orbital-command 0.1.4 → 0.3.0

package/dist/server/server/routes/manifest-routes.js

@@ -0,0 +1,319 @@
+/**
+ * REST API routes for the manifest-based primitive management system.
+ * Exposes status, validation, update, pin/unpin, reset, and diff operations.
+ */
+import path from 'path';
+import fs from 'fs';
+import { execFileSync } from 'child_process';
+import { Router } from 'express';
+import { loadManifest, saveManifest, hashFile, computeFileStatus, refreshFileStatuses, summarizeManifest, reverseRemapPath, safeBackupFile, safeCopyTemplate, safeRestoreFile, } from '../manifest.js';
+import { validate } from '../validator.js';
+import { computeUpdatePlan, loadRenameMap } from '../update-planner.js';
+import { runInit, runUpdate } from '../init.js';
+import { needsLegacyMigration, migrateFromLegacy } from '../migrate-legacy.js';
+import { errMsg, isValidRelativePath } from '../utils/route-helpers.js';
+// ─── Route Factory ──────────────────────────────────────────
+export function createManifestRoutes({ projectRoot, templatesDir, packageVersion, io, }) {
+    const router = Router();
+    const claudeDir = path.join(projectRoot, '.claude');
+    // ─── GET /manifest/status — summary overview ────────────
+    router.get('/manifest/status', (_req, res) => {
+        try {
+            const manifest = loadManifest(projectRoot);
+            if (!manifest) {
+                return res.json({
+                    success: true,
+                    data: {
+                        exists: false,
+                        packageVersion,
+                        installedVersion: '',
+                        needsUpdate: true,
+                        preset: '',
+                        files: { total: 0, synced: 0, modified: 0, pinned: 0, userOwned: 0, byType: {} },
+                        lastUpdated: '',
+                    },
+                });
+            }
+            refreshFileStatuses(manifest, claudeDir);
+            const summary = summarizeManifest(manifest);
+            res.json({
+                success: true,
+                data: {
+                    exists: true,
+                    packageVersion,
+                    installedVersion: manifest.packageVersion,
+                    needsUpdate: manifest.packageVersion !== packageVersion,
+                    preset: manifest.preset,
+                    files: summary,
+                    lastUpdated: manifest.updatedAt,
+                },
+            });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── GET /manifest/files — file inventory ───────────────
+    router.get('/manifest/files', (_req, res) => {
+        try {
+            const manifest = loadManifest(projectRoot);
+            if (!manifest) {
+                return res.json({ success: true, data: [] });
+            }
+            refreshFileStatuses(manifest, claudeDir);
+            const files = Object.entries(manifest.files).map(([filePath, record]) => ({
+                path: filePath,
+                origin: record.origin,
+                status: record.status,
+                templateHash: record.templateHash,
+                installedHash: record.installedHash,
+                pinnedAt: record.pinnedAt,
+                pinnedReason: record.pinnedReason,
+                hasPrev: fs.existsSync(path.join(claudeDir, filePath + '.prev')),
+            }));
+            res.json({ success: true, data: files });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── GET /manifest/validate — run validation ────────────
+    router.get('/manifest/validate', (_req, res) => {
+        try {
+            const report = validate(projectRoot, packageVersion);
+            res.json({ success: true, data: report });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── POST /manifest/init — initialize manifest ───────────
+    router.post('/manifest/init', (_req, res) => {
+        try {
+            // If manifest already exists, just return success
+            if (loadManifest(projectRoot)) {
+                return res.json({ success: true, message: 'Already initialized' });
+            }
+            // If legacy install exists, migrate it
+            if (needsLegacyMigration(projectRoot)) {
+                migrateFromLegacy(projectRoot, templatesDir, packageVersion);
+                io.emit('manifest:changed', { action: 'initialized' });
+                return res.json({ success: true });
+            }
+            // No existing install at all — run full init
+            runInit(projectRoot, { force: false });
+            io.emit('manifest:changed', { action: 'initialized' });
