@kafca/agentdock 0.1.13 → 0.1.15

package/dist-electron/services/local-ai-core/src/acp/local-core-acp-store.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalCoreAcpStore = void 0;
+exports.redactSecrets = redactSecrets;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_sqlite_1 = require("node:sqlite");
@@ -123,6 +124,98 @@ class LocalCoreAcpStore {
         FOREIGN KEY (job_id) REFERENCES scheduled_jobs(id) ON DELETE CASCADE
       );
       CREATE INDEX IF NOT EXISTS idx_scheduled_job_runs_job_triggered ON scheduled_job_runs (job_id, triggered_at DESC);
+      CREATE TABLE IF NOT EXISTS workspace_registry (
+        id TEXT PRIMARY KEY,
+        display_name TEXT NOT NULL,
+        path TEXT NOT NULL,
+        device_id TEXT NOT NULL,
+        default_runtime_id TEXT,
+        git_json TEXT NOT NULL DEFAULT '{}',
+        health_json TEXT NOT NULL DEFAULT '{}',
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        last_opened_at TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_workspace_registry_updated ON workspace_registry (updated_at DESC);
+      CREATE TABLE IF NOT EXISTS agent_tasks (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        device_id TEXT NOT NULL,
+        runtime_id TEXT NOT NULL,
+        thread_id TEXT,
+        run_id TEXT,
+        title TEXT NOT NULL,
+        prompt TEXT,
+        status TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        queued_at TEXT,
+        started_at TEXT,
+        completed_at TEXT,
+        summary TEXT,
+        error TEXT,
+        timeline_json TEXT NOT NULL DEFAULT '[]',
+        logs_json TEXT NOT NULL DEFAULT '[]',
+        artifacts_json TEXT NOT NULL DEFAULT '[]',
+        approval_ids_json TEXT NOT NULL DEFAULT '[]',
+        metadata_json TEXT NOT NULL DEFAULT '{}'
+      );
+      CREATE INDEX IF NOT EXISTS idx_agent_tasks_workspace_updated ON agent_tasks (workspace_id, updated_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_agent_tasks_status_updated ON agent_tasks (status, updated_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_agent_tasks_run ON agent_tasks (run_id);
+      CREATE TABLE IF NOT EXISTS workspace_security_settings (
+        workspace_id TEXT PRIMARY KEY,
+        permissions_json TEXT NOT NULL,
+        allow_paths_json TEXT NOT NULL DEFAULT '[]',
+        deny_paths_json TEXT NOT NULL DEFAULT '[]',
+        updated_at TEXT NOT NULL,
+        updated_by TEXT
+      );
+      CREATE TABLE IF NOT EXISTS approval_requests (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        task_id TEXT,
+        thread_id TEXT,
+        run_id TEXT,
+        device_id TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        status TEXT NOT NULL,
+        risk_level TEXT NOT NULL,
+        title TEXT NOT NULL,
+        description TEXT NOT NULL,
+        requested_action TEXT NOT NULL,
+        command TEXT,
+        scopes_json TEXT NOT NULL DEFAULT '[]',
+        options_json TEXT NOT NULL DEFAULT '[]',
+        requested_by TEXT,
+        resolved_by TEXT,
+        resolution TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        resolved_at TEXT,
+        expires_at TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}'
+      );
+      CREATE INDEX IF NOT EXISTS idx_approval_requests_workspace_updated ON approval_requests (workspace_id, updated_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_approval_requests_status_updated ON approval_requests (status, updated_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_approval_requests_task ON approval_requests (task_id);
+      CREATE INDEX IF NOT EXISTS idx_approval_requests_run ON approval_requests (run_id);
+      CREATE TABLE IF NOT EXISTS audit_events (
+        id TEXT PRIMARY KEY,
+        type TEXT NOT NULL,
+        workspace_id TEXT,
+        task_id TEXT,
+        approval_id TEXT,
+        actor TEXT,
+        summary TEXT NOT NULL,
+        risk_level TEXT,
+        created_at TEXT NOT NULL,
+        metadata_json TEXT NOT NULL DEFAULT '{}'
+      );
+      CREATE INDEX IF NOT EXISTS idx_audit_events_workspace_created ON audit_events (workspace_id, created_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_audit_events_task_created ON audit_events (task_id, created_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_audit_events_type_created ON audit_events (type, created_at DESC);
     `);
         this.ensureColumn('scheduled_jobs', 'execution_mode', "TEXT NOT NULL DEFAULT 'same-thread'");
     }
@@ -311,6 +404,394 @@ class LocalCoreAcpStore {
       WHERE id = ?
