@trops/dash-core 0.1.626 → 0.1.628

package/dist/electron/index.js

@@ -73683,6 +73683,7 @@ const Store = require$$0$5;
 function createElectronHost$1() {
   const store = new Store({ name: "dash-bots" });
   const budgetStore = new Store({ name: "dash-bot-budgets" });
+  const memoryStore = new Store({ name: "dash-bot-memory" });
   const botsRoot = path$3.join(app$2.getPath("userData"), "bots");
 
   return {
@@ -73700,6 +73701,11 @@ function createElectronHost$1() {
         budgetStore.get("store", { budgets: {}, spend: {}, overrides: {} }),
       write: (obj) => budgetStore.set("store", obj),
     },
+    // Separate blob for scoped bot memory (P1: FR-010).
+    memoryPersistence: {
+      read: () => memoryStore.get("store", { scopes: {} }),
+      write: (obj) => memoryStore.set("store", obj),
+    },
   };
 }
 
@@ -73808,11 +73814,25 @@ function validateBotDefinition$1(def) {
   if (!WHILE_PAUSED.has(def.whilePaused)) {
     errors.push(`whilePaused must be one of ${[...WHILE_PAUSED].join(", ")}`);
   }
-  for (const field of ["mcpServers", "allowedTools", "schedules"]) {
-    if (!Array.isArray(def[field])) {
+  for (const field of [
+    "mcpServers",
+    "allowedTools",
+    "schedules",
+    "subscriptions",
+  ]) {
+    if (def[field] !== undefined && !Array.isArray(def[field])) {
       errors.push(`${field} must be an array`);
     }
   }
+  // Each subscription must name an eventType (PRD FR-009).
+  if (Array.isArray(def.subscriptions)) {
+    for (const sub of def.subscriptions) {
+      if (!sub || typeof sub.eventType !== "string" || !sub.eventType.trim()) {
+        errors.push("each subscription must have a non-empty eventType");
+        break;
+      }
+    }
+  }
   return { valid: errors.length === 0, errors };
 }
 
@@ -74777,6 +74797,7 @@ var engines$1 = { getEngine, listEngines, registerEngine };
  *   botId: string,
  *   allowedTools?: string[],
  *   mcpServers?: string[],
+ *   internalServers?: string[],
  *   approvalPolicy?: "ask" | "allow",
  *   resolveServer: (toolName: string) => (string | null),
  *   createApproval: (request: object) => { id: string, promise: Promise<any> },
@@ -74792,6 +74813,7 @@ function createRequestPermission$1(ctx) {
     botId,
     allowedTools = [],
     mcpServers = [],
+    internalServers = [],
     resolveServer,
     createApproval,
     audit = () => {},
@@ -74840,6 +74862,16 @@ function createRequestPermission$1(ctx) {
 
     const serverName = resolveServer(toolName);
 
+    // 1b. Internal Bot Factory tools (e.g. bot-memory) are the bot's own
+    //     sandbox — auto-allowed, never a consent prompt or external action.
+    if (serverName && internalServers.includes(serverName)) {
+      return record(
+        toolName,
+        { allow: true },
+        { outcome: "internal", serverName },
+      );
+    }
+
     // 2. A tool whose server the bot was never configured with is denied
     //    without prompting — it's not a consent gap, it's out of scope.
     if (!serverName || !mcpServers.includes(serverName)) {
@@ -74959,6 +74991,9 @@ let BotRunner$1 = class BotRunner {
     this._makeRequestPermission =
       deps.makeRequestPermission || createRequestPermission;
     this._gate = deps.gate; // forwarded to PermissionGate ctx (optional)
+    // Virtual servers whose tools are auto-allowed (e.g. "bot-memory") — the
+    // bot's own sandbox, not external actions. Forwarded to the gate ctx.
+    this._internalServers = deps.internalServers || [];
     this._isPaused = deps.isPaused || (() => false);
     // Called after each run with the run's token usage so budgets (Slice 5)
     // can accrue cost. Optional — default no-op keeps the runner portable.
@@ -75030,6 +75065,7 @@ let BotRunner$1 = class BotRunner {
         workspaceId: bot.workspaceId,
         allowedTools: bot.allowedTools || [],
         mcpServers: bot.mcpServers || [],
+        internalServers: this._internalServers,
         resolveServer,
         createApproval: (request) => this._approvals.create(request),
         audit: this._audit,
@@ -75491,6 +75527,319 @@ let PauseController$1 = class PauseController {
 
 var PauseController_1 = PauseController$1;
 
