crewly 1.3.30 → 1.4.0

package/dist/backend/backend/src/services/agent/crewly-agent/approval-queue.service.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Approval Queue Service
+ *
+ * Manages pending tool approval requests for the Crewly Agent runtime.
+ * When a tool requires approval (based on SecurityPolicy.requireApproval),
+ * execution is blocked and a PendingApproval entry is created. External
+ * callers (API, auditor) can then approve or reject the request.
+ *
+ * @module services/agent/crewly-agent/approval-queue.service
+ */
+import type { ToolSensitivity } from './types.js';
+/**
+ * Status of an approval request.
+ */
+export type ApprovalStatus = 'pending' | 'approved' | 'rejected' | 'expired';
+/**
+ * A single pending approval entry.
+ */
+export interface PendingApproval {
+    /** Unique approval ID */
+    id: string;
+    /** Agent session that requested the tool call */
+    sessionName: string;
+    /** Name of the tool awaiting approval */
+    toolName: string;
+    /** Sensitivity classification of the tool */
+    sensitivity: ToolSensitivity;
+    /** Sanitized arguments passed to the tool */
+    args: Record<string, unknown>;
+    /** Current status */
+    status: ApprovalStatus;
+    /** ISO timestamp when the approval was requested */
+    requestedAt: string;
+    /** ISO timestamp when the approval was resolved (approved/rejected/expired) */
+    resolvedAt?: string;
+    /** Who resolved the approval (e.g. 'api', 'auditor', 'auto-expire') */
+    resolvedBy?: string;
+    /** Reason for rejection (if rejected) */
+    reason?: string;
+}
+/**
+ * Result of resolving (approve/reject) an approval request.
+ */
+export interface ApprovalResolution {
+    /** Whether the resolution was successful */
+    success: boolean;
+    /** The resolved approval entry */
+    approval?: PendingApproval;
+    /** Error message if resolution failed */
+    error?: string;
+}
+/**
+ * In-memory approval queue for tool execution requests.
+ *
+ * Stores pending approvals and provides approve/reject operations.
+ * Approvals that exceed the TTL are automatically marked as expired
+ * when queried.
+ *
+ * @example
+ * ```typescript
+ * const queue = new ApprovalQueueService();
+ * const approval = queue.enqueue('session-1', 'edit_file', 'destructive', { path: '/foo' });
+ * // Later, approve it:
+ * const result = queue.approve(approval.id, 'api');
+ * ```
+ */
+export declare class ApprovalQueueService {
+    private static instance;
+    private approvals;
+    private idCounter;
+    private ttlMs;
+    /**
+     * Get the shared singleton instance.
+     * All agent-runners and API controllers share the same queue.
+     *
+     * @returns The shared ApprovalQueueService instance
+     */
+    static getInstance(): ApprovalQueueService;
+    /**
+     * Reset the singleton instance (for testing only).
+     */
+    static resetInstance(): void;
+    /**
+     * Create a new ApprovalQueueService.
+     *
+     * @param ttlMs - Time-to-live for pending approvals in milliseconds
+     */
+    constructor(ttlMs?: number);
+    /**
+     * Add a new approval request to the queue.
+     *
+     * @param sessionName - Agent session requesting approval
+     * @param toolName - Name of the tool
+     * @param sensitivity - Sensitivity classification
+     * @param args - Sanitized tool arguments
+     * @returns The created PendingApproval entry
+     */
+    enqueue(sessionName: string, toolName: string, sensitivity: ToolSensitivity, args: Record<string, unknown>): PendingApproval;
+    /**
+     * Approve a pending approval request.
+     *
+     * @param id - Approval ID to approve
+     * @param resolvedBy - Who is approving (e.g. 'api', 'auditor')
+     * @returns Resolution result
+     */
+    approve(id: string, resolvedBy?: string): ApprovalResolution;
+    /**
+     * Reject a pending approval request.
+     *
+     * @param id - Approval ID to reject
+     * @param resolvedBy - Who is rejecting
+     * @param reason - Reason for rejection
+     * @returns Resolution result
+     */
+    reject(id: string, resolvedBy?: string, reason?: string): ApprovalResolution;
+    /**
+     * Get all pending approval requests.
+     *
+     * @param sessionName - Optional filter by session name
+     * @returns Array of pending approvals
+     */
+    getPending(sessionName?: string): PendingApproval[];
+    /**
+     * Get a specific approval by ID.
+     *
+     * @param id - Approval ID
+     * @returns The approval entry or undefined
+     */
+    getById(id: string): PendingApproval | undefined;
+    /**
+     * Get the count of currently pending approvals.
+     *
+     * @returns Number of pending approvals
+     */
+    getPendingCount(): number;
+    /**
+     * Clear all approvals (for testing or reset).
+     */
+    clear(): void;
+    /**
+     * Resolve a pending approval with the given status.
+     *
+     * @param id - Approval ID
+     * @param status - New status
+     * @param resolvedBy - Who resolved it
+     * @param reason - Optional reason (for rejections)
+     * @returns Resolution result
+     */
+    private resolve;
+    /**
+     * Expire stale pending approvals that have exceeded the TTL.
+     */
+    private expireStale;
+    /**
+     * Get the oldest pending approval.
+     *
+     * @returns Oldest pending approval or undefined
+     */
+    private getOldestPending;
+}
+//# sourceMappingURL=approval-queue.service.d.ts.map

