mstro-app 0.5.0 → 0.5.1

package/server/cli/retry/retry-context-loss.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Context-loss detection: figures out when a run's output indicates the

package/server/cli/retry/retry-premature-completion.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Detects when a claimed-complete run is actually unfinished (hit
@@ -80,7 +79,7 @@ function applyPrematureCompletionRetry(
   });
 
   callbacks.queueOutput(
-    `\n${reason} — resuming session (retry ${state.retryNumber}/${maxRetries}).\n`
+    `\n\n${reason} — resuming session (retry ${state.retryNumber}/${maxRetries}).\n\n`
   );
   callbacks.flushOutputQueue();
 

package/server/cli/retry/retry-recovery-strategies.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Recovery strategies: context-loss (inter-movement / native-timeout),

package/server/cli/retry/retry-resume-strategy.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Picks how the next retry iteration should resume execution:

package/server/cli/retry/retry-runner-factory.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Factory for the HeadlessRunner used in a single retry iteration.

package/server/cli/retry/retry-tool-results.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Running buffer of tool results preserved across retries so recovery

package/server/cli/retry/retry-types.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Shared types used across the retry modules. Defined separately so each

package/server/index.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Mstro Server (Node.js + Hono)

package/server/mcp/bouncer-cli.ts

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Bouncer CLI — stdin/stdout wrapper for Claude Code PreToolUse hooks.

package/server/mcp/bouncer-haiku.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Bouncer Haiku — Haiku AI analysis subprocess for ambiguous operations.

package/server/mcp/bouncer-integration.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Bouncer Integration V2 - Prompt Injection Protection

package/server/mcp/security-analysis.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Security Analysis — Decision logic for routing operations through the bouncer.

package/server/mcp/security-audit.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Security Audit Logging System

package/server/mcp/security-patterns.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Security Patterns - Single Source of Truth

package/server/mcp/server.ts

@@ -1,6 +1,5 @@
 #!/usr/bin/env -S npx tsx
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * MCP Bouncer Server

package/server/routes/files.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * File Routes

package/server/routes/improvise.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Improvise History Routes

package/server/routes/index.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Routes Index

package/server/routes/instances.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Instance Management Routes

package/server/routes/notifications.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Notification Routes

package/server/server-setup.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Server Setup Utilities — Helpers for the main server entry point.

package/server/services/analytics.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * PostHog Analytics Service for mstro CLI

package/server/services/auth.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Authentication Service

package/server/services/client-id.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Client ID Service

package/server/services/file-explorer-ops.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * File Explorer Operations — CRUD for files/directories in the working directory.

package/server/services/files.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * File Service — Autocomplete and file scoring for the working directory.

package/server/services/instances.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Instance Registry Service

package/server/services/pathUtils.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Path Utilities

package/server/services/plan/agent-loader.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Agent Prompt Loader — loads review agent prompts from Skills and markdown files.

package/server/services/plan/agents/code-review.md

@@ -74,14 +74,19 @@ For each finding, use this reasoning process:
 
 ## Scoring Guidelines
 
-After your analysis, provide an honest overall quality score (0-100) and letter grade:
-- **A (90-100)**: Excellent — clean architecture, minimal issues, well-tested, follows best practices
-- **B (80-89)**: Good — solid code with minor issues, mostly well-structured
-- **C (70-79)**: Adequate — functional but has notable quality issues that should be addressed
-- **D (60-69)**: Below average — significant issues in architecture, testing, or code quality
-- **F (0-59)**: Poor — serious problems: security vulnerabilities, broken architecture, major bugs, or unmaintainable code
+The overall grade is computed deterministically from your findings, not from a number you supply. Severity and category on each finding are what drive the grade — pick them carefully.
 
