mewkit 1.7.1 → 1.8.1

package/dist/orchviz/server/index.js

@@ -0,0 +1,147 @@
+/**
+ * OrchvizServer — node:http server bound 127.0.0.1 with SSE relay + static UI.
+ *
+ * Architecture ported from patoles/agent-flow @ 59ccf4e (app/src/server.ts +
+ * scripts/relay.ts SSE block). License Apache-2.0 (see ../../NOTICE).
+ */
+import * as http from "node:http";
+import { BIND_HOST, SSE_DRAIN_GRACE_MS } from "../constants.js";
+import { sanitizeEvent } from "../sanitize.js";
+import { SseRelay } from "./sse-handler.js";
+import { serveStatic } from "./static-handler.js";
+import { handleOverlays, handlePlan, handlePlans, writeJson, PLACEHOLDER_OVERLAYS, PLACEHOLDER_PLAN, } from "./api-handlers.js";
+import { handleTodoWrite, handleTodoPreflight, } from "./write-handlers.js";
+export class OrchvizServer {
+    server = null;
+    relay = new SseRelay();
+    actualPort = 0;
+    opts;
+    forwardEvent;
+    constructor(opts) {
+        this.opts = opts;
+        this.forwardEvent = (e) => {
+            this.relay.publish(sanitizeEvent(e));
+        };
+    }
+    get port() {
+        return this.actualPort;
+    }
+    get url() {
+        return `http://${BIND_HOST}:${this.actualPort}`;
+    }
+    async start(onListening) {
+        this.relay.start();
+        this.opts.eventSource.on("event", this.forwardEvent);
+        const desiredPort = this.opts.port ?? 0;
+        const tryListen = (port) => new Promise((resolve, reject) => {
+            const server = http.createServer((req, res) => this.routeRequest(req, res));
+            // All errors reject — caller distinguishes EADDRINUSE / EACCES for fallback.
+            server.on("error", reject);
+            server.listen(port, BIND_HOST, () => {
+                this.server = server;
+                const addr = server.address();
+                this.actualPort = typeof addr === "object" && addr ? addr.port : port;
+                resolve();
+            });
+        });
+        try {
+            await tryListen(desiredPort);
+        }
+        catch (err) {
+            const e = err;
+            if (desiredPort !== 0 && (e.code === "EADDRINUSE" || e.code === "EACCES")) {
+                if (this.opts.verbose) {
+                    process.stderr.write(`[orchviz] port ${desiredPort} unavailable (${e.code}); falling back to random\n`);
+                }
+                await tryListen(0);
+            }
+            else {
+                throw err;
+            }
+        }
+        const url = this.url;
+        if (onListening)
+            onListening(url);
+        return url;
+    }
+    async stop() {
+        this.opts.eventSource.off("event", this.forwardEvent);
+        this.relay.stop();
+        if (!this.server)
+            return;
+        const srv = this.server;
+        this.server = null;
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => resolve(), SSE_DRAIN_GRACE_MS);
+            if (typeof timer.unref === "function")
+                timer.unref();
+            srv.close(() => {
+                clearTimeout(timer);
+                resolve();
+            });
+        });
+    }
+    routeRequest(req, res) {
+        // Host header guard — defense vs DNS rebinding (red-team RT2 #1).
+        if (!this.isHostAllowed(req)) {
+            res.writeHead(403, { "Content-Type": "text/plain" });
+            res.end("Forbidden");
+            return;
+        }
+        const url = new URL(req.url ?? "/", `http://${BIND_HOST}:${this.actualPort}`);
+        const pathname = url.pathname;
+        // Route /api/plan/todo BEFORE the GET/HEAD method gate (spec step 14).
+        if (pathname === "/api/plan/todo") {
+            const writeCtx = {
+                projectRoot: this.opts.projectRoot ?? "",
+                port: this.actualPort,
+                planCollector: this.opts.planCollector,
+            };
+            if (req.method === "OPTIONS") {
+                handleTodoPreflight(req, res, this.actualPort);
+                return;
+            }
+            void handleTodoWrite(req, res, writeCtx);
+            return;
+        }
+        if (req.method !== "GET" && req.method !== "HEAD") {
+            res.writeHead(405, { Allow: "GET, HEAD", "Content-Type": "text/plain" });
+            res.end("Method Not Allowed");
+            return;
+        }
+        if (pathname === "/events") {
+            this.relay.handle(req, res);
+            return;
+        }
+        if (pathname === "/api/overlays") {
+            handleOverlays(res, this.opts.overlayProvider ?? PLACEHOLDER_OVERLAYS);
+            return;
+        }
+        if (pathname === "/api/plans") {
+            if (this.opts.projectRoot) {
+                handlePlans(res, this.opts.projectRoot);
+            }
+            else {
+                writeJson(res, 200, { plans: [], generatedAt: new Date().toISOString() });
+            }
+            return;
+        }
+        if (pathname === "/api/plan") {
+            handlePlan(res, this.opts.planProvider ?? PLACEHOLDER_PLAN, url.searchParams);
+            return;
+        }
+        serveStatic(req, res, this.opts.staticDir);
+    }
+    isHostAllowed(req) {
+        const host = req.headers.host;
+        if (!host)
+            return false;
+        const expected = new Set([
+            `${BIND_HOST}:${this.actualPort}`,
+            `localhost:${this.actualPort}`,
+        ]);
+        // Allow stable port match too in case actualPort still 0 during fallback.
+        return expected.has(host) || host === BIND_HOST || host === "localhost";
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/orchviz/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/orchviz/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACN,cAAc,EACd,UAAU,EACV,WAAW,EACX,SAAS,EACT,oBAAoB,EACpB,gBAAgB,GAGhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,eAAe,EACf,mBAAmB,GAEnB,MAAM,qBAAqB,CAAC;AAgB7B,MAAM,OAAO,aAAa;IACjB,MAAM,GAAuB,IAAI,CAAC;IACzB,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;IAChC,UAAU,GAAG,CAAC,CAAC;IACN,IAAI,CAAuB;IAC3B,YAAY,CAA0B;IAEvD,YAAY,IAA0B;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAa,EAAQ,EAAE;YAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,IAAI,GAAG;QACN,OAAO,UAAU,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmC;QAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAiB,EAAE,CACjD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5E,6EAA6E;YAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;gBACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtE,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC3E,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,WAAW,iBAAiB,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC;gBACzG,CAAC;gBACD,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,WAAW;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;gBACd,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAyB,EAAE,GAAwB;QACvE,kEAAkE;QAClE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACR,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B,uEAAuE;QACvE,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAwB;gBACrC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;gBACxC,IAAI,EAAE,IAAI,CAAC,UAAU;gBACrB,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;aACtC,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/C,OAAO;YACR,CAAC;YACD,KAAK,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACzE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC9B,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAClC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,oBAAoB,CAAC,CAAC;YACvE,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3B,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9E,OAAO;QACR,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,aAAa,CAAC,GAAyB;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACxB,GAAG,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE;YACjC,aAAa,IAAI,CAAC,UAAU,EAAE;SAC9B,CAAC,CAAC;QACH,0EAA0E;QAC1E,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC;IACzE,CAAC;CACD"}

