@crewx/workflow 0.3.22-rc.192 → 0.3.22-rc.194

package/dist/src/types.d.ts

@@ -142,4 +142,4 @@ export interface AutoRunResult {
     reason?: string;
     executed: string[];
 }
-//# sourceMappingURL=types.d.ts.map
+                                   

package/dist/src/types.js

@@ -1,5 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NEVER_RETRYABLE = void 0;
-exports.NEVER_RETRYABLE = ['CANCELLED', 'CONFIG_INVALID'];
-//# sourceMappingURL=types.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.NEVER_RETRYABLE=void 0;exports.NEVER_RETRYABLE=["CANCELLED","CONFIG_INVALID"];

package/dist/src/utils/output-format.d.ts

@@ -15,4 +15,4 @@ export declare function buildJsonOutputSuffix(schema?: JsonSchema, strict?: bool
 export declare function extractJson(text: string): string;
 export declare function validateJsonSchema(value: unknown, schema: JsonSchema): Promise<void>;
 export declare function toOpenAIStrictSchema(schema: JsonSchema): JsonSchema;
-//# sourceMappingURL=output-format.d.ts.map
+                                           

package/dist/src/utils/output-format.js

@@ -1,53 +1,8 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKFLOW_SIGNAL_KEY = void 0;
-exports.buildWorkflowPreamble = buildWorkflowPreamble;
-exports.detectWorkflowSignal = detectWorkflowSignal;
-exports.buildJsonOutputSuffix = buildJsonOutputSuffix;
-exports.extractJson = extractJson;
-exports.validateJsonSchema = validateJsonSchema;
-exports.toOpenAIStrictSchema = toOpenAIStrictSchema;
-const node_crypto_1 = require("node:crypto");
-exports.WORKFLOW_SIGNAL_KEY = 'workflow_signal';
-function buildWorkflowPreamble(ctx) {
-    return `<crewx.workflow>
+"use strict";var y=exports&&exports.__createBinding||(Object.create?(function(n,e,r,t){if(t===void 0)t=r;var o=Object.getOwnPropertyDescriptor(e,r);if(!o||("get"in o?!e.__esModule:o.writable||o.configurable)){o={enumerable:true,get:function(){return e[r]}}}Object.defineProperty(n,t,o)}):(function(n,e,r,t){if(t===void 0)t=r;n[t]=e[r]}));var _=exports&&exports.__setModuleDefault||(Object.create?(function(n,e){Object.defineProperty(n,"default",{enumerable:true,value:e})}):function(n,e){n["default"]=e});var v=exports&&exports.__importStar||(function(){var n=function(e){n=Object.getOwnPropertyNames||function(r){var t=[];for(var o in r)if(Object.prototype.hasOwnProperty.call(r,o))t[t.length]=o;return t};return n(e)};return function(e){if(e&&e.__esModule)return e;var r={};if(e!=null){for(var t=n(e),o=0;o<t.length;o++)if(t[o]!=="default")y(r,e,t[o])}_(r,e);return r}})();Object.defineProperty(exports,"__esModule",{value:true});exports.WORKFLOW_SIGNAL_KEY=void 0;exports.buildWorkflowPreamble=j;exports.detectWorkflowSignal=E;exports.buildJsonOutputSuffix=P;exports.extractJson=O;exports.validateJsonSchema=W;exports.toOpenAIStrictSchema=S;const N=require("node:crypto");exports.WORKFLOW_SIGNAL_KEY="workflow_signal";function j(n){return`<crewx.workflow>
 ## Execution Context
-You are running headless as node "${ctx.nodeId}" of workflow "${ctx.workflowId}" (run ${ctx.execId}).
+You are running headless as node "${n.nodeId}" of workflow "${n.workflowId}" (run ${n.execId}).
 - No human is watching this session. NEVER ask clarifying questions or wait for
-  confirmation — state your assumptions and proceed, or report failure.
+  confirmation \u2014 state your assumptions and proceed, or report failure.
 - Your output is consumed verbatim by downstream nodes. Output the result only;
   skip greetings, progress notes, and meta commentary.
 - If the task cannot be completed (broken precondition, missing data, failed
@@ -57,167 +12,18 @@ You are running headless as node "${ctx.nodeId}" of workflow "${ctx.workflowId}"
   The engine will halt the workflow at this node and record the reason.
 </crewx.workflow>
 
