wicked-crew 0.8.7 → 0.8.9

package/dist/api/routes.js

@@ -3,6 +3,7 @@ import { PlanSchema, toLaunchPlan } from './plan-schema.js';
 import { z } from 'zod';
 import { listRequirements, getRequirement, patchRequirement } from './requirements.js';
 import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
 import { readFileSync, existsSync } from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { isAbsolute, join, relative, resolve } from 'node:path';
@@ -14,7 +15,7 @@ import { detectRefusal } from './gate-cache.js';
 import { acceptanceRequirementOf, buildAcceptanceView } from '../qe/acceptance.js';
 import { runIdentityOf, wireIdentity } from '../core/run-identity.js';
 import { buildEvidenceBundle, coreUnitId, evidenceFilename } from './evidence.js';
-import { outputUnavailableReason, resolveUnit, unitKeysFor } from './unit-output.js';
+import { attemptUnavailableReason, capturedAttempts, outputUnavailableReason, resolveUnit, storedAttempt, unitKeysFor } from './unit-output.js';
 import { execCapped, ExecOutputTooLarge } from '../core/exec.js';
 import { callEstateTool, EstateMcpError, memoryStoreInfo } from '../core/estate-mcp-client.js';
 import { SeatHealthTracker } from './seat-health.js';
@@ -148,15 +149,28 @@ function message(err) {
  * the caller comparing their JSON against the source, so the unknown keys are named in `error`
  * itself, where a human and a `curl | jq .error` both see it without reading `details`.
  */
-function invalidBody(err, what) {
+export function invalidBody(err, what) {
     const unknown = err.issues.flatMap((i) => (i.code === 'unrecognized_keys' ? i.keys : []));
     const error = unknown.length > 0
         ? `${what}: unknown field${unknown.length > 1 ? 's' : ''} ${unknown
             .map((k) => `\`${k}\``)
             .join(', ')} — this endpoint does not accept ${unknown.length > 1 ? 'them' : 'it'}, and ignoring ${unknown.length > 1 ? 'them' : 'it'} would run a different request than you sent`
-        : what;
+        : namedIssues(what, err.issues);
     return { error, details: err.issues };
 }
+/**
+ * crew#662: a schema rejection that is NOT an unknown key names the field and what was expected —
+ * `Invalid request body: \`revisesPr\` — Expected number, received boolean`. The bare
+ * "Invalid request body" sent a caller off to misdiagnose the contract. Up to three issues are
+ * spelled out; the rest are counted (all of them stay in `details`).
+ */
+function namedIssues(what, issues) {
+    if (issues.length === 0)
+        return what;
+    const shown = issues.slice(0, 3).map((i) => (i.path.length > 0 ? `\`${i.path.join('.')}\` — ${i.message}` : i.message));
+    const more = issues.length > 3 ? `; and ${issues.length - 3} more (see details)` : '';
+    return `${what}: ${shown.join('; ')}${more}`;
+}
 /** First value of a possibly-repeated query param, WITHOUT trimming — `''` is PRESERVED because a
  *  blank `scope`/`scope_prefix` is meaningful to estate (root / whole-subtree), unlike an omitted
  *  one. Returns undefined only when the param is absent. */
@@ -313,6 +327,11 @@ const OnboardBodySchema = z
 // compile time, that every body the published contract (`wicked-crew-api-types`) lets a client
 // send is a body these schemas accept — the request-direction half of the drift guard (task #84).
 export { PlanSchema };
+/** crew#825: the issue refs a launch leaves out of the linked-issue expansion. */
+const ExcludeLinkedIssuesSchema = z
+    .array(z.string().regex(/^\s*(?:\d+|(?:(?:[\w.-]+\/)?[\w.-]+)?#\d+)\s*$/, 'an issue ref: 541, #541, repo#541 or owner/repo#541'))
+    .max(50)
+    .optional();
 export const LaunchSchema = z.object({
     problem: z.string().min(1),
     sessionId: z.string().min(1).optional(),
@@ -375,6 +394,11 @@ export const LaunchSchema = z.object({
      *  launch (e.g. a CI job name or a studio tab id). Persisted on the `run.launched` audit entry
      *  (`detail.actor`) and served on the run DTO; absent = caller omitted it. */
     actor: z.string().min(1).max(256).optional(),
+    /** crew#825 (api-types additive) — issue refs the intent names that the daemon must NOT read and
+     *  append (`541`, `#541`, `repo#541`, `owner/repo#541`): a reference in passing is not a request to inline
+     *  the issue. They are answered as `linkedIssues[].excluded`. Send only when
+     *  `GET /health.capabilities.linkedIssuesExclude === true`. */
+    excludeLinkedIssues: ExcludeLinkedIssuesSchema,
 }).strict().refine((b) => b.plan === undefined || b.workflow === undefined, {
     message: 'plan and workflow are mutually exclusive — a launch carries a plan or names a preset, not both',
     path: ['plan'],
@@ -461,6 +485,11 @@ export const OpenTerminalSchema = z.object({
     // default; the ungoverned operator shell must opt in explicitly).
