hammoc 1.4.0 → 1.6.0

package/packages/server/dist/controllers/claudeMdController.js

@@ -0,0 +1,158 @@
+/**
+ * Story 29.1: Claude Code free-edit memory layer controller.
+ *
+ * Mounts at GET/PUT/POST `/api/harness/claude-md` to expose the two CLAUDE.md
+ * files (project root + global) the harness workbench manages. Mirrors the
+ * error-mapping pattern in `harnessController.ts` (Story 28.0.5) — the same
+ * envelope `{ error: { code, message, details? } }` and `req.t!()` i18n
+ * resolution apply, so client-side error handling is uniform across all
+ * harness endpoints.
+ */
+import { z } from 'zod';
+import { HARNESS_ERRORS } from '@hammoc/shared';
+import { claudeMdService } from '../services/claudeMdService.js';
+const refQuerySchema = z
+    .object({
+    scope: z.enum(['user', 'project']),
+    projectSlug: z.string().optional(),
+})
+    .refine((v) => v.scope !== 'project' || (v.projectSlug && v.projectSlug.length > 0), { message: 'projectSlug is required when scope is "project"', path: ['projectSlug'] });
+const writeBodySchema = z
+    .object({
+    scope: z.enum(['user', 'project']),
+    projectSlug: z.string().optional(),
+    content: z.string(),
+    expectedMtime: z.string().optional(),
+})
+    .refine((v) => v.scope !== 'project' || (v.projectSlug && v.projectSlug.length > 0), { message: 'projectSlug is required when scope is "project"', path: ['projectSlug'] });
+const createBodySchema = z
+    .object({
+    scope: z.enum(['user', 'project']),
+    projectSlug: z.string().optional(),
+})
+    .refine((v) => v.scope !== 'project' || (v.projectSlug && v.projectSlug.length > 0), { message: 'projectSlug is required when scope is "project"', path: ['projectSlug'] });
+const MAPPED_CODES = [
+    'HARNESS_PATH_DENIED',
+    'HARNESS_FORBIDDEN',
+    'HARNESS_FILE_NOT_FOUND',
+    'HARNESS_NOT_A_FILE',
+    'HARNESS_ROOT_MISSING',
+    'HARNESS_PARENT_NOT_FOUND',
+    'HARNESS_STALE_WRITE',
+    'HARNESS_FILE_EXISTS',
+    'HARNESS_PARSE_ERROR',
+];
+const MESSAGE_KEY = {
+    HARNESS_PATH_DENIED: 'harness.error.pathDenied',
+    HARNESS_FORBIDDEN: 'harness.error.forbidden',
+    HARNESS_FILE_NOT_FOUND: 'harness.error.fileNotFound',
+    HARNESS_NOT_A_FILE: 'harness.error.notAFile',
+    HARNESS_ROOT_MISSING: 'harness.error.rootMissing',
+    HARNESS_PARENT_NOT_FOUND: 'harness.error.parentNotFound',
+    HARNESS_STALE_WRITE: 'harness.error.staleWrite',
+    HARNESS_FILE_EXISTS: 'harness.claudeMd.error.fileExists',
+    HARNESS_PARSE_ERROR: 'harness.error.parseError',
+};
+function handleError(req, res, error) {
+    const nodeError = error;
+    for (const key of MAPPED_CODES) {
+        const entry = HARNESS_ERRORS[key];
+        if (nodeError.code === entry.code) {
+            const body = {
+                code: entry.code,
+                message: req.t(MESSAGE_KEY[key]),
+            };
+            if (key === 'HARNESS_STALE_WRITE') {
+                body.details = { currentMtime: nodeError.currentMtime ?? '' };
+            }
+            // Story 29.1 (AC4.c): surface the resolved absolute path in 404 details
+            // so the client can render the empty-state "Create CLAUDE.md?" confirm
+            // dialog with the canonical location string.
+            if (key === 'HARNESS_FILE_NOT_FOUND' && nodeError.absolutePath) {
+                body.details = { absolutePath: nodeError.absolutePath };
+            }
+            res.status(entry.httpStatus).json({ error: body });
+            return;
+        }
+    }
+    res.status(HARNESS_ERRORS.HARNESS_WRITE_ERROR.httpStatus).json({
+        error: {
+            code: HARNESS_ERRORS.HARNESS_WRITE_ERROR.code,
+            message: req.t('harness.error.writeError'),
+        },
+    });
+}
+function parseQueryRef(req, res) {
+    const parsed = refQuerySchema.safeParse(req.query);
+    if (!parsed.success) {
+        const msg = parsed.error.issues[0]?.message ?? 'invalid query';
+        res.status(400).json({ error: { code: 'INVALID_REQUEST', message: msg } });
+        return null;
+    }
+    return { scope: parsed.data.scope, projectSlug: parsed.data.projectSlug };
+}
+export const claudeMdController = {
+    /** GET /api/harness/claude-md?scope=user | scope=project&projectSlug=<slug> */
+    async read(req, res) {
+        const ref = parseQueryRef(req, res);
+        if (!ref)
+            return;
+        try {
+            const result = await claudeMdService.read(ref);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /** PUT /api/harness/claude-md  body: { scope, projectSlug?, content, expectedMtime? } */
+    async write(req, res) {
+        const parsed = writeBodySchema.safeParse(req.body ?? {});
+        if (!parsed.success) {
+            res.status(400).json({
+                error: {
+                    code: 'INVALID_REQUEST',
+                    message: parsed.error.issues[0]?.message ?? 'invalid body',
+                },
+            });
+            return;
+        }
+        try {
+            const result = await claudeMdService.write({ scope: parsed.data.scope, projectSlug: parsed.data.projectSlug }, { content: parsed.data.content, expectedMtime: parsed.data.expectedMtime });
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /**
+     * POST /api/harness/claude-md  body: { scope, projectSlug? }
+     *
+     * AC4: creates an empty file. Distinct from PUT-with-empty-content so client
+     * intent ("create new") is preserved at the controller boundary. Pre-existing
+     * file → 409 HARNESS_FILE_EXISTS (no overwrite).
+     */
+    async create(req, res) {
+        const parsed = createBodySchema.safeParse(req.body ?? {});
+        if (!parsed.success) {
+            res.status(400).json({
+                error: {
+                    code: 'INVALID_REQUEST',
+                    message: parsed.error.issues[0]?.message ?? 'invalid body',
+                },
+            });
+            return;
+        }
+        try {
+            const result = await claudeMdService.create({
+                scope: parsed.data.scope,
+                projectSlug: parsed.data.projectSlug,
+            });
+            res.status(201).json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+};
+//# sourceMappingURL=claudeMdController.js.map

