@askexenow/exe-os 0.9.299 → 0.9.301

package/dist/chunk-GY66UPMX.js

@@ -0,0 +1,167 @@
+import {
+  EXE_AI_DIR
+} from "./chunk-R36FAN53.js";
+
+// src/lib/worker-gate.ts
+import { readdirSync, writeFileSync, unlinkSync, mkdirSync, existsSync, readFileSync } from "fs";
+import path from "path";
+import { totalmem, cpus } from "os";
+var WORKER_PID_DIR = path.join(EXE_AI_DIR, "worker-pids");
+function computeMaxWorkers() {
+  const totalGB = totalmem() / 1024 ** 3;
+  const coreCount = cpus().length;
+  const byRam = Math.floor(totalGB / 4);
+  const byCpu = Math.floor(coreCount / 2);
+  return Math.max(2, Math.min(8, Math.min(byRam, byCpu)));
+}
+var MAX_CONCURRENT_WORKERS = process.env.EXE_MAX_WORKERS ? Math.max(1, parseInt(process.env.EXE_MAX_WORKERS, 10) || 3) : computeMaxWorkers();
+function tryAcquireWorkerSlot() {
+  try {
+    mkdirSync(WORKER_PID_DIR, { recursive: true });
+    const reservationId = `res-${process.pid}-${Date.now()}`;
+    const reservationPath = path.join(WORKER_PID_DIR, `${reservationId}.pid`);
+    writeFileSync(reservationPath, String(process.pid));
+    const files = readdirSync(WORKER_PID_DIR);
+    let alive = 0;
+    for (const f of files) {
+      if (!f.endsWith(".pid")) continue;
+      if (f.startsWith("res-")) {
+        const resParts = f.replace(".pid", "").split("-");
+        const resPid = parseInt(resParts[1] ?? "", 10);
+        if (!isNaN(resPid) && resPid > 0) {
+          try {
+            process.kill(resPid, 0);
+            alive++;
+          } catch {
+            try {
+              unlinkSync(path.join(WORKER_PID_DIR, f));
+            } catch {
+            }
+          }
+        } else {
+          alive++;
+        }
+        continue;
+      }
+      const dashIdx = f.lastIndexOf("-");
+      const pid = parseInt(f.slice(dashIdx + 1).replace(".pid", ""), 10);
+      if (isNaN(pid)) continue;
+      try {
+        process.kill(pid, 0);
+        alive++;
+      } catch {
+        try {
+          unlinkSync(path.join(WORKER_PID_DIR, f));
+        } catch {
+        }
+      }
+    }
+    if (alive >= MAX_CONCURRENT_WORKERS) {
+      try {
+        unlinkSync(reservationPath);
+      } catch {
+      }
+      return false;
+    }
+    try {
+      unlinkSync(reservationPath);
+    } catch {
+    }
+    return true;
+  } catch {
+    return true;
+  }
+}
+function registerWorkerPid(pid) {
+  try {
+    mkdirSync(WORKER_PID_DIR, { recursive: true });
+    writeFileSync(path.join(WORKER_PID_DIR, `worker-${pid}.pid`), String(pid));
+  } catch {
+  }
+}
+function cleanupWorkerPid() {
+  try {
+    unlinkSync(path.join(WORKER_PID_DIR, `worker-${process.pid}.pid`));
+  } catch {
+  }
+}
+var BACKFILL_LOCK = path.join(WORKER_PID_DIR, "backfill.lock");
+function tryAcquireBackfillLock() {
+  try {
+    mkdirSync(WORKER_PID_DIR, { recursive: true });
+    if (existsSync(BACKFILL_LOCK)) {
+      try {
+        const pid = parseInt(
+          readFileSync(BACKFILL_LOCK, "utf8").trim(),
+          10
+        );
+        if (!isNaN(pid) && pid > 0) {
+          try {
+            process.kill(pid, 0);
+            return false;
