wicked-crew 0.10.2 → 0.12.0

package/dist/api/routes.js

@@ -8,6 +8,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { videoPalette } from '../appearance/video-palette.js';
 import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, GovernanceReplayUnsupportedError, PlanLaunchUnsupportedError, SteeringUnsupportedError, addonSupportsQeOverride, addonSupportsReducedAssurance, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
 import { codeGraphDb, codeGraphErrorStatus, requirementsGraph } from '../core/repoPaths.js';
 import { resolveCursorUnit } from '../core/cursor.js';
@@ -25,6 +26,7 @@ import { defaultLaunchRoster, markOptIn } from '../core/opt-in-seats.js';
 import { chatSeatAdmission } from './seat-standing.js';
 import { seatGovernanceDiagnostics, seatGovernanceWarnings, } from './seat-governance.js';
 import { ROSTER_REFRESH_WAIT_MS, rosterWithStandingFactory } from './roster-standing.js';
+import { SeatContainerStatus, isContainerLoginCli, isContainerSeatFloor, loginDetail, runSeatLogin, seatLoginDepsFor, } from './seat-container-login.js';
 import { ChatTurnIndex } from './chat-turns.js';
 import { ChatScopeIndex, chatScopeDeps, chatScopeStatement, prepareChatScratch, removeChatScratch, namedKindRefusal, resolveChatScope, } from './chat-scope.js';
 import { ASK_TURN_BUDGET_SECS, AskPathIndex, answerStep, isAskTurn } from './ask-paths.js';
@@ -46,7 +48,8 @@ import { isSteeringAuthorRun, landSteeringProposal } from './steering-landing.js
 import { inventoryComplete, parseInventoryClaims } from '../core/inventory-claim.js';
 import { ApproveEditSchema, approveEdited, captureLaunchRoots, editInFlight, FileProposalSchema, registerCaptureRoutes } from './capture.js';
 import { registerTestingRoutes } from './testing.js';
-import { DEMO_PRESET, demoLaunchRoots, registerDemoRoutes, registerWalkthroughRoutes, walkthroughAcceptance } from './recording.js';
+import { DEMO_PRESET, demoLaunchRoots, registerDemoDocumentRoute, registerDemoRoutes, registerWalkthroughRoutes, walkthroughAcceptance } from './recording.js';
+import { projectDocsRoot } from '../interactive/project-root.js';
 import { registerSkillsRoutes } from './skills.js';
 import { registerMcpRoutes } from './mcp.js';
 import { McpPolicies } from '../mcp/policies.js';
@@ -57,7 +60,8 @@ import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE, baseSkillRemedy } from '../s
 import { REQUIRED_GARDEN_VERSION } from '../skills/plugin-source.js';
 import { engineRosterJson, noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
 import { launchAssuranceNotice } from '../core/assurance.js';
-import { QE_ACCEPTANCE, QE_PRESETS, aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcceptanceRefusal, receiptOf, qeAcceptanceNotRequired, qeDecisionBypasses, qeDecisionOf, unreadableQeAcceptance, } from './delivery-assurance.js';
+import { launchRequiresQe, mayRequireQe, qeAcceptanceMode, qeSettingSkipReason } from '../core/qe-acceptance-setting.js';
+import { aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcceptanceRefusal, receiptOf, qeAcceptanceNotRequired, qeDecisionBypasses, qeDecisionOf, unreadableQeAcceptance, } from './delivery-assurance.js';
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { isHumanOperator } from './watch-routes.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
@@ -1077,6 +1081,9 @@ runtime = {}) {
     // spellings where the contract has no name, statusCodes list every code the route answers on
     // purpose. Declared on the highest-traffic run-lifecycle routes first; the manifest records
     // null / [] for the rest ("where declared", never invented). See src/api/endpoint-manifest.ts.
+    // The daemon's QE acceptance setting as read now ('required' when the settings cannot be read:
+    // fail closed, never off by accident).
