@mndrk/agx 2.4.4 → 2.4.6

package/cloud-runtime/standalone/apps/local/lib/github-resolvers.ts

@@ -0,0 +1,41 @@
+import { listCachedTrackerItems } from "./tracker/tracker-item-store";
+import { findAgxTaskByIdentifier } from "./task-identifier-store";
+import type { TrackerResolver } from "./github-link-resolver";
+
+/**
+ * Resolver for Linear issue identifiers like "AGX-42" (or any tracker using the
+ * generic tracker-item cache). Matches the cached item whose `identifier`
+ * exactly equals the input.
+ */
+export const linearIssueResolver: TrackerResolver = async (id) => {
+  const needle = id.toUpperCase();
+  const result = await listCachedTrackerItems({ search: needle, limit: 20 });
+  const hit = result.issues.find((i) => i.identifier.toUpperCase() === needle);
+  if (!hit) return null;
+  return { targetType: "linear_issue", targetId: hit.identifier };
+};
+
+/**
+ * Resolver for agx task identifiers (e.g. "TSK-42", "AGX-7").
+ *
+ * Looks up the `tasks.identifier` column, which is populated on creation when
+ * the parent project has an `identifier_prefix` set. Matches are
+ * case-insensitive. The returned `targetId` is the identifier string itself
+ * (mirroring Linear's resolver), so downstream `pr_links` store a stable
+ * user-visible key.
+ */
+export const agxTaskResolver: TrackerResolver = async (id) => {
+  const needle = id.toUpperCase();
+  const hit = await findAgxTaskByIdentifier(needle);
+  if (!hit) return null;
+  return { targetType: "agx_task", targetId: needle };
+};
+
+/**
+ * Default resolver list used by the sync orchestrator. Add/remove entries
+ * here as trackers gain identifier support.
+ */
+export const defaultResolvers: TrackerResolver[] = [
+  linearIssueResolver,
+  agxTaskResolver,
+];

package/cloud-runtime/standalone/apps/local/lib/github-token-store.ts

@@ -0,0 +1,41 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { GithubTokens } from "./github-types";
+
+function projectTokenPath(projectId: string): string {
+  const base = process.env.AGX_DATA_DIR || path.join(os.homedir(), ".agx");
+  return path.join(base, "projects", projectId, "integrations", "github.json");
+}
+
+export function saveGithubTokens(projectId: string, tokens: GithubTokens): void {
+  const p = projectTokenPath(projectId);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, JSON.stringify(tokens, null, 2), { mode: 0o600 });
+}
+
+export function loadGithubTokens(projectId: string): GithubTokens | null {
+  const p = projectTokenPath(projectId);
+  if (!fs.existsSync(p)) return null;
+  try {
+    const raw = fs.readFileSync(p, "utf8");
+    const parsed = JSON.parse(raw) as GithubTokens;
+    if (typeof parsed.accessToken !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+export function clearGithubTokens(projectId: string): void {
+  const p = projectTokenPath(projectId);
+  if (fs.existsSync(p)) fs.rmSync(p);
+}
+
+export function githubTokensExpired(
+  tokens: GithubTokens,
+  skewMs = 60_000,
+): boolean {
+  if (tokens.expiresAt == null) return false;
+  return Date.now() >= tokens.expiresAt - skewMs;
+}

