宜博 / lemonboss

远程部署前置需求：登录鉴权 + 公司级多租户隔离。后端 auth.js/jwt-auth.js（注册/登录/
JWT-cookie/OAuth）本来就已经可用，这次只是把它接到前端。

- scripts/seed-admin-user.js（npm run seed:admin）：幂等种子脚本，建出 admin/hex1234，
  role=admin。
- web/src/composables/useAuth.js + views/Login.vue：登录态 + 登录页。
- router/index.js 全局 beforeEach：未登录跳 /login?redirect=...，登录后带着原目标跳回。
- main.js 全局 401 拦截器：cookie 中途过期同样兜住，不止页面切换那一刻。
- AppNav.vue：显示用户名 + 退出登录。
- 顺手修：App.vue 原来无条件渲染 MasterChatDrawer，登录页也会露出这个悬浮入口，
  改成登录且非登录页才显示。

业务路由还没加锁（Phase 1 的事），登录后依然能看到现状全部数据，符合这一阶段的验收边界。
真实浏览器走过一遍全部流程（跳转/登录/跳回/直接刷新受保护路由/退出），npm run build 通过。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

判据统一：目标文件既不在盘上、**也从未在 git 历史里出现过**（逐个 git log --all 核过），
不是「搬了地方」而是从来没有过。跑起来一律 MODULE_NOT_FOUND。

删除（12 处，指向 4 个从未存在的目录）：
  server/src/cli/       main、bin.auto-dev、example、example-bmi
  server/src/utils/     logs、analyze、parse
  server/src/modules/   test:browser-logger、test:design-validator
  server/src/tests/scripts/  test:multi-cli
  skills/whatsapp-bot/  whatsapp:auth、whatsapp:start
                        （skills/ 是 gitignored 的运行时目录，确实存在，
                          但里面没有也从没有过 whatsapp-bot；
                          /api/whatsapp 路由走的是 routes/whatsapp-auth.js，不受影响）

只授权了 auto-dev 那 3 处，其余 9 处是同一类缺陷、同一条判据，一并删了 —— 要退回来
`git revert` 这一笔即可。删完 package.json 零死引用（脚本目标存在性已脚本化核过）。

CLAUDE.md 同步：
  - 常用命令去掉已删除的 6 条，补上真实存在但之前没列的 graph:seed / okr:migrate
  - 上一笔加的 auto-dev 警告块随引用一起去掉
  - /api/goals 从「向后兼容别名」改为「已退役」—— 7f24ef0（27-P3C §六.1）已落地，
    OKR 只剩 /api/okr 一个挂载点，且有守卫测试盯着

验证：npm run test:unit 1057/1057 绿；npm run spec:check 52 份 _spec 全同步；
CLAUDE.md 里出现的每一条 npm run 都在 package.json 里存在（脚本核对）。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

代码层：
- server/services/goals.js → okr-service.js；GoalsService → OkrService
  · this.goalsDir → okrDir，目录 goals/ → okr/
  · ID 前缀 G- → O-；落盘文件 goal.json → objective.json
  · updateGoal → updateObjective，_nextGoalId/_saveGoal 等同步改名
  · parseNodeId 层级名 ['Goal','Objective','KeyResult','SubTask']
    → ['Objective','KeyResult','SubTask','SubTask']（OKR 无 Goal 这一层）
- server/routes/goals.js → okr.js；:goalId → :objectiveId
- 7 处调用点同步：index.js / agent-server.js / agent-chat.js / company.js /
  company-heartbeat-service.js / prompt-builder.js / test-company-e2e.js
- 前端 OkrDashboard.vue / CompanyDashboard.vue 切到 /api/okr（前后端命名终于一致）
- bin/lemon.js 新增 okr create/add-node/list/status

向后兼容（不破坏任何现有调用方）：
- /api/goals/* 与 /api/company/:cid/goals/* 全部保留为别名，与新路径同时挂载
- task dispatch/report 同时接受 objectiveId(新) 与 goalId(旧)，写入时两字段都留
- bin/lemon.js 保留 goal * 命令别名

