cowork-os 0.3.21

package/src/electron/reports/StandupReportService.ts

@@ -0,0 +1,356 @@
+import Database from 'better-sqlite3';
+import { v4 as uuidv4 } from 'uuid';
+import { StandupReport, Task, BoardColumn } from '../../shared/types';
+
+/**
+ * Query for standup reports
+ */
+export interface StandupListQuery {
+  workspaceId: string;
+  limit?: number;
+  startDate?: string;  // YYYY-MM-DD
+  endDate?: string;    // YYYY-MM-DD
+}
+
+/**
+ * Channel configuration for report delivery
+ */
+export interface DeliveryConfig {
+  channelType: string;  // telegram, discord, slack, etc.
+  channelId: string;
+}
+
+/**
+ * Service for generating and managing daily standup reports
+ */
+export class StandupReportService {
+  constructor(
+    private db: Database.Database,
+    private deliverToChannel?: (report: StandupReport, config: DeliveryConfig) => Promise<void>
+  ) {}
+
+  /**
+   * Generate a standup report for a workspace
+   * Aggregates task status from the past 24 hours
+   */
+  async generateReport(workspaceId: string, date: Date = new Date()): Promise<StandupReport> {
+    const reportDate = this.formatDate(date);
+    const yesterday = date.getTime() - 24 * 60 * 60 * 1000;
+
+    // Check if report already exists for this date
+    const existing = this.getByDate(workspaceId, reportDate);
+    if (existing) {
+      return existing;
+    }
+
+    // Get completed tasks (done column, updated in last 24h)
+    const completedTasks = this.getTasksByColumn(workspaceId, 'done', yesterday);
+
+    // Get in-progress tasks
+    const inProgressTasks = this.getTasksByColumn(workspaceId, 'in_progress');
+
+    // Get blocked tasks (status = 'blocked' or 'failed')
+    const blockedTasks = this.getBlockedTasks(workspaceId);
+
+    // Generate summary
+    const summary = this.buildSummary(completedTasks, inProgressTasks, blockedTasks);
+
+    const report: StandupReport = {
+      id: uuidv4(),
+      workspaceId,
+      reportDate,
+      completedTaskIds: completedTasks.map(t => t.id),
+      inProgressTaskIds: inProgressTasks.map(t => t.id),
+      blockedTaskIds: blockedTasks.map(t => t.id),
+      summary,
+      createdAt: Date.now(),
+    };
+
+    // Save to database
+    this.save(report);
+
+    return report;
+  }
+
+  /**
+   * Deliver a standup report to a configured channel
+   */
+  async deliverReport(report: StandupReport, config: DeliveryConfig): Promise<void> {
+    if (!this.deliverToChannel) {
+      throw new Error('No delivery handler configured');
+    }
+
+    await this.deliverToChannel(report, config);
+
+    // Update report with delivery info
+    const deliveredToChannel = `${config.channelType}:${config.channelId}`;
+    const stmt = this.db.prepare(
+      'UPDATE standup_reports SET delivered_to_channel = ? WHERE id = ?'
+    );
+    stmt.run(deliveredToChannel, report.id);
+  }
+
+  /**
+   * Get the latest standup report for a workspace
+   */
+  getLatest(workspaceId: string): StandupReport | undefined {
+    const stmt = this.db.prepare(`
+      SELECT * FROM standup_reports
+      WHERE workspace_id = ?
+      ORDER BY created_at DESC
+      LIMIT 1
+    `);
+    const row = stmt.get(workspaceId) as any;
+    return row ? this.mapRowToReport(row) : undefined;
+  }
+
+  /**
+   * Get a standup report by date
+   */
+  getByDate(workspaceId: string, reportDate: string): StandupReport | undefined {
+    const stmt = this.db.prepare(`
+      SELECT * FROM standup_reports
+      WHERE workspace_id = ? AND report_date = ?
