create-principles-disciple 1.85.0 → 1.87.0

package/console/dist/server/index.js

@@ -2,12 +2,11 @@ import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
-import { RuntimeStateManager, CandidateIntakeService, PrincipleTreeLedgerAdapter, PainChainReadModel, PruningReadModel, OperatorHealthReadModel, } from '@principles/core/runtime-v2';
+import { loadWorkspaceFeatureFlags, buildFeedbackChannelFlags, } from './config/feature-flags.js';
 import { AuthConfig } from './config/AuthConfig.js';
 import { WorkspaceConfigStore } from './config/WorkspaceConfigStore.js';
 import { WorkspaceService } from './models/WorkspaceService.js';
 import { handleFeedbackReportsRoute, disposeFeedbackReportModels } from './routes/feedback-reports.js';
-import { loadWorkspaceFeatureFlags, buildFeedbackChannelFlags, } from './config/feature-flags.js';
 import { handleApprovalsRoute, disposeApprovalsModels } from './routes/approvals.js';
 import { handleHealthRoute, disposeHealthModels } from './routes/health.js';
 import { handlePrinciplesRoute, disposePrinciplesModels } from './routes/principles.js';
@@ -19,7 +18,6 @@ import { handleEvidenceChainRoute, disposeEvidenceChainModels } from './routes/e
 import { createWorkspacesRoutes } from './routes/workspaces.js';
 import { handleUpdateRoute } from './routes/update.js';
 import { handleUpdateHistoryRoute } from './routes/update-history.js';
-import { handleStateRoute } from './routes/state.js';
 import { handleConfigRoute } from './routes/config.js';
 import { sendJson, sendNotFound, sendUnauthorized } from './utils/response.js';
 const __filename = fileURLToPath(import.meta.url);
@@ -158,14 +156,15 @@ function serveFile(res, filePath) {
 }
 // ── Async handler wrapper ──────────────────────────────────────────────────────────────
 const REQUEST_TIMEOUT_MS = 10000;
-function asyncHandler(fn) {
+const UPDATE_APPLY_TIMEOUT_MS = 120000;
+function asyncHandler(fn, timeoutMs = REQUEST_TIMEOUT_MS) {
     return (innerReq, innerRes) => {
         const timeoutId = setTimeout(() => {
             if (!innerRes.headersSent) {
                 sendJson(innerRes, 504, { success: false, error: 'Request timeout' });
                 innerRes.end();
             }
-        }, REQUEST_TIMEOUT_MS);
+        }, timeoutMs);
         fn(innerReq, innerRes)
             .finally(() => clearTimeout(timeoutId))
             .catch((err) => {
@@ -181,21 +180,6 @@ function asyncHandler(fn) {
     };
 }
 async function initServices(workspaceDir, authConfig) {
-    const stateManager = new RuntimeStateManager({ workspaceDir });
-    await stateManager.initialize();
-    const painChainReadModel = new PainChainReadModel({ workspaceDir, stateManager });
-    const pruningReadModel = new PruningReadModel({ workspaceDir });
-    const healthReadModel = new OperatorHealthReadModel({
-        workspaceDir,
-        painChainReadModel,
-        pruningReadModel,
-    });
-    const stateDir = path.join(workspaceDir, '.state');
-    const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir });
-    const candidateIntakeService = new CandidateIntakeService({
-        stateManager,
-        ledgerAdapter,
-    });
     const configStore = new WorkspaceConfigStore();
     const workspaceService = new WorkspaceService(configStore);
     // Load feature flags — fail-closed: on error, feedback_channel is disabled
@@ -205,11 +189,6 @@ async function initServices(workspaceDir, authConfig) {
         console.warn('[pd-console] Feature flag loading failed (feedback channel disabled):', flagLoadResult.reason);
     }
     return {
-        stateManager,
-        healthReadModel,
-        painChainReadModel,
-        pruningReadModel,
-        candidateIntakeService,
         workspaceDir,
         authConfig,
         configStore,
@@ -228,24 +207,6 @@ async function closeServices(services) {
     disposeGovernanceModels();
     disposeEvidenceChainModels();
     services.workspaceService.dispose();
-    try {
-        await services.healthReadModel.close();
-    }
-    catch (err) {
-        console.error('[pd-console] Failed to close health read model', err);
-    }
-    try {
-        await services.painChainReadModel.close();
-    }
-    catch (err) {
-        console.error('[pd-console] Failed to close pain chain read model', err);
-    }
-    try {
-        await services.stateManager.close();
-    }
-    catch (err) {
-        console.error('[pd-console] Failed to close state manager', err);
-    }
 }
 // ── Route handler ───────────────────────────────────────────────────────────
 function handleRequest(services) {
@@ -317,13 +278,8 @@ function handleRequest(services) {
             // Update routes: GET /api/update/check, POST /api/update/apply, GET /api/update/status, POST /api/update/rollback
             if (urlPath === '/api/update' || urlPath.startsWith('/api/update/')) {
                 const subPath = urlPath.slice('/api/update'.length);
-                asyncHandler(() => handleUpdateRoute(req, res, services.workspaceDir, subPath))(req, res);
-                return;
-            }
-            // GET /api/v1/state, /api/v1/state/:taskId
-            if (urlPath === '/api/v1/state' || urlPath.startsWith('/api/v1/state/')) {
-                const subPath = urlPath.slice('/api/v1/state'.length);
-                asyncHandler(() => handleStateRoute(req, res, services.workspaceDir, subPath))(req, res);
+                const isApply = subPath === '/apply';
+                asyncHandler(() => handleUpdateRoute(req, res, services.workspaceDir, subPath), isApply ? UPDATE_APPLY_TIMEOUT_MS : undefined)(req, res);
                 return;
             }
             // Config API routes: /api/v1/config/summary, /api/v1/config/catalog,