-`;
-}
-function detectWorkflowSignal(output) {
-    if (!output.includes(`"${exports.WORKFLOW_SIGNAL_KEY}"`))
-        return null;
-    const toSignal = (parsed) => {
-        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) &&
-            parsed[exports.WORKFLOW_SIGNAL_KEY] === 'fail') {
-            const reason = parsed['reason'];
-            return { signal: 'fail', ...(typeof reason === 'string' && reason ? { reason } : {}) };
-        }
-        return null;
-    };
-    try {
-        const signal = toSignal(JSON.parse(extractJson(output)));
-        if (signal)
-            return signal;
-    }
-    catch { }
-    const inline = output.match(new RegExp(`\\{[^{}]*"${exports.WORKFLOW_SIGNAL_KEY}"\\s*:\\s*"fail"[^{}]*\\}`));
-    if (inline) {
-        try {
-            return toSignal(JSON.parse(inline[0]));
-        }
-        catch {
-            return { signal: 'fail' };
-        }
-    }
-    return null;
-}
-function buildJsonOutputSuffix(schema, strict = false) {
-    const finalSchema = strict && schema ? toOpenAIStrictSchema(schema) : schema;
-    const schemaStr = finalSchema ? `JSON Schema:\n${JSON.stringify(finalSchema, null, 2)}\n` : '';
-    return `\n\n<crewx.workflow>
-## ⚠️ Output Format (read first — drives branch evaluation)
+`}function E(n){if(!n.includes(`"${exports.WORKFLOW_SIGNAL_KEY}"`))return null;const e=t=>{if(typeof t==="object"&&t!==null&&!Array.isArray(t)&&t[exports.WORKFLOW_SIGNAL_KEY]==="fail"){const o=t["reason"];return{signal:"fail",...typeof o==="string"&&o?{reason:o}:{}}}return null};try{const t=e(JSON.parse(O(n)));if(t)return t}catch{}const r=n.match(new RegExp(`\\{[^{}]*"${exports.WORKFLOW_SIGNAL_KEY}"\\s*:\\s*"fail"[^{}]*\\}`));if(r){try{return e(JSON.parse(r[0]))}catch{return{signal:"fail"}}}return null}function P(n,e=false){const r=e&&n?S(n):n;const t=r?`JSON Schema:
+${JSON.stringify(r,null,2)}
+`:"";return`
+
+<crewx.workflow>
+## \u26A0\uFE0F Output Format (read first \u2014 drives branch evaluation)
 
 **The first character of your output MUST be \`{\`. The last character MUST be \`}\`.**
 No other text is permitted (no explanations, greetings, progress notes, or analysis remarks).
 **NEVER use markdown code fences (\`\`\`json ... \`\`\`).** Do not output even a single backtick.
-Branch evaluation calls \`JSON.parse(state.<output>)\` directly —
+Branch evaluation calls \`JSON.parse(state.<output>)\` directly \u2014
 even one non-JSON character at start or end will halt the workflow.
 