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    writeFileSync(BACKFILL_LOCK, String(process.pid));
+    return true;
+  } catch {
+    return true;
+  }
+}
+function releaseBackfillLock() {
+  try {
+    unlinkSync(BACKFILL_LOCK);
+  } catch {
+  }
+}
+async function getTaskAwareCapacity() {
+  const { getClient } = await import("./lib/database.js");
+  const { sessionScopeFilter } = await import("./task-scope-CQZ33PRU.js");
+  const client = getClient();
+  const scope = sessionScopeFilter();
+  const result = await client.execute({
+    sql: `SELECT assigned_to, COUNT(*) as cnt
+          FROM tasks
+          WHERE status IN ('open', 'in_progress')${scope.sql}
+          GROUP BY assigned_to`,
+    args: [...scope.args]
+  });
+  const busyAgents = [];
+  let totalInProgress = 0;
+  for (const row of result.rows) {
+    const agent = String(row.assigned_to ?? "");
+    const count = Number(row.cnt ?? 0);
+    if (agent && count > 0) {
+      busyAgents.push(agent);
+      totalInProgress += count;
+    }
+  }
+  const idleAgents = [];
+  try {
+    const { listTmuxSessions } = await import("./lib/tmux-status.js");
+    const { isExeSession } = await import("./lib/tmux-routing.js");
+    const { baseAgentName } = await import("./lib/employees.js");
+    const liveSessions = listTmuxSessions().filter((s) => !isExeSession(s) && s.includes("-"));
+    const liveAgentNames = new Set(liveSessions.map((s) => baseAgentName(s.split("-")[0] ?? "")));
+    for (const name of liveAgentNames) {
+      if (name && !busyAgents.includes(name)) {
+        idleAgents.push(name);
+      }
+    }
+  } catch {
+  }
+  return { busyAgents, idleAgents, totalInProgress };
+}
+
+export {
+  MAX_CONCURRENT_WORKERS,
+  tryAcquireWorkerSlot,
+  registerWorkerPid,
+  cleanupWorkerPid,
+  tryAcquireBackfillLock,
+  releaseBackfillLock,
+  getTaskAwareCapacity
+};

package/dist/chunk-HCCG67BY.js

@@ -0,0 +1,43 @@
+// src/lib/daemon-heap.ts
+function computeDaemonHeapCapMb(_totalGb) {
+  return 4096;
+}
+var HEAP_FLAG_RE = /^--(max[-_]old[-_]space[-_]size|max[-_]semi[-_]space[-_]size|max[-_]heap[-_]size)(=|$)/i;
+var EMBED_WORKER_DEFAULT_HEAP_MB = 6144;
+var EMBED_WORKER_MIN_HEAP_MB = 3072;
+var EMBED_WORKER_RSS_HEADROOM_MB = 2048;
+var EMBED_WORKER_RSS_KILL_FLOOR_MB = 8192;
+function resolveEmbedWorkerRssKillMb(envValue, heapMb) {
+  const heap = Number.isFinite(heapMb) && heapMb > 0 ? heapMb : EMBED_WORKER_DEFAULT_HEAP_MB;
+  const safeDefault = Math.max(heap + EMBED_WORKER_RSS_HEADROOM_MB, EMBED_WORKER_RSS_KILL_FLOOR_MB);
+  const raw = parseInt(envValue ?? "", 10);
+  if (Number.isFinite(raw) && raw > heap + EMBED_WORKER_RSS_HEADROOM_MB) return raw;
+  return safeDefault;
+}
+var EMBED_MAX_RESPAWNS = 3;
+var EMBED_BACKOFF_BASE_MS = 1e4;
+var EMBED_BACKOFF_MAX_MS = 6e4;
+function resolveEmbedWorkerHeapMb(envValue) {
+  const raw = parseInt(envValue ?? "", 10);
+  return Number.isFinite(raw) && raw >= EMBED_WORKER_MIN_HEAP_MB ? raw : EMBED_WORKER_DEFAULT_HEAP_MB;
+}
+function buildEmbedWorkerExecArgv(parentExecArgv, heapMb) {
+  return [
+    ...parentExecArgv.filter((a) => !HEAP_FLAG_RE.test(a)),
+    `--max-old-space-size=${heapMb}`
