mover-os 4.7.7 → 4.7.8

package/src/dashboard/lib/activation-log.js

@@ -0,0 +1,297 @@
+"use strict";
+
+// Activation event log — local-only, append-only, telemetry-never.
+//
+// V5.0 scaffold (per Phase 41.0 in dev/plan.md). Records when a user
+// actually USES Mover OS so V5 features can be measured against real
+// behavior instead of founder intuition.
+//
+// Codex blind-spot fix (2026-05-24 gpt-5 review): an activation-based goal
+// (e.g. "N activated installs by <date>") needs "activated" operationalized.
+// Without local activation signals, every activation feature is a guess
+// about what causes activation.
+//
+// Constraints:
+//   - LOCAL ONLY. File at ~/.mover/activation-events.jsonl. Never sent
+//     anywhere. Respects the dashboard's "TELEMETRY NEVER" promise.
+//   - APPEND ONLY. One event per line (jsonl). New writes never modify
+//     existing lines.
+//   - SIZE CAPPED. 10MB ceiling; oldest events rotated to .jsonl.bak.
+//   - BEST EFFORT. Failures (disk full, perms) log to console.warn and
+//     return silently. Activation logging must never block the server.
+//
+// Event shape:
+//   {
+//     "ts":      "2026-05-24T02:30:00.000Z",  // ISO
+//     "type":    "dashboard_open",            // enum (see EVENT_TYPES)
+//     "version": "4.7.7",                     // package version at time of event
+//     "session": "pid-12345",                 // process id, lets us de-dupe within a session
+//     "meta":    { ... }                      // optional, per-event payload
+//   }
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+// Allowed event types. Adding a new type? Extend this list AND update
+// the readStats() aggregation in build.js when Phase 41.0.4 wires it.
+const EVENT_TYPES = Object.freeze([
+  "dashboard_open",         // /api/health hit (first time per process)
+  "workflow_run",           // /api/workflow/run or /api/workflow/open-in-terminal called
+  "log_completed",          // /log workflow finished (Stop hook signal)
+  "onboarding_finished",    // first-run flow completed
+  "file_edit_in_obsidian",  // user clicked obsidian:// deep link
+  "referral_mentioned",     // user mentioned someone else installed (manual capture)
+]);
+
+const MAX_FILE_BYTES = 10 * 1024 * 1024; // 10MB
+const ROTATION_SUFFIX = ".bak";
+
+function logFilePath() {
+  const home = os.homedir();
+  return path.join(home, ".mover", "activation-events.jsonl");
+}
+
+function rotationPath() {
+  return logFilePath() + ROTATION_SUFFIX;
+}
+
+function ensureLogDir() {
+  const dir = path.dirname(logFilePath());
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+  } catch (_) {
+    // Best effort. Caller will see the appendFileSync error if dir really
+    // can't be created.
+  }
+}
+
+function rotateIfNeeded(pendingBytes = 0) {
+  // Audit H4: TOCTOU race between stat and rename across concurrent processes.
+  // We can't fully eliminate it without a file lock, but we can ensure the
+  // failure mode is "no-op" instead of "lose data" by catching ENOENT on
+  // rename (means another process already rotated). Returns true if a
+  // rotation succeeded so the caller can retry the write to a fresh file.
+  //
+  // Audit pass 2 #10: include `pendingBytes` so a write that would push
+  // the file past the cap rotates first instead of overshooting. This
+  // makes 10MB the actual ceiling, not a soft target.
+  try {
+    const st = fs.statSync(logFilePath());
+    if (st.size + pendingBytes > MAX_FILE_BYTES) {
+      // Pass 3 #4 regression fix: previous version read CURRENT + OLD into
+      // archive THEN renamed CURRENT → .bak. That left CURRENT both in the
+      // new .bak (from rename) AND in archive — duplicating data and
+      // re-duplicating on each subsequent rotation.
+      //
+      // Correct order: read the about-to-be-clobbered OLD .bak into
+      // archive FIRST (preserving prior generations), THEN rename so
+      // CURRENT becomes the new .bak. CURRENT only ends up in .bak (once),
+      // OLD only ends up in archive (once).
