create-workframe 0.1.14 → 0.1.16

package/README.md

@@ -3,7 +3,7 @@
 Published on npm as **create-workframe**.
 
 ```bash
-npx create-workframe@0.1.14 MyProject
+npx create-workframe@0.1.16 MyProject
 ```
 
 Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.

package/bin/create-workframe.js

@@ -396,6 +396,8 @@ ${hermesServiceVolumesBlock(hermesHome)}
       - ./Agents:/opt/data
       - ./Files:${WORKSPACE_DATA_MOUNT}
       - ./scripts:/opt/install/scripts:ro
+      - .:/project:ro
+      - .:/compose:ro
       - workframe-proxy-token:/run/workframe-proxy
     env_file:
       - ./.env
@@ -528,6 +530,8 @@ services:
       - \${WORKFRAME_HOST_PROJECT_ROOT}/Agents:/opt/data
       - \${WORKFRAME_HOST_PROJECT_ROOT}/Files:${WORKSPACE_DATA_MOUNT}
       - \${WORKFRAME_HOST_PROJECT_ROOT}/scripts:/opt/install/scripts:ro
+      - \${WORKFRAME_HOST_PROJECT_ROOT}:/project:ro
+      - \${WORKFRAME_HOST_COMPOSE_DIR}:/compose:ro
       - workframe-proxy-token:/run/workframe-proxy
 
   workframe-supervisor:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-workframe",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Scaffold a Workframe + Hermes workspace with guided onboarding",
   "type": "module",
   "bin": {

package/scripts/sync-canonical-to-package.mjs

@@ -22,6 +22,9 @@ const SKIP_DIRS = new Set([
   '.pytest_cache',
   '.venv',
   'node_modules',
+  '.tmp',
+  '.tmp-test-data',
+  '.tmp-test-hermes',
 ]);
 
 const SKIP_FILES = new Set([

package/workframe-api/activity_feed.py

@@ -338,7 +338,7 @@ def _kanban_activity(
             assignee = str(r["assignee"] or "kanban")
             member = crew_lookup.get(assignee.lower()) or crew_lookup.get(_srv()._profile_slug(assignee).lower())
             agent = _resolve_agent(member, _srv()._profile_display_name(assignee) if assignee != "kanban" else "Kanban")
-            desc = f"{r['title'] or 'task'} · {r['kind']}"
+            desc = f"{r['title'] or 'task'} · {r['kind']}"
             if len(desc) > 140:
                 desc = desc[:137] + "..."
             st = str(r["status"] or r["kind"] or "event").lower()
@@ -638,9 +638,9 @@ def _room_session_activity_label(
 ) -> str:
     base = str(title or room_name or "Session").strip()
     if msg_count > 0:
-        return f"{base} · {msg_count} message{'s' if msg_count != 1 else ''}"
+        return f"{base} · {msg_count} message{'s' if msg_count != 1 else ''}"
     if status == "active":
-        return f"{base} · active"
+        return f"{base} · active"
     return base
 
 
@@ -689,7 +689,7 @@ def room_activity_data(
         ended = info.get("ended_at")
         row_status = str(row["status"] or "active")
         if row_status == "active" and not ended:
-            status = "active"
+            status = "idle"
         elif ended:
             status = "completed"
         else:
@@ -721,7 +721,7 @@ def room_activity_data(
         merged.extend(_message_activity_for_sessions(prof, crew_lookup, sids, ACTIVITY_ROOM_LIMIT))
 
     try:
-        merged.extend(run_ledger.list_run_events_for_room(room_id, limit=ACTIVITY_ROOM_LIMIT))
+        merged.extend(_run_ledger_activity(room_id, crew_lookup, ACTIVITY_ROOM_LIMIT))
     except Exception:  # noqa: BLE001
         pass
 
@@ -729,6 +729,54 @@ def room_activity_data(
     return merged[:ACTIVITY_ROOM_LIMIT]
 
