tycono 0.1.25 → 0.1.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tycono",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Build an AI company. Watch them work.",
   "type": "module",
   "bin": {

package/src/api/src/routes/knowledge.ts

@@ -13,8 +13,8 @@ import { COMPANY_ROOT } from '../services/file-reader.js';
 
 export const knowledgeRouter = Router();
 
-const knowledgeDir = path.join(COMPANY_ROOT, 'knowledge');
-const companyRoot = COMPANY_ROOT;
+function knowledgeDir(): string { return path.join(COMPANY_ROOT, 'knowledge'); }
+function companyRoot(): string { return COMPANY_ROOT; }
 
 /* ─── Helpers ─────────────────────────────────────── */
 
@@ -61,13 +61,13 @@ function inferCategory(filePath: string, tags: string[]): string {
 
 knowledgeRouter.get('/', (_req: Request, res: Response, next: NextFunction) => {
   try {
-    if (!fs.existsSync(companyRoot)) {
+    if (!fs.existsSync(companyRoot())) {
       res.json([]);
       return;
     }
 
     const files = glob.sync('**/*.{md,html}', {
-      cwd: companyRoot,
+      cwd: companyRoot(),
       ignore: [
         'node_modules/**', '.claude/**', '.obsidian/**', '.tycono/**', '.git/**',
         '**/node_modules/**',
@@ -82,7 +82,7 @@ knowledgeRouter.get('/', (_req: Request, res: Response, next: NextFunction) => {
       .sort();
 
     const docs = files.map((f) => {
-      const absPath = path.join(companyRoot, f);
+      const absPath = path.join(companyRoot(), f);
       let raw = '';
       try { raw = fs.readFileSync(absPath, 'utf-8'); } catch { return null; }
 
@@ -165,9 +165,9 @@ knowledgeRouter.post('/', (req: Request, res: Response, next: NextFunction) => {
     // Sanitize filename
     const safeName = filename.replace(/[^a-zA-Z0-9가-힣_\-. ]/g, '').replace(/\s+/g, '-');
     const fullName = safeName.endsWith('.md') ? safeName : `${safeName}.md`;
-    const absPath = path.join(knowledgeDir, fullName);
+    const absPath = path.join(knowledgeDir(), fullName);
 
-    if (!absPath.startsWith(knowledgeDir)) {
+    if (!absPath.startsWith(knowledgeDir())) {
       res.status(403).json({ error: 'Forbidden' });
       return;
     }
@@ -206,8 +206,8 @@ knowledgeRouter.put('/{*path}', (req: Request, res: Response, next: NextFunction
       return;
     }
 
-    const absPath = path.join(companyRoot, docId);
-    if (!absPath.startsWith(companyRoot)) {
+    const absPath = path.join(companyRoot(), docId);
+    if (!absPath.startsWith(companyRoot())) {
       res.status(403).json({ error: 'Forbidden' });
       return;
     }
@@ -248,8 +248,8 @@ knowledgeRouter.delete('/{*path}', (req: Request, res: Response, next: NextFunct
       return;
     }
 
-    const absPath = path.join(companyRoot, docId);
-    if (!absPath.startsWith(companyRoot)) {
+    const absPath = path.join(companyRoot(), docId);
+    if (!absPath.startsWith(companyRoot())) {
       res.status(403).json({ error: 'Forbidden' });
       return;
     }
@@ -277,10 +277,10 @@ knowledgeRouter.get('/{*path}', (req: Request, res: Response, next: NextFunction
       return;
     }
 
-    const absPath = path.join(knowledgeDir, docId);
+    const absPath = path.join(knowledgeDir(), docId);
 
     // Security: ensure path stays within knowledgeDir
-    if (!absPath.startsWith(knowledgeDir)) {
+    if (!absPath.startsWith(knowledgeDir())) {
       res.status(403).json({ error: 'Forbidden' });
       return;
     }

package/src/api/src/routes/setup.ts

@@ -16,6 +16,7 @@ import { AnthropicProvider, type LLMProvider } from '../engine/llm-adapter.js';
 import { jobManager } from '../services/job-manager.js';
 import { applyConfig, readConfig, writeConfig } from '../services/company-config.js';
 import { mergePreferences } from '../services/preferences.js';
+import { setCompanyRoot } from '../services/file-reader.js';
 
 export const setupRouter = Router();
 
