@cohortapp/agent-sdk 2.3.0

package/scripts/media-generation/veo-video-client.mjs

@@ -0,0 +1,219 @@
+/**
+ * Veo 3.1 Video Generation Client for Northwind CEO Brain
+ *
+ * Generates branded video assets for presentations, social media,
+ * and corporate communications.
+ *
+ * Ported from ~/company-web/app/scripts/media-generation/veo-video-client.mjs
+ *
+ * Usage:
+ *   import { createText2Video, createImage2Video, downloadVideo } from './veo-video-client.mjs';
+ *
+ *   const result = await createText2Video('A professional...', { duration: '8' });
+ *   await downloadVideo(result, 'output.mp4');
+ */
+
+import "dotenv/config";
+
+import fs from "fs/promises";
+import path from "path";
+import { GoogleGenAI } from "@google/genai";
+
+const DEFAULT_MODEL = "veo-3.1-generate-preview";
+const DEFAULT_DURATION = "8";
+const DEFAULT_RESOLUTION = "720p";
+const POLL_INTERVAL = 10000;
+const POLL_TIMEOUT = 600000;
+
+let client = null;
+
+function getClient() {
+  if (client) return client;
+
+  const apiKey = process.env.GEMINI_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "GEMINI_API_KEY environment variable is required.\n" +
+        "Add it to config/environment.yaml or .env file.\n" +
+        "Get your key from: https://aistudio.google.com/apikey",
+    );
+  }
+
+  client = new GoogleGenAI({ apiKey });
+  return client;
+}
+
+async function pollOperation(operation, options = {}) {
+  const ai = getClient();
+  const interval = options.interval || POLL_INTERVAL;
+  const timeout = options.timeout || POLL_TIMEOUT;
+  const startTime = Date.now();
+
+  console.log(
+    `   [Veo] Polling operation (interval: ${interval / 1000}s, timeout: ${timeout / 1000}s)`,
+  );
+
+  while (!operation.done) {
+    const elapsed = Date.now() - startTime;
+    if (elapsed > timeout) {
+      throw new Error(`Veo operation timed out after ${timeout / 1000}s`);
+    }
+
+    console.log(
+      `   [Veo] Status: processing (${Math.round(elapsed / 1000)}s elapsed)`,
+    );
+
+    await new Promise((resolve) => setTimeout(resolve, interval));
+    operation = await ai.operations.getVideosOperation({ operation });
+  }
+
+  console.log(`   [Veo] Operation completed successfully`);
+  return operation;
+}
+
+/**
+ * Create a text-to-video generation task.
+ *
+ * @param {string} prompt - Text description of the video
+ * @param {object} options
+ * @param {string} options.model - Model name (default: veo-3.1-generate-preview)
+ * @param {string} options.duration - '4', '6', or '8' seconds (default: '8')
+ * @param {string} options.aspectRatio - '16:9' or '9:16' (default: '16:9')
+ * @param {string} options.resolution - '720p', '1080p', '4k' (default: '720p')
+ * @param {string} options.negativePrompt - Content to exclude
+ */
+export async function createText2Video(prompt, options = {}) {
+  const ai = getClient();
+  const model = options.model || DEFAULT_MODEL;
+  const duration = options.duration || DEFAULT_DURATION;
+  const aspectRatio = options.aspectRatio || "16:9";
+  const resolution = options.resolution || DEFAULT_RESOLUTION;
+
+  console.log(`   [Veo] Creating text2video task...`);
+  console.log(`   [Veo] Model: ${model}`);
+  console.log(
+    `   [Veo] Duration: ${duration}s, Aspect: ${aspectRatio}, Resolution: ${resolution}`,
+  );
+
+  const config = {
+    aspectRatio,
+    durationSeconds: parseInt(duration, 10),
+    resolution,
+  };
+
+  if (options.negativePrompt) {
+    config.negativePrompt = options.negativePrompt;
+  }
+
+  let operation = await ai.models.generateVideos({
+    model,
+    prompt,
+    config,
+  });
+
+  console.log(`   [Veo] Task submitted, polling for completion...`);
+  operation = await pollOperation(operation);
+
+  return operation;
+}
+
+/**
+ * Create an image-to-video generation task.
