@skillsmith/core 0.4.14 → 0.4.15

package/dist/src/services/quarantine/QuarantineService.multiapproval.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Multi-Approval Workflow for MALICIOUS Severity Quarantine
+ * @module @skillsmith/core/services/quarantine/QuarantineService.multiapproval
+ * @see SMI-2277: Persist multi-approval state to database
+ * @see SMI-2741: Split from QuarantineService.ts to meet 500-line standard
+ *
+ * Handles the multi-approval workflow required for MALICIOUS severity skills.
+ * MALICIOUS severity requires multiple independent reviewers to approve before
+ * a skill can be unquarantined, preventing single-reviewer compromise.
+ */
+import type { QuarantineRepository } from '../../repositories/quarantine/index.js';
+import type { ApprovalRepository } from '../../repositories/quarantine/ApprovalRepository.js';
+import type { AuditLogger } from '../../security/AuditLogger.js';
+import type { AuthenticatedSession, AuthenticatedReviewInput, AuthenticatedReviewResult, MultiApprovalStatus } from './types.js';
+/**
+ * Number of approvals required for MALICIOUS severity reviews
+ */
+export declare const MALICIOUS_APPROVAL_COUNT = 2;
+/**
+ * Multi-approval timeout in milliseconds (24 hours)
+ */
+export declare const MULTI_APPROVAL_TIMEOUT_MS: number;
+/**
+ * Handle approval for MALICIOUS severity skills
+ *
+ * MALICIOUS severity requires multiple reviewers to approve
+ * before a skill can be unquarantined. This prevents single
+ * reviewer compromise from allowing malicious skills.
+ *
+ * Approval state is persisted to the database (SMI-2277) so
+ * pending approvals survive service restarts.
+ *
+ * @param session - Authenticated session
+ * @param quarantineId - Quarantine entry ID
+ * @param skillId - Skill ID
+ * @param input - Review input
+ * @param repository - Quarantine repository
+ * @param approvalRepository - Approval repository
+ * @param auditLogger - Audit logger
+ * @returns Review result with multi-approval status
+ */
+export declare function handleMaliciousApproval(session: AuthenticatedSession, quarantineId: string, skillId: string, input: AuthenticatedReviewInput, repository: QuarantineRepository, approvalRepository: ApprovalRepository, auditLogger: AuditLogger): AuthenticatedReviewResult;
+/**
+ * Build a MultiApprovalStatus from database rows
+ *
+ * Converts persisted approval entries into the MultiApprovalStatus
+ * interface expected by consumers.
+ */
+export declare function buildMultiApprovalStatus(quarantineId: string, approvals: Array<{
+    reviewerId: string;
+    reviewerEmail: string;
+    createdAt: string;
+    completedAt: string | null;
+    reason: string | null;
+    isComplete: boolean;
+}>): MultiApprovalStatus;
+//# sourceMappingURL=QuarantineService.multiapproval.d.ts.map

package/dist/src/services/quarantine/QuarantineService.multiapproval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineService.multiapproval.d.ts","sourceRoot":"","sources":["../../../../src/services/quarantine/QuarantineService.multiapproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAA;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAA;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EAEpB,MAAM,YAAY,CAAA;AAGnB;;GAEG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,oBAAoB,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,GACvB,yBAAyB,CAoK3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,KAAK,CAAC;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,OAAO,CAAA;CACpB,CAAC,GACD,mBAAmB,CAoBrB"}

package/dist/src/services/quarantine/QuarantineService.multiapproval.js

@@ -0,0 +1,211 @@
+/**
+ * @fileoverview Multi-Approval Workflow for MALICIOUS Severity Quarantine
+ * @module @skillsmith/core/services/quarantine/QuarantineService.multiapproval
+ * @see SMI-2277: Persist multi-approval state to database
+ * @see SMI-2741: Split from QuarantineService.ts to meet 500-line standard
+ *
+ * Handles the multi-approval workflow required for MALICIOUS severity skills.
+ * MALICIOUS severity requires multiple independent reviewers to approve before
+ * a skill can be unquarantined, preventing single-reviewer compromise.
