qiksy 1.0.0

package/tools/travel/vendor/docs/ENGINE-MIGRATION.md

@@ -0,0 +1,33 @@
+# Travel → Qiksy Engine: what this backend brings with it
+
+Travel is folded into [products/qiksy-engine](../../qiksy-engine/ARCHITECTURE.md) **last**
+(stage 4 there), because this folder was being rewritten while the engine was being built.
+This file is the handover: what changed here on 2026-07-25, so the port picks it up instead
+of copying an older shape.
+
+## The product changed, not just the code
+
+Travel is no longer "an HR assistant for company trips". It is **one person planning their
+own trips (free) and a travel agency running other people's trips (Pro)** — owner decision
+2026-07-25. That is why the paywall moved from *number of travellers* to *number of groups*.
+
+## What the module must carry over
+
+| Piece | Where | Why it matters |
+|---|---|---|
+| **Parties (groups)** | `lib/store.mjs` (`parties`, `SELF_PARTY_ID`, migration), `server.mjs` `/api/parties` CRUD | The whole billing axis. A traveller and a trip each carry `partyId`; the migration back-fills existing rows into the owner's own group, so an upgrade needs no manual re-assignment. |
+| **Plan shape** | `lib/plans.mjs` | `partyLimit` (free 1 · pro ∞) is the paywall; `travelerLimit` (free 8) only stops a runaway list inside one family. `teamLimit` stays as a compat alias. |
+| **Machine-code errors** | `server.mjs` (`PARTY_LIMIT:1`, `TRAVELER_LIMIT:8`) | The UI translates them; the backend must NOT send prose for these, or a Ukrainian user gets a Russian sentence. The frontend suppresses the toast for `^[A-Z_]+:` errors. |
+| **Agent steps** | `lib/jobs.mjs` (`steps`, `jobStep`), `lib/agent.mjs` (`onStep`, `reportStep`) | Feeds the live "theatre" — what the agent is doing in words. **The WF copy of `jobs.mjs` does NOT have this** (it has the `jobEvents` SSE bus instead). The core version needs BOTH: the bus pushes instantly, the steps say what happened. |
+| **Interrupted-trip recovery** | `server.mjs` (`recoverInterruptedTrips`) | Jobs are in memory, statuses are on disk, so every restart used to freeze trips in `searching` forever. On boot, `searching → draft` (or `options` if partials survived), `booking → options`, with a line in the trip's activity. Any tool with long jobs wants this in the core. |
+| **Client proposal** | `lib/proposal.mjs`, `GET /api/trips/:id/proposal?lang=` | The Pro feature: the whole selection as one self-contained HTML page under the agency's own name. Pure rendering, no deps, `402` below Pro. Brand header comes from `settings.brandName/brandContact/brandNote`. |
+
+## Frontend side
+
+`apps/travel-assistant/src/app/api.ts` is the single place the base URL lives
+(`API_BASE`, `ENGINE_URL`, `apiUrl()`). Mounting Travel at `/api/travel` on port 5544 is a
+one-line change there — the controller, the app shell and the engine probe all read it.
+
+`apiUrl()` exists because a relative `fetch('/api/…')` silently resolves against
+`qiksy.app` in the production build (that bug shipped for `/api/parse-route`). Anything the
+browser opens directly — a new tab, a download — must go through it.

package/tools/travel/vendor/lib/agent.mjs

@@ -0,0 +1,190 @@
+/**
+ * Headless Claude Code runner: spawns `claude -p` with stream-json output,
+ * feeds tool-use events to onEvent (job log), returns the final result text.
+ * Калька с work-finder/lib/agent.mjs; партиалы здесь — строки `OPTION: {...}`.
+ */
+import { spawnClaude } from './spawn-claude.mjs';
+import { resolve } from 'node:path';
+import { ROOT } from './store.mjs';
+
+// Все живые дочерние агенты: убиваем при остановке сервера, чтобы
+// осиротевшие claude-процессы не дожигали токены в пустоту.