-Consider ALL findings (both CLI tool findings and your own) when determining the score. The score should reflect the overall state of the codebase honestly. A project with 50+ linting errors, formatting issues, complex functions, AND architectural problems should NOT score above 70.
+Three independent dimension grades are computed:
+
+- **Security** (category: `security`) — uses a severity-threshold rule: A = 0 findings, B = only low, C = ≥1 medium, D = ≥1 high, F = ≥1 critical.
+- **Reliability** (categories: `bugs`, `logic`, `performance`) — severity-threshold rule, slightly more lenient: A = 0 findings or ≤1 low, B = ≥2 low or ≤2 medium, C = ≥3 medium or ≥1 high, D = ≥2 high, F = ≥1 critical.
+- **Maintainability** (categories: `architecture`, `oop`, `maintainability`) — density-based (issues per 1000 lines), with a severity escape hatch: any high finding caps at C, any critical caps at D.
+
+Overall grade = the worst of the three dimensions. A single critical security finding caps the entire codebase at F.
+
+This means **severity is load-bearing**: marking something `high` when it's really `low` will swing the grade unfairly. When in doubt, downgrade. A finding without clear evidence of harm is `low`.
+
+You may still emit `score`, `grade`, and `scoreRationale` for reference — they are persisted but ignored when computing the displayed grade. Focus your effort on accurate findings, not on guessing the overall number.
 