+ */
+import { QuarantineServiceError, requirePermission } from './types.js';
+/**
+ * Number of approvals required for MALICIOUS severity reviews
+ */
+export const MALICIOUS_APPROVAL_COUNT = 2;
+/**
+ * Multi-approval timeout in milliseconds (24 hours)
+ */
+export const MULTI_APPROVAL_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+/**
+ * Handle approval for MALICIOUS severity skills
+ *
+ * MALICIOUS severity requires multiple reviewers to approve
+ * before a skill can be unquarantined. This prevents single
+ * reviewer compromise from allowing malicious skills.
+ *
+ * Approval state is persisted to the database (SMI-2277) so
+ * pending approvals survive service restarts.
+ *
+ * @param session - Authenticated session
+ * @param quarantineId - Quarantine entry ID
+ * @param skillId - Skill ID
+ * @param input - Review input
+ * @param repository - Quarantine repository
+ * @param approvalRepository - Approval repository
+ * @param auditLogger - Audit logger
+ * @returns Review result with multi-approval status
+ */
+export function handleMaliciousApproval(session, quarantineId, skillId, input, repository, approvalRepository, auditLogger) {
+    // Require elevated permission for MALICIOUS review
+    requirePermission(session, 'quarantine:review_malicious');
+    // Check if this reviewer already approved (database-backed)
+    if (approvalRepository.hasReviewerApproved(quarantineId, session.userId)) {
+        // Retrieve existing approval for error details
+        const existingApprovals = approvalRepository.getPendingApprovals(quarantineId);
+        const existing = existingApprovals.find((a) => a.reviewerId === session.userId);
+        throw new QuarantineServiceError('You have already approved this entry', 'ALREADY_REVIEWED', {
+            quarantineId,
+            previousApprovalAt: existing?.createdAt ?? 'unknown',
+        });
+    }
+    // Check for approval timeout
+    const startTime = approvalRepository.getWorkflowStartTime(quarantineId);
+    if (startTime) {
+        const timeSinceStart = Date.now() - new Date(startTime).getTime();
+        if (timeSinceStart > MULTI_APPROVAL_TIMEOUT_MS) {
+            // Capture existing approvals before clearing for audit
+            const expiredApprovals = approvalRepository.getPendingApprovals(quarantineId);
+            // Reset approval workflow
+            approvalRepository.clearApprovals(quarantineId);
+            // Log timeout event so cleared reviewer work is auditable
+            auditLogger.log({
+                event_type: 'quarantine_multi_approval_timeout',
+                actor: 'system',
+                resource: skillId,
+                action: 'timeout',
+                result: 'success',
+                metadata: {
+                    quarantineId,
+                    timeoutMs: MULTI_APPROVAL_TIMEOUT_MS,
+                    expiredApprovals: expiredApprovals.map((a) => ({
+                        reviewerId: a.reviewerId,
+                        email: a.reviewerEmail,
+                        approvedAt: a.createdAt,
+                    })),
+                    triggeredBy: {
+                        userId: session.userId,
+                        email: session.email,
+                    },
+                },
+            });
+            throw new QuarantineServiceError('Multi-approval workflow timed out. Please start again.', 'INVALID_INPUT', { quarantineId, timeoutMs: MULTI_APPROVAL_TIMEOUT_MS });
+        }
+    }
+    // Record this approval in the database
+    approvalRepository.recordApproval({
+        skillId: quarantineId,
+        reviewerId: session.userId,
+        reviewerEmail: session.email,
+        decision: 'approved',
+        reason: input.reviewNotes,