+    const qeAcceptanceNow = async () => qeAcceptanceMode(await Promise.resolve().then(() => adapter.getSettings()).catch(() => null));
     app.get(`${V}/health`, { config: { manifest: { statusCodes: [200] } } }, async () => {
         const ping = await enginePing();
         // F-E2E-030: what this deployment can keep. A composer reads `capabilities.deliverGate`
@@ -1103,6 +1110,9 @@ runtime = {}) {
             // QE-IN-APP-WORKFLOWS: `LaunchRunBody.skipQeAcceptance` / `forceQeAcceptance` reach an addon
             // that carries the QE decision; never an invented capability.
             qeAcceptanceOverride: typeof adapter.engineCapabilities === 'function' && addonSupportsQeOverride(),
+            // api-types 0.120.0: the daemon's QE acceptance setting, read per probe ('off' = every launch
+            // that requires QE acceptance skips it, labelled with the setting).
+            qeAcceptance: await qeAcceptanceNow(),
         };
         // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
         // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
@@ -1267,7 +1277,9 @@ runtime = {}) {
     // (built over the same `seatHealth`); a directly-driven route set builds an equivalent one here.
     // `POST /chats` seats its defaults through the SAME standing, so the roster and the chat never
     // disagree about a seat.
-    const rosterWithStanding = runtime.rosterWithStanding ?? rosterWithStandingFactory({ seatHealth, signedIn });
+    const seatLoginDeps = seatLoginDepsFor(adapter.dbPath, runtime.seatLoginExec);
+    const containerStatus = runtime.rosterWithStanding?.containerStatus ?? new SeatContainerStatus(seatLoginDeps);
+    const rosterWithStanding = runtime.rosterWithStanding ?? rosterWithStandingFactory({ seatHealth, signedIn, containerStatus });
     // A3b (DES-seats-page): `?refresh=<key>` re-runs that seat's sign-in check now and waits for it,
     // bounded, so the Agents page's "I've signed in: check again" reads the seat's fresh answer, not
     // the probe cache's 30-second-old one. A read with no parameter never waits.
@@ -1819,15 +1831,23 @@ runtime = {}) {
         // F-E2E-030: only the explicit `'auto'` opts out of the engine's deliver gate. `'human'` and
         // an omitted field both leave `autoDeliver` off the input — the gate is the engine's default,
         // so the wire never has to say "gate me" to be gated.
+        // The daemon's QE acceptance setting, read ONCE for this launch: the deliverGate check below and
+        // the skip handed to the engine come from the same reading (core/qe-acceptance-setting.ts).
+        // An addon without the QE decision enforces none, so the setting has nothing to skip on it.
+        const qeMode = addonSupportsQeOverride() ? await qeAcceptanceNow() : 'required';
+        const qeRequired = b.deliverGate === 'auto' || qeMode === 'off' ? await launchRequiresQe(adapter, b.workflow, b.projectId) : false;
+        const settingSkip = qeSettingSkipReason(qeMode, { skipQeAcceptanceReason: b.skipQeAcceptance?.reason, forceQeAcceptance: b.forceQeAcceptance }, qeRequired);
         if (b.deliverGate === 'auto') {
             // wicked-core#850 EX-03: a workflow that requires QE acceptance delivers only through the deliver
             // gate, where crew checks the verdict. Unattended delivery would push before anyone could.
             // QE-IN-APP-WORKFLOWS: an explicit operator skip leaves no verdict to check, so it may. A name
             // the engine resolves to a built-in preset that requires QE acceptance is judged by that preset
             // (the engine resolves a preset before any def, so a def of the same name never speaks for it).
-            const required = b.workflow !== undefined ? adapter.getWorkflow(b.workflow)?.required_instruments : undefined;
-            const qeRequired = required?.includes(QE_ACCEPTANCE) === true || (b.workflow !== undefined && QE_PRESETS.has(b.workflow));
-            if (qeRequired && b.skipQeAcceptance === undefined) {
+            // The daemon's `qeAcceptance: 'off'` setting skips it the same way (resolved once, above, and
+            // handed to the engine with this launch), unless this launch forces QE acceptance.
+            // Refused on the CONSERVATIVE reading (a built-in QE name or a QE def counts even when a project
+            // preset shadows it now): only an explicit or setting skip lets QE work deliver unattended.