     `).get(runId);
     }
+    listWorkspaceRegistry() {
+        const rows = this.db.prepare(`
+      SELECT id, display_name, path, device_id, default_runtime_id, git_json, health_json, metadata_json, created_at, updated_at, last_opened_at
+      FROM workspace_registry
+      ORDER BY display_name ASC
+    `).all();
+        return rows.map((row) => this.toWorkspaceRegistryEntry(row));
+    }
+    getWorkspaceRegistryEntry(workspaceId) {
+        const row = this.db.prepare(`
+      SELECT id, display_name, path, device_id, default_runtime_id, git_json, health_json, metadata_json, created_at, updated_at, last_opened_at
+      FROM workspace_registry
+      WHERE id = ?
+    `).get(workspaceId);
+        return row ? this.toWorkspaceRegistryEntry(row) : undefined;
+    }
+    upsertWorkspaceRegistryEntry(input) {
+        const id = input.workspaceId || input.displayName;
+        const now = new Date().toISOString();
+        const existing = this.getWorkspaceRegistryEntry(id);
+        const health = input.health || existing?.health || {
+            status: 'unknown',
+            summary: 'Workspace health has not been checked.',
+            issues: [],
+        };
+        this.db.prepare(`
+      INSERT INTO workspace_registry (
+        id, display_name, path, device_id, default_runtime_id, git_json, health_json, metadata_json, created_at, updated_at, last_opened_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        display_name = excluded.display_name,
+        path = excluded.path,
+        device_id = excluded.device_id,
+        default_runtime_id = excluded.default_runtime_id,
+        git_json = excluded.git_json,
+        health_json = excluded.health_json,
+        metadata_json = excluded.metadata_json,
+        updated_at = excluded.updated_at
+    `).run(id, input.displayName, input.path, input.deviceId, input.defaultRuntimeId || null, JSON.stringify(input.git || existing?.git || {}), JSON.stringify(health), JSON.stringify(input.metadata || existing?.metadata || {}), existing?.createdAt || now, now, existing?.lastOpenedAt || null);
+        return this.getWorkspaceRegistryEntry(id);
+    }
+    updateWorkspaceRegistryEntry(workspaceId, input) {
+        const existing = this.getWorkspaceRegistryEntry(workspaceId);
+        if (!existing) {
+            throw new Error(`Workspace not found: ${workspaceId}`);
+        }
+        return this.upsertWorkspaceRegistryEntry({
+            workspaceId,
+            displayName: input.displayName || existing.displayName,
+            path: input.path || existing.path,
+            deviceId: existing.deviceId,
+            defaultRuntimeId: input.defaultRuntimeId === null ? undefined : input.defaultRuntimeId || existing.defaultRuntimeId,
+            git: existing.git,
+            health: existing.health,
+            metadata: input.metadata || existing.metadata,
+        });
+    }
+    deleteWorkspaceRegistryEntry(workspaceId) {
+        this.db.prepare('DELETE FROM workspace_registry WHERE id = ?').run(workspaceId);
+        return { deleted: true };
+    }
+    touchWorkspaceRegistryEntry(workspaceId) {
+        this.db.prepare('UPDATE workspace_registry SET last_opened_at = ?, updated_at = ? WHERE id = ?')
+            .run(new Date().toISOString(), new Date().toISOString(), workspaceId);
+    }
+    getWorkspaceSecuritySettings(workspaceId) {
+        const row = this.db.prepare(`
+      SELECT workspace_id, permissions_json, allow_paths_json, deny_paths_json, updated_at, updated_by
+      FROM workspace_security_settings
+      WHERE workspace_id = ?
