steer 불가, 드라이런은 세션 없음.)
+  const groupRuns = async (groupId: number): Promise<{
+    group: typeof taskGroups.$inferSelect;
+    rows: Array<{ run: typeof agentRuns.$inferSelect; task: typeof tasks.$inferSelect }>;
+  } | null> => {
+    const gr = await db.select().from(taskGroups).where(eq(taskGroups.id, groupId)).limit(1);
+    if (!gr[0]) return null;
+    const gts = await db.select().from(tasks).where(eq(tasks.groupId, groupId));
+    const rows: Array<{ run: typeof agentRuns.$inferSelect; task: typeof tasks.$inferSelect }> = [];
+    for (const t of gts) {
+      const trs = await db.select().from(agentRuns).where(eq(agentRuns.taskId, t.id));
+      for (const run of trs) rows.push({ run, task: t });
+    }
+    rows.sort((a, b) => a.run.id - b.run.id);
+    return { group: gr[0], rows };
+  };
+  const isSteerable = (r: typeof agentRuns.$inferSelect): boolean =>
+    !isRunLive(r.id) && ['done', 'failed', 'stopped'].includes(r.status) && !!r.sessionId && !!r.worktreePath;
+
+  // B1 — 애그리게이트 뷰(방의 chips + 최근 타임라인). 페이로드 다이어트: 최근 200 이벤트만.
+  app.get('/api/groups/:id', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const g = await groupRuns(id);
+    if (!g) return reply.code(404).send({ error: 'group not found' });
+    const runs = g.rows.map(({ run, task }) => ({
+      runId: run.id, taskId: task.id, title: task.title, status: run.status,
+      agent: run.agent, model: run.model, branch: run.branch, filesChanged: run.filesChanged,
+      live: isRunLive(run.id), steerable: isSteerable(run),
+      // 수렴 콕핏 결정 행용: 태스크 닫힘 여부 + worktree 생존(터미널 가드·머지 가능성 판단).
+      taskStatus: task.status, hasWorktree: !!run.worktreePath,
+    }));
+    const runIds = g.rows.map((x) => x.run.id);
+    // 이벤트: 그룹 run 전체에서 최근 200개(id 순, 오래된 것 먼저 — 방 피드는 append-only).
+    const evs = runIds.length
+      ? (await db.select().from(agentEvents).where(inArray(agentEvents.runId, runIds)))
+          .sort((a, b) => a.id - b.id).slice(-200)
+      : [];
+    return {
+      group: { id: g.group.id, kind: g.group.kind, title: g.group.title, coordSessionId: g.group.coordSessionId },
+      runs,
+      events: evs.map((e) => ({ runId: e.runId, kind: e.kind, payload: e.payload, ts: e.ts })),
+    };
+  });
+
+  // B2 — "＋ New attempt": 그룹에 새 시도(들)를 발사. repo 는 그룹의 기존 태스크에서 상속.
+  app.post('/api/groups/:id/spawn', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const b = (req.body ?? {}) as { title?: string; prompt?: string; count?: number; real?: boolean };
+    const prompt = (b.prompt ?? '').trim();
+    if (!prompt) return reply.code(400).send({ error: 'prompt required' });
+    const g = await groupRuns(id);
+    if (!g) return reply.code(404).send({ error: 'group not found' });
+    if (!g.rows[0]) return reply.code(409).send({ error: 'group has no tasks to inherit a repo from' });
+    const repoId = g.rows[0].task.repoId; // 형제는 같은 repo 를 공유
+    const title = (b.title ?? '').trim() || prompt.slice(0, 40);
+    const count = Math.max(1, Math.min(5, Number(b.count) || 1));
+    const created: Array<{ id: number; title: string; runId: number }> = [];
+    for (let i = 0; i < count; i++) {
+      created.push(await launchGroupTask(id, repoId, title, prompt, b.real === true));
+    }
+    return reply.code(201).send({ ok: true, tasks: created });
+  });
+
+  // B3 — "→ Broadcast": 그룹의 정착·steerable run 전부에 후속 지시. 라이브/드라이는 정직하게 skip.
+  app.post('/api/groups/:id/steer', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const b = (req.body ?? {}) as { message?: string; mode?: string };
+    const message = (b.message ?? '').trim();
+    if (!message) return reply.code(400).send({ error: 'message required' });
+    const g = await groupRuns(id);
+    if (!g) return reply.code(404).send({ error: 'group not found' });
+    const mode = b.mode === 'ask' ? 'ask' : 'work';
+    let steered = 0;
+    const skipped: Array<{ runId: number; reason: string }> = [];
+    let running = 0, noSession = 0;
+    // 그룹 규모가 작아 순차 for 루프로 충분(폭주 fan-out 없음).