+            if (mayRequireQe(adapter, b.workflow, qeRequired) && b.skipQeAcceptance === undefined && settingSkip === undefined) {
                 return reply.code(400).send({
                     error: `workflow ${b.workflow} requires QE acceptance (required_instruments: qe_acceptance), so it delivers only ` +
                         'through the deliver gate, where the verdict is checked — deliverGate: "auto" cannot apply to it ' +
@@ -1909,6 +1929,8 @@ runtime = {}) {
         // when sent, never inferred.
         if (b.skipQeAcceptance !== undefined)
             input.skipQeAcceptanceReason = b.skipQeAcceptance.reason;
+        else if (settingSkip !== undefined)
+            input.skipQeAcceptanceReason = settingSkip;
         if (b.forceQeAcceptance === true)
             input.forceQeAcceptance = true;
         // DES-L9 / crew#550 — REVISION: `revisesPr` names an OPEN same-repository pull request whose
@@ -5126,6 +5148,159 @@ runtime = {}) {
             return reply.code(201).send({ terminalId: termId, cli, action });
         });
     }
+    const containerLoginOutcomes = new Map();
+    const containerSeat = (cli) => isContainerSeatFloor() && isContainerLoginCli(cli) && rosterWithStanding().some((seat) => seat.key === cli);
+    const loginError = (stderr) => loginDetail(stderr) || 'seat-login failed';
+    // One sign-in/sign-out at a time per seat, and a generation every new sign-in and every sign-out
+    // bumps (agy crew-r1): an abandoned login terminal that exits later never ingests over a newer
+    // sign-in or a sign-out, and an ingest in flight finishes before a sign-out runs.
+    const loginGeneration = new Map();
+    const seatOps = new Map();
+    const serial = (cli, op) => {
+        const next = (seatOps.get(cli) ?? Promise.resolve()).then(op, op);
+        seatOps.set(cli, next.catch(() => undefined));
+        return next;
+    };
+    const bump = (cli) => {
+        const g = (loginGeneration.get(cli) ?? 0) + 1;
+        loginGeneration.set(cli, g);
+        return g;
+    };
+    // The one sign-in per seat, reserved synchronously from the request's first await until its
+    // ingest settles (codex crew-r1/r2: two sessions would share the engine's login session), and
+    // released only by its owner (the generation that reserved it).
+    const openLogins = new Map();
+    const release = (cli, generation) => {
+        if (openLogins.get(cli) === generation)
+            openLogins.delete(cli);
+    };
+    app.post(`${V}/seats/:cli/container-login`, { config: { manifest: { requestType: 'SeatSessionBody', responseType: 'SeatContainerLoginResponse', statusCodes: [201, 400, 404, 502] } } }, async (req, reply) => {
+        const { cli } = req.params;
+        if (!containerSeat(cli))
+            return reply.code(404).send({ error: `container login unavailable for seat: ${cli}` });
+        const parsed = SeatSessionSchema.safeParse(req.body ?? {});
+        if (!parsed.success)
+            return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
+        if (openLogins.has(cli)) {
+            return reply.code(409).send({ error: `a sign-in is already open for ${cli}; finish or close it first` });
+        }
+        // Reserved BEFORE the first await (codex crew-r1): a sign-out that lands meanwhile wins.
+        const generation = bump(cli);
+        openLogins.set(cli, generation);
+        containerLoginOutcomes.delete(cli);
+        const out = await serial(cli, () => runSeatLogin('argv', cli, seatLoginDeps));
+        if (out.rc !== 0) {
+            release(cli, generation);
+            return reply.code(502).send({ error: loginError(out.stderr) });
+        }
+        if (loginGeneration.get(cli) !== generation) {
+            release(cli, generation);
+            return reply.code(409).send({ error: `the ${cli} sign-in was superseded (a sign-out or another sign-in)` });
+        }
+        let argv;
+        try {
+            const value = JSON.parse(out.stdout);
+            if (!Array.isArray(value) || value.length === 0 || !value.every((arg) => typeof arg === 'string' && arg.length > 0)) {
+                throw new Error('seat-login argv must be a non-empty array of non-empty strings');
+            }
+            argv = value;
+        }
+        catch (err) {
+            release(cli, generation);
+            return reply.code(502).send({ error: message(err) });
+        }
+        let termId = null;
+        let completed = false;
+        const exitedEarly = new Set();
+        const ingest = () => serial(cli, async () => {
+            // A newer sign-in or a sign-out superseded this terminal: nothing to ingest or record.
