spectoflow 0.23.5 → 0.27.0

package/templates/agents/framework-curator.md

@@ -28,11 +28,10 @@ project's own team will use to build product features.
 ## Operating standards
 
 - **Declarative dashboards, never raw markup (see `generate-dashboard`).** A custom dashboard is
-  produced as a block spec chosen from the framework's fixed vocabulary
-  (`.spectoflow/lib/custom-dashboard.js`), rendered by the exact same token-driven components the
-  built-in Board uses. Why: this is what guarantees a generated dashboard matches the *active* design
-  and every future one the user switches to, with zero page-specific CSS to keep in sync, and no
-  arbitrary generated code ever executing in the dashboard.
+  produced as a block spec chosen from the framework's fixed vocabulary, rendered by the exact same
+  token-driven components the built-in Board uses. Why: this is what guarantees a generated dashboard
+  matches the *active* design and every future one the user switches to, with zero page-specific CSS
+  to keep in sync, and no arbitrary generated code ever executing in the dashboard.
 - **Gold-standard shape for skills and agents (`docs/agents-skills-standard.md`).** A generated
   `SKILL.md` or agent `.md` follows the exact same front-matter and heading structure as every
   shipped one — `## When to use` / `## Method` / `## Output contract` / `## Quality bar` /
@@ -61,19 +60,19 @@ A generated dashboard renders correctly in every shipped design (light and dark)
 hardcoded color or manual style — verified by construction, since only the declarative block
 vocabulary was used. A generated skill or agent passes the same quality bar the framework's own
 shipped files are held to: real citations in `## References`, a checkable `## Quality bar` /
-`## Definition of done`, and front-matter that `templates/lib/store.js`'s flat parser can read
+`## Definition of done`, and front-matter that the dashboard's flat parser can read
 unchanged. The new dashboard tab, skill, or agent is visible in the dashboard (Board's nav / Agents &
 Skills tab) on the very next SSE tick — no manual refresh, no extra registration step.
 
 ## Handoff
 
-Writes the generated file(s) directly (`.spectoflow/dashboard/custom/<id>.json`,
+Writes the generated file(s) directly (`.spectoflow/dashboards/<id>.json`,
 `.spectoflow/skills/<slug>/SKILL.md`, or `.spectoflow/agents/<slug>.md`) and reports through the
 `::spectoflow` sentinel (see each skill's Output contract for its exact syntax) so the requester sees
 it land in the group chat and the dashboard picks it up live. A dashboard spec that fails
-`.spectoflow/lib/custom-dashboard.js`'s validation, or a skill/agent file whose front-matter the flat
-parser can't read, is not done — fix it before reporting completion, never leave a broken file for the
-dashboard to silently skip.
+`spectoflow dashboard validate`, or a skill/agent file whose front-matter the flat parser can't read,
+is not done — fix it before reporting completion, never leave a broken file for the dashboard to
+silently skip.
 
 ## Guardrails
 
@@ -90,5 +89,6 @@ dashboard to silently skip.
 ## References
 
 - `docs/agents-skills-standard.md` — the gold-standard shape this role's output must match.
-- `.spectoflow/lib/custom-dashboard.js` — the declarative block vocabulary and its validator.
+- `spectoflow dashboard validate <file>` — the declarative block vocabulary's validator (in the
+  spectoflow package).
 - `.spectoflow/skills/clarify` — the reflex this role leans on before generating from an ambiguous ask.

package/templates/capabilities.md

@@ -17,7 +17,7 @@ the Clarify step in `AGENTS.md`.
 `customization` is also **not a workflow step** — it is triggered explicitly, either from the
 dashboard's Settings → Customize page or by a direct request ("add a dashboard for…", "create a skill
 for…", "create an agent for…"). The `framework-curator` agent owns it, running one of four skills:
-`generate-dashboard` (a declarative block-spec page — see `templates/lib/custom-dashboard.js`),
+`generate-dashboard` (a declarative block-spec page — validated by `spectoflow dashboard validate`),
 `generate-skill`, `generate-agent` (both follow `docs/agents-skills-standard.md`'s gold-standard
 shape, grounded in real, cited domain standards), and `propose-customizations` (the "Auto" mode:
 analyzes the project and proposes candidates instead of taking a description). Still gated by mode

