patchwork-os 0.2.0-alpha.33 → 0.2.0-alpha.35

package/dist/recipesHttp.d.ts

@@ -1,3 +1,35 @@
+import { loadConfig } from "./patchworkConfig.js";
+/**
+ * Returns true unless `filePath` lives inside an install dir whose
+ * `.disabled` marker is present. Top-level legacy recipes (direct children
+ * of `recipesDir`) are always considered enabled — there's no install dir
+ * to put a marker in. Used by every trigger surface (webhook, manual fire,
+ * automation) so the marker means the same thing everywhere.
+ */
+export declare function isRecipeFileEnabled(filePath: string, recipesDir: string): boolean;
+/**
+ * Unified enable/disable for install-dir AND legacy top-level recipes.
+ *
+ * Routing:
+ *   1. Try to find an install dir whose entrypoint declares this `name`.
+ *      If found, write/remove the `.disabled` marker on that dir. This
+ *      matches CLI `recipe enable/disable` and the trigger-side
+ *      enforcement landed in PRs #43 / #49.
+ *   2. Otherwise the recipe is a top-level legacy file — fall back to
+ *      the legacy `cfg.recipes.disabled` config-file array, which the
+ *      scheduler already honors as a parallel mechanism (it checks both).
+ *
+ * Replaces the old dashboard-only `setRecipeEnabledFn` that wrote ONLY to
+ * the legacy config — which silently did nothing for install-dir recipes.
+ */
+export declare function setRecipeEnabled(name: string, enabled: boolean, options?: {
+    recipesDir?: string;
+    loadConfigFn?: typeof loadConfig;
+    saveConfigFn?: (cfg: unknown) => void;
+}): {
+    ok: boolean;
+    error?: string;
+};
 /**
  * Patchwork recipes HTTP surface — reads installed recipes from disk so the
  * dashboard Recipes page can list what's available. The bridge does not yet
@@ -39,10 +71,31 @@ export declare function saveRecipeContent(recipesDir: string, name: string, cont
     path?: string;
     error?: string;
 };
+/**
+ * Deletes a recipe file (yaml/yml or json) plus any sidecar permissions file.
+ * Returns ok=false with a 404-style error when the recipe cannot be located.
+ */
+export declare function deleteRecipeContent(recipesDir: string, name: string): {
+    ok: boolean;
+    path?: string;
+    error?: string;
+};
+/**
+ * Lints raw YAML/JSON recipe content without writing to disk. Used by the
+ * dashboard edit UI to surface validateRecipeDefinition warnings live, in
+ * addition to the warnings returned by saveRecipeContent on save.
+ */
+export declare function lintRecipeContent(content: string): {
+    ok: boolean;
+    errors: string[];
+    warnings: string[];
+};
 export interface RecipeSummary {
     name: string;
     description?: string;
     trigger?: string;
+    /** For webhook triggers, the configured path (e.g. "/github-pr"). */
+    webhookPath?: string;
     stepCount: number;
     path: string;
     installedAt: number;
@@ -55,6 +108,13 @@ export interface RecipeSummary {
         required?: boolean;
         default?: string;
     }>;
+    /** Lint summary so the dashboard list can flag invalid recipes without N+1 fetches. */
+    lint?: {
+        ok: boolean;
+        errorCount: number;
+        warningCount: number;
+        firstError?: string;
+    };
 }
 export interface ListRecipesResult {
     recipesDir: string;

package/dist/recipesHttp.js

@@ -1,8 +1,190 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { loadConfig } from "./patchworkConfig.js";
 import { validateRecipeDefinition } from "./recipes/validation.js";
+/**
+ * Per-recipe disabled marker — must match the constant in
+ * `src/commands/recipeInstall.ts` and `src/recipes/scheduler.ts` (kept inline
+ * here to avoid a circular import via commands → recipesHttp → commands).
+ *
+ * Absence on a recipe's install dir = enabled (legacy default).
+ * Presence = disabled — `runRecipeInstall` writes one on every fresh install.
+ */
+const DISABLED_MARKER = ".disabled";
+/**
+ * Returns true unless `filePath` lives inside an install dir whose
+ * `.disabled` marker is present. Top-level legacy recipes (direct children
+ * of `recipesDir`) are always considered enabled — there's no install dir
+ * to put a marker in. Used by every trigger surface (webhook, manual fire,
+ * automation) so the marker means the same thing everywhere.
+ */
+export function isRecipeFileEnabled(filePath, recipesDir) {
+    const rel = path.relative(recipesDir, filePath);
+    // Top-level file in recipesDir → no install dir → enabled by default.
+    if (rel === "" || rel.startsWith("..") || !rel.includes(path.sep)) {
+        return true;
+    }
+    const installDirName = rel.split(path.sep)[0];
+    if (!installDirName)
+        return true;
+    const installDir = path.join(recipesDir, installDirName);
+    return !existsSync(path.join(installDir, DISABLED_MARKER));
+}
+/**
+ * Iterate one level of subdirectories under `recipesDir` that look like
+ * install dirs (directory containing `recipe.json` or at least one `.yaml`).
+ * Skips dirs whose `.disabled` marker is present so callers automatically
+ * honor the marker without having to remember.
+ *
+ * Yields `{ installDir, entrypointPath }` pairs where `entrypointPath` is the
+ * file the caller should parse:
+ *   - `recipe.json`'s `recipes.main` if a manifest exists
+ *   - otherwise the first `*.yaml` / `*.yml` in the dir
+ *
+ * Used by webhook + manual-fire path resolvers to find recipes installed
+ * via `runRecipeInstall`.
+ */
+function* iterateInstallDirs(recipesDir, options = {}) {
+    const includeDisabled = options.includeDisabled === true;
+    let entries;
+    try {
+        entries = readdirSync(recipesDir);
+    }
+    catch {
+        return;
+    }
+    for (const f of entries) {
+        const fullPath = path.join(recipesDir, f);
+        let isDir = false;
+        try {
+            isDir = statSync(fullPath).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (!isDir)
+            continue;
+        const enabled = !existsSync(path.join(fullPath, DISABLED_MARKER));
+        if (!enabled && !includeDisabled)
+            continue;
+        let entrypoint = null;
+        const manifestPath = path.join(fullPath, "recipe.json");
+        if (existsSync(manifestPath)) {
+            try {
+                const m = JSON.parse(readFileSync(manifestPath, "utf-8"));
+                if (m.recipes?.main) {
+                    const candidate = path.join(fullPath, m.recipes.main);
+                    if (existsSync(candidate))
+                        entrypoint = candidate;
+                }
+            }
+            catch {
+                // malformed manifest — fall through to first-yaml fallback
+            }
+        }
+        if (!entrypoint) {
+            try {
+                const yaml = readdirSync(fullPath).find((x) => /\.ya?ml$/i.test(x));
+                if (yaml)
+                    entrypoint = path.join(fullPath, yaml);
+            }
+            catch {
+                // unreadable
+            }
+        }
+        if (entrypoint) {
+            yield { installDir: fullPath, entrypointPath: entrypoint, enabled };
+        }
+    }
+}
+/**
+ * Locate an install dir by the *recipe name* declared inside its entrypoint
+ * (not the directory name). The dashboard reports recipes by the parsed
+ * `name` field, while `runRecipeEnable` looks them up by dir name —
+ * the two are usually different (`morning-pkg` vs `morning-brief`). Includes
+ * disabled dirs so re-enabling actually finds them.
+ */
+function findInstallDirByRecipeName(recipesDir, name) {
+    for (const { installDir, entrypointPath } of iterateInstallDirs(recipesDir, {
+        includeDisabled: true,
+    })) {
+        try {
+            const ext = path.extname(entrypointPath).toLowerCase();
+            const raw = readFileSync(entrypointPath, "utf-8");
+            const parsed = (ext === ".json" ? JSON.parse(raw) : parseYaml(raw));
+            if (parsed.name === name)
+                return installDir;
+        }
+        catch {
+            // skip malformed
+        }
+    }
+    return null;
+}
+/**
+ * Unified enable/disable for install-dir AND legacy top-level recipes.
+ *
+ * Routing:
+ *   1. Try to find an install dir whose entrypoint declares this `name`.
+ *      If found, write/remove the `.disabled` marker on that dir. This
+ *      matches CLI `recipe enable/disable` and the trigger-side
+ *      enforcement landed in PRs #43 / #49.
