sensorium-mcp 3.1.1-board.2 → 3.1.2

package/dist/dashboard/routes/board.d.ts

@@ -1,67 +0,0 @@
-/**
- * Dashboard API — Agent Task Board routes.
- *
- * The ONLY write surface for the board (single-writer invariant): the operator
- * acts here; agents never see these endpoints. The orchestrator service is the
- * other writer (worker reports → comments, status moves) but that is server
- * code, not an exposed surface.
- *
- * Routes (all Bearer-auth like every /api/*):
- *   GET    /api/board/cards?includeArchived=1&lane=<threadId>
- *   POST   /api/board/cards
- *   GET    /api/board/cards/:id            (card + comments)
- *   PATCH  /api/board/cards/:id
- *   DELETE /api/board/cards/:id
- *   POST   /api/board/cards/:id/comments
- *   GET    /api/board/lanes
- *   POST   /api/board/lanes
- *   DELETE /api/board/lanes/:threadId
- *   GET    /api/board/profiles
- *   PUT    /api/board/profiles
- */
-import { type RouteArgs, type RouteHandler } from "./types.js";
-/** GET /api/board/cards → { cards } (comments not included; fetch per card). */
-export declare const handleGetBoardCards: RouteHandler;
-/** POST /api/board/cards — create; type seeds the profile, explicit fields win. */
-export declare const handlePostBoardCard: RouteHandler;
-/** GET /api/board/cards/:id → { card, comments } */
-export declare function handleGetBoardCard(args: RouteArgs, cardId: number): boolean;
-/**
- * PATCH /api/board/cards/:id — operator edits, drag-drop status moves, resume.
- *
- * Live-card policy (design D2/D4): a card that is in_progress is TASK-IMMUTABLE.
- * The bound worker owns what it is DOING; the only way to change that is an
- * explicit Stop (POST .../stop) that decommissions it. So while in_progress:
- *   • re-laning, archiving, and profile/type edits are REFUSED (409) — "Stop
- *     first" — because they would silently diverge from what the worker runs.
- *   • moving to backlog (re-run) or done ALLOWS the move but first releases
- *     (kills + tears down) the bound worker, so no orphaned/duplicate worker
- *     survives to double-push or leak its report (R1 closes B1/B2).
- * Leaving in_progress/blocked clears the worker binding + blocked reason so a
- * later dispatch spawns a FRESH stateless worker (design §3.5).
- */
-export declare function handlePatchBoardCard(args: RouteArgs, cardId: number): Promise<boolean>;
-/**
- * POST /api/board/cards/:id/stop — explicit operator Stop (design D3).
- * Decommission the bound worker (kill + teardown) and park the card in blocked
- * with a clear reason. Blocked is never auto-dispatched, so the card sits safely
- * until the operator resumes it (→ backlog re-dispatches a fresh worker).
- */
-export declare function handleStopBoardCard(args: RouteArgs, cardId: number): Promise<boolean>;
-/** DELETE /api/board/cards/:id — remove the card. A live card's bound worker
- *  is decommissioned first (R1/B8) so deleting it never orphans a running
- *  worker that would push/report against a card that no longer exists. */
-export declare function handleDeleteBoardCard(args: RouteArgs, cardId: number): Promise<boolean>;
-/** POST /api/board/cards/:id/comments — operator comment. */
-export declare function handlePostBoardComment(args: RouteArgs, cardId: number): Promise<boolean>;
-/** GET /api/board/lanes → lanes decorated with thread names for the UI. */
-export declare const handleGetBoardLanes: RouteHandler;
-/** POST /api/board/lanes — connect/disconnect a thread, set max_concurrent. */
-export declare const handlePostBoardLane: RouteHandler;
-/** DELETE /api/board/lanes/:threadId */
-export declare function handleDeleteBoardLane(args: RouteArgs, threadId: number): boolean;
-/** GET /api/board/profiles → effective per-type templates (builtin ⊕ overrides). */
-export declare const handleGetBoardProfiles: RouteHandler;
-/** PUT /api/board/profiles — persist operator overrides wholesale. */
-export declare const handlePutBoardProfiles: RouteHandler;
-//# sourceMappingURL=board.d.ts.map

package/dist/dashboard/routes/board.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/board.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAY,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAsJzE,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,EAAE,YAuBjC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,EAAE,YA4DjC,CAAC;AAEF,oDAAoD;AACpD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAa3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiJ5F;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwB3F;AAED;;0EAE0E;AAC1E,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoB7F;AAED,6DAA6D;AAC7D,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkB9F;AAID,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,EAAE,YAWjC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,YAkCjC,CAAC;AAEF,wCAAwC;AACxC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuBhF;AAID,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,EAAE,YAOpC,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,YAgCpC,CAAC"}

package/dist/dashboard/routes/board.js

@@ -1,612 +0,0 @@
-/**
- * Dashboard API — Agent Task Board routes.