package/templates/config.json

@@ -7,6 +7,29 @@
   "specsDir": null,
   "dashboard": { "autostart": true },
   "design": "console",
+  "theme": "dark",
+  "boardView": "list",
+  "sideHidden": false,
+  "expandedPhases": [],
+  "activeTab": "board",
+  "chatOpen": false,
+  "kanbanColumns": ["todo", "in_progress", "to_validate", "to_analyze", "done", "blocked"],
+  "kanbanPageSize": 10,
+  "navTabs": [
+    {"id":"board","enabled":true},
+    {"id":"chat","enabled":true},
+    {"id":"requests","enabled":true},
+    {"id":"attention","enabled":true},
+    {"id":"backlog","enabled":true},
+    {"id":"workflow","enabled":true},
+    {"id":"team","enabled":true},
+    {"id":"files","enabled":true},
+    {"id":"notes","enabled":false},
+    {"id":"meeting","enabled":false},
+    {"id":"info","enabled":true},
+    {"id":"docs","enabled":true},
+    {"id":"personalize","enabled":true}
+  ],
   "runners": {
     "claude": "claude -p --permission-mode acceptEdits",
     "codex": "codex exec"

package/templates/skills/generate-dashboard/SKILL.md

@@ -3,7 +3,7 @@ name: generate-dashboard
 description: Turn a description (or an auto-analysis) into a new custom dashboard page, as a declarative block spec that automatically matches every design the dashboard ships.
 capability: customization
 inputs: A description of what the dashboard should show (from the Customize page or chat), or a chosen candidate from propose-customizations; the project's specs/plans/code as source material.
-outputs: A validated block-spec JSON file at .spectoflow/dashboard/custom/<id>.json, live in the dashboard's nav on the next tick.
+outputs: A validated block-spec JSON file at .spectoflow/dashboards/<id>.json, live in the dashboard's nav on the next tick.
 standard: declarative UI generation; Few's dashboard design principles
 ---
 # Generate dashboard
@@ -67,8 +67,8 @@ computed stats the Board already uses (see step 5).
 
 ### 4. Choose blocks — the vocabulary
 
-Pick from exactly these block types (anything else is invisible to the renderer — see
-`.spectoflow/lib/custom-dashboard.js` for the enforced schema):
+Pick from exactly these block types (anything else is invisible to the renderer — the block schema
+documented below is enforced by `spectoflow dashboard validate`):
 
 | `type` | Shape | Use for |
 |---|---|---|
@@ -102,7 +102,7 @@ in one screen — 4-8 blocks is a healthy page, not 20.
 ### 6. Pick an id, a title, an icon
 
 - `id`: lowercase kebab-case, unique among existing custom dashboards (list
-  `.spectoflow/dashboard/custom/*.json` first) — this becomes the URL segment and the file name.
+  `.spectoflow/dashboards/*.json` first) — this becomes the URL segment and the file name.
 - `title`: short, a few words, shown as the nav tab label.
 - `icon`: one of `board`, `requests`, `backlog`, `workflow`, `agents`, `chat`, `info`, `attention`,
   `settings` (the same set the rest of the dashboard uses — pick the closest match; default to `info`
@@ -110,19 +110,21 @@ in one screen — 4-8 blocks is a healthy page, not 20.
 
 ### 7. Write and verify
 
-Write the spec to `.spectoflow/dashboard/custom/<id>.json` (pretty-printed, 2-space indent). Then
+Write the spec to `.spectoflow/dashboards/<id>.json` (pretty-printed, 2-space indent). Then
 **verify it, don't assume it's valid** — run:
 ```
-node -e "console.log(JSON.stringify(require('./.spectoflow/lib/custom-dashboard').validateSpec(JSON.parse(require('fs').readFileSync('./.spectoflow/dashboard/custom/<id>.json','utf8')))))"
+spectoflow dashboard validate .spectoflow/dashboards/<id>.json
 ```
-If `valid` is `false`, fix the reported errors and re-run before reporting done — a spec the
-dashboard's own validator rejects is never a finished deliverable, it would simply be skipped and the
-user would see nothing.
+(use `npx spectoflow …` if spectoflow isn't on PATH)
+
+If the output shows errors, fix them and re-run before reporting done — a spec the dashboard's own
+validator rejects is never a finished deliverable, it would simply be skipped and the user would see
+nothing.
 
