wicked-crew 0.7.33 → 0.7.35

package/dist/api/routes.js

@@ -5,7 +5,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, SteeringUnsupportedError, humanGatePhaseIds } from '../core/adapter.js';
+import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, SteeringUnsupportedError, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
 import { codeGraphDb, codeGraphErrorStatus, requirementsGraph } from '../core/repoPaths.js';
 import { resolveCursorUnit } from '../core/cursor.js';
 import { detectRefusal } from './gate-cache.js';
@@ -35,6 +35,9 @@ import { isSteeringAuthorRun, landSteeringProposal } from './steering-landing.js
 import { registerTestingRoutes } from './testing.js';
 import { registerSkillsRoutes } from './skills.js';
 import { disabledSkillsHealth } from '../skills/runtime.js';
+import { STATE_HOME_BLOCKER_CODE, STATE_HOME_REMEDY, isEngineStateHomeRefusal, stateHomeBlockerBody, } from '../projects/state-home-preflight.js';
+import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE } from '../skills/base-skill.js';
+import { noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
 import { composeDeliverText, factsFromRun, framedDeliverText, runUrlFor } from '../core/deliver-text.js';
@@ -486,6 +489,7 @@ runtime = {}) {
     const guidanceIndex = runtime.guidanceIndex ?? new GuidanceIndex();
     const chatScopes = runtime.chatScopes ?? new ChatScopeIndex();
     const chatTurns = runtime.chatTurns ?? new ChatTurnIndex();
+    const chatTranscripts = runtime.chatTranscripts;
     const deliveryIndex = runtime.deliveryIndex ?? new DeliveryIndex();
     // Wave 6: the doc↔run binding and the registered test sets — `createServer` injects the real
     // ones; a directly-driven route set gets an empty index (every run `document_id: null`, no sets).
@@ -632,7 +636,26 @@ runtime = {}) {
         const capabilities = typeof adapter.engineCapabilities === 'function'
             ? adapter.engineCapabilities()
             : { deliverGate: false };
-        return { status: 'ok', version: PKG_VERSION, ping, capabilities };
+        // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
+        // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
+        // launch while the state home holds an entry the worker Read fence cannot classify. Re-surveyed
+        // per probe (two readdirs) so an entry that appears after boot is reported without a restart;
+        // the field is ABSENT when there is nothing to say, and on a route set booted without the watch.
+        const stateHome = runtime.stateHome !== undefined ? await runtime.stateHome.refresh() : null;
+        const warnings = stateHome === null
+            ? []
+            : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }));
+        // crew#554: the BASE skill posture for the next launch — the composer's confirm line
+        // ("discipline skill: <name> gen N" / "MISSING — …"). Cached by the skills runtime: no I/O.
+        const baseSkill = runtime.skills?.baseSkill() ?? null;
+        return {
+            status: 'ok',
+            version: PKG_VERSION,
+            ping,
+            capabilities,
+            baseSkill,
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
     });
     // The daemon's self-knowledge surface (diagnostics): what is deployed, what it stores, what
     // has gone wrong recently, and whether ACP is really working across the CLIs — the answer
@@ -680,6 +703,11 @@ runtime = {}) {
             // Is the governance evidence LANDING (crew#495): the store, the records on it, the dead
             // letters — with a `governance.deadletter` finding the moment the outbox holds one.
             governance,
+            // The state-home classification (wicked-core#411 / crew#497): which state home the worker
+            // Read fence classifies, every entry it cannot classify there (top level and skills root),
+            // who classified (the engine, or crew's registry copy on an older addon) and whether that
+            // refuses launches — re-surveyed per read. `null` on a route set booted without the watch.
+            stateHome: runtime.stateHome !== undefined ? await runtime.stateHome.refresh() : null,
         };
     });
     // Who am I talking to the daemon as? (task #88). In local mode this is
@@ -1025,10 +1053,13 @@ runtime = {}) {
                 requestType: 'LaunchRunBody',
                 responseType: '{ runId: string }',
                 // 404/409: unknown project / unknown campaignId (wicked-studio#27) /
-                // archived-or-synthesized project + busy engine (see the catch below); 400: zod
-                // reject or a retryOf naming no existing run; 501: campaignId attach on an engine
-                // addon without the campaign bindings ("upgrade the engine").