+const activeChildren = new Set();
+function killAllChildren() {
+  for (const child of activeChildren) {
+    try { child.kill('SIGKILL'); } catch { /* already dead */ }
+  }
+  activeChildren.clear();
+}
+for (const sig of ['SIGINT', 'SIGTERM']) {
+  process.on(sig, () => { killAllChildren(); process.exit(0); });
+}
+process.on('exit', killAllChildren);
+
+const APPROVER_SERVER = {
+  type: 'stdio',
+  command: process.execPath,
+  args: [resolve(ROOT, 'scripts/approver-mcp.mjs')],
+};
+const PLAYWRIGHT_SERVER = {
+  type: 'stdio',
+  command: 'npx',
+  args: ['@playwright/mcp@latest', '--cdp-endpoint', 'http://localhost:9222'],
+};
+
+/** Hostname of a URL, without the www — the label a source chip shows. */
+function hostOf(url) {
+  try { return new URL(String(url)).hostname.replace(/^www\./, ''); } catch { return ''; }
+}
+
+/**
+ * A tool call as a sentence a traveller can read: which site is being opened, what
+ * is being looked up. Anything unrecognised is deliberately dropped rather than
+ * shown raw — "ToolSearch {"query":"select:WebSearch,WebFetch"}" tells the person
+ * waiting for their flights precisely nothing.
+ */
+function reportStep(block, onStep) {
+  const name = block.name || '';
+  const inp = block.input || {};
+  if (name === 'WebSearch') return onStep('search', inp.query || '');
+  if (name === 'WebFetch') return onStep('read', inp.prompt || '', hostOf(inp.url));
+  if (name.startsWith('mcp__playwright__browser_navigate')) return onStep('browse', '', hostOf(inp.url));
+  if (name.startsWith('mcp__playwright__browser_')) {
+    const what = name.replace('mcp__playwright__browser_', '');
+    return onStep('browse', what === 'snapshot' ? '' : what);
+  }
+}
+
+export function runClaude({
+  prompt,
+  allowedTools = [], // built-in tools the agent may use; [] = no built-ins
+  withBrowser = false,
+  model = 'sonnet',
+  timeoutMs = 10 * 60_000,
+  onEvent = () => {},
+  onStep = null, // (kind, text, host) => void — читаемый ход агента для «театра» в UI
+  onPartial = null, // (obj) => void — строки `OPTION: {...}` из текста агента, по мере готовности
+  signal = null, // AbortSignal — отмена задачи пользователем
+}) {
+  return new Promise(resolvePromise => {
+    // The user's global settings put WebSearch/WebFetch in the "ask" list,
+    // which auto-denies in -p mode and overrides --allowedTools and even
+    // --dangerously-skip-permissions. So permissions go through our own
+    // approver MCP server (--permission-prompt-tool) with a whitelist,
+    // and --tools hard-limits the built-in toolset (no Bash/Edit/Write).
+    const mcpServers = { approver: APPROVER_SERVER };
+    if (withBrowser) mcpServers.playwright = PLAYWRIGHT_SERVER;
+    const args = [
+      '-p', prompt,
+      '--output-format', 'stream-json', '--verbose',
+      '--model', model,
+      '--tools', allowedTools.length ? [...allowedTools, 'ToolSearch'].join(',') : '',
+      '--mcp-config', JSON.stringify({ mcpServers }),
+      '--strict-mcp-config',
+      '--permission-prompt-tool', 'mcp__approver__approve',
+    ];
+    // Playwright is intentionally NOT pre-approved here: listing it in
+    // --allowedTools would skip the permission-prompt-tool, so every browser
+    // call is gated by the approver (which denies evaluate/file_upload/run_code_unsafe).
+    if (allowedTools.length) args.push('--allowedTools', allowedTools.join(','));
+
+    // A nested interactive session is refused, but `-p` is fine; strip the
+    // markers anyway so the child never thinks it is inside another session.
