crewly 1.20.195 → 1.20.197

package/dist/backend/backend/src/constants.js

@@ -3,7 +3,7 @@
  * Re-exported from the main config constants for backend use
  */
 // Import from config directory for cross-domain constants
-import { CREWLY_CONSTANTS as CONFIG_CREWLY_CONSTANTS, AGENT_IDENTITY_CONSTANTS as CONFIG_AGENT_IDENTITY_CONSTANTS, TIMING_CONSTANTS as CONFIG_TIMING_CONSTANTS, MEMORY_CONSTANTS as CONFIG_MEMORY_CONSTANTS, CONTINUATION_CONSTANTS as CONFIG_CONTINUATION_CONSTANTS, ORCHESTRATOR_RESTART_CONSTANTS as CONFIG_ORCHESTRATOR_RESTART_CONSTANTS, AGENT_SUSPEND_CONSTANTS as CONFIG_AGENT_SUSPEND_CONSTANTS, VERSION_CHECK_CONSTANTS as CONFIG_VERSION_CHECK_CONSTANTS, AUTO_UPDATE_CONSTANTS as CONFIG_AUTO_UPDATE_CONSTANTS, CLOUD_DISCONNECT_NOTICE_CONSTANTS as CONFIG_CLOUD_DISCONNECT_NOTICE_CONSTANTS, AGENT_HEARTBEAT_MONITOR_CONSTANTS as CONFIG_AGENT_HEARTBEAT_MONITOR_CONSTANTS, ORCHESTRATOR_HEARTBEAT_CONSTANTS as CONFIG_ORCHESTRATOR_HEARTBEAT_CONSTANTS, MARKETPLACE_CONSTANTS as CONFIG_MARKETPLACE_CONSTANTS, TEMPLATE_MARKETPLACE_CONSTANTS as CONFIG_TEMPLATE_MARKETPLACE_CONSTANTS, ADDON_CONSTANTS as CONFIG_ADDON_CONSTANTS, AUDITOR_CONSTANTS as CONFIG_AUDITOR_CONSTANTS, PROCESS_EXIT_CODES as CONFIG_PROCESS_EXIT_CODES, SAFE_RESTART_CONSTANTS as CONFIG_SAFE_RESTART_CONSTANTS, WEB_CONSTANTS as CONFIG_WEB_CONSTANTS, API_SECURITY_CONSTANTS as CONFIG_API_SECURITY_CONSTANTS, PROJECT_TICKET_CONSTANTS as CONFIG_PROJECT_TICKET_CONSTANTS, } from '../../config/constants.js';
+import { CREWLY_CONSTANTS as CONFIG_CREWLY_CONSTANTS, AGENT_IDENTITY_CONSTANTS as CONFIG_AGENT_IDENTITY_CONSTANTS, TIMING_CONSTANTS as CONFIG_TIMING_CONSTANTS, MEMORY_CONSTANTS as CONFIG_MEMORY_CONSTANTS, CONTINUATION_CONSTANTS as CONFIG_CONTINUATION_CONSTANTS, ORCHESTRATOR_RESTART_CONSTANTS as CONFIG_ORCHESTRATOR_RESTART_CONSTANTS, AGENT_SUSPEND_CONSTANTS as CONFIG_AGENT_SUSPEND_CONSTANTS, VERSION_CHECK_CONSTANTS as CONFIG_VERSION_CHECK_CONSTANTS, AUTO_UPDATE_CONSTANTS as CONFIG_AUTO_UPDATE_CONSTANTS, CLOUD_DISCONNECT_NOTICE_CONSTANTS as CONFIG_CLOUD_DISCONNECT_NOTICE_CONSTANTS, AGENT_HEARTBEAT_MONITOR_CONSTANTS as CONFIG_AGENT_HEARTBEAT_MONITOR_CONSTANTS, ORCHESTRATOR_HEARTBEAT_CONSTANTS as CONFIG_ORCHESTRATOR_HEARTBEAT_CONSTANTS, MARKETPLACE_CONSTANTS as CONFIG_MARKETPLACE_CONSTANTS, TEMPLATE_MARKETPLACE_CONSTANTS as CONFIG_TEMPLATE_MARKETPLACE_CONSTANTS, ADDON_CONSTANTS as CONFIG_ADDON_CONSTANTS, AUDITOR_CONSTANTS as CONFIG_AUDITOR_CONSTANTS, PROCESS_EXIT_CODES as CONFIG_PROCESS_EXIT_CODES, SAFE_RESTART_CONSTANTS as CONFIG_SAFE_RESTART_CONSTANTS, WEB_CONSTANTS as CONFIG_WEB_CONSTANTS, API_SECURITY_CONSTANTS as CONFIG_API_SECURITY_CONSTANTS, OWNER_AUTH_CONSTANTS as CONFIG_OWNER_AUTH_CONSTANTS, PROJECT_TICKET_CONSTANTS as CONFIG_PROJECT_TICKET_CONSTANTS, } from '../../config/constants.js';
 // Re-export the cross-domain constants for backend use
 export const PROCESS_EXIT_CODES = CONFIG_PROCESS_EXIT_CODES;
 /** Project tickets (specs/2026-09-28-project-tickets.md) — see config/constants.ts. */
@@ -73,6 +73,52 @@ export const TICKET_AUTOPILOT_CONSTANTS = {
     STATE_FILENAME: 'ticket-autopilot-state.json',
     /** Env kill switch: `0` keeps the autopilot service from starting */
