fraim-framework 2.0.183 → 2.0.185

package/dist/src/ai-hub/server.js

@@ -56,6 +56,7 @@ const hosts_1 = require("./hosts");
 const manager_turns_1 = require("./manager-turns");
 const preferences_1 = require("./preferences");
 const conversation_store_1 = require("./conversation-store");
+const remote_hub_gateway_1 = require("./remote-hub-gateway");
 const managed_browser_1 = require("./managed-browser");
 const managed_agent_paths_1 = require("../cli/utils/managed-agent-paths");
 let personaHiringModule;
@@ -137,29 +138,6 @@ function buildHubManagerHiringCatalog() {
         roles: {},
     };
 }
-async function getHubWorkspacePersonaState(dbService, userId, apiKey) {
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const service = require('../services/persona-entitlement-service');
-        return await service.getWorkspacePersonaState(dbService, userId, apiKey);
-    }
-    catch {
-        return null;
-    }
-}
-function createDefaultDbService() {
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const { FraimDbService } = require('../fraim/db-service');
-        return new FraimDbService();
-    }
-    catch {
-        return undefined;
-    }
-}
-function supportsManagerSeatAssignments(dbService) {
-    return typeof dbService.countHubManagerAssignments === 'function';
-}
 class AiHubRunRegistry {
     constructor() {
         this.runs = new Map();
@@ -398,19 +376,22 @@ function normalizeReviewHandoff(raw) {
         const url = safeHttpUrl(rawTarget?.url);
         if (!url)
             return null;
+        if (artifacts.length > 0)
+            return null;
         return {
             reviewRequired: true,
             reviewTarget: { type: 'pull_request', label: targetLabel || 'Pull request', url },
-            artifacts,
+            artifacts: [],
             summary: typeof value.summary === 'string' ? value.summary.trim() : '',
             feedbackMode: typeof value.feedbackMode === 'string' ? value.feedbackMode.trim() : 'pull_request_comments',
         };
     }
-    if (targetType === 'artifact_set' && artifacts.length > 0) {
+    const fileArtifacts = artifacts.filter((artifact) => artifact.path && !artifact.url);
+    if (targetType === 'artifact_set' && fileArtifacts.length > 0 && fileArtifacts.length === artifacts.length) {
         return {
             reviewRequired: true,
             reviewTarget: { type: 'artifact_set', label: targetLabel || `${artifacts.length} artifact${artifacts.length === 1 ? '' : 's'}` },
-            artifacts,
+            artifacts: fileArtifacts,
             summary: typeof value.summary === 'string' ? value.summary.trim() : '',
             feedbackMode: typeof value.feedbackMode === 'string' ? value.feedbackMode.trim() : 'inline',
         };
@@ -573,31 +554,6 @@ function extractDelegationLedgerFromText(text) {
     }
     return null;
 }
-const ARTIFACT_EXCLUDE_RE = /(^|[\\/])(retrospectives|evidence|learnings|mocks|raw|archive)[\\/]/i;
-function extractReviewArtifactsFromText(text, projectPath) {
-    if (!text)
-        return [];
-    const artifacts = [];
-    const seen = new Set();
-    const matches = String(text)
-        .split(/[\s`"'()<>{}\[\],;:]+/)
-        .filter((token) => /^(docs|public|src|tests)[\\/]/.test(token));
-    for (const candidate of matches) {
-        const relativePath = candidate.replace(/[.)]+$/g, '').replace(/\\/g, '/');
-        if (!/\.[A-Za-z0-9]+$/.test(relativePath))
-            continue;
-        if (ARTIFACT_EXCLUDE_RE.test(relativePath))
-            continue;
-        const parts = relativePath.split('/').filter(Boolean);
-        const name = parts[parts.length - 1] || relativePath;
-        const artifactPath = path_1.default.isAbsolute(relativePath) ? relativePath : path_1.default.join(projectPath, relativePath);
-        if (seen.has(artifactPath))
-            continue;
-        seen.add(artifactPath);
