neondeck 1.0.0-beta.4

package/src/domains/mcp/tools.ts

@@ -0,0 +1,119 @@
+import { defineTool } from '@flue/runtime';
+import * as v from 'valibot';
+import { runtimePaths } from '../../runtime-home';
+import { getMcpRegistry } from './registry';
+import { mcpListAuditInputSchema, mcpServerIdSchema } from './schemas';
+import { listMcpApprovals, listMcpAudit } from './store';
+
+const outputSchema = v.looseObject({
+  ok: v.boolean(),
+  action: v.string(),
+  changed: v.boolean(),
+  message: v.string(),
+});
+
+export const mcpServersLookupTool = defineTool({
+  name: 'neondeck_mcp_servers_lookup',
+  description: 'List configured MCP servers with live connection status.',
+  input: v.object({}),
+  output: outputSchema,
+  async run() {
+    const paths = runtimePaths();
+    const servers = await getMcpRegistry(paths).status();
+    return {
+      ok: true,
+      action: 'mcp_servers_lookup',
+      changed: false,
+      message: `Read ${servers.length} MCP server statuses.`,
+      servers,
+    };
+  },
+});
+
+export const mcpToolsLookupTool = defineTool({
+  name: 'neondeck_mcp_tools_lookup',
+  description:
+    'List cached MCP tool catalogs. Live calls still require a connected server and approval policy.',
+  input: v.object({
+    id: v.optional(mcpServerIdSchema),
+  }),
+  output: outputSchema,
+  async run({ input }) {
+    const paths = runtimePaths();
+    const tools = await getMcpRegistry(paths).listTools(input.id);
+    return {
+      ok: true,
+      action: 'mcp_tools_lookup',
+      changed: false,
+      message: `Read ${tools.length} cached MCP tools.`,
+      tools,
+    };
+  },
+});
+
+export const mcpStatusLookupTool = defineTool({
+  name: 'neondeck_mcp_status_lookup',
+  description: 'Read MCP registry status and enabled server health.',
+  input: v.object({}),
+  output: outputSchema,
+  async run() {
+    const paths = runtimePaths();
+    const servers = await getMcpRegistry(paths).status();
+    return {
+      ok: true,
+      action: 'mcp_status_lookup',
+      changed: false,
+      message: `Read ${servers.length} MCP server statuses.`,
+      servers,
+    };
+  },
+});
+
+export const mcpApprovalsLookupTool = defineTool({
+  name: 'neondeck_mcp_approvals_lookup',
+  description: 'List pending MCP tool-call approvals.',
+  input: v.object({
+    includeResolved: v.optional(v.boolean()),
+  }),
+  output: outputSchema,
+  async run({ input }) {
+    const approvals = await listMcpApprovals(runtimePaths(), {
+      includeResolved: input.includeResolved,
+    });
+    return {
+      ok: true,
+      action: 'mcp_approvals_lookup',
+      changed: false,
+      message: `Read ${approvals.length} MCP approval records.`,
+      approvals,
+    };
+  },
+});
+
+export const mcpAuditLookupTool = defineTool({
+  name: 'neondeck_mcp_audit_lookup',
+  description: 'List recent MCP tool-call audit rows.',
+  input: mcpListAuditInputSchema,
+  output: outputSchema,
+  async run({ input }) {
+    const audit = await listMcpAudit(runtimePaths(), {
+      serverId: input.serverId,
+      limit: input.limit,
+    });
+    return {
+      ok: true,
+      action: 'mcp_audit_lookup',
+      changed: false,
+      message: `Read ${audit.length} MCP audit rows.`,
+      audit,
+    };
+  },
+});
+
+export const neondeckMcpTools = [
+  mcpServersLookupTool,
+  mcpToolsLookupTool,
+  mcpStatusLookupTool,
+  mcpApprovalsLookupTool,
+  mcpAuditLookupTool,
+];

