@damn-dev/cli 0.14.0 → 0.15.0

package/runtime/apps/backend/dist/server.cjs

@@ -5579,6 +5579,31 @@ var require_openclawBindings = __commonJS({
   }
 });
 
+// apps/backend/dist/lib/organigramUpdate.js
+var require_organigramUpdate = __commonJS({
+  "apps/backend/dist/lib/organigramUpdate.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.OrganigramUpdateSchema = void 0;
+    var zod_12 = require("zod");
+    var ReparentOpSchema = zod_12.z.object({
+      op: zod_12.z.literal("reparent"),
+      child: zod_12.z.string().min(1),
+      // null = make child a root (reports to no one)
+      parent: zod_12.z.string().min(1).nullable()
+    });
+    var SetRoleOpSchema = zod_12.z.object({
+      op: zod_12.z.literal("set-role"),
+      agentId: zod_12.z.string().min(1),
+      role: zod_12.z.string().min(1).max(140)
+    });
+    exports2.OrganigramUpdateSchema = zod_12.z.object({
+      operations: zod_12.z.array(zod_12.z.union([ReparentOpSchema, SetRoleOpSchema])).min(1),
+      reason: zod_12.z.string().max(280).optional()
+    });
+  }
+});
+
 // apps/backend/dist/lib/delegationSecurity.js
 var require_delegationSecurity = __commonJS({
   "apps/backend/dist/lib/delegationSecurity.js"(exports2) {
@@ -7742,7 +7767,8 @@ var require_approvalRules = __commonJS({
       "git_pr",
       "cron_config",
       "workspace_guide",
-      "channel_binding"
+      "channel_binding",
+      "organigram_update"
     ]);
     function derivePattern(type, payloadRaw) {
       if (exports2.BLOCKED_TYPES.has(type))
@@ -7785,6 +7811,10 @@ var require_approvalRules = __commonJS({
           const bindingAgentId = typeof payload.bindingAgentId === "string" ? payload.bindingAgentId : "*";
           return { pattern: `binding:${plugin}:${bindingAgentId}`, ruleType: "channel_binding" };
         }
+        case "organigram_update": {
+          const op = typeof payload.op === "string" ? payload.op : "*";
+          return { pattern: `organigram:${op}`, ruleType: "organigram_update" };
+        }
         default:
           return null;
       }
@@ -9686,6 +9716,340 @@ ${conflictDiffs}`,
   }
 });
 
+// apps/backend/dist/lib/organigramParse.js
+var require_organigramParse = __commonJS({
+  "apps/backend/dist/lib/organigramParse.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.parseOrganigram = parseOrganigram;
+    var SECTION_TITLE_RE = /^(reporting|org\s*chart|structure|reporting\s+structure|hierarchy)\b/i;
+    function extractSection(md, title) {
+      const lines = md.split("\n");
+      let start = -1;
+      let end = lines.length;
+      for (let i = 0; i < lines.length; i++) {
+        const m = /^##\s+(.+?)\s*$/.exec(lines[i]);
+        if (!m)
+          continue;
+        if (start === -1 && title.test(m[1])) {
+          start = i + 1;
+          continue;
+        }
+        if (start !== -1) {
+          end = i;
+          break;
+        }
+      }
+      if (start === -1)
+        return null;
+      return lines.slice(start, end).join("\n");
+    }
+    function extractRef(rawLine) {
+      let s = rawLine.replace(/[│├└─]/g, " ").replace(/^[\s\-*•◦]+/, "").replace(/[\[\]]/g, "").trim();
+      if (!s)
+        return null;
+      const asciiStart = s.search(/[A-Za-z]/);
+      if (asciiStart > 0)
+        s = s.slice(asciiStart).trim();
+      const idMatch = /\(([A-Za-z0-9][A-Za-z0-9_-]*)\)\s*$/.exec(s);
+      const idHint = idMatch ? idMatch[1].toLowerCase() : null;
+      const display = (idMatch ? s.slice(0, idMatch.index) : s).trim();
+      if (!display && !idHint)
+        return null;
+      return { display, idHint };
+    }
+    function resolveAgent(ref, agents) {
+      if (!ref)
+        return null;
+      if (ref.idHint) {
+        const byId = agents.find((a) => a.id.toLowerCase() === ref.idHint);
+        if (byId)
+          return byId.id;
+      }
+      if (/^(human|user|owner|you|me)$/i.test(ref.display))
+        return null;
+      const norm = ref.display.toLowerCase().replace(/\s+/g, " ").trim();
+      if (!norm)
+        return null;
+      const byName = agents.find((a) => a.name.toLowerCase() === norm);
+      if (byName)
+        return byName.id;
+      const byPrefix = agents.find((a) => a.name.toLowerCase().startsWith(norm) || norm.startsWith(a.name.toLowerCase()));
+      return byPrefix?.id ?? null;
+    }
+    function indentLevel(line) {
+      const m = /^([\s│├└─]*)/.exec(line);
+      if (!m)
+        return 0;
+      return Math.floor(m[1].length / 2);
+    }
+    function buildFlatFallback(agents) {
+      const coo = agents.find((a) => a.id === "coo" || a.name.toLowerCase() === "coo");
+      if (!coo)
+        return [];
+      const out = [{ parent: null, child: coo.id }];
+      for (const a of agents) {
+        if (a.id === coo.id)
+          continue;
+        out.push({ parent: coo.id, child: a.id });
+      }
+      return out;
+    }
+    function parseOrganigram(md, agents) {
+      if (agents.length === 0)
+        return [];
+      const section = md ? extractSection(md, SECTION_TITLE_RE) : null;
+      if (!section)
+        return buildFlatFallback(agents);
+      const lines = section.split("\n").filter((l) => l.trim().length > 0);
+      if (lines.length === 0)
+        return buildFlatFallback(agents);
+      const edges = [];
+      const stack = [];
+      const seenChildren = /* @__PURE__ */ new Set();
+      for (const raw of lines) {
+        const level = indentLevel(raw);
+        const ref = extractRef(raw);
+        if (!ref)
+          continue;