package/dist/orchviz/server/sse-handler.d.ts

@@ -0,0 +1,25 @@
+/**
+ * SSE handler — replay buffer, heartbeat, Last-Event-ID, client cap.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { AgentEvent } from "../protocol.js";
+export interface BufferedEvent {
+    id: number;
+    event: AgentEvent;
+}
+export declare class SseRelay {
+    private readonly clients;
+    private readonly buffer;
+    private readonly agentRegistry;
+    private nextId;
+    private heartbeat;
+    start(): void;
+    stop(): void;
+    clientCount(): number;
+    publish(event: AgentEvent): void;
+    handle(req: IncomingMessage, res: ServerResponse): void;
+    private broadcast;
+    private writeOne;
+    private sendHeartbeat;
+}
+//# sourceMappingURL=sse-handler.d.ts.map

package/dist/orchviz/server/sse-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-handler.d.ts","sourceRoot":"","sources":["../../../src/orchviz/server/sse-handler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,gBAAgB,CAAC;AASjE,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;CAClB;AAED,qBAAa,QAAQ;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAK9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAClE,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,SAAS,CAA+B;IAEhD,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAaZ,WAAW,IAAI,MAAM;IAIrB,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAYhC,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAsCvD,OAAO,CAAC,SAAS;IAmBjB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,aAAa;CAcrB"}

package/dist/orchviz/server/sse-handler.js

@@ -0,0 +1,128 @@
+/**
+ * SSE handler — replay buffer, heartbeat, Last-Event-ID, client cap.
+ */
+import { MAX_SSE_BUFFER, MAX_SSE_CLIENTS, SSE_HEARTBEAT_MS, } from "../constants.js";
+const SPAWN_TYPE = "agent_spawn";
+export class SseRelay {
+    clients = new Set();
+    buffer = [];
+    // Persistent registry of agent_spawn events keyed by `${sessionId}:${name}`.
+    // The ring buffer evicts old events, but a browser that reconnects mid-session
+    // still needs to know which agents exist — otherwise tool_call_* events drop
+    // silently because their target agent was never spawned in the client view.
+    agentRegistry = new Map();
+    nextId = 1;
+    heartbeat = null;
+    start() {
+        if (this.heartbeat)
+            return;
+        this.heartbeat = setInterval(() => this.sendHeartbeat(), SSE_HEARTBEAT_MS);
+        if (typeof this.heartbeat.unref === "function")
+            this.heartbeat.unref();
+    }
+    stop() {
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = null;
+        for (const c of this.clients) {
+            try {
+                c.end();
+            }
+            catch {
+                // ignore
+            }
+        }
+        this.clients.clear();
+    }
+    clientCount() {
+        return this.clients.size;
+    }
+    publish(event) {
+        const id = this.nextId++;
+        const buffered = { id, event };
+        this.buffer.push(buffered);
+        if (this.buffer.length > MAX_SSE_BUFFER)
+            this.buffer.shift();
+        if (event.type === SPAWN_TYPE) {
+            const name = event.payload?.name ?? "unknown";
+            this.agentRegistry.set(`${event.sessionId ?? "_"}:${name}`, buffered);
+        }
+        this.broadcast(id, event);
+    }
+    handle(req, res) {
+        if (this.clients.size >= MAX_SSE_CLIENTS) {
+            res.writeHead(503, { "Content-Type": "text/plain" });
+            res.end("Too many SSE clients");
+            return;
+        }
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache, no-transform",
+            Connection: "keep-alive",
+            "X-Accel-Buffering": "no",
+        });
+        res.write(": connected\n\n");
+        const lastIdHeader = req.headers["last-event-id"];
+        const lastId = typeof lastIdHeader === "string" ? parseInt(lastIdHeader, 10) || 0 : 0;
+        // Replay agent_spawn registry first so the client knows which agents exist
+        // before any tool_call_* / message events arrive that reference them. Skip
+        // any agent_spawn already inside the ring buffer (avoid duplicate).
+        const bufferedIds = new Set(this.buffer.map((b) => b.id));
+        for (const buffered of this.agentRegistry.values()) {
+            if (buffered.id > lastId && !bufferedIds.has(buffered.id)) {
+                this.writeOne(res, buffered.id, buffered.event);
+            }
+        }
+        for (const buffered of this.buffer) {
+            if (buffered.id > lastId)
+                this.writeOne(res, buffered.id, buffered.event);
+        }
+        this.clients.add(res);
+        const cleanup = () => {
+            this.clients.delete(res);
+        };
+        req.on("close", cleanup);
+        req.on("error", cleanup);
+        res.on("error", cleanup);
+    }
+    broadcast(id, event) {
+        for (const res of this.clients) {
+            try {
+                const ok = this.writeOne(res, id, event);
+                if (!ok) {
+                    // Slow client; backpressure → drop further events for it but keep alive.
+                    continue;
+                }
+            }
+            catch {
+                this.clients.delete(res);
+                try {
+                    res.end();
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+    }
+    writeOne(res, id, event) {
+        return res.write(`id: ${id}\ndata: ${JSON.stringify(event)}\n\n`);
+    }
+    sendHeartbeat() {
+        for (const res of this.clients) {
+            try {
+                res.write(": ping\n\n");
+            }
+            catch {
+                this.clients.delete(res);
+                try {
+                    res.end();
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=sse-handler.js.map

