create-workframe 0.1.11 → 0.1.13

package/workframe-api/install_api.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import os
 import re
 import sqlite3
@@ -17,6 +18,37 @@ from email_sender import send_email_with_config
 HERMES_DATA = Path(os.environ.get("HERMES_DATA", "/opt/data"))
 NATIVE_PROFILE = os.environ.get("WORKFRAME_NATIVE_PROFILE", "workframe-agent").strip() or "workframe-agent"
 
+INSTALL_WIZARD_STEPS = frozenset({
+    "intro",
+    "welcome",
+    "publish",
+    "smtp",
+    "admin_auth",
+    "workframe",
+    "billing",
+    "integrations",
+    "profile",
+    "agent",
+    "agent_model",
+    "invites",
+    "done",
+})
+INSTALL_WIZARD_STEP_ORDER = (
+    "intro",
+    "welcome",
+    "publish",
+    "smtp",
+    "admin_auth",
+    "workframe",
+    "billing",
+    "integrations",
+    "profile",
+    "agent",
+    "agent_model",
+    "invites",
+    "done",
+)
+
 
 def _user_count(db_path: str) -> int:
     try:
@@ -34,6 +66,97 @@ def install_window_open(db_path: str) -> bool:
     return not bool(stack_config.get_stack_config().get("install_complete"))
 
 
+def install_owner_claimed(db_path: str) -> bool:
+    """True once the first install admin has verified and owns the default workspace."""
+    try:
+        conn = sqlite3.connect(db_path, timeout=2.0)
+        row = conn.execute(
+            """
+            SELECT 1 FROM workspaces
+            WHERE deleted_at IS NULL
+              AND TRIM(COALESCE(owner_id, '')) != ''
+            LIMIT 1
+            """,
+        ).fetchone()
+        conn.close()
+        return bool(row)
+    except (sqlite3.Error, OSError):
+        return False
+
+
+def install_mutations_require_owner(db_path: str) -> bool:
+    """After admin verify, install stack mutations require the owner session."""
+    return install_owner_claimed(db_path) or stack_config.install_admin_verified()
+
+
+def _default_workspace_settings(db_path: str) -> dict[str, Any]:
+    try:
+        conn = sqlite3.connect(db_path, timeout=2.0)
+        row = conn.execute(
+            """
+            SELECT settings_json FROM workspaces
+            WHERE deleted_at IS NULL
+            ORDER BY CASE WHEN slug = 'default' THEN 0 ELSE 1 END, created_at ASC
+            LIMIT 1
+            """,
+        ).fetchone()
+        conn.close()
+        if not row:
+            return {}
+        raw = str(row[0] or "{}")
+        parsed = json.loads(raw)
+        return parsed if isinstance(parsed, dict) else {}
+    except (sqlite3.Error, OSError, json.JSONDecodeError, TypeError):
+        return {}
+
+
+def _wizard_step_index(step: str) -> int:
+    try:
+        return INSTALL_WIZARD_STEP_ORDER.index(step)
+    except ValueError:
+        return -1
+
+
+def _derive_install_wizard_step(db_path: str) -> str:
+    cfg = stack_config.get_stack_config()
+    mode = str(cfg.get("deployment_mode") or "").strip()
+    if not mode:
+        return "welcome"
+    if mode == "public_multi_user" and not str(cfg.get("app_base_url") or "").strip():
+        return "publish"
+    if mode != "single_user_local" and not stack_config.install_admin_verified() and not install_owner_claimed(db_path):
+        return "smtp"
+
+    settings = _default_workspace_settings(db_path)
+    if not settings.get("admin_onboarding_done"):
+        return "workframe"
+    if not settings.get("admin_integrations_done"):
+        return "billing"
+
+    return "profile"
+
+
+def resolve_install_wizard_step(db_path: str) -> str:
+    """Resume ConciergeFlow at the last persisted or derived wizard step."""
