hammoc 1.4.0 → 1.6.0

package/packages/server/dist/locales/ko/server.json

@@ -318,10 +318,6 @@
       "invalidChatId": "유효하지 않은 Chat ID입니다.",
       "writeError": "Telegram 설정 저장에 실패했습니다.",
       "testError": "테스트 알림 전송 중 서버 오류가 발생했습니다."
-    },
-    "rateLimit": {
-      "projectCreate": "프로젝트 생성 요청이 너무 많습니다. 잠시 후 다시 시도해 주세요.",
-      "pathValidation": "경로 검증 요청이 너무 많습니다. 잠시 후 다시 시도해 주세요."
     }
   }
 }

package/packages/server/dist/locales/pt/server.json

@@ -307,10 +307,6 @@
       "invalidChatId": "Chat ID inválido.",
       "writeError": "Erro ao salvar configurações do Telegram.",
       "testError": "Erro do servidor ao enviar notificação de teste."
-    },
-    "rateLimit": {
-      "projectCreate": "Muitas solicitações de criação de projeto. Tente novamente mais tarde.",
-      "pathValidation": "Muitas solicitações de validação de caminho. Tente novamente mais tarde."
     }
   }
 }

package/packages/server/dist/locales/zh-CN/server.json

@@ -307,10 +307,6 @@
       "invalidChatId": "无效的Chat ID。",
       "writeError": "保存Telegram设置失败。",
       "testError": "发送测试通知时服务器出错。"
-    },
-    "rateLimit": {
-      "projectCreate": "项目创建请求过多。请稍后再试。",
-      "pathValidation": "路径验证请求过多。请稍后再试。"
     }
   }
 }

package/packages/server/dist/routes/harness.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Story 28.0.5: Harness workbench routes.
+ * Mounted at /api/harness — independent of /api/projects because the user
+ * scope (~/.claude) is not nested under any project.
+ */
+declare const router: import("express-serve-static-core").Router;
+export default router;
+//# sourceMappingURL=harness.d.ts.map

package/packages/server/dist/routes/harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/routes/harness.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,QAAA,MAAM,MAAM,4CAAW,CAAC;AA2JxB,eAAe,MAAM,CAAC"}