package/src/lib/action-result.ts

@@ -0,0 +1,51 @@
+import { type JsonValue } from '@flue/runtime';
+
+type ActionDetails = {
+  errors?: string[];
+  requires?: string[];
+};
+
+export function okAction<TExtra extends Record<string, unknown> = never>(
+  action: string,
+  changed: boolean,
+  message: string,
+  extra?: TExtra,
+) {
+  return {
+    ok: true as const,
+    action,
+    changed,
+    message,
+    ...extra,
+  };
+}
+
+export function failedAction<TDetails extends ActionDetails = ActionDetails>(
+  action: string,
+  message: string,
+  details: TDetails = {} as TDetails,
+) {
+  return {
+    ok: false as const,
+    action,
+    changed: false as const,
+    message,
+    ...(details.errors ? { errors: details.errors } : {}),
+    ...(details.requires ? { requires: details.requires } : {}),
+  };
+}
+
+export function invalidInputAction(action: string, message: string) {
+  return {
+    ok: false as const,
+    action,
+    changed: false as const,
+    message,
+    errors: [message],
+    error: { code: 'INVALID_INPUT', message },
+  };
+}
+
+export function asJsonValue(value: unknown): JsonValue {
+  return JSON.parse(JSON.stringify(value)) as JsonValue;
+}

package/src/lib/exec.ts

@@ -0,0 +1,118 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+export type ExecFileOptions = {
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+  timeoutMs?: number;
+  signal?: AbortSignal;
+  maxBuffer?: number;
+};
+
+export type ExecFileOutput = {
+  stdout: string;
+  stderr: string;
+};
+
+export class ExecFileError extends Error {
+  readonly code: string | number | null;
+  readonly signal: NodeJS.Signals | null;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly timedOut: boolean;
+
+  constructor(
+    message: string,
+    details: {
+      code?: string | number | null;
+      signal?: NodeJS.Signals | null;
+      stdout?: string | Buffer;
+      stderr?: string | Buffer;
+      timedOut?: boolean;
+      cause?: unknown;
+    },
+  ) {
+    super(message, { cause: details.cause });
+    this.name = 'ExecFileError';
+    this.code = details.code ?? null;
+    this.signal = details.signal ?? null;
+    this.stdout = outputText(details.stdout);
+    this.stderr = outputText(details.stderr);
+    this.timedOut = Boolean(details.timedOut);
+  }
+}
+
+export async function runExecFile(
+  file: string,
+  args: string[] = [],
+  options: ExecFileOptions = {},
+): Promise<ExecFileOutput> {
+  try {
+    const result = await execFileAsync(file, args, {
+      cwd: options.cwd,
+      env: options.env,
+      timeout: options.timeoutMs,
+      signal: options.signal,
+      maxBuffer: options.maxBuffer,
+      encoding: 'utf8',
+    });
+    return {
+      stdout: outputText(result.stdout),
+      stderr: outputText(result.stderr),
+    };
+  } catch (error) {
+    throw normalizeExecFileError(error, file, args);
+  }
+}
+
+export function normalizeExecFileError(
+  error: unknown,
+  file = 'command',
+  args: string[] = [],
+) {
+  if (error instanceof ExecFileError) return error;
+  if (error && typeof error === 'object') {
+    const record = error as {
+      message?: unknown;
+      code?: unknown;
+      signal?: unknown;
+      stdout?: unknown;
+      stderr?: unknown;
+      killed?: unknown;
+    };
+    return new ExecFileError(
+      typeof record.message === 'string'
+        ? record.message
+        : `${[file, ...args].join(' ')} failed.`,
+      {
+        code:
+          typeof record.code === 'string' || typeof record.code === 'number'
+            ? record.code
+            : null,
+        signal:
+          typeof record.signal === 'string'
+            ? (record.signal as NodeJS.Signals)
+            : null,
+        stdout:
+          typeof record.stdout === 'string' || Buffer.isBuffer(record.stdout)
+            ? record.stdout
+            : '',
+        stderr:
+          typeof record.stderr === 'string' || Buffer.isBuffer(record.stderr)
+            ? record.stderr
+            : '',
+        timedOut: record.killed === true && record.signal === 'SIGTERM',
+        cause: error,
+      },
+    );
+  }
+  return new ExecFileError(`${[file, ...args].join(' ')} failed.`, {
+    cause: error,
+  });
+}
+
+function outputText(value: string | Buffer | undefined) {
+  return typeof value === 'string' ? value : (value?.toString('utf8') ?? '');
+}