+ *
+ * @param {string} imagePathOrUrl - Local PNG path or URL
+ * @param {string} prompt - Motion description
+ * @param {object} options - Same as createText2Video
+ */
+export async function createImage2Video(imagePathOrUrl, prompt, options = {}) {
+  const ai = getClient();
+  const model = options.model || DEFAULT_MODEL;
+  const duration = options.duration || DEFAULT_DURATION;
+  const aspectRatio = options.aspectRatio || "16:9";
+  const resolution = options.resolution || DEFAULT_RESOLUTION;
+
+  let image;
+
+  if (
+    imagePathOrUrl.startsWith("http://") ||
+    imagePathOrUrl.startsWith("https://")
+  ) {
+    console.log(`   [Veo] Fetching source image from URL...`);
+    const response = await fetch(imagePathOrUrl);
+    const buffer = Buffer.from(await response.arrayBuffer());
+    image = { imageBytes: buffer.toString("base64"), mimeType: "image/png" };
+  } else {
+    const imageBuffer = await fs.readFile(imagePathOrUrl);
+    console.log(
+      `   [Veo] Read source image: ${imagePathOrUrl} (${Math.round(imageBuffer.length / 1024)} KB)`,
+    );
+    image = {
+      imageBytes: imageBuffer.toString("base64"),
+      mimeType: "image/png",
+    };
+  }
+
+  console.log(`   [Veo] Creating image2video task...`);
+  console.log(`   [Veo] Model: ${model}`);
+
+  const config = {
+    aspectRatio,
+    durationSeconds: parseInt(duration, 10),
+    resolution,
+  };
+
+  if (options.negativePrompt) {
+    config.negativePrompt = options.negativePrompt;
+  }
+
+  let operation = await ai.models.generateVideos({
+    model,
+    prompt: prompt || "",
+    image,
+    config,
+  });
+
+  console.log(`   [Veo] Task submitted, polling for completion...`);
+  operation = await pollOperation(operation);
+
+  return operation;
+}
+
+/**
+ * Download a video from a completed Veo operation.
+ */
+export async function downloadVideo(operation, outputPath) {
+  const ai = getClient();
+
+  const generatedVideos = operation.response?.generatedVideos;
+  if (!generatedVideos || generatedVideos.length === 0) {
+    throw new Error("Operation completed but no video was returned");
+  }
+
+  const video = generatedVideos[0].video;
+
+  console.log(`   [Veo] Downloading video to: ${outputPath}`);
+  await fs.mkdir(path.dirname(outputPath), { recursive: true });
+
+  const maxRetries = 3;
+  for (let attempt = 1; attempt <= maxRetries; attempt++) {
+    try {
+      await ai.files.download({ file: video, downloadPath: outputPath });
+      break;
+    } catch (err) {
+      if (attempt === maxRetries) throw err;
+      console.log(
+        `   [Veo] Download attempt ${attempt} failed (${err.message}), retrying in 5s...`,
+      );
+      await new Promise((r) => setTimeout(r, 5000));
+    }
+  }
+
+  const stats = await fs.stat(outputPath);
+  console.log(`   [Veo] Downloaded: ${Math.round(stats.size / 1024)} KB`);
+}
+
+export default {
+  createText2Video,
+  createImage2Video,
+  downloadVideo,
+};

package/scripts/org/send-orgmail.mjs

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+/**
+ * send-orgmail.mjs — the sanctioned CLI lane for workspace email sends.
+ *
+ * Thin CLI over the org client's `emailSend` (companion spec 2026-07-21 §9.3).
+ * Sessions reply to workspace email with THIS script — never raw curl, never
+ * the MCP `email_send` tool (hook-blocked in agent repos): this lane runs the
+ * local outbound send-gate first and drives the first-contact approval flow;
+ * hq's server-side guardrails (per-recipient first-contact policy, caps, loop
+ * guards) remain authoritative.
+ *
+ * Usage:
+ *   node scripts/org/send-orgmail.mjs --thread "<thread_id>" --body-file reply.md
+ *   node scripts/org/send-orgmail.mjs --to a@x.com,b@y.com --subject "Hi" --body "text"
+ *   node scripts/org/send-orgmail.mjs --thread T --body B --reply-to-message <id>
+ *   … --request-approval [--wait]     file the external_comms approval on
+ *                                     approval_required (and long-poll it),
+ *                                     then re-send with the granted approvalId.