     ENV_SWITCH: 'CREWLY_TICKET_AUTOPILOT',
+    // --- Autopilot stats and daily retro (specs/2026-10-03-autopilot-experiments.md) ---
+    /** Default and largest range of `GET …/stats` and `…/runs` (days, today included) */
+    STATS_DEFAULT_DAYS: 14,
+    STATS_MAX_DAYS: 90,
+    /** WorkItem type / `metadata.kind` of the daily retro the driver receives */
+    RETRO_WORK_ITEM_TYPE: 'autopilot_retro',
+    RETRO_METADATA_KIND: 'autopilot_retro',
+    /** Local hour (0-23) at or after which yesterday's retro is scheduled */
+    RETRO_HOUR_LOCAL: 9,
+    /** Wiki folder (inside the project vault) the retros are written to */
+    RETRO_WIKI_DIR: 'llm-curated/autopilot-retros',
+    /** Project (by name) harness-gap tickets are filed on */
+    RETRO_HARNESS_PROJECT: 'Crewly',
+    /**
+     * Hold on a harness-gap ticket until the owner approves it: triage skips
+     * it; only the retro card's answer removes it (not ask-owner --clear,
+     * not other decisions), and the digest does not list it as waiting.
+     */
+    RETRO_PENDING_LABEL: 'retro-pending',
+    /** Retro scheduling / check-in reads that fail are retried after this, doubling up to the max */
+    RETRY_BACKOFF_MIN_MS: 30 * 60 * 1000,
+    RETRY_BACKOFF_MAX_MS: 24 * 60 * 60 * 1000,
+    /** Labels of a harness-gap ticket filed by a retro */
+    RETRO_GAP_LABELS: ['harness-gap', 'from-retro'],
+    /** Most harness-gap tickets filed per day, across projects */
+    RETRO_MAX_GAPS_PER_DAY: 3,
+    /** Word overlap (Jaccard) at or above which a gap duplicates an open ticket / earlier gap */
+    RETRO_DEDUPE_SIMILARITY: 0.6,
+    /** How long filed gap titles are remembered for the dedupe (days) */
+    RETRO_GAP_MEMORY_DAYS: 60,
+    /** Longest retro summary / problem detail accepted (chars) */
+    RETRO_SUMMARY_MAX_CHARS: 6_000,
+    RETRO_DETAIL_MAX_CHARS: 1_000,
+    /** Problem title bounds (chars) and most problems per retro */
+    RETRO_TITLE_MIN_CHARS: 4,
+    RETRO_TITLE_MAX_CHARS: 140,
+    RETRO_MAX_PROBLEMS: 20,
+    /** Problem classes */
+    RETRO_CLASSES: ['agent_judgment', 'missing_skill', 'harness_gap', 'owner_dependency'],
+    /** Decision kind of the one card that approves a retro's harness-gap tickets */
+    RETRO_DECISION_KIND: 'retro_harness_gaps',
+    /** How long the owner has to answer it (the default, Skip, applies after) */
+    RETRO_DECISION_DEADLINE_MS: 48 * 60 * 60 * 1000,
+    /** Option labels of that card */
+    RETRO_APPROVE_LABEL: 'Approve',
+    RETRO_SKIP_LABEL: 'Skip',
 };
 /**
  * Safe restart: drain in-flight agent turns before a shutdown kills the PTYs,
@@ -100,6 +146,8 @@ export const SAFE_RESTART = {
     PROBE_TAIL_LINES: 15,
     /** Open messages kept per session (oldest dropped beyond this) */
     MAX_OPEN_MESSAGES_PER_SESSION: 5,
+    /** Sessions whose last delivered message is remembered (labels runtime-started turns) */
+    MAX_LAST_DELIVERED_SESSIONS: 500,
     /** Characters of the delivered text kept as a preview */
     PREVIEW_CHARS: 160,
     /** File under CREWLY_HOME holding turns cut off by the last shutdown */
@@ -110,8 +158,52 @@ export const SAFE_RESTART = {
     RESUME_ORC_READY_TIMEOUT_MS: 10 * 60 * 1000,
