tumwater 0.2.0 → 0.3.0

package/dist/src/gui/gui-config-commands.js

@@ -10,16 +10,16 @@
 import { setConfigKey, setDailyBudgetUsd, setRoleModelFields, unsetConfigKey } from "../config/config-write.js";
 import { checkDailyBudgetUsd, checkMinRunInterval } from "../config/config-keys.js";
 import { testNotifyHook } from "../cli/notify-command.js";
-import { rejectBadRole, requireConfigKey } from "./gui-args.js";
-import { baseRoleOf } from "../roles/loop-ids.js";
+import { rejectBadRole, requireConfigKey, requireRoleField, requireStringField } from "./gui-args.js";
+import { baseRoleOf } from "../roles/runner-ids.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { badRequest, sendJson } from "./http-body.js";
-import { gotSuffix } from "../text/text.js";
 import { readPostBody } from "./gui-endpoint-common.js";
 /** Handle POST /api/budget: the dashboard's budget-badge editor saves the daily cost cap —
  * same body discipline as /api/prompt (readJsonObject), and the same shared validation rule +
  * atomic setter the TUI's Ctrl+B uses, so both surfaces write tumwater.json identically and
- * the running orchestrator picks the change up on its next ~2 s poll. */
+ * the running orchestrator picks the change up on its next ~2 s poll. A cap already in place
+ * answers `unchanged: true` and writes nothing. */
 export async function handleBudget(req, res, root) {
     const body = await readPostBody(req, res, '{"maxDailyCostUsd": 25}');
     if (!body)
@@ -43,7 +43,7 @@ export async function handleBudget(req, res, root) {
         sendJson(res, 500, { error: result.error });
         return;
     }
-    sendJson(res, 200, { ok: true, maxDailyCostUsd: value });
+    sendJson(res, 200, { ok: true, maxDailyCostUsd: value, ...unchangedFlag(result) });
 }
 /** Handle POST /api/role-cap: the dashboard role drawer's editor saves one role's daily cost
  * cap — the control the amber role-cap alert remedies. Same body discipline as /api/budget
@@ -52,18 +52,16 @@ export async function handleBudget(req, res, root) {
  * through the CLI's own setConfigKey dotted path so the per-key validator and whole-candidate
  * validateConfig (which rejects an unknown role id) own the final truth. The director has no
  * cap (role-view.ts's guard exempts it), so it is refused up front with wording that mirrors
- * handleRoleNotes. A bare `feature-2` loop id maps to its base role's cap (baseRoleOf), since
+ * handleRoleNotes. A bare `feature-2` role id maps to its base role's cap (baseRoleOf), since
  * the cap is about the role. A write failure is configKeyError's 400 exactly as handleConfigSet
- * reports it. */
+ * reports it. A no-op write answers `unchanged: true`. */
 export async function handleRoleCap(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "feature", "maxDailyCostUsd": 2}');
     if (!body)
         return;
-    const role = body.role;
-    if (typeof role !== "string" || role.trim() === "") {
-        badRequest(res, "role required");
+    const role = requireRoleField(res, body);
+    if (role === null)
         return;
-    }
     if (role === DIRECTOR_ROLE) {
         badRequest(res, "the director has no daily cap");
         return;
@@ -86,7 +84,7 @@ export async function handleRoleCap(req, res, root) {
     const result = setConfigKey(root, "maxDailyCostUsdPerRole." + baseRole, JSON.stringify(value));
     if (!result.ok)
         return configKeyError(res, "maxDailyCostUsdPerRole." + baseRole, result);
-    sendJson(res, 200, { ok: true, role: baseRole, maxDailyCostUsd: value });
+    sendJson(res, 200, { ok: true, role: baseRole, maxDailyCostUsd: value, ...unchangedFlag(result) });
 }
 /** Handle POST /api/role-interval: the role drawer's min run interval editor sets or clears
  * one role's override of the team-wide minRunIntervalSeconds — the knob that makes one role
@@ -95,19 +93,17 @@ export async function handleRoleCap(req, res, root) {
  * value clears the key through unsetConfigKey (so the role falls back to the team-wide
  * interval), otherwise the write rides the CLI's own setConfigKey dotted path so
  * checkMinRunInterval and whole-candidate validateConfig (which rejects an unknown role id)