+    `);
+    const row = stmt.get(workspaceId, reportDate) as any;
+    return row ? this.mapRowToReport(row) : undefined;
+  }
+
+  /**
+   * List standup reports for a workspace
+   */
+  list(query: StandupListQuery): StandupReport[] {
+    const conditions: string[] = ['workspace_id = ?'];
+    const params: any[] = [query.workspaceId];
+
+    if (query.startDate) {
+      conditions.push('report_date >= ?');
+      params.push(query.startDate);
+    }
+
+    if (query.endDate) {
+      conditions.push('report_date <= ?');
+      params.push(query.endDate);
+    }
+
+    let sql = `SELECT * FROM standup_reports WHERE ${conditions.join(' AND ')} ORDER BY report_date DESC`;
+
+    if (query.limit) {
+      sql += ` LIMIT ${query.limit}`;
+    }
+
+    const stmt = this.db.prepare(sql);
+    const rows = stmt.all(...params) as any[];
+    return rows.map(row => this.mapRowToReport(row));
+  }
+
+  /**
+   * Find a report by ID
+   */
+  findById(id: string): StandupReport | undefined {
+    const stmt = this.db.prepare('SELECT * FROM standup_reports WHERE id = ?');
+    const row = stmt.get(id) as any;
+    return row ? this.mapRowToReport(row) : undefined;
+  }
+
+  /**
+   * Delete old reports (cleanup)
+   */
+  deleteOlderThan(workspaceId: string, daysToKeep: number): number {
+    const cutoffDate = new Date();
+    cutoffDate.setDate(cutoffDate.getDate() - daysToKeep);
+    const cutoffStr = this.formatDate(cutoffDate);
+
+    const stmt = this.db.prepare(
+      'DELETE FROM standup_reports WHERE workspace_id = ? AND report_date < ?'
+    );
+    const result = stmt.run(workspaceId, cutoffStr);
+    return result.changes;
+  }
+
+  /**
+   * Format the standup report as a message for delivery
+   */
+  formatReportMessage(report: StandupReport, tasks: Map<string, Task>): string {
+    const lines: string[] = [
+      `**Daily Standup Report - ${report.reportDate}**`,
+      '',
+    ];
+
+    // Completed section
+    if (report.completedTaskIds.length > 0) {
+      lines.push('**Completed Today:**');
+      for (const taskId of report.completedTaskIds) {
+        const task = tasks.get(taskId);
+        if (task) {
+          lines.push(`- ${task.title}`);
+        }
+      }
+      lines.push('');
+    }
+
+    // In Progress section
+    if (report.inProgressTaskIds.length > 0) {
+      lines.push('**In Progress:**');
+      for (const taskId of report.inProgressTaskIds) {
+        const task = tasks.get(taskId);
+        if (task) {
+          lines.push(`- ${task.title}`);
+        }
+      }
+      lines.push('');
+    }
+
+    // Blocked section
+    if (report.blockedTaskIds.length > 0) {
+      lines.push('**Blocked:**');
+      for (const taskId of report.blockedTaskIds) {
+        const task = tasks.get(taskId);
+        if (task) {
+          lines.push(`- ${task.title}`);
+        }
+      }
+      lines.push('');
+    }
+
+    // Summary
+    lines.push('**Summary:**');
+    lines.push(report.summary);
+
+    return lines.join('\n');
+  }
+
+  /**
+   * Save a report to the database
+   */
+  private save(report: StandupReport): void {
+    const stmt = this.db.prepare(`
+      INSERT INTO standup_reports (
+        id, workspace_id, report_date, completed_task_ids,
+        in_progress_task_ids, blocked_task_ids, summary,
+        delivered_to_channel, created_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+
+    stmt.run(
+      report.id,
+      report.workspaceId,
+      report.reportDate,
+      JSON.stringify(report.completedTaskIds),
+      JSON.stringify(report.inProgressTaskIds),
+      JSON.stringify(report.blockedTaskIds),
+      report.summary,
+      report.deliveredToChannel || null,
+      report.createdAt
+    );
+  }
+
+  /**
+   * Get tasks by board column with optional time filter
+   */
+  private getTasksByColumn(
+    workspaceId: string,
+    column: BoardColumn,
+    updatedAfter?: number
+  ): Task[] {
+    let sql = `
+      SELECT * FROM tasks
+      WHERE workspace_id = ? AND board_column = ?
