@lumenflow/cli 4.24.0 → 5.0.1

package/packs/sidekick/tool-impl/task-tools.ts

@@ -18,6 +18,13 @@ import {
   type ToolContextLike,
   type ToolOutput,
 } from './shared.js';
+import {
+  buildTaskCompletedEvent,
+  buildTaskCreatedEvent,
+  buildTaskScheduledEvent,
+  buildTaskSnoozedEvent,
+  emitSidekickEvent,
+} from '../sidekick-events.js';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -97,6 +104,16 @@ function buildCanceledTask(task: TaskRecord): TaskRecord {
   };
 }
 
+function movedDueDateLater(
+  previousDueAt: string | undefined,
+  nextDueAt: string | undefined,
+): boolean {
+  if (!previousDueAt || !nextDueAt) {
+    return false;
+  }
+  return Date.parse(nextDueAt) > Date.parse(previousDueAt);
+}
+
 // ---------------------------------------------------------------------------
 // task:create
 // ---------------------------------------------------------------------------
@@ -140,6 +157,8 @@ async function taskCreateTool(input: unknown, context?: ToolContextLike): Promis
     );
   });
 
+  await emitSidekickEvent(buildTaskCreatedEvent(task));
+
   return success({ task: task as unknown as Record<string, unknown> });
 }
 
@@ -234,6 +253,8 @@ async function taskUpdateTool(input: unknown, context?: ToolContextLike): Promis
     });
   }
 
+  const previousDueAt = task.due_at ?? null;
+
   await storage.withLock(async () => {
     const latest = await storage.readStore('tasks');
     const target = latest.find((entry) => entry.id === id);
@@ -254,6 +275,15 @@ async function taskUpdateTool(input: unknown, context?: ToolContextLike): Promis
 
   const updated = await storage.readStore('tasks');
   const updatedTask = updated.find((entry) => entry.id === id);
+  if (updatedTask && movedDueDateLater(previousDueAt ?? undefined, updatedTask.due_at)) {
+    await emitSidekickEvent(
+      buildTaskSnoozedEvent({
+        task_id: id,
+        previous_due_at: previousDueAt,
+        due_at: updatedTask.due_at ?? previousDueAt ?? '',
+      }),
+    );
+  }
   return success({ task: updatedTask as unknown as Record<string, unknown> });
 }
 
@@ -309,6 +339,9 @@ async function taskCompleteTool(input: unknown, context?: ToolContextLike): Prom
 
   const updated = await storage.readStore('tasks');
   const completedTask = updated.find((t) => t.id === id);
+  if (completedTask) {
+    await emitSidekickEvent(buildTaskCompletedEvent(completedTask));
+  }
 
   return success({ task: completedTask as unknown as Record<string, unknown> });
 }
@@ -391,6 +424,7 @@ async function taskScheduleTool(input: unknown, context?: ToolContextLike): Prom
 
   const dueAt = asNonEmptyString(parsed.due_at);
   const cron = asNonEmptyString(parsed.cron);
+  const previousDueAt = task.due_at ?? null;
 
   if (isDryRun(parsed)) {
     const preview = {
@@ -429,6 +463,18 @@ async function taskScheduleTool(input: unknown, context?: ToolContextLike): Prom
 
   const updated = await storage.readStore('tasks');
   const scheduledTask = updated.find((t) => t.id === id);
+  if (scheduledTask) {
+    await emitSidekickEvent(buildTaskScheduledEvent(scheduledTask));
+    if (movedDueDateLater(previousDueAt ?? undefined, scheduledTask.due_at)) {
+      await emitSidekickEvent(
+        buildTaskSnoozedEvent({
+          task_id: id,
+          previous_due_at: previousDueAt,
+          due_at: scheduledTask.due_at ?? previousDueAt ?? '',
+        }),
+      );
+    }
+  }
 
   return success({ task: scheduledTask as unknown as Record<string, unknown> });
 }

package/packs/sidekick/tsconfig.json

@@ -15,6 +15,6 @@
     "checkJs": false,
     "noEmitOnError": true
   },
-  "include": ["*.ts", "tools/**/*.ts", "tool-impl/**/*.ts"],
+  "include": ["*.ts", "tools/**/*.ts", "tool-impl/**/*.ts", "src/**/*.ts"],
   "exclude": ["node_modules", "dist", "__tests__"]
 }

