@askexenow/exe-os 0.9.288 → 0.9.290

package/dist/chunk-F3DQ3HDH.js

@@ -0,0 +1,333 @@
+import {
+  executeAction,
+  substituteTemplate
+} from "./chunk-FI5Q6F5S.js";
+
+// src/automation/workflow-engine.ts
+import { randomUUID } from "crypto";
+var _definitions = /* @__PURE__ */ new Map();
+var _instances = /* @__PURE__ */ new Map();
+function createWorkflowDefinition(input) {
+  const def = {
+    id: randomUUID().slice(0, 12),
+    ...input,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  def.steps = def.steps.map((s, i) => ({ ...s, index: s.index || i + 1 }));
+  _definitions.set(def.id, def);
+  return def;
+}
+function getWorkflowDefinition(id) {
+  return _definitions.get(id);
+}
+function listWorkflowDefinitions() {
+  return [..._definitions.values()];
+}
+function buildTemplateContext(instance) {
+  const ctx = { ...instance.context };
+  const stepMap = {};
+  for (const sr of instance.step_results) {
+    stepMap[String(sr.step_index)] = {
+      status: sr.status,
+      result: sr.result,
+      error: sr.error
+    };
+  }
+  ctx.step = stepMap;
+  return ctx;
+}
+function resolveActionParams(action, context) {
+  const resolved = {};
+  for (const [key, val] of Object.entries(action.params)) {
+    resolved[key] = substituteTemplate(val, context);
+  }
+  return { ...action, params: resolved };
+}
+function startWorkflow(definitionId, context = {}) {
+  const def = _definitions.get(definitionId);
+  if (!def) throw new Error(`Workflow definition "${definitionId}" not found`);
+  const instance = {
+    id: randomUUID().slice(0, 12),
+    definition_id: definitionId,
+    status: "running",
+    current_step: 1,
+    step_results: [],
+    context,
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  _instances.set(instance.id, instance);
+  return instance;
+}
+function getWorkflowInstance(id) {
+  return _instances.get(id);
+}
+function listWorkflowInstances(status) {
+  const all = [..._instances.values()];
+  return status ? all.filter((i) => i.status === status) : all;
+}
+async function advanceWorkflow(instanceId) {
+  const instance = _instances.get(instanceId);
+  if (!instance) throw new Error(`Workflow instance "${instanceId}" not found`);
+  if (instance.status !== "running") {
+    throw new Error(`Workflow "${instanceId}" is ${instance.status}, cannot advance`);
+  }
+  const def = _definitions.get(instance.definition_id);
+  if (!def) throw new Error(`Workflow definition "${instance.definition_id}" not found`);
+  const step = def.steps.find((s) => s.index === instance.current_step);
+  if (!step) {
+    instance.status = "completed";
+    instance.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    return instance;
+  }
+  const templateCtx = buildTemplateContext(instance);
+  const stepResult = {
+    step_index: step.index,
+    status: "success",
+    started_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  switch (step.type) {
+    case "execute_action": {
+      const action = step.action ?? buildActionFromConnector(step);
+      if (!action) {
+        stepResult.status = "failed";
+        stepResult.error = "No action defined for execute_action step";
+        break;
+      }
+      const resolvedAction = resolveActionParams(action, templateCtx);
+      const result = await executeAction(resolvedAction, templateCtx);
+      stepResult.status = result.success ? "success" : "failed";
+      stepResult.result = result;
+      stepResult.error = result.error;
+      if (!result.success) {
+        instance.status = "failed";
+      }
+      break;
+    }
+    case "wait_for_approval": {
+      const { createTask } = await import("./lib/tasks.js");
+      const { getCoordinatorName } = await import("./lib/employees.js");
