cool-workflow 0.1.78

package/dist/orchestrator/audit-operations.js

@@ -0,0 +1,182 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditSummary = auditSummary;
+exports.auditMultiAgent = auditMultiAgent;
+exports.auditPolicy = auditPolicy;
+exports.auditRole = auditRole;
+exports.auditBlackboard = auditBlackboard;
+exports.auditJudge = auditJudge;
+exports.workerAudit = workerAudit;
+exports.auditEvidenceProvenance = auditEvidenceProvenance;
+exports.recordAuditAttestation = recordAuditAttestation;
+exports.recordAuditDecision = recordAuditDecision;
+// Audit domain operations (v0.1.40 self-audit P3 maintainability).
+//
+// Carved out of the CoolWorkflowRunner god-object as the first domain in the
+// router pattern: every function here takes an already-loaded WorkflowRun and
+// returns a value (mutating ops persist via the run), so the runner method is a
+// thin `loadRun -> delegate` wrapper. Behavior is identical to the inline
+// implementations these replaced; only the location changed.
+const node_path_1 = __importDefault(require("node:path"));
+const state_1 = require("../state");
+const report_1 = require("./report");
+const cli_options_1 = require("./cli-options");
+const worker_isolation_1 = require("../worker-isolation");
+const sandbox_profile_1 = require("../sandbox-profile");
+const trust_audit_1 = require("../trust-audit");
+const multi_agent_trust_1 = require("../multi-agent-trust");
+function auditSummary(run) {
+    return (0, trust_audit_1.summarizeTrustAudit)(run);
+}
+function auditMultiAgent(run) {
+    return (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
+}
+function auditPolicy(run) {
+    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
+    return {
+        schemaVersion: 1,
+        runId: run.id,
+        rolePolicies: summary.rolePolicies,
+        permissionDecisions: summary.permissionDecisions,
+        policyViolations: summary.policyViolations,
+        nextAction: summary.nextAction
+    };
+}
+function auditRole(run, roleId) {
+    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
+    const events = (0, trust_audit_1.listTrustAuditEvents)(run).filter((event) => event.agentRoleId === roleId);
+    return {
+        schemaVersion: 1,
+        runId: run.id,
+        roleId,
+        role: run.multiAgent?.roles.find((entry) => entry.id === roleId),
+        rolePolicies: summary.rolePolicies.filter((entry) => entry.subjectId === roleId),
+        permissionDecisions: events.filter((event) => event.kind === "multi-agent.permission"),
+        blackboardWrites: events.filter((event) => event.kind === "blackboard.write"),
+        messageProvenance: events.filter((event) => event.kind === "blackboard.message-provenance"),
+        judgeRationales: events.filter((event) => event.kind === "judge.rationale"),
+        panelDecisions: events.filter((event) => event.kind === "judge.panel-decision"),
+        policyViolations: events.filter((event) => event.kind === "policy.violation"),
+        events,
+        nextAction: `node scripts/cw.js audit multi-agent ${run.id} --json`
+    };
+}
+function auditBlackboard(run) {
+    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
+    return {
+        schemaVersion: 1,
+        runId: run.id,
+        blackboardWrites: summary.blackboardWrites,
+        messageProvenance: summary.messageProvenance,
+        policyViolations: summary.policyViolations.filter((event) => event.blackboardId),
+        nextAction: summary.nextAction
+    };
+}
+function auditJudge(run) {
+    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
+    return {
+        schemaVersion: 1,
+        runId: run.id,
+        judgeRationales: summary.judgeRationales,
+        panelDecisions: summary.panelDecisions,
