neondeck 1.0.0-beta.4

package/src/server/autopilot-push-dispatch.ts

@@ -0,0 +1,326 @@
+import { invoke, type WorkflowDefinition } from '@flue/runtime';
+import { asJsonValue } from '../lib/action-result';
+import { addNotification, addWorkflowSummary } from '../modules/app-state';
+import { approvePreparedDiffPushWithPolicy } from '../modules/autopilot';
+import {
+  type PreparedDiffActionResult,
+  type PreparedDiffRecord,
+} from '../modules/prepared-diffs';
+import {
+  type RuntimePaths,
+  parseAppConfig,
+  readRuntimeJson,
+  runtimePaths,
+} from '../runtime-home';
+
+type PushOnApprovalMode = 'push' | 'verify-then-push' | 'off';
+type DispatchWorkflowName = 'push-pr-autofix' | 'verify-then-push-pr-autofix';
+type WorkflowReceipt = { runId: string };
+
+type ApprovalDispatchDependencies = {
+  invokeWorkflow?: (
+    workflow: DispatchWorkflowName,
+    input: Record<string, unknown>,
+  ) => Promise<WorkflowReceipt>;
+};
+type DispatchPlan =
+  ReturnType<typeof pushDispatch> | ReturnType<typeof verifyThenPushDispatch>;
+
+export async function approvePreparedDiffPushWithDispatch(
+  rawInput: unknown,
+  paths: RuntimePaths = runtimePaths(),
+  dependencies: ApprovalDispatchDependencies = {},
+): Promise<PreparedDiffActionResult> {
+  const approval = await approvePreparedDiffPushWithPolicy(rawInput, paths);
+  if (!approval.ok || !approval.preparedDiff) return approval;
+  return dispatchApprovedPreparedDiffPush(approval, paths, dependencies);
+}
+
+async function dispatchApprovedPreparedDiffPush(
+  approval: PreparedDiffActionResult,
+  paths: RuntimePaths,
+  dependencies: ApprovalDispatchDependencies,
+): Promise<PreparedDiffActionResult> {
+  const preparedDiff = approval.preparedDiff;
+  if (!preparedDiff) return approval;
+
+  const mode = await readPushOnApprovalMode(paths);
+  if (mode === 'off') {
+    return withDispatchData(
+      approval,
+      {
+        mode,
+        status: 'off',
+        message: 'Push dispatch is disabled by autopilot.pushOnApproval=off.',
+      },
+      'Recorded prepared diff push approval. Push dispatch is disabled by autopilot.pushOnApproval=off.',
+    );
+  }
+
+  const dispatch =
+    mode === 'verify-then-push' && preparedDiff.verificationStatus !== 'passed'
+      ? verifyThenPushDispatch(preparedDiff)
+      : pushDispatch(preparedDiff);
+  const invokeWorkflow = dependencies.invokeWorkflow ?? invokeAutopilotWorkflow;
+  const approvalId = approval.approvals?.[0]?.id ?? null;
+  let receipt: WorkflowReceipt;
+  try {
+    receipt = await invokeWorkflowForRuntimeHome(
+      paths,
+      dispatch,
+      invokeWorkflow,
+    );
+  } catch (error) {
+    const message = errorMessage(error);
+    await recordDispatchFailure(
+      preparedDiff,
+      mode,
+      dispatch,
+      approvalId,
+      message,
+      paths,
+    );
+    return {
+      ...withDispatchData(
+        approval,
+        {
+          mode,
+          status: 'dispatch-failed',
+          workflow: dispatch.workflow,
+          message,
+        },
+        `Recorded prepared diff push approval, but workflow dispatch failed: ${message}`,
+      ),
+      requires: ['workflowDispatch'],
+      errors: [message],
+    };
+  }
+
+  const workflowSummary = await addWorkflowSummary(
+    {
+      workflow: dispatch.workflow.replaceAll('-', '_'),
+      runId: receipt.runId,
+      status: 'pending',
+      summary: {
+        event: 'prepared_diff_push_approval_dispatch',
+        mode,
+        approvalId,
+        preparedDiffId: preparedDiff.id,
+        worktreeId: preparedDiff.worktreeId,
+        repoId: preparedDiff.repoId,
+        repoFullName: preparedDiff.repoFullName,
+        prNumber: preparedDiff.prNumber,
+        workflow: dispatch.workflow,
+        input: dispatch.input,
+        dispatchedAt: new Date().toISOString(),
+      },
+    },
+    paths,
+  ).catch(async (error) => {
+    const message = errorMessage(error);
+    await recordDispatchSummaryFailure(
+      preparedDiff,
+      mode,
+      dispatch,
+      approvalId,
+      receipt.runId,
+      message,
+      paths,
+    );
+    return null;
+  });
+
+  const summaryFailedMessage = workflowSummary
+    ? undefined
+    : ' Workflow summary recording failed; the workflow was still admitted.';
+  return {
+    ...withDispatchData(
+      approval,
+      {
+        mode,
+        status: 'dispatched',
+        workflow: dispatch.workflow,
+        runId: receipt.runId,
+        workflowSummaryId: workflowSummary?.id ?? null,
+        message: `${dispatch.message}${summaryFailedMessage ?? ''}`,
+      },
+      `${dispatch.message}${summaryFailedMessage ?? ''}`,
+    ),
+    ...(workflowSummary
+      ? {}
+      : {
+          requires: ['workflowSummary'],
+          errors: [summaryFailedMessage!.trim()],
+        }),
+  };
+}
+
+function pushDispatch(preparedDiff: PreparedDiffRecord) {
+  return {
+    workflow: 'push-pr-autofix' as const,
+    input: {
+      preparedDiffId: preparedDiff.id,