package/src/lib/git.ts

@@ -0,0 +1,20 @@
+import { runExecFile } from './exec';
+
+const schedulerGitTimeoutMs = 20_000;
+const schedulerGitMaxBuffer = 4 * 1024 * 1024;
+
+export async function runBoundedGit(cwd: string, args: string[]) {
+  const { stdout } = await runExecFile('git', args, {
+    cwd,
+    timeoutMs: schedulerGitTimeoutMs,
+    maxBuffer: schedulerGitMaxBuffer,
+  });
+  return stdout.trim();
+}
+
+export async function runBoundedGitLines(cwd: string, args: string[]) {
+  return (await runBoundedGit(cwd, args))
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean);
+}

package/src/lib/report-html.ts

@@ -0,0 +1,193 @@
+export type ReportHtmlSection = {
+  title: string;
+  body?: string | null;
+  items?: Array<{
+    label?: string | null;
+    value: string;
+  }>;
+};
+
+export type RenderReportHtmlInput = {
+  title: string;
+  eyebrow?: string | null;
+  summary?: string | null;
+  sections?: ReportHtmlSection[];
+  generatedAt?: string | Date;
+};
+
+export function renderReportHtml(input: RenderReportHtmlInput) {
+  const generatedAt = dateText(input.generatedAt ?? new Date());
+  const sections = (input.sections ?? []).map(renderSection).join('\n');
+  const summary = input.summary
+    ? `<p class="summary">${escapeHtml(input.summary)}</p>`
+    : '';
+  const eyebrow = input.eyebrow
+    ? `<p class="eyebrow">${escapeHtml(input.eyebrow)}</p>`
+    : '';
+
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(input.title)}</title>
+  <style>
+    :root {
+      color-scheme: dark light;
+      --bg: #0a0b10;
+      --panel: #0c0d12;
+      --field: #070810;
+      --line: #ffffff1f;
+      --ink: #d7f7ff;
+      --muted: #d7f7ff99;
+      --primary: #69e6ff;
+      --accent: #ff4fb8;
+      --violet: #8b4dff;
+    }
+    @media (prefers-color-scheme: light) {
+      :root {
+        --bg: #edf5f8;
+        --panel: #f7fbfd;
+        --field: #dbeaef;
+        --line: #142d3c24;
+        --ink: #19232e;
+        --muted: #334653;
+        --primary: #007f91;
+        --accent: #b71f78;
+        --violet: #7044d8;
+      }
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      background: var(--bg);
+      color: var(--ink);
+      font: 13px/1.55 "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    }
+    main {
+      max-width: 980px;
+      margin: 0 auto;
+      padding: 28px;
+    }
+    header {
+      border: 1px solid var(--line);
+      background: linear-gradient(180deg, #69e6ff12, transparent 60%), var(--panel);
+      padding: 18px 20px;
+    }
+    .eyebrow,
+    .meta,
+    h2,
+    dt {
+      font-family: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    }
+    .eyebrow {
+      margin: 0 0 7px;
+      color: var(--primary);
+      font-size: 10px;
+      letter-spacing: 0.08em;
+    }
+    h1 {
+      margin: 0;
+      font: 600 20px/1.25 "Chakra Petch", ui-sans-serif, system-ui, sans-serif;
+      letter-spacing: 0;
+    }
+    .summary {
+      margin: 10px 0 0;
+      max-width: 74ch;
+      color: var(--muted);
+    }
+    .meta {
+      margin: 10px 0 0;
+      color: var(--muted);
+      font-size: 10px;
+    }
+    section {
+      margin-top: 14px;
+      border: 1px solid var(--line);
+      background: var(--panel);
+      padding: 16px 18px;
+    }
+    h2 {
+      margin: 0 0 10px;
+      color: var(--primary);
+      font-size: 12px;
+      letter-spacing: 0.06em;
+    }
+    p {
+      margin: 0;
+      max-width: 74ch;
+    }
+    dl {
+      display: grid;
+      grid-template-columns: minmax(120px, 0.34fr) 1fr;
+      gap: 8px 14px;
+      margin: 0;
+    }
+    dt {
+      min-width: 0;
+      color: var(--muted);
+      font-size: 10px;
+      overflow-wrap: anywhere;
+    }
+    dd {
+      margin: 0;
+      min-width: 0;
+      overflow-wrap: anywhere;
+      white-space: pre-wrap;
+    }
+    ul {
+      margin: 0;
+      padding-left: 18px;
+    }
+    li + li {
+      margin-top: 6px;
+    }
+    code {
+      background: var(--field);
+      color: var(--primary);
+      padding: 1px 4px;
+      font-family: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <header>
+      ${eyebrow}
+      <h1>${escapeHtml(input.title)}</h1>
+      ${summary}
+      <p class="meta">generated ${escapeHtml(generatedAt)}</p>
+    </header>
+    ${sections}
+  </main>
+</body>
+</html>
+`;
+}
+
+export function escapeHtml(value: string) {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+function renderSection(section: ReportHtmlSection) {
+  const body = section.body ? `<p>${escapeHtml(section.body)}</p>` : '';
+  const items = section.items?.length
+    ? `<dl>${section.items
+        .map(
+          (item) =>
+            `<dt>${escapeHtml(item.label ?? 'item')}</dt><dd>${escapeHtml(item.value)}</dd>`,
+        )
+        .join('')}</dl>`
+    : '';
+  return `<section><h2>${escapeHtml(section.title)}</h2>${body}${items}</section>`;
+}
+
+function dateText(value: string | Date) {
+  if (value instanceof Date) return value.toISOString();
+  return value;
+}