     /** Poll interval while waiting for the orchestrator to become active (ms) */
     RESUME_ORC_POLL_MS: 5_000,
-    /** Prefix of the notice re-delivered with an interrupted message */
-    RESUME_NOTICE: '[CREWLY] You were interrupted by a restart while handling this message; pick it up again:',
+    /**
+     * Resume note sent once to an agent whose work a restart cut off;
+     * `{work}` is the ticket (TKT-194) or "this request".
+     */
+    RESUME_NOTICE_TEMPLATE: 'Crewly restarted while you were working on {work}. Continue where you left off and deliver.',
+    /** `{work}` when no ticket is known */
+    RESUME_DEFAULT_WORK_LABEL: 'this request',
+    /** Matches a resume note at the start of a message (so notes never stack) */
+    RESUME_NOTICE_PATTERN: /^Crewly restarted while you were working on [^\n]*?\. Continue where you left off and deliver\.[^\n]*\n?/,
+    /** Line that introduces the original message under a resume note */
+    RESUME_ORIGINAL_HEADER: 'The message you were handling:',
+    /** Line that introduces an owner promise under a resume note */
+    RESUME_PROMISE_HEADER: 'You promised the owner:',
+};
+/**
+ * Runtime turn state (specs/2026-10-02-restart-busy-and-resume.md): whether
+ * an agent is mid-turn according to its runtime (Claude Code hooks and
+ * transcript), not according to screen output.
+ */
+export const TURN_STATE_CONSTANTS = {
+    /** An active turn with no hook event for this long (and nothing open) is no longer trusted (ms) */
+    HOOK_SILENCE_MS: 10 * 60 * 1000,
+    /** An open tool call or a running subagent / background task expires after this (ms) */
+    OPEN_WORK_MAX_MS: 60 * 60 * 1000,
+    /** After a delivery, wait this long for the runtime to report the turn started (ms) */
+    DELIVERY_START_MS: 2 * 60 * 1000,
+    /** A transcript that says "mid-turn" counts only if it changed within this window (ms) */
+    TRANSCRIPT_FRESH_MS: 10 * 60 * 1000,
+    /** Re-check interval for end-of-turn settling skipped while background work runs (ms) */
+    SETTLE_RECHECK_MS: 60_000,
+    /** Clock slack between a Stop hook and the transcript's own turn-end entry (ms) */
+    TRANSCRIPT_LAG_MS: 30_000,
+    /** Accepted SessionStart sources from the hook */
+    SESSION_START_SOURCES: ['startup', 'resume', 'clear', 'compact'],
+    /** How long a located transcript path is reused before re-resolving (ms) */
+    LOCATOR_CACHE_MS: 60_000,
+    /** Bytes read from the end of a transcript */
+    TRANSCRIPT_TAIL_BYTES: 512 * 1024,
+    /** Sessions tracked in memory (oldest dropped beyond this) */
+    MAX_TRACKED_SESSIONS: 500,
+    /** Open tool calls / subagents remembered per session */
+    MAX_OPEN_PER_SESSION: 64,
+    /** Accepted toolUseId / agentId values from the hook */
+    ID_PATTERN: /^[A-Za-z0-9_-]{1,128}$/,
+    /** Gemini CLI's busy footer ("esc to cancel, 12s"); only read for Gemini sessions */
+    GEMINI_BUSY_MARKER: 'esc to cancel',
 };
 export const AGENT_IDENTITY_CONSTANTS = CONFIG_AGENT_IDENTITY_CONSTANTS;
 export const TIMING_CONSTANTS = CONFIG_TIMING_CONSTANTS;
@@ -128,6 +220,8 @@ export const WEB_CONSTANTS = CONFIG_WEB_CONSTANTS;