-${schemaStr}Execute the task, then output **exactly one JSON object** matching the schema above. Nothing else.
-</crewx.workflow>`;
-}
-function extractJson(text) {
-    let trimmed = text.trim();
-    const fenceMatch = trimmed.match(/^```(?:json|JSON)?\s*\n?([\s\S]*?)\n?```\s*$/);
-    if (fenceMatch && fenceMatch[1] !== undefined) {
-        trimmed = fenceMatch[1].trim();
-    }
-    const collectSpans = (s, open, close) => {
-        const spans = [];
-        let inString = false;
-        let escape = false;
-        let depth = 0;
-        let spanStart = -1;
-        for (let i = 0; i < s.length; i++) {
-            const ch = s[i];
-            if (escape) {
-                escape = false;
-                continue;
-            }
-            if (inString) {
-                if (ch === '\\') {
-                    escape = true;
-                    continue;
-                }
-                if (ch === '"') {
-                    inString = false;
-                }
-                continue;
-            }
-            if (ch === '"') {
-                inString = true;
-                continue;
-            }
-            if (ch === open) {
-                if (depth === 0)
-                    spanStart = i;
-                depth++;
-            }
-            else if (ch === close) {
-                if (depth > 0) {
-                    depth--;
-                    if (depth === 0 && spanStart !== -1) {
-                        spans.push({ text: s.slice(spanStart, i + 1), start: spanStart, end: i });
-                        spanStart = -1;
-                    }
-                }
-            }
-        }
-        return spans;
-    };
-    const objSpans = collectSpans(trimmed, '{', '}');
-    const arrSpans = collectSpans(trimmed, '[', ']');
-    const candidates = [...objSpans, ...arrSpans].sort((a, b) => b.end - a.end);
-    for (const candidate of candidates) {
-        try {
-            JSON.parse(candidate.text);
-            return candidate.text;
-        }
-        catch {
-        }
-    }
-    return trimmed;
-}
-async function validateJsonSchema(value, schema) {
-    const { registerSchema, validate } = await Promise.resolve().then(() => __importStar(require('@hyperjump/json-schema/draft-2020-12')));
-    const uri = `urn:crewx:schema:${(0, node_crypto_1.randomUUID)()}`;
-    registerSchema({ $schema: 'https://json-schema.org/draft/2020-12/schema', ...schema }, uri);
-    const result = await validate(uri, value);
-    if (!result.valid) {
-        const errors = (result.errors ?? [])
-            .map((e) => e.instanceLocation)
-            .join('; ');
-        throw new Error(`Schema validation failed: ${errors || 'unknown error'}`);
-    }
-}
-function toOpenAIStrictSchema(schema) {
-    return transformStrict(schema);
-}
-const OPENAI_UNSUPPORTED_KEYWORDS = new Set([
-    'default', 'format', 'pattern', 'minLength', 'maxLength',
-    'minimum', 'maximum', 'not',
-]);
-function transformStrict(schema) {
-    const result = {};
-    for (const [key, value] of Object.entries(schema)) {
-        if (OPENAI_UNSUPPORTED_KEYWORDS.has(key))
-            continue;
-        if (key === 'properties' && isRecord(value)) {
-            const transformed = {};
-            for (const [propKey, propVal] of Object.entries(value)) {
-                transformed[propKey] = transformStrict(propVal);
-            }
-            result['properties'] = transformed;
-            result['required'] = Object.keys(transformed);
-            result['additionalProperties'] = false;
-        }
-        else if (key === 'items' && isRecord(value)) {
-            result['items'] = transformStrict(value);
-        }
-        else if (key === 'required') {
-            if (!('properties' in schema)) {
-                result['required'] = value;
-            }
-        }
-        else if (key === 'additionalProperties') {
-            result['additionalProperties'] = false;
-        }
-        else {
-            result[key] = value;
-        }
-    }
-    if (result['type'] === 'object' && !('additionalProperties' in result)) {
-        result['additionalProperties'] = false;
-    }
-    return result;
-}
-function isRecord(val) {
-    return typeof val === 'object' && val !== null && !Array.isArray(val);
-}
-//# sourceMappingURL=output-format.js.map
+${t}Execute the task, then output **exactly one JSON object** matching the schema above. Nothing else.
+</crewx.workflow>`}function O(n){let e=n.trim();const r=e.match(/^```(?:json|JSON)?\s*\n?([\s\S]*?)\n?```\s*$/);if(r&&r[1]!==void 0){e=r[1].trim()}const t=(i,d,b)=>{const w=[];let h=false;let p=false;let l=0;let u=-1;for(let s=0;s<i.length;s++){const f=i[s];if(p){p=false;continue}if(h){if(f==="\\"){p=true;continue}if(f==='"'){h=false}continue}if(f==='"'){h=true;continue}if(f===d){if(l===0)u=s;l++}else if(f===b){if(l>0){l--;if(l===0&&u!==-1){w.push({text:i.slice(u,s+1),start:u,end:s});u=-1}}}}return w};const o=t(e,"{","}");const a=t(e,"[","]");const c=[...o,...a].sort((i,d)=>d.end-i.end);for(const i of c){try{JSON.parse(i.text);return i.text}catch{}}return e}async function W(n,e){const{registerSchema:r,validate:t}=await Promise.resolve().then(()=>v(require("@hyperjump/json-schema/draft-2020-12")));const o=`urn:crewx:schema:${(0,N.randomUUID)()}`;r({$schema:"https://json-schema.org/draft/2020-12/schema",...e},o);const a=await t(o,n);if(!a.valid){const c=(a.errors??[]).map(i=>i.instanceLocation).join("; ");throw new Error(`Schema validation failed: ${c||"unknown error"}`)}}function S(n){return m(n)}const J=new Set(["default","format","pattern","minLength","maxLength","minimum","maximum","not"]);function m(n){const e={};for(const[r,t]of Object.entries(n)){if(J.has(r))continue;if(r==="properties"&&g(t)){const o={};for(const[a,c]of Object.entries(t)){o[a]=m(c)}e["properties"]=o;e["required"]=Object.keys(o);e["additionalProperties"]=false}else if(r==="items"&&g(t)){e["items"]=m(t)}else if(r==="required"){if(!("properties"in n)){e["required"]=t}}else if(r==="additionalProperties"){e["additionalProperties"]=false}else{e[r]=t}}if(e["type"]==="object"&&!("additionalProperties"in e)){e["additionalProperties"]=false}return e}function g(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}

package/dist/src/utils/shell-security.d.ts

@@ -15,4 +15,4 @@ export interface CwdCheck {
 }
 export declare function normalizeCwd(cwd: string | undefined, projectRoot: string): CwdCheck;
 export declare function buildShellEnv(nodeEnv: Record<string, string> | undefined, parentEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-//# sourceMappingURL=shell-security.d.ts.map
+                                            

package/dist/src/utils/shell-security.js

@@ -1,138 +1 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DANGEROUS_ENV_KEYS = exports.INLINE_CODE_INTERPRETERS = exports.SHELL_DENYLIST = exports.SKILL_NAME_RE = void 0;
-exports.validateShellCommand = validateShellCommand;
-exports.validateEnvKeys = validateEnvKeys;
-exports.normalizeCwd = normalizeCwd;
-exports.buildShellEnv = buildShellEnv;
-const path = __importStar(require("path"));
-const fs = __importStar(require("fs"));
-exports.SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
-exports.SHELL_DENYLIST = new Set([
-    'bash', 'sh', 'zsh', 'dash', 'fish',
-    'cmd', 'cmd.exe', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe',
-]);
-exports.INLINE_CODE_INTERPRETERS = new Set([
-    'python', 'python3', 'node', 'nodejs', 'deno', 'perl', 'ruby', 'php',
-]);
-const INLINE_CODE_FLAGS = new Set(['-c', '-e', '--eval', '--exec']);
-exports.DANGEROUS_ENV_KEYS = new Set([
-    'LD_PRELOAD', 'LD_LIBRARY_PATH', 'LD_AUDIT',
-    'DYLD_INSERT_LIBRARIES', 'DYLD_LIBRARY_PATH', 'DYLD_FRAMEWORK_PATH',
-    'NODE_OPTIONS',
-]);
-function baseName(cmd) {
-    return path.basename(cmd).toLowerCase();
-}
-function validateShellCommand(command) {
-    if (!Array.isArray(command)) {
-        return { ok: false, error: 'shell_task.command must be an array of strings (argv), not a string' };
-    }
-    if (command.length === 0) {
-        return { ok: false, error: 'shell_task.command must not be empty' };
-    }
-    if (!command.every((c) => typeof c === 'string')) {
-        return { ok: false, error: 'shell_task.command must contain only strings' };
-    }
-    const bin = baseName(command[0]);
-    const binNoExt = bin.replace(/\.exe$/, '');
-    if (exports.SHELL_DENYLIST.has(bin) || exports.SHELL_DENYLIST.has(binNoExt)) {
-        return { ok: false, error: `shell_task.command[0] "${command[0]}" is a blocked shell interpreter` };
-    }
-    if (exports.INLINE_CODE_INTERPRETERS.has(binNoExt)) {
-        const hasInlineFlag = command
-            .slice(1)
-            .some((arg) => INLINE_CODE_FLAGS.has(String(arg)));
-        if (hasInlineFlag) {
-            return {
-                ok: false,
-                error: `shell_task.command "${binNoExt} ${command[1]}" uses an inline-code flag (escape vector blocked)`,
-            };
-        }
-    }
-    return { ok: true };
-}
-function validateEnvKeys(env) {
-    if (!env)
-        return { ok: true };
-    for (const key of Object.keys(env)) {
-        if (exports.DANGEROUS_ENV_KEYS.has(key)) {
-            return { ok: false, error: `shell_task.env key "${key}" is not allowed` };
-        }
-    }
-    return { ok: true };
-}
-function normalizeCwd(cwd, projectRoot) {
-    let root;
-    try {
-        root = fs.realpathSync(projectRoot);
-    }
-    catch (error) {
-        return { ok: false, error: `project root "${projectRoot}" is not accessible: ${error.message}` };
-    }
-    if (cwd === undefined || cwd === '') {
-        return { ok: true, resolved: root };
-    }
-    const candidate = path.resolve(root, cwd);
-    let resolved;
-    try {
-        resolved = fs.realpathSync(candidate);
-    }
-    catch (error) {
-        return { ok: false, error: `cwd "${cwd}" is not accessible: ${error.message}` };
-    }
-    if (resolved !== root && !resolved.startsWith(root + path.sep)) {
-        return { ok: false, error: `cwd "${cwd}" resolves outside the project root` };
-    }
-    return { ok: true, resolved };