+        const id = resolveAgent(ref, agents);
+        const isHumanRoot = /^(human|user|owner|you|me)$/i.test(ref.display) && !ref.idHint;
+        if (!id && !isHumanRoot)
+          continue;
+        while (stack.length > 0 && stack[stack.length - 1].level >= level)
+          stack.pop();
+        const parentNode = stack[stack.length - 1] ?? null;
+        const parent = parentNode?.id ?? null;
+        if (id) {
+          if (!seenChildren.has(id)) {
+            edges.push({ parent, child: id });
+            seenChildren.add(id);
+          }
+          stack.push({ id, level });
+        } else {
+          stack.push({ id: null, level });
+        }
+      }
+      if (edges.length === 0)
+        return buildFlatFallback(agents);
+      const flatHintMatch = /flat\s+delegation|all\s+(workspace\s+)?agents/i.test(section);
+      if (flatHintMatch) {
+        const rootAgentId = edges.find((e) => e.parent === null)?.child ?? (agents.find((a) => a.id === "coo")?.id ?? null);
+        if (rootAgentId) {
+          for (const a of agents) {
+            if (seenChildren.has(a.id) || a.id === rootAgentId)
+              continue;
+            edges.push({ parent: rootAgentId, child: a.id });
+            seenChildren.add(a.id);
+          }
+        }
+      }
+      return edges;
+    }
+  }
+});
+
+// apps/backend/dist/lib/organigramWrite.js
+var require_organigramWrite = __commonJS({
+  "apps/backend/dist/lib/organigramWrite.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.applyOrganigramOperations = applyOrganigramOperations;
+    exports2.applyReparent = applyReparent;
+    var promises_12 = require("fs/promises");
+    var path_12 = require("path");
+    var os_12 = require("os");
+    var intelligence_12 = require_intelligence();
+    var organigramParse_1 = require_organigramParse();
+    var db_12 = require_db();
+    var ORGANIGRAM_PATH = (0, path_12.join)((0, os_12.homedir)(), ".openclaw", "agents", "coo", "ORGANIGRAM.md");
+    var SECTION_TITLE_RE = /^##\s+(reporting|org\s*chart|structure|reporting\s+structure|hierarchy)\s*$/i;
+    function splitOnReportingSection(md) {
+      const lines = md.split("\n");
+      let sectionStart = -1;
+      let sectionEnd = lines.length;
+      for (let i = 0; i < lines.length; i++) {
+        if (sectionStart === -1) {
+          if (SECTION_TITLE_RE.test(lines[i])) {
+            sectionStart = i;
+            continue;
+          }
+        } else {
+          if (/^##\s+/.test(lines[i])) {
+            sectionEnd = i;
+            break;
+          }
+        }
+      }
+      if (sectionStart === -1) {
+        return { prefix: lines, body: [], suffix: [], synthesised: true };
+      }
+      return {
+        prefix: lines.slice(0, sectionStart),
+        body: lines.slice(sectionStart + 1, sectionEnd),
+        suffix: lines.slice(sectionEnd),
+        synthesised: false
+      };
+    }
+    function applyReparentOps(current, ops) {
+      const byChild = /* @__PURE__ */ new Map();
+      for (const e of current)
+        byChild.set(e.child, e.parent);
+      const rejected = [];
+      for (const op of ops) {
+        if (op.child === op.parent) {
+          rejected.push(op);
+          continue;
+        }
+        if (op.parent !== null) {
+          let cur = op.parent;
+          const seen = /* @__PURE__ */ new Set();
+          let cycle = false;
+          while (cur !== null && cur !== void 0 && !seen.has(cur)) {
+            if (cur === op.child) {
+              cycle = true;
+              break;
+            }
+            seen.add(cur);
+            cur = byChild.get(cur) ?? null;
+          }
+          if (cycle) {
+            rejected.push(op);
+            continue;
+          }
+        }
+        byChild.set(op.child, op.parent);
+      }
+      return {
+        edges: Array.from(byChild.entries()).map(([child, parent]) => ({ parent, child })),
+        rejected
+      };
+    }
+    function renderReportingSection(edges, agents) {
+      const childrenOf = /* @__PURE__ */ new Map();
+      for (const e of edges) {
+        if (e.parent === null)
+          continue;
+        const arr = childrenOf.get(e.parent) ?? [];
+        arr.push(e.child);
+        childrenOf.set(e.parent, arr);
+      }
+      const nameById = new Map(agents.map((a) => [a.id, a.name]));
+      for (const arr of childrenOf.values()) {
+        arr.sort((a, b) => (nameById.get(a) ?? a).localeCompare(nameById.get(b) ?? b));
+      }
+      const roots = edges.filter((e) => e.parent === null).map((e) => e.child);
+      roots.sort((a, b) => (nameById.get(a) ?? a).localeCompare(nameById.get(b) ?? b));
+      const out = [];
+      function emit(id, depth) {
+        const indent = "  ".repeat(depth);
+        const a = agents.find((x) => x.id === id);
+        const label = a ? `${a.emoji} ${a.name} (${a.id})` : id;
+        out.push(`${indent}- ${label}`);
+        const kids = childrenOf.get(id) ?? [];
+        for (const k of kids)
+          emit(k, depth + 1);
+      }
+      for (const r of roots)
+        emit(r, 0);
+      return out;
+    }
+    function reassemble(split, renderedBody) {
+      if (split.synthesised) {
+        const out2 = [...split.prefix];
+        if (out2.length > 0 && out2[out2.length - 1].trim() !== "")
+          out2.push("");
+        out2.push("## Reporting Structure", ...renderedBody);
+        return out2.join("\n");
+      }
+      const out = [...split.prefix, "## Reporting Structure", ...renderedBody, ...split.suffix];
+      return out.join("\n");
+    }