+        requiredApprovals: MALICIOUS_APPROVAL_COUNT,
+    });
+    // Get current approval count and all pending approvals
+    const pendingApprovals = approvalRepository.getPendingApprovals(quarantineId);
+    const approvalCount = pendingApprovals.filter((a) => a.decision === 'approved').length;
+    // Build the multi-approval status from database state
+    const approvalStatus = buildMultiApprovalStatus(quarantineId, pendingApprovals);
+    // Log the approval
+    auditLogger.log({
+        event_type: 'quarantine_multi_approval',
+        actor: 'reviewer',
+        resource: skillId,
+        action: 'approve',
+        result: 'success',
+        metadata: {
+            quarantineId,
+            approvalNumber: approvalCount,
+            requiredApprovals: MALICIOUS_APPROVAL_COUNT,
+            reviewer: {
+                userId: session.userId,
+                email: session.email,
+            },
+        },
+    });
+    // Check if we have enough approvals
+    if (approvalCount >= MALICIOUS_APPROVAL_COUNT) {
+        // Mark approvals as complete in database
+        approvalRepository.markComplete(quarantineId);
+        approvalStatus.isComplete = true;
+        approvalStatus.completedAt = new Date();
+        // Perform the actual review
+        const approverEmails = pendingApprovals
+            .filter((a) => a.decision === 'approved')
+            .map((a) => a.reviewerEmail);
+        const reviewResult = repository.review(quarantineId, {
+            reviewedBy: approverEmails.join(', '),
+            reviewStatus: 'approved',
+            reviewNotes: `Multi-approval complete: ${approvalCount} reviewers approved. ${input.reviewNotes || ''}`,
+        });
+        // Log completion
+        auditLogger.log({
+            event_type: 'quarantine_multi_approval_complete',
+            actor: 'reviewer',
+            resource: skillId,
+            action: 'complete',
+            result: 'success',
+            metadata: {
+                quarantineId,
+                approvals: pendingApprovals
+                    .filter((a) => a.decision === 'approved')
+                    .map((a) => ({
+                    reviewerId: a.reviewerId,
+                    email: a.reviewerEmail,
+                    approvedAt: a.createdAt,
+                })),
+            },
+        });
+        return {
+            success: true,
+            approved: true,
+            skillId,
+            severity: 'MALICIOUS',
+            canImport: reviewResult?.canImport ?? false,
+            warnings: [
+                'MALICIOUS skill approved through multi-approval workflow',
+                `Approved by: ${approverEmails.join(', ')}`,
+            ],
+            reviewedBy: {
+                userId: session.userId,
+                email: session.email,
+                displayName: session.displayName,
+            },
+            multiApprovalStatus: approvalStatus,
+        };
+    }
+    // Need more approvals
+    return {
+        success: true,
+        approved: false,
+        skillId,
+        severity: 'MALICIOUS',
+        canImport: false,
+        warnings: [
+            `Multi-approval in progress: ${approvalCount}/${MALICIOUS_APPROVAL_COUNT} approvals received`,
+            `Requires ${MALICIOUS_APPROVAL_COUNT - approvalCount} more approval(s)`,
+        ],
+        reviewedBy: {
+            userId: session.userId,
+            email: session.email,
+            displayName: session.displayName,
+        },
+        multiApprovalStatus: approvalStatus,
+    };
+}
+/**
+ * Build a MultiApprovalStatus from database rows
+ *
+ * Converts persisted approval entries into the MultiApprovalStatus
+ * interface expected by consumers.