-}
-function buildShellEnv(nodeEnv, parentEnv = process.env) {
-    const allowlist = process.platform === 'win32'
-        ? ['PATH', 'Path', 'SystemRoot', 'COMSPEC', 'TEMP', 'TMP']
-        : ['PATH', 'HOME', 'LANG', 'TMPDIR'];
-    const env = {};
-    for (const key of allowlist) {
-        if (parentEnv[key] !== undefined)
-            env[key] = parentEnv[key];
-    }
-    if (nodeEnv) {
-        for (const [key, value] of Object.entries(nodeEnv)) {
-            env[key] = value;
-        }
-    }
-    return env;
-}
-//# sourceMappingURL=shell-security.js.map
+"use strict";var u=exports&&exports.__createBinding||(Object.create?(function(e,r,n,s){if(s===void 0)s=n;var t=Object.getOwnPropertyDescriptor(r,n);if(!t||("get"in t?!r.__esModule:t.writable||t.configurable)){t={enumerable:true,get:function(){return r[n]}}}Object.defineProperty(e,s,t)}):(function(e,r,n,s){if(s===void 0)s=n;e[s]=r[n]}));var f=exports&&exports.__setModuleDefault||(Object.create?(function(e,r){Object.defineProperty(e,"default",{enumerable:true,value:r})}):function(e,r){e["default"]=r});var l=exports&&exports.__importStar||(function(){var e=function(r){e=Object.getOwnPropertyNames||function(n){var s=[];for(var t in n)if(Object.prototype.hasOwnProperty.call(n,t))s[s.length]=t;return s};return e(r)};return function(r){if(r&&r.__esModule)return r;var n={};if(r!=null){for(var s=e(r),t=0;t<s.length;t++)if(s[t]!=="default")u(n,r,s[t])}f(n,r);return n}})();Object.defineProperty(exports,"__esModule",{value:true});exports.DANGEROUS_ENV_KEYS=exports.INLINE_CODE_INTERPRETERS=exports.SHELL_DENYLIST=exports.SKILL_NAME_RE=void 0;exports.validateShellCommand=E;exports.validateEnvKeys=h;exports.normalizeCwd=d;exports.buildShellEnv=S;const a=l(require("path"));const i=l(require("fs"));exports.SKILL_NAME_RE=/^[a-z0-9][a-z0-9-]*$/;exports.SHELL_DENYLIST=new Set(["bash","sh","zsh","dash","fish","cmd","cmd.exe","powershell","powershell.exe","pwsh","pwsh.exe"]);exports.INLINE_CODE_INTERPRETERS=new Set(["python","python3","node","nodejs","deno","perl","ruby","php"]);const c=new Set(["-c","-e","--eval","--exec"]);exports.DANGEROUS_ENV_KEYS=new Set(["LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","NODE_OPTIONS"]);function _(e){return a.basename(e).toLowerCase()}function E(e){if(!Array.isArray(e)){return{ok:false,error:"shell_task.command must be an array of strings (argv), not a string"}}if(e.length===0){return{ok:false,error:"shell_task.command must not be empty"}}if(!e.every(s=>typeof s==="string")){return{ok:false,error:"shell_task.command must contain only strings"}}const r=_(e[0]);const n=r.replace(/\.exe$/,"");if(exports.SHELL_DENYLIST.has(r)||exports.SHELL_DENYLIST.has(n)){return{ok:false,error:`shell_task.command[0] "${e[0]}" is a blocked shell interpreter`}}if(exports.INLINE_CODE_INTERPRETERS.has(n)){const s=e.slice(1).some(t=>c.has(String(t)));if(s){return{ok:false,error:`shell_task.command "${n} ${e[1]}" uses an inline-code flag (escape vector blocked)`}}}return{ok:true}}function h(e){if(!e)return{ok:true};for(const r of Object.keys(e)){if(exports.DANGEROUS_ENV_KEYS.has(r)){return{ok:false,error:`shell_task.env key "${r}" is not allowed`}}}return{ok:true}}function d(e,r){let n;try{n=i.realpathSync(r)}catch(o){return{ok:false,error:`project root "${r}" is not accessible: ${o.message}`}}if(e===void 0||e===""){return{ok:true,resolved:n}}const s=a.resolve(n,e);let t;try{t=i.realpathSync(s)}catch(o){return{ok:false,error:`cwd "${e}" is not accessible: ${o.message}`}}if(t!==n&&!t.startsWith(n+a.sep)){return{ok:false,error:`cwd "${e}" resolves outside the project root`}}return{ok:true,resolved:t}}function S(e,r=process.env){const n=process.platform==="win32"?["PATH","Path","SystemRoot","COMSPEC","TEMP","TMP"]:["PATH","HOME","LANG","TMPDIR"];const s={};for(const t of n){if(r[t]!==void 0)s[t]=r[t]}if(e){for(const[t,o]of Object.entries(e)){s[t]=o}}return s}