迁移脚本 scripts/migrate-goals-to-okr.js（npm run okr:migrate）：
- 目录 data/{,companies/*/}goals/ → okr/；条目 G-xxx → O-xxx
- 改写 objective.json 的 id / nodes 的 key / children 数组、_index.json、
  progress.json 的 goalId、history.log 文本、system/tasklog/*.json 的 goalId+nodeId
- --dry-run 预演；幂等；迁移前自动备份为 *.bak-goals（已加入 .gitignore）
- 处理一个反直觉边界：OkrService 构造函数会自动 mkdir 目标目录，"okr/ 已存在"
  不等于"已迁移过"——只要服务被 require 过一次就留下空壳。用 isEmptyOkrDir()
  区分空壳与真实数据，空壳移除后继续迁移。这个 bug 是在 fixture 上验证时发现的。
- 同样在 fixture 上发现并修掉：nodeId 的值漏改写、tasklog 迁移不幂等

验证：新增 server/tests/unit/okr-service.test.js（7 例，覆盖新命名工作正常 +
迁移纯函数的 ID 改写）；全量 npm run test:unit 652 例全绿。

范围说明：NAMING §五 的 benchmark 三分（skill-/agent-/goal-）本轮未动代码——
该节自身的建议就是存量保持现状、只对新增代码强制前缀，因为 benchmark_runs 等表
服务于线上 Arena 排行榜，改表名/路由是另一次独立迁移。
§二-四 的新 agent id 尚不存在实体，待 P2/P3 实现时按规范创建。

已知遗留（非本次引入）：server/scripts/test-company-e2e.js 早已失效——它按
data/{id}/ 找公司，而 company-service 用的是 data/companies/{id}/，在 HEAD 版本
同样全部断言失败。本次只同步了其中的 OKR 命名，未修这个路径问题。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Adds server/services/graph-db.js (new data/graph.sqlite: system_agents,
org_graph_nodes, org_graph_edges) and graph-seed-service.js, which scans
system/agents/, system/templates/, and data/companies/*/company.json into
seed rows without touching company-service.js's existing hire/copy path.

Real repo data diverged from the design doc's original estimates (8 not 10
global agents; 39 not 34 template dirs; system/agents/ and system/templates/
turn out to share 6 ids describing the "same" agent from two different
files) — documented in docs/todo/system-design/27-graph-agent-architecture.md
section 7 for P1/P2 to resolve.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

First concrete code commit for DevLoop. Implements all 7 services that
P0.A tools will depend on, per plan-migration P0.0.

Services (server/services/devloop/, ~900 lines):
- path-resolver.js   foundation — resolveProjectRoot + 12 derived paths;
                     sandbox + linked-new mode support; sensitive path
                     blacklist (with /tmp + os.tmpdir() exemptions);
                     ~/.devloop/linked-projects.json registry
- doc-store.js       PRD/SDD multi-file site IO + cheerio validateHTML +
                     validateUnitsSchema + canonical-JSON hashContract
                     + automatic history/ archival
- unit-registry.js   FSM (M-2: pending→coding→testing→passed/failed/blocked);
                     l2GateOpen; diffUnits (added/changed/removed);
                     reset semantics for L2 + L3
- bug-tracker.js     bugs.ndjson append-only + dedupKey + P-9 transition
                     state machine + list/stats/history aggregation
- timeline-logger.js M-13 ProcessTimeline — append/read/tail;
                     summary truncate to 280; payload oversize → ref form
- changelog-writer.js M-15 — append/read/latest for prd/sdd/units revs
- sse-broker.js      per-pid pub/sub + 25s heartbeat + stream.log replay
                     via Last-Event-ID; emit returns monotonic id
- git-vault.js       spawn-git wrapper — init/commit/tag/log/diff/status/
                     resetWorkingTree/revert/archive; per-pid mutex;
                     nothing-to-commit returns {skipped:true} not throw