+        permissionDecisions: summary.permissionDecisions.filter((event) => String(event.metadata?.operation || "").startsWith("judge.")),
+        policyViolations: summary.policyViolations.filter((event) => String(event.metadata?.operation || "").startsWith("judge.")),
+        nextAction: summary.nextAction
+    };
+}
+function workerAudit(run, workerId) {
+    return (0, trust_audit_1.workerTrustAudit)(run, workerId);
+}
+function auditEvidenceProvenance(run, options = {}) {
+    return (0, trust_audit_1.evidenceProvenance)(run, {
+        workerId: (0, cli_options_1.stringOption)(options.worker || options.workerId),
+        candidateId: (0, cli_options_1.stringOption)(options.candidate || options.candidateId),
+        commitId: (0, cli_options_1.stringOption)(options.commit || options.commitId)
+    });
+}
+function recordAuditAttestation(run, options = {}) {
+    const workerId = (0, cli_options_1.stringOption)(options.worker || options.workerId);
+    const worker = workerId ? (0, worker_isolation_1.getWorkerScope)(run, workerId) : undefined;
+    const event = (0, trust_audit_1.recordHostAttestation)(run, {
+        actor: (0, cli_options_1.stringOption)(options.actor) || "host",
+        workerId,
+        taskId: worker?.taskId || (0, cli_options_1.stringOption)(options.task || options.taskId),
+        sandboxProfileId: worker?.sandboxProfileId || (0, cli_options_1.stringOption)(options.sandboxProfileId),
+        policySnapshot: worker?.sandboxPolicy,
+        command: (0, cli_options_1.stringOption)(options.command),
+        networkTarget: (0, cli_options_1.stringOption)(options.network || options.networkTarget),
+        envVars: (0, cli_options_1.valuesOption)(options.env || options.envVar || options.envVars),
+        metadata: {
+            note: (0, cli_options_1.stringOption)(options.note || options.message),
+            hostEnforced: options.hostEnforced === undefined ? undefined : Boolean(options.hostEnforced)
+        }
+    });
+    (0, state_1.saveCheckpoint)(run);
+    return event;
+}
+function recordAuditDecision(run, workerId, options = {}) {
+    const worker = (0, worker_isolation_1.getWorkerScope)(run, workerId);
+    if (!worker)
+        throw new Error(`Unknown worker id for run ${run.id}: ${workerId}`);
+    const kind = (0, cli_options_1.stringOption)(options.kind) || (0, cli_options_1.inferAuditDecisionKind)(options);
+    const target = (0, cli_options_1.stringOption)(options.path || options.command || options.network || options.networkTarget || options.env || options.envVar);
+    if (!target)
+        throw new Error("Missing audit decision target: provide --path, --command, --network, or --env");
+    const policy = worker.sandboxPolicy;
+    let denied = null;
+    if (kind === "sandbox.command") {
+        denied = policy ? (0, sandbox_profile_1.validateSandboxCommand)(policy, target, workerId) : null;
+    }
+    else if (kind === "sandbox.network") {
+        denied = policy ? (0, sandbox_profile_1.validateSandboxNetwork)(policy, target, workerId) : null;
+    }
+    else if (kind === "sandbox.env") {
+        const name = target.includes("=") ? target.split("=")[0] : target;
+        const allowed = Boolean(policy?.env.inherit || policy?.env.expose.includes(name));
+        denied = allowed ? null : { code: "sandbox-env-denied", message: `Worker ${workerId} env var is outside sandbox profile ${policy?.id || "unknown"}: ${name}` };
+    }
+    else {
+        denied = (0, worker_isolation_1.validateWorkerBoundary)(run, workerId, { path: target });
+    }
+    const feedbackIds = [];
+    if (denied) {
+        const failure = (0, worker_isolation_1.recordWorkerFailure)(run, workerId, {
+            code: denied.code,
+            message: denied.message,
+            at: new Date().toISOString(),