+      lockOwner: 'approval_push_pr_autofix',
+    },
+    message: `Approved prepared diff ${preparedDiff.id}; dispatched push-pr-autofix workflow.`,
+  };
+}
+
+function verifyThenPushDispatch(preparedDiff: PreparedDiffRecord) {
+  return {
+    workflow: 'verify-then-push-pr-autofix' as const,
+    input: {
+      preparedDiffId: preparedDiff.id,
+      worktreeId: preparedDiff.worktreeId,
+    },
+    message: `Approved prepared diff ${preparedDiff.id}; dispatched verify-then-push-pr-autofix workflow.`,
+  };
+}
+
+async function readPushOnApprovalMode(
+  paths: RuntimePaths,
+): Promise<PushOnApprovalMode> {
+  const config = await readRuntimeJson(paths.config, parseAppConfig);
+  const value = config.autopilot?.pushOnApproval;
+  return value === 'push' || value === 'off' ? value : 'verify-then-push';
+}
+
+async function invokeWorkflowForRuntimeHome(
+  paths: RuntimePaths,
+  dispatch: DispatchPlan,
+  invokeWorkflow: NonNullable<ApprovalDispatchDependencies['invokeWorkflow']>,
+) {
+  // Flue workflows still call runtimePaths() from the process environment after
+  // admission, so keep NEONDECK_HOME aligned with this app instance instead of
+  // restoring it immediately after the dynamic import/invoke boundary.
+  process.env.NEONDECK_HOME = paths.home;
+  return invokeWorkflow(dispatch.workflow, dispatch.input);
+}
+
+async function invokeAutopilotWorkflow(
+  workflow: DispatchWorkflowName,
+  input: Record<string, unknown>,
+) {
+  if (workflow === 'push-pr-autofix') {
+    const module = await import('../workflows/push-pr-autofix');
+    return invokeWorkflow(module.default, { input });
+  }
+  const module = await import('../workflows/verify-then-push-pr-autofix');
+  return invokeWorkflow(module.default, { input });
+}
+
+async function recordDispatchFailure(
+  preparedDiff: PreparedDiffRecord,
+  mode: PushOnApprovalMode,
+  dispatch: DispatchPlan,
+  approvalId: string | null,
+  error: string,
+  paths: RuntimePaths,
+) {
+  await addWorkflowSummary(
+    {
+      workflow: dispatch.workflow.replaceAll('-', '_'),
+      status: 'failed',
+      summary: {
+        event: 'prepared_diff_push_approval_dispatch',
+        mode,
+        approvalId,
+        preparedDiffId: preparedDiff.id,
+        worktreeId: preparedDiff.worktreeId,
+        repoId: preparedDiff.repoId,
+        repoFullName: preparedDiff.repoFullName,
+        prNumber: preparedDiff.prNumber,
+        workflow: dispatch.workflow,
+        input: dispatch.input,
+        error,
+        dispatchedAt: new Date().toISOString(),
+      },
+    },
+    paths,
+  ).catch(() => undefined);
+  await addNotification(
+    {
+      level: 'attention',
+      title: 'Push dispatch failed',
+      message: `Prepared diff ${preparedDiff.id} was approved, but workflow dispatch failed: ${error}`,
+      source: 'autopilot',
+      sourceId: `prepared-diff:${preparedDiff.id}:push-dispatch-failed`,
+      data: {
+        approvalId,
+        preparedDiffId: preparedDiff.id,
+        worktreeId: preparedDiff.worktreeId,
+        workflow: dispatch.workflow,
+        error,
+      },
+    },
+    paths,
+  ).catch(() => undefined);
+}
+
+async function recordDispatchSummaryFailure(
+  preparedDiff: PreparedDiffRecord,
+  mode: PushOnApprovalMode,
+  dispatch: DispatchPlan,
+  approvalId: string | null,
+  runId: string,
+  error: string,
+  paths: RuntimePaths,
+) {
+  await addNotification(
+    {
+      level: 'attention',
+      title: 'Push dispatch audit failed',
+      message: `Prepared diff ${preparedDiff.id} dispatched ${dispatch.workflow} (${runId}), but workflow summary recording failed: ${error}`,
+      source: 'autopilot',
+      sourceId: `prepared-diff:${preparedDiff.id}:push-dispatch-summary-failed:${runId}`,
+      data: {
+        mode,
+        approvalId,
+        preparedDiffId: preparedDiff.id,
+        worktreeId: preparedDiff.worktreeId,
+        workflow: dispatch.workflow,
+        runId,
+        error,
+      },
+    },
+    paths,
+  ).catch(() => undefined);
+}
+
+async function invokeWorkflow(
+  workflow: WorkflowDefinition,
+  request: { input: Record<string, unknown> },
+) {
+  return invoke(workflow, request);
+}
+
+function errorMessage(error: unknown) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function withDispatchData(
+  approval: PreparedDiffActionResult,
+  dispatch: Record<string, unknown>,
+  message: string,
+): PreparedDiffActionResult {
+  const existing =
+    approval.data &&
+    typeof approval.data === 'object' &&
+    !Array.isArray(approval.data)
+      ? approval.data
+      : {};
+  return {
+    ...approval,
+    message,
+    data: asJsonValue({
+      ...existing,
+      pushApprovalDispatch: dispatch,
+      dispatchedPushRunId:
+        typeof dispatch.runId === 'string' ? dispatch.runId : null,
+      workflowSummaryId:
+        typeof dispatch.workflowSummaryId === 'string'
+          ? dispatch.workflowSummaryId
+          : null,
+    }),
+  };
+}