+    const env = { ...process.env };
+    delete env.CLAUDECODE;
+    delete env.CLAUDE_CODE_ENTRYPOINT;
+
+    const child = spawnClaude(args, { cwd: ROOT, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    activeChildren.add(child);
+    child.on('close', () => activeChildren.delete(child));
+
+    let resultText = '';
+    let errText = '';
+    let costUsd = null;
+    let settled = false;
+    let partialBuf = '';
+    let partialsEmitted = 0;
+    const t0 = Date.now();
+
+    const finish = out => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolvePromise({ durationMs: Date.now() - t0, costUsd, ...out });
+    };
+
+    const timer = setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch { /* already dead */ }
+      finish({ ok: false, error: `timeout after ${Math.round(timeoutMs / 1000)}s` });
+    }, timeoutMs);
+
+    if (signal) {
+      const onAbort = () => {
+        try { child.kill('SIGKILL'); } catch { /* already dead */ }
+        finish({ ok: false, error: 'отменено' });
+      };
+      if (signal.aborted) onAbort();
+      else signal.addEventListener('abort', onAbort, { once: true });
+    }
+
+    let buf = '';
+    child.stdout.on('data', chunk => {
+      buf += chunk;
+      let nl;
+      while ((nl = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, nl).trim();
+        buf = buf.slice(nl + 1);
+        if (!line) continue;
+        let ev;
+        try { ev = JSON.parse(line); } catch { continue; }
+        if (ev.type === 'assistant') {
+          for (const block of ev.message?.content || []) {
+            if (block.type === 'tool_use') {
+              const input = JSON.stringify(block.input || {});
+              onEvent(`⚙ ${block.name} ${input.length > 160 ? input.slice(0, 160) + '…' : input}`);
+              if (onStep) reportStep(block, onStep);
+            } else if (block.type === 'text' && block.text && onPartial) {
+              partialBuf += block.text + '\n';
+              const matches = [...partialBuf.matchAll(/^OPTION:\s*(\{.*\})\s*$/gm)];
+              for (let i = partialsEmitted; i < matches.length; i++) {
+                try { onPartial(JSON.parse(matches[i][1])); } catch { /* побитый партиал — придёт в финальном JSON */ }
+              }
+              partialsEmitted = Math.max(partialsEmitted, matches.length);
+            }
+          }
+        } else if (ev.type === 'result') {
+          resultText = ev.result || '';
+          costUsd = ev.total_cost_usd ?? null;
+          if (ev.is_error) errText = resultText || ev.subtype || 'agent error';
+        }
+      }
+    });
+    child.stderr.on('data', chunk => { errText += chunk; });
+
+    child.on('error', err => finish({ ok: false, error: `spawn failed: ${err.message}` }));
+    child.on('close', code => {
+      if (code === 0 && resultText) finish({ ok: true, result: resultText });
+      else finish({ ok: false, error: (errText || `claude exited with code ${code}`).slice(0, 2000) });
+    });
+  });
+}
+
+/** Pull a JSON value out of agent prose: direct parse → fenced block → object slice → array slice. */
+export function extractJson(text) {
+  if (!text) return null;
+  const attempts = [text.trim()];
+  const fence = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+  if (fence) attempts.push(fence[1].trim());
+  // Object slice first: all agents return a top-level {options,summary,...}
+  // object; slicing [...] first would grab the inner options array and drop it.
+  const firstObj = text.indexOf('{');
+  const lastObj = text.lastIndexOf('}');
+  if (firstObj >= 0 && lastObj > firstObj) attempts.push(text.slice(firstObj, lastObj + 1));
+  const firstArr = text.indexOf('[');
+  const lastArr = text.lastIndexOf(']');
+  if (firstArr >= 0 && lastArr > firstArr) attempts.push(text.slice(firstArr, lastArr + 1));
+  for (const candidate of attempts) {
+    try { return JSON.parse(candidate); } catch { /* next */ }
+  }
+  return null;
+}

package/tools/travel/vendor/lib/engine.mjs

@@ -0,0 +1,283 @@
+/**
+ * Can this machine actually run the agent — and how is it paying?
+ *
+ * The tools are local-first: the work is done by the `claude` CLI on the user's own
+ * machine. That CLI authenticates in one of two ways — a Claude subscription it was
+ * signed into once, or an Anthropic API key. Both work, and they are BILLED FROM
+ * DIFFERENT WALLETS: a claude.ai subscription grants no API credit, and an API key
+ * gives no subscription.
+ *
+ * This matters because the gate used to demand an API key from everyone, and two of
+ * the three tools never even forwarded it — they spawn `claude` with the ambient
+ * environment. So a Max subscriber with a working setup was sent to buy credits for a
+ * credential the engine ignored. The question is not "do you have a key" but "can this
+ * machine run it", and only the machine can answer.