package/dist/src/workflow-persistence.d.ts

@@ -45,4 +45,4 @@ export interface WorkflowPersistenceProjectionOptions {
 export type WorkflowPersistenceProjection = (run: RunExecution) => WorkflowPersistenceProjectionResult;
 export declare function createWorkflowPersistenceProjection(options: WorkflowPersistenceProjectionOptions): WorkflowPersistenceProjection;
 export declare function previewWorkflowPersistenceProjection(options: WorkflowPersistenceProjectionPreviewOptions, run: RunExecution): WorkflowPersistenceProjectionPreview;
-//# sourceMappingURL=workflow-persistence.d.ts.map
+                                                  

package/dist/src/workflow-persistence.js

@@ -1,224 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createWorkflowPersistenceProjection = createWorkflowPersistenceProjection;
-exports.previewWorkflowPersistenceProjection = previewWorkflowPersistenceProjection;
-const card_state_js_1 = require("./card-state.js");
-const parent_task_sync_js_1 = require("./parent-task-sync.js");
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function asJsonObject(state) {
-    return state;
-}
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map((item) => canonicalJson(item)).join(',')}]`;
-    if (value !== null && typeof value === 'object') {
-        const record = value;
-        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
-    }
-    return JSON.stringify(value) ?? 'null';
-}
-function sameJson(left, right) {
-    return canonicalJson(left) === canonicalJson(right);
-}
-function buildResult(runId, parent) {
-    return {
-        runId,
-        changedParentTaskIds: [...parent.changedParentTaskIds],
-        projectedAuditInstanceIds: [],
-        errors: [],
-    };
-}
-function createWorkflowPersistenceProjection(options) {
-    const parentSinkOptions = {
-        taskRepo: options.taskRepo,
-        workspaceId: options.workspaceId,
-        ...(options.parentKinds ? { parentKinds: options.parentKinds } : {}),
-    };
-    const parentSink = (0, parent_task_sync_js_1.createWorkflowParentPersistSink)(parentSinkOptions);
-    const warn = options.warn ?? ((message) => console.warn(message));
-    return (run) => {
-        let parent;
-        try {
-            parent = parentSink(run);
-        }
-        catch (error) {
-            const message = `workflow persistence parent projection failed for ${run.id}: ${errorMessage(error)}`;
-            warn(message);
-            return {
-                runId: run.id,
-                changedParentTaskIds: [],
-                projectedAuditInstanceIds: [],
-                errors: [message],
-            };
-        }
-        const result = buildResult(run.id, parent);
-        const addError = (stage, error) => {
-            const message = `workflow persistence ${stage} failed for ${run.id}: ${errorMessage(error)}`;
-            result.errors.push(message);
-            warn(message);
-        };
-        const instanceIds = [...new Set(parent.linkedAuditInstanceIds)];
-        if (instanceIds.length > 0) {
-            let spec;
-            try {
-                spec = options.resolveWorkflowSpec(run);
-                if (!spec)
-                    throw new Error(`workflow spec not found for ${run.workflow_id}`);
-            }
-            catch (error) {
-                addError('spec resolution', error);
-            }
-            if (spec) {
-                let state = null;
-                try {
-                    state = (0, card_state_js_1.buildWorkflowApprovalState)(run, spec);
-                }
-                catch (error) {
-                    addError('audit state build', error);
-                }
-                if (state) {
-                    const updatedAt = Date.parse(run.updated_at);
-                    if (!Number.isSafeInteger(updatedAt) || updatedAt < 0) {
-                        addError('audit snapshot', new Error(`invalid run updated_at: ${run.updated_at}`));
-                    }
-                    else {
-                        let store = options.uiInstanceStore;
-                        if (!store && options.getUiInstanceStore) {
-                            try {
-                                store = options.getUiInstanceStore();
-                            }
-                            catch (error) {
-                                addError('audit store creation', error);
-                            }
-                        }
-                        if (!store) {
-                            addError('audit snapshot', new Error('no UiInstanceStore was provided'));
-                        }
-                        else {
-                            for (const instanceId of instanceIds) {
-                                try {
-                                    const instance = store.get(instanceId);
-                                    const domainRunId = instance?.domainRef?.workflowRunId;
-                                    if (!instance
-                                        || instance.workspaceId !== options.workspaceId
-                                        || domainRunId !== run.id) {
-                                        continue;
-                                    }
-                                    const beforeState = canonicalJson(instance.state);
-                                    const beforeUpdatedAt = instance.updatedAt;
-                                    const updatedInstance = store.updateAuditSnapshot({
-                                        instanceId,
-                                        workspaceId: options.workspaceId,
-                                        updatedAt,
-                                        state: asJsonObject(state),
-                                    });
-                                    if (updatedInstance
-                                        && (canonicalJson(updatedInstance.state) !== beforeState
-                                            || updatedInstance.updatedAt !== beforeUpdatedAt)) {
-                                        result.projectedAuditInstanceIds.push(instanceId);
-                                    }
-                                }
-                                catch (error) {
-                                    addError(`audit snapshot ${instanceId}`, error);
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        if ((result.changedParentTaskIds.length > 0 || result.projectedAuditInstanceIds.length > 0)
-            && options.onChanged) {
-            try {
-                options.onChanged(result);
-            }
-            catch (error) {
-                addError('change callback', error);
-            }
-        }
-        return result;
-    };
-}
-function previewWorkflowPersistenceProjection(options, run) {
-    const parent = (0, parent_task_sync_js_1.previewWorkflowParentRepair)({
-        taskRepo: options.taskRepo,
-        run,
-        workspaceId: options.workspaceId,
-        ...(options.parentKinds ? { parentKinds: options.parentKinds } : {}),
-    });
-    const result = {
-        runId: run.id,
-        runStatus: parent.runStatus,
-        parentChanges: [...parent.changes],
-        auditSnapshotChanges: [],
-        errors: [],
-    };
-    const addError = (stage, error) => {
-        result.errors.push(`workflow persistence preview ${stage} failed for ${run.id}: ${errorMessage(error)}`);
-    };
-    const instanceIds = [...new Set(parent.linkedAuditInstanceIds)];
-    if (instanceIds.length === 0)
-        return result;
-    let spec;
-    try {
-        spec = options.resolveWorkflowSpec(run);
-        if (!spec)
-            throw new Error(`workflow spec not found for ${run.workflow_id}`);
-    }
-    catch (error) {
-        addError('spec resolution', error);
-    }
-    if (!spec)
-        return result;
-    let state;
-    try {
-        state = (0, card_state_js_1.buildWorkflowApprovalState)(run, spec);
-    }
-    catch (error) {
-        addError('audit state build', error);
-        return result;
-    }
-    const updatedAt = Date.parse(run.updated_at);
-    if (!Number.isSafeInteger(updatedAt) || updatedAt < 0) {
-        addError('audit snapshot', new Error(`invalid run updated_at: ${run.updated_at}`));
-        return result;
-    }
-    let store = options.uiInstanceStore;
-    if (!store && options.getUiInstanceStore) {
-        try {
-            store = options.getUiInstanceStore();
-        }
-        catch (error) {
-            addError('audit store creation', error);
-        }
-    }
-    if (!store) {
-        addError('audit snapshot', new Error('no UiInstanceStore was provided'));
-        return result;
-    }
-    for (const instanceId of instanceIds) {
-        try {