+            res.json({ success: true });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── POST /manifest/update — run update or dry-run ──────
+    router.post('/manifest/update', (req, res) => {
+        const { dryRun = true } = req.body;
+        try {
+            // Ensure manifest exists (migrate legacy if needed)
+            let manifest = loadManifest(projectRoot);
+            if (!manifest && needsLegacyMigration(projectRoot)) {
+                migrateFromLegacy(projectRoot, templatesDir, packageVersion);
+                manifest = loadManifest(projectRoot);
+            }
+            if (!manifest) {
+                return res.status(400).json({ success: false, error: 'No manifest. Run orbital init first.' });
+            }
+            if (dryRun) {
+                refreshFileStatuses(manifest, claudeDir);
+                const renameMap = loadRenameMap(templatesDir, manifest.packageVersion, packageVersion);
+                const plan = computeUpdatePlan({
+                    templatesDir,
+                    claudeDir,
+                    manifest,
+                    newVersion: packageVersion,
+                    renameMap,
+                });
+                return res.json({ success: true, data: plan });
+            }
+            // Execute actual update
+            runUpdate(projectRoot, { dryRun: false });
+            io.emit('manifest:changed', { action: 'updated' });
+            res.json({ success: true });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── POST /manifest/pin — pin a file ───────────────────
+    router.post('/manifest/pin', (req, res) => {
+        const { file, reason } = req.body;
+        if (!file || !isValidRelativePath(file)) {
+            return res.status(400).json({ success: false, error: 'Valid file path required' });
+        }
+        try {
+            const manifest = loadManifest(projectRoot);
+            if (!manifest)
+                return res.status(400).json({ success: false, error: 'No manifest' });
+            const record = manifest.files[file];
+            if (!record)
+                return res.status(404).json({ success: false, error: 'File not tracked' });
+            if (record.origin === 'user')
+                return res.status(400).json({ success: false, error: 'Cannot pin user-owned file' });
+            record.status = 'pinned';
+            record.pinnedAt = new Date().toISOString();
+            if (reason)
+                record.pinnedReason = reason;
+            saveManifest(projectRoot, manifest);
+            io.emit('manifest:changed', { action: 'pinned', file });
+            res.json({ success: true });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── POST /manifest/unpin — unpin a file ────────────────
+    router.post('/manifest/unpin', (req, res) => {
+        const { file } = req.body;
+        if (!file || !isValidRelativePath(file)) {
+            return res.status(400).json({ success: false, error: 'Valid file path required' });
+        }
+        try {
+            const manifest = loadManifest(projectRoot);
+            if (!manifest)
+                return res.status(400).json({ success: false, error: 'No manifest' });
+            const record = manifest.files[file];
+            if (!record || record.status !== 'pinned') {
+                return res.status(400).json({ success: false, error: 'File is not pinned' });
+            }
+            // Clear pinned state before recomputing status
+            record.status = 'synced';
+            delete record.pinnedAt;
+            delete record.pinnedReason;
+            const absPath = path.join(claudeDir, file);
+            if (fs.existsSync(absPath)) {
+                const currentHash = hashFile(absPath);
+                record.status = computeFileStatus(record, currentHash);
+            }
+            saveManifest(projectRoot, manifest);
+            io.emit('manifest:changed', { action: 'unpinned', file });
+            res.json({ success: true });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── POST /manifest/reset — reset file to template ──────
+    router.post('/manifest/reset', (req, res) => {
+        const { file } = req.body;
+        if (!file || !isValidRelativePath(file)) {
+            return res.status(400).json({ success: false, error: 'Valid file path required' });
+        }
+        try {
+            const manifest = loadManifest(projectRoot);
+            if (!manifest)
+                return res.status(400).json({ success: false, error: 'No manifest' });
+            const record = manifest.files[file];
+            if (!record || record.origin !== 'template') {