+ *
+ * Flags:
+ *   --thread <id>             reply into an existing thread (recipients +
+ *                             subject derive server-side from the thread's
+ *                             newest delivered inbound message)
+ *   --to a@b.com[,c@d.com]    explicit recipients (repeatable / comma-lists)
+ *   --cc / --bcc              extra recipients (same syntax)
+ *   --subject <s>             subject (required for new threads)
+ *   --body <text> | --body-file <path>
+ *   --reply-to-message <id>   reply to a specific message (In-Reply-To)
+ *   --request-approval        on approval_required, file approval.request
+ *   --wait                    with --request-approval: approval.wait until
+ *                             decided (bounded polls), then re-send
+ *
+ * Exit code 0 ONLY on a `queued` or `deduped` send result.
+ *
+ * Idempotency: ONE business `idempotencyId` per invocation (stable across the
+ * approval re-send — hq dedups on it), and a FRESH dispatcher
+ * `x-idempotency-key` per network attempt (mandatory: `email.send` is
+ * idempotent:true, so the approval_required refusal was cached under the old
+ * header key — companion §8.2). The approved re-send passes the intent's
+ * explicit resolved to/cc/bcc rather than re-deriving from --thread, so the
+ * approval's payload hash stays stable even if newer mail arrived meanwhile.
+ */
+
+"use strict";
+
+import { readFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { emailSend } from "../../lib/org/ui-parity.mjs";
+import { call, approvalWait } from "../../lib/org/client.mjs";
+import { resolveOrgToolConfig } from "../../lib/org/tool-surface.mjs";
+import { applyBrandEnvCompat } from "../../lib/env-compat.mjs";
+
+// Fleet back-compat FIRST: bridge NEOLITH_* ⇄ COHORT_* env names before the
+// env-first credential resolution (COHORT_API_TOKEN et al.) kicks in.
+applyBrandEnvCompat();
+
+function parseArgs(argv) {
+  const flags = { to: [], cc: [], bcc: [] };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    const next = () => { i += 1; return argv[i]; };
+    switch (a) {
+      case "--thread": flags.thread = next(); break;
+      case "--to": flags.to.push(...String(next()).split(",")); break;
+      case "--cc": flags.cc.push(...String(next()).split(",")); break;
+      case "--bcc": flags.bcc.push(...String(next()).split(",")); break;
+      case "--subject": flags.subject = next(); break;
+      case "--body": flags.body = next(); break;
+      case "--body-file": flags.bodyFile = next(); break;
+      case "--reply-to-message": flags.replyToMessageId = next(); break;
+      case "--request-approval": flags.requestApproval = true; break;
+      case "--wait": flags.wait = true; break;
+      case "--help": case "-h": flags.help = true; break;
+      default:
+        console.error(`send-orgmail: unknown flag ${a}`);
+        process.exit(2);
+    }
+  }
+  flags.to = flags.to.map((s) => s.trim().toLowerCase()).filter(Boolean);
+  flags.cc = flags.cc.map((s) => s.trim().toLowerCase()).filter(Boolean);
+  flags.bcc = flags.bcc.map((s) => s.trim().toLowerCase()).filter(Boolean);
+  return flags;
+}
+
+function usage() {
+  console.log('Usage: node scripts/org/send-orgmail.mjs --thread "<thread_id>" --body-file <path>');
+  console.log("       node scripts/org/send-orgmail.mjs --to a@x.com --subject 'Hi' --body 'text' [--request-approval [--wait]]");
+}
+
+/** Belt-and-braces local screen; the server guardrails stay authoritative. */
+async function screenLocally(text, recipients, agentRoot) {
+  try {
+    const { screenOutbound } = await import("../../lib/comms/send-gate.mjs");
+    const verdict = await screenOutbound({
+      channel: "orgmail",
+      recipient: recipients.join(",") || "(thread)",
+      text,
+      agentRoot,
+    });
+    if (verdict && verdict.allow === false) {
+      console.error(`send-orgmail: BLOCKED by the outbound send-gate — ${verdict.reason || "policy"}`);
+      process.exit(1);
+    }
+    return typeof verdict?.redactedText === "string" ? verdict.redactedText : text;
+  } catch {
+    return text; // gate unavailable → server guardrails still apply
+  }
+}
+
+async function main() {
+  const flags = parseArgs(process.argv.slice(2));
+  if (flags.help) { usage(); process.exit(0); }
+
+  let body = flags.body;
+  if (!body && flags.bodyFile) body = readFileSync(flags.bodyFile, "utf8");
+  if (!body || !String(body).trim()) {
+    console.error("send-orgmail: --body or --body-file required");
+    usage();
+    process.exit(2);
+  }
+  if (!flags.thread && !flags.replyToMessageId && flags.to.length === 0) {
+    console.error("send-orgmail: --thread, --reply-to-message, or --to required");
+    process.exit(2);
+  }
+
+  const cfg = resolveOrgToolConfig({});
+  if (!cfg.token || !cfg.base) {
+    console.error("send-orgmail: no org credential — set COHORT_API_TOKEN or run `cohort setup --only org`");
+    process.exit(1);
+  }
+  const o = { base: cfg.base, token: cfg.token, orgId: cfg.orgId };
+
+  const text = await screenLocally(String(body), [...flags.to, ...flags.cc, ...flags.bcc], cfg.agentRoot);
+
+  // ONE business id per invocation; hq dedups on (mailbox, idempotencyId).
+  const idempotencyId = randomUUID();
+  const baseParams = { text, idempotencyId };
+  if (flags.thread) baseParams.threadId = flags.thread;
+  if (flags.replyToMessageId) baseParams.replyToMessageId = flags.replyToMessageId;
+  if (flags.to.length) baseParams.to = flags.to;
+  if (flags.cc.length) baseParams.cc = flags.cc;
+  if (flags.bcc.length) baseParams.bcc = flags.bcc;
+  if (flags.subject) baseParams.subject = flags.subject;
+
+  let frame = await emailSend(baseParams, { ...o, idempotencyKey: randomUUID() });
+  if (!frame.ok) {
+    console.error(`send-orgmail: ${frame.error?.code || "ERROR"} — ${frame.error?.message || "email.send failed"}`);
+    process.exit(1);
+  }
+
+  if (frame.result?.status === "approval_required") {
+    const approval = frame.result.approval || {};
+    const firstContact = frame.result.firstContactRecipients || [];
+    console.log("send-orgmail: first-contact approval required (actionClass external_comms)");
+    console.log(`  first-contact recipients: ${firstContact.join(", ") || "(unknown)"}`);
+    console.log(`  payloadHash: ${approval.payloadHash || "(none)"}`);
+    console.log(`  intent: ${JSON.stringify(approval.intent || {}, null, 2)}`);
+
+    if (!flags.requestApproval) {
+      console.log("re-run with --request-approval [--wait] to file the approval and re-send once granted.");
+      process.exit(1);
+    }
+
+    const req = await call(
+      "approval.request",
+      {
+        actionClass: approval.actionClass || "external_comms",
+        payload: approval.intent || {},
+        payloadHash: approval.payloadHash,
+        subject: `workspace email first-contact: ${firstContact.join(", ")}`.slice(0, 200),
+      },
+      { ...o, idempotencyKey: `orgmail-approval:${idempotencyId}` },
+    );
+    if (!req.ok) {
+      console.error(`send-orgmail: approval.request failed — ${req.error?.code}: ${req.error?.message}`);
+      process.exit(1);
+    }
+    const approvalId = req.result?.id || req.result?.approvalId;
+    console.log(`approval filed: ${approvalId} — a human must approve it in Cohort (/decisions).`);
+    if (!approvalId) process.exit(1);
+
+    if (!flags.wait) {
+      console.log(`once approved, this invocation cannot be resumed — re-run with --wait next time, or re-send with the SAME recipients and the granted approvalId.`);
+      process.exit(1);
+    }
+
+    // Bounded long-polls (server clamps each to ≤55s) up to ~10 minutes.