+            path: denied.path || (kind === "sandbox.path" ? node_path_1.default.resolve(target) : undefined),
+            retryable: false
+        }, { persist: false });
+        feedbackIds.push(...(failure.feedbackIds || []));
+    }
+    const event = kind === "sandbox.path"
+        ? (0, trust_audit_1.recordSandboxPathDecision)(run, {
+            workerId,
+            taskId: worker.taskId,
+            sandboxProfileId: worker.sandboxProfileId,
+            policySnapshot: policy,
+            target,
+            decision: denied ? "denied" : "allowed",
+            feedbackIds,
+            metadata: { code: denied?.code }
+        })
+        : (0, trust_audit_1.recordSandboxPolicyDecision)(run, {
+            kind,
+            decision: denied ? "denied" : "allowed",
+            workerId,
+            taskId: worker.taskId,
+            sandboxProfileId: worker.sandboxProfileId,
+            policySnapshot: policy,
+            command: kind === "sandbox.command" ? target : undefined,
+            networkTarget: kind === "sandbox.network" ? target : undefined,
+            envVars: kind === "sandbox.env" ? [target.includes("=") ? target.split("=")[0] : target] : undefined,
+            feedbackIds,
+            metadata: { code: denied?.code }
+        });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return event;
+}

package/dist/orchestrator/candidate-operations.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listCandidates = listCandidates;
+exports.showCandidate = showCandidate;
+exports.registerCandidate = registerCandidate;
+exports.scoreCandidate = scoreCandidate;
+exports.rankCandidates = rankCandidates;
+exports.selectCandidate = selectCandidate;
+exports.rejectCandidate = rejectCandidate;
+// Candidate domain operations (v0.1.40 self-audit P3 router pattern).
+// Carved out of CoolWorkflowRunner; each function takes a loaded run. Behavior is
+// identical to the inline implementations — only the location changed.
+const node_path_1 = __importDefault(require("node:path"));
+const state_1 = require("../state");
+const report_1 = require("./report");
+const cli_options_1 = require("./cli-options");
+const worker_isolation_1 = require("../worker-isolation");
+const candidate_scoring_1 = require("../candidate-scoring");
+function listCandidates(run, options = {}) {
+    return (0, candidate_scoring_1.listCandidates)(run, {
+        status: options.status ? String(options.status) : undefined,
+        kind: options.kind ? String(options.kind) : undefined
+    });
+}
+function showCandidate(run, candidateId) {
+    const candidate = (0, candidate_scoring_1.getCandidate)(run, candidateId);
+    if (!candidate)
+        throw new Error(`Unknown candidate id for run ${run.id}: ${candidateId}`);
+    return candidate;
+}
+function registerCandidate(run, options = {}) {
+    const workerId = options.worker ? String(options.worker) : undefined;
+    const worker = workerId ? (0, worker_isolation_1.getWorkerScope)(run, workerId) : undefined;
+    if (workerId && !worker)
+        throw new Error(`Unknown worker id for run ${run.id}: ${workerId}`);
+    const task = worker ? run.tasks.find((candidate) => candidate.id === worker.taskId) : undefined;
+    const resultNodeId = (0, cli_options_1.stringOption)(options.resultNode) || worker?.resultNodeId || task?.resultNodeId;
+    const verifierNodeId = (0, cli_options_1.stringOption)(options.verifierNode) || worker?.output?.verifierNodeId || task?.verifierNodeId;
+    const resultPath = (0, cli_options_1.stringOption)(options.resultPath) || worker?.output?.resultPath || task?.resultPath;
+    const resultNode = resultNodeId ? run.nodes?.find((node) => node.id === resultNodeId) : undefined;
+    const verifierNode = verifierNodeId ? run.nodes?.find((node) => node.id === verifierNodeId) : undefined;
