@lumenflow/cli 3.19.0 → 3.21.0

package/packs/sidekick/manifest.yaml

@@ -1,6 +1,7 @@
 id: sidekick
 version: 0.1.0
 config_key: sidekick
+policy_factory: policy-factory.ts#createSidekickPolicyFactory
 task_types:
   - sidekick
 tools:
@@ -49,7 +50,7 @@ tools:
       properties:
         status:
           type: string
-          enum: [pending, done]
+          enum: [pending, done, canceled]
         priority:
           type: string
           enum: [P0, P1, P2, P3]
@@ -67,6 +68,67 @@ tools:
     output_schema:
       type: object
       additionalProperties: true
+  - name: task:update
+    entry: tool-impl/task-tools.ts
+    permission: write
+    required_scopes:
+      - type: path
+        pattern: .sidekick/**
+        access: read
+      - type: path
+        pattern: .sidekick/**
+        access: write
+    input_schema:
+      type: object
+      properties:
+        id:
+          type: string
+          minLength: 1
+        title:
+          type: string
+          minLength: 1
+        description:
+          type: string
+        priority:
+          type: string
+          enum: [P0, P1, P2, P3]
+        tags:
+          type: array
+          items: { type: string }
+        due_at:
+          type: string
+        cron:
+          type: string
+        dry_run:
+          type: boolean
+      required: [id]
+      additionalProperties: false
+    output_schema:
+      type: object
+      additionalProperties: true
+  - name: task:cancel
+    entry: tool-impl/task-tools.ts
+    permission: admin
+    required_scopes:
+      - type: path
+        pattern: .sidekick/**
+        access: read
+      - type: path
+        pattern: .sidekick/**
+        access: write
+    input_schema:
+      type: object
+      properties:
+        id:
+          type: string
+          minLength: 1
+        dry_run:
+          type: boolean
+      required: [id]
+      additionalProperties: false
+    output_schema:
+      type: object
+      additionalProperties: true
   - name: task:complete
     entry: tool-impl/task-tools.ts
     permission: write
@@ -174,6 +236,29 @@ tools:
       type: object
       additionalProperties: true
   - name: memory:forget
+    entry: tool-impl/memory-tools.ts
+    permission: admin
+    required_scopes:
+      - type: path
+        pattern: .sidekick/**
+        access: read
+      - type: path
+        pattern: .sidekick/**
+        access: write
+    input_schema:
+      type: object
+      properties:
+        id:
+          type: string
+          minLength: 1
+        dry_run:
+          type: boolean
+      required: [id]
+      additionalProperties: false
+    output_schema:
+      type: object
+      additionalProperties: true
+  - name: memory:update
     entry: tool-impl/memory-tools.ts
     permission: write
     required_scopes:
@@ -189,6 +274,15 @@ tools:
         id:
           type: string
           minLength: 1
+        type:
+          type: string
+          enum: [fact, preference, note, snippet]
+        content:
+          type: string
+          minLength: 1
+        tags:
+          type: array
+          items: { type: string }
         dry_run:
           type: boolean
       required: [id]
@@ -222,6 +316,43 @@ tools:
     output_schema:
       type: object
       additionalProperties: true
+  - name: channel:list
+    entry: tool-impl/channel-tools.ts
+    permission: read
+    required_scopes:
+      - type: path
+        pattern: .sidekick/**
+        access: read
+    input_schema:
+      type: object
+      properties: {}
+      additionalProperties: false
+    output_schema:
+      type: object
+      additionalProperties: true
+  - name: channel:delete
+    entry: tool-impl/channel-tools.ts
+    permission: admin
+    required_scopes:
+      - type: path
+        pattern: .sidekick/**
+        access: read
+      - type: path
+        pattern: .sidekick/**
+        access: write
+    input_schema:
+      type: object
+      properties:
+        id:
+          type: string
+          minLength: 1
+        dry_run:
+          type: boolean
+      required: [id]
+      additionalProperties: false
+    output_schema:
+      type: object
+      additionalProperties: true
   - name: channel:send
     entry: tool-impl/channel-tools.ts
     permission: write
@@ -342,6 +473,73 @@ tools:
     output_schema:
       type: object
       additionalProperties: true
+  - name: routine:update
+    entry: tool-impl/routine-tools.ts
+    permission: write
+    required_scopes:
+      - type: path
+        pattern: .sidekick/**
+        access: read
+      - type: path
+        pattern: .sidekick/**
+        access: write
+    input_schema:
+      type: object
+      properties:
+        id:
+          type: string
+          minLength: 1
+        name:
+          type: string
+          minLength: 1
+        steps:
+          type: array
+          minItems: 1
+          items:
+            type: object
+            properties:
+              tool:
+                type: string
+                minLength: 1
+              input:
+                type: object
+                additionalProperties: true
+            required: [tool]
+            additionalProperties: false
+        cron:
+          type: string
+        enabled:
+          type: boolean
+        dry_run:
+          type: boolean
+      required: [id]
+      additionalProperties: false
+    output_schema:
+      type: object
+      additionalProperties: true
+  - name: routine:delete
+    entry: tool-impl/routine-tools.ts
+    permission: admin
+    required_scopes:
+      - type: path
+        pattern: .sidekick/**
+        access: read
+      - type: path
+        pattern: .sidekick/**
+        access: write
+    input_schema:
+      type: object
+      properties:
+        id:
+          type: string
+          minLength: 1
+        dry_run:
+          type: boolean
+      required: [id]
+      additionalProperties: false
+    output_schema:
+      type: object
+      additionalProperties: true
   - name: routine:run
     entry: tool-impl/routine-tools.ts
     permission: read