 
+def _run_event_activity_status(event_type: str, run_status: str) -> str:
+    et = str(event_type or "").strip().lower()
+    if et == "run.completed":
+        return "completed"
+    if et in ("run.failed", "run.denied"):
+        return "failed"
+    rs = str(run_status or "").strip().lower()
+    if rs == "running":
+        return "active"
+    if rs == "completed":
+        return "completed"
+    if rs in ("failed", "denied", "cancelled"):
+        return "failed"
+    return "idle"
+
+
+def _run_ledger_activity(
+    room_id: str,
+    crew_lookup: dict[str, dict[str, Any]],
+    limit: int,
+) -> list[dict[str, Any]]:
+    """User-facing run ledger rows — skip internal authorize noise, resolve agent names."""
+    rows = run_ledger.list_run_events_for_room(room_id, limit=limit)
+    out: list[dict[str, Any]] = []
+    for row in rows:
+        event_type = str(row.get("event_type") or "")
+        if event_type == "run.authorized":
+            continue
+        prof = str(row.get("profile") or "").strip()
+        member = crew_lookup.get(prof.lower()) or crew_lookup.get(_srv()._profile_slug(prof).lower())
+        agent = _resolve_agent(member, _srv()._profile_display_name(prof))
+        desc = str(row.get("task_description") or "").strip()
+        if not desc:
+            continue
+        out.append(
+            {
+                **row,
+                "agent_name": agent["agent_name"],
+                "key": agent["key"],
+                "profile": prof or agent["profile"],
+                "task_description": desc,
+                "status": _run_event_activity_status(event_type, str(row.get("run_status") or row.get("status") or "")),
+                "source": "run_ledger",
+            }
+        )
+    return out
+
+
 def _room_agent_dm_owner_user_id(conn: sqlite3.Connection, room_id: str) -> str | None:
     row = conn.execute(
         """

