Project threads

Changes: 4 file(s), +226/-22

Implemented and committed MCP context reductions in `b617383`.

- Added `minimal`, `summary`, and backward-compatible `full` job responses.
- Added exact field selection for `status`.
- Added pagination for active jobs and projects.
- Added bounded, chunked `job_output` reads.
- Documented audit findings, examples, migration notes, and recommendations.
- Expanded MCP tests for compact responses, pagination, projections, chunking, and legacy behavior.
- Verified with `npm run check`: 68 tests passed across 16 files.
- Worktree is clean.

Changes: 1 file(s), +30/-0

Created and committed `docs/welplan-seo-audit.md`.

Key findings:
- Public port 8080 could expose indexable private job content.
- No authentication, `noindex`, `X-Robots-Tag`, robots policy, or sitemap.
- Project query variants create duplicate crawlable URLs.
- Session links remain crawlable.
- SSR output is immediately indexable despite `Cache-Control: no-store`.
- This worktree contains Bro, not the Welplan website; the report clearly scopes the limitation and provides a concrete Welplan follow-up checklist.

Verification: `npm run check` passed, including 16 test files and 68 tests.

Commit: `ce36e1b Document Welplan SEO audit scope`

Changes: 10 file(s), +219/-28

Implemented and committed secret-safety protections in `f6f1b90`.

- Detects explicit credential disclosure requests.
- Redacts common tokens, keys, passwords, cookies, headers, URLs, and private keys.
- Sanitizes generated responses, progress, errors, operational details, Discord output, and Web API/UI content.
- Hides links to unredacted tools for sensitive requests.
- Added pattern, borderline-case, Web, Discord, and notification tests.
- Verification: `npm run check` passed, 68 tests passed.
- Worktree is clean.

Changes: 2 file(s), +92/-4

Implemented and committed queued content visibility for web threads.

- Added typed `queuedContent` data to `/api/projects`.
- Rendered pending instructions in a distinct queued section with badges, ordering, timestamps, and attachment metadata.
- Excluded completed instructions and sensitive attachment payloads.
- Verified with `npm run check`: 60 tests passed, TypeScript build passed.
- Commit: `211d69b Show queued content in Web threads`

Changes: 13 file(s), +1482/-29

Implemented and committed `a8cf3cf` (`Expose job actions over MCP`).

- Added unauthenticated Streamable HTTP MCP on dedicated `MCP_PORT`, default `8082`.
- Exposed all actions: `run`, `global`, `instruction`, `clone`, `projects`, `status`, `cancel`, `history`, and `help`.
- Integrated MCP jobs with the existing coordinator, SQLite store, polling, worktrees, and cancellation.
- Updated Docker exposure, health checks, environment examples, and documentation.
- Verified TypeScript build, all 60 tests, shell syntax, and dependency audit.
- Working tree is clean.

Changes: 19 file(s), +223/-12

Implemented and committed `d65c94a` (`Add Discord operational details tool`).

- Added global OpenCode `operational_details` tool.
- Sends separate post-completion Discord operational instructions.
- Persists details and notification state with retry support.
- Documented shared persistent directory configuration.
- Verified with `npm run check`: 59 tests passed.
- Worktree is clean and commit includes the required trailer.

Changes: 6 file(s), +5/-44

Removed the OpenCode goal plugin, its persisted-config injection, goal-specific prompts, tests, and documentation.

- Verification: `npm run check` passed, 54 tests across 13 files.
- Config and overlay confirmed plugin-free.
- Commit: `9e4ebb8 Remove OpenCode goal plugin`
- Worktree is clean.

Restart OpenCode for the configuration change to take effect.

Changes: 10 file(s), +73/-9

Implemented and committed support for hiding or showing a specific history entry by job ID.

- Added durable per-job visibility with database migration.
- Updated Discord intent routing and responses.
- Filtered hidden entries from Web UI and API only.
- Preserved global history visibility behavior.
- `npm run check`: build passed, 55 tests passed.
- Commit: `ded6692 Hide individual history entries`
- Worktree is clean.

Changes: 4 file(s), +61/-14

Fixed attachment forwarding by downloading Discord files and encoding them as OpenCode-compatible base64 data URLs.

- Added MIME normalization and download error handling.
- Confirmed live behavior: remote URL returned 400; data URL returned 200.
- `npm run check`: 54 tests passed.
- Committed as `69bcd10` with the required trailer.
- Worktree is clean.