+                return res.status(400).json({ success: false, error: 'Not a template file' });
+            }
+            // Resolve template source path
+            const templateRelPath = reverseRemapPath(file);
+            const templatePath = path.join(templatesDir, templateRelPath);
+            if (!fs.existsSync(templatePath)) {
+                return res.status(404).json({ success: false, error: 'Template file not found' });
+            }
+            const localPath = path.join(claudeDir, file);
+            // Back up current version so user can revert (symlink-safe)
+            safeBackupFile(localPath);
+            // Copy template to destination (skips if symlink)
+            safeCopyTemplate(templatePath, localPath);
+            const newHash = hashFile(localPath);
+            record.status = 'synced';
+            record.templateHash = newHash;
+            record.installedHash = newHash;
+            delete record.pinnedAt;
+            delete record.pinnedReason;
+            saveManifest(projectRoot, manifest);
+            io.emit('manifest:changed', { action: 'reset', file });
+            res.json({ success: true });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── POST /manifest/revert — restore file from .prev backup ──
+    router.post('/manifest/revert', (req, res) => {
+        const { file } = req.body;
+        if (!file || !isValidRelativePath(file)) {
+            return res.status(400).json({ success: false, error: 'Valid file path required' });
+        }
+        try {
+            const manifest = loadManifest(projectRoot);
+            if (!manifest)
+                return res.status(400).json({ success: false, error: 'No manifest' });
+            const record = manifest.files[file];
+            if (!record)
+                return res.status(404).json({ success: false, error: 'File not tracked' });
+            const localPath = path.join(claudeDir, file);
+            if (!safeRestoreFile(localPath)) {
+                return res.status(404).json({ success: false, error: 'No previous version available' });
+            }
+            // Recompute status — file may now be a symlink or regular file
+            if (fs.existsSync(localPath)) {
+                const stat = fs.lstatSync(localPath);
+                if (stat.isSymbolicLink()) {
+                    record.status = 'synced'; // restored symlink points at template
+                }
+                else {
+                    const currentHash = hashFile(localPath);
+                    record.installedHash = currentHash;
+                    record.status = computeFileStatus(record, currentHash);
+                }
+            }
+            else {
+                record.status = 'missing';
+            }
+            saveManifest(projectRoot, manifest);
+            io.emit('manifest:changed', { action: 'reverted', file });
+            res.json({ success: true });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    // ─── GET /manifest/diff — diff template vs local ─────────
+    router.get('/manifest/diff', (req, res) => {
+        const file = req.query.file;
+        if (!file || !isValidRelativePath(file)) {
+            return res.status(400).json({ success: false, error: 'Valid file path required' });
+        }
+        try {
+            const templateRelPath = reverseRemapPath(file);
+            const rawTemplatePath = path.join(templatesDir, templateRelPath);
+            // Resolve symlinks so git diff compares file content, not symlink metadata
+            const templatePath = fs.existsSync(rawTemplatePath) ? fs.realpathSync(rawTemplatePath) : rawTemplatePath;
+            const localPath = path.join(claudeDir, file);
+            if (!fs.existsSync(templatePath)) {
+                return res.status(404).json({ success: false, error: 'Template file not found' });
+            }
+            if (!fs.existsSync(localPath)) {
+                return res.status(404).json({ success: false, error: 'Local file not found' });
+            }
+            let diff = '';
+            try {
+                diff = execFileSync('git', ['diff', '--no-index', '--', templatePath, localPath], {
+                    encoding: 'utf-8',
+                });
+            }
+            catch (e) {
+                // git diff exits 1 when files differ
+                const err = e;
+                diff = err.stdout || 'Files differ';
+            }
+            res.json({ success: true, data: { diff } });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: errMsg(err) });
+        }
+    });
+    return router;
+}