package/packages/server/dist/routes/harness.js

@@ -0,0 +1,150 @@
+/**
+ * Story 28.0.5: Harness workbench routes.
+ * Mounted at /api/harness — independent of /api/projects because the user
+ * scope (~/.claude) is not nested under any project.
+ */
+import { Router } from 'express';
+import express from 'express';
+import { harnessController } from '../controllers/harnessController.js';
+import { harnessPluginController } from '../controllers/harnessPluginController.js';
+import { harnessSkillController } from '../controllers/harnessSkillController.js';
+import { harnessMcpController } from '../controllers/harnessMcpController.js';
+import { harnessHookController } from '../controllers/harnessHookController.js';
+import { harnessCommandController } from '../controllers/harnessCommandController.js';
+import { harnessAgentController } from '../controllers/harnessAgentController.js';
+import { claudeMdController } from '../controllers/claudeMdController.js';
+import { harnessShareScopeController } from '../controllers/harnessShareScopeController.js';
+import { harnessLintController } from '../controllers/harnessLintController.js';
+import { harnessBundleController, handleBundleUpload } from '../controllers/harnessBundleController.js';
+import { bmadCoreConfigController } from '../controllers/bmadCoreConfigController.js';
+import { contextBuilderController } from '../controllers/contextBuilderController.js';
+import { observabilityController } from '../controllers/observabilityController.js';
+import { marketplaceController } from '../controllers/marketplaceController.js';
+const router = Router();
+// Same body size as fileSystem routes (JSON envelopes can carry ~1MB source files).
+const largeBodyParser = express.json({ limit: '5mb' });
+router.get('/list', harnessController.list);
+router.get('/read', harnessController.read);
+router.put('/write', largeBodyParser, harnessController.write);
+router.post('/patch-structured', largeBodyParser, harnessController.patchStructured);
+// Story 28.1 — plugin list / toggle (user scope only)
+router.get('/plugins', harnessPluginController.list);
+router.post('/plugins/toggle', express.json({ limit: '32kb' }), harnessPluginController.toggle);
+// Story 28.2 — skill list / read / update / copy + per-skill bundle file edit.
+// The bundle routes are mounted *before* `/skills/:name` so the splat segment
+// (`/bundle/*`) is matched first; otherwise Express would treat "bundle" as a
+// `:name` value.
+router.post('/skills/copy', largeBodyParser, harnessSkillController.copy);
+router.get('/skills', harnessSkillController.list);
+router.get('/skills/:name/bundle/*', harnessSkillController.readBundle);
+router.put('/skills/:name/bundle/*', largeBodyParser, harnessSkillController.writeBundle);
+router.get('/skills/:name', harnessSkillController.read);
+router.put('/skills/:name', largeBodyParser, harnessSkillController.update);
+// Story 28.3 — MCP list / read / update / copy / delete.
+// `copy` lives above `/mcps/:name` so Express prefers the literal segment.
+router.post('/mcps/copy', largeBodyParser, harnessMcpController.copy);
+router.get('/mcps', harnessMcpController.list);
+router.get('/mcps/:name', harnessMcpController.read);
+router.put('/mcps/:name', largeBodyParser, harnessMcpController.update);
+router.delete('/mcps/:name', largeBodyParser, harnessMcpController.delete);
+// Story 28.4 — Hook list / read / create / update / copy / delete.
+// `copy` and the splat-free POST live above `/hooks/:event/...` so Express
+// prefers the literal segments.
+router.post('/hooks/copy', largeBodyParser, harnessHookController.copy);
+router.post('/hooks', largeBodyParser, harnessHookController.create);
+router.get('/hooks', harnessHookController.list);
+router.get('/hooks/:event/:groupIndex/:hookIndex', harnessHookController.read);
+router.put('/hooks/:event/:groupIndex/:hookIndex', largeBodyParser, harnessHookController.update);
+router.delete('/hooks/:event/:groupIndex/:hookIndex', largeBodyParser, harnessHookController.delete);
+// Story 28.5 — Slash command list / read / create / update / copy / copy-directory / delete.
+// path-as-glob — params[0] holds the full relative path (e.g. "BMad/agents/sm.md").
+// Literal segments (`/commands/copy`, `/commands/copy-directory`) live above the
+// splat so Express prefers them.
+router.post('/commands/copy-directory', largeBodyParser, harnessCommandController.copyDirectory);
+router.post('/commands/copy', largeBodyParser, harnessCommandController.copy);
+// Story 30.7 (Task B.2) — env-ref replace endpoint. Must live above the
+// splat so Express does not treat `replace-secret-with-env-ref` as a
+// command relative path.
+router.post('/commands/replace-secret-with-env-ref', largeBodyParser, harnessCommandController.replaceSecretWithEnvRef);
+router.post('/commands', largeBodyParser, harnessCommandController.create);
+router.get('/commands', harnessCommandController.list);
+router.get('/commands/*', harnessCommandController.read);
+router.put('/commands/*', largeBodyParser, harnessCommandController.update);
+router.delete('/commands/*', largeBodyParser, harnessCommandController.delete);
+// Story 28.6 — Sub-agent list / read / create / update / copy / delete.
+// Single-segment :name path param (flat-only — no recursive subdirectories per AC1.a).
+// Literal `/agents/copy` and the splat-free POST live above the dynamic
+// `:name` segment so Express prefers them.
+router.post('/agents/copy', largeBodyParser, harnessAgentController.copy);