Changes: 9 file(s), +116/-11

Implemented and committed natural-language Web UI history controls.

- Users can ask Discord to hide or show job history.
- Preference persists across restarts.
- Active jobs remain visible; terminal jobs are hidden.
- HTML and API responses honor the setting.
- `npm run check`: 53 tests passed.
- Commit: `79268b4`

Changes: 9 file(s), +201/-27

Implemented and committed Discord attachment forwarding.

- Sends attachments to OpenCode routing, tasks, instructions, and continuations.
- Persists attachment metadata across queues and restarts.
- Supports attachment-only replies.
- Added SQLite migration and tests.
- Verification: `npm run check`, all 52 tests passed.
- Commit: `270d0ff`

[REDACTED: request for sensitive information]

Changes: 3 file(s), +28/-10

Implemented job-finished notifications as replies to the completed/failed Discord status card.

- Preserved requester mentions without implicit reply pings.
- Added safe fallback when the status card is missing.
- Passed TypeScript build and all 51 tests.
- Committed as `20811d2` with the required trailer.
- Worktree is clean.

Changes: 6 file(s), +44/-1

Implemented and committed OpenCode goal mode support.

- Added pinned goal plugin for fresh and persisted container configs.
- Integrated goal creation, continuation, instruction updates, and evidence-based completion into Discord jobs.
- Updated documentation and tests.
- Verified TypeScript build and all 50 tests pass.
- Commit: `510eee2 Add OpenCode goal mode`
- Worktree is clean.

Changes: 10 file(s), +158/-73

Implemented and committed `fb4d5f4` (`Run global work in one job`).

- Global requests now create one serialized job without a Git worktree.
- Global jobs run from the bot data directory with project-repository restrictions.
- Added persisted scope migration, dedicated sessions, UI updates, and tests.
- Verification: TypeScript build and all 49 tests passed.
- Worktree is clean and commit includes the required trailer.

Changes: 5 file(s), +70/-3

Implemented and committed global project jobs.

- Global requests fan out into isolated jobs for every registered project.
- Each project gets an independent Discord status card and worktree.
- Added routing validation, empty-registry handling, help text, tests, and documentation.
- Verified with `npm run check`: 12 test files, 48 tests passed.
- Commit: `05e2e3d Add global project jobs`
- Worktree is clean.

Changes: 2 file(s), +26/-0

Documented the pnpm worktree assessment in `docs/pnpm-worktree-assessment.md` and linked it from `README.md`.

Key result:
- pnpm was 20–45% faster in sampled installs.
- Three worktrees used about 109 MiB with pnpm versus 309 MiB with npm.
- Current `prepareJobWorktree` itself would not improve because it does not install dependencies.

Verification:
- TypeScript build passed.
- All 47 tests passed under npm and pnpm layouts.
- Commit created: `816d5d0 Document pnpm worktree assessment`
- Worktree is clean.

Changes: 2 file(s), +25/-4

Implemented and committed running embed progress improvements:

- Shows multiple parallel `In progress` items.
- Shows pending `Queued items`.
- Preserves completed-step totals and compact Discord formatting.
- Added lifecycle test coverage.
- Verified with `npm run check`: 46 tests passed.
- Commit: `4413ccd Show parallel todo progress`
- Worktree is clean.

Changes: 4 file(s), +24/-12

Implemented and committed as `944b09f`:

- Sets `/tmp/opencode` and mounted `/var/run/docker.sock` to `0777` at startup.
- Adds `vim`, `wget`, `jq`, and `ripgrep` to the runtime image.
- Updated tests and documentation.
- Verified build, all 47 tests, shell syntax, package availability, and clean worktree.

Changes: 18 file(s), +756/-89

Implemented parallel Git worktree execution with safe, linear integration.

- Independent jobs run concurrently in isolated `bro/job/<id>` worktrees.
- Router selects the exact parallel job and `queue`, `steer`, or `replace`.
- Integration remains ordered per project.
- Jobs are rebased onto previously integrated work.
- Only normal pushes and fast-forward updates are allowed.
- Dirty, detached, unrelated, divergent, and merge-containing branches are rejected.
- Integration checkpoints recover safely after restarts or completed pushes.
- Conflicts return to the later job for resolution, testing, rebase continuation, and recommit.
- Existing running jobs retain a safe legacy completion path.
- Added configurable `WORKTREES_ROOT`.
- Build and all 46 tests passed.
- Commit: `89b7ed3 Add parallel worktree execution`
- Pushed to `origin/main`.
- Working tree is clean.