+      const message = step.approval_message ? substituteTemplate(step.approval_message, templateCtx) : `Workflow "${def.name}" step ${step.index} ("${step.name}") requires approval.`;
+      const task = await createTask({
+        title: `[Workflow Approval] ${def.name}: ${step.name}`,
+        assignedTo: getCoordinatorName(),
+        assignedBy: "workflow-engine",
+        projectName: "exe-os",
+        priority: "p1",
+        context: `${message}
+
+**Workflow:** ${def.name} (${instance.id})
+**Step:** ${step.index} \u2014 ${step.name}
+
+To approve: call approve_workflow_step with instance_id="${instance.id}"
+To reject: call approve_workflow_step with instance_id="${instance.id}" approved=false`,
+        baseDir: process.cwd()
+      });
+      instance.approval_task_id = task.id;
+      instance.status = "waiting_approval";
+      stepResult.status = "pending_approval";
+      break;
+    }
+    case "conditional": {
+      if (!step.condition) {
+        stepResult.status = "failed";
+        stepResult.error = "No condition defined for conditional step";
+        break;
+      }
+      const resolvedExpr = substituteTemplate(step.condition.expression, templateCtx);
+      const conditionMet = evaluateSimpleExpression(resolvedExpr);
+      stepResult.result = { expression: resolvedExpr, met: conditionMet };
+      if (conditionMet && step.condition.then_step) {
+        instance.current_step = step.condition.then_step;
+        stepResult.completed_at = (/* @__PURE__ */ new Date()).toISOString();
+        instance.step_results.push(stepResult);
+        instance.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+        return instance;
+      } else if (!conditionMet && step.condition.else_step) {
+        instance.current_step = step.condition.else_step;
+        stepResult.completed_at = (/* @__PURE__ */ new Date()).toISOString();
+        instance.step_results.push(stepResult);
+        instance.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+        return instance;
+      }
+      break;
+    }
+  }
+  stepResult.completed_at = (/* @__PURE__ */ new Date()).toISOString();
+  instance.step_results.push(stepResult);
+  if (instance.status === "running") {
+    const nextStep = def.steps.find((s) => s.index > step.index);
+    if (nextStep) {
+      instance.current_step = nextStep.index;
+    } else {
+      instance.status = "completed";
+    }
+  }
+  instance.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+  return instance;
+}
+async function runWorkflow(instanceId) {
+  let instance = _instances.get(instanceId);
+  if (!instance) throw new Error(`Workflow instance "${instanceId}" not found`);
+  while (instance.status === "running") {
+    instance = await advanceWorkflow(instanceId);
+  }
+  return instance;
+}
+async function approveWorkflowStep(instanceId, approved = true) {
+  const instance = _instances.get(instanceId);
+  if (!instance) throw new Error(`Workflow instance "${instanceId}" not found`);
+  if (instance.status !== "waiting_approval") {
+    throw new Error(`Workflow "${instanceId}" is not waiting for approval (status: ${instance.status})`);
+  }
+  const pendingResult = instance.step_results.find(
+    (sr) => sr.step_index === instance.current_step && sr.status === "pending_approval"
+  );
+  if (pendingResult) {
+    pendingResult.status = approved ? "approved" : "failed";
+    pendingResult.completed_at = (/* @__PURE__ */ new Date()).toISOString();
+    pendingResult.result = { approved };
+  }
+  if (!approved) {
+    instance.status = "cancelled";
+    instance.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    return instance;
+  }
+  const def = _definitions.get(instance.definition_id);
+  if (!def) throw new Error(`Workflow definition "${instance.definition_id}" not found`);
+  const currentStep = def.steps.find((s) => s.index === instance.current_step);
