great-cto 2.99.0 → 3.1.0

package/board/packages/board/lib/routes.mjs

@@ -18,6 +18,7 @@ import { log } from './log.mjs';
 import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { readVerdicts } from './verdicts.mjs';
+import { parseAgentBudgets, upsertAgentBudget, removeAgentBudget } from '../../../scripts/lib/agent-budget.mjs';
 import { getAgentsFleet, getAgentProfile, retireAgent, restoreAgent, appendDecisionLog, readDecisionsLog } from './fleet.mjs';
 import { getResume, getShareState, toggleShare } from './share.mjs';
 import { listSessions, readSession, editedFiles, searchSessions } from './transcripts.mjs';
@@ -363,7 +364,18 @@ async function dispatch(req, res, url, cwd) {
       const degraded = getRegistryDegradation();
       // A registry that could not be read used to render as a board with no
       // projects — the same silence this screen exists to remove, one level out.
-      const out = portfolio(degraded ? { unread: degraded } : reg);
+      // The pipeline map, so the fleet can say which projects are waiting on a
+      // decision rather than only which ones failed. Read once for the sweep;
+      // unreadable means the gate question is simply not answered, never
+      // answered as "nothing is waiting".
+      let transitions = null;
+      try {
+        const { pipelineMapFor } = await import('../../../scripts/lib/pipeline-health.mjs');
+        const { parsePipelineToml } = await import('../../../scripts/hooks/pipeline-dispatcher.mjs');
+        const map = pipelineMapFor(cwd);
+        if (map.path) transitions = parsePipelineToml(fs.readFileSync(map.path, 'utf8'));
+      } catch { transitions = null; }
+      const out = portfolio(degraded ? { unread: degraded } : reg, { transitions });
       res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
       res.end(JSON.stringify(out));
     } catch (e) {
@@ -1343,16 +1355,20 @@ async function dispatch(req, res, url, cwd) {
     // Per-agent budgets from PROJECT.md
     const projectMdPath = path.join(cwd, '.great_cto', 'PROJECT.md');
     let budgets = {};
+    let budgetsDeprecatedKey = null;
+    const budgetsMalformed = [];
     let goalAncestry = null;
     try {
       const projectTxt = fs.readFileSync(projectMdPath, 'utf8');
-      const sectionMatch = projectTxt.match(/^agent-budget:\s*\n((?:[ \t]+\S[^\n]*\n?)*)/m);
-      if (sectionMatch) {
-        for (const line of sectionMatch[1].split('\n')) {
-          const m = line.match(/^\s+([a-z][a-z0-9-]*):\s*(\d+(?:\.\d+)?)/);
-          if (m) budgets[m[1]] = parseFloat(m[2]);
-        }
-      }
+      // One parser, in scripts/lib/agent-budget.mjs — the same one the pipeline
+      // dispatcher enforces with and the fleet view judges with. This was an
+      // inline regex reading a different key (`agent-budget:`) with a different
+      // meaning ("$X/run"), so the board could display a cap the dispatcher had
+      // never heard of, and vice versa.
+      const parsed = parseAgentBudgets(projectTxt);
+      for (const [agent, cap] of parsed.budgets) budgets[agent] = cap;
+      if (parsed.deprecatedKey) budgetsDeprecatedKey = parsed.deprecatedKey;
+      for (const bad of parsed.malformed) budgetsMalformed.push(bad);
       // Goal ancestry
       const archetype = (projectTxt.match(/^(?:archetype|primary):\s*(\S+)/m) || [])[1] || null;
       const compliance = (projectTxt.match(/^compliance:\s*(.+)$/m) || [])[1] || null;
@@ -1370,7 +1386,135 @@ async function dispatch(req, res, url, cwd) {
     } catch { /* no log */ }
 