+      try {
+        if (fs.existsSync(rotationPath())) {
+          const archive = rotationPath() + ".archive";
+          const oldBak = fs.readFileSync(rotationPath(), "utf8");
+          fs.appendFileSync(archive, oldBak, { encoding: "utf8" });
+        }
+      } catch (_) { /* non-fatal */ }
+      try {
+        fs.renameSync(logFilePath(), rotationPath());
+        return true;
+      } catch (err) {
+        if (err && err.code === "ENOENT") {
+          // Another process already rotated — fine, our future appendFileSync
+          // will recreate the file.
+          return true;
+        } else if (err && err.code === "EBUSY") {
+          // Windows file lock contention — skip this write rather than
+          // appending to an oversized log unbounded (audit pass 2 #11).
+          // The caller's appendFileSync will get EBUSY too and skip cleanly.
+          return false;
+        } else {
+          // Other errors are unexpected but non-fatal.
+          return false;
+        }
+      }
+    }
+  } catch (_) {
+    // File doesn't exist yet — nothing to rotate.
+  }
+  return false;
+}
+
+function packageVersion() {
+  try {
+    const pkg = require("../../../package.json");
+    return pkg.version || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+// Write one event. Best-effort. Never throws.
+//
+// type:  one of EVENT_TYPES
+// meta:  optional object (will be JSON-stringified)
+//
+// Returns true if write succeeded, false otherwise.
+function logEvent(type, meta) {
+  if (!EVENT_TYPES.includes(type)) {
+    console.warn(`[activation-log] unknown event type: ${type}`);
+    return false;
+  }
+  // Sanitize meta (code-bug-audit M9): handle circular refs + reject huge
+  // payloads. JSON.stringify throws on circular refs; we don't want the
+  // logEvent call to lose the event because the caller passed an Error
+  // with a .cause chain.
+  let safeMeta;
+  if (meta && typeof meta === "object") {
+    try {
+      const json = JSON.stringify(meta);
+      // Cap at 16KB — beyond that, the event is metadata-dump territory
+      // and not useful for activation analysis. Replace with marker.
+      if (json && json.length <= 16 * 1024) {
+        safeMeta = JSON.parse(json);
+      } else {
+        safeMeta = { error: "meta-too-large", size: json.length };
+      }
+    } catch {
+      safeMeta = { error: "unserializable-meta" };
+    }
+  }
+  const event = {
+    ts: new Date().toISOString(),
+    type,
+    version: packageVersion(),
+    session: `pid-${process.pid}`,
+    ...(safeMeta ? { meta: safeMeta } : {}),
+  };
+  try {
+    ensureLogDir();
+    const line = JSON.stringify(event) + "\n";
+    // Pass 3 #7 fix: previously appendFileSync ran even when
+    // rotateIfNeeded couldn't rotate (EBUSY, perms) — the file grew
+    // unbounded past the 10MB cap. Now: check whether rotation was
+    // needed AND succeeded. If a rotation was needed but failed, skip
+    // the write so the cap holds.
+    const sizeBeforeWrite = (() => {
+      try { return fs.statSync(logFilePath()).size; } catch (_) { return 0; }
+    })();
+    const pending = Buffer.byteLength(line, "utf8");
+    const willOvershoot = sizeBeforeWrite + pending > MAX_FILE_BYTES;
+    if (willOvershoot) {
+      const rotated = rotateIfNeeded(pending);
+      if (!rotated) {
+        // Couldn't rotate. Skip rather than break the cap.
+        console.warn("[activation-log] skipping write — cap reached and rotation failed");
+        return false;
+      }
+    } else {
+      // Always call (cheap no-op if no rotation needed) so caller stays
+      // simple.
+      rotateIfNeeded(pending);
+    }
+    fs.appendFileSync(logFilePath(), line, { encoding: "utf8" });
+    return true;
+  } catch (err) {
+    console.warn(`[activation-log] write failed: ${err.message}`);
+    return false;
+  }
+}
+
+// Read all events. Returns array of parsed event objects. Never throws.
