create-workframe 0.1.5 → 0.1.6

package/shared/WORKFRAME_HANDOFF_SCHEMA.md

@@ -1,25 +1,25 @@
-# Workframe Handoff Schema
-
-Every completed specialist task should include:
-
-Required
-- summary: what was done
-- changed_files: absolute or repo-relative paths
-- next_action: concrete next step
-- owner: next responsible profile/person
-
-Recommended
-- decisions: key choices made
-- assumptions: unresolved assumptions
-- blockers: explicit question if blocked
-- evidence: links/refs/tests for verification
-
-Heartbeat schema (for long-running tasks)
-- state: phase name
-- progress: short status
-- eta: rough estimate
-- risk: only if material risk changed
-
-Storage
-- heartbeat/handoff in Kanban comments
-- durable result in project files
+# Workframe Handoff Schema
+
+Every completed specialist task should include:
+
+Required
+- summary: what was done
+- changed_files: absolute or repo-relative paths
+- next_action: concrete next step
+- owner: next responsible profile/person
+
+Recommended
+- decisions: key choices made
+- assumptions: unresolved assumptions
+- blockers: explicit question if blocked
+- evidence: links/refs/tests for verification
+
+Heartbeat schema (for long-running tasks)
+- state: phase name
+- progress: short status
+- eta: rough estimate
+- risk: only if material risk changed
+
+Storage
+- heartbeat/handoff in Kanban comments
+- durable result in project files

package/shared/WORKFRAME_SKILL_CURATION.md

@@ -1,27 +1,27 @@
-# Workframe Skill and Tool Curation
-
-Purpose
-- enforce lean specialization and avoid context bloat.
-
-Skill matrix (recommended baseline)
-
-| Profile | Mandatory (recommended) | Optional (recommended) | Avoid |
-|---|---|---|---|
-| {nativeProfileSlug} (project agent) | kanban-orchestrator | writing-plans, plan | domain-heavy implementation skills |
-| visionary | writing-plans | arxiv, blogwatcher | low-level debugging stacks |
-| architect | writing-plans | systematic-debugging, github-code-review | generic creative bundles |
-| docs | humanizer | hermes-agent-skill-authoring | infra-heavy ops bundles |
-| dev | test-driven-development, systematic-debugging | python-debugpy, requesting-code-review | broad strategy skills |
-| research | arxiv | llm-wiki, blogwatcher | unrelated creative generators |
-| designer | sketch | popular-web-designs, architecture-diagram | deep backend/debug toolchains |
-
-Tool curation rules
-1) Give each profile only tools it uses weekly.
-2) Shared essentials should be small.
-3) Add a skill only after repeated need.
-4) Remove stale skills quarterly.
-
-Install-time selection
-- default to the `native` starter pack unless a larger reference pack is explicitly requested
-- reference packs remain available (`core` / `product` / `engineering` / `full`)
-- concierge can request profile add/remove later with owner approval.
+# Workframe Skill and Tool Curation
+
+Purpose
+- enforce lean specialization and avoid context bloat.
+
+Skill matrix (recommended baseline)
+
+| Profile | Mandatory (recommended) | Optional (recommended) | Avoid |
+|---|---|---|---|
+| {nativeProfileSlug} (project agent) | kanban-orchestrator | writing-plans, plan | domain-heavy implementation skills |
+| visionary | writing-plans | arxiv, blogwatcher | low-level debugging stacks |
+| architect | writing-plans | systematic-debugging, github-code-review | generic creative bundles |
+| docs | humanizer | hermes-agent-skill-authoring | infra-heavy ops bundles |
+| dev | test-driven-development, systematic-debugging | python-debugpy, requesting-code-review | broad strategy skills |
+| research | arxiv | llm-wiki, blogwatcher | unrelated creative generators |
+| designer | sketch | popular-web-designs, architecture-diagram | deep backend/debug toolchains |
+
+Tool curation rules
+1) Give each profile only tools it uses weekly.
+2) Shared essentials should be small.
+3) Add a skill only after repeated need.
+4) Remove stale skills quarterly.
+
+Install-time selection
+- default to the `native` starter pack unless a larger reference pack is explicitly requested
+- reference packs remain available (`core` / `product` / `engineering` / `full`)
+- concierge can request profile add/remove later with owner approval.

