voidforge-build 23.9.1

package/dist/wizard/api/danger-room.js

@@ -0,0 +1,274 @@
+/**
+ * Danger Room API — Real-time data feeds for the mission control dashboard.
+ *
+ * v22.0 (ADR-041 M1): All project-scoped routes use resolveProject() middleware.
+ * Routes registered at /api/projects/:id/danger-room/* with param routing.
+ *
+ * Shared parsers and WebSocket infra live in wizard/lib/dashboard-*.ts.
+ */
+import { readdir, stat, open } from 'node:fs/promises';
+import { join } from 'node:path';
+import { watch, existsSync } from 'node:fs';
+import { readHeartbeatSnapshot } from '../lib/treasury-reader.js';
+import { addRoute } from '../router.js';
+import { sendJson, readFileOrNull } from '../lib/http-helpers.js';
+import { resolveProject } from '../lib/project-scope.js';
+import { TREASURY_DIR } from '../lib/financial-core.js';
+import { parseCampaignState, parseBuildState, parseFindings, readDeployLog, readVersion, readContextStats, readTestResults, readGitStatus, detectDeployDrift, } from '../lib/dashboard-data.js';
+import { createDashboardWs } from '../lib/dashboard-ws.js';
+import { DaemonAggregator } from '../lib/daemon-aggregator.js';
+// ── WebSocket ───────────────────────────────────
+const ws = createDashboardWs('Danger Room');
+/** Aggregates daemon status across all projects for the dashboard. */
+const aggregator = new DaemonAggregator(30_000);
+/** Broadcast a message to all connected Danger Room clients. */
+export const broadcastDangerRoom = ws.broadcast;
+/** Start the daemon aggregator (call during dashboard setup). */
+export function startDaemonAggregator() {
+    aggregator.start();
+}
+/** Get aggregated daemon status for all projects. */
+export function getDaemonStatus() {
+    return aggregator.getStatus();
+}
+/** Close all Danger Room WebSocket connections, activity watcher, and shut down. */
+export function closeDangerRoom() {
+    ws.close();
+    aggregator.stop();
+    if (activityPollInterval)
+        clearInterval(activityPollInterval);
+    if (activityWatcher) {
+        try {
+            activityWatcher.close();
+        }
+        catch { /* ignore */ }
+        activityWatcher = null;
+    }
+    if (activityDebounce)
+        clearTimeout(activityDebounce);
+}
+/** Handle WebSocket upgrade for /ws/danger-room. Accepts optional projectId for subscription filtering. */
+export const handleDangerRoomUpgrade = (req, socket, head, projectId) => ws.handleUpgrade(req, socket, head, projectId);
+// ── Agent Activity Watcher (global — wizard operational logs) ──
+// This watches the wizard's own agent-activity.jsonl, not a user project's.
+// Will be scoped per-project via subscription rooms in M5.
+let activityFile = join(process.cwd(), 'logs', 'agent-activity.jsonl');
+// Try to find it relative to CWD (where the wizard was launched)
+let lastActivitySize = 0;
+let activityDebounce = null;
+let activityCheckInProgress = false;
+async function checkAgentActivity() {
+    if (activityCheckInProgress)
+        return;
+    activityCheckInProgress = true;
+    try {
+        await _checkAgentActivity();
+    }
+    finally {
+        activityCheckInProgress = false;
+    }
+}
+async function _checkAgentActivity() {
+    try {
+        const st = await stat(activityFile);
+        if (st.size <= lastActivitySize)
+            return;
+        const fd = await open(activityFile, 'r');
+        const buf = Buffer.alloc(st.size - lastActivitySize);
+        await fd.read(buf, 0, buf.length, lastActivitySize);
+        await fd.close();
+        const newContent = buf.toString('utf-8');
+        const newLines = newContent.trim().split('\n').filter(Boolean);
+        lastActivitySize = st.size;
+        for (const line of newLines) {
+            try {
+                const entry = JSON.parse(line);
+                if (entry.agent) {
+                    const agent = String(entry.agent).slice(0, 50);
+                    const action = String(entry.task || entry.status || 'dispatched').slice(0, 200);
+                    ws.broadcast({ type: 'agent-activity', agent, action });
+                }
+            }
+            catch { /* skip malformed lines */ }
+        }
+    }
+    catch { /* file doesn't exist yet */ }
+}
+let activityWatcher = null;
+function setupActivityWatch() {
+    if (activityWatcher)
+        return;
+    try {
+        activityWatcher = watch(activityFile, { persistent: false }, () => {
+            if (activityDebounce)
+                clearTimeout(activityDebounce);
+            activityDebounce = setTimeout(checkAgentActivity, 200);
+        });
+        activityWatcher.on('error', () => { activityWatcher = null; });
+    }
+    catch { /* file doesn't exist yet */ }
+}
+setupActivityWatch();
+const activityPollInterval = setInterval(() => {
+    if (!activityWatcher)
+        setupActivityWatch();
+    checkAgentActivity();
+}, 3000);
+// ── Project-scoped REST endpoints (/api/projects/:id/danger-room/*) ──
+addRoute('GET', '/api/projects/:id/danger-room/campaign', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await parseCampaignState(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/danger-room/build', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await parseBuildState(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/danger-room/findings', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await parseFindings(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/danger-room/version', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await readVersion(resolved.context.directory));
+});
+addRoute('GET', '/api/projects/:id/danger-room/deploy', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await readDeployLog(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/danger-room/context', async (_req, res) => {
+    // Context stats are global (user-scoped Claude session) — no project resolution needed
+    sendJson(res, 200, await readContextStats());
+});
+addRoute('GET', '/api/projects/:id/danger-room/experiments', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    try {
+        const { listExperiments } = await import('../lib/experiment.js');
+        const experiments = await listExperiments();
+        sendJson(res, 200, { experiments, total: experiments.length });
+    }
+    catch {
+        sendJson(res, 200, { experiments: [], total: 0 });
+    }
+});
+addRoute('GET', '/api/projects/:id/danger-room/tests', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await readTestResults(resolved.context.directory, resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/danger-room/git-status', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await readGitStatus(resolved.context.directory));
+});
+addRoute('GET', '/api/projects/:id/danger-room/drift', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await detectDeployDrift(resolved.context.logsDir, resolved.context.directory));
+});
+// ── Danger Room-specific endpoints ───────────────
+addRoute('GET', '/api/projects/:id/danger-room/heartbeat', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    const ctx = resolved.context;
+    // Financial vault check uses global treasury dir (vault stays user-scoped per ADR-040 §4)
+    const vaultCheckPath = join(TREASURY_DIR, 'vault.enc');
+    const snapshot = await readHeartbeatSnapshot(ctx.treasuryDir, ctx.stateFile, vaultCheckPath);
+    sendJson(res, 200, snapshot);
+});
+addRoute('POST', '/api/projects/:id/danger-room/freeze', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    // Deployer+ required for freeze (safety-critical operation)
+    if (resolved.role !== 'deployer' && resolved.role !== 'admin') {
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const ctx = resolved.context;
+    try {
+        const net = await import('node:net');
+        const { readFile: fsReadFile } = await import('node:fs/promises');
+        if (!existsSync(ctx.socketPath)) {
+            sendJson(res, 503, { ok: false, error: 'Heartbeat daemon not running. Start with: voidforge heartbeat start' });
+            return;
+        }
+        let authToken = '';
+        try {
+            authToken = (await fsReadFile(ctx.tokenFile, 'utf-8')).trim();
+        }
+        catch {
+            // No fallback to global token (v22.0.x P1-C — fragile trust model removed)
+            sendJson(res, 503, { ok: false, error: 'Cannot read daemon auth token — heartbeat may not be configured for this project' });
+            return;
+        }
+        const response = await new Promise((resolve, reject) => {
+            const socket = net.connect(ctx.socketPath);
+            let data = '';
+            socket.on('data', (chunk) => { data += chunk.toString(); });
+            socket.on('end', () => resolve(data));
+            socket.on('error', (err) => reject(err));
+            socket.setTimeout(5000, () => { socket.destroy(); reject(new Error('Daemon socket timeout')); });
+            socket.write(`POST /freeze HTTP/1.0\r\nAuthorization: Bearer ${authToken}\r\nContent-Length: 0\r\n\r\n`);
+        });
+        const bodyStart = response.indexOf('\r\n\r\n');
+        const body = bodyStart >= 0 ? response.slice(bodyStart + 4) : response;
+        const parsed = JSON.parse(body);
+        sendJson(res, parsed.ok ? 200 : 500, parsed);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to contact daemon';
+        sendJson(res, 503, { ok: false, error: `Daemon communication failed: ${message}` });
+    }
+});
+// ── Deep Current endpoints ─────────────────
+addRoute('GET', '/api/projects/:id/danger-room/current', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    const logsDir = resolved.context.logsDir;
+    const situationPath = join(logsDir, 'deep-current', 'situation.json');
+    const content = await readFileOrNull(situationPath);
+    if (!content) {
+        sendJson(res, 200, { initialized: false });
+        return;
+    }
+    try {
+        const situation = JSON.parse(content);
+        const proposalsDir = join(logsDir, 'deep-current', 'proposals');
+        let latestProposal = null;
+        try {
+            if (existsSync(proposalsDir)) {
+                const files = await readdir(proposalsDir);
+                const mdFiles = files.filter(f => f.endsWith('.md')).sort().reverse();
+                if (mdFiles.length > 0) {
+                    latestProposal = await readFileOrNull(join(proposalsDir, mdFiles[0]));
+                }
+            }
+        }
+        catch { /* no proposals dir */ }
+        sendJson(res, 200, { initialized: true, situation, latestProposal });
+    }
+    catch {
+        sendJson(res, 200, { initialized: false, error: 'Failed to parse situation model' });
+    }
+});
+// ── Legacy routes removed (ADR-046, v23.4) ────────
+// The standalone danger-room.html now redirects to the project dashboard.
+// Legacy /api/danger-room/* shims (v22.0.x P0-B) have been removed.
+// All data is served via /api/projects/:id/danger-room/* routes above.