- *
- * The ONLY write surface for the board (single-writer invariant): the operator
- * acts here; agents never see these endpoints. The orchestrator service is the
- * other writer (worker reports → comments, status moves) but that is server
- * code, not an exposed surface.
- *
- * Routes (all Bearer-auth like every /api/*):
- *   GET    /api/board/cards?includeArchived=1&lane=<threadId>
- *   POST   /api/board/cards
- *   GET    /api/board/cards/:id            (card + comments)
- *   PATCH  /api/board/cards/:id
- *   DELETE /api/board/cards/:id
- *   POST   /api/board/cards/:id/comments
- *   GET    /api/board/lanes
- *   POST   /api/board/lanes
- *   DELETE /api/board/lanes/:threadId
- *   GET    /api/board/profiles
- *   PUT    /api/board/profiles
- */
-import { readBody } from "./types.js";
-import { errorMessage } from "../../lib/utils.js";
-import { getMaxConcurrentThreads } from "../../config/index.js";
-import { buildDonePatch, createCard, deleteCard, getCard, listCards, updateCard, } from "../../data/board/card.repository.js";
-import { addComment, listComments } from "../../data/board/comment.repository.js";
-import { listLanes, removeLane, upsertLane } from "../../data/board/lane.repository.js";
-import { getProfileForType, getProfileTemplates, saveProfileOverrides, } from "../../data/board/profile-defaults.js";
-import { getThread } from "../../data/memory/thread-registry.js";
-import { releaseWorkerForCard, } from "../../services/board/release-worker.js";
-/** Assemble the decommission deps the release-worker path needs from the
- *  dashboard context (single place carrying telegram/chatId into the routes). */
-function releaseDeps(args) {
-    return {
-        db: args.db,
-        telegram: args.ctx.telegram,
-        chatId: args.ctx.chatId,
-        threadLifecycle: args.ctx.threadLifecycle,
-    };
-}
-/** Operator-legal status targets. in_progress is entered ONLY by the
- *  orchestrator's atomic claim (a hand-set in_progress card would have no
- *  worker and sit stuck); blocked ONLY by worker reports / exit safety nets
- *  (a hand-set blocked card would carry no reason). */
-const OPERATOR_STATUS_TARGETS = ["backlog", "done"];
-async function parseJsonBody(args) {
-    try {
-        const parsed = JSON.parse(await readBody(args.req));
-        return typeof parsed === "object" && parsed !== null
-            ? parsed
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
-const asInt = (v) => {
-    const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
-    return Number.isInteger(n) ? n : undefined;
-};
-/** A lane must be a REAL registered thread — a typo'd id must not silently
- *  become a live connected lane that dispatch then spawns workers against. */
-function validateLaneThread(db, threadId) {
-    const thread = getThread(db, threadId);
-    if (!thread)
-        return `Thread ${threadId} does not exist in the thread registry`;
-    if (thread.type === "worker")
-        return `Thread ${threadId} is a worker — lanes must be root/branch threads`;
-    return null;
-}
-/** Valid card types = builtin + operator-defined profile templates. An unknown
- *  type would silently seed an EMPTY profile, stripping tests/PR/review rigor. */
-function validateCardType(type) {
-    const known = Object.keys(getProfileTemplates());
-    return known.includes(type)
-        ? null
-        : `Unknown card type '${type}' — known types: ${known.join(", ")}`;
-}
-/**
- * Empty/zeroed input means "no recurrence" — NULL, not a 1-minute respawn loop.