package/workframe-api/Dockerfile

@@ -1,14 +1,14 @@
-FROM python:3-alpine
-
-RUN apk add --no-cache docker-cli docker-cli-compose bash nodejs npm
-
-WORKDIR /app
-
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-
-COPY . .
-
-EXPOSE 8080
-
-CMD ["python3", "server.py"]
+FROM python:3-alpine
+
+RUN apk add --no-cache docker-cli docker-cli-compose bash nodejs npm
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+EXPOSE 8080
+
+CMD ["python3", "server.py"]

package/workframe-api/README.md

@@ -1,24 +1,24 @@
-# Workframe API Service
-
-HTTP API for the Workframe UI. See [docs/VERSION.md](../../docs/VERSION.md) for release version.
-
-## Local (outside Docker)
-
-```bash
-cd services/workframe-api
-python3 -m venv .venv
-. .venv/bin/activate   # Windows: .venv\Scripts\activate
-pip install -r requirements.txt
-HOST=0.0.0.0 PORT=8080 HERMES_DATA=/opt/data WORKSPACE=/workspace python3 server.py
-```
-
-## Runtime state (not committed)
-
-- `data/*.db`, vault files under `WORKFRAME_API_DATA_DIR`
-- Hermes `Agents/` tree on mounted volume
-
-## Docs
-
-- [Operations](../../docs/public/operations.md)
-- [Security](../../docs/public/security.md)
-- [API reference](../../docs/public/api-reference.md)
+# Workframe API Service
+
+HTTP API for the Workframe UI. See [docs/VERSION.md](../../docs/VERSION.md) for release version.
+
+## Local (outside Docker)
+
+```bash
+cd services/workframe-api
+python3 -m venv .venv
+. .venv/bin/activate   # Windows: .venv\Scripts\activate
+pip install -r requirements.txt
+HOST=0.0.0.0 PORT=8080 HERMES_DATA=/opt/data WORKSPACE=/workspace python3 server.py
+```
+
+## Runtime state (not committed)
+
+- `data/*.db`, vault files under `WORKFRAME_API_DATA_DIR`
+- Hermes `Agents/` tree on mounted volume
+
+## Docs
+
+- [Operations](../../docs/public/operations.md)
+- [Security](../../docs/public/security.md)
+- [API reference](../../docs/public/api-reference.md)

