botmux 3.10.0 → 3.23.1

package/dist/services/sandbox-migration.js

@@ -1,85 +0,0 @@
-/**
- * bots.json sandbox-config auto-migration (old fields → fs-policy model).
- *
- * Runs at daemon startup, inside the shared cross-process file lock (multiple
- * per-bot daemons boot concurrently against the same bots.json). Writes the
- * NEW fields while KEEPING the legacy ones on disk — a downgraded daemon reads
- * the untouched legacy fields, so downgrade needs no reverse script (design
- * doc §6.2: upgrade rewrites, downgrade is zero-op). The original file is
- * backed up once to `bots.json.bak-sandbox-v1` before the first rewrite.
- *
- * Idempotent: entries that already carry `sandboxPaths` (or have nothing to
- * migrate) are skipped, so every subsequent boot is a no-op.
- */
-import { promises as fsp, existsSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { homedir } from 'node:os';
-import { withFileLock } from '../utils/file-lock.js';
-import { writeRawConfigAtomic } from './config-store.js';
-import { migrateLegacySandboxFields } from '../adapters/cli/fs-policy.js';
-import { logger } from '../utils/logger.js';
-/** The bots.json path the daemon will load (same resolution as loadBotConfigs). */
-export function resolveBotsConfigPath() {
-    const fromEnv = process.env.BOTS_CONFIG;
-    if (fromEnv) {
-        const p = resolve(fromEnv);
-        return existsSync(p) ? p : null;
-    }
-    const p = resolve(homedir(), '.botmux', 'bots.json');
-    return existsSync(p) ? p : null;
-}
-/**
- * Migrate every entry's legacy sandbox fields in `path`. Returns the appIds
- * that were migrated (empty = file untouched). Never throws on a malformed
- * file — migration must not brick daemon startup; loadBotConfigs surfaces
- * parse errors with better context right after.
- */
-export async function migrateSandboxConfigOnDisk(path) {
-    try {
-        return await withFileLock(path, async () => {
-            let raw;
-            try {
-                raw = JSON.parse(await fsp.readFile(path, 'utf-8'));
-            }
-            catch {
-                return { migrated: [] };
-            }
-            if (!Array.isArray(raw))
-                return { migrated: [] };
-            const migrated = [];
-            for (const entry of raw) {
-                if (!entry || typeof entry !== 'object')
-                    continue;
-                const m = migrateLegacySandboxFields(entry);
-                if (!m)
-                    continue;
-                entry.sandbox = m.sandbox;
-                if (m.sandboxPaths)
-                    entry.sandboxPaths = m.sandboxPaths;
-                migrated.push(typeof entry.larkAppId === 'string' ? entry.larkAppId : '<unknown>');
-            }
-            if (!migrated.length)
-                return { migrated };
-            const bak = `${path}.bak-sandbox-v1`;
-            if (!existsSync(bak)) {
-                await fsp.copyFile(path, bak);
-                await fsp.chmod(bak, 0o600);
-            }
-            await writeRawConfigAtomic(path, raw);
-            logger.info(`[sandbox-migration] migrated legacy sandbox fields for ${migrated.length} bot(s): ${migrated.join(', ')} (backup: ${bak})`);
-            return { migrated };
-        });
-    }
-    catch (err) {
-        logger.warn(`[sandbox-migration] skipped (${err instanceof Error ? err.message : String(err)})`);
-        return { migrated: [] };
-    }
-}
-/** Startup convenience: resolve the config path and migrate if present. */
-export async function migrateSandboxConfigAtStartup() {
-    const path = resolveBotsConfigPath();
-    if (!path)
-        return;
-    await migrateSandboxConfigOnDisk(path);
-}
-//# sourceMappingURL=sandbox-migration.js.map

package/dist/services/sandbox-migration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-migration.js","sourceRoot":"","sources":["../../src/services/sandbox-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,mFAAmF;AACnF,MAAM,UAAU,qBAAqB;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY;IAC3D,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACzC,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBAClD,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,CAAC,CAAC;oBAAE,SAAS;gBACjB,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;gBAC1B,IAAI,CAAC,CAAC,YAAY;oBAAE,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;gBACxD,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,iBAAiB,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC9B,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,MAAM,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,0DAA0D,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;YACzI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjG,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,6BAA6B;IACjD,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC"}