+  ];
+}
+function computeEmbedRespawnDelayMs(respawnCount) {
+  if (respawnCount > EMBED_MAX_RESPAWNS) return null;
+  return Math.min(EMBED_BACKOFF_BASE_MS * 2 ** (respawnCount - 1), EMBED_BACKOFF_MAX_MS);
+}
+
+export {
+  computeDaemonHeapCapMb,
+  HEAP_FLAG_RE,
+  resolveEmbedWorkerRssKillMb,
+  EMBED_MAX_RESPAWNS,
+  resolveEmbedWorkerHeapMb,
+  buildEmbedWorkerExecArgv,
+  computeEmbedRespawnDelayMs
+};

package/dist/chunk-HCSZZXZZ.js

@@ -0,0 +1,197 @@
+import {
+  initStore
+} from "./chunk-3NYY2NZ3.js";
+import {
+  getClient,
+  isInitialized
+} from "./chunk-XABJRAUW.js";
+
+// src/lib/schedules.ts
+import crypto from "crypto";
+import { execSync } from "child_process";
+var CRON_FIELD = /^[\d*/,\-]+$/;
+function isValidCron(cron) {
+  const fields = cron.trim().split(/\s+/);
+  if (fields.length !== 5) return false;
+  return fields.every((f) => CRON_FIELD.test(f));
+}
+var SAFE_ID = /^[a-zA-Z0-9_\-]+$/;
+function isValidScheduleId(id) {
+  return SAFE_ID.test(id) && id.length <= 128;
+}
+async function ensureDb() {
+  if (!isInitialized()) {
+    await initStore();
+  }
+}
+function parseHumanCron(input) {
+  const s = input.toLowerCase().trim();
+  if (/^[\d*\/,-]+\s+[\d*\/,-]+\s+[\d*\/,-]+\s+[\d*\/,-]+\s+[\d*\/,-]+$/.test(s)) {
+    return s;
+  }
+  const dayMap = {
+    sunday: "0",
+    sun: "0",
+    monday: "1",
+    mon: "1",
+    tuesday: "2",
+    tue: "2",
+    wednesday: "3",
+    wed: "3",
+    thursday: "4",
+    thu: "4",
+    friday: "5",
+    fri: "5",
+    saturday: "6",
+    sat: "6"
+  };
+  const everyMatch = s.match(/every\s+(\d+)\s*([mh])/);
+  if (everyMatch) {
+    const n = everyMatch[1];
+    const unit = everyMatch[2];
+    if (unit === "m") return `*/${n} * * * *`;
+    if (unit === "h") return `0 */${n} * * *`;
+  }
+  let hour = -1;
+  let minute = 0;
+  if (/midnight/.test(s)) {
+    hour = 0;
+  } else if (/noon/.test(s)) {
+    hour = 12;
+  } else {
+    const timeMatch = s.match(/(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/);
+    if (timeMatch) {
+      hour = parseInt(timeMatch[1], 10);
+      minute = timeMatch[2] ? parseInt(timeMatch[2], 10) : 0;
+      if (timeMatch[3] === "pm" && hour < 12) hour += 12;
+      if (timeMatch[3] === "am" && hour === 12) hour = 0;
+    }
+  }
+  if (hour === -1) hour = 0;
+  let dow = "*";
+  if (/weekday|weekdays/.test(s)) {
+    dow = "1-5";
+  } else if (/weekend|weekends/.test(s)) {
+    dow = "0,6";
+  } else {
+    for (const [name, val] of Object.entries(dayMap)) {
+      if (s.includes(name)) {
+        dow = val;
+        break;
+      }
+    }
+  }
+  return `${minute} ${hour} * * ${dow}`;
+}
+async function createSchedule(input) {
+  if (!isValidCron(input.cron)) {
+    throw new Error(`Invalid cron expression: ${input.cron}. Must be 5 fields with only digits, *, /, -, comma.`);
+  }
+  await ensureDb();
+  const client = getClient();
+  const id = crypto.randomUUID().slice(0, 8);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const prompt = input.prompt ?? input.description;
+  await client.execute({
