mstro-app 0.4.20 → 0.4.22

package/dist/server/services/deploy/headless-session-handler.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Headless Session Handler
+ *
+ * Handles headless Claude Code session requests from a developer's backend
+ * on behalf of end users. Each session is isolated — no shared context
+ * between end users.
+ *
+ * Security: End-user prompts are untrusted input. They are always passed as
+ * user messages, never injected into system prompts or tool parameters.
+ * The Security Bouncer governs tool access within each session.
+ */
+import type { ToolUseEvent } from '../../cli/headless/types.js';
+import { type DeployExecutionResult } from './deploy-ai-service.js';
+export interface HeadlessSessionRequest {
+    /** The end user's prompt (untrusted input) */
+    prompt: string;
+    /** Override the deployment's default system prompt */
+    systemPrompt?: string;
+    /** Restrict which tools Claude can use in this session */
+    allowedTools?: string[];
+    /** Override the deployment's default model */
+    model?: string;
+    /** Unique identifier for the end user (for isolation + rate tracking) */
+    endUserId: string;
+}
+export interface DeploymentAiConfig {
+    deploymentId: string;
+    aiEnabled: boolean;
+    allowedAiCapabilities: string[];
+    maxTokensPerRequest: number | null;
+    maxRequestsPerMinute: number | null;
+    maxConcurrentSessions: number;
+    defaultSystemPrompt: string | null;
+    defaultModel: string;
+    workingDir: string;
+}
+export type HeadlessSessionErrorCode = 'CAPABILITY_DENIED' | 'AI_DISABLED' | 'RATE_LIMIT_EXCEEDED' | 'CONCURRENT_LIMIT_EXCEEDED' | 'INVALID_REQUEST' | 'EXECUTION_FAILED';
+export interface HeadlessSessionError {
+    code: HeadlessSessionErrorCode;
+    message: string;
+}
+export interface HeadlessSessionStreamCallbacks {
+    onOutput?: (text: string) => void;
+    onThinking?: (text: string) => void;
+    onToolUse?: (event: ToolUseEvent) => void;
+    onUsageReport?: (report: UsageReportData) => void;
+    onHealthUpdate?: (update: HealthUpdateData) => void;
+}
+export interface UsageReportData {
+    deploymentId: string;
+    endUserId: string;
+    capability: 'headless' | 'pm-board';
+    tokensUsed: number;
+    model: string;
+    durationMs: number;
+    boardId?: string;
+}
+export interface HealthUpdateData {
+    deploymentId: string;
+    status: 'healthy' | 'invalid_key' | 'no_credits' | 'rate_limited' | 'unknown_error';
+    message: string;
+    aiDisabled: boolean;
+}
+export type HeadlessSessionResult = {
+    ok: true;
+    result: DeployExecutionResult;
+} | {
+    ok: false;
+    error: HeadlessSessionError;
+};
+/**
+ * Handle a headless session request for an end user.
+ *
+ * Validates the deployment config, checks rate limits, composes the prompt
+ * with the system instruction, and launches an isolated headless session
+ * via DeployAiService. Streams results back through the provided callbacks.
+ *
+ * @returns Structured result with either the execution result or an error.
+ */
+export declare function handleHeadlessSession(request: HeadlessSessionRequest, config: DeploymentAiConfig, callbacks?: HeadlessSessionStreamCallbacks): Promise<HeadlessSessionResult>;
+/**
+ * Get the current rate limit state for a deployment.
+ * Useful for status/monitoring endpoints.
+ */
+export declare function getDeploymentRateLimitState(deploymentId: string): {
+    requestsInLastMinute: number;
+    activeSessions: number;
+};
+/**
+ * Reset rate limit state for a deployment. Call when a deployment
+ * is deleted or all its sessions are force-stopped.
+ */
+export declare function resetDeploymentRateLimit(deploymentId: string): void;
+//# sourceMappingURL=headless-session-handler.d.ts.map

package/dist/server/services/deploy/headless-session-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-session-handler.d.ts","sourceRoot":"","sources":["../../../../server/services/deploy/headless-session-handler.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAIrF,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC,mBAAmB,GACnB,aAAa,GACb,qBAAqB,GACrB,2BAA2B,GAC3B,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,CAAC;IAClD,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,cAAc,GAAG,eAAe,CAAC;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AA4F/C;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,kBAAkB,EAC1B,SAAS,CAAC,EAAE,8BAA8B,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAwIhC;AAkED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG;IACjE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;CACxB,CAOA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAEnE"}