- * An emptied number input arrives as '' (asInt('')=0) or 0; treating either as
- * Math.max(1,0)=1 turned "no recurrence" into "every minute" (H3 regression).
- * Only an intentional integer ≥1 sets a real cadence; everything falsy → null.
- */
-function parseRecurDelay(v) {
-    if (v === null || v === undefined || v === "")
-        return null;
-    const n = asInt(v);
-    if (n === undefined)
-        return undefined;
-    return n >= 1 ? n : null;
-}
-/** Order-independent equality for two execution profiles (flat primitives +
- *  a skills string[]). Used to tell an actual profile edit apart from an
- *  unchanged profile bundled into a PATCH that only touches allowed fields. */
-function profileChanged(a, b) {
-    const keys = [...new Set([...Object.keys(a), ...Object.keys(b)])].sort();
-    return JSON.stringify(a, keys) !== JSON.stringify(b, keys);
-}
-/** Providers a card/profile may name (ExecutionProfile.agentType contract). An
- *  unknown value must 400 — otherwise it slips past card creation and silently
- *  falls through to the default Claude spawn branch instead of erroring. */
-const AGENT_TYPES = ["claude", "copilot", "codex", "fable"];
-/** Every legal ExecutionProfile field. PUT /profiles validates each persisted
- *  per-type profile against this whitelist so junk keys can't be stored. */
-const PROFILE_FIELDS = [
-    "repository",
-    "createBranch",
-    "skills",
-    "operatorReview",
-    "openPr",
-    "expertReview",
-    "reviewAgentType",
-    "workerSplit",
-    "agentType",
-    "size",
-    "runTests",
-    "build",
-    "push",
-    "ciCheck",
-    "inline",
-    "ttlMinutes",
-];
-/** Reject a profile naming an unknown agentType/reviewAgentType. Empty (absent/
- *  null) means "default" and is fine; a garbage provider is a 400, not a silent
- *  fall-through to the Claude spawn branch. */
-function validateProfileAgents(profile) {
-    for (const field of ["agentType", "reviewAgentType"]) {
-        const v = profile[field];
-        if (v !== undefined && v !== null && !AGENT_TYPES.includes(v))
-            return `Unknown ${field} '${String(v)}' — allowed: ${AGENT_TYPES.join(", ")}`;
-    }
-    return null;
-}
-/** Well-formedness of a single per-type profile persisted via PUT /profiles: a
- *  plain object whose keys are all real ExecutionProfile fields with valid agent
- *  enums. A non-object or a junk key is rejected outright. */
-function validateProfileShape(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return "each profile must be a JSON object";
-    const profile = value;
-    for (const key of Object.keys(profile))
-        if (!PROFILE_FIELDS.includes(key))
-            return `unknown profile field '${key}'`;
-    return validateProfileAgents(profile);
-}
-// ── Cards ────────────────────────────────────────────────────────────────────
-/** GET /api/board/cards → { cards } (comments not included; fetch per card). */
-export const handleGetBoardCards = ({ url, json, db }) => {
-    try {
-        // A malformed ?lane= must 400, not silently drop the filter and return ALL
-        // cards (a caller scoping to one lane would leak every lane's cards).