+    `).get(workspaceId);
+        if (row) {
+            return this.toWorkspaceSecuritySettings(row);
+        }
+        const now = new Date().toISOString();
+        return {
+            workspaceId,
+            permissions: defaultPermissions(),
+            allowPaths: [],
+            denyPaths: [],
+            updatedAt: now,
+        };
+    }
+    updateWorkspaceSecuritySettings(workspaceId, input) {
+        const existing = this.getWorkspaceSecuritySettings(workspaceId);
+        const now = new Date().toISOString();
+        const next = {
+            workspaceId,
+            permissions: {
+                ...existing.permissions,
+                ...(input.permissions || {}),
+            },
+            allowPaths: Array.isArray(input.allowPaths) ? input.allowPaths : existing.allowPaths,
+            denyPaths: Array.isArray(input.denyPaths) ? input.denyPaths : existing.denyPaths,
+            updatedAt: now,
+            updatedBy: input.updatedBy || existing.updatedBy,
+        };
+        this.db.prepare(`
+      INSERT INTO workspace_security_settings (workspace_id, permissions_json, allow_paths_json, deny_paths_json, updated_at, updated_by)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(workspace_id) DO UPDATE SET
+        permissions_json = excluded.permissions_json,
+        allow_paths_json = excluded.allow_paths_json,
+        deny_paths_json = excluded.deny_paths_json,
+        updated_at = excluded.updated_at,
+        updated_by = excluded.updated_by
+    `).run(workspaceId, JSON.stringify(next.permissions), JSON.stringify(next.allowPaths), JSON.stringify(next.denyPaths), now, next.updatedBy || null);
+        this.createAuditEvent({
+            type: 'permission.changed',
+            workspaceId,
+            actor: next.updatedBy || 'local',
+            summary: 'Workspace security settings changed.',
+            metadata: {
+                permissions: next.permissions,
+                allowPaths: next.allowPaths,
+                denyPaths: next.denyPaths,
+            },
+        });
+        return this.getWorkspaceSecuritySettings(workspaceId);
+    }
+    createApprovalRequest(input) {
+        const id = `approval:${(0, node_crypto_1.randomUUID)()}`;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      INSERT INTO approval_requests (
+        id, workspace_id, task_id, thread_id, run_id, device_id, kind, status, risk_level, title, description,
+        requested_action, command, scopes_json, options_json, requested_by, created_at, updated_at, expires_at, metadata_json
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.workspaceId, input.taskId || null, input.threadId || null, input.runId || null, input.deviceId || 'local', input.kind, input.riskLevel, input.title, redactSecrets(input.description), redactSecrets(input.requestedAction), input.command ? redactSecrets(input.command) : null, JSON.stringify(input.scopes || []), JSON.stringify(input.options || []), input.requestedBy || null, now, now, input.expiresAt || null, JSON.stringify(input.metadata || {}));
+        const approval = this.getApprovalRequest(id);
+        this.createAuditEvent({
+            type: 'approval.requested',
+            workspaceId: approval.workspaceId,
+            taskId: approval.taskId,
+            approvalId: approval.approvalId,
+            actor: approval.requestedBy || 'agent',
+            summary: approval.title,
+            riskLevel: approval.riskLevel,
+            metadata: {
+                kind: approval.kind,
+                requestedAction: approval.requestedAction,
+                scopes: approval.scopes,
+            },
+        });
+        if (approval.taskId) {
+            this.updateAgentTask(approval.taskId, {
+                approvalId: approval.approvalId,
+                timelineItem: {
+                    type: 'approval_requested',
+                    title: approval.title,
+                    description: approval.description,
+                    metadata: { approvalId: approval.approvalId, riskLevel: approval.riskLevel },
+                },
+            });
+        }
+        return approval;
+    }
+    listApprovalRequests(query = {}) {
+        const predicates = [];
+        const params = [];
+        if (query.workspaceId) {
+            predicates.push('workspace_id = ?');
+            params.push(query.workspaceId);
+        }
+        if (query.taskId) {
+            predicates.push('task_id = ?');
+            params.push(query.taskId);
+        }
+        if (query.status) {
+            const statuses = Array.isArray(query.status) ? query.status : [query.status];
+            predicates.push(`status IN (${statuses.map(() => '?').join(', ')})`);
+            params.push(...statuses);
+        }
+        const limit = Math.max(1, Math.min(Number(query.limit || 50), 100));
+        const where = predicates.length ? `WHERE ${predicates.join(' AND ')}` : '';
+        const rows = this.db.prepare(`
+      SELECT *
+      FROM approval_requests
+      ${where}
+      ORDER BY updated_at DESC
+      LIMIT ?