+ *   2. Otherwise the recipe is a top-level legacy file — fall back to
+ *      the legacy `cfg.recipes.disabled` config-file array, which the
+ *      scheduler already honors as a parallel mechanism (it checks both).
+ *
+ * Replaces the old dashboard-only `setRecipeEnabledFn` that wrote ONLY to
+ * the legacy config — which silently did nothing for install-dir recipes.
+ */
+export function setRecipeEnabled(name, enabled, options = {}) {
+    const recipesDir = options.recipesDir ?? path.join(os.homedir(), ".patchwork", "recipes");
+    try {
+        const installDir = findInstallDirByRecipeName(recipesDir, name);
+        if (installDir) {
+            const markerPath = path.join(installDir, DISABLED_MARKER);
+            if (enabled) {
+                if (existsSync(markerPath))
+                    rmSync(markerPath);
+            }
+            else {
+                writeFileSync(markerPath, "");
+            }
+            return { ok: true };
+        }
+        // Legacy top-level path — fall back to config-file disabled list
+        const cfg = (options.loadConfigFn ?? loadConfig)();
+        const disabled = new Set(cfg.recipes?.disabled ?? []);
+        if (enabled)
+            disabled.delete(name);
+        else
+            disabled.add(name);
+        const next = {
+            ...cfg,
+            recipes: {
+                ...(cfg.recipes ?? {}),
+                disabled: [...disabled],
+            },
+        };
+        if (options.saveConfigFn)
+            options.saveConfigFn(next);
+        else {
+            // Dynamic import to avoid coupling at module-load time and to keep
+            // tests able to swap the saver via options.saveConfigFn.
+            // biome-ignore lint/suspicious/noExplicitAny: dynamic require shape
+            const mod = require("./patchworkConfig.js");
+            mod.savePatchworkConfig(next);
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
 function normalizeRecipeDraftTrigger(trigger) {
     if (trigger.type === "schedule" || trigger.type === "cron") {
         const schedule = typeof trigger.schedule === "string" && trigger.schedule.trim()
@@ -170,6 +352,22 @@ function resolveJsonRecipePathByName(recipesDir, safeName) {
     catch {
         return null;
     }
+    // Also search install dirs from `recipeInstall`. Skips dirs with
+    // `.disabled` marker so the manual-fire / orchestrator path can't
+    // resolve a recipe the user has explicitly disabled.
+    for (const { entrypointPath } of iterateInstallDirs(recipesDir)) {
+        if (!entrypointPath.endsWith(".json"))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(entrypointPath, "utf-8"));
+            if (parsed.name?.toLowerCase() === safeName) {
+                return entrypointPath;
+            }
+        }
+        catch {
+            // skip malformed
+        }
+    }
     return null;
 }
 export function loadRecipeContent(recipesDir, name) {
@@ -221,9 +419,16 @@ export function saveRecipeContent(recipesDir, name, content) {
         };
     }
     const validation = validateRecipeDefinition(parsed);
+    const warnings = validation.issues
+        .filter((issue) => issue.level === "warning")
+        .map((issue) => issue.message);
     const validationError = validation.issues.find((issue) => issue.level === "error");
     if (validationError) {
-        return { ok: false, error: validationError.message };
+        return {
+            ok: false,
+            error: validationError.message,
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
     }
     try {
         mkdirSync(recipesDir, { recursive: true });
@@ -234,7 +439,50 @@ export function saveRecipeContent(recipesDir, name, content) {
             return { ok: false, error: "Invalid path" };
         }
         writeFileSync(candidate, content.endsWith("\n") ? content : `${content}\n`, "utf-8");
-        return { ok: true, path: candidate };
+        return {
+            ok: true,
+            path: candidate,
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/**
+ * Deletes a recipe file (yaml/yml or json) plus any sidecar permissions file.
+ * Returns ok=false with a 404-style error when the recipe cannot be located.
+ */
+export function deleteRecipeContent(recipesDir, name) {
+    const safeName = name.toLowerCase();
+    if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(safeName)) {
+        return { ok: false, error: "Invalid recipe name" };
+    }
+    const base = path.resolve(recipesDir);
+    const target = findYamlRecipePath(recipesDir, safeName) ??