+// Lines that fail to parse are silently skipped (forward-compat: future
+// event shapes won't break the reader).
+function readEvents(opts = {}) {
+  const { sinceIso, types, limit } = opts;
+  let raw;
+  try {
+    raw = fs.readFileSync(logFilePath(), "utf8");
+  } catch (_) {
+    return [];
+  }
+  const since = sinceIso ? Date.parse(sinceIso) : 0;
+  const typeFilter = Array.isArray(types) && types.length ? new Set(types) : null;
+  const events = [];
+  let corruptLines = 0;
+  const lines = raw.split("\n");
+  // Walk from end (newest) so `limit` returns most recent N efficiently.
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line) continue;
+    let ev;
+    try { ev = JSON.parse(line); } catch { corruptLines += 1; continue; }
+    if (typeFilter && !typeFilter.has(ev.type)) continue;
+    if (since && ev.ts && Date.parse(ev.ts) < since) continue;
+    events.push(ev);
+    if (limit && events.length >= limit) break;
+  }
+  events.reverse(); // chronological order
+  // Audit pass 2 #12: expose corruption count so the Briefing tile can
+  // distinguish "day 0" from "log file damaged." Attach as a sentinel
+  // on the array (non-enumerable so iteration is unaffected).
+  Object.defineProperty(events, "corruptLines", { value: corruptLines, enumerable: false });
+  return events;
+}
+
+// Aggregate stats for the dashboard's state.json. Cheap to compute on
+// every state rebuild (~once per request). Used by Phase 41.0.4 +
+// 41.0.5 to render the Briefing activation tile.
+function readStats() {
+  const events = readEvents();
+  const now = Date.now();
+  const week = 7 * 86400000;
+  const day = 86400000;
+  let firstEventTs = null;
+  let dashboardOpens = 0;
+  let workflowRuns = 0;
+  let dashboardOpens7d = 0;
+  let workflowRuns7d = 0;
+  let logCompletions7d = 0;
+  const distinctOpenDays = new Set();
+  for (const ev of events) {
+    const tMs = ev.ts ? Date.parse(ev.ts) : 0;
+    if (!firstEventTs || tMs < firstEventTs) firstEventTs = tMs;
+    if (ev.type === "dashboard_open") {
+      dashboardOpens += 1;
+      if (now - tMs <= week) dashboardOpens7d += 1;
+      if (ev.ts) distinctOpenDays.add(ev.ts.slice(0, 10));
+    } else if (ev.type === "workflow_run") {
+      workflowRuns += 1;
+      if (now - tMs <= week) workflowRuns7d += 1;
+    } else if (ev.type === "log_completed") {
+      if (now - tMs <= week) logCompletions7d += 1;
+    }
+  }
+  const installDays = firstEventTs ? Math.max(0, Math.round((now - firstEventTs) / day)) : 0;
+  // Activation definition (proposed): 2+ dashboard opens on separate days
+  // AND 1+ workflow run. Phase 41.0.6 will codify this in
+  // dev/V5_ACTIVATION_METRICS.md and test against the configured target.
+  const activated = distinctOpenDays.size >= 2 && workflowRuns >= 1;
+  return {
+    available: events.length > 0,
+    firstEventAt: firstEventTs ? new Date(firstEventTs).toISOString() : null,
+    installDays,
+    dashboardOpens,
+    dashboardOpens7d,
+    workflowRuns,
+    workflowRuns7d,
+    logCompletions7d,
+    distinctOpenDays: distinctOpenDays.size,
+    activated,
+    // Audit pass 2 #12: surfaces JSONL corruption to the Briefing tile.
+    // Non-zero => the log file has malformed lines (mid-write crash,
+    // editor edit, etc.); UI can show a repair hint rather than treat
+    // corruption as "no events."
+    corruptLines: events.corruptLines || 0,
+  };
+}
+
+module.exports = {
+  EVENT_TYPES,
+  logEvent,
+  readEvents,
+  readStats,
+  // Exported for tests:
+  __logFilePath: logFilePath,
+};

package/src/dashboard/lib/active-context-parser.js

@@ -0,0 +1,177 @@
+"use strict";
+
+const { activeContextPath, safeRead, safeStat } = require("./paths");
+
+// Forgiving Active_Context.md parser. Returns {available, lastUpdated, sections{...}, fields{...}}.