 ## Output contract
 
-- One file: `.spectoflow/dashboard/custom/<id>.json`, valid against
-  `.spectoflow/lib/custom-dashboard.js`'s `validateSpec` (verified per step 7, not assumed).
+- One file: `.spectoflow/dashboards/<id>.json`, valid against the block schema
+  (verified per step 7 with `spectoflow dashboard validate`, not assumed).
 - Progress and completion reported to the orchestrator and group chat:
 
 ```
@@ -147,6 +149,6 @@ user would see nothing.
 - Stephen Few, *Information Dashboard Design* (O'Reilly/Analytics Press) — one purpose per dashboard,
   the plainest chart that carries the point, single-screen legibility.
   https://www.perceptualedge.com/library.php
-- `.spectoflow/lib/custom-dashboard.js` — the enforced block schema and bind allow-list (source of
-  truth; this document summarizes it, the code is authoritative).
+- `spectoflow dashboard validate <file>` — the declarative block vocabulary's validator (in the
+  spectoflow package; enforces the block schema and bind allow-list).
 - `dashboard/public/stats.js` — the exact shape of the live stats object bindable via `bind`.

package/templates/dashboard/custom/.gitkeep

@@ -1,3 +0,0 @@
-# This directory holds user-generated custom dashboard specs (created via the Customize page in
-# Settings, or written directly by the `generate-dashboard` skill). Empty on a fresh install.
-# Schema: templates/lib/custom-dashboard.js

package/templates/dashboard/handlers.js

@@ -1,251 +0,0 @@
-'use strict';
-/*
- * spectoflow dashboard — per-project route logic, vendored into every project's
- * .spectoflow/dashboard/ (copied by init/update, exactly like server.js). Split out of server.js so
- * a single global hub process (lib/hub-server.js) can load a different project's routes on demand —
- * see docs/multi-project-hub-design.md's "the server must split in two" addendum.
- *
- * createHandlers(root) returns the per-project surface a listener-owning process needs:
- *   - handleApi(req, res, u, emit): Promise<boolean> — true if this request was an API route and was
- *     handled (caller should not also try static/SPA fallback); false otherwise. Deliberately excludes
- *     /api/events: SSE client registration stays owned by whichever file owns the HTTP listener.
- *   - watchDirs: string[] — dirs (relative to root) whose changes should emit {type:'change'}. The
- *     caller owns the actual fs.watch calls (it owns emit).
- *   - onBoot(): call once, the first time this project is opened in a server's lifetime (creates the
- *     custom-dashboards dir if missing, reconciles any stale in-flight orchestration).
- */
-const fs = require('fs');
-const path = require('path');
-const store = require('../lib/store');
-const { startRun } = require('./runner');
-const { runSummarize } = require('./summarize');
-const orchestrator = require('./orchestrator');
-const agentsRegistry = require('../lib/agents-registry');
-const files = require('./files');
-
-function sendJSON(res, code, obj) { res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8' }); res.end(JSON.stringify(obj)); }
-function body(req) { return new Promise((r) => { let b = ''; req.on('data', (c) => b += c); req.on('end', () => { try { r(JSON.parse(b || '{}')); } catch { r({}); } }); }); }
-
-function createHandlers(root) {
-  // Installed framework version: the manifest records it at init/update time. Fallback to the kit's
-  // own package.json — only reachable (and only used) when the server is run straight from templates/
-  // (dev/preview), never from an installed project whose sibling package.json belongs to the user.
-  function frameworkVersion() {
-    try { return JSON.parse(fs.readFileSync(path.join(root, '.spectoflow', '.manifest.json'), 'utf8')).version; } catch {}
-    try { const pk = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8')); if (pk.name === 'spectoflow') return pk.version; } catch {}
-    return null;
-  }
-  function project() {
-    const p = store.readProject(root);
-    const v = frameworkVersion(); if (v) p.version = v;
-    p.projectName = path.basename(root);
-    p.knownAgents = agentsRegistry.KNOWN_AGENTS.map((a) => ({ id: a.id, label: a.label, headless: a.headless, docsUrl: a.docsUrl }));
-    p.installedAgents = agentsRegistry.installedAgents(root);
-    return p;
-  }
-  function findPlanFileForTask(id) { for (const pl of store.readPlans(root)) for (const ph of pl.phases) if (ph.tasks.find((t) => t.id === id)) return pl.file; return null; }
