@crewx/workflow 0.3.22-rc.22 → 0.3.22-rc.221

package/dist/src/run-projection.d.ts

@@ -0,0 +1,30 @@
+import type { RunExecution, WorkflowSpec } from './types.js';
+export type RunStepStatus = 'not_started' | 'running' | 'waiting_approval' | 'approved' | 'rejected' | 'completed' | 'failed' | 'stopped';
+export interface RunStepProjection {
+    nodeId: string;
+    label: string;
+    type: string | null;
+    status: RunStepStatus;
+    isApproval: boolean;
+    startedAt: string | null;
+    endedAt: string | null;
+    durationMs: number | null;
+    exitCode: number | null;
+    retryCount: number;
+    taskIds: string[];
+}
+export type RunStepTaskLookup = (workflowRunId: string, nodeId: string) => readonly string[];
+export interface RunProgressSummary {
+    done: number;
+    total: number | null;
+    current: {
+        nodeId: string;
+        label: string;
+    } | null;
+    waitingApproval: boolean;
+}
+export declare function projectRunSteps(definition: WorkflowSpec | null | undefined, run: RunExecution, options?: {
+    findTaskIds?: RunStepTaskLookup;
+}): RunStepProjection[];
+export declare function summarizeRunProgress(definition: WorkflowSpec | null | undefined, run: RunExecution): RunProgressSummary;
+                                            

package/dist/src/run-projection.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.projectRunSteps=N;exports.summarizeRunProgress=A;const j=require("./cancel-reason.js");const p="approval";const m="retry";function v(e){return e.status??(e.auto_run?"running":"pending")}function g(e){return(0,j.isUserCancelledRun)(e)?"stopped":"failed"}function y(e){return e==="end"||e==="error"}function R(e,t){for(let r=e.length-1;r>=0;r-=1){const n=e[r];if(n.node_id===t&&n.type===p&&n.decision)return n}return void 0}function h(e){let t;for(const r of e){const n=Date.parse(r);if(Number.isFinite(n)&&(!t||n<t.ms))t={value:r,ms:n}}return t?.value??null}function D(e){let t;for(const r of e){const n=Date.parse(r);if(Number.isFinite(n)&&(!t||n>t.ms))t={value:r,ms:n}}return t?.value??null}function O(e,t,r,n){if(n)return n.decision==="reject"?"rejected":"approved";const o=v(r);if(r.current_node===e){if(o==="cancelled")return g(r);if(o==="failed")return"failed";if(o==="completed")return"completed";return"waiting_approval"}if(!r.completed_nodes.includes(e))return"not_started";const c=a=>typeof a==="string"&&(r.completed_nodes.includes(a)||r.current_node===a);if(c(t?.on_approve))return"approved";if(c(t?.on_reject))return"rejected";return"completed"}function P(e,t,r){const n=v(t);const o=t.auto_run?.node_id||t.current_node;if(n==="cancelled"&&o===e&&!t.completed_nodes.includes(e)){return g(t)}if(t.completed_nodes.includes(e))return"completed";if(t.current_node===e){if(n==="running"||n==="retrying")return"running";if(n==="failed")return"failed";if(n==="completed")return"completed";return"not_started"}const c=r.at(-1);if(c)return c.error?"failed":"completed";return"not_started"}function T(e,t,r,n,o){const c=n.filter(d=>d.node_id===e&&d.type!==m&&d.type!==p);const a=R(n,e);const s=t?.type==="approval"||a!==void 0;const i=t?.type??(s?p:null);const l=s?a?.decided_at??null:h(c.map(d=>d.started_at));const u=s?a?.decided_at??null:D(c.map(d=>d.ended_at));const f=l?Date.parse(l):NaN;const _=u?Date.parse(u):NaN;const S=Number.isFinite(f)&&Number.isFinite(_)?Math.max(0,_-f):null;return{nodeId:e,label:t?.label??e,type:i,status:s?O(e,t,r,a):P(e,r,c),isApproval:s,startedAt:l,endedAt:u,durationMs:S,exitCode:s?null:c.at(-1)?.exit_code??null,retryCount:n.filter(d=>d.node_id===e&&d.type===m).length,taskIds:o?[...o(r.id,e)]:[]}}function b(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function w(e,t){const r=new Set;const n=[...e.completed_nodes,e.current_node,e.auto_run?.node_id,...(e.audit??[]).map(o=>o.node_id)];for(const o of n){if(o&&!b(t,o))r.add(o)}return[...r]}function N(e,t,r={}){const n=e?.nodes??{};const o=t.audit??[];const c=Object.keys(n);const a=[...c,...w(t,n)];return a.map(s=>T(s,b(n,s)?n[s]:void 0,t,o,r.findTaskIds))}function A(e,t){const r=N(e,t);const n=s=>s==="completed"||s==="approved"||s==="rejected";let o;let c;if(e){const s=Object.keys(e.nodes).filter(l=>!y(e.nodes[l]?.type));const i=new Map(r.map(l=>[l.nodeId,l]));o=s.filter(l=>{const u=i.get(l);return u!==void 0&&n(u.status)}).length;c=s.length}else{const s=r.filter(i=>!y(i.type));o=s.filter(i=>n(i.status)).length;c=null}const a=t.current_node?r.find(s=>s.nodeId===t.current_node):void 0;return{done:o,total:c,current:a?{nodeId:a.nodeId,label:a.label}:null,waitingApproval:r.some(s=>s.status==="waiting_approval")}}