+    derived = _derive_install_wizard_step(db_path)
+    raw = stack_config.read_stack_raw()
+    saved = str(raw.get("wizard_step") or "").strip()
+    if saved in INSTALL_WIZARD_STEPS:
+        if _wizard_step_index(derived) > _wizard_step_index(saved):
+            return derived
+        return saved
+    return derived
+
+
+def install_wizard_public_payload(db_path: str) -> dict[str, Any]:
+    admin_verified = stack_config.install_admin_verified() or install_owner_claimed(db_path)
+    return {
+        "admin_verified": admin_verified,
+        "resume_step": resolve_install_wizard_step(db_path),
+        "owner_claimed": install_owner_claimed(db_path),
+    }
+
+
 def _hermes_native_present() -> bool:
     for slug in (NATIVE_PROFILE, "workframe-agent"):
         if not slug:

package/workframe-api/kanban_cron.py

@@ -0,0 +1,473 @@
+"""WF-032 extract: kanban_cron."""
+from __future__ import annotations
+
+import json
+import os
+import queue
+import re
+import sqlite3
+import time
+import uuid
+from pathlib import Path
+from typing import Any
+
+from http.server import BaseHTTPRequestHandler
+
+import run_ledger
+import user_prefs
+from domain.entities import ActorType, FundingSource, RunStatus, RunSurface
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def _iter_kanban_dbs() -> list[Path]:
+    dbs = [_srv().HERMES_DATA / "kanban.db"]
+    boards_root = _srv().HERMES_DATA / "kanban" / "boards"
+    if boards_root.is_dir():
+        for board_dir in boards_root.iterdir():
+            if board_dir.is_dir():
+                candidate = board_dir / "kanban.db"
+                if candidate.is_file():
+                    dbs.append(candidate)
+    return dbs
+
+
+def _refresh_active_kanban_assignee_credentials() -> None:
+    """Keep kanban worker profile .env aligned with assignee owner (not last chatter)."""
+    assignees: set[str] = set()
+    for db_path in _iter_kanban_dbs():
+        conn = _srv()._ro_sqlite_live(db_path)
+        if not conn:
+            continue
+        try:
+            rows = conn.execute(
+                """
+                SELECT DISTINCT assignee FROM tasks
+                WHERE status IN ('ready', 'running', 'scheduled', 'triage')
+                  AND assignee LIKE 'u-%'
+                """
+            ).fetchall()
+            for row in rows:
+                slug = _srv().safe_profile_slug(str(row["assignee"] or "").strip())
+                if slug:
+                    assignees.add(slug)
+        except sqlite3.Error:
+            pass
+        finally:
+            conn.close()
+    for assignee in assignees:
+        resolved = _srv()._resolve_runtime_owner(assignee)
+        if not resolved:
+            continue
+        owner_id, workspace_id = resolved
+        _srv()._prepare_runtime_profile_credentials(assignee, owner_id, workspace_id)
+
+
+def _kanban_credential_guard_daemon() -> None:
+    while True:
+        try:
+            _refresh_active_kanban_assignee_credentials()
+        except Exception:  # noqa: BLE001
+            pass
+        time.sleep(5)
+def validate_kanban_assignee(
+    assignee: str,
+    acting_user_id: str,
+    workspace_id: str,
+    *,
+    delegate_user_ids: frozenset[str] | None = None,
+    allow_template: bool = False,
+) -> tuple[bool, str]:
+    """Check whether acting_user may create/dispatch a task to assignee.
+
+    Returns (ok, reason_or_owner_user_id).