+    const candidate = (0, candidate_scoring_1.registerCandidate)(run, {
+        id: (0, cli_options_1.stringOption)(options.id),
+        kind: (0, cli_options_1.stringOption)(options.kind),
+        workerId,
+        taskId: (0, cli_options_1.stringOption)(options.task) || worker?.taskId,
+        resultNodeId,
+        verifierNodeId,
+        resultPath,
+        artifacts: [
+            ...(resultPath ? [{ id: "result", kind: "markdown", path: node_path_1.default.resolve(resultPath) }] : []),
+            ...(worker ? [{ id: "worker", kind: "json", path: node_path_1.default.join(worker.workerDir, "worker.json") }] : [])
+        ],
+        evidence: (0, cli_options_1.mergeEvidence)(resultNode?.evidence || [], verifierNode?.evidence || []),
+        metadata: {
+            source: worker ? "worker" : "manual",
+            workerDir: worker?.workerDir
+        }
+    }, { persist: false });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return candidate;
+}
+function scoreCandidate(run, candidateId, options = {}) {
+    const score = (0, candidate_scoring_1.scoreCandidate)(run, candidateId, {
+        id: (0, cli_options_1.stringOption)(options.id),
+        scorer: (0, cli_options_1.stringOption)(options.scorer),
+        criteria: (0, cli_options_1.parseCriteria)(options),
+        maxTotal: (0, cli_options_1.numberOption)(options.maxTotal || options.max),
+        verdict: (0, cli_options_1.stringOption)(options.verdict),
+        evidence: (0, cli_options_1.parseEvidence)(options.evidence),
+        notes: (0, cli_options_1.stringOption)(options.notes)
+    }, { persist: false });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return score;
+}
+function rankCandidates(run, options = {}) {
+    const ranking = (0, candidate_scoring_1.rankCandidates)(run, {
+        includeRejected: Boolean(options.includeRejected),
+        policy: {
+            minNormalized: (0, cli_options_1.numberOption)(options.minNormalized),
+            requireEvidence: options.requireEvidence === undefined ? undefined : Boolean(options.requireEvidence),
+            requireVerifierGate: options.requireVerifierGate === undefined ? undefined : Boolean(options.requireVerifierGate),
+            tieBreaker: (0, cli_options_1.stringOption)(options.tieBreaker)
+        }
+    });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return ranking;
+}
+function selectCandidate(run, candidateId, options = {}) {
+    const selection = (0, candidate_scoring_1.selectCandidate)(run, candidateId, {
+        selectedBy: (0, cli_options_1.stringOption)(options.by) || (0, cli_options_1.stringOption)(options.selectedBy),
+        reason: (0, cli_options_1.stringOption)(options.reason),
+        scoreId: (0, cli_options_1.stringOption)(options.score),
+        allowUnverified: Boolean(options.allowUnverified)
+    }, {
+        persist: false,
+        policy: {
+            minNormalized: (0, cli_options_1.numberOption)(options.minNormalized),
+            requireVerifierGate: options.requireVerifierGate === undefined ? undefined : Boolean(options.requireVerifierGate)
+        }
+    });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return selection;
+}
+function rejectCandidate(run, candidateId, reason) {
+    const candidate = (0, candidate_scoring_1.rejectCandidate)(run, candidateId, reason, { persist: false });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return candidate;
+}

package/dist/orchestrator/cli-options.js

@@ -0,0 +1,288 @@
+"use strict";
+// CLI option parsing & coercion utilities — extracted from orchestrator.ts.
+//
+// Pure functions that turn the raw parsed-argv option bag into typed values
+// (strings, numbers, arrays, actors, blackboard scopes, sandbox choices, …).