+    async function archivePrevious() {
+      try {
+        const prev = await (0, promises_12.readFile)(ORGANIGRAM_PATH, "utf-8");
+        if (prev.trim().length === 0)
+          return;
+        await (0, intelligence_12.atomicWrite)((0, path_12.join)((0, path_12.dirname)(ORGANIGRAM_PATH), "ORGANIGRAM.prev.md"), prev);
+      } catch {
+      }
+    }
+    async function applyOrganigramOperations(ops, workspaceId) {
+      if (ops.length === 0)
+        return { ok: false, error: "no operations" };
+      const agents = await db_12.db.agent.findMany({
+        where: { workspaceId },
+        select: { id: true, name: true, emoji: true }
+      });
+      const agentRefs = agents.map((a) => ({ id: a.id, name: a.name, emoji: a.emoji }));
+      const agentIds = new Set(agents.map((a) => a.id));
+      for (const op of ops) {
+        if (op.op === "reparent") {
+          if (!agentIds.has(op.child))
+            return { ok: false, error: `unknown agent: ${op.child}` };
+          if (op.parent !== null && !agentIds.has(op.parent))
+            return { ok: false, error: `unknown agent: ${op.parent}` };
+        } else if (op.op === "set-role") {
+          if (!agentIds.has(op.agentId))
+            return { ok: false, error: `unknown agent: ${op.agentId}` };
+        }
+      }
+      let md = "";
+      try {
+        md = await (0, promises_12.readFile)(ORGANIGRAM_PATH, "utf-8");
+      } catch {
+        md = "";
+      }
+      const split = splitOnReportingSection(md);
+      const currentEdges = (0, organigramParse_1.parseOrganigram)(md, agentRefs);
+      const reparentOps = ops.filter((o) => o.op === "reparent");
+      const { edges: mutatedEdges, rejected: rejectedReparent } = applyReparentOps(currentEdges, reparentOps);
+      let prefixLines = [...split.prefix];
+      const setRoleRejected = [];
+      for (const op of ops) {
+        if (op.op !== "set-role")
+          continue;
+        const agent = agents.find((a) => a.id === op.agentId);
+        if (!agent) {
+          setRoleRejected.push(op);
+          continue;
+        }
+        const heading = new RegExp(`^####\\s+.*\\(${op.agentId}\\)\\s*$`);
+        let i = prefixLines.findIndex((l) => heading.test(l));
+        if (i < 0) {
+          setRoleRejected.push(op);
+          continue;
+        }
+        let replaced = false;
+        for (let j = i + 1; j < Math.min(i + 7, prefixLines.length); j++) {
+          if (/^Role:\s*/i.test(prefixLines[j])) {
+            prefixLines[j] = `Role: ${op.role}`;
+            replaced = true;
+            break;
+          }
+          if (/^####?\s+/.test(prefixLines[j]) || /^##\s+/.test(prefixLines[j]))
+            break;
+        }
+        if (!replaced)
+          prefixLines.splice(i + 1, 0, `Role: ${op.role}`);
+      }
+      const renderedBody = renderReportingSection(mutatedEdges, agentRefs);
+      const newMd = reassemble({ ...split, prefix: prefixLines }, renderedBody);
+      await archivePrevious();
+      await (0, intelligence_12.atomicWrite)(ORGANIGRAM_PATH, newMd);
+      return { ok: true, content: newMd, rejected: [...rejectedReparent, ...setRoleRejected] };
+    }
+    async function applyReparent(child, parent, workspaceId) {
+      const r = await applyOrganigramOperations([{ op: "reparent", child, parent }], workspaceId);
+      if (!r.ok)
+        return r;
+      if (r.rejected.length > 0)
+        return { ok: false, error: "cycle would be created \u2014 reparent refused" };
+      return { ok: true, content: r.content };
+    }
+  }
+});
+
 // apps/backend/dist/routers/approvals.js
 var require_approvals = __commonJS({
   "apps/backend/dist/routers/approvals.js"(exports2) {
@@ -10065,6 +10429,32 @@ var require_approvals = __commonJS({
                 console.error("[channel_binding approval] apply error:", err);
               }
             })();
+          } else if (decision === "approved" && message.approval?.type === "organigram_update" && message.approval.payload) {
+            const orgPayload = JSON.parse(message.approval.payload);
+            void (async () => {
+              try {
+                const { applyOrganigramOperations } = await Promise.resolve().then(() => __importStar2(require_organigramWrite()));
+                const result = await applyOrganigramOperations(orgPayload.operations, workspace.id);
+                const ok = result.ok;
+                const summaryLine = ok ? `Organigram updated (${orgPayload.operations.length} op${orgPayload.operations.length === 1 ? "" : "s"}).${result.rejected.length > 0 ? ` ${result.rejected.length} rejected (cycle).` : ""}` : `Organigram update failed: ${result.error}`;
+                const sysMsg = await db_12.db.message.create({
+                  data: {
+                    channelId: message.channelId,
+                    senderType: "system",
+                    senderId: "system",
+                    senderName: "System",
+                    senderColor: null,
+                    content: summaryLine
+                  },
+                  include: messages_12.messageInclude
+                });
+                (0, ws_12.broadcastToChannel)(message.channelId, { type: "message.new", payload: (0, messages_12.toMessage)(sysMsg) });
+                (0, ws_12.broadcastToWorkspace)(workspace.id, { type: "delegationGraph.changed", payload: { workspaceId: workspace.id } });
+                await (0, triggerAgent_12.triggerAgentDm)(agentId, message.channelId, ok ? `[Approval granted] ${summaryLine}` : `[Approval granted but apply failed] ${result.error}`, workspace.id);