-            const instance = store.get(instanceId);
-            if (!instance
-                || instance.workspaceId !== options.workspaceId
-                || instance.domainRef.workflowRunId !== run.id) {
-                continue;
-            }
-            if (!sameJson(instance.state, state)) {
-                result.auditSnapshotChanges.push({
-                    instanceId,
-                    before: instance.state,
-                    after: state,
-                });
-            }
-        }
-        catch (error) {
-            addError(`audit snapshot ${instanceId}`, error);
-        }
-    }
-    void updatedAt;
-    return result;
-}
-//# sourceMappingURL=workflow-persistence.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.createWorkflowPersistenceProjection=b;exports.previewWorkflowPersistenceProjection=m;const g=require("./card-state.js");const S=require("./parent-task-sync.js");function h(e){return e instanceof Error?e.message:String(e)}function _(e){return e}function w(e){if(Array.isArray(e))return`[${e.map(r=>w(r)).join(",")}]`;if(e!==null&&typeof e==="object"){const r=e;return`{${Object.keys(r).sort().map(i=>`${JSON.stringify(i)}:${w(r[i])}`).join(",")}}`}return JSON.stringify(e)??"null"}function A(e,r){return w(e)===w(r)}function P(e,r){return{runId:e,changedParentTaskIds:[...r.changedParentTaskIds],projectedAuditInstanceIds:[],errors:[]}}function b(e){const r={taskRepo:e.taskRepo,workspaceId:e.workspaceId,...e.parentKinds?{parentKinds:e.parentKinds}:{}};const i=(0,S.createWorkflowParentPersistSink)(r);const o=e.warn??(n=>console.warn(n));return n=>{let u;try{u=i(n)}catch(s){const t=`workflow persistence parent projection failed for ${n.id}: ${h(s)}`;o(t);return{runId:n.id,changedParentTaskIds:[],projectedAuditInstanceIds:[],errors:[t]}}const c=P(n.id,u);const d=(s,t)=>{const a=`workflow persistence ${s} failed for ${n.id}: ${h(t)}`;c.errors.push(a);o(a)};const p=[...new Set(u.linkedAuditInstanceIds)];if(p.length>0){let s;try{s=e.resolveWorkflowSpec(n);if(!s)throw new Error(`workflow spec not found for ${n.workflow_id}`)}catch(t){d("spec resolution",t)}if(s){let t=null;try{t=(0,g.buildWorkflowApprovalState)(n,s)}catch(a){d("audit state build",a)}if(t){const a=Date.parse(n.updated_at);if(!Number.isSafeInteger(a)||a<0){d("audit snapshot",new Error(`invalid run updated_at: ${n.updated_at}`))}else{let I=e.uiInstanceStore;if(!I&&e.getUiInstanceStore){try{I=e.getUiInstanceStore()}catch(l){d("audit store creation",l)}}if(!I){d("audit snapshot",new Error("no UiInstanceStore was provided"))}else{for(const l of p){try{const f=I.get(l);const $=f?.domainRef?.workflowRunId;if(!f||f.workspaceId!==e.workspaceId||$!==n.id){continue}const j=w(f.state);const y=f.updatedAt;const k=I.updateAuditSnapshot({instanceId:l,workspaceId:e.workspaceId,updatedAt:a,state:_(t)});if(k&&(w(k.state)!==j||k.updatedAt!==y)){c.projectedAuditInstanceIds.push(l)}}catch(f){d(`audit snapshot ${l}`,f)}}}}}}}if((c.changedParentTaskIds.length>0||c.projectedAuditInstanceIds.length>0)&&e.onChanged){try{e.onChanged(c)}catch(s){d("change callback",s)}}return c}}function m(e,r){const i=(0,S.previewWorkflowParentRepair)({taskRepo:e.taskRepo,run:r,workspaceId:e.workspaceId,...e.parentKinds?{parentKinds:e.parentKinds}:{}});const o={runId:r.id,runStatus:i.runStatus,parentChanges:[...i.changes],auditSnapshotChanges:[],errors:[]};const n=(t,a)=>{o.errors.push(`workflow persistence preview ${t} failed for ${r.id}: ${h(a)}`)};const u=[...new Set(i.linkedAuditInstanceIds)];if(u.length===0)return o;let c;try{c=e.resolveWorkflowSpec(r);if(!c)throw new Error(`workflow spec not found for ${r.workflow_id}`)}catch(t){n("spec resolution",t)}if(!c)return o;let d;try{d=(0,g.buildWorkflowApprovalState)(r,c)}catch(t){n("audit state build",t);return o}const p=Date.parse(r.updated_at);if(!Number.isSafeInteger(p)||p<0){n("audit snapshot",new Error(`invalid run updated_at: ${r.updated_at}`));return o}let s=e.uiInstanceStore;if(!s&&e.getUiInstanceStore){try{s=e.getUiInstanceStore()}catch(t){n("audit store creation",t)}}if(!s){n("audit snapshot",new Error("no UiInstanceStore was provided"));return o}for(const t of u){try{const a=s.get(t);if(!a||a.workspaceId!==e.workspaceId||a.domainRef.workflowRunId!==r.id){continue}if(!A(a.state,d)){o.auditSnapshotChanges.push({instanceId:t,before:a.state,after:d})}}catch(a){n(`audit snapshot ${t}`,a)}}void p;return o}