+// Never throws. On any error, returns {available:false, error}.
+
+function parseActiveContext(vault) {
+  const filePath = activeContextPath(vault);
+  const stat = safeStat(filePath);
+  const text = safeRead(filePath);
+  if (!text) return { available: false, error: "Active_Context.md not found", filePath };
+
+  const result = {
+    available: true,
+    filePath,
+    lastUpdated: stat ? stat.mtime : null,
+    raw: text,
+    sectionsRaw: {},
+    sections: {},
+    fields: {}
+  };
+
+  // Top-of-file fields like **Last Updated:** YYYY-MM-DD or "log_last_run: YYYY-MM-DD"
+  // Extract before first ## header
+  const firstHeader = text.search(/^## /m);
+  const preface = firstHeader > 0 ? text.slice(0, firstHeader) : text;
+  const fieldRe = /\*\*([^*]+):\*\*\s*([^\n]+)/g;
+  let m;
+  while ((m = fieldRe.exec(preface)) !== null) {
+    const k = m[1].trim().toLowerCase().replace(/\s+/g, "_");
+    result.fields[k] = m[2].trim();
+  }
+  // Plain field lines like "log_last_run: 2026-05-06T13:19"
+  const plainRe = /^([a-z_]+):\s*([^\n]+)$/gm;
+  while ((m = plainRe.exec(preface)) !== null) {
+    const k = m[1].trim();
+    if (!result.fields[k]) result.fields[k] = m[2].trim();
+  }
+
+  // Split file into ## sections
+  const lines = text.split("\n");
+  let current = null;
+  let buf = [];
+  const sections = [];
+  for (const line of lines) {
+    const h = line.match(/^##\s+(.+?)\s*$/);
+    if (h) {
+      if (current) sections.push({ title: current, body: buf.join("\n") });
+      current = h[1];
+      buf = [];
+    } else if (current) {
+      buf.push(line);
+    }
+  }
+  if (current) sections.push({ title: current, body: buf.join("\n") });
+
+  for (const sec of sections) {
+    result.sectionsRaw[sec.title] = sec.body;
+    // Try to extract bold-key fields per section
+    const fields = {};
+    const fr = /\*\*([^*]+):\*\*\s*([^\n]+)/g;
+    while ((m = fr.exec(sec.body)) !== null) {
+      const k = m[1].trim().toLowerCase().replace(/\s+/g, "_");
+      fields[k] = m[2].trim();
+    }
+    // Plain key: value lines
+    const pf = /^([a-z_]+):\s*([^\n]+)$/gm;
+    while ((m = pf.exec(sec.body)) !== null) {
+      const k = m[1].trim();
+      if (!fields[k]) fields[k] = m[2].trim();
+    }
+    result.sectionsRaw[sec.title] = sec.body;
+    result.sections[sec.title] = { fields, body: sec.body };
+  }
+
+  // Helpful named accessors for known sections
+  result.findSection = (needle) => {
+    const lower = String(needle).toLowerCase();
+    for (const [title, sec] of Object.entries(result.sections)) {
+      if (title.toLowerCase().includes(lower)) return { title, ...sec };
+    }
+    return null;
+  };
+
+  result.workflowState = (() => {
+    const ws = result.findSection("workflow state");
+    if (ws && ws.fields) return ws.fields;
+    // Fallback: top-of-file fields
+    const out = {};
+    for (const k of ["log_last_run", "analyse_day_last_run", "weekly_review_last_run", "pivot_strategy_last_run", "monthly_review_last_run", "review_week_day", "friction_escalation"]) {
+      if (result.fields[k]) out[k] = result.fields[k];
+    }
+    return out;
+  })();
+
+  result.engineHealth = (() => {
+    const eh = result.findSection("engine health");
+    if (!eh) return null;
+    return eh.fields || {};
+  })();
+
+  // Bullet items from S8 BACKLOG, S3.5 WAITING FOR, S8.5 COMMITMENTS.