package/dist/src/types.d.ts

@@ -8,7 +8,7 @@ export interface RetryConfig {
     max: number;
     delay: 'exponential' | 'fixed';
     max_delay?: number;
-    on?: string[];
+    on?: WorkflowFailureCode[];
 }
 export interface OnError {
     handler?: string;
@@ -26,6 +26,7 @@ export interface WorkflowNode {
     command?: string[];
     cwd?: string;
     env?: Record<string, string>;
+    stdin?: string;
     output?: string;
     output_format?: 'json';
     output_schema?: JsonSchema;
@@ -40,6 +41,7 @@ export interface WorkflowNode {
     default?: string;
     join?: string;
     on_failure?: 'fail_fast' | 'continue' | 'ignore';
+    label?: string;
     description?: string;
     assignee?: string;
     timeout?: number;
@@ -79,7 +81,7 @@ export interface ValidationResult {
 export interface AuditEntry {
     exec_id: string;
     node_id: string;
-    type: NodeType | string;
+    type: NodeType | 'retry' | string;
     summary: string;
     started_at: string;
     ended_at: string;
@@ -87,6 +89,36 @@ export interface AuditEntry {
     exit_code: number | null;
     error?: string;
     trigger: 'manual' | 'auto';
+    decision?: 'approve' | 'reject';
+    decided_at?: string;
+    actor?: string;
+}
+export interface WorkflowAutoRunLease {
+    pid: number;
+    token: string;
+    node_id: string;
+    started_at: string;
+}
+export interface WorkflowManualResume {
+    node_id: string;
+    requested_at: string;
+}
+export type WorkflowFailureCode = 'CLI_UNRESOLVABLE' | 'SPAWN_FAILED' | 'NODE_TIMEOUT' | 'NODE_EXIT_NONZERO' | 'OUTPUT_INVALID' | 'RATE_LIMITED' | 'CONFIG_INVALID' | 'INTERRUPTED' | 'CANCELLED' | 'UNKNOWN';
+export interface RetryPolicy {
+    max: number;
+    delay: 'exponential' | 'fixed';
+    max_delay: number;
+    on: WorkflowFailureCode[];
+}
+export declare const NEVER_RETRYABLE: readonly WorkflowFailureCode[];
+export interface WorkflowNodeFailure {
+    failedNode: string;
+    attempt: number;
+    causeCode: WorkflowFailureCode;
+    causeMessage: string;
+    exitCode: number | null;
+    evidencePreview: string | null;
+    occurredAt: string;
 }
 export interface RunExecution {
     id: string;
@@ -98,10 +130,15 @@ export interface RunExecution {
     completed_nodes: string[];
     state: Record<string, unknown>;
     initial_state: Record<string, unknown>;
-    status?: 'running' | 'completed' | 'failed' | 'cancelled';
+    status?: 'pending' | 'running' | 'retrying' | 'completed' | 'failed' | 'cancelled';
     tasks?: Record<string, string>;
     error?: string;
+    last_failure?: WorkflowNodeFailure;
     audit?: AuditEntry[];
+    retry_count?: number;
+    node_attempts?: Record<string, number>;
+    auto_run?: WorkflowAutoRunLease;
+    manual_resume?: WorkflowManualResume;
 }
 export interface AutoRunResult {
     run: RunExecution;
@@ -109,4 +146,4 @@ export interface AutoRunResult {
     reason?: string;
     executed: string[];
 }
-//# sourceMappingURL=types.d.ts.map
+                                   

package/dist/src/types.js

@@ -1,3 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.NEVER_RETRYABLE=void 0;exports.NEVER_RETRYABLE=["CANCELLED","CONFIG_INVALID"];

package/dist/src/utils/output-format.d.ts

@@ -15,4 +15,4 @@ export declare function buildJsonOutputSuffix(schema?: JsonSchema, strict?: bool
 export declare function extractJson(text: string): string;
 export declare function validateJsonSchema(value: unknown, schema: JsonSchema): Promise<void>;
 export declare function toOpenAIStrictSchema(schema: JsonSchema): JsonSchema;
-//# sourceMappingURL=output-format.d.ts.map
+                                           

