@ai-sdlc/orchestrator 0.5.0 → 0.6.0

package/dist/runners/review-agent.js

@@ -0,0 +1,220 @@
+/**
+ * PR Review agent runner — analyzes pull request diffs for testing coverage,
+ * code quality, and security issues. Read-only: never modifies files.
+ *
+ * Uses the Anthropic Messages API directly (not Claude Code CLI)
+ * to produce a structured review verdict. Follows the SecurityTriageRunner
+ * pattern exactly.
+ */
+import { DEFAULT_ANTHROPIC_API_URL, DEFAULT_ANTHROPIC_MODEL, DEFAULT_LLM_TIMEOUT_MS, } from '../defaults.js';
+// ── System prompts ───────────────────────────────────────────────────
+const REVIEW_PROMPTS = {
+    testing: `You are a testing review agent analyzing a pull request diff. Your job is to verify that the changes are well-tested and that acceptance criteria are met.
+
+Analyze the diff and any provided acceptance criteria. Check for:
+1. **Test coverage**: Are new/changed code paths covered by tests?
+2. **Acceptance criteria**: If provided, are all acceptance criteria addressed?
+3. **Edge cases**: Are boundary conditions and error paths tested?
+4. **Test quality**: Are tests meaningful (not just asserting true)?
+5. **Missing tests**: Are there obvious test gaps for the changed code?
+
+Respond with ONLY a JSON object (no markdown, no code fences):
+
+{
+  "approved": true/false,
+  "findings": [
+    {"severity": "critical|major|minor|suggestion", "file": "path/to/file.ts", "line": 42, "message": "description"}
+  ],
+  "summary": "1-2 sentence overall assessment"
+}
+
+Severity guide:
+- critical: Missing tests for critical paths, acceptance criteria not met
+- major: Significant test gaps for changed code
+- minor: Minor test improvements possible
+- suggestion: Nice-to-have test additions`,
+    critic: `You are a code quality review agent analyzing a pull request diff. Your job is to identify code quality issues, logic errors, and design problems.
+
+Analyze the diff for:
+1. **Logic errors**: Incorrect conditions, off-by-one errors, race conditions
+2. **Code quality**: Naming, readability, unnecessary complexity
+3. **Error handling**: Missing error cases, swallowed exceptions
+4. **Design patterns**: Violations of existing project patterns/conventions
+5. **Performance**: Obvious inefficiencies (N+1 queries, unnecessary allocations)
+
+Do NOT flag style-only issues (formatting, trailing whitespace). Focus on substantive issues.
+
+Respond with ONLY a JSON object (no markdown, no code fences):
+
+{
+  "approved": true/false,
+  "findings": [
+    {"severity": "critical|major|minor|suggestion", "file": "path/to/file.ts", "line": 42, "message": "description"}
+  ],
+  "summary": "1-2 sentence overall assessment"
+}
+
+Severity guide:
+- critical: Logic errors, data loss risks, broken functionality
+- major: Significant quality issues that should be fixed before merge
+- minor: Improvements that would make the code better
+- suggestion: Optional enhancements`,
+    security: `You are a security review agent analyzing a pull request diff. Your job is to identify security vulnerabilities in the changed code.
+
+Analyze the diff for:
+1. **Injection vulnerabilities**: SQL injection, command injection, XSS, template injection
+2. **Authentication/authorization**: Missing auth checks, privilege escalation
+3. **Credential exposure**: Hardcoded secrets, API keys, tokens in code
+4. **Path traversal**: Unsanitized file paths, directory traversal
+5. **Unsafe deserialization**: JSON.parse on untrusted input without validation
+6. **Dependency issues**: Known vulnerable patterns, unsafe API usage
+7. **Information disclosure**: Verbose error messages, stack traces in responses
+
+Respond with ONLY a JSON object (no markdown, no code fences):
+
+{
+  "approved": true/false,
+  "findings": [
+    {"severity": "critical|major|minor|suggestion", "file": "path/to/file.ts", "line": 42, "message": "description"}
+  ],
+  "summary": "1-2 sentence overall assessment"
+}
+
+Severity guide:
+- critical: Exploitable vulnerability (injection, credential leak, auth bypass)
+- major: Security weakness that should be fixed (missing validation, unsafe patterns)
+- minor: Defense-in-depth improvement
+- suggestion: Security hardening opportunity`,
+};
+// ── Runner ───────────────────────────────────────────────────────────
+export class ReviewAgentRunner {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    get reviewType() {
+        return this.config.reviewType;
+    }
+    async run(ctx) {
+        const apiKey = this.config.apiKey ?? process.env.ANTHROPIC_API_KEY;
+        if (!apiKey) {
+            return {