+  // T242 bug hunt fix (C#3/C#4): the parser emitted {label} but the UI
+  // (PromiseWall, ExecutionCockpit, WeeklyLearnings) read {from, to,
+  // expected} — different field names per list semantics. Alias the
+  // bold-name capture into the right field per list:
+  //   commitments[].to      = who we owe
+  //   waitingFor[].from     = who we're waiting on
+  //   waitingFor[].expected = same as due (when expected)
+  result.backlog = parseBulletList(result.findSection("BACKLOG") || result.findSection("Backlog"), "backlog");
+  result.waitingFor = parseBulletList(result.findSection("WAITING FOR") || result.findSection("Waiting For"), "waitingFor");
+  result.commitments = parseBulletList(result.findSection("COMMITMENTS") || result.findSection("Commitments"), "commitments");
+  result.graveyard = parseBulletList(result.findSection("GRAVEYARD") || result.findSection("Graveyard"));
+  result.activeSessions = parseBulletList(result.findSection("ACTIVE SESSIONS") || result.findSection("Active Sessions"));
+  result.activePatterns = parseBulletList(result.findSection("ACTIVE PATTERNS") || result.findSection("Active Patterns"));
+
+  return result;
+}
+
+function parseBulletList(section, kind) {
+  if (!section || !section.body) return [];
+  const lines = section.body.split("\n");
+  const items = [];
+  for (const line of lines) {
+    const m = line.match(/^[-*]\s*\[(.)\]\s*(.+)$/) || line.match(/^[-*]\s+(.+)$/);
+    if (m) {
+      if (m.length === 3) {
+        const checked = m[1] === "x" || m[1] === "X";
+        const text = m[2].trim();
+        const meta = extractCommitmentMeta(text);
+        // Alias label → kind-appropriate role field. Keep label too for
+        // legacy consumers; UIs already reading {label} get no change.
+        if (meta.label) {
+          if (kind === "commitments") meta.to = meta.to || meta.label;
+          else if (kind === "waitingFor" || kind === "backlog") meta.from = meta.from || meta.label;
+        }
+        // For waitingFor, the UI uses .expected (not .due). Alias.
+        if (kind === "waitingFor" && meta.due) meta.expected = meta.expected || meta.due;
+        items.push({
+          checked,
+          done: checked,
+          text,
+          raw: line.trim(),
+          ...meta,
+        });
+      } else {
+        items.push({ checked: null, done: null, text: m[1].trim(), raw: line.trim() });
+      }
+    }
+  }
+  return items;
+}
+
+// A1 fix supplement: pull party/date/added from free-form commitment prose
+// so the PromiseWall row layout has real data to render instead of `—` and
+// `0d open`. Conservative — only emit fields when a pattern matches.
+function extractCommitmentMeta(text) {
+  const meta = {};
+  // Date added → "[Added: 2026-05-15]" or "[Added: 2026-05-15T20:05]"
+  const addedM = text.match(/\[Added:\s*([\d\-T:]{8,20})\]/i);
+  if (addedM) meta.added = addedM[1];
+  // Due date → "due May 28", "due 2026-05-28", "by Thursday May 1"
+  const dueIso = text.match(/\b(?:due|by)\s+(20\d{2}-[01]\d-[0-3]\d)\b/i);
+  const dueLoose = text.match(/\b(?:due|by)\s+([A-Z][a-z]+\s+\d{1,2})(?:[,\s]+(20\d{2}))?/);
+  if (dueIso) meta.due = dueIso[1];
+  else if (dueLoose) meta.due = dueLoose[2] ? `${dueLoose[1]} ${dueLoose[2]}` : dueLoose[1];
+  // Bold-quoted label → "**Thing name** — rest of description". Tolerate a
+  // leading 💀/emoji + whitespace (graveyard entries lead with a skull) before
+  // the bold label so `label` populates for graveyard rows too (v6 W1-S2).
