wicked-crew 0.9.1 → 0.9.3

package/dist/api/routes.js

@@ -8,7 +8,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, GovernanceReplayUnsupportedError, PlanLaunchUnsupportedError, SteeringUnsupportedError, addonSupportsReducedAssurance, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
+import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, GovernanceReplayUnsupportedError, PlanLaunchUnsupportedError, SteeringUnsupportedError, addonSupportsQeOverride, addonSupportsReducedAssurance, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
 import { codeGraphDb, codeGraphErrorStatus, requirementsGraph } from '../core/repoPaths.js';
 import { resolveCursorUnit } from '../core/cursor.js';
 import { detectRefusal } from './gate-cache.js';
@@ -49,18 +49,18 @@ import { registerSkillsRoutes } from './skills.js';
 import { registerMcpRoutes } from './mcp.js';
 import { McpPolicies } from '../mcp/policies.js';
 import { disabledSkillsHealth } from '../skills/runtime.js';
-import { phaseSkillFindings, withPhaseSkillGaps } from '../skills/phase-skill-gaps.js';
+import { withPhaseSkillGaps } from '../skills/phase-skill-gaps.js';
 import { STATE_HOME_BLOCKER_CODE, STATE_HOME_REMEDY, isEngineStateHomeRefusal, stateHomeBlockerBody, } from '../projects/state-home-preflight.js';
 import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE, baseSkillRemedy } from '../skills/base-skill.js';
 import { REQUIRED_GARDEN_VERSION } from '../skills/plugin-source.js';
 import { engineRosterJson, noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
 import { launchAssuranceNotice } from '../core/assurance.js';
-import { QE_ACCEPTANCE, aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcceptanceRefusal, receiptOf, requiresQeAcceptance, unreadableQeAcceptance, } from './delivery-assurance.js';
+import { QE_ACCEPTANCE, QE_PRESETS, aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcceptanceRefusal, receiptOf, qeAcceptanceNotRequired, qeDecisionBypasses, qeDecisionOf, unreadableQeAcceptance, } from './delivery-assurance.js';
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { isHumanOperator } from './watch-routes.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
 import { composeDeliverText, configuredPublicOrigin, extractFollowUps, factsFromRun, reportsFromOutputs, FOLLOW_UPS_MAX, framedDeliverText, runUrlFor, } from '../core/deliver-text.js';
-import { deliverRepoFor, deliverTargetView, isGitHubLogin, readDeliverOriginUrl, resolvePullRequest as resolvePullRequestViaGh, unverifiedTreesFrom, } from '../core/deliver.js';
+import { deliverIdentityFor, deliverRepoFor, deliverTargetView, isGitHubLogin, pushIdentityOf, readDeliverOriginUrl, resolvePullRequest as resolvePullRequestViaGh, unverifiedTreesFrom, } from '../core/deliver.js';
 import { credentialsMissingIn, deliverCredentialsProbe, missingCredentials } from '../core/deliver-credentials.js';
 import { codebaseArchiveUrl } from './codebase-archive.js';
 import { registerInteractiveProxy } from '../interactive/proxy-routes.js';
@@ -411,7 +411,16 @@ export const LaunchSchema = z.object({
      *  "full assurance", the same as omitting it: the launcher never chooses for the caller, and a
      *  full-assurance launch on a one-CLI roster is answered with `assuranceNotice` (`core/assurance.ts`). */
     reducedAssurance: z.boolean().optional(),
-}).strict().refine((b) => b.plan === undefined || b.workflow === undefined, {
+    /** QE-IN-APP-WORKFLOWS (api-types 0.106.0) — the operator's EXPLICIT skip of a required QE
+     *  acceptance, with a reason (labelled on the run, every gate and the delivery), or its explicit
+     *  force (no score waiver). Forwarded only when sent; crew never decides either for the caller,
+     *  and the engine refuses either on a run whose workflow does not require QE acceptance. */
+    skipQeAcceptance: z.object({ reason: z.string().trim().min(1).max(2000) }).strict().optional(),
+    forceQeAcceptance: z.boolean().optional(),
+}).strict().refine((b) => b.skipQeAcceptance === undefined || b.forceQeAcceptance !== true, {
+    message: 'skipQeAcceptance and forceQeAcceptance are mutually exclusive — skip it with a reason, or force it',
+    path: ['forceQeAcceptance'],
+}).refine((b) => b.plan === undefined || b.workflow === undefined, {
     message: 'plan and workflow are mutually exclusive — a launch carries a plan or names a preset, not both',
     path: ['plan'],
 }).refine((b) => b.plan !== undefined || b.deliver !== 'pr' || b.workflow !== undefined, {
@@ -1075,6 +1084,9 @@ runtime = {}) {
             // assurance contract); a one-CLI full-assurance launch answers `assuranceNotice`. A route set
             // that cannot probe the addon reports no capability — never an invented one.