-
-  const configPath = () => path.join(root, '.spectoflow', 'config.json');
-  function writeConfig(patch) {
-    const cp = configPath(); const cfg = JSON.parse(fs.readFileSync(cp, 'utf8'));
-    if (patch.mode && ['autopilot', 'semi', 'manual'].includes(patch.mode)) cfg.mode = patch.mode;
-    if (typeof patch.language === 'string' && patch.language.trim()) cfg.language = patch.language.trim();
-    if (typeof patch.design === 'string' && /^[a-z0-9-]{1,40}$/.test(patch.design)) cfg.design = patch.design;
-    if (typeof patch.agent === 'string' && patch.agent.trim()) {
-      const id = patch.agent.trim();
-      // Never activate an agent whose CLI isn't actually there — a picked-but-absent agent would just
-      // fail silently the next time something tries to run it.
-      if (!agentsRegistry.isAgentInstalled(id, root)) {
-        const known = agentsRegistry.KNOWN_AGENTS.find((a) => a.id === id);
-        const label = known ? known.label : id;
-        throw new Error(`${label} isn't installed here (its command wasn't found on PATH). Install it, then try again.`);
-      }
-      cfg.agent = id;
-      const known = agentsRegistry.KNOWN_AGENTS.find((a) => a.id === id);
-      if (known && known.runner) { cfg.runners = cfg.runners || {}; if (!cfg.runners[id]) cfg.runners[id] = known.runner; }
-    }
-    fs.writeFileSync(cp, JSON.stringify(cfg, null, 2) + '\n');
-    return cfg;
-  }
-  function promoteAttention(item) {
-    return store.addTask(root, { phase: 'Attention', title: item.text, owner: 'user' });
-  }
-
-  async function handleApi(req, res, u, emit) {
-    const p = u.pathname;
-
-    if (p === '/api/project') { sendJSON(res, 200, project()); return true; }
-
-    if (p === '/api/agentfile' && req.method === 'GET') {
-      const rel = new URL(req.url, 'http://x').searchParams.get('path') || '';
-      const base = path.join(root, '.spectoflow');
-      const aDir = path.join(base, 'agents'), sDir = path.join(base, 'skills');
-      const abs = path.resolve(base, rel);
-      const okDir = abs.startsWith(aDir + path.sep) || abs.startsWith(sDir + path.sep);
-      if (!okDir || !abs.endsWith('.md') || !fs.existsSync(abs) || fs.statSync(abs).isDirectory())
-        { sendJSON(res, 400, { error: 'not an agent/skill file' }); return true; }
-      // Symlink guard: the resolved real path must stay within the (real) scope dirs.
-      let real; try { real = fs.realpathSync(abs); } catch { real = null; }
-      const realA = (() => { try { return fs.realpathSync(aDir); } catch { return aDir; } })();
-      const realS = (() => { try { return fs.realpathSync(sDir); } catch { return sDir; } })();
-      const okReal = real && (real.startsWith(realA + path.sep) || real.startsWith(realS + path.sep));
-      if (!okReal || !real.endsWith('.md') || fs.statSync(real).isDirectory())
-        { sendJSON(res, 400, { error: 'not an agent/skill file' }); return true; }
-      sendJSON(res, 200, { content: fs.readFileSync(real, 'utf8') }); return true;
-    }
-
-    if (p === '/api/files/tree' && req.method === 'GET') { sendJSON(res, 200, { tree: files.tree(root) }); return true; }
-    if (p === '/api/files/read' && req.method === 'GET') {
-      const rel = new URL(req.url, 'http://x').searchParams.get('path') || '';
-      const r = files.readFile(root, rel);
-      sendJSON(res, r.error ? 400 : 200, r); return true;
-    }
-    if (p === '/api/files/write' && req.method === 'POST') {
-      const { path: rel, content } = await body(req);
-      const r = files.writeFile(root, rel, content);
-      if (r.error) { sendJSON(res, 400, r); return true; }
-      emit({ type: 'change' }); sendJSON(res, 200, r); return true;
-    }
-    if (p === '/api/files/mkdir' && req.method === 'POST') {
-      const { path: rel } = await body(req);
-      const r = files.mkdir(root, rel);
-      if (r.error) { sendJSON(res, 400, r); return true; }
-      emit({ type: 'change' }); sendJSON(res, 200, r); return true;
-    }
-
-    if (p === '/api/task' && req.method === 'POST') {
-      const { title, phase, file, owner, level } = await body(req);
-      if (!title || !String(title).trim()) { sendJSON(res, 400, { error: 'A title is required.' }); return true; }
-      const t = store.addTask(root, { title: String(title).trim(), phase, file, owner, level });
-      emit({ type: 'change' }); sendJSON(res, 200, { task: t }); return true;