+  const nextStep = currentStep ? def.steps.find((s) => s.index > currentStep.index) : void 0;
+  if (nextStep) {
+    instance.current_step = nextStep.index;
+    instance.status = "running";
+  } else {
+    instance.status = "completed";
+  }
+  instance.approval_task_id = void 0;
+  instance.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+  if (instance.status === "running") {
+    return runWorkflow(instanceId);
+  }
+  return instance;
+}
+function buildActionFromConnector(step) {
+  if (!step.connector || !step.operation) return null;
+  const params = {};
+  if (step.payload) {
+    for (const [k, v] of Object.entries(step.payload)) {
+      params[k] = String(v);
+    }
+  }
+  params._connector = step.connector;
+  params._operation = step.operation;
+  return {
+    type: "mcp_tool",
+    params
+  };
+}
+function evaluateSimpleExpression(expr) {
+  const operators = ["==", "!=", ">=", "<=", ">", "<"];
+  for (const op of operators) {
+    const idx = expr.indexOf(op);
+    if (idx === -1) continue;
+    const left = expr.slice(0, idx).trim();
+    const right = expr.slice(idx + op.length).trim();
+    switch (op) {
+      case "==":
+        return left === right;
+      case "!=":
+        return left !== right;
+      case ">":
+        return Number(left) > Number(right);
+      case "<":
+        return Number(left) < Number(right);
+      case ">=":
+        return Number(left) >= Number(right);
+      case "<=":
+        return Number(left) <= Number(right);
+    }
+  }
+  return expr.trim() !== "" && expr.trim() !== "false" && expr.trim() !== "0";
+}
+async function persistWorkflows() {
+  try {
+    const { getClient } = await import("./lib/database.js");
+    const client = getClient();
+    for (const def of _definitions.values()) {
+      await client.execute({
+        sql: `INSERT OR REPLACE INTO workflow_definitions (id, name, description, steps, trigger_event, created_at)
+              VALUES (?, ?, ?, ?, ?, ?)`,
+        args: [def.id, def.name, def.description ?? null, JSON.stringify(def.steps), def.trigger_event ?? null, def.created_at]
+      });
+    }
+    for (const inst of _instances.values()) {
+      await client.execute({
+        sql: `INSERT OR REPLACE INTO workflow_instances
+              (id, definition_id, status, current_step, step_results, context, approval_task_id, created_at, updated_at)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          inst.id,
+          inst.definition_id,
+          inst.status,
+          inst.current_step,
+          JSON.stringify(inst.step_results),
+          JSON.stringify(inst.context),
+          inst.approval_task_id ?? null,
+          inst.created_at,
+          inst.updated_at
+        ]
+      });
+    }
+  } catch (e) {
+    process.stderr.write(`[workflow-engine] persist failed: ${e instanceof Error ? e.message : String(e)}
+`);
+  }
+}
+async function loadWorkflows() {
+  try {
+    const { getClient } = await import("./lib/database.js");
+    const client = getClient();
+    const defs = await client.execute("SELECT * FROM workflow_definitions");
+    for (const row of defs.rows) {
+      const def = {
+        id: String(row.id),
+        name: String(row.name),
+        description: String(row.description),
+        steps: JSON.parse(String(row.steps)),
+        trigger_event: String(row.trigger_event),
+        created_at: String(row.created_at)
+      };
+      _definitions.set(def.id, def);
+    }
+    const insts = await client.execute("SELECT * FROM workflow_instances WHERE status NOT IN ('completed', 'cancelled')");
+    for (const row of insts.rows) {
+      const inst = {
+        id: String(row.id),
+        definition_id: String(row.definition_id),
+        status: String(row.status),
+        current_step: Number(row.current_step),