package/dist/server/services/deploy/headless-session-handler.js

@@ -0,0 +1,274 @@
+// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
+// Licensed under the MIT License. See LICENSE file for details.
+import { DeployAiService } from './deploy-ai-service.js';
+const rateBuckets = new Map();
+function getBucket(deploymentId) {
+    let bucket = rateBuckets.get(deploymentId);
+    if (!bucket) {
+        bucket = { timestamps: [], activeSessions: 0 };
+        rateBuckets.set(deploymentId, bucket);
+    }
+    return bucket;
+}
+function pruneTimestamps(bucket) {
+    const oneMinuteAgo = Date.now() - 60_000;
+    // Remove timestamps older than 1 minute
+    while (bucket.timestamps.length > 0 && bucket.timestamps[0] < oneMinuteAgo) {
+        bucket.timestamps.shift();
+    }
+}
+function checkRateLimit(config) {
+    const bucket = getBucket(config.deploymentId);
+    // Check concurrent sessions
+    if (bucket.activeSessions >= config.maxConcurrentSessions) {
+        return {
+            code: 'CONCURRENT_LIMIT_EXCEEDED',
+            message: `Deployment has reached the maximum of ${config.maxConcurrentSessions} concurrent sessions. Wait for an existing session to complete.`,
+        };
+    }
+    // Check requests per minute
+    if (config.maxRequestsPerMinute !== null) {
+        pruneTimestamps(bucket);
+        if (bucket.timestamps.length >= config.maxRequestsPerMinute) {
+            return {
+                code: 'RATE_LIMIT_EXCEEDED',
+                message: `Deployment has exceeded the rate limit of ${config.maxRequestsPerMinute} requests per minute. Try again shortly.`,
+            };
+        }
+    }
+    return null;
+}
+function recordRequestStart(deploymentId) {
+    const bucket = getBucket(deploymentId);
+    bucket.timestamps.push(Date.now());
+    bucket.activeSessions++;
+}
+function recordRequestEnd(deploymentId) {
+    const bucket = getBucket(deploymentId);
+    bucket.activeSessions = Math.max(0, bucket.activeSessions - 1);
+}
+// ========== Prompt Composition ==========
+/**
+ * Compose the final prompt sent to Claude. The system prompt (from deployment
+ * config or per-request override) is prepended as a system instruction block.
+ * The end-user prompt follows as a clearly delimited user message.
+ *
+ * SECURITY: The end-user prompt is always in the user-message section,
+ * never interpolated into the system instruction.
+ */
+function composePrompt(systemPrompt, userPrompt) {
+    if (!systemPrompt) {
+        return userPrompt;
+    }
+    return [
+        '<system-instruction>',
+        systemPrompt,
+        '</system-instruction>',
+        '',
+        userPrompt,
+    ].join('\n');
+}
+// ========== Handler ==========
+/**
+ * Handle a headless session request for an end user.
+ *
+ * Validates the deployment config, checks rate limits, composes the prompt
+ * with the system instruction, and launches an isolated headless session
+ * via DeployAiService. Streams results back through the provided callbacks.
+ *
+ * @returns Structured result with either the execution result or an error.
+ */
+export async function handleHeadlessSession(request, config, callbacks) {
+    // ── Validate request ───────────────────────────────────────
+    if (!request.prompt || request.prompt.trim().length === 0) {
+        return {
+            ok: false,
+            error: { code: 'INVALID_REQUEST', message: 'prompt is required and must not be empty.' },
+        };
+    }
+    if (!request.endUserId || request.endUserId.trim().length === 0) {
+        return {
+            ok: false,
+            error: { code: 'INVALID_REQUEST', message: 'endUserId is required.' },
+        };
+    }
+    // ── Validate AI is enabled ─────────────────────────────────
+    if (!config.aiEnabled) {
+        return {
+            ok: false,
+            error: { code: 'AI_DISABLED', message: 'AI features are not enabled for this deployment.' },
+        };
+    }
+    // ── Validate headless capability ───────────────────────────
+    if (!config.allowedAiCapabilities.includes('headless')) {
+        return {
+            ok: false,
+            error: {
+                code: 'CAPABILITY_DENIED',
+                message: "This deployment does not have the 'headless' AI capability enabled.",
+            },
+        };
+    }
+    // ── Rate limit checks ─────────────────────────────────────
+    const rateLimitError = checkRateLimit(config);
+    if (rateLimitError) {
+        return { ok: false, error: rateLimitError };
+    }
+    // ── Token limit pre-check ─────────────────────────────────
+    // Estimate input tokens from prompt length (~4 chars per token).
+    // Reject if estimated input alone exceeds the cap.
+    if (config.maxTokensPerRequest !== null) {
+        const estimatedInputTokens = Math.ceil(request.prompt.length / 4);
+        if (estimatedInputTokens > config.maxTokensPerRequest) {
+            return {
+                ok: false,
+                error: {
+                    code: 'RATE_LIMIT_EXCEEDED',
+                    message: `Estimated input tokens (${estimatedInputTokens}) exceeds maxTokensPerRequest (${config.maxTokensPerRequest}). Shorten your prompt.`,
+                },
+            };
+        }
+    }
+    // ── Compose prompt ─────────────────────────────────────────
+    // Use per-request system prompt if provided, otherwise deployment default
+    const effectiveSystemPrompt = request.systemPrompt ?? config.defaultSystemPrompt;
