crewly 1.8.9 → 1.8.11

package/dist/backend/backend/src/services/agent/crewly-agent/audit-log.service.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Persistent Audit Log Service (SQLite)
+ *
+ * Provides durable, queryable audit logging using better-sqlite3.
+ * Replaces the append-only JSONL approach with a proper relational store
+ * that supports efficient filtering, pagination, and aggregation.
+ *
+ * Single WAL-mode database shared across all sessions. Thread-safe for
+ * the single-threaded Node.js event loop (better-sqlite3 is synchronous).
+ *
+ * @module services/agent/crewly-agent/audit-log.service
+ */
+import type { AuditEntry, AuditLogFilters, ToolSensitivity } from './types.js';
+/**
+ * Extended audit entry stored in the database.
+ * Adds an auto-incremented row ID and an action field for approval events.
+ */
+export interface AuditLogRow extends AuditEntry {
+    /** Auto-incremented row ID */
+    id: number;
+    /** Action type: 'tool_call' | 'approval_granted' | 'approval_rejected' | 'approval_expired' */
+    action: string;
+    /** Who resolved an approval (e.g. 'api', 'auditor', 'auto-expire') */
+    resolvedBy?: string;
+    /** Approval ID if this entry relates to an approval event */
+    approvalId?: string;
+}
+/**
+ * Query filters for the audit log, extending the base AuditLogFilters.
+ */
+export interface AuditLogQueryFilters extends AuditLogFilters {
+    /** Filter by session name */
+    sessionName?: string;
+    /** Filter by action type */
+    action?: string;
+    /** Filter entries after this ISO timestamp */
+    since?: string;
+    /** Filter entries before this ISO timestamp */
+    until?: string;
+    /** Offset for pagination */
+    offset?: number;
+}
+/**
+ * SQLite-backed persistent audit log service.
+ *
+ * @example
+ * ```typescript
+ * const log = new AuditLogService('/path/to/.crewly');
+ * log.initialize();
+ * log.append(auditEntry);
+ * log.logApprovalEvent('approval-123', 'session-1', 'edit_file', 'destructive', 'approved', 'api');
+ * const entries = log.query({ limit: 50, sessionName: 'session-1' });
+ * log.close();
+ * ```
+ */
+export declare class AuditLogService {
+    private db;
+    private dbPath;
+    private initialized;
+    /** Prepared statements for performance */
+    private stmtInsert;
+    private stmtInsertApproval;
+    /**
+     * Create a new AuditLogService.
+     *
+     * @param crewlyHome - Path to the .crewly directory
+     * @param dbFilename - Database filename (default: audit-log.sqlite)
+     */
+    constructor(crewlyHome: string, dbFilename?: string);
+    /**
+     * Initialize the database, creating tables if needed.
+     * Enables WAL mode for better concurrent read performance.
+     */
+    initialize(): void;
+    /**
+     * Append a tool-call audit entry.
+     *
+     * @param entry - The AuditEntry from the agent runtime
+     */
+    append(entry: AuditEntry): void;
+    /**
+     * Log an approval lifecycle event (granted, rejected, expired).
+     *
+     * @param approvalId - The approval request ID
+     * @param sessionName - Agent session name
+     * @param toolName - Tool that was approved/rejected
+     * @param sensitivity - Sensitivity classification
+     * @param action - 'approval_granted' | 'approval_rejected' | 'approval_expired'
+     * @param resolvedBy - Who resolved it
+     */
+    logApprovalEvent(approvalId: string, sessionName: string, toolName: string, sensitivity: ToolSensitivity, action: 'approval_granted' | 'approval_rejected' | 'approval_expired', resolvedBy: string): void;
+    /**
+     * Query audit log entries with filters and pagination.
+     *
+     * @param filters - Query filters
+     * @returns Array of audit log rows, most recent first
+     */
+    query(filters: AuditLogQueryFilters): AuditLogRow[];
+    /**
+     * Get total count of entries matching filters (for pagination).
+     *
+     * @param filters - Same filters as query (limit/offset ignored)
+     * @returns Total matching row count
+     */
+    count(filters?: Partial<AuditLogQueryFilters>): number;
+    /**
+     * Get the database file path.
+     *
+     * @returns Absolute path to the SQLite database
+     */
+    getDbPath(): string;
+    /**
+     * Check if the service is initialized.
+     *
+     * @returns True if initialize() has been called
+     */
+    isInitialized(): boolean;
+    /**
+     * Close the database connection.
+     * Safe to call multiple times.
+     */
+    close(): void;
+    /**
+     * Ensure the service is initialized before operations.
+     *
+     * @throws Error if not initialized
+     */
+    private ensureInitialized;
+}
+//# sourceMappingURL=audit-log.service.d.ts.map