+ */
+export function buildMultiApprovalStatus(quarantineId, approvals) {
+    const currentApprovals = approvals.map((a) => ({
+        reviewerId: a.reviewerId,
+        reviewerEmail: a.reviewerEmail,
+        approvedAt: new Date(a.createdAt),
+        notes: a.reason ?? undefined,
+    }));
+    const startedAt = approvals.length > 0 ? new Date(approvals[0].createdAt) : new Date();
+    const isComplete = approvals.some((a) => a.isComplete);
+    const completedEntry = approvals.find((a) => a.completedAt);
+    return {
+        quarantineId,
+        requiredApprovals: MALICIOUS_APPROVAL_COUNT,
+        currentApprovals,
+        isComplete,
+        startedAt,
+        completedAt: completedEntry ? new Date(completedEntry.completedAt) : undefined,
+    };
+}
+//# sourceMappingURL=QuarantineService.multiapproval.js.map

package/dist/src/services/quarantine/QuarantineService.multiapproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineService.multiapproval.js","sourceRoot":"","sources":["../../../../src/services/quarantine/QuarantineService.multiapproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA6B,EAC7B,YAAoB,EACpB,OAAe,EACf,KAA+B,EAC/B,UAAgC,EAChC,kBAAsC,EACtC,WAAwB;IAExB,mDAAmD;IACnD,iBAAiB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAA;IAEzD,4DAA4D;IAC5D,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,+CAA+C;QAC/C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;QAC/E,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,EAAE,kBAAkB,EAAE;YAC3F,YAAY;YACZ,kBAAkB,EAAE,QAAQ,EAAE,SAAS,IAAI,SAAS;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAA;QACjE,IAAI,cAAc,GAAG,yBAAyB,EAAE,CAAC;YAC/C,uDAAuD;YACvD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;YAE7E,0BAA0B;YAC1B,kBAAkB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;YAE/C,0DAA0D;YAC1D,WAAW,CAAC,GAAG,CAAC;gBACd,UAAU,EAAE,mCAAmC;gBAC/C,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE;oBACR,YAAY;oBACZ,SAAS,EAAE,yBAAyB;oBACpC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC7C,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,aAAa;wBACtB,UAAU,EAAE,CAAC,CAAC,SAAS;qBACxB,CAAC,CAAC;oBACH,WAAW,EAAE;wBACX,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;qBACrB;iBACF;aACF,CAAC,CAAA;YAEF,MAAM,IAAI,sBAAsB,CAC9B,wDAAwD,EACxD,eAAe,EACf,EAAE,YAAY,EAAE,SAAS,EAAE,yBAAyB,EAAE,CACvD,CAAA;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,kBAAkB,CAAC,cAAc,CAAC;QAChC,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,aAAa,EAAE,OAAO,CAAC,KAAK;QAC5B,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,KAAK,CAAC,WAAW;QACzB,iBAAiB,EAAE,wBAAwB;KAC5C,CAAC,CAAA;IAEF,uDAAuD;IACvD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;IAC7E,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAA;IAEtF,sDAAsD;IACtD,MAAM,cAAc,GAAG,wBAAwB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;IAE/E,mBAAmB;IACnB,WAAW,CAAC,GAAG,CAAC;QACd,UAAU,EAAE,2BAA2B;QACvC,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,YAAY;YACZ,cAAc,EAAE,aAAa;YAC7B,iBAAiB,EAAE,wBAAwB;YAC3C,QAAQ,EAAE;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF;KACF,CAAC,CAAA;IAEF,oCAAoC;IACpC,IAAI,aAAa,IAAI,wBAAwB,EAAE,CAAC;QAC9C,yCAAyC;QACzC,kBAAkB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QAC7C,cAAc,CAAC,UAAU,GAAG,IAAI,CAAA;QAChC,cAAc,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAA;QAEvC,4BAA4B;QAC5B,MAAM,cAAc,GAAG,gBAAgB;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;QAC9B,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE;YACnD,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,YAAY,EAAE,UAAU;YACxB,WAAW,EAAE,4BAA4B,aAAa,wBAAwB,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE;SACxG,CAAC,CAAA;QAEF,iBAAiB;QACjB,WAAW,CAAC,GAAG,CAAC;YACd,UAAU,EAAE,oCAAoC;YAChD,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACR,YAAY;gBACZ,SAAS,EAAE,gBAAgB;qBACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;qBACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,KAAK,EAAE,CAAC,CAAC,aAAa;oBACtB,UAAU,EAAE,CAAC,CAAC,SAAS;iBACxB,CAAC,CAAC;aACN;SACF,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,YAAY,EAAE,SAAS,IAAI,KAAK;YAC3C,QAAQ,EAAE;gBACR,0DAA0D;gBAC1D,gBAAgB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5C;YACD,UAAU,EAAE;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC;YACD,mBAAmB,EAAE,cAAc;SACpC,CAAA;IACH,CAAC;IAED,sBAAsB;IACtB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,OAAO;QACP,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE;YACR,+BAA+B,aAAa,IAAI,wBAAwB,qBAAqB;YAC7F,YAAY,wBAAwB,GAAG,aAAa,mBAAmB;SACxE;QACD,UAAU,EAAE;YACV,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC;QACD,mBAAmB,EAAE,cAAc;KACpC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,SAOE;IAEF,MAAM,gBAAgB,GAAqB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;KAC7B,CAAC,CAAC,CAAA;IAEH,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IACtF,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IAE3D,OAAO;QACL,YAAY;QACZ,iBAAiB,EAAE,wBAAwB;QAC3C,gBAAgB;QAChB,UAAU;QACV,SAAS;QACT,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAA;AACH,CAAC"}

package/dist/src/session/SessionManager.d.ts

@@ -2,6 +2,7 @@
  * Session Manager for Claude-Flow Memory Integration
  * SMI-641: Session ID Storage in Claude-Flow Memory
  * SMI-1518: V3 API Migration - Use direct API calls instead of spawn
+ * SMI-2741: Split to meet 500-line standard
  *
  * Manages session lifecycle with persistent storage in claude-flow memory
  * to enable context restoration across sessions.