+    const composedPrompt = composePrompt(effectiveSystemPrompt, request.prompt);
+    // Use per-request model if provided, otherwise deployment default
+    const effectiveModel = request.model ?? config.defaultModel;
+    // ── Launch isolated session ────────────────────────────────
+    const service = DeployAiService.getInstance();
+    recordRequestStart(config.deploymentId);
+    try {
+        const result = await service.execute({
+            deploymentId: config.deploymentId,
+            prompt: composedPrompt,
+            workingDir: config.workingDir,
+            model: effectiveModel,
+            outputCallback: callbacks?.onOutput,
+            thinkingCallback: callbacks?.onThinking,
+            toolUseCallback: callbacks?.onToolUse,
+            // allowedTools from request are inverted: any tool NOT in the list is disallowed.
+            // If allowedTools is not specified, no additional restrictions are applied
+            // (Security Bouncer still governs tool access).
+            disallowedTools: request.allowedTools
+                ? invertAllowedTools(request.allowedTools)
+                : undefined,
+        });
+        // Check token limit if configured
+        if (config.maxTokensPerRequest !== null &&
+            result.totalTokens > config.maxTokensPerRequest) {
+            // Session already ran — log but don't fail the response.
+            // The token overage is informational; the developer can use this
+            // for billing or to tighten limits.
+        }
+        // Emit usage report after successful execution
+        callbacks?.onUsageReport?.({
+            deploymentId: config.deploymentId,
+            endUserId: request.endUserId,
+            capability: 'headless',
+            tokensUsed: result.totalTokens,
+            model: effectiveModel,
+            durationMs: result.durationMs,
+        });
+        // Check for API key health issues from execution result
+        const healthStatus = detectAiHealthIssue(result.error);
+        if (healthStatus) {
+            callbacks?.onHealthUpdate?.({
+                deploymentId: config.deploymentId,
+                ...healthStatus,
+            });
+        }
+        return { ok: true, result };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        // Check for API key health issues from caught errors
+        const healthStatus = detectAiHealthIssue(message);
+        if (healthStatus) {
+            callbacks?.onHealthUpdate?.({
+                deploymentId: config.deploymentId,
+                ...healthStatus,
+            });
+        }
+        return {
+            ok: false,
+            error: { code: 'EXECUTION_FAILED', message },
+        };
+    }
+    finally {
+        recordRequestEnd(config.deploymentId);
+    }
+}
+// ========== Health Detection ==========
+/**
+ * Detect API key health issues from error messages returned by Claude Code.
+ *
+ * Anthropic API errors that indicate credential/billing problems:
+ * - 401: Invalid API key
+ * - 402/insufficient_funds: Account has no credits
+ * - 429: Rate limited by Anthropic
+ */
+function detectAiHealthIssue(errorMessage) {
+    if (!errorMessage)
+        return null;
+    const lower = errorMessage.toLowerCase();
+    if (lower.includes('invalid api key') || lower.includes('invalid x-api-key') || lower.includes('authentication_error')) {
+        return { status: 'invalid_key', message: 'Anthropic API key is invalid or revoked.', aiDisabled: true };
+    }
+    if (lower.includes('insufficient_funds') || lower.includes('no credits') || lower.includes('billing') || lower.includes('credit balance')) {
+        return { status: 'no_credits', message: 'Anthropic account has insufficient credits.', aiDisabled: true };
+    }
+    if (lower.includes('rate_limit') || lower.includes('rate limit') || lower.includes('too many requests')) {
+        return { status: 'rate_limited', message: 'Anthropic API rate limit exceeded.', aiDisabled: false };
+    }
+    return null;
+}
+// ========== Helpers ==========
+/**
+ * The DeployAiService accepts `disallowedTools` (blocklist), but the
+ * headless session API exposes `allowedTools` (allowlist) for a better
+ * developer UX. This converts an allowlist into a blocklist by marking
+ * everything outside the allowlist as disallowed.
+ *
+ * We use a known set of standard Claude Code tool names. Tools not in
+ * the known set are left unrestricted (the Security Bouncer handles them).
+ */
+const KNOWN_TOOLS = [
+    'Read',
+    'Write',
+    'Edit',
+    'MultiEdit',
+    'Bash',
+    'Glob',
+    'Grep',
+    'WebFetch',
+    'WebSearch',
+    'TodoRead',
+    'TodoWrite',
+    'NotebookEdit',
+    'Agent',
+];
+function invertAllowedTools(allowedTools) {
+    const allowed = new Set(allowedTools);
+    return KNOWN_TOOLS.filter((tool) => !allowed.has(tool));
+}
+/**
+ * Get the current rate limit state for a deployment.
+ * Useful for status/monitoring endpoints.
+ */
+export function getDeploymentRateLimitState(deploymentId) {
+    const bucket = getBucket(deploymentId);
+    pruneTimestamps(bucket);
+    return {
+        requestsInLastMinute: bucket.timestamps.length,
+        activeSessions: bucket.activeSessions,
+    };
+}
+/**
+ * Reset rate limit state for a deployment. Call when a deployment
+ * is deleted or all its sessions are force-stopped.
+ */
+export function resetDeploymentRateLimit(deploymentId) {
+    rateBuckets.delete(deploymentId);
+}
+//# sourceMappingURL=headless-session-handler.js.map