+    """
+    assignee = _srv().safe_profile_slug(str(assignee or "").strip())
+    acting = str(acting_user_id or "").strip()
+    workspace_id = str(workspace_id or "").strip()
+    if not assignee:
+        return False, "assignee_required"
+    if not acting or not workspace_id:
+        return False, "acting_user_required"
+    if delegate_user_ids is None:
+        delegate_user_ids = frozenset(_srv()._delegation_grantor_ids_for_grantee(acting, workspace_id))
+    if _srv()._is_runtime_profile_slug(assignee):
+        owner = _srv()._user_id_for_runtime_slug(assignee, workspace_id)
+        if not owner:
+            return False, "assignee_not_in_workspace"
+        allowed = {acting} | set(delegate_user_ids or ())
+        if owner in allowed:
+            return True, owner
+        return False, "assignee_owner_forbidden"
+    if allow_template:
+        return True, "template"
+    return False, "template_assignee_forbidden"
+def _hermes_kanban_db_path(board_slug: str) -> Path:
+    slug = _srv().safe_profile_slug(str(board_slug or "default").strip()) or "default"
+    if slug == "default":
+        return _srv().HERMES_DATA / "kanban.db"
+    return _srv().HERMES_DATA / "kanban" / "boards" / slug / "kanban.db"
+
+
+def _workspace_kanban_board_row(workspace_id: str) -> sqlite3.Row | None:
+    conn = _srv()._workframe_db()
+    try:
+        return conn.execute(
+            """
+            SELECT * FROM workspace_kanban_boards
+            WHERE workspace_id = ? AND deleted_at IS NULL
+            LIMIT 1
+            """,
+            (workspace_id,),
+        ).fetchone()
+    finally:
+        conn.close()
+
+
+def ensure_workspace_kanban_board(workspace_id: str) -> str:
+    workspace_id = str(workspace_id or "").strip()
+    row = _workspace_kanban_board_row(workspace_id)
+    if row:
+        return str(row["hermes_board_slug"])
+    conn = _srv()._workframe_db()
+    try:
+        ws = conn.execute(
+            "SELECT slug, display_name FROM workspaces WHERE id = ? AND deleted_at IS NULL",
+            (workspace_id,),
+        ).fetchone()
+        if not ws:
+            raise ValueError("workspace_not_found")
+        board_slug = re.sub(r"[^a-z0-9-]+", "-", str(ws["slug"] or workspace_id).lower()).strip("-")[:40]
+        if not board_slug:
+            board_slug = f"ws-{workspace_id[:8].lower()}"
+        display_name = str(ws["display_name"] or board_slug)
+        now = _srv()._utc_now()
+        conn.execute(
+            """
+            INSERT INTO workspace_kanban_boards (
+                id, workspace_id, hermes_board_slug, display_name, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?)
+            """,
+            (str(uuid.uuid4()), workspace_id, board_slug, display_name, now, now),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+    primary = _srv()._primary_profile()
+    if primary:
+        code, out = _srv()._gateway_exec(
+            primary,
+            ["kanban", "boards", "create", board_slug, "--name", display_name],
+        )
+        if code != 0 and "already exists" not in out.lower():
+            pass  # ponytail: board row is source of truth; Hermes may already have the board
+    return board_slug
+
+
+def kanban_proxy_list_tasks(workspace_id: str, user_id: str) -> dict[str, Any]:
+    workspace_id = str(workspace_id or "").strip()
+    user_id = str(user_id or "").strip()
+    if not _srv()._user_is_workspace_member(user_id, workspace_id):
+        raise PermissionError("forbidden")
+    row = _workspace_kanban_board_row(workspace_id)
+    board_slug = str(row["hermes_board_slug"]) if row else "default"
+    db = _hermes_kanban_db_path(board_slug)
+    out: dict[str, Any] = {
+        "ok": True,
+        "board": board_slug,
+        "workspace_id": workspace_id,
+        "tasks": [],
+        "total": 0,
+    }
+    conn = _srv()._ro_sqlite_live(db)
+    if not conn:
+        return out
+    try:
+        rows = conn.execute(
+            """
+            SELECT id, title, status, assignee, priority, created_at, completed_at
+            FROM tasks
+            ORDER BY created_at DESC
+            LIMIT 100
+            """
+        ).fetchall()
+        tasks = [
+            {
+                "id": r["id"],
+                "title": r["title"],
+                "status": r["status"],
+                "assignee": r["assignee"] or "",
+                "priority": r["priority"] or 0,
+                "created_at": _srv()._iso_from_unix(r["created_at"]),
+                "completed_at": _srv()._iso_from_unix(r["completed_at"]) if r["completed_at"] else None,
+            }
+            for r in rows
+        ]
+        out["tasks"] = tasks
+        out["total"] = len(tasks)
+    except sqlite3.Error:
+        pass
+    finally:
+        conn.close()
+    return out
+
+
+def _record_kanban_dispatch_run(
+    *,
+    workspace_id: str,
+    user_id: str,
+    runtime: str,
+    title: str,
+    board: str,
+) -> str:
+    """WF-NS-P2: audit trail for kanban task dispatch (not an LLM gate)."""