package/dist/backend/backend/src/services/agent/crewly-agent/approval-queue.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-queue.service.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/approval-queue.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQlD;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,WAAW,EAAE,eAAe,CAAC;IAC7B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qBAAqB;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAqC;IAC5D,OAAO,CAAC,SAAS,CAA2C;IAC5D,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,KAAK,CAAS;IAEtB;;;;;OAKG;IACH,MAAM,CAAC,WAAW,IAAI,oBAAoB;IAO1C;;OAEG;IACH,MAAM,CAAC,aAAa,IAAI,IAAI;IAI5B;;;;OAIG;gBACS,KAAK,GAAE,MAAgC;IAInD;;;;;;;;OAQG;IACH,OAAO,CACL,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,eAAe,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,eAAe;IA+BlB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,GAAE,MAAc,GAAG,kBAAkB;IAInE;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,GAAE,MAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAInF;;;;;OAKG;IACH,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE;IAWnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAMhD;;;;OAIG;IACH,eAAe,IAAI,MAAM;IAQzB;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;IA0Bf;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;CAUzB"}

package/dist/backend/backend/src/services/agent/crewly-agent/approval-queue.service.js

@@ -0,0 +1,237 @@
+/**
+ * Approval Queue Service
+ *
+ * Manages pending tool approval requests for the Crewly Agent runtime.
+ * When a tool requires approval (based on SecurityPolicy.requireApproval),
+ * execution is blocked and a PendingApproval entry is created. External
+ * callers (API, auditor) can then approve or reject the request.
+ *
+ * @module services/agent/crewly-agent/approval-queue.service
+ */
+/** Maximum number of pending approvals before oldest are auto-rejected */
+const MAX_PENDING_APPROVALS = 100;
+/** Default TTL for pending approvals in milliseconds (10 minutes) */
+const DEFAULT_APPROVAL_TTL_MS = 10 * 60 * 1000;
+/**
+ * In-memory approval queue for tool execution requests.
+ *
+ * Stores pending approvals and provides approve/reject operations.
+ * Approvals that exceed the TTL are automatically marked as expired
+ * when queried.
+ *
+ * @example
+ * ```typescript
+ * const queue = new ApprovalQueueService();
+ * const approval = queue.enqueue('session-1', 'edit_file', 'destructive', { path: '/foo' });
+ * // Later, approve it:
+ * const result = queue.approve(approval.id, 'api');
+ * ```
+ */
+export class ApprovalQueueService {
+    static instance = null;
+    approvals = new Map();
+    idCounter = 0;
+    ttlMs;
+    /**
+     * Get the shared singleton instance.
+     * All agent-runners and API controllers share the same queue.
+     *
+     * @returns The shared ApprovalQueueService instance
+     */
+    static getInstance() {
+        if (!ApprovalQueueService.instance) {
+            ApprovalQueueService.instance = new ApprovalQueueService();
+        }
+        return ApprovalQueueService.instance;
+    }
+    /**
+     * Reset the singleton instance (for testing only).
+     */
+    static resetInstance() {
+        ApprovalQueueService.instance = null;
+    }
+    /**
+     * Create a new ApprovalQueueService.
+     *
+     * @param ttlMs - Time-to-live for pending approvals in milliseconds
+     */
+    constructor(ttlMs = DEFAULT_APPROVAL_TTL_MS) {
+        this.ttlMs = ttlMs;
+    }
+    /**
+     * Add a new approval request to the queue.
+     *
+     * @param sessionName - Agent session requesting approval
+     * @param toolName - Name of the tool
+     * @param sensitivity - Sensitivity classification
+     * @param args - Sanitized tool arguments
+     * @returns The created PendingApproval entry
+     */
+    enqueue(sessionName, toolName, sensitivity, args) {
+        this.expireStale();
+        // Enforce max pending limit — reject oldest if full
+        if (this.getPendingCount() >= MAX_PENDING_APPROVALS) {
+            const oldest = this.getOldestPending();
+            if (oldest) {
+                oldest.status = 'rejected';
+                oldest.resolvedAt = new Date().toISOString();
+                oldest.resolvedBy = 'auto-overflow';
+                oldest.reason = 'Approval queue overflow — auto-rejected oldest entry';
+            }
+        }
+        this.idCounter++;
+        const id = `approval-${this.idCounter}-${Date.now()}`;
+        const approval = {
+            id,
+            sessionName,
+            toolName,
+            sensitivity,
+            args,
+            status: 'pending',
+            requestedAt: new Date().toISOString(),
+        };
+        this.approvals.set(id, approval);