+            if (loginGeneration.get(cli) !== generation)
+                return;
+            // Refusals the OLD credential earned up to now are superseded by this sign-in (codex
+            // crew-r2: a 401 during the interactive login must not outlive it).
+            const cutoff = Date.now();
+            const result = await runSeatLogin('ingest', cli, seatLoginDeps);
+            // The broker may have changed whatever happens next: the next reading is its own.
+            containerStatus.invalidate(cli);
+            rosterWithStanding.reprobe?.(cli);
+            const outcome = { cli, ok: result.rc === 0, at: new Date().toISOString() };
+            if (result.rc !== 0)
+                outcome.error = loginError(result.stderr);
+            else {
+                try {
+                    const value = JSON.parse(result.stdout);
+                    if (value === null || !Array.isArray(value.files) || !value.files.every((file) => typeof file === 'string') ||
+                        !(value.expires_at === null || (typeof value.expires_at === 'number' && Number.isFinite(value.expires_at)))) {
+                        throw new Error('invalid seat-login ingest response');
+                    }
+                    // Only the public ingest fields cross the wire; raw stdout may contain credentials.
+                    outcome.files = value.files;
+                    outcome.expires_at = value.expires_at;
+                }
+                catch {
+                    outcome.ok = false;
+                    outcome.error = 'invalid seat-login ingest response';
+                }
+            }
+            if (outcome.ok) {
+                seatHealth.clearAuthFailureBefore(cli, cutoff);
+                seatHealth.clearRecentBench(cli);
+            }
+            // A sign-out (or a newer sign-in) while this ingest ran owns the outcome now.
+            if (loginGeneration.get(cli) === generation)
+                containerLoginOutcomes.set(cli, outcome);
+        }).finally(() => release(cli, generation));
+        const done = () => {
+            if (completed)
+                return;
+            completed = true;
+            stop();
+            void ingest();
+        };
+        // Subscribe before spawn: an immediate exit still needs exactly one ingest.
+        const stop = adapter.onEvent((event) => {
+            if (event.type !== 'terminalExited' || typeof event.id !== 'string')
+                return;
+            if (termId === null)
+                exitedEarly.add(event.id);
+            else if (event.id === termId)
+                done();
+        });
+        try {
+            termId = await adapter.openTerminal(homedir(), argv, parsed.data.cols ?? 100, parsed.data.rows ?? 30, true);
+        }
+        catch (err) {
+            stop();
+            release(cli, generation);
+            return reply.code(400).send({ error: message(err) });
+        }
+        if (exitedEarly.has(termId))
+            done();
+        return reply.code(201).send({ terminalId: termId, cli, action: 'sign_in' });
+    });
+    app.get(`${V}/seats/:cli/container-login`, { config: { manifest: { responseType: 'SeatContainerLoginOutcome', statusCodes: [200, 404] } } }, async (req, reply) => {
+        const { cli } = req.params;
+        const outcome = containerSeat(cli) ? containerLoginOutcomes.get(cli) : undefined;
+        if (outcome === undefined)
+            return reply.code(404).send({ error: `no container login outcome for seat: ${cli}` });
+        return reply.send(outcome);
+    });
+    app.post(`${V}/seats/:cli/container-logout`, { config: { manifest: { responseType: 'SeatContainerLogoutResponse', statusCodes: [200, 404, 502] } } }, async (req, reply) => {
+        const { cli } = req.params;
+        if (!containerSeat(cli))
+            return reply.code(404).send({ error: `container logout unavailable for seat: ${cli}` });
+        bump(cli);
+        const out = await serial(cli, async () => {
+            containerLoginOutcomes.delete(cli);
+            return runSeatLogin('sign-out', cli, seatLoginDeps);
+        });
+        // Whatever the engine managed before failing, the next reading is the broker's (codex crew-r1).