- * own the final truth. The director is accepted here — it ticks on the same clock, unlike
- * the cap's director exemption. A bare `feature-2` loop id maps to its base role's override
+ * own the final truth. The director is accepted here — it runs on the same clock, unlike
+ * the cap's director exemption. A bare `feature-2` role id maps to its base role's override
  * (baseRoleOf), since the interval is about the role. A write failure is configKeyError's 400
- * exactly as handleRoleCap reports it. */
+ * exactly as handleRoleCap reports it. A no-op set or clear says so in its message. */
 export async function handleRoleInterval(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "feature", "minRunIntervalSeconds": 300}');
     if (!body)
         return;
-    const role = body.role;
-    if (typeof role !== "string" || role.trim() === "") {
-        badRequest(res, "role required");
+    const role = requireRoleField(res, body);
+    if (role === null)
         return;
-    }
     const value = body.minRunIntervalSeconds;
     if (value === undefined) {
         badRequest(res, "minRunIntervalSeconds required");
@@ -126,7 +122,10 @@ export async function handleRoleInterval(req, res, root) {
         const clearResult = unsetConfigKey(root, `roles.${base}.minRunIntervalSeconds`);
         if (!clearResult.ok)
             return configKeyError(res, `roles.${base}.minRunIntervalSeconds`, clearResult);
-        sendJson(res, 200, { ok: true, role: base, message: `${base}: min run interval cleared` });
+        const message = clearResult.oldValue === undefined
+            ? `${base}: min run interval is not set in tumwater.json, so nothing was cleared`
+            : `${base}: min run interval cleared`;
+        sendJson(res, 200, { ok: true, role: base, message });
         return;
     }
     // The shared rule (finite 0..MAX_DURATION_SECONDS), naming the per-role dotted key so a
@@ -141,10 +140,13 @@ export async function handleRoleInterval(req, res, root) {
     const result = setConfigKey(root, `roles.${base}.minRunIntervalSeconds`, JSON.stringify(value));
     if (!result.ok)
         return configKeyError(res, `roles.${base}.minRunIntervalSeconds`, result);
-    sendJson(res, 200, { ok: true, role: base, minRunIntervalSeconds: value, message: `${base}: min run interval set to ${value}s` });
+    const message = result.unchanged
+        ? `${base}: min run interval is already ${value}s, so tumwater.json was not written`
+        : `${base}: min run interval set to ${value}s`;
+    sendJson(res, 200, { ok: true, role: base, minRunIntervalSeconds: value, message });
 }
 /** Handle POST /api/role-instances: the role drawer's instance-count editor sets or clears one
- * role's parallel-runner count — the count that lets `feature-2`…`feature-N` tick. Same body
+ * role's parallel-runner count — the count that lets `feature-2`…`feature-N` run. Same body
  * discipline as /api/role-interval (readPostBody → 400 malformed/non-object, 413 oversized); a
  * null, "" or whitespace-only value clears the key through unsetConfigKey (so the role falls
  * back to the default 1), otherwise the write rides the CLI's own setConfigKey dotted path so
@@ -152,18 +154,16 @@ export async function handleRoleInterval(req, res, root) {
  * (unlike handleRoleCap's director exemption): setConfigKey runs the candidate through
  * validateConfig, whose INSTANCE_COUNT rejects 0, 9, 1.5 and `abc` and whose INSTANCE_ROLES
  * branch rejects an instances key under any role but feature and bugfix (the director and
- * custom roles included). A bare `feature-2` loop id maps to its base role's count (baseRoleOf),
+ * custom roles included). A bare `feature-2` role id maps to its base role's count (baseRoleOf),
  * since the count is about the role. A write failure is configKeyError's 400 exactly as
- * handleRoleInterval reports it. */
+ * handleRoleInterval reports it. A no-op set or clear says so in its message. */
 export async function handleRoleInstances(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "feature", "instances": 3}');
     if (!body)
         return;
-    const role = body.role;
-    if (typeof role !== "string" || role.trim() === "") {
