wicked-crew 0.7.22 → 0.7.24

package/dist/api/routes.js

@@ -36,6 +36,7 @@ import { AuditLog } from './audit.js';
 import { AcpFoldCache, EngineVersionCache, eventsDirOf, installedPackageVersion, listStoreFiles, readStudioBundleVersion, } from './diagnostics.js';
 import { RetryIndex } from './retry-index.js';
 import { GroupIndex } from './group-index.js';
+import { RunTimingIndex, recordRunLaunched } from './run-timing-index.js';
 import { GuidanceIndex } from './guidance-index.js';
 import { DeliveryIndex, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, prUrlFrom, } from './delivery-index.js';
 import { DeliveryDerivationCache } from './delivery-cache.js';
@@ -93,6 +94,39 @@ function invalidBody(err, what) {
 function firstQueryValue(v) {
     return Array.isArray(v) ? v[0] : v;
 }
+/**
+ * Parse an optional `since`/`until` date-bound query param (unix SECONDS). Returns the parsed
+ * non-negative integer, `undefined` when the param is absent or blank, or the sentinel `'invalid'`
+ * when it is present but not a non-negative integer — the caller turns `'invalid'` into a 400 that
+ * names the offending param (a silently-dropped bad bound would answer a different date question
+ * than the one asked).
+ */
+function parseUnixSecondsParam(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || !Number.isInteger(n) || n < 0)
+        return 'invalid';
+    return n;
+}
+/**
+ * Inclusive `[since, until]` date-range predicate (unix seconds) shared by the memory + rules
+ * browse filters. An item with NO `created_at` is EXCLUDED whenever either bound is set — an
+ * unknown creation time is never asserted in range, and never fabricated (crew never invents a
+ * timestamp for a row the store did not stamp). With NEITHER bound set every item passes, so the
+ * un-filtered browse is unchanged.
+ */
+function withinDateRange(createdAt, since, until) {
+    if (since === undefined && until === undefined)
+        return true;
+    if (typeof createdAt !== 'number')
+        return false;
+    if (since !== undefined && createdAt < since)
+        return false;
+    if (until !== undefined && createdAt > until)
+        return false;
+    return true;
+}
 /** A JSON object whose every value is a string (a facet/intent tuple, axis→value). */
 function isStringRecord(v) {
     return (typeof v === 'object' &&
@@ -201,6 +235,10 @@ function shapeMemoryItem(raw) {
     };
     if (typeof r['score'] === 'number')
         item.score = r['score'];
+    // `created_at` (unix seconds) rides through from estate `memory.list` verbatim — the "added" time
+    // the surface date-filters on. Absent on an item the store did not stamp; never fabricated.
+    if (typeof r['created_at'] === 'number')
+        item.created_at = r['created_at'];
     return item;
 }
 /** Shape the estate `memory.coverage` result (`{ total, by_tier, by_kind }`) into the wire
@@ -392,6 +430,7 @@ runtime = {}) {
     const signedIn = runtime.signedIn ?? signedInHeuristic;
     const retryIndex = runtime.retryIndex ?? new RetryIndex();
     const groupIndex = runtime.groupIndex ?? new GroupIndex();
+    const runTimingIndex = runtime.runTimingIndex ?? new RunTimingIndex();
     const guidanceIndex = runtime.guidanceIndex ?? new GuidanceIndex();
     const deliveryIndex = runtime.deliveryIndex ?? new DeliveryIndex();
     const worktreeExists = runtime.worktreeExists ?? ((p) => existsSync(p));
@@ -491,6 +530,13 @@ runtime = {}) {
         const guidance = guidanceIndex.guidanceFor(view.session.id);
         if (guidance !== undefined)
             view.session.guidance = guidance;
+        // Run launch time (home command-center run metrics): unix SECONDS from the `run.launched`
+        // audit entry, ABSENT when the daemon has no launch record for this run (onboarding/campaign
+        // runs launched off POST /runs, pre-field runs) — never fabricated, so a bucketed KPI can
+        // exclude an undated run rather than dating it with a false now.
+        const createdAt = runTimingIndex.createdAtFor(view.session.id);
+        if (createdAt !== undefined)
+            view.session.created_at = createdAt;
         const state = resolveDelivery(view, conflictStrand);
         view.session.delivery = state.delivery;
         if (state.deliverUrl !== undefined)
@@ -966,24 +1012,29 @@ runtime = {}) {
             // Who launched it — the engine's LaunchOptions carries no actor field
             // (checked, wicked-core-ts 0.6.0), so the crew-side trail is the system
             // of record for run provenance (task #88).