 export const ADDON_CONSTANTS = CONFIG_ADDON_CONSTANTS;
 export const AUDITOR_CONSTANTS = CONFIG_AUDITOR_CONSTANTS;
 export const API_SECURITY_CONSTANTS = CONFIG_API_SECURITY_CONSTANTS;
+/** Owner authentication (#999, specs/2026-10-03-owner-auth.md) — see config/constants.ts. */
+export const OWNER_AUTH_CONSTANTS = CONFIG_OWNER_AUTH_CONSTANTS;
 // Re-export specific constants that the backend needs from the main config
 export const ORCHESTRATOR_SESSION_NAME = CONFIG_CREWLY_CONSTANTS.SESSIONS.ORCHESTRATOR_NAME;
 export const ORCHESTRATOR_ROLE = 'orchestrator';
@@ -429,10 +523,13 @@ export const CONTROL_PLANE_GUARD_CONSTANTS = {
 export const AGENT_STATUS_HOOK_CONSTANTS = {
     /** Hook script, relative to the install root. */
     HOOK_SCRIPT: 'config/hooks/agent-status/report.sh',
-    /** Hook events the script is registered for. */
-    EVENTS: ['Notification', 'PermissionRequest', 'Stop', 'UserPromptSubmit', 'PostToolUse'],
+    /**
+     * Hook events the script is registered for. PreToolUse, SubagentStart,
+     * SubagentStop and SessionStart feed the runtime turn state (specs/2026-10-02-restart-busy-and-resume.md).
+     */
+    EVENTS: ['Notification', 'PermissionRequest', 'Stop', 'UserPromptSubmit', 'PreToolUse', 'PostToolUse', 'SubagentStart', 'SubagentStop', 'SessionStart'],
     /** Events that carry a tool matcher; they match every tool. */
-    TOOL_EVENTS: ['PermissionRequest', 'PostToolUse'],
+    TOOL_EVENTS: ['PermissionRequest', 'PreToolUse', 'PostToolUse'],
     /** Matcher that selects every tool. */
     ALL_TOOLS_MATCHER: '*',
     /** Notification types that mean "waiting on the user". */
@@ -1240,6 +1337,15 @@ export const SLACK_TYPING_CONSTANTS = {
     AUTO_WORKING_DELIVERY_MAX_MS: 10 * 60 * 1000,
     /** Deliveries still watched at once; the oldest is dropped past this */
     AUTO_WORKING_MAX_WATCHES: 200,
+    /**
+     * A scheduled brief (trigger / cron work item, `[SCHEDULED]` message)
+     * delivered to an agent this long before an owner message's watch opened,
+     * or any time after, means the agent's next turn is the scheduled one: it
+     * gets no "working on it" under the owner's message. Busy is seen up to a
+     * 30 s poll late, so a brief written just before the owner's message can
+     * still be the turn that shows up.
+     */
+    AUTO_WORKING_SCHEDULED_GRACE_MS: 30 * 1000,
 };
 /**
  * Slack thread context read at delivery time.
@@ -2143,6 +2249,15 @@ export const RUNTIME_EXIT_CONSTANTS = {
     EARLY_EXIT_WINDOW_MS: 60_000,
     /** Characters of cleaned terminal output logged with an unexplained exit (#791) */
     EXIT_DIAGNOSTIC_TAIL_CHARS: 1500,
+    /**
+     * #989: this many `startup_exit`s of one runtime within
+     * STARTUP_EXIT_WINDOW_MS means it keeps dying at start; the owner is told.
+     */
+    STARTUP_EXIT_ALERT_THRESHOLD: 3,
+    /** Window over which repeated `startup_exit`s of one runtime are counted (30 minutes). */
+    STARTUP_EXIT_WINDOW_MS: 30 * 60 * 1000,
+    /** The owner is told about one runtime's startup exits at most this often (24 hours). */
+    STARTUP_EXIT_NOTICE_COOLDOWN_MS: 24 * 60 * 60 * 1000,
 };
 /**
  * Constants for context window monitoring and auto-recovery.
