wicked-crew 0.7.31 → 0.7.33

package/dist/api/routes.js

@@ -17,7 +17,9 @@ import { execCapped, ExecOutputTooLarge } from '../core/exec.js';
 import { callEstateTool, EstateMcpError } from '../core/estate-mcp-client.js';
 import { SeatHealthTracker } from './seat-health.js';
 import { applyWorkerConfigRoot, signedInHeuristic } from './seat-signin.js';
-import { chatSeatAdmission, seatStanding } from './seat-standing.js';
+import { chatSeatAdmission } from './seat-standing.js';
+import { rosterWithStandingFactory } from './roster-standing.js';
+import { ChatTurnIndex } from './chat-turns.js';
 import { ChatScopeIndex, chatScopeDeps, prepareChatScratch, removeChatScratch, resolveChatScope, } from './chat-scope.js';
 import { allowedRootsFor, isInsideRoot, openWithSystemDefault } from './open-path.js';
 import { InvalidDiffBaseError, MERGE_BASE_LITERAL, NotARegularFileError, UnresolvableDiffBaseError, branchDiff, isPlainRef, readFileCapped, worktreeDiff, } from './run-files.js';
@@ -339,6 +341,12 @@ export const LaunchSchema = z.object({
      *  defaults to `"pr"` (flippable via the `deliverDefault` setting), everything else to
      *  `"none"` — see the resolution below. */
     deliver: z.enum(['pr', 'none']).optional(),
+    /** F-E2E-030 — who confirms the deliver phase. `'human'` (the default when omitted): the engine
+     *  pauses before the composed `deliver` Tool unit pushes and opens the PR, whatever
+     *  `humanConfirm` says. `'auto'`: the caller's EXPLICIT opt-out — the push and PR follow verify
+     *  unattended, under the daemon's active gh account; a UI sending it must name the posture
+     *  "auto-deliver" to its operator. Additive; an older daemon's schema rejects it with a 400. */
+    deliverGate: z.enum(['human', 'auto']).optional(),
     /** DES-UX-001 §8.3 (CREW-UX-3) — the run this launch retries. Must name an EXISTING run id
      *  (the route checks the store and 400s with a named error otherwise); persisted via the
      *  `run.launched` audit entry + retry index and echoed as `AgentSession.retry_of`. */
@@ -356,6 +364,12 @@ export const LaunchSchema = z.object({
 }).strict().refine((b) => b.deliver !== 'pr' || b.workflow !== undefined, {
     message: 'deliver: "pr" requires a workflow — a free-text run has no def to append the deliver phase to',
     path: ['deliver'],
+}).refine((b) => b.deliverGate === undefined || b.deliver !== 'none', {
+    // F-E2E-030: a deliver-gate posture on a launch that declines delivery is a contradiction the
+    // caller should hear about, not a silent no-op. (A launch that OMITS `deliver` may still
+    // resolve to no deliver unit — repo-less, free-text, read-only def; the field is then inert.)
+    message: 'deliverGate has no meaning with deliver: "none" — there is no deliver phase to gate',
+    path: ['deliverGate'],
 }).refine((b) => b.campaignId === undefined || b.groupLabel === undefined, {
     message: 'campaignId and groupLabel are mutually exclusive — a run files onto ONE grouping surface (an existing campaign, or a label group)',
     path: ['groupLabel'],
@@ -471,6 +485,7 @@ runtime = {}) {
     const runTimingIndex = runtime.runTimingIndex ?? new RunTimingIndex();
     const guidanceIndex = runtime.guidanceIndex ?? new GuidanceIndex();
     const chatScopes = runtime.chatScopes ?? new ChatScopeIndex();
+    const chatTurns = runtime.chatTurns ?? new ChatTurnIndex();
     const deliveryIndex = runtime.deliveryIndex ?? new DeliveryIndex();
     // Wave 6: the doc↔run binding and the registered test sets — `createServer` injects the real
     // ones; a directly-driven route set gets an empty index (every run `document_id: null`, no sets).
@@ -611,7 +626,13 @@ runtime = {}) {
     // null / [] for the rest ("where declared", never invented). See src/api/endpoint-manifest.ts.
     app.get(`${V}/health`, { config: { manifest: { statusCodes: [200] } } }, async () => {
         const ping = await adapter.ping();
-        return { status: 'ok', version: PKG_VERSION, ping };
+        // F-E2E-030: what this deployment can keep. A composer reads `capabilities.deliverGate`
+        // before it promises "pauses at the deliver gate"; a stub-driven route set without the
+        // probe honestly reports no gate.
+        const capabilities = typeof adapter.engineCapabilities === 'function'
+            ? adapter.engineCapabilities()
+            : { deliverGate: false };
+        return { status: 'ok', version: PKG_VERSION, ping, capabilities };
     });
     // The daemon's self-knowledge surface (diagnostics): what is deployed, what it stores, what
     // has gone wrong recently, and whether ACP is really working across the CLIs — the answer
@@ -702,41 +723,14 @@ runtime = {}) {
         return { port, host };
     });
     // The council seats for the launch form (static production roster), each carrying its RUNTIME
-    // health (crew#274). The roster is declarative — every configured seat is listed — and `health`
-    // is what the platform has observed: default active with no message; inactive + the error
-    // excerpt after a seat-level failure, until an ok output or the recovery probe flips it back.
-    // Existing fields ride through verbatim (the seat still round-trips into `clisJson` on launch)
-    // — the spread is deliberately NOT a field whitelist, which is what lets the engine's
-    // `login_invocation` (seat sign-in, wicked-core PR#278) pass through untouched. Each seat also
-    // gains `signed_in`: the cheap file/env presence heuristic, computed against the LIVE
-    // `WICKED_WORKER_HOME` env — the same value the engine reads at the next worker spawn, kept
-    // current by `applyWorkerConfigRoot` at boot and on every settings change.