package/dist/src/utils/output-format.js

@@ -1,53 +1,8 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKFLOW_SIGNAL_KEY = void 0;
-exports.buildWorkflowPreamble = buildWorkflowPreamble;
-exports.detectWorkflowSignal = detectWorkflowSignal;
-exports.buildJsonOutputSuffix = buildJsonOutputSuffix;
-exports.extractJson = extractJson;
-exports.validateJsonSchema = validateJsonSchema;
-exports.toOpenAIStrictSchema = toOpenAIStrictSchema;
-const node_crypto_1 = require("node:crypto");
-exports.WORKFLOW_SIGNAL_KEY = 'workflow_signal';
-function buildWorkflowPreamble(ctx) {
-    return `<crewx.workflow>
+"use strict";var y=exports&&exports.__createBinding||(Object.create?(function(n,e,r,t){if(t===void 0)t=r;var o=Object.getOwnPropertyDescriptor(e,r);if(!o||("get"in o?!e.__esModule:o.writable||o.configurable)){o={enumerable:true,get:function(){return e[r]}}}Object.defineProperty(n,t,o)}):(function(n,e,r,t){if(t===void 0)t=r;n[t]=e[r]}));var _=exports&&exports.__setModuleDefault||(Object.create?(function(n,e){Object.defineProperty(n,"default",{enumerable:true,value:e})}):function(n,e){n["default"]=e});var v=exports&&exports.__importStar||(function(){var n=function(e){n=Object.getOwnPropertyNames||function(r){var t=[];for(var o in r)if(Object.prototype.hasOwnProperty.call(r,o))t[t.length]=o;return t};return n(e)};return function(e){if(e&&e.__esModule)return e;var r={};if(e!=null){for(var t=n(e),o=0;o<t.length;o++)if(t[o]!=="default")y(r,e,t[o])}_(r,e);return r}})();Object.defineProperty(exports,"__esModule",{value:true});exports.WORKFLOW_SIGNAL_KEY=void 0;exports.buildWorkflowPreamble=j;exports.detectWorkflowSignal=E;exports.buildJsonOutputSuffix=P;exports.extractJson=O;exports.validateJsonSchema=W;exports.toOpenAIStrictSchema=S;const N=require("node:crypto");exports.WORKFLOW_SIGNAL_KEY="workflow_signal";function j(n){return`<crewx.workflow>
 ## Execution Context
-You are running headless as node "${ctx.nodeId}" of workflow "${ctx.workflowId}" (run ${ctx.execId}).
+You are running headless as node "${n.nodeId}" of workflow "${n.workflowId}" (run ${n.execId}).
 - No human is watching this session. NEVER ask clarifying questions or wait for
-  confirmation — state your assumptions and proceed, or report failure.
+  confirmation \u2014 state your assumptions and proceed, or report failure.
 - Your output is consumed verbatim by downstream nodes. Output the result only;
   skip greetings, progress notes, and meta commentary.
 - If the task cannot be completed (broken precondition, missing data, failed
@@ -57,118 +12,18 @@ You are running headless as node "${ctx.nodeId}" of workflow "${ctx.workflowId}"
   The engine will halt the workflow at this node and record the reason.
 </crewx.workflow>
 
-`;
-}
-function detectWorkflowSignal(output) {
-    if (!output.includes(`"${exports.WORKFLOW_SIGNAL_KEY}"`))
-        return null;
-    const toSignal = (parsed) => {
-        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) &&
-            parsed[exports.WORKFLOW_SIGNAL_KEY] === 'fail') {
-            const reason = parsed['reason'];
-            return { signal: 'fail', ...(typeof reason === 'string' && reason ? { reason } : {}) };
-        }
-        return null;
-    };
-    try {
-        const signal = toSignal(JSON.parse(extractJson(output)));
-        if (signal)
-            return signal;
-    }
-    catch { }
-    const inline = output.match(new RegExp(`\\{[^{}]*"${exports.WORKFLOW_SIGNAL_KEY}"\\s*:\\s*"fail"[^{}]*\\}`));
-    if (inline) {
-        try {
-            return toSignal(JSON.parse(inline[0]));
-        }
-        catch {
-            return { signal: 'fail' };
-        }
-    }
-    return null;
-}
-function buildJsonOutputSuffix(schema, strict = false) {
-    const finalSchema = strict && schema ? toOpenAIStrictSchema(schema) : schema;
-    const schemaStr = finalSchema ? `JSON Schema:\n${JSON.stringify(finalSchema, null, 2)}\n` : '';
-    return `\n\n<crewx.workflow>
-## ⚠️ Output Format (read first — drives branch evaluation)
+`}function E(n){if(!n.includes(`"${exports.WORKFLOW_SIGNAL_KEY}"`))return null;const e=t=>{if(typeof t==="object"&&t!==null&&!Array.isArray(t)&&t[exports.WORKFLOW_SIGNAL_KEY]==="fail"){const o=t["reason"];return{signal:"fail",...typeof o==="string"&&o?{reason:o}:{}}}return null};try{const t=e(JSON.parse(O(n)));if(t)return t}catch{}const r=n.match(new RegExp(`\\{[^{}]*"${exports.WORKFLOW_SIGNAL_KEY}"\\s*:\\s*"fail"[^{}]*\\}`));if(r){try{return e(JSON.parse(r[0]))}catch{return{signal:"fail"}}}return null}function P(n,e=false){const r=e&&n?S(n):n;const t=r?`JSON Schema:
+${JSON.stringify(r,null,2)}
+`:"";return`
+
+<crewx.workflow>
+## \u26A0\uFE0F Output Format (read first \u2014 drives branch evaluation)
 
 **The first character of your output MUST be \`{\`. The last character MUST be \`}\`.**
 No other text is permitted (no explanations, greetings, progress notes, or analysis remarks).
 **NEVER use markdown code fences (\`\`\`json ... \`\`\`).** Do not output even a single backtick.
-Branch evaluation calls \`JSON.parse(state.<output>)\` directly —
+Branch evaluation calls \`JSON.parse(state.<output>)\` directly \u2014
 even one non-JSON character at start or end will halt the workflow.
 