+/**
+ * BotMemory.js
+ *
+ * Durable, scoped key-value memory for bots (PRD FR-010 / FR-012, US-012/015):
+ * a bot can remember facts across runs. Values are namespaced by scope
+ * (`workspace` — isolated per workspace — or `global` — shared across a
+ * principal's bots) and carry a monotonic `version` + `updatedAt` so a later
+ * slice can add history/optimistic concurrency without a data migration.
+ *
+ * Portable (NFR-006): the durable blob is injected as `persistence` (same shape
+ * as BotStore/BudgetController), so this loads and runs under plain Node. The
+ * Electron wiring (electron-store) lives in host.js. A KV store needs no SQL for
+ * v1; SQLite can later slot in behind this exact interface if volume demands.
+ */
+
+const VALID_SCOPES = ["workspace", "global"];
+
+/** Bucket key for a (scope, id) pair. Global collapses all ids to one bucket. */
+function bucketKey(scope, id) {
+  return scope === "global" ? "global" : `workspace:${id || "default"}`;
+}
+
+let BotMemory$1 = class BotMemory {
+  /**
+   * @param {{ persistence: { read: () => object, write: (o: object) => void },
+   *           clock?: { now: () => string } }} deps
+   */
+  constructor({ persistence, clock } = {}) {
+    if (!persistence) throw new Error("BotMemory: persistence is required");
+    this._persistence = persistence;
+    this._now = (clock && clock.now) || (() => new Date().toISOString());
+  }
+
+  _read() {
+    const blob = this._persistence.read() || {};
+    return blob.scopes ? blob : { scopes: {} };
+  }
+
+  _write(blob) {
+    this._persistence.write(blob);
+  }
+
+  /** @returns {*} the stored value, or undefined if absent. */
+  get(scope, id, key) {
+    const bucket = this._read().scopes[bucketKey(scope, id)] || {};
+    const entry = bucket[key];
+    return entry ? entry.value : undefined;
+  }
+
+  /** Store (or overwrite) a value; bumps version. @returns the stored entry. */
+  set(scope, id, key, value) {
+    const blob = this._read();
+    const bk = bucketKey(scope, id);
+    const bucket = blob.scopes[bk] || (blob.scopes[bk] = {});
+    const prev = bucket[key];
+    const entry = {
+      value,
+      version: prev ? prev.version + 1 : 1,
+      updatedAt: this._now(),
+    };
+    bucket[key] = entry;
+    this._write(blob);
+    return entry;
+  }
+
+  /** @returns {Array<{key,value,version,updatedAt}>} entries, optionally prefixed. */
+  list(scope, id, prefix) {
+    const bucket = this._read().scopes[bucketKey(scope, id)] || {};
+    return Object.keys(bucket)
+      .filter((k) => !prefix || k.startsWith(prefix))
+      .sort()
+      .map((k) => ({
+        key: k,
+        value: bucket[k].value,
+        version: bucket[k].version,
+        updatedAt: bucket[k].updatedAt,
+      }));
+  }
+
+  /** @returns {boolean} true if a value was removed. */
+  delete(scope, id, key) {
+    const blob = this._read();
+    const bucket = blob.scopes[bucketKey(scope, id)];
+    if (!bucket || !(key in bucket)) return false;
+    delete bucket[key];
+    this._write(blob);
+    return true;
+  }
+};
+
+var BotMemory_1 = { BotMemory: BotMemory$1, VALID_SCOPES };
+
+/**
+ * memoryTools.js
+ *
+ * Exposes BotMemory to bots as in-process tools (PRD FR-010): memory_get /
+ * memory_set / memory_list / memory_delete. These are served under a virtual
+ * "bot-memory" server that the bot PermissionGate auto-allows (it's the bot's
+ * own sandbox, not an external action), so no consent prompt is required.
+ *
+ * Portable (NFR-006): no Electron. botController wires a BotMemory instance and
+ * the calling bot's scope, and routes MEMORY_SERVER tool calls here. The result
+ * shape matches the tool-loop engine's executeTool contract: { text, isError }.
+ */
+
+const MEMORY_SERVER$1 = "bot-memory";
+
+const SCOPE_PROP = {
+  type: "string",
+  enum: ["workspace", "global"],