package/workframe-api/api_errors.py

@@ -0,0 +1,126 @@
+"""Public API error codes and sanitization — never leak tracebacks to clients."""
+from __future__ import annotations
+
+import re
+from typing import Any
+
+_TRACE = re.compile(r"\n(?:Traceback|  File )", re.MULTILINE)
+_SNAKE_CODE = re.compile(r"^[a-z][a-z0-9_]{2,63}$")
+
+PUBLIC: dict[str, dict[str, str]] = {
+    "request_failed": {
+        "message": "Something went wrong.",
+        "hint": "Try again in a moment. If it keeps happening, contact your admin.",
+    },
+    "runtime_profile_permission_denied": {
+        "message": "Workframe could not prepare your agent workspace on disk.",
+        "hint": "An admin should restart the stack or fix permissions on the Agents data volume.",
+    },
+    "runtime_profile_create_failed": {
+        "message": "Workframe could not create your personal agent profile.",
+        "hint": "Try again in a moment. If it persists, restart Workframe or contact your admin.",
+    },
+    "runtime_profile_api_config_failed": {
+        "message": "Workframe could not start the agent API for this profile.",
+        "hint": "Check that the Hermes gateway is running and try again.",
+    },
+    "runtime_profile_bootstrap_failed": {
+        "message": "Workframe could not finish setting up this agent profile.",
+        "hint": "Try again or pick another agent from the crew list.",
+    },
+    "session_bootstrap_failed": {
+        "message": "Workframe could not start this chat session.",
+        "hint": "Refresh the page or open another agent room.",
+    },
+    "room_not_found": {
+        "message": "That chat room was not found.",
+        "hint": "Refresh the room list or open another chat.",
+    },
+    "room_access_denied": {
+        "message": "You cannot access this room.",
+        "hint": "Ask a workspace admin for access.",
+    },
+    "no_session": {
+        "message": "You are not signed in.",
+        "hint": "Refresh the page and sign in again.",
+    },
+    "model_required": {
+        "message": "Choose a model for this agent.",
+        "hint": "Open LLM models, select a connected provider and model, then create the agent.",
+    },
+}
+
+
+def scrub_internal(text: str) -> str:
+    """Drop tracebacks and multiline internals — keep a single safe line for logs."""
+    cleaned = str(text or "").strip()
+    if not cleaned:
+        return ""
+    if _TRACE.search(cleaned):
+        cleaned = _TRACE.split(cleaned, maxsplit=1)[0].strip()
+    if "\n" in cleaned:
+        cleaned = cleaned.split("\n", 1)[0].strip()
+    return cleaned
+
+
+def classify_error(text: str) -> str | None:
+    raw_full = str(text or "")
+    lowered_full = raw_full.lower()
+    if "permissionerror" in lowered_full or "permission denied" in lowered_full:
+        return "runtime_profile_permission_denied"
+    raw = scrub_internal(text)
+    if not raw:
+        return None
+    lowered = raw.lower()
+    if "runtime profile create failed" in lowered:
+        return "runtime_profile_create_failed"
+    if "runtime profile api config failed" in lowered:
+        return "runtime_profile_api_config_failed"
+    if "runtime profile bootstrap failed" in lowered:
+        return "runtime_profile_bootstrap_failed"
+    if "connection refused" in lowered_full or "errno 111" in lowered_full:
+        return "runtime_profile_api_config_failed"
+    if "profile api did not become healthy" in lowered or "profile api unavailable" in lowered:
+        return "runtime_profile_api_config_failed"
+    if "session creation failed" in lowered or "create session failed" in lowered:
+        return "session_bootstrap_failed"
+    if "room_not_found" in lowered or "room not found" in lowered:
+        return "room_not_found"
+    if "room_access_denied" in lowered or "access denied" in lowered:
+        return "room_access_denied"
+    if "no_session" in lowered:
+        return "no_session"
+    if _SNAKE_CODE.fullmatch(raw):
+        return raw
+    return None
+
+
+def public_api_error_payload(exc: BaseException, *, context: str = "") -> dict[str, Any]:
+    """Map an exception to a client-safe {error, message, hint} payload."""
+    full = str(exc)
+    code = classify_error(full)
+    if code and code in PUBLIC:
+        row = PUBLIC[code]
+        return {"error": code, "message": row["message"], "hint": row.get("hint", "")}
+    if code and _SNAKE_CODE.fullmatch(code):
+        human = code.replace("_", " ").strip().capitalize() + "."
+        return {"error": code, "message": human, "hint": PUBLIC["request_failed"]["hint"]}
+    fallback = PUBLIC["request_failed"]
+    payload: dict[str, Any] = {
+        "error": "request_failed",
+        "message": fallback["message"],
+        "hint": fallback["hint"],
+    }
+    if context.strip():
+        payload["context"] = context.strip()
+    return payload
+
+
+def http_status_for_code(code: str) -> int:
+    if code in ("no_session",):
+        return 401
+    if code in ("room_access_denied", "forbidden"):
+        return 403
+    if code in ("room_not_found",):
+        return 404
+    return 400

package/workframe-api/chat_bind.py

@@ -27,6 +27,7 @@ def profile_chat_bind(profile: str, payload: dict[str, Any], user_id: str = "")
     session = lane_bindings.profile_chat_session(profile, payload, user_id)
     sid = str(session.get("session_id") or "").strip()
     hermes_prof = str(session.get("profile") or _srv().resolve_validated_profile(profile))
+    workspace_id = str(session.get("workspace_id") or payload.get("workspace_id") or "").strip()
     template_prof = str(session.get("template_profile") or "").strip()
     if not template_prof:
         template_prof = (
@@ -34,7 +35,13 @@ def profile_chat_bind(profile: str, payload: dict[str, Any], user_id: str = "")
             if _srv()._is_runtime_profile_slug(hermes_prof)
             else _srv().resolve_validated_profile(profile)
         )
-    workspace_id = str(session.get("workspace_id") or payload.get("workspace_id") or "").strip()
+    if user_id and workspace_id and session.get("llm_ready"):
+        llm_provider = _srv()._llm_billing_provider(
+            hermes_prof, user_id=user_id, workspace_id=workspace_id,
+        )
+        _srv()._schedule_profile_lease_yaml_reconcile(
+            hermes_prof, user_id, workspace_id, llm_provider,
+        )
     history = _srv().chat_messages(hermes_prof, sid)
     # ponytail: cohort manifest is lazy — GET /api/me/cohort; bind must stay fast
     cohort: list[dict[str, Any]] = []

package/workframe-api/chat_stream.py

@@ -205,6 +205,34 @@ def _iter_profile_stream_frames(upstream: Any) -> Iterator[tuple[str, dict[str,
         if parsed:
             yield parsed
 