package/cloud-runtime/standalone/apps/local/lib/github-types.ts

@@ -0,0 +1,116 @@
+export type GithubPrState = "open" | "closed" | "merged";
+export type GithubCiStatus = "success" | "failure" | "pending" | null;
+export type GithubReviewDecision =
+  | "approved"
+  | "changes_requested"
+  | "review_required"
+  | null;
+
+export interface GithubRepo {
+  id: string; // "owner/repo"
+  owner: string;
+  name: string;
+  defaultBranch: string | null;
+  private: boolean;
+  accessRevoked: boolean;
+  addedAt: number;
+  lastSyncedAt: number | null;
+}
+
+export interface GithubReviewer {
+  login: string;
+  state:
+    | "pending"
+    | "approved"
+    | "changes_requested"
+    | "commented"
+    | "dismissed";
+}
+
+export interface GithubPr {
+  id: string; // "owner/repo#123"
+  repoId: string; // "owner/repo"
+  number: number;
+  title: string;
+  body: string;
+  state: GithubPrState;
+  draft: boolean;
+  authorLogin: string;
+  headRef: string;
+  headSha: string;
+  baseRef: string;
+  url: string;
+  ciStatus: GithubCiStatus;
+  reviewDecision: GithubReviewDecision;
+  assignees: string[];
+  reviewers: GithubReviewer[];
+  labels: string[];
+  createdAt: number;
+  updatedAt: number;
+  mergedAt: number | null;
+  closedAt: number | null;
+  lastSyncedAt: number;
+}
+
+export type GithubIssueState = "open" | "closed";
+
+export interface GithubIssue {
+  id: string; // "owner/repo!123" (! distinguishes from PR "#")
+  repoId: string;
+  number: number;
+  title: string;
+  body: string;
+  state: GithubIssueState;
+  authorLogin: string;
+  url: string;
+  assignees: string[];
+  labels: string[];
+  createdAt: number;
+  updatedAt: number;
+  closedAt: number | null;
+  lastSyncedAt: number;
+}
+
+export type PrLinkSource = "branch" | "title" | "body" | "manual";
+export type TrackerTargetType = "agx_task" | "linear_issue" | "jira_issue";
+
+export interface PrLink {
+  prId: string;
+  targetType: TrackerTargetType;
+  targetId: string;
+  linkSource: PrLinkSource;
+  createdAt: number;
+}
+
+export type GithubPrCommentKind = "issue_comment" | "review" | "review_comment";
+
+export interface GithubPrComment {
+  id: string;
+  prId: string;
+  kind: GithubPrCommentKind;
+  authorLogin: string;
+  body: string;
+  path: string | null;
+  line: number | null;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface GithubPrFile {
+  prId: string;
+  path: string;
+  status: string;
+  additions: number;
+  deletions: number;
+  changes: number;
+  patch: string | null;
+  lastSyncedAt: number;
+}
+
+export interface GithubTokens {
+  accessToken: string;
+  refreshToken: string | null;
+  expiresAt: number | null;
+  login: string;
+  scopes: string[];
+}

package/cloud-runtime/standalone/apps/local/lib/logger.ts

@@ -0,0 +1 @@
+export { logger, flush } from "../../../lib/logger";

package/cloud-runtime/standalone/apps/local/lib/migrations/task-identifier-migration.ts

@@ -0,0 +1,39 @@
+import type { DatabaseSync } from "node:sqlite";
+
+/**
+ * Idempotent migration adding user-configurable task identifier support.
+ *
+ * - `projects.identifier_prefix` (TEXT, nullable) — e.g. "TSK", "AGX".
+ * - `projects.next_identifier` (INTEGER, default 1) — monotonic counter.
+ * - `tasks.identifier` (TEXT, nullable) — e.g. "TSK-42".
+ * - Partial unique index on (project_id, identifier) where identifier IS NOT NULL.
+ *
+ * Each step is wrapped in try/catch so it is safe to run repeatedly and on
+ * DBs where the columns/index already exist (new schema files, prior runs).
+ */
+export function runTaskIdentifierMigration(db: DatabaseSync): void {
+  try {
+    db.exec("ALTER TABLE projects ADD COLUMN identifier_prefix TEXT");
+  } catch {
+    /* column already exists */
+  }
+  try {
+    db.exec(
+      "ALTER TABLE projects ADD COLUMN next_identifier INTEGER NOT NULL DEFAULT 1"
+    );
+  } catch {
+    /* column already exists */
+  }
+  try {
+    db.exec("ALTER TABLE tasks ADD COLUMN identifier TEXT");
+  } catch {
+    /* column already exists */
+  }
+  try {
+    db.exec(
+      "CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_identifier ON tasks (project_id, identifier) WHERE identifier IS NOT NULL"
+    );
+  } catch {
+    /* already exists */
+  }
+}

package/cloud-runtime/standalone/apps/local/lib/notifications/index.ts

@@ -1,4 +1,5 @@
 import { createAdminDbClient } from '@/lib/db-adapter';
+import { logger } from '@/lib/logger';
 import type { TaskStage, TaskStatus } from '@/lib/db-adapter.interface';
 import {
   NotificationEventType,
@@ -6,6 +7,7 @@ import {
 } from './constants';
 
 type NotificationWebhookRaw = Record<string, any>;
+const WEBHOOK_DELIVERY_TIMEOUT_MS = 10_000;
 
 export interface NotificationWebhookRecord {
   id: string;
@@ -49,6 +51,30 @@ export interface NotificationEventPayload {
 