+    `;
+    const params: any[] = [workspaceId, column];
+
+    if (updatedAfter) {
+      sql += ' AND updated_at >= ?';
+      params.push(updatedAfter);
+    }
+
+    sql += ' ORDER BY updated_at DESC';
+
+    const stmt = this.db.prepare(sql);
+    const rows = stmt.all(...params) as any[];
+    return rows.map(row => this.mapRowToTask(row));
+  }
+
+  /**
+   * Get blocked tasks (status = blocked or failed)
+   */
+  private getBlockedTasks(workspaceId: string): Task[] {
+    const stmt = this.db.prepare(`
+      SELECT * FROM tasks
+      WHERE workspace_id = ? AND status IN ('blocked', 'failed')
+      ORDER BY updated_at DESC
+    `);
+    const rows = stmt.all(workspaceId) as any[];
+    return rows.map(row => this.mapRowToTask(row));
+  }
+
+  /**
+   * Build a summary from task lists
+   */
+  private buildSummary(
+    completed: Task[],
+    inProgress: Task[],
+    blocked: Task[]
+  ): string {
+    const parts: string[] = [];
+
+    if (completed.length > 0) {
+      parts.push(`${completed.length} task${completed.length === 1 ? '' : 's'} completed`);
+    }
+
+    if (inProgress.length > 0) {
+      parts.push(`${inProgress.length} task${inProgress.length === 1 ? '' : 's'} in progress`);
+    }
+
+    if (blocked.length > 0) {
+      parts.push(`${blocked.length} task${blocked.length === 1 ? '' : 's'} blocked`);
+    }
+
+    if (parts.length === 0) {
+      return 'No task activity today.';
+    }
+
+    return parts.join(', ') + '.';
+  }
+
+  /**
+   * Format date as YYYY-MM-DD
+   */
+  private formatDate(date: Date): string {
+    return date.toISOString().split('T')[0];
+  }
+
+  /**
+   * Map database row to StandupReport
+   */
+  private mapRowToReport(row: any): StandupReport {
+    return {
+      id: row.id,
+      workspaceId: row.workspace_id,
+      reportDate: row.report_date,
+      completedTaskIds: JSON.parse(row.completed_task_ids || '[]'),
+      inProgressTaskIds: JSON.parse(row.in_progress_task_ids || '[]'),
+      blockedTaskIds: JSON.parse(row.blocked_task_ids || '[]'),
+      summary: row.summary,
+      deliveredToChannel: row.delivered_to_channel || undefined,
+      createdAt: row.created_at,
+    };
+  }
+
+  /**
+   * Map database row to Task (minimal mapping for standup)
+   */
+  private mapRowToTask(row: any): Task {
+    return {
+      id: row.id,
+      title: row.title,
+      prompt: row.prompt,
+      status: row.status,
+      workspaceId: row.workspace_id,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at,
+      boardColumn: row.board_column,
+      assignedAgentRoleId: row.assigned_agent_role_id,
+    };
+  }
+}

package/src/electron/security/concurrency.ts

@@ -0,0 +1,333 @@
+/**
+ * Concurrency Safety Module
+ *
+ * Provides mutex locks and idempotency guarantees for critical operations.
+ */
+
+/**
+ * Simple async mutex for protecting critical sections
+ * Prevents race conditions in pairing, approval, and state changes
+ */
+export class AsyncMutex {
+  private locked = false;
+  private queue: Array<() => void> = [];
+
+  /**
+   * Acquire the lock. Returns a release function.