+def _stream_data_text(data_lines: list[str]) -> str:
+    raw = "\n".join(line.strip() for line in data_lines if line.strip())
+    if not raw:
+        return ""
+    try:
+        data = json.loads(raw)
+    except json.JSONDecodeError:
+        return raw
+    if not isinstance(data, dict):
+        return raw
+    err = data.get("error")
+    if isinstance(err, dict):
+        nested = str(err.get("message") or err.get("detail") or "").strip()
+        if nested:
+            return nested
+    for key in ("message", "error", "text", "detail", "summary"):
+        val = data.get(key)
+        if isinstance(val, str) and val.strip():
+            return val.strip()
+    return raw
+
+
+def _concierge_notice_from_error(text: str, *, provider: str) -> dict[str, Any]:
+    entry = llm_error_glossary.classify_exception_text(str(text or "").strip())
+    entry = llm_error_glossary.tailor_provider_entry(entry, provider)
+    return concierge.respond("", last_error=entry)
+
+
 def _emit_stream_chat_error(
     handler: BaseHTTPRequestHandler,
     message: str = "",
@@ -276,18 +304,13 @@ def _emit_stream_error_body(
 
 
 def _emit_stream_concierge(handler: BaseHTTPRequestHandler, entry: dict[str, Any]) -> None:
-    """Deterministic assistant reply when LLM path is unavailable."""
+    """Deterministic assistant reply when LLM path is unavailable (SSE headers already open)."""
     payload = llm_error_glossary.notice_payload(entry)
     text = str(payload.get("message") or "")
     hint = str(payload.get("hint") or "").strip()
     if hint:
         text = f"{text}\n\n{hint}"
     try:
-        handler.send_response(200)
-        handler.send_header("Content-Type", "text/event-stream; charset=utf-8")
-        handler.send_header("Cache-Control", "no-cache")
-        handler.send_header("Connection", "keep-alive")
-        handler.end_headers()
         handler.wfile.write(
             f"event: concierge\ndata: {json.dumps(payload)}\n\n".encode("utf-8"),
         )
@@ -373,6 +396,14 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
         prof, user_id=_triggering_user, workspace_id=_workspace_id, block=model_block,
     )
     model_used = str(model_block.get("default") or "").strip()
+    api_port = _srv()._profile_api_port(prof)
+    _open_profile_stream(
+        handler,
+        prof,
+        model_used=model_used,
+        llm_provider=llm_provider,
+        api_port=api_port,
+    )
     _auth_decision: run_authority.RunAuthorityDecision | None = None
     if _triggering_user:
         run_ledger.ensure_schema()
@@ -427,14 +458,6 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
         _log_llm_failure(handler, str(entry.get("code") or "no_llm_provider"), provider=llm_provider, profile=prof)
         _emit_stream_concierge(handler, entry)
         return
-    api_port = _srv()._profile_api_port(prof)
-    _open_profile_stream(
-        handler,
-        prof,
-        model_used=model_used,
-        llm_provider=llm_provider,
-        api_port=api_port,
-    )
     try:
         _srv().ensure_profile_api(
             prof,
@@ -455,6 +478,7 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
             _emit_stream_error_body(handler, entry=entry)
             return
         entry = llm_error_glossary.classify_exception_text(err_text)
+        entry = llm_error_glossary.tailor_provider_entry(entry, llm_provider)
         _log_llm_failure(handler, str(entry.get("code") or ""), provider=llm_provider, profile=prof)
         _emit_stream_error_body(handler, entry=entry)
         return
@@ -484,6 +508,7 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
     req = urllib.request.Request(url, data=upstream_body, headers=headers, method="POST")
     saw_complete = False
     complete_text = ""
+    last_classified_error: dict[str, Any] | None = None
     try:
         upstream = urllib.request.urlopen(req, timeout=3600)
     except urllib.error.HTTPError as exc:
@@ -492,11 +517,16 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
             data = json.loads(raw)
         except Exception:  # noqa: BLE001
             data = {"error": raw or f"upstream stream failed: {exc.code}"}
-        entry = llm_error_glossary.classify_exception_text(str(data))
+        if not isinstance(data, dict):
+            data = {"error": raw or f"upstream stream failed: {exc.code}"}
+        err_text = llm_error_glossary._extract_error_message(data, raw)
+        if not err_text:
+            err_text = raw or f"HTTP {exc.code}"
+        entry = _concierge_notice_from_error(err_text, provider=llm_provider)
         _emit_stream_error_body(handler, entry=entry)
         return
     except OSError as exc:
-        entry = llm_error_glossary.classify_exception_text(str(exc))
+        entry = _concierge_notice_from_error(str(exc), provider=llm_provider)
         _emit_stream_error_body(handler, entry=entry)
         return
 