package/dist/server/server/routes/scope-routes.js

@@ -2,10 +2,12 @@ import { Router } from 'express';
 import { spawn } from 'child_process';
 import { launchInTerminal, escapeForAnsiC, buildSessionName, snapshotSessionPids, discoverNewSession, renameSession } from '../utils/terminal-launcher.js';
 import { resolveDispatchEvent, linkPidToDispatch } from '../utils/dispatch-utils.js';
-import { getConfig } from '../config.js';
 import { createLogger } from '../utils/logger.js';
 const log = createLogger('dispatch');
-export function createScopeRoutes({ db, io, scopeService, readinessService, projectRoot, engine }) {
+function isValidSlug(slug) {
+    return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(slug) && slug.length <= 80;
+}
+export function createScopeRoutes({ db, io, scopeService, readinessService, projectRoot, projectName, engine }) {
     const router = Router();
     // ─── Scope CRUD ──────────────────────────────────────────
     router.get('/scopes', (_req, res) => {
@@ -45,7 +47,7 @@ export function createScopeRoutes({ db, io, scopeService, readinessService, proj
     });
     router.patch('/scopes/:id', (req, res) => {
         const id = Number(req.params.id);
-        const result = scopeService.updateScopeFrontmatter(id, req.body);
+        const result = scopeService.updateFields(id, req.body);
         if (!result.ok) {
             const code = result.code === 'NOT_FOUND' ? 404 : 400;
             res.status(code).json({ error: result.error, code: result.code });
@@ -64,32 +66,44 @@ export function createScopeRoutes({ db, io, scopeService, readinessService, proj
         const idea = scopeService.createIdeaFile(title.trim(), (description ?? '').trim());
         res.status(201).json(idea);
     });
-    router.patch('/ideas/:id', (req, res) => {
-        const id = Number(req.params.id);
+    router.patch('/ideas/:slug', (req, res) => {
+        const { slug } = req.params;
+        if (!isValidSlug(slug)) {
+            res.status(400).json({ error: 'Invalid slug' });
+            return;
+        }
         const { title, description } = req.body;
         if (!title?.trim()) {
             res.status(400).json({ error: 'title is required' });
             return;
         }
-        const updated = scopeService.updateIdeaFile(id, title.trim(), (description ?? '').trim());
+        const updated = scopeService.updateIdeaFile(slug, title.trim(), (description ?? '').trim());
         if (!updated) {
             res.status(404).json({ error: 'Idea not found' });
             return;
         }
         res.json({ ok: true });
     });
-    router.delete('/ideas/:id', (req, res) => {
-        const id = Number(req.params.id);
-        const deleted = scopeService.deleteIdeaFile(id);
+    router.delete('/ideas/:slug', (req, res) => {
+        const { slug } = req.params;
+        if (!isValidSlug(slug)) {
+            res.status(400).json({ error: 'Invalid slug' });
+            return;
+        }
+        const deleted = scopeService.deleteIdeaFile(slug);
         if (!deleted) {
             res.status(404).json({ error: 'Idea not found' });
             return;
         }
         res.json({ ok: true });
     });
-    router.post('/ideas/:id/promote', async (req, res) => {
-        const ideaId = Number(req.params.id);
-        const result = scopeService.promoteIdea(ideaId);
+    router.post('/ideas/:slug/promote', async (req, res) => {
+        const { slug } = req.params;
+        if (!isValidSlug(slug)) {
+            res.status(400).json({ error: 'Invalid slug' });
+            return;
+        }
+        const result = scopeService.promoteIdea(slug);
         if (!result) {
             res.status(404).json({ error: 'Idea not found' });
             return;
@@ -146,17 +160,14 @@ export function createScopeRoutes({ db, io, scopeService, readinessService, proj
             return;
         }
         surpriseInProgress = true;
-        const nextIdStart = scopeService.getNextIceboxId();
         const today = new Date().toISOString().split('T')[0];
-        const idRange = Array.from({ length: 5 }, (_, i) => nextIdStart + i);
-        const prompt = `You are analyzing the ${getConfig().projectName} codebase to suggest feature ideas. Your ONLY job is to create markdown files.
+        const prompt = `You are analyzing the ${projectName} codebase to suggest feature ideas. Your ONLY job is to create markdown files.
 