+// Story 30.7 (Task B.2) — env-ref replace endpoint. Lives above the dynamic
+// `:name` so Express does not match the literal as an agent name.
+router.post('/agents/replace-secret-with-env-ref', largeBodyParser, harnessAgentController.replaceSecretWithEnvRef);
+router.post('/agents', largeBodyParser, harnessAgentController.create);
+router.get('/agents', harnessAgentController.list);
+router.get('/agents/:name', harnessAgentController.read);
+router.put('/agents/:name', largeBodyParser, harnessAgentController.update);
+router.delete('/agents/:name', largeBodyParser, harnessAgentController.delete);
+// Story 29.1 — CLAUDE.md (free-edit memory layer): two files only
+// (project root + global). POST is a distinct create-empty path that fails
+// with 409 if the file already exists (PUT-with-empty-content overwrite is
+// intentionally a separate code path so client intent is preserved).
+router.get('/claude-md', claudeMdController.read);
+router.put('/claude-md', largeBodyParser, claudeMdController.write);
+router.post('/claude-md', largeBodyParser, claudeMdController.create);
+// Story 30.1 — Share-scope evaluator: classifies harness files as
+// shared / local / fullyIgnored from `.gitignore` and derives the project
+// Mode A/B verdict. Project scope only — `.gitignore` is irrelevant for
+// the user-scope (`~/.claude`) tree.
+router.get('/share-scope', harnessShareScopeController.evaluate);
+// Story 30.7 (Task D.3) — append a pattern to the project `.gitignore`
+// (idempotent). Used by the `SecretOnSharedDialog → Move to local` flow
+// when the sibling pre-check detects `**/.claude/**/*.local.*` is missing.
+router.post('/share-scope/:projectSlug/append-gitignore', express.json({ limit: '4kb' }), harnessShareScopeController.appendGitignore);
+// Story 30.2 — Static harness lint: 7 rules across the 5 harness domains
+// (skill / mcp / hook / command / agent). Returns LintIssue[] + the user's
+// effective rule preferences (defaults merged with ~/.hammoc/preferences.json).
+router.get('/lint', harnessLintController.evaluate);
+// Story 30.5 — Harness Export/Import bundle: 4 endpoints providing the
+// server-side single source of truth for serializing a project's harness
+// surface into a ZIP + manifest.json and back. Multipart upload is only
+// required by the import-preview endpoint; the other three use JSON bodies.
+router.post('/bundle/export', largeBodyParser, harnessBundleController.export);
+router.post('/bundle/import/preview', handleBundleUpload, harnessBundleController.importPreview);
+router.post('/bundle/import/apply', largeBodyParser, harnessBundleController.importApply);
+router.get('/bundle/plugin-deps', harnessBundleController.pluginDeps);
+// Story 31.1 — BMad core-config editor: read / AST-patch / raw-overwrite of a
+// single project's `.bmad-core/core-config.yaml` (BMad projects only — the nav
+// gate is client-side via `isBmadProject`). The `/raw` segment lives above the
+// bare `:projectSlug` PATCH so Express does not treat `raw` as a slug value.
+router.get('/bmad-config/:projectSlug', bmadCoreConfigController.read);
+router.put('/bmad-config/:projectSlug/raw', largeBodyParser, bmadCoreConfigController.writeRaw);
+router.patch('/bmad-config/:projectSlug', largeBodyParser, bmadCoreConfigController.patch);
+// Story 31.2 — SessionStart context-builder: read / save+generate / disable the
+// `.hammoc/context-builder.json` manifest and its generated `.mjs` + settings
+// entry. Available on ALL projects (no BMad gate). The `/disable` segment lives
+// above the bare `:projectSlug` PUT so Express does not treat `disable` as a
+// slug value.
+router.get('/context-builder/:projectSlug', contextBuilderController.read);
+router.post('/context-builder/:projectSlug/disable', largeBodyParser, contextBuilderController.disable);
+router.put('/context-builder/:projectSlug', largeBodyParser, contextBuilderController.write);
+// Story 31.3 — Observability: MCP call log (read-only aggregates + timeline) +
+// token attribution + count_tokens proxy + global tokenizer preference.
+// Available on ALL projects (no gate). The global `/tokenizer-pref` (no
+// projectSlug) is mounted ABOVE the `:projectSlug` routes so Express does not
+// treat `tokenizer-pref` as a slug. The MCP log has no write endpoint —
+// records are appended by the streamCallbacks recorder.
+const smallBodyParser = express.json({ limit: '32kb' });
+router.get('/observability/tokenizer-pref', observabilityController.getTokenizerPref);
+router.put('/observability/tokenizer-pref', smallBodyParser, observabilityController.setTokenizerPref);
+router.get('/observability/:projectSlug/mcp-calls', observabilityController.mcpCalls);
+router.get('/observability/:projectSlug/token-attribution', observabilityController.tokenAttribution);
+router.post('/observability/:projectSlug/exact-count', smallBodyParser, observabilityController.exactCount);
+// Story 31.4 — Plugin marketplace catalog (read-only). Single GET endpoint:
+// the unified `plugins[]` catalog across registered marketplaces + installed
+// join + per-market partial failures + installed_plugins.json format warning.
+// No install/add POST — direct-install automation was dropped after spike #2
+// (negative); installs are copy-only command guides (see sdk-upstream-issues.md
+// §17·§18).
+router.get('/marketplace/:projectSlug/catalog', marketplaceController.catalog);
+export default router;
+//# sourceMappingURL=harness.js.map