package/packs/software-delivery/manifest-schema.ts

@@ -37,6 +37,13 @@ export interface SoftwareDeliveryManifestTool {
   permission: ToolPermission;
   required_scopes: PathScope[];
   internal_only?: boolean;
+  /**
+   * WU-2729 (INIT-060 Phase 2, ADR-013 §3): approval-surface identifiers the
+   * tool must present to callers before runtime dispatch. Empty array means
+   * no approval gate; undefined means the tool does not declare approval
+   * metadata (treated the same as empty by the discovery surface).
+   */
+  required_approvals?: string[];
 }
 
 export interface SoftwareDeliveryManifestPolicy {
@@ -57,6 +64,11 @@ export interface SoftwareDeliveryPackManifest {
   evidence_types: string[];
   state_aliases: Record<string, string>;
   lane_templates: Array<{ id: string }>;
+  /** WU-2718 (INIT-060 WU-1, ADR-013). */
+  emitted_event_kinds: string[];
+  subscribed_event_kinds: string[];
+  required_approvals: string[];
+  surfaces_required: string[];
 }
 
 function asRecord(input: unknown, label: string): Record<string, unknown> {
@@ -166,6 +178,12 @@ function parseTool(input: unknown, index: number): SoftwareDeliveryManifestTool
     throw new Error(`tools[${index}].permission is invalid.`);
   }
 
+  // WU-2729: optional per-tool required_approvals list.
+  const parsedApprovals =
+    tool.required_approvals === undefined
+      ? undefined
+      : parseStringArray(tool.required_approvals, `tools[${index}].required_approvals`);
+
   return {
     name: parseNonEmptyString(tool.name, `tools[${index}].name`),
     entry: parseNonEmptyString(tool.entry, `tools[${index}].entry`),
@@ -180,6 +198,7 @@ function parseTool(input: unknown, index: number): SoftwareDeliveryManifestTool
             }
             return tool.internal_only;
           })(),
+    ...(parsedApprovals === undefined ? {} : { required_approvals: parsedApprovals }),
   };
 }
 
@@ -233,6 +252,17 @@ export const SoftwareDeliveryManifestSchema: Parser<SoftwareDeliveryPackManifest
         const entry = asRecord(laneTemplate, `lane_templates[${index}]`);
         return { id: parseNonEmptyString(entry.id, `lane_templates[${index}].id`) };
       }),
+      // WU-2718 (INIT-060 WU-1, ADR-013): manifest extension fields.
+      emitted_event_kinds: parseStringArray(
+        manifest.emitted_event_kinds ?? [],
+        'emitted_event_kinds',
+      ),
+      subscribed_event_kinds: parseStringArray(
+        manifest.subscribed_event_kinds ?? [],
+        'subscribed_event_kinds',
+      ),
+      required_approvals: parseStringArray(manifest.required_approvals ?? [], 'required_approvals'),
+      surfaces_required: parseStringArray(manifest.surfaces_required ?? [], 'surfaces_required'),
     };
   },
 };

package/packs/software-delivery/manifest.ts

@@ -31,6 +31,51 @@ export type {
 } from './manifest-schema.js';
 