package/packages/server/dist/controllers/claudeMdController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeMdController.js","sourceRoot":"","sources":["../../src/controllers/claudeMdController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAoB,MAAM,gCAAgC,CAAC;AAEnF,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAC3E,EAAE,OAAO,EAAE,iDAAiD,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CACtF,CAAC;AAEJ,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAC3E,EAAE,OAAO,EAAE,iDAAiD,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CACtF,CAAC;AAEJ,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAC3E,EAAE,OAAO,EAAE,iDAAiD,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CACtF,CAAC;AAEJ,MAAM,YAAY,GAAG;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,0BAA0B;IAC1B,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;CACb,CAAC;AAEX,MAAM,WAAW,GAAgD;IAC/D,mBAAmB,EAAE,0BAA0B;IAC/C,iBAAiB,EAAE,yBAAyB;IAC5C,sBAAsB,EAAE,4BAA4B;IACpD,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,2BAA2B;IACjD,wBAAwB,EAAE,8BAA8B;IACxD,mBAAmB,EAAE,0BAA0B;IAC/C,mBAAmB,EAAE,mCAAmC;IACxD,mBAAmB,EAAE,0BAA0B;CAChD,CAAC;AAEF,SAAS,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,KAAc;IAC9D,MAAM,SAAS,GAAG,KAGjB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,GAAyE;gBACjF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,CAAC,CAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;aAClC,CAAC;YACF,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,6CAA6C;YAC7C,IAAI,GAAG,KAAK,wBAAwB,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC/D,IAAI,CAAC,OAAO,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;YAC1D,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;IACH,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QAC7D,KAAK,EAAE;YACL,IAAI,EAAE,cAAc,CAAC,mBAAmB,CAAC,IAAI;YAC7C,OAAO,EAAE,GAAG,CAAC,CAAE,CAAC,0BAA0B,CAAC;SAC5C;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,GAAa;IAChD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,+EAA+E;IAC/E,KAAK,CAAC,IAAI,CAAC,GAAY,EAAE,GAAa;QACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,KAAK,CAAC,GAAY,EAAE,GAAa;QACrC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc;iBAC3D;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CACxC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAClE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAC3E,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,GAAa;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc;iBAC3D;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;gBAC1C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;aACrC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAC"}