-        const laneParam = url.searchParams.get("lane");
-        let laneThreadId;
-        if (laneParam !== null) {
-            laneThreadId = asInt(laneParam);
-            if (laneThreadId === undefined) {
-                json({ error: "'lane' must be an integer thread id" }, 400);
-                return true;
-            }
-        }
-        json({
-            cards: listCards(db, {
-                includeArchived: url.searchParams.get("includeArchived") === "1",
-                ...(laneThreadId !== undefined ? { laneThreadId } : {}),
-            }),
-        });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-};
-/** POST /api/board/cards — create; type seeds the profile, explicit fields win. */
-export const handlePostBoardCard = async (args) => {
-    const { json, db } = args;
-    try {
-        const body = await parseJsonBody(args);
-        const title = typeof body?.title === "string" ? body.title.trim() : "";
-        const laneThreadId = asInt(body?.laneThreadId);
-        if (!body || !title || laneThreadId === undefined) {
-            json({ error: "'title' and integer 'laneThreadId' are required" }, 400);
-            return true;
-        }
-        const laneError = validateLaneThread(db, laneThreadId);
-        if (laneError) {
-            json({ error: laneError }, 400);
-            return true;
-        }
-        const type = typeof body.type === "string" ? body.type : "chore";
-        const typeError = validateCardType(type);
-        if (typeError) {
-            json({ error: typeError }, 400);
-            return true;
-        }
-        // A garbage non-empty recurDelayMin ("abc") must 400, not silently clear
-        // recurrence. parseRecurDelay returns undefined ONLY for such garbage;
-        // ''/null/absent → null (no recurrence, fine).
-        const recurDelay = parseRecurDelay(body.recurDelayMin);
-        if (recurDelay === undefined) {
-            json({ error: "'recurDelayMin' must be an integer ≥ 1 (or empty to disable)" }, 400);
-            return true;
-        }
-        if (typeof body.profile === "object" && body.profile !== null) {
-            const agentError = validateProfileAgents(body.profile);
-            if (agentError) {
-                json({ error: agentError }, 400);
-                return true;
-            }
-        }
-        const profile = {
-            ...getProfileForType(type),
-            ...(typeof body.profile === "object" && body.profile !== null
-                ? body.profile
-                : {}),
-        };
-        // Connecting the lane on first use is idempotent and saves a separate call.
-        upsertLane(db, laneThreadId);
-        const card = createCard(db, {
-            title,
-            description: typeof body.description === "string" ? body.description : "",
-            acceptance: typeof body.acceptance === "string" ? body.acceptance : "",
-            type,
-            laneThreadId,
-            priority: asInt(body.priority) ?? 0,
-            profile,
-            escalate: body.escalate === true,
-            ...(recurDelay != null ? { recurDelayMin: recurDelay } : {}),
-        });
-        json({ card }, 201);
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-};
-/** GET /api/board/cards/:id → { card, comments } */
-export function handleGetBoardCard(args, cardId) {
-    const { json, db } = args;
-    try {
-        const card = getCard(db, cardId);
-        if (!card) {
-            json({ error: `Card ${cardId} not found` }, 404);
-            return true;
-        }
-        json({ card, comments: listComments(db, cardId) });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-}
-/**
- * PATCH /api/board/cards/:id — operator edits, drag-drop status moves, resume.
- *
- * Live-card policy (design D2/D4): a card that is in_progress is TASK-IMMUTABLE.
- * The bound worker owns what it is DOING; the only way to change that is an
- * explicit Stop (POST .../stop) that decommissions it. So while in_progress:
- *   • re-laning, archiving, and profile/type edits are REFUSED (409) — "Stop
- *     first" — because they would silently diverge from what the worker runs.
- *   • moving to backlog (re-run) or done ALLOWS the move but first releases
- *     (kills + tears down) the bound worker, so no orphaned/duplicate worker
- *     survives to double-push or leak its report (R1 closes B1/B2).
- * Leaving in_progress/blocked clears the worker binding + blocked reason so a
- * later dispatch spawns a FRESH stateless worker (design §3.5).
- */
-export async function handlePatchBoardCard(args, cardId) {
-    const { json, db } = args;
-    try {
-        const body = await parseJsonBody(args);
-        if (!body) {
-            json({ error: "JSON body required" }, 400);
-            return true;
-        }
-        const existing = getCard(db, cardId);
-        if (!existing) {
-            json({ error: `Card ${cardId} not found` }, 404);
-            return true;
-        }
-        // Does this PATCH move the card OUT of in_progress by an operator status
-        // target? Only then do the live-card edit guards relax (the move itself is
-        // the sanctioned "Stop-then-change" — it releases the worker below).