 export class SchemaNotReadyError extends Error {}
 
+function normalizeWebhookUrl(value: unknown): string {
+  if (typeof value !== 'string') {
+    throw new Error('Webhook URL is required');
+  }
+
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new Error('Webhook URL is required');
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error('Webhook URL must be a valid URL');
+  }
+
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error('Webhook URL must use http or https');
+  }
+
+  return parsed.toString();
+}
+
 function isMissingRelationError(error: unknown, relation: string): boolean {
   if (!error || typeof error !== 'object') return false;
   const code = (error as any).code;
@@ -148,10 +174,7 @@ export async function createNotificationWebhook(
   userId: string,
   input: NotificationWebhookCreateInput
 ): Promise<NotificationWebhookRecord> {
-  const url = typeof input.url === 'string' ? input.url.trim() : '';
-  if (!url) {
-    throw new Error('Webhook URL is required');
-  }
+  const url = normalizeWebhookUrl(input.url);
 
   const events = normalizeEvents(input.events);
   if (!events.length) {
@@ -192,11 +215,7 @@ export async function updateNotificationWebhook(
   const updates: Record<string, unknown> = {};
 
   if (input.url !== undefined) {
-    const url = input.url ? input.url.trim() : '';
-    if (!url) {
-      throw new Error('Webhook URL cannot be empty');
-    }
-    updates.url = url;
+    updates.url = normalizeWebhookUrl(input.url);
   }
 
   if (input.name !== undefined) {
@@ -263,7 +282,7 @@ export async function notifyTaskEvent(payload: NotificationEventPayload): Promis
       console.debug('[notifications] notification_webhooks schema not ready, skipping');
       return;
     }
-    console.error('[notifications] failed to load webhooks', error);
+    logger.error('[notifications] failed to load webhooks', logger.formatError(error));
     return;
   }
 
@@ -291,19 +310,24 @@ export async function notifyTaskEvent(payload: NotificationEventPayload): Promis
 
   await Promise.all(
     targets.map(async (endpoint) => {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), WEBHOOK_DELIVERY_TIMEOUT_MS);
       try {
         const response = await fetch(endpoint.url, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify(body),
+          signal: controller.signal,
         });
         if (!response.ok) {
-          console.error(
+          logger.error(
             `[notifications] webhook ${endpoint.url} responded with ${response.status}`
           );
         }
       } catch (error) {
-        console.error(`[notifications] failed to send to ${endpoint.url}`, error);
+        logger.error(`[notifications] failed to send to ${endpoint.url}`, logger.formatError(error));
+      } finally {
+        clearTimeout(timeout);
       }
     })
   );

package/cloud-runtime/standalone/apps/local/lib/parse-body.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+
+type ParseBodySuccess<T> = { ok: true; body: T };
+type ParseBodyFailure = { ok: false; response: NextResponse };
+type ParseBodyResult<T> = ParseBodySuccess<T> | ParseBodyFailure;
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function parseBody<T = any>(
+  request: Request,
+): Promise<ParseBodyResult<T>> {
+  try {
+    const body = await request.json();
+    return { ok: true, body: body as T };
+  } catch {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: "Invalid or missing request body" },
+        { status: 400 },
+      ),
+    };
+  }
+}

package/cloud-runtime/standalone/apps/local/lib/security.ts

@@ -1,6 +1,7 @@
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { getAllowedOrigins } from "./app-config";
 import { createAdminDbClient } from "./db-adapter";
+import { logger } from "@/lib/logger";
 
 // ============ TASK SIGNING (HMAC-SHA256) ============
 
@@ -215,7 +216,7 @@ export async function writeAuditLog(entry: AuditLogEntry): Promise<string> {
     .single();
 
   if (error) {
-    console.error("Failed to write audit log:", error);
+    logger.error("Failed to write audit log", logger.formatError(error));
     throw new Error("Audit log write failed");
   }
 
@@ -241,7 +242,7 @@ export async function updateAuditLogResult(
     .eq("id", auditId);
 
   if (error) {
-    console.error("Failed to update audit log:", error);
+    logger.error("Failed to update audit log", logger.formatError(error));
     throw new Error("Audit log update failed");
   }
 }
@@ -274,7 +275,7 @@ export async function getAuditLogs(
   const { data, error } = await query;
 
   if (error) {
-    console.error("Failed to get audit logs:", error);
+    logger.error("Failed to get audit logs", logger.formatError(error));
     throw error;
   }
 

package/cloud-runtime/standalone/apps/local/lib/sqlite-query-adapter.ts

@@ -32,6 +32,7 @@ import {
   autoMigrateLegacyWorkspacesToProjects,
   getWorkspaceTeamTableState,
 } from "./workspaces-to-projects-migration";
+import { runTaskIdentifierMigration } from "./migrations/task-identifier-migration";
 
 const AGX_DATA_DIR = process.env.AGX_DATA_DIR || path.join(os.homedir(), ".agx");
 