-            audit.record('run.launched', actorOf(req), {
-                runId,
-                detail: {
-                    ...(b.workflow !== undefined ? { workflow: b.workflow } : {}),
-                    ...(b.repoRef !== undefined ? { repoRef: b.repoRef } : {}),
-                    ...(b.projectId !== undefined ? { projectId: b.projectId } : {}),
-                    // crew#393: the RESOLVED delivery decision, not just the caller's field — so the
-                    // trail says what the run will actually do, and whether the daemon decided it.
-                    deliver,
-                    ...(deliverDefaulted ? { deliverDefaulted: true } : {}),
-                    // CREW-UX-3: the trail is the durable record of lineage — the retry index (and a
-                    // restarted daemon's hydrate) reads it back from exactly this entry.
-                    ...(b.retryOf !== undefined ? { retryOf: b.retryOf } : {}),
-                    // wicked-studio#27: the trail is likewise the durable record of the group attach —
-                    // the group index (and a restarted daemon's hydrate) reads it back from here.
-                    ...(b.campaignId !== undefined ? { campaignId: b.campaignId } : {}),
-                    ...(b.groupLabel !== undefined ? { groupLabel: b.groupLabel } : {}),
-                },
+            // `run.launched` is the system of record for run provenance (the engine's LaunchOptions
+            // carries no actor field — task #88). `recordRunLaunched` writes the trail entry AND stamps
+            // the run-timing index with the SAME durable `ts` (home command-center run metrics): the live
+            // `created_at` equals what a restart rehydrates from the trail — no 1s drift, and no fabricated
+            // value (audit disabled → nothing stamped → `created_at` ABSENT, the honest answer for a run
+            // with no durable launch record). `createServer` always builds a REAL trail, so this fires on
+            // every production launch. The SHARED helper (Copilot #466) is why the recon/steering-author
+            // launchers stamp identically instead of leaving their runs undated until a restart.
+            recordRunLaunched(audit, runTimingIndex, actorOf(req), runId, {
+                ...(b.workflow !== undefined ? { workflow: b.workflow } : {}),
+                ...(b.repoRef !== undefined ? { repoRef: b.repoRef } : {}),
+                ...(b.projectId !== undefined ? { projectId: b.projectId } : {}),
+                // crew#393: the RESOLVED delivery decision, not just the caller's field — so the
+                // trail says what the run will actually do, and whether the daemon decided it.
+                deliver,
+                ...(deliverDefaulted ? { deliverDefaulted: true } : {}),
+                // CREW-UX-3: the trail is the durable record of lineage — the retry index (and a
+                // restarted daemon's hydrate) reads it back from exactly this entry.
+                ...(b.retryOf !== undefined ? { retryOf: b.retryOf } : {}),
+                // wicked-studio#27: the trail is likewise the durable record of the group attach —
+                // the group index (and a restarted daemon's hydrate) reads it back from here.
+                ...(b.campaignId !== undefined ? { campaignId: b.campaignId } : {}),
+                ...(b.groupLabel !== undefined ? { groupLabel: b.groupLabel } : {}),
             });
             if (b.retryOf !== undefined)
                 retryIndex.set(runId, b.retryOf);
@@ -2063,6 +2114,27 @@ runtime = {}) {
             return invalid('status', status, 'active|retired|all');
         }
         const layer = facet('layer');
+        // `since`/`until` (unix SECONDS, inclusive) date-bound the listed rows by each rule's
+        // `created_at`. A present-but-non-integer bound is a 400. NOTE: `created_at` is wired-but-
+        // pending a core-ts bump — it landed on the engine's `ConformanceRule` after the published
+        // core-ts this daemon builds against, so on the current binding NO rule carries it and this
+        // filter narrows to empty. The pass-through is verbatim (`listConformanceRules` returns the
+        // parsed rows unchanged), so the bound starts working the moment crew re-pins to a core-ts
+        // that surfaces it — a rule with no `created_at` is excluded, never dated with a fabricated now.