-${schemaStr}Execute the task, then output **exactly one JSON object** matching the schema above. Nothing else.
-</crewx.workflow>`;
-}
-function extractJson(text) {
-    let trimmed = text.trim();
-    const fenceMatch = trimmed.match(/^```(?:json|JSON)?\s*\n?([\s\S]*?)\n?```\s*$/);
-    if (fenceMatch && fenceMatch[1] !== undefined) {
-        trimmed = fenceMatch[1].trim();
-    }
-    const objMatch = trimmed.match(/\{[\s\S]*\}/);
-    const arrMatch = trimmed.match(/\[[\s\S]*\]/);
-    if (objMatch && arrMatch) {
-        return objMatch.index < arrMatch.index ? objMatch[0] : arrMatch[0];
-    }
-    return objMatch?.[0] ?? arrMatch?.[0] ?? trimmed;
-}
-async function validateJsonSchema(value, schema) {
-    const { registerSchema, validate } = await Promise.resolve().then(() => __importStar(require('@hyperjump/json-schema/draft-2020-12')));
-    const uri = `urn:crewx:schema:${(0, node_crypto_1.randomUUID)()}`;
-    registerSchema({ $schema: 'https://json-schema.org/draft/2020-12/schema', ...schema }, uri);
-    const result = await validate(uri, value);
-    if (!result.valid) {
-        const errors = (result.errors ?? [])
-            .map((e) => e.instanceLocation)
-            .join('; ');
-        throw new Error(`Schema validation failed: ${errors || 'unknown error'}`);
-    }
-}
-function toOpenAIStrictSchema(schema) {
-    return transformStrict(schema);
-}
-const OPENAI_UNSUPPORTED_KEYWORDS = new Set([
-    'default', 'format', 'pattern', 'minLength', 'maxLength',
-    'minimum', 'maximum', 'not',
-]);
-function transformStrict(schema) {
-    const result = {};
-    for (const [key, value] of Object.entries(schema)) {
-        if (OPENAI_UNSUPPORTED_KEYWORDS.has(key))
-            continue;
-        if (key === 'properties' && isRecord(value)) {
-            const transformed = {};
-            for (const [propKey, propVal] of Object.entries(value)) {
-                transformed[propKey] = transformStrict(propVal);
-            }
-            result['properties'] = transformed;
-            result['required'] = Object.keys(transformed);
-            result['additionalProperties'] = false;
-        }
-        else if (key === 'items' && isRecord(value)) {
-            result['items'] = transformStrict(value);
-        }
-        else if (key === 'required') {
-            if (!('properties' in schema)) {
-                result['required'] = value;
-            }
-        }
-        else if (key === 'additionalProperties') {
-            result['additionalProperties'] = false;
-        }
-        else {
-            result[key] = value;
-        }
-    }
-    if (result['type'] === 'object' && !('additionalProperties' in result)) {
-        result['additionalProperties'] = false;
-    }
-    return result;
-}
-function isRecord(val) {
-    return typeof val === 'object' && val !== null && !Array.isArray(val);
-}
-//# sourceMappingURL=output-format.js.map
+${t}Execute the task, then output **exactly one JSON object** matching the schema above. Nothing else.
+</crewx.workflow>`}function O(n){let e=n.trim();const r=e.match(/^```(?:json|JSON)?\s*\n?([\s\S]*?)\n?```\s*$/);if(r&&r[1]!==void 0){e=r[1].trim()}const t=(i,d,b)=>{const w=[];let h=false;let p=false;let l=0;let u=-1;for(let s=0;s<i.length;s++){const f=i[s];if(p){p=false;continue}if(h){if(f==="\\"){p=true;continue}if(f==='"'){h=false}continue}if(f==='"'){h=true;continue}if(f===d){if(l===0)u=s;l++}else if(f===b){if(l>0){l--;if(l===0&&u!==-1){w.push({text:i.slice(u,s+1),start:u,end:s});u=-1}}}}return w};const o=t(e,"{","}");const a=t(e,"[","]");const c=[...o,...a].sort((i,d)=>d.end-i.end);for(const i of c){try{JSON.parse(i.text);return i.text}catch{}}return e}async function W(n,e){const{registerSchema:r,validate:t}=await Promise.resolve().then(()=>v(require("@hyperjump/json-schema/draft-2020-12")));const o=`urn:crewx:schema:${(0,N.randomUUID)()}`;r({$schema:"https://json-schema.org/draft/2020-12/schema",...e},o);const a=await t(o,n);if(!a.valid){const c=(a.errors??[]).map(i=>i.instanceLocation).join("; ");throw new Error(`Schema validation failed: ${c||"unknown error"}`)}}function S(n){return m(n)}const J=new Set(["default","format","pattern","minLength","maxLength","minimum","maximum","not"]);function m(n){const e={};for(const[r,t]of Object.entries(n)){if(J.has(r))continue;if(r==="properties"&&g(t)){const o={};for(const[a,c]of Object.entries(t)){o[a]=m(c)}e["properties"]=o;e["required"]=Object.keys(o);e["additionalProperties"]=false}else if(r==="items"&&g(t)){e["items"]=m(t)}else if(r==="required"){if(!("properties"in n)){e["required"]=t}}else if(r==="additionalProperties"){e["additionalProperties"]=false}else{e[r]=t}}if(e["type"]==="object"&&!("additionalProperties"in e)){e["additionalProperties"]=false}return e}function g(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}

