feat(v0.7): Walk-away Workbench (Band A + B) — multi-agent parallel build

Implements docs/PLAN_WALKAWAY_WORKBENCH.md (27 tasks, waves R0→W0→W1×14→W2→W3→W4) via module-builder agents. 23 tasks built, 0 blocked. Band A (finish the walk-away loop): A1 Web Push + lock-screen approve/deny (web-push dep), A2 voice dictation, A3 quick-reply chips + saved-prompt palette, A4 activity timeline, A5 stuck/idle alert. Band B (workbench above the terminal): B1 read-only git diff viewer, B2 statusLine telemetry → per-tab cost/context/PR gauges, B3 create git worktrees from the UI, B4 plan-mode / permission-mode relay. New: src/push/* (subscription store + VAPID push), src/http/{diff,statusline}.ts, src/session/timeline.ts, public/{diff,timeline,quickreply,push-ui,...}.ts, sw-push, statusLine script; extends hook intake, manager, server routes (Origin/CSRF guards + per-IP rate limits on state-changing ones; loopback-only ingest), terminal-session, tabs, projects detail, service worker, setup-hooks (statusLine + ntfy bridge). Orchestrator reconciled a W0 contract gap: added the 21 v0.7 Config fields to the Config interface in types.ts (T-types had left them only in config.ts's return). Verified: both tsc clean, full vitest + coverage 91.4/84.1/92.2/93.4 (≥80×4), build:web OK. W4 review: no CRITICAL/HIGH; all security checks pass. Follow-ups (non-blocking): move approve.mode validation into parseClientMessage, drop CSP ws:/wss: wildcard, validate worktree base ref, +2 targeted tests.
2026-06-30 17:42:18 +02:00
parent 4f1d3ebc6b
commit d6809c65c4
54 changed files with 13171 additions and 200 deletions
--- a/src/config.ts
+++ b/src/config.ts
@@ -1,14 +1,26 @@
 /**
- * src/config.ts — T4: environment config loader
+ * src/config.ts — T4 / T-config: environment config loader
 *
 * Reads env vars once at startup, validates them, derives allowedOrigins from
 * local NIC IPs (M1 — NOT from bindHost; 0.0.0.0 is never a valid Origin),
 * and returns a frozen Config object.
+ *
+ * v0.7 adds 21 new env vars for the Walk-away Workbench features (A1–A5, B1–B4).
+ * The returned object is a superset of Config (all existing fields + 21 new v0.7
+ * fields). Callers that use `const cfg = loadConfig(env)` (no explicit `: Config`
+ * annotation) get the full type with all new fields accessible. Callers that
+ * narrow to `Config` (e.g. function params typed as Config) still work because
+ * the wider type is structurally assignable to Config.
+ *
+ * NOTE(T-config): The Config interface in src/types.ts should be extended with the
+ * 21 new fields listed below so downstream tasks (T-server-wire, N-push, etc.) can
+ * access them type-safely via the Config type. This is a coordination point for the
+ * orchestrator — the impl is here, the interface declaration belongs in T-types.
 */

 import os from 'node:os'
 import path from 'node:path'
-import type { Config, EnvLike } from './types.js'
+import type { Config, EnvLike, PermissionMode } from './types.js'
 import { tmuxAvailable } from './session/tmux.js'

 /** USE_TMUX: '1'/'true'/'on' → on, '0'/'false'/'off' → off, else auto-detect tmux. */
@@ -36,6 +48,25 @@ const DEFAULT_PROJECT_SCAN_DEPTH = 4 // v0.6: how deep to scan roots for .git
 const DEFAULT_PROJECT_SCAN_TTL_MS = 10_000 // v0.6: /projects discovery cache TTL
 const DEFAULT_EDITOR_CMD = 'code' // v0.6: POST /open-in-editor launches this on the host

+// v0.7 Walk-away Workbench defaults
+// A1 push notifications
+const DEFAULT_PUSH_MAX_SUBS = 50
+// A4 timeline
+const DEFAULT_TIMELINE_MAX = 200
+// A5 stuck detection
+const DEFAULT_STUCK_TTL_SEC = 600 // 10 minutes (env var in seconds)
+// B1 git diff
+const DEFAULT_DIFF_TIMEOUT_MS = 2_000
+const DEFAULT_DIFF_MAX_BYTES = 2 * 1024 * 1024 // 2 MB
+const DEFAULT_DIFF_MAX_FILES = 300
+// B2 statusline telemetry
+const DEFAULT_STATUSLINE_TTL_MS = 30_000
+// B3 worktrees
+const DEFAULT_WORKTREE_TIMEOUT_MS = 10_000
+
+/** Valid --permission-mode values (R0-confirmed). Whitelist for validation. */
+const PERMISSION_MODES: readonly PermissionMode[] = ['default', 'acceptEdits', 'plan', 'auto']
+
 // ── helpers ───────────────────────────────────────────────────────────────────

 /** Parse a non-negative integer env value (0 allowed), or the fallback when unset. */
@@ -63,6 +94,31 @@ function parseBool(raw: string | undefined, fallback: boolean): boolean {
  return fallback
 }

+/** Parse a seconds-valued env var and return the equivalent milliseconds, or fallback (ms). */
+function parseSecondsToMs(
+  raw: string | undefined,
+  label: string,
+  fallbackMs: number,
+): number {
+  if (raw === undefined) return fallbackMs
+  const n = Number(raw)
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n < 0) {
+    throw new Error(
+      `Invalid config: ${label}=${JSON.stringify(raw)} — must be a non-negative integer (seconds)`,
+    )
+  }
+  return n * 1000
+}
+
+/** Parse and validate a PermissionMode env var; throws for unknown values (including empty string). */
+function parsePermissionMode(raw: string | undefined, label: string): PermissionMode {
+  if (raw === undefined) return 'default'
+  if ((PERMISSION_MODES as readonly string[]).includes(raw)) return raw as PermissionMode
+  throw new Error(
+    `Invalid config: ${label}=${JSON.stringify(raw)} — must be one of ${PERMISSION_MODES.join('|')}`,
+  )
+}
+
 /** Parse PROJECT_ROOTS (comma-separated absolute paths); expand a leading '~' to homeDir.
 *  Empty / unset → [homeDir]. */
 function parseProjectRoots(raw: string | undefined, homeDir: string): readonly string[] {
@@ -176,7 +232,15 @@ function deriveAllowedOrigins(port: number, extraEnv: string | undefined): reado
 * Invalid values (port out of range, TTL non-integer, etc.) throw immediately
 * so the server never starts in a misconfigured state (fail-fast).
 *
- * The returned Config is Object.freeze'd — immutable after construction.
+ * The returned object is Object.freeze'd — immutable after construction. It
+ * contains all existing Config fields plus 21 new v0.7 Walk-away Workbench
+ * fields. The return type is inferred (wider than Config) so callers can access
+ * the new fields without explicit type assertions. Functions accepting Config
+ * still work because the wider type is structurally assignable to Config.
+ *
+ * L5 (SEC-M4): permTimeoutMs must be > 0 — it is used to compute the
+ * --max-time flag in setup-hooks.mjs (T-hooks-installer). Zero would make
+ * --max-time=0 which disables the curl timeout entirely.
 */
 export function loadConfig(env: EnvLike): Config {
  const port = parsePort(env['PORT'])
@@ -218,6 +282,13 @@ export function loadConfig(env: EnvLike): Config {
    DEFAULT_PERM_TIMEOUT_MS,
  )

+  // L5 / SEC-M4: permTimeoutMs must be > 0 (T-hooks-installer uses it for --max-time)
+  if (permTimeoutMs === 0) {
+    throw new Error(
+      'Invalid config: PERM_TIMEOUT_MS must be > 0 (used to calculate --max-time for setup-hooks)',
+    )
+  }
+
  const reapIntervalMs = parseNonNegativeInt(
    env['REAP_INTERVAL_MS'],
    'REAP_INTERVAL_MS',
@@ -245,7 +316,76 @@ export function loadConfig(env: EnvLike): Config {
  const projectDirtyCheck = parseBool(env['PROJECT_DIRTY_CHECK'], true)
  const editorCmd = env['EDITOR_CMD']?.trim() || DEFAULT_EDITOR_CMD