package/dist/wizard/api/deploy.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Deploy wizard API routes — project scanning for Haku.
+ */
+export {};

package/dist/wizard/api/deploy.js

@@ -0,0 +1,164 @@
+/**
+ * Deploy wizard API routes — project scanning for Haku.
+ */
+import { readFile, access, realpath } from 'node:fs/promises';
+import { join } from 'node:path';
+import { addRoute } from '../router.js';
+import { parseJsonBody } from '../lib/body-parser.js';
+import { parseFrontmatter } from '../lib/frontmatter.js';
+import { recommendInstanceType } from '../lib/instance-sizing.js';
+import { sendJson } from '../lib/http-helpers.js';
+// POST /api/deploy/scan — scan a project directory for deploy info
+addRoute('POST', '/api/deploy/scan', async (req, res) => {
+    const body = await parseJsonBody(req);
+    if (!body.directory) {
+        sendJson(res, 400, { error: 'directory is required' });
+        return;
+    }
+    // SEC-010: Validate path — absolute, no traversal
+    if (!body.directory.startsWith('/') || body.directory.includes('..')) {
+        sendJson(res, 400, { error: 'directory must be an absolute path with no ".." segments' });
+        return;
+    }
+    let dir = body.directory;
+    // Check directory exists and resolve symlinks (IG-R4: use real path for all operations)
+    try {
+        await access(dir);
+        dir = await realpath(dir);
+    }
+    catch {
+        sendJson(res, 400, { error: `Directory not found: ${dir}` });
+        return;
+    }
+    // Check it's a VoidForge project (has CLAUDE.md)
+    try {
+        await access(join(dir, 'CLAUDE.md'));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Not a VoidForge project — no CLAUDE.md found' });
+        return;
+    }
+    // Read project name from CLAUDE.md
+    let name = 'Unknown';
+    try {
+        const claudeMd = await readFile(join(dir, 'CLAUDE.md'), 'utf-8');
+        const nameMatch = claudeMd.match(/\*\*Name:\*\*\s*(.+)/);
+        if (nameMatch) {
+            const extracted = nameMatch[1].trim();
+            if (!extracted.startsWith('['))
+                name = extracted;
+        }
+    }
+    catch { /* use default */ }
+    // Read deploy target from .env
+    let deploy = '';
+    try {
+        const envContent = await readFile(join(dir, '.env'), 'utf-8');
+        const deployMatch = envContent.match(/DEPLOY_TARGET=(.+)/);
+        if (deployMatch) {
+            deploy = deployMatch[1].trim().replace(/^["']|["']$/g, '').split('#')[0].trim();
+        }
+    }
+    catch { /* no .env yet */ }
+    // Read framework/database/cache from PRD frontmatter
+    let framework = '';
+    let database = 'none';
+    let cache = 'none';
+    let instanceType = '';
+    let hostname = '';
+    let prdFrontmatter = {};
+    try {
+        const prd = await readFile(join(dir, 'docs', 'PRD.md'), 'utf-8');
+        const { frontmatter } = parseFrontmatter(prd);
+        prdFrontmatter = frontmatter;
+        if (frontmatter.framework)
+            framework = frontmatter.framework;
+        if (frontmatter.database)
+            database = frontmatter.database;
+        if (frontmatter.cache)