             reducedAssurance: typeof adapter.engineCapabilities === 'function' && addonSupportsReducedAssurance(),
+            // QE-IN-APP-WORKFLOWS: `LaunchRunBody.skipQeAcceptance` / `forceQeAcceptance` reach an addon
+            // that carries the QE decision; never an invented capability.
+            qeAcceptanceOverride: typeof adapter.engineCapabilities === 'function' && addonSupportsQeOverride(),
         };
         // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
         // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
@@ -1091,14 +1103,11 @@ runtime = {}) {
         // `baseSkill.finding` and `/diagnostics.skills.findings[]` (one surface, no new field;
         // `HealthWarning.kind` is open); status stays ok because the daemon serves and studio must load
         // and show it — exactly the state-home blocker's precedent above.
-        // crew#661: a drafting seam that armed WITHOUT its declared skill rides `warnings` as well — its
-        // runs proceed degraded, so "status ok, no warnings" would be the silent answer the issue names.
         const warnings = [
             ...(stateHome === null ? [] : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }))),
             ...(baseSkill?.finding ? [{ kind: baseSkill.finding.kind, severity: baseSkill.finding.severity, message: baseSkill.finding.message }] : []),
             // crew#753: a garden older than the minimum is a blocking finding on the first screen too.
             ...[gardenBlocker()].filter((f) => f !== null),
-            ...phaseSkillFindings(runtime.phaseSkills?.gaps() ?? []),
             // DES-TEAMING-002 T0: the daemon's bus did not open at boot, so the engine was handed none
             // and runs un-teamed. A daemon-level notice (status stays ok: it serves); the per-run
             // `transport:"none"` record lands with P1.
@@ -1160,9 +1169,9 @@ runtime = {}) {
             // The skills seam's last outcome (skills keystone): published / fallback / blocked /
             // config-error, with the `skills.*` findings the ladder produced — the operator's one
             // read-only answer to "why do launches refuse the snapshot".
-            // crew#661: plus every subsystem whose phases ARMED without a declared skill (`phaseSkillGaps`,
-            // one `skills.phase-skill` finding each) — the degraded runs' operator-facing record.
-            skills: withPhaseSkillGaps(runtime.skills?.health() ?? disabledSkillsHealth(), runtime.phaseSkills),
+            // crew#661's `phaseSkillGaps` stays on the wire, always `[]` since crew#935: no seam arms
+            // without its declared skill (the interactive presets fail such a run instead).