package/dist/server/services/deploy/headless-session-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-session-handler.js","sourceRoot":"","sources":["../../../../server/services/deploy/headless-session-handler.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAehE,OAAO,EAAE,eAAe,EAA8B,MAAM,wBAAwB,CAAC;AA8ErF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;AAElD,SAAS,SAAS,CAAC,YAAoB;IACrC,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QAC/C,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACzC,wCAAwC;IACxC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,CAAC;QAC3E,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAA0B;IAE1B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE9C,4BAA4B;IAC5B,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,yCAAyC,MAAM,CAAC,qBAAqB,iEAAiE;SAChJ,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACzC,eAAe,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,6CAA6C,MAAM,CAAC,oBAAoB,0CAA0C;aAC5H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,cAAc,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,2CAA2C;AAE3C;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,YAA2B,EAAE,UAAkB;IACpE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,sBAAsB;QACtB,YAAY;QACZ,uBAAuB;QACvB,EAAE;QACF,UAAU;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,gCAAgC;AAEhC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA+B,EAC/B,MAA0B,EAC1B,SAA0C;IAE1C,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,2CAA2C,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE;SACtE,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kDAAkD,EAAE;SAC5F,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,qEAAqE;aAC/E;SACF,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,6DAA6D;IAC7D,iEAAiE;IACjE,mDAAmD;IACnD,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,2BAA2B,oBAAoB,kCAAkC,MAAM,CAAC,mBAAmB,yBAAyB;iBAC9I;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,0EAA0E;IAC1E,MAAM,qBAAqB,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,mBAAmB,CAAC;IACjF,MAAM,cAAc,GAAG,aAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5E,kEAAkE;IAClE,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC;IAE5D,8DAA8D;IAC9D,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;IAE9C,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,cAAc;YACrB,cAAc,EAAE,SAAS,EAAE,QAAQ;YACnC,gBAAgB,EAAE,SAAS,EAAE,UAAU;YACvC,eAAe,EAAE,SAAS,EAAE,SAAS;YACrC,kFAAkF;YAClF,2EAA2E;YAC3E,gDAAgD;YAChD,eAAe,EAAE,OAAO,CAAC,YAAY;gBACnC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC;gBAC1C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,kCAAkC;QAClC,IACE,MAAM,CAAC,mBAAmB,KAAK,IAAI;YACnC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,mBAAmB,EAC/C,CAAC;YACD,yDAAyD;YACzD,iEAAiE;YACjE,oCAAoC;QACtC,CAAC;QAED,+CAA+C;QAC/C,SAAS,EAAE,aAAa,EAAE,CAAC;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QAEH,wDAAwD;QACxD,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,EAAE,cAAc,EAAE,CAAC;gBAC1B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,YAAY;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,qDAAqD;QACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,EAAE,cAAc,EAAE,CAAC;gBAC1B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,YAAY;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE;SAC7C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,yCAAyC;AAEzC;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,YAAgC;IAEhC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1G,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1I,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,6CAA6C,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC5G,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxG,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACtG,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gCAAgC;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG;IAClB,MAAM;IACN,OAAO;IACP,MAAM;IACN,WAAW;IACX,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,WAAW;IACX,UAAU;IACV,WAAW;IACX,cAAc;IACd,OAAO;CACC,CAAC;AAEX,SAAS,kBAAkB,CAAC,YAAsB;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,YAAoB;IAI9D,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO;QACL,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;QAC9C,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACnC,CAAC"}

package/dist/server/services/pathUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pathUtils.d.ts","sourceRoot":"","sources":["../../../server/services/pathUtils.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,oBAAoB,CAoDtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB;IACD,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CA0BA;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAS/D"}
+{"version":3,"file":"pathUtils.d.ts","sourceRoot":"","sources":["../../../server/services/pathUtils.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,oBAAoB,CAqFtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB;IACD,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CA0BA;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAS/D"}