@@ -504,7 +534,7 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
         buffer = b""
 
         def _rewrite_event_frame(frame: bytes) -> bytes:
-            nonlocal saw_complete, complete_text
+            nonlocal saw_complete, complete_text, last_classified_error
             text = frame.decode("utf-8", errors="replace")
             lines = text.splitlines()
             event_name = ""
@@ -539,6 +569,13 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
             elif event_name == "error":
                 normalized = "error"
 
+            if normalized == "error" and data_lines:
+                err_text = _stream_data_text(data_lines)
+                if err_text:
+                    notice = _concierge_notice_from_error(err_text, provider=llm_provider)
+                    last_classified_error = notice
+                    data_lines = [json.dumps(notice, separators=(",", ":"))]
+
             output_lines: list[str] = []
             if normalized:
                 output_lines.append(f"event: {normalized}")
@@ -575,22 +612,29 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
                 handler.wfile.write(rewritten)
                 handler.wfile.flush()
         if not saw_complete or not complete_text:
-            config_key = _srv()._read_config_model_api_key(prof)
-            _, model_name = _srv()._read_model_from_config(prof)
-            if config_key.startswith(turn_credentials.LEASE_PREFIX) and not turn_credentials.validate_lease(
-                config_key,
-            ):
-                entry = llm_error_glossary.playbook_entry("invalid_lease")
+            if last_classified_error:
+                entry = last_classified_error
             else:
-                entry = llm_error_glossary.playbook_entry("provider_empty_reply")
+                config_key = _srv()._read_config_model_api_key(prof)
+                _, model_name = _srv()._read_model_from_config(prof)
+                if config_key.startswith(turn_credentials.LEASE_PREFIX) and not turn_credentials.validate_lease(
+                    config_key,
+                ):
+                    entry = llm_error_glossary.notice_payload(
+                        llm_error_glossary.playbook_entry("invalid_lease"),
+                    )
+                else:
+                    entry = llm_error_glossary.notice_payload(
+                        llm_error_glossary.playbook_entry("provider_empty_reply"),
+                    )
             _log_llm_failure(
                 handler,
                 str(entry.get("code") or "provider_empty_reply"),
                 provider=llm_provider,
-                model=str(model_name or ""),
+                model=str(model_name if not last_classified_error else ""),
                 profile=prof,
             )
-            err_payload = json.dumps(llm_error_glossary.notice_payload(entry))
+            err_payload = json.dumps(entry)
             handler.wfile.write(f"event: error\ndata: {err_payload}\n\n".encode("utf-8"))
             handler.wfile.flush()
         handler.wfile.write(b"event: done\ndata: {}\n\n")