+        resolveJsonRecipePathByName(recipesDir, safeName);
+    if (!target) {
+        return { ok: false, error: "Recipe not found" };
+    }
+    const resolved = path.resolve(target);
+    if (!resolved.startsWith(base + path.sep)) {
+        return { ok: false, error: "Invalid path" };
+    }
+    try {
+        rmSync(resolved, { force: true });
+        const sidecar = `${resolved}.permissions.json`;
+        if (existsSync(sidecar)) {
+            try {
+                rmSync(sidecar, { force: true });
+            }
+            catch {
+                // sidecar removal best-effort
+            }
+        }
+        return { ok: true, path: resolved };
     }
     catch (err) {
         return {
@@ -243,6 +491,37 @@ export function saveRecipeContent(recipesDir, name, content) {
         };
     }
 }
+/**
+ * Lints raw YAML/JSON recipe content without writing to disk. Used by the
+ * dashboard edit UI to surface validateRecipeDefinition warnings live, in
+ * addition to the warnings returned by saveRecipeContent on save.
+ */
+export function lintRecipeContent(content) {
+    if (!content.trim()) {
+        return { ok: false, errors: ["Recipe content is required"], warnings: [] };
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(content);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            errors: [err instanceof Error ? err.message : String(err)],
+            warnings: [],
+        };
+    }
+    const validation = validateRecipeDefinition(parsed);
+    const errors = [];
+    const warnings = [];
+    for (const issue of validation.issues) {
+        if (issue.level === "error")
+            errors.push(issue.message);
+        else
+            warnings.push(issue.message);
+    }
+    return { ok: errors.length === 0, errors, warnings };
+}
 export function listInstalledRecipes(recipesDir) {
     let entries;
     try {
@@ -287,25 +566,118 @@ export function listInstalledRecipes(recipesDir) {
             }
             const ext = isYaml ? (f.endsWith(".yml") ? ".yml" : ".yaml") : ".json";
             const parsedName = parsed.name ?? path.basename(f, ext);
+            const lintRes = validateRecipeDefinition(parsed);
+            let errCount = 0;
+            let warnCount = 0;
+            let firstError;
+            for (const issue of lintRes.issues) {
+                if (issue.level === "error") {
+                    errCount++;
+                    if (!firstError)
+                        firstError = issue.message;
+                }
+                else {
+                    warnCount++;
+                }
+            }
+            const webhookPath = parsed.trigger?.type === "webhook" &&
+                typeof parsed.trigger?.path === "string"
+                ? parsed.trigger.path
+                : undefined;
             recipes.push({
                 name: parsedName,
                 description: parsed.description,
                 trigger: parsed.trigger?.type,
+                ...(webhookPath ? { webhookPath } : {}),
                 stepCount: Array.isArray(parsed.steps) ? parsed.steps.length : 0,
                 path: fullPath,
                 installedAt: stat.mtimeMs,
                 hasPermissions,
                 source,
+                // Top-level legacy recipes don't have install dirs to put a marker
+                // in, so the `enabled` field still comes from the legacy config list.
                 enabled: !disabledSet.has(parsedName),
                 ...(Array.isArray(parsed.vars) && parsed.vars.length > 0
                     ? { vars: parsed.vars }
                     : {}),
+                lint: {
+                    ok: errCount === 0,
+                    errorCount: errCount,
+                    warningCount: warnCount,
+                    ...(firstError ? { firstError } : {}),
+                },
             });
         }
         catch {
             // skip malformed recipe file
         }
     }
+    // Second pass — recipes installed via `runRecipeInstall` into subdirs.
+    // `enabled` reflects the per-install `.disabled` marker; the legacy
+    // config disabled list is a top-level concern (we still apply it as a
+    // safety belt in case a name collides).
+    for (const { installDir, entrypointPath, enabled: installEnabled, } of iterateInstallDirs(recipesDir, { includeDisabled: true })) {
+        try {
+            const ext = path.extname(entrypointPath).toLowerCase();
+            const isYaml = ext === ".yaml" || ext === ".yml";
+            const isJson = ext === ".json";
+            if (!isYaml && !isJson)
+                continue;
+            const raw = readFileSync(entrypointPath, "utf-8");
+            const parsed = (isYaml ? parseYaml(raw) : JSON.parse(raw));
+            const stat = statSync(entrypointPath);
+            const parsedName = parsed.name ??