@@ -10,6 +11,7 @@ import type { SessionData, Checkpoint } from './SessionContext.js';
 import type { CommandExecutor, SessionOptions } from './SessionManager.types.js';
 export type { CommandExecutor, MemoryResult, SessionOptions } from './SessionManager.types.js';
 export { DefaultCommandExecutor } from './SessionManager.helpers.js';
+export { storeMemoryEntry, retrieveMemoryEntry, deleteMemoryEntry, runPreTaskHook, runPostTaskHook, } from './SessionManager.memory.js';
 /**
  * Session Manager for claude-flow memory integration
  *
@@ -85,38 +87,5 @@ export declare class SessionManager {
      * Clear the current session pointer
      */
     private clearCurrentSession;
-    /**
-     * Store data in claude-flow memory
-     *
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use direct storeEntry() when available
-     */
-    private storeMemory;
-    /**
-     * Retrieve data from claude-flow memory
-     *
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use direct getEntry() when available
-     */
-    private retrieveMemory;
-    /**
-     * Delete data from claude-flow memory
-     *
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use callMCPTool('memory/delete') when available
-     */
-    private deleteMemory;
-    /**
-     * Run pre-task hook
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use callMCPTool('hooks/pre-task') when available
-     */
-    private runPreTaskHook;
-    /**
-     * Run post-task hook
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use callMCPTool('hooks/post-task') when available
-     */
-    private runPostTaskHook;
 }
 //# sourceMappingURL=SessionManager.d.ts.map

package/dist/src/session/SessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../src/session/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGlE,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAe9F,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAEpE;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,cAAc,CAA2B;IAEjD;;;OAGG;IACH,OAAO,CAAC,WAAW,CAAmC;gBAE1C,QAAQ,CAAC,EAAE,eAAe;IAItC;;;OAGG;YACW,QAAQ;IAiBtB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACG,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BtE;;;;;OAKG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAoDhE;;;OAGG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC;;OAEG;IACH,iBAAiB,IAAI,WAAW,GAAG,IAAI;IAIvC;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAehE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAenD;;OAEG;YACW,YAAY;IAM1B;;OAEG;YACW,iBAAiB;IAI/B;;OAEG;YACW,mBAAmB;IAIjC;;;;;OAKG;YACW,WAAW;IA4CzB;;;;;OAKG;YACW,cAAc;IAgD5B;;;;;OAKG;YACW,YAAY;IA4C1B;;;;OAIG;YACW,cAAc;IAwC5B;;;;OAIG;YACW,eAAe;CA6B9B"}
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../src/session/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGlE,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAgB9F,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,4BAA4B,CAAA;AAEnC;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,cAAc,CAA2B;IAEjD;;;OAGG;IACH,OAAO,CAAC,WAAW,CAAmC;gBAE1C,QAAQ,CAAC,EAAE,eAAe;IAItC;;;OAGG;YACW,QAAQ;IAiBtB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACG,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BtE;;;;;OAKG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAqDhE;;;OAGG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC;;OAEG;IACH,iBAAiB,IAAI,WAAW,GAAG,IAAI;IAIvC;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAehE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAenD;;OAEG;YACW,YAAY;IAM1B;;OAEG;YACW,iBAAiB;IAI/B;;OAEG;YACW,mBAAmB;CAGlC"}

package/dist/src/session/SessionManager.js

@@ -2,6 +2,7 @@
  * Session Manager for Claude-Flow Memory Integration
  * SMI-641: Session ID Storage in Claude-Flow Memory
  * SMI-1518: V3 API Migration - Use direct API calls instead of spawn
+ * SMI-2741: Split to meet 500-line standard
  *
  * Manages session lifecycle with persistent storage in claude-flow memory
  * to enable context restoration across sessions.