-        artifacts.push({ type: path_1.default.extname(name).replace(/^\./, '') || 'file', label: name, path: artifactPath });
-    }
-    return artifacts;
-}
 function applyReviewProjection(run, text) {
     const delegation = extractDelegationLedgerFromText(text);
     if (delegation) {
@@ -610,41 +566,9 @@ function applyReviewProjection(run, text) {
     const handoff = extractReviewHandoffFromText(text);
     if (handoff) {
         run.reviewHandoff = handoff;
-        run.artifacts = handoff.artifacts;
+        run.artifacts = handoff.reviewTarget?.type === 'artifact_set' ? handoff.artifacts : [];
         return;
     }
-    const artifacts = extractReviewArtifactsFromText(text, run.projectPath);
-    if (!artifacts.length)
-        return;
-    run.artifacts = run.artifacts || [];
-    for (const artifact of artifacts) {
-        if (!run.artifacts.some((entry) => (entry.path && artifact.path && entry.path === artifact.path) || (entry.url && artifact.url && entry.url === artifact.url))) {
-            run.artifacts.push(artifact);
-        }
-    }
-}
-function mergeReviewArtifacts(existing, discovered) {
-    const merged = [...(existing || [])];
-    for (const artifact of discovered) {
-        if (!merged.some((entry) => (entry.path && artifact.path && entry.path === artifact.path) || (entry.url && artifact.url && entry.url === artifact.url))) {
-            merged.push(artifact);
-        }
-    }
-    return merged;
-}
-function extractRunReviewArtifacts(run) {
-    const discovered = [];
-    for (const message of run.messages || []) {
-        if (message.role !== 'employee')
-            continue;
-        discovered.push(...extractReviewArtifactsFromText(message.text, run.projectPath));
-    }
-    for (const event of run.events || []) {
-        if (event.channel !== 'stdout')
-            continue;
-        discovered.push(...extractReviewArtifactsFromText(event.text, run.projectPath));
-    }
-    return mergeReviewArtifacts(run.artifacts, discovered);
 }
 function emptyTotals() {
     return {
@@ -750,8 +674,13 @@ function applySeekMentoringSignal(run, signal) {
     const callJobId = signal.jobId || signal.jobName;
     if (callJobId && targetJobId && callJobId !== targetJobId)
         return;
-    if (signal.reviewHandoff)
-        run.reviewHandoff = signal.reviewHandoff;
+    if (signal.reviewHandoff) {
+        const normalizedReviewHandoff = normalizeReviewHandoff(signal.reviewHandoff);
+        run.reviewHandoff = normalizedReviewHandoff || signal.reviewHandoff;
+        run.artifacts = normalizedReviewHandoff?.reviewTarget?.type === 'artifact_set'
+            ? normalizedReviewHandoff.artifacts
+            : [];
+    }
     if (signal.delegationLedger &&
         run.jobId === 'fully-delegate' &&
         signal.phaseStatus === 'complete' &&
@@ -1009,6 +938,22 @@ function ensureDirectoryPath(projectPath) {
     }
     return resolved;
 }
+function normalizedDirectoryPath(projectPath) {
+    const resolved = path_1.default.resolve(projectPath);
+    return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+function sameDirectoryPath(left, right) {
+    return normalizedDirectoryPath(left) === normalizedDirectoryPath(right);
+}
+function deploymentProjectFilter(rawProjectPath, fallbackProjectPath) {
+    return ensureDirectoryPath(typeof rawProjectPath === 'string' && rawProjectPath.trim() ? rawProjectPath : fallbackProjectPath);
+}
+function deploymentBelongsToProject(deployment, projectPath, fallbackProjectPath) {
+    const deploymentProjectPath = typeof deployment.projectPath === 'string' && deployment.projectPath.trim()
+        ? deployment.projectPath
+        : fallbackProjectPath;
+    return sameDirectoryPath(deploymentProjectPath, projectPath);
+}
 // ---------------------------------------------------------------------------
 // Issue #512 (S3) — Hub bootstrap projection helpers.