package/dist/backend/backend/src/services/agent/crewly-agent/audit-log.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.service.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/audit-log.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAW/E;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAAkC;IAC5C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAS;IAE5B,0CAA0C;IAC1C,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,kBAAkB,CAAmC;IAE7D;;;;;OAKG;gBACS,UAAU,EAAE,MAAM,EAAE,UAAU,GAAE,MAAoB;IAKhE;;;OAGG;IACH,UAAU,IAAI,IAAI;IA8ClB;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAc/B;;;;;;;;;OASG;IACH,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,eAAe,EAC5B,MAAM,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,EACrE,UAAU,EAAE,MAAM,GACjB,IAAI;IAcP;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,WAAW,EAAE;IAiEnD;;;;;OAKG;IACH,KAAK,CAAC,OAAO,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAAG,MAAM;IAqB1D;;;;OAIG;IACH,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,aAAa,IAAI,OAAO;IAIxB;;;OAGG;IACH,KAAK,IAAI,IAAI;IAUb;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;CAK1B"}

package/dist/backend/backend/src/services/agent/crewly-agent/audit-log.service.js

@@ -0,0 +1,263 @@
+/**
+ * Persistent Audit Log Service (SQLite)
+ *
+ * Provides durable, queryable audit logging using better-sqlite3.
+ * Replaces the append-only JSONL approach with a proper relational store
+ * that supports efficient filtering, pagination, and aggregation.
+ *
+ * Single WAL-mode database shared across all sessions. Thread-safe for
+ * the single-threaded Node.js event loop (better-sqlite3 is synchronous).
+ *
+ * @module services/agent/crewly-agent/audit-log.service
+ */
+import Database from 'better-sqlite3';
+import { join } from 'path';
+import { mkdirSync } from 'fs';
+/** Default database filename */
+const DB_FILENAME = 'audit-log.sqlite';
+/** Default directory under .crewly */
+const AUDIT_DIR = 'audit-logs';
+/** Maximum rows returned by a single query */
+const MAX_QUERY_LIMIT = 10000;
+/**
+ * SQLite-backed persistent audit log service.
+ *
+ * @example
+ * ```typescript
+ * const log = new AuditLogService('/path/to/.crewly');
+ * log.initialize();
+ * log.append(auditEntry);
+ * log.logApprovalEvent('approval-123', 'session-1', 'edit_file', 'destructive', 'approved', 'api');
+ * const entries = log.query({ limit: 50, sessionName: 'session-1' });
+ * log.close();
+ * ```
+ */
+export class AuditLogService {
+    db = null;
+    dbPath;
+    initialized = false;
+    /** Prepared statements for performance */
+    stmtInsert = null;
+    stmtInsertApproval = null;
+    /**
+     * Create a new AuditLogService.
+     *
+     * @param crewlyHome - Path to the .crewly directory
+     * @param dbFilename - Database filename (default: audit-log.sqlite)
+     */
+    constructor(crewlyHome, dbFilename = DB_FILENAME) {
+        const dir = join(crewlyHome, AUDIT_DIR);
+        this.dbPath = join(dir, dbFilename);
+    }
+    /**
+     * Initialize the database, creating tables if needed.
+     * Enables WAL mode for better concurrent read performance.
+     */
+    initialize() {
+        if (this.initialized)
+            return;
+        // Ensure directory exists
+        const dir = join(this.dbPath, '..');
+        mkdirSync(dir, { recursive: true });
+        this.db = new Database(this.dbPath);
+        this.db.pragma('journal_mode = WAL');
+        this.db.pragma('foreign_keys = ON');
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS audit_log (
+        id            INTEGER PRIMARY KEY AUTOINCREMENT,
+        timestamp     TEXT    NOT NULL,
+        session_name  TEXT,
+        tool_name     TEXT    NOT NULL,
+        sensitivity   TEXT    NOT NULL,
+        args          TEXT    NOT NULL DEFAULT '{}',
+        success       INTEGER NOT NULL DEFAULT 1,
+        error         TEXT,
+        duration_ms   REAL    NOT NULL DEFAULT 0,
+        action        TEXT    NOT NULL DEFAULT 'tool_call',
+        resolved_by   TEXT,
+        approval_id   TEXT
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_log(timestamp);
+      CREATE INDEX IF NOT EXISTS idx_audit_session   ON audit_log(session_name);
+      CREATE INDEX IF NOT EXISTS idx_audit_action    ON audit_log(action);
+      CREATE INDEX IF NOT EXISTS idx_audit_tool      ON audit_log(tool_name);
+    `);
+        this.stmtInsert = this.db.prepare(`
+      INSERT INTO audit_log (timestamp, session_name, tool_name, sensitivity, args, success, error, duration_ms, action)
+      VALUES (@timestamp, @sessionName, @toolName, @sensitivity, @args, @success, @error, @durationMs, 'tool_call')
+    `);
+        this.stmtInsertApproval = this.db.prepare(`
+      INSERT INTO audit_log (timestamp, session_name, tool_name, sensitivity, args, success, duration_ms, action, resolved_by, approval_id)
+      VALUES (@timestamp, @sessionName, @toolName, @sensitivity, @args, 1, 0, @action, @resolvedBy, @approvalId)
+    `);
+        this.initialized = true;
+    }
+    /**
+     * Append a tool-call audit entry.
+     *
+     * @param entry - The AuditEntry from the agent runtime
+     */
+    append(entry) {
+        this.ensureInitialized();
+        this.stmtInsert.run({
+            timestamp: entry.timestamp,
+            sessionName: entry.sessionName ?? null,