+// No run state, no I/O. The orchestrator imports the subset it uses.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COLLABORATION_TARGET_KINDS = void 0;
+exports.isMissing = isMissing;
+exports.numberOption = numberOption;
+exports.stringOption = stringOption;
+exports.requiredStringOption = requiredStringOption;
+exports.collaborationTarget = collaborationTarget;
+exports.collaborationTargetMaybe = collaborationTargetMaybe;
+exports.actorInputFrom = actorInputFrom;
+exports.firstDefined = firstDefined;
+exports.graphViewOption = graphViewOption;
+exports.graphViewsOption = graphViewsOption;
+exports.metadataOption = metadataOption;
+exports.withoutHostRunKeys = withoutHostRunKeys;
+exports.optionsRecord = optionsRecord;
+exports.parseBlackboardAuthor = parseBlackboardAuthor;
+exports.parseBlackboardScope = parseBlackboardScope;
+exports.parseBlackboardLinks = parseBlackboardLinks;
+exports.parseSandboxChoices = parseSandboxChoices;
+exports.parseCriteria = parseCriteria;
+exports.parseEvidence = parseEvidence;
+exports.mergeEvidence = mergeEvidence;
+exports.arrayOption = arrayOption;
+exports.valuesOption = valuesOption;
+exports.inferAuditDecisionKind = inferAuditDecisionKind;
+exports.isSandboxProfileError = isSandboxProfileError;
+exports.validationIssuesFromError = validationIssuesFromError;
+const sandbox_profile_1 = require("../sandbox-profile");
+const state_explosion_1 = require("../state-explosion");
+const workflow_app_framework_1 = require("../workflow-app-framework");
+function isMissing(value) {
+    return value === undefined || value === null || value === "";
+}
+function numberOption(value) {
+    if (value === undefined || value === null || value === true)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function stringOption(value) {
+    if (value === undefined || value === null || value === true)
+        return undefined;
+    return String(value);
+}
+function requiredStringOption(value, label) {
+    const parsed = stringOption(value);
+    if (!parsed)
+        throw new Error(`Missing ${label}`);
+    return parsed;
+}
+exports.COLLABORATION_TARGET_KINDS = ["run", "task", "candidate", "selection", "commit", "node"];
+function collaborationTarget(kind, id) {
+    const normalizedKind = stringOption(kind);
+    const normalizedId = stringOption(id);
+    if (!normalizedKind || !exports.COLLABORATION_TARGET_KINDS.includes(normalizedKind)) {
+        throw new Error(`Target kind must be one of ${exports.COLLABORATION_TARGET_KINDS.join("|")}`);
+    }
+    if (!normalizedId)
+        throw new Error("Missing target id");
+    return { kind: normalizedKind, id: normalizedId };
+}
+function collaborationTargetMaybe(kind, id) {
+    if (!kind && !id)
+        return undefined;
+    return collaborationTarget(String(kind || ""), String(id || ""));
+}
+function actorInputFrom(options) {
+    return {
+        actor: stringOption(firstDefined(options, "actor", "by")),
+        actorKind: stringOption(firstDefined(options, "actorKind", "actor-kind", "kind")),
+        role: stringOption(firstDefined(options, "role", "roleId", "role-id")),
+        displayName: stringOption(firstDefined(options, "displayName", "display-name", "name")),
+        attested: Boolean(options.attested),
+        attestation: stringOption(options.attestation)
+    };
+}
+/** First option value present under any of the given keys (camelCase or dashed). */
+function firstDefined(options, ...keys) {
+    for (const key of keys) {
+        if (options[key] !== undefined)
+            return options[key];
+    }
+    return undefined;
+}
+function graphViewOption(value) {
+    const parsed = stringOption(value);
+    if (!parsed)
+        return "compact";
+    if (!state_explosion_1.GRAPH_VIEWS.includes(parsed)) {
+        throw new Error(`Unknown graph view: ${parsed}. Valid views: ${state_explosion_1.GRAPH_VIEWS.join(", ")}`);
+    }
+    return parsed;
+}
+function graphViewsOption(options) {
+    const raw = arrayOption(options.view || options.views).map(String);
+    if (!raw.length)
+        return undefined;
+    for (const view of raw) {
+        if (!state_explosion_1.GRAPH_VIEWS.includes(view)) {
+            throw new Error(`Unknown graph view: ${view}. Valid views: ${state_explosion_1.GRAPH_VIEWS.join(", ")}`);
+        }
+    }
+    return raw;
+}
+function metadataOption(options) {
+    const raw = options.metadata;