+                success: false,
+                filesChanged: [],
+                summary: 'Missing ANTHROPIC_API_KEY for PR review',
+                error: 'ANTHROPIC_API_KEY environment variable is not set',
+            };
+        }
+        const userContent = [
+            `## Pull Request Diff to Review`,
+            '',
+            ctx.issueBody, // diff is passed via issueBody
+            '',
+            ...(ctx.ciErrors ? [`## Acceptance Criteria`, '', ctx.ciErrors, ''] : []),
+            `## Context`,
+            '',
+            `**Issue Title:** ${ctx.issueTitle}`,
+        ].join('\n');
+        try {
+            const verdict = await this.callAPI(apiKey, userContent);
+            return {
+                success: true,
+                filesChanged: [], // Read-only — never modifies files
+                summary: JSON.stringify(verdict),
+                tokenUsage: verdict._tokenUsage,
+            };
+        }
+        catch (err) {
+            return {
+                success: false,
+                filesChanged: [],
+                summary: 'PR review failed',
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+    async callAPI(apiKey, userContent) {
+        const apiUrl = this.config.apiUrl ?? DEFAULT_ANTHROPIC_API_URL;
+        const model = this.config.model ?? DEFAULT_ANTHROPIC_MODEL;
+        const timeoutMs = this.config.timeoutMs ?? DEFAULT_LLM_TIMEOUT_MS;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const res = await fetch(apiUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-api-key': apiKey,
+                    'anthropic-version': '2023-06-01',
+                },
+                body: JSON.stringify({
+                    model,
+                    max_tokens: 4096,
+                    system: this.config.reviewPolicy
+                        ? `${this.config.reviewPolicy}\n\n---\n\n${REVIEW_PROMPTS[this.config.reviewType]}`
+                        : REVIEW_PROMPTS[this.config.reviewType],
+                    messages: [{ role: 'user', content: userContent }],
+                }),
+                signal: controller.signal,
+            });
+            if (!res.ok) {
+                const text = await res.text().catch(() => '');
+                throw new Error(`Anthropic API error ${res.status}: ${text.slice(0, 200)}`);
+            }
+            const body = (await res.json());
+            const text = body.content?.[0]?.text ?? '';
+            const verdict = this.parseVerdict(text);
+            const tokenUsage = body.usage
+                ? {
+                    inputTokens: body.usage.input_tokens,
+                    outputTokens: body.usage.output_tokens,
+                    model: body.model ?? model,
+                }
+                : undefined;
+            return { ...verdict, _tokenUsage: tokenUsage };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    parseVerdict(text) {
+        // Strip markdown fences if the model wraps the JSON
+        const cleaned = text.replace(/^```(?:json)?\s*/m, '').replace(/\s*```$/m, '');
+        try {
+            const parsed = JSON.parse(cleaned);
+            const findings = Array.isArray(parsed.findings)
+                ? parsed.findings.map((f) => ({
+                    severity: ['critical', 'major', 'minor', 'suggestion'].includes(String(f.severity))
+                        ? String(f.severity)
+                        : 'minor',
+                    file: f.file ? String(f.file) : undefined,
+                    line: typeof f.line === 'number' ? f.line : undefined,
+                    message: String(f.message ?? ''),
+                }))
+                : [];
+            return {
+                type: this.config.reviewType,
+                approved: Boolean(parsed.approved),
+                findings,
+                summary: String(parsed.summary ?? ''),
+            };
+        }
+        catch {
+            // If JSON parse fails, treat as not approved — conservative
+            return {
+                type: this.config.reviewType,
+                approved: false,
+                findings: [
+                    {
+                        severity: 'critical',
+                        message: 'Failed to parse review verdict — treating as not approved',
+                    },
+                ],
+                summary: `Review agent response was not valid JSON: ${text.slice(0, 200)}`,
+            };
+        }
+    }
+}
+// ── Exported prompts for testing ─────────────────────────────────────
+export { REVIEW_PROMPTS };
+//# sourceMappingURL=review-agent.js.map