package/dist/orchviz/server/sse-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-handler.js","sourceRoot":"","sources":["../../../src/orchviz/server/sse-handler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EACN,cAAc,EACd,eAAe,EACf,gBAAgB,GAChB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,UAAU,GAAmB,aAAa,CAAC;AAOjD,MAAM,OAAO,QAAQ;IACH,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,MAAM,GAAoB,EAAE,CAAC;IAC9C,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC3D,aAAa,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,MAAM,GAAG,CAAC,CAAC;IACX,SAAS,GAA0B,IAAI,CAAC;IAEhD,KAAK;QACJ,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC3E,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxE,CAAC;IAED,IAAI;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACJ,CAAC,CAAC,GAAG,EAAE,CAAC;YACT,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS;YACV,CAAC;QACF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,WAAW;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,KAAiB;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,cAAc;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,EAAE,IAA2B,IAAI,SAAS,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAChC,OAAO;QACR,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,wBAAwB;YACzC,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAE7B,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,2EAA2E;QAC3E,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACpD,IAAI,QAAQ,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;QACF,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,QAAQ,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,GAAS,EAAE;YAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;IAEO,SAAS,CAAC,EAAU,EAAE,KAAiB;QAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC;gBACJ,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACT,yEAAyE;oBACzE,SAAS;gBACV,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,IAAI,CAAC;oBACJ,GAAG,CAAC,GAAG,EAAE,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAEO,QAAQ,CAAC,GAAmB,EAAE,EAAU,EAAE,KAAiB;QAClE,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAEO,aAAa;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC;gBACJ,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACR,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,IAAI,CAAC;oBACJ,GAAG,CAAC,GAAG,EAAE,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;CACD"}

package/dist/orchviz/server/static-handler.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Static file serving with path-traversal guard.
+ *
+ * Ported from patoles/agent-flow @ 59ccf4e (app/src/static.ts).
+ * License Apache-2.0 (see ../../NOTICE).
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+export declare function serveStatic(req: IncomingMessage, res: ServerResponse, staticDir: string): void;
+//# sourceMappingURL=static-handler.d.ts.map

package/dist/orchviz/server/static-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/orchviz/server/static-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAqBjE,wBAAgB,WAAW,CAC1B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GACf,IAAI,CAmDN"}

package/dist/orchviz/server/static-handler.js

@@ -0,0 +1,76 @@
+/**
+ * Static file serving with path-traversal guard.
+ *
+ * Ported from patoles/agent-flow @ 59ccf4e (app/src/static.ts).
+ * License Apache-2.0 (see ../../NOTICE).
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+const MIME = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "application/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".ico": "image/x-icon",
+    ".svg": "image/svg+xml",
+    ".woff2": "font/woff2",
+    ".json": "application/json; charset=utf-8",
+};
+function mimeFor(filePath) {
+    return MIME[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+function send404(res) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Not Found");
+}
+export function serveStatic(req, res, staticDir) {
+    if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { Allow: "GET, HEAD", "Content-Type": "text/plain" });
+        res.end("Method Not Allowed");
+        return;
+    }
+    const reqUrl = req.url ?? "/";
+    // Defense in depth: reject any request containing ".." even after parsing.
+    if (reqUrl.includes("..")) {
+        send404(res);
+        return;
+    }
+    const url = new URL(reqUrl, "http://127.0.0.1");
+    let pathname = url.pathname;
+    if (pathname === "/")
+        pathname = "/index.html";
+    const baseDir = path.resolve(staticDir);
+    const candidate = path.resolve(baseDir, "." + pathname);
+    if (candidate !== baseDir && !candidate.startsWith(baseDir + path.sep)) {
+        send404(res);
+        return;
+    }
+    let stat;
+    try {
+        stat = fs.statSync(candidate);
+    }
+    catch {
+        send404(res);
+        return;
+    }
+    if (!stat.isFile()) {
+        send404(res);
+        return;
+    }
+    const isAsset = pathname.startsWith("/assets/");
+    const headers = {
+        "Content-Type": mimeFor(candidate),
+        "Content-Length": String(stat.size),
+        "Cache-Control": isAsset
+            ? "public, max-age=31536000, immutable"
+            : "no-cache",
+    };
+    res.writeHead(200, headers);
+    if (req.method === "HEAD") {
+        res.end();
+        return;
+    }
+    const stream = fs.createReadStream(candidate);
+    stream.on("error", () => res.end());
+    stream.pipe(res);
+}
+//# sourceMappingURL=static-handler.js.map