+    if (raw && typeof raw === "object" && !Array.isArray(raw))
+        return raw;
+    if (typeof raw === "string")
+        return JSON.parse(raw);
+    return undefined;
+}
+function withoutHostRunKeys(args) {
+    const copy = { ...args };
+    for (const key of [
+        "app",
+        "appId",
+        "workflow",
+        "workflowId",
+        "inputs",
+        "topology",
+        "topologyId",
+        "topologyRun",
+        "topologyRunId",
+        "multiAgentRun",
+        "multiAgentRunId",
+        "blackboard",
+        "blackboardId",
+        "mapperCount",
+        "mappers",
+        "mapper",
+        "judgeCount",
+        "judges",
+        "judge",
+        "debateRounds",
+        "rounds",
+        "collectInitialFanin",
+        "collect-initial-fanin"
+    ]) {
+        delete copy[key];
+    }
+    return { ...copy, ...(optionsRecord(args.inputs) || {}) };
+}
+function optionsRecord(value) {
+    if (value && typeof value === "object" && !Array.isArray(value))
+        return value;
+    return undefined;
+}
+function parseBlackboardAuthor(options) {
+    const structured = options.author;
+    if (structured && typeof structured === "object" && !Array.isArray(structured))
+        return structured;
+    const id = stringOption(options.authorId || options.author || options.worker || options.workerId || options.role || options.roleId || options.group || options.groupId);
+    const kind = stringOption(options.authorKind || options.sourceKind || options.source);
+    const displayName = stringOption(options.authorName || options.displayName);
+    if (!id && !kind && !displayName)
+        return undefined;
+    return { kind: kind, id, displayName };
+}
+function parseBlackboardScope(options) {
+    const structured = options.scope;
+    if (structured && typeof structured === "object" && !Array.isArray(structured))
+        return structured;
+    const kind = stringOption(options.scopeKind);
+    const id = stringOption(options.scopeId);
+    if (!kind && !id)
+        return undefined;
+    return { kind: kind, id };
+}
+function parseBlackboardLinks(runId, options) {
+    const structured = options.provenance || options.links;
+    if (structured && typeof structured === "object" && !Array.isArray(structured))
+        return structured;
+    const links = {
+        workflowRunId: runId,
+        multiAgentRunId: stringOption(options.multiAgentRun || options.multiAgentRunId || options["multi-agent-run"]),
+        agentGroupId: stringOption(options.group || options.groupId || options["multi-agent-group"]),
+        agentRoleId: stringOption(options.role || options.roleId || options["multi-agent-role"]),
+        agentMembershipId: stringOption(options.membership || options.membershipId || options["multi-agent-membership"]),
+        agentFanoutId: stringOption(options.fanout || options.fanoutId || options["multi-agent-fanout"]),
+        agentFaninId: stringOption(options.fanin || options.faninId || options["multi-agent-fanin"]),
+        taskId: stringOption(options.task || options.taskId),
+        workerId: stringOption(options.worker || options.workerId),
+        candidateId: stringOption(options.candidate || options.candidateId),
+        verifierNodeId: stringOption(options.verifier || options.verifierNode || options.verifierNodeId),
+        commitId: stringOption(options.commit || options.commitId),
+        auditEventIds: arrayOption(options.audit || options.auditEvent || options.auditEventId || options["audit-event"]).map(String),
+        evidenceRefs: arrayOption(options.evidence || options.evidenceRef || options["evidence-ref"]).map(String)
+    };
+    const entries = Object.entries(links).filter(([, value]) => value !== undefined && (!Array.isArray(value) || value.length));
+    return entries.length > 1 ? Object.fromEntries(entries) : undefined;
+}
+function parseSandboxChoices(options) {
+    const choices = {};
+    const structured = options.sandboxChoices || options.sandboxProfileChoices;
+    if (structured && typeof structured === "object" && !Array.isArray(structured)) {
+        for (const [key, value] of Object.entries(structured))
+            choices[key] = String(value);
+    }
+    for (const entry of arrayOption(options.sandboxChoice || options["sandbox-choice"])) {
+        const [key, ...rest] = String(entry).split("=");
+        if (key && rest.length)