+    for (const { run } of g.rows) {
+      const res = await steerRun(run.id, message, mode);
+      if (res.ok) { steered++; continue; }
+      skipped.push({ runId: run.id, reason: res.detail });
+      if (/still running/.test(res.detail)) running++;
+      else if (/no agent session/.test(res.detail)) noSession++;
+    }
+    const parts = [`${steered} steered`];
+    if (running) parts.push(`${running} still running (steer after they settle)`);
+    if (noSession) parts.push(`${noSession} no session`);
+    const otherSkips = skipped.length - running - noSession;
+    if (otherSkips > 0) parts.push(`${otherSkips} skipped`);
+    return { ok: true, steered, skipped, detail: parts.join(' · ') };
+  });
+  // NOTE(v4.6): queuing a broadcast to apply to running runs once they settle is
+  // explicitly out of scope for L1 — running runs are reported as skipped, not queued.
+
+  // B4 (L2) — "? Ask": 그룹 스코프 읽기 전용 코디네이터. run 발사·steer·파일 쓰기 절대 없음.
+  // askGroupCoordinator 는 getRunDiff(읽기)와 텍스트 반환뿐 — launch/steer/write 경로를 부르지 않는다.
+  app.post('/api/groups/:id/ask', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const b = (req.body ?? {}) as { message?: string; real?: boolean };
+    const message = (b.message ?? '').trim();
+    if (!message) return reply.code(400).send({ error: 'message required' });
+    const g = await groupRuns(id);
+    if (!g) return reply.code(404).send({ error: 'group not found' });
+    const res = await askGroupCoordinator(id, message, b.real === true);
+    if (!res.ok) return reply.code(422).send({ error: res.detail });
+    return { ok: true, answer: res.answer };
+  });
+
   // 통합 — 여러 run(태스크 무관)을 base 에 순차 머지, 충돌은 통합 에이전트 자동 발사.
   app.post('/api/integrate', async (req, reply) => {
     const b = (req.body ?? {}) as { runIds?: number[]; real?: boolean };
@@ -817,6 +964,96 @@ export async function buildServer(): Promise<FastifyInstance> {
     return { ok: true, docs, source };
   });
 
+  // ─── 산출물 계약(v4.7 P1) — 카드 목록 · 뷰어 콘텐츠 · 파일 바이트 ──
+  // 카드 목록: computeRunOutputs 로 병합(매니페스트+git status+answer). 404 = run 없음.
+  app.get('/api/runs/:id/outputs', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+    if (!rr[0]) return reply.code(404).send({ error: 'not found' });
+    const outputs = await computeRunOutputs(id);
+    return { outputs };
+  });
+
+  // 뷰어 콘텐츠: answer/doc → md, page → html(둘 다 loadRunDocs 폴백 재사용).
+  // code 는 별도 콘텐츠 없음 — 클라이언트가 기존 /api/runs/:id/diff 를 재사용한다.
+  app.get('/api/runs/:id/output', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const q = (req.query ?? {}) as { type?: string; path?: string };
+    const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+    if (!rr[0]) return reply.code(404).send({ error: 'not found' });
+    const type = (q.type ?? '').trim();
+    if (type === 'answer') {
+      const cards = await computeRunOutputs(id);
+      const has = cards.some((c) => c.type === 'answer' && c.present);
+      const content = has ? (rr[0].exitSummary || '') : '';
+      // answer 본문은 result 이벤트가 원천 — exitSummary 는 그 클립(≤500자)이라 여기선 이벤트 우선.
+      const evs = await db.select().from(agentEvents).where(eq(agentEvents.runId, id));
+      let answer = content;
+      for (let i = evs.length - 1; i >= 0; i--) {
+        if (evs[i]!.kind !== 'result') continue;
+        try { const o = JSON.parse(evs[i]!.payload) as { result?: string }; if (typeof o.result === 'string' && o.result.trim()) { answer = o.result.trim(); break; } } catch { /* skip */ }
+      }
+      return { kind: 'md', content: answer };
+    }
+    if (type === 'doc' || type === 'page') {
+      const wantKind = type === 'doc' ? 'md' : 'html';
+      const { docs } = await loadRunDocs(id); // worktree→snapshot 폴백 내장
+      const path = (q.path ?? '').trim();
+      const doc = path ? docs.find((d) => d.path === path) : docs.find((d) => d.kind === wantKind);
+      if (!doc) return reply.code(404).send({ error: 'output not found' });
+      return { kind: doc.kind === 'html' ? 'html' : 'md', content: doc.content };
+    }
+    if (type === 'code') {
+      // code 는 콘텐츠 뷰어가 없다 — 컬러 diff 는 클라이언트가 /api/runs/:id/diff 로 재사용.
