rcf-lite 0.28.2 → 0.29.0

package/src/server/routes.js

@@ -4,7 +4,28 @@
 // GET /style.css     -> shipped stylesheet
 // GET /mermaid.min.js-> vendored mermaid runtime
 // GET /live-client.js-> phase 3.8 live client script
+// GET /page-init.js  -> viewer UI refresh PR 1 shell / router script
+//                      (Dex / wespa 2026-10-02 #263; release-noted so
+//                      the proxy's route allow-list is extended).
 // GET /scope.json    -> deep-link scope resolver (w-2026-08-30-dave-020)
+// GET /index.json    -> viewer UI refresh PR 7 ID lookup index built
+//                      from BuiltTreeModel on every rewalk; `{ rows }`
+//                      with one row per document id plus one per AC
+//                      (ADR-4134; release-noted).
+// GET /_fixtures/components -> viewer UI refresh PR 2 component
+//                      fixture page (release-noted). Static page, no
+//                      live-walk coupling, so it is always available
+//                      even before the first rewalk completes.
+// GET /test-host.html -> viewer UI refresh PR 9 wespa host fixture
+//                      page (TAC-4134, ADR-4136). Only served when
+//                      `deps.testHost === true`; 404 otherwise so
+//                      wespa's reverse-proxy allow-list is unaffected.
+//                      Mimics the wespa shell (56px header, resizable
+//                      sidebar) and iframes the viewer at `./?embed=1
+//                      &theme=light`. Test-suite proof only; not a
+//                      shipped UI.
+// GET /test-host.js  -> viewer UI refresh PR 9 wespa host fixture
+//                      client script. Same testHost gate as the HTML.
 // Everything else -> 404 text/plain.
 //
 // No CORS headers, no cache headers on static assets beyond what the
@@ -12,16 +33,36 @@
 
 import { readFile, stat } from 'node:fs/promises';
 
+import { renderComponentsFixturePage } from '../view/components-fixture.js';
+import { renderTestHostPage } from '../view/test-host/fixture.js';
+
+// Issue #248 (0.28.3): the shipped static assets (style.css,
+// mermaid.min.js, live-client.js) MUST be resolved once at server
+// startup, not read from disk on every HTTP request. If the checkout
+// switches branches or the file mutates while the server runs, per-
+// request reads return the new bytes even though the HTML that
+// references them was rendered from a walk taken at startup. The
+// asymmetry produced the 2026-09-22 Product Map "unstyled preview"
+// regression: HTML from the store walker was old, style.css was
+// current, and the browser combined them.
+//
+// `deps.styleAsset`, `deps.mermaidAsset` and `deps.liveClientAsset`
+// carry `{ buffer, size, contentType }` snapshotted at startup. The
+// legacy `stylePath`/`mermaidPath`/`liveClientPath` props are kept
+// for backwards compatibility with tests that pass a path; the
+// router reads on-demand in that fallback path.
+
 const MIME = {
   html: 'text/html; charset=utf-8',
   css: 'text/css; charset=utf-8',
   js: 'application/javascript; charset=utf-8',
+  json: 'application/json; charset=utf-8',
   txt: 'text/plain; charset=utf-8',
 };
 