package/console/dist/server/models/ActivationsConsoleModel.d.ts

@@ -15,12 +15,8 @@ export interface ActivationsResponse {
     note?: string;
 }
 export declare class ActivationsConsoleModel {
-    private readConnection;
-    private writeConnection;
     private readonly workspaceDir;
     constructor(workspaceDir: string);
-    private getReadConnection;
-    private getWriteConnection;
     getActivations(): Promise<ActivationsResponse>;
     deactivateActivation(activationId: string): Promise<{
         ok: true;

package/console/dist/server/models/ActivationsConsoleModel.js

@@ -7,106 +7,98 @@ function isMissingTableError(err) {
     return err.message.includes('no such table');
 }
 export class ActivationsConsoleModel {
-    readConnection = null;
-    writeConnection = null;
     workspaceDir;
     constructor(workspaceDir) {
         this.workspaceDir = workspaceDir;
     }
-    getReadConnection() {
-        if (!this.readConnection) {
-            this.readConnection = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true });
-        }
-        return this.readConnection;
-    }
-    getWriteConnection() {
-        if (!this.writeConnection) {
-            this.writeConnection = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
-        }
-        return this.writeConnection;
-    }
     async getActivations() {
         const stateDbPath = path.join(this.workspaceDir, '.pd', 'state.db');
         if (!fs.existsSync(stateDbPath)) {
             return { activations: [], generatedAt: new Date().toISOString(), note: 'state.db not found — workspace may not be initialized' };
         }
-        const conn = this.getReadConnection();
-        const activationStore = new SqliteActivationStateStore(conn);
-        const artifactStore = new SqlitePIArtifactStore(conn);
-        let allActivations;
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true });
         try {
-            allActivations = await activationStore.listAllActivations();
-        }
-        catch (err) {
-            if (isMissingTableError(err)) {
-                return { activations: [], generatedAt: new Date().toISOString(), note: 'activation table not found — workspace may not be initialized' };
+            const activationStore = new SqliteActivationStateStore(conn);
+            const artifactStore = new SqlitePIArtifactStore(conn);
+            let allActivations;
+            try {
+                allActivations = await activationStore.listAllActivations();
             }
-            throw err;
-        }
-        // Build artifactId → sourcePrincipleId map from PIArtifactSnapshot
-        const artifactPrincipleMap = new Map();
-        for (const activation of allActivations) {
-            if (!artifactPrincipleMap.has(activation.artifactId)) {
-                try {
-                    const artifact = await artifactStore.getArtifactById(activation.artifactId);
-                    artifactPrincipleMap.set(activation.artifactId, artifact?.sourcePrincipleId ?? null);
+            catch (err) {
+                if (isMissingTableError(err)) {
+                    return { activations: [], generatedAt: new Date().toISOString(), note: 'activation table not found — workspace may not be initialized' };
                 }
-                catch (err) {
-                    if (isMissingTableError(err)) {
-                        artifactPrincipleMap.set(activation.artifactId, null);
+                throw err;
+            }
+            // Build artifactId → sourcePrincipleId map from PIArtifactSnapshot
+            const artifactPrincipleMap = new Map();
+            for (const activation of allActivations) {
+                if (!artifactPrincipleMap.has(activation.artifactId)) {
+                    try {
+                        const artifact = await artifactStore.getArtifactById(activation.artifactId);
+                        artifactPrincipleMap.set(activation.artifactId, artifact?.sourcePrincipleId ?? null);
                     }
-                    else {
-                        throw err;
+                    catch (err) {
+                        if (isMissingTableError(err)) {
+                            artifactPrincipleMap.set(activation.artifactId, null);
+                        }
+                        else {
+                            throw err;
+                        }
                     }
                 }
             }
+            const facts = allActivations.map((record) => ({
+                id: record.activationId,
+                artifactId: record.artifactId,
+                principleId: artifactPrincipleMap.get(record.artifactId) ?? 'unlinked',
+                channel: record.channel,
+                action: record.action,
+                targetRef: record.targetRef,
+                activatedAt: record.activatedAt,
+                status: record.deactivatedAt === null ? 'active' : 'inactive',
+            }));
+            return {
+                activations: facts,
+                generatedAt: new Date().toISOString(),
+            };
+        }
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best-effort */ }
         }
-        const facts = allActivations.map((record) => ({
-            id: record.activationId,
-            artifactId: record.artifactId,
-            principleId: artifactPrincipleMap.get(record.artifactId) ?? 'unlinked',
-            channel: record.channel,
-            action: record.action,
-            targetRef: record.targetRef,
-            activatedAt: record.activatedAt,
-            status: record.deactivatedAt === null ? 'active' : 'inactive',
-        }));
-        return {
-            activations: facts,
-            generatedAt: new Date().toISOString(),
-        };
     }
     async deactivateActivation(activationId) {
         const stateDbPath = path.join(this.workspaceDir, '.pd', 'state.db');
         if (!fs.existsSync(stateDbPath)) {
             return { ok: false, reason: 'state.db not found — workspace may not be initialized', nextAction: 'Ensure the workspace has been initialized with PD before disabling activations.' };
         }
-        const conn = this.getWriteConnection();
-        const activationStore = new SqliteActivationStateStore(conn);
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
         try {
-            const deactivated = await activationStore.deactivateActivation(activationId, new Date().toISOString());
-            if (!deactivated) {
-                return { ok: false, reason: `Activation '${activationId}' not found or already inactive`, nextAction: 'Refresh the activation list and verify the activation ID is correct.' };
+            const activationStore = new SqliteActivationStateStore(conn);
+            try {
+                const deactivated = await activationStore.deactivateActivation(activationId, new Date().toISOString());
+                if (!deactivated) {
+                    return { ok: false, reason: `Activation '${activationId}' not found or already inactive`, nextAction: 'Refresh the activation list and verify the activation ID is correct.' };
+                }
+                return { ok: true };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                return { ok: false, reason: `Failed to deactivate activation: ${message}`, nextAction: 'Check server logs for details. The activation state has not been changed.' };
             }
-            return { ok: true };
         }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            return { ok: false, reason: `Failed to deactivate activation: ${message}`, nextAction: 'Check server logs for details. The activation state has not been changed.' };
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best-effort */ }
         }
     }
+    // eslint-disable-next-line @typescript-eslint/class-methods-use-this -- lifecycle interface; connections are request-scoped
     dispose() {
-        for (const conn of [this.readConnection, this.writeConnection]) {
-            if (conn) {
-                try {
-                    conn.close();
-                }
-                catch (err) {
-                    console.warn('ActivationsConsoleModel.dispose: failed to close connection:', err instanceof Error ? err.message : String(err));
-                }
-            }
-        }
-        this.readConnection = null;
-        this.writeConnection = null;
+        // Connections are opened and closed per-request; no persistent state.
     }
 }