 Create exactly 3 idea files in the scopes/icebox/ directory. Each file must use this EXACT format:
 
-File: scopes/icebox/{ID}-{kebab-slug}.md
+File: scopes/icebox/{kebab-slug}.md
 
 ---
-id: {ID}
 title: "{title}"
 status: icebox
 ghost: true
@@ -169,13 +180,12 @@ tags: []
 
 {2-3 sentence description of the feature, what problem it solves, and a rough approach.}
 
-Use these IDs: ${idRange[0]}, ${idRange[1]}, ${idRange[2]}
-
 Rules:
 - Focus on practical improvements: performance, UX, security, developer experience, monitoring, or reliability
 - Be specific and actionable — not vague architectural rewrites
 - Keep descriptions concise (2-3 sentences max)
-- Filenames must be {ID}-{kebab-case-slug}.md
+- Filenames must be {kebab-case-slug}.md (NO numeric prefix)
+- Do NOT include an id field in frontmatter
 - The ghost: true field is required in frontmatter
 - Do NOT create any other files or make any other changes`;
         const child = spawn('claude', ['-p', prompt, '--output-format', 'text'], {
@@ -199,9 +209,13 @@ Rules:
         });
         res.json({ ok: true, status: 'generating' });
     });
-    router.post('/ideas/:id/approve', (req, res) => {
-        const id = Number(req.params.id);
-        const approved = scopeService.approveGhostIdea(id);
+    router.post('/ideas/:slug/approve', (req, res) => {
+        const { slug } = req.params;
+        if (!isValidSlug(slug)) {
+            res.status(400).json({ error: 'Invalid slug' });
+            return;
+        }
+        const approved = scopeService.approveGhostIdea(slug);
         if (!approved) {
             res.status(404).json({ error: 'Ghost idea not found' });
             return;