+  description:
+    "Which memory scope to use: 'workspace' (default, isolated to this bot's workspace) or 'global' (shared across your bots).",
+};
+
+const MEMORY_TOOLS$1 = [
+  {
+    name: "memory_set",
+    description:
+      "Store a value in your durable memory under a key. Persists across runs so you can recall it later.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        key: { type: "string", description: "Key to store the value under." },
+        value: { description: "The value to store (any JSON)." },
+        scope: SCOPE_PROP,
+      },
+      required: ["key", "value"],
+    },
+  },
+  {
+    name: "memory_get",
+    description:
+      "Retrieve a value previously stored with memory_set. Returns the value, or a note if nothing is stored.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        key: { type: "string", description: "Key to look up." },
+        scope: SCOPE_PROP,
+      },
+      required: ["key"],
+    },
+  },
+  {
+    name: "memory_list",
+    description:
+      "List the keys currently in your memory, optionally filtered by a key prefix.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        prefix: {
+          type: "string",
+          description: "Only list keys with this prefix.",
+        },
+        scope: SCOPE_PROP,
+      },
+    },
+  },
+  {
+    name: "memory_delete",
+    description: "Delete a key from your memory.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        key: { type: "string", description: "Key to delete." },
+        scope: SCOPE_PROP,
+      },
+      required: ["key"],
+    },
+  },
+];
+
+function ok$1(text) {
+  return { text, isError: false };
+}
+function fail$1(text) {
+  return { text, isError: true };
+}
+
+/**
+ * Execute a memory_* tool call in-process.
+ * @param {import("./BotMemory").BotMemory} memory
+ * @param {{ workspaceId?: string }} ctx  the calling bot's scope context
+ * @param {string} toolName
+ * @param {object} args
+ * @returns {{ text: string, isError: boolean }}
+ */
+function handleMemoryTool$1(memory, ctx, toolName, args = {}) {
+  const scope = args && args.scope === "global" ? "global" : "workspace";
+  const id = ctx && ctx.workspaceId;
+  try {
+    switch (toolName) {
+      case "memory_set": {
+        if (!args || !args.key) return fail$1("memory_set requires a 'key'.");
+        const entry = memory.set(scope, id, args.key, args.value);
+        return ok$1(`Stored '${args.key}' (${scope}, v${entry.version}).`);
+      }
+      case "memory_get": {
+        if (!args || !args.key) return fail$1("memory_get requires a 'key'.");
+        const value = memory.get(scope, id, args.key);
+        if (value === undefined)
+          return ok$1(`No value stored for '${args.key}' (${scope}).`);
+        return ok$1(typeof value === "string" ? value : JSON.stringify(value));
+      }
+      case "memory_list": {
+        const entries = memory.list(scope, id, args && args.prefix);
+        if (!entries.length) return ok$1(`No memory keys stored (${scope}).`);
+        return ok$1(entries.map((e) => `${e.key} (v${e.version})`).join("\n"));
+      }
+      case "memory_delete": {
+        if (!args || !args.key) return fail$1("memory_delete requires a 'key'.");
+        const removed = memory.delete(scope, id, args.key);
+        return ok$1(
+          removed
+            ? `Deleted '${args.key}' (${scope}).`
+            : `No value to delete for '${args.key}' (${scope}).`,
+        );
+      }
+      default:
+        return fail$1(`Unknown memory tool '${toolName}'.`);
+    }
+  } catch (e) {
+    return fail$1(`Memory tool error: ${(e && e.message) || e}`);
+  }
+}
+
+var memoryTools = { MEMORY_SERVER: MEMORY_SERVER$1, MEMORY_TOOLS: MEMORY_TOOLS$1, handleMemoryTool: handleMemoryTool$1 };
+
+/**
+ * eventMatcher.js
+ *