+        step_results: JSON.parse(String(row.step_results)),
+        context: JSON.parse(String(row.context)),
+        approval_task_id: row.approval_task_id ? String(row.approval_task_id) : void 0,
+        created_at: String(row.created_at),
+        updated_at: String(row.updated_at)
+      };
+      _instances.set(inst.id, inst);
+    }
+  } catch {
+  }
+}
+
+export {
+  createWorkflowDefinition,
+  getWorkflowDefinition,
+  listWorkflowDefinitions,
+  startWorkflow,
+  getWorkflowInstance,
+  listWorkflowInstances,
+  advanceWorkflow,
+  runWorkflow,
+  approveWorkflowStep,
+  persistWorkflows,
+  loadWorkflows
+};

package/dist/chunk-F5SADWWW.js

@@ -0,0 +1,240 @@
+import {
+  getClient,
+  isCoordinatorName,
+  loadEmployeesSync
+} from "./chunk-3X2ZT5FN.js";
+
+// src/lib/steward-gate.ts
+import crypto from "crypto";
+var ROLE_PERMISSIONS = {
+  coordinator: /* @__PURE__ */ new Set([
+    "close_task",
+    "cancel_task",
+    "merge_entities",
+    "purge_document",
+    "deactivate_behavior",
+    "override"
+  ]),
+  manager: /* @__PURE__ */ new Set([
+    "close_task",
+    // their team only — enforced contextually
+    "deactivate_behavior"
+    // their team's behaviors
+  ]),
+  specialist: /* @__PURE__ */ new Set([
+    "deactivate_behavior_own",
+    // own behaviors only
+    "delete_own_memory"
+  ])
+};
+var UNIVERSAL_OPS = /* @__PURE__ */ new Set([
+  "update_own_task",
+  "store_memory",
+  "store_behavior"
+]);
+var MANAGER_ROLES = /* @__PURE__ */ new Set(["CTO", "CMO"]);
+var StewardGate = class {
+  /**
+   * Check whether an agent has authority for a destructive operation.
+   */
+  async checkAuthority(agent, operation, target) {
+    const role = await this.resolveRole(agent);
+    if (UNIVERSAL_OPS.has(operation)) {
+      const decision2 = {
+        allowed: true,
+        reason: `Operation "${operation}" is universally permitted.`,
+        confidence: 1,
+        requires_override: false
+      };
+      await this.logDecision(agent, operation, target, decision2);
+      return decision2;
+    }
+    const permissions = ROLE_PERMISSIONS[role];
+    let allowed = permissions.has(operation);
+    let reason;
+    if (!allowed && role === "specialist" && operation === "deactivate_behavior") {
+      const isOwn = await this.isOwnBehavior(agent, target);
+      if (isOwn) {
+        allowed = true;
+        reason = `Specialist "${agent}" can deactivate their own behavior.`;
+      } else {
+        reason = `Specialist "${agent}" cannot deactivate behaviors belonging to other agents.`;
+      }
+    } else if (allowed) {
+      reason = `Role "${role}" has authority for "${operation}".`;
+    } else {
+      reason = `Role "${role}" does not have authority for "${operation}". Requires coordinator override.`;
+    }
+    let requiresOverride = !allowed;
+    let confidence = allowed ? 0.95 : 0.9;
+    try {
+      const dreamingPath = "./dreaming.js";
+      const dreaming = await import(
+        /* @vite-ignore */
+        dreamingPath
+      );
+      if (typeof dreaming.calculateDrift === "function") {
+        const driftScore = await dreaming.calculateDrift(agent);
+        if (typeof driftScore === "number" && driftScore > 0.8) {
+          requiresOverride = true;
+          confidence = Math.max(0.5, confidence - 0.3);
+          reason += ` (\u26A0\uFE0F High drift score: ${driftScore.toFixed(2)} \u2014 requires override.)`;
+        }
+      }
+    } catch {
+    }
+    const decision = {
+      allowed: allowed && !requiresOverride,
+      reason,
+      confidence,
+      requires_override: requiresOverride
+    };
+    await this.logDecision(agent, operation, target, decision);
+    return decision;
+  }
+  /**
+   * Record an explicit coordinator override that bypasses the gate.