+              } catch (err) {
+                console.error("[organigram_update approval] apply error:", err);
+              }
+            })();
           } else if (decision === "approved" && message.approval?.type !== "shell_exec") {
             await (0, triggerAgent_12.triggerAgentDm)(agentId, message.channelId, "[Approval granted] Your pending action has been approved. Proceed.", workspace.id);
           } else if (decision === "rejected") {
@@ -13433,7 +13823,7 @@ var require_governance = __commonJS({
       const approvalsCreated = [];
       const delegationsInitiated = [];
       let memoryWritten = false;
-      const { extractMemoryUpdate, extractContextUpdate, extractSoulUpdate, extractHeartbeatUpdate, extractIdentityUpdate, extractSkillInstallProposal, extractSkillWriteProposal, extractCronWriteProposal, extractWorkspaceGuideUpdate, extractChannelBinding, extractDelegationRules, extractTaskInput, extractGitCommit, extractGitPR, extractGitMerge, extractDelegateBlock, extractDelegateChain, extractDelegateParallel, extractChannelPost, extractChannelUpdate, extractSkillToolCall, applyContextUpdate, applyHeartbeatUpdate, createFileEditApproval, executeSkillToolCall } = await Promise.resolve().then(() => __importStar2(require_triggerAgent()));
+      const { extractMemoryUpdate, extractContextUpdate, extractSoulUpdate, extractHeartbeatUpdate, extractIdentityUpdate, extractSkillInstallProposal, extractSkillWriteProposal, extractCronWriteProposal, extractWorkspaceGuideUpdate, extractChannelBinding, extractDelegationRules, extractOrganigramUpdate, extractTaskInput, extractGitCommit, extractGitPR, extractGitMerge, extractDelegateBlock, extractDelegateChain, extractDelegateParallel, extractChannelPost, extractChannelUpdate, extractSkillToolCall, applyContextUpdate, applyHeartbeatUpdate, createFileEditApproval, executeSkillToolCall } = await Promise.resolve().then(() => __importStar2(require_triggerAgent()));
       const { content: afterMemory, memoryAppend } = extractMemoryUpdate(responseText);
       if (memoryAppend) {
         blocksFound.push("memory-update");
@@ -13533,7 +13923,20 @@ var require_governance = __commonJS({
           });
         }
       }
-      const { content: afterTaskInput, taskInput } = extractTaskInput(afterDelegationRules);
+      const { content: afterOrganigramUpdate, organigramUpdate } = extractOrganigramUpdate(afterDelegationRules);
+      if (organigramUpdate) {
+        blocksFound.push("organigram-update");
+        void createOrganigramUpdateApproval({
+          agentId,
+          channelId,
+          workspaceId,
+          update: organigramUpdate,
+          agentName: agentName ?? agentId,
+          agentColor: agentColor ?? null,
+          externalSource
+        });
+      }
+      const { content: afterTaskInput, taskInput } = extractTaskInput(afterOrganigramUpdate);
       if (taskInput) {
         blocksFound.push("task-input");
         const { handleTaskInput } = await Promise.resolve().then(() => __importStar2(require_delegation()));
@@ -14046,6 +14449,86 @@ _${binding.reason}_`,
         console.error("[channel-binding] approval creation failed:", err);
       }
     }
+    async function createOrganigramUpdateApproval(opts) {
+      const { agentId, channelId, workspaceId, update, agentName, agentColor, externalSource } = opts;
+      try {
+        const { toMessage, messageInclude } = await Promise.resolve().then(() => __importStar2(require_messages()));
+        const { broadcastToChannel } = await Promise.resolve().then(() => __importStar2(require_ws()));
+        const { getActiveModel } = await Promise.resolve().then(() => __importStar2(require_triggerAgent()));
+        const { maybeAutoApprove } = await Promise.resolve().then(() => __importStar2(require_approvals()));
+        const agent = await db_12.db.agent.findUnique({ where: { id: agentId }, select: { defaultModel: true } });
+        const opCounts = {};
+        for (const op of update.operations)
+          opCounts[op.op] = (opCounts[op.op] ?? 0) + 1;
+        const summary = `Organigram update: ${Object.entries(opCounts).map(([op, n]) => `${n}\xD7 ${op}`).join(", ")}`;
+        const approvalMsg = await db_12.db.message.create({
+          data: {
+            channelId,
+            senderType: "agent",
+            senderId: agentId,
+            senderName: agentName,
+            senderColor: agentColor,
+            content: `${summary}${update.reason ? `
+
+_${update.reason}_` : ""}`,
+            status: "pending_approval",
+            modelUsed: await getActiveModel(agentId, agent?.defaultModel ?? "unknown"),
+            metadata: JSON.stringify({ organigramUpdate: update })
+          },
+          include: messageInclude
+        });
+        const firstOp = update.operations[0];
+        const approvalPayload = {
+          operations: update.operations,
+          reason: update.reason ?? "",
+          // surface a stable pattern for derivePattern
+          op: firstOp.op
+        };
+        await db_12.db.approval.create({
+          data: {
+            messageId: approvalMsg.id,
+            type: "organigram_update",
+            payload: JSON.stringify(approvalPayload)
+          }
+        });
+        const msgForBroadcast = await db_12.db.message.findUnique({ where: { id: approvalMsg.id }, include: messageInclude });
+        broadcastToChannel(channelId, { type: "message.new", payload: toMessage(msgForBroadcast) });