+ * Given a fired event and the set of bots, returns the bots that subscribe to
+ * it (PRD FR-009 / US-010). A bot subscribes via `subscriptions: [{ eventType }]`.
+ *
+ * Workspace scoping is designed in but not yet exercised: when an event carries
+ * a `workspaceId`, a bot only matches if it's unscoped (`workspaceId` falsy) or
+ * its `workspaceId` equals the event's. Events aren't stamped with a workspace
+ * yet (a follow-up slice), so today every subscribed bot matches — but the
+ * scoping "just works" once stamping lands, with no matcher change.
+ *
+ * Pure (NFR-006): no Electron, no I/O.
+ */
+
+/**
+ * @param {Array<object>} bots  bot definitions (each may have `subscriptions`)
+ * @param {{ eventType: string, workspaceId?: string }} event
+ * @param {{ excludeBotId?: string }} [opts]  loop guard — never match this bot
+ * @returns {Array<object>} the subscribing bots
+ */
+function matchSubscribedBots$1(bots, event, opts = {}) {
+  if (!Array.isArray(bots) || !event || !event.eventType) return [];
+  const excludeBotId = opts.excludeBotId || null;
+  const eventWorkspace = event.workspaceId || null;
+
+  return bots.filter((bot) => {
+    if (!bot || bot.id === excludeBotId) return false;
+    const subs = Array.isArray(bot.subscriptions) ? bot.subscriptions : [];
+    const subscribed = subs.some((s) => s && s.eventType === event.eventType);
+    if (!subscribed) return false;
+
+    // Workspace scoping (forward-compatible): only enforced once events carry a
+    // workspaceId. An unscoped bot (no workspaceId) listens everywhere.
+    if (eventWorkspace && bot.workspaceId) {
+      return bot.workspaceId === eventWorkspace;
+    }
+    return true;
+  });
+}
+
+var eventMatcher = { matchSubscribedBots: matchSubscribedBots$1 };
+
+/**
+ * EventDispatcher.js
+ *
+ * Rate guard for event-triggered bot runs (PRD FR-009): a chatty event must not
+ * spawn a flood of runs. Enforces a per-bot cooldown — a given bot won't be
+ * event-triggered more often than once per `cooldownMs`. The dispatch decision
+ * (pause, already-running) lives in botController; this owns only the timing.
+ *
+ * Pure (NFR-006): the clock is injected, so it's deterministic under test and
+ * Electron-free.
+ */
+
+const DEFAULT_COOLDOWN_MS = 10_000;
+
+let EventDispatcher$1 = class EventDispatcher {
+  /**
+   * @param {{ cooldownMs?: number, clock?: { nowMs: () => number } }} [opts]
+   */
+  constructor(opts = {}) {
+    this._cooldownMs =
+      typeof opts.cooldownMs === "number"
+        ? opts.cooldownMs
+        : DEFAULT_COOLDOWN_MS;
+    this._nowMs = (opts.clock && opts.clock.nowMs) || (() => Date.now());
+    /** @type {Map<string, number>} botId → last dispatch time (ms) */
+    this._last = new Map();
+  }
+
+  /** @returns {boolean} true if the bot is allowed to run for an event now. */
+  shouldDispatch(botId) {
+    const last = this._last.get(botId);
+    if (last === undefined) return true;
+    return this._nowMs() - last >= this._cooldownMs;
+  }
+
+  /** Record that the bot was just event-dispatched (starts its cooldown). */
+  note(botId) {
+    this._last.set(botId, this._nowMs());
+  }
+};
+
+var EventDispatcher_1 = { EventDispatcher: EventDispatcher$1, DEFAULT_COOLDOWN_MS };
+
 /**
  * mcpResult.js
  *
@@ -75557,6 +75906,14 @@ const BotRunner = BotRunner_1;
 const BotScheduler = BotScheduler_1;
 const BudgetController = BudgetControllerExports;
 const PauseController = PauseController_1;
+const { BotMemory } = BotMemory_1;
+const {
+  MEMORY_SERVER,
+  MEMORY_TOOLS,
+  handleMemoryTool,
+} = memoryTools;
+const { matchSubscribedBots } = eventMatcher;
+const { EventDispatcher } = EventDispatcher_1;
 const { normalizeMcpResult } = mcpResult;
 const {
   getProvider: getProvider$1,
@@ -75578,6 +75935,25 @@ function pricingFor(providerId, model) {
   return (m && m.pricing) || null;
 }
 