+ *
+ * `claude auth status` answers it for free and instantly — no tokens, no round trip to
+ * Anthropic's inference API. It is also the only way to see the SUBSCRIPTION behind an
+ * API key: with ANTHROPIC_API_KEY set the CLI reports `apiKeySource` and hides the
+ * account, so the probe deliberately runs without it.
+ */
+
+import { spawnClaude } from './spawn-claude.mjs';
+
+const TTL_MS = 60 * 1000;
+
+let cached = null;
+let inflight = null;
+
+function cleanEnv() {
+  const env = { ...process.env };
+  // The same strip the agent runner does: a CLI spawned from inside Claude Code
+  // otherwise inherits markers that change how it behaves.
+  delete env.CLAUDECODE;
+  delete env.CLAUDE_CODE_ENTRYPOINT;
+  // Deliberately removed: the machine's own auth is exactly what we are asking
+  // about. With a key in the environment the CLI reports the key and nothing about
+  // the subscription underneath it.
+  delete env.ANTHROPIC_API_KEY;
+  return env;
+}
+
+function run(args, { timeoutMs = 20_000, detached = false } = {}) {
+  return new Promise((resolve) => {
+    const env = cleanEnv();
+
+    let out = '';
+    let err = '';
+    let done = false;
+    let child;
+    try {
+      child = spawnClaude(args, {
+        env,
+        detached,
+        stdio: detached ? 'ignore' : ['ignore', 'pipe', 'pipe'],
+      });
+    } catch (e) {
+      return resolve({ code: null, out, err: e.code === 'ENOENT' ? 'not-installed' : e.message });
+    }
+    if (detached) {
+      child.unref();
+      return resolve({ code: 0, out, err });
+    }
+
+    const timer = setTimeout(() => {
+      if (done) return;
+      done = true;
+      child.kill('SIGKILL');
+      resolve({ code: null, out, err: 'timeout' });
+    }, timeoutMs);
+
+    child.stdout.on('data', (d) => (out += d));
+    child.stderr.on('data', (d) => (err += d));
+    child.on('error', (e) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve({ code: null, out, err: e.code === 'ENOENT' ? 'not-installed' : e.message });
+    });
+    child.on('close', (code) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve({ code, out, err });
+    });
+  });
+}
+
+function parse(out) {
+  try {
+    const i = out.indexOf('{');
+    const j = out.lastIndexOf('}');
+    return i >= 0 && j > i ? JSON.parse(out.slice(i, j + 1)) : null;
+  } catch {
+    return null;
+  }
+}
+
+async function measure() {
+  const r = await run(['auth', 'status']);
+  if (r.err === 'not-installed') {
+    return { ok: false, mode: 'none', reason: 'cli-missing', account: null, plan: null };
+  }
+  const st = parse(r.out);
+  if (!st) {
+    return {
+      ok: false,
+      mode: 'none',
+      reason: 'cli-broken',
+      account: null,
+      plan: null,
+      detail: (r.err || r.out || '').slice(0, 300),
+    };
+  }
+  if (!st.loggedIn) {
+    return { ok: false, mode: 'none', reason: 'not-authenticated', account: null, plan: null };
+  }
+  // Signed in with a claude.ai account → the subscription pays, no key needed.
+  // Anything else means the CLI is leaning on API billing, which needs credit.
+  const bySubscription = st.authMethod === 'claude.ai' && !st.apiKeySource;
+  return {
+    ok: true,
+    mode: bySubscription ? 'subscription' : 'key',
+    reason: null,
+    account: st.email ?? null,
+    plan: st.subscriptionType ?? null,
+  };
+}
+
+/**
+ * @param {{force?: boolean}} [opts]
+ * @returns {Promise<{ok:boolean, mode:'subscription'|'key'|'none', reason:string|null,
+ *   account:string|null, plan:string|null, checkedAt:number}>}
+ */
+export async function probeEngine({ force = false } = {}) {
+  if (cached && !force && Date.now() - cached.checkedAt < TTL_MS) return cached;
+  // One probe at a time: three panels opening at once must not spawn three CLIs.