 // ---------------------------------------------------------------------------
@@ -1138,14 +1083,14 @@ class AiHubServer {
             explicitPath: process.env.FRAIM_BROWSER_PATH || undefined,
         });
         this.hostRuntime = options.hostRuntime || (process.env.FRAIM_AI_HUB_FAKE_HOST === '1' ? new hosts_1.FakeHostRuntime() : new hosts_1.CliHostRuntime());
-        if (options.dbService !== undefined) {
-            this.dbService = options.dbService;
-            this.ownsDbService = false;
-        }
-        else {
-            this.dbService = createDefaultDbService();
-            this.ownsDbService = this.dbService !== undefined;
-        }
+        // Issue #701: the AI Hub is a loopback companion that never touches MongoDB directly —
+        // on every machine (dev, CI, prod) it resolves persona/manager-team state from the hosted
+        // server through the same code path. The hosted server is the sole owner of DB access.
+        // A dbService is used ONLY when explicitly injected (e.g. the hosted server embedding the
+        // Hub, or a test); it is never auto-created, so there is no dev/prod divergence.
+        this.dbService = options.dbService;
+        this.ownsDbService = false;
+        this.remoteGateway = options.remoteGateway ?? new remote_hub_gateway_1.HttpHubRemoteGateway();
         this.deploymentStore = options.deploymentStore ?? new DeploymentStore();
         this.hostConfigStore = options.hostConfigStore ?? new HostConfigStore();
         this.app.use(express_1.default.json({ limit: '10mb' }));
@@ -1413,8 +1358,9 @@ class AiHubServer {
             requiredPersonaKey: getProtectedPersonaForHubJob(job.id),
         }));
         const managerTemplates = (0, catalog_1.discoverManagerTemplates)(normalizedProjectPath, catalogOptions);
-        const { personas, subscriptionActive, workspaceId, userKey } = await this.computePersonas(apiKey || preferences.apiKey);
-        const managerTeam = await this.computeManagerTeam(workspaceId, userKey);
+        const resolvedApiKey = apiKey || preferences.apiKey;
+        const { personas, subscriptionActive, workspaceId, userKey } = await this.computePersonas(resolvedApiKey);
+        const managerTeam = await this.computeManagerTeam(resolvedApiKey);
         const projects = this.knownProjects(normalizedProjectPath);
         preferences = { ...preferences, projectPath: normalizedProjectPath, projects };
         this.preferencesStore.save(preferences);
@@ -1835,12 +1781,9 @@ class AiHubServer {
         if (!resolvedJobId) {
             throw new Error('Choose a FRAIM job before starting a run, or start with /fraim <job-id>.');
         }
-        // #521: `display` is what the manager's conversation bubble shows — only their own
-        // words. The FRAIM invocation (`$fraim <job>`), the stub path, and the shared-
-        // browser / communication-style notes are system context for the AGENT, kept out
-        // of the bubble so the thread isn't cluttered with machinery. `message` (with all
-        // of it) is what the agent actually receives.
-        const display = (explicit?.remainder || instructions || '').trim();
+        // #696: `display` is the manager conversation bubble. Keep the full generated
+        // turn in `message`, but show only the host-specific FRAIM invocation.
+        const display = (0, manager_turns_1.fraimInvocationFor)(hostId, resolvedJobId) || (explicit?.remainder || instructions || '').trim();
         // #521: the shared-browser guidance is injected HERE, at the Hub layer — never
         // baked into the registry job/skill. It only appears when a shared browser is
         // available (env published at boot).
@@ -1869,13 +1812,12 @@ class AiHubServer {
         // as the target of the FRAIM invocation. The server picks the correct
         // invocation prefix ($fraim / /fraim) based on run.hostId — the UI never
         // passes raw invocation syntax.