package/src/server/create-app.ts

@@ -0,0 +1,160 @@
+import { registerProvider } from '@flue/runtime';
+import { flue } from '@flue/runtime/routing';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { Hono } from 'hono';
+import { getMcpRegistry } from '../domains/mcp';
+import { installFlueExecutionContextTracker } from '../modules/flue/execution-context';
+import { loadNeondeckEnv } from '../modules/runtime';
+import {
+  providerRuntimeRegistrations,
+  readProviderConfigSync,
+} from '../modules/repos';
+import {
+  ensureRuntimeHome,
+  ensureRuntimeHomeSync,
+  type RuntimePaths,
+  runtimePaths,
+} from '../runtime-home';
+import { createConfigEventRoutes } from './events/config-stream';
+import { createNotificationEventRoutes } from './events/notification-stream';
+import { createSessionEventRoutes } from './events/session-stream';
+import {
+  displayAssistantLearningMiddleware,
+  installFlueObservationHandlers,
+} from './learning-hooks';
+import {
+  requireFlueRunInspectionToken,
+  requireLocalApiAccess,
+} from './middleware';
+import { createAutopilotRoutes } from './routes/autopilot';
+import { createCommandRoutes } from './routes/commands';
+import { createConfigRoutes } from './routes/config';
+import { createExecutionRoutes } from './routes/execution';
+import { createGitHubRoutes } from './routes/github';
+import { createHandoffRoutes } from './routes/handoff';
+import { createKiloRoutes } from './routes/kilo';
+import { createLearningRoutes } from './routes/learning';
+import { createMemoryRoutes } from './routes/memory';
+import { createMetricsRoutes } from './routes/metrics';
+import { createMcpRoutes } from './routes/mcp';
+import { createNotificationRoutes } from './routes/notifications';
+import { createRepoEditRoutes } from './routes/repo-edit';
+import {
+  createReportApiRoutes,
+  createReportFileRoutes,
+} from './routes/reports';
+import { createReposRoutes } from './routes/repos';
+import { createScheduledTaskRoutes } from './routes/scheduled-tasks';
+import { createRuntimeRoutes } from './routes/runtime';
+import { createSafetyRoutes } from './routes/safety';
+import { createSchedulerRoutes } from './routes/scheduler';
+import { startSchedulerObservedLoop } from './scheduler-workflow';
+import { createSessionRoutes } from './routes/sessions';
+import { createSkillRoutes } from './routes/skills';
+import { createWatchRoutes } from './routes/watches';
+import { createWorkflowRoutes } from './routes/workflows';
+import { createWorktreeRoutes } from './routes/worktrees';
+
+export type CreateAppOptions = {
+  paths?: RuntimePaths;
+  staticRoot?: string;
+  scheduler?: boolean;
+};
+
+export async function createApp(options: CreateAppOptions = {}) {
+  const paths = options.paths ?? runtimePaths();
+  process.env.NEONDECK_HOME = paths.home;
+  ensureRuntimeHomeSync(paths);
+  loadNeondeckEnv(paths);
+  const providerConfig = readProviderConfigSync(paths);
+  for (const provider of providerRuntimeRegistrations(
+    process.env,
+    providerConfig,
+  )) {
+    registerProvider(provider.id, provider.registration);
+  }
+
+  const app = new Hono();