+  if (inflight) return inflight;
+  inflight = measure()
+    .then((r) => {
+      cached = { ...r, checkedAt: Date.now() };
+      return cached;
+    })
+    .finally(() => {
+      inflight = null;
+    });
+  return inflight;
+}
+
+/* ── sign-in ─────────────────────────────────────────────────────────────────
+ * We do not build a "connect with Claude" of our own — there is no such thing for a
+ * third-party app, and faking one would be exactly the wrong instinct. What we do is
+ * run Anthropic's own `claude auth login` here and HAND THE USER ITS LINK.
+ *
+ * The CLI prints the authorize URL on its first line of output and then waits for the
+ * flow to land either way: its loopback callback fires (the browser is on this machine
+ * and can reach it), or the person pastes back the code the callback page shows them.
+ * Both endings are kept open, which is why stdout is READ instead of thrown away and
+ * stdin stays a live pipe — the old version spawned this detached with `stdio:'ignore'`
+ * and so could neither show the link nor accept the code, leaving the user with a
+ * browser tab and a button that had visibly done nothing.
+ */
+
+/** The one login in flight: { child, url, done, ok, startedAt }. */
+let login = null;
+/** An abandoned sign-in must not leave a CLI sitting on the machine forever. */
+const LOGIN_TTL_MS = 10 * 60 * 1000;
+const URL_RE = /(https?:\/\/[^\s"'<>]+)/;
+
+function endLogin() {
+  if (!login || login.done) return;
+  login.done = true;
+  try {
+    login.child.kill('SIGKILL');
+  } catch {
+    /* already gone */
+  }
+}
+
+/**
+ * Launch the sign-in and return the URL to put in front of the user.
+ *
+ * @returns {Promise<{ok:boolean, url?:string, reason?:string}>}
+ */
+export async function startLogin() {
+  /* Idempotent while one is running. Every spawn mints a FRESH PKCE challenge and
+     invalidates the previous one, so re-opening the dialog (or a second panel asking)
+     must hand back the SAME link — otherwise the URL the user already copied dies in
+     their clipboard and the sign-in fails with nothing on screen to explain why. */
+  if (login && !login.done && login.url && Date.now() - login.startedAt < LOGIN_TTL_MS) {
+    return { ok: true, url: login.url };
+  }
+  endLogin();
+
+  const probe = await run(['--version'], { timeoutMs: 10_000 });
+  if (probe.err === 'not-installed') return { ok: false, reason: 'cli-missing' };
+
+  let child;
+  try {
+    child = spawnClaude(['auth', 'login', '--claudeai'], {
+      env: cleanEnv(),
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch {
+    return { ok: false, reason: 'login-failed' };
+  }
+
+  const state = { child, url: null, done: false, ok: false, startedAt: Date.now() };
+  login = state;
+  cached = null; // the answer is about to change
+
+  const ttl = setTimeout(endLogin, LOGIN_TTL_MS);
+  ttl.unref?.();
+
+  return new Promise((resolve) => {
+    let out = '';
+    let settled = false;
+    const give = (r) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(wait);
+      resolve(r);
+    };
+    /* The URL is printed within a second; if it somehow is not, say so rather than
+       hang the dialog — the CLI may still be opening the browser by itself, which is
+       the pre-existing behaviour and a survivable outcome. */
+    const wait = setTimeout(() => give({ ok: true, url: null }), 12_000);
+
+    const read = (chunk) => {
+      out += chunk;
+      if (!state.url) {
+        // "If the browser didn't open, visit: https://claude.com/cai/oauth/authorize?…"
+        const line = out.split('\n').find((l) => /visit:/i.test(l) && URL_RE.test(l));
+        const m = line?.match(URL_RE);
+        if (m) {
+          state.url = m[1];
+          give({ ok: true, url: m[1] });
+        }
+      }
+      /* The CLI says so out loud when the loopback callback lands. Busting the cache
+         here means the panel's next poll turns green immediately instead of serving a
+         60-second-old "not signed in". */
+      if (/login successful/i.test(out)) {
+        state.ok = true;
+        cached = null;
+      }
+    };
+    child.stdout.on('data', read);
+    child.stderr.on('data', read);
+    child.on('error', () => {
+      state.done = true;
+      give({ ok: false, reason: 'login-failed' });
+    });
+    child.on('close', () => {
+      state.done = true;
+      clearTimeout(ttl);
+      cached = null;
+      give({ ok: !!state.url, url: state.url ?? undefined, reason: state.url ? undefined : 'login-failed' });
+    });
+  });
+}
+
+/**
+ * Hand the CLI the code from the callback page.