-        const effectiveJobId = coachingJobId || run.jobId;
-        // #521: `display` = the manager's own words for the conversation bubble. When the
-        // manager typed nothing (a quick-coach button), fall back to the bare invocation
-        // so the bubble still shows what was triggered — but never the style note.
         const explicit = (0, manager_turns_1.extractExplicitFraimInvocation)(instructions);
+        const effectiveJobId = explicit?.jobId || coachingJobId || run.jobId;
+        // #696: the thread shows the invocation that the Hub sent, while the employee
+        // still receives the full manager turn plus the style note.
         const userText = (explicit?.remainder || instructions || '').trim();
-        const display = userText || (0, manager_turns_1.buildManagerMessage)(run.hostId, effectiveJobId, 'continue', '');
+        const display = (0, manager_turns_1.fraimInvocationFor)(run.hostId, effectiveJobId) || userText || (0, manager_turns_1.buildManagerMessage)(run.hostId, effectiveJobId, 'continue', '');
         return {
             message: (0, manager_turns_1.buildManagerMessage)(run.hostId, effectiveJobId, 'continue', instructions) + (0, manager_turns_1.buildCommunicationStyleNote)(),
             display,
@@ -1894,18 +1836,18 @@ class AiHubServer {
             seatCount: 0,
             seatsInUse: 0,
         }));
-        if (!this.dbService) {
-            return { personas: fallbackPersonas, subscriptionActive: false, workspaceId: null, userKey: null };
-        }
         try {
-            const state = await getHubWorkspacePersonaState(this.dbService, getHubUserEmail(), apiKey ?? '');
+            // Issue #701: persona state comes from the hosted server (GET /api/personas/me)
+            // via the user's API key — never a local MongoDB connection. A null result means
+            // no/expired key or the feature is off; render the locked fallback (not-signed-in).
+            const state = await this.remoteGateway.getPersonaState(apiKey);
             if (!state) {
                 return { personas: fallbackPersonas, subscriptionActive: false, workspaceId: null, userKey: null };
             }
             // Legacy bypass: persona gating is not active for this workspace, so all personas are accessible.
             // Mirrors the evaluatePersonaAccess legacy bypass in persona-entitlement-service.ts.
+            // Seats are not assignable on legacy workspaces (the hosted server is always DB-backed).
             if (!state.subscriptionActive) {
-                const legacySeatCount = supportsManagerSeatAssignments(this.dbService) ? 0 : 1;
                 const allPersonas = allBundles.map((bundle) => ({
                     key: bundle.personaKey,
                     displayName: bundle.catalogMetadata.displayName,
@@ -1914,7 +1856,7 @@ class AiHubServer {
                     pricingLabel: '',
                     status: 'hired',
                     hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
-                    seatCount: legacySeatCount,
+                    seatCount: 0,
                     seatsInUse: 0,
                 }));
                 return { personas: allPersonas, subscriptionActive: false, workspaceId: state.workspaceId, userKey: state.userId ?? null };
@@ -1930,13 +1872,13 @@ class AiHubServer {
                     seatCountByKey[e.personaKey] = (seatCountByKey[e.personaKey] ?? 0) + (e.jobCreditsRemaining ?? 1);
                 }
             }
-            // seatsInUse is the count of manager-assignment rows for this workspace/persona.
-            const workspaceId = state.workspaceId;
+            // seatsInUse for display: derived from the hosted manager team. Authoritative
+            // out-of-stock enforcement lives on the hosted assign endpoint (server-side),
+            // so this display count does not need to be workspace-wide.