-    }
-    if (p.startsWith('/api/task/') && req.method === 'PATCH') {
-      const id = decodeURIComponent(p.split('/')[3] || ''); const patch = await body(req);
-      const file = findPlanFileForTask(id); if (!file) { sendJSON(res, 404, { error: `Task ${id} not found.` }); return true; }
-      store.updateTaskLine(root, file, id, patch); emit({ type: 'change' }); sendJSON(res, 200, { ok: true }); return true;
-    }
-    if (/^\/api\/task\/[^/]+\/comment$/.test(p) && req.method === 'POST') {
-      const id = decodeURIComponent(p.split('/')[3] || ''); const { text, action } = await body(req);
-      if (!text || !String(text).trim()) { sendJSON(res, 400, { error: 'Empty comment.' }); return true; }
-      const file = findPlanFileForTask(id); if (!file) { sendJSON(res, 404, { error: `Task ${id} not found.` }); return true; }
-      store.addTaskComment(root, file, id, String(text).trim(), 'me');
-      if (action === 'analyze') store.updateTaskLine(root, file, id, { status: 'to_analyze' });
-      emit({ type: 'change' }); sendJSON(res, 200, { ok: true }); return true;
-    }
-    if (p === '/api/workflow/toggle' && req.method === 'POST') {
-      const { name } = await body(req); const wf = path.join(root, '.spectoflow', 'workflow.md');
-      const lines = fs.readFileSync(wf, 'utf8').split('\n');
-      // Must strip a trailing {cap:... skill:... policy} annotation (added in D29) BEFORE stripping
-      // "(optional)" — same order as store.js's readWorkflow(), which is what the client's own step
-      // names (and so `name` here) are actually derived from. Every step in the default workflow.md
-      // template carries one of these annotations, so getting this order wrong breaks toggling
-      // every single step, not just an edge case.
-      const stepName = (rest) => {
-        const ann = rest.match(/\{([^}]*)\}\s*$/);
-        if (ann) rest = rest.slice(0, ann.index).trim();
-        return rest.replace(/\s*\(optional\)\s*$/i, '').trim();
-      };
-      for (let i = 0; i < lines.length; i++) { const m = lines[i].match(/^(\s*- \[)( |x|X)(\]\s+)(.*)$/);
-        if (m && stepName(m[4]) === name) lines[i] = m[1] + (m[2].trim() ? ' ' : 'x') + m[3] + m[4]; }
-      fs.writeFileSync(wf, lines.join('\n')); emit({ type: 'change' }); sendJSON(res, 200, { ok: true }); return true;
-    }
-
-    if (p === '/api/run' && req.method === 'POST') {
-      const { prompt, agent } = await body(req);
-      if (!prompt || !String(prompt).trim()) { sendJSON(res, 400, { error: 'Empty request.' }); return true; }
-      const r = startRun(root, { prompt, agent }, emit);
-      if (r.error) { sendJSON(res, 400, { error: r.error }); return true; }
-      sendJSON(res, 200, { runId: r.runId }); return true;
-    }
-
-    if (p === '/api/chat/summarize' && req.method === 'POST') {
-      const { agent } = await body(req);
-      const r = runSummarize(root, { agent }, emit);
-      if (r.error) { sendJSON(res, 400, { error: r.error }); return true; }
-      sendJSON(res, 200, { ok: true }); return true;
-    }
-    if (p === '/api/chat/clear' && req.method === 'POST') {
-      const rt = store.readRuntime(root); rt.messages = []; store.writeRuntime(root, rt);
-      emit({ type: 'change' }); sendJSON(res, 200, { ok: true }); return true;
-    }
-
-    if (p === '/api/orchestrate' && req.method === 'POST') {
-      const { request } = await body(req);
-      if (!request || !String(request).trim()) { sendJSON(res, 400, { error: 'Empty request.' }); return true; }
-      const active = store.readRuntime(root).orchestration;
-      if (active && ['running', 'awaiting_approval'].includes(active.status))
-        { sendJSON(res, 409, { error: 'An orchestration is already active.' }); return true; }
-      const mode = store.readConfig(root).mode || 'semi';
-      orchestrator.runOrchestration({ root, request: String(request).trim(), mode,
-        runStep: orchestrator.defaultRunStep, confirm: orchestrator.defaultConfirm }, emit)
-        .catch((e) => emit({ type: 'message', message: { role: 'orchestrator', kind: 'status', text: 'orchestration error: ' + e.message } }));
-      const o = store.readRuntime(root).orchestration;
-      sendJSON(res, 200, { orchestrationId: o && o.id }); return true;
-    }
-    if (p === '/api/orchestrate/approve' && req.method === 'POST') {
-      const { decision, note } = await body(req);
