crewx 0.8.0-rc.82 → 0.8.0-rc.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewx",
-  "version": "0.8.0-rc.82",
+  "version": "0.8.0-rc.83",
   "description": "CrewX — AI agent team dashboard with Electron UI and CLI (Web + Electron + Global CLI)",
   "main": "server.js",
   "bin": {
@@ -92,16 +92,16 @@
     "yargs": "^17.7.0",
     "zod": "^3.22.0",
     "zustand": "^4.5.0",
-    "@crewx/cli": "0.8.0-rc.82",
-    "@crewx/cron": "0.1.6",
+    "@crewx/cli": "0.8.0-rc.83",
     "@crewx/doc": "0.1.6",
-    "@crewx/sdk": "0.8.0-rc.82",
+    "@crewx/cron": "0.1.6",
+    "@crewx/sdk": "0.8.0-rc.83",
     "@crewx/memory": "0.1.8",
     "@crewx/search": "0.1.6",
-    "@crewx/shared": "0.0.4",
-    "@crewx/wbs": "0.1.7",
+    "@crewx/skill": "0.1.5",
     "@crewx/workflow": "0.3.6",
-    "@crewx/skill": "0.1.5"
+    "@crewx/wbs": "0.1.7",
+    "@crewx/shared": "0.0.4"
   },
   "devDependencies": {
     "@nestjs/cli": "^11.0.16",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewx/cli",
-  "version": "0.8.0-rc.82",
+  "version": "0.8.0-rc.83",
   "license": "UNLICENSED",
   "engines": {
     "node": ">=20.19.0"

package/dist-server/packages/sdk/src/adapter/context-builder.js

@@ -1,86 +0,0 @@
-"use strict";
-/**
- * createAdapterContext — builds an AdapterContext for an adapter instance.
- *
- * M1: respondSync uses AsyncLocalStorage to bind the current HTTP response.
- * When called inside a registerRoute handler (sync window), respondSync writes
- * to the HTTP res. When called outside the sync window, it performs graceful
- * degradation: logs a warning instead of throwing (PoC correction #3).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSyncWindowStore = getSyncWindowStore;
-exports.runInSyncWindow = runInSyncWindow;
-exports.createAdapterContext = createAdapterContext;
-const async_hooks_1 = require("async_hooks");
-const syncWindowStore = new async_hooks_1.AsyncLocalStorage();
-function getSyncWindowStore() {
-    return syncWindowStore;
-}
-function runInSyncWindow(window, fn) {
-    return syncWindowStore.run(window, fn);
-}
-function createAdapterContext(opts) {
-    const log = opts.log ?? opts.logger ?? {
-        debug: () => { },
-        info: () => { },
-        warn: () => { },
-        error: () => { },
-    };
-    const agentRunner = opts.agentRunner ?? {
-        run: async () => ({ output: '' }),
-    };
-    const db = opts.db ?? {
-        get: async () => undefined,
-        set: async () => { },
-        delete: async () => false,
-        list: async () => [],
-    };
-    const storage = opts.storage ?? {
-        put: async () => '',
-        get: async () => undefined,
-        delete: async () => false,
-    };
-    const audit = opts.audit ?? {
-        log: async () => { },
-    };
-    const inbound = opts.onInbound ?? (async () => ({ accepted: true }));
-    const emitEventFn = opts.onEmitEvent ?? (async () => ({ accepted: true }));
-    const updateMessage = opts.onUpdateMessage ?? (async () => { });
-    const resolveUser = opts.onResolveUser ?? (async (userId) => ({
-        userId,
-        displayName: userId,
-    }));
-    const respondSync = async (payload) => {
-        const window = syncWindowStore.getStore();
-        if (!window) {
-            log.warn('respondSync called outside sync window — graceful degradation (no-op)', {
-                textPreview: typeof payload === 'object' && 'text' in payload ? payload.text.slice(0, 80) : undefined,
-            });
-            return;
-        }
-        const text = 'text' in payload ? payload.text : '';
-        window.res.status(200).json({ text });
-    };
-    const httpRouter = opts.httpRouter ?? {
-        registerRoute: () => {
-            log.warn('httpRouter not configured — registerRoute is a no-op');
-        },
-    };
-    return {
-        instanceId: opts.instanceId,
-        config: opts.config,
-        capabilities: opts.capabilities,
-        log,
-        agentRunner,
-        db,
-        storage,
-        audit,
-        abortSignal: opts.abortSignal ?? new AbortController().signal,
-        httpRouter,
-        inbound,
-        emitEvent: emitEventFn,
-        updateMessage,
-        resolveUser,
-        respondSync,
-    };
-}