     governed: z.boolean().optional(),
 }).strict();
+/** `POST /seats/:cli/login|logout` body (crew#615): the PTY size, both optional. */
+export const SeatSessionSchema = z.object({
+    cols: z.number().int().positive().optional(),
+    rows: z.number().int().positive().optional(),
+}).strict();
 const ResizeTerminalSchema = z.object({
     cols: z.number().int().positive(),
     rows: z.number().int().positive(),
@@ -764,7 +793,8 @@ runtime = {}) {
     /** DES-L9: PR number → head branch, through `gh pr view` unless the runtime injected an answerer. */
     const resolvePullRequest = runtime.resolvePullRequest ?? resolvePullRequestViaGh;
     /** crew#627: the intent's linked issues, read under the daemon's identity at launch. */
-    const readLinkedIssues = runtime.resolveLinkedIssues ?? ((p, root, ref) => resolveLinkedIssues(p, root, ref));
+    const readLinkedIssues = runtime.resolveLinkedIssues ??
+        ((p, root, ref, exclude) => resolveLinkedIssues(p, root, ref, undefined, exclude));
     /** crew#550 P-7: the follow-ups the run's evaluator units flagged, read from their captured output.
      *  A unit whose output cannot be read contributes nothing (the section then says what WAS read);
      *  an adapter without transcripts (a directly-driven route set) reads as "not read" — absent. */
@@ -1000,6 +1030,8 @@ runtime = {}) {
                 : { deliverGate: false, revisesPr: false, chatIdOnLaunch: false, seatChipOnCreate: false }),
             // C1: `AgentSession.chat_id` is served from the daemon's own launch index, whatever the engine.
             runChatId: true,
+            // crew#825: `LaunchRunBody.excludeLinkedIssues` + `POST /linked-issues/preview` are served.
+            linkedIssuesExclude: true,
             // ASK-C1 (DES-ASK-TEAM-CHAT-001 §5.1): an ask starts a path — the whole contract is the
             // pinned core-ts floor the adapter reports; an older studio reads ABSENT as "every helper
             // answers", a newer one renders the one PA voice.
@@ -1586,6 +1618,33 @@ runtime = {}) {
         const projectAttachError = await recordOnboardingLaunch(req, runId, repo.id, body.data);
         return reply.code(201).send({ runId, ...(projectAttachError !== undefined ? { projectAttachError } : {}) });
     });
+    // crew#825: what a workflow launch WOULD append — the same reading `POST /runs` does, before Send,
+    // so the composer shows "N linked issues will be appended (≈K chars)" with a way to leave one out
+    // (`excludeLinkedIssues`). Read-only: nothing launches, nothing is stored.
+    const LinkedIssuesPreviewSchema = z
+        .object({
+        problem: z.string().min(1),
+        repoRef: z.string().min(1).optional(),
+        excludeLinkedIssues: ExcludeLinkedIssuesSchema,
+    })
+        .strict();
+    app.post(`${V}/linked-issues/preview`, { config: { manifest: { requestType: 'LinkedIssuesPreviewBody', responseType: 'LinkedIssuesPreviewResponse', statusCodes: [200, 400] } } }, async (req, reply) => {
+        const parsed = LinkedIssuesPreviewSchema.safeParse(req.body);
+        if (!parsed.success)
+            return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
+        const b = parsed.data;
+        // The launch's own best-effort contract (codex on this PR): a resolver fault launches on the
+        // intent alone, so the preview answers "nothing appended" and says why — never a 500.