-                statusCodes: [201, 400, 404, 409, 501],
+                // archived-or-synthesized project + busy engine + the state-home blocker
+                // (`state_home_unregistered`) + a roster with no eligible seat (`no_eligible_seat`,
+                // wicked-core#461 — see the catch below); 400: zod reject or a retryOf naming no
+                // existing run; 422: the base-skill intake refusal (`base_skill_refused`, crew#554);
+                // 501: campaignId attach on an engine addon without the campaign bindings ("upgrade
+                // the engine").
+                statusCodes: [201, 400, 404, 409, 422, 501],
             },
         },
     }, async (req, reply) => {
@@ -1037,6 +1068,18 @@ runtime = {}) {
             return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
         }
         const b = parsed.data;
+        // wicked-core#411 / crew#497: the state-home blocker, judged BEFORE anything is resolved or
+        // committed. While the handed skills snapshot derives a state home with an entry the worker
+        // Read fence cannot classify, the engine refuses this launch at intake (and an engine before
+        // that fix refused it at the run's first worker, after councils and the intake gate) — so the
+        // daemon answers the typed 409 itself, naming every entry and the remedy, until they are gone.
+        // Re-surveyed per launch: the entries named are the ones there NOW.
+        if (runtime.stateHome !== undefined) {
+            const stateHome = await runtime.stateHome.refresh();
+            if (stateHome.refusesLaunches) {
+                return reply.code(409).send(stateHomeBlockerBody(stateHome));
+            }
+        }
         const input = {
             problem: b.problem,
             sessionId: b.sessionId ?? randomUUID(),
@@ -1195,6 +1238,34 @@ runtime = {}) {
         }
         catch (err) {
             const msg = message(err);
+            // The engine's own intake refusal (wicked-core#411 `StateHomeConfigError`) is a configuration
+            // error, not a malformed request: the same typed 409 the pre-check above answers, over a fresh
+            // survey — the pre-check saw a clean state home (or an addon that could not classify), the
+            // engine did not.
+            if (isEngineStateHomeRefusal(msg)) {
+                const stateHome = runtime.stateHome !== undefined ? await runtime.stateHome.refresh() : null;
+                return reply
+                    .code(409)
+                    .send(stateHome !== null && stateHome.unregistered.length > 0
+                    ? stateHomeBlockerBody(stateHome)
+                    : {
+                        error: msg,
+                        code: STATE_HOME_BLOCKER_CODE,
+                        stateHome: stateHome?.stateHome ?? null,
+                        unregistered: [],
+                        remedy: STATE_HOME_REMEDY,
+                    });
+            }
+            // wicked-core#461 / crew#556: the engine's typed `NoEligibleSeat` intake refusal — the plan
+            // needs a seat and every seat of the roster was benched by the launcher (signed out / quota /
+            // not installed). A 409 with a typed body, not the 400 the generic arm below answered: the
+            // request is well-formed and succeeds unchanged once a seat is signed in — the conflict is
+            // with the roster's standing (the `state_home_unregistered` rule) — and not a 5xx: the engine
+            // is healthy and said no, naming every seat and its cause.
+            const noSeat = parseNoEligibleSeat(msg);
+            if (noSeat !== null) {
+                return reply.code(409).send(noEligibleSeatBody(msg, noSeat));
+            }
             // An unknown/archived project is a state conflict on a real resource, not a malformed
             // request: 404/409 per the projects error mapping; anything else keeps the launch 400/409.
             if (b.projectId !== undefined && /project.*not registered/i.test(msg)) {
@@ -1203,6 +1274,17 @@ runtime = {}) {
             if (b.projectId !== undefined && /archived|'default'|synthesized/i.test(msg)) {
                 return reply.code(409).send({ error: msg });
             }
+            // crew#554 / wicked-core#468: the engine refused the launch AT INTAKE because the handed
+            // skills snapshot lacks the run's BASE skill (`SkillsError::BaseSkillRefused` — the message
+            // names the skill and "refused at intake"). Nothing was planned or persisted. A typed 422 so a
+            // composer renders a clear card (skill, policy, remedy) instead of a generic launch 400.