package/dist/services/sandbox-store.d.ts

@@ -1,50 +0,0 @@
-/** Current configured file-sandbox flag for a bot. */
-export declare function getBotSandbox(larkAppId: string): boolean;
-export declare function updateBotSandbox(larkAppId: string, enabled: boolean): Promise<{
-    ok: true;
-    sandbox: boolean;
-} | {
-    ok: false;
-    reason: string;
-}>;
-/** Current configured read-isolation flag for a bot. */
-export declare function getBotReadIsolation(larkAppId: string): boolean;
-/** Per-bot read-isolation toggle (macOS Seatbelt read-deny). Same persistence
- *  contract as {@link updateBotSandbox}: atomic bots.json write + in-memory sync,
- *  so the next session spawn reads `botCfg.readIsolation` without a daemon restart. */
-export declare function updateBotReadIsolation(larkAppId: string, enabled: boolean): Promise<{
-    ok: true;
-    readIsolation: boolean;
-} | {
-    ok: false;
-    reason: string;
-}>;
-/** The three-tier sandbox path lists a bot may declare (highest-precedence
- *  layer of the FsPolicy). Empty/absent tiers fall back to deny-by-default. */
-export interface SandboxPathTiers {
-    readWrite?: string[];
-    readOnly?: string[];
-    deny?: string[];
-}
-/** Current configured sandboxPaths for a bot (undefined = none set). */
-export declare function getBotSandboxPaths(larkAppId: string): SandboxPathTiers | undefined;
-/** Normalize a three-tier sandboxPaths object for storage: per-tier trim/dedup,
- *  then CROSS-TIER dedup resolving a path listed in >1 tier to the MORE
- *  RESTRICTIVE tier (deny > readOnly > readWrite) — matching fs-policy's
- *  mergeFsRules same-source tie-break, so what's stored matches what the sandbox
- *  (and the dashboard UI/tester) resolve. Returns `{}` when every tier is empty
- *  (caller treats that as "clear the field"). Pure — unit-tested directly. */
-export declare function normalizeSandboxPaths(tiers: SandboxPathTiers): SandboxPathTiers;
-/** Per-bot sandboxPaths (readWrite/readOnly/deny) persistence. Same contract as
- *  {@link updateBotSandbox}: atomic bots.json write + in-memory sync, so the next
- *  session spawn reads `botCfg.sandboxPaths` without a daemon restart. Passing an
- *  all-empty tiers object CLEARS the field (bots.json stays clean → pure
- *  deny-by-default baseline). */
-export declare function updateBotSandboxPaths(larkAppId: string, tiers: SandboxPathTiers): Promise<{
-    ok: true;
-    sandboxPaths?: SandboxPathTiers;
-} | {
-    ok: false;
-    reason: string;
-}>;
-//# sourceMappingURL=sandbox-store.d.ts.map

package/dist/services/sandbox-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-store.d.ts","sourceRoot":"","sources":["../../src/services/sandbox-store.ts"],"names":[],"mappings":"AAUA,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAczE;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;uFAEuF;AACvF,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAc/E;AAED;+EAC+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAElF;AAkBD;;;;;8EAK8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAc/E;AAED;;;;iCAIiC;AACjC,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBxF"}