package/dist/server/server/routes/sync-routes.js

@@ -0,0 +1,134 @@
+import { Router } from 'express';
+import { isValidRelativePath } from '../utils/route-helpers.js';
+export function createSyncRoutes({ syncService, projectManager }) {
+    const router = Router();
+    // ─── Sync State ─────────────────────────────────────────
+    /** GET /sync/state/:projectId — sync state for a specific project */
+    router.get('/sync/state/:projectId', (req, res) => {
+        const ctx = projectManager.getContext(req.params.projectId);
+        if (!ctx)
+            return res.status(404).json({ error: 'Project not found' });
+        const report = syncService.computeSyncState(ctx.id, ctx.config.projectRoot);
+        res.json(report);
+    });
+    /** GET /sync/global-state — matrix view across all projects */
+    router.get('/sync/global-state', (_req, res) => {
+        const report = syncService.computeGlobalSyncState();
+        res.json(report);
+    });
+    // ─── Override Operations ────────────────────────────────
+    /** POST /sync/override — create an override for a file in a project */
+    router.post('/sync/override', (req, res) => {
+        const { projectId, relativePath, reason } = req.body;
+        if (!projectId || !relativePath) {
+            return res.status(400).json({ error: 'projectId and relativePath required' });
+        }
+        if (!isValidRelativePath(relativePath)) {
+            return res.status(400).json({ error: 'Invalid relativePath' });
+        }
+        const ctx = projectManager.getContext(projectId);
+        if (!ctx)
+            return res.status(404).json({ error: 'Project not found' });
+        syncService.createOverride(ctx.config.projectRoot, relativePath, reason);
+        res.json({ success: true });
+    });
+    /** POST /sync/revert — revert an override back to global */
+    router.post('/sync/revert', (req, res) => {
+        const { projectId, relativePath } = req.body;
+        if (!projectId || !relativePath) {
+            return res.status(400).json({ error: 'projectId and relativePath required' });
+        }
+        if (!isValidRelativePath(relativePath)) {
+            return res.status(400).json({ error: 'Invalid relativePath' });
+        }
+        const ctx = projectManager.getContext(projectId);
+        if (!ctx)
+            return res.status(404).json({ error: 'Project not found' });
+        syncService.revertOverride(ctx.config.projectRoot, relativePath);
+        res.json({ success: true });
+    });
+    /** POST /sync/promote — promote a project override to global */
+    router.post('/sync/promote', (req, res) => {
+        const { projectId, relativePath } = req.body;
+        if (!projectId || !relativePath) {
+            return res.status(400).json({ error: 'projectId and relativePath required' });
+        }
+        if (!isValidRelativePath(relativePath)) {
+            return res.status(400).json({ error: 'Invalid relativePath' });
+        }
+        const ctx = projectManager.getContext(projectId);
+        if (!ctx)
+            return res.status(404).json({ error: 'Project not found' });
+        const result = syncService.promoteOverride(ctx.config.projectRoot, relativePath);
+        res.json({ success: true, ...result });
+    });
+    /** POST /sync/resolve-drift — resolve a drifted file */
+    router.post('/sync/resolve-drift', (req, res) => {
+        const { projectId, relativePath, resolution } = req.body;
+        if (!projectId || !relativePath || !resolution) {
+            return res.status(400).json({ error: 'projectId, relativePath, and resolution required' });
+        }
+        if (!isValidRelativePath(relativePath)) {
+            return res.status(400).json({ error: 'Invalid relativePath' });
+        }
+        const ctx = projectManager.getContext(projectId);
+        if (!ctx)
+            return res.status(404).json({ error: 'Project not found' });
+        syncService.resolveDrift(ctx.config.projectRoot, relativePath, resolution);
+        res.json({ success: true });
+    });
+    // ─── Impact Preview ─────────────────────────────────────
+    /** GET /sync/impact?path=<relativePath> — preview impact of a global change */
+    router.get('/sync/impact', (req, res) => {
+        const relativePath = req.query.path;
+        if (!relativePath) {
+            return res.status(400).json({ error: 'path query parameter required' });
+        }
+        if (!isValidRelativePath(relativePath)) {
+            return res.status(400).json({ error: 'Invalid path' });
+        }
+        const preview = syncService.getImpactPreview(relativePath);
+        res.json(preview);
+    });
+    // ─── Project Management ─────────────────────────────────
+    /** GET /projects — list all registered projects */
+    router.get('/projects', (req, res) => {
+        const include = req.query.include;
+        res.json(projectManager.getProjectList({
+            includeWorkflow: include?.includes('workflow'),
+        }));
+    });
+    /** POST /projects — register a new project */
+    router.post('/projects', async (req, res) => {
+        const { path: projectPath, name, color } = req.body;
+        if (!projectPath) {
+            return res.status(400).json({ error: 'path required' });
+        }
+        try {
+            const summary = await projectManager.addProject(projectPath, { name, color });
+            res.status(201).json(summary);
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err) });
+        }
+    });
+    /** DELETE /projects/:id — unregister a project */
+    router.delete('/projects/:id', async (req, res) => {
+        const removed = await projectManager.removeProject(req.params.id);
+        if (!removed)
+            return res.status(404).json({ error: 'Project not found' });
+        res.json({ success: true });
+    });
+    /** PATCH /projects/:id — update project metadata */
+    router.patch('/projects/:id', async (req, res) => {
+        const { name, color, enabled } = req.body;
+        if (name !== undefined && !name.trim()) {
+            return res.status(400).json({ error: 'Name cannot be empty' });
+        }
+        const updated = await projectManager.updateProject(req.params.id, { name, color, enabled });
+        if (!updated)
+            return res.status(404).json({ error: 'Project not found' });
+        res.json(updated);
+    });
+    return router;
+}