package/dist/orchviz/server/static-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/orchviz/server/static-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,IAAI,GAA2B;IACpC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,YAAY;IACtB,OAAO,EAAE,iCAAiC;CAC1C,CAAC;AAEF,SAAS,OAAO,CAAC,QAAgB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,GAAmB;IACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,WAAW,CAC1B,GAAoB,EACpB,GAAmB,EACnB,SAAiB;IAEjB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC9B,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9B,2EAA2E;IAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,KAAK,GAAG;QAAE,QAAQ,GAAG,aAAa,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACJ,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,OAAO,GAA2B;QACvC,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC;QAClC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,eAAe,EAAE,OAAO;YACvB,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,UAAU;KACb,CAAC;IACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/dist/orchviz/server/write-handlers.d.ts

@@ -0,0 +1,20 @@
+/**
+ * write-handlers — POST /api/plan/todo handler.
+ *
+ * Pipeline: readonly → method → origin → CT → body → parse → zod
+ *   → slug → boundary (R2-15) → orphan cleanup (R2-13)
+ *   → phase glob (R2-1) → file boundary (M15) → etag → toggle
+ *   → no-op early return → atomic write → invalidate → 200.
+ * Helpers live in write-utils.ts. Red-team: H4 H5 M11 M15 R2-1 R2-6
+ *   R2-10 R2-13 R2-14 R2-15 SEC#8.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type PlanCollector } from "../plan/collector.js";
+export { handleTodoPreflight } from "./write-utils.js";
+export interface WriteHandlerContext {
+    projectRoot: string;
+    port: number;
+    planCollector?: PlanCollector;
+}
+export declare function handleTodoWrite(req: IncomingMessage, res: ServerResponse, ctx: WriteHandlerContext): Promise<void>;
+//# sourceMappingURL=write-handlers.d.ts.map

package/dist/orchviz/server/write-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-handlers.d.ts","sourceRoot":"","sources":["../../../src/orchviz/server/write-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAQjE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAW7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAqBvD,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,aAAa,CAAC;CAC9B;AAMD,wBAAsB,eAAe,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC,IAAI,CAAC,CA2Gf"}