@@ -9,8 +10,11 @@
 import { randomUUID } from 'node:crypto';
 import { sanitizeSessionData } from './SessionManager.types.js';
 // Import helpers
-import { getClaudeFlowMemory, getClaudeFlowMcp, MEMORY_KEYS, USE_V3_API, MEMORY_NAMESPACE, validateMemoryKey, DefaultCommandExecutor, } from './SessionManager.helpers.js';
+import { MEMORY_KEYS, DefaultCommandExecutor } from './SessionManager.helpers.js';
+// SMI-2741: Memory and hook operations extracted to companion file
+import { storeMemoryEntry, retrieveMemoryEntry, deleteMemoryEntry, runPreTaskHook, runPostTaskHook, } from './SessionManager.memory.js';
 export { DefaultCommandExecutor } from './SessionManager.helpers.js';
+export { storeMemoryEntry, retrieveMemoryEntry, deleteMemoryEntry, runPreTaskHook, runPostTaskHook, } from './SessionManager.memory.js';
 /**
  * Session Manager for claude-flow memory integration
  *
@@ -80,7 +84,7 @@ export class SessionManager {
         await this.setCurrentSession(sessionId);
         // Run pre-task hook if description provided
         if (options.description) {
-            await this.runPreTaskHook(options.description);
+            await runPreTaskHook(options.description, this.executor);
         }
         this.currentSession = session;
         return session;
@@ -103,7 +107,7 @@ export class SessionManager {
                 memoryKey: `${MEMORY_KEYS.CHECKPOINT_PREFIX}${this.currentSession.sessionId}/${Date.now()}`,
             };
             // SMI-676: Store checkpoint data FIRST (before updating session)
-            const checkpointResult = await this.storeMemory(checkpoint.memoryKey, JSON.stringify(checkpoint));
+            const checkpointResult = await storeMemoryEntry(checkpoint.memoryKey, JSON.stringify(checkpoint), this.executor);
             if (!checkpointResult.success) {
                 throw new Error(`Failed to store checkpoint: ${checkpointResult.error}`);
             }
@@ -125,7 +129,7 @@ export class SessionManager {
                 this.currentSession.checkpoints = previousCheckpoints;
                 this.currentSession.lastActivity = previousLastActivity;
                 // Clean up the checkpoint from memory
-                await this.deleteMemory(checkpoint.memoryKey);
+                await deleteMemoryEntry(checkpoint.memoryKey, this.executor);
                 throw err;
             }
             return checkpoint;
@@ -158,7 +162,7 @@ export class SessionManager {
         this.currentSession.lastActivity = new Date().toISOString();
         await this.storeSession(this.currentSession);
         // Run post-task hook
-        await this.runPostTaskHook(this.currentSession.sessionId);
+        await runPostTaskHook(this.currentSession.sessionId, this.executor);
         // Clear current session pointer
         await this.clearCurrentSession();
         this.currentSession = null;
@@ -174,7 +178,7 @@ export class SessionManager {
      */
     async getSession(sessionId) {
         const memoryKey = `${MEMORY_KEYS.SESSION_PREFIX}${sessionId}`;
-        const result = await this.retrieveMemory(memoryKey);
+        const result = await retrieveMemoryEntry(memoryKey, this.executor);
         if (!result.success || !result.data) {
             return null;
         }
@@ -189,7 +193,7 @@ export class SessionManager {
      * Get the ID of the current session from memory
      */
     async getCurrentSessionId() {
-        const result = await this.retrieveMemory(MEMORY_KEYS.CURRENT);
+        const result = await retrieveMemoryEntry(MEMORY_KEYS.CURRENT, this.executor);
         if (!result.success || !result.data) {
             return null;
         }
@@ -207,247 +211,19 @@ export class SessionManager {
     async storeSession(session) {
         const memoryKey = `${MEMORY_KEYS.SESSION_PREFIX}${session.sessionId}`;
         const sanitized = sanitizeSessionData(session);
-        return this.storeMemory(memoryKey, JSON.stringify(sanitized));
+        return storeMemoryEntry(memoryKey, JSON.stringify(sanitized), this.executor);
     }
     /**
      * Set the current session pointer
      */
     async setCurrentSession(sessionId) {
-        return this.storeMemory(MEMORY_KEYS.CURRENT, JSON.stringify({ sessionId }));
+        return storeMemoryEntry(MEMORY_KEYS.CURRENT, JSON.stringify({ sessionId }), this.executor);
     }
     /**
      * Clear the current session pointer