+                path.basename(entrypointPath, path.extname(entrypointPath));
+            const lintRes = validateRecipeDefinition(parsed);
+            let errCount = 0;
+            let warnCount = 0;
+            let firstError;
+            for (const issue of lintRes.issues) {
+                if (issue.level === "error") {
+                    errCount++;
+                    if (!firstError)
+                        firstError = issue.message;
+                }
+                else {
+                    warnCount++;
+                }
+            }
+            const webhookPath = parsed.trigger?.type === "webhook" &&
+                typeof parsed.trigger?.path === "string"
+                ? parsed.trigger.path
+                : undefined;
+            recipes.push({
+                name: parsedName,
+                description: parsed.description,
+                trigger: parsed.trigger?.type,
+                ...(webhookPath ? { webhookPath } : {}),
+                stepCount: Array.isArray(parsed.steps) ? parsed.steps.length : 0,
+                path: entrypointPath,
+                installedAt: stat.mtimeMs,
+                hasPermissions: false,
+                source: "user",
+                // Disabled if EITHER the install marker is set OR the legacy config
+                // names this recipe — defence-in-depth so a stale config entry can't
+                // accidentally re-enable a recipe the user explicitly disabled, and
+                // the dashboard can't accidentally enable one disabled by an admin
+                // through the legacy file.
+                enabled: installEnabled && !disabledSet.has(parsedName),
+                ...(Array.isArray(parsed.vars) && parsed.vars.length > 0
+                    ? { vars: parsed.vars }
+                    : {}),
+                lint: {
+                    ok: errCount === 0,
+                    errorCount: errCount,
+                    warningCount: warnCount,
+                    ...(firstError ? { firstError } : {}),
+                },
+            });
+            void installDir;
+        }
+        catch {
+            // skip malformed install dir
+        }
+    }
     recipes.sort((a, b) => a.name.localeCompare(b.name));
     return { recipesDir, recipes };
 }
@@ -348,6 +720,22 @@ export function findYamlRecipePath(recipesDir, name) {
             // skip malformed candidate
         }
     }
+    // Also search install dirs from `recipeInstall`. Skips dirs with
+    // `.disabled` marker so the manual-fire / orchestrator path can't
+    // resolve a recipe the user has explicitly disabled.
+    for (const { entrypointPath } of iterateInstallDirs(recipesDir)) {
+        if (!/\.ya?ml$/i.test(entrypointPath))
+            continue;
+        try {
+            const parsed = parseYaml(readFileSync(entrypointPath, "utf-8"));
+            if (parsed.name?.toLowerCase() === safeName) {
+                return entrypointPath;
+            }
+        }
+        catch {
+            // skip malformed
+        }
+    }
     return null;
 }
 /**
@@ -363,6 +751,7 @@ export function findWebhookRecipe(recipesDir, requestPath) {
     catch {
         return null;
     }
+    // Pass 1 — top-level files (legacy)
     for (const f of entries) {
         const isYaml = f.endsWith(".yaml") || f.endsWith(".yml");
         const isJson = f.endsWith(".json") && !f.endsWith(".permissions.json");
@@ -387,6 +776,32 @@ export function findWebhookRecipe(recipesDir, requestPath) {
             // skip malformed
         }
     }
+    // Pass 2 — install dirs (skips dirs marked .disabled).
+    for (const { entrypointPath } of iterateInstallDirs(recipesDir)) {
+        const ext = path.extname(entrypointPath).toLowerCase();
+        const isYaml = ext === ".yaml" || ext === ".yml";
+        const isJson = ext === ".json";
+        if (!isYaml && !isJson)
+            continue;
+        try {
+            const raw = readFileSync(entrypointPath, "utf-8");
+            const parsed = (isYaml ? parseYaml(raw) : JSON.parse(raw));
+            if (parsed.trigger?.type !== "webhook")
+                continue;
+            if (parsed.trigger.path === requestPath) {
+                return {
+                    name: parsed.name ??
+                        path.basename(entrypointPath, path.extname(entrypointPath)),
+                    path: requestPath,
+                    filePath: entrypointPath,
+                    format: isYaml ? "yaml" : "json",
+                };
+            }
+        }
+        catch {
+            // skip malformed
+        }
+    }
     return null;
 }
 /**