+            choices[key] = rest.join("=");
+    }
+    const sandbox = stringOption(options.sandbox || options.sandboxProfile || options.sandboxProfileId);
+    if (sandbox && !Object.keys(choices).length)
+        choices.default = sandbox;
+    return Object.keys(choices).length ? choices : undefined;
+}
+function parseCriteria(options) {
+    const criteria = {};
+    const structured = options.criteria;
+    if (structured && typeof structured === "object" && !Array.isArray(structured)) {
+        for (const [key, value] of Object.entries(structured)) {
+            const parsed = Number(value);
+            if (key && Number.isFinite(parsed))
+                criteria[key] = parsed;
+        }
+    }
+    const rawCriteria = options.criterion || (typeof structured === "object" && !Array.isArray(structured) ? undefined : structured) || options.score;
+    for (const entry of arrayOption(rawCriteria)) {
+        const [key, value] = String(entry).split("=");
+        if (!key || value === undefined)
+            continue;
+        criteria[key] = Number(value);
+    }
+    if (!Object.keys(criteria).length && options.total !== undefined) {
+        criteria.total = Number(options.total);
+    }
+    if (!Object.keys(criteria).length)
+        throw new Error("Missing score criteria. Use --criterion name=value");
+    return criteria;
+}
+function parseEvidence(value) {
+    return arrayOption(value).map((entry, index) => ({
+        id: `score:${index + 1}`,
+        source: "candidate-score",
+        locator: String(entry),
+        summary: String(entry)
+    }));
+}
+function mergeEvidence(left, right) {
+    const merged = [...left];
+    for (const item of right) {
+        const index = merged.findIndex((entry) => entry.id === item.id);
+        if (index >= 0)
+            merged[index] = item;
+        else
+            merged.push(item);
+    }
+    return merged;
+}
+function arrayOption(value) {
+    if (value === undefined || value === null || value === true)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+function valuesOption(value) {
+    return arrayOption(value).map((entry) => String(entry).split("=")[0]).filter(Boolean);
+}
+function inferAuditDecisionKind(options) {
+    if (options.command)
+        return "sandbox.command";
+    if (options.network || options.networkTarget)
+        return "sandbox.network";
+    if (options.env || options.envVar)
+        return "sandbox.env";
+    return "sandbox.path";
+}
+function isSandboxProfileError(error) {
+    return error instanceof sandbox_profile_1.SandboxProfileError || Boolean(error && typeof error === "object" && "code" in error && String(error.code).startsWith("sandbox-"));
+}
+function validationIssuesFromError(error) {
+    if (error instanceof workflow_app_framework_1.WorkflowAppValidationError)
+        return error.issues;
+    return [
+        {
+            code: "workflow-app-invalid",
+            message: error instanceof Error ? error.message : String(error)
+        }
+    ];
+}

package/dist/orchestrator/collaboration-operations.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collaborationApprove = collaborationApprove;
+exports.collaborationComment = collaborationComment;
+exports.collaborationCommentList = collaborationCommentList;
+exports.collaborationHandoff = collaborationHandoff;
+exports.reviewStatus = reviewStatus;
+exports.reviewPolicy = reviewPolicy;
+exports.formatReviewStatus = formatReviewStatus;
+exports.formatCommentList = formatCommentList;
+const state_1 = require("../state");
+const report_1 = require("./report");
+const cli_options_1 = require("./cli-options");
+const collaboration_1 = require("../collaboration");
+function collaborationApprove(run, targetKind, targetId, options = {}, decision = "approve") {
+    const record = (0, collaboration_1.recordApproval)(run, {
+        target: (0, cli_options_1.collaborationTarget)(targetKind, targetId),
+        decision,
+        ...(0, cli_options_1.actorInputFrom)(options),
+        rationale: (0, cli_options_1.stringOption)(options.rationale) || (0, cli_options_1.stringOption)(options.reason) || (0, cli_options_1.stringOption)(options.message),
+        supersedes: (0, cli_options_1.stringOption)(options.supersedes)
+    }, { persist: false });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return record;
+}
+function collaborationComment(run, targetKind, targetId, options = {}) {