+      return { kind: 'diff', diffUrl: `/api/runs/${id}/diff` };
+    }
+    return reply.code(400).send({ error: 'type must be one of answer|doc|page|code' });
+  });
+
+  // 파일 바이트(NEW · 보안 임계) — 이미지/바이너리 미리보기용 raw bytes.
+  // 가드: worktree 루트 기준으로 path 를 해석하고, realpath 가 worktree 밖으로
+  // 벗어나면(.. / 절대경로 / 심볼릭링크 탈출) 거부. 크기 상한 ~10MB. worktree 소멸 후 404.
+  const FILE_MAX = 10 * 1024 * 1024;
+  app.get('/api/runs/:id/file', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const q = (req.query ?? {}) as { path?: string };
+    const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+    const run = rr[0];
+    if (!run) return reply.code(404).send({ error: 'not found' });
+    const rel = (q.path ?? '').trim();
+    if (!rel) return reply.code(400).send({ error: 'path required' });
+    // 절대경로 즉시 거부(worktree 밖 강제)
+    if (rel.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(rel)) return reply.code(400).send({ error: 'path must be relative' });
+    if (!run.worktreePath) return reply.code(404).send({ error: 'no worktree' });
+
+    // 원격 머신 파일은 데몬 파일시스템에 없다 — export 와 동일하게 로컬 전용.
+    const mr = await db.select().from(machines).where(eq(machines.id, run.machineId)).limit(1);
+    const mach = mr[0];
+    const isRemote = !!mach && mach.kind !== 'local' && (mach.address ?? '') !== '';
+    if (isRemote) return reply.code(400).send({ error: 'remote file preview not supported' });
+
+    // worktree 루트를 realpath 로 정규화(심링크 해소된 canonical base).
+    let rootReal: string;
+    try { rootReal = await realpath(run.worktreePath); }
+    catch { return reply.code(404).send({ error: 'worktree gone' }); }
+    // 요청 경로 = 루트에 join 후 realpath — 심링크 탈출까지 잡는다.
+    const joined = presolve(rootReal, rel);
+    let targetReal: string;
+    try { targetReal = await realpath(joined); }
+    catch { return reply.code(404).send({ error: 'file not found' }); }
+    // realpath 결과가 worktree 루트 하위가 아니면 탈출 — 거부.
+    const rootWithSep = rootReal.endsWith(psep) ? rootReal : rootReal + psep;
+    if (targetReal !== rootReal && !targetReal.startsWith(rootWithSep)) {
+      return reply.code(403).send({ error: 'path escapes the worktree' });
+    }
+    let st;
+    try { st = await stat(targetReal); } catch { return reply.code(404).send({ error: 'file not found' }); }
+    if (!st.isFile()) return reply.code(404).send({ error: 'not a file' });
+    if (st.size > FILE_MAX) return reply.code(413).send({ error: 'file too large (>10MB)' });
+    const buf = await readFile(targetReal);
+    return reply.type(contentTypeFor(rel)).send(buf);
+  });
+
   // ─── 에이전트 셀프 오케스트레이션 (run 별 Bearer 토큰 — authGate 예외, 여기서 자체 검증) ──
   const agentAuth = (req: { headers: { authorization?: string } }): number | null => {
     const h = req.headers.authorization ?? '';
@@ -930,7 +1167,13 @@ export async function buildServer(): Promise<FastifyInstance> {
     const rows = Math.max(5, Math.min(200, Number(q.rows) || 24));
     const info = await getRunTermInfo(id);
     if (!info) {
-      socket.send(JSON.stringify({ t: 'err', d: 'run or tmux session not found' }));
+      // tmuxWindow 가 없음 = 세션이 정리됐거나(닫힌 task·cleanup) run 미존재.
+      // 죽은 세션에 attach 를 시도하지 말고 명확한 사유로 닫는다.
+      const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+      const d = rr[0]
+        ? 'terminal unavailable — worktree cleaned (run closed or cleaned up)'
+        : 'run not found';
+      socket.send(JSON.stringify({ t: 'err', d }));
       socket.close();
       return;
     }