+  const labelText = text.replace(/^[\s\u{1F000}-\u{1FAFF}☀-➿←-⇿️]+/u, "");
+  const labelM = labelText.match(/^\*\*([^*]+)\*\*/);
+  if (labelM) meta.label = labelM[1].trim();
+  return meta;
+}
+
+module.exports = { parseActiveContext };

package/src/dashboard/lib/agent-command.js

@@ -0,0 +1,93 @@
+// agent-command.js — one-shot agent argv assembly for /api/workflow/run and
+// /api/agent/run (extracted from server.js so the provider matrix is pure and
+// unit-testable; the RunRegistry spawn stays a passthrough).
+//
+// #112 provider/model/effort control. Every flag below was probed against the
+// binaries installed on this machine on 2026-07-02 (`claude --help`,
+// `codex exec --help`, `gemini --help`), not recalled from training data:
+//   claude  --model <m>  --effort <low|medium|high|xhigh|max>
+//   codex   -m <m>       -c model_reasoning_effort="<v>"   (TOML override)
+//   gemini  -m <m>       --approval-mode <default|auto_edit|yolo|plan>, no effort
+// Gemini's old hardcoded --yolo becomes a visible approval-mode choice; yolo
+// stays the default because a headless run cannot answer approval prompts.
+
+const EFFORTS = {
+  "claude-code": ["low", "medium", "high", "xhigh", "max"],
+  codex: ["low", "medium", "high", "xhigh"],
+  gemini: [],
+};
+
+const GEMINI_APPROVAL = ["default", "auto_edit", "yolo", "plan"];
+
+const ALIASES = {
+  "gemini-cli": "gemini",
+  "claude": "claude-code",
+  "codex-cli": "codex",
+};
+
+// These strings land in spawn argv. Model ids look like "claude-fable-5",
+// "o3", "gemini-2.5-pro"; anything that could read as a flag (leading dash),
+// carry spaces, or smuggle shell metacharacters is rejected, not escaped.
+function cleanToken(v, max) {
+  const s = String(v == null ? "" : v).trim();
+  if (!s || s.length > (max || 64)) return null;
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(s)) return null;
+  return s;
+}
+
+function agentCommand(agent, opts) {
+  const o = opts || {};
+  const model = cleanToken(o.model, 64);
+  const effort = cleanToken(o.effort, 12);
+  const map = {
+    "claude-code": {
+      cmd: "claude",
+      stdin: false,
+      args(prompt) {
+        const a = [];
+        if (model) a.push("--model", model);
+        if (effort && EFFORTS["claude-code"].includes(effort)) a.push("--effort", effort);
+        a.push("-p", prompt);
+        return a;
+      },
+    },
+    codex: {
+      cmd: "codex",
+      stdin: true,
+      args() {
+        const a = ["exec", "--skip-git-repo-check", "--ephemeral"];
+        if (model) a.push("-m", model);
+        // value is parsed as TOML by codex; the embedded quotes make it an
+        // unambiguous string (same shape as ~/.codex/config.toml uses).
+        if (effort && EFFORTS.codex.includes(effort)) a.push("-c", 'model_reasoning_effort="' + effort + '"');
+        a.push("-");
+        return a;
+      },
+    },
+    gemini: {
+      cmd: "gemini",
+      stdin: false,
+      args(prompt) {
+        const a = [];
+        if (model) a.push("-m", model);
+        const mode = GEMINI_APPROVAL.includes(o.approvalMode) ? o.approvalMode : "yolo";
+        a.push("--approval-mode", mode);
+        a.push("-p", prompt);
+        return a;
+      },
+    },
+  };
+  const id = ALIASES[agent] || agent;
+  const entry = map[id] || null;
+  if (!entry) return null;
+  // surfaced so the run preamble can echo exactly what launched
+  entry.applied = {
+    agent: id,
+    model: model || null,
+    effort: entry === map.gemini ? null : (effort && EFFORTS[id].includes(effort) ? effort : null),
+    approvalMode: id === "gemini" ? (GEMINI_APPROVAL.includes(o.approvalMode) ? o.approvalMode : "yolo") : null,
+  };
+  return entry;
+}
+
+module.exports = { agentCommand, cleanToken, EFFORTS, GEMINI_APPROVAL, ALIASES };