package/dist/services/sandbox-store.js

@@ -1,155 +0,0 @@
-/**
- * Per-bot file-sandbox toggle persistence. Mirrors brand-store: cross-process
- * file lock + atomic bots.json write + in-memory registry sync, so the daemon
- * picks up the change without a restart (the next session spawn reads
- * `botCfg.sandbox` in forkWorker). Pure opt-in; absent = off (legacy behaviour).
- */
-import { rmwBotEntry } from './config-store.js';
-import { getBot } from '../bot-registry.js';
-import { logger } from '../utils/logger.js';
-/** Current configured file-sandbox flag for a bot. */
-export function getBotSandbox(larkAppId) {
-    try {
-        return getBot(larkAppId).config.sandbox === true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function updateBotSandbox(larkAppId, enabled) {
-    let bot;
-    try {
-        bot = getBot(larkAppId);
-    }
-    catch {
-        return { ok: false, reason: 'bot_not_registered' };
-    }
-    const r = await rmwBotEntry(larkAppId, (entry) => {
-        if (enabled)
-            entry.sandbox = true;
-        else
-            delete entry.sandbox; // omit key when off → preserves "absent = off"
-        return { write: true, result: enabled };
-    });
-    if (!r.ok)
-        return { ok: false, reason: r.reason };
-    bot.config.sandbox = enabled;
-    logger.info(`[sandbox:${larkAppId}] sandbox → ${enabled}`);
-    return { ok: true, sandbox: enabled };
-}
-/** Current configured read-isolation flag for a bot. */
-export function getBotReadIsolation(larkAppId) {
-    try {
-        return getBot(larkAppId).config.readIsolation === true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Per-bot read-isolation toggle (macOS Seatbelt read-deny). Same persistence
- *  contract as {@link updateBotSandbox}: atomic bots.json write + in-memory sync,
- *  so the next session spawn reads `botCfg.readIsolation` without a daemon restart. */
-export async function updateBotReadIsolation(larkAppId, enabled) {
-    let bot;
-    try {
-        bot = getBot(larkAppId);
-    }
-    catch {
-        return { ok: false, reason: 'bot_not_registered' };
-    }
-    const r = await rmwBotEntry(larkAppId, (entry) => {
-        if (enabled)
-            entry.readIsolation = true;
-        else
-            delete entry.readIsolation; // omit key when off → preserves "absent = off"
-        return { write: true, result: enabled };
-    });
-    if (!r.ok)
-        return { ok: false, reason: r.reason };
-    bot.config.readIsolation = enabled;
-    logger.info(`[read-isolation:${larkAppId}] readIsolation → ${enabled}`);
-    return { ok: true, readIsolation: enabled };
-}
-/** Current configured sandboxPaths for a bot (undefined = none set). */
-export function getBotSandboxPaths(larkAppId) {
-    try {
-        return getBot(larkAppId).config.sandboxPaths;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Trim + drop empties + dedupe one tier's path list. Returns undefined for an
- *  empty result so an all-empty tiers object collapses to "no sandboxPaths". */
-function normalizeTier(list) {
-    if (!Array.isArray(list))
-        return undefined;
-    const seen = new Set();
-    const out = [];
-    for (const raw of list) {
-        if (typeof raw !== 'string')
-            continue;
-        const p = raw.trim();
-        if (!p || seen.has(p))
-            continue;
-        seen.add(p);
-        out.push(p);
-    }
-    return out.length ? out : undefined;
-}
-/** Normalize a three-tier sandboxPaths object for storage: per-tier trim/dedup,
- *  then CROSS-TIER dedup resolving a path listed in >1 tier to the MORE
- *  RESTRICTIVE tier (deny > readOnly > readWrite) — matching fs-policy's
- *  mergeFsRules same-source tie-break, so what's stored matches what the sandbox
- *  (and the dashboard UI/tester) resolve. Returns `{}` when every tier is empty
- *  (caller treats that as "clear the field"). Pure — unit-tested directly. */
-export function normalizeSandboxPaths(tiers) {
-    const rw = normalizeTier(tiers.readWrite);
-    const ro = normalizeTier(tiers.readOnly);
-    const deny = normalizeTier(tiers.deny);
-    const normPath = (p) => p.replace(/\/+$/, '') || '/';
-    const denySet = new Set((deny ?? []).map(normPath));
-    const roSet = new Set((ro ?? []).map(normPath));
-    const keptRw = (rw ?? []).filter(p => !denySet.has(normPath(p)) && !roSet.has(normPath(p)));
-    const keptRo = (ro ?? []).filter(p => !denySet.has(normPath(p)));
-    const out = {};
-    if (keptRw.length)
-        out.readWrite = keptRw;
-    if (keptRo.length)
-        out.readOnly = keptRo;
-    if (deny)
-        out.deny = deny;
-    return out;
-}
-/** Per-bot sandboxPaths (readWrite/readOnly/deny) persistence. Same contract as
- *  {@link updateBotSandbox}: atomic bots.json write + in-memory sync, so the next
- *  session spawn reads `botCfg.sandboxPaths` without a daemon restart. Passing an
- *  all-empty tiers object CLEARS the field (bots.json stays clean → pure
- *  deny-by-default baseline). */
-export async function updateBotSandboxPaths(larkAppId, tiers) {
-    let bot;
-    try {
-        bot = getBot(larkAppId);
-    }
-    catch {
-        return { ok: false, reason: 'bot_not_registered' };
-    }
-    const normalized = normalizeSandboxPaths(tiers);
-    const isEmpty = !normalized.readWrite && !normalized.readOnly && !normalized.deny;
-    const r = await rmwBotEntry(larkAppId, (entry) => {
-        if (isEmpty)
-            delete entry.sandboxPaths; // clear → preserves deny-by-default baseline
-        else
-            entry.sandboxPaths = normalized;
-        return { write: true, result: isEmpty ? undefined : normalized };
-    });
-    if (!r.ok)
-        return { ok: false, reason: r.reason };
-    if (isEmpty)
-        delete bot.config.sandboxPaths;
-    else
-        bot.config.sandboxPaths = normalized;
-    logger.info(`[sandbox:${larkAppId}] sandboxPaths → rw=${normalized.readWrite?.length ?? 0} ro=${normalized.readOnly?.length ?? 0} deny=${normalized.deny?.length ?? 0}`);
-    return { ok: true, sandboxPaths: isEmpty ? undefined : normalized };
-}
-//# sourceMappingURL=sandbox-store.js.map