+  const staticRoot = options.staticRoot ?? resolveStaticRoot();
+
+  await ensureRuntimeHome(paths);
+  installFlueExecutionContextTracker();
+  installFlueObservationHandlers(paths);
+
+  if (
+    options.scheduler !== false &&
+    process.env.NEONDECK_DISABLE_SCHEDULER !== '1'
+  ) {
+    startSchedulerObservedLoop(paths);
+  }
+  await getMcpRegistry(paths).start();
+
+  app.use('/api/*', requireLocalApiAccess);
+  app.use('/reports/*', requireLocalApiAccess);
+
+  app.route('/api', createRuntimeRoutes(paths));
+  app.route('/api/events', createConfigEventRoutes());
+  app.route('/api/events', createNotificationEventRoutes());
+  app.route('/api/events', createSessionEventRoutes());
+  app.route('/api/safety', createSafetyRoutes(paths));
+  app.route('/api/execution', createExecutionRoutes(paths));
+  app.route('/api', createSessionRoutes(paths));
+  app.route('/api', createConfigRoutes(paths));
+  app.route('/api/metrics', createMetricsRoutes());
+  app.route('/api/mcp', createMcpRoutes(paths));
+  app.route('/api/repos', createReposRoutes(paths));
+  app.route('/api', createRepoEditRoutes(paths));
+  app.route('/api', createWorktreeRoutes(paths));
+  app.route('/api/kilo', createKiloRoutes(paths));
+  app.route('/api', createAutopilotRoutes(paths));
+  app.route('/api', createHandoffRoutes(paths));
+  app.route('/api', createWatchRoutes(paths));
+  app.route('/api', createSchedulerRoutes(paths));
+  app.route('/api', createScheduledTaskRoutes(paths));
+  app.route('/api/notifications', createNotificationRoutes(paths));
+  app.route('/api', createMemoryRoutes(paths));
+  app.route('/api/learning', createLearningRoutes(paths));
+  app.route('/api/skills', createSkillRoutes(paths));
+  app.route('/api/commands', createCommandRoutes());
+  app.route('/api', createReportApiRoutes(paths));
+  app.route('/api/workflows', createWorkflowRoutes(paths));
+  app.route('/api/github', createGitHubRoutes(paths));
+
+  app.use(
+    '/api/flue/agents/display-assistant/*',
+    displayAssistantLearningMiddleware(paths),
+  );
+
+  const requireRunInspection = requireFlueRunInspectionToken(paths);
+  app.use('/api/flue/runs', requireRunInspection);
+  app.use('/api/flue/runs/*', requireRunInspection);
+  app.route('/api/flue', flue());
+  app.route('/reports', createReportFileRoutes(paths));
+
+  app.use('/assets/*', serveStatic({ root: staticRoot }));
+  app.get(
+    '/manifest.webmanifest',
+    serveStatic({ root: staticRoot, path: 'manifest.webmanifest' }),
+  );
+  app.use('/icons/*', serveStatic({ root: staticRoot }));
+  app.get(
+    '/favicon.svg',
+    serveStatic({ root: staticRoot, path: 'favicon.svg' }),
+  );
+  app.get('*', serveStatic({ root: staticRoot, path: 'index.html' }));
+
+  return app;
+}
+
+export function resolveStaticRoot(env = process.env) {
+  const candidates = [
+    env.NEONDECK_STATIC_ROOT,
+    fileURLToPath(new URL('../../web/dist', import.meta.url)),
+    fileURLToPath(new URL('../web/dist', import.meta.url)),
+    './web/dist',
+  ].filter((value): value is string => Boolean(value));
+
+  return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
+}