+            toolName: entry.toolName,
+            sensitivity: entry.sensitivity,
+            args: JSON.stringify(entry.args),
+            success: entry.success ? 1 : 0,
+            error: entry.error ?? null,
+            durationMs: entry.durationMs,
+        });
+    }
+    /**
+     * Log an approval lifecycle event (granted, rejected, expired).
+     *
+     * @param approvalId - The approval request ID
+     * @param sessionName - Agent session name
+     * @param toolName - Tool that was approved/rejected
+     * @param sensitivity - Sensitivity classification
+     * @param action - 'approval_granted' | 'approval_rejected' | 'approval_expired'
+     * @param resolvedBy - Who resolved it
+     */
+    logApprovalEvent(approvalId, sessionName, toolName, sensitivity, action, resolvedBy) {
+        this.ensureInitialized();
+        this.stmtInsertApproval.run({
+            timestamp: new Date().toISOString(),
+            sessionName,
+            toolName,
+            sensitivity,
+            args: '{}',
+            action,
+            resolvedBy,
+            approvalId,
+        });
+    }
+    /**
+     * Query audit log entries with filters and pagination.
+     *
+     * @param filters - Query filters
+     * @returns Array of audit log rows, most recent first
+     */
+    query(filters) {
+        this.ensureInitialized();
+        const conditions = [];
+        const params = {};
+        if (filters.sessionName) {
+            conditions.push('session_name = @sessionName');
+            params.sessionName = filters.sessionName;
+        }
+        if (filters.sensitivity) {
+            conditions.push('sensitivity = @sensitivity');
+            params.sensitivity = filters.sensitivity;
+        }
+        if (filters.toolName) {
+            conditions.push('tool_name = @toolName');
+            params.toolName = filters.toolName;
+        }
+        if (filters.action) {
+            conditions.push('action = @action');
+            params.action = filters.action;
+        }
+        if (filters.since) {
+            conditions.push('timestamp >= @since');
+            params.since = filters.since;
+        }
+        if (filters.until) {
+            conditions.push('timestamp <= @until');
+            params.until = filters.until;
+        }
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+        const limit = Math.min(filters.limit || 100, MAX_QUERY_LIMIT);
+        const offset = filters.offset || 0;
+        const sql = `
+      SELECT id, timestamp, session_name, tool_name, sensitivity, args,
+             success, error, duration_ms, action, resolved_by, approval_id
+      FROM audit_log
+      ${where}
+      ORDER BY id DESC
+      LIMIT @limit OFFSET @offset
+    `;
+        params.limit = limit;
+        params.offset = offset;
+        const rows = this.db.prepare(sql).all(params);
+        return rows.map(row => ({
+            id: row.id,
+            timestamp: row.timestamp,
+            sessionName: row.session_name,
+            toolName: row.tool_name,
+            sensitivity: row.sensitivity,
+            args: JSON.parse(row.args || '{}'),
+            success: row.success === 1,
+            error: row.error,
+            durationMs: row.duration_ms,
+            action: row.action,
+            resolvedBy: row.resolved_by,
+            approvalId: row.approval_id,
+        }));
+    }
+    /**
+     * Get total count of entries matching filters (for pagination).
+     *
+     * @param filters - Same filters as query (limit/offset ignored)
+     * @returns Total matching row count
+     */
+    count(filters = {}) {
+        this.ensureInitialized();
+        const conditions = [];
+        const params = {};
+        if (filters.sessionName) {
+            conditions.push('session_name = @sessionName');
+            params.sessionName = filters.sessionName;
+        }
+        if (filters.action) {
+            conditions.push('action = @action');
+            params.action = filters.action;
+        }
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+        const sql = `SELECT COUNT(*) as cnt FROM audit_log ${where}`;
+        const row = this.db.prepare(sql).get(params);
+        return row.cnt;
+    }
+    /**
+     * Get the database file path.
+     *
+     * @returns Absolute path to the SQLite database
+     */
+    getDbPath() {
+        return this.dbPath;
+    }
+    /**
+     * Check if the service is initialized.
+     *
+     * @returns True if initialize() has been called
+     */
+    isInitialized() {
+        return this.initialized;
+    }
+    /**
+     * Close the database connection.
+     * Safe to call multiple times.
+     */
+    close() {
+        if (this.db) {
+            this.db.close();
+            this.db = null;
+            this.stmtInsert = null;
+            this.stmtInsertApproval = null;
+            this.initialized = false;
+        }
+    }
+    /**
+     * Ensure the service is initialized before operations.
+     *
+     * @throws Error if not initialized
+     */
+    ensureInitialized() {
+        if (!this.initialized || !this.db) {
+            throw new Error('AuditLogService not initialized. Call initialize() first.');
+        }
+    }
+}
+//# sourceMappingURL=audit-log.service.js.map

