宜博 / lemonboss

Two parallel pieces of plumbing — neither has been exercised end-to-end yet
(real CLI gated on `claude /login`; Projects list view served alongside
existing pages):

──── real-CLI wire-up (REAL.1 + REAL.2) ────

LemonBoss now has a clean toggle between mock & real Claude CLI:

- packages/acp-core/protocol/ClaudeCliProtocol.js
  * `options.systemPrompt` → `--append-system-prompt <prompt>` so each
    devloop agent receives its role-specific prompt.md without losing
    Claude's default tool-use conventions.
  * `options.maxBudgetUsd` → `--max-budget-usd` (note: only effective in
    `--print` mode; documented inline).

- server/src/core/devloop/loop-controller.js
  * callAgent now branches on `opts.mock`:
    - mock (P1-P5 path, untouched): fixture sequence + `mock/files` event
    - real: read system/templates/{agent}/prompt.md, pass as systemPrompt,
      snapshot project file mtimes pre-call, diff post-call to compute
      `files_written` — no fixture, no mock/files needed.
  * `_snapshotMtimes(root)` helper walks the project tree (skipping
    .git / node_modules / .cache / .tmp) and returns Map<relPath,mtime>.
  * timeline event payload now carries `real: true` flag.

- scripts/real-pm-smoke.js — minimal real-CLI sanity:
  spawns claude, injects PM prompt, prints which files were written +
  git commit sha. Hard timeout 5min. Single agent → expected spend
  $0.10-0.30 per run when authenticated.

Current status: process spawn + system-prompt injection + stream-json
flow all verified up to the `Not logged in · Please run /login` gate.
Auth is the only remaining blocker for executing the real smoke.

──── project CRUD routes ────

server/routes/devloop.js + server/services/devloop/path-resolver.js
add the lifecycle pieces the Projects list view needs:

- GET    /projects?include_archived=true   list w/ archive filter
- PATCH  /projects/:pid                    edit name + idea_summary
- DELETE /projects/:pid                    soft delete (archive)
- DELETE /projects/:pid?hard=true          hard delete (rm -rf sandbox;
                                            unregister linked)
- POST   /projects/:pid/restore            un-archive

path-resolver exposes matching helpers: listProjects({includeArchived}),
patchProjectMeta(pid,patch), hardDeleteProject(pid).

──── UI ────

- web/src/views/DevLoopProjects.vue (320 lines, new)  — Projects list
- web/src/router/index.js — adds `/devloop` → DevLoopProjects
- web/src/components/devloop/DashboardHeader.vue — back-link now points
  to `/devloop` (project list) instead of `/company`.

──── housekeeping ────

- CLAUDE.md / start.sh — start.sh now boots server/index.js (full route
  surface incl. /api/devloop) instead of the historical agent-server.js;
  docs updated to reflect this.

──── tests (+12) ────

- server/tests/devloop/routes-crud.test.js — 12 cases:
  PATCH validation (4) · soft DELETE + list filter (4) · POST /restore
  (1) · hard DELETE (2) · GET /projects default behavior (1).

Results:
- phase0-verify .. phase5-verify: 8+7+7+6+9+9+7 all pass
- vitest devloop+acp-core: 230/230 (was 218 → +12)

Specs:
- docs/prd/newfunction/_spec/arch-acp-bridge.md · Mock Mode
- docs/prd/newfunction/_spec/plan-migration.md · "自举乐趣" (real path
  prep)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>