package/src/server/events/config-stream.ts

@@ -0,0 +1,67 @@
+import { Hono } from 'hono';
+import {
+  formatConfigServerSentEvent,
+  replayConfigEventsAfter,
+  subscribeConfigEvents,
+} from '../../modules/config';
+
+const configEventHeartbeatMs = 10_000;
+const configEventStreamMaxAgeMs = 20_000;
+
+export function createConfigEventRoutes() {
+  const routes = new Hono();
+
+  routes.get('/config', (c) => {
+    const lastEventId = c.req.header('last-event-id');
+    const encoder = new TextEncoder();
+    let cleanup = () => {};
+
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        let active = true;
+        function send(value: string) {
+          if (!active) return;
+          controller.enqueue(encoder.encode(value));
+        }
+
+        send('retry: 3000\n: connected\n\n');
+        const unsubscribe = subscribeConfigEvents((event) => {
+          send(formatConfigServerSentEvent(event));
+        });
+        for (const event of replayConfigEventsAfter(lastEventId)) {
+          send(formatConfigServerSentEvent(event));
+        }
+        const heartbeat = setInterval(() => {
+          send(`: heartbeat ${Date.now()}\n\n`);
+        }, configEventHeartbeatMs);
+        const maxAge = setTimeout(() => {
+          send(': reconnecting\n\n');
+          cleanup();
+          controller.close();
+        }, configEventStreamMaxAgeMs);
+
+        cleanup = () => {
+          if (!active) return;
+          active = false;
+          clearInterval(heartbeat);
+          clearTimeout(maxAge);
+          unsubscribe();
+        };
+      },
+      cancel() {
+        cleanup();
+      },
+    });
+
+    return new Response(stream, {
+      headers: {
+        'cache-control': 'no-cache, no-transform',
+        connection: 'keep-alive',
+        'content-type': 'text/event-stream; charset=utf-8',
+        'x-accel-buffering': 'no',
+      },
+    });
+  });
+
+  return routes;
+}

package/src/server/events/notification-stream.ts

@@ -0,0 +1,49 @@
+import { Hono } from 'hono';
+import {
+  formatNotificationServerSentEvent,
+  subscribeNotificationEvents,
+} from '../../modules/app-state';
+
+export function createNotificationEventRoutes() {
+  const routes = new Hono();
+
+  routes.get('/notifications', () => {
+    const encoder = new TextEncoder();
+    let cleanup = () => {};
+
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        function send(value: string) {
+          controller.enqueue(encoder.encode(value));
+        }
+
+        send(': connected\n\n');
+        const unsubscribe = subscribeNotificationEvents((event) => {
+          send(formatNotificationServerSentEvent(event));
+        });
+        const heartbeat = setInterval(() => {
+          send(`: heartbeat ${Date.now()}\n\n`);
+        }, 25_000);
+
+        cleanup = () => {
+          clearInterval(heartbeat);
+          unsubscribe();
+        };
+      },
+      cancel() {
+        cleanup();
+      },
+    });
+
+    return new Response(stream, {
+      headers: {
+        'cache-control': 'no-cache, no-transform',
+        connection: 'keep-alive',
+        'content-type': 'text/event-stream; charset=utf-8',
+        'x-accel-buffering': 'no',
+      },
+    });
+  });
+
+  return routes;
+}

package/src/server/events/session-stream.ts

@@ -0,0 +1,49 @@
+import { Hono } from 'hono';
+import {
+  formatChatSessionServerSentEvent,
+  subscribeChatSessionEvents,
+} from '../../modules/sessions';
+
+export function createSessionEventRoutes() {
+  const routes = new Hono();
+
+  routes.get('/sessions', () => {
+    const encoder = new TextEncoder();
+    let cleanup = () => {};
+
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        function send(value: string) {
+          controller.enqueue(encoder.encode(value));
+        }
+
+        send(': connected\n\n');
+        const unsubscribe = subscribeChatSessionEvents((event) => {
+          send(formatChatSessionServerSentEvent(event));
+        });
+        const heartbeat = setInterval(() => {
+          send(`: heartbeat ${Date.now()}\n\n`);
+        }, 25_000);
+
+        cleanup = () => {
+          clearInterval(heartbeat);
+          unsubscribe();
+        };
+      },
+      cancel() {
+        cleanup();
+      },
+    });
+
+    return new Response(stream, {
+      headers: {
+        'cache-control': 'no-cache, no-transform',
+        connection: 'keep-alive',
+        'content-type': 'text/event-stream; charset=utf-8',
+        'x-accel-buffering': 'no',
+      },
+    });
+  });
+
+  return routes;
+}