package/dist/backend/backend/src/services/agent/crewly-agent/audit-log.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.service.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/audit-log.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAG/B,gCAAgC;AAChC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAEvC,sCAAsC;AACtC,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,8CAA8C;AAC9C,MAAM,eAAe,GAAG,KAAK,CAAC;AAiC9B;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAe;IAClB,EAAE,GAA6B,IAAI,CAAC;IACpC,MAAM,CAAS;IACf,WAAW,GAAG,KAAK,CAAC;IAE5B,0CAA0C;IAClC,UAAU,GAA8B,IAAI,CAAC;IAC7C,kBAAkB,GAA8B,IAAI,CAAC;IAE7D;;;;;OAKG;IACH,YAAY,UAAkB,EAAE,aAAqB,WAAW;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;KAoBZ,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGjC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGzC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAiB;QACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,UAAW,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CACd,UAAkB,EAClB,WAAmB,EACnB,QAAgB,EAChB,WAA4B,EAC5B,MAAqE,EACrE,UAAkB;QAElB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,kBAAmB,CAAC,GAAG,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW;YACX,QAAQ;YACR,WAAW;YACX,IAAI,EAAE,IAAI;YACV,MAAM;YACN,UAAU;YACV,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAA6B;QACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC/C,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC9C,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACzC,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,GAAG;;;;QAIR,KAAK;;;KAGR,CAAC;QAEF,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAmC,CAAC;QAEjF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,SAAS,EAAE,GAAG,CAAC,SAAmB;YAClC,WAAW,EAAE,GAAG,CAAC,YAAkC;YACnD,QAAQ,EAAE,GAAG,CAAC,SAAmB;YACjC,WAAW,EAAE,GAAG,CAAC,WAA8B;YAC/C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAE,GAAG,CAAC,IAAe,IAAI,IAAI,CAAC;YAC9C,OAAO,EAAG,GAAG,CAAC,OAAkB,KAAK,CAAC;YACtC,KAAK,EAAE,GAAG,CAAC,KAA2B;YACtC,UAAU,EAAE,GAAG,CAAC,WAAqB;YACrC,MAAM,EAAE,GAAG,CAAC,MAAgB;YAC5B,UAAU,EAAE,GAAG,CAAC,WAAiC;YACjD,UAAU,EAAE,GAAG,CAAC,WAAiC;SAClD,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAyC,EAAE;QAC/C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC/C,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjC,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,yCAAyC,KAAK,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAoB,CAAC;QACjE,OAAO,GAAG,CAAC,GAAG,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Audit Trail Service
+ *
+ * Provides file-based persistence for the security audit trail.
+ * Writes audit entries as append-only JSONL (one JSON object per line)
+ * for structured, queryable audit logging.
+ *
+ * @module services/agent/crewly-agent/audit-trail.service
+ */
+import type { AuditEntry, AuditLogFilters } from './types.js';
+/**
+ * File-based audit trail service.
+ *
+ * Persists audit entries as append-only JSONL files organized by session.
+ * Each session gets its own log file for easy per-agent auditing.
+ *
+ * @example
+ * ```typescript
+ * const trail = new AuditTrailService('/path/to/.crewly', 'agent-session-1');
+ * await trail.initialize();
+ * await trail.append(auditEntry);
+ * const entries = await trail.query({ limit: 50 });
+ * ```
+ */
+export declare class AuditTrailService {
+    private crewlyHome;
+    private sessionName;
+    private logDir;
+    private logFile;
+    private initialized;
+    /**
+     * Create a new AuditTrailService.
+     *
+     * @param crewlyHome - Path to the .crewly directory
+     * @param sessionName - Agent session name for log file naming
+     */
+    constructor(crewlyHome: string, sessionName: string);
+    /**
+     * Initialize the audit trail by ensuring the log directory exists.
+     *
+     * @throws Error if directory creation fails
+     */
+    initialize(): Promise<void>;
+    /**
+     * Append an audit entry to the log file.
+     *
+     * @param entry - Audit entry to persist
+     * @throws Error if not initialized or write fails
+     */
+    append(entry: AuditEntry): Promise<void>;
+    /**
+     * Query persisted audit entries with optional filters.
+     *
+     * Reads the log file and returns matching entries in reverse
+     * chronological order (most recent first).
+     *
+     * @param filters - Query filters for limit, sensitivity, and toolName
+     * @returns Filtered audit entries
+     */
+    query(filters: AuditLogFilters): Promise<AuditEntry[]>;
+    /**
+     * Get the path to the audit log file.
+     *
+     * @returns Absolute path to the JSONL log file
+     */
+    getLogFilePath(): string;
+    /**
+     * Check if the service has been initialized.
+     *
+     * @returns True if initialize() has been called successfully
+     */
+    isInitialized(): boolean;
+}
+//# sourceMappingURL=audit-trail.service.d.ts.map