-      const ok = orchestrator.submitDecision(decision, note);
-      sendJSON(res, ok ? 200 : 409, ok ? { ok: true } : { error: 'No pending approval.' }); return true;
-    }
-
-    if (p === '/api/settings' && req.method === 'POST') {
-      const patch = await body(req);
-      try { const cfg = writeConfig(patch); emit({ type: 'change' }); sendJSON(res, 200, { config: cfg }); }
-      catch (e) { sendJSON(res, 400, { error: String(e && e.message || e) }); }
-      return true;
-    }
-
-    if (p === '/api/attention' && req.method === 'POST') {
-      const { text } = await body(req);
-      if (!text || !String(text).trim()) { sendJSON(res, 400, { error: 'Empty note.' }); return true; }
-      const rt = store.readRuntime(root); rt.attention = rt.attention || [];
-      const item = { id: 'att' + Date.now().toString(36), at: new Date().toISOString(), by: 'me', source: 'user', status: 'open', text: String(text).trim() };
-      rt.attention.unshift(item); store.writeRuntime(root, rt); emit({ type: 'change' });
-      sendJSON(res, 200, { item }); return true;
-    }
-    if (/^\/api\/attention\/[^/]+\/promote$/.test(p) && req.method === 'POST') {
-      const id = decodeURIComponent(p.split('/')[3] || '');
-      const rt = store.readRuntime(root); const it = (rt.attention || []).find((x) => x.id === id);
-      if (!it) { sendJSON(res, 404, { error: 'Note not found.' }); return true; }
-      const t = promoteAttention(it); it.status = 'resolved'; it.promotedTo = t.id;
-      store.writeRuntime(root, rt); emit({ type: 'change' });
-      sendJSON(res, 200, { task: t }); return true;
-    }
-    if (/^\/api\/attention\/[^/]+$/.test(p) && req.method === 'PATCH') {
-      const id = decodeURIComponent(p.split('/')[3] || '');
-      const patch = await body(req);
-      const rt = store.readRuntime(root); const it = (rt.attention || []).find((x) => x.id === id);
-      if (!it) { sendJSON(res, 404, { error: 'Note not found.' }); return true; }
-      if (typeof patch.text === 'string' && patch.text.trim()) it.text = patch.text.trim();
-      if (patch.status && ['open', 'resolved'].includes(patch.status)) it.status = patch.status;
-      store.writeRuntime(root, rt); emit({ type: 'change' });
-      sendJSON(res, 200, { item: it }); return true;
-    }
-    if (/^\/api\/attention\/[^/]+$/.test(p) && req.method === 'DELETE') {
-      const id = decodeURIComponent(p.split('/')[3] || '');
-      const rt = store.readRuntime(root); rt.attention = (rt.attention || []).filter((x) => x.id !== id);
-      store.writeRuntime(root, rt); emit({ type: 'change' });
-      sendJSON(res, 200, { ok: true }); return true;
-    }
-
-    return false;
-  }
-
-  function onBoot() {
-    // A project that hasn't used Customize yet won't have this dir on disk, and `spectoflow init` on
-    // an older install won't have created it either.
-    try { fs.mkdirSync(path.join(root, '.spectoflow', 'dashboard', 'custom'), { recursive: true }); } catch (_) {}
-    // A process restart loses any in-flight orchestration; without this, a stale 'running' or
-    // 'awaiting_approval' status wedges the /api/orchestrate 409 guard forever. Not a real resume —
-    // just clears the wedge so a fresh orchestration can start.
-    try { orchestrator.reconcileOnBoot(root); } catch (_) {}
-  }
-
-  return {
-    handleApi,
-    watchDirs: ['plans', 'specs', '.spectoflow', '.spectoflow/dashboard/custom'],
-    onBoot,
-  };
-}
-
-module.exports = { createHandlers };

package/templates/dashboard/server.js

@@ -1,73 +0,0 @@
-'use strict';
-/*
- * spectoflow dashboard — ZERO-DEPENDENCY server, real-time (SSE + fs.watch), single project.
- * The actual /api/* route behavior lives in ./handlers.js — split out so the future multi-project hub
- * (lib/hub-server.js) can load a different project's handlers.js on demand (see
- * docs/multi-project-hub-design.md's "the server must split in two" addendum). This file remains the
- * direct single-project entry point (`node .spectoflow/dashboard/server.js`, today's `spectoflow
- * dashboard`) — its own external behavior is unchanged by the split.
- */
-const http = require('http');
-const fs = require('fs');
-const path = require('path');
-const { createHandlers } = require('./handlers');
-
-const PORT = process.env.SPECTOFLOW_PORT ? Number(process.env.SPECTOFLOW_PORT) : 4319;
-const PUBLIC = path.join(__dirname, 'public');