+        return approval;
+    }
+    /**
+     * Approve a pending approval request.
+     *
+     * @param id - Approval ID to approve
+     * @param resolvedBy - Who is approving (e.g. 'api', 'auditor')
+     * @returns Resolution result
+     */
+    approve(id, resolvedBy = 'api') {
+        return this.resolve(id, 'approved', resolvedBy);
+    }
+    /**
+     * Reject a pending approval request.
+     *
+     * @param id - Approval ID to reject
+     * @param resolvedBy - Who is rejecting
+     * @param reason - Reason for rejection
+     * @returns Resolution result
+     */
+    reject(id, resolvedBy = 'api', reason) {
+        return this.resolve(id, 'rejected', resolvedBy, reason);
+    }
+    /**
+     * Get all pending approval requests.
+     *
+     * @param sessionName - Optional filter by session name
+     * @returns Array of pending approvals
+     */
+    getPending(sessionName) {
+        this.expireStale();
+        const pending = [];
+        for (const approval of this.approvals.values()) {
+            if (approval.status !== 'pending')
+                continue;
+            if (sessionName && approval.sessionName !== sessionName)
+                continue;
+            pending.push({ ...approval });
+        }
+        return pending;
+    }
+    /**
+     * Get a specific approval by ID.
+     *
+     * @param id - Approval ID
+     * @returns The approval entry or undefined
+     */
+    getById(id) {
+        const approval = this.approvals.get(id);
+        if (!approval)
+            return undefined;
+        return { ...approval };
+    }
+    /**
+     * Get the count of currently pending approvals.
+     *
+     * @returns Number of pending approvals
+     */
+    getPendingCount() {
+        let count = 0;
+        for (const approval of this.approvals.values()) {
+            if (approval.status === 'pending')
+                count++;
+        }
+        return count;
+    }
+    /**
+     * Clear all approvals (for testing or reset).
+     */
+    clear() {
+        this.approvals.clear();
+        this.idCounter = 0;
+    }
+    /**
+     * Resolve a pending approval with the given status.
+     *
+     * @param id - Approval ID
+     * @param status - New status
+     * @param resolvedBy - Who resolved it
+     * @param reason - Optional reason (for rejections)
+     * @returns Resolution result
+     */
+    resolve(id, status, resolvedBy, reason) {
+        const approval = this.approvals.get(id);
+        if (!approval) {
+            return { success: false, error: `Approval '${id}' not found` };
+        }
+        if (approval.status !== 'pending') {
+            return {
+                success: false,
+                error: `Approval '${id}' is already ${approval.status}`,
+                approval: { ...approval },
+            };
+        }
+        approval.status = status;
+        approval.resolvedAt = new Date().toISOString();
+        approval.resolvedBy = resolvedBy;
+        if (reason)
+            approval.reason = reason;
+        return { success: true, approval: { ...approval } };
+    }
+    /**
+     * Expire stale pending approvals that have exceeded the TTL.
+     */
+    expireStale() {
+        const now = Date.now();
+        const resolvedRetentionMs = this.ttlMs * 3; // Keep resolved entries 3x TTL then prune
+        for (const [id, approval] of this.approvals.entries()) {
+            if (approval.status === 'pending') {
+                const requestedAt = new Date(approval.requestedAt).getTime();
+                if (now - requestedAt > this.ttlMs) {
+                    approval.status = 'expired';
+                    approval.resolvedAt = new Date().toISOString();
+                    approval.resolvedBy = 'auto-expire';
+                    approval.reason = 'Approval request expired';
+                }
+            }
+            else if (approval.resolvedAt) {
+                // Prune resolved entries that are older than retention window
+                const resolvedAt = new Date(approval.resolvedAt).getTime();
+                if (now - resolvedAt > resolvedRetentionMs) {
+                    this.approvals.delete(id);
+                }
+            }
+        }
+    }
+    /**
+     * Get the oldest pending approval.
+     *
+     * @returns Oldest pending approval or undefined
+     */
+    getOldestPending() {
+        let oldest;
+        for (const approval of this.approvals.values()) {
+            if (approval.status !== 'pending')
+                continue;
+            if (!oldest || approval.requestedAt < oldest.requestedAt) {
+                oldest = approval;
+            }
+        }
+        return oldest;
+    }
+}
+//# sourceMappingURL=approval-queue.service.js.map