package/dist-server/packages/sdk/src/adapter/scoped-store.js

@@ -1,42 +0,0 @@
-"use strict";
-/**
- * ScopedAdapterStore — adapter key-value store with mandatory instanceId prefix.
- *
- * Security: Uses Map closure pattern (RT-1 defense).
- * The internal Map is captured in a function closure — no public or private
- * property on the returned AdapterStore object holds the raw Map reference.
- * Reflect / Object.getPrototypeOf / (ctx.db as any)['_rawStore'] all fail
- * because the Map only exists in the createScopedAdapterStore function scope.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createScopedAdapterStore = createScopedAdapterStore;
-function createScopedAdapterStore(instanceId) {
-    const store = new Map();
-    const prefixKey = (key) => {
-        if (key.startsWith(`${instanceId}::`))
-            return key;
-        return `${instanceId}::${key}`;
-    };
-    return {
-        async get(key) {
-            const entry = store.get(prefixKey(key));
-            return entry ? entry.value : undefined;
-        },
-        async set(key, value) {
-            store.set(prefixKey(key), { value });
-        },
-        async delete(key) {
-            return store.delete(prefixKey(key));
-        },
-        async list(prefix) {
-            const fullPrefix = prefix ? prefixKey(prefix) : `${instanceId}::`;
-            const keys = [];
-            for (const k of store.keys()) {
-                if (k.startsWith(fullPrefix)) {
-                    keys.push(k.slice(instanceId.length + 2));
-                }
-            }
-            return keys;
-        },
-    };
-}

package/dist-server/packages/sdk/src/adapter/types.js

@@ -1,22 +0,0 @@
-"use strict";
-/**
- * Adapter Platform v0.4 — core types.
- * PoC corrections applied:
- *   1. AdapterError: class only (interface removed)
- *   2. kind: added 'config' for configuration errors
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AdapterError = void 0;
-class AdapterError extends Error {
-    code;
-    kind;
-    retryAfterMs;
-    constructor(code, kind, retryAfterMs) {
-        super(`AdapterError: ${code}`);
-        this.name = 'AdapterError';
-        this.code = code;
-        this.kind = kind;
-        this.retryAfterMs = retryAfterMs;
-    }
-}
-exports.AdapterError = AdapterError;

package/dist-server/packages/sdk/src/agent/resolver.js

@@ -1,45 +0,0 @@
-"use strict";
-/**
- * Agent resolver: looks up an agent from a list by ref.
- * Supports both bare id ('claude') and @mention format ('@claude').
- * Falls back to built-in provider shorthands (claude, gemini, copilot, codex).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentNotFoundError = void 0;
-exports.resolveAgent = resolveAgent;
-class AgentNotFoundError extends Error {
-    constructor(agentRef, availableIds) {
-        const available = availableIds.length > 0
-            ? ` Available: ${availableIds.join(', ')}`
-            : '';
-        super(`Agent not found: "${agentRef}".${available}`);
-        this.name = 'AgentNotFoundError';
-    }
-}
-exports.AgentNotFoundError = AgentNotFoundError;
-/** Built-in provider shorthands that can be used without a crewx.yaml entry. */
-const BUILTIN_PROVIDERS = {
-    claude: { id: 'claude', provider: 'cli/claude' },
-    gemini: { id: 'gemini', provider: 'cli/gemini' },
-    copilot: { id: 'copilot', provider: 'cli/copilot' },
-    codex: { id: 'codex', provider: 'cli/codex' },
-};
-/**
- * Resolve an agent by reference.
- * @param agentRef - Agent reference: '@claude', 'claude', '@my_agent', etc.
- * @param agents   - List of available agent configs.
- * @returns The matching AgentConfig.
- * @throws AgentNotFoundError when no match is found.
- */
-function resolveAgent(agentRef, agents) {
-    const agentId = agentRef.startsWith('@') ? agentRef.slice(1) : agentRef;
-    // 1. Look in YAML-defined agents first
-    const agent = agents.find(a => a.id === agentId);
-    if (agent)
-        return agent;
-    // 2. Fall back to built-in provider shorthands
-    const builtin = BUILTIN_PROVIDERS[agentId];
-    if (builtin)
-        return builtin;
-    throw new AgentNotFoundError(agentRef, agents.map(a => a.id));
-}