+/** Build the run prompt for an event-triggered bot (P1: FR-009). */
+function composeEventPrompt(event) {
+  let payload;
+  try {
+    payload =
+      event.content === undefined
+        ? "(no payload)"
+        : JSON.stringify(event.content);
+  } catch (_e) {
+    payload = "(unserializable payload)";
+  }
+  return (
+    `An event you subscribe to just fired.\n\n` +
+    `Event: ${event.eventType}\n` +
+    `Payload: ${payload}\n\n` +
+    `Follow your instructions to handle it.`
+  );
+}
+
 const botController$1 = {
   _ready: false,
 
@@ -75633,10 +76009,20 @@ const botController$1 = {
       getPricing: pricingFor,
     });
 
+    // Scoped, durable bot memory (P1: FR-010), served as in-process memory_*
+    // tools that every bot can use without a consent prompt.
+    this._memory = new BotMemory({ persistence: host.memoryPersistence });
+
+    // Event-bus bridge (P1: FR-009): per-bot cooldown so a chatty event can't
+    // flood the runner with event-triggered runs.
+    this._dispatcher = new EventDispatcher();
+
     this._runner = new BotRunner({
       engines,
       store: this._store,
       approvals: approvalsForRunner,
+      // Memory tools are the bot's own sandbox — auto-allowed at the gate.
+      internalServers: [MEMORY_SERVER],
       resolveRunProfile: (bot) => this._resolveRunProfile(bot),
       resolveTools: (bot) => this._resolveTools(bot),
       callTool: (serverName, toolName, args, o) =>
@@ -75686,6 +76072,30 @@ const botController$1 = {
     }
   },
 
+  /**
+   * Dispatch a fired event to every subscribed bot (P1: FR-009 / US-010).
+   * Called by dash-electron's widget-event relay tap. Guards: never re-trigger
+   * the origin bot (loop safety), skip paused bots and bots in cooldown; a bot
+   * already running is skipped by the runner itself.
+   * @param {{ eventType: string, content?: any, workspaceId?: string,
+   *           originBotId?: string }} event
+   */
+  handleEvent(event) {
+    if (!this._ready || !event || !event.eventType) return;
+    const bots = matchSubscribedBots(this._store.list(), event, {
+      excludeBotId: event.originBotId,
+    });
+    for (const bot of bots) {
+      if (this._pause.isPaused(bot.id)) continue;
+      if (!this._dispatcher.shouldDispatch(bot.id)) continue;
+      this._dispatcher.note(bot.id);
+      this._run(bot.id, {
+        prompt: composeEventPrompt(event),
+        trigger: "event",
+      });
+    }
+  },
+
   // ---- IPC-facing operations ---------------------------------------------
 
   list() {
@@ -75869,10 +76279,24 @@ const botController$1 = {
         toolServer[tool.name] = server.serverName;
       }
     }
+    // Always-available in-process memory tools (P1: FR-010).
+    for (const tool of MEMORY_TOOLS) {
+      tools.push(tool);
+      toolServer[tool.name] = MEMORY_SERVER;
+    }
     return { tools, resolveServer: (toolName) => toolServer[toolName] || null };
   },
 
   async _callTool(serverName, toolName, args, opts = {}) {
+    // In-process memory tools bypass MCP; scoped to the calling bot's workspace.
+    if (serverName === MEMORY_SERVER) {
+      return handleMemoryTool(
+        this._memory,
+        { workspaceId: opts.workspaceId },
+        toolName,
+        args,
+      );
+    }
     const win = this._getMainWindow();
     // widgetId + token are null → the widget permission gate is bypassed; bot
     // tool calls are gated upstream by the bot PermissionGate.