wicked-crew 0.4.0 → 0.6.0

package/dist/api/seat-signin.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Injectable IO for tests: `home` replaces `os.homedir()` and `env` replaces `process.env`,
+ * so fixture dirs built with `mkdtemp` exercise every branch without touching the developer's
+ * real dotfiles. Production callers omit it.
+ */
+export interface SigninProbeIo {
+    home?: string;
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Cheap signed-in presence for one seat. `workerConfigRoot` is the settings-applied
+ * `WICKED_WORKER_HOME` value when set (the roster route passes the live env, which is exactly
+ * what the engine will read at the next spawn); omitted = the engine default `~/.wicked-worker`.
+ *
+ * Never throws: an unreadable file or dir is treated as the corresponding "not observable"
+ * answer for that seat's rule, never a 500 on the roster route.
+ */
+export declare function signedInHeuristic(seatKey: string, workerConfigRoot?: string, io?: SigninProbeIo): boolean | null;
+/**
+ * Apply the persisted `worker_config_root` setting to THIS process's environment. The engine
+ * reads `WICKED_WORKER_HOME` per worker spawn (acp_runner.rs — never cached at engine start),
+ * so calling this at daemon boot and again on every settings change is sufficient: the next
+ * spawn sees the new root with no daemon or engine restart. `settings.json` is the source of
+ * truth — unset/empty DELETES the env, restoring the engine default `~/.wicked-worker`.
+ */
+export declare function applyWorkerConfigRoot(root: string | undefined): void;
+//# sourceMappingURL=seat-signin.d.ts.map

package/dist/api/seat-signin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-signin.d.ts","sourceRoot":"","sources":["../../src/api/seat-signin.ts"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,gBAAgB,CAAC,EAAE,MAAM,EACzB,EAAE,GAAE,aAAkB,GACrB,OAAO,GAAG,IAAI,CA2FhB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMpE"}

package/dist/api/seat-signin.js

@@ -0,0 +1,143 @@
+// Seat sign-in presence (seat sign-in): does each council seat LOOK signed in?
+//
+// The doctrine mirrors seat health (crew#274): auth state is RUNTIME state the platform observes
+// and displays, never config an operator hand-edits. The studio surfaces every seat's auth
+// uniformly — `signed_in` says what the daemon can OBSERVE, and the seat's `login_invocation`
+// (engine roster passthrough, wicked-core PR#278) is what the studio runs in a PTY terminal
+// (`POST /terminals`) to fix it.
+//
+// This module is a HEURISTIC, deliberately cheap:
+//
+// - File/env PRESENCE only — no process is ever spawned (the roster route calls this per seat
+//   per request; a spawn here would be a fork bomb with a UI attached).
+// - Three-valued: `true`/`false` when the observable half of the seat's auth state answers,
+//   `null` when it is unknowable cheaply. Keychain-backed credentials are the canonical `null`:
+//   a file can prove a login HAPPENED, but its absence proves nothing when the secret lives in
+//   the OS keychain — and `false` would send an operator to re-login a working seat.
+// - `true` is "a credential artifact exists", NOT "the credential still works". An expired
+//   OAuth token reads `true` here; seat HEALTH (crew#274) is what catches it failing live.
+//
+// Per-seat rules (each documented at its branch):
+//   claude    — the WORKER config home's `.claude.json` (per-config-dir keychain entry means the
+//               file is the observable half; see below), under `WICKED_WORKER_HOME`/the default.
+//   codex     — `~/.codex/auth.json` presence.
+//   copilot   — env token (COPILOT_GITHUB_TOKEN/GH_TOKEN/GITHUB_TOKEN) → true; installed but no
+//               env → null (keychain state unknowable cheaply — NOT false); no trace → false.
+//   opencode  — `~/.local/share/opencode/auth.json` presence.
+//   pi        — `~/.pi/agent/auth.json` presence.
+//   agy       — any `.json` under `~/.antigravitycli/` → true; else null (keyring unknowable).
+//   unknown   — null (a seat this module has no rule for is exactly "unknown").
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Cheap signed-in presence for one seat. `workerConfigRoot` is the settings-applied
+ * `WICKED_WORKER_HOME` value when set (the roster route passes the live env, which is exactly
+ * what the engine will read at the next spawn); omitted = the engine default `~/.wicked-worker`.
+ *
+ * Never throws: an unreadable file or dir is treated as the corresponding "not observable"
+ * answer for that seat's rule, never a 500 on the roster route.
+ */
+export function signedInHeuristic(seatKey, workerConfigRoot, io = {}) {
+    const home = io.home ?? homedir();
+    const env = io.env ?? process.env;
+    switch (seatKey) {
+        case 'claude': {
+            // The engine places the claude WORKER home at `<root>/claude` (acp_runner.rs
+            // claude_worker_home; root = WICKED_WORKER_HOME or ~/.wicked-worker). Claude keeps the
+            // OAuth token itself in a PER-CONFIG-DIR keychain entry, so the token is not observable —
+            // but `/login` also writes an `oauthAccount` block into that dir's `.claude.json`, which
+            // is: present-with-key means a login completed for the WORKER home (not the operator's
+            // own ~/.claude). Heuristic by construction — a revoked token still reads true.
