宜博 / lemonboss

First successful real-CLI agent invocation. After REAL.1 (system-prompt
injection) + REAL.2 (mtime-diff file detection) wired, the only remaining
gate was Claude auth. Once CLAUDE_CODE_OAUTH_TOKEN was added to the
project .env, scripts/real-pm-smoke.js completed cleanly:

  Wire-up status:
    ✓ process spawn
    ✓ stream chunks       (3)
    ✓ result text          (Claude returned "DONE")
    ✓ files written        (6: prd/index, feature-tree, user-flows,
                              product/overview, assets/shell.{css,js})
    ✓ git commit           (8cb0493)
  5/5 checks passed · elapsed 163s

PM output quality (real Claude, not mock):
- valid <article data-doc="prd" data-rev="1"> + <section data-rev="1">
  structure per system prompt
- nav links use correct relative paths across 4 chapters
- pid (p-7gwlbl) embedded in HTML metadata
- 中文 prose in the requested 克制 voice

Spec-deviation confirmed (no MCP tool gateway yet — Claude only has
built-in Read/Write/Bash):
- ✗ agent-state/pm.json (no update_runtime_state tool)
- ✗ agent-state/pm-todo.json (no write_todolist tool)
- ✗ history/prd-rev-001.html (no archive_doc tool)
- ✗ timeline.ndjson 'prd_drafted' event (no timeline_append tool)
- ✓ core PRD site IS produced — sufficient to prove pipeline

──── code ────

- scripts/real-pm-smoke.js — loads root .env via dotenv resolved
  from server/node_modules (script dir has no node_modules of its own).

──── ambient ────

Files modified by user/linter while real-CLI work was in flight; merged
without revert:
- server/routes/devloop.js — new GET /:pid/requirements endpoint
- server/services/devloop/path-resolver.js — listProjects() includes
  archived flag + helpers; supports project archive lifecycle
- server/services/devloop/git-vault.js — commit() now accepts files[]
  to scope which paths the commit covers (avoids dragging linked-existing
  user's unstaged files into chore commits)
- server/src/core/devloop/loop-controller.js — createProject uses
  explicit files:['project.json','timeline.ndjson'] for first chore
  commit (avoids same issue)
- server/tests/devloop/path-resolver.test.js — coverage for archive/
  patch/hardDelete helpers
- web/src/components/devloop/RequirementListSection.vue (new)
- web/src/views/DevLoopNewRequirement.vue (new)
- web/src/views/DevLoopDashboard.vue — mounts RequirementListSection
- web/src/views/DevLoopProjects.vue — list page polish
- web/src/router/index.js — adds /devloop/:pid/requirements/new route
- web/src/components/devloop/DashboardHeader.vue — back link tweak

Test results: 233/233 vitest pass (was 230 → +3 path-resolver cases).

──── ⚠ SECURITY NOTE ────

.env is currently TRACKED in git (committed in b1a348b) even though
.gitignore lists it. Existing committed contents include credentials for
DOUBAO / FEISHU / GITHUB / GOOGLE / JWT. The CLAUDE_CODE_OAUTH_TOKEN +
AZURE_OPENAI_API_KEY I just added to .env are NOT in this commit — they
stay in your working tree only.

Recommended follow-up (separate commit):
  git rm --cached .env
  git commit -m "chore: stop tracking .env (already gitignored)"
And rotate every key that was in the previous committed .env.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

First concrete code commit for DevLoop. Implements all 7 services that
P0.A tools will depend on, per plan-migration P0.0.

Services (server/services/devloop/, ~900 lines):
- path-resolver.js   foundation — resolveProjectRoot + 12 derived paths;
                     sandbox + linked-new mode support; sensitive path
                     blacklist (with /tmp + os.tmpdir() exemptions);
                     ~/.devloop/linked-projects.json registry
- doc-store.js       PRD/SDD multi-file site IO + cheerio validateHTML +
                     validateUnitsSchema + canonical-JSON hashContract
                     + automatic history/ archival
- unit-registry.js   FSM (M-2: pending→coding→testing→passed/failed/blocked);
                     l2GateOpen; diffUnits (added/changed/removed);
                     reset semantics for L2 + L3
- bug-tracker.js     bugs.ndjson append-only + dedupKey + P-9 transition
                     state machine + list/stats/history aggregation
- timeline-logger.js M-13 ProcessTimeline — append/read/tail;
                     summary truncate to 280; payload oversize → ref form
- changelog-writer.js M-15 — append/read/latest for prd/sdd/units revs
- sse-broker.js      per-pid pub/sub + 25s heartbeat + stream.log replay
                     via Last-Event-ID; emit returns monotonic id
- git-vault.js       spawn-git wrapper — init/commit/tag/log/diff/status/
                     resetWorkingTree/revert/archive; per-pid mutex;
                     nothing-to-commit returns {skipped:true} not throw

Tests (server/tests/devloop/, 71 passing):
- path-resolver.test.js  (17 cases) — sensitive path · sandbox alloc · linked-new
- doc-store.test.js      (12 cases) — validateHTML · validateUnitsSchema · hashContract
- unit-registry.test.js  (15 cases) — FSM transitions · l2GateOpen · diffUnits
- bug-tracker.test.js    (10 cases) — open dedup · transition · list filter · history
- timeline-logger.test.js (9 cases) — append/read/tail · summary truncate · oversize
- git-vault.test.js      (8 cases)  — init idempotent · commit · tag · status · archive

vitest config (`globals: true`) means tests use describe/it/expect globally,
no `require('vitest')` needed (and would fail under vitest 4).

Dep added: cheerio@^1.0.0 (used by docStore.validateHTML; HTML parsing).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>