 /**
  * @typedef {object} RouterDeps
- * @property {() => { fullPageHtml: string, contentHtml: string, version: number } | null} currentState
+ * @property {() => { fullPageHtml: string, contentHtml: string, version: number, indexJson?: string } | null} currentState
  * @property {ReturnType<typeof import('./sse.js').createSseHub>} sse
  * @property {string} stylePath
  * @property {string} mermaidPath
@@ -68,15 +109,75 @@ export function createRouter(deps) {
       return;
     }
     if (path === '/style.css') {
-      serveFile(res, deps.stylePath, MIME.css).catch((err) => fail(res, err));
+      serveAsset(res, deps.styleAsset, deps.stylePath, MIME.css).catch((err) => fail(res, err));
       return;
     }
     if (path === '/mermaid.min.js') {
-      serveFile(res, deps.mermaidPath, MIME.js).catch((err) => fail(res, err));
+      serveAsset(res, deps.mermaidAsset, deps.mermaidPath, MIME.js).catch((err) => fail(res, err));
       return;
     }
     if (path === '/live-client.js') {
-      serveFile(res, deps.liveClientPath, MIME.js).catch((err) => fail(res, err));
+      serveAsset(res, deps.liveClientAsset, deps.liveClientPath, MIME.js).catch((err) => fail(res, err));
+      return;
+    }
+    if (path === '/page-init.js') {
+      serveAsset(res, deps.pageInitAsset, deps.pageInitPath, MIME.js).catch((err) => fail(res, err));
+      return;
+    }
+    if (path.startsWith('/product-map/')) {
+      const state = deps.currentState();
+      if (!state || !state.pmPartials) {
+        res.writeHead(503, { 'content-type': MIME.txt });
+        res.end('view server initialising\n');
+        return;
+      }
+      const group = path.slice('/product-map/'.length);
+      const html = state.pmPartials[group];
+      if (typeof html !== 'string') {
+        res.writeHead(404, { 'content-type': MIME.txt });
+        res.end('unknown grouping\n');
+        return;
+      }
+      res.writeHead(200, { 'content-type': MIME.html, 'cache-control': 'no-store' });
+      res.end(html);
+      return;
+    }
+    if (path === '/_fixtures/components') {
+      res.writeHead(200, { 'content-type': MIME.html, 'cache-control': 'no-store' });
+      res.end(renderComponentsFixturePage());
+      return;
+    }
+    if (path === '/test-host.html' && deps.testHost) {
+      // Viewer UI refresh PR 9 (TAC-4134, ADR-4136): the wespa host
+      // fixture is only mounted when the server was started with
+      // testHost: true. No X-Frame-Options, no CSP; the viewer's
+      // framing lint asserts the same on GET /.
+      res.writeHead(200, { 'content-type': MIME.html, 'cache-control': 'no-store' });
+      res.end(renderTestHostPage());
+      return;
+    }
+    if (path === '/test-host.js' && deps.testHost) {
+      serveAsset(res, deps.testHostClientAsset, deps.testHostClientPath, MIME.js).catch((err) => fail(res, err));
+      return;
+    }
+    if (path === '/index.json') {
+      // Viewer UI refresh PR 7 (TAC-4132, ADR-4134): the ID lookup
+      // index is built once per rewalk and lives on `state.indexJson`
+      // as a pre-stringified payload, so this handler never touches
+      // disk and content-length matches the exact bytes served.
+      const state = deps.currentState();
+      if (!state || typeof state.indexJson !== 'string') {
+        res.writeHead(503, { 'content-type': MIME.txt });
+        res.end('view server initialising\n');
+        return;
+      }
+      const body = state.indexJson;
+      res.writeHead(200, {
+        'content-type': MIME.json,
+        'content-length': String(Buffer.byteLength(body)),
+        'cache-control': 'no-store',
+      });
+      res.end(body);
       return;
     }
     if (path === '/scope.json') {
@@ -94,6 +195,34 @@ export function createRouter(deps) {
   };
 }
 
+/**
+ * Issue #248 (0.28.3): serve a snapshotted asset when the server has
+ * one, otherwise fall through to the legacy per-request read. The
+ * happy path never touches the filesystem after startup, so a checkout
+ * switch during the server's lifetime cannot change what gets served.
+ *
+ * @param {import('node:http').ServerResponse} res
+ * @param {{ buffer: Buffer, size: number, contentType?: string } | undefined | null} asset
+ * @param {string | undefined} fallbackPath
+ * @param {string} contentType
+ */
+async function serveAsset(res, asset, fallbackPath, contentType) {
+  if (asset && asset.buffer) {
+    res.writeHead(200, {
+      'content-type': asset.contentType ?? contentType,
+      'content-length': String(asset.size),
+    });
+    res.end(asset.buffer);
+    return;
+  }
+  if (fallbackPath) {
+    await serveFile(res, fallbackPath, contentType);
+    return;
+  }
+  res.writeHead(404, { 'content-type': MIME.txt });
+  res.end('not found\n');
+}
+
 async function serveFile(res, path, contentType) {
   let body;
   let size;

package/src/setup/identity-seed.js

@@ -75,6 +75,23 @@ escalation.)_
 
 unstated
 
+## Surface
+
+_(how the agent frames its review-ready output when a slice closes.
+One of the three values below on a single line; the seeded default is
+\`prDiff\` and a hand-edit is one word away.)_
+
+- \`viewer\`: the slice is reviewed in a rendered viewer surface (an
+  HTML preview, a Readiness tab, a dashboard). The agent lands on a
+  URL the operator opens.
+- \`runningApp\`: the slice is reviewed by running the app and
+  observing behaviour. The agent lands on a one-line reproduction
+  recipe.
+- \`prDiff\`: the slice is reviewed as a pull-request diff on the
+  shared repo. The agent lands on a PR link with the chain IDs listed.
+
+prDiff
+
 ## Project-scoped notes
 
 _(anything specific to this project that would be useful for the agent