+ *
+ * Only needed when the browser could not reach the loopback callback — a different
+ * machine, or a browser that refuses to open localhost. Then Anthropic's page shows a
+ * code instead of redirecting, and this is where it goes.
+ *
+ * @param {string} code
+ * @returns {{ok:boolean, reason?:string}}
+ */
+export function submitLoginCode(code) {
+  const value = String(code ?? '').trim();
+  if (!value) return { ok: false, reason: 'empty-code' };
+  if (!login || login.done || !login.child.stdin.writable) return { ok: false, reason: 'no-login' };
+  try {
+    login.child.stdin.write(value + '\n');
+  } catch {
+    return { ok: false, reason: 'no-login' };
+  }
+  cached = null;
+  return { ok: true };
+}

package/tools/travel/vendor/lib/jobs.mjs

@@ -0,0 +1,125 @@
+/** In-memory job registry + tiny concurrency queue (max 2 claude processes). */
+import { uid } from './store.mjs';
+
+const jobs = new Map();
+const controllers = new Map(); // job.id → AbortController (только у выполняющихся)
+const MAX_CONCURRENT = 2;
+let running = 0;
+const queue = [];
+
+export function createJob(type, tripId, label, work, onCancelled = null) {
+  const job = {
+    id: uid(),
+    type,
+    tripId,
+    label,
+    status: 'queued',
+    log: [],
+    /* What the agent is DOING, in words a traveller understands — the raw log
+       (`⚙ WebSearch {"query":…}`) is for us, not for the person waiting. Each step
+       is {at, kind:'search'|'read'|'browse'|'found', text, host}. */
+    steps: [],
+    result: null,
+    error: null,
+    startedAt: Date.now(),
+    finishedAt: null,
+  };
+  jobs.set(job.id, job);
+  queue.push({ job, work, onCancelled });
+  pump();
+  // Keep the registry bounded.
+  if (jobs.size > 100) {
+    const finished = [...jobs.values()].filter(j => j.finishedAt).sort((a, b) => a.finishedAt - b.finishedAt);
+    for (const old of finished.slice(0, jobs.size - 100)) jobs.delete(old.id);
+  }
+  return job;
+}
+
+function pump() {
+  while (running < MAX_CONCURRENT && queue.length) {
+    const { job, work } = queue.shift();
+    running++;
+    job.status = 'running';
+    const ac = new AbortController();
+    controllers.set(job.id, ac);
+    jobLog(job, `старт: ${job.label}`);
+    Promise.resolve()
+      .then(() => work(job, ac.signal))
+      .then(result => {
+        job.status = 'done';
+        job.result = result ?? null;
+      })
+      .catch(err => {
+        if (ac.signal.aborted) {
+          job.status = 'cancelled';
+          jobLog(job, '⏹ отменено');
+        } else {
+          job.status = 'error';
+          job.error = String(err?.message || err).slice(0, 2000);
+          jobLog(job, `✗ ${job.error}`);
+        }
+      })
+      .finally(() => {
+        controllers.delete(job.id);
+        job.finishedAt = Date.now();
+        running--;
+        pump();
+      });
+  }
+}
+
+/** Отмена: из очереди — мгновенно, выполняющуюся — через abort (kill агента). */
+export function cancelJob(id) {
+  const job = jobs.get(id);
+  if (!job) return false;
+  if (job.status === 'queued') {
+    const idx = queue.findIndex(q => q.job.id === id);
+    const entry = idx >= 0 ? queue.splice(idx, 1)[0] : null;
+    job.status = 'cancelled';
+    job.finishedAt = Date.now();
+    jobLog(job, '⏹ отменено (не начиналось)');
+    // джоб так и не запустился — воркерный откат не сработает, катим статус здесь
+    entry?.onCancelled?.(job);
+    return true;
+  }
+  if (job.status === 'running') {
+    controllers.get(id)?.abort();
+    return true;
+  }
+  return false;
+}
+
+export function cancelActiveByTrip(tripId) {
+  let n = 0;
+  for (const j of jobs.values()) {
+    if (j.tripId === tripId && (j.status === 'running' || j.status === 'queued') && cancelJob(j.id)) n++;
+  }
+  return n;
+}
+
+export function jobLog(job, line) {
+  job.log.push(`${new Date().toLocaleTimeString('ru-RU')} ${line}`);
+  if (job.log.length > 300) job.log.splice(0, job.log.length - 300);
+}
+
+/** One readable move of the agent. `kind` decides the icon, `host` the source chip. */
+export function jobStep(job, kind, text = '', host = '') {
+  if (!job) return;
+  const last = job.steps[job.steps.length - 1];
+  // Agents repeat themselves (three fetches of the same host in a row); collapsing
+  // duplicates keeps the theatre readable instead of a stuttering list.