+   */
+  async acquire(): Promise<() => void> {
+    return new Promise((resolve) => {
+      const tryAcquire = () => {
+        if (!this.locked) {
+          this.locked = true;
+          resolve(() => this.release());
+        } else {
+          this.queue.push(tryAcquire);
+        }
+      };
+      tryAcquire();
+    });
+  }
+
+  /**
+   * Release the lock
+   */
+  private release(): void {
+    this.locked = false;
+    const next = this.queue.shift();
+    if (next) {
+      next();
+    }
+  }
+
+  /**
+   * Execute a function with the lock held
+   */
+  async withLock<T>(fn: () => Promise<T>): Promise<T> {
+    const release = await this.acquire();
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+
+  /**
+   * Check if the lock is currently held
+   */
+  isLocked(): boolean {
+    return this.locked;
+  }
+}
+
+/**
+ * Named mutex manager for managing multiple locks by key
+ */
+export class NamedMutexManager {
+  private mutexes: Map<string, AsyncMutex> = new Map();
+
+  /**
+   * Get or create a mutex for a given key
+   */
+  getMutex(key: string): AsyncMutex {
+    let mutex = this.mutexes.get(key);
+    if (!mutex) {
+      mutex = new AsyncMutex();
+      this.mutexes.set(key, mutex);
+    }
+    return mutex;
+  }
+
+  /**
+   * Execute a function with the named lock held
+   */
+  async withLock<T>(key: string, fn: () => Promise<T>): Promise<T> {
+    return this.getMutex(key).withLock(fn);
+  }
+
+  /**
+   * Clean up unused mutexes
+   */
+  cleanup(): void {
+    for (const [key, mutex] of this.mutexes.entries()) {
+      if (!mutex.isLocked()) {
+        this.mutexes.delete(key);
+      }
+    }
+  }
+}
+
+/**
+ * Idempotency key entry
+ */
+interface IdempotencyEntry {
+  key: string;
+  result: any;
+  createdAt: number;
+  expiresAt: number;
+  status: 'pending' | 'completed' | 'failed';
+}
+
+/**
+ * Idempotency Manager
+ *
+ * Ensures operations are idempotent by tracking operation keys and their results.
+ * Implements C6-style approval safety: prevents duplicate approvals/denials.
+ */
+export class IdempotencyManager {
+  private entries: Map<string, IdempotencyEntry> = new Map();
+  private defaultTTLMs: number;
+  private cleanupIntervalId?: ReturnType<typeof setInterval>;
+
+  constructor(defaultTTLMs = 5 * 60 * 1000) { // 5 minutes default
+    this.defaultTTLMs = defaultTTLMs;
+
+    // Periodic cleanup of expired entries
+    this.cleanupIntervalId = setInterval(() => {
+      this.cleanupExpired();
+    }, 60 * 1000); // Every minute
+  }
+
+  /**
+   * Generate an idempotency key for an operation
+   */
+  static generateKey(operation: string, ...args: (string | number | undefined)[]): string {
+    const parts = [operation, ...args.filter(a => a !== undefined)];
+    return parts.join(':');
+  }
+
+  /**
+   * Check if an operation with this key is already in progress or completed
+   */
+  check(key: string): { exists: boolean; status?: 'pending' | 'completed' | 'failed'; result?: any } {
+    const entry = this.entries.get(key);
+
+    if (!entry) {
+      return { exists: false };
+    }
+
+    // Check if expired
+    if (Date.now() > entry.expiresAt) {
+      this.entries.delete(key);
+      return { exists: false };
+    }
+
+    return {
+      exists: true,
+      status: entry.status,
+      result: entry.result,
+    };
+  }
+
+  /**
+   * Start tracking an operation (mark as pending)
+   * Returns false if operation is already in progress
+   */
+  start(key: string, ttlMs?: number): boolean {
+    const existing = this.check(key);
+
+    if (existing.exists) {
+      // Already in progress or completed
+      return false;
+    }
+
+    const now = Date.now();
+    this.entries.set(key, {
+      key,
+      result: undefined,
+      createdAt: now,
+      expiresAt: now + (ttlMs || this.defaultTTLMs),
+      status: 'pending',
+    });
+
+    return true;
+  }
+
+  /**
+   * Mark an operation as completed with its result
+   */
+  complete(key: string, result: any): void {
+    const entry = this.entries.get(key);
+    if (entry) {
+      entry.status = 'completed';
+      entry.result = result;