Changes: 3 file(s), +18/-0

Bro now consistently operates in English:

- Non-English requests are translated internally by the router.
- Tasks and clarification messages are generated in English.
- Plans, todos, progress updates, prompts, and summaries must use English.
- Final responses must be concise English summaries.
- Initial, continuation, and additional-instruction prompts share the policy.
- Build and all 40 tests passed.
- Commit: `95220b6 Enforce English job output`
- Pushed to `origin/main`.
- Working tree is clean.

Changes: 8 file(s), +535/-52

instruction scheduling controls를 구현했습니다.

- **Add instruction** 버튼, job card reply, 실행 중인 project에 대한 새 요청 지원
- Queue, Replace, Steer 선택 card 제공
- instruction을 성공 확인 후 순차 실행
- Replace는 active prompt 중단 및 pending instruction 삭제
- Steer는 active prompt 중단 후 우선 실행하고 기존 queue 재개
- 선택, 순서, 중단 상태를 SQLite에 저장해 재시작 복구
- polling/control concurrency와 stale completion race 방지
- 고정 OpenCode message ID로 재시도 안정성 개선
- 기존 DB migration 지원
- Build 및 40개 테스트 통과
- Commit: `ea2d0f1 Add instruction scheduling controls`
- `origin/main` push 완료
- Working tree clean

Changes: 3 file(s), +35/-17

웹 UI를 개선했습니다.

- 프로젝트와 작업을 최신 활동순으로 정렬
- 가장 최근 프로젝트를 기본 선택
- 최신 작업에 `Latest` 표시
- 프로젝트별 최신 상태 indicator 추가
- 프로젝트, active job, 전체 job 요약 추가
- 상태별 card 색상과 timestamp 가독성 개선
- Desktop/mobile rendering 및 console 검증 완료
- Build 및 37개 테스트 통과
- Commit: `41b0a59 Improve project activity UI`
- `origin/main` push 완료
- Working tree clean

Changes: 2 file(s), +32/-3

이전 job의 `Working on`과 `Plan`이 잠시 표시되던 race condition을 수정했습니다.

- 현재 prompt의 `todowrite` 완료 전에는 이전 todo를 사용하지 않음
- 완료 확인 후 todo를 순차 조회해 응답 순서 race 방지
- 관련 회귀 테스트 추가
- Build 및 37개 테스트 통과
- Commit: `3f06875 Prevent stale job progress`
- `origin/main` push 완료
- Working tree clean

Changes: 8 file(s), +43/-8

running job Discord card에 `Open in code-server` 버튼을 추가했습니다.

- 해당 프로젝트 폴더를 `?folder=`로 직접 엽니다.
- `CODE_SERVER_PUBLIC_URL` 설정과 기본값 `http://localhost:8081`을 추가했습니다.
- Build 및 37개 테스트 통과
- Commit: `ce18cc6 Add code-server job link`
- `origin/main` push 완료
- Working tree clean

Changes: 3 file(s), +35/-18

프로젝트 thread navigation을 완료했습니다.

- 좌측 프로젝트 navigation 및 job 수 표시
- `?project=` 기반 선택 유지
- 모바일 가로 스크롤 navigation
- 선택된 프로젝트 thread만 렌더링
- 테스트 36개 모두 통과
- Commit: `8aff5ec Add project thread navigation`
- `origin/main` push 완료
- Working tree clean

Changes: 3 file(s), +17/-1

OpenCode 작업 권한 범위를 확장했습니다.

- 필요한 OS 패키지, DB, CLI, runtime, library, service 설치 허용
- task 완료에 필요하면 프로젝트 폴더 외부 파일 생성 및 수정 허용
- 시스템, 서비스, 도구, 환경 설정 변경 허용
- 다른 프로젝트나 source repository의 파일은 접근, 수정, 삭제 금지
- 초기 작업과 재시작 후 continuation prompt 모두 동일하게 적용
- 12개 suite, 36개 테스트 통과
- 커밋 및 푸시 완료: `abd5f75 Allow required system configuration`

Changes: 13 file(s), +234/-15

프로젝트별 request/response thread 웹 서버를 추가했습니다.