package/dist/runners/security-triage.js

@@ -54,6 +54,10 @@ export class SecurityTriageRunner {
                 error: 'ANTHROPIC_API_KEY environment variable is not set',
             };
         }
+        // Warn if issue body is empty or whitespace-only
+        if (!ctx.issueBody || ctx.issueBody.trim() === '') {
+            console.warn(`[SecurityTriageRunner] Warning: Issue #${ctx.issueId} has an empty body. Triage quality may be degraded.`);
+        }
         const userContent = [
             `## Issue to Analyze`,
             '',

package/dist/runners/types.d.ts

@@ -20,6 +20,8 @@ export interface AgentContext {
     };
     /** CI failure logs, populated only during fix-CI retries. */
     ciErrors?: string;
+    /** Review findings from PR reviews, populated only during fix-review retries. */
+    reviewFindings?: string;
     /** Agent memory for long-term/episodic recall. */
     memory?: AgentMemory;
     /** Override the default tool allowlist for the agent subprocess. */
@@ -36,12 +38,29 @@ export interface AgentContext {
     lintCommand?: string;
     /** Format command for agent prompt (e.g., `npm run format`). */
     formatCommand?: string;
+    /** Typecheck command for agent prompt (e.g., `pnpm build`). */
+    typecheckCommand?: string;
     /** Commit message template with `{issueNumber}` and `{issueTitle}` placeholders. */
     commitMessageTemplate?: string;
     /** Co-author line for commits. */
     commitCoAuthor?: string;
     /** OpenShell sandbox ID — when set, the runner spawns the agent inside this sandbox. */
     sandboxId?: string;
+    /** Progress callback — called with streaming events as the agent works. */
+    onProgress?: (event: AgentProgressEvent) => void;
+}
+/** Streaming progress event emitted by the agent runner. */
+export interface AgentProgressEvent {
+    /** Event type. */
+    type: 'tool_start' | 'tool_end' | 'text' | 'error' | 'cost';
+    /** Tool name (for tool_start/tool_end events). */
+    tool?: string;
+    /** File path or resource being acted on. */
+    file?: string;
+    /** Short description of what's happening. */
+    message?: string;
+    /** Cost in USD so far (for cost events). */
+    costUsd?: number;
 }
 export interface TokenUsage {
     inputTokens: number;

package/dist/state/index.d.ts

@@ -1,4 +1,4 @@
 export { StateStore } from './store.js';
 export { CURRENT_SCHEMA_VERSION, SCHEMA_DDL, MIGRATION_V2, MIGRATION_V3, MIGRATION_V4, MIGRATION_V5, MIGRATIONS, } from './schema.js';
-export type { ComplexityProfile, EpisodicRecord, AutonomyLedgerEntry, PipelineRun, PipelineRunStatus, Convention, HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, AutonomyEventType, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, PriorityCalibrationSample, } from './types.js';
+export type { ComplexityProfile, EpisodicRecord, AutonomyLedgerEntry, PipelineRun, PipelineRunStatus, Convention, HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, AutonomyEventType, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, PriorityCalibrationSample, ToolSequenceEvent, WorkflowPattern, PatternProposal, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/state/schema.d.ts