             const seatsInUseByKey = {};
-            if (this.dbService) {
-                await Promise.all(Object.keys(seatCountByKey).map(async (pKey) => {
-                    seatsInUseByKey[pKey] = await this.dbService.countHubManagerAssignments(workspaceId, pKey);
-                }));
+            const team = await this.remoteGateway.listManagerTeam(apiKey);
+            for (const entry of team) {
+                seatsInUseByKey[entry.personaKey] = (seatsInUseByKey[entry.personaKey] ?? 0) + 1;
             }
             const personas = allBundles.map((bundle) => ({
                 key: bundle.personaKey,
@@ -1949,23 +1891,16 @@ class AiHubServer {
                 seatCount: seatCountByKey[bundle.personaKey] ?? 0,
                 seatsInUse: seatsInUseByKey[bundle.personaKey] ?? 0,
             }));
-            return { personas, subscriptionActive: state.subscriptionActive, workspaceId, userKey: state.userId ?? null };
+            return { personas, subscriptionActive: state.subscriptionActive, workspaceId: state.workspaceId, userKey: state.userId ?? null };
         }
         catch (err) {
-            console.error('[ai-hub] persona entitlement lookup failed:', err);
+            console.error('[ai-hub] persona lookup failed:', err);
             return { personas: fallbackPersonas, subscriptionActive: false, workspaceId: null, userKey: null };
         }
     }
-    async computeManagerTeam(workspaceId, userKey) {
-        if (!workspaceId || !userKey || !this.dbService)
-            return [];
-        try {
-            const rows = await this.dbService.getHubManagerAssignments(workspaceId, userKey);
-            return rows.map((r) => ({ personaKey: r.personaKey, assignedAt: r.assignedAt.toISOString() }));
-        }
-        catch {
-            return [];
-        }
+    async computeManagerTeam(apiKey) {
+        // Issue #701: manager team comes from the hosted server, not local Mongo.
+        return this.remoteGateway.listManagerTeam(apiKey);
     }
     registerRoutes() {
         // Issue #512: Serve the account and analytics pages from public/.
@@ -2109,57 +2044,25 @@ class AiHubServer {
                 return res.status(400).json({ error: error instanceof Error ? error.message : 'Could not write learning.' });
             }
         });
-        // Issue #540: POST /api/ai-hub/manager-team/assign
-        // Assigns a persona to the authenticated manager's team (uses X-Fraim-Api-Key header).
-        // Returns 404 {error:'no_company_seat'} when the workspace has purchased no seats for the persona.
-        // Returns 409 {error:'out_of_stock'} when all company seats are already assigned to other managers.
+        // Issue #540/#701: POST /api/ai-hub/manager-team/assign
+        // Proxies to the hosted server (which owns the DB + seat enforcement). The Hub
+        // accepts the local X-Fraim-Api-Key header and forwards it as the hosted x-api-key.
+        // Hosted returns 404 no_company_seat / 409 out_of_stock; those are passed through.
         this.app.post('/api/ai-hub/manager-team/assign', async (req, res) => {
             const apiKey = typeof req.headers['x-fraim-api-key'] === 'string' ? req.headers['x-fraim-api-key'] : undefined;
             const { personaKey } = (req.body ?? {});
             if (!personaKey)
                 return res.status(400).json({ error: 'personaKey required' });
-            if (!this.dbService) {
-                return res.status(404).json({ error: 'no_company_seat', personaKey });
-            }
-            try {
-                const { workspaceId, userKey, personas } = await this.computePersonas(apiKey);
-                if (!workspaceId || !userKey) {
-                    return res.status(404).json({ error: 'no_company_seat', personaKey });
-                }
-                const persona = personas.find((p) => p.key === personaKey);
-                if (!persona || persona.seatCount === 0) {
-                    return res.status(404).json({ error: 'no_company_seat', personaKey });
-                }
-                if (persona.seatsInUse >= persona.seatCount) {
-                    return res.status(409).json({ error: 'out_of_stock', personaKey, seatCount: persona.seatCount });
-                }
-                await this.dbService.addHubManagerAssignment(workspaceId, userKey, personaKey);
-                const team = await this.computeManagerTeam(workspaceId, userKey);
-                return res.json({ managerTeam: team });
-            }
-            catch (err) {
-                console.error('[ai-hub] assign manager seat failed:', err);
-                return res.status(500).json({ error: 'internal_error' });
-            }
+            const result = await this.remoteGateway.assignManagerTeam(apiKey, personaKey);
+            return res.status(result.status).json(result.body);
         });
-        // Issue #540: DELETE /api/ai-hub/manager-team/assign/:personaKey
-        // Removes a persona from the authenticated manager's team.