-        const targetStatus = typeof body.status === "string" && body.status !== existing.status
-            ? body.status
-            : undefined;
-        const leavingInProgress = existing.status === "in_progress" &&
-            targetStatus !== undefined &&
-            OPERATOR_STATUS_TARGETS.includes(targetStatus);
-        const liveLocked = existing.status === "in_progress" && !leavingInProgress;
-        const patch = {};
-        if (typeof body.title === "string" && body.title.trim())
-            patch.title = body.title.trim();
-        if (typeof body.description === "string")
-            patch.description = body.description;
-        if (typeof body.acceptance === "string")
-            patch.acceptance = body.acceptance;
-        if (typeof body.type === "string") {
-            const typeError = validateCardType(body.type);
-            if (typeError) {
-                json({ error: typeError }, 400);
-                return true;
-            }
-            // M3: type reseeds the standing orders — a task mutation. Refuse on a live
-            // card (the running worker was already briefed from the old type).
-            if (liveLocked && body.type !== existing.type) {
-                json({ error: "Card is locked while running — Stop the card to change its type" }, 409);
-                return true;
-            }
-            patch.type = body.type;
-        }
-        const patchLane = asInt(body.laneThreadId);
-        if (patchLane !== undefined) {
-            const laneError = validateLaneThread(db, patchLane);
-            if (laneError) {
-                json({ error: laneError }, 400);
-                return true;
-            }
-            // M1: re-laning a live card would leave the worker reporting to the old
-            // lane → lost report / false BLOCKED. Refuse until stopped.
-            if (liveLocked && patchLane !== existing.laneThreadId) {
-                json({ error: "Stop the card before re-laning" }, 409);
-                return true;
-            }
-            upsertLane(db, patchLane);
-            patch.laneThreadId = patchLane;
-        }
-        if (asInt(body.priority) !== undefined)
-            patch.priority = asInt(body.priority);
-        if (typeof body.escalate === "boolean")
-            patch.escalate = body.escalate;
-        if ("recurDelayMin" in body) {
-            // A garbage non-empty recurDelayMin must 400, not silently clear
-            // recurrence (undefined ⇒ garbage; ''/null ⇒ intentional disable).
-            const parsedDelay = parseRecurDelay(body.recurDelayMin);
-            if (parsedDelay === undefined) {
-                json({ error: "'recurDelayMin' must be an integer ≥ 1 (or empty to disable)" }, 400);
-                return true;
-            }
-            const nextDelay = parsedDelay;
-            patch.recurDelayMin = nextDelay;
-            // M7.1: enabling recurrence on a card that was never a recurring original
-            // must anchor the group here. Otherwise the card completes but
-            // listDueRecurrences (which requires recur_group_id NOT NULL) never
-            // respawns it AND archiveDoneOlderThan skips it (next_spawn_at is set) —
-            // a permanent zombie stuck in Done. Anchor to its own id, matching how
-            // createCard seeds a brand-new recurring original.
-            if (nextDelay != null && existing.recurDelayMin == null && existing.recurGroupId == null)
-                patch.recurGroupId = cardId;
-        }
-        if (typeof body.profile === "object" && body.profile !== null) {
-            // A typo'd agentType/reviewAgentType must 400 (would otherwise fall
-            // through to the default spawn branch on the next dispatch).
-            const agentError = validateProfileAgents(body.profile);
-            if (agentError) {
-                json({ error: agentError }, 400);
-                return true;
-            }
-            // M3: profile/agentType is baked at spawn — CHANGING it mid-run is a
-            // misleading no-op against the live worker. Refuse a real change until
-            // stopped; an unchanged profile bundled with an allowed edit passes.
-            if (liveLocked && profileChanged(existing.profile, body.profile)) {
-                json({ error: "Card is locked while running — Stop the card to change its profile" }, 409);
-                return true;
-            }
-            patch.profile = body.profile;
-        }
-        if ("archivedAt" in body) {
-            const archiving = body.archivedAt !== null;
-            // M2: archiving a live card orphans its worker and (pre-fix) leaked a
-            // concurrency slot forever. Refuse until stopped; un-archiving is fine.