+        const autoApproved = await maybeAutoApprove({
+          messageId: approvalMsg.id,
+          agentId,
+          workspaceId,
+          approvalType: "organigram_update",
+          payload: approvalPayload
+        });
+        if (autoApproved)
+          return;
+        if (externalSource) {
+          const { sendTelegramApprovalNotification } = await Promise.resolve().then(() => __importStar2(require_telegramBridge()));
+          void sendTelegramApprovalNotification({
+            agentId,
+            chatId: externalSource.externalChatId,
+            approvalId: approvalMsg.id,
+            messageId: approvalMsg.id,
+            approvalType: "organigram_update",
+            description: summary
+          });
+        }
+        const admins = await db_12.db.workspaceMember.findMany({
+          where: { workspaceId, role: { in: ["owner", "admin"] } },
+          select: { userId: true }
+        });
+        const { sendPush } = await Promise.resolve().then(() => __importStar2(require_pushNotifications()));
+        for (const a of admins) {
+          void sendPush(a.userId, {
+            title: "Action requires approval",
+            body: summary.slice(0, 100),
+            data: { type: "approval", approvalId: approvalMsg.id, channelId }
+          });
+        }
+      } catch (err) {
+        console.error("[organigram-update] approval creation failed:", err);
+      }
+    }
     async function createDelegationRuleApproval(opts) {
       const { agentId, channelId, workspaceId, rule, agentName, agentColor, externalSource } = opts;
       try {
@@ -14196,6 +14679,7 @@ var require_triggerAgent = __commonJS({
     exports2.extractCronWriteProposal = extractCronWriteProposal;
     exports2.extractWorkspaceGuideUpdate = extractWorkspaceGuideUpdate;
     exports2.extractChannelBinding = extractChannelBinding;
+    exports2.extractOrganigramUpdate = extractOrganigramUpdate;
     exports2.applyMemoryUpdate = applyMemoryUpdate;
     exports2.applyContextUpdate = applyContextUpdate;
     exports2.extractHeartbeatUpdate = extractHeartbeatUpdate;
@@ -14233,6 +14717,7 @@ var require_triggerAgent = __commonJS({
     var cronStore_1 = require_cronStore();
     var workspaceGuide_1 = require_workspaceGuide();
     var openclawBindings_1 = require_openclawBindings();
+    var organigramUpdate_1 = require_organigramUpdate();
     var execFileAsync2 = (0, util_12.promisify)(child_process_12.execFile);
     function isFenceLine(line) {
       if (line.startsWith("````"))
@@ -14379,6 +14864,7 @@ ${newBlock}`;
     var CRON_WRITE_RE = /````cron-write\n([\s\S]*?)````|```cron-write\n([\s\S]*?)```/;
     var WORKSPACE_GUIDE_UPDATE_RE = /````workspace-guide-update\n([\s\S]*?)````|```workspace-guide-update\n([\s\S]*?)```/;
     var CHANNEL_BINDING_RE = /````channel-binding\n([\s\S]*?)````|```channel-binding\n([\s\S]*?)```/;
+    var ORGANIGRAM_UPDATE_RE = /````organigram-update\n([\s\S]*?)````|```organigram-update\n([\s\S]*?)```/;
     function extractGitPR(raw) {
       const match = raw.match(GIT_PR_RE);
       if (!match)
@@ -15031,6 +15517,10 @@ ${sectionHeader}`);
       const { content, proposal } = extractJsonBlock(raw, CHANNEL_BINDING_RE, openclawBindings_1.ChannelBindingSchema, "channel-binding");
       return { content, channelBinding: proposal };
     }
+    function extractOrganigramUpdate(raw) {
+      const { content, proposal } = extractJsonBlock(raw, ORGANIGRAM_UPDATE_RE, organigramUpdate_1.OrganigramUpdateSchema, "organigram-update");
+      return { content, organigramUpdate: proposal };
+    }
     async function applyMemoryUpdate(agentId, memoryAppend, source = "gateway") {
       const memoryDir = path_12.default.join(OPENCLAW_AGENTS_DIR, agentId, "memory");
       try {
@@ -15462,6 +15952,31 @@ Pattern syntax: \`shell:<argv0>\` (or \`shell:<argv0> <subcommand>\`), \`delegat
 You may emit MULTIPLE \`delegation-rule\` blocks in a single message (one per pattern). Each becomes its own approval card.
 
 Each rule requires human approval before it takes effect. Never propose delegation rules for: delete, publish, send, transfer, post (public write), or any destructive action without explicit user instruction. Never propose auto-approve for items in \`BLOCKED_TYPES\` (file_edit, skill_install, trust_config, git_merge, delegation_rule itself) \u2014 those are principled "always human-in-the-loop" types.`;
+    var ORGANIGRAM_UPDATE_PATCH = `
+
+## Organigram Update Protocol
+You can mutate the workspace organigram (reporting structure + role labels) via the structured \`organigram-update\` block. Prefer this over rewriting Organigram.md prose directly \u2014 the structured block is parser-stable, atomic, and the canvas reflects changes within ~1s.
+
+**Cardinal rule:** the fenced \`\`\`organigram-update\`\`\` block IS the proposal. Narrating "I've moved Birdie under Marketing" / "Reporting updated" without the fenced block does nothing.
+
+Operations:
+- \`reparent\` \u2014 change who an agent reports to. \`parent\` is an agent slug, OR \`null\` to make the child a root (reports to no one).
+- \`set-role\` \u2014 change an agent's role label in the Agent Directory section.
+
+Example: move Birdie under Marketing Lead and update Claw's role:
+\`\`\`organigram-update
+{
+  "operations": [
+    {"op": "reparent", "child": "birdie", "parent": "marketing-lead"},
+    {"op": "set-role", "agentId": "claw", "role": "Brand Voice Lead"}
+  ],
+  "reason": "Birdie now reports to the new Marketing Lead; Claw's title shortened for clarity on the canvas."