+        // Issue #540/#701: DELETE /api/ai-hub/manager-team/assign/:personaKey
+        // Proxies the seat release to the hosted server.
         this.app.delete('/api/ai-hub/manager-team/assign/:personaKey', async (req, res) => {
             const apiKey = typeof req.headers['x-fraim-api-key'] === 'string' ? req.headers['x-fraim-api-key'] : undefined;
             const { personaKey } = req.params;
-            if (!this.dbService)
-                return res.status(204).end();
-            try {
-                const { workspaceId, userKey } = await this.computePersonas(apiKey);
-                if (workspaceId && userKey) {
-                    await this.dbService.removeHubManagerAssignment(workspaceId, userKey, personaKey);
-                }
-                return res.status(204).end();
-            }
-            catch (err) {
-                console.error('[ai-hub] remove manager seat failed:', err);
-                return res.status(500).json({ error: 'internal_error' });
-            }
+            await this.remoteGateway.removeManagerTeam(apiKey, personaKey);
+            return res.status(204).end();
         });
         this.app.get('/api/ai-hub/conversations', (req, res) => {
             const projectPath = typeof req.query.projectPath === 'string' && req.query.projectPath.length > 0
@@ -2962,9 +2865,15 @@ class AiHubServer {
             this.scheduleDeployment(deployment);
             return res.status(201).json(deployment);
         });
-        // GET /api/ai-hub/schedules — list all scheduled deployments.
-        this.app.get('/api/ai-hub/schedules', (_req, res) => {
-            return res.json(this.deploymentStore.load().filter((d) => d.type === 'scheduled'));
+        // GET /api/ai-hub/schedules — list scheduled deployments for one project.
+        this.app.get('/api/ai-hub/schedules', (req, res) => {
+            try {
+                const projectPath = deploymentProjectFilter(req.query.projectPath, this.projectPath);
+                return res.json(this.deploymentStore.load().filter((d) => d.type === 'scheduled' && deploymentBelongsToProject(d, projectPath, this.projectPath)));
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
         });
         // DELETE /api/ai-hub/schedules/:id — remove a scheduled deployment.
         this.app.delete('/api/ai-hub/schedules/:id', (req, res) => {
@@ -2982,7 +2891,7 @@ class AiHubServer {
         // PUT /api/ai-hub/schedules/:id — update an existing scheduled deployment.
         this.app.put('/api/ai-hub/schedules/:id', (req, res) => {
             const { id } = req.params;
-            const { label, jobId, cronExpr, hostId, instructions, allowConcurrent } = req.body ?? {};
+            const { label, jobId, projectPath, cronExpr, hostId, instructions, allowConcurrent } = req.body ?? {};
             if (cronExpr !== undefined) {
                 // eslint-disable-next-line @typescript-eslint/no-var-requires
                 const cronLib = require('node-cron');
@@ -2990,6 +2899,14 @@ class AiHubServer {
                     return res.status(400).json({ error: 'Invalid cron expression.' });
                 }
             }
+            let resolvedProjectPath;
+            try {
+                if (projectPath !== undefined)
+                    resolvedProjectPath = ensureDirectoryPath(projectPath || this.projectPath);
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
             const validEmployees = VALID_EMPLOYEE_IDS;
             let updated = null;
             const ok = this.deploymentStore.update(id, (dep) => {
@@ -2997,6 +2914,8 @@ class AiHubServer {
                     dep.label = label;
                 if (jobId !== undefined)
                     dep.jobId = jobId;
+                if (resolvedProjectPath !== undefined)
+                    dep.projectPath = resolvedProjectPath;
                 if (cronExpr !== undefined)
                     dep.cronExpr = cronExpr;
                 if (hostId !== undefined && validEmployees.includes(hostId))
@@ -3043,12 +2962,18 @@ class AiHubServer {
             this.deploymentStore.create(deployment);
             return res.status(201).json({ ...deployment, inboundUrl: `${this.hubBase}/api/ai-hub/webhooks/${deployment.id}/inbound` });
         });
-        // GET /api/ai-hub/webhooks — list all webhook deployments.