+   */
+  async override(agent, operation, target, reason) {
+    const role = await this.resolveRole(agent);
+    if (role !== "coordinator") {
+      const decision2 = {
+        allowed: false,
+        reason: `Only coordinators can issue overrides. "${agent}" is a ${role}.`,
+        confidence: 1,
+        requires_override: false
+      };
+      await this.logDecision(agent, `override:${operation}`, target, decision2);
+      return decision2;
+    }
+    const decision = {
+      allowed: true,
+      reason: `Coordinator override: ${reason}`,
+      confidence: 1,
+      requires_override: false
+    };
+    await this.logDecision(agent, `override:${operation}`, target, decision);
+    return decision;
+  }
+  /**
+   * Query the audit trail.
+   */
+  async getAuditLog(opts) {
+    await this.ensureAuditTable();
+    const client = getClient();
+    const conditions = [];
+    const args = [];
+    if (opts?.agent) {
+      conditions.push("agent = ?");
+      args.push(opts.agent);
+    }
+    if (opts?.operation) {
+      conditions.push("operation = ?");
+      args.push(opts.operation);
+    }
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const limit = opts?.limit ?? 50;
+    const result = await client.execute({
+      sql: `SELECT * FROM steward_audit ${where} ORDER BY created_at DESC LIMIT ?`,
+      args: [...args, limit]
+    });
+    return result.rows.map((row) => ({
+      id: String(row.id),
+      agent: String(row.agent),
+      operation: String(row.operation),
+      target: String(row.target),
+      decision: {
+        allowed: Number(row.allowed) === 1,
+        reason: String(row.reason),
+        confidence: Number(row.confidence),
+        requires_override: Number(row.requires_override) === 1
+      },
+      timestamp: String(row.created_at)
+    }));
+  }
+  // -------------------------------------------------------------------------
+  // Internal methods
+  // -------------------------------------------------------------------------
+  /**
+   * Resolve an agent name to a role category.
+   */
+  async resolveRole(agent) {
+    if (isCoordinatorName(agent)) return "coordinator";
+    try {
+      const employees = loadEmployeesSync();
+      const employee = employees.find((e) => e.name === agent);
+      if (employee && MANAGER_ROLES.has(employee.role)) return "manager";
+    } catch {
+    }
+    return "specialist";
+  }
+  /**
+   * Check if a behavior belongs to the given agent.
+   */
+  async isOwnBehavior(agent, behaviorId) {
+    try {
+      const client = getClient();
+      const result = await client.execute({
+        sql: "SELECT agent_id FROM behaviors WHERE id = ? LIMIT 1",
+        args: [behaviorId]
+      });
+      if (result.rows.length === 0) return false;
+      return String(result.rows[0].agent_id) === agent;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Ensure the steward_audit table exists.
+   */
+  async ensureAuditTable() {
+    const client = getClient();
+    await client.execute({
+      sql: `CREATE TABLE IF NOT EXISTS steward_audit (
+        id                TEXT PRIMARY KEY,
+        agent             TEXT NOT NULL,
+        operation         TEXT NOT NULL,
+        target            TEXT NOT NULL,
+        allowed           INTEGER NOT NULL,
+        reason            TEXT NOT NULL,
+        confidence        REAL NOT NULL,
+        requires_override INTEGER NOT NULL DEFAULT 0,
+        created_at        TEXT NOT NULL
+      )`,
+      args: []
+    });
+  }
+  /**
+   * Log a gate decision to the audit trail.
+   */
+  async logDecision(agent, operation, target, decision) {
+    try {
+      await this.ensureAuditTable();
+      const client = getClient();
+      await client.execute({
+        sql: `INSERT INTO steward_audit (id, agent, operation, target, allowed, reason, confidence, requires_override, created_at)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          crypto.randomUUID(),
+          agent,
+          operation,
+          target,
+          decision.allowed ? 1 : 0,
+          decision.reason,
+          decision.confidence,
+          decision.requires_override ? 1 : 0,
+          (/* @__PURE__ */ new Date()).toISOString()
+        ]
+      });
+    } catch {
+      process.stderr.write(
+        `[steward-gate] Audit log write failed for ${agent}:${operation}
+`
+      );
+    }
+  }
+};
+
+export {
+  StewardGate
+};