-    //
-    // Each seat ALSO carries its STANDING (F-2R2-009): `auth` re-reads `signed_in` for what it means
-    // (a `signed_out` codex is benched on its first ballot; a `not_required` opencode answers on its
-    // free tier), and `council_eligible` says what a council would do with the seat as far as the
-    // daemon can tell. `POST /chats` seats its defaults through the SAME standing, so the roster and
-    // the chat never disagree about a seat.
-    const rosterWithStanding = () => {
-        const workerRoot = process.env['WICKED_WORKER_HOME'];
-        return CoreAdapter.roster().map((seat) => {
-            const key = String(seat.key);
-            const health = seatHealth.healthFor(key);
-            const signed = signedIn(key, workerRoot === '' ? undefined : workerRoot);
-            return {
-                ...seat,
-                health,
-                signed_in: signed,
-                // The bench is THIS daemon's council evidence (councilSeatFailed, bounded window) — the
-                // prediction learns from what the engine actually did with the seat (#533 review, F-1).
-                ...seatStanding(seat, signed, health, seatHealth.councilBenchFor(key), 
-                // F-A45-006: the seat's OWN "no credential" report (a ballot's "No API key found", a
-                // worker's 401, an auth ACP fallback) overrides the file probe — `auth` flips, not only
-                // `council_eligible`, and the evidence rides on the wire.
-                seatHealth.authFailureFor(key)),
-            };
-        });
-    };
+    // health (crew#274) and its STANDING (F-2R2-009) — `api/roster-standing.ts` is the ONE accessor
+    // every launch path shares (F-RECON-002/003: the interactive seams, the adapter's onboarding
+    // launch and `wicked-crew start` used to hand the engine the RAW registry roster, so signed-out
+    // seats were convened and even elected). `createServer` injects the daemon's single instance
+    // (built over the same `seatHealth`); a directly-driven route set builds an equivalent one here.
+    // `POST /chats` seats its defaults through the SAME standing, so the roster and the chat never
+    // disagree about a seat.
+    const rosterWithStanding = runtime.rosterWithStanding ?? rosterWithStandingFactory({ seatHealth, signedIn });
     app.get(`${V}/roster`, async () => ({ roster: rosterWithStanding() }));
     // Open a file/folder with the OS default application (crew#273) — the studio Files tab's
     // click-to-open. The open MUST happen daemon-side (the SPA cannot spawn a process), which is
@@ -1055,6 +1049,11 @@ runtime = {}) {
             input.entityMode = b.entityMode;
         if (b.humanConfirm !== undefined)
             input.humanConfirm = b.humanConfirm;
+        // F-E2E-030: only the explicit `'auto'` opts out of the engine's deliver gate. `'human'` and
+        // an omitted field both leave `autoDeliver` off the input — the gate is the engine's default,
+        // so the wire never has to say "gate me" to be gated.
+        if (b.deliverGate === 'auto')
+            input.autoDeliver = true;
         if (b.repoRef !== undefined)
             input.repoRef = b.repoRef;
         if (b.workflow !== undefined)
@@ -1851,15 +1850,35 @@ runtime = {}) {
         text: z.string().min(1).max(65536),
         targets: z.array(z.string().min(1)).min(1).max(8).optional(),
     }).strict();
+    // F-RECON-017: a message sent while a targeted seat is still answering the previous one is
+    // REFUSED, not queued. The engine queues silently (the worker gets the text the instant the
+    // previous turn's final block lands) and its reply frames carry no message correlation, so the
+    // recon saw Q2's reply render under Q3's bubble. The daemon's own turn index (`chat-turns.ts`)
+    // is the record: 409 `turn_in_flight` names the turn and the busy seats — a send that targets
+    // only IDLE seats passes (a stalled seat never blocks a follow-up to the one that answered) —
+    // and the 202 returns the `turnId` the reply frames are stamped with (`turn_id`) on `/ws`.
     app.post(`${V}/chats/:id/messages`, async (req, reply) => {
         const { id } = req.params;
         const parsed = ChatMessageSchema.safeParse(req.body);
         if (!parsed.success) {
             return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
         }
+        const inFlight = chatTurns.inFlight(id, parsed.data.targets);
+        if (inFlight !== null) {
+            const ageS = Math.round(inFlight.ageMs / 1000);
+            return reply.code(409).send({
+                code: 'turn_in_flight',
+                error: `${inFlight.busy.join(', ')} ${inFlight.busy.length === 1 ? 'is' : 'are'} still answering the previous ` +
+                    `message in this chat (turn ${inFlight.turnId}, ${ageS}s ago: “${inFlight.excerpt}”) — wait for the ` +
+                    `reply, or target only idle seats. Nothing was sent.`,
+                chatId: id,
+                turn: inFlight,
+            });
+        }
         try {
             const seats = await adapter.chatSend(id, parsed.data.text, parsed.data.targets);
-            return reply.code(202).send({ seats });
+            const turn = chatTurns.begin(id, seats, parsed.data.text);
+            return reply.code(202).send({ seats, ...(turn !== null ? { turnId: turn.turnId } : {}) });
         }
         catch (err) {
             const msg = message(err);
@@ -1924,6 +1943,7 @@ runtime = {}) {
         // (crew#502); the id stays parked until the engine's `chatClosed` is observed, so a delayed
         // close can never land on a chat that reused it (Copilot, #518).
         chatScopes.beginClose(id);
+        chatTurns.closed(id);
         try {
             await adapter.chatClose(id);
             return { ok: true };