+}
+\`\`\`
+
+Cycle protection is enforced server-side \u2014 proposing a reparent that would create a loop (X under one of X's descendants) is rejected at apply time; safe to attempt. The COO retains full freedom to edit Organigram.md prose (Agent Directory descriptions, narrative sections) via the workspace dialog or the existing setOrganigram flow; only structural mutations should flow through this block.
+
+\`organigram-update\` is auto-approvable by default (low risk \u2014 metadata only). The owner can gate it via the rule pattern \`organigram:reparent\` / \`organigram:set-role\` / \`organigram:*\`.`;
     var OPS_PROTOCOL_PATCH = `
 
 ## Workspace Operations Protocol
@@ -15654,9 +16169,11 @@ You have three coordination mechanisms:
         out = patchSection(out, "## Channel Update Protocol", CHANNEL_UPDATE_PATCH.trim());
         out = patchSection(out, "## Delegation Rule Protocol", DELEGATION_RULE_PATCH.trim());
         out = patchSection(out, "## Workspace Operations Protocol", OPS_PROTOCOL_PATCH.trim());
+        out = patchSection(out, "## Organigram Update Protocol", ORGANIGRAM_UPDATE_PATCH.trim());
       } else {
         out = out.replace(/\n*## Delegation Rule Protocol\n[\s\S]*?(?=\n## |\n# |$)/, "");
         out = out.replace(/\n*## Workspace Operations Protocol\n[\s\S]*?(?=\n## |\n# |$)/, "");
+        out = out.replace(/\n*## Organigram Update Protocol\n[\s\S]*?(?=\n## |\n# |$)/, "");
       }
       if (flags.heartbeatChecklist) {
         const block = `## Heartbeat Checklist
@@ -20538,6 +21055,7 @@ var require_onboarding = __commonJS({
     var modelId_1 = require_modelId();
     var skills_12 = require_skills();
     var gateways_12 = require_gateways();
+    var ws_12 = require_ws();
     var triggerAgent_2 = require_triggerAgent();
     var execAsync = (0, util_12.promisify)(child_process_12.exec);
     var OPENROUTER_URL = "https://openrouter.ai/api/v1";
@@ -21436,7 +21954,7 @@ Or just tell me what you're working on \u2014 I'll figure out the rest.`
           return "";
         }
       }),
-      setOrganigram: trpc_12.protectedProcedure.input(zod_12.z.object({ content: zod_12.z.string() })).mutation(async ({ input }) => {
+      setOrganigram: trpc_12.protectedProcedure.input(zod_12.z.object({ content: zod_12.z.string() })).mutation(async ({ ctx, input }) => {
         await promises_12.default.mkdir(path_12.default.dirname(ORGANIGRAM_PATH), { recursive: true });
         try {
           const prev = await promises_12.default.readFile(ORGANIGRAM_PATH, "utf-8");
@@ -21447,6 +21965,7 @@ Or just tell me what you're working on \u2014 I'll figure out the rest.`
         }
         await atomicWrite(ORGANIGRAM_PATH, input.content);
         reloadCoo();
+        (0, ws_12.broadcastToWorkspace)(ctx.workspaceId, { type: "delegationGraph.changed", payload: { workspaceId: ctx.workspaceId } });
         return { ok: true };
       }),
       hasGoogleAuth: trpc_12.publicProcedure.query(() => {
@@ -22093,6 +22612,29 @@ You may emit MULTIPLE \`delegation-rule\` blocks in a single message (one per pa
 
 The human approves each rule before it takes effect. Never propose delegation rules for: delete, publish, send, transfer, post (public write), or any destructive action without explicit user instruction. Never propose auto-approve for items in \`BLOCKED_TYPES\` (file_edit, skill_install, trust_config, git_merge, delegation_rule itself) \u2014 those are principled "always human-in-the-loop" types.
 
+## Organigram Update Protocol
+
+You can mutate the workspace organigram (reporting structure + role labels) via the structured \`organigram-update\` block. Prefer this over rewriting Organigram.md prose directly \u2014 the structured block is parser-stable, atomic, and the canvas reflects changes within ~1s.
+
+**Cardinal rule:** the fenced \`\`\`organigram-update\`\`\` block IS the proposal. Narrating "I've moved Birdie under Marketing" / "Reporting updated" without the fenced block does nothing.
+
+Operations:
+- \`reparent\` \u2014 change who an agent reports to. \`parent\` is an agent slug, OR \`null\` to make the child a root (reports to no one).
+- \`set-role\` \u2014 change an agent's role label in the Agent Directory section.
+
+Example: move Birdie under Marketing Lead and update Claw's role:
+\`\`\`organigram-update
+{
+  "operations": [
+    {"op": "reparent", "child": "birdie", "parent": "marketing-lead"},
+    {"op": "set-role", "agentId": "claw", "role": "Brand Voice Lead"}
+  ],
+  "reason": "Birdie now reports to the new Marketing Lead; Claw's title shortened for clarity on the canvas."
+}
+\`\`\`
+
+Cycle protection is enforced server-side \u2014 proposing a reparent that would create a loop is rejected at apply time; safe to attempt. The COO retains full freedom to edit Organigram.md prose (Agent Directory descriptions, narrative sections) via the workspace dialog or the existing setOrganigram flow; only structural mutations should flow through this block. \`organigram-update\` is auto-approvable by default (low risk \u2014 metadata only); the owner can gate it via the rule pattern \`organigram:reparent\` / \`organigram:set-role\` / \`organigram:*\`.