+            if (/\bbase skill\b.*\brefused at intake\b/is.test(msg)) {
+                const posture = runtime.skills?.baseSkill() ?? null;
+                const remedy = posture !== null && posture.inCatalog
+                    ? `the skill is in the catalog — POST /skills/publish hands it to the next launch (or set baseSkillRef "" via PUT /settings to turn the base skill off explicitly)`
+                    : `install a wicked-garden that ships the skill, POST /skills/refresh-baseline, then POST /skills/publish (or set baseSkillRef "" via PUT /settings to turn the base skill off explicitly)`;
+                return reply.code(422).send({ code: 'base_skill_refused', error: msg, baseSkill: posture, remedy });
+            }
             const busy = /busy|in flight|already/i.test(msg);
             return reply.code(busy ? 409 : 400).send({ error: msg });
         }
@@ -1863,7 +1945,15 @@ runtime = {}) {
         if (!parsed.success) {
             return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
         }
-        const inFlight = chatTurns.inFlight(id, parsed.data.targets);
+        // DES-L5 §5-c (F-E2E-041): the audience is decided HERE — the named targets, else the engine's
+        // warm seats — so the turn can be opened BEFORE the engine call, in the same tick as the
+        // predicate below: two racing sends can no longer both pass `inFlight` during the await, and a
+        // `chatDelta` that lands before `chatSend` resolves is already stamped with its `turn_id`.
+        const audience = parsed.data.targets ?? (await adapter.chatSeats(id));
+        if (audience.length === 0) {
+            return reply.code(409).send({ error: `chat '${id}' has no warm seats — open it first` });
+        }
+        const inFlight = chatTurns.inFlight(id, audience);
         if (inFlight !== null) {
             const ageS = Math.round(inFlight.ageMs / 1000);
             return reply.code(409).send({
@@ -1875,12 +1965,22 @@ runtime = {}) {
                 turn: inFlight,
             });
         }
+        // Sync, same tick as `inFlight`: the window is closed before anything yields.
+        const turn = chatTurns.begin(id, audience, parsed.data.text);
         try {
             const seats = await adapter.chatSend(id, parsed.data.text, parsed.data.targets);
-            const turn = chatTurns.begin(id, seats, parsed.data.text);
+            if (turn !== null) {
+                // The engine's answer is the truth: the reserved audience is squared with the seats it
+                // reached, and the operator's message joins the transcript with exactly those seats.
+                chatTurns.reconcile(id, turn.turnId, seats);
+                chatTranscripts?.appendUser(id, turn.turnId, parsed.data.text, seats);
+            }
             return reply.code(202).send({ seats, ...(turn !== null ? { turnId: turn.turnId } : {}) });
         }
         catch (err) {
+            // Nothing went out: the reservation is retracted so the next send is not refused for it.
+            if (turn !== null)
+                chatTurns.abort(id, turn.turnId);
             const msg = message(err);
             return reply.code(/no warm seats/.test(msg) ? 409 : 400).send({ error: msg });
         }
@@ -1931,6 +2031,9 @@ runtime = {}) {
                 seats: await adapter.chatSeats(id),
                 scope: chatScopes.get(id) ?? null,
                 refused: chatScopes.refusedOf(id) ?? null,
+                // DES-L5 (D-13): the transcript so far, append order — `[]` before the first persisted
+                // turn; the file goes with the chat on `chatClosed`, so a reclaimed id answers `[]` too.
+                ...(chatTranscripts !== undefined ? { messages: chatTranscripts.read(id) } : {}),
             };
         }
         catch (err) {
@@ -3235,7 +3338,11 @@ runtime = {}) {
     // The store is SHARED with the skin (crew#323): beside the engine's own keys it round-trips
     // the studio's `studio.*` preference blobs verbatim — see `CrewSystemSettings`'s index
     // signature in core/types.ts, which states that rather than leaving it to a client comment.