@@ -82,28 +83,33 @@ setupRouter.post('/validate-path', (req, res) => {
  * POST /api/setup/scaffold
  */
 setupRouter.post('/scaffold', (req, res) => {
-  const { companyName, description, apiKey, team, existingProjectPath, knowledgePaths, codeRoot, language } = req.body;
+  const { companyName, description, apiKey, team, existingProjectPath, knowledgePaths, codeRoot, language, location } = req.body;
 
   if (!companyName || typeof companyName !== 'string') {
     res.status(400).json({ error: 'companyName is required' });
     return;
   }
 
-  const baseRoot = process.env.COMPANY_ROOT || process.cwd();
-
-  // Safety: if CWD is a dangerous path (home dir, root, or has too many entries),
-  // scaffold into a subdirectory named after the company
-  const dangerousPaths = new Set(['/', os.homedir(), os.tmpdir()]);
-  const isDangerous = dangerousPaths.has(baseRoot) || baseRoot === '/tmp';
-  let projectRoot = baseRoot;
-  if (isDangerous) {
-    const slug = companyName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'my-company';
-    projectRoot = path.join(baseRoot, slug);
-    if (!fs.existsSync(projectRoot)) {
-      fs.mkdirSync(projectRoot, { recursive: true });
+  // Determine project root: explicit location from wizard > fallback to CWD with safety check
+  let projectRoot: string;
+  if (location && typeof location === 'string') {
+    projectRoot = path.resolve(location);
+  } else {
+    const baseRoot = process.env.COMPANY_ROOT || process.cwd();
+    const dangerousPaths = new Set(['/', os.homedir(), os.tmpdir()]);
+    const isDangerous = dangerousPaths.has(baseRoot) || baseRoot === '/tmp';
+    if (isDangerous) {
+      const slug = companyName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'my-company';
+      projectRoot = path.join(baseRoot, slug);
+    } else {
+      projectRoot = baseRoot;
     }
   }
 
+  if (!fs.existsSync(projectRoot)) {
+    fs.mkdirSync(projectRoot, { recursive: true });
+  }
+
   const config: ScaffoldConfig = {
     companyName,
     description: description || 'An AI-powered organization',
@@ -117,7 +123,7 @@ setupRouter.post('/scaffold', (req, res) => {
   try {
     const created = scaffold(config);
 
-    process.env.COMPANY_ROOT = projectRoot;
+    setCompanyRoot(projectRoot);
     // Load config.json written by scaffold and apply to process.env
     const scaffoldConfig = applyConfig(projectRoot);
     // Save codeRoot if provided
@@ -212,7 +218,7 @@ setupRouter.post('/connect-akb', (req, res) => {
     if (match) companyName = match[1].trim();
   } catch { /* ignore */ }
 
-  process.env.COMPANY_ROOT = resolved;
+  setCompanyRoot(resolved);
 
   // Load existing config.json if present
   const config = readConfig(resolved);

package/src/api/src/services/activity-stream.ts

@@ -24,16 +24,19 @@ export interface ActivityEvent {
 
 /* ─── Constants ──────────────────────────── */
 
-const STREAMS_DIR = path.join(COMPANY_ROOT, 'operations', 'activity-streams');
+function streamsDir(): string {
+  return path.join(COMPANY_ROOT, 'operations', 'activity-streams');
+}
 
 function ensureDir(): void {
-  if (!fs.existsSync(STREAMS_DIR)) {
-    fs.mkdirSync(STREAMS_DIR, { recursive: true });
+  const dir = streamsDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
   }
 }
 
 function streamPath(jobId: string): string {
-  return path.join(STREAMS_DIR, `${jobId}.jsonl`);
+  return path.join(streamsDir(), `${jobId}.jsonl`);
 }
 