package/dist/src/utils/shell-security.d.ts

@@ -15,4 +15,4 @@ export interface CwdCheck {
 }
 export declare function normalizeCwd(cwd: string | undefined, projectRoot: string): CwdCheck;
 export declare function buildShellEnv(nodeEnv: Record<string, string> | undefined, parentEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-//# sourceMappingURL=shell-security.d.ts.map
+                                            

package/dist/src/utils/shell-security.js

@@ -1,138 +1 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DANGEROUS_ENV_KEYS = exports.INLINE_CODE_INTERPRETERS = exports.SHELL_DENYLIST = exports.SKILL_NAME_RE = void 0;
-exports.validateShellCommand = validateShellCommand;
-exports.validateEnvKeys = validateEnvKeys;
-exports.normalizeCwd = normalizeCwd;
-exports.buildShellEnv = buildShellEnv;
-const path = __importStar(require("path"));
-const fs = __importStar(require("fs"));
-exports.SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
-exports.SHELL_DENYLIST = new Set([
-    'bash', 'sh', 'zsh', 'dash', 'fish',
-    'cmd', 'cmd.exe', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe',
-]);
-exports.INLINE_CODE_INTERPRETERS = new Set([
-    'python', 'python3', 'node', 'nodejs', 'deno', 'perl', 'ruby', 'php',
-]);
-const INLINE_CODE_FLAGS = new Set(['-c', '-e', '--eval', '--exec']);
-exports.DANGEROUS_ENV_KEYS = new Set([
-    'LD_PRELOAD', 'LD_LIBRARY_PATH', 'LD_AUDIT',
-    'DYLD_INSERT_LIBRARIES', 'DYLD_LIBRARY_PATH', 'DYLD_FRAMEWORK_PATH',
-    'NODE_OPTIONS',
-]);
-function baseName(cmd) {
-    return path.basename(cmd).toLowerCase();
-}
-function validateShellCommand(command) {
-    if (!Array.isArray(command)) {
-        return { ok: false, error: 'shell_task.command must be an array of strings (argv), not a string' };
-    }
-    if (command.length === 0) {
-        return { ok: false, error: 'shell_task.command must not be empty' };
-    }
-    if (!command.every((c) => typeof c === 'string')) {
-        return { ok: false, error: 'shell_task.command must contain only strings' };
-    }
-    const bin = baseName(command[0]);
-    const binNoExt = bin.replace(/\.exe$/, '');
-    if (exports.SHELL_DENYLIST.has(bin) || exports.SHELL_DENYLIST.has(binNoExt)) {
-        return { ok: false, error: `shell_task.command[0] "${command[0]}" is a blocked shell interpreter` };
-    }
-    if (exports.INLINE_CODE_INTERPRETERS.has(binNoExt)) {
-        const hasInlineFlag = command
-            .slice(1)
-            .some((arg) => INLINE_CODE_FLAGS.has(String(arg)));
-        if (hasInlineFlag) {
-            return {
-                ok: false,
-                error: `shell_task.command "${binNoExt} ${command[1]}" uses an inline-code flag (escape vector blocked)`,
-            };
-        }
-    }
-    return { ok: true };
-}
-function validateEnvKeys(env) {
-    if (!env)
-        return { ok: true };
-    for (const key of Object.keys(env)) {
-        if (exports.DANGEROUS_ENV_KEYS.has(key)) {
-            return { ok: false, error: `shell_task.env key "${key}" is not allowed` };
-        }
-    }
-    return { ok: true };
-}
-function normalizeCwd(cwd, projectRoot) {
-    let root;
-    try {
-        root = fs.realpathSync(projectRoot);
-    }
-    catch (error) {
-        return { ok: false, error: `project root "${projectRoot}" is not accessible: ${error.message}` };
-    }
-    if (cwd === undefined || cwd === '') {
-        return { ok: true, resolved: root };
-    }
-    const candidate = path.resolve(root, cwd);
-    let resolved;
-    try {
-        resolved = fs.realpathSync(candidate);
-    }
-    catch (error) {
-        return { ok: false, error: `cwd "${cwd}" is not accessible: ${error.message}` };
-    }
-    if (resolved !== root && !resolved.startsWith(root + path.sep)) {
-        return { ok: false, error: `cwd "${cwd}" resolves outside the project root` };
-    }
-    return { ok: true, resolved };