package/workframe-api/action_proxy.py

@@ -1,131 +1,131 @@
-"""Internal action proxy — dev/tool PATs stay in vault; Hermes sends lease tokens."""
-
-from __future__ import annotations
-
-import json
-import re
-import urllib.error
-import urllib.request
-from http.server import BaseHTTPRequestHandler
-from typing import Any, Callable
-
-import llm_proxy
-import turn_credentials
-
-UPSTREAM_BASE: dict[str, str] = {
-    "github": "https://api.github.com",
-    "vercel": "https://api.vercel.com",
-    "netlify": "https://api.netlify.com/api/v1",
-}
-
-PROXY_PATH_RE = re.compile(r"^/internal/action/([a-z0-9_-]+)(/.*)?$", re.IGNORECASE)
-
-
-def upstream_auth_header(provider: str, secret: str) -> dict[str, str]:
-    provider = str(provider or "").strip().lower()
-    secret = str(secret or "").strip()
-    if provider == "github":
-        return {"Authorization": f"Bearer {secret}", "Accept": "application/vnd.github+json"}
-    if provider == "netlify":
-        return {"Authorization": f"Bearer {secret}"}
-    return {"Authorization": f"Bearer {secret}"}
-
-
-def forward_request(
-    provider: str,
-    subpath: str,
-    method: str,
-    headers: dict[str, str],
-    body: bytes | None,
-    *,
-    resolve_secret: Callable[[str, str, str, str], tuple[str, str]],
-) -> tuple[int, dict[str, str], bytes]:
-    provider = str(provider or "").strip().lower()
-    base = UPSTREAM_BASE.get(provider)
-    if not base:
-        return 404, {"Content-Type": "application/json"}, json.dumps({"error": "unknown provider"}).encode()
-
-    token = llm_proxy.extract_bearer(headers)
-    lease = turn_credentials.validate_lease(token)
-    if not lease:
-        return 401, {"Content-Type": "application/json"}, json.dumps({"error": "invalid lease"}).encode()
-    if str(lease.get("provider") or "").lower() != provider:
-        return 403, {"Content-Type": "application/json"}, json.dumps({"error": "provider mismatch"}).encode()
-
-    ok_profile, profile_err, profile_status = llm_proxy.validate_lease_profile(lease, headers)
-    if not ok_profile:
-        return (
-            profile_status,
-            {"Content-Type": "application/json"},
-            json.dumps({"error": profile_err}).encode(),
-        )
-
-    _env_var, secret = turn_credentials.resolve_lease_secret(lease, resolve_secret)
-    if not secret:
-        return 402, {"Content-Type": "application/json"}, json.dumps({"error": "no credential"}).encode()
-
-    path = subpath if subpath.startswith("/") else f"/{subpath}"
-    url = f"{base.rstrip('/')}{path}"
-    upstream_headers = {
-        k: v
-        for k, v in headers.items()
-        if k.lower()
-        not in {
-            "host",
-            "connection",
-            "content-length",
-            "authorization",
-            "x-api-key",
-        }
-    }
-    upstream_headers.update(upstream_auth_header(provider, secret))
-
-    req = urllib.request.Request(url, data=body, headers=upstream_headers, method=method.upper())
-    try:
-        with urllib.request.urlopen(req, timeout=600) as resp:
-            resp_body = resp.read()
-            out_headers = {"Content-Type": resp.headers.get("Content-Type", "application/octet-stream")}
-            return resp.status, out_headers, resp_body
-    except urllib.error.HTTPError as exc:
-        raw = exc.read()
-        out_headers = {"Content-Type": exc.headers.get("Content-Type", "application/json")}
-        return exc.code, out_headers, raw
-
-
-def handle_proxy_request(
-    handler: BaseHTTPRequestHandler,
-    path: str,
-    method: str,
-    body: bytes | None,
-    *,
-    resolve_secret: Callable[[str, str, str, str], tuple[str, str]],
-) -> bool:
-    ok, err = llm_proxy.authorize_internal_proxy(handler)
-    if not ok:
-        handler.send_response(403)
-        handler.send_header("Content-Type", "application/json")
-        handler.end_headers()
-        handler.wfile.write(json.dumps({"error": err or "internal only"}).encode())
-        return True
-
-    match = PROXY_PATH_RE.match(path)
-    if not match:
-        return False
-
-    provider = match.group(1).lower()
-    subpath = match.group(2) or "/"
-    headers = {k: v for k, v in handler.headers.items()}
-    status, out_headers, resp_body = forward_request(
-        provider,
-        subpath,
-        method,
-        headers,
-        body,
-        resolve_secret=resolve_secret,
-    )
-    handler.send_response(status)
-    for key, value in out_headers.items():
-        handler.send_header(key, value)
-    handler.end_headers()
-    handler.wfile.write(resp_body)