+    sql: `INSERT INTO schedules (id, cron, description, job_type, prompt, assigned_to, project_name, active, use_crontab, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?, ?)`,
+    args: [
+      id,
+      input.cron,
+      input.description,
+      input.jobType ?? "report",
+      prompt,
+      input.assignedTo ?? null,
+      input.projectName ?? null,
+      input.useCrontab ? 1 : 0,
+      now
+    ]
+  });
+  if (input.useCrontab) {
+    addToCrontab(id, input.cron, prompt, input.projectName);
+  }
+  return {
+    id,
+    cron: input.cron,
+    description: input.description,
+    jobType: input.jobType ?? "report",
+    prompt,
+    assignedTo: input.assignedTo,
+    projectName: input.projectName,
+    active: true,
+    useCrontab: input.useCrontab ?? false,
+    createdAt: now
+  };
+}
+async function listSchedules(activeOnly = true) {
+  await ensureDb();
+  const client = getClient();
+  const sql = activeOnly ? "SELECT * FROM schedules WHERE active = 1 ORDER BY created_at ASC" : "SELECT * FROM schedules ORDER BY created_at ASC";
+  const result = await client.execute({ sql, args: [] });
+  return result.rows.map((row) => ({
+    id: String(row.id),
+    cron: String(row.cron),
+    description: String(row.description),
+    jobType: String(row.job_type),
+    prompt: row.prompt ? String(row.prompt) : void 0,
+    assignedTo: row.assigned_to ? String(row.assigned_to) : void 0,
+    projectName: row.project_name ? String(row.project_name) : void 0,
+    active: Number(row.active) === 1,
+    useCrontab: Number(row.use_crontab) === 1,
+    createdAt: String(row.created_at)
+  }));
+}
+async function deleteSchedule(id) {
+  await ensureDb();
+  const client = getClient();
+  const existing = await client.execute({
+    sql: "SELECT use_crontab FROM schedules WHERE id = ?",
+    args: [id]
+  });
+  if (existing.rows.length === 0) return false;
+  const usesCrontab = Number(existing.rows[0].use_crontab) === 1;
+  await client.execute({
+    sql: "DELETE FROM schedules WHERE id = ?",
+    args: [id]
+  });
+  if (usesCrontab) {
+    removeFromCrontab(id);
+  }
+  return true;
+}
+function addToCrontab(id, cron, prompt, projectDir) {
+  if (!isValidCron(cron)) {
+    throw new Error(`Invalid cron expression: ${cron}`);
+  }
+  if (!isValidScheduleId(id)) {
+    throw new Error(`Invalid schedule ID: ${id}`);
+  }
+  try {
+    const cwd = projectDir ? `cd ${JSON.stringify(projectDir)} && ` : "";
+    const escapedPrompt = prompt.replace(/"/g, '\\"');
+    const entry = `${cron} ${cwd}claude -p --dangerously-skip-permissions "${escapedPrompt}" # exe-schedule:${id}`;
+    execSync(
+      `(crontab -l 2>/dev/null; echo ${JSON.stringify(entry)}) | crontab -`,
+      { timeout: 5e3, stdio: "ignore" }
+    );
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Invalid")) throw err;
+  }
+}
+function removeFromCrontab(id) {
+  if (!isValidScheduleId(id)) return;
+  try {
+    execSync(
+      `crontab -l 2>/dev/null | grep -v "exe-schedule:${id}" | crontab -`,
+      { timeout: 5e3, stdio: "ignore" }
+    );
+  } catch {
+  }
+}
+
+export {
+  parseHumanCron,
+  createSchedule,
+  listSchedules,
+  deleteSchedule
+};

package/dist/chunk-HNGNZU62.js