package/dist/services/sandbox-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-store.js","sourceRoot":"","sources":["../../src/services/sandbox-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,sDAAsD;AACtD,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,OAAgB;IAEhB,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAAC,CAAC;IAE9F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAU,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,IAAI,OAAO;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;;YAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAE,+CAA+C;QAC3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAElD,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC7B,MAAM,CAAC,IAAI,CAAC,YAAY,SAAS,eAAe,OAAO,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzF,CAAC;AAED;;uFAEuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,OAAgB;IAEhB,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAAC,CAAC;IAE9F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAU,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,IAAI,OAAO;YAAE,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;;YACnC,OAAO,KAAK,CAAC,aAAa,CAAC,CAAE,+CAA+C;QACjF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAElD,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC;IACnC,MAAM,CAAC,IAAI,CAAC,mBAAmB,SAAS,qBAAqB,OAAO,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAUD,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACnF,CAAC;AAED;gFACgF;AAChF,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;;;;8EAK8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAAuB;IAC3D,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IACzC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;iCAIiC;AACjC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,KAAuB;IAEvB,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAAC,CAAC;IAE9F,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;IAElF,MAAM,CAAC,GAAG,MAAM,WAAW,CAA+B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7E,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC,YAAY,CAAC,CAAG,6CAA6C;;YAClF,KAAK,CAAC,YAAY,GAAG,UAAU,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAElD,IAAI,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;;QACvC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,YAAY,SAAS,uBAAuB,UAAU,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACzK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AACtE,CAAC"}

package/dist/services/schedule-split-migration.d.ts

@@ -1,2 +0,0 @@
-export declare function migrateSharedSchedulesAtStartup(knownAppIds: readonly string[], primaryAppId: string): void;
-//# sourceMappingURL=schedule-split-migration.d.ts.map

package/dist/services/schedule-split-migration.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schedule-split-migration.d.ts","sourceRoot":"","sources":["../../src/services/schedule-split-migration.ts"],"names":[],"mappings":"AA2DA,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,YAAY,EAAE,MAAM,GACnB,IAAI,CAiGN"}