-    return True
+"""Internal action proxy — dev/tool PATs stay in vault; Hermes sends lease tokens."""
+
+from __future__ import annotations
+
+import json
+import re
+import urllib.error
+import urllib.request
+from http.server import BaseHTTPRequestHandler
+from typing import Any, Callable
+
+import llm_proxy
+import turn_credentials
+
+UPSTREAM_BASE: dict[str, str] = {
+    "github": "https://api.github.com",
+    "vercel": "https://api.vercel.com",
+    "netlify": "https://api.netlify.com/api/v1",
+}
+
+PROXY_PATH_RE = re.compile(r"^/internal/action/([a-z0-9_-]+)(/.*)?$", re.IGNORECASE)
+
+
+def upstream_auth_header(provider: str, secret: str) -> dict[str, str]:
+    provider = str(provider or "").strip().lower()
+    secret = str(secret or "").strip()
+    if provider == "github":
+        return {"Authorization": f"Bearer {secret}", "Accept": "application/vnd.github+json"}
+    if provider == "netlify":
+        return {"Authorization": f"Bearer {secret}"}
+    return {"Authorization": f"Bearer {secret}"}
+
+
+def forward_request(
+    provider: str,
+    subpath: str,
+    method: str,
+    headers: dict[str, str],
+    body: bytes | None,
+    *,
+    resolve_secret: Callable[[str, str, str, str], tuple[str, str]],
+) -> tuple[int, dict[str, str], bytes]:
+    provider = str(provider or "").strip().lower()
+    base = UPSTREAM_BASE.get(provider)
+    if not base:
+        return 404, {"Content-Type": "application/json"}, json.dumps({"error": "unknown provider"}).encode()
+
+    token = llm_proxy.extract_bearer(headers)
+    lease = turn_credentials.validate_lease(token)
+    if not lease:
+        return 401, {"Content-Type": "application/json"}, json.dumps({"error": "invalid lease"}).encode()
+    if str(lease.get("provider") or "").lower() != provider:
+        return 403, {"Content-Type": "application/json"}, json.dumps({"error": "provider mismatch"}).encode()
+
+    ok_profile, profile_err, profile_status = llm_proxy.validate_lease_profile(lease, headers)
+    if not ok_profile:
+        return (
+            profile_status,
+            {"Content-Type": "application/json"},
+            json.dumps({"error": profile_err}).encode(),
+        )
+
+    _env_var, secret = turn_credentials.resolve_lease_secret(lease, resolve_secret)
+    if not secret:
+        return 402, {"Content-Type": "application/json"}, json.dumps({"error": "no credential"}).encode()
+
+    path = subpath if subpath.startswith("/") else f"/{subpath}"
+    url = f"{base.rstrip('/')}{path}"
+    upstream_headers = {
+        k: v
+        for k, v in headers.items()
+        if k.lower()
+        not in {
+            "host",
+            "connection",
+            "content-length",
+            "authorization",
+            "x-api-key",
+        }
+    }
+    upstream_headers.update(upstream_auth_header(provider, secret))
+
+    req = urllib.request.Request(url, data=body, headers=upstream_headers, method=method.upper())
+    try:
+        with urllib.request.urlopen(req, timeout=600) as resp:
+            resp_body = resp.read()
+            out_headers = {"Content-Type": resp.headers.get("Content-Type", "application/octet-stream")}
+            return resp.status, out_headers, resp_body
+    except urllib.error.HTTPError as exc:
+        raw = exc.read()
+        out_headers = {"Content-Type": exc.headers.get("Content-Type", "application/json")}
+        return exc.code, out_headers, raw
+
+
+def handle_proxy_request(
+    handler: BaseHTTPRequestHandler,
+    path: str,
+    method: str,
+    body: bytes | None,
+    *,
+    resolve_secret: Callable[[str, str, str, str], tuple[str, str]],
+) -> bool:
+    ok, err = llm_proxy.authorize_internal_proxy(handler)
+    if not ok:
+        handler.send_response(403)
+        handler.send_header("Content-Type", "application/json")
+        handler.end_headers()
+        handler.wfile.write(json.dumps({"error": err or "internal only"}).encode())
+        return True
+
+    match = PROXY_PATH_RE.match(path)
+    if not match:
+        return False
+
+    provider = match.group(1).lower()
+    subpath = match.group(2) or "/"
+    headers = {k: v for k, v in handler.headers.items()}
+    status, out_headers, resp_body = forward_request(
+        provider,
+        subpath,
+        method,
+        headers,
+        body,
+        resolve_secret=resolve_secret,
+    )
+    handler.send_response(status)
+    for key, value in out_headers.items():
+        handler.send_header(key, value)
+    handler.end_headers()
+    handler.wfile.write(resp_body)
+    return True