package/dist/orchviz/server/write-handlers.js

@@ -0,0 +1,167 @@
+/**
+ * write-handlers — POST /api/plan/todo handler.
+ *
+ * Pipeline: readonly → method → origin → CT → body → parse → zod
+ *   → slug → boundary (R2-15) → orphan cleanup (R2-13)
+ *   → phase glob (R2-1) → file boundary (M15) → etag → toggle
+ *   → no-op early return → atomic write → invalidate → 200.
+ * Helpers live in write-utils.ts. Red-team: H4 H5 M11 M15 R2-1 R2-6
+ *   R2-10 R2-13 R2-14 R2-15 SEC#8.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { z } from "zod";
+import { applyTodoToggle } from "../plan/apply-todo-toggle.js";
+import { atomicWriteFileSync, cleanOrphanedTmps } from "../plan/atomic-write.js";
+import { SLUG_RE, buildPhaseNumberRe } from "../plan/plan-constants.js";
+import { isOrchvizReadonly } from "../plan/collector.js";
+import { createLogger } from "../logger.js";
+import { isOriginAllowed, bufferBody, BodyError, resolvePlanDirBoundary, resolvePhaseFileBoundary, writeJson, } from "./write-utils.js";
+export { handleTodoPreflight } from "./write-utils.js";
+const log = createLogger("PlanWriter");
+// ── Inline zod schema (R2-10) ───────────────────────────────────────────────
+const TodoWriteRequest = z.object({
+    slug: z.string(),
+    phase: z.number().int().min(0).max(99),
+    todoIdx: z.number().int().min(0).max(999),
+    checked: z.boolean(),
+    etag: z.string().regex(/^[0-9a-f]{64}$/),
+});
+const BODY_CAP = 4096;
+const DEFAULT_TIMEOUT_MS = 5000;
+function reqTimeout() {
+    const v = parseInt(process.env.MEOWKIT_ORCHVIZ_REQ_TIMEOUT_MS ?? "", 10);
+    return Number.isFinite(v) && v > 0 ? v : DEFAULT_TIMEOUT_MS;
+}
+// Per-process: tracks which slugs we have already cleaned of orphan tmps.
+// Intentionally unbounded — slug count is bounded by the plans directory size.
+const cleanedSlugs = new Set();
+export async function handleTodoWrite(req, res, ctx) {
+    if (isOrchvizReadonly()) {
+        writeJson(res, 405, { error: "readonly" });
+        return;
+    }
+    if (req.method !== "POST") {
+        res.writeHead(405, { Allow: "POST" });
+        res.end();
+        return;
+    }
+    const origin = req.headers["origin"] ?? "";
+    if (!isOriginAllowed(origin, ctx.port)) {
+        log.warn("origin-rejected", { originHeader: origin });
+        writeJson(res, 403, { error: "forbidden-origin" });
+        return;
+    }
+    const ct = req.headers["content-type"] ?? "";
+    if (!ct.toLowerCase().includes("application/json")) {
+        writeJson(res, 415, { error: "unsupported-media-type" });
+        return;
+    }
+    let rawBuf;
+    try {
+        rawBuf = await bufferBody(req, BODY_CAP, reqTimeout());
+    }
+    catch (err) {
+        writeJson(res, err instanceof BodyError ? err.status : 400, { error: err instanceof BodyError ? err.tag : "body-read-error" });
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(rawBuf.toString("utf-8"));
+    }
+    catch {
+        writeJson(res, 400, { error: "invalid-json" });
+        return;
+    }
+    const validated = TodoWriteRequest.safeParse(parsed);
+    if (!validated.success) {
+        writeJson(res, 400, { error: "validation-failed", details: validated.error.issues });
+        return;
+    }
+    const body = validated.data;
+    if (!SLUG_RE.test(body.slug)) {
+        log.warn("invalid-slug", { httpStatus: 400 });
+        writeJson(res, 400, { error: "invalid-slug" });
+        return;
+    }
+    const plansDir = path.join(ctx.projectRoot, "tasks", "plans");