package/dist/services/schedule-split-migration.js

@@ -1,159 +0,0 @@
-/**
- * One-time split of the legacy shared `data/schedules.json` into per-bot
- * stores (`<botmuxHome>/bots/<appId>/schedules.json`).
- *
- * Why: the shared file needed a sandbox policy special-case (single-file
- * readWrite grant) that could not cover the RMW sibling lock
- * (`schedules.json.lock`) — a sandboxed `botmux schedule add` failed EPERM —
- * and it exposed every bot's task prompts/routing to every other sandboxed
- * bot. Per-bot stores live inside each bot's BOT_HOME, which the sandbox
- * already grants readWrite to the owner and denies to siblings by
- * construction.
- *
- * Runs at daemon startup, BEFORE the scheduler and the external-write watcher
- * touch the store. Multiple per-bot daemons boot concurrently against the same
- * legacy file: the whole split runs under the legacy file's cross-process lock
- * and re-checks existence inside it, so exactly one daemon performs the split
- * and the rest see the file already gone (renamed to `schedules.json.bak-split-v1`).
- *
- * Routing (per task):
- *   - OWNERLESS (`larkAppId` undefined) → PRIMARY bot's store, kept ownerless.
- *       The scheduler runs ownerless tasks on the primary daemon (bot-0) — the
- *       exact pre-split behaviour. The appId is NOT stamped on. ONLY `undefined`
- *       is ownerless; a falsy non-string is corrupt data (next branch).
- *   - owner present but NOT a string     → fail-safe: abort the split. Covers
- *     (bool/number/null/object, truthy      `true`/`false`/`0`/`null`/objects —
- *      OR falsy)                             none matches a string appId, and a
- *       falsy one would otherwise slip into primary and run under primary's
- *       identity (codex #611 f3+f4). `assertSafeAppId`'s RegExp.test would also
- *       silently coerce a truthy one (`true`→"true"), so guard the TYPE first.
- *   - owner IS in bots.json             → that owner's own BOT_HOME store.
- *   - owner well-formed but NOT in       → that owner's own (dormant) store, NOT
- *     bots.json (removed / config drift)   primary. Folding it into primary would
- *       either strand it (primary's owner filter rejects a foreign appId) or, if
- *       stripped, run it under the wrong bot identity; its own store keeps it
- *       verbatim so it reappears intact if the bot is re-added (codex #611 f1).
- *   - owner is an UNSAFE string appId    → fail-safe: abort the split before any
- *     (cannot be a path segment)           import, leave the legacy file for a
- *       human. Never silently drop the row.
- * Id conflicts with an existing per-bot entry keep the existing entry (the
- * per-bot store is newer by definition) and are logged.
- *
- * Downgrade: the pre-split file survives verbatim as `*.bak-split-v1`; an
- * older build can be restored by renaming it back (documented in the PR).
- * Never throws — a failed/partial migration must not brick daemon startup;
- * the legacy file stays in place and the next boot retries.
- */
-import { existsSync, readFileSync, renameSync } from 'node:fs';
-import { join } from 'node:path';
-import { config } from '../config.js';
-import { logger } from '../utils/logger.js';
-import { withFileLockSync } from '../utils/file-lock.js';
-import { assertSafeAppId } from '../adapters/cli/read-isolation.js';
-import * as scheduleStore from './schedule-store.js';
-function legacyFilePath() {
-    return join(config.session.dataDir, 'schedules.json');
-}
-export function migrateSharedSchedulesAtStartup(knownAppIds, primaryAppId) {
-    const legacyFp = legacyFilePath();
-    if (!existsSync(legacyFp))
-        return; // already split (or fresh install) — no-op
-    try {
-        withFileLockSync(legacyFp, () => {
-            // Another daemon may have completed the split while we waited on the lock.
-            if (!existsSync(legacyFp))
-                return;
-            let raw;
-            try {
-                raw = JSON.parse(readFileSync(legacyFp, 'utf-8'));
-            }
-            catch (err) {
-                // Malformed legacy file: leave it for a human — do NOT rename (that
-                // would silently discard whatever tasks it held) and do not brick boot.
-                logger.error(`[schedule-split] legacy schedules.json unreadable, split skipped: ${err}`);
-                return;
-            }
-            if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
-                logger.error('[schedule-split] legacy schedules.json root is not an object, split skipped');
-                return;
-            }
-            const known = new Set(knownAppIds);
-            const byBot = new Map();
-            for (const [id, task] of Object.entries(raw)) {