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.service.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/audit-trail.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQ9D;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAS;IAE5B;;;;;OAKG;gBACS,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAOnD;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9C;;;;;;;;OAQG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAmC5D;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;OAIG;IACH,aAAa,IAAI,OAAO;CAGzB"}

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.js

@@ -0,0 +1,140 @@
+/**
+ * Audit Trail Service
+ *
+ * Provides file-based persistence for the security audit trail.
+ * Writes audit entries as append-only JSONL (one JSON object per line)
+ * for structured, queryable audit logging.
+ *
+ * @module services/agent/crewly-agent/audit-trail.service
+ */
+import { promises as fsPromises } from 'fs';
+import { join } from 'path';
+/** Default directory name for audit logs under .crewly */
+const AUDIT_DIR = 'audit-logs';
+/** Maximum lines to read when querying the log file */
+const MAX_QUERY_LINES = 10000;
+/**
+ * File-based audit trail service.
+ *
+ * Persists audit entries as append-only JSONL files organized by session.
+ * Each session gets its own log file for easy per-agent auditing.
+ *
+ * @example
+ * ```typescript
+ * const trail = new AuditTrailService('/path/to/.crewly', 'agent-session-1');
+ * await trail.initialize();
+ * await trail.append(auditEntry);
+ * const entries = await trail.query({ limit: 50 });
+ * ```
+ */
+export class AuditTrailService {
+    crewlyHome;
+    sessionName;
+    logDir;
+    logFile;
+    initialized = false;
+    /**
+     * Create a new AuditTrailService.
+     *
+     * @param crewlyHome - Path to the .crewly directory
+     * @param sessionName - Agent session name for log file naming
+     */
+    constructor(crewlyHome, sessionName) {
+        this.crewlyHome = crewlyHome;
+        this.sessionName = sessionName;
+        this.logDir = join(crewlyHome, AUDIT_DIR);
+        this.logFile = join(this.logDir, `${sanitizeFilename(sessionName)}.jsonl`);
+    }
+    /**
+     * Initialize the audit trail by ensuring the log directory exists.
+     *
+     * @throws Error if directory creation fails
+     */
+    async initialize() {
+        await fsPromises.mkdir(this.logDir, { recursive: true });
+        this.initialized = true;
+    }
+    /**
+     * Append an audit entry to the log file.
+     *
+     * @param entry - Audit entry to persist
+     * @throws Error if not initialized or write fails
+     */
+    async append(entry) {
+        if (!this.initialized) {
+            throw new Error('AuditTrailService not initialized. Call initialize() first.');
+        }
+        const line = JSON.stringify(entry) + '\n';
+        await fsPromises.appendFile(this.logFile, line, 'utf8');
+    }
+    /**
+     * Query persisted audit entries with optional filters.
+     *
+     * Reads the log file and returns matching entries in reverse
+     * chronological order (most recent first).
+     *
+     * @param filters - Query filters for limit, sensitivity, and toolName
+     * @returns Filtered audit entries
+     */
+    async query(filters) {
+        if (!this.initialized) {
+            throw new Error('AuditTrailService not initialized. Call initialize() first.');
+        }
+        let content;
+        try {
+            content = await fsPromises.readFile(this.logFile, 'utf8');
+        }
+        catch (err) {
+            // File doesn't exist yet — no entries
+            if (err.code === 'ENOENT') {
+                return [];
+            }
+            throw err;
+        }
+        const lines = content.trim().split('\n').filter(Boolean);
+        // Parse from end (most recent first), apply filters
+        let entries = [];
+        const startIdx = Math.max(0, lines.length - MAX_QUERY_LINES);