+            const root = workerConfigRoot !== undefined && workerConfigRoot !== ''
+                ? workerConfigRoot
+                : join(home, '.wicked-worker');
+            const file = join(root, 'claude', '.claude.json');
+            try {
+                const parsed = JSON.parse(readFileSync(file, 'utf8'));
+                return typeof parsed === 'object' && parsed !== null && 'oauthAccount' in parsed;
+            }
+            catch {
+                return false; // missing / unreadable / malformed: no completed login is observable
+            }
+        }
+        case 'codex':
+            // `codex login` writes ~/.codex/auth.json (tokens live IN the file — presence is the state).
+            return existsSync(join(home, '.codex', 'auth.json'));
+        case 'copilot': {
+            // Env token wins: copilot honors these directly, and a set token IS a signed-in seat.
+            for (const key of ['COPILOT_GITHUB_TOKEN', 'GH_TOKEN', 'GITHUB_TOKEN']) {
+                const v = env[key];
+                if (typeof v === 'string' && v !== '')
+                    return true;
+            }
+            // `copilot login` stores the TOKEN in the OS keychain, but it also records the logged-in
+            // USER in config.json (`lastLoggedInUser` / `loggedInUsers`) — verified in the field: a
+            // successful sign-in left the chip on null-neutral and the Sign in button up, reading as
+            // "didn't work". The file is JSONC (comment header), so this parses key-presence
+            // leniently rather than JSON.parse-ing the whole document.
+            const cfg = join(home, '.copilot', 'config.json');
+            if (existsSync(cfg)) {
+                try {
+                    const raw = readFileSync(cfg, 'utf8');
+                    // A non-empty STRING user, or an array whose first entry is a non-empty string —
+                    // `[""]` must not read as signed in (Copilot, PR#282).
+                    // Both shapes seen in the field: a plain string user, OR an OBJECT user
+                    // ({host, login} — the live config on macOS). A non-empty "login" string inside
+                    // either container is the common observable.
+                    if (/"lastLoggedInUser"\s*:\s*"[^"]+"/.test(raw) ||
+                        /"loggedInUsers"\s*:\s*\[\s*"[^"]+"/.test(raw) ||
+                        // Object shapes, SCOPED to the user containers (an unrelated "login" string
+                        // elsewhere in the config must not read as signed in — Copilot, PR#283).
+                        /"lastLoggedInUser"\s*:\s*\{[^}]*"login"\s*:\s*"[^"]+"/.test(raw) ||
+                        /"loggedInUsers"\s*:\s*\[\s*\{[^}]*"login"\s*:\s*"[^"]+"/.test(raw)) {
+                        return true;
+                    }
+                }
+                catch {
+                    /* unreadable config falls through to null */
+                }
+                // Installed but no recorded user and no env: the keychain half stays unknowable.
+                return null;
+            }
+            return false; // no env, no config dir: nothing suggests this seat ever signed in
+        }
+        case 'opencode':
+            // `opencode auth login` writes the credential file itself — presence is the state.
+            return existsSync(join(home, '.local', 'share', 'opencode', 'auth.json'));
+        case 'pi':
+            // pi's auth flow writes ~/.pi/agent/auth.json — presence is the state.
+            return existsSync(join(home, '.pi', 'agent', 'auth.json'));
+        case 'agy': {
+            // Antigravity keeps its credential in the OS keyring; a `.json` in ~/.antigravitycli/ is
+            // the observable artifact a completed login leaves behind. Missing dir OR dir-with-no-json
+            // both mean the keyring state is unknowable cheaply → null (only a json upgrades to true).
+            let entries;
+            try {
+                entries = readdirSync(join(home, '.antigravitycli'));
+            }
+            catch {
+                return null;
+            }
+            return entries.some((f) => f.endsWith('.json')) ? true : null;
+        }
+        default:
+            return null; // a seat with no rule here is exactly "unknown"
+    }
+}
+/**
+ * Apply the persisted `worker_config_root` setting to THIS process's environment. The engine
+ * reads `WICKED_WORKER_HOME` per worker spawn (acp_runner.rs — never cached at engine start),
+ * so calling this at daemon boot and again on every settings change is sufficient: the next
+ * spawn sees the new root with no daemon or engine restart. `settings.json` is the source of
+ * truth — unset/empty DELETES the env, restoring the engine default `~/.wicked-worker`.
