@synergenius/flow-weaver-pack-weaver 0.9.151 → 0.9.153

package/src/bot/runner.ts

@@ -84,7 +84,7 @@ function parseConfigFile(configPath: string): WeaverConfig {
   }
 }
 
-function buildSummary(result: unknown): string {
+export function buildSummary(result: unknown): string {
   if (!result || typeof result !== 'object') return String(result);
 
   const r = result as Record<string, unknown>;
@@ -101,6 +101,120 @@ function buildSummary(result: unknown): string {
   return parts.length > 0 ? parts.join(', ') : 'completed';
 }
 
+/**
+ * Build a markdown report from the workflow result's ctx field.
+ * Extracted for testability — same logic used inside runWorkflow.
+ */
+export function buildReport(
+  result: Record<string, unknown> | null,
+  success: boolean,
+  stepLog?: import('./types.js').StepLogEntry[],
+): string | undefined {
+  try {
+    const ctxStr = result?.ctx as string | undefined;
+    if (!ctxStr) return undefined;
+    const ctx = JSON.parse(ctxStr);
+    const md: string[] = [];
+    md.push(`## ${success ? 'Task Completed' : 'Task Failed'}`);
+    md.push('');
+
+    // Steps
+    if (stepLog && stepLog.length > 0) {
+      md.push('### Steps');
+      md.push('');
+      for (const s of stepLog) {
+        const icon = s.status === 'ok' ? '**ok**' : s.status === 'error' ? '**error**' : '**blocked**';
+        md.push(`- ${s.step} (${icon})${s.detail ? `: ${s.detail}` : ''}`);
+      }
+      md.push('');
+    }
+
+    // Files
+    const files: string[] = ctx.filesModified ? JSON.parse(ctx.filesModified) : [];
+    if (files.length > 0) {
+      md.push('### Files Modified');
+      md.push('');
+      for (const f of files) md.push(`- \`${f}\``);
+      md.push('');
+    }
+
+    // Review
+    if (ctx.reviewJson) {
+      const review = JSON.parse(ctx.reviewJson) as Record<string, string>;
+      if (review.intent || review.execution || review.result || review.completeness) {
+        md.push('### Review');
+        md.push('');
+        for (const key of ['intent', 'execution', 'result', 'completeness']) {
+          if (review[key]) md.push(`- **${key}:** ${review[key]}`);
+        }
+        if (review.reason) md.push(`\n${review.reason}`);
+        md.push('');
+      }
+    }
+
+    return md.length > 2 ? md.join('\n') : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Extract stepLog and plan from the result's ctx field.
+ * Extracted for testability — same logic used inside runWorkflow.
+ */
+export function extractCtxData(result: Record<string, unknown> | null): {
+  stepLog?: import('./types.js').StepLogEntry[];
+  plan?: { summary: string; steps: Array<{ id: string; operation: string; description: string; args?: Record<string, unknown> }> };
+} {
+  try {
+    const ctxStr = result?.ctx as string | undefined;
+    if (!ctxStr) return {};
+    const ctx = JSON.parse(ctxStr);
+    let stepLog: import('./types.js').StepLogEntry[] | undefined;
+    let plan: { summary: string; steps: Array<{ id: string; operation: string; description: string; args?: Record<string, unknown> }> } | undefined;
+
+    if (ctx.stepLogJson) stepLog = JSON.parse(ctx.stepLogJson);
+    if (ctx.planJson) {
+      const parsed = JSON.parse(ctx.planJson);
+      if (parsed?.steps) {
+        plan = {
+          summary: parsed.summary ?? '',
+          steps: (parsed.steps as Array<Record<string, unknown>>).map((s) => ({
+            id: String(s.id ?? ''),
+            operation: String(s.operation ?? ''),
+            description: String(s.description ?? ''),
+            ...(s.args ? { args: s.args as Record<string, unknown> } : {}),
+          })),
+        };
+      }
+    }
+    return { stepLog, plan };
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Fallback: extract report from trace outputs (bot-report node's "Markdown report" port).
+ */
+export function extractReportFromTrace(
+  trace: Array<{ type: string; outputs?: unknown[] }>,
+): string | undefined {
+  for (const te of trace) {
+    if (te.type === 'node-complete' && te.outputs) {
+      for (const o of te.outputs) {
+        if (typeof o === 'object' && o && 'portLabel' in o) {
+          const po = o as { portLabel: string; value: unknown };
+          if (po.portLabel === 'Markdown report' && typeof po.value === 'string' && po.value.length > 0) {
+            return po.value;
+          }
+        }
+      }
+    }
+  }
+  return undefined;
+}
+
 export async function runWorkflow(
   filePath: string,
   options?: {
@@ -272,7 +386,7 @@ export async function runWorkflow(
           }
         }
       }
-      for (const inst of parseResult?.workflow?.instances ?? []) {
+      for (const inst of (parseResult?.workflows?.[0]?.instances ?? parseResult?.workflow?.instances ?? [])) {
         const label = inst.config?.label ?? nodeLabels.get(inst.nodeType);
         if (label) nodeLabels.set(inst.id, label);
         // Inherit visual meta from node type to instance
@@ -415,77 +529,17 @@ export async function runWorkflow(
     }
 