package/workframe-api/crew_registry.py

@@ -96,12 +96,9 @@ def _workspace_agent_identities(workspace_id: str | None = None) -> dict[str, di
 def _agent_identity_fields(profile: str, workspace_id: str | None = None, user_id: str = "") -> dict[str, Any]:
     slug = _srv().safe_profile_slug(str(profile or "").strip())
     template = _srv()._runtime_template_slug(slug) if _srv()._is_runtime_profile_slug(slug) else slug
-    reg = _agent_registry_row(slug)
-    if user_id and template:
-        runtime = _srv()._runtime_profile_slug(user_id, template)
-        reg_user = _agent_registry_row(runtime)
-        if reg_user.get("display_name") or reg_user.get("tagline") or reg_user.get("avatar_url"):
-            reg = {**reg, **{k: v for k, v in reg_user.items() if v}}
+    # Runtime profiles are credential/session proxies, not alternate agent
+    # identities.  Shared template metadata is authoritative for all users.
+    reg = _agent_registry_row(template)
     ident = _workspace_agent_identities(workspace_id).get(template, {})
     reg_template = _agent_registry_row(template)
     avatar_url: Any = None

package/workframe-api/google_auth.py

@@ -3,17 +3,16 @@
 from __future__ import annotations
 
 import json
-import os
 import secrets
 import urllib.parse
 import urllib.request
 from typing import Any
 
+import oauth_pending
 import oidc_jwt
 import stack_config
-
-APP_BASE_URL = os.environ.get("APP_BASE_URL", "http://127.0.0.1:18644").rstrip("/")
-_PENDING: dict[str, dict[str, str]] = {}
+from email_sender import APP_BASE_URL
+GOOGLE_SIGNIN_PROVIDER = "google_signin"
 
 
 def _google_creds() -> tuple[str, str]:
@@ -28,10 +27,13 @@ def _google_creds() -> tuple[str, str]:
 def start_google_auth(invite_email: str = "", invite_token: str = "") -> dict[str, Any]:
     client_id, _ = _google_creds()
     state = secrets.token_urlsafe(24)
-    _PENDING[state] = {
-        "invite_email": invite_email.strip().lower(),
-        "invite_token": invite_token.strip(),
-    }
+    meta = json.dumps(
+        {
+            "invite_email": invite_email.strip().lower(),
+            "invite_token": invite_token.strip(),
+        },
+    )
+    oauth_pending.store_pending(state, "", GOOGLE_SIGNIN_PROVIDER, "", meta)
     redirect_uri = f"{APP_BASE_URL}/api/auth/google/callback"
     params = {
         "client_id": client_id,
@@ -49,9 +51,15 @@ def start_google_auth(invite_email: str = "", invite_token: str = "") -> dict[st
 
 
 def exchange_google_code(code: str, state: str) -> dict[str, Any]:
-    pending = _PENDING.pop(state, None)
-    if not pending:
+    pending = oauth_pending.take_pending(state)
+    if not pending or str(pending.get("provider") or "") != GOOGLE_SIGNIN_PROVIDER:
         raise ValueError("invalid or expired OAuth state")
+    try:
+        meta = json.loads(str(pending.get("workspace_id") or "{}"))
+    except json.JSONDecodeError:
+        meta = {}
+    if not isinstance(meta, dict):
+        meta = {}
     client_id, client_secret = _google_creds()
     redirect_uri = f"{APP_BASE_URL}/api/auth/google/callback"
     data = urllib.parse.urlencode(
@@ -80,11 +88,11 @@ def exchange_google_code(code: str, state: str) -> dict[str, Any]:
         raise ValueError("Google account has no email")
     if claims.get("email_verified") is False:
         raise ValueError("Google email is not verified")
-    invite_email = pending.get("invite_email") or ""
+    invite_email = str(meta.get("invite_email") or "").strip().lower()
     if invite_email and email != invite_email:
         raise ValueError("Google email does not match the invited address")
     return {
         "email": email,
         "display_name": str(claims.get("name") or email),
-        "invite_token": pending.get("invite_token") or "",
+        "invite_token": str(meta.get("invite_token") or ""),
     }