+ */
+export function applyWorkerConfigRoot(root) {
+    if (typeof root === 'string' && root !== '') {
+        process.env['WICKED_WORKER_HOME'] = root;
+    }
+    else {
+        delete process.env['WICKED_WORKER_HOME'];
+    }
+}
+//# sourceMappingURL=seat-signin.js.map

package/dist/api/seat-signin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-signin.js","sourceRoot":"","sources":["../../src/api/seat-signin.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,iGAAiG;AACjG,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,iCAAiC;AACjC,EAAE;AACF,kDAAkD;AAClD,EAAE;AACF,8FAA8F;AAC9F,wEAAwE;AACxE,4FAA4F;AAC5F,gGAAgG;AAChG,+FAA+F;AAC/F,qFAAqF;AACrF,2FAA2F;AAC3F,2FAA2F;AAC3F,EAAE;AACF,kDAAkD;AAClD,iGAAiG;AACjG,iGAAiG;AACjG,+CAA+C;AAC/C,gGAAgG;AAChG,8FAA8F;AAC9F,8DAA8D;AAC9D,kDAAkD;AAClD,+FAA+F;AAC/F,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,gBAAyB,EACzB,KAAoB,EAAE;IAEtB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,6EAA6E;YAC7E,uFAAuF;YACvF,0FAA0F;YAC1F,yFAAyF;YACzF,uFAAuF;YACvF,gFAAgF;YAChF,MAAM,IAAI,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,EAAE;gBACpE,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC/D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,cAAc,IAAI,MAAM,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,CAAC,qEAAqE;YACrF,CAAC;QACH,CAAC;QAED,KAAK,OAAO;YACV,6FAA6F;YAC7F,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAEvD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,sFAAsF;YACtF,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;gBACvE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;oBAAE,OAAO,IAAI,CAAC;YACrD,CAAC;YACD,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,iFAAiF;YACjF,2DAA2D;YAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YAClD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACtC,iFAAiF;oBACjF,uDAAuD;oBACvD,wEAAwE;oBACxE,gFAAgF;oBAChF,6CAA6C;oBAC7C,IACE,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAC5C,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAC9C,4EAA4E;wBAC5E,yEAAyE;wBACzE,uDAAuD,CAAC,IAAI,CAAC,GAAG,CAAC;wBACjE,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC,EACnE,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;gBACD,iFAAiF;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,mEAAmE;QACnF,CAAC;QAED,KAAK,UAAU;YACb,mFAAmF;YACnF,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAE5E,KAAK,IAAI;YACP,uEAAuE;YACvE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAE7D,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,yFAAyF;YACzF,2FAA2F;YAC3F,2FAA2F;YAC3F,IAAI,OAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QAED;YACE,OAAO,IAAI,CAAC,CAAC,gDAAgD;IACjE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/api/server.d.ts

@@ -1,14 +1,122 @@
 import Fastify from 'fastify';
-import type { CoreAdapter } from '../core/adapter.js';
+import { type AuthOptions } from './auth.js';
+import { CoreAdapter } from '../core/adapter.js';
 /**
  * The bundled studio SPA lives at `dist/studio` next to the compiled server
  * (`dist/api/server.js` → `../studio`). See DES-STUDIO-SERVING-001 §2.3/§3.1
- * and `scripts/bundle-studio.mjs` which copies `packages/studio/dist` there.
+ * and `scripts/bundle-studio.mjs`, which copies the installed `wicked-studio`
+ * package's `dist/` there (the SPA is its own product since the #98 carve —
+ * github.com/mikeparcewski/wicked-studio — consumed as a dist artifact).
  */
 export declare function defaultStudioRoot(): string;
 export interface CreateServerOptions {
     /** Override the studio asset root (tests point this at a temp fixture dir). */
     studioRoot?: string;
+    /**
+     * Opt-in QE gate-event consumption over wicked-bus (Phase 6a). When enabled,
+     * a durable subscriber folds `wicked.qe.gate.*` / `wicked.qe.deploy.completed`
+     * into the acceptance route's freshness cache; when absent (the default),
+     * the route's lazy ledger read stands alone — same answers, read on demand.
+     */
+    qeGateEvents?: {
+        enabled: boolean;
+        /** Bus db path; omit for wicked-bus's own default resolution. */
+        dbPath?: string;
+        /** Poll cadence, ms (tests shorten it). */
+        pollIntervalMs?: number;
+    };
+    /**
+     * Opt-in governed answering of wicked-interactive first-draft generation (task #86 spike,
+     * Phase 7c). When enabled, a durable subscriber answers `wicked.interactive.doc.created`
+     * (kind:source) with a governed `interactive-draft` run that ends in
+     * `wicked.interactive.draft.completed`; when absent (the default), interactive's own assist
+     * loop remains the answerer and crew never touches that bus traffic.