+        for (let i = lines.length - 1; i >= startIdx && entries.length < filters.limit; i--) {
+            try {
+                const entry = JSON.parse(lines[i]);
+                if (filters.sensitivity && entry.sensitivity !== filters.sensitivity)
+                    continue;
+                if (filters.toolName && entry.toolName !== filters.toolName)
+                    continue;
+                entries.push(entry);
+            }
+            catch {
+                // Skip malformed lines
+            }
+        }
+        return entries;
+    }
+    /**
+     * Get the path to the audit log file.
+     *
+     * @returns Absolute path to the JSONL log file
+     */
+    getLogFilePath() {
+        return this.logFile;
+    }
+    /**
+     * Check if the service has been initialized.
+     *
+     * @returns True if initialize() has been called successfully
+     */
+    isInitialized() {
+        return this.initialized;
+    }
+}
+/**
+ * Sanitize a session name for use as a filename.
+ * Replaces non-alphanumeric characters (except hyphens and underscores) with hyphens.
+ *
+ * @param name - Raw session name
+ * @returns Sanitized filename-safe string
+ */
+function sanitizeFilename(name) {
+    return name.replace(/[^a-zA-Z0-9_-]/g, '-');
+}
+//# sourceMappingURL=audit-trail.service.js.map

package/dist/backend/backend/src/services/agent/crewly-agent/audit-trail.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.service.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/audit-trail.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,0DAA0D;AAC1D,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,uDAAuD;AACvD,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,WAAW,GAAG,KAAK,CAAC;IAE5B;;;;;OAKG;IACH,YAAY,UAAkB,EAAE,WAAmB;QACjD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,MAAM,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sCAAsC;YACtC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEzD,oDAAoD;QACpD,IAAI,OAAO,GAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;QAC7D,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAe,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/C,IAAI,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;oBAAE,SAAS;gBAC/E,IAAI,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;oBAAE,SAAS;gBACtE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC"}

package/dist/backend/backend/src/services/agent/crewly-agent/auditor-tools.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Crewly Auditor Tool Registry
+ *
+ * Read-only tools for the Auditor agent. These tools allow the auditor
+ * to observe agent activity, read logs, check task alignment, and write
+ * structured bug reports — without any ability to modify system state.
+ *
+ * @module services/agent/crewly-agent/auditor-tools
+ */
+import type { CrewlyApiClient } from './api-client.js';
+import type { ToolDefinition } from './types.js';
+/**
+ * Create the auditor tool set for the Crewly Auditor agent.
+ *
+ * All tools are read-only except `write_audit_report` which appends
+ * to the audit log file.
+ *
+ * @param client - API client for Crewly REST API calls
+ * @param projectPath - Project root path for file operations
+ * @returns Object of named tools for the auditor agent
+ */
+export declare function createAuditorTools(client: CrewlyApiClient, projectPath: string): Record<string, ToolDefinition>;
+/**
+ * Get the list of auditor tool names.
+ *
+ * @returns Array of auditor tool name strings
+ */
+export declare function getAuditorToolNames(): string[];
+//# sourceMappingURL=auditor-tools.d.ts.map

package/dist/backend/backend/src/services/agent/crewly-agent/auditor-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor-tools.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/agent/crewly-agent/auditor-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAwQhC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAM9C"}