@@ -1,7 +1,7 @@
 /**
  * SQLite DDL and migrations for the state store.
  */
-export declare const CURRENT_SCHEMA_VERSION = 8;
+export declare const CURRENT_SCHEMA_VERSION = 9;
 export declare const SCHEMA_DDL = "\nCREATE TABLE IF NOT EXISTS schema_version (\n  version INTEGER PRIMARY KEY,\n  applied_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS complexity_profile (\n  id INTEGER PRIMARY KEY,\n  repo_path TEXT NOT NULL,\n  score REAL NOT NULL,\n  files_count INTEGER,\n  modules_count INTEGER,\n  dependency_count INTEGER,\n  analyzed_at TEXT DEFAULT (datetime('now')),\n  raw_data TEXT\n);\n\nCREATE TABLE IF NOT EXISTS episodic_memory (\n  id INTEGER PRIMARY KEY,\n  issue_number INTEGER,\n  pr_number INTEGER,\n  pipeline_type TEXT NOT NULL,\n  outcome TEXT NOT NULL,\n  duration_ms INTEGER,\n  files_changed INTEGER,\n  error_message TEXT,\n  metadata TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS autonomy_ledger (\n  id INTEGER PRIMARY KEY,\n  agent_name TEXT NOT NULL UNIQUE,\n  current_level INTEGER DEFAULT 0,\n  total_tasks INTEGER DEFAULT 0,\n  success_count INTEGER DEFAULT 0,\n  failure_count INTEGER DEFAULT 0,\n  last_task_at TEXT,\n  metrics TEXT\n);\n\nCREATE TABLE IF NOT EXISTS pipeline_runs (\n  id INTEGER PRIMARY KEY,\n  run_id TEXT NOT NULL UNIQUE,\n  issue_number INTEGER,\n  pr_number INTEGER,\n  pipeline_type TEXT NOT NULL,\n  status TEXT NOT NULL,\n  current_stage TEXT,\n  started_at TEXT DEFAULT (datetime('now')),\n  completed_at TEXT,\n  result TEXT,\n  gate_results TEXT\n);\n\nCREATE TABLE IF NOT EXISTS conventions (\n  id INTEGER PRIMARY KEY,\n  category TEXT NOT NULL,\n  pattern TEXT NOT NULL,\n  confidence REAL,\n  examples TEXT,\n  detected_at TEXT DEFAULT (datetime('now'))\n);\n";
 export interface Migration {
     version: number;
@@ -14,5 +14,6 @@ export declare const MIGRATION_V5 = "\n-- Deployment records\nCREATE TABLE IF NO
 export declare const MIGRATION_V6 = "\n-- Cost governance: add stage_name and cache_read_tokens to cost_ledger\nALTER TABLE cost_ledger ADD COLUMN stage_name TEXT;\nALTER TABLE cost_ledger ADD COLUMN cache_read_tokens INTEGER DEFAULT 0;\n";
 export declare const MIGRATION_V7 = "\n-- String issue IDs\nALTER TABLE pipeline_runs ADD COLUMN issue_id TEXT;\nALTER TABLE episodic_memory ADD COLUMN issue_id TEXT;\nALTER TABLE cost_ledger ADD COLUMN issue_id TEXT;\nALTER TABLE routing_history ADD COLUMN issue_id TEXT;\n";