package/dist/server/services/pathUtils.js

@@ -6,7 +6,8 @@
  * Secure path validation utilities to prevent path traversal attacks.
  * All file explorer operations MUST validate paths through these functions.
  */
-import { isAbsolute, normalize, relative, resolve } from 'node:path';
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
+import { dirname, isAbsolute, normalize, relative, resolve } from 'node:path';
 /**
  * Validate that a path is within the allowed working directory.
  * Prevents path traversal attacks using .. or absolute paths.
@@ -29,6 +30,37 @@ export function validatePathWithinWorkingDir(targetPath, workingDir) {
         }
         // Normalize to remove any .. or . segments
         resolvedPath = normalize(resolvedPath);
+        // Resolve symlinks to prevent symlink-based path traversal.
+        // A symlink at /project/link -> /etc/passwd would pass the string
+        // check below but actually read outside the working directory.
+        // For existing paths: resolve the full path via realpath.
+        // For new paths (create operations): resolve the parent directory.
+        if (existsSync(resolvedPath)) {
+            // If the path itself is a symlink, resolve it to the real target
+            const stat = lstatSync(resolvedPath);
+            if (stat.isSymbolicLink()) {
+                resolvedPath = realpathSync(resolvedPath);
+            }
+        }
+        else {
+            // Path doesn't exist yet (create operation) — validate the parent
+            const parentDir = dirname(resolvedPath);
+            if (existsSync(parentDir)) {
+                const realParent = realpathSync(parentDir);
+                const parentWithSep = normalizedWorkingDir.endsWith('/')
+                    ? normalizedWorkingDir
+                    : `${normalizedWorkingDir}/`;
+                if (realParent !== normalizedWorkingDir && !realParent.startsWith(parentWithSep)) {
+                    console.error(`[PathUtils] SECURITY: Symlink traversal in parent directory blocked. ` +
+                        `Target: "${targetPath}", RealParent: "${realParent}", WorkingDir: "${normalizedWorkingDir}"`);
+                    return {
+                        valid: false,
+                        resolvedPath: '',
+                        error: 'Access denied: parent directory resolves outside working directory'
+                    };
+                }
+            }
+        }
         // Check if the resolved path starts with the working directory
         // Add trailing separator to prevent partial matches (e.g., /home/user vs /home/username)
         const workingDirWithSep = normalizedWorkingDir.endsWith('/')

package/dist/server/services/pathUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"pathUtils.js","sourceRoot":"","sources":["../../../server/services/pathUtils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQrE;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,UAAkB;IAElB,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAEjD,wDAAwD;QACxD,IAAI,YAAoB,CAAC;QACzB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QAED,2CAA2C;QAC3C,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAEvC,+DAA+D;QAC/D,yFAAyF;QACzF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,GAAG,oBAAoB,GAAG,CAAC;QAE/B,MAAM,kBAAkB,GACtB,YAAY,KAAK,oBAAoB;YACrC,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAE7C,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,wCAAwC;YACxC,OAAO,CAAC,KAAK,CACX,wDAAwD;gBACxD,YAAY,UAAU,iBAAiB,YAAY,mBAAmB,oBAAoB,GAAG,CAC9F,CAAC;YAEF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,EAAE;gBAChB,KAAK,EAAE,kDAAkD;aAC1D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,YAAY;SACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAAkB,EAClB,QAAgB,EAChB,UAAkB;IAOlB,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,EAAE;YACpB,KAAK,EAAE,sBAAsB,gBAAgB,CAAC,KAAK,EAAE;SACtD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,EAAE;YACpB,KAAK,EAAE,2BAA2B,cAAc,CAAC,KAAK,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;QACjD,gBAAgB,EAAE,cAAc,CAAC,YAAY;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,UAAkB;IACtE,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,iBAAiB,GAAG;QACxB,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,uDAAuD;QAC7D,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"pathUtils.js","sourceRoot":"","sources":["../../../server/services/pathUtils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQ9E;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,UAAkB;IAElB,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAEjD,wDAAwD;QACxD,IAAI,YAAoB,CAAC;QACzB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QAED,2CAA2C;QAC3C,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAEvC,4DAA4D;QAC5D,kEAAkE;QAClE,+DAA+D;QAC/D,0DAA0D;QAC1D,mEAAmE;QACnE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,iEAAiE;YACjE,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1B,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC3C,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACtD,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,GAAG,oBAAoB,GAAG,CAAC;gBAC/B,IAAI,UAAU,KAAK,oBAAoB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjF,OAAO,CAAC,KAAK,CACX,uEAAuE;wBACvE,YAAY,UAAU,mBAAmB,UAAU,mBAAmB,oBAAoB,GAAG,CAC9F,CAAC;oBACF,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,YAAY,EAAE,EAAE;wBAChB,KAAK,EAAE,oEAAoE;qBAC5E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,yFAAyF;QACzF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,GAAG,oBAAoB,GAAG,CAAC;QAE/B,MAAM,kBAAkB,GACtB,YAAY,KAAK,oBAAoB;YACrC,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAE7C,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,wCAAwC;YACxC,OAAO,CAAC,KAAK,CACX,wDAAwD;gBACxD,YAAY,UAAU,iBAAiB,YAAY,mBAAmB,oBAAoB,GAAG,CAC9F,CAAC;YAEF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,EAAE;gBAChB,KAAK,EAAE,kDAAkD;aAC1D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,YAAY;SACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAAkB,EAClB,QAAgB,EAChB,UAAkB;IAOlB,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,EAAE;YACpB,KAAK,EAAE,sBAAsB,gBAAgB,CAAC,KAAK,EAAE;SACtD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,EAAE;YACpB,KAAK,EAAE,2BAA2B,cAAc,CAAC,KAAK,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;QACjD,gBAAgB,EAAE,cAAc,CAAC,YAAY;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,UAAkB;IACtE,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,iBAAiB,GAAG;QACxB,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,uDAAuD;QAC7D,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/server/services/plan/agent-loader.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Load an agent prompt by name with layered resolution.
+ *
+ * @param agentName - The agent file name without extension (e.g., "review-code")
+ * @param variables - Key-value map for {{variable}} substitution
+ * @param boardDir  - Optional board directory for board-level overrides
+ * @returns The interpolated prompt string, or null if no agent file found
+ */
+export declare function loadAgentPrompt(agentName: string, variables: Record<string, string>, boardDir?: string | null): string | null;
+//# sourceMappingURL=agent-loader.d.ts.map