+        containerStatus.invalidate(cli);
+        rosterWithStanding.reprobe?.(cli);
+        if (out.rc !== 0)
+            return reply.code(502).send({ error: loginError(out.stderr) });
+        return reply.send({ cli, action: 'sign_out' });
+    });
     // Resize a live terminal's PTY.
     app.post(`${V}/terminals/:id/resize`, async (req, reply) => {
         const { id } = req.params;
@@ -5163,6 +5338,9 @@ runtime = {}) {
     // additive `path` (api-types 0.38.0 `SettingsResponse.path?`; adjudicated §4.6 — `path`, not
     // `settings_path`).
     app.get(`${V}/settings`, async () => ({ settings: await adapter.getSettings(), path: settingsFilePath() }));
+    // The demo video's palette from the studio skin (operator 2026-10-14): read-only, derived from `studio.appearance`;
+    // garden's demo stage and interactive's re-cuts read it as their default colours.
+    app.get(`${V}/appearance/video-palette`, { config: { manifest: { responseType: 'VideoPaletteResponse', statusCodes: [200] } } }, async () => videoPalette((await adapter.getSettings())['studio.appearance']));
     app.put(`${V}/settings`, async (req, reply) => {
         const patch = req.body;
         if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {
@@ -5278,6 +5456,19 @@ runtime = {}) {
                     .send({ error: "deliverDefault must be 'pr' or 'none'" });
             }
         }
+        // qeAcceptance (api-types 0.120.0): 'required' | 'off' only. 'off' skips QE acceptance on every
+        // launch that requires it (labelled with the setting), so a typo must be a 400, never a dropped key.
+        // Turning it off waives an assurance instrument on every launch after it, so only a PERSON may
+        // change it (the predicate the watch switches use); a worker's bearer gets 403.
+        if (Object.hasOwn(patch, 'qeAcceptance')) {
+            const q = patch.qeAcceptance;
+            if (q !== 'required' && q !== 'off') {
+                return reply.code(400).send({ error: "qeAcceptance must be 'required' or 'off'" });
+            }
+            if (!isHumanOperator(actorOf(req))) {
+                return reply.code(403).send({ error: 'Only a person can change QE acceptance (qeAcceptance); a worker or system actor cannot' });
+            }
+        }
         // onboardingAutoCapture (crew#552): whether a completed onboarding chains capture-learnings.
         if (Object.hasOwn(patch, 'onboardingAutoCapture') && typeof patch.onboardingAutoCapture !== 'boolean') {
             return reply.code(400).send({ error: 'onboardingAutoCapture must be true or false' });
@@ -5362,6 +5553,7 @@ runtime = {}) {
             'workerStallEscalateAction',
             'workerStallMaxEscalations',
             'deliverDefault',
+            'qeAcceptance',
             'onboardingAutoCapture',
             'deliverIdentityLogin',
             'deliverIdentityByRepo',
@@ -6035,6 +6227,35 @@ runtime = {}) {
         dropDocLedgerRows: runtime.dropDocLedgerRows ?? (() => ({ ok: true, removed_keys: [] })),
         log: (m) => app.log.warn(m),
     });
+    // ── A demo run's video as an editable document (the video editor re-cuts it through E1's per-doc API) ──
+    registerDemoDocumentRoute(app, adapter, {
+        bridgeFor: async (projectId) => {
+            const root = await projectDocsRoot(adapter, projectSettings, projectId);
+            if (root === null)
+                return null;
+            const bridge = await interactiveBridges.ensure(root);
+            return async (method, path, body) => {
+                const raw = Buffer.isBuffer(body);
+                const res = await fetch(`http://${bridge.host}:${bridge.port}${path}`, {
+                    method,
+                    headers: { 'content-type': raw ? 'application/octet-stream' : 'application/json' },
+                    body: raw ? new Uint8Array(body) : JSON.stringify(body),
+                    // A segment upload or the import's render (ffmpeg) can take minutes on a loaded host.
+                    signal: AbortSignal.timeout(600_000),
+                });
+                let parsed = {};
+                try {
+                    const j = await res.json();
+                    if (j !== null && typeof j === 'object' && !Array.isArray(j))
+                        parsed = j;
+                }
+                catch {
+                    parsed = {};
+                }
+                return { status: res.status, body: parsed };
+            };
+        },
+    });
     // ── Project-attributed docs list (crew#472) ──
     // `GET /projects/:id/interactive/api/docs` relays the bridge's list and stamps each row with
     // the mount's `projectId` — the attribution the bridge cannot know. Same static-over-wildcard