package/console/dist/server/models/ApprovalsConsoleModel.d.ts

@@ -10,6 +10,7 @@ export type ApproveWithActivationResult = {
     ok: true;
     record: ApprovalRecord;
     activation?: ActivationDecision;
+    warning?: string;
 } | {
     ok: false;
     error: 'already_decided';
@@ -28,20 +29,45 @@ export type ApproveWithActivationResult = {
     approvalRolledBack: boolean;
 };
 export declare class ApprovalsConsoleModel {
-    private readConnection;
-    private readQueue;
-    private writeConnection;
-    private writeQueue;
     private readonly workspaceDir;
     constructor(workspaceDir: string);
-    private getReadQueue;
-    private getWriteQueue;
-    private getWriteConnection;
+    private createReadContext;
+    private createWriteContext;
     listApprovals(filter?: ApprovalListFilter): Promise<ApprovalListResult>;
     getApprovalDetail(approvalId: string): Promise<(ApprovalWithContext & {
         isMvpProven: boolean;
     }) | null>;
     approve(approvalId: string, decidedBy: string, note?: string): Promise<ApproveWithActivationResult>;
+    /**
+     * Edit a pending approval's artifact to a new version (P1 #2 fix).
+     *
+     * Before this method existed, ApprovalQueue.edit() was dead code — no
+     * Console/CLI/OpenClaw entry point called it. Owners could only approve
+     * or reject, not edit. This method makes the edit capability reachable
+     * from the Console route and CLI command.
+     *
+     * P1 #2 (adversarial review): validates the new artifact exists, has
+     * passed validation (validationStatus === 'validated'), and has lineage
+     * consistent with the original approval (same task, explicit artifact
+     * lineage, or shared source principle). Previously
+     * the method accepted any newArtifactId without checking existence,
+     * validation status, or lineage — allowing an owner to point an approval
+     * at an arbitrary, unvalidated, or lineage-mismatched artifact.
+     */
+    editApproval(input: {
+        approvalId: string;
+        editedBy: string;
+        newArtifactId: string;
+        editReason: string;
+    }): Promise<{
+        ok: true;
+        record: ApprovalRecord;
+    } | {
+        ok: false;
+        error: 'not_found' | 'already_decided' | 'artifact_not_found' | 'artifact_not_validated' | 'artifact_lineage_mismatch';
+        status?: ApprovalStatus;
+        reason?: string;
+    }>;
     private dispatchActivationAfterApproval;
     reject(approvalId: string, decidedBy: string, reason: string): Promise<ChannelGuardedDecisionResult>;
     /** Returns null when the approvals table does not exist. */