package/dist/backend/backend/src/services/agent/crewly-agent/approval-queue.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-queue.service.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/approval-queue.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6C/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,oBAAoB;IACvB,MAAM,CAAC,QAAQ,GAAgC,IAAI,CAAC;IACpD,SAAS,GAAiC,IAAI,GAAG,EAAE,CAAC;IACpD,SAAS,GAAG,CAAC,CAAC;IACd,KAAK,CAAS;IAEtB;;;;;OAKG;IACH,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAAC;YACnC,oBAAoB,CAAC,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,oBAAoB,CAAC,QAAQ,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa;QAClB,oBAAoB,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,YAAY,QAAgB,uBAAuB;QACjD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CACL,WAAmB,EACnB,QAAgB,EAChB,WAA4B,EAC5B,IAA6B;QAE7B,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,oDAAoD;QACpD,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,qBAAqB,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;gBAC3B,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC7C,MAAM,CAAC,UAAU,GAAG,eAAe,CAAC;gBACpC,MAAM,CAAC,MAAM,GAAG,sDAAsD,CAAC;YACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,EAAE,GAAG,YAAY,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAEtD,MAAM,QAAQ,GAAoB;YAChC,EAAE;YACF,WAAW;YACX,QAAQ;YACR,WAAW;YACX,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,EAAU,EAAE,aAAqB,KAAK;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,EAAU,EAAE,aAAqB,KAAK,EAAE,MAAe;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,WAAoB;QAC7B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC5C,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;gBAAE,SAAS;YAClE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,EAAU;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACK,OAAO,CACb,EAAU,EACV,MAA+B,EAC/B,UAAkB,EAClB,MAAe;QAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,aAAa,EAAE,gBAAgB,QAAQ,CAAC,MAAM,EAAE;gBACvD,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE;aAC1B,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;QACjC,IAAI,MAAM;YAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QAErC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,0CAA0C;QAEtF,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC7D,IAAI,GAAG,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;oBACnC,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC;oBAC5B,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAC/C,QAAQ,CAAC,UAAU,GAAG,aAAa,CAAC;oBACpC,QAAQ,CAAC,MAAM,GAAG,0BAA0B,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC/B,8DAA8D;gBAC9D,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC3D,IAAI,GAAG,GAAG,UAAU,GAAG,mBAAmB,EAAE,CAAC;oBAC3C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,gBAAgB;QACtB,IAAI,MAAmC,CAAC;QACxC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC5C,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzD,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC"}