@@ -2474,6 +2589,15 @@ export const CLAUDE_TRANSCRIPT_SYNC_CONSTANTS = {
      * read; the remembered offset keeps it from being counted twice.
      */
     MAX_REMEMBERED_TRANSCRIPTS: 8,
+    /**
+     * #990 cost repair: a cursor's `cost` is lowered to its session's ledger
+     * cost only when it is above it by more than this many USD…
+     */
+    COST_REPAIR_MIN_EXCESS_USD: 1,
+    /** …and by more than this fraction of the ledger cost (price-table drift is ~0.5%). */
+    COST_REPAIR_MIN_EXCESS_FRACTION: 0.02,
+    /** Set to `1` to log what the #990 cost repair would change without changing anything. */
+    COST_REPAIR_DRY_RUN_ENV: 'CREWLY_COST_REPAIR_DRY_RUN',
     /**
      * Context size, in tokens, above which a claude-code agent is asked to
      * compact.
@@ -2971,6 +3095,15 @@ export const SYSTEM_RESOURCE_ALERT_CONSTANTS = {
     POLL_INTERVAL: 60000, // 1 minute
     /** Cooldown between repeated alerts for the same metric (ms) */
     ALERT_COOLDOWN: 600000, // 10 minutes
+    /**
+     * Alert keys that also go to the owner over Slack (#991): critical disk
+     * and memory, and idle agents auto-stopped under memory pressure.
+     */
+    OWNER_NOTICE_KEYS: ['disk_critical', 'memory_critical', 'agents_auto_stopped'],
+    /** Owner Slack notice for the same alert key at most this often (6 hours). */
+    OWNER_NOTICE_COOLDOWN: 6 * 60 * 60 * 1000,
+    /** State file under CREWLY_HOME remembering when the owner was last told, per alert key. */
+    OWNER_NOTICE_STATE_FILENAME: 'system-alert-owner-notices.json',
     /** Thresholds for triggering alerts */
     THRESHOLDS: {
         DISK_WARNING: 85, // 85% used
@@ -3994,6 +4127,25 @@ export const OWNER_RECEIPT_CONSTANTS = {
     MIN_SUMMARY_WEIGHTED_LENGTH: 12,
     /** How the orchestrator is named on the receipt (it is in no team) */
     ORCHESTRATOR_LABEL: 'Orc',
+    /**
+     * The format ask (#856 follow-up): while the nightly receipt is off, the
+     * owner is shown one real sample of it on a decision card and chooses.
+     * Nothing is turned on without his "Turn on" answer.
+     */
+    FORMAT_ASK: {
+        /** Decision kind whose handler applies the answer */
+        DECISION_KIND: 'owner_receipt_format',
+        /** `system.key` of the decision */
+        SYSTEM_KEY: 'nightly-format',
+        /** The sample covers this much time before the ask (ms) */
+        SAMPLE_WINDOW_MS: 24 * 60 * 60 * 1000,
+        /** Unanswered by then: the default (stay off) is applied (ms) */
+        DEADLINE_MS: 3 * 24 * 60 * 60 * 1000,
+        TITLE: 'Nightly receipt · try this format?',
+        QUESTION: 'This is what tonight\'s receipt would look like. Send it to you every night?',
+        OPTION_ON: 'Turn on nightly — this format',
+        OPTION_PER_ASK: 'Keep per-ask format — every ask, one line each',
+    },
 };
 /**
  * Ticket loop (specs/ticket-loop.md, Phase 1): owner messages become tickets
@@ -4930,6 +5082,9 @@ export const SECRET_REDACTION_CONSTANTS = {
         'SLACK_USER_TOKEN',
         'SLACK_SIGNING_SECRET',
         'CREWLY_API_TOKEN',
+        // The per-session agent badge (#999). Its name avoids TOKEN on purpose
+        // (Codex strips such variables), so the suffix rule would miss it.