package/src/lib/sqlite.ts

@@ -0,0 +1,51 @@
+import { DatabaseSync } from 'node:sqlite';
+import * as v from 'valibot';
+import { asJsonValue } from './action-result';
+
+export type OpenDbOptions = {
+  readOnly?: boolean;
+};
+
+export const defaultSqliteBusyTimeoutMs = 5000;
+
+export function openDb(path: string, options: OpenDbOptions = {}) {
+  return configureDb(new DatabaseSync(path, options));
+}
+
+export function configureDb(database: DatabaseSync) {
+  database.exec(`PRAGMA busy_timeout = ${defaultSqliteBusyTimeoutMs};`);
+  return database;
+}
+
+export function parseRow<T>(
+  row: unknown,
+  schema: v.GenericSchema<unknown, T>,
+  context: string,
+): T {
+  const parsed = v.safeParse(schema, row);
+  if (parsed.success) return parsed.output;
+  throw new Error(`${context}: ${v.summarize(parsed.issues)}`);
+}
+
+export function readJsonColumn<T = unknown>(value: string | null): T | null {
+  if (value === null) return null;
+  return JSON.parse(value) as T;
+}
+
+export function writeJsonColumn(value: unknown): string {
+  return JSON.stringify(asJsonValue(value));
+}
+
+export function writeNullableJsonColumn(value: unknown | null | undefined) {
+  return value == null ? null : writeJsonColumn(value);
+}
+
+export const nullableStringColumnSchema = v.nullable(v.string());
+export const nullableNumberColumnSchema = v.nullable(v.number());
+export const nullableBooleanColumnSchema = v.nullable(v.boolean());
+
+export function isUniqueConstraintError(error: unknown) {
+  return (
+    error instanceof Error && /UNIQUE constraint failed/i.test(error.message)
+  );
+}