package/dist/server/services/plan/agent-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loader.d.ts","sourceRoot":"","sources":["../../../../server/services/plan/agent-loader.ts"],"names":[],"mappings":"AAoCA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,GAAG,IAAI,CAwBf"}

package/dist/server/services/plan/agent-loader.js

@@ -0,0 +1,65 @@
+// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
+// Licensed under the MIT License. See LICENSE file for details.
+/**
+ * Agent Prompt Loader — loads review agent prompts from markdown files.
+ *
+ * Resolution order (first match wins):
+ *   1. Board-level override:  {boardDir}/agents/{agentName}.md
+ *   2. System default:        cli/server/services/plan/agents/{agentName}.md
+ *
+ * Files use YAML frontmatter + markdown body with {{variable}} placeholders.
+ * Falls back to null when no file is found (caller should use hardcoded fallback).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SYSTEM_AGENTS_DIR = join(__dirname, 'agents');
+/** Strip YAML frontmatter (--- ... ---) from markdown, returning just the body. */
+function stripFrontmatter(content) {
+    if (!content.startsWith('---'))
+        return content;
+    const endIdx = content.indexOf('---', 3);
+    if (endIdx === -1)
+        return content;
+    return content.slice(endIdx + 3).trimStart();
+}
+/** Replace all {{variable}} placeholders with values from the provided map. */
+function interpolate(template, variables) {
+    return template.replace(/\{\{(\w+)\}\}/g, (match, key) => {
+        return key in variables ? variables[key] : match;
+    });
+}
+/**
+ * Load an agent prompt by name with layered resolution.
+ *
+ * @param agentName - The agent file name without extension (e.g., "review-code")
+ * @param variables - Key-value map for {{variable}} substitution
+ * @param boardDir  - Optional board directory for board-level overrides
+ * @returns The interpolated prompt string, or null if no agent file found
+ */
+export function loadAgentPrompt(agentName, variables, boardDir) {
+    const fileName = `${agentName}.md`;
+    // 1. Board-level override
+    if (boardDir) {
+        const boardAgentPath = join(boardDir, 'agents', fileName);
+        if (existsSync(boardAgentPath)) {
+            try {
+                const raw = readFileSync(boardAgentPath, 'utf-8');
+                return interpolate(stripFrontmatter(raw), variables);
+            }
+            catch { /* fall through to system default */ }
+        }
+    }
+    // 2. System default
+    const systemPath = join(SYSTEM_AGENTS_DIR, fileName);
+    if (existsSync(systemPath)) {
+        try {
+            const raw = readFileSync(systemPath, 'utf-8');
+            return interpolate(stripFrontmatter(raw), variables);
+        }
+        catch { /* return null */ }
+    }
+    return null;
+}
+//# sourceMappingURL=agent-loader.js.map

package/dist/server/services/plan/agent-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loader.js","sourceRoot":"","sources":["../../../../server/services/plan/agent-loader.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEpD,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,QAAgB,EAAE,SAAiC;IACtE,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC/D,OAAO,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,SAAiC,EACjC,QAAwB;IAExB,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAC;IAEnC,0BAA0B;IAC1B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBAClD,OAAO,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/services/plan/composer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../../../../server/services/plan/composer.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA6GvD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Kf"}
+{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../../../../server/services/plan/composer.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA6GvD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAgLf"}