+    run_id = str(uuid.uuid4())
+    run_ledger.ensure_schema()
+    conn = _srv()._workframe_db()
+    try:
+        run_ledger.insert_run(
+            conn,
+            run_id=run_id,
+            workspace_id=workspace_id,
+            surface=RunSurface.KANBAN,
+            actor_type=ActorType.USER,
+            actor_id=user_id,
+            triggering_user_id=user_id,
+            agent_id=runtime,
+            runtime_binding_id=runtime,
+            status=RunStatus.RUNNING,
+            payer_user_id=user_id,
+            funding_source=FundingSource.BYOK,
+            profile_slug=runtime,
+        )
+        run_ledger.insert_run_event(
+            conn,
+            run_id=run_id,
+            event_type="kanban.task_created",
+            payload={"title": title, "board": board, "assignee": runtime},
+        )
+        run_ledger.complete_run(
+            conn,
+            run_id,
+            model="",
+            provider="",
+            funding_source=FundingSource.BYOK,
+            payer_user_id=user_id,
+            receipt={"title": title, "board": board, "assignee": runtime},
+        )
+        conn.commit()
+    finally:
+        conn.close()
+    return run_id
+
+
+def kanban_proxy_create_task(workspace_id: str, user_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+    workspace_id = str(workspace_id or "").strip()
+    user_id = str(user_id or "").strip()
+    if not _srv()._user_is_workspace_member(user_id, workspace_id):
+        raise PermissionError("forbidden")
+    title = str(payload.get("title") or "").strip()
+    if not title:
+        raise ValueError("title_required")
+    raw_assignee = str(payload.get("assignee") or payload.get("template_slug") or "").strip()
+    assignee_owner = str(payload.get("assignee_user_id") or user_id).strip()
+    if _srv()._is_runtime_profile_slug(_srv().safe_profile_slug(raw_assignee)):
+        runtime = _srv().safe_profile_slug(raw_assignee)
+    elif raw_assignee:
+        runtime = _srv().resolve_runtime_assignee(raw_assignee, assignee_owner, workspace_id)
+    else:
+        raise ValueError("assignee_required")
+    ok, reason = validate_kanban_assignee(runtime, user_id, workspace_id)
+    if not ok:
+        raise PermissionError(str(reason))
+    board = ensure_workspace_kanban_board(workspace_id)
+    orchestrator = _srv().resolve_runtime_assignee("workframe-agent", user_id, workspace_id)
+    args = ["kanban", "--board", board, "create", title, "--assignee", runtime]
+    workspace_kind = str(payload.get("workspace_kind") or "scratch").strip()
+    if workspace_kind:
+        args.extend(["--workspace-kind", workspace_kind])
+    body = str(payload.get("body") or "").strip()
+    if body:
+        args.extend(["--body", body])
+    code, out = _srv()._gateway_exec(orchestrator, args)
+    if code != 0:
+        raise ValueError(f"kanban_create_failed: {out.strip()}")
+    run_id = _record_kanban_dispatch_run(
+        workspace_id=workspace_id,
+        user_id=user_id,
+        runtime=runtime,
+        title=title,
+        board=board,
+    )
+    owner_id = assignee_owner
+    if _srv()._is_runtime_profile_slug(runtime):
+        resolved = _srv()._resolve_runtime_owner(runtime)
+        if resolved:
+            owner_id, workspace_id = resolved[0], resolved[1] or workspace_id
+    _srv()._prepare_runtime_profile_credentials(runtime, owner_id, workspace_id)
+    return {
+        "ok": True,
+        "board": board,
+        "assignee": runtime,
+        "title": title,
+        "output": out.strip(),
+        "run_id": run_id,
+    }
+def _cron_plain_english(schedule: str) -> str:
+    s = (schedule or "").strip()
+    if not s:
+        return "No schedule"
+    if s.startswith("every "):
+        return s.capitalize()
+    parts = s.split()
+    if len(parts) == 5:
+        minute, hour, dom, month, dow = parts
+        if dom == "*" and month == "*" and dow == "*":
+            return f"Every day at {hour.zfill(2)}:{minute.zfill(2)} UTC"
+        if dom == "*" and month == "*" and dow != "*":
+            return f"Cron: {s}"
+    return f"Cron: {s}"
+def kanban_data() -> dict[str, Any]:
+    db = _srv().HERMES_DATA / "kanban.db"
+    out: dict[str, Any] = {
+        "ok": False,
+        "total": 0,
+        "tasks": [],
+        "stats": {"todo": 0, "scheduled": 0, "ready": 0, "running": 0, "blocked": 0, "done": 0},
+    }
+    conn = _srv()._ro_sqlite_live(db)
+    if not conn:
+        return out
+    try:
+        rows = conn.execute(
+            """
+            SELECT id, title, status, assignee, priority, created_at, completed_at
+            FROM tasks
+            ORDER BY created_at DESC
+            LIMIT 100
+            """
+        ).fetchall()
+        tasks = [
+            {
+                "id": r["id"],
+                "title": r["title"],
+                "status": r["status"],
+                "assignee": r["assignee"] or "",
+                "priority": r["priority"] or 0,
+                "created_at": _srv()._iso_from_unix(r["created_at"]),
+                "completed_at": _srv()._iso_from_unix(r["completed_at"]) if r["completed_at"] else None,
+            }
+            for r in rows
+        ]
+        out["ok"] = True
+        out["tasks"] = tasks
+        out["total"] = len(tasks)
+        for r in rows:
+            st = str(r["status"] or "todo").lower()
+            if st in out["stats"]:
+                out["stats"][st] += 1
+            elif st == "triage":
+                out["stats"]["todo"] += 1
+    except sqlite3.Error:
+        pass
+    finally:
+        conn.close()
+    return out
+
+
+def _hermes_cron_jobs(profile: str) -> list[dict[str, Any]]:
+    paths = [
+        _srv()._profile_dir(profile) / "cron" / "jobs.json",
+        _srv().HERMES_DATA / "cron" / "jobs.json",
+    ]
+    jobs: list[dict[str, Any]] = []
+    for path in paths:
+        if not path.is_file():
+            continue
+        try:
+            raw = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(raw, dict):
+            items = raw.get("jobs") or raw.get("items") or []
+        elif isinstance(raw, list):
+            items = raw
+        else:
+            items = []
+        for job in items:
+            if not isinstance(job, dict):
+                continue
+            schedule = job.get("schedule") or job.get("cron") or job.get("every") or ""
+            command = job.get("prompt") or job.get("message") or job.get("name") or ""
+            jobs.append(
+                {
+                    "id": job.get("id") or job.get("name") or "",
+                    "name": job.get("name") or job.get("id") or "job",
+                    "schedule": schedule,
+                    "command": command[:200],
+                    "enabled": job.get("enabled", True),
+                    "owner": "hermes",
+                    "label": "hermes",
+                    "category": "hermes",
+                    "source": str(path),
+                    "description": _cron_plain_english(str(schedule)),
+                    "prompt_preview": command[:120],
+                }
+            )
+    return jobs
+
+
+def _system_cron_jobs() -> list[dict[str, Any]]:
+    jobs: list[dict[str, Any]] = []
+    candidates = [
+        Path("/etc/crontab"),
+        Path("/var/spool/cron/crontabs/root"),
+    ]
+    cron_d = Path("/etc/cron.d")
+    if cron_d.is_dir():
+        candidates.extend(sorted(cron_d.glob("*")))
+    for path in candidates:
+        if not path.is_file():
+            continue
+        try:
+            text = path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#"):
+                continue
+            parts = line.split(None, 5 if path.name == "crontab" or "crontabs" in str(path) else 6)
+            if len(parts) < 6:
+                continue
+            if path.name == "crontab" or "crontabs" in str(path):
+                schedule = " ".join(parts[:5])
+                command = parts[5] if len(parts) > 5 else ""
+            else:
+                schedule = " ".join(parts[:5])
+                command = parts[-1]
+            jobs.append(
+                {
+                    "name": command.split()[0] if command else "system",
+                    "schedule": schedule,
+                    "command": command[:200],
+                    "owner": "system",
+                    "label": "system",
+                    "category": "system",
+                    "source": str(path),
+                    "description": _cron_plain_english(schedule),
+                    "enabled": True,
+                }
+            )
+    return jobs[:50]
+
+
+def cron_data(profile: str) -> dict[str, Any]:
+    hermes = _hermes_cron_jobs(profile)
+    system = _system_cron_jobs()
+    all_jobs = hermes + system
+    return {"jobs": all_jobs, "items": all_jobs, "count": len(all_jobs), "hermes": hermes, "system": system}