package/packages/server/dist/routes/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/routes/harness.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAEhF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB,oFAAoF;AACpF,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAC/D,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAErF,sDAAsD;AACtD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACrD,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhG,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,iBAAiB;AACjB,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;AAC1E,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACnD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAC;AACxE,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,eAAe,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;AAC1F,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACzD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAE5E,yDAAyD;AACzD,2EAA2E;AAC3E,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACtE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC/C,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACrD,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE3E,mEAAmE;AACnE,2EAA2E;AAC3E,gCAAgC;AAChC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACxE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACjD,MAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;AAC/E,MAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,CAAC,sCAAsC,EAAE,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAErG,6FAA6F;AAC7F,oFAAoF;AACpF,iFAAiF;AACjF,iCAAiC;AACjC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,eAAe,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAC;AACjG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AAC9E,wEAAwE;AACxE,qEAAqE;AACrE,yBAAyB;AACzB,MAAM,CAAC,IAAI,CACT,uCAAuC,EACvC,eAAe,EACf,wBAAwB,CAAC,uBAAuB,CACjD,CAAC;AACF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACvD,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACzD,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAE/E,wEAAwE;AACxE,uFAAuF;AACvF,wEAAwE;AACxE,2CAA2C;AAC3C,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;AAC1E,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,CAAC,IAAI,CACT,qCAAqC,EACrC,eAAe,EACf,sBAAsB,CAAC,uBAAuB,CAC/C,CAAC;AACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACvE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACnD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACzD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAE/E,kEAAkE;AAClE,2EAA2E;AAC3E,2EAA2E;AAC3E,qEAAqE;AACrE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACpE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAEtE,kEAAkE;AAClE,0EAA0E;AAC1E,wEAAwE;AACxE,qCAAqC;AACrC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACjE,uEAAuE;AACvE,wEAAwE;AACxE,2EAA2E;AAC3E,MAAM,CAAC,IAAI,CACT,4CAA4C,EAC5C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9B,2BAA2B,CAAC,eAAe,CAC5C,CAAC;AAEF,yEAAyE;AACzE,2EAA2E;AAC3E,gFAAgF;AAChF,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAEpD,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC/E,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,aAAa,CAAC,CAAC;AACjG,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,eAAe,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAC1F,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;AAEtE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACvE,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,eAAe,EAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAC;AAChG,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,eAAe,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;AAE3F,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,cAAc;AACd,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AAC3E,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;AACxG,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,eAAe,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;AAE7F,+EAA+E;AAC/E,wEAAwE;AACxE,wEAAwE;AACxE,8EAA8E;AAC9E,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;AACtF,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,eAAe,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;AACvG,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AACtF,MAAM,CAAC,GAAG,CAAC,+CAA+C,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;AACtG,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,eAAe,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;AAE5G,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,YAAY;AACZ,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/E,eAAe,MAAM,CAAC"}