+    `).all(...params, limit);
+        return { approvals: rows.map((row) => this.toApprovalRequest(row)) };
+    }
+    getApprovalRequest(approvalId) {
+        const row = this.db.prepare('SELECT * FROM approval_requests WHERE id = ?').get(approvalId);
+        return row ? this.toApprovalRequest(row) : undefined;
+    }
+    resolveApprovalRequest(approvalId, input) {
+        const existing = this.getApprovalRequest(approvalId);
+        if (!existing) {
+            throw new Error(`Approval not found: ${approvalId}`);
+        }
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      UPDATE approval_requests
+      SET status = ?, resolved_by = ?, resolution = ?, resolved_at = ?, updated_at = ?
+      WHERE id = ?
+    `).run(input.status, input.resolvedBy || existing.resolvedBy || 'local', input.resolution || existing.resolution || null, now, now, approvalId);
+        const approval = this.getApprovalRequest(approvalId);
+        this.createAuditEvent({
+            type: input.status === 'rejected' ? 'approval.rejected' : 'approval.resolved',
+            workspaceId: approval.workspaceId,
+            taskId: approval.taskId,
+            approvalId: approval.approvalId,
+            actor: approval.resolvedBy || 'local',
+            summary: `Approval ${input.status}: ${approval.title}`,
+            riskLevel: approval.riskLevel,
+            metadata: { resolution: approval.resolution },
+        });
+        if (approval.taskId) {
+            this.updateAgentTask(approval.taskId, {
+                timelineItem: {
+                    type: 'approval_resolved',
+                    title: `Approval ${input.status}`,
+                    description: approval.resolution || approval.title,
+                    metadata: { approvalId: approval.approvalId, status: input.status },
+                },
+            });
+        }
+        return approval;
+    }
+    createAuditEvent(input) {
+        const id = `audit:${(0, node_crypto_1.randomUUID)()}`;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      INSERT INTO audit_events (id, type, workspace_id, task_id, approval_id, actor, summary, risk_level, created_at, metadata_json)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.type, input.workspaceId || null, input.taskId || null, input.approvalId || null, input.actor || null, redactSecrets(input.summary), input.riskLevel || null, now, JSON.stringify(input.metadata || {}));
+        return this.toAuditEvent(this.db.prepare('SELECT * FROM audit_events WHERE id = ?').get(id));
+    }
+    listAuditEvents(query = {}) {
+        const predicates = [];
+        const params = [];
+        if (query.workspaceId) {
+            predicates.push('workspace_id = ?');
+            params.push(query.workspaceId);
+        }
+        if (query.taskId) {
+            predicates.push('task_id = ?');
+            params.push(query.taskId);
+        }
+        if (query.approvalId) {
+            predicates.push('approval_id = ?');
+            params.push(query.approvalId);
+        }
+        if (query.type) {
+            const types = Array.isArray(query.type) ? query.type : [query.type];
+            predicates.push(`type IN (${types.map(() => '?').join(', ')})`);
+            params.push(...types);
+        }
+        const limit = Math.max(1, Math.min(Number(query.limit || 50), 100));
+        const where = predicates.length ? `WHERE ${predicates.join(' AND ')}` : '';
+        const rows = this.db.prepare(`
+      SELECT *
+      FROM audit_events
+      ${where}
+      ORDER BY created_at DESC
+      LIMIT ?