      */
     async clearCurrentSession() {
-        return this.deleteMemory(MEMORY_KEYS.CURRENT);
-    }
-    /**
-     * Store data in claude-flow memory
-     *
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use direct storeEntry() when available
-     */
-    async storeMemory(key, value) {
-        if (!validateMemoryKey(key)) {
-            return { success: false, error: 'Invalid memory key' };
-        }
-        // SMI-1518, SMI-1609: Try V3 direct API first if enabled
-        if (USE_V3_API) {
-            try {
-                const memoryModule = await getClaudeFlowMemory();
-                if (memoryModule?.storeEntry) {
-                    const result = await memoryModule.storeEntry({
-                        key,
-                        value,
-                        namespace: MEMORY_NAMESPACE,
-                    });
-                    if (result.success) {
-                        return { success: true };
-                    }
-                    console.warn(`V3 storeEntry failed: ${result.error}, falling back to spawn`);
-                }
-            }
-            catch (error) {
-                console.warn(`V3 storeEntry exception: ${error}, falling back to spawn`);
-            }
-        }
-        try {
-            const args = ['claude-flow', 'memory', 'store', '--key', key, '--value', value];
-            if (this.executor.spawn) {
-                await this.executor.spawn('npx', args);
-            }
-            else {
-                const escapedValue = value.replace(/'/g, "'\\''");
-                const command = `npx claude-flow memory store --key "${key}" --value '${escapedValue}'`;
-                await this.executor.execute(command);
-            }
-            return { success: true };
-        }
-        catch (error) {
-            return {
-                success: false,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-    /**
-     * Retrieve data from claude-flow memory
-     *
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use direct getEntry() when available
-     */
-    async retrieveMemory(key) {
-        if (!validateMemoryKey(key)) {
-            return { success: false, error: 'Invalid memory key' };
-        }
-        // SMI-1518, SMI-1609: Try V3 direct API first if enabled
-        if (USE_V3_API) {
-            try {
-                const memoryModule = await getClaudeFlowMemory();
-                if (memoryModule?.getEntry) {
-                    const result = await memoryModule.getEntry({
-                        key,
-                        namespace: MEMORY_NAMESPACE,
-                    });
-                    if (result.success && result.found && result.entry) {
-                        return { success: true, data: result.entry.content };
-                    }
-                    if (result.success && !result.found) {
-                        return { success: false, error: 'Key not found' };
-                    }
-                    console.warn(`V3 getEntry failed: ${result.error}, falling back to spawn`);
-                }
-            }
-            catch (error) {
-                console.warn(`V3 getEntry exception: ${error}, falling back to spawn`);
-            }
-        }
-        try {
-            const args = ['claude-flow', 'memory', 'get', '--key', key];
-            let stdout;
-            if (this.executor.spawn) {
-                const result = await this.executor.spawn('npx', args);
-                stdout = result.stdout;
-            }
-            else {
-                const command = `npx claude-flow memory get --key "${key}"`;
-                const result = await this.executor.execute(command);
-                stdout = result.stdout;
-            }
-            return { success: true, data: stdout.trim() };
-        }
-        catch (error) {
-            return {
-                success: false,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-    /**
-     * Delete data from claude-flow memory
-     *
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use callMCPTool('memory/delete') when available
-     */
-    async deleteMemory(key) {
-        if (!validateMemoryKey(key)) {
-            return { success: false, error: 'Invalid memory key' };
-        }
-        // SMI-1518, SMI-1609: Try V3 MCP API first if enabled