+     */
+    interactiveDraftEvents?: {
+        enabled: boolean;
+        /** Bus db path; omit for wicked-bus's own default resolution (honors WICKED_BUS_DATA_DIR). */
+        dbPath?: string;
+        /** Poll cadence, ms (tests shorten it). */
+        pollIntervalMs?: number;
+        /** Heartbeat narration cadence, ms (default 15000). */
+        heartbeatMs?: number;
+        /** Durable replay-dedup ledger path (default ~/.wicked-crew/interactive-draft-ledger.json). */
+        ledgerPath?: string;
+        /** Where governed workers write finished drafts (default ~/.wicked-crew/interactive-drafts). */
+        draftDir?: string;
+        /** Seat roster override (JSON array); omit for the production council roster. */
+        clisJson?: string;
+    };
+    /**
+     * Opt-in governed answering of wicked-interactive STRUCTURAL edits (task #86, Phase 7c final
+     * leg). When enabled, a durable subscriber answers `wicked.interactive.feedback.processed`
+     * (awaiting_structural > 0) with a governed `interactive-edit` run that ends in
+     * `wicked.interactive.edit.completed` — after a deterministic INV-2 pre-emit self-check;
+     * when absent (the default), interactive's own assist loop remains the answerer.
+     * Deterministic (content/style/remove) edits never reach this seam at all: the model-free
+     * service applies those instantly and hands off only the structural remainder.
+     */
+    interactiveEditEvents?: {
+        enabled: boolean;
+        /** Bus db path; omit for wicked-bus's own default resolution (honors WICKED_BUS_DATA_DIR). */
+        dbPath?: string;
+        /** Poll cadence, ms (tests shorten it). */
+        pollIntervalMs?: number;
+        /** Heartbeat narration cadence, ms (default 15000). */
+        heartbeatMs?: number;
+        /** Durable replay-dedup ledger path (default ~/.wicked-crew/interactive-edit-ledger.json). */
+        ledgerPath?: string;
+        /** Where handoff files land and workers write edited fragments
+         *  (default ~/.wicked-crew/interactive-edits). */
+        editDir?: string;
+        /** Seat roster override (JSON array); omit for the production council roster. */
+        clisJson?: string;
+    };
+    /**
+     * The project bus seam (DES-PROJECT-001 §4/§5.2). DEFAULT-ON, unlike the opt-in seams
+     * above: the ADR's event vocabulary and the live activity bridge are part of the surface, not
+     * an integration experiment — but the posture stays LOUD-non-fatal (no wicked-bus / broken db
+     * ⇒ project CRUD works, events don't ride). `disabled: true` turns the whole seam off (tests).
+     */
+    projectEvents?: {
+        disabled?: boolean;
+        /** Bus db path; omit for wicked-bus's own default resolution (honors WICKED_BUS_DATA_DIR). */
+        dbPath?: string;
+        /** Poll cadence for the /ws activity bridge, ms (tests shorten it). */
+        pollIntervalMs?: number;
+    };
+    /**
+     * DES-MERGE-001 §5.4/§6.1 (slice 3) — the interactive /ws relay. DEFAULT-ON: every
+     * wicked.interactive.** bus event is bridged onto the /ws stream as an `interactiveEvent`
+     * frame so the studio needs exactly ONE socket. `disabled: true` turns it off (tests).
+     */
+    interactiveWsRelay?: {
+        disabled?: boolean;
+        /** Bus db path; omit for wicked-bus's own default resolution. */
+        dbPath?: string;
+        /** Poll cadence, ms (tests shorten it). */
+        pollIntervalMs?: number;
+    };
+    /**
+     * The identity/actor seam (task #88). Omit for full env/file resolution:
+     * OFF by default (the local loopback deployment — nothing changes), REQUIRED
+     * under `WICKED_RUNTIME=team` or `WICKED_CREW_AUTH=required`. See
+     * `src/api/auth.ts` + docs/auth.md.
+     */
+    auth?: AuthOptions;
+    /** Audit-trail path override (tests). Default `~/.wicked-crew/audit.log` / `WICKED_CREW_AUDIT_LOG`. */
+    auditPath?: string;
+    /**
+     * The seat-health recovery probe (crew#274): every `intervalMs` (default 10 min), INACTIVE
+     * seats only, run the seat's `version_probe`; exit 0 flips the seat active again. `enabled`
+     * defaults to ON in the daemon and OFF under a test runner (VITEST / NODE_ENV=test), so a
+     * test-built server never spawns CLI probes unless it opts in explicitly.