 const FULL_WORKSPACE_SCOPE_PATTERN = '**';
+const SOFTWARE_DELIVERY_WRITE_DIRECTORY_PATTERNS = [
+  '.changeset/**',
+  '.claude/**',
+  '.codex/**',
+  '.cursor/**',
+  '.github/**',
+  '.git/**',
+  '.husky/**',
+  '.lumenflow/**',
+  '.vercel/**',
+  '.windsurf/**',
+  'apps/**',
+  'docs/**',
+  'packages/**',
+  'scripts/**',
+  'tools/**',
+  'worktrees/**',
+] as const;
+const SOFTWARE_DELIVERY_ROOT_WRITE_FILE_PATTERNS = [
+  '.gitignore',
+  '.npmrc',
+  'LUMENFLOW.md',
+  'README.md',
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  'turbo.json',
+  'workspace.yaml',
+  '*.cjs',
+  '*.js',
+  '*.json',
+  '*.md',
+  '*.mjs',
+  '*.sh',
+  '*.toml',
+  '*.ts',
+  '*.tsx',
+  '*.txt',
+  '*.yaml',
+  '*.yml',
+] as const;
+const SOFTWARE_DELIVERY_WRITE_SCOPE_PATTERNS = [
+  ...SOFTWARE_DELIVERY_WRITE_DIRECTORY_PATTERNS,
+  ...SOFTWARE_DELIVERY_ROOT_WRITE_FILE_PATTERNS,
+] as const;
 const GIT_STATUS_TOOL_ENTRY = 'tool-impl/git-tools.ts#gitStatusTool';
 const WU_STATUS_TOOL_ENTRY = 'tool-impl/wu-lifecycle-tools.ts#wuStatusTool';
 const WU_CREATE_TOOL_ENTRY = 'tool-impl/wu-lifecycle-tools.ts#wuCreateTool';
@@ -55,6 +100,10 @@ const WU_RELEASE_TOOL_ENTRY = 'tool-impl/wu-lifecycle-tools.ts#wuReleaseTool';
 const WU_RECOVER_TOOL_ENTRY = 'tool-impl/wu-lifecycle-tools.ts#wuRecoverTool';
 const WU_REPAIR_TOOL_ENTRY = 'tool-impl/wu-lifecycle-tools.ts#wuRepairTool';
 const GATES_TOOL_ENTRY = 'tool-impl/wu-lifecycle-tools.ts#gatesTool';
+// WU-2729 (INIT-060 Phase 2): gates:docs exposes docs-only gate runs via a
+// dedicated manifest entry so remote callers can request the docs gate
+// without opting into the permissive gates handler surface.
+const GATES_DOCS_TOOL_ENTRY = 'tool-impl/wu-lifecycle-tools.ts#gatesDocsTool';
 const CONFIG_SET_TOOL_ENTRY = 'tool-impl/runtime-native-tools.ts#configSetTool';
 const CONFIG_GET_TOOL_ENTRY = 'tool-impl/runtime-native-tools.ts#configGetTool';
 const MEM_INIT_TOOL_ENTRY = 'tool-impl/memory-tools.ts#memInitTool';
@@ -193,6 +242,7 @@ const TOOL_PERMISSIONS = {
   'flow:bottlenecks': 'read',
   'flow:report': 'read',
   gates: 'write',
+  'gates:docs': 'write',
   'file:delete': 'write',
   'file:edit': 'write',
   'file:read': 'read',
@@ -272,6 +322,7 @@ const TOOL_ENTRY_OVERRIDES: Partial<Record<ToolName, string>> = {
   'wu:repair': WU_REPAIR_TOOL_ENTRY,
   'wu:infer-lane': WU_INFER_LANE_TOOL_ENTRY,
   gates: GATES_TOOL_ENTRY,
+  'gates:docs': GATES_DOCS_TOOL_ENTRY,
   'mem:init': MEM_INIT_TOOL_ENTRY,
   'mem:start': MEM_START_TOOL_ENTRY,
   'mem:ready': MEM_READY_TOOL_ENTRY,
@@ -348,28 +399,104 @@ export interface SoftwareDeliveryMigrationScorecard {
   realHandlerEntries: number;
 }
 
+function createPathScopes(
+  patterns: readonly string[],
+  access: (typeof TOOL_SCOPE_ACCESS)[keyof typeof TOOL_SCOPE_ACCESS],
+): PathScope[] {
+  return patterns.map((pattern) => ({
+    type: TOOL_SCOPE_TYPES.PATH,
+    pattern,
+    access,
+  }));
+}
+
 function requiredScopesForPermission(permission: ToolPermission): PathScope[] {
-  return [
-    {
-      type: TOOL_SCOPE_TYPES.PATH,
-      pattern: FULL_WORKSPACE_SCOPE_PATTERN,
-      access:
-        permission === TOOL_PERMISSION_VALUES.READ
-          ? TOOL_SCOPE_ACCESS.READ
-          : TOOL_SCOPE_ACCESS.WRITE,
-    },
-  ];
+  if (permission === TOOL_PERMISSION_VALUES.READ) {
+    return createPathScopes([FULL_WORKSPACE_SCOPE_PATTERN], TOOL_SCOPE_ACCESS.READ);
+  }
+
+  return createPathScopes(SOFTWARE_DELIVERY_WRITE_SCOPE_PATTERNS, TOOL_SCOPE_ACCESS.WRITE);
+}
+
+/**
+ * WU-2729 (INIT-060 Phase 2): the 10 software-delivery pack tools that are
+ * callable remotely via POST /tools/:name. The HTTP surface uses this list
+ * to build its allowlist so the set is the single source of truth (no
+ * duplicate allowlist in surface code). ADR-013 §3 tool exposure.
+ */
+export const REMOTE_CALLABLE_TOOLS = [
+  'gates',
+  'gates:docs',
+  'lane:suggest',
+  'lane:health',
+  'plan:create',
+  'plan:promote',
+  'initiative:create',
+  'initiative:add-wu',
+  'initiative:status',
+  'flow:report',
+] as const satisfies readonly ToolName[];
+
+export type RemoteCallableToolName = (typeof REMOTE_CALLABLE_TOOLS)[number];
+
+/**
+ * Well-known approval identifiers the software-delivery pack may request.
+ * Kept narrow on purpose; adding a new identifier requires an ADR.
+ */
+export const SOFTWARE_DELIVERY_APPROVAL_IDS = {
+  REMOTE_MUTATION: 'software-delivery:remote_mutation',
+} as const;
+
+/**
+ * WU-2729 (INIT-060 Phase 2): per-tool required_approvals overrides.
+ * Tools absent from this table default to `[]` (no approval required).
+ * Read-only tools MUST remain at `[]`; state-mutating remote-callable
+ * tools SHOULD request an explicit approval identifier so the conductor
+ * UI can surface the approval gate to operators.
+ */
+const APPROVAL_OVERRIDES: Partial<Record<ToolName, readonly string[]>> = {
+  'lane:suggest': [SOFTWARE_DELIVERY_APPROVAL_IDS.REMOTE_MUTATION],
+  'plan:create': [SOFTWARE_DELIVERY_APPROVAL_IDS.REMOTE_MUTATION],
+  'plan:promote': [SOFTWARE_DELIVERY_APPROVAL_IDS.REMOTE_MUTATION],
+  'initiative:create': [SOFTWARE_DELIVERY_APPROVAL_IDS.REMOTE_MUTATION],
+  'initiative:add-wu': [SOFTWARE_DELIVERY_APPROVAL_IDS.REMOTE_MUTATION],
+};
+
+function requiredApprovalsForTool(name: ToolName): string[] | undefined {
+  // WU-2729: only the 10 remote-callable tools carry explicit
+  // required_approvals metadata (even if empty). Other tools leave the
+  // field undefined so the manifest stays minimally descriptive.
+  const isRemoteCallable = (REMOTE_CALLABLE_TOOLS as readonly string[]).includes(name);
+  if (!isRemoteCallable) {
+    return undefined;
+  }
+  const override = APPROVAL_OVERRIDES[name];
+  return override ? [...override] : [];
+}
+
+/**
+ * WU-2729: ordered list of the 10 remote-callable tool names. Preserves
+ * declaration order from REMOTE_CALLABLE_TOOLS so callers can render
+ * stable UIs without re-sorting.
+ */
+export function getRemoteCallableToolNames(): RemoteCallableToolName[] {
+  return [...REMOTE_CALLABLE_TOOLS];
 }
 