 /* ─── Subscriber type ────────────────────── */
@@ -149,7 +152,7 @@ export class ActivityStream {
   /** List all stream files (job IDs) */
   static listAll(): string[] {
     ensureDir();
-    return fs.readdirSync(STREAMS_DIR)
+    return fs.readdirSync(streamsDir())
       .filter(f => f.endsWith('.jsonl'))
       .map(f => f.replace('.jsonl', ''));
   }

package/src/api/src/services/activity-tracker.ts

@@ -2,7 +2,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { COMPANY_ROOT } from './file-reader.js';
 
-const ACTIVITY_DIR = path.join(COMPANY_ROOT, 'operations', 'activity');
+function activityDir(): string {
+  return path.join(COMPANY_ROOT, 'operations', 'activity');
+}
 
 export interface RoleActivity {
   roleId: string;
@@ -14,12 +16,13 @@ export interface RoleActivity {
 }
 
 function activityPath(roleId: string): string {
-  return path.join(ACTIVITY_DIR, `${roleId}.json`);
+  return path.join(activityDir(), `${roleId}.json`);
 }
 
 function ensureDir(): void {
-  if (!fs.existsSync(ACTIVITY_DIR)) {
-    fs.mkdirSync(ACTIVITY_DIR, { recursive: true });
+  const dir = activityDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
   }
 }
 
@@ -71,10 +74,10 @@ export function getActivity(roleId: string): RoleActivity | null {
 
 export function getAllActivities(): RoleActivity[] {
   ensureDir();
-  const files = fs.readdirSync(ACTIVITY_DIR).filter(f => f.endsWith('.json'));
+  const files = fs.readdirSync(activityDir()).filter(f => f.endsWith('.json'));
   return files.map(f => {
     try {
-      return JSON.parse(fs.readFileSync(path.join(ACTIVITY_DIR, f), 'utf-8'));
+      return JSON.parse(fs.readFileSync(path.join(activityDir(), f), 'utf-8'));
     } catch {
       return null;
     }

package/src/api/src/services/file-reader.ts

@@ -14,7 +14,13 @@ function findCompanyRoot(): string {
   return process.cwd();
 }
 
-export const COMPANY_ROOT = findCompanyRoot();
+export let COMPANY_ROOT = findCompanyRoot();
+
+/** Update COMPANY_ROOT at runtime (e.g. after scaffold picks a new location) */
+export function setCompanyRoot(root: string): void {
+  COMPANY_ROOT = root;
+  process.env.COMPANY_ROOT = root;
+}
 
 function resolve(...segments: string[]): string {
   return path.resolve(COMPANY_ROOT, ...segments);

package/src/api/src/services/session-store.ts

@@ -26,16 +26,19 @@ export interface Session {
 
 /* ─── Session directory ─────────────────── */
 
-const SESSIONS_DIR = path.join(COMPANY_ROOT, 'operations', 'sessions');
+function sessionsDir(): string {
+  return path.join(COMPANY_ROOT, 'operations', 'sessions');
+}
 
 function ensureDir(): void {
-  if (!fs.existsSync(SESSIONS_DIR)) {
-    fs.mkdirSync(SESSIONS_DIR, { recursive: true });
+  const dir = sessionsDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
   }
 }
 
 function sessionPath(id: string): string {
-  return path.join(SESSIONS_DIR, `${id}.json`);
+  return path.join(sessionsDir(), `${id}.json`);
 }
 
 /* ─── Debounced write ───────────────────── */
@@ -69,10 +72,10 @@ const cache = new Map<string, Session>();
 
 function loadAll(): void {
   ensureDir();
-  const files = fs.readdirSync(SESSIONS_DIR).filter((f) => f.endsWith('.json'));
+  const files = fs.readdirSync(sessionsDir()).filter((f) => f.endsWith('.json'));
   for (const file of files) {
     try {
-      const data = JSON.parse(fs.readFileSync(path.join(SESSIONS_DIR, file), 'utf-8')) as Session;
+      const data = JSON.parse(fs.readFileSync(path.join(sessionsDir(), file), 'utf-8')) as Session;
       cache.set(data.id, data);
     } catch { /* skip corrupted */ }
   }