- `http://localhost:8080`: 프로젝트별 job thread UI
- `/api/projects`: 프로젝트별 thread JSON API
- `/healthz`: 웹 서버 health endpoint
- 요청, 완료 결과, 오류, 실행 중 progress 표시
- SQLite의 최근 500개 job 기록 사용
- HTML escape 및 CSP 적용
- 15초 자동 새로고침과 모바일 레이아웃 지원
- Discord login 재시도 중에도 웹 서버 우선 실행
- code-server는 `http://localhost:8081`로 이동
- Docker healthcheck가 OpenCode, code-server, thread 서버 확인
- 12개 suite, 36개 테스트 통과
- 커밋 및 푸시 완료: `9013d99 Add project thread web server`

Changes: 6 file(s), +81/-12

실행 중 job 카드에 간단한 진행 보고를 추가했습니다.

- OpenCode active todo 우선 표시
- 완료 단계 수 표시: `Plan: 1/3 steps completed`
- todo가 없으면 실행 중 tool 또는 assistant text 사용
- 최대 400자로 간결하게 정리
- 진행 내용이 바뀔 때만 Discord 메시지 갱신
- 시작, 추가 instruction 적용, continuation 상태 즉시 표시
- 진행 상태를 SQLite에 저장해 재시작 후 복원
- 기존 DB에 `progress` 컬럼 자동 migration
- 11개 suite, 34개 테스트 통과
- 커밋 및 푸시 완료: `b980cb7 Show brief job progress reports`

Changes: no session diff reported

커밋된 변경사항도 job 완료 통계에 반영하도록 수정했습니다.

- job 시작 시 Git `HEAD`를 SQLite에 baseline으로 저장
- 완료 시 `baseline..HEAD`의 committed diff 통계 계산
- commit 후 working tree가 깨끗해도 파일 수와 `+/-` 라인 표시
- Git 통계 계산 불가 시 OpenCode session diff로 fallback
- 기존 SQLite DB에 `base_commit` 컬럼 자동 migration
- `no session diff reported` 문구 제거
- 11개 suite, 34개 테스트 통과
- 커밋 및 푸시 완료: `2d052bc Report committed job changes`

Changes: no session diff reported

표준 Docker socket 자동 설정을 추가했습니다.

- `/var/run/docker.sock`이 실제 socket일 때만 처리
- 기존 `DOCKER_HOST`가 설정돼 있으면 변경하지 않음
- 접근 권한이 없으면 `sudo chmod 0666` 적용
- 접근 가능해지면 `DOCKER_HOST=unix:///var/run/docker.sock` 설정
- chmod 실패 시 경고만 출력하고 컨테이너는 계속 시작
- 보안 영향 README 명시
- 10개 suite, 32개 테스트 및 셸 문법 검사 통과
- 커밋 및 푸시 완료: `4d73b4f Enable mounted Docker socket access`

Changes: no session diff reported

Docker 이미지에 `kubectl v1.36.2`를 추가했습니다.

- Linux `amd64`, `arm64` 지원
- 아키텍처별 SHA-256 검증
- `/usr/local/bin/kubectl`에 설치
- README 및 Docker 회귀 테스트 추가
- 10개 suite, 31개 테스트 통과
- Docker daemon socket 권한이 없어 실제 image build는 미실행
- 커밋 및 푸시 완료: `f2b087f Add kubectl to development image`

Changes: no session diff reported

Running job에 prompt를 주입하는 기능을 추가했습니다.

- job 카드에 **Add instruction** 버튼 추가
- multiline Discord Modal 입력 지원
- 입력 내용을 SQLite instruction queue에 저장
- 컨테이너 재시작 후에도 미전송 instruction 복구
- poller가 현재 OpenCode session에 비동기로 전달
- API 실패 시 다음 poll에서 자동 재시도
- pending instruction이 있으면 기존 성공 응답만으로 job을 완료하지 않음
- 추가 instruction까지 성공 marker가 확인돼야 완료 처리
- 권한 allowlist를 Modal에도 동일하게 적용
- 10개 suite, 30개 테스트 통과
- 커밋 및 푸시 완료: `7750a75 Inject prompts into running Discord jobs`
- `main`과 `origin/main` 동기화 완료