 export declare const MIGRATION_V8 = "\n-- Priority calibration table (RFC-0005 PPA)\nCREATE TABLE IF NOT EXISTS priority_calibration (\n  id INTEGER PRIMARY KEY,\n  issue_id TEXT NOT NULL,\n  priority_composite REAL NOT NULL,\n  priority_confidence REAL NOT NULL,\n  priority_dimensions TEXT,\n  actual_complexity INTEGER,\n  files_changed INTEGER,\n  outcome TEXT,\n  sampled_at TEXT DEFAULT (datetime('now'))\n);\nCREATE INDEX IF NOT EXISTS idx_priority_calibration_issue ON priority_calibration(issue_id);\nCREATE INDEX IF NOT EXISTS idx_priority_calibration_sampled ON priority_calibration(sampled_at);\n\n-- Extend episodic_memory with priority columns\nALTER TABLE episodic_memory ADD COLUMN priority_composite REAL;\nALTER TABLE episodic_memory ADD COLUMN priority_confidence REAL;\n";
+export declare const MIGRATION_V9 = "\n-- Workflow pattern detection tables\n\n-- Tool sequence events captured by PostToolUse hook\nCREATE TABLE IF NOT EXISTS tool_sequence_events (\n  id INTEGER PRIMARY KEY,\n  session_id TEXT NOT NULL,\n  tool_name TEXT NOT NULL,\n  action_canonical TEXT NOT NULL,\n  project_path TEXT,\n  timestamp TEXT NOT NULL,\n  ingested_at TEXT DEFAULT (datetime('now'))\n);\nCREATE INDEX IF NOT EXISTS idx_tool_seq_session ON tool_sequence_events(session_id);\nCREATE INDEX IF NOT EXISTS idx_tool_seq_ts ON tool_sequence_events(timestamp);\n\n-- Detected workflow patterns (from n-gram mining)\nCREATE TABLE IF NOT EXISTS workflow_patterns (\n  id INTEGER PRIMARY KEY,\n  pattern_hash TEXT NOT NULL UNIQUE,\n  pattern_type TEXT NOT NULL,\n  sequence_json TEXT NOT NULL,\n  frequency INTEGER NOT NULL,\n  session_count INTEGER NOT NULL,\n  confidence REAL NOT NULL,\n  first_seen TEXT,\n  last_seen TEXT,\n  status TEXT DEFAULT 'detected',\n  detected_at TEXT DEFAULT (datetime('now'))\n);\nCREATE INDEX IF NOT EXISTS idx_workflow_patterns_status ON workflow_patterns(status);\n\n-- Automation proposals for human review\nCREATE TABLE IF NOT EXISTS pattern_proposals (\n  id INTEGER PRIMARY KEY,\n  pattern_id INTEGER NOT NULL,\n  proposal_type TEXT NOT NULL,\n  artifact_type TEXT NOT NULL,\n  artifact_path TEXT,\n  draft_content TEXT NOT NULL,\n  confidence REAL NOT NULL,\n  status TEXT DEFAULT 'pending',\n  reviewed_at TEXT,\n  reviewer_reason TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  FOREIGN KEY (pattern_id) REFERENCES workflow_patterns(id)\n);\nCREATE INDEX IF NOT EXISTS idx_pattern_proposals_status ON pattern_proposals(status);\n";
 export declare const MIGRATIONS: Migration[];
 //# sourceMappingURL=schema.d.ts.map