-        badRequest(res, "role required");
+    const role = requireRoleField(res, body);
+    if (role === null)
         return;
-    }
     const value = body.instances;
     if (value === undefined) {
         badRequest(res, "instances required");
@@ -182,7 +182,10 @@ export async function handleRoleInstances(req, res, root) {
         const clearResult = unsetConfigKey(root, `roles.${base}.instances`);
         if (!clearResult.ok)
             return configKeyError(res, `roles.${base}.instances`, clearResult);
-        sendJson(res, 200, { ok: true, role: base, message: `${base}: instances cleared` });
+        const message = clearResult.oldValue === undefined
+            ? `${base}: instances is not set in tumwater.json, so nothing was cleared`
+            : `${base}: instances cleared`;
+        sendJson(res, 200, { ok: true, role: base, message });
         return;
     }
     // setConfigKey takes the raw CLI text; a JSON round-trip of an already-parsed value is
@@ -191,7 +194,10 @@ export async function handleRoleInstances(req, res, root) {
     const result = setConfigKey(root, `roles.${base}.instances`, JSON.stringify(value));
     if (!result.ok)
         return configKeyError(res, `roles.${base}.instances`, result);
-    sendJson(res, 200, { ok: true, role: base, instances: value, message: `${base}: instances set to ${value}` });
+    const message = result.unchanged
+        ? `${base}: instances is already ${value}, so tumwater.json was not written`
+        : `${base}: instances set to ${value}`;
+    sendJson(res, 200, { ok: true, role: base, instances: value, message });
 }
 /** Handle POST /api/role-model: the role drawer's Model overrides editor sets or clears one
  * role's provider/model/thinking triple (roles.<base>.provider/.model/.thinking) in one
@@ -200,31 +206,27 @@ export async function handleRoleInstances(req, res, root) {
  * already write it). Same body discipline as /api/role-interval (readPostBody → 400
  * malformed/non-object, 413 oversized); a missing/blank role is a 400 `role required`, each
  * of the three must be a string when present (400 naming the field otherwise), and at least
- * one must be present (400 `provider, model or thinking required`). A bare `feature-2` loop
+ * one must be present (400 `provider, model or thinking required`). A bare `feature-2` role
  * id maps to its base role's keys (baseRoleOf). The director is accepted — configForRole
  * resolves roles.director.* like any role's, matching the CLI's accepted triple for it.
  * Values are trimmed; `""` clears that field (never stored — checkStringField rejects an
  * empty string). The write rides setRoleModelFields, whose validateConfig names
  * roles.<base>.<field> on a bad value and refuses an unknown role, reported as a 400 exactly
- * as handleRoleInterval reports a write failure. */
+ * as handleRoleInterval reports a write failure. A no-op write says so in its message. */
 export async function handleRoleModel(req, res, root) {
-    const body = await readPostBody(req, res, '{"role": "feature", "provider": "claude", "model": "claude-opus-5", "thinking": "high"}');
+    const body = await readPostBody(req, res, '{"role": "feature", "provider": "huggingface", "model": "claude-opus-5", "thinking": "high"}');
     if (!body)
         return;
-    const role = body.role;
-    if (typeof role !== "string" || role.trim() === "") {
-        badRequest(res, "role required");
+    const role = requireRoleField(res, body);
+    if (role === null)
         return;
-    }
     const fields = {};
     for (const key of ["provider", "model", "thinking"]) {
-        const value = body[key];
-        if (value === undefined)
+        if (body[key] === undefined)
             continue;
-        if (typeof value !== "string") {
-            badRequest(res, `"${key}" must be a string — a model override, or "" to clear it${gotSuffix(value)}`);
+        const value = requireStringField(res, body, key, 'a model override, or "" to clear it');
+        if (value === null)
             return;
-        }
         fields[key] = value.trim();
     }
     if (!("provider" in fields) && !("model" in fields) && !("thinking" in fields)) {
@@ -235,12 +237,15 @@ export async function handleRoleModel(req, res, root) {
     const result = setRoleModelFields(root, base, fields);
     if (!result.ok)
         return badRequest(res, result.error);
-    sendJson(res, 200, { ok: true, role: base, message: `${base}: model updated` });
+    const message = result.unchanged
+        ? `${base}: model overrides unchanged, so tumwater.json was not written`
+        : `${base}: model updated`;
+    sendJson(res, 200, { ok: true, role: base, message });
 }
 /** Handle POST /api/role-instructions: the role drawer's standing-instructions editor — the
  * `Instructions override` row's Edit/Save. Same body discipline as /api/role-cap (readPostBody
  * → 400 malformed/non-object, 413 oversized); an empty role id is a 400, and a bare `feature-2`
- * loop id maps to its base role's override (baseRoleOf), the key tick-prompt reads — so an
+ * role id maps to its base role's override (baseRoleOf), the key run-prompt reads — so an
  * instance edits the instructions its runs carry (readRoleBody's shared guard is not used
  * because it rejects instance ids, and the unknown-role check is validateConfig's, below).
  * The director is editable here (its override reaches its runs), unlike handleRoleNotes'
@@ -248,16 +253,17 @@ export async function handleRoleModel(req, res, root) {
  * CLI's --clear-instructions); otherwise the write goes through the CLI's own setConfigKey
  * with the same JSON.stringify wrapper --instructions-file uses, so validateConfig owns the
  * 4096-char cap and the unknown-role check, and a write failure is configKeyError's 400
- * naming the dotted key. */
+ * naming the dotted key. A no-op set or clear says so in its message. */
 export async function handleRoleInstructions(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "feature", "text": "…"}');
     if (!body)
         return;
-    const role = body.role;
-    if (typeof role !== "string" || role.trim() === "")
-        return badRequest(res, "role required");
-    if (typeof body.text !== "string")
-        return badRequest(res, `"text" must be a string — the full replacement instructions, or "" to clear it${gotSuffix(body.text)}`);
+    const role = requireRoleField(res, body);
+    if (role === null)
+        return;
+    const text = requireStringField(res, body, "text", `the full replacement instructions, or "" to clear it`);
+    if (text === null)
+        return;
     const base = baseRoleOf(role);
     // An empty or whitespace-only buffer clears the override, like the CLI's --clear-instructions;
     // otherwise the same JSON.stringify wrapper --instructions-file uses (setConfigKey takes raw
@@ -265,7 +271,7 @@ export async function handleRoleInstructions(req, res, root) {
     // 4096-char cap and the unknown-role check in writeConfigMutation. Unlike quiet hours the
     // clear arm carries no role guard (the director may clear, and the unknown-role clear gap is
     // pre-existing).
-    writeRoleJsonKey(res, root, base, `roles.${base}.instructions`, "instructions", body.text, (v) => JSON.stringify(v), (v) => `${base}: instructions saved (${v.length} chars)`);
+    writeRoleJsonKey(res, root, base, `roles.${base}.instructions`, "instructions", text, (v) => JSON.stringify(v), (v) => `${base}: instructions saved (${v.length} chars)`);
 }
 /** The shared write behind POST /api/role-enable and POST /api/role-disable: the Settings
  * card's Enable button and the role drawer's two-click Disable both write
@@ -273,18 +279,19 @@ export async function handleRoleInstructions(req, res, root) {
  * yields the boolean checkBoolean expects), and validateConfig's unknown-role check refuses an
  * unknown id as configKeyError's 400 before anything is written. Same body discipline as
  * /api/role-cap (readPostBody → 400 malformed/non-object, 413 oversized); a missing,
- * non-string, or blank role is a 400 `role required`, and a bare `feature-2` loop id maps to
+ * non-string, or blank role is a 400 `role required`, and a bare `feature-2` role id maps to
  * its base role's key (baseRoleOf), so an instance disables/enables the role it belongs to.
- * The director cannot be disabled (with it disabled loopIds omits it and no loop dequeues the
+ * The director cannot be disabled (with it disabled runnerIds omits it and no role dequeues the
  * operator's inbox), so a disable is refused explicitly; enabling the director stays harmless
- * and mirrors the CLI's --enable. */
+ * and mirrors the CLI's --enable. A role already in the requested state answers `already
+ * enabled`/`already disabled` and writes nothing. */
 async function setRoleEnabled(req, res, root, enabled) {
     const body = await readPostBody(req, res, '{"role": "selfcheck"}');
     if (!body)
         return;
-    const role = body.role;
-    if (typeof role !== "string" || role.trim() === "")
-        return badRequest(res, "role required");
+    const role = requireRoleField(res, body);
+    if (role === null)
+        return;
     const base = baseRoleOf(role);
     if (!enabled && base === DIRECTOR_ROLE)
         return badRequest(res, "the director cannot be disabled");
@@ -294,7 +301,8 @@ async function setRoleEnabled(req, res, root, enabled) {
     const result = setConfigKey(root, key, enabled ? "true" : "false");
     if (!result.ok)
         return configKeyError(res, key, result);
-    sendJson(res, 200, { ok: true, role: base, message: `${base}: ${enabled ? "enabled" : "disabled"}` });
+    const state = enabled ? "enabled" : "disabled";
+    sendJson(res, 200, { ok: true, role: base, message: result.unchanged ? `${base}: already ${state}` : `${base}: ${state}` });
 }
 /** Handle POST /api/role-enable: the Settings view's "Disabled roles" card Enable button —
  * re-enables one disabled role (the GUI half of the CLI's `tumwater role <id> --enable`). Body
@@ -313,7 +321,7 @@ export async function handleRoleDisable(req, res, root) {
  * role's daily quiet-hours window — the control the `Quiet hours` row it already shows leads
  * to (the counterpart of the in-flight `tumwater role <id> --quiet-hours` CLI write). Same body
  * discipline as /api/role-cap (readPostBody → 400 malformed/non-object, 413 oversized); a
- * missing/blank role is a 400, and a bare `feature-2` loop id maps to its base role's key
+ * missing/blank role is a 400, and a bare `feature-2` role id maps to its base role's key
  * (baseRoleOf), so an instance edits the window its runs read. The director is refused up front:
  * `quietHoursPerRole.director` is inert (roleQuietHold and doctor both exempt the director). An
  * empty/whitespace-only window clears the key (unsetConfigKey, like the CLI's --clear-quiet-hours);
@@ -321,18 +329,20 @@ export async function handleRoleDisable(req, res, root) {
  * map path skips validateConfig — the guard the set branch gets free from validateConfig's
  * unknown-role refusal; otherwise the write goes through setConfigKey with the same
  * JSON.stringify wrapper, so checkQuietHours (naming quietHoursPerRole.<base>) and validateConfig
- * own the truth, and a write failure is configKeyError's 400 naming the dotted key. */
+ * own the truth, and a write failure is configKeyError's 400 naming the dotted key. A no-op set
+ * or clear says so in its message. */
 export async function handleRoleQuietHours(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "feature", "window": "23:00-07:00"}');
     if (!body)
         return;
-    const role = body.role;
-    if (typeof role !== "string" || role.trim() === "")
-        return badRequest(res, "role required");
+    const role = requireRoleField(res, body);
+    if (role === null)
+        return;
     if (role === DIRECTOR_ROLE)
         return badRequest(res, "the director has no quiet hours");
-    if (typeof body.window !== "string")
-        return badRequest(res, `"window" must be a string — a window like 23:00-07:00, or "" to clear it${gotSuffix(body.window)}`);
+    const window = requireStringField(res, body, "window", `a window like 23:00-07:00, or "" to clear it`);
+    if (window === null)
+        return;
     const base = baseRoleOf(role);
     // An empty or whitespace-only window clears the hold, like the CLI's --clear-quiet-hours;
     // the clear arm carries rejectBadRole because unsetConfigKey's no-op map path (a role the
@@ -340,7 +350,7 @@ export async function handleRoleQuietHours(req, res, root) {
     // branch's unknown-role refusal would never fire on a clear and a bogus id would answer 200
     // "cleared" (mirrors the CLI's knownRoleIds guard). The set arm runs setConfigKey raw, its
     // map branch checking the dotted key as the label and validateConfig owning the unknown role.
-    writeRoleJsonKey(res, root, base, `quietHoursPerRole.${base}`, "quiet hours", body.window, (v) => JSON.stringify(v), (v) => `${base}: quiet hours set to ${v}`, () => rejectBadRole(root, res, role));
+    writeRoleJsonKey(res, root, base, `quietHoursPerRole.${base}`, "quiet hours", window, (v) => JSON.stringify(v), (v) => `${base}: quiet hours set to ${v}`, () => rejectBadRole(root, res, role));
 }
 /** The shared 400 for a failed config mutation — the set and unset write paths both nest the
  * write's error under the key it names, so the Settings view can tell which field failed and a
@@ -349,6 +359,12 @@ export async function handleRoleQuietHours(req, res, root) {
 function configKeyError(res, key, result) {
     badRequest(res, `${key}: ${result.error}`);
 }
+/** The `unchanged: true` field a no-op config write adds to its 200 reply, or nothing when
+ * the write changed the file — spread into the body by the budget, role-cap, and config-set
+ * handlers. */
+function unchangedFlag(result) {
+    return result.unchanged ? { unchanged: true } : {};
+}
 /** The set-or-clear write the two per-role JSON-config-key handlers (quiet hours, standing
  * instructions) share: an empty/whitespace `raw` unsets `key` (after `guardClear`, a per-call
  * check the clear arm runs first — quiet hours' unknown-role guard; instructions has none),
@@ -363,15 +379,21 @@ function writeRoleJsonKey(res, root, base, key, noun, raw, serialize, setMessage
         const result = unsetConfigKey(root, key);
         if (!result.ok)
             configKeyError(res, key, result);
-        else
-            sendJson(res, 200, { ok: true, role: base, message: `${base}: ${noun} cleared` });
+        else {
+            const message = result.oldValue === undefined
+                ? `${base}: ${noun} is not set in tumwater.json, so nothing was cleared`
+                : `${base}: ${noun} cleared`;
+            sendJson(res, 200, { ok: true, role: base, message });
+        }
         return;
     }
     const result = setConfigKey(root, key, serialize(raw));
     if (!result.ok)
         configKeyError(res, key, result);
-    else
-        sendJson(res, 200, { ok: true, role: base, message: setMessage(raw) });
+    else {
+        const message = result.unchanged ? `${base}: ${noun} unchanged, so tumwater.json was not written` : setMessage(raw);
+        sendJson(res, 200, { ok: true, role: base, message });
+    }
 }
 /** Handle POST /api/config-set: the Settings view's per-key Save — one curated key set to
  * one JSON value, through setConfigKey so the browser cannot drift from the CLI's rules
@@ -382,7 +404,7 @@ function writeRoleJsonKey(res, root, base, key, noun, raw, serialize, setMessage
  * JSON.stringify before setConfigKey parses it back, so `set model gpt-5`'s
  * JSON-or-literal rule is bypassed harmlessly: the browser already sent parsed JSON.