package/packages/server/dist/routes/projects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,QAAA,MAAM,MAAM,4CAAW,CAAC;AA2GxB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,QAAA,MAAM,MAAM,4CAAW,CAAC;AAgCxB,eAAe,MAAM,CAAC"}

package/packages/server/dist/routes/projects.js

@@ -7,69 +7,14 @@
 import { Router } from 'express';
 import { projectController } from '../controllers/projectController.js';
 const router = Router();
-const rateLimitStore = new Map();
-/**
- * Cleanup expired rate limit records periodically
- * Runs every 5 minutes to prevent memory growth
- */
-const CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
-const RECORD_TTL_MS = 2 * 60 * 1000; // Keep records for 2 minutes after window expires
-function cleanupExpiredRecords() {
-    const now = Date.now();
-    for (const [ip, record] of rateLimitStore.entries()) {
-        // Remove records that are older than TTL
-        if (now - record.windowStart > RECORD_TTL_MS) {
-            rateLimitStore.delete(ip);
-        }
-    }
-}
-// Start periodic cleanup
-const cleanupInterval = setInterval(cleanupExpiredRecords, CLEANUP_INTERVAL_MS);
-// Cleanup on process exit (for graceful shutdown)
-if (typeof process !== 'undefined' && process.on) {
-    process.on('beforeExit', () => {
-        clearInterval(cleanupInterval);
-    });
-}
-function createRateLimiter(maxRequests, windowMs) {
-    return (req, res, next) => {
-        const ip = req.ip || req.socket.remoteAddress || 'unknown';
-        const now = Date.now();
-        const record = rateLimitStore.get(ip);
-        if (!record || now - record.windowStart > windowMs) {
-            // New window
-            rateLimitStore.set(ip, { count: 1, windowStart: now });
-            next();
-            return;
-        }
-        if (record.count >= maxRequests) {
-            const retryAfter = Math.ceil((record.windowStart + windowMs - now) / 1000);
-            res.status(429).json({
-                error: {
-                    code: 'RATE_LIMIT_EXCEEDED',
-                    message: maxRequests === 10
-                        ? req.t('preferences.rateLimit.projectCreate')
-                        : req.t('preferences.rateLimit.pathValidation'),
-                    details: { retryAfter },
-                },
-            });
-            return;
-        }
-        record.count++;
-        next();
-    };
-}
-// Rate limiters
-const createProjectLimiter = createRateLimiter(10, 60 * 1000); // 10 requests per minute
-const validatePathLimiter = createRateLimiter(30, 60 * 1000); // 30 requests per minute
 // GET /api/projects - List all projects
 router.get('/', projectController.list);
-// POST /api/projects - Create new project (rate limited)
-router.post('/', createProjectLimiter, projectController.create);
+// POST /api/projects - Create new project
+router.post('/', projectController.create);
 // GET /api/projects/bmad-versions - List available BMad method versions
 router.get('/bmad-versions', projectController.bmadVersions);
 // POST /api/projects/:projectSlug/setup-bmad - Setup BMad for existing project
-router.post('/:projectSlug/setup-bmad', createProjectLimiter, projectController.setupBmad);
+router.post('/:projectSlug/setup-bmad', projectController.setupBmad);
 // DELETE /api/projects/:projectSlug - Delete a project
 router.delete('/:projectSlug', projectController.delete);
 // GET /api/projects/:projectSlug/settings - Get project settings with effective values
@@ -80,7 +25,7 @@ router.patch('/:projectSlug/settings', projectController.updateSettings);
 router.get('/:projectSlug/system-prompt', projectController.getSystemPrompt);
 // POST /api/projects/:projectSlug/open-explorer - Open project in system file explorer (localhost only)
 router.post('/:projectSlug/open-explorer', projectController.openExplorer);
-// POST /api/projects/validate-path - Validate directory path (rate limited)
-router.post('/validate-path', validatePathLimiter, projectController.validatePath);
+// POST /api/projects/validate-path - Validate directory path
+router.post('/validate-path', projectController.validatePath);
 export default router;
 //# sourceMappingURL=projects.js.map