-            if (archiving && liveLocked) {
-                json({ error: "Stop the card before archiving" }, 409);
-                return true;
-            }
-            patch.archivedAt = archiving ? new Date().toISOString() : null;
-            // M7.2: archiving a DONE recurring card must also stop recurrence — else
-            // next_spawn_at survives and the card still respawns (possibly into a
-            // since-deleted lane). Mirror the resume path's clear.
-            if (archiving)
-                patch.nextSpawnAt = null;
-        }
-        if (targetStatus !== undefined) {
-            if (!OPERATOR_STATUS_TARGETS.includes(targetStatus)) {
-                json({
-                    error: `Operator moves may only target ${OPERATOR_STATUS_TARGETS.join("/")} — in_progress and blocked are set by the board itself`,
-                }, 400);
-                return true;
-            }
-            // R1: releasing a live card's worker BEFORE the DB move is what prevents
-            // the next tick from spawning a second worker on the same card.
-            if (leavingInProgress)
-                await releaseWorkerForCard(releaseDeps(args), existing.workerThreadId);
-            patch.status = targetStatus;
-            if (targetStatus === "backlog") {
-                // Resume/re-run: next dispatch spawns a fresh worker briefed from the
-                // card. The resumed card IS the group's live instance again — clear any
-                // pending respawn time or the group could double-spawn (H3).
-                patch.workerThreadId = null;
-                patch.blockedReason = null;
-                patch.nextSpawnAt = null;
-            }
-            else if (targetStatus === "done") {
-                // Single DONE-transition source — same patch the worker-report path uses.
-                Object.assign(patch, buildDonePatch(existing));
-            }
-        }
-        json({ card: updateCard(db, cardId, patch) });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-}
-/**
- * POST /api/board/cards/:id/stop — explicit operator Stop (design D3).
- * Decommission the bound worker (kill + teardown) and park the card in blocked
- * with a clear reason. Blocked is never auto-dispatched, so the card sits safely
- * until the operator resumes it (→ backlog re-dispatches a fresh worker).
- */
-export async function handleStopBoardCard(args, cardId) {
-    const { json, db } = args;
-    try {
-        const existing = getCard(db, cardId);
-        if (!existing) {
-            json({ error: `Card ${cardId} not found` }, 404);
-            return true;
-        }
-        if (existing.status !== "in_progress") {
-            json({ error: `Card ${cardId} is not running (status: ${existing.status})` }, 409);
-            return true;
-        }
-        await releaseWorkerForCard(releaseDeps(args), existing.workerThreadId);
-        const card = updateCard(db, cardId, {
-            status: "blocked",
-            blockedReason: "Stopped by operator",
-            workerThreadId: null,
-            nextSpawnAt: null,
-        });
-        json({ card });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-}
-/** DELETE /api/board/cards/:id — remove the card. A live card's bound worker
- *  is decommissioned first (R1/B8) so deleting it never orphans a running
- *  worker that would push/report against a card that no longer exists. */
-export async function handleDeleteBoardCard(args, cardId) {
-    const { json, db } = args;
-    try {
-        const existing = getCard(db, cardId);
-        if (!existing) {
-            json({ error: `Card ${cardId} not found` }, 404);
-            return true;
-        }
-        if (existing.status === "in_progress") {
-            await releaseWorkerForCard(releaseDeps(args), existing.workerThreadId);
-        }
-        if (!deleteCard(db, cardId)) {
-            json({ error: `Card ${cardId} not found` }, 404);
-            return true;
-        }
-        json({ ok: true });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-}
-/** POST /api/board/cards/:id/comments — operator comment. */
-export async function handlePostBoardComment(args, cardId) {
-    const { json, db } = args;
-    try {
-        const body = await parseJsonBody(args);
-        const content = typeof body?.content === "string" ? body.content.trim() : "";
-        if (!content) {
-            json({ error: "'content' is required" }, 400);
-            return true;
-        }
-        if (!getCard(db, cardId)) {
-            json({ error: `Card ${cardId} not found` }, 404);
-            return true;
-        }
-        json({ comment: addComment(db, cardId, "operator", content) }, 201);
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-}
-// ── Lanes ────────────────────────────────────────────────────────────────────
-/** GET /api/board/lanes → lanes decorated with thread names for the UI. */
-export const handleGetBoardLanes = ({ json, db }) => {
-    try {
-        const lanes = listLanes(db).map((lane) => ({
-            ...lane,
-            name: getThread(db, lane.threadId)?.name ?? `Thread ${lane.threadId}`,
-        }));
-        json({ lanes });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-};
-/** POST /api/board/lanes — connect/disconnect a thread, set max_concurrent. */
-export const handlePostBoardLane = async (args) => {
-    const { json, db } = args;
-    try {
-        const body = await parseJsonBody(args);
-        const threadId = asInt(body?.threadId);
-        if (threadId === undefined) {
-            json({ error: "integer 'threadId' is required" }, 400);
-            return true;
-        }
-        const laneError = validateLaneThread(db, threadId);
-        if (laneError) {
-            json({ error: laneError }, 400);
-            return true;
-        }
-        // maxConcurrent must be a sane slot count: 0/negative makes a lane silently
-        // never dispatch; an absurd value would let one lane monopolise the global
-        // cap. Bound it to 1..global-cap.