+        try {
+            const root = b.repoRef !== undefined ? await repoRootOf(b.repoRef) : undefined;
+            const linked = await readLinkedIssues(b.problem, root, b.repoRef, b.excludeLinkedIssues ?? []);
+            return { issues: linked.issues, appendedChars: linked.block === null ? 0 : linked.block.length + 2 };
+        }
+        catch (err) {
+            req.log.warn(`linked-issue preview failed; a launch would run on the intent alone: ${message(err)}`);
+            return { issues: [], appendedChars: 0, error: `linked issues could not be read: ${message(err)} — a launch now runs on the intent alone` };
+        }
+    });
     // Launch a run (replaces POST /sessions). `clisJson` defaults to the roster;
     // `sessionId` is minted if the client omits it.
     app.post(`${V}/runs`, {
@@ -1798,11 +1857,12 @@ runtime = {}) {
             // fault (the repo list unreadable, say) launches the run on its intent alone and is logged.
             try {
                 const root = b.repoRef !== undefined ? await repoRootOf(b.repoRef) : undefined;
-                const linked = await readLinkedIssues(b.problem, root, b.repoRef);
-                if (linked.block !== null) {
+                const linked = await readLinkedIssues(b.problem, root, b.repoRef, b.excludeLinkedIssues ?? []);
+                if (linked.block !== null)
                     input.problem = `${b.problem.trimEnd()}\n\n${linked.block}`;
+                // crew#825: an all-excluded intent appends nothing but still answers what it left out.
+                if (linked.issues.length > 0)
                     linkedIssues = linked.issues;
-                }
             }
             catch (err) {
                 req.log.warn(`linked-issue resolution failed; launching on the intent alone: ${message(err)}`);
@@ -1899,7 +1959,11 @@ runtime = {}) {
             // planner (one unit, the brief verbatim). Say so in the answer, with how to get work done,
             // instead of letting it pass for a launch of real work.
             const freeText = input.workflow === undefined && input.plan === undefined ? { freeText: { notice: FREE_TEXT_NOTICE } } : {};
-            return reply.code(201).send({ runId, ...(linkedIssues !== undefined ? { linkedIssues } : {}), ...freeText });
+            // crew#874: the run uses the PUBLISHED generation; when the installed garden is not the one it
+            // was built from, the launch answer says so (a recorded proof can disclose which garden ran).
+            const skillsAhead = runtime.skills?.installedAheadFinding({ fresh: true }) ?? null; // fresh: an upgrade just before Send counts (codex r1)
+            const skillsWarning = skillsAhead === null ? {} : { skillsWarning: { kind: skillsAhead.kind, severity: skillsAhead.severity, message: skillsAhead.message } };
+            return reply.code(201).send({ runId, ...(linkedIssues !== undefined ? { linkedIssues } : {}), ...freeText, ...skillsWarning });
         }
         catch (err) {
             const msg = message(err);
@@ -3009,7 +3073,9 @@ runtime = {}) {
                 refused: chatScopes.refusedOf(id) ?? null,
                 ...(askPaths.view(id) !== undefined ? { path: askPaths.view(id) } : {}),
                 // DES-L5 (D-13): the transcript so far, append order — `[]` before the first persisted
-                // turn; the file goes with the chat on `chatClosed`, so a reclaimed id answers `[]` too.
+                // turn. The file goes with the chat on `chatClosed` UNLESS a run promoted from it is still
+                // live (crew#619 retention — dropped when that run terminals), so a reclaimed id answers
+                // `[]` only once no promoted run holds the old file.
                 ...(chatTranscripts !== undefined ? { messages: chatTranscripts.read(id) } : {}),
             };
         }
@@ -3085,12 +3151,48 @@ runtime = {}) {
                 units: unitKeysFor(run),
             });
         }
+        const rawAttempt = req.query.attempt;
+        const attemptArg = Array.isArray(rawAttempt) ? rawAttempt[0] : rawAttempt;
+        const wanted = attemptArg === undefined || attemptArg === '' ? undefined : /^\d{1,9}$/.test(attemptArg) ? Number(attemptArg) : NaN;
+        if (wanted !== undefined && !Number.isSafeInteger(wanted)) {
+            return reply.code(400).send({ error: '`attempt` must be a non-negative integer' });
+        }
         // Keyed off the unit RECORD (the same derivation the evidence bundle uses), not off the
         // caller's path segment — the two disagreeing is what made a resolvable unit unreadable.
         const output = await adapter.workOutput(coreUnitId(id, unit));
-        if (output !== null)
-            return reply.send({ output });
-        return reply.send({ output: null, outputUnavailable: outputUnavailableReason(unit) });
+        // crew#848: which attempt those bytes are. The engine keeps one transcript per unit (the last
+        // attempt that folded ok); the durable log has one `unitOutputCaptured` per attempt.