package/dist/state/schema.js

@@ -1,7 +1,7 @@
 /**
  * SQLite DDL and migrations for the state store.
  */
-export const CURRENT_SCHEMA_VERSION = 8;
+export const CURRENT_SCHEMA_VERSION = 9;
 export const SCHEMA_DDL = `
 CREATE TABLE IF NOT EXISTS schema_version (
   version INTEGER PRIMARY KEY,
@@ -262,6 +262,55 @@ CREATE INDEX IF NOT EXISTS idx_priority_calibration_sampled ON priority_calibrat
 ALTER TABLE episodic_memory ADD COLUMN priority_composite REAL;
 ALTER TABLE episodic_memory ADD COLUMN priority_confidence REAL;
 `;
+export const MIGRATION_V9 = `
+-- Workflow pattern detection tables
+
+-- Tool sequence events captured by PostToolUse hook
+CREATE TABLE IF NOT EXISTS tool_sequence_events (
+  id INTEGER PRIMARY KEY,
+  session_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  action_canonical TEXT NOT NULL,
+  project_path TEXT,
+  timestamp TEXT NOT NULL,
+  ingested_at TEXT DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_tool_seq_session ON tool_sequence_events(session_id);
+CREATE INDEX IF NOT EXISTS idx_tool_seq_ts ON tool_sequence_events(timestamp);
+
+-- Detected workflow patterns (from n-gram mining)
+CREATE TABLE IF NOT EXISTS workflow_patterns (
+  id INTEGER PRIMARY KEY,
+  pattern_hash TEXT NOT NULL UNIQUE,
+  pattern_type TEXT NOT NULL,
+  sequence_json TEXT NOT NULL,
+  frequency INTEGER NOT NULL,
+  session_count INTEGER NOT NULL,
+  confidence REAL NOT NULL,
+  first_seen TEXT,
+  last_seen TEXT,
+  status TEXT DEFAULT 'detected',
+  detected_at TEXT DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_workflow_patterns_status ON workflow_patterns(status);
+
+-- Automation proposals for human review
+CREATE TABLE IF NOT EXISTS pattern_proposals (
+  id INTEGER PRIMARY KEY,
+  pattern_id INTEGER NOT NULL,
+  proposal_type TEXT NOT NULL,
+  artifact_type TEXT NOT NULL,
+  artifact_path TEXT,
+  draft_content TEXT NOT NULL,
+  confidence REAL NOT NULL,
+  status TEXT DEFAULT 'pending',
+  reviewed_at TEXT,
+  reviewer_reason TEXT,
+  created_at TEXT DEFAULT (datetime('now')),
+  FOREIGN KEY (pattern_id) REFERENCES workflow_patterns(id)
+);
+CREATE INDEX IF NOT EXISTS idx_pattern_proposals_status ON pattern_proposals(status);
+`;
 export const MIGRATIONS = [
     {
         version: 1,
@@ -295,5 +344,9 @@ export const MIGRATIONS = [
         version: 8,
         sql: MIGRATION_V8,
     },
+    {
+        version: 9,
+        sql: MIGRATION_V9,
+    },
 ];
 //# sourceMappingURL=schema.js.map

package/dist/state/store.d.ts

@@ -5,7 +5,7 @@
  * optional — the orchestrator works without it.
  */
 import type BetterSqlite3 from 'better-sqlite3';
-import type { ComplexityProfile, EpisodicRecord, AutonomyLedgerEntry, PipelineRun, PipelineRunStatus, Convention, HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, PriorityCalibrationSample } from './types.js';
+import type { ComplexityProfile, EpisodicRecord, AutonomyLedgerEntry, PipelineRun, PipelineRunStatus, Convention, HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, PriorityCalibrationSample, ToolSequenceEvent, WorkflowPattern, PatternProposal } from './types.js';
 export declare class StateStore {
     private db;
     constructor(db: BetterSqlite3.Database);
@@ -118,6 +118,22 @@ export declare class StateStore {
     }): number;
     /** Expose the underlying database for direct queries (e.g. dashboard). */
     getDatabase(): BetterSqlite3.Database;
+    saveToolSequenceEvent(event: ToolSequenceEvent): number;
+    saveToolSequenceEvents(events: ToolSequenceEvent[]): number;
+    getToolSequenceEvents(opts?: {
+        sessionId?: string;
+        since?: string;
+        limit?: number;
+    }): ToolSequenceEvent[];
+    saveWorkflowPattern(pattern: WorkflowPattern): number;
+    getWorkflowPatterns(opts?: {
+        status?: string;
+    }): WorkflowPattern[];
+    savePatternProposal(proposal: PatternProposal): number;
+    getPatternProposals(opts?: {
+        status?: string;
+    }): PatternProposal[];
+    updateProposalStatus(id: number, status: string, reason?: string): void;
     close(): void;
 }
 //# sourceMappingURL=store.d.ts.map