     // Extract stepLog and plan from WeaverContext if available
-    let stepLog: import('./types.js').StepLogEntry[] | undefined;
-    let plan: RunRecord['plan'] | undefined;
-    try {
-      const ctxStr = result?.ctx as string | undefined;
-      if (ctxStr) {
-        const ctx = JSON.parse(ctxStr);
-        if (ctx.stepLogJson) stepLog = JSON.parse(ctx.stepLogJson);
-        if (ctx.planJson) {
-          const parsed = JSON.parse(ctx.planJson);
-          if (parsed?.steps) {
-            plan = {
-              summary: parsed.summary ?? '',
-              steps: (parsed.steps as Array<Record<string, unknown>>).map((s) => ({
-                id: String(s.id ?? ''),
-                operation: String(s.operation ?? ''),
-                description: String(s.description ?? ''),
-                ...(s.args ? { args: s.args as Record<string, unknown> } : {}),
-              })),
-            };
-          }
-        }
-      }
-    } catch { /* extraction is best-effort */ }
+    const { stepLog, plan } = extractCtxData(result);
 
     // Build markdown report from the extracted context data
-    let report: string | undefined;
-    try {
-      const ctxStr = result?.ctx as string | undefined;
-      if (ctxStr) {
-        const ctx = JSON.parse(ctxStr);
-        const md: string[] = [];
-        md.push(`## ${success ? 'Task Completed' : 'Task Failed'}`);
-        md.push('');
-
-        // Steps
-        if (stepLog && stepLog.length > 0) {
-          md.push('### Steps');
-          md.push('');
-          for (const s of stepLog) {
-            const icon = s.status === 'ok' ? '**ok**' : s.status === 'error' ? '**error**' : '**blocked**';
-            md.push(`- ${s.step} (${icon})${s.detail ? `: ${s.detail}` : ''}`);
-          }
-          md.push('');
-        }
-
-        // Files
-        const files: string[] = ctx.filesModified ? JSON.parse(ctx.filesModified) : [];
-        if (files.length > 0) {
-          md.push('### Files Modified');
-          md.push('');
-          for (const f of files) md.push(`- \`${f}\``);
-          md.push('');
-        }
-
-        // Review
-        if (ctx.reviewJson) {
-          const review = JSON.parse(ctx.reviewJson) as Record<string, string>;
-          if (review.intent || review.execution || review.result || review.completeness) {
-            md.push('### Review');
-            md.push('');
-            for (const key of ['intent', 'execution', 'result', 'completeness']) {
-              if (review[key]) md.push(`- **${key}:** ${review[key]}`);
-            }
-            if (review.reason) md.push(`\n${review.reason}`);
-            md.push('');
-          }
-        }
+    let report = buildReport(result, success, stepLog);
 