+
 ## Federation (Cross-Instance Delegation)
 
 This workspace may have federated nodes \u2014 separate damn.dev instances running in isolated Docker containers. They appear in the "Federation Nodes" section of your runtime context below (live state, refreshed every turn). Each node has a current \`delegationPolicy\` that governs who on THIS hub may dispatch tasks INTO it:
@@ -23165,6 +23707,9 @@ ${historyLines.join("\n\n")}
           } catch {
           }
         }
+        const { content: afterOrganigramUpdate, organigramUpdate } = (0, triggerAgent_12.extractOrganigramUpdate)(cleanContent);
+        if (organigramUpdate)
+          cleanContent = afterOrganigramUpdate;
         const { content: afterMissionPlan, missionPlan } = extractMissionPlan(cleanContent);
         if (missionPlan)
           cleanContent = afterMissionPlan;
@@ -23246,6 +23791,9 @@ ${historyLines.join("\n\n")}
         if (delegationRulePayload) {
           msgMetadata.delegationRule = delegationRulePayload;
         }
+        if (organigramUpdate) {
+          msgMetadata.organigramUpdate = organigramUpdate;
+        }
         if (missionPlan) {
           msgMetadata.missionPlan = missionPlan;
         }
@@ -23268,7 +23816,7 @@ ${historyLines.join("\n\n")}
             (0, approvalPolicy_12.logDelegatedApproval)({ agentId: "coo", channelId: "chan_coo", action: skillAction });
           }
         }
-        const needsApproval = !trustDelegated && !!trustUpdatePayload || !skillDelegated && !!skillWriteProposal || !!delegationRulePayload || !!missionPlan || !!nodeSpawnProposalId || remoteAgentProposals.length > 0;
+        const needsApproval = !trustDelegated && !!trustUpdatePayload || !skillDelegated && !!skillWriteProposal || !!delegationRulePayload || !!organigramUpdate || !!missionPlan || !!nodeSpawnProposalId || remoteAgentProposals.length > 0;
         const cooMsg = await db_12.db.message.create({
           data: {
             channelId: "chan_coo",
@@ -23335,6 +23883,26 @@ ${historyLines.join("\n\n")}
           (0, ws_12.broadcast)({ type: "approval.created", payload: { approvalId: cooMsg.id, agentId: "coo", channelId: "chan_coo", priority: delPrio } });
           (0, ws_12.broadcastToWorkspace)(ctx.workspaceId, { type: "delegationGraph.changed", payload: { workspaceId: ctx.workspaceId } });
         }
+        if (organigramUpdate) {
+          const firstOp = organigramUpdate.operations[0];
+          const orgPayload = {
+            operations: organigramUpdate.operations,
+            reason: organigramUpdate.reason ?? "",
+            op: firstOp.op
+          };
+          const orgPrio = (0, approvalPolicy_12.classifyPriority)(`organigram:${firstOp.op}`, "organigram_update");
+          const orgExpiry = (0, approvalPolicy_12.computeExpiresAt)(orgPrio);
+          await db_12.db.approval.create({
+            data: {
+              messageId: cooMsg.id,
+              type: "organigram_update",
+              payload: JSON.stringify(orgPayload),
+              priority: orgPrio,
+              expiresAt: orgExpiry
+            }
+          });
+          (0, ws_12.broadcast)({ type: "approval.created", payload: { approvalId: cooMsg.id, agentId: "coo", channelId: "chan_coo", priority: orgPrio } });
+        }
         (0, ws_12.broadcastToChannel)("chan_coo", { type: "message.new", payload: (0, messages_12.toMessage)(cooMsg) });
         if (dispatchBlock) {
           const plan = {
@@ -25219,139 +25787,6 @@ var require_shellExec2 = __commonJS({
   }
 });
 
-// apps/backend/dist/lib/organigramParse.js
-var require_organigramParse = __commonJS({
-  "apps/backend/dist/lib/organigramParse.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.parseOrganigram = parseOrganigram;
-    var SECTION_TITLE_RE = /^(reporting|org\s*chart|structure|reporting\s+structure|hierarchy)\b/i;
-    function extractSection(md, title) {
-      const lines = md.split("\n");
-      let start = -1;
-      let end = lines.length;
-      for (let i = 0; i < lines.length; i++) {
-        const m = /^##\s+(.+?)\s*$/.exec(lines[i]);
-        if (!m)
-          continue;
-        if (start === -1 && title.test(m[1])) {
-          start = i + 1;
-          continue;
-        }
-        if (start !== -1) {
-          end = i;
-          break;
-        }
-      }
-      if (start === -1)
-        return null;
-      return lines.slice(start, end).join("\n");
-    }
-    function extractRef(rawLine) {
-      let s = rawLine.replace(/[│├└─]/g, " ").replace(/^[\s\-*•◦]+/, "").replace(/[\[\]]/g, "").trim();
-      if (!s)
-        return null;
-      const asciiStart = s.search(/[A-Za-z]/);
-      if (asciiStart > 0)
-        s = s.slice(asciiStart).trim();
-      const idMatch = /\(([A-Za-z0-9][A-Za-z0-9_-]*)\)\s*$/.exec(s);
-      const idHint = idMatch ? idMatch[1].toLowerCase() : null;
-      const display = (idMatch ? s.slice(0, idMatch.index) : s).trim();
-      if (!display && !idHint)
-        return null;
-      return { display, idHint };
-    }
-    function resolveAgent(ref, agents) {
-      if (!ref)
-        return null;
-      if (ref.idHint) {
-        const byId = agents.find((a) => a.id.toLowerCase() === ref.idHint);
-        if (byId)
-          return byId.id;
-      }
-      if (/^(human|user|owner|you|me)$/i.test(ref.display))
-        return null;
-      const norm = ref.display.toLowerCase().replace(/\s+/g, " ").trim();
-      if (!norm)
-        return null;
-      const byName = agents.find((a) => a.name.toLowerCase() === norm);
-      if (byName)
-        return byName.id;
-      const byPrefix = agents.find((a) => a.name.toLowerCase().startsWith(norm) || norm.startsWith(a.name.toLowerCase()));
-      return byPrefix?.id ?? null;