package/dist/server/server/routes/version-routes.js

@@ -3,24 +3,10 @@ import { execFile } from 'child_process';
 import { promisify } from 'util';
 import path from 'path';
 import fs from 'fs';
-import { fileURLToPath } from 'url';
 import { createLogger } from '../utils/logger.js';
+import { getOrbitalRoot } from '../utils/package-info.js';
 const log = createLogger('version');
 const execFileAsync = promisify(execFile);
-/** Resolve the root directory of the orbital-command package itself. */
-function getOrbitalRoot() {
-    const __selfDir = path.dirname(fileURLToPath(import.meta.url));
-    // Walk up until we find package.json (handles both dev and compiled paths)
-    let dir = __selfDir;
-    for (let i = 0; i < 6; i++) {
-        if (fs.existsSync(path.join(dir, 'package.json'))) {
-            return dir;
-        }
-        dir = path.dirname(dir);
-    }
-    // Fallback: assume dev layout (server/routes/ → 2 levels up)
-    return path.resolve(__selfDir, '../..');
-}
 async function git(args, cwd, timeoutMs = 15_000) {
     const { stdout } = await execFileAsync('git', args, { cwd, timeout: timeoutMs });
     return stdout.trim();

package/dist/server/server/routes/workflow-routes.js

@@ -2,6 +2,7 @@ import { Router } from 'express';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { parseCcHooks } from '../utils/cc-hooks-parser.js';
+import { errMsg } from '../utils/route-helpers.js';
 export function createWorkflowRoutes({ workflowService, projectRoot }) {
     const router = Router();
     // GET /workflow — returns active config
@@ -121,6 +122,10 @@ export function createWorkflowRoutes({ workflowService, projectRoot }) {
                 return;
             }
             const filePath = path.resolve(projectRoot, hook.target);
+            if (!filePath.startsWith(projectRoot + path.sep) && filePath !== projectRoot) {
+                res.status(400).json({ success: false, error: 'Path outside project root' });
+                return;
+            }
             const content = await readFile(filePath, 'utf-8');
             const lineCount = content.split('\n').length;
             res.json({ success: true, data: { hookId, filePath: hook.target, content, lineCount } });
@@ -155,6 +160,10 @@ export function createWorkflowRoutes({ workflowService, projectRoot }) {
                 return;
             }
             const filePath = path.resolve(projectRoot, hookPath);
+            if (!filePath.startsWith(projectRoot + path.sep) && filePath !== projectRoot) {
+                res.status(400).json({ success: false, error: 'Path outside project root' });
+                return;
+            }
             const content = await readFile(filePath, 'utf-8');
             const lineCount = content.split('\n').length;
             res.json({ success: true, data: { filePath: hookPath, content, lineCount } });
@@ -180,6 +189,3 @@ export function createWorkflowRoutes({ workflowService, projectRoot }) {
     });
     return router;
 }
-function errMsg(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/server/server/schema.js

@@ -81,10 +81,12 @@ CREATE TABLE IF NOT EXISTS sprint_scopes (
 CREATE INDEX IF NOT EXISTS idx_events_type ON events(type);
 CREATE INDEX IF NOT EXISTS idx_events_timestamp ON events(timestamp);
 CREATE INDEX IF NOT EXISTS idx_events_scope_id ON events(scope_id);
+CREATE INDEX IF NOT EXISTS idx_events_type_timestamp ON events(type, timestamp);
 CREATE INDEX IF NOT EXISTS idx_gates_scope_id ON quality_gates(scope_id);
 CREATE INDEX IF NOT EXISTS idx_gates_run_at ON quality_gates(run_at);
 CREATE INDEX IF NOT EXISTS idx_deployments_env ON deployments(environment);
 CREATE INDEX IF NOT EXISTS idx_sessions_scope ON sessions(scope_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_claude_id ON sessions(claude_session_id);
 CREATE INDEX IF NOT EXISTS idx_sprints_status ON sprints(status);
 CREATE INDEX IF NOT EXISTS idx_sprint_scopes_sprint ON sprint_scopes(sprint_id);
 `;