-        if (USE_V3_API) {
-            try {
-                const mcpModule = await getClaudeFlowMcp();
-                if (mcpModule?.callMCPTool) {
-                    const result = (await mcpModule.callMCPTool('memory/delete', { key }));
-                    if (result.success) {
-                        return { success: true };
-                    }
-                    console.warn(`V3 memory/delete failed, falling back to spawn`);
-                }
-            }
-            catch (error) {
-                const mcpModule = await getClaudeFlowMcp();
-                const MCPClientError = mcpModule?.MCPClientError;
-                if (!MCPClientError || !(error instanceof MCPClientError)) {
-                    console.warn(`V3 memory/delete exception: ${error}, falling back to spawn`);
-                }
-            }
-        }
-        try {
-            const args = ['claude-flow', 'memory', 'delete', '--key', key];
-            if (this.executor.spawn) {
-                await this.executor.spawn('npx', args);
-            }
-            else {
-                const command = `npx claude-flow memory delete --key "${key}"`;
-                await this.executor.execute(command);
-            }
-            return { success: true };
-        }
-        catch {
-            // Ignore delete errors (key may not exist)
-            return { success: true };
-        }
-    }
-    /**
-     * Run pre-task hook
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use callMCPTool('hooks/pre-task') when available
-     */
-    async runPreTaskHook(description) {
-        // SMI-1518, SMI-1609: Try V3 MCP API first if enabled
-        if (USE_V3_API) {
-            try {
-                const mcpModule = await getClaudeFlowMcp();
-                if (mcpModule?.callMCPTool) {
-                    await mcpModule.callMCPTool('hooks/pre-task', {
-                        description,
-                        memoryKey: 'session/current',
-                    });
-                    return;
-                }
-            }
-            catch {
-                // V3 API not available or failed, fall back to spawn
-            }
-        }
-        try {
-            const args = [
-                'claude-flow',
-                'hooks',
-                'pre-task',
-                '--description',
-                description,
-                '--memory-key',
-                'session/current',
-            ];
-            if (this.executor.spawn) {
-                await this.executor.spawn('npx', args);
-            }
-            else {
-                const escapedDesc = description.replace(/'/g, "'\\''");
-                const command = `npx claude-flow hooks pre-task --description '${escapedDesc}' --memory-key "session/current"`;
-                await this.executor.execute(command);
-            }
-        }
-        catch {
-            // Hooks are optional, don't fail if they don't work
-        }
-    }
-    /**
-     * Run post-task hook
-     * SMI-674: Uses spawn() with argument array to prevent command injection
-     * SMI-1518: V3 API Migration - Use callMCPTool('hooks/post-task') when available
-     */
-    async runPostTaskHook(taskId) {
-        // SMI-1518, SMI-1609: Try V3 MCP API first if enabled
-        if (USE_V3_API) {
-            try {
-                const mcpModule = await getClaudeFlowMcp();
-                if (mcpModule?.callMCPTool) {
-                    await mcpModule.callMCPTool('hooks/post-task', {
-                        taskId,
-                    });
-                    return;
-                }
-            }
-            catch {
-                // V3 API not available or failed, fall back to spawn
-            }
-        }
-        try {
-            const args = ['claude-flow', 'hooks', 'post-task', '--task-id', taskId];
-            if (this.executor.spawn) {
-                await this.executor.spawn('npx', args);
-            }
-            else {
-                const command = `npx claude-flow hooks post-task --task-id "${taskId}"`;
-                await this.executor.execute(command);
-            }
-        }
-        catch {
-            // Hooks are optional, don't fail if they don't work
-        }
+        return deleteMemoryEntry(MEMORY_KEYS.CURRENT, this.executor);
     }
 }
 //# sourceMappingURL=SessionManager.js.map