-}
-function buildShellEnv(nodeEnv, parentEnv = process.env) {
-    const allowlist = process.platform === 'win32'
-        ? ['PATH', 'Path', 'SystemRoot', 'COMSPEC', 'TEMP', 'TMP']
-        : ['PATH', 'HOME', 'LANG', 'TMPDIR'];
-    const env = {};
-    for (const key of allowlist) {
-        if (parentEnv[key] !== undefined)
-            env[key] = parentEnv[key];
-    }
-    if (nodeEnv) {
-        for (const [key, value] of Object.entries(nodeEnv)) {
-            env[key] = value;
-        }
-    }
-    return env;
-}
-//# sourceMappingURL=shell-security.js.map
+"use strict";var u=exports&&exports.__createBinding||(Object.create?(function(e,r,n,s){if(s===void 0)s=n;var t=Object.getOwnPropertyDescriptor(r,n);if(!t||("get"in t?!r.__esModule:t.writable||t.configurable)){t={enumerable:true,get:function(){return r[n]}}}Object.defineProperty(e,s,t)}):(function(e,r,n,s){if(s===void 0)s=n;e[s]=r[n]}));var f=exports&&exports.__setModuleDefault||(Object.create?(function(e,r){Object.defineProperty(e,"default",{enumerable:true,value:r})}):function(e,r){e["default"]=r});var l=exports&&exports.__importStar||(function(){var e=function(r){e=Object.getOwnPropertyNames||function(n){var s=[];for(var t in n)if(Object.prototype.hasOwnProperty.call(n,t))s[s.length]=t;return s};return e(r)};return function(r){if(r&&r.__esModule)return r;var n={};if(r!=null){for(var s=e(r),t=0;t<s.length;t++)if(s[t]!=="default")u(n,r,s[t])}f(n,r);return n}})();Object.defineProperty(exports,"__esModule",{value:true});exports.DANGEROUS_ENV_KEYS=exports.INLINE_CODE_INTERPRETERS=exports.SHELL_DENYLIST=exports.SKILL_NAME_RE=void 0;exports.validateShellCommand=E;exports.validateEnvKeys=h;exports.normalizeCwd=d;exports.buildShellEnv=S;const a=l(require("path"));const i=l(require("fs"));exports.SKILL_NAME_RE=/^[a-z0-9][a-z0-9-]*$/;exports.SHELL_DENYLIST=new Set(["bash","sh","zsh","dash","fish","cmd","cmd.exe","powershell","powershell.exe","pwsh","pwsh.exe"]);exports.INLINE_CODE_INTERPRETERS=new Set(["python","python3","node","nodejs","deno","perl","ruby","php"]);const c=new Set(["-c","-e","--eval","--exec"]);exports.DANGEROUS_ENV_KEYS=new Set(["LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","NODE_OPTIONS"]);function _(e){return a.basename(e).toLowerCase()}function E(e){if(!Array.isArray(e)){return{ok:false,error:"shell_task.command must be an array of strings (argv), not a string"}}if(e.length===0){return{ok:false,error:"shell_task.command must not be empty"}}if(!e.every(s=>typeof s==="string")){return{ok:false,error:"shell_task.command must contain only strings"}}const r=_(e[0]);const n=r.replace(/\.exe$/,"");if(exports.SHELL_DENYLIST.has(r)||exports.SHELL_DENYLIST.has(n)){return{ok:false,error:`shell_task.command[0] "${e[0]}" is a blocked shell interpreter`}}if(exports.INLINE_CODE_INTERPRETERS.has(n)){const s=e.slice(1).some(t=>c.has(String(t)));if(s){return{ok:false,error:`shell_task.command "${n} ${e[1]}" uses an inline-code flag (escape vector blocked)`}}}return{ok:true}}function h(e){if(!e)return{ok:true};for(const r of Object.keys(e)){if(exports.DANGEROUS_ENV_KEYS.has(r)){return{ok:false,error:`shell_task.env key "${r}" is not allowed`}}}return{ok:true}}function d(e,r){let n;try{n=i.realpathSync(r)}catch(o){return{ok:false,error:`project root "${r}" is not accessible: ${o.message}`}}if(e===void 0||e===""){return{ok:true,resolved:n}}const s=a.resolve(n,e);let t;try{t=i.realpathSync(s)}catch(o){return{ok:false,error:`cwd "${e}" is not accessible: ${o.message}`}}if(t!==n&&!t.startsWith(n+a.sep)){return{ok:false,error:`cwd "${e}" resolves outside the project root`}}return{ok:true,resolved:t}}function S(e,r=process.env){const n=process.platform==="win32"?["PATH","Path","SystemRoot","COMSPEC","TEMP","TMP"]:["PATH","HOME","LANG","TMPDIR"];const s={};for(const t of n){if(r[t]!==void 0)s[t]=r[t]}if(e){for(const[t,o]of Object.entries(e)){s[t]=o}}return s}