-        if (md.length > 2) report = md.join('\n');
-      }
-    } catch { /* report generation is best-effort */ }
+    // Fallback: extract report from the bot-report node's trace output.
+    // The FW compiled workflow doesn't wire bot-report's report port to END,
+    // so result.report is undefined. But the trace captured all node outputs.
+    if (!report) {
+      report = extractReportFromTrace(collectedTrace);
+    }
 
     await notifier({
       type: 'workflow-complete',

package/src/bot/step-executor.ts

@@ -189,18 +189,24 @@ export async function executeStep(
       }
       assertSafePath(file, projectDir);
       const filePath = path.resolve(projectDir, file);
-      const content = (args.content as string) ?? (args.body as string) ?? '';
+      // Use the relative path for reporting — never leak absolute server paths
+      const relPath = path.relative(projectDir, filePath);
+      const rawContent = args.content ?? args.body ?? '';
+      if (typeof rawContent !== 'string') {
+        return { blocked: true, blockReason: `${step.operation}: "content" must be a string, got ${typeof rawContent}.` };
+      }
+      const content = rawContent;
 
       const guard = checkWriteSafety(filePath, content);
       if (!guard.allowed) {
-        return { file: filePath, blocked: true, blockReason: guard.reason };
+        return { file: relPath, blocked: true, blockReason: guard.reason };
       }
 
       fs.mkdirSync(path.dirname(filePath), { recursive: true });
       const existed = fs.existsSync(filePath);
       fs.writeFileSync(filePath, content, 'utf-8');
       filesWrittenThisPlan++;
-      return { file: filePath, created: !existed };
+      return { file: relPath, created: !existed };
     }
 
     // -----------------------------------------------------------------
@@ -212,6 +218,7 @@ export async function executeStep(
       }
       assertSafePath(file, projectDir);
       const filePath = path.resolve(projectDir, file);
+      const relPath = path.relative(projectDir, filePath);
 
       if (!fs.existsSync(filePath)) {
         return { blocked: true, blockReason: `File not found: ${file}` };
@@ -234,6 +241,17 @@ export async function executeStep(
         return { blocked: true, blockReason: 'patch_file requires "patches" array or "find"+"replace" args.' };
       }
 
+      // Validate each patch entry has string find and replace
+      for (let i = 0; i < patches.length; i++) {
+        const p = patches[i];
+        if (typeof p.find !== 'string') {
+          return { blocked: true, blockReason: `patch_file: patch[${i}].find must be a string, got ${typeof p.find}.` };
+        }
+        if (typeof p.replace !== 'string') {
+          return { blocked: true, blockReason: `patch_file: patch[${i}].replace must be a string, got ${typeof p.replace}.` };
+        }
+      }
+
       let applied = 0;
       const notFound: string[] = [];
 
@@ -248,7 +266,7 @@ export async function executeStep(
 
       if (applied === 0) {
         return {
-          file: filePath,
+          file: relPath,
           output: `No patches applied. Search strings not found: ${notFound.join('; ')}`,
         };
       }
@@ -259,7 +277,7 @@ export async function executeStep(
       if (originalSize > SHRINK_GUARD_MIN_SIZE && newSize < originalSize * MAX_SHRINK_RATIO) {
         const shrinkPct = Math.round((1 - newSize / originalSize) * 100);
         return {
-          file: filePath,
+          file: relPath,
           blocked: true,
           blockReason:
             `Refusing to patch ${path.basename(filePath)}: result (${newSize}B) ` +
@@ -273,7 +291,7 @@ export async function executeStep(
 
       const summary = `Applied ${applied}/${patches.length} patches` +
         (notFound.length ? `. Not found: ${notFound.join('; ')}` : '');
-      return { file: filePath, output: summary };
+      return { file: relPath, output: summary };
     }
 