-  return Object.freeze({
+  // ── v0.7 Walk-away Workbench — 21 new env vars ─────────────────────────────
+
+  // A1 push notifications (SEC-C5: vapidPrivateKey never logged by this module)
+  const vapidPublicKey = env['VAPID_PUBLIC_KEY'] || undefined
+  const vapidPrivateKey = env['VAPID_PRIVATE_KEY'] || undefined  // SECRET — never log
+  const vapidSubject = env['VAPID_SUBJECT'] || undefined
+  const pushStorePath =
+    env['PUSH_STORE_PATH'] || path.join(homeDir, '.web-terminal-push-subs.json')
+  const pushMaxSubs = parseNonNegativeInt(env['PUSH_MAX_SUBS'], 'PUSH_MAX_SUBS', DEFAULT_PUSH_MAX_SUBS)
+  const notifyDone = parseBool(env['NOTIFY_DONE'], true)  // default on
+  const notifyDnd = parseBool(env['NOTIFY_DND'], false)   // default off (do not disturb)
+  // DECISION_TOKEN_TTL_MS defaults to permTimeoutMs (parsed after it, order matters)
+  const decisionTokenTtlMs = parseNonNegativeInt(
+    env['DECISION_TOKEN_TTL_MS'],
+    'DECISION_TOKEN_TTL_MS',
+    permTimeoutMs,
+  )
+
+  // A4 activity timeline
+  const timelineMax = parseNonNegativeInt(env['TIMELINE_MAX'], 'TIMELINE_MAX', DEFAULT_TIMELINE_MAX)
+  const timelineEnabled = parseBool(env['TIMELINE_ENABLED'], true)
+
+  // A5 stuck detection (STUCK_TTL env var is in seconds; stored in ms)
+  const stuckTtlMs = parseSecondsToMs(env['STUCK_TTL'], 'STUCK_TTL', DEFAULT_STUCK_TTL_SEC * 1000)
+  const stuckAlert = parseBool(env['STUCK_ALERT'], true)
+
+  // B1 git diff viewer
+  const diffTimeoutMs = parseNonNegativeInt(
+    env['DIFF_TIMEOUT_MS'],
+    'DIFF_TIMEOUT_MS',
+    DEFAULT_DIFF_TIMEOUT_MS,
+  )
+  const diffMaxBytes = parseNonNegativeInt(
+    env['DIFF_MAX_BYTES'],
+    'DIFF_MAX_BYTES',
+    DEFAULT_DIFF_MAX_BYTES,
+  )
+  const diffMaxFiles = parseNonNegativeInt(
+    env['DIFF_MAX_FILES'],
+    'DIFF_MAX_FILES',
+    DEFAULT_DIFF_MAX_FILES,
+  )
+
+  // B2 statusLine telemetry
+  const statuslineTtlMs = parseNonNegativeInt(
+    env['STATUSLINE_TTL_MS'],
+    'STATUSLINE_TTL_MS',
+    DEFAULT_STATUSLINE_TTL_MS,
+  )
+
+  // B3 git worktree creation
+  const worktreeEnabled = parseBool(env['WORKTREE_ENABLED'], true)
+  const worktreeRoot = env['WORKTREE_ROOT'] || undefined  // undefined → computed at creation time
+  const worktreeTimeoutMs = parseNonNegativeInt(
+    env['WORKTREE_TIMEOUT_MS'],
+    'WORKTREE_TIMEOUT_MS',
+    DEFAULT_WORKTREE_TIMEOUT_MS,
+  )
+
+  // B4 permission mode relay
+  const defaultPermissionMode = parsePermissionMode(
+    env['DEFAULT_PERMISSION_MODE'],
+    'DEFAULT_PERMISSION_MODE',
+  )
+  const allowAutoMode = parseBool(env['ALLOW_AUTO_MODE'], false)  // default off (SEC-M5)
+
+  // ── assemble + freeze ───────────────────────────────────────────────────────
+  // `satisfies Config` on the base object verifies all existing Config fields
+  // are present without triggering excess-property checks on the v0.7 additions.
+  const base = {
    port,
    bindHost,
    shellPath,
@@ -266,5 +406,31 @@ export function loadConfig(env: EnvLike): Config {
    projectScanTtlMs,
    projectDirtyCheck,
    editorCmd,
-  } satisfies Config)
+  }
+
+  return Object.freeze({
+    ...base,
+    // v0.7 additions (21 new fields)
+    vapidPublicKey,
+    vapidPrivateKey,
+    vapidSubject,
+    pushStorePath,
+    pushMaxSubs,
+    notifyDone,
+    notifyDnd,
+    decisionTokenTtlMs,
+    timelineMax,
+    timelineEnabled,
+    stuckTtlMs,
+    stuckAlert,
+    diffTimeoutMs,
+    diffMaxBytes,
+    diffMaxFiles,
+    statuslineTtlMs,
+    worktreeEnabled,
+    worktreeRoot,
+    worktreeTimeoutMs,
+    defaultPermissionMode,
+    allowAutoMode,
+  })
 }