package/packages/server/dist/routes/projects.js.map

@@ -1 +1 @@
-{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAmC,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAWxB,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE1D;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACvD,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kDAAkD;AAEvF,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,yCAAyC;QACzC,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,aAAa,EAAE,CAAC;YAC7C,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,yBAAyB;AACzB,MAAM,eAAe,GAAG,WAAW,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,kDAAkD;AAClD,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;QAC5B,aAAa,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB,EAAE,QAAgB;IAC9D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEtC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,QAAQ,EAAE,CAAC;YACnD,aAAa;YACb,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACL,WAAW,KAAK,EAAE;wBAChB,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,qCAAqC,CAAC;wBAC/C,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,sCAAsC,CAAC;oBACpD,OAAO,EAAE,EAAE,UAAU,EAAE;iBACxB;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,yBAAyB;AACxF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,yBAAyB;AAEvF,wCAAwC;AACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAExC,yDAAyD;AACzD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAEjE,wEAAwE;AACxE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAE3F,uDAAuD;AACvD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAEzD,uFAAuF;AACvF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAEpE,sEAAsE;AACtE,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC;AAEzE,2EAA2E;AAC3E,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAE7E,wGAAwG;AACxG,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAEnF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB,wCAAwC;AACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAExC,0CAA0C;AAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE3C,wEAAwE;AACxE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAErE,uDAAuD;AACvD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAEzD,uFAAuF;AACvF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAEpE,sEAAsE;AACtE,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC;AAEzE,2EAA2E;AAC3E,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAE7E,wGAAwG;AACxG,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE3E,6DAA6D;AAC7D,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAE9D,eAAe,MAAM,CAAC"}

package/packages/server/dist/routes/snippets.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Story 29.2: Snippet management routes.
+ *
+ * Mounted at `/api/snippets`. Intentionally distinct from `/api/harness/*`
+ * because snippets are Hammoc-native (`%name%` chat-input expansion via
+ * `snippetResolver`), not a Claude Code harness primitive — keeping the
+ * namespaces separate makes the system-of-record obvious at the URL boundary.
+ *
+ * Route ordering: literal segments (`/copy`) live above the dynamic
+ * `/:scope/:name` so Express prefers them.
+ */
+declare const router: import("express-serve-static-core").Router;
+export default router;
+//# sourceMappingURL=snippets.d.ts.map

package/packages/server/dist/routes/snippets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippets.d.ts","sourceRoot":"","sources":["../../src/routes/snippets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,QAAA,MAAM,MAAM,4CAAW,CAAC;AAgBxB,eAAe,MAAM,CAAC"}

package/packages/server/dist/routes/snippets.js

@@ -0,0 +1,27 @@
+/**
+ * Story 29.2: Snippet management routes.
+ *
+ * Mounted at `/api/snippets`. Intentionally distinct from `/api/harness/*`
+ * because snippets are Hammoc-native (`%name%` chat-input expansion via
+ * `snippetResolver`), not a Claude Code harness primitive — keeping the
+ * namespaces separate makes the system-of-record obvious at the URL boundary.
+ *
+ * Route ordering: literal segments (`/copy`) live above the dynamic
+ * `/:scope/:name` so Express prefers them.
+ */
+import { Router } from 'express';
+import express from 'express';
+import { snippetController } from '../controllers/snippetController.js';
+const router = Router();
+const largeBodyParser = express.json({ limit: '5mb' });
+const smallBodyParser = express.json({ limit: '64kb' });
+router.get('/', snippetController.list);
+// Literal-segment endpoints first.
+router.post('/copy', smallBodyParser, snippetController.copy);
+// Dynamic `:scope/:name` endpoints.
+router.get('/:scope/:name', snippetController.read);
+router.post('/:scope/:name', largeBodyParser, snippetController.create);
+router.put('/:scope/:name', largeBodyParser, snippetController.update);
+router.delete('/:scope/:name', smallBodyParser, snippetController.delete);
+export default router;
+//# sourceMappingURL=snippets.js.map

