Merge remote-tracking branch 'prgs/master' into feat/issue-435-auth-deployment

# Conflicts:
#	docs/webui-local-dev.md

webui/app.py

@@ -15,14 +15,21 @@ from webui.project_registry import find_project, load_registry, registry_to_dict
 from webui.project_views import render_project_detail, render_projects_list
 from webui.prompt_library import find_prompt, library_to_dict
 from webui.prompt_views import render_prompt_detail, render_prompts_page
+from final_report_validator import FINAL_REPORT_TASK_KINDS
+
+from webui.audit_validator import audit_report, audit_to_dict
+from webui.audit_views import render_audit_page
 from webui.lease_loader import load_lease_snapshot, snapshot_to_dict as lease_snapshot_to_dict
 from webui.lease_views import render_leases_page
 from webui.queue_loader import load_queue_snapshot, snapshot_to_dict as queue_snapshot_to_dict
 from webui.queue_views import render_queue_page
+from webui.worktree_scanner import load_hygiene_snapshot, snapshot_to_dict as worktree_snapshot_to_dict
+from webui.worktree_views import render_worktrees_page
 from webui.runtime_health import load_runtime_snapshot, snapshot_to_dict as runtime_snapshot_to_dict
 from webui.runtime_views import render_runtime_page
 
 _READ_ONLY_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
+_AUDIT_MUTATION_PATHS = frozenset({"/audit", "/api/audit"})
 
 
 def _stub_page(title: str, description: str) -> HTMLResponse:
@@ -135,18 +142,56 @@ async def api_runtime(_request: Request) -> JSONResponse:
     return JSONResponse(runtime_snapshot_to_dict(load_runtime_snapshot()))
 
 
-async def audit(_request: Request) -> HTMLResponse:
-    return _stub_page(
-        "Audit",
-        "Report audit will accept pasted final reports and run validator previews.",
+async def _parse_audit_form(request: Request) -> tuple[str, str | None]:
+    if request.method == "GET":
+        return "", None
+    content_type = (request.headers.get("content-type") or "").lower()
+    if "application/json" in content_type:
+        payload = await request.json()
+        if not isinstance(payload, dict):
+            return "", None
+        report_text = str(payload.get("report_text") or "")
+        task_kind = payload.get("task_kind")
+        return report_text, str(task_kind) if task_kind else None
+    form = await request.form()
+    report_text = str(form.get("report_text") or "")
+    task_kind = form.get("task_kind")
+    return report_text, str(task_kind) if task_kind else None
+
+
+async def audit(request: Request) -> HTMLResponse:
+    report_text, task_kind = await _parse_audit_form(request)
+    result = None
+    if request.method == "POST" and report_text.strip():
+        result = audit_report(report_text, task_kind=task_kind)
+    return HTMLResponse(
+        render_audit_page(
+            report_text=report_text,
+            task_kind=task_kind,
+            result=result,
+        )
     )
 
 
+async def api_audit(request: Request) -> JSONResponse:
+    if request.method == "GET":
+        return JSONResponse({
+            "usage": "POST JSON with report_text and optional task_kind",
+            "task_kinds": sorted(FINAL_REPORT_TASK_KINDS),
+        })
+    report_text, task_kind = await _parse_audit_form(request)
+    if not report_text.strip():
+        return JSONResponse({"error": "report_text required"}, status_code=400)
+    return JSONResponse(audit_to_dict(audit_report(report_text, task_kind=task_kind)))
+
+
 async def worktrees(_request: Request) -> HTMLResponse:
-    return _stub_page(
-        "Worktrees",
-        "Worktree hygiene will summarize branches/ session folders and cleanup risk.",
-    )
+    snapshot = load_hygiene_snapshot()
+    return HTMLResponse(render_worktrees_page(snapshot))
+
+
+async def api_worktrees(_request: Request) -> JSONResponse:
+    return JSONResponse(worktree_snapshot_to_dict(load_hygiene_snapshot()))
 
 
 async def leases(_request: Request) -> HTMLResponse:
@@ -159,6 +204,9 @@ async def api_leases(_request: Request) -> JSONResponse:
 
 
 async def method_not_allowed(request: Request, _exc: Exception) -> Response:
+    path = request.url.path
+    if path in _AUDIT_MUTATION_PATHS and request.method == "POST":
+        return JSONResponse({"error": "not_found"}, status_code=404)
     if request.method not in _READ_ONLY_METHODS:
         return JSONResponse(
             {"error": "read-only-mvp", "detail": f"{request.method} not permitted"},
@@ -187,8 +235,10 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
             Route("/api/prompts", api_prompts, methods=["GET"]),
             Route("/runtime", runtime, methods=["GET"]),
             Route("/api/runtime", api_runtime, methods=["GET"]),
-            Route("/audit", audit, methods=["GET"]),
+            Route("/audit", audit, methods=["GET", "POST"]),
+            Route("/api/audit", api_audit, methods=["GET", "POST"]),
             Route("/worktrees", worktrees, methods=["GET"]),
+            Route("/api/worktrees", api_worktrees, methods=["GET"]),
             Route("/leases", leases, methods=["GET"]),
             Route("/api/leases", api_leases, methods=["GET"]),
         ],