+        'CREWLY_AGENT_BADGE',
     ],
     /** Name families masked in `NAME=value` (tested against the upper-cased name). */
     SECRET_NAME_PATTERNS: [/^SLACK_\w*_TOKEN$/, /^CREWLY_\w*_TOKEN$/, /(?:^|_)PRIVATE_KEY$/],
@@ -5349,6 +5504,44 @@ export const TRACE_CONSTANTS = {
     SKIPPED_SKILL_PATH_PREFIXES: ['/agent-hooks', '/traces', '/heartbeat', '/health'],
     /** HTTP statuses recorded as `guard.block` instead of `error` */
     GUARD_BLOCK_STATUSES: [403, 409, 423, 429],
+    // --- Autonomy metrics (#984, specs/2026-10-03-autonomy-metrics.md) ---
+    /** A gap with no progress longer than this is a stall. Override: CREWLY_TRACE_STALL_MINUTES, `?stallMinutes=` */
+    STALL_MINUTES: 30,
+    /** Bounds of a caller-given stall threshold (minutes) */
+    STALL_MINUTES_MIN: 1,
+    STALL_MINUTES_MAX: 7 * 24 * 60,
+    /** Events this long before a stall still explain it (quota, delivery failure) */
+    STALL_CAUSE_LOOKBACK_MS: 5 * 60 * 1000,
+    /** Without turn events, a session's activity points at most this far apart form one busy period */
+    INFERRED_TURN_GAP_MS: 5 * 60 * 1000,
+    /** The owner message this close to the root is the ask, not a touch */
+    ROOT_GRACE_MS: 2 * 60 * 1000,
+    /** The same owner message delivered to two agents within this window is one touch */
+    OWNER_MESSAGE_DEDUPE_MS: 60 * 1000,
+    /** A dashboard write this close to an owner touch is that touch, not a manual intervention */
+    OWNER_ACTION_DEDUPE_MS: 10 * 1000,
+    /** How long computed metrics are reused (an ongoing stall keeps growing) */
+    METRICS_CACHE_TTL_MS: 60 * 1000,
+    /** Most traces whose metrics are cached (≥ MAX_LIST_LIMIT, so one list call never evicts its own rows) */
+    METRICS_CACHE_MAX: 1_000,
+    /** Most rows of `GET /api/traces` when metrics are embedded (each row may read a whole trace file) */
+    METRICS_LIST_MAX: 100,
+    /** Default and largest size of the `trace-read` summary (chars) */
+    READ_DEFAULT_CHARS: 4_000,
+    READ_MIN_CHARS: 600,
+    READ_MAX_CHARS: 16_000,
+    /** Longest event summary shown in a key-event line of the text summary */
+    SUMMARY_EVENT_CHARS: 140,
+    /** Stalls listed in the text summary (the longest first) */
+    SUMMARY_MAX_STALLS: 5,
+    /** Agents / models listed in the text summary (most expensive first) */
+    SUMMARY_MAX_BREAKDOWN: 4,
+    /** Stalls kept in a metrics object (the longest; counts cover all) */
+    METRICS_MAX_STALL_ITEMS: 50,
+    /** Hook event the subagent guard posts to /api/agent-hooks when it sends a subagent back */
+    SUBAGENT_SENDBACK_HOOK_EVENT: 'SubagentSendBack',
+    /** Most ticket labels kept in a trace's tags (specs/2026-10-03-autopilot-experiments.md) */
+    MAX_TAG_LABELS: 20,
 };
 /**
  * Token usage: the unit, the stats endpoint, and the Codex / Antigravity
@@ -5649,5 +5842,12 @@ export const EXPERIMENT_CONSTANTS = {
     MAX_TEXT_LENGTH: 1000,
     /** Kill switch for the scheduler */
     ENV_SWITCH: 'CREWLY_EXPERIMENTS',
+    /** Autopilot cards: extra outcome metrics allowed besides the primary (specs/2026-10-03-autopilot-experiments.md) */
+    MAX_EXTRA_METRICS: 5,
+    /** Autopilot cards: one owner check-in this often while running */
+    CHECK_IN_INTERVAL_MS: 7 * 24 * 60 * 60 * 1000,
+    /** A check-in whose process read (or send) failed is retried after this, doubling up to the max */
+    CHECK_IN_RETRY_MIN_MS: 30 * 60 * 1000,
+    CHECK_IN_RETRY_MAX_MS: 24 * 60 * 60 * 1000,
 };
 //# sourceMappingURL=constants.js.map