+    const planDir = path.join(plansDir, body.slug);
+    // 8. Boundary check — resolvedPlanDir cached once (R2-15)
+    const boundary = resolvePlanDirBoundary(plansDir, planDir);
+    if (!boundary) {
+        log.warn("plandir-boundary-failed", { slug: body.slug, httpStatus: 403 });
+        writeJson(res, 403, { error: "forbidden-path" });
+        return;
+    }
+    const { resolvedPlanDir } = boundary;
+    // R2-13: orphan cleanup on first write per slug
+    if (!cleanedSlugs.has(body.slug)) {
+        cleanedSlugs.add(body.slug);
+        cleanOrphanedTmps(resolvedPlanDir);
+    }
+    // 9. Phase glob — zero-pad regex (R2-1 CRITICAL)
+    const phaseRe = buildPhaseNumberRe(body.phase);
+    let dirEntries;
+    try {
+        dirEntries = fs.readdirSync(resolvedPlanDir);
+    }
+    catch {
+        writeJson(res, 404, { error: "plan-not-found" });
+        return;
+    }
+    const matches = dirEntries.filter((n) => !n.startsWith(".") && phaseRe.test(n));
+    if (matches.length !== 1) {
+        log.warn("ambiguous-phase", { slug: body.slug, phase: body.phase, matchCount: matches.length, httpStatus: 400 });
+        writeJson(res, 400, { error: "ambiguous-phase" });
+        return;
+    }
+    // 10. Realpath check on globbed file (M15 + R2-15)
+    const resolvedPhaseFile = resolvePhaseFileBoundary(path.join(resolvedPlanDir, matches[0]), resolvedPlanDir);
+    if (!resolvedPhaseFile) {
+        log.warn("phasefile-boundary-failed", { slug: body.slug, phase: body.phase, httpStatus: 403 });
+        writeJson(res, 403, { error: "forbidden-path" });
+        return;
+    }
+    // 12-14. Single read; derive ETag from buffer (avoids second readFileSync)
+    let fileBuf;
+    try {
+        fileBuf = fs.readFileSync(resolvedPhaseFile);
+    }
+    catch {
+        writeJson(res, 500, { error: "file-read-failed" });
+        return;
+    }
+    const currentEtag = crypto.createHash("sha256").update(fileBuf).digest("hex");
+    if (currentEtag !== body.etag) {
+        log.debug("stale-etag", { slug: body.slug, phase: body.phase, todoIdx: body.todoIdx, httpStatus: 409 });
+        writeJson(res, 409, { error: "stale", currentEtag });
+        return;
+    }
+    const result = applyTodoToggle(fileBuf.toString("utf-8"), body.todoIdx, body.checked);
+    if ("error" in result) {
+        log.warn("toggle-error", { slug: body.slug, phase: body.phase, todoIdx: body.todoIdx, errorTag: result.error, httpStatus: 400 });
+        writeJson(res, 400, { error: result.error });
+        return;
+    }
+    // 15. Idempotent no-op
+    if (!result.changed) {
+        log.debug("no-op", { slug: body.slug, phase: body.phase, todoIdx: body.todoIdx, changed: false, httpStatus: 200 });
+        writeJson(res, 200, { ok: true, changed: false, etag: currentEtag });
+        return;
+    }
+    // 16. Atomic write
+    try {
+        atomicWriteFileSync(resolvedPhaseFile, result.content);
+    }
+    catch {
+        writeJson(res, 500, { error: "write-failed" });
+        return;
+    }
+    // 17-18. New etag (hash the just-written content directly, no re-read) + invalidate + respond
+    const newEtag = crypto.createHash("sha256").update(result.content).digest("hex");
+    ctx.planCollector?.invalidate();
+    log.debug("write-success", { slug: body.slug, phase: body.phase, todoIdx: body.todoIdx, changed: true, httpStatus: 200 });
+    writeJson(res, 200, { ok: true, changed: true, etag: newEtag });
+}
+//# sourceMappingURL=write-handlers.js.map