+            skills: withPhaseSkillGaps(runtime.skills?.health() ?? disabledSkillsHealth()),
             // Is the governance evidence LANDING (crew#495): the store, the records on it, the dead
             // letters — with a `governance.deadletter` finding the moment the outbox holds one.
             governance,
@@ -1454,7 +1463,8 @@ runtime = {}) {
             return reply.code(500).send({ error: message(err) });
         };
         const worktreeLive = typeof workdir === 'string' && workdir.length > 0 && existsSync(workdir);
-        if (!worktreeLive) {
+        /** The run branch's diff, when the worktree is gone (or went while this request ran). */
+        const fromBranchOr409 = async () => {
             // Wave 6 (F-7R2-013): the engine reaps a completed run's worktree, and the run page went dark
             // (`409 workdir no longer exists`). The run's WORK is not gone — it lives on the `wicked/<id>`
             // branch of the registered repo, and the wave-6 engine records `run_branch` + `base_commit`
@@ -1479,11 +1489,14 @@ runtime = {}) {
                 // Narrowing: a path under the (gone) worktree or under the repo root, made repo-relative.
                 let rel;
                 if (resolved.target !== undefined) {
-                    if (isInsideRoot(root, resolved.target))
-                        rel = relative(root, resolved.target);
-                    else if (typeof workdir === 'string' && workdir.length > 0 && isInsideRoot(workdir, resolved.target)) {
+                    // The worktree first: engine worktrees live UNDER the repo root (`wicked-worktrees/<id>`),
+                    // and a path inside one is worktree-relative on the branch (codex r1).
+                    if (typeof workdir === 'string' && workdir.length > 0 && isInsideRoot(workdir, resolved.target)) {
                         rel = relative(workdir, resolved.target);
                     }
+                    else if (isInsideRoot(root, resolved.target)) {
+                        rel = relative(root, resolved.target);
+                    }
                     else {
                         return reply.code(400).send({
                             error: `\`path\` must be inside the run's worktree or its repository to diff: ${root}`,
@@ -1505,7 +1518,9 @@ runtime = {}) {
             return reply.code(409).send({
                 error: `run ${id}'s workdir no longer exists (${workdir}) and its run branch holds no commits — nothing to diff`,
             });
-        }
+        };
+        if (!worktreeLive)
+            return fromBranchOr409();
         // Narrowing is WORKTREE-scoped: a contained-but-outside-the-worktree path (extra write
         // root / repo root) is a valid FILE read but has no meaning as a diff pathspec — rejected
         // explicitly here rather than handing git a `../`-prefixed pathspec and surfacing its
@@ -1536,6 +1551,11 @@ runtime = {}) {
             return { ...(await worktreeDiff(workdir, rel, rawBase)), source: 'worktree' };
         }
         catch (err) {
+            // The worktree was removed WHILE this request ran (the delivered-worktree sweep, an engine
+            // reap): git's spawn into a vanished cwd fails ENOENT, which is not "git is missing". Serve the
+            // run branch, as for a worktree that was already gone (seen in the 0.9.1 release smoke, S04).
+            if (err.code === 'ENOENT' && !existsSync(workdir))
+                return fromBranchOr409();
             return diffError(err);
         }
     });
@@ -1759,11 +1779,16 @@ runtime = {}) {
         if (b.deliverGate === 'auto') {
             // wicked-core#850 EX-03: a workflow that requires QE acceptance delivers only through the deliver
             // gate, where crew checks the verdict. Unattended delivery would push before anyone could.
+            // QE-IN-APP-WORKFLOWS: an explicit operator skip leaves no verdict to check, so it may. A name
+            // the engine resolves to a built-in preset that requires QE acceptance is judged by that preset
+            // (the engine resolves a preset before any def, so a def of the same name never speaks for it).
             const required = b.workflow !== undefined ? adapter.getWorkflow(b.workflow)?.required_instruments : undefined;
-            if (required?.includes(QE_ACCEPTANCE) === true) {
+            const qeRequired = required?.includes(QE_ACCEPTANCE) === true || (b.workflow !== undefined && QE_PRESETS.has(b.workflow));
+            if (qeRequired && b.skipQeAcceptance === undefined) {
                 return reply.code(400).send({
                     error: `workflow ${b.workflow} requires QE acceptance (required_instruments: qe_acceptance), so it delivers only ` +
-                        'through the deliver gate, where the verdict is checked — deliverGate: "auto" cannot apply to it',
+                        'through the deliver gate, where the verdict is checked — deliverGate: "auto" cannot apply to it ' +
+                        '(unless the launch explicitly skips QE acceptance with a reason: skipQeAcceptance)',
                 });
             }
             input.autoDeliver = true;
@@ -1837,6 +1862,12 @@ runtime = {}) {
         // assurance on anyone's behalf (a one-CLI launch that did not is TOLD so in its answer, below).
         if (b.reducedAssurance === true)
             input.reducedAssurance = true;
+        // QE-IN-APP-WORKFLOWS: the operator's explicit skip (with its reason) or force — forwarded only
+        // when sent, never inferred.