+    }
+  }
+
+  /**
+   * Mark an operation as failed
+   */
+  fail(key: string, error?: any): void {
+    const entry = this.entries.get(key);
+    if (entry) {
+      entry.status = 'failed';
+      entry.result = error;
+    }
+  }
+
+  /**
+   * Remove an entry (for retry scenarios)
+   */
+  remove(key: string): void {
+    this.entries.delete(key);
+  }
+
+  /**
+   * Execute an operation with idempotency guarantee
+   * If operation was already completed, returns cached result
+   * If operation is in progress, waits and returns result
+   */
+  async execute<T>(
+    key: string,
+    operation: () => Promise<T>,
+    ttlMs?: number
+  ): Promise<{ result: T; cached: boolean }> {
+    const existing = this.check(key);
+
+    if (existing.exists && existing.status === 'completed') {
+      return { result: existing.result as T, cached: true };
+    }
+
+    if (existing.exists && existing.status === 'pending') {
+      // Wait for completion
+      const result = await this.waitForCompletion<T>(key);
+      return { result, cached: true };
+    }
+
+    // Start new operation
+    if (!this.start(key, ttlMs)) {
+      // Race condition: another call started between check and start
+      const result = await this.waitForCompletion<T>(key);
+      return { result, cached: true };
+    }
+
+    try {
+      const result = await operation();
+      this.complete(key, result);
+      return { result, cached: false };
+    } catch (error) {
+      this.fail(key, error);
+      throw error;
+    }
+  }
+
+  /**
+   * Wait for a pending operation to complete
+   */
+  private async waitForCompletion<T>(key: string, timeoutMs = 30000): Promise<T> {
+    const startTime = Date.now();
+
+    while (Date.now() - startTime < timeoutMs) {
+      const entry = this.entries.get(key);
+
+      if (!entry || Date.now() > entry.expiresAt) {
+        throw new Error(`Operation ${key} expired or not found`);
+      }
+
+      if (entry.status === 'completed') {
+        return entry.result as T;
+      }
+
+      if (entry.status === 'failed') {
+        throw entry.result || new Error(`Operation ${key} failed`);
+      }
+
+      // Wait a bit before checking again
+      await new Promise(resolve => setTimeout(resolve, 100));
+    }
+
+    throw new Error(`Timeout waiting for operation ${key}`);
+  }
+
+  /**
+   * Clean up expired entries
+   */
+  private cleanupExpired(): void {
+    const now = Date.now();
+    for (const [key, entry] of this.entries.entries()) {
+      if (now > entry.expiresAt) {
+        this.entries.delete(key);
+      }
+    }
+  }
+
+  /**
+   * Get statistics about the idempotency cache
+   */
+  getStats(): { total: number; pending: number; completed: number; failed: number } {
+    let pending = 0;
+    let completed = 0;
+    let failed = 0;
+
+    for (const entry of this.entries.values()) {
+      switch (entry.status) {
+        case 'pending': pending++; break;
+        case 'completed': completed++; break;
+        case 'failed': failed++; break;
+      }
+    }
+
+    return {
+      total: this.entries.size,
+      pending,
+      completed,
+      failed,
+    };
+  }
+
+  /**
+   * Clean up and stop background tasks
+   */
+  destroy(): void {
+    if (this.cleanupIntervalId) {
+      clearInterval(this.cleanupIntervalId);
+      this.cleanupIntervalId = undefined;
+    }
+    this.entries.clear();
+  }
+}
+
+// Global instances for common use cases
+export const pairingMutex = new NamedMutexManager();
+export const approvalIdempotency = new IdempotencyManager(5 * 60 * 1000); // 5 min TTL
+export const taskIdempotency = new IdempotencyManager(60 * 1000); // 1 min TTL for task creation

package/src/electron/security/index.ts

@@ -0,0 +1,17 @@
+/**
+ * Security Module
+ *
+ * Exports all security-related components for the application.
+ */
+
+export {
+  SecurityPolicyManager,
+  createPolicyManager,
+  isToolAllowedQuick,
+  type PolicyCheckResult,
+  type PolicyLayer,
+  type LayerDecision,
+  type PolicyContext,
+} from './policy-manager';
+
+export { AsyncMutex, IdempotencyManager } from './concurrency';