-const ROOT = process.env.SPECTOFLOW_ROOT || path.resolve(__dirname, '..', '..');
-const MIME = { '.html':'text/html; charset=utf-8', '.css':'text/css; charset=utf-8', '.js':'application/javascript; charset=utf-8', '.png':'image/png', '.svg':'image/svg+xml', '.ico':'image/x-icon', '.woff2':'font/woff2', '.woff':'font/woff' };
-const clients = new Set();
-function sendJSON(res,code,obj){ res.writeHead(code,{'Content-Type':'application/json; charset=utf-8'}); res.end(JSON.stringify(obj)); }
-function emit(obj){ const line='data: '+JSON.stringify(obj)+'\n\n'; for(const res of clients) res.write(line); }
-
-const handlers = createHandlers(ROOT);
-
-function watch(dir){ try{ fs.watch(dir,{recursive:false},()=>emit({type:'change'})); }catch(_){} }
-handlers.onBoot();
-handlers.watchDirs.forEach((d)=>{ const p=path.join(ROOT,d); if(fs.existsSync(p)) watch(p); });
-
-const server = http.createServer(async (req,res)=>{
-  const u=new URL(req.url,`http://localhost:${PORT}`); const p=u.pathname;
-  try{
-    if(p==='/api/events'){
-      res.writeHead(200,{'Content-Type':'text/event-stream','Cache-Control':'no-cache',Connection:'keep-alive'});
-      res.write('data: '+JSON.stringify({type:'hello'})+'\n\n');
-      clients.add(res); req.on('close',()=>clients.delete(res)); return;
-    }
-
-    if (p.startsWith('/api/')) {
-      const handled = await handlers.handleApi(req, res, u, emit);
-      if (handled) return;
-    }
-
-    // ---- static files, with SPA fallback: a route like /backlog (no file extension)
-    //      that isn't a real asset serves index.html so client-side routing can take over ----
-    let file=p==='/'?'/index.html':p;
-    const full=path.join(PUBLIC,path.normalize(file).replace(/^(\.\.[/\\])+/,''));
-    if(!full.startsWith(PUBLIC)){ res.writeHead(403); return res.end('Forbidden'); }
-    // Local tool: always serve the freshest asset — never let the browser cache a stale app.js/css.
-    const noCache = { 'Cache-Control': 'no-store, must-revalidate' };
-    fs.readFile(full,(err,data)=>{
-      if(err){
-        if(req.method==='GET' && !path.extname(p) && !p.startsWith('/api/')){
-          return fs.readFile(path.join(PUBLIC,'index.html'),(e2,d2)=>{
-            if(e2){ res.writeHead(404); return res.end('Not found'); }
-            res.writeHead(200,Object.assign({'Content-Type':MIME['.html']},noCache)); res.end(d2);
-          });
-        }
-        res.writeHead(404); return res.end('Not found');
-      }
-      const ext=path.extname(full);
-      // fonts are content-hashed by name and safe to cache long-term; everything else is no-store
-      const headers = ext==='.woff2'||ext==='.woff' ? { 'Cache-Control':'public, max-age=604800' } : noCache;
-      res.writeHead(200,Object.assign({'Content-Type':MIME[ext]||'application/octet-stream'},headers)); res.end(data);
-    });
-  }catch(e){ sendJSON(res,500,{error:String(e&&e.message||e)}); }
-});
-// pidfile so `spectoflow dashboard stop` can find and stop this server; cleared on exit.
-const LOCK = path.join(ROOT, '.spectoflow', '.dashboard.lock');
-function writeLock(){ try{ fs.mkdirSync(path.dirname(LOCK),{recursive:true}); fs.writeFileSync(LOCK, JSON.stringify({ pid:process.pid, port:PORT, url:`http://localhost:${PORT}`, startedAt:new Date().toISOString() })+'\n'); }catch{} }
-function clearLock(){ try{ const l=JSON.parse(fs.readFileSync(LOCK,'utf8')); if(l.pid===process.pid) fs.unlinkSync(LOCK); }catch{} }
-process.on('exit', clearLock);
-['SIGINT','SIGTERM'].forEach((s)=> process.on(s, ()=>{ clearLock(); process.exit(0); }));
-server.listen(PORT,()=>{ writeLock(); console.log(`spectoflow · dashboard → http://localhost:${PORT}`); console.log(`project root: ${ROOT}`); });

package/templates/lib/agents-registry.js

@@ -1,65 +0,0 @@
-'use strict';
-/*
- * The dashboard's own view of "which coding agents exist and is one actually installed" — a small,
- * self-contained subset of this package's lib/adapters.js (the richer install-time registry with
- * memory-file content). Duplicated rather than shared: .spectoflow/ must be self-contained (ships
- * into every project), while lib/adapters.js does not ship there. test/agents-registry.test.js
- * guards the two id/bin/runner sets from drifting apart.
- */
-const fs = require('fs');
-const path = require('path');
-
-// headless:false = detectable and selectable as the active agent, but spectoflow never spawns it