package/dist/orchviz/server/write-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-handlers.js","sourceRoot":"","sources":["../../../src/orchviz/server/write-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAsB,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,eAAe,EACf,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,wBAAwB,EACxB,SAAS,GACT,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAEvC,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACxC,CAAC,CAAC;AAGH,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,SAAS,UAAU;IAClB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC7D,CAAC;AAQD,0EAA0E;AAC1E,+EAA+E;AAC/E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,GAAoB,EACpB,GAAmB,EACnB,GAAwB;IAExB,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAChF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAExF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACnD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAEzH,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,GAAG,EAAE,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC/H,OAAO;IACR,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;IACtD,MAAM,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAEjE,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzH,MAAM,IAAI,GAAyB,SAAS,CAAC,IAAI,CAAC;IAElD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACR,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjD,OAAO;IACR,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC;IAErC,gDAAgD;IAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IAEtG,iDAAiD;IACjD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QAAC,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IACrD,MAAM,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjH,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClD,OAAO;IACR,CAAC;IAED,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5G,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjD,OAAO;IACR,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;IACrD,MAAM,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAErE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,WAAW,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO;IACR,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjI,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7C,OAAO;IACR,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACnH,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACrE,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC;QAAC,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAEjE,8FAA8F;IAC9F,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1H,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACjE,CAAC"}