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Audit Trail Service
+ *
+ * Provides file-based persistence for the security audit trail.
+ * Writes audit entries as append-only JSONL (one JSON object per line)
+ * for structured, queryable audit logging.
+ *
+ * @module services/agent/crewly-agent/audit-trail.service
+ */
+import type { AuditEntry, AuditLogFilters } from './types.js';
+/**
+ * File-based audit trail service.
+ *
+ * Persists audit entries as append-only JSONL files organized by session.
+ * Each session gets its own log file for easy per-agent auditing.
+ *
+ * @example
+ * ```typescript
+ * const trail = new AuditTrailService('/path/to/.crewly', 'agent-session-1');
+ * await trail.initialize();
+ * await trail.append(auditEntry);
+ * const entries = await trail.query({ limit: 50 });
+ * ```
+ */
+export declare class AuditTrailService {
+    private crewlyHome;
+    private sessionName;
+    private logDir;
+    private logFile;
+    private initialized;
+    /**
+     * Create a new AuditTrailService.
+     *
+     * @param crewlyHome - Path to the .crewly directory
+     * @param sessionName - Agent session name for log file naming
+     */
+    constructor(crewlyHome: string, sessionName: string);
+    /**
+     * Initialize the audit trail by ensuring the log directory exists.
+     *
+     * @throws Error if directory creation fails
+     */
+    initialize(): Promise<void>;
+    /**
+     * Append an audit entry to the log file.
+     *
+     * @param entry - Audit entry to persist
+     * @throws Error if not initialized or write fails
+     */
+    append(entry: AuditEntry): Promise<void>;
+    /**
+     * Query persisted audit entries with optional filters.
+     *
+     * Reads the log file and returns matching entries in reverse
+     * chronological order (most recent first).
+     *
+     * @param filters - Query filters for limit, sensitivity, and toolName
+     * @returns Filtered audit entries
+     */
+    query(filters: AuditLogFilters): Promise<AuditEntry[]>;
+    /**
+     * Get the path to the audit log file.
+     *
+     * @returns Absolute path to the JSONL log file
+     */
+    getLogFilePath(): string;
+    /**
+     * Check if the service has been initialized.
+     *
+     * @returns True if initialize() has been called successfully
+     */
+    isInitialized(): boolean;
+}
+//# sourceMappingURL=audit-trail.service.d.ts.map

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.service.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/audit-trail.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQ9D;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAS;IAE5B;;;;;OAKG;gBACS,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAOnD;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9C;;;;;;;;OAQG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAmC5D;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;OAIG;IACH,aAAa,IAAI,OAAO;CAGzB"}