@@ -88,6 +89,7 @@ export function getSQLiteDb(): DatabaseSync {
   // Drop legacy teams tables after migration is complete
   dropLegacyTeamsTables(_db);
   ensureProjectScopedTeamTables(_db);
+  ensureWorkspaceEntriesTable(_db);
 
   return _db;
 }
@@ -153,6 +155,31 @@ function ensureProjectScopedTeamTables(db: DatabaseSync): void {
   `);
 }
 
+function ensureWorkspaceEntriesTable(db: DatabaseSync): void {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS workspace_entries (
+      id TEXT NOT NULL PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      category TEXT NOT NULL,
+      name TEXT NOT NULL,
+      path TEXT DEFAULT NULL,
+      purpose TEXT,
+      sort_order INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      UNIQUE(project_id, category, name)
+    );
+    CREATE INDEX IF NOT EXISTS idx_workspace_entries_project_id ON workspace_entries(project_id);
+
+    CREATE TRIGGER IF NOT EXISTS workspace_entries_updated_at
+      AFTER UPDATE ON workspace_entries
+      FOR EACH ROW
+      BEGIN
+        UPDATE workspace_entries SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE rowid = NEW.rowid;
+      END;
+  `);
+}
+
 function runMigrations(db: DatabaseSync): void {
   const graphTables = db
     .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='execution_graphs'")
@@ -164,6 +191,9 @@ function runMigrations(db: DatabaseSync): void {
     }
   }
 
+  // Add identifier_prefix/next_identifier to projects and identifier to tasks
+  runTaskIdentifierMigration(db);
+
   // Add archived_at column to projects for soft delete
   const projectTables = db
     .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='projects'")
@@ -246,6 +276,7 @@ function runMigrations(db: DatabaseSync): void {
   `);
 
   ensureProjectScopedTeamTables(db);
+  ensureWorkspaceEntriesTable(db);
 
   // Create project_agents table
   db.exec(`

package/cloud-runtime/standalone/apps/local/lib/stream-multiplexer.ts

@@ -1,4 +1,5 @@
 import { readFile } from "fs/promises";
+import os from "os";
 import type { Participant, ChatEvent } from "./types";
 import { runCliResponse } from "./cli-runner";
 import { register, update as updateProcess } from "./agent-process-registry";
@@ -36,6 +37,23 @@ function isKnowledgeEvidence(
 
 const DEFAULT_RUNTIME_SEED = "I evolve through experience and collaboration.";
 
+function buildFilesystemAccessContext(p: Participant): string | null {
+  const homeDir = os.homedir();
+  switch (p.provider) {
+    case "claude":
+    case "codex":
+    case "gemini":
+    case "zai":
+      return `<filesystem-access>
+Current CLI access includes the project working directory and ${homeDir}.
+Treat ~/.agx as accessible from this chat because it lives under ${homeDir}.
+Do not claim that ~/.agx is unavailable unless a tool call in this run actually fails with an access error.
+</filesystem-access>`;
+    default:
+      return null;
+  }
+}
+
 function normalizeRuntimeSeedText(raw: string, name: string): string {
   const collapsed = raw.replace(/\s+/g, " ").trim();
   if (!collapsed) return `I am ${name}. ${DEFAULT_RUNTIME_SEED}`;
@@ -781,6 +799,7 @@ async function runAgent(
   );
   const systemContext = [
     baseSystemContext,
+    buildFilesystemAccessContext(p),
     executionProvenance
       ? `<execution-provenance>
 Resolved skills: ${executionProvenance.skills.map((skill) => `${skill.file} (${skill.source})`).join(", ") || "none"}

package/cloud-runtime/standalone/apps/local/lib/task-identifier-store.ts

@@ -0,0 +1,32 @@
+/**
+ * Lookup helpers for user-facing task identifiers (e.g. "TSK-42").
+ *
+ * Backed by the `tasks.identifier` column which is populated on creation when
+ * the parent project has an `identifier_prefix` set.
+ */
+
+import { getSQLiteDb } from "./sqlite-query-adapter";
+
+/**
+ * Find an agx task by its identifier (case-insensitive). Returns `{ id }` (UUID)
+ * if exactly one match, otherwise null.
+ */
+export async function findAgxTaskByIdentifier(
+  identifier: string
+): Promise<{ id: string } | null> {
+  const trimmed = identifier.trim();
+  if (!trimmed) return null;
+  const db = getSQLiteDb();
+  try {
+    const row = db
+      .prepare(
+        "SELECT id FROM tasks WHERE UPPER(identifier) = UPPER(?) LIMIT 1"
+      )
+      .get(trimmed) as { id: string } | undefined;
+    if (!row) return null;
+    return { id: row.id };
+  } catch {
+    // `identifier` column may not exist on very old DBs; treat as miss.
+    return null;
+  }
+}