-    }
-    function indentLevel(line) {
-      const m = /^([\s│├└─]*)/.exec(line);
-      if (!m)
-        return 0;
-      return Math.floor(m[1].length / 2);
-    }
-    function buildFlatFallback(agents) {
-      const coo = agents.find((a) => a.id === "coo" || a.name.toLowerCase() === "coo");
-      if (!coo)
-        return [];
-      const out = [{ parent: null, child: coo.id }];
-      for (const a of agents) {
-        if (a.id === coo.id)
-          continue;
-        out.push({ parent: coo.id, child: a.id });
-      }
-      return out;
-    }
-    function parseOrganigram(md, agents) {
-      if (agents.length === 0)
-        return [];
-      const section = md ? extractSection(md, SECTION_TITLE_RE) : null;
-      if (!section)
-        return buildFlatFallback(agents);
-      const lines = section.split("\n").filter((l) => l.trim().length > 0);
-      if (lines.length === 0)
-        return buildFlatFallback(agents);
-      const edges = [];
-      const stack = [];
-      const seenChildren = /* @__PURE__ */ new Set();
-      for (const raw of lines) {
-        const level = indentLevel(raw);
-        const ref = extractRef(raw);
-        if (!ref)
-          continue;
-        const id = resolveAgent(ref, agents);
-        const isHumanRoot = /^(human|user|owner|you|me)$/i.test(ref.display) && !ref.idHint;
-        if (!id && !isHumanRoot)
-          continue;
-        while (stack.length > 0 && stack[stack.length - 1].level >= level)
-          stack.pop();
-        const parentNode = stack[stack.length - 1] ?? null;
-        const parent = parentNode?.id ?? null;
-        if (id) {
-          if (!seenChildren.has(id)) {
-            edges.push({ parent, child: id });
-            seenChildren.add(id);
-          }
-          stack.push({ id, level });
-        } else {
-          stack.push({ id: null, level });
-        }
-      }
-      if (edges.length === 0)
-        return buildFlatFallback(agents);
-      const flatHintMatch = /flat\s+delegation|all\s+(workspace\s+)?agents/i.test(section);
-      if (flatHintMatch) {
-        const rootAgentId = edges.find((e) => e.parent === null)?.child ?? (agents.find((a) => a.id === "coo")?.id ?? null);
-        if (rootAgentId) {
-          for (const a of agents) {
-            if (seenChildren.has(a.id) || a.id === rootAgentId)
-              continue;
-            edges.push({ parent: rootAgentId, child: a.id });
-            seenChildren.add(a.id);
-          }
-        }
-      }
-      return edges;
-    }
-  }
-});
-
 // apps/backend/dist/routers/delegations.js
 var require_delegations = __commonJS({
   "apps/backend/dist/routers/delegations.js"(exports2) {
@@ -25366,6 +25801,7 @@ var require_delegations = __commonJS({
     var path_12 = require("path");
     var os_12 = require("os");
     var organigramParse_1 = require_organigramParse();
+    var organigramWrite_1 = require_organigramWrite();
     var ORGANIGRAM_PATH = (0, path_12.join)((0, os_12.homedir)(), ".openclaw", "agents", "coo", "ORGANIGRAM.md");
     async function readOrganigramSafe() {
       try {
@@ -25479,6 +25915,38 @@ var require_delegations = __commonJS({
         await db_12.db.delegationRule.delete({ where: { id: input.id } });
         (0, ws_12.broadcastToWorkspace)(ctx.workspaceId, { type: "delegationGraph.changed", payload: { workspaceId: ctx.workspaceId } });
       }),
+      // Canvas drag-to-reparent — the human IS the approver, so this is a
+      // plain `protectedProcedure` mutation. Atomic-rewrites ORGANIGRAM.md's
+      // `## Reporting Structure` section; preserves the rest of the file
+      // verbatim. Broadcasts so all canvases refetch.
+      reparent: trpc_12.protectedProcedure.input(zod_12.z.object({
+        childAgentId: zod_12.z.string().min(1),
+        // null = make child a root (reports to no one). Useful to demote a
+        // sub-tree to root level or remove a reporting relationship.
+        parentAgentId: zod_12.z.string().nullable()
+      })).mutation(async ({ ctx, input }) => {
+        const childAgent = await db_12.db.agent.findFirst({
+          where: { id: input.childAgentId, workspaceId: ctx.workspaceId },
+          select: { id: true }
+        });
+        if (!childAgent)
+          throw new Error("Child agent not in this workspace");
+        if (input.parentAgentId) {
+          const parentAgent = await db_12.db.agent.findFirst({
+            where: { id: input.parentAgentId, workspaceId: ctx.workspaceId },
+            select: { id: true }
+          });
+          if (!parentAgent)
+            throw new Error("Parent agent not in this workspace");
+          if (input.parentAgentId === input.childAgentId)
+            throw new Error("An agent cannot report to itself");
+        }
+        const result = await (0, organigramWrite_1.applyReparent)(input.childAgentId, input.parentAgentId, ctx.workspaceId);
+        if (!result.ok)
+          throw new Error(result.error);
+        (0, ws_12.broadcastToWorkspace)(ctx.workspaceId, { type: "delegationGraph.changed", payload: { workspaceId: ctx.workspaceId } });
+        return { ok: true };
+      }),
       // Team Canvas projection. Workspace-scoped read of the delegation/trust
       // topology. Parses `delegate:*` patterns into edge / starburst / halo /
       // full-mesh shapes server-side — the canvas layer never sees raw patterns.
@@ -31285,7 +31753,7 @@ var require_package = __commonJS({
     module2.exports = {
       name: "backend",
       private: true,
-      version: "0.14.0",
+      version: "0.15.0",
       scripts: {
         dev: "tsx watch src/server.ts",
         build: "tsc && rm -rf dist/resources && cp -r resources dist/resources",