package/dist/src/workflow-persistence.d.ts

@@ -0,0 +1,48 @@
+import type { JsonObject, UiAuditSnapshotInput, UiInstance } from '@crewx/sdk';
+import { type WorkflowApprovalState } from './card-state.js';
+import { type WorkflowParentLifecycleChange, type WorkflowParentPersistTaskRepository, type WorkflowParentTaskKind } from './parent-task-sync.js';
+import type { RunExecution, WorkflowSpec } from './types.js';
+export interface WorkflowAuditSnapshotStore {
+    get(instanceId: string): UiInstance | null;
+    updateAuditSnapshot(input: UiAuditSnapshotInput): UiInstance | null;
+}
+export interface WorkflowPersistenceProjectionResult {
+    runId: string;
+    changedParentTaskIds: string[];
+    projectedAuditInstanceIds: string[];
+    errors: string[];
+}
+export interface WorkflowAuditSnapshotChange {
+    instanceId: string;
+    before: JsonObject;
+    after: WorkflowApprovalState;
+}
+export interface WorkflowPersistenceProjectionPreview {
+    runId: string;
+    runStatus: NonNullable<RunExecution['status']>;
+    parentChanges: WorkflowParentLifecycleChange[];
+    auditSnapshotChanges: WorkflowAuditSnapshotChange[];
+    errors: string[];
+}
+export interface WorkflowPersistenceProjectionPreviewOptions {
+    taskRepo: Pick<WorkflowParentPersistTaskRepository, 'findWorkflowParentTask'>;
+    workspaceId: string;
+    resolveWorkflowSpec: (run: RunExecution) => WorkflowSpec | null | undefined;
+    uiInstanceStore?: Pick<WorkflowAuditSnapshotStore, 'get'>;
+    getUiInstanceStore?: () => Pick<WorkflowAuditSnapshotStore, 'get'>;
+    parentKinds?: readonly WorkflowParentTaskKind[];
+}
+export interface WorkflowPersistenceProjectionOptions {
+    taskRepo: WorkflowParentPersistTaskRepository;
+    workspaceId: string;
+    resolveWorkflowSpec: (run: RunExecution) => WorkflowSpec | null | undefined;
+    uiInstanceStore?: WorkflowAuditSnapshotStore;
+    getUiInstanceStore?: () => WorkflowAuditSnapshotStore;
+    parentKinds?: readonly WorkflowParentTaskKind[];
+    onChanged?: (result: WorkflowPersistenceProjectionResult) => void;
+    warn?: (message: string) => void;
+}
+export type WorkflowPersistenceProjection = (run: RunExecution) => WorkflowPersistenceProjectionResult;
+export declare function createWorkflowPersistenceProjection(options: WorkflowPersistenceProjectionOptions): WorkflowPersistenceProjection;
+export declare function previewWorkflowPersistenceProjection(options: WorkflowPersistenceProjectionPreviewOptions, run: RunExecution): WorkflowPersistenceProjectionPreview;
+                                                  