-        this.app.get('/api/ai-hub/webhooks', (_req, res) => {
+        // GET /api/ai-hub/webhooks — list webhook deployments for one project.
+        this.app.get('/api/ai-hub/webhooks', (req, res) => {
             const hubBase = this.hubBase;
-            return res.json(this.deploymentStore.load()
-                .filter((d) => d.type === 'webhook')
-                .map((d) => ({ ...d, inboundUrl: `${hubBase}/api/ai-hub/webhooks/${d.id}/inbound` })));
+            try {
+                const projectPath = deploymentProjectFilter(req.query.projectPath, this.projectPath);
+                return res.json(this.deploymentStore.load()
+                    .filter((d) => d.type === 'webhook' && deploymentBelongsToProject(d, projectPath, this.projectPath))
+                    .map((d) => ({ ...d, inboundUrl: `${hubBase}/api/ai-hub/webhooks/${d.id}/inbound` })));
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
         });
         // DELETE /api/ai-hub/webhooks/:id — remove a webhook deployment.
         this.app.delete('/api/ai-hub/webhooks/:id', (req, res) => {
@@ -3060,7 +2985,15 @@ class AiHubServer {
         // PUT /api/ai-hub/webhooks/:id — update an existing webhook deployment.
         this.app.put('/api/ai-hub/webhooks/:id', (req, res) => {
             const { id } = req.params;
-            const { label, jobId, hostId, instructions, allowConcurrent } = req.body ?? {};
+            const { label, jobId, projectPath, hostId, instructions, allowConcurrent } = req.body ?? {};
+            let resolvedProjectPath;
+            try {
+                if (projectPath !== undefined)
+                    resolvedProjectPath = ensureDirectoryPath(projectPath || this.projectPath);
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
             const validEmployees = VALID_EMPLOYEE_IDS;
             let updated = null;
             const ok = this.deploymentStore.update(id, (dep) => {
@@ -3068,6 +3001,8 @@ class AiHubServer {
                     dep.label = label;
                 if (jobId !== undefined)
                     dep.jobId = jobId;
+                if (resolvedProjectPath !== undefined)
+                    dep.projectPath = resolvedProjectPath;
                 if (hostId !== undefined && validEmployees.includes(hostId))
                     dep.hostId = hostId;
                 if (instructions !== undefined)
@@ -3391,7 +3326,7 @@ class AiHubServer {
                 liveTotals.waitingDurationMs = Math.max(0, liveTotals.waitingDurationMs - overflow);
             }
         }
-        return { ...run, stages, totals: liveTotals, artifacts: extractRunReviewArtifacts(run) };
+        return { ...run, stages, totals: liveTotals, artifacts: run.artifacts || [] };
     }
 }
 exports.AiHubServer = AiHubServer;

package/dist/src/api/ai-hub/manager-team.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getManagerTeamFor = getManagerTeamFor;
+exports.assignManagerSeatFor = assignManagerSeatFor;
+exports.removeManagerSeatFor = removeManagerSeatFor;
+exports.listManagerTeam = listManagerTeam;
+exports.assignManagerTeam = assignManagerTeam;
+exports.removeManagerTeam = removeManagerTeam;
+const persona_entitlement_service_1 = require("../../services/persona-entitlement-service");
+async function loadTeam(dbService, workspaceId, userKey) {
+    const rows = await dbService.getHubManagerAssignments(workspaceId, userKey);
+    return rows.map((r) => ({ personaKey: r.personaKey, assignedAt: r.assignedAt.toISOString() }));
+}
+/** Seats purchased for a persona in this workspace. Mirrors computePersonas' seatCountByKey:
+ *  legacy (unsubscribed) workspaces have no assignable seats. */
+function seatCountForPersona(state, personaKey) {
+    if (!state.subscriptionActive)
+        return 0;
+    return state.entitlements
+        .filter((e) => e.personaKey === personaKey && e.status === 'active')
+        .reduce((sum, e) => sum + (e.jobCreditsRemaining ?? 1), 0);
+}
+// ── Core operations (shared by hosted handlers and the Hub's local-DB gateway) ──────
+async function getManagerTeamFor(dbService, userId, apiKey) {
+    const state = await (0, persona_entitlement_service_1.getWorkspacePersonaState)(dbService, userId, apiKey);
+    return loadTeam(dbService, state.workspaceId, state.userId);
+}
+async function assignManagerSeatFor(dbService, userId, apiKey, personaKey) {
+    const state = await (0, persona_entitlement_service_1.getWorkspacePersonaState)(dbService, userId, apiKey);
+    const seatCount = seatCountForPersona(state, personaKey);
+    if (seatCount === 0)
+        return { status: 404, body: { error: 'no_company_seat', personaKey } };
+    const seatsInUse = await dbService.countHubManagerAssignments(state.workspaceId, personaKey);
+    if (seatsInUse >= seatCount)
+        return { status: 409, body: { error: 'out_of_stock', personaKey, seatCount } };
+    await dbService.addHubManagerAssignment(state.workspaceId, state.userId, personaKey);
+    return { status: 200, body: { managerTeam: await loadTeam(dbService, state.workspaceId, state.userId) } };
+}
+async function removeManagerSeatFor(dbService, userId, apiKey, personaKey) {
+    const state = await (0, persona_entitlement_service_1.getWorkspacePersonaState)(dbService, userId, apiKey);
+    await dbService.removeHubManagerAssignment(state.workspaceId, state.userId, personaKey);
+}
+// ── Hosted HTTP handlers (thin wrappers over the core, authed via req.apiKeyData) ───
+async function listManagerTeam(req, res, dbService) {
+    const apiKeyData = req.apiKeyData;
+    if (!apiKeyData?.userId) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    try {
+        res.json({ team: await getManagerTeamFor(dbService, apiKeyData.userId, apiKeyData.key) });
+    }
+    catch (error) {
+        console.error('[api] listManagerTeam failed:', error);
+        res.status(500).json({ error: 'internal_error', details: error?.message || String(error) });
+    }
+}
+async function assignManagerTeam(req, res, dbService) {
+    const apiKeyData = req.apiKeyData;
+    if (!apiKeyData?.userId) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    const { personaKey } = (req.body ?? {});
+    if (!personaKey) {
+        res.status(400).json({ error: 'personaKey required' });
+        return;
+    }
+    try {
+        const result = await assignManagerSeatFor(dbService, apiKeyData.userId, apiKeyData.key, personaKey);
+        res.status(result.status).json(result.body);
+    }
+    catch (error) {
+        console.error('[api] assignManagerTeam failed:', error);
+        res.status(500).json({ error: 'internal_error', details: error?.message || String(error) });
+    }
+}
+async function removeManagerTeam(req, res, dbService) {
+    const apiKeyData = req.apiKeyData;
+    if (!apiKeyData?.userId) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    const personaKey = String(req.params.personaKey ?? '');
+    try {
+        await removeManagerSeatFor(dbService, apiKeyData.userId, apiKeyData.key, personaKey);
+        res.status(204).end();
+    }
+    catch (error) {
+        console.error('[api] removeManagerTeam failed:', error);
+        res.status(500).json({ error: 'internal_error', details: error?.message || String(error) });
+    }
+}