+    const deadline = Date.now() + 10 * 60 * 1000;
+    let status = "pending";
+    while (Date.now() < deadline) {
+      const w = await approvalWait({ id: approvalId, timeoutMs: 55_000 }, o);
+      status = w?.payload?.status || status;
+      if (status && status !== "pending" && status !== "requested") break;
+    }
+    if (status !== "approved") {
+      console.error(`send-orgmail: approval not granted (status: ${status}) — nothing sent.`);
+      process.exit(1);
+    }
+
+    // Hash-stable re-send: the intent's explicit RESOLVED recipients, never a
+    // re-derivation from --thread; SAME idempotencyId; FRESH dispatcher key.
+    const intent = approval.intent || {};
+    const resend = { ...baseParams, approvalId };
+    if (Array.isArray(intent.to) && intent.to.length) resend.to = intent.to;
+    if (Array.isArray(intent.cc) && intent.cc.length) resend.cc = intent.cc;
+    if (Array.isArray(intent.bcc) && intent.bcc.length) resend.bcc = intent.bcc;
+    if (intent.subject) resend.subject = intent.subject;
+    frame = await emailSend(resend, { ...o, idempotencyKey: randomUUID() });
+    if (!frame.ok) {
+      console.error(`send-orgmail: approved re-send failed — ${frame.error?.code}: ${frame.error?.message}`);
+      process.exit(1);
+    }
+  }
+
+  const status = frame.result?.status;
+  if (status === "queued" || status === "deduped") {
+    console.log(`send-orgmail: ${status} — messageId ${frame.result.messageId} threadId ${frame.result.threadId}`);
+    process.exit(0);
+  }
+  console.error(`send-orgmail: unexpected result status ${status || "(none)"} — ${JSON.stringify(frame.result || {})}`);
+  process.exit(1);
+}
+
+main().catch((err) => {
+  console.error(`send-orgmail: ${err && err.message ? err.message : err}`);
+  process.exit(1);
+});

package/scripts/outbound-dedup-cleanup.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# outbound-dedup-cleanup.sh — Cron-compatible cleanup for outbound dedup locks
+#
+# Removes all lock directories older than 5 minutes from state/locks/outbound/
+# Also cleans the legacy Slack locks in state/locks/slack-response/
+#
+# Intended to be run by launchd or cron every 5 minutes:
+#   */5 * * * * <AGENT_REPO_DIR>/scripts/outbound-dedup-cleanup.sh
+#
+# Or via launchd plist with StartInterval: 300
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+AGENT_REPO_DIR="${AGENT_DIR:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+LOG_DIR="$AGENT_REPO_DIR/logs/audit"
+TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+mkdir -p "$LOG_DIR"
+
+# Clean generalized outbound locks (5 min TTL)
+OUTBOUND_RESULT=""
+if [ -x "$SCRIPT_DIR/outbound-dedup.sh" ]; then
+  OUTBOUND_RESULT=$("$SCRIPT_DIR/outbound-dedup.sh" cleanup 5 2>/dev/null) || true
+fi
+
+# Clean legacy Slack response locks (5 min for active dedup, 24h for full purge)
+SLACK_RESULT=""
+if [ -x "$SCRIPT_DIR/slack-responded.sh" ]; then
+  SLACK_RESULT=$("$SCRIPT_DIR/slack-responded.sh" clean 2>/dev/null) || true
+fi
+
+# Log the cleanup
+AUDIT_FILE="$LOG_DIR/$(date +%Y-%m-%d)-actions.jsonl"
+printf '{"timestamp":"%s","agent":"outbound-dedup-cleanup","action":"scheduled_cleanup","outbound_result":"%s","slack_result":"%s"}\n' \
+  "$TIMESTAMP" \
+  "$(printf '%s' "$OUTBOUND_RESULT" | tr '"' "'" | tr '\n' ' ')" \
+  "$(printf '%s' "$SLACK_RESULT" | tr '"' "'" | tr '\n' ' ')" \
+  >> "$AUDIT_FILE" 2>/dev/null || true
+
+# Output for manual runs / cron logging
+echo "[$TIMESTAMP] Outbound dedup cleanup complete"
+[ -n "$OUTBOUND_RESULT" ] && echo "  $OUTBOUND_RESULT"
+[ -n "$SLACK_RESULT" ] && echo "  Slack: $SLACK_RESULT"