+        if (b.skipQeAcceptance !== undefined)
+            input.skipQeAcceptanceReason = b.skipQeAcceptance.reason;
+        if (b.forceQeAcceptance === true)
+            input.forceQeAcceptance = true;
         // DES-L9 / crew#550 — REVISION: `revisesPr` names an OPEN same-repository pull request whose
         // head branch becomes the run's base (`baseRef`, crew-internal → the engine's
         // `LaunchSpec.base_ref`) and the push target of the composed deliver phase — the PR gains
@@ -1961,6 +1992,9 @@ runtime = {}) {
                 // wicked-core#850: the caller's explicit assurance choice (the engine persists the contract
                 // on the session; this records WHO waived it).
                 ...(b.reducedAssurance !== undefined ? { reducedAssurance: b.reducedAssurance } : {}),
+                // QE-IN-APP-WORKFLOWS: WHO skipped or forced QE acceptance, and why.
+                ...(b.skipQeAcceptance !== undefined ? { skipQeAcceptance: b.skipQeAcceptance } : {}),
+                ...(b.forceQeAcceptance === true ? { forceQeAcceptance: true } : {}),
                 // CREW-UX-3: the trail is the durable record of lineage — the retry index (and a
                 // restarted daemon's hydrate) reads it back from exactly this entry.
                 ...(b.retryOf !== undefined ? { retryOf: b.retryOf } : {}),
@@ -3483,10 +3517,15 @@ runtime = {}) {
         });
     }
     /** EX-03: the run's QE acceptance check when its contract requires `qe_acceptance`; `null` when it
-     *  does not. A read that fails is a refusal naming why, never a pass. */
+     *  does not. A read that fails is a refusal naming why, never a pass. QE-IN-APP-WORKFLOWS: a
+     *  decision the score WAIVED or the operator SKIPPED is satisfied without a ledger read and says
+     *  which, in the decision's words; only `required` reads the ledger. */
     async function qeAcceptanceCheckFor(run) {
-        if (!requiresQeAcceptance(run))
+        const decision = qeDecisionOf(run);
+        if (decision === null)
             return null;
+        if (qeDecisionBypasses(decision))
+            return qeAcceptanceNotRequired(decision);
         try {
             return qeAcceptanceFromView(await acceptanceViewOf(run, { forceDeclared: true }));
         }
@@ -4882,7 +4921,17 @@ runtime = {}) {
             return reply.code(404).send({ error: `Repo ${id} not found` });
         const originUrl = repo.root_path === '' ? null : await readDeliverOriginUrl(repo.root_path);
         // crew#720: the provider credential preflight, so a launch can say "not configured" up front.
-        const credentials = await deliverCredentialsProbe(originUrl, process.env);
+        // crew#940: with a push identity configured, only that account's own gh login counts. Settings
+        // that cannot be read leave it unconfigured (GH_ACCOUNT decides), as at launch.
+        let configured = '';
+        try {
+            configured = deliverIdentityFor(await adapter.getSettings(), id).login;
+        }
+        catch {
+            configured = '';
+        }
+        const identity = pushIdentityOf(configured);
+        const credentials = await deliverCredentialsProbe(originUrl, process.env, undefined, identity);
         return reply.send({ repo: repo.id, ...deliverTargetView(originUrl), credentials });
     });
     app.get(`${V}/repos/:id/git-history`, async (req, reply) => {