package/workframe-api/auth_rate_limit.py

@@ -1,49 +1,49 @@
-"""In-process auth endpoint throttle — trust boundary (0022 N5)."""
-from __future__ import annotations
-
-import time
-from collections import deque
-
-_BUCKETS: dict[str, deque[float]] = {}
-_MINUTE_WINDOW = 60.0
-_MINUTE_MAX = 5
-_HOUR_WINDOW = 3600.0
-_HOUR_MAX = 20
-
-
-def _bucket_key(kind: str, client_ip: str, email: str) -> str:
-    return f"{kind}:{client_ip}:{email.strip().lower()}"
-
-
-def _prune(queue: deque[float], now: float, window: float) -> None:
-    while queue and now - queue[0] > window:
-        queue.popleft()
-
-
-def allow_auth_request(kind: str, client_ip: str, email: str) -> bool:
-    now = time.time()
-    key = _bucket_key(kind, client_ip, email)
-    queue = _BUCKETS.setdefault(key, deque())
-    _prune(queue, now, _HOUR_WINDOW)
-    if len(queue) >= _HOUR_MAX:
-        return False
-    recent = deque(queue)
-    _prune(recent, now, _MINUTE_WINDOW)
-    if len(recent) >= _MINUTE_MAX:
-        return False
-    queue.append(now)
-    return True
-
-
-def reset_for_tests() -> None:
-    _BUCKETS.clear()
-
-
-if __name__ == "__main__":
-    reset_for_tests()
-    ip = "203.0.113.1"
-    email = "a@example.com"
-    for _ in range(_MINUTE_MAX):
-        assert allow_auth_request("start", ip, email)
-    assert not allow_auth_request("start", ip, email)
-    print("auth_rate_limit ok")
+"""In-process auth endpoint throttle — trust boundary (0022 N5)."""
+from __future__ import annotations
+
+import time
+from collections import deque
+
+_BUCKETS: dict[str, deque[float]] = {}
+_MINUTE_WINDOW = 60.0
+_MINUTE_MAX = 5
+_HOUR_WINDOW = 3600.0
+_HOUR_MAX = 20
+
+
+def _bucket_key(kind: str, client_ip: str, email: str) -> str:
+    return f"{kind}:{client_ip}:{email.strip().lower()}"
+
+
+def _prune(queue: deque[float], now: float, window: float) -> None:
+    while queue and now - queue[0] > window:
+        queue.popleft()
+
+
+def allow_auth_request(kind: str, client_ip: str, email: str) -> bool:
+    now = time.time()
+    key = _bucket_key(kind, client_ip, email)
+    queue = _BUCKETS.setdefault(key, deque())
+    _prune(queue, now, _HOUR_WINDOW)
+    if len(queue) >= _HOUR_MAX:
+        return False
+    recent = deque(queue)
+    _prune(recent, now, _MINUTE_WINDOW)
+    if len(recent) >= _MINUTE_MAX:
+        return False
+    queue.append(now)
+    return True
+
+
+def reset_for_tests() -> None:
+    _BUCKETS.clear()
+
+
+if __name__ == "__main__":
+    reset_for_tests()
+    ip = "203.0.113.1"
+    email = "a@example.com"
+    for _ in range(_MINUTE_MAX):
+        assert allow_auth_request("start", ip, email)
+    assert not allow_auth_request("start", ip, email)
+    print("auth_rate_limit ok")