package/dist/state/store.js

@@ -711,6 +711,128 @@ export class StateStore {
     getDatabase() {
         return this.db;
     }
+    // ── Workflow Pattern Detection ─────────────────────────────────────
+    saveToolSequenceEvent(event) {
+        const stmt = this.db.prepare(`
+      INSERT INTO tool_sequence_events (session_id, tool_name, action_canonical, project_path, timestamp)
+      VALUES (?, ?, ?, ?, ?)
+    `);
+        const result = stmt.run(event.sessionId, event.toolName, event.actionCanonical, event.projectPath ?? null, event.timestamp);
+        return Number(result.lastInsertRowid);
+    }
+    saveToolSequenceEvents(events) {
+        const stmt = this.db.prepare(`
+      INSERT INTO tool_sequence_events (session_id, tool_name, action_canonical, project_path, timestamp)
+      VALUES (?, ?, ?, ?, ?)
+    `);
+        const tx = this.db.transaction((items) => {
+            for (const e of items) {
+                stmt.run(e.sessionId, e.toolName, e.actionCanonical, e.projectPath ?? null, e.timestamp);
+            }
+            return items.length;
+        });
+        return tx(events);
+    }
+    getToolSequenceEvents(opts) {
+        const conditions = [];
+        const params = [];
+        if (opts?.sessionId) {
+            conditions.push('session_id = ?');
+            params.push(opts.sessionId);
+        }
+        if (opts?.since) {
+            conditions.push('timestamp >= ?');
+            params.push(opts.since);
+        }
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+        const limit = opts?.limit ?? 10000;
+        params.push(limit);
+        const rows = this.db
+            .prepare(`SELECT * FROM tool_sequence_events ${where} ORDER BY timestamp ASC LIMIT ?`)
+            .all(...params);
+        return rows.map((r) => ({
+            id: r.id,
+            sessionId: r.session_id,
+            toolName: r.tool_name,
+            actionCanonical: r.action_canonical,
+            projectPath: r.project_path,
+            timestamp: r.timestamp,
+            ingestedAt: r.ingested_at,
+        }));
+    }
+    saveWorkflowPattern(pattern) {
+        const stmt = this.db.prepare(`
+      INSERT OR REPLACE INTO workflow_patterns
+        (pattern_hash, pattern_type, sequence_json, frequency, session_count, confidence, first_seen, last_seen, status)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+        const result = stmt.run(pattern.patternHash, pattern.patternType, pattern.sequenceJson, pattern.frequency, pattern.sessionCount, pattern.confidence, pattern.firstSeen ?? null, pattern.lastSeen ?? null, pattern.status);
+        return Number(result.lastInsertRowid);
+    }
+    getWorkflowPatterns(opts) {
+        const conditions = [];
+        const params = [];
+        if (opts?.status) {
+            conditions.push('status = ?');
+            params.push(opts.status);
+        }
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+        const rows = this.db
+            .prepare(`SELECT * FROM workflow_patterns ${where} ORDER BY confidence DESC`)
+            .all(...params);
+        return rows.map((r) => ({
+            id: r.id,
+            patternHash: r.pattern_hash,
+            patternType: r.pattern_type,
+            sequenceJson: r.sequence_json,
+            frequency: r.frequency,
+            sessionCount: r.session_count,
+            confidence: r.confidence,
+            firstSeen: r.first_seen,
+            lastSeen: r.last_seen,
+            status: r.status,
+            detectedAt: r.detected_at,
+        }));
+    }
+    savePatternProposal(proposal) {
+        const stmt = this.db.prepare(`
+      INSERT INTO pattern_proposals
+        (pattern_id, proposal_type, artifact_type, artifact_path, draft_content, confidence, status)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+        const result = stmt.run(proposal.patternId, proposal.proposalType, proposal.artifactType, proposal.artifactPath ?? null, proposal.draftContent, proposal.confidence, proposal.status);
+        return Number(result.lastInsertRowid);
+    }
+    getPatternProposals(opts) {
+        const conditions = [];
+        const params = [];
+        if (opts?.status) {
+            conditions.push('status = ?');
+            params.push(opts.status);
+        }
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+        const rows = this.db
+            .prepare(`SELECT * FROM pattern_proposals ${where} ORDER BY confidence DESC`)
+            .all(...params);
+        return rows.map((r) => ({
+            id: r.id,
+            patternId: r.pattern_id,
+            proposalType: r.proposal_type,
+            artifactType: r.artifact_type,
+            artifactPath: r.artifact_path,
+            draftContent: r.draft_content,
+            confidence: r.confidence,
+            status: r.status,
+            reviewedAt: r.reviewed_at,
+            reviewerReason: r.reviewer_reason,
+            createdAt: r.created_at,
+        }));
+    }
+    updateProposalStatus(id, status, reason) {
+        this.db
+            .prepare(`UPDATE pattern_proposals SET status = ?, reviewed_at = datetime('now'), reviewer_reason = ? WHERE id = ?`)
+            .run(status, reason ?? null, id);
+    }
     close() {
         this.db.close();
     }