     // -----------------------------------------------------------------
@@ -281,10 +299,11 @@ export async function executeStep(
     // -----------------------------------------------------------------
     case OP_READ_FILE: {
       if (!file) {
-        return { output: '' };
+        return { blocked: true, blockReason: 'read_file requires a "file" argument.' };
       }
       assertSafePath(file, projectDir);
       const filePath = path.resolve(projectDir, file);
+      const relPath = path.relative(projectDir, filePath);
       if (!fs.existsSync(filePath)) {
         return { output: `File not found: ${file}` };
       }
@@ -298,9 +317,9 @@ export async function executeStep(
           return { output: `File too large to read (${stat.size} bytes, max ${MAX_READ_SIZE}). Use run_shell with head/tail instead.` };
         }
         const content = fs.readFileSync(filePath, 'utf-8');
-        return { file: filePath, output: content };
+        return { file: relPath, output: content };
       } catch (err: unknown) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = (err instanceof Error ? err.message : String(err)).replaceAll(projectDir + '/', '');
         return { output: `Error reading file "${file}": ${msg}` };
       }
     }
@@ -341,8 +360,9 @@ export async function executeStep(
         const stdout = (execErr.stdout ?? '').trim();
         const stderr = (execErr.stderr ?? '').trim();
         const combined = [stdout, stderr].filter(Boolean).join('\n');
+        const raw = combined || (err instanceof Error ? err.message : String(err));
         return {
-          output: combined || (err instanceof Error ? err.message : String(err)),
+          output: raw.replaceAll(projectDir + '/', ''),
         };
       }
     }
@@ -364,7 +384,7 @@ export async function executeStep(
       try {
         entries = fs.readdirSync(targetDir, { recursive: true, encoding: 'utf-8' }) as string[];
       } catch (err: unknown) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = (err instanceof Error ? err.message : String(err)).replaceAll(projectDir + '/', '');
         return { output: `Error listing directory "${dir}": ${msg}` };
       }
       let files = entries
@@ -376,6 +396,9 @@ export async function executeStep(
         .sort();
 
       if (pattern) {
+        if (pattern.length > 200) {
+          return { blocked: true, blockReason: `list_files: regex pattern too long (${pattern.length} chars, max 200).` };
+        }
         try {
           const regex = new RegExp(pattern);
           files = files.filter(f => regex.test(f));
@@ -399,7 +422,60 @@ export async function executeStep(
       if (!title) return { blocked: true, blockReason: 'task_create requires a "title" argument.' };
 
       const store = new TaskStore(projectDir);
-      const assignedProfile = args.assignedProfile as string | undefined;
+
+      // Validate assignedProfile: must be a valid slug (lowercase alphanumeric + hyphens)
+      const rawProfile = args.assignedProfile as string | undefined;
+      let assignedProfile: string | undefined;
+      if (rawProfile !== undefined && rawProfile !== null) {
+        if (typeof rawProfile !== 'string' || !rawProfile.trim()) {
+          return { blocked: true, blockReason: 'task_create: assignedProfile must be a non-empty string.' };
+        }
+        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(rawProfile)) {
+          return { blocked: true, blockReason: `task_create: assignedProfile "${rawProfile}" is not a valid slug (use lowercase alphanumeric with hyphens).` };
+        }
+        assignedProfile = rawProfile;
+      }
+
+      // Validate complexity against enum, default to 'simple' if invalid
+      const VALID_COMPLEXITIES = new Set(['trivial', 'simple', 'moderate', 'complex']);
+      const rawComplexity = args.complexity as string | undefined;
+      const complexity: 'trivial' | 'simple' | 'moderate' | 'complex' =
+        rawComplexity && VALID_COMPLEXITIES.has(rawComplexity)
+          ? (rawComplexity as 'trivial' | 'simple' | 'moderate' | 'complex')
+          : 'simple';
+
+      // Validate priority: coerce to number, default to 0 if NaN
+      const rawPriority = Number(args.priority);
+      const priority = Number.isFinite(rawPriority) ? rawPriority : 0;
+
+      // Validate parentId — must reference an existing task
+      const rawParentId = args.parentId as string | undefined;
+      let parentId: string | undefined;
+      if (rawParentId) {
+        // Resolve through symbolicIdMap first (in case it's a title or symbolic ref)
+        const resolved = symbolicIdMap?.[rawParentId] ?? rawParentId;
+        const parentTask = await store.get(resolved);
+        if (!parentTask) {
+          return { blocked: true, blockReason: `task_create: parentId "${rawParentId}" does not match any existing task. Use the exact Task ID from the prompt.` };
+        }
+        parentId = resolved;
+      }
+
+      // Idempotent: if a task with the same title and parentId already exists, return it
+      // instead of creating a duplicate. This prevents retry loops from producing duplicates.
+      if (parentId) {
+        const existing = (await store.list()).find(
+          t => t.parentId === parentId && t.title.toLowerCase() === title.toLowerCase(),
+        );
+        if (existing) {
+          if (symbolicIdMap) {
+            const symbolicKey = (args.symbolicId as string) ?? (args.id as string);
+            if (symbolicKey) symbolicIdMap[symbolicKey] = existing.id;
+            symbolicIdMap[title] = existing.id;
+          }
+          return { output: `Task "${title}" already exists (${existing.id}), skipped duplicate.` };
+        }
+      }
 