Tests (server/tests/devloop/, 71 passing):
- path-resolver.test.js  (17 cases) — sensitive path · sandbox alloc · linked-new
- doc-store.test.js      (12 cases) — validateHTML · validateUnitsSchema · hashContract
- unit-registry.test.js  (15 cases) — FSM transitions · l2GateOpen · diffUnits
- bug-tracker.test.js    (10 cases) — open dedup · transition · list filter · history
- timeline-logger.test.js (9 cases) — append/read/tail · summary truncate · oversize
- git-vault.test.js      (8 cases)  — init idempotent · commit · tag · status · archive

vitest config (`globals: true`) means tests use describe/it/expect globally,
no `require('vitest')` needed (and would fail under vitest 4).

Dep added: cheerio@^1.0.0 (used by docStore.validateHTML; HTML parsing).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The 50-page PRD HTML totals ~520KB; loading it all costs Claude ~222K
tokens just for context. This adds a token-efficient sibling layer:

- scripts/extract-spec.js → npm run spec:extract / spec:check
  Walks docs/prd/newfunction/*.html and produces stripped MD into _spec/.
  Strategy varies per page (full-extract for SDD/process/data,
  shell-strip for agents to keep long system prompts intact).
  Result: 327.9KB MD (~84K tokens) — 38% of full load, saves ~138K tokens
  for every Agent invocation that reads the spec.

- scripts/git-hooks/pre-commit + scripts/install-hooks.sh
  Pre-commit guard: when any docs/prd/newfunction/*.html changes, the
  hook checks the corresponding _spec/*.md is up to date; fails commit
  if stale, telling user to `npm run spec:extract`. Auto-installed via
  package.json `prepare` script on `npm install`.

- docs/prd/newfunction/_spec/ (51 .md files + CONVENTIONS.md)
  Machine-readable mirror of HTML. Used by:
  - Coder/Architect/Tester agents when reading spec at runtime
  - External Claude Code sessions doing reproducibility
  - CI checks (npm run spec:check)
  NOT hand-edited; regenerated from HTML by extract-spec.js.

- CLAUDE.md: 1-line note directing future agents to read _spec/*.md
  preferentially, fall back to *.html only for wireframes/SVG/full
  human-readable context.

This is the user's pre-existing scaffolding that the previous commits
hadn't pulled in yet. Now tracked + enforced by hook.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Architecture fix for long-running tool execution:

1. ClaudeCliProtocol: Two-tier idle timeout
   - Chat mode: 45s (detect API hang/silent rate limit)
   - Tool execution mode: 5min (Bash long tasks like pip install)
   - Automatically switches on tool_use_start / content_block_stop events

2. Provision API: POST /templates/:templateId/provision
   - Runs shell commands directly via child_process.exec
   - Bypasses Claude ACP entirely (no idle timeout issue)
   - 10min per-command timeout, security blocklist
   - Frontend button with prompt for custom commands

3. Template UI: Added 🔧 安装依赖 button (teal)

…aruncreate skill paths

- Upload skill files to .claude/skills/ (Claude Code ACP reads from here)
- Add conversation type filter (user/callback/task/train) to AgentChat
- Parse messages.log for richer conversation history display
- Fix idearuncreate template & company agent skill directory structure
- Add adm-zip dependency for ZIP extraction
- Add fs/path top-level requires in company.js

- Agent as Micro-Container: each agent lives in data/agents/{id}/ with full encapsulation
- Persona vs Capability split: agent.md (identity) + .claude/skills/main_skill/SKILL.md (workflow)
- Conversations co-located: data/agents/{id}/conversations/ replaces global dir
- Meta Skills renamed: meta_hunt, meta_digest, meta_creator, meta_evolving, meta_benchmark, meta_research
- Dynamic Hot-Reload: AgentManager.getAgentConfig() falls back to filesystem scan
- Parallel Sub-Agent orchestration via Promise.all with multi-terminal UI
- Removed SQLite dependency, global skills/ directory, and legacy conversations/
- Full architecture docs: 18-local-filesystem-first-agent-encapsulation.md