+    const record = (0, collaboration_1.recordComment)(run, {
+        target: (0, cli_options_1.collaborationTarget)(targetKind, targetId),
+        body: (0, cli_options_1.stringOption)(options.body) || (0, cli_options_1.stringOption)(options.message) || (0, cli_options_1.stringOption)(options.text) || "",
+        threadId: (0, cli_options_1.stringOption)(options.thread) || (0, cli_options_1.stringOption)(options.threadId),
+        parentId: (0, cli_options_1.stringOption)(options.parent) || (0, cli_options_1.stringOption)(options.parentId),
+        ...(0, cli_options_1.actorInputFrom)(options)
+    }, { persist: false });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return record;
+}
+function collaborationCommentList(run, options = {}) {
+    const target = (0, cli_options_1.collaborationTargetMaybe)((0, cli_options_1.stringOption)(options.targetKind) || (0, cli_options_1.stringOption)(options.kind), (0, cli_options_1.stringOption)(options.target) || (0, cli_options_1.stringOption)(options.targetId));
+    const comments = (0, collaboration_1.listComments)(run, target);
+    return { schemaVersion: 1, surface: "collaboration", runId: run.id, target, count: comments.length, comments };
+}
+function collaborationHandoff(run, targetKind, targetId, options = {}) {
+    const record = (0, collaboration_1.recordHandoff)(run, {
+        target: (0, cli_options_1.collaborationTarget)(targetKind, targetId),
+        toActor: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "to", "toActor")),
+        toActorKind: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "toKind", "to-kind", "toActorKind")),
+        toRole: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "toRole", "to-role")),
+        toDisplayName: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "toName", "to-name", "toDisplayName")),
+        toAttested: Boolean((0, cli_options_1.firstDefined)(options, "toAttested", "to-attested")),
+        fromActor: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "from", "fromActor")),
+        fromActorKind: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "fromKind", "from-kind", "fromActorKind")),
+        fromRole: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "fromRole", "from-role")),
+        reason: (0, cli_options_1.stringOption)(options.reason) || (0, cli_options_1.stringOption)(options.message) || "handoff",
+        ...(0, cli_options_1.actorInputFrom)(options)
+    }, { persist: false });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return record;
+}
+function reviewStatus(run, options = {}) {
+    const now = typeof options.now === "string" && options.now ? options.now : new Date().toISOString();
+    const target = (0, cli_options_1.collaborationTargetMaybe)((0, cli_options_1.stringOption)(options.targetKind) || (0, cli_options_1.stringOption)(options.kind), (0, cli_options_1.stringOption)(options.target) || (0, cli_options_1.stringOption)(options.targetId));
+    return (0, collaboration_1.buildReviewStatusReport)(run, { now, target });
+}
+function reviewPolicy(run, options = {}) {
+    const allowSelf = (0, cli_options_1.firstDefined)(options, "allowSelfApproval", "allow-self-approval");
+    const requireAttested = (0, cli_options_1.firstDefined)(options, "requireAttestedActor", "require-attested-actor");
+    const policy = (0, collaboration_1.setReviewPolicy)(run, {
+        requiredApprovals: (0, cli_options_1.numberOption)((0, cli_options_1.firstDefined)(options, "requiredApprovals", "required-approvals", "required", "approvals")),
+        authorizedRoles: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "authorizedRoles", "authorized-roles", "roles")),
+        allowSelfApproval: allowSelf === undefined ? undefined : Boolean(allowSelf),
+        requireAttestedActor: requireAttested === undefined ? undefined : Boolean(requireAttested),
+        appliesTo: (0, cli_options_1.stringOption)((0, cli_options_1.firstDefined)(options, "appliesTo", "applies-to", "targets"))
+    }, { persist: false });
+    (0, report_1.writeReport)(run);
+    (0, state_1.saveCheckpoint)(run);
+    return { schemaVersion: 1, surface: "collaboration", runId: run.id, policy };
+}
+function formatReviewStatus(report) {
+    return (0, collaboration_1.formatReviewStatus)(report);
+}
+function formatCommentList(comments) {
+    return (0, collaboration_1.formatCommentList)(comments);
+}