+    `).all(...params, limit);
+        return { events: rows.map((row) => this.toAuditEvent(row)) };
+    }
+    createAgentTask(input) {
+        const id = `task:${(0, node_crypto_1.randomUUID)()}`;
+        const now = new Date().toISOString();
+        const status = input.status || 'created';
+        const timeline = [{
+                id: `timeline:${(0, node_crypto_1.randomUUID)()}`,
+                type: 'status_change',
+                title: `Task ${status}`,
+                status,
+                timestamp: now,
+            }];
+        this.db.prepare(`
+      INSERT INTO agent_tasks (
+        id, workspace_id, device_id, runtime_id, thread_id, run_id, title, prompt, status, created_at, updated_at, queued_at,
+        started_at, completed_at, summary, error, timeline_json, logs_json, artifacts_json, approval_ids_json, metadata_json
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, ?, '[]', '[]', '[]', ?)
+    `).run(id, input.workspaceId, input.deviceId, input.runtimeId, input.threadId || null, input.runId || null, input.title, input.prompt ? redactSecrets(input.prompt) : null, status, now, now, status === 'queued' ? now : null, status === 'running' ? now : null, JSON.stringify(timeline), JSON.stringify(input.metadata || {}));
+        const task = this.getAgentTask(id);
+        this.createAuditEvent({
+            type: 'task.created',
+            workspaceId: task.workspaceId,
+            taskId: task.taskId,
+            actor: 'local',
+            summary: `Task created: ${task.title}`,
+            metadata: { runtimeId: task.runtimeId, threadId: task.threadId, runId: task.runId },
+        });
+        return task;
+    }
+    listAgentTasks(query = {}) {
+        const predicates = [];
+        const params = [];
+        if (query.workspaceId) {
+            predicates.push('workspace_id = ?');
+            params.push(query.workspaceId);
+        }
+        if (query.runtimeId) {
+            predicates.push('runtime_id = ?');
+            params.push(query.runtimeId);
+        }
+        if (query.status) {
+            const statuses = Array.isArray(query.status) ? query.status : [query.status];
+            predicates.push(`status IN (${statuses.map(() => '?').join(', ')})`);
+            params.push(...statuses);
+        }
+        const limit = Math.max(1, Math.min(Number(query.limit || 50), 100));
+        const where = predicates.length ? `WHERE ${predicates.join(' AND ')}` : '';
+        const rows = this.db.prepare(`
+      SELECT *
+      FROM agent_tasks
+      ${where}
+      ORDER BY updated_at DESC
+      LIMIT ?
+    `).all(...params, limit);
+        return { tasks: rows.map((row) => this.toAgentTask(row)) };
+    }
+    getAgentTask(taskId) {
+        const row = this.db.prepare('SELECT * FROM agent_tasks WHERE id = ?').get(taskId);
+        return row ? this.toAgentTask(row) : undefined;
+    }
+    getAgentTaskByRunId(runId) {
+        const row = this.db.prepare('SELECT * FROM agent_tasks WHERE run_id = ? ORDER BY updated_at DESC LIMIT 1').get(runId);
+        return row ? this.toAgentTask(row) : undefined;
+    }
+    updateAgentTask(taskId, input) {
+        const existing = this.getAgentTask(taskId);
+        if (!existing) {
+            throw new Error(`Task not found: ${taskId}`);
+        }
+        const now = new Date().toISOString();
+        const nextStatus = input.status || existing.status;
+        const timeline = [...existing.timeline];
+        const logs = [...existing.logs];
+        const artifacts = [...existing.artifacts];
+        const approvalIds = [...existing.approvalIds];
+        if (input.status && input.status !== existing.status) {
+            timeline.push({
+                id: `timeline:${(0, node_crypto_1.randomUUID)()}`,
+                type: 'status_change',
+                title: `Task ${input.status}`,
+                status: input.status,
+                timestamp: now,
+            });
+        }
+        if (input.timelineItem) {
+            timeline.push({
+                id: input.timelineItem.id || `timeline:${(0, node_crypto_1.randomUUID)()}`,
+                timestamp: input.timelineItem.timestamp || now,
+                ...input.timelineItem,
+            });
+        }
+        if (input.log) {
+            logs.push({
+                id: input.log.id || `log:${(0, node_crypto_1.randomUUID)()}`,
+                timestamp: input.log.timestamp || now,
+                ...input.log,
+                message: redactSecrets(input.log.message),
+            });
+        }
+        if (input.artifact) {
+            artifacts.push({
+                id: input.artifact.id || `artifact:${(0, node_crypto_1.randomUUID)()}`,
+                ...input.artifact,
+            });
+        }
+        if (input.approvalId && !approvalIds.includes(input.approvalId)) {
+            approvalIds.push(input.approvalId);
+        }
+        this.db.prepare(`
+      UPDATE agent_tasks
+      SET status = ?, thread_id = ?, run_id = ?, title = ?, updated_at = ?, queued_at = ?, started_at = ?, completed_at = ?,
+          summary = ?, error = ?, timeline_json = ?, logs_json = ?, artifacts_json = ?, approval_ids_json = ?, metadata_json = ?
+      WHERE id = ?
+    `).run(nextStatus, input.threadId || existing.threadId || null, input.runId || existing.runId || null, input.title || existing.title, now, existing.queuedAt || (nextStatus === 'queued' ? now : null), existing.startedAt || (nextStatus === 'running' ? now : null), existing.completedAt || (['completed', 'failed', 'cancelled'].includes(nextStatus) ? now : null), input.summary ?? existing.summary ?? null, input.error === null ? null : input.error ?? existing.error ?? null, JSON.stringify(timeline), JSON.stringify(logs), JSON.stringify(artifacts), JSON.stringify(approvalIds), JSON.stringify(input.metadata || existing.metadata || {}), taskId);
+        const task = this.getAgentTask(taskId);
+        if (input.status && input.status !== existing.status) {
+            this.createAuditEvent({
+                type: 'task.updated',
+                workspaceId: task.workspaceId,
+                taskId: task.taskId,
+                actor: 'local',
+                summary: `Task status changed to ${input.status}.`,
+                metadata: { previousStatus: existing.status, status: input.status, runId: task.runId },
+            });
+        }
+        return task;
+    }
     listScheduledJobs(workspaceId) {
         const query = workspaceId
             ? `
@@ -663,6 +1144,118 @@ class LocalCoreAcpStore {
             platformMessageId: row.platform_message_id || undefined,
         };
     }
+    toWorkspaceRegistryEntry(row) {
+        const activeTaskCount = Number(this.db.prepare(`
+      SELECT COUNT(*) AS total
+      FROM agent_tasks
+      WHERE workspace_id = ? AND status IN ('created', 'queued', 'running', 'waiting_for_user')
+    `).get(row.id)?.total || 0);
+        const recentTaskRows = this.db.prepare(`
+      SELECT id
+      FROM agent_tasks
+      WHERE workspace_id = ?
+      ORDER BY updated_at DESC
+      LIMIT 8
+    `).all(row.id);
+        return {
+            workspaceId: row.id,
+            displayName: row.display_name,
+            path: row.path,
+            deviceId: row.device_id,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+            lastOpenedAt: row.last_opened_at || undefined,
+            defaultRuntimeId: row.default_runtime_id || undefined,
+            git: parseJson(row.git_json, { isRepo: false }),
+            health: parseJson(row.health_json, {
+                status: 'unknown',
+                summary: 'Workspace health has not been checked.',
+                issues: [],
+            }),
+            activeTaskCount,
+            recentTaskIds: recentTaskRows.map((item) => item.id),
+            metadata: parseJson(row.metadata_json, {}),
+        };
+    }
+    toAgentTask(row) {
+        return {
+            taskId: row.id,
+            workspaceId: row.workspace_id,
+            deviceId: row.device_id,
+            runtimeId: row.runtime_id,
+            threadId: row.thread_id || undefined,
+            runId: row.run_id || undefined,
+            title: row.title,
+            prompt: row.prompt || undefined,
+            status: row.status,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+            queuedAt: row.queued_at || undefined,
+            startedAt: row.started_at || undefined,
+            completedAt: row.completed_at || undefined,
+            summary: row.summary || undefined,
+            error: row.error || undefined,
+            timeline: parseJson(row.timeline_json, []),
+            logs: parseJson(row.logs_json, []),
+            artifacts: parseJson(row.artifacts_json, []),
+            approvalIds: parseJson(row.approval_ids_json, []),
+            metadata: parseJson(row.metadata_json, {}),
+        };
+    }
+    toWorkspaceSecuritySettings(row) {
+        return {
+            workspaceId: row.workspace_id,
+            permissions: {
+                ...defaultPermissions(),
+                ...parseJson(row.permissions_json, {}),
+            },
+            allowPaths: parseJson(row.allow_paths_json, []),
+            denyPaths: parseJson(row.deny_paths_json, []),
+            updatedAt: row.updated_at,
+            updatedBy: row.updated_by || undefined,
+        };
+    }
+    toApprovalRequest(row) {
+        return {
+            approvalId: row.id,
+            workspaceId: row.workspace_id,
+            taskId: row.task_id || undefined,
+            threadId: row.thread_id || undefined,
+            runId: row.run_id || undefined,
+            deviceId: row.device_id,
+            kind: row.kind,
+            status: row.status,
+            riskLevel: row.risk_level,
+            title: row.title,
+            description: row.description,
+            requestedAction: row.requested_action,
+            command: row.command || undefined,
+            scopes: parseJson(row.scopes_json, []),
+            options: parseJson(row.options_json, []),
+            requestedBy: row.requested_by || undefined,
+            resolvedBy: row.resolved_by || undefined,
+            resolution: row.resolution || undefined,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+            resolvedAt: row.resolved_at || undefined,
+            expiresAt: row.expires_at || undefined,
+            metadata: parseJson(row.metadata_json, {}),
+        };
+    }
+    toAuditEvent(row) {
+        return {
+            auditId: row.id,
+            type: row.type,
+            workspaceId: row.workspace_id || undefined,
+            taskId: row.task_id || undefined,
+            approvalId: row.approval_id || undefined,
+            actor: row.actor || undefined,
+            summary: row.summary,
+            riskLevel: row.risk_level || undefined,
+            createdAt: row.created_at,
+            metadata: parseJson(row.metadata_json, {}),
+        };
+    }
     ensureColumn(table, column, definition) {
         const rows = this.db.prepare(`PRAGMA table_info(${table})`).all();
         if (rows.some((row) => row.name === column)) {
@@ -672,3 +1265,27 @@ class LocalCoreAcpStore {
     }
 }
 exports.LocalCoreAcpStore = LocalCoreAcpStore;
+function parseJson(value, fallback) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return fallback;
+    }
+}
+function defaultPermissions() {
+    return {
+        'workspace.read': 'allow',
+        'workspace.write': 'ask',
+        'command.execute': 'ask',
+        'network.access': 'ask',
+        'secrets.access': 'deny',
+        'git.modify': 'ask',
+    };
+}
+function redactSecrets(value) {
+    return value
+        .replace(/\b(sk-[A-Za-z0-9_-]{12,})\b/g, '[REDACTED_SECRET]')
+        .replace(/\b([A-Za-z0-9_]*TOKEN[A-Za-z0-9_]*|[A-Za-z0-9_]*SECRET[A-Za-z0-9_]*|[A-Za-z0-9_]*KEY[A-Za-z0-9_]*)=([^\s]+)/gi, '$1=[REDACTED_SECRET]')
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._-]+/gi, '$1[REDACTED_SECRET]');
+}

package/dist-electron/services/local-ai-core/src/acp/local-core-acp-turn-coordinator.js

@@ -103,6 +103,17 @@ class LocalCoreAcpTurnCoordinator {
             isSchedulerAdd,
             options,
         };
+        const approvalId = this.options.createApprovalRequest?.({
+            threadId: session.threadId,
+            runId: currentRunId,
+            title: toolTitle ? `Approve ${toolTitle}` : 'Approve agent action',
+            description: toolTitle || 'Agent requested permission before continuing.',
+            command: toolTitle,
+            options,
+        });
+        if (approvalId) {
+            permissionRequest.approvalId = approvalId;
+        }
         session.pendingPermissionByRun.set(currentRunId, permissionRequest);
         if (session.currentTurn) {
             session.currentTurn.permission = permissionRequest;