     res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-    res.end(JSON.stringify({ stuck, budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h }));
+    // `budgets_deprecated_key` and `budgets_malformed` travel with the caps.
+    // A limit somebody wrote under the old key still works and they are told; a
+    // line the parser could not read is reported rather than dropped, because a
+    // budget silently ignored is a limit its author believes they have.
+    res.end(JSON.stringify({
+      stuck, budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h,
+      budgets_deprecated_key: budgetsDeprecatedKey,
+      budgets_malformed: budgetsMalformed,
+    }));
+    return true;
+  }
+
+  // Set or clear one agent's spending cap, by writing PROJECT.md.
+  //
+  // POST /api/agent-budgets  { agent, limit_usd }   set / replace
+  // POST /api/agent-budgets  { agent, remove: true } clear
+  //
+  // This writes a file the operator owns and git tracks, from a browser. Same
+  // two gates as /api/projects/register, for the same reason: the board listens
+  // on 127.0.0.1, and a page the user happens to be visiting can still issue a
+  // simple cross-origin POST to localhost.
+  //
+  // The reply always reports the PREVIOUS value. A cap that silently replaced
+  // another is a change the operator cannot see they made.
+  if (pathname === '/api/agent-budgets' && req.method === 'POST') {
+    if (!originAllowed(req)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'origin not allowed' }));
+      return true;
+    }
+    let body = '';
+    req.on('data', (c) => { body += c; if (body.length > 4096) req.destroy(); });
+    req.on('end', () => {
+      let parsed;
+      try { parsed = JSON.parse(body || '{}'); }
+      catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'invalid_json', message: String(e.message || e) }));
+        return;
+      }
+      const mdPath = path.join(cwd, '.great_cto', 'PROJECT.md');
+      let before;
+      try { before = fs.readFileSync(mdPath, 'utf8'); }
+      catch (e) {
+        // No PROJECT.md is not a project we may create one for from a browser.
+        res.writeHead(409, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'no PROJECT.md to write to', detail: String(e.message || e) }));
+        return;
+      }
+      let out;
+      try {
+        out = parsed.remove
+          ? removeAgentBudget(before, parsed.agent)
+          : upsertAgentBudget(before, parsed.agent, parsed.limit_usd);
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: String(e.message || e) }));
+        return;
+      }
+      try {
+        // Write through a temp file in the same directory, then rename: a
+        // half-written PROJECT.md is the project's own identity truncated.
+        const tmp = `${mdPath}.tmp-${process.pid}`;
+        fs.writeFileSync(tmp, out.text);
+        fs.renameSync(tmp, mdPath);
+      } catch (e) {
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: `could not write PROJECT.md: ${String(e.message || e)}` }));
+        return;
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: true,
+        agent: String(parsed.agent || '').toLowerCase(),
+        previous_usd: out.previousUsd,
+        removed: out.removed === true,
+        created_block: out.created === true,
+      }));
+    });
+    return true;
+  }
+
+  // Search INSIDE documents, not only their titles.
+  //
+  // The docs list has always matched on filename and heading. A hundred and
+  // eighty-seven documents whose contents cannot be searched are a directory
+  // listing, and the thing an operator actually wants — "where did we write down
+  // the reason for X" — was answerable only by leaving the board.
+  //
+  // GET /api/docs/search?q=...  ->  { q, matched, scanned, results[] }
+  if (pathname === '/api/docs/search' && req.method === 'GET') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    const q = (url.searchParams.get('q') || '').trim();
+    if (q.length < 2) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'query must be at least 2 characters' }));
+      return true;
+    }
+    try {
+      const { listDocs } = await import('./docs.mjs');
+      const all = listDocs(c);
+      const needle = q.toLowerCase();
+      const results = [];
+      let scanned = 0, unreadable = 0;
+      for (const g of (all.groups || [])) {
+        for (const d of (g.docs || [])) {
+          if (results.length >= 60) break;
+          let text;
+          try { text = fs.readFileSync(path.join(c, d.path), 'utf8'); scanned++; }
+          catch { unreadable++; continue; }   // counted, never silently skipped
+          const lines = text.split('\n');
+          const hits = [];
+          for (let i = 0; i < lines.length && hits.length < 3; i++) {
+            if (lines[i].toLowerCase().includes(needle)) {
+              hits.push({ line: i + 1, text: lines[i].trim().slice(0, 160) });
+            }
+          }
+          if (hits.length) results.push({ path: d.path, title: d.title || d.name, group: g.label, hits });
+        }
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      // `scanned` and `unreadable` travel with the answer: "no results" over
+      // 187 files and "no results" over 3 that could be opened are different
+      // facts, and only one of them means the phrase is not there.
+      res.end(JSON.stringify({ q, matched: results.length, scanned, unreadable, results }));
+    } catch (e) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: String(e.message || e) }));
+    }
     return true;
   }
 

package/board/packages/board/lib/watchers.mjs

@@ -3,7 +3,7 @@ import path from 'path';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { sseClients } from './state.mjs';
 import { listProjects } from './projects.mjs';
-import { bdCacheInvalidate, getTasks } from './beads.mjs';
+import { bdCacheStale, getTasks, isSelfInflictedTouch } from './beads.mjs';
 import { getPipeline, getInbox } from './data-readers.mjs';
 
 // ── File watcher ───────────────────────────────────────────────────────────────
@@ -17,7 +17,41 @@ function watchBeads() {
   if (!dirs.includes(process.cwd())) dirs.push(process.cwd());
 
   const broadcast = (dir) => {
-    bdCacheInvalidate(dir);
+    // Invalidate ONLY for a project somebody is looking at.
+    //
+    // This ran unconditionally, for all sixteen registered projects, on every
+    // file event in any of them — and an invalidated entry is deleted, so no
+    // later read can be served from cache no matter how stale it is willing to
+    // accept. The alert crons then re-ran `bd list` for all sixteen every five
+    // minutes, at 2-6 s each, synchronously. That is the pair that made the
+    // board unanswerable: watchers emptying the cache as fast as sweeps filled
+    // it, with the event loop held by `spawnSync` throughout.
+    //
+    // A project nobody is watching serves data up to BD_CACHE_TTL_MS old, which
+    // is the freshness contract everywhere else, and the read that refreshes it
+    // happens when someone actually opens it.
+    const watched = [...sseClients].some((r) => r._gctoCwd === dir);
+    if (!watched) return;
+    // Do not react at all to the echo of our own read. `bd list` touches the dolt
+    // journal this watcher watches, so every read was dropping the entry it had
+    // just filled — a loop that made the cache useless at any TTL.
+    //
+    // Return, rather than merely skipping the invalidation. I tried the narrower
+    // version — suppress the cache drop, still broadcast — reasoning that a
+    // watcher event is still an event. It is not: the broadcast reads
+    // getTasks(dir), and on a self-touch the entry was deliberately NOT
+    // invalidated, so the event carries the cache's older answer. Clients were
+    // pushed stale tasks, and `gate: SSE broadcasts updated tasks after
+    // approval` failed on exactly that.
+    //
+    // Nothing is lost by staying silent here. A write through the board calls
+    // broadcastTasks itself; a write from outside is not a self-touch and lands
+    // in the branch below.
+    if (isSelfInflictedTouch(dir)) return;
+    // Stale, not deleted. A change we NOTICED must not make the next reader pay
+    // for it — they asked for something else. The broadcast below still reads
+    // fresh, because a stale entry refreshes on read.
+    bdCacheStale(dir);
     for (const res of sseClients) {
       if (res._gctoCwd === dir) {
         try {