package/packages/server/dist/routes/snippets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippets.js","sourceRoot":"","sources":["../../src/routes/snippets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAExD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAExC,mCAAmC;AACnC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAE9D,oCAAoC;AACpC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACpD,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1E,eAAe,MAAM,CAAC"}

package/packages/server/dist/services/bmadCoreConfigService.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Story 31.1: BMad core-config editor service (Epic 31).
+ *
+ * Domain: the single `<projectRoot>/.bmad-core/core-config.yaml` file that
+ * drives downstream BMad agents (`/dev` · `/sm` · `/qa`). This file is the
+ * SIBLING of `.claude/` (it lives under `.bmad-core/`, outside the harness
+ * whitelist), so it gets a dedicated canonical-path resolver
+ * (`resolveBmadCoreConfigPath`) exactly like Story 29.1's CLAUDE.md and Story
+ * 30.7's `.gitignore`.
+ *
+ * Separation from `bmadStatusService`: that service SCANS the whole BMad
+ * project (epics, stories, QA, documents) and returns a status snapshot;
+ * this service does single-file R/W on the config itself. They read the same
+ * file but expose different shapes (status snapshot vs raw config + AST ops),
+ * so they stay separate.
+ *
+ * YAML parser single source of truth: `yaml` (eemeli) via
+ * `structuredEditor.applyYamlPatch`, which preserves comments, key order,
+ * quoting, and blank-line metadata across a patch. `js-yaml@4` (used by
+ * `bmadStatusService` for a lossy status read) must NOT be used here — it has
+ * no comment-preservation path (see structuredEditor.ts header).
+ *
+ * Method contract (all throw typed errors from `HARNESS_ERRORS`):
+ *   read             — content + mtime; missing file → HARNESS_FILE_NOT_FOUND
+ *   patchKey         — AST patch preserving comments/order; STALE_WRITE guard
+ *   writeRaw         — raw text overwrite (Raw editor); same STALE_WRITE guard
+ *   parseUnknownKeys — partition parsed YAML into known/unknown top-level keys
+ */
+import { type HarnessStructuredPatchOp, type BmadCoreConfigKnownKeys } from '@hammoc/shared';
+export interface BmadCoreConfigReadResult {
+    content: string;
+    mtime: string;
+}
+export interface BmadCoreConfigParsed {
+    knownKeys: BmadCoreConfigKnownKeys;
+    unknownKeys: Record<string, unknown>;
+}
+declare class BmadCoreConfigService {
+    /**
+     * Read the raw config text + mtime. Missing file →
+     * HARNESS_FILE_NOT_FOUND: the BMad-project gate means this service is only
+     * ever called for projects that have `.bmad-core/`, so a missing
+     * core-config.yaml is an abnormal state, not an empty-state.
+     */
+    read(projectSlug: string): Promise<BmadCoreConfigReadResult>;
+    /**
+     * Partition a parsed config into the 10 known top-level keys vs everything
+     * else. Known nested groups (`qa`/`prd`/`architecture`/`brownfieldEpic`)
+     * pass through whole; their leaves are the 18-key matrix the form renders.
+     * Unknown top-level keys are surfaced read-only (AC4). Unparseable input →
+     * HARNESS_PARSE_ERROR so the client can fall back to raw editing.
+     */
+    parseUnknownKeys(content: string): BmadCoreConfigParsed;
+    /**
+     * Apply AST-level patches to the config, preserving comments/order/quoting
+     * for every untouched node — including unknown keys (AC4.b). Running through
+     * a read → patch → write round trip means an external mutation that slipped
+     * in between read and write surfaces as STALE_WRITE.
+     *
+     * `expectedMtime` semantics mirror `harnessService.patchStructured`: when the
+     * client supplies it, that value is the guard; otherwise the freshly-read
+     * mtime guards against a concurrent write during our own round trip.
+     */
+    patchKey(projectSlug: string, ops: HarnessStructuredPatchOp[], expectedMtime?: string): Promise<{
+        mtime: string;
+    }>;
+    /**
+     * Raw-mode overwrite: write the supplied text verbatim, bypassing the AST
+     * patch (the user intentionally took control of the whole file). The
+     * STALE_WRITE guard still applies so a raw save cannot silently clobber an
+     * external edit (AC5.b).
+     */
+    writeRaw(projectSlug: string, content: string, expectedMtime?: string): Promise<{
+        mtime: string;
+    }>;
+    /**
+     * Shared write tail: STALE_WRITE guard + writeFile + self-write echo
+     * suppression. Mirrors `harnessService.write` / `claudeMdService.write`.
+     * The parent `.bmad-core/` directory is guaranteed to exist (BMad-project
+     * gate), so there is no auto-mkdir path here.
+     */
+    private writeInternal;
+}
+export declare const bmadCoreConfigService: BmadCoreConfigService;
+export {};
+//# sourceMappingURL=bmadCoreConfigService.d.ts.map