@@ -0,0 +1,240 @@
+import {
+  getClient,
+  isCoordinatorName,
+  loadEmployeesSync
+} from "./chunk-XABJRAUW.js";
+
+// src/lib/steward-gate.ts
+import crypto from "crypto";
+var ROLE_PERMISSIONS = {
+  coordinator: /* @__PURE__ */ new Set([
+    "close_task",
+    "cancel_task",
+    "merge_entities",
+    "purge_document",
+    "deactivate_behavior",
+    "override"
+  ]),
+  manager: /* @__PURE__ */ new Set([
+    "close_task",
+    // their team only — enforced contextually
+    "deactivate_behavior"
+    // their team's behaviors
+  ]),
+  specialist: /* @__PURE__ */ new Set([
+    "deactivate_behavior_own",
+    // own behaviors only
+    "delete_own_memory"
+  ])
+};
+var UNIVERSAL_OPS = /* @__PURE__ */ new Set([
+  "update_own_task",
+  "store_memory",
+  "store_behavior"
+]);
+var MANAGER_ROLES = /* @__PURE__ */ new Set(["CTO", "CMO"]);
+var StewardGate = class {
+  /**
+   * Check whether an agent has authority for a destructive operation.
+   */
+  async checkAuthority(agent, operation, target) {
+    const role = await this.resolveRole(agent);
+    if (UNIVERSAL_OPS.has(operation)) {
+      const decision2 = {
+        allowed: true,
+        reason: `Operation "${operation}" is universally permitted.`,
+        confidence: 1,
+        requires_override: false
+      };
+      await this.logDecision(agent, operation, target, decision2);
+      return decision2;
+    }
+    const permissions = ROLE_PERMISSIONS[role];
+    let allowed = permissions.has(operation);
+    let reason;
+    if (!allowed && role === "specialist" && operation === "deactivate_behavior") {
+      const isOwn = await this.isOwnBehavior(agent, target);
+      if (isOwn) {
+        allowed = true;
+        reason = `Specialist "${agent}" can deactivate their own behavior.`;
+      } else {
+        reason = `Specialist "${agent}" cannot deactivate behaviors belonging to other agents.`;
+      }
+    } else if (allowed) {
+      reason = `Role "${role}" has authority for "${operation}".`;
+    } else {
+      reason = `Role "${role}" does not have authority for "${operation}". Requires coordinator override.`;
+    }
+    let requiresOverride = !allowed;
+    let confidence = allowed ? 0.95 : 0.9;
+    try {
+      const dreamingPath = "./dreaming.js";
+      const dreaming = await import(
+        /* @vite-ignore */
+        dreamingPath
+      );
+      if (typeof dreaming.calculateDrift === "function") {
+        const driftScore = await dreaming.calculateDrift(agent);
+        if (typeof driftScore === "number" && driftScore > 0.8) {
+          requiresOverride = true;
+          confidence = Math.max(0.5, confidence - 0.3);
+          reason += ` (\u26A0\uFE0F High drift score: ${driftScore.toFixed(2)} \u2014 requires override.)`;
+        }
+      }
+    } catch {
+    }
+    const decision = {
+      allowed: allowed && !requiresOverride,
+      reason,
+      confidence,
+      requires_override: requiresOverride
+    };
+    await this.logDecision(agent, operation, target, decision);
+    return decision;
+  }
+  /**
+   * Record an explicit coordinator override that bypasses the gate.