+            cache = frontmatter.cache;
+        if (frontmatter.deploy && !deploy)
+            deploy = frontmatter.deploy;
+        if (frontmatter.instance_type)
+            instanceType = frontmatter.instance_type;
+        if (frontmatter.hostname)
+            hostname = frontmatter.hostname;
+    }
+    catch { /* no PRD or no frontmatter */ }
+    // Also check .env for hostname if not in PRD
+    if (!hostname) {
+        try {
+            const envContent = await readFile(join(dir, '.env'), 'utf-8');
+            const hostnameMatch = envContent.match(/HOSTNAME=(.+)/);
+            if (hostnameMatch) {
+                hostname = hostnameMatch[1].trim().replace(/^["']|["']$/g, '').split('#')[0].trim();
+            }
+        }
+        catch { /* no .env */ }
+    }
+    // Auto-detect framework from files if not in PRD
+    if (!framework) {
+        try {
+            const pkg = await readFile(join(dir, 'package.json'), 'utf-8');
+            const pkgData = JSON.parse(pkg);
+            const deps = pkgData.dependencies || {};
+            if (deps['next'])
+                framework = 'next.js';
+            else if (deps['express'])
+                framework = 'express';
+        }
+        catch { /* not a Node project */ }
+        if (!framework) {
+            try {
+                const reqs = await readFile(join(dir, 'requirements.txt'), 'utf-8');
+                const reqsLower = reqs.toLowerCase();
+                if (reqsLower.includes('django'))
+                    framework = 'django';
+                else
+                    framework = 'python';
+            }
+            catch { /* not Python */ }
+        }
+        if (!framework) {
+            try {
+                await access(join(dir, 'Gemfile'));
+                framework = 'rails';
+            }
+            catch { /* not Ruby */ }
+        }
+    }
+    // Detect PostgreSQL extensions from Prisma schema
+    let extensions = [];
+    if (database === 'postgres') {
+        try {
+            const prismaSchema = await readFile(join(dir, 'prisma', 'schema.prisma'), 'utf-8');
+            const extMatch = prismaSchema.match(/extensions\s*=\s*\[([^\]]+)\]/);
+            if (extMatch) {
+                extensions = extMatch[1].split(',').map((e) => e.trim().replace(/["']/g, '')).filter(Boolean);
+            }
+        }
+        catch { /* no Prisma schema or no extensions */ }
+    }
+    // Auto-recommend instance type from PRD scope if not explicitly set
+    if (!instanceType && (deploy === 'vps' || !deploy)) {
+        instanceType = recommendInstanceType({
+            type: prdFrontmatter.type,
+            framework,
+            database,
+            cache,
+            workers: prdFrontmatter.workers,
+            payments: prdFrontmatter.payments,
+        });
+    }
+    sendJson(res, 200, {
+        valid: true,
+        name,
+        deploy: deploy || 'docker',
+        framework,
+        database,
+        cache,
+        instanceType: instanceType || 't3.micro',
+        hostname: hostname || '',
+        extensions,
+    });
+});

package/dist/wizard/api/prd.d.ts

@@ -0,0 +1 @@
+export {};