package/packages/server/dist/controllers/contextBuilderController.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Story 31.2: SessionStart context-builder controller (Epic 31).
+ *
+ * Mounts at:
+ *   GET    /api/harness/context-builder/:projectSlug            → read manifest + artifact state
+ *   PUT    /api/harness/context-builder/:projectSlug            → save manifest + (re)generate
+ *   POST   /api/harness/context-builder/:projectSlug/disable    → disable + cleanup
+ *
+ * Mirrors `bmadCoreConfigController` (Story 31.1): success responses are the raw
+ * result object; failures are `{ error: { code, message, details? } }` with the
+ * message resolved through `req.t!()` for i18n. There is no global Express error
+ * middleware — `HARNESS_ERRORS` codes are mapped to HTTP statuses inline,
+ * reusing the existing `harness.error.*` i18n keys.
+ */
+import { Request, Response } from 'express';
+export declare const contextBuilderController: {
+    /**
+     * GET /api/harness/context-builder/:projectSlug
+     *
+     * Returns the manifest + derived artifact state (script exists, entry
+     * registered). A missing manifest yields a default (disabled, empty) manifest
+     * with `mtime: ''` so the panel opens in an empty-state.
+     */
+    read(req: Request, res: Response): Promise<void>;
+    /**
+     * PUT /api/harness/context-builder/:projectSlug
+     * body: { manifest: ContextBuilderManifest; expectedMtime? }
+     *
+     * Persists the manifest then (re)generates the script + settings entry when
+     * enabled (or removes them when disabled). Returns the new manifest mtime +
+     * artifact locations + non-blocking secret warnings (AC5.c).
+     */
+    write(req: Request, res: Response): Promise<void>;
+    /**
+     * POST /api/harness/context-builder/:projectSlug/disable
+     * body: { expectedMtime? }
+     *
+     * Retains the declaration (`enabled: false`) but removes the generated script
+     * and the Hammoc-managed SessionStart entry (foreign entries preserved).
+     */
+    disable(req: Request, res: Response): Promise<void>;
+};
+//# sourceMappingURL=contextBuilderController.d.ts.map

package/packages/server/dist/controllers/contextBuilderController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextBuilderController.d.ts","sourceRoot":"","sources":["../../src/controllers/contextBuilderController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkF5C,eAAO,MAAM,wBAAwB;IACnC;;;;;;OAMG;cACa,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtD;;;;;;;OAOG;eACc,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvD;;;;;;OAMG;iBACgB,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAiB1D,CAAC"}

package/packages/server/dist/controllers/contextBuilderController.js

@@ -0,0 +1,159 @@
+/**
+ * Story 31.2: SessionStart context-builder controller (Epic 31).
+ *
+ * Mounts at:
+ *   GET    /api/harness/context-builder/:projectSlug            → read manifest + artifact state
+ *   PUT    /api/harness/context-builder/:projectSlug            → save manifest + (re)generate
+ *   POST   /api/harness/context-builder/:projectSlug/disable    → disable + cleanup
+ *
+ * Mirrors `bmadCoreConfigController` (Story 31.1): success responses are the raw
+ * result object; failures are `{ error: { code, message, details? } }` with the
+ * message resolved through `req.t!()` for i18n. There is no global Express error
+ * middleware — `HARNESS_ERRORS` codes are mapped to HTTP statuses inline,
+ * reusing the existing `harness.error.*` i18n keys.
+ */
+import { z } from 'zod';
+import { HARNESS_ERRORS } from '@hammoc/shared';
+import { contextBuilderService } from '../services/contextBuilderService.js';
+const projectSlugSchema = z.string().min(1, 'projectSlug is required');
+const manifestSchema = z.object({
+    version: z.literal(1).optional(),
+    enabled: z.boolean(),
+    files: z.array(z.string()),
+    variables: z.record(z.string(), z.boolean()),
+    recentCommitsCount: z.number().optional(),
+    customCommands: z.array(z.object({ command: z.string(), acknowledged: z.boolean() })),
+});
+const putBodySchema = z.object({
+    manifest: manifestSchema,
+    expectedMtime: z.string().optional(),
+});
+const disableBodySchema = z.object({
+    expectedMtime: z.string().optional(),
+});
+const MAPPED_CODES = [
+    'HARNESS_PATH_DENIED',
+    'HARNESS_FORBIDDEN',
+    'HARNESS_FILE_NOT_FOUND',
+    'HARNESS_NOT_A_FILE',
+    'HARNESS_ROOT_MISSING',
+    'HARNESS_STALE_WRITE',
+    'HARNESS_PARSE_ERROR',
+];
+const MESSAGE_KEY = {
+    HARNESS_PATH_DENIED: 'harness.error.pathDenied',
+    HARNESS_FORBIDDEN: 'harness.error.forbidden',
+    HARNESS_FILE_NOT_FOUND: 'harness.error.fileNotFound',
+    HARNESS_NOT_A_FILE: 'harness.error.notAFile',
+    HARNESS_ROOT_MISSING: 'harness.error.rootMissing',
+    HARNESS_STALE_WRITE: 'harness.error.staleWrite',
+    HARNESS_PARSE_ERROR: 'harness.error.parseError',
+};
+function handleError(req, res, error) {
+    const nodeError = error;
+    for (const key of MAPPED_CODES) {
+        const entry = HARNESS_ERRORS[key];
+        if (nodeError.code === entry.code) {
+            const body = {
+                code: entry.code,
+                message: req.t(MESSAGE_KEY[key]),
+            };
+            if (key === 'HARNESS_STALE_WRITE') {
+                body.details = { currentMtime: nodeError.currentMtime ?? '' };
+            }
+            res.status(entry.httpStatus).json({ error: body });
+            return;
+        }
+    }
+    res.status(HARNESS_ERRORS.HARNESS_WRITE_ERROR.httpStatus).json({
+        error: {
+            code: HARNESS_ERRORS.HARNESS_WRITE_ERROR.code,
+            message: req.t('harness.error.writeError'),
+        },
+    });
+}
+function parseSlug(req, res) {
+    const parsed = projectSlugSchema.safeParse(req.params.projectSlug);
+    if (!parsed.success) {
+        res.status(400).json({
+            error: { code: 'INVALID_REQUEST', message: parsed.error.issues[0]?.message ?? 'invalid projectSlug' },
+        });
+        return null;
+    }
+    return parsed.data;
+}
+export const contextBuilderController = {
+    /**
+     * GET /api/harness/context-builder/:projectSlug
+     *
+     * Returns the manifest + derived artifact state (script exists, entry
+     * registered). A missing manifest yields a default (disabled, empty) manifest
+     * with `mtime: ''` so the panel opens in an empty-state.
+     */
+    async read(req, res) {
+        const projectSlug = parseSlug(req, res);
+        if (!projectSlug)
+            return;
+        try {
+            const result = await contextBuilderService.readManifest(projectSlug);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /**
+     * PUT /api/harness/context-builder/:projectSlug
+     * body: { manifest: ContextBuilderManifest; expectedMtime? }
+     *
+     * Persists the manifest then (re)generates the script + settings entry when
+     * enabled (or removes them when disabled). Returns the new manifest mtime +
+     * artifact locations + non-blocking secret warnings (AC5.c).
+     */
+    async write(req, res) {
+        const projectSlug = parseSlug(req, res);
+        if (!projectSlug)
+            return;
+        const parsed = putBodySchema.safeParse(req.body ?? {});
+        if (!parsed.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: parsed.error.issues[0]?.message ?? 'invalid body' },
+            });
+            return;
+        }
+        try {
+            const result = await contextBuilderService.writeManifest(projectSlug, parsed.data.manifest, parsed.data.expectedMtime);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /**
+     * POST /api/harness/context-builder/:projectSlug/disable
+     * body: { expectedMtime? }
+     *
+     * Retains the declaration (`enabled: false`) but removes the generated script
+     * and the Hammoc-managed SessionStart entry (foreign entries preserved).
+     */
+    async disable(req, res) {
+        const projectSlug = parseSlug(req, res);
+        if (!projectSlug)
+            return;
+        const parsed = disableBodySchema.safeParse(req.body ?? {});
+        if (!parsed.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: parsed.error.issues[0]?.message ?? 'invalid body' },
+            });
+            return;
+        }
+        try {
+            await contextBuilderService.disable(projectSlug, parsed.data.expectedMtime);
+            res.json({ success: true });
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+};
+//# sourceMappingURL=contextBuilderController.js.map

package/packages/server/dist/controllers/contextBuilderController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextBuilderController.js","sourceRoot":"","sources":["../../src/controllers/contextBuilderController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAEvE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,KAAK,CACrB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAC7D;CACF,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;CACb,CAAC;AAEX,MAAM,WAAW,GAAgD;IAC/D,mBAAmB,EAAE,0BAA0B;IAC/C,iBAAiB,EAAE,yBAAyB;IAC5C,sBAAsB,EAAE,4BAA4B;IACpD,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,2BAA2B;IACjD,mBAAmB,EAAE,0BAA0B;IAC/C,mBAAmB,EAAE,0BAA0B;CAChD,CAAC;AAEF,SAAS,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,KAAc;IAC9D,MAAM,SAAS,GAAG,KAA0D,CAAC;IAC7E,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,GAAyE;gBACjF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,CAAC,CAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;aAClC,CAAC;YACF,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;IACH,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QAC7D,KAAK,EAAE;YACL,IAAI,EAAE,cAAc,CAAC,mBAAmB,CAAC,IAAI;YAC7C,OAAO,EAAE,GAAG,CAAC,CAAE,CAAC,0BAA0B,CAAC;SAC5C;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,GAAa;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qBAAqB,EAAE;SACtG,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,GAAY,EAAE,GAAa;QACpC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,GAAY,EAAE,GAAa;QACrC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,aAAa,CACtD,WAAW,EACX,MAAM,CAAC,IAAI,CAAC,QAAQ,EACpB,MAAM,CAAC,IAAI,CAAC,aAAa,CAC1B,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,GAAa;QACvC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAC"}

package/packages/server/dist/controllers/harnessAgentController.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Story 28.6: Harness sub-agent list / read / create / update / copy / delete controller.
+ *
+ * Mirrors the inline error-mapping pattern from harnessCommandController. New
+ * mapped codes for this story: HARNESS_AGENT_NOT_FOUND and
+ * HARNESS_AGENT_NAME_CONFLICT.
+ *
+ * Route surface (mounted at /api/harness from routes/harness.ts):
+ *   GET    /agents?projectSlug=<slug>?
+ *   GET    /agents/:name
+ *   POST   /agents
+ *   PUT    /agents/:name
+ *   POST   /agents/copy
+ *   DELETE /agents/:name
+ *
+ * Single-segment :name path param — flat-only policy (AC1.a) of the agents
+ * directory means no path-as-glob is needed (vs 28.5 commands which used `*`).
+ */
+import type { Request, Response } from 'express';
+export declare const harnessAgentController: {
+    list(req: Request, res: Response): Promise<void>;
+    read(req: Request, res: Response): Promise<void>;
+    create(req: Request, res: Response): Promise<void>;
+    update(req: Request, res: Response): Promise<void>;
+    copy(req: Request, res: Response): Promise<void>;
+    delete(req: Request, res: Response): Promise<void>;
+    /**
+     * Story 30.7 (Task B.2): rewrite every detected secret in the agent body
+     * as a `${ENV_REF}` placeholder. The route is the client-side dialog's
+     * `replaceWithEnvRefAgent` action target — distinct from `update` so the
+     * intent is auditable in the access log.
+     */
+    replaceSecretWithEnvRef(req: Request, res: Response): Promise<void>;
+};
+//# sourceMappingURL=harnessAgentController.d.ts.map

package/packages/server/dist/controllers/harnessAgentController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessAgentController.d.ts","sourceRoot":"","sources":["../../src/controllers/harnessAgentController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAmOjD,eAAO,MAAM,sBAAsB;cACjB,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cAgBtC,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;gBAuBpC,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;gBAgBtC,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cA6BxC,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;gBAgBpC,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BxD;;;;;OAKG;iCACgC,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CA0B1E,CAAC"}