-                if (!task || typeof task !== 'object')
-                    continue;
-                let owner;
-                if (task.larkAppId === undefined) {
-                    // Truly OWNERLESS legacy task (field absent) → primary's store, kept
-                    // ownerless. The scheduler runs an ownerless task on the primary daemon
-                    // (bot-0), which is exactly the pre-split behaviour. Do NOT stamp
-                    // primary's appId — that would pin it away from the legacy ownerless
-                    // semantics. ONLY `undefined` counts as ownerless: a falsy non-string
-                    // (`false`/`0`/`null`) is corrupt data, not "no owner", and must not be
-                    // silently absorbed into primary where it would run under primary's
-                    // identity (codex #611 finding 4).
-                    owner = primaryAppId;
-                }
-                else if (typeof task.larkAppId !== 'string') {
-                    // Present but NOT a string (boolean/number/null/object, truthy OR falsy):
-                    // corrupt owner data. It can NEVER match a real bot — the scheduler's
-                    // owner filter compares `task.larkAppId === ownerAppId` against a STRING
-                    // appId — and `assertSafeAppId`'s `RegExp.test` would silently coerce it
-                    // (`true`→"true", `false`→"false") and pass, migrating it into
-                    // `bots/<coerced>/` where no daemon ever runs it, OR (for falsy values)
-                    // slip past a truthiness check into primary and run under the WRONG
-                    // identity (codex #611 findings 3 & 4). Guard the TYPE, then fail-safe:
-                    // abort the whole split with no import performed, leaving legacy intact.
-                    logger.error(`[schedule-split] task ${id} has a non-string larkAppId ` +
-                        `(${task.larkAppId === null ? 'null' : typeof task.larkAppId}); ` +
-                        'split aborted, legacy schedules.json preserved');
-                    return;
-                }
-                else if (known.has(task.larkAppId)) {
-                    // Configured owner → its own BOT_HOME store.
-                    owner = task.larkAppId;
-                }
-                else {
-                    // Well-formed STRING appId that is NOT currently in bots.json (bot
-                    // removed, or config drift): route to ITS OWN store, not primary. Folding
-                    // it into primary either strands it (primary's owner filter rejects a
-                    // foreign appId — codex #611 finding 1) or, if we stripped the appId,
-                    // would run it under the WRONG bot identity. Its own dormant store
-                    // preserves the task verbatim so it reappears intact if the bot is
-                    // re-added later.
-                    //
-                    // An unsafe string appId (path-traversal, or empty string) cannot be a
-                    // path segment (`scheduleFilePathFor` → `assertSafeAppId` throws).
-                    // Fail-safe: abort the whole split with NO import performed yet (imports
-                    // happen after this loop), leaving legacy untouched — never drop the row.
-                    try {
-                        assertSafeAppId(task.larkAppId);
-                    }
-                    catch {
-                        logger.error(`[schedule-split] task ${id} has an unsafe larkAppId ${JSON.stringify(task.larkAppId)}; ` +
-                            'split aborted, legacy schedules.json preserved for manual resolution');
-                        return;
-                    }
-                    owner = task.larkAppId;
-                }
-                let bucket = byBot.get(owner);
-                if (!bucket) {
-                    bucket = [];
-                    byBot.set(owner, bucket);
-                }
-                bucket.push([id, task]);
-            }
-            for (const [appId, entries] of byBot) {
-                scheduleStore.importTasks(appId, entries);
-            }
-            const bak = `${legacyFp}.bak-split-v1`;
-            renameSync(legacyFp, bak);
-            const counts = [...byBot.entries()].map(([a, e]) => `${a}:${e.length}`).join(', ');
-            logger.info(`[schedule-split] split legacy schedules.json into per-bot stores (${counts || 'empty'}); backup: ${bak}`);
-        });
-    }
-    catch (err) {
-        logger.warn(`[schedule-split] skipped (${err instanceof Error ? err.message : String(err)})`);
-    }
-}
-//# sourceMappingURL=schedule-split-migration.js.map