-        const maxConcurrent = asInt(body?.maxConcurrent);
-        if (maxConcurrent !== undefined) {
-            const maxAllowed = getMaxConcurrentThreads();
-            if (maxConcurrent < 1 || maxConcurrent > maxAllowed) {
-                json({ error: `'maxConcurrent' must be an integer between 1 and ${maxAllowed}` }, 400);
-                return true;
-            }
-        }
-        const lane = upsertLane(db, threadId, {
-            ...(typeof body?.connected === "boolean" ? { connected: body.connected } : {}),
-            ...(maxConcurrent !== undefined ? { maxConcurrent } : {}),
-        });
-        json({ lane });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-};
-/** DELETE /api/board/lanes/:threadId */
-export function handleDeleteBoardLane(args, threadId) {
-    const { json, db } = args;
-    try {
-        // No FK on board_cards.lane_thread_id (SQLite would need a table rebuild),
-        // so guard here instead: removing a lane that still owns live cards would
-        // orphan them invisibly. Archived cards don't block removal; use
-        // "disconnect" to merely stop dispatch without removing the lane.
-        const liveCards = listCards(db, { laneThreadId: threadId }).length;
-        if (liveCards > 0) {
-            json({
-                error: `Lane ${threadId} still has ${liveCards} non-archived card(s) — move or archive them first, or disconnect the lane instead`,
-            }, 409);
-            return true;
-        }
-        if (removeLane(db, threadId))
-            json({ ok: true });
-        else
-            json({ error: "Lane not found" }, 404);
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-}
-// ── Profile templates ────────────────────────────────────────────────────────
-/** GET /api/board/profiles → effective per-type templates (builtin ⊕ overrides). */
-export const handleGetBoardProfiles = ({ json }) => {
-    try {
-        json({ profiles: getProfileTemplates() });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-};
-/** PUT /api/board/profiles — persist operator overrides wholesale. */
-export const handlePutBoardProfiles = async (args) => {
-    const { json } = args;
-    try {
-        const body = await parseJsonBody(args);
-        if (!body || Array.isArray(body)) {
-            json({ error: "JSON body required ({ '<type>': {profile} })" }, 400);
-            return true;
-        }
-        // Reject an empty {} that would erase every override (a fat-finger wipe).
-        const types = Object.keys(body);
-        if (types.length === 0) {
-            json({ error: "Refusing to erase all profile overrides — send at least one per-type profile" }, 400);
-            return true;
-        }
-        // Persist only well-formed per-type profiles: each value must be a plain
-        // object whose keys are real ExecutionProfile fields with valid agent enums.
-        for (const type of types) {
-            const shapeError = validateProfileShape(body[type]);
-            if (shapeError) {
-                json({ error: `profile '${type}': ${shapeError}` }, 400);
-                return true;
-            }
-        }
-        saveProfileOverrides(body);
-        json({ profiles: getProfileTemplates() });
-    }
-    catch (err) {
-        json({ error: errorMessage(err) }, 500);
-    }
-    return true;
-};
-//# sourceMappingURL=board.js.map