 ## Output
 
@@ -89,13 +94,10 @@ After your analysis, output EXACTLY one JSON code block with your findings. No o
 
 ```json
 {
-  "score": 72,
-  "grade": "C",
-  "scoreRationale": "Brief explanation of why this score was given, referencing key issues",
   "findings": [
     {
       "severity": "critical|high|medium|low",
-      "category": "architecture|oop|security|bugs|performance|logic",
+      "category": "architecture|oop|security|bugs|performance|logic|maintainability",
       "file": "relative/path/to/file.ts",
       "line": 42,
       "title": "Short title describing the issue",

package/server/services/plan/board-config.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Board configuration helpers: read board.md + workspace.json settings

package/server/services/plan/composer.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Plan Composer — Handles natural language prompts for PPS creation/editing.

package/server/services/plan/config-installer.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Config Installer — Manages temporary .claude/settings.json modifications

package/server/services/plan/dependency-resolver.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Dependency Resolver — Validates and computes the dependency DAG.

package/server/services/plan/executor.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Plan Executor — Wave-based execution with parallel headless Claude Code instances.
@@ -55,6 +54,40 @@ export type ExecutionStatus = 'idle' | 'starting' | 'executing' | 'paused' | 'st
 /** Stop after this many consecutive waves with zero completions. */
 const MAX_CONSECUTIVE_EMPTY_WAVES = 3;
 
+/**
+ * Render a tool-call event as a short single-line label for the verbose
+ * Output stream — `Read · package.json`, `Bash · npm test`, etc. The web UI
+ * splits the label on the first ` · ` to render the tool name as a badge.
+ */
+function formatToolCallLine(toolName: string, input: Record<string, unknown> | undefined): string {
+  const arg = pickPrimaryArg(toolName, input);
+  return arg ? `${toolName} · ${arg}` : toolName;
+}
+
+function pickPrimaryArg(toolName: string, input: Record<string, unknown> | undefined): string {
+  if (!input) return '';
+  // Map common Claude Code tools to their most informative single argument.
+  const candidates: Record<string, string[]> = {
+    Read: ['file_path'],
+    Write: ['file_path'],
+    Edit: ['file_path'],
+    Glob: ['pattern'],
+    Grep: ['pattern'],
+    Bash: ['command'],
+    WebFetch: ['url'],
+    WebSearch: ['query'],
+    Task: ['description'],
+  };
+  const keys = candidates[toolName] ?? ['command', 'file_path', 'path', 'pattern', 'url', 'query'];
+  for (const key of keys) {
+    const value = input[key];
+    if (typeof value === 'string' && value.length > 0) {
+      return value.length > 120 ? `${value.slice(0, 117)}...` : value;
+    }
+  }
+  return '';
+}
+
 /** Per-issue stall timeouts (ms) — shorter than Agent Teams wave timeouts */
 const ISSUE_STALL_WARNING_MS = 900_000;    // 15 min
 const ISSUE_STALL_KILL_MS = 1_800_000;     // 30 min
@@ -344,6 +377,7 @@ export class PlanExecutor extends EventEmitter {
     });
 
     const boardLogDir = boardDir ? join(boardDir, 'logs') : undefined;
+    const emitOutput = (text: string) => this.emit('output', { issueId: issue.id, text });
     const result = await runWithFileLogger(`pm-issue-${issue.id}`, () => runIssueWithRetry({
       workingDir: effectiveDir,
       prompt,
@@ -351,8 +385,16 @@ export class PlanExecutor extends EventEmitter {
       stallKillMs: ISSUE_STALL_KILL_MS,
       stallHardCapMs: ISSUE_STALL_HARD_CAP_MS,
       stallMaxExtensions: ISSUE_STALL_MAX_EXTENSIONS,
-      outputCallback: (text: string) => {
-        this.emit('output', { issueId: issue.id, text });
+      outputCallback: emitOutput,
+      // Thinking deltas: marker-prefix so the web UI can classify them as a
+      // separate verbose-only block type without needing a new message field.
+      thinkingCallback: (text: string) => emitOutput(`[[MSTRO_THINKING]]${text}`),
+      // Tool calls: emit a single line per completed tool with a short arg
+      // summary. The 'tool_complete' event fires after input has fully
+      // streamed in, so we can render the tool with its real arguments.
+      toolUseCallback: (event) => {
+        if (event.type !== 'tool_complete' || !event.toolName) return;
+        emitOutput(`[[MSTRO_TOOL]]${formatToolCallLine(event.toolName, event.completeInput)}`);
       },
       extraEnv: this.extraEnv,
       abortSignal,

package/server/services/plan/front-matter.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Front Matter Utilities — Read/write YAML front matter fields.

package/server/services/plan/issue-classification.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import type { Issue } from './types.js';
 

package/server/services/plan/issue-loader.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Issue loader: wraps parser.ts to load either board-scoped or

package/server/services/plan/issue-prompt-builder.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Issue Prompt Builder — Constructs a prompt for a single headless Claude Code instance.

package/server/services/plan/issue-retry.ts

@@ -1,8 +1,7 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import { ResilientRunner } from '../../cli/headless/resilient-runner.js';
-import type { SessionResult } from '../../cli/headless/types.js';
+import type { SessionResult, ToolUseEvent } from '../../cli/headless/types.js';
 
 export interface IssueRunnerConfig {
   workingDir: string;
@@ -12,6 +11,8 @@ export interface IssueRunnerConfig {
   stallHardCapMs: number;
   stallMaxExtensions: number;
   outputCallback?: (text: string) => void;
+  thinkingCallback?: (text: string) => void;
+  toolUseCallback?: (event: ToolUseEvent) => void;
   extraEnv?: Record<string, string>;
   abortSignal?: AbortSignal;
 }
@@ -27,6 +28,8 @@ export async function runIssueWithRetry(config: IssueRunnerConfig): Promise<Sess
     stallHardCapMs: config.stallHardCapMs,
     stallMaxExtensions: config.stallMaxExtensions,
     outputCallback: config.outputCallback,
+    thinkingCallback: config.thinkingCallback,
+    toolUseCallback: config.toolUseCallback,
     verbose: true,
     extraEnv: config.extraEnv,
     abortSignal: config.abortSignal,

package/server/services/plan/issue-writer.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Issue file mutations: front-matter status updates, activity note appends,

package/server/services/plan/output-manager.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Output Manager — Resolves output paths, lists existing docs, and publishes outputs.

package/server/services/plan/parser-core.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * YAML front-matter parsing and entity parsers for PPS (.mstro/pm/) files.

package/server/services/plan/parser-migration.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Legacy → Board-centric migration for .mstro/pm/ directories.

package/server/services/plan/parser.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * PPS Parser — Public API for reading .mstro/pm/ directories.

package/server/services/plan/progress-log.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Progress log writer: ensures output directories exist and appends

package/server/services/plan/prompt-builder.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Prompt Builder — Constructs the Agent Teams coordinator prompt.

package/server/services/plan/readiness-planner.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Pure helpers for wave readiness: human-readable completion reasons

package/server/services/plan/review-gate.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Review Gate — AI-powered quality gate for completed issues.

package/server/services/plan/state-reconciler.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * State Reconciler — Recomputes STATE.md from individual issue files.

package/server/services/plan/types.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Plan Types — Project Plan Spec (PPS) data structures

package/server/services/plan/watcher.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Plan Watcher — Watches .mstro/pm/ directory for changes and broadcasts updates.

package/server/services/platform-credentials.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Platform Credentials — Token management for device authentication.