+        const since = facet('since');
+        const sinceSecs = parseUnixSecondsParam(since);
+        if (sinceSecs === 'invalid') {
+            return reply
+                .code(400)
+                .send({ error: `since must be a non-negative integer in unix seconds (got \`${since ?? ''}\`)` });
+        }
+        const until = facet('until');
+        const untilSecs = parseUnixSecondsParam(until);
+        if (untilSecs === 'invalid') {
+            return reply
+                .code(400)
+                .send({ error: `until must be a non-negative integer in unix seconds (got \`${until ?? ''}\`)` });
+        }
         const rules = (await adapter.listConformanceRules()).filter((r) => (severity === undefined || r.severity === severity) &&
             (ruleType === undefined || r.rule_type === ruleType) &&
             (layer === undefined || r.targets.layer === layer) &&
@@ -2070,7 +2142,9 @@ runtime = {}) {
             // steering engine always stamps it, but filter defensively over mixed-era rows.
             (steeringType === undefined || (r.steering_type ?? DEFAULT_STEERING_TYPE) === steeringType) &&
             // `retired` is absent on rows written before the field existed, which read as active.
-            (status === 'all' || (status === 'retired') === (r.retired === true)));
+            (status === 'all' || (status === 'retired') === (r.retired === true)) &&
+            // Undated rules (every rule on a pre-bump core-ts) are excluded once a bound is set.
+            withinDateRange(r.created_at, sinceSecs, untilSecs));
         return { rules };
     });
     app.get(`${V}/governance/claims`, async () => {
@@ -2991,6 +3065,18 @@ runtime = {}) {
             }
             limit = n;
         }
+        // `since`/`until` (unix SECONDS, inclusive) date-bound the complete set crew-side by each
+        // memory's `created_at`. A present-but-non-integer bound is a 400 (fail-loud, never a silent
+        // no-filter); a memory with no `created_at` is excluded once either bound is set (see
+        // withinDateRange). Applied BEFORE the row cap, so `limit` cuts the dated set.
+        const since = parseUnixSecondsParam(firstQueryValue(q.since));
+        if (since === 'invalid') {
+            return reply.code(400).send({ error: '`since` must be a non-negative integer (unix seconds)' });
+        }
+        const until = parseUnixSecondsParam(firstQueryValue(q.until));
+        if (until === 'invalid') {
+            return reply.code(400).send({ error: '`until` must be a non-negative integer (unix seconds)' });
+        }
         // `query`, when present, is a case-insensitive CONTENT substring filter over the complete set
         // — a management search that finds faceted memories too (unlike relevance recall).
         const query = (firstQueryValue(q.query) ?? '').trim().toLowerCase();
@@ -3007,6 +3093,9 @@ runtime = {}) {
                 const pairs = Object.entries(facetFilter);
                 memories = memories.filter((m) => pairs.every(([k, v]) => m.facets[k] === v));
             }
+            if (since !== undefined || until !== undefined) {
+                memories = memories.filter((m) => withinDateRange(m.created_at, since, until));
+            }
             if (limit !== undefined)
                 memories = memories.slice(0, limit);
             const body = { memories };
@@ -3094,6 +3183,8 @@ runtime = {}) {
         audit,
         actorOf,
         roster: () => CoreAdapter.roster(),
+        // So the steering-author run's `run.launched` entry stamps `created_at` live too (Copilot #466).
+        runTimingIndex,
     });
     // ── Testing (crew-testing) — governance evals + eval corpora + the recon trigger ────────────
     // Run the evals (does the steering corpus catch what it claims to?) and import a named eval
@@ -3105,6 +3196,12 @@ runtime = {}) {
         actorOf,
         roster: () => CoreAdapter.roster(),
         projects: { bus: projects.bus, index: projects.index },
+        // So the recon fan's `run.launched` entries stamp `created_at` live too (Copilot #466), not
+        // just after a restart re-hydrates the trail.
+        runTimingIndex,
+        // The eval history store: `createServer` supplies a real one (state-home-rooted); a
+        // directly-driven route set records nothing unless it injects one (no `~/.wicked-crew` writes).
+        ...(runtime.evalStore !== undefined ? { evalStore: runtime.evalStore } : {}),
     });
     // ── The wicked-interactive bridge, reverse-proxied (DES-MERGE-001 §5.3/§7.2) ──
     // Mounted BESIDE the routes above and under the same `${V}` prefix, so it inherits one