-// itself (no confirmed non-interactive one-shot mode) — Run/Orchestrate/Summarize stay disabled for
-// it client-side; runner/summarize.js also refuse server-side (defense in depth). `docsUrl` is that
-// agent's own official CLI docs, surfaced verbatim in the dashboard's Documentation tab. See the
-// longer rationale above lib/adapters.js's REGISTRY, the richer install-time twin of this list —
-// including why DeepSeek Harness isn't here at all, and why some runner strings order their flags
-// the way they do (the trailing prompt must land right after whichever flag takes a value).
-const KNOWN_AGENTS = [
-  { id: 'claude', label: 'Claude Code', bin: 'claude', dirs: ['.claude'], runner: 'claude -p --permission-mode acceptEdits', headless: true, docsUrl: 'https://code.claude.com/docs/en/cli-reference' },
-  { id: 'codex', label: 'Codex', bin: 'codex', dirs: ['.codex'], runner: 'codex exec', headless: true, docsUrl: 'https://developers.openai.com/codex/cli/reference' },
-  { id: 'cursor', label: 'Cursor', bin: 'cursor-agent', dirs: ['.cursor'], runner: 'cursor-agent -p', headless: true, docsUrl: 'https://cursor.com/docs/cli/overview' },
-  { id: 'gemini', label: 'Gemini CLI', bin: 'gemini', dirs: ['.gemini'], runner: 'gemini -p', headless: true, docsUrl: 'https://github.com/google-gemini/gemini-cli' },
-  { id: 'opencode', label: 'OpenCode', bin: 'opencode', dirs: ['.opencode'], runner: 'opencode run --quiet', headless: true, docsUrl: 'https://opencode.ai/docs/cli/' },
-  { id: 'kiro', label: 'Kiro CLI', bin: 'kiro-cli', dirs: ['.kiro'], runner: 'kiro-cli chat --no-interactive --trust-all-tools', headless: true, docsUrl: 'https://kiro.dev/docs/cli/headless/' },
-  { id: 'antigravity', label: 'Antigravity', bin: 'agy', dirs: [], runner: 'agy -p', headless: true, docsUrl: 'https://antigravity.google/docs/cli/headless/' },
-  { id: 'kimi', label: 'Kimi CLI', bin: 'kimi', dirs: [], runner: null, headless: false, docsUrl: 'https://github.com/MoonshotAI/kimi-cli' },
-  { id: 'copilot', label: 'GitHub Copilot CLI', bin: 'copilot', dirs: [], runner: 'copilot -s --allow-all-tools -p', headless: true, docsUrl: 'https://docs.github.com/copilot/concepts/agents/about-copilot-cli' },
-  { id: 'amazon-q', label: 'Amazon Q Developer CLI', bin: 'q', dirs: ['.amazonq'], runner: 'q chat --no-interactive --trust-all-tools', headless: true, docsUrl: 'https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-chat.html' },
-  { id: 'droid', label: 'Factory Droid CLI', bin: 'droid', dirs: ['.factory'], runner: 'droid exec', headless: true, docsUrl: 'https://docs.factory.ai/droid-exec/overview' },
-  { id: 'auggie', label: 'Auggie CLI', bin: 'auggie', dirs: ['.augment'], runner: 'auggie --quiet --print', headless: true, docsUrl: 'https://docs.augmentcode.com/cli/overview' },
-  { id: 'goose', label: 'Goose CLI', bin: 'goose', dirs: ['.goose'], runner: 'goose run -t', headless: true, docsUrl: 'https://block.github.io/goose/' },
-];
-
-// Is `bin` an executable resolvable on PATH? On win32, an extension from PATHEXT is required, so we
-// try each; we also try the bare name (covers test fixtures and extensionless shims).
-function binOnPath(bin, { env = process.env, platform = process.platform } = {}) {
-  const raw = env.PATH || env.Path || '';
-  const dirs = raw.split(path.delimiter).filter(Boolean);
-  const exts =
-    platform === 'win32' ? ['', ...(env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean)] : [''];
-  for (const d of dirs) {
-    for (const e of exts) {
-      if (fs.existsSync(path.join(d, bin + e))) return true;
-    }
-  }
-  return false;
-}
-
-// True if `id` looks genuinely installed: its bin resolves on PATH, or the project already has its
-// config dir (a project can be set up for an agent whose bin isn't on THIS machine's PATH, e.g. a
-// remote/CI runner). Unknown ids are never "installed".
-function isAgentInstalled(id, projectRoot, opts) {
-  const a = KNOWN_AGENTS.find((x) => x.id === id);
-  if (!a) return false;
-  if (a.bin && binOnPath(a.bin, opts)) return true;
-  return (a.dirs || []).some((d) => fs.existsSync(path.join(projectRoot, d)));
-}
-
-// ids of every known agent actually installed for this project, in KNOWN_AGENTS (priority) order.
-function installedAgents(projectRoot, opts) {
-  return KNOWN_AGENTS.filter((a) => isAgentInstalled(a.id, projectRoot, opts)).map((a) => a.id);
-}
-
-module.exports = { KNOWN_AGENTS, binOnPath, isAgentInstalled, installedAgents };