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.js

@@ -0,0 +1,140 @@
+/**
+ * Audit Trail Service
+ *
+ * Provides file-based persistence for the security audit trail.
+ * Writes audit entries as append-only JSONL (one JSON object per line)
+ * for structured, queryable audit logging.
+ *
+ * @module services/agent/crewly-agent/audit-trail.service
+ */
+import { promises as fsPromises } from 'fs';
+import { join } from 'path';
+/** Default directory name for audit logs under .crewly */
+const AUDIT_DIR = 'audit-logs';
+/** Maximum lines to read when querying the log file */
+const MAX_QUERY_LINES = 10000;
+/**
+ * File-based audit trail service.
+ *
+ * Persists audit entries as append-only JSONL files organized by session.
+ * Each session gets its own log file for easy per-agent auditing.
+ *
+ * @example
+ * ```typescript
+ * const trail = new AuditTrailService('/path/to/.crewly', 'agent-session-1');
+ * await trail.initialize();
+ * await trail.append(auditEntry);
+ * const entries = await trail.query({ limit: 50 });
+ * ```
+ */
+export class AuditTrailService {
+    crewlyHome;
+    sessionName;
+    logDir;
+    logFile;
+    initialized = false;
+    /**
+     * Create a new AuditTrailService.
+     *
+     * @param crewlyHome - Path to the .crewly directory
+     * @param sessionName - Agent session name for log file naming
+     */
+    constructor(crewlyHome, sessionName) {
+        this.crewlyHome = crewlyHome;
+        this.sessionName = sessionName;
+        this.logDir = join(crewlyHome, AUDIT_DIR);
+        this.logFile = join(this.logDir, `${sanitizeFilename(sessionName)}.jsonl`);
+    }
+    /**
+     * Initialize the audit trail by ensuring the log directory exists.
+     *
+     * @throws Error if directory creation fails
+     */
+    async initialize() {
+        await fsPromises.mkdir(this.logDir, { recursive: true });
+        this.initialized = true;
+    }
+    /**
+     * Append an audit entry to the log file.
+     *
+     * @param entry - Audit entry to persist
+     * @throws Error if not initialized or write fails
+     */
+    async append(entry) {
+        if (!this.initialized) {
+            throw new Error('AuditTrailService not initialized. Call initialize() first.');
+        }
+        const line = JSON.stringify(entry) + '\n';
+        await fsPromises.appendFile(this.logFile, line, 'utf8');
+    }
+    /**
+     * Query persisted audit entries with optional filters.
+     *
+     * Reads the log file and returns matching entries in reverse
+     * chronological order (most recent first).
+     *
+     * @param filters - Query filters for limit, sensitivity, and toolName
+     * @returns Filtered audit entries
+     */
+    async query(filters) {
+        if (!this.initialized) {
+            throw new Error('AuditTrailService not initialized. Call initialize() first.');
+        }
+        let content;
+        try {
+            content = await fsPromises.readFile(this.logFile, 'utf8');
+        }
+        catch (err) {
+            // File doesn't exist yet — no entries
+            if (err.code === 'ENOENT') {
+                return [];
+            }
+            throw err;
+        }
+        const lines = content.trim().split('\n').filter(Boolean);
+        // Parse from end (most recent first), apply filters
+        let entries = [];
+        const startIdx = Math.max(0, lines.length - MAX_QUERY_LINES);
+        for (let i = lines.length - 1; i >= startIdx && entries.length < filters.limit; i--) {
+            try {
+                const entry = JSON.parse(lines[i]);
+                if (filters.sensitivity && entry.sensitivity !== filters.sensitivity)
+                    continue;
+                if (filters.toolName && entry.toolName !== filters.toolName)
+                    continue;
+                entries.push(entry);
+            }
+            catch {
+                // Skip malformed lines
+            }
+        }
+        return entries;
+    }
+    /**
+     * Get the path to the audit log file.
+     *
+     * @returns Absolute path to the JSONL log file
+     */
+    getLogFilePath() {
+        return this.logFile;
+    }
+    /**
+     * Check if the service has been initialized.
+     *
+     * @returns True if initialize() has been called successfully
+     */
+    isInitialized() {
+        return this.initialized;
+    }
+}
+/**
+ * Sanitize a session name for use as a filename.
+ * Replaces non-alphanumeric characters (except hyphens and underscores) with hyphens.
+ *
+ * @param name - Raw session name
+ * @returns Sanitized filename-safe string
+ */
+function sanitizeFilename(name) {
+    return name.replace(/[^a-zA-Z0-9_-]/g, '-');
+}
+//# sourceMappingURL=audit-trail.service.js.map

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.service.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/audit-trail.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,0DAA0D;AAC1D,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,uDAAuD;AACvD,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,WAAW,GAAG,KAAK,CAAC;IAE5B;;;;;OAKG;IACH,YAAY,UAAkB,EAAE,WAAmB;QACjD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,MAAM,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sCAAsC;YACtC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEzD,oDAAoD;QACpD,IAAI,OAAO,GAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;QAC7D,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAe,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/C,IAAI,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;oBAAE,SAAS;gBAC/E,IAAI,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;oBAAE,SAAS;gBACtE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC"}

package/dist/backend/backend/src/services/agent/crewly-agent/auditor-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditor-tools.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/auditor-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CA4MhC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAM9C"}
+{"version":3,"file":"auditor-tools.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/auditor-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAsQhC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAM9C"}