+   */
+  async override(agent, operation, target, reason) {
+    const role = await this.resolveRole(agent);
+    if (role !== "coordinator") {
+      const decision2 = {
+        allowed: false,
+        reason: `Only coordinators can issue overrides. "${agent}" is a ${role}.`,
+        confidence: 1,
+        requires_override: false
+      };
+      await this.logDecision(agent, `override:${operation}`, target, decision2);
+      return decision2;
+    }
+    const decision = {
+      allowed: true,
+      reason: `Coordinator override: ${reason}`,
+      confidence: 1,
+      requires_override: false
+    };
+    await this.logDecision(agent, `override:${operation}`, target, decision);
+    return decision;
+  }
+  /**
+   * Query the audit trail.
+   */
+  async getAuditLog(opts) {
+    await this.ensureAuditTable();
+    const client = getClient();
+    const conditions = [];
+    const args = [];
+    if (opts?.agent) {
+      conditions.push("agent = ?");
+      args.push(opts.agent);
+    }
+    if (opts?.operation) {
+      conditions.push("operation = ?");
+      args.push(opts.operation);
+    }
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const limit = opts?.limit ?? 50;
+    const result = await client.execute({
+      sql: `SELECT * FROM steward_audit ${where} ORDER BY created_at DESC LIMIT ?`,
+      args: [...args, limit]
+    });
+    return result.rows.map((row) => ({
+      id: String(row.id),
+      agent: String(row.agent),
+      operation: String(row.operation),
+      target: String(row.target),
+      decision: {
+        allowed: Number(row.allowed) === 1,
+        reason: String(row.reason),
+        confidence: Number(row.confidence),
+        requires_override: Number(row.requires_override) === 1
+      },
+      timestamp: String(row.created_at)
+    }));
+  }
+  // -------------------------------------------------------------------------
+  // Internal methods
+  // -------------------------------------------------------------------------
+  /**
+   * Resolve an agent name to a role category.
+   */
+  async resolveRole(agent) {
+    if (isCoordinatorName(agent)) return "coordinator";
+    try {
+      const employees = loadEmployeesSync();
+      const employee = employees.find((e) => e.name === agent);
+      if (employee && MANAGER_ROLES.has(employee.role)) return "manager";
+    } catch {
+    }
+    return "specialist";
+  }
+  /**
+   * Check if a behavior belongs to the given agent.
+   */
+  async isOwnBehavior(agent, behaviorId) {
+    try {
+      const client = getClient();
+      const result = await client.execute({
+        sql: "SELECT agent_id FROM behaviors WHERE id = ? LIMIT 1",
+        args: [behaviorId]
+      });
+      if (result.rows.length === 0) return false;
+      return String(result.rows[0].agent_id) === agent;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Ensure the steward_audit table exists.
+   */
+  async ensureAuditTable() {
+    const client = getClient();
+    await client.execute({
+      sql: `CREATE TABLE IF NOT EXISTS steward_audit (
+        id                TEXT PRIMARY KEY,
+        agent             TEXT NOT NULL,
+        operation         TEXT NOT NULL,
+        target            TEXT NOT NULL,
+        allowed           INTEGER NOT NULL,
+        reason            TEXT NOT NULL,
+        confidence        REAL NOT NULL,
+        requires_override INTEGER NOT NULL DEFAULT 0,
+        created_at        TEXT NOT NULL
+      )`,
+      args: []
+    });
+  }
+  /**
+   * Log a gate decision to the audit trail.
+   */
+  async logDecision(agent, operation, target, decision) {
+    try {
+      await this.ensureAuditTable();
+      const client = getClient();
+      await client.execute({
+        sql: `INSERT INTO steward_audit (id, agent, operation, target, allowed, reason, confidence, requires_override, created_at)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          crypto.randomUUID(),
+          agent,
+          operation,
+          target,
+          decision.allowed ? 1 : 0,
+          decision.reason,
+          decision.confidence,
+          decision.requires_override ? 1 : 0,
+          (/* @__PURE__ */ new Date()).toISOString()
+        ]
+      });
+    } catch {
+      process.stderr.write(
+        `[steward-gate] Audit log write failed for ${agent}:${operation}
+`
+      );
+    }
+  }
+};
+
+export {
+  StewardGate
+};