+     */
+    seatHealthProbe?: {
+        enabled?: boolean;
+        intervalMs?: number;
+        timeoutMs?: number;
+    };
 }
 export declare function createServer(adapter: CoreAdapter, options?: CreateServerOptions): Promise<ReturnType<typeof Fastify>>;
 export interface StartedServer {
@@ -16,5 +124,5 @@ export interface StartedServer {
     port: number;
     host: string;
 }
-export declare function startServer(adapter: CoreAdapter, port?: number, host?: string): Promise<StartedServer>;
+export declare function startServer(adapter: CoreAdapter, port?: number, host?: string, options?: CreateServerOptions): Promise<StartedServer>;
 //# sourceMappingURL=server.d.ts.map

package/dist/api/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAW9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CA8GrC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EACpB,IAAI,SAAO,EACX,IAAI,SAAc,GACjB,OAAO,CAAC,aAAa,CAAC,CAQxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAS9B,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAW7E,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAUjD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE;QACb,OAAO,EAAE,OAAO,CAAC;QACjB,iEAAiE;QACjE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2CAA2C;QAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE;QACvB,OAAO,EAAE,OAAO,CAAC;QACjB,8FAA8F;QAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2CAA2C;QAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,uDAAuD;QACvD,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,+FAA+F;QAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gGAAgG;QAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iFAAiF;QACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE;QACtB,OAAO,EAAE,OAAO,CAAC;QACjB,8FAA8F;QAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2CAA2C;QAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,uDAAuD;QACvD,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,8FAA8F;QAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;0DACkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iFAAiF;QACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;;;OAKG;IACH,aAAa,CAAC,EAAE;QACd,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,8FAA8F;QAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,uEAAuE;QACvE,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,iEAAiE;QACjE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2CAA2C;QAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,uGAAuG;IACvG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CA0WrC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EACpB,IAAI,SAAO,EACX,IAAI,SAAc,EAClB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAQxB"}

package/dist/api/server.js

@@ -6,8 +6,20 @@ import { fileURLToPath } from 'node:url';
 import { registerRoutes } from './routes.js';
 import { GateCache } from './gate-cache.js';
 import { ElicitationCache } from './elicitation-cache.js';
+import { registerAuthHooks, resolveAuth } from './auth.js';
+import { AuditLog } from './audit.js';
 import { registerClient, broadcast } from '../events/bus.js';
 import { TerminalHub, registerTerminalWs } from '../events/terminals.js';
+import { QeGateCache, startQeGateSubscriber } from '../qe/gate-events.js';
+import { startInteractiveDraftSubscriber } from '../interactive/draft-events.js';
+import { startInteractiveEditSubscriber } from '../interactive/edit-events.js';
+import { startProjectBus, MEMBERSHIP_ATTACHED, membershipAttachedKey } from '../projects/events.js';
+import { startInteractiveWsRelay, registerInteractiveEventRoutes } from '../interactive/ws-relay.js';
+import { MembershipIndex } from '../projects/membership-index.js';
+import { writeRunEvidencePointer } from '../projects/charter.js';
+import { CoreAdapter } from '../core/adapter.js';
+import { SeatHealthTracker, startSeatHealthProbe } from './seat-health.js';
+import { applyWorkerConfigRoot } from './seat-signin.js';
 // Allow the studio (a separate localhost origin, e.g. :4200) to call the
 // daemon's REST API. Restricted to loopback origins — the daemon only binds
 // 127.0.0.1, so this never widens exposure beyond the local machine.
@@ -15,7 +27,9 @@ const LOOPBACK_ORIGIN = /^http:\/\/(127\.0\.0\.1|localhost):\d+$/;
 /**
  * The bundled studio SPA lives at `dist/studio` next to the compiled server
  * (`dist/api/server.js` → `../studio`). See DES-STUDIO-SERVING-001 §2.3/§3.1
- * and `scripts/bundle-studio.mjs` which copies `packages/studio/dist` there.
+ * and `scripts/bundle-studio.mjs`, which copies the installed `wicked-studio`
+ * package's `dist/` there (the SPA is its own product since the #98 carve —
+ * github.com/mikeparcewski/wicked-studio — consumed as a dist artifact).
  */
 export function defaultStudioRoot() {
     return fileURLToPath(new URL('../studio', import.meta.url));
@@ -25,23 +39,219 @@ export async function createServer(adapter, options) {
     const gateCache = new GateCache();
     const elicitationCache = new ElicitationCache();
     const terminals = new TerminalHub();
+    const qeGateCache = new QeGateCache();
+    // Per-seat runtime health (crew#274): folded from the single CoreEvent subscription below,
+    // surfaced on GET /roster, recovered by the low-frequency probe armed further down.
+    const seatHealth = new SeatHealthTracker();
+    // The identity/actor seam (task #88). Resolved ONCE, before any hook exists:
+    // a malformed token file or a configured-but-unimplemented OIDC block must
+    // fail the boot here, never a request mid-flight. In the default local mode
+    // this reads no file and installs a hook that only pins the local actor.