package/dist/state/types.d.ts

@@ -204,4 +204,39 @@ export interface AuditEntryRecord {
     signature?: string;
     createdAt?: string;
 }
+export interface ToolSequenceEvent {
+    id?: number;
+    sessionId: string;
+    toolName: string;
+    actionCanonical: string;
+    projectPath?: string;
+    timestamp: string;
+    ingestedAt?: string;
+}
+export interface WorkflowPattern {
+    id?: number;
+    patternHash: string;
+    patternType: string;
+    sequenceJson: string;
+    frequency: number;
+    sessionCount: number;
+    confidence: number;
+    firstSeen?: string;
+    lastSeen?: string;
+    status: string;
+    detectedAt?: string;
+}
+export interface PatternProposal {
+    id?: number;
+    patternId: number;
+    proposalType: string;
+    artifactType: string;
+    artifactPath?: string;
+    draftContent: string;
+    confidence: number;
+    status: string;
+    reviewedAt?: string;
+    reviewerReason?: string;
+    createdAt?: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/workflow-patterns/artifact-writer.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Artifact writer — generates files for approved pattern proposals.
+ * Never overwrites existing files.
+ */
+export interface WriteResult {
+    success: boolean;
+    filePath: string;
+    error?: string;
+}
+/**
+ * Write a proposal artifact to the filesystem.
+ * Creates parent directories if needed.
+ * Returns error if file already exists (never overwrites).
+ */
+export declare function writeArtifact(projectDir: string, relativePath: string, content: string): WriteResult;
+//# sourceMappingURL=artifact-writer.d.ts.map

package/dist/workflow-patterns/artifact-writer.js

@@ -0,0 +1,34 @@
+/**
+ * Artifact writer — generates files for approved pattern proposals.
+ * Never overwrites existing files.
+ */
+import { writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+/**
+ * Write a proposal artifact to the filesystem.
+ * Creates parent directories if needed.
+ * Returns error if file already exists (never overwrites).
+ */
+export function writeArtifact(projectDir, relativePath, content) {
+    const fullPath = join(projectDir, relativePath);
+    if (existsSync(fullPath)) {
+        return {
+            success: false,
+            filePath: fullPath,
+            error: `File already exists: ${relativePath}`,
+        };
+    }
+    try {
+        mkdirSync(dirname(fullPath), { recursive: true });
+        writeFileSync(fullPath, content, 'utf-8');
+        return { success: true, filePath: fullPath };
+    }
+    catch (err) {
+        return {
+            success: false,
+            filePath: fullPath,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+//# sourceMappingURL=artifact-writer.js.map

package/dist/workflow-patterns/classifiers.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Pattern type classifiers — refine detected patterns into
+ * specific automation types based on their structure.
+ */
+import type { DetectedPattern } from './types.js';
+/**
+ * Classify a detected pattern into a specific type and suggest an artifact.
+ */
+export declare function classifyPattern(pattern: DetectedPattern): DetectedPattern;
+//# sourceMappingURL=classifiers.d.ts.map