package/dist/services/schedule-split-migration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schedule-split-migration.js","sourceRoot":"","sources":["../../src/services/schedule-split-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AAGrD,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,WAA8B,EAC9B,YAAoB;IAEpB,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,2CAA2C;IAC9E,IAAI,CAAC;QACH,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC9B,2EAA2E;YAC3E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO;YAElC,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,wEAAwE;gBACxE,MAAM,CAAC,KAAK,CAAC,qEAAqE,GAAG,EAAE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;gBAC5F,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;YAChE,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAoC,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,IAAI,KAAa,CAAC;gBAClB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACjC,qEAAqE;oBACrE,wEAAwE;oBACxE,kEAAkE;oBAClE,qEAAqE;oBACrE,sEAAsE;oBACtE,wEAAwE;oBACxE,oEAAoE;oBACpE,mCAAmC;oBACnC,KAAK,GAAG,YAAY,CAAC;gBACvB,CAAC;qBAAM,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC9C,0EAA0E;oBAC1E,sEAAsE;oBACtE,yEAAyE;oBACzE,yEAAyE;oBACzE,+DAA+D;oBAC/D,wEAAwE;oBACxE,oEAAoE;oBACpE,wEAAwE;oBACxE,yEAAyE;oBACzE,MAAM,CAAC,KAAK,CACV,yBAAyB,EAAE,8BAA8B;wBACzD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK;wBACjE,gDAAgD,CACjD,CAAC;oBACF,OAAO;gBACT,CAAC;qBAAM,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrC,6CAA6C;oBAC7C,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,0EAA0E;oBAC1E,sEAAsE;oBACtE,sEAAsE;oBACtE,mEAAmE;oBACnE,mEAAmE;oBACnE,kBAAkB;oBAClB,EAAE;oBACF,uEAAuE;oBACvE,mEAAmE;oBACnE,yEAAyE;oBACzE,0EAA0E;oBAC1E,IAAI,CAAC;wBACH,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAClC,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,KAAK,CACV,yBAAyB,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI;4BACzF,sEAAsE,CACvE,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;gBACzB,CAAC;gBACD,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBAAC,MAAM,GAAG,EAAE,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAAC,CAAC;gBACvD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1B,CAAC;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;gBACrC,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,QAAQ,eAAe,CAAC;YACvC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,qEAAqE,MAAM,IAAI,OAAO,cAAc,GAAG,EAAE,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChG,CAAC;AACH,CAAC"}