 function createManifestTools(): SoftwareDeliveryManifestTool[] {
   return (Object.keys(TOOL_PERMISSIONS) as ToolName[]).map((name) => {
     const permission = TOOL_PERMISSIONS[name];
-    return {
+    const approvals = requiredApprovalsForTool(name);
+    const entry: SoftwareDeliveryManifestTool = {
       name,
       entry: resolveToolEntry(name),
       permission,
       required_scopes: requiredScopesForPermission(permission),
     };
+    if (approvals !== undefined) {
+      entry.required_approvals = approvals;
+    }
+    return entry;
   });
 }
 
@@ -400,6 +527,24 @@ export function renderSoftwareDeliveryMigrationScorecard(
 }
 
 const POLICY_SUFFIXES = ['format', 'lint', 'typecheck', 'test', 'coverage'] as const;
+const SOFTWARE_DELIVERY_EMITTED_EVENT_KINDS = [
+  'software-delivery:gate_started',
+  'software-delivery:gate_passed',
+  'software-delivery:gate_failed',
+  'software-delivery:co_change_rule_fired',
+  'software-delivery:conditional_command_fired',
+  'software-delivery:lane_wip_breached',
+  'software-delivery:lane_locked',
+  'software-delivery:lane_unlocked',
+  'software-delivery:lane_suggestion_emitted',
+  'software-delivery:initiative_created',
+  'software-delivery:initiative_closed',
+  'software-delivery:initiative_phase_advanced',
+  'software-delivery:plan_created',
+  'software-delivery:plan_linked',
+  'software-delivery:plan_promoted',
+] as const;
+const SOFTWARE_DELIVERY_REQUIRED_SURFACES = ['http'] as const;
 
 export const SOFTWARE_DELIVERY_MANIFEST: SoftwareDeliveryPackManifest = {
   id: SOFTWARE_DELIVERY_PACK_ID,
@@ -415,4 +560,8 @@ export const SOFTWARE_DELIVERY_MANIFEST: SoftwareDeliveryPackManifest = {
   evidence_types: ['gate-run'],
   state_aliases: { active: 'in_progress' },
   lane_templates: [],
+  emitted_event_kinds: [...SOFTWARE_DELIVERY_EMITTED_EVENT_KINDS],
+  subscribed_event_kinds: [],
+  required_approvals: [],
+  surfaces_required: [...SOFTWARE_DELIVERY_REQUIRED_SURFACES],
 };