package/packs/sidekick/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumenflow/packs-sidekick",
-  "version": "3.19.0",
+  "version": "3.21.0",
   "description": "Sidekick personal assistant pack for LumenFlow — 16 tools for task management, typed memory, channels, routines, and audit",
   "keywords": [
     "lumenflow",
@@ -50,6 +50,9 @@
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   },
+  "dependencies": {
+    "@lumenflow/kernel": "workspace:^"
+  },
   "devDependencies": {
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"

package/packs/sidekick/policy-factory.ts

@@ -0,0 +1,38 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { POLICY_TRIGGERS, type PackPolicyFactory, type PolicyRule } from '@lumenflow/kernel';
+import { SIDEKICK_POLICY_ID_PREFIX } from './constants.js';
+
+export const SIDEKICK_APPROVAL_REQUIRED_TOOL_NAMES = [
+  'task:cancel',
+  'memory:forget',
+  'channel:delete',
+  'routine:delete',
+] as const;
+
+const SIDEKICK_APPROVAL_REQUIRED_TOOL_NAME_SET = new Set<string>(
+  SIDEKICK_APPROVAL_REQUIRED_TOOL_NAMES,
+);
+
+export function isSidekickApprovalRequiredToolName(toolName: string): boolean {
+  return SIDEKICK_APPROVAL_REQUIRED_TOOL_NAME_SET.has(toolName);
+}
+
+export const createSidekickPolicyFactory: PackPolicyFactory = async () => {
+  if (SIDEKICK_APPROVAL_REQUIRED_TOOL_NAME_SET.size === 0) {
+    return [];
+  }
+
+  const approvalRule: PolicyRule = {
+    id: `${SIDEKICK_POLICY_ID_PREFIX}.destructive-approval`,
+    trigger: POLICY_TRIGGERS.ON_TOOL_REQUEST,
+    decision: 'approval_required',
+    reason: 'Destructive Sidekick tools require explicit approval before execution.',
+    when: (context) =>
+      typeof context.tool_name === 'string' &&
+      isSidekickApprovalRequiredToolName(context.tool_name.trim()),
+  };
+
+  return [approvalRule];
+};

package/packs/sidekick/tool-impl/channel-tools.ts

@@ -23,6 +23,8 @@ import {
 
 const TOOL_NAMES = {
   CONFIGURE: 'channel:configure',
+  LIST: 'channel:list',
+  DELETE: 'channel:delete',
   SEND: 'channel:send',
   RECEIVE: 'channel:receive',
 } as const;
@@ -116,6 +118,99 @@ async function channelConfigureTool(
   return success({ channel: resolvedChannel as unknown as Record<string, unknown> });
 }
 
+// ---------------------------------------------------------------------------
+// channel:list
+// ---------------------------------------------------------------------------
+
+async function channelListTool(_input: unknown, _context?: ToolContextLike): Promise<ToolOutput> {
+  const storage = getStoragePort();
+  const channels = await storage.readStore('channels');
+  const messages = await storage.readStore('messages');
+
+  const items = channels
+    .map((channel) => {
+      const channelMessages = messages.filter((message) => message.channel_id === channel.id);
+      const lastMessage = channelMessages.toSorted(
+        (left, right) => Date.parse(right.created_at) - Date.parse(left.created_at),
+      )[0];
+
+      return {
+        ...channel,
+        message_count: channelMessages.length,
+        last_message_at: lastMessage?.created_at,
+      };
+    })
+    .toSorted((left, right) => {
+      const leftTs = left.last_message_at ?? left.updated_at;
+      const rightTs = right.last_message_at ?? right.updated_at;
+      return Date.parse(rightTs) - Date.parse(leftTs);
+    });
+
+  return success({
+    items: items as unknown as Record<string, unknown>,
+    count: items.length,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// channel:delete
+// ---------------------------------------------------------------------------
+
+async function channelDeleteTool(input: unknown, context?: ToolContextLike): Promise<ToolOutput> {
+  const parsed = toRecord(input);
+  const id = asNonEmptyString(parsed.id);
+
+  if (!id) {
+    return failure('INVALID_INPUT', 'id is required.');
+  }
+
+  const storage = getStoragePort();
+  const channels = await storage.readStore('channels');
+  const channel = channels.find((entry) => entry.id === id);
+
+  if (!channel) {
+    return failure('NOT_FOUND', `channel ${id} was not found.`);
+  }
+
+  const messages = await storage.readStore('messages');
+  const deletedMessages = messages.filter((message) => message.channel_id === id);
+
+  if (isDryRun(parsed)) {
+    return success({
+      dry_run: true,
+      deleted_id: id,
+      deleted_message_count: deletedMessages.length,
+    });
+  }
+
+  await storage.withLock(async () => {
+    const latestChannels = await storage.readStore('channels');
+    const latestMessages = await storage.readStore('messages');
+    await storage.writeStore(
+      'channels',
+      latestChannels.filter((entry) => entry.id !== id),
+    );
+    await storage.writeStore(
+      'messages',
+      latestMessages.filter((message) => message.channel_id !== id),
+    );
+    await storage.appendAudit(
+      buildAuditEvent({
+        tool: TOOL_NAMES.DELETE,
+        op: 'delete',
+        context,
+        ids: [id],
+        details: { deleted_message_count: deletedMessages.length },
+      }),
+    );
+  });
+
+  return success({
+    deleted_id: id,
+    deleted_message_count: deletedMessages.length,
+  });
+}
+
 // ---------------------------------------------------------------------------
 // channel:send
 // ---------------------------------------------------------------------------
@@ -390,6 +485,10 @@ export default async function channelTools(
   switch (context?.tool_name) {
     case TOOL_NAMES.CONFIGURE:
       return channelConfigureTool(input, context);
+    case TOOL_NAMES.LIST:
+      return channelListTool(input, context);
+    case TOOL_NAMES.DELETE:
+      return channelDeleteTool(input, context);
     case TOOL_NAMES.SEND:
       return channelSendTool(input, context);
     case TOOL_NAMES.RECEIVE:

package/packs/sidekick/tool-impl/memory-tools.ts

@@ -26,10 +26,11 @@ import {
 const TOOL_NAMES = {
   STORE: 'memory:store',
   RECALL: 'memory:recall',
+  UPDATE: 'memory:update',
   FORGET: 'memory:forget',
 } as const;
 
-const VALID_MEMORY_TYPES: MemoryType[] = ['fact', 'preference', 'note'];
+const VALID_MEMORY_TYPES: MemoryType[] = ['fact', 'preference', 'note', 'snippet'];
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -126,6 +127,88 @@ async function memoryRecallTool(input: unknown, _context?: ToolContextLike): Pro
   });
 }
 
+// ---------------------------------------------------------------------------
+// memory:update
+// ---------------------------------------------------------------------------
+
+async function memoryUpdateTool(input: unknown, context?: ToolContextLike): Promise<ToolOutput> {
+  const parsed = toRecord(input);
+  const id = asNonEmptyString(parsed.id);
+
+  if (!id) {
+    return failure('INVALID_INPUT', 'id is required.');
+  }
+
+  const patch: Partial<MemoryRecord> = {};
+  if (parsed.type !== undefined) {
+    const type = asMemoryType(parsed.type);
+    if (!type) {
+      return failure('INVALID_INPUT', 'type must be one of fact, preference, note, snippet.');
+    }
+    patch.type = type;
+  }
+  if (parsed.content !== undefined) {
+    const content = asNonEmptyString(parsed.content);
+    if (!content) {
+      return failure('INVALID_INPUT', 'content must be a non-empty string when provided.');
+    }
+    patch.content = content;
+  }
+  if (parsed.tags !== undefined) {
+    patch.tags = asStringArray(parsed.tags);
+  }
+
+  if (Object.keys(patch).length === 0) {
+    return failure(
+      'INVALID_INPUT',
+      'memory:update requires at least one of type, content, or tags.',
+    );
+  }
+
+  const storage = getStoragePort();
+  const memories = await storage.readStore('memories');
+  const memory = memories.find((entry) => entry.id === id);
+
+  if (!memory) {
+    return failure('NOT_FOUND', `memory ${id} was not found.`);
+  }
+
+  const preview: MemoryRecord = {
+    ...memory,
+    ...patch,
+    updated_at: nowIso(),
+  };
+
+  if (isDryRun(parsed)) {
+    return success({
+      dry_run: true,
+      memory: preview as unknown as Record<string, unknown>,
+    });
+  }
+
+  await storage.withLock(async () => {
+    const latest = await storage.readStore('memories');
+    const target = latest.find((entry) => entry.id === id);
+    if (!target) {
+      return;
+    }
+    Object.assign(target, preview);
+    await storage.writeStore('memories', latest);
+    await storage.appendAudit(
+      buildAuditEvent({
+        tool: TOOL_NAMES.UPDATE,
+        op: 'update',
+        context,
+        ids: [id],
+      }),
+    );
+  });
+
+  const updated = await storage.readStore('memories');
+  const updatedMemory = updated.find((entry) => entry.id === id);
+  return success({ memory: updatedMemory as unknown as Record<string, unknown> });
+}
+
 // ---------------------------------------------------------------------------
 // memory:forget
 // ---------------------------------------------------------------------------
@@ -180,6 +263,8 @@ export default async function memoryTools(
       return memoryStoreTool(input, context);
     case TOOL_NAMES.RECALL:
       return memoryRecallTool(input, context);
+    case TOOL_NAMES.UPDATE:
+      return memoryUpdateTool(input, context);
     case TOOL_NAMES.FORGET:
       return memoryForgetTool(input, context);
     default: