wicked-crew 0.7.13 → 0.7.14

package/dist/api/routes.js

@@ -7,6 +7,7 @@ import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, SteeringUnsupportedError, humanGatePhaseIds } from '../core/adapter.js';
 import { codeGraphDb, requirementsGraph } from '../core/repoPaths.js';
+import { detectRefusal } from './gate-cache.js';
 import { QeGateCache } from '../qe/gate-events.js';
 import { buildAcceptanceView, resolveRunWorkflow } from '../qe/acceptance.js';
 import { buildEvidenceBundle, coreUnitId, evidenceFilename } from './evidence.js';
@@ -34,7 +35,8 @@ import { AcpFoldCache, EngineVersionCache, eventsDirOf, installedPackageVersion,
 import { RetryIndex } from './retry-index.js';
 import { GroupIndex } from './group-index.js';
 import { GuidanceIndex } from './guidance-index.js';
-import { DeliveryIndex, deliveryStateWithVacuity, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, prUrlFrom, } from './delivery-index.js';
+import { DeliveryIndex, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, prUrlFrom, } from './delivery-index.js';
+import { DeliveryDerivationCache } from './delivery-cache.js';
 import { gitReprovisionWorktree, runDeliverScript, } from './post-hoc-deliver.js';
 import { LOCAL_ACTOR } from './auth.js';
 // Re-exported so existing `import { API_PREFIX } from './routes.js'` callers keep working; the
@@ -262,6 +264,16 @@ runtime = {}) {
                 return repos.find((r) => r.id === repoRef)?.root_path;
             }),
     };
+    // The background layer that owns the git probes above (GET /runs p99): the run DTOs read it,
+    // the daemon's sweep/warm feed it. The default (a directly-driven route set) is COLD and
+    // unstarted — no background timer under a unit test, reads degrade to the stat-only
+    // tri-state — while `createServer` injects a started one over the production probes.
+    const deliveryCache = runtime.deliveryCache ??
+        new DeliveryDerivationCache({
+            listViews: () => adapter.sessionsDetail(),
+            probes: vacuityProbes,
+            isDelivered: (runId) => deliveryIndex.urlFor(runId) !== undefined,
+        });
     const deliverExec = runtime.deliverExec ?? runDeliverScript;
     const reprovisionWorktree = runtime.reprovisionWorktree ?? gitReprovisionWorktree;
     /** Repo root for a repo ref, from the registry — shared by the reprovision path below. */
@@ -275,7 +287,10 @@ runtime = {}) {
     // completed code run whose work is sitting unlifted in its worktree is VISIBLE on the wire,
     // legacy records included. The would-be-stranded runs are further split (crew#311): a
     // completed run whose worktree carries NO contribution at all reads `'vacuous'` — units all
-    // "done" with nothing produced must be LOUD on the wire, never silently green.
+    // "done" with nothing produced must be LOUD on the wire, never silently green. The vacuity
+    // split's git probes run in the BACKGROUND (delivery-cache.ts — GET /runs p99): DTO assembly
+    // reads the cache and degrades to the stat-only stranded/none label for at most one sweep
+    // tick on a miss, so the list fan-out never spawns git.
     // Applied at DTO assembly on exactly the two endpoints that serve the run DTO
     // (GET /runs + GET /runs/:id); the internal sessionsDetail() consumers are untouched.
     // crew#418 A: a `failed` run whose ONLY failure was the deliver phase's LIFT collision (a
@@ -303,16 +318,18 @@ runtime = {}) {
     };
     /** The run's delivery state, honest by construction (crew#393/#311/#418): a recorded PR wins
      *  (`'delivered'`); else a lift-conflict strand reads `'stranded'` from the branch; else the
-     *  worktree-stat derivation (stranded / vacuous / none). */
-    const resolveDelivery = async (view, conflictStrand) => {
+     *  delivery-derivation CACHE (a background-derived stranded / vacuous / none — GET /runs p99).
+     *  A cache miss answers the stat-only tri-state (one existsSync, the pre-crew#311 label) for
+     *  at most one sweep tick; the request path never spawns git and never awaits a derivation. */
+    const resolveDelivery = (view, conflictStrand) => {
         const url = deliveryIndex.urlFor(view.session.id);
         if (url !== undefined)
             return { delivery: 'delivered', deliverUrl: url };
         if (conflictStrand)
             return { delivery: 'stranded' };
-        return deliveryStateWithVacuity(view.session, undefined, vacuityProbes);
+        return deliveryCache.read(view.session);
     };
-    const decorateRun = async (view) => {
+    const decorateRun = (view) => {
         const conflictStrand = normalizeStranded(view);
         view.session.project_id = projects.index.projectOf(view.session.id) ?? null;
         const retryOf = retryIndex.retryOfFor(view.session.id);
@@ -330,7 +347,7 @@ runtime = {}) {
         const guidance = guidanceIndex.guidanceFor(view.session.id);
         if (guidance !== undefined)
             view.session.guidance = guidance;
-        const state = await resolveDelivery(view, conflictStrand);
+        const state = resolveDelivery(view, conflictStrand);
         view.session.delivery = state.delivery;
         if (state.deliverUrl !== undefined)
             view.session.deliverUrl = state.deliverUrl;
@@ -858,7 +875,7 @@ runtime = {}) {
     });
     // Run list (replaces GET /sessions). Actionable-first; reconciles the gate and elicitation caches
     // so that terminal-run entries are pruned even when their terminal CoreEvent was missed.
-    app.get(`${V}/runs`, { config: { manifest: { responseType: '{ runs: SessionView[] }', statusCodes: [200] } } }, async (req) => {
+    app.get(`${V}/runs`, { config: { manifest: { responseType: '{ runs: SessionView[] }', statusCodes: [200, 400] } } }, async (req, reply) => {
         const views = await adapter.sessionsDetail();
         gateCache.reconcile(views);
         elicitationCache.reconcile(views);
@@ -868,12 +885,35 @@ runtime = {}) {
         // resolve, not leak.
         // Fastify parses a REPEATED query param as string[] — normalize so `?include=archived`
         // and `?include=archived&include=archived` behave identically (Copilot).
-        const { include } = req.query;
+        const { include, limit } = req.query;
         const includeArchived = (Array.isArray(include) ? include : [include]).includes('archived');
+        // `?limit=N` — the top N AFTER the actionable-first sort below, so a capped poll still sees
+        // the runs that need a human before the terminal sediment. The default stays UNBOUNDED: the
+        // param used to be read by nobody (silently ignored — the full payload regardless), so an
+        // implicit cap would silently change results for un-migrated callers. A malformed value is
+        // refused loudly instead of ignored (the FINDING-031 posture: ignoring a field runs a
+        // different request than the caller sent) — and a repeated `?limit` is malformed too, since
+        // two caps are an ambiguity, not an idempotent repetition like `include`.
+        let cap;
+        if (limit !== undefined) {
+            // STRICT canonical decimal only (Copilot on #435): `Number(...)` also admits hex
+            // (`0x10`), exponent (`2e3`), signed (`+1`), and whitespace-padded spellings — surprising
+            // aliases a 400-on-malformed contract must refuse, not quietly honor. `0` is deliberately
+            // VALID and answers the empty list — a real non-negative integer, not a malformation —
+            // while non-canonical zeros (`00`, `01`) are refused with the rest.
+            const canonical = !Array.isArray(limit) && /^(0|[1-9][0-9]*)$/.test(limit);
+            if (!canonical) {
+                return reply.code(400).send({
+                    error: `Invalid ?limit — expected one non-negative decimal integer, got ${JSON.stringify(limit)}`,
+                });
+            }
+            cap = Number(limit);
+        }
         const visible = includeArchived
             ? views
             : views.filter((v) => v.session.archived_at == null);
-        return { runs: await Promise.all(sortActionableFirst(visible).map(decorateRun)) };
+        const ordered = sortActionableFirst(visible);
+        return { runs: (cap !== undefined ? ordered.slice(0, cap) : ordered).map(decorateRun) };
     });
     // ── Run archival (crew#265) — write-off, not delete ────────────────────────
     const ArchiveSchema = z.object({
@@ -933,7 +973,7 @@ runtime = {}) {
         const run = views.find((v) => v.session.id === id);
         if (!run)
             return reply.code(404).send({ error: 'Run not found' });
-        return { run: await decorateRun(run) };
+        return { run: decorateRun(run) };
     });
     // ── Post-hoc delivery (crew#393) — lift a stranded run's worktree into a PR ──
     // The recovery path for the run 83052f0b class: a COMPLETED repo-scoped run whose reviewable
@@ -1463,7 +1503,7 @@ runtime = {}) {
         // The 409 body carries the machine-readable pointer (`ResumeRefusal` in api-types).
         const terminal = run.session.status;
         if (terminal === 'completed' || terminal === 'cancelled') {
-            const state = await resolveDelivery(run, conflictStrand);
+            const state = resolveDelivery(run, conflictStrand);
             const recovery = terminal === 'completed' && state.delivery === 'stranded'
                 ? 'deliver'
                 : 'retry';
@@ -1562,11 +1602,16 @@ runtime = {}) {
             : null;
         const durableGate = durableRows?.find((r) => r.kind === 'gate');
         if (durableGate !== undefined) {
+            // This path builds the entry inline (not through `fold`), so it must run the SAME refusal
+            // detection (issue #419) — otherwise a gate served from the durable row after a restart would
+            // silently drop the warning that the live/replay paths carry.
+            const refusal = detectRefusal(durableGate.prompt);
             const entry = {
                 ord: durableGate.ord ?? 0,
                 prompt: durableGate.prompt,
                 lifecycle: 'open',
                 receivedAt: new Date(durableGate.created_at).toISOString(),
+                ...(refusal !== undefined ? { refusal } : {}),
             };
             gateCache.adopt(id, entry);
             return { runId: id, ...entry };
@@ -2434,7 +2479,7 @@ runtime = {}) {
         // The escalation ladder's knobs (crew#341). This trio lets the PLATFORM touch runs, so a
         // typo must be a 400, never a silently-dropped key that leaves the operator believing they
         // armed (or disarmed) automatic recovery. `workerStallEscalateMinutes: 0` is the explicit
-        // OFF spelling — and the shipped default is off (absent).
+        // OFF spelling — the shipped default is ON at 30 (perf#4), so 0 is how an operator disarms.
         if (Object.hasOwn(patch, 'workerStallEscalateMinutes')) {
             const mins = patch.workerStallEscalateMinutes;
             if (typeof mins !== 'number' || !Number.isInteger(mins) || mins < 0 || mins > 1440) {
@@ -2556,6 +2601,8 @@ runtime = {}) {
         groupIndex,
         deliveryUrlFor: (runId) => deliveryIndex.urlFor(runId),
         vacuity: vacuityProbes,
+        // A non-probe derivation throw in the rollup is a defect — error level, loud in diagnostics.
+        logDefect: (m) => app.log.error(m),
     });
     // ── Governance wiki management (wiki-mgmt) — scoreboard + honest empty-state meta ──────────
     // Browse (`GET /governance/rules` + facets) and retire (`DELETE /governance/rules/:id`) stay