+        const events = typeof adapter.runEvents === 'function' ? await adapter.runEvents(id).catch(() => null) : null;
+        const attempts = capturedAttempts((events ?? []), unit.ord);
+        const served = output !== null ? storedAttempt(attempts, output) : null;
+        const latest = attempts[attempts.length - 1];
+        const meta = {
+            ...(served !== null ? { attempt: served } : {}),
+            ...(latest !== undefined ? { latestAttempt: latest.attempt } : {}),
+            ...(events !== null ? { attempts } : {}),
+        };
+        if (served !== null)
+            void reply.header('x-wicked-unit-attempt', String(served));
+        if (wanted !== undefined) {
+            const rec = attempts.find((a) => a.attempt === wanted);
+            if (rec === undefined) {
+                return reply.code(404).send({
+                    error: `Unit ${unit.ord} of run ${id} has no attempt ${wanted} on record`,
+                    attempts: attempts.map((a) => a.attempt),
+                });
+            }
+            if (output !== null && served === wanted)
+                return reply.send({ output, ...meta });
+            return reply.send({ output: null, ...meta, attempt: wanted, outputUnavailable: attemptUnavailableReason(unit, rec, served) });
+        }
+        if (output !== null) {
+            // A later attempt that left no transcript: the stored bytes are SUPERSEDED — say so, and why.
+            if (served !== null && latest !== undefined && latest.attempt > served) {
+                return reply.send({ output, ...meta, superseded: true, latestUnavailable: attemptUnavailableReason(unit, latest, served) });
+            }
+            return reply.send({ output, ...meta });
+        }
+        return reply.send({ output: null, ...meta, outputUnavailable: outputUnavailableReason(unit) });
     });
     // DC-S7 (§4.6): what the seats considered, set aside and cited for one chat turn or one unit
     // attempt. Operator+ (the rules are the project's doctrine). A cited rule is "unchecked", never
@@ -4617,6 +4719,57 @@ runtime = {}) {
             return reply.code(400).send({ error: message(err) });
         }
     });
+    // crew#615: sign a seat in or out without the client composing the command. The daemon runs the
+    // ENGINE's own `login_invocation` / `logout_invocation` for that seat (already prefixed with the
+    // seat's configuration root; the daemon never synthesizes one) in a governed PTY, and answers
+    // the terminal id — the device URL or the CLI's prompt streams over `/ws/terminals/:id`. The
+    // seat's credential probe is re-run when the terminal exits, so the roster's `signed_in` follows
+    // the outcome instead of waiting out the probe's TTL.
+    for (const action of ['login', 'logout']) {
+        app.post(`${V}/seats/:cli/${action}`, { config: { manifest: { requestType: 'SeatSessionBody', responseType: 'SeatSessionResponse', statusCodes: [201, 400, 404] } } }, async (req, reply) => {
+            const { cli } = req.params;
+            const parsed = SeatSessionSchema.safeParse(req.body ?? {});
+            if (!parsed.success) {
+                return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
+            }
+            const seat = rosterWithStanding().find((s) => s.key === cli);
+            if (seat === undefined)
+                return reply.code(404).send({ error: `unknown seat: ${cli}` });
+            const field = action === 'login' ? seat.login_invocation : seat.logout_invocation;
+            const invocation = typeof field === 'string' ? field.trim() : '';
+            if (invocation === '') {
+                return reply.code(404).send({
+                    error: `seat ${cli} has no ${action} command: the engine roster carries no ${action}_invocation for it (its CLI documents none)`,
+                });
+            }
+            // Subscribe BEFORE the spawn: a short command can exit before `openTerminal` resolves, and
+            // its exit must still re-probe and release the listener (codex review).
+            let termId = null;
+            const exitedEarly = new Set();
+            const done = () => {
+                stop();
+                rosterWithStanding.reprobe?.(cli);
+            };
+            const stop = adapter.onEvent((event) => {
+                if (event.type !== 'terminalExited' || typeof event.id !== 'string')
+                    return;
+                if (termId === null)
+                    exitedEarly.add(event.id);
+                else if (event.id === termId)
+                    done();
+            });
+            try {
+                termId = await adapter.openTerminal(homedir(), ['sh', '-lc', invocation], parsed.data.cols ?? 100, parsed.data.rows ?? 30, true);
+            }
+            catch (err) {
+                stop();
+                return reply.code(400).send({ error: message(err) });
+            }
+            if (exitedEarly.has(termId))
+                done();
+            return reply.code(201).send({ terminalId: termId, cli, action });
+        });
+    }
     // Resize a live terminal's PTY.
     app.post(`${V}/terminals/:id/resize`, async (req, reply) => {
         const { id } = req.params;