wicked-crew 0.7.29 → 0.7.30

package/dist/api/routes.js

@@ -17,6 +17,7 @@ import { execCapped, ExecOutputTooLarge } from '../core/exec.js';
 import { callEstateTool, EstateMcpError } from '../core/estate-mcp-client.js';
 import { SeatHealthTracker } from './seat-health.js';
 import { applyWorkerConfigRoot, signedInHeuristic } from './seat-signin.js';
+import { chatSeatAdmission, seatStanding } from './seat-standing.js';
 import { ChatScopeIndex, chatScopeDeps, prepareChatScratch, removeChatScratch, resolveChatScope, } from './chat-scope.js';
 import { allowedRootsFor, isInsideRoot, openWithSystemDefault } from './open-path.js';
 import { InvalidDiffBaseError, NotARegularFileError, UnresolvableDiffBaseError, readFileCapped, worktreeDiff, } from './run-files.js';
@@ -73,13 +74,6 @@ const STATUS_ORDER = {
 function sortActionableFirst(views) {
     return [...views].sort((a, b) => (STATUS_ORDER[a.session.status] ?? 9) - (STATUS_ORDER[b.session.status] ?? 9));
 }
-/**
- * `codeGraphDb(repo)` for a repo surface, or `null` after answering **503** — a CURRENT engine that
- * resolved no repo-graph root (`code_graph_root_unresolvable`, wicked-core#406) is a daemon-
- * environment fault, not a bad request and not Fastify's generic 500. The mapping is the shared
- * `codeGraphErrorStatus`; anything it does not classify rethrows unchanged (the stale-addon error
- * keeps its pre-existing shape here).
- */
 function codeGraphDbOr503(repo, reply) {
     try {
         return codeGraphDb(repo);
@@ -707,16 +701,29 @@ runtime = {}) {
     // gains `signed_in`: the cheap file/env presence heuristic, computed against the LIVE
     // `WICKED_WORKER_HOME` env — the same value the engine reads at the next worker spawn, kept
     // current by `applyWorkerConfigRoot` at boot and on every settings change.
-    app.get(`${V}/roster`, async () => {
+    //
+    // Each seat ALSO carries its STANDING (F-2R2-009): `auth` re-reads `signed_in` for what it means
+    // (a `signed_out` codex is benched on its first ballot; a `not_required` opencode answers on its
+    // free tier), and `council_eligible` says what a council would do with the seat as far as the
+    // daemon can tell. `POST /chats` seats its defaults through the SAME standing, so the roster and
+    // the chat never disagree about a seat.
+    const rosterWithStanding = () => {
         const workerRoot = process.env['WICKED_WORKER_HOME'];
-        return {
-            roster: CoreAdapter.roster().map((seat) => ({
+        return CoreAdapter.roster().map((seat) => {
+            const key = String(seat.key);
+            const health = seatHealth.healthFor(key);
+            const signed = signedIn(key, workerRoot === '' ? undefined : workerRoot);
+            return {
                 ...seat,
-                health: seatHealth.healthFor(String(seat.key)),
-                signed_in: signedIn(String(seat.key), workerRoot === '' ? undefined : workerRoot),
-            })),
-        };
-    });
+                health,
+                signed_in: signed,
+                // The bench is THIS daemon's council evidence (councilSeatFailed, bounded window) — the
+                // prediction learns from what the engine actually did with the seat (#533 review, F-1).
+                ...seatStanding(seat, signed, health, seatHealth.councilBenchFor(key)),
+            };
+        });
+    };
+    app.get(`${V}/roster`, async () => ({ roster: rosterWithStanding() }));
     // Open a file/folder with the OS default application (crew#273) — the studio Files tab's
     // click-to-open. The open MUST happen daemon-side (the SPA cannot spawn a process), which is
     // why the path is validated first: absolute, and inside one of the caller-visible roots — the
@@ -1559,26 +1566,43 @@ runtime = {}) {
                     .code(500)
                     .send({ error: `cannot prepare the chat's scratch root ${scope.cwd}: ${message(err)}` });
             }
-            // The default seats of a SCOPED chat are pre-filtered by admissibility (independent review,
-            // W5): the engine admits a seat to a scoped chat only when its ACP adapter asks permissions
-            // (`acp_input_governance`) or its record arms the kernel write floor (`os_sandbox`) — with the
-            // default roster that is claude and opencode — so a default project-scoped open does not show
-            // four refused seats. Explicit `clis` are passed through as asked; the engine refuses per seat
-            // with the reason.
+            // The DEFAULT seats are the roster seats the daemon's own admission admits (F-2R2-007,
+            // F-2R2-009): the seat's auth standing (a signed-out seat is refused up front, with the
+            // reason, instead of failing its first turn — the same predicate `GET /roster` reports as
+            // `council_eligible`) and, for a SCOPED chat, the engine's rule restated (only a seat whose
+            // ACP adapter asks permissions or whose record arms the kernel write floor can be held to
+            // read-only roots — with the default roster that is claude and opencode). Every seat dropped
+            // here is NAMED on the response (`refused`) and in the thread (`chatSeatRefused`), so a
+            // person can see why pi is missing. Explicit `clis` are passed through as asked; the engine
+            // refuses per seat with its reason, which is copied into `refused` too.
             const scoped = scope.kind !== 'none';
-            const roster = CoreAdapter.roster();
-            const clis = b.clis ??
-                roster
-                    .filter((s) => !scoped || s.acp?.acp_input_governance === true || s.acp?.os_sandbox === true)
-                    .map((s) => s.key)
-                    .filter((k) => typeof k === 'string');
+            const refused = [];
+            let clis;
+            if (b.clis !== undefined) {
+                clis = b.clis;
+            }
+            else {
+                clis = [];
+                for (const seat of rosterWithStanding()) {
+                    const key = String(seat.key);
+                    const admission = chatSeatAdmission(seat, seat.auth ?? 'unknown', scoped);
+                    if (admission.ok)
+                        clis.push(key);
+                    else
+                        refused.push({ cliKey: key, reason: admission.reason });
+                }
+            }
             if (clis.length === 0) {
                 chatScopes.release(chatId, token);
                 removeChatScratch(scope.cwd, chatScopes.base);
                 return reply.code(409).send({
-                    error: 'no seat in the roster can be held to a scoped chat (an ACP adapter admitted to input ' +
-                        'governance, or `os_sandbox = true` on its [cli.acp] record); open the chat unscoped, or ' +
-                        'name seats with `clis`',
+                    error: (scoped
+                        ? 'no seat in the roster can be held to a scoped chat (an ACP adapter admitted to input ' +
+                            'governance, or `os_sandbox = true` on its [cli.acp] record) and take a turn; open the ' +
+                            'chat unscoped, sign a seat in, or name seats with `clis`'
+                        : 'no seat in the roster can take a turn (every seat is signed out); sign a seat in from ' +
+                            'the System page, or name seats with `clis`') + ' — see refused',
+                    refused,
                 });
             }
             try {
@@ -1586,6 +1610,11 @@ runtime = {}) {
                     codeGraphDb: engine.codeGraphDb,
                     readRoots: engine.readRoots,
                 });
+                // A REQUESTED seat the engine refused joins the same list, with the engine's reason.
+                for (const s of seats) {
+                    if (!s.ok)
+                        refused.push({ cliKey: s.cliKey, reason: s.error ?? 'the engine refused the seat' });
+                }
                 // Nothing warmed (independent review, W1): the engine holds no pool row and has dropped the
                 // scope itself (no `chatClosed` will come) — report the PER-SEAT reasons, never an
                 // engine-version guess; the root goes, the id is free again.
@@ -1595,6 +1624,7 @@ runtime = {}) {
                     return reply.code(409).send({
                         error: `chat ${chatId}: no seat warmed (${seats.length} failed) — see seats`,
                         seats,
+                        refused,
                     });
                 }
                 // Honest scope (Copilot, #518): a SCOPED chat is a promise — the roots are read-only, the
@@ -1663,10 +1693,23 @@ runtime = {}) {
                         error: `chat ${chatId} was closed while it was being opened; open it again`,
                     });
                 }
+                // The thread learns of every refused seat the way it learns of everything else — a frame
+                // on /ws — AFTER the scope is published, so a reader never sees a refusal for a chat it
+                // cannot yet look up.
+                for (const r of refused) {
+                    runtime.broadcast?.({
+                        type: 'chatSeatRefused',
+                        chat: chatId,
+                        cliKey: r.cliKey,
+                        reason: r.reason,
+                        ...(b.projectId !== undefined ? { project_id: b.projectId } : {}),
+                    });
+                }
                 return reply.code(201).send({
                     chatId,
                     seats,
                     scope,
+                    refused,
                     ...(projectAttachError !== undefined ? { projectAttachError } : {}),
                 });
             }
@@ -2791,7 +2834,7 @@ runtime = {}) {
             return reply.code(404).send({ error: 'Requirement not found' });
         return { requirement: detail };
     });
-    app.get(`${V}/repos/:id/graph`, async (req, reply) => {
+    app.get(`${V}/repos/:id/graph`, { config: { manifest: { responseType: 'RepoGraphResponse', statusCodes: [200, 404, 500, 503] } } }, async (req, reply) => {
         const { id } = req.params;
         const repos = await adapter.listRepos();
         const repo = repos.find((r) => r.id === id);
@@ -2801,7 +2844,17 @@ runtime = {}) {
         if (dbPath === null)
             return reply;
         if (!existsSync(dbPath)) {
-            return reply.send({ graph: null });
+            // `graph: null` alone cannot tell "not indexed" from "empty" (F-2R2-005): say WHY, with the
+            // same finding text the repos wire carries when the engine has one.
+            const finding = (repo.findings ?? []).find((f) => f.code === 'in_tree_code_graph_ignored' || f.code === 'code_graph_root_unresolvable');
+            const unbuilt = {
+                graph: null,
+                reason: finding?.message ??
+                    `no code graph has been built for '${repo.name}' yet (nothing at ${dbPath}) — run onboarding ` +
+                        `(POST /api/v1/repos/${repo.id}/onboard) to index it`,
+                ...(finding !== undefined ? { finding } : {}),
+            };
+            return reply.send(unbuilt);
         }
         try {
             const settings = await adapter.getSettings();
@@ -2822,13 +2875,14 @@ runtime = {}) {
             });
             const raw = JSON.parse(stdout);
             const fileCount = new Set(raw.nodes.map((n) => n.file)).size;
-            return reply.send({
+            const built = {
                 graph: {
                     nodes: raw.nodes,
                     edges: raw.edges,
                     stats: { nodeCount: raw.nodes.length, edgeCount: raw.edges.length, fileCount },
                 },
-            });
+            };
+            return reply.send(built);
         }
         catch (err) {
             return reply.code(500).send({ error: message(err) });