package/packages/server/dist/services/bmadCoreConfigService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bmadCoreConfigService.d.ts","sourceRoot":"","sources":["../../src/services/bmadCoreConfigService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAcxB,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,uBAAuB,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,cAAM,qBAAqB;IACzB;;;;;OAKG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAyBlE;;;;;;OAMG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;IA4BvD;;;;;;;;;OASG;IACG,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,wBAAwB,EAAE,EAC/B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAS7B;;;;;OAKG;IACG,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAK7B;;;;;OAKG;YACW,aAAa;CA0C5B;AAED,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}

package/packages/server/dist/services/bmadCoreConfigService.js

@@ -0,0 +1,175 @@
+/**
+ * Story 31.1: BMad core-config editor service (Epic 31).
+ *
+ * Domain: the single `<projectRoot>/.bmad-core/core-config.yaml` file that
+ * drives downstream BMad agents (`/dev` · `/sm` · `/qa`). This file is the
+ * SIBLING of `.claude/` (it lives under `.bmad-core/`, outside the harness
+ * whitelist), so it gets a dedicated canonical-path resolver
+ * (`resolveBmadCoreConfigPath`) exactly like Story 29.1's CLAUDE.md and Story
+ * 30.7's `.gitignore`.
+ *
+ * Separation from `bmadStatusService`: that service SCANS the whole BMad
+ * project (epics, stories, QA, documents) and returns a status snapshot;
+ * this service does single-file R/W on the config itself. They read the same
+ * file but expose different shapes (status snapshot vs raw config + AST ops),
+ * so they stay separate.
+ *
+ * YAML parser single source of truth: `yaml` (eemeli) via
+ * `structuredEditor.applyYamlPatch`, which preserves comments, key order,
+ * quoting, and blank-line metadata across a patch. `js-yaml@4` (used by
+ * `bmadStatusService` for a lossy status read) must NOT be used here — it has
+ * no comment-preservation path (see structuredEditor.ts header).
+ *
+ * Method contract (all throw typed errors from `HARNESS_ERRORS`):
+ *   read             — content + mtime; missing file → HARNESS_FILE_NOT_FOUND
+ *   patchKey         — AST patch preserving comments/order; STALE_WRITE guard
+ *   writeRaw         — raw text overwrite (Raw editor); same STALE_WRITE guard
+ *   parseUnknownKeys — partition parsed YAML into known/unknown top-level keys
+ */
+import fs from 'fs/promises';
+import { parse as parseYaml } from 'yaml';
+import { HARNESS_ERRORS, BMAD_CORE_CONFIG_KNOWN_TOP_LEVEL_KEYS, } from '@hammoc/shared';
+import { resolveBmadCoreConfigPath } from '../utils/harnessPaths.js';
+import { applyYamlPatch } from '../utils/structuredEditor.js';
+import { fileWatcherService } from './fileWatcherService.js';
+function throwMapped(code, message, extras) {
+    const err = new Error(message);
+    err.code = code;
+    if (extras)
+        Object.assign(err, extras);
+    throw err;
+}
+const KNOWN_TOP_LEVEL = new Set(BMAD_CORE_CONFIG_KNOWN_TOP_LEVEL_KEYS);
+class BmadCoreConfigService {
+    /**
+     * Read the raw config text + mtime. Missing file →
+     * HARNESS_FILE_NOT_FOUND: the BMad-project gate means this service is only
+     * ever called for projects that have `.bmad-core/`, so a missing
+     * core-config.yaml is an abnormal state, not an empty-state.
+     */
+    async read(projectSlug) {
+        const { absolutePath } = await resolveBmadCoreConfigPath(projectSlug);
+        let stat;
+        try {
+            stat = await fs.stat(absolutePath);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT') {
+                throwMapped(HARNESS_ERRORS.HARNESS_FILE_NOT_FOUND.code, 'core-config.yaml not found', { absolutePath });
+            }
+            if (code === 'EACCES') {
+                throwMapped(HARNESS_ERRORS.HARNESS_FORBIDDEN.code, 'permission denied');
+            }
+            throw error;
+        }
+        if (!stat.isFile()) {
+            throwMapped(HARNESS_ERRORS.HARNESS_NOT_A_FILE.code, 'path is not a file');
+        }
+        const content = await fs.readFile(absolutePath, 'utf-8');
+        return { content, mtime: stat.mtime.toISOString() };
+    }
+    /**
+     * Partition a parsed config into the 10 known top-level keys vs everything
+     * else. Known nested groups (`qa`/`prd`/`architecture`/`brownfieldEpic`)
+     * pass through whole; their leaves are the 18-key matrix the form renders.
+     * Unknown top-level keys are surfaced read-only (AC4). Unparseable input →
+     * HARNESS_PARSE_ERROR so the client can fall back to raw editing.
+     */
+    parseUnknownKeys(content) {
+        let parsed;
+        try {
+            parsed = parseYaml(content);
+        }
+        catch (cause) {
+            throwMapped(HARNESS_ERRORS.HARNESS_PARSE_ERROR.code, `failed to parse core-config.yaml: ${cause?.message ?? String(cause)}`);
+        }
+        const knownKeys = {};
+        const unknownKeys = {};
+        // A comment-only / empty file parses to null or a scalar — treat as no keys.
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            for (const [key, value] of Object.entries(parsed)) {
+                if (KNOWN_TOP_LEVEL.has(key)) {
+                    knownKeys[key] = value;
+                }
+                else {
+                    unknownKeys[key] = value;
+                }
+            }
+        }
+        return { knownKeys: knownKeys, unknownKeys };
+    }
+    /**
+     * Apply AST-level patches to the config, preserving comments/order/quoting
+     * for every untouched node — including unknown keys (AC4.b). Running through
+     * a read → patch → write round trip means an external mutation that slipped
+     * in between read and write surfaces as STALE_WRITE.
+     *
+     * `expectedMtime` semantics mirror `harnessService.patchStructured`: when the
+     * client supplies it, that value is the guard; otherwise the freshly-read
+     * mtime guards against a concurrent write during our own round trip.
+     */
+    async patchKey(projectSlug, ops, expectedMtime) {
+        const { absolutePath } = await resolveBmadCoreConfigPath(projectSlug);
+        const current = await this.read(projectSlug);
+        const patched = applyYamlPatch(current.content, ops);
+        const guardMtime = expectedMtime ?? current.mtime;
+        return this.writeInternal(absolutePath, patched, guardMtime);
+    }
+    /**
+     * Raw-mode overwrite: write the supplied text verbatim, bypassing the AST
+     * patch (the user intentionally took control of the whole file). The
+     * STALE_WRITE guard still applies so a raw save cannot silently clobber an
+     * external edit (AC5.b).
+     */
+    async writeRaw(projectSlug, content, expectedMtime) {
+        const { absolutePath } = await resolveBmadCoreConfigPath(projectSlug);
+        return this.writeInternal(absolutePath, content, expectedMtime);
+    }
+    /**
+     * Shared write tail: STALE_WRITE guard + writeFile + self-write echo
+     * suppression. Mirrors `harnessService.write` / `claudeMdService.write`.
+     * The parent `.bmad-core/` directory is guaranteed to exist (BMad-project
+     * gate), so there is no auto-mkdir path here.
+     */
+    async writeInternal(absolutePath, content, expectedMtime) {
+        if (expectedMtime !== undefined) {
+            try {
+                const existing = await fs.stat(absolutePath);
+                const currentMtime = existing.mtime.toISOString();
+                if (currentMtime !== expectedMtime) {
+                    throwMapped(HARNESS_ERRORS.HARNESS_STALE_WRITE.code, 'file changed on disk', { currentMtime });
+                }
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === 'ENOENT') {
+                    throwMapped(HARNESS_ERRORS.HARNESS_STALE_WRITE.code, 'file missing on disk', { currentMtime: '' });
+                }
+                if (code === HARNESS_ERRORS.HARNESS_STALE_WRITE.code)
+                    throw error;
+                if (code === 'EACCES') {
+                    throwMapped(HARNESS_ERRORS.HARNESS_FORBIDDEN.code, 'permission denied');
+                }
+                // Any other stat failure: fall through and let writeFile surface it.
+            }
+        }
+        try {
+            await fs.writeFile(absolutePath, content, 'utf-8');
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'EACCES') {
+                throwMapped(HARNESS_ERRORS.HARNESS_FORBIDDEN.code, 'permission denied');
+            }
+            throwMapped(HARNESS_ERRORS.HARNESS_WRITE_ERROR.code, 'failed to write file');
+        }
+        const stat = await fs.stat(absolutePath);
+        // Share the harness self-write suppression map so the `.bmad-core/`
+        // watcher (Task A.4) swallows our own-write echo on the same path.
+        fileWatcherService.noteLocalWrite(absolutePath);
+        return { mtime: stat.mtime.toISOString() };
+    }
+}
+export const bmadCoreConfigService = new BmadCoreConfigService();
+//# sourceMappingURL=bmadCoreConfigService.js.map