package/dist/server/services/plan/composer.js

@@ -4,7 +4,7 @@
  * Plan Composer — Handles natural language prompts for PPS creation/editing.
  *
  * When a planPrompt message arrives, this builds a context-enriched prompt
- * against the .pm/ (or legacy .plan/) directory and spawns a scoped
+ * against the .mstro/pm/ directory and spawns a scoped
  * HeadlessRunner session to execute it.
  */
 import { existsSync, readFileSync } from 'node:fs';
@@ -214,6 +214,10 @@ User request: ${userPrompt}`;
         const runner = new HeadlessRunner({
             workingDir,
             directPrompt: enrichedPrompt,
+            stallWarningMs: 300_000, // 5 min — compose usually finishes quickly
+            stallKillMs: 900_000, // 15 min
+            stallHardCapMs: 1_800_000, // 30 min hard cap
+            verbose: true,
             outputCallback: (text) => {
                 ctx.send(ws, {
                     type: 'planPromptStreaming',

package/dist/server/services/plan/composer.js.map

@@ -1 +1 @@
-{"version":3,"file":"composer.js","sourceRoot":"","sources":["../../../../server/services/plan/composer.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAqB,MAAM,6BAA6B,CAAC;AAGhF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7G,MAAM,oBAAoB,GAA2B;IACnD,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,2BAA2B;IAClC,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,qBAAqB;CAC5B,CAAC;AAEF,SAAS,4BAA4B,CAAC,KAAmB;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjD,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,OAAO,CAAC,KAAmB,EAAiB,EAAE;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,OAAO,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;YAAE,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD,SAAS,oBAAoB,CAAC,KAAa,EAAE,UAAkB,EAAE,OAAgB;IAC/E,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,OAAO,IAAI,SAAS,EAAE,SAAS,EAAE,aAAa,IAAI,IAAI,CAAC;IAEhF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,MAAM,GAAY,EAAE,CAAC;IAEzB,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC;YACpF,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YAC3B,YAAY,GAAG,mBAAmB,gBAAgB,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK;gBACrE,UAAU,CAAC,KAAK,CAAC,MAAM;cACzB,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,YAAY;mBAChC,KAAK,WAAW,gBAAgB;qBAC9B,KAAK,WAAW,gBAAgB,aAAa,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY;QAAE,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS;QAAE,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAEhE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,uBAAuB,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;QAC1G,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;QAC1C,CAAC,CAAC,sBAAsB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAClI,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;QAC5C,CAAC,CAAC,qCAAqC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpI,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,gBAAgB;QAClC,CAAC,CAAC,GAAG,KAAK,WAAW,gBAAgB,WAAW;QAChD,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;IAExB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAC7H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAmB,EACnB,EAAa,EACb,UAAkB,EAClB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAE5D,MAAM,cAAc,GAAG;;EAEvB,EAAE,CAAC,YAAY;;EAEf,EAAE,CAAC,YAAY,IAAI,wBAAwB;;;;EAI3C,cAAc,IAAI,mBAAmB;;;EAGrC,EAAE,CAAC,MAAM;EACT,EAAE,CAAC,WAAW;EACd,EAAE,CAAC,aAAa;;;;;EAKhB,KAAK;;;;UAIG,EAAE,CAAC,gBAAgB,IAAI,WAAW;;;;;;;;;;;;;;6CAcC,EAAE,CAAC,WAAW;;;6DAGE,KAAK,IAAI,EAAE,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAwDnD,EAAE,CAAC,WAAW;;;;;;;;gBAQ5B,UAAU,EAAE,CAAC;IAE3B,IAAI,CAAC;QACH,GAAG,CAAC,cAAc,CAAC;YACjB,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE;SAClD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,UAAU;YACV,YAAY,EAAE,cAAc;YAC5B,cAAc,EAAE,CAAC,IAAY,EAAE,EAAE;gBAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;oBACX,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,eAAe,EAAE,CAAC,GAAG,EAAE;gBACrB,MAAM,kBAAkB,GAAG,2BAA2B,EAAE,CAAC;gBACzD,OAAO,CAAC,KAAmB,EAAE,EAAE;oBAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;oBAC1C,IAAI,OAAO,EAAE,CAAC;wBACZ,GAAG,CAAC,cAAc,CAAC;4BACjB,IAAI,EAAE,oBAAoB;4BAC1B,IAAI,EAAE,EAAE,OAAO,EAAE;yBAClB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE;SACL,CAAC,CAAC;QAEH,GAAG,CAAC,cAAc,CAAC;YACjB,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;SACxD,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;QAEtF,GAAG,CAAC,cAAc,CAAC;YACjB,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE;SAChD,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;YACX,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE;gBACJ,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC;gBAChG,OAAO,EAAE,MAAM,CAAC,SAAS;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;aAC5B;SACF,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;YACX,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"composer.js","sourceRoot":"","sources":["../../../../server/services/plan/composer.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAqB,MAAM,6BAA6B,CAAC;AAGhF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7G,MAAM,oBAAoB,GAA2B;IACnD,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,2BAA2B;IAClC,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,qBAAqB;CAC5B,CAAC;AAEF,SAAS,4BAA4B,CAAC,KAAmB;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjD,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,OAAO,CAAC,KAAmB,EAAiB,EAAE;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,OAAO,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;YAAE,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD,SAAS,oBAAoB,CAAC,KAAa,EAAE,UAAkB,EAAE,OAAgB;IAC/E,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,OAAO,IAAI,SAAS,EAAE,SAAS,EAAE,aAAa,IAAI,IAAI,CAAC;IAEhF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,MAAM,GAAY,EAAE,CAAC;IAEzB,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC;YACpF,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YAC3B,YAAY,GAAG,mBAAmB,gBAAgB,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK;gBACrE,UAAU,CAAC,KAAK,CAAC,MAAM;cACzB,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,YAAY;mBAChC,KAAK,WAAW,gBAAgB;qBAC9B,KAAK,WAAW,gBAAgB,aAAa,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY;QAAE,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS;QAAE,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAEhE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,uBAAuB,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;QAC1G,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;QAC1C,CAAC,CAAC,sBAAsB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAClI,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;QAC5C,CAAC,CAAC,qCAAqC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpI,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,gBAAgB;QAClC,CAAC,CAAC,GAAG,KAAK,WAAW,gBAAgB,WAAW;QAChD,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;IAExB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAC7H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAmB,EACnB,EAAa,EACb,UAAkB,EAClB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAE5D,MAAM,cAAc,GAAG;;EAEvB,EAAE,CAAC,YAAY;;EAEf,EAAE,CAAC,YAAY,IAAI,wBAAwB;;;;EAI3C,cAAc,IAAI,mBAAmB;;;EAGrC,EAAE,CAAC,MAAM;EACT,EAAE,CAAC,WAAW;EACd,EAAE,CAAC,aAAa;;;;;EAKhB,KAAK;;;;UAIG,EAAE,CAAC,gBAAgB,IAAI,WAAW;;;;;;;;;;;;;;6CAcC,EAAE,CAAC,WAAW;;;6DAGE,KAAK,IAAI,EAAE,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAwDnD,EAAE,CAAC,WAAW;;;;;;;;gBAQ5B,UAAU,EAAE,CAAC;IAE3B,IAAI,CAAC;QACH,GAAG,CAAC,cAAc,CAAC;YACjB,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE;SAClD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,UAAU;YACV,YAAY,EAAE,cAAc;YAC5B,cAAc,EAAE,OAAO,EAAI,2CAA2C;YACtE,WAAW,EAAE,OAAO,EAAO,SAAS;YACpC,cAAc,EAAE,SAAS,EAAE,kBAAkB;YAC7C,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,CAAC,IAAY,EAAE,EAAE;gBAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;oBACX,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,eAAe,EAAE,CAAC,GAAG,EAAE;gBACrB,MAAM,kBAAkB,GAAG,2BAA2B,EAAE,CAAC;gBACzD,OAAO,CAAC,KAAmB,EAAE,EAAE;oBAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;oBAC1C,IAAI,OAAO,EAAE,CAAC;wBACZ,GAAG,CAAC,cAAc,CAAC;4BACjB,IAAI,EAAE,oBAAoB;4BAC1B,IAAI,EAAE,EAAE,OAAO,EAAE;yBAClB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE;SACL,CAAC,CAAC;QAEH,GAAG,CAAC,cAAc,CAAC;YACjB,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;SACxD,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;QAEtF,GAAG,CAAC,cAAc,CAAC;YACjB,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE;SAChD,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;YACX,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE;gBACJ,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC;gBAChG,OAAO,EAAE,MAAM,CAAC,SAAS;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;aAC5B;SACF,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;YACX,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/server/services/plan/dependency-resolver.d.ts