+    const auth = resolveAuth(options?.auth, (m) => app.log.warn(m));
+    if (auth.mode === 'required') {
+        app.log.info('auth REQUIRED: bearer tokens enforced on /api/v1 and /ws');
+    }
+    const audit = new AuditLog(options?.auditPath, (m) => app.log.warn(m));
+    app.addHook('onClose', async () => {
+        await audit.flush(); // don't lose the trail's tail on shutdown
+    });
+    // Seat sign-in: export the persisted worker-config root as WICKED_WORKER_HOME at boot (the
+    // PUT /settings route re-applies it on every change). The engine reads the env PER SPAWN
+    // (acp_runner.rs claude_worker_home), so boot + on-change application is sufficient — no
+    // engine restart is ever needed. settings.json is the source of truth: unset/empty deletes
+    // the env, restoring the engine default ~/.wicked-worker.
+    applyWorkerConfigRoot((await adapter.getSettings()).worker_config_root);
+    // The project seam (DES-PROJECT-001): the bus handle for post-commit event emission + the
+    // /ws activity bridge, and the run→project index that tags outbound frames (§5.2). Hydrated
+    // from the engine so a restarted daemon tags correctly from the first frame. Created BEFORE
+    // the interactive seams below: their project-bound launches share the launch route's
+    // post-commit half (index tag + membership.attached emit) via `fileRun`.
+    const membershipIndex = new MembershipIndex();
+    await membershipIndex.hydrate(adapter, (m) => app.log.warn(m));
+    const projectBus = options?.projectEvents?.disabled === true
+        ? null
+        : await startProjectBus({
+            ...(options?.projectEvents?.dbPath !== undefined
+                ? { dbPath: options.projectEvents.dbPath }
+                : {}),
+            ...(options?.projectEvents?.pollIntervalMs !== undefined
+                ? { pollIntervalMs: options.projectEvents.pollIntervalMs }
+                : {}),
+            log: (m) => app.log.warn(m),
+        });
+    if (projectBus !== null) {
+        app.log.info('project bus seam armed (wicked.crew.project.* + /ws activity bridge)');
+        app.addHook('onClose', async () => {
+            await projectBus.stop();
+        });
+    }
+    // The interactive relay seam (DES-MERGE-001 §5.4/§6.1, slice 3): every wicked.interactive.**
+    // bus event becomes an `interactiveEvent` frame on the SAME /ws socket the studio already
+    // holds, and POST /projects/:id/interactive-events puts a whitelisted UI event back on the bus.
+    // Default ON — the merged skin needs it to render a generating doc — with the seam's usual
+    // posture: a machine without wicked-bus gets a logged null and boots anyway.
+    const interactiveRelay = options?.interactiveWsRelay?.disabled === true
+        ? null
+        : await startInteractiveWsRelay({
+            ...(options?.interactiveWsRelay?.dbPath !== undefined
+                ? { dbPath: options.interactiveWsRelay.dbPath }
+                : {}),
+            ...(options?.interactiveWsRelay?.pollIntervalMs !== undefined
+                ? { pollIntervalMs: options.interactiveWsRelay.pollIntervalMs }
+                : {}),
+            log: (m) => app.log.warn(m),
+        });
+    if (interactiveRelay !== null) {
+        app.log.info('interactive /ws relay armed (filter wicked.interactive.** → interactiveEvent)');
+        app.addHook('onClose', async () => {
+            await interactiveRelay.stop();
+        });
+    }
+    /** The post-commit half of a project-FILED launch, shared with the launch route (§2.2/§4):
+     *  the engine already attached the crew.run membership atomically with the launch — here we
+     *  tag future /ws frames and announce the attach on the project bus. */
+    const fileRun = (runId, projectId) => {
+        membershipIndex.set(runId, projectId);
+        projectBus?.emit(MEMBERSHIP_ATTACHED, 
+        // A daemon-internal launcher (the interactive-edit/draft subscribers),
+        // not an HTTP caller — the id is set server-side, so it stays honest
+        // under the task #88 rule that event actors are never caller-supplied.
+        { project_id: projectId, member: { kind: 'crew.run', ref: runId }, actor: 'interactive' }, membershipAttachedKey(projectId, 'crew.run', runId, Date.now()));
+    };
+    // Arm the opt-in QE gate-event subscription (crew's bus seam). Failure to
+    // arm is LOUD but non-fatal: the acceptance route never depends on the bus.
+    if (options?.qeGateEvents?.enabled === true) {
+        const { dbPath, pollIntervalMs } = options.qeGateEvents;
+        const sub = await startQeGateSubscriber(qeGateCache, {
+            ...(dbPath !== undefined ? { dbPath } : {}),
+            ...(pollIntervalMs !== undefined ? { pollIntervalMs } : {}),
+            log: (m) => app.log.warn(m),
+        });
+        if (sub !== null) {
+            app.log.info(`qe gate-event subscription armed (filter wicked.qe.**)`);
+            app.addHook('onClose', async () => {
+                await sub.stop();
+            });
+        }
+    }
+    // Arm the opt-in interactive-draft answering seam (task #86 spike). Same posture as the QE
+    // seam: failure to arm is LOUD but non-fatal — interactive's assist loop is the fallback
+    // answerer, and this daemon must boot on a machine whose bus is broken.