package/dist/src/workflow-persistence.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.createWorkflowPersistenceProjection=b;exports.previewWorkflowPersistenceProjection=m;const g=require("./card-state.js");const S=require("./parent-task-sync.js");function h(e){return e instanceof Error?e.message:String(e)}function _(e){return e}function w(e){if(Array.isArray(e))return`[${e.map(r=>w(r)).join(",")}]`;if(e!==null&&typeof e==="object"){const r=e;return`{${Object.keys(r).sort().map(i=>`${JSON.stringify(i)}:${w(r[i])}`).join(",")}}`}return JSON.stringify(e)??"null"}function A(e,r){return w(e)===w(r)}function P(e,r){return{runId:e,changedParentTaskIds:[...r.changedParentTaskIds],projectedAuditInstanceIds:[],errors:[]}}function b(e){const r={taskRepo:e.taskRepo,workspaceId:e.workspaceId,...e.parentKinds?{parentKinds:e.parentKinds}:{}};const i=(0,S.createWorkflowParentPersistSink)(r);const o=e.warn??(n=>console.warn(n));return n=>{let u;try{u=i(n)}catch(s){const t=`workflow persistence parent projection failed for ${n.id}: ${h(s)}`;o(t);return{runId:n.id,changedParentTaskIds:[],projectedAuditInstanceIds:[],errors:[t]}}const c=P(n.id,u);const d=(s,t)=>{const a=`workflow persistence ${s} failed for ${n.id}: ${h(t)}`;c.errors.push(a);o(a)};const p=[...new Set(u.linkedAuditInstanceIds)];if(p.length>0){let s;try{s=e.resolveWorkflowSpec(n);if(!s)throw new Error(`workflow spec not found for ${n.workflow_id}`)}catch(t){d("spec resolution",t)}if(s){let t=null;try{t=(0,g.buildWorkflowApprovalState)(n,s)}catch(a){d("audit state build",a)}if(t){const a=Date.parse(n.updated_at);if(!Number.isSafeInteger(a)||a<0){d("audit snapshot",new Error(`invalid run updated_at: ${n.updated_at}`))}else{let I=e.uiInstanceStore;if(!I&&e.getUiInstanceStore){try{I=e.getUiInstanceStore()}catch(l){d("audit store creation",l)}}if(!I){d("audit snapshot",new Error("no UiInstanceStore was provided"))}else{for(const l of p){try{const f=I.get(l);const $=f?.domainRef?.workflowRunId;if(!f||f.workspaceId!==e.workspaceId||$!==n.id){continue}const j=w(f.state);const y=f.updatedAt;const k=I.updateAuditSnapshot({instanceId:l,workspaceId:e.workspaceId,updatedAt:a,state:_(t)});if(k&&(w(k.state)!==j||k.updatedAt!==y)){c.projectedAuditInstanceIds.push(l)}}catch(f){d(`audit snapshot ${l}`,f)}}}}}}}if((c.changedParentTaskIds.length>0||c.projectedAuditInstanceIds.length>0)&&e.onChanged){try{e.onChanged(c)}catch(s){d("change callback",s)}}return c}}function m(e,r){const i=(0,S.previewWorkflowParentRepair)({taskRepo:e.taskRepo,run:r,workspaceId:e.workspaceId,...e.parentKinds?{parentKinds:e.parentKinds}:{}});const o={runId:r.id,runStatus:i.runStatus,parentChanges:[...i.changes],auditSnapshotChanges:[],errors:[]};const n=(t,a)=>{o.errors.push(`workflow persistence preview ${t} failed for ${r.id}: ${h(a)}`)};const u=[...new Set(i.linkedAuditInstanceIds)];if(u.length===0)return o;let c;try{c=e.resolveWorkflowSpec(r);if(!c)throw new Error(`workflow spec not found for ${r.workflow_id}`)}catch(t){n("spec resolution",t)}if(!c)return o;let d;try{d=(0,g.buildWorkflowApprovalState)(r,c)}catch(t){n("audit state build",t);return o}const p=Date.parse(r.updated_at);if(!Number.isSafeInteger(p)||p<0){n("audit snapshot",new Error(`invalid run updated_at: ${r.updated_at}`));return o}let s=e.uiInstanceStore;if(!s&&e.getUiInstanceStore){try{s=e.getUiInstanceStore()}catch(t){n("audit store creation",t)}}if(!s){n("audit snapshot",new Error("no UiInstanceStore was provided"));return o}for(const t of u){try{const a=s.get(t);if(!a||a.workspaceId!==e.workspaceId||a.domainRef.workflowRunId!==r.id){continue}if(!A(a.state,d)){o.auditSnapshotChanges.push({instanceId:t,before:a.state,after:d})}}catch(a){n(`audit snapshot ${t}`,a)}}void p;return o}

package/dist/workflow-schema.json

@@ -81,7 +81,7 @@
         },
         "cwd": {
           "type": "string",
-          "description": "skill_task/shell_task: working directory, normalized and constrained under the project root."
+          "description": "agent_task/skill_task/shell_task: working directory, normalized and constrained under the project root."
         },
         "env": {
           "type": "object",
@@ -90,6 +90,10 @@
           },
           "description": "shell_task: explicit env pass-through. Dangerous keys (LD_PRELOAD, etc.) are rejected."
         },
+        "stdin": {
+          "type": "string",
+          "description": "skill_task/shell_task: optional stdin payload. Supports {{template}} interpolation."
+        },
         "mode": {
           "type": "string",
           "enum": ["query", "execute"]
@@ -166,6 +170,10 @@
           "type": "string",
           "description": "error: failure message recorded in run.error. Supports {{template}} interpolation."
         },
+        "label": {
+          "type": "string",
+          "description": "Short human-facing step name shown in run views. Falls back to the node id."
+        },
         "on_approve": {
           "type": "string"
         },
@@ -218,19 +226,36 @@
       "required": ["max", "delay"],
       "properties": {
         "max": {
-          "type": "number"
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 10,
+          "description": "Number of additional retries after the first attempt (0 disables retry)."
         },
         "delay": {
           "type": "string",
           "enum": ["exponential", "fixed"]
         },
         "max_delay": {
-          "type": "number"
+          "type": "integer",
+          "minimum": 0,
+          "description": "Maximum retry delay in milliseconds; runtime hard-caps this at 60000."
         },
         "on": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "enum": [
+              "CLI_UNRESOLVABLE",
+              "SPAWN_FAILED",
+              "NODE_TIMEOUT",
+              "NODE_EXIT_NONZERO",
+              "OUTPUT_INVALID",
+              "RATE_LIMITED",
+              "CONFIG_INVALID",
+              "INTERRUPTED",
+              "CANCELLED",
+              "UNKNOWN"
+            ]
           }
         }
       }