@@ -14,7 +14,7 @@ export declare function detectCycles(issues: Issue[]): string[] | null;
  * Compute the set of issues that are ready to work on.
  * An issue is ready if:
  * - It's not an epic
- * - Its status is backlog or todo (not started, done, or cancelled)
+ * - Its status is todo (refined and ready for execution)
  * - All its blocked_by items are done or cancelled
  *
  * If epicScope is provided, only returns issues belonging to that epic.

package/dist/server/services/plan/dependency-resolver.js

@@ -59,7 +59,7 @@ function dfs(path, issueByPath, color, parent) {
  * Compute the set of issues that are ready to work on.
  * An issue is ready if:
  * - It's not an epic
- * - Its status is backlog or todo (not started, done, or cancelled)
+ * - Its status is todo (refined and ready for execution)
  * - All its blocked_by items are done or cancelled
  *
  * If epicScope is provided, only returns issues belonging to that epic.
@@ -69,7 +69,7 @@ export function resolveReadyToWork(issues, epicScope, sprintScope) {
     for (const issue of issues) {
         issueByPath.set(issue.path, issue);
     }
-    const readyStatuses = new Set(['backlog', 'todo']);
+    const readyStatuses = new Set(['todo']);
     const doneStatuses = new Set(['done', 'cancelled']);
     const priorityOrder = { P0: 0, P1: 1, P2: 2, P3: 3 };
     // Build set of child paths for epic scoping