-    app.get(`${V}/settings`, async () => ({ settings: await adapter.getSettings() }));
+    // crew#494 (F-007 — FIX-IT-ALL L10-6): the System page showed a LITERAL settings path; the daemon
+    // now says where its settings file actually is (`WICKED_CREW_SYSTEM_SETTINGS` honoured) as the
+    // additive `path` (api-types 0.38.0 `SettingsResponse.path?`; adjudicated §4.6 — `path`, not
+    // `settings_path`).
+    app.get(`${V}/settings`, async () => ({ settings: await adapter.getSettings(), path: settingsFilePath() }));
     app.put(`${V}/settings`, async (req, reply) => {
         const patch = req.body;
         if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {
@@ -3309,6 +3416,26 @@ runtime = {}) {
                     .send({ error: "deliverDefault must be 'pr' or 'none'" });
             }
         }
+        // baseSkillRef / baseSkillPolicy (crew#554 / wicked-core#468): the discipline skill EVERY
+        // governed unit is told to follow, and what a snapshot without it means. Both decide whether
+        // launches carry the directive or are refused at intake, so a typo is a 400, never a silently
+        // dropped key. The name is exported to the engine verbatim: a skill-name shape only.
+        if (Object.hasOwn(patch, 'baseSkillRef')) {
+            const r = patch.baseSkillRef;
+            if (typeof r !== 'string' || !BASE_SKILL_REF_SHAPE.test(r.trim())) {
+                return reply.code(400).send({
+                    error: 'baseSkillRef must be a skill name (lowercase letters, digits, "-", "_", ":", ".", up to 128 chars — e.g. "wicked-garden-governed-worker"), or "" to turn the base skill off',
+                });
+            }
+        }
+        if (Object.hasOwn(patch, 'baseSkillPolicy')) {
+            const p = patch.baseSkillPolicy;
+            if (typeof p !== 'string' || !BASE_SKILL_POLICIES.has(p)) {
+                return reply.code(400).send({
+                    error: "baseSkillPolicy must be 'require' — the only policy (the engine refuses launches at intake until the published snapshot holds the base skill); 'warn' was deleted in crew 0.7.35: it ran seats UNGROUNDED. Set baseSkillRef \"\" to turn the base skill off explicitly",
+                });
+            }
+        }
         // Skin-owned keys (crew#323): allowed through, but VALIDATED rather than trusted. The
         // daemon does not read these values, so the only two things it can check are the two that
         // can hurt it — a value it cannot persist, and a value big enough to bloat settings.json.
@@ -3349,6 +3476,8 @@ runtime = {}) {
             'workerStallEscalateAction',
             'workerStallMaxEscalations',
             'deliverDefault',
+            'baseSkillRef',
+            'baseSkillPolicy',
         ];
         const safe = {};
         for (const key of allowed) {
@@ -3374,6 +3503,12 @@ runtime = {}) {
         // WICKED_WORKER_HOME per worker spawn — never cached — so this alone makes the change live
         // at the next spawn: no daemon restart, no engine restart.
         applyWorkerConfigRoot(settings.worker_config_root);
+        // Re-judge and re-export the BASE skill (crew#554) — the engine reads WICKED_BASE_SKILL_REF at
+        // intake, per launch, so this alone makes a changed name or policy live at the next launch.
+        // Only when the patch named either key: an unrelated settings write must not re-log the seam.
+        if (Object.hasOwn(safe, 'baseSkillRef') || Object.hasOwn(safe, 'baseSkillPolicy')) {
+            runtime.skills?.configureBaseSkill(settings);
+        }
         // (No skills re-apply: the skills root is not a setting — skills/runtime.ts, codex round 5.)
         // `changed` names every persisted key, engine and `studio.*` alike; `ignored` (present only
         // when there is one) is where a dropped unknown key stops being invisible.