       // Resolve symbolic IDs in dependsOn through the map
       const rawDeps = (args.dependsOn as string[]) ?? [];
@@ -410,9 +486,9 @@ export async function executeStep(
       const input: CreateTaskInput = {
         title,
         description: (args.description as string) ?? title,
-        complexity: (args.complexity as 'trivial' | 'simple' | 'moderate' | 'complex') ?? 'simple',
-        priority: (args.priority as number) ?? 0,
-        parentId: args.parentId as string | undefined,
+        complexity,
+        priority,
+        parentId,
         dependsOn: resolvedDeps,
         assignedProfile,
       };
@@ -420,16 +496,30 @@ export async function executeStep(
       // Support inline subtasks
       const subtasksArg = args.subtasks as Array<Record<string, unknown>> | undefined;
       if (subtasksArg?.length) {
-        input.subtasks = subtasksArg.map((s) => ({
-          title: (s.title as string) ?? '',
-          description: (s.description as string) ?? '',
-          complexity: (s.complexity as 'trivial' | 'simple' | 'moderate' | 'complex') ?? 'simple',
-          priority: (s.priority as number) ?? 0,
-          assignedProfile: (s.assignedProfile as string) ?? assignedProfile ?? 'developer',
-          dependsOn: symbolicIdMap
-            ? ((s.dependsOn as string[]) ?? []).map(dep => symbolicIdMap[dep] ?? dep)
-            : (s.dependsOn as string[]) ?? [],
-        }));
+        // Validate subtask titles are non-empty
+        for (let i = 0; i < subtasksArg.length; i++) {
+          const subTitle = (subtasksArg[i].title as string) ?? '';
+          if (!subTitle.trim()) {
+            return { blocked: true, blockReason: `task_create: subtask[${i}] has an empty title. All subtasks must have non-empty titles.` };
+          }
+        }
+
+        input.subtasks = subtasksArg.map((s) => {
+          const subComplexity = s.complexity as string | undefined;
+          const subPriority = Number(s.priority);
+          return {
+            title: (s.title as string) ?? '',
+            description: (s.description as string) ?? '',
+            complexity: subComplexity && VALID_COMPLEXITIES.has(subComplexity)
+              ? (subComplexity as 'trivial' | 'simple' | 'moderate' | 'complex')
+              : 'simple',
+            priority: Number.isFinite(subPriority) ? subPriority : 0,
+            assignedProfile: (s.assignedProfile as string) ?? assignedProfile ?? 'developer',
+            dependsOn: symbolicIdMap
+              ? ((s.dependsOn as string[]) ?? []).map(dep => symbolicIdMap[dep] ?? dep)
+              : (s.dependsOn as string[]) ?? [],
+          };
+        });
       }
 
       const task = await store.create(input);