package/dist/services/schedule-store.d.ts

@@ -1,138 +0,0 @@
-import type { ScheduledTask, ParsedSchedule, ScheduleExecutionPosition } from '../types.js';
-/**
- * Raised by `createTask` when an `id` is supplied but a task already exists
- * with that id AND its canonical input differs from the incoming params.
- *
- * Workflow runtime uses this to detect "same attempt asked to create a
- * different schedule" — a sign the attempt is being mutated (forbidden by
- * attempt-immutability rule, events doc §4.2).
- */
-export declare class IdempotencyConflictError extends Error {
-    readonly taskId: string;
-    readonly existingInputHash: string;
-    readonly incomingInputHash: string;
-    constructor(detail: {
-        taskId: string;
-        existingInputHash: string;
-        incomingInputHash: string;
-    });
-}
-/**
- * Canonical schedule input used for create-or-return-identical comparison.
- *
- * Includes only the fields that callers control as task **input** (events
- * doc v0.1.2 §3.5 ScheduleCanonicalInput).  Excludes:
- *   - `creator*` (audit metadata, not input)
- *   - `enabled`, `nextRunAt`, `lastRunAt`, `lastStatus`, `lastError`,
- *     `lastDeliveryError` (runtime state, mutates over task lifetime)
- *   - `createdAt` (metadata)
- *   - `repeat.completed` (counter, mutates per run)
- *   - `parsed.display` (UI-facing string, redundant given `expr`/`runAt`)
- *
- * Codex round 4 finding 4: `parsed` is NOT purely derived for one-shot or
- * relative schedules.  `30m`/`2h`/`明天9:00`/`5分钟后` etc compute a
- * concrete `runAt` at parse time using "now"; if a workflow retry re-
- * parses the same raw `schedule`, it gets a different `runAt`.  So the
- * canonical input freezes the resolved schedule shape (`parsed.kind` and
- * whichever of `parsed.runAt`/`parsed.minutes`/`parsed.expr` applies).
- */
-export declare function canonicalScheduleInput(t: {
-    name: string;
-    schedule: string;
-    parsed?: ParsedSchedule;
-    prompt: string;
-    workingDir: string;
-    chatId: string;
-    chatType?: 'group' | 'p2p' | 'topic_group';
-    rootMessageId?: string;
-    scope?: 'thread' | 'chat';
-    executionPosition?: ScheduleExecutionPosition;
-    topicTitle?: string;
-    larkAppId?: string;
-    repeat?: {
-        times: number | null;
-        completed?: number;
-    };
-    deliver?: 'origin' | 'local' | 'new-topic';
-    silent?: boolean;
-}): unknown;
-/** Bind the store's default file to one bot. Daemon: own bot at startup.
- *  CLI: the session's bot / explicit --lark-app-id before any store call. */
-export declare function setScheduleScope(appId: string): void;
-export declare function getScheduleScope(): string | null;
-/** The per-bot schedules file: `<botmuxHome>/bots/<appId>/schedules.json`. */
-export declare function scheduleFilePathFor(appId: string): string;
-export declare function getTaskOutputDir(taskId: string): string;
-export declare function __setScheduleStoreBeforeRenameTestHook(hook?: () => void): void;
-/**
- * Create a scheduled task — or return the existing one with the same input
- * when called with a workflow-supplied `id` that already exists.
- *
- * Behaviour matrix (events doc v0.1.2 §2.2 Option A):
- *
- *   | scenario                                   | result                       |
- *   |--------------------------------------------|------------------------------|
- *   | no `id`                                    | randomUUID(8) — legacy path  |
- *   | `id` not in store                          | create with the given id     |
- *   | `id` in store + canonical input matches    | return existing (no mutation)|
- *   | `id` in store + canonical input differs    | IdempotencyConflictError     |
- *
- * Use `wf_<hash...>` prefixed ids when called from workflow runtime to
- * avoid collisions with the 8-char randomUUID legacy namespace.
- */
-export declare function createTask(params: {
-    id?: string;
-    name: string;
-    schedule: string;
-    parsed: ParsedSchedule;
-    prompt: string;
-    workingDir: string;
-    chatId: string;
-    rootMessageId?: string;
-    scope?: 'thread' | 'chat';
-    executionPosition?: ScheduleExecutionPosition;
-    topicTitle?: string;
-    chatType?: 'group' | 'p2p' | 'topic_group';
-    larkAppId?: string;
-    creatorChatId?: string;
-    creatorRootMessageId?: string;
-    creatorLarkAppId?: string;
-    nextRunAt?: string;
-    repeat?: {
-        times: number | null;
-        completed: number;
-    };
-    deliver?: 'origin' | 'local' | 'new-topic';
-    silent?: boolean;
-}): ScheduledTask;
-export declare function getTask(id: string, appId?: string): ScheduledTask | undefined;
-export declare function removeTask(id: string, appId?: string): boolean;
-export declare function updateTask(id: string, updates: Partial<Pick<ScheduledTask, 'enabled' | 'lastRunAt' | 'nextRunAt' | 'lastStatus' | 'lastError' | 'lastDeliveryError' | 'repeat' | 'rootMessageId' | 'scope' | 'executionPosition' | 'topicTitle' | 'chatType' | 'deliver' | 'name' | 'prompt' | 'schedule' | 'parsed' | 'silent' | 'workingDir'>>, appId?: string): void;
-/**
- * Record a run outcome and auto-manage repeat counter.  If the task has a
- * finite repeat count and we've hit it, the task is removed.
- */
-export declare function markRun(id: string, success: boolean, error?: string, deliveryError?: string): void;
-export declare function listTasks(appId?: string): ScheduledTask[];
-/** Aggregate view across several bots' stores (unsandboxed admin CLI). Bots
- *  whose store cannot be read (sandbox deny / missing BOT_HOME) are skipped —
- *  callers inside a sandbox naturally collapse to their own bot. */
-export declare function listTasksForBots(appIds: readonly string[]): Array<ScheduledTask & {
-    _storeAppId: string;
-}>;
-/** Bulk-insert raw task entries into one bot's store (startup split
- *  migration). Runs the same in-file legacy normalization as a disk read;
- *  an id already present in the destination wins (the per-bot store is newer
- *  by definition) and the collision is logged. */
-export declare function importTasks(appId: string, entries: ReadonlyArray<[string, unknown]>): void;
-/** Locate a task id across several bots' stores. First hit wins (ids are
- *  UUID-derived; a cross-store collision is negligible and would only make an
- *  id-addressed command pick the first store). */
-export declare function findTaskAcrossBots(id: string, appIds: readonly string[]): {
-    task: ScheduledTask;
-    appId: string;
-} | undefined;
-/** Ensure per-task output dir exists and return path to today's run log. */
-export declare function appendOutputLog(taskId: string, content: string): string;
-export declare function startExternalWriteWatcher(): void;
-//# sourceMappingURL=schedule-store.d.ts.map

package/dist/services/schedule-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schedule-store.d.ts","sourceRoot":"","sources":["../../src/services/schedule-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAI5F;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;gBACvB,MAAM,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;CAUF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,aAAa,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAkCV;AA2BD;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAWD,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAmBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAuHD,wBAAgB,sCAAsC,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI,CAK9E;AAyHD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,aAAa,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,aAAa,CA6DhB;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAG7E;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAO9D;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EACjC,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,mBAAmB,GAAG,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,mBAAmB,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CACpQ,CAAC,EACF,KAAK,CAAC,EAAE,MAAM,GACb,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CA+BlG;AAED,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CAGzD;AAED;;oEAEoE;AACpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1G;AAED;;;kDAGkD;AAClD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAgB1F;AAED;;kDAEkD;AAClD,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQpD;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAOvE;AAcD,wBAAgB,yBAAyB,IAAI,IAAI,CAwDhD"}