+    if (options?.interactiveDraftEvents?.enabled === true) {
+        const o = options.interactiveDraftEvents;
+        const sub = await startInteractiveDraftSubscriber(adapter, {
+            ...(o.dbPath !== undefined ? { dbPath: o.dbPath } : {}),
+            ...(o.pollIntervalMs !== undefined ? { pollIntervalMs: o.pollIntervalMs } : {}),
+            ...(o.heartbeatMs !== undefined ? { heartbeatMs: o.heartbeatMs } : {}),
+            ...(o.ledgerPath !== undefined ? { ledgerPath: o.ledgerPath } : {}),
+            ...(o.draftDir !== undefined ? { draftDir: o.draftDir } : {}),
+            ...(o.clisJson !== undefined ? { clisJson: o.clisJson } : {}),
+            onRunFiled: fileRun,
+            log: (m) => app.log.warn(m),
+        });
+        if (sub !== null) {
+            app.log.info('interactive-draft subscription armed (filter wicked.interactive.doc.created)');
+            app.addHook('onClose', async () => {
+                await sub.stop();
+            });
+        }
+    }
+    // Arm the opt-in interactive STRUCTURAL-edit answering seam (task #86 final leg). Same
+    // posture as the draft seam: failure to arm is LOUD but non-fatal — interactive's assist
+    // loop is the fallback answerer, and this daemon must boot on a machine whose bus is broken.
+    if (options?.interactiveEditEvents?.enabled === true) {
+        const o = options.interactiveEditEvents;
+        const sub = await startInteractiveEditSubscriber(adapter, {
+            ...(o.dbPath !== undefined ? { dbPath: o.dbPath } : {}),
+            ...(o.pollIntervalMs !== undefined ? { pollIntervalMs: o.pollIntervalMs } : {}),
+            ...(o.heartbeatMs !== undefined ? { heartbeatMs: o.heartbeatMs } : {}),
+            ...(o.ledgerPath !== undefined ? { ledgerPath: o.ledgerPath } : {}),
+            ...(o.editDir !== undefined ? { editDir: o.editDir } : {}),
+            ...(o.clisJson !== undefined ? { clisJson: o.clisJson } : {}),
+            onRunFiled: fileRun,
+            log: (m) => app.log.warn(m),
+        });
+        if (sub !== null) {
+            app.log.info('interactive-edit subscription armed (filter wicked.interactive.feedback.processed)');
+            app.addHook('onClose', async () => {
+                await sub.stop();
+            });
+        }
+    }
     // The daemon's single CoreEvent subscription fans out here: cache gate prompts
     // (§3.3), cache elicitation prompts (DES-002), route terminal frames to their owning
-    // per-terminal socket (by id, DES-TERMINAL-001 §6), then forward every frame verbatim
-    // to all `/ws` clients (§2.1).
-    adapter.onEvent((event) => {
+    // per-terminal socket (by id, DES-TERMINAL-001 §6), then forward every frame — tagged
+    // with its run's `project_id` when the membership table files it (DES-PROJECT-001
+    // §5.2; no new socket, additive field) — to all `/ws` clients (§2.1).
+    //
+    // Unregistered on close: a process can build more than one server over the same
+    // adapter (tests do), and a closed server's caches must stop consuming events —
+    // otherwise every discarded server keeps folding state forever (listener leak).
+    const offEvent = adapter.onEvent((event) => {
         gateCache.ingest(event);
         elicitationCache.ingest(event);
+        seatHealth.ingest(event);
         terminals.route(event);
-        broadcast(event);
+        const session = typeof event.session === 'string' ? event.session : undefined;
+        const projectId = session !== undefined ? membershipIndex.projectOf(session) : undefined;
+        broadcast(projectId !== undefined ? { ...event, project_id: projectId } : event);
+        // The foundation record's evidence pointer (§3.2 row 3): a project-bound run that completes
+        // gets its run-scope pointer written, best-effort, off the hot path.
+        if (event.type === 'sessionCompleted' && session !== undefined && projectId !== undefined) {
+            void (async () => {
+                try {
+                    const views = await adapter.sessionsDetail();
+                    const view = views.find((v) => v.session.id === session);
+                    const repoRef = view?.session.repo_ref ?? null;
+                    const repoRoot = repoRef !== null
+                        ? ((await adapter.listRepos()).find((r) => r.id === repoRef)?.root_path ?? null)
+                        : null;
+                    // The STORED scope, not a derived spelling: `Project.scope` is the designed tenancy
+                    // seam (ADR §3.1 — a future `org:<o>/project:<id>` prefix must not strand pointers).