  * Same body discipline as /api/budget (readPostBody → 400 malformed/non-object, 413
- * oversized). */
+ * oversized). A value already in place answers `unchanged: true`. */
 export async function handleConfigSet(req, res, root) {
     const body = await readPostBody(req, res, '{"key": "model", "value": "gpt-5"}');
     if (!body)
@@ -399,7 +421,7 @@ export async function handleConfigSet(req, res, root) {
     const result = setConfigKey(root, key, JSON.stringify(body.value));
     if (!result.ok)
         return configKeyError(res, key, result);
-    sendJson(res, 200, { ok: true, key, value: result.value, oldValue: result.oldValue });
+    sendJson(res, 200, { ok: true, key, value: result.value, oldValue: result.oldValue, ...unchangedFlag(result) });
 }
 /** Handle POST /api/config-unset: the Settings view's per-key Clear — one curated key removed,
  * through unsetConfigKey so the browser cannot drift from `tumwater config unset`'s rules

package/dist/src/gui/gui-endpoint-commands.js

@@ -1,8 +1,9 @@
 /**
  * The dashboard's POST operator endpoint namespace (src/gui/gui-server.ts routes to these
  * handlers): one file per domain, each adapting HTTP onto the domain work one layer down, all
- * gathered here. The GET data endpoints (transcript, backlog, report, failures, history, tick,
- * diff, config) stay in gui/gui-endpoints.ts; the shared request-body helpers
+ * gathered here. The GET data endpoints are barrelled into gui/gui-endpoints.ts from one module
+ * per family (gui-history-endpoints, gui-backlog-endpoints, gui-report-endpoints,
+ * gui-admin-endpoints); the shared request-body helpers
  * (readPostBody, readRoleBody, sendRequestResult) live in gui/gui-endpoint-common.ts. The
  * per-domain command modules, each a thin HTTP adapter touching no socket beyond its own `res`:
  * prompt queueing/cancel/edit (gui/gui-prompt-commands), backlog entry file/cancel/edit +
@@ -15,4 +16,4 @@ export { handlePrompt, handlePromptRole, handlePromptCancel, handlePromptEdit, h
 export { handleQuestionAnswer, handleBacklogFile, handleBacklogCancel, handleBacklogRelease, handleBacklogTop, handleBacklogEdit } from "./gui-backlog-commands.js";
 export { handleConfigSet, handleConfigUnset, handleBudget, handleRoleCap, handleRoleEnable, handleRoleDisable, handleRoleInstances, handleRoleInterval, handleRoleInstructions, handleRoleModel, handleRoleQuietHours, handleNotifyTest } from "./gui-config-commands.js";
 export { handlePause, handlePauseRole, handleWake, handleWakeCancel } from "./gui-team-commands.js";
-export { handleResetCounters, handleRestart, handleReclaim, handleAbort, handleStopSchedule, handleRoleNotes, handleRetire, handleBriefEdit } from "./gui-operator-commands.js";
+export { handleResetCounters, handleRestart, handleReclaim, handleKillOrphans, handleDoctorReprobe, handleAbort, handleStopSchedule, handleRoleNotes, handleRetire, handleRevert, handleQueueCancel, handleBriefEdit } from "./gui-operator-commands.js";

package/dist/src/gui/gui-endpoint-common.js

@@ -25,10 +25,10 @@ export async function readPostBody(req, res, example) {
  * wake/abort/prompt-role/pause-role family states the body-discipline-and-role-check pairing
  * once instead of two guard lines per handler. Its null return means the response is already
  * written and the handler must stop; callers keep their own `if (!body) return` bail. Exactly
- * seven call sites — handlePromptRole, handleWake, handleWakeCancel and handleResetCounters
- * (allowMissing, the {} → all-roles default), handleAbort, handlePauseRole, and
- * handleRoleNotes; handlePromptCancel deliberately does not ride it, since its role is
- * optional and validates only when present. */
+ * eight call sites — handlePromptRole, handleWake, handleWakeCancel and handleResetCounters
+ * (allowMissing, the {} → all-roles default), handleAbort, handlePauseRole,
+ * handleRoleNotes, and handleRetire; handlePromptCancel deliberately does not ride it, since
+ * its role is optional and validates only when present. */
 export async function readRoleBody(req, res, example, root, allowMissing = false) {
     const body = await readPostBody(req, res, example);
     if (body === null)