+  if (last && last.kind === kind && last.text === text && last.host === host) return;
+  job.steps.push({ at: Date.now(), kind, text: String(text).slice(0, 160), host: String(host).slice(0, 60) });
+  if (job.steps.length > 60) job.steps.splice(0, job.steps.length - 60);
+}
+
+export function listJobs() {
+  return [...jobs.values()]
+    .sort((a, b) => b.startedAt - a.startedAt)
+    .slice(0, 25)
+    .map(({ log, steps, ...j }) => ({ ...j, logTail: log.slice(-12), steps: steps.slice(-24) }));
+}
+
+export function getJob(id) {
+  return jobs.get(id) || null;
+}

package/tools/travel/vendor/lib/license.mjs

@@ -0,0 +1,41 @@
+/**
+ * License verification against the Qiksy licensing worker (products/licenses).
+ * Identical contract to the Work Finder copy — see that file for the rationale.
+ * Local-first: paid tiers are unlocked by a key validated HERE, not by the plan
+ * stored in the user's own db.json. Best-effort + offline-grace cache.
+ */
+const LICENSE_API = (process.env.QIKSY_LICENSE_API || 'https://qiksy-licenses.qiksy.workers.dev').replace(/\/+$/, '');
+const PRODUCT = 'travel';
+export const RECHECK_MS = 6 * 3600 * 1000;
+export const OFFLINE_GRACE_MS = 7 * 86400 * 1000;
+
+/**
+ * @param {string} key
+ * @returns {Promise<{plan:string, active:boolean, paidUntil:number, trial:boolean, checkedAt:number, invalid?:boolean}|null>}
+ *          null when the check couldn't complete (offline) → keep the old cache.
+ */
+export async function verifyLicense(key) {
+  if (!key) return { plan: 'free', active: false, paidUntil: 0, trial: false, checkedAt: Date.now() };
+  try {
+    const signal = typeof AbortSignal !== 'undefined' && AbortSignal.timeout ? AbortSignal.timeout(4000) : undefined;
+    const r = await fetch(`${LICENSE_API}/v?key=${encodeURIComponent(key)}&product=${PRODUCT}`, { signal });
+    if (!r.ok) return null;
+    const j = await r.json();
+    if (!j || j.ok === false) return { plan: 'free', active: false, paidUntil: 0, trial: false, checkedAt: Date.now(), invalid: true };
+    return { plan: j.plan || 'free', active: !!j.active, paidUntil: j.paidUntil || 0, trial: !!j.trial, checkedAt: Date.now() };
+  } catch {
+    return null;
+  }
+}
+
+/** Effective plan id from a cached licenseInfo ('dev' is decided by the caller first). */
+export function licensePlanId(licenseInfo) {
+  const li = licenseInfo;
+  if (!li || !li.plan || li.plan === 'free') return 'free';
+  const now = Date.now();
+  const notExpired = !li.paidUntil || li.paidUntil > now;
+  if (li.active && notExpired) return li.plan;
+  const offlineOk = li.checkedAt && now - li.checkedAt < OFFLINE_GRACE_MS;
+  if (offlineOk && li.paidUntil > now) return li.plan;
+  return 'free';
+}