+                    const project = await adapter.projectGet(projectId);
+                    await writeRunEvidencePointer(adapter, project?.scope ?? `project:${projectId}`, session, repoRoot, (m) => app.log.warn(m));
+                }
+                catch (err) {
+                    app.log.warn(`[projects] evidence-pointer lookup for ${session} failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            })();
+        }
+    });
+    app.addHook('onClose', async () => {
+        offEvent();
     });
+    // The seat-health recovery probe (crew#274 §3). A plain setInterval, unref'd, torn down on
+    // close. Default ON in the daemon, OFF under a test runner — a test suite building servers
+    // must never spawn `<cli> --version` children unless it opts in with `enabled: true`.
+    const probeCfg = options?.seatHealthProbe;
+    const underTestRunner = process.env['VITEST'] !== undefined || process.env['NODE_ENV'] === 'test';
+    if (probeCfg?.enabled ?? !underTestRunner) {
+        const probe = startSeatHealthProbe(seatHealth, () => CoreAdapter.roster(), {
+            ...(probeCfg?.intervalMs !== undefined ? { intervalMs: probeCfg.intervalMs } : {}),
+            ...(probeCfg?.timeoutMs !== undefined ? { timeoutMs: probeCfg.timeoutMs } : {}),
+            log: (m) => app.log.warn(m),
+        });
+        app.addHook('onClose', async () => {
+            probe.stop();
+        });
+    }
     app.addHook('onRequest', async (req, reply) => {
         const origin = req.headers.origin;
-        if (origin && LOOPBACK_ORIGIN.test(origin)) {
+        // Loopback origins are always allowed (the studio on another localhost
+        // port). NON-loopback origins are allowed ONLY when auth is required — the
+        // R2 pairing: a hosted skin needs CORS, and CORS beyond the machine is
+        // safe exactly when every request must carry a bearer token (no ambient
+        // credential exists for a foreign page to ride). An explicit allowlist
+        // (`allowedOrigins` / WICKED_CREW_ALLOWED_ORIGINS) narrows it further.
+        const allowed = origin !== undefined &&
+            (LOOPBACK_ORIGIN.test(origin) ||
+                (auth.mode === 'required' &&
+                    (auth.allowedOrigins === null || auth.allowedOrigins.includes(origin))));
+        if (origin && allowed) {
             reply.header('Access-Control-Allow-Origin', origin);
             reply.header('Vary', 'Origin');
-            reply.header('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE,OPTIONS');
-            reply.header('Access-Control-Allow-Headers', 'Content-Type');
+            reply.header('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
+            reply.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
         }
         if (req.method === 'OPTIONS') {
             await reply.code(204).send();
@@ -60,13 +270,28 @@ export async function createServer(adapter, options) {
         }
     });
     await app.register(fastifyWebsocket);
+    // Identity (401) + trust (403) hooks. Ordering is load-bearing twice over:
+    // AFTER the CORS hook, so an OPTIONS preflight (which carries no
+    // Authorization by design) is answered 204 above and never reaches the token
+    // check — and AFTER the websocket plugin, whose own onRequest hook flags
+    // upgrade requests (`request.ws`); if auth 401s first, that flag is never
+    // set and the plugin's onResponse cleanup skips destroying the raw upgrade
+    // socket, which then holds `app.close()` open forever.
+    registerAuthHooks(app, auth);
     app.get('/ws', { websocket: true }, (socket) => {
         // Late-join gets no replay; the studio reconciles with a one-shot GET /runs.
         registerClient(socket);
     });
     // One dedicated WS channel per PTY: /ws/terminals/:id (DES-TERMINAL-001 §6).
     registerTerminalWs(app, adapter, terminals);
-    registerRoutes(app, adapter, gateCache, elicitationCache);
+    registerRoutes(app, adapter, gateCache, elicitationCache, qeGateCache, {
+        bus: projectBus,
+        index: membershipIndex,
+        log: (m) => app.log.warn(m),
+    }, { audit, authMode: auth.mode }, { seatHealth });
+    // The UI-emittable direction of the interactive seam. Registered unconditionally (a null relay
+    // answers 503, not 404) and BEFORE the static/SPA fallback below, like every other API route.
+    registerInteractiveEventRoutes(app, interactiveRelay);
     // Serve the bundled studio SPA same-origin (DES-STUDIO-SERVING-001 §3). The
     // API routes, `/ws`, and terminal WS are registered ABOVE and keep winning:
     // static uses `wildcard: false` (only serves files that physically exist),
@@ -121,8 +346,8 @@ export async function createServer(adapter, options) {
     }
     return app;
 }
-export async function startServer(adapter, port = 7701, host = '127.0.0.1') {
-    const app = await createServer(adapter);
+export async function startServer(adapter, port = 7701, host = '127.0.0.1', options) {
+    const app = await createServer(adapter, options);
     await app.listen({ port, host });
     const addr = app.server.address();
     const boundPort = typeof addr === 'object' && addr ? addr.port : port;