package/src/lib/valibot.ts

@@ -0,0 +1,33 @@
+import * as v from 'valibot';
+
+export type ParseInputResult<TInput, TResult> =
+  { ok: true; input: TInput } | { ok: false; result: TResult };
+
+export function parseInput<TInput, TResult>(
+  schema: v.GenericSchema<unknown, TInput>,
+  rawInput: unknown,
+  invalidResult: (
+    message: string,
+    issues: [v.BaseIssue<unknown>, ...v.BaseIssue<unknown>[]],
+  ) => TResult,
+  messageForIssues: (
+    issues: [v.BaseIssue<unknown>, ...v.BaseIssue<unknown>[]],
+  ) => string = (issues) => v.summarize(issues),
+): ParseInputResult<TInput, TResult> {
+  const parsed = v.safeParse(schema, rawInput);
+  if (parsed.success) return { ok: true, input: parsed.output };
+  const issues = parsed.issues as [
+    v.BaseIssue<unknown>,
+    ...v.BaseIssue<unknown>[],
+  ];
+  return {
+    ok: false,
+    result: invalidResult(messageForIssues(issues), issues),
+  };
+}
+
+export const nonEmptyStringSchema = v.pipe(v.string(), v.minLength(1));
+export const nullableStringColumnSchema = v.nullable(v.string());
+export const isoDateStringSchema = v.pipe(v.string(), v.isoTimestamp());
+export const nullableIsoDateStringColumnSchema =
+  v.nullable(isoDateStringSchema);

package/src/modules/app-state/index.ts

@@ -0,0 +1,5 @@
+export * from './native-notifications';
+export * from './notification-events';
+export * from './notifications';
+export * from './types';
+export * from './workflow-summaries';

package/src/modules/app-state/native-notifications.ts

@@ -0,0 +1,76 @@
+import { spawn } from 'node:child_process';
+import { platform } from 'node:os';
+import type { NotificationRecord } from './types';
+
+export type NativeNotificationDelivery = {
+  delivered: boolean;
+  provider: 'macos-osascript' | 'disabled' | 'unsupported';
+  reason?: string;
+};
+
+const attentionLevels = new Set(['attention', 'urgent']);
+
+export function shouldDeliverNativeNotification(
+  notification: Pick<NotificationRecord, 'level' | 'resolvedAt'>,
+  env = process.env,
+) {
+  if (notification.resolvedAt) return false;
+  if (env.NEONDECK_NATIVE_NOTIFICATIONS === '0') return false;
+  if (env.NODE_ENV === 'test' && env.NEONDECK_NATIVE_NOTIFICATIONS !== '1') {
+    return false;
+  }
+  return attentionLevels.has(notification.level);
+}
+
+export function deliverNativeNotification(
+  notification: Pick<
+    NotificationRecord,
+    'level' | 'message' | 'resolvedAt' | 'source' | 'title'
+  >,
+  env = process.env,
+): NativeNotificationDelivery {
+  if (!shouldDeliverNativeNotification(notification, env)) {
+    return { delivered: false, provider: 'disabled' };
+  }
+
+  if (platform() !== 'darwin') {
+    return {
+      delivered: false,
+      provider: 'unsupported',
+      reason: 'Native notifications are currently implemented for macOS.',
+    };
+  }
+
+  const subprocess = spawn(
+    'osascript',
+    [
+      '-e',
+      `
+on run argv
+  set notificationTitle to item 1 of argv
+  set notificationBody to item 2 of argv
+  set notificationSubtitle to item 3 of argv
+  if notificationSubtitle is "" then
+    display notification notificationBody with title notificationTitle
+  else
+    display notification notificationBody with title notificationTitle subtitle notificationSubtitle
+  end if
+end run
+`,
+      notification.title,
+      notification.message,
+      notification.source ?? '',
+    ],
+    {
+      detached: true,
+      stdio: 'ignore',
+    },
+  );
+
+  subprocess.on('error', (error) => {
+    console.error('[neondeck] native notification failed', error);
+  });
+  subprocess.unref();
+
+  return { delivered: true, provider: 'macos-osascript' };
+}