package/dist-server/packages/sdk/src/config/loader.js

@@ -1,94 +0,0 @@
-"use strict";
-/**
- * YAML configuration loader for CrewX projects.
- * Reads crewx.yaml and validates it with Zod schema.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigLoadError = void 0;
-exports.parseYamlContent = parseYamlContent;
-exports.loadYamlFile = loadYamlFile;
-const js_yaml_1 = require("js-yaml");
-const fs_1 = require("fs");
-const types_1 = require("../types");
-class ConfigLoadError extends Error {
-    cause;
-    constructor(message, cause) {
-        super(message);
-        this.cause = cause;
-        this.name = 'ConfigLoadError';
-    }
-}
-exports.ConfigLoadError = ConfigLoadError;
-/**
- * Parse YAML string into a validated CrewxProjectConfig.
- * Converts the agents record (keyed by id) into an array.
- */
-function parseYamlContent(yamlString) {
-    if (!yamlString || typeof yamlString !== 'string' || !yamlString.trim()) {
-        throw new ConfigLoadError('YAML content must be a non-empty string');
-    }
-    let raw;
-    try {
-        raw = (0, js_yaml_1.load)(yamlString);
-    }
-    catch (err) {
-        throw new ConfigLoadError(`YAML parse error: ${err.message}`, err);
-    }
-    // Normalize agents: YAML has agents as a map (Record<id, config>),
-    // but our type uses an array with 'id' field.
-    const normalized = normalizeRaw(raw);
-    const result = types_1.CrewxProjectConfigSchema.safeParse(normalized);
-    if (!result.success) {
-        throw new ConfigLoadError(`Config validation error: ${result.error.message}`);
-    }
-    return result.data;
-}
-/**
- * Load and parse crewx.yaml from a file path.
- */
-function loadYamlFile(filePath) {
-    let content;
-    try {
-        content = (0, fs_1.readFileSync)(filePath, 'utf-8');
-    }
-    catch (err) {
-        throw new ConfigLoadError(`Cannot read file: ${filePath}`, err);
-    }
-    return parseYamlContent(content);
-}
-/**
- * Normalize raw YAML output:
- * - agents map (Record<id, agentConfig>) → agents array ([{ id, ...agentConfig }])
- */
-function normalizeRaw(raw) {
-    if (!raw || typeof raw !== 'object') {
-        return { agents: [] };
-    }
-    const obj = raw;
-    // Gather agents as array (support map form and array form)
-    let agentsArray;
-    if (obj.agents && typeof obj.agents === 'object' && !Array.isArray(obj.agents)) {
-        const agentsMap = obj.agents;
-        agentsArray = Object.entries(agentsMap).map(([id, cfg]) => {
-            const agentCfg = (cfg && typeof cfg === 'object' ? cfg : {});
-            return { id, ...agentCfg };
-        });
-    }
-    else if (Array.isArray(obj.agents)) {
-        agentsArray = obj.agents;
-    }
-    else {
-        return { ...obj, agents: [] };
-    }
-    // Normalize inline.provider → top-level provider (fallback for cross-repo yaml compat)
-    const normalizedAgents = agentsArray.map(agent => {
-        if (agent.provider === undefined && agent.inline && typeof agent.inline === 'object') {
-            const inline = agent.inline;
-            if (inline.provider !== undefined) {
-                return { ...agent, provider: inline.provider };
-            }
-        }
-        return agent;
-    });
-    return { ...obj, agents: normalizedAgents };
-}

package/dist-server/packages/sdk/src/conversation/sqlite-provider.js

@@ -1,177 +0,0 @@
-"use strict";
-/**
- * SqliteConversationProvider — reads/writes conversation history from ~/.crewx/crewx.db.
- *
- * Security:
- * - SEC-1: SELECT columns are explicitly whitelisted (no rendered_prompt, command, logs, metadata).
- * - SEC-2: All queries use parameterized bindings (? placeholders).
- * - Writes target `threads` table ONLY — `tasks` table writes are owned by SqliteTracingPlugin.
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SqliteConversationProvider = void 0;
-const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
-const path_1 = require("path");
-const os_1 = require("os");
-const THREADS_DDL = `
-  CREATE TABLE IF NOT EXISTS threads (
-    id TEXT PRIMARY KEY,
-    workspace_id TEXT,
-    platform TEXT NOT NULL DEFAULT 'cli',
-    title TEXT,
-    first_message TEXT,
-    last_message TEXT,
-    message_count INTEGER NOT NULL DEFAULT 0,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL,
-    metadata TEXT
-  )
-`;
-const COLUMNS = [
-    'id', 'thread_id', 'prompt', 'result', 'started_at',
-    'trace_id', 'status', 'parent_task_id', 'agent_id',
-];
-function stripCliNoise(content) {
-    let cleaned = content.replace(/<conversation_history[^>]*>[\s\S]*?<\/conversation_history>/g, '');
-    const lines = cleaned.split('\n');
-    const cleanLines = lines.filter(line => {
-        if (line.startsWith('Loaded ') && line.includes('layouts from'))
-            return false;
-        if (line.includes('[dotenv@'))
-            return false;
-        if (line.includes('[Nest]') && line.includes('DEBUG'))
-            return false;
-        if (line.startsWith('Registered custom layout:'))
-            return false;
-        if (line.startsWith('Updated custom layout:'))
-            return false;
-        return true;
-    });
-    return cleanLines.join('\n').trim();
-}
-function cleanResult(raw) {
-    if (!raw)
-        return '';
-    let content = raw;
-    try {
-        const parsed = JSON.parse(content);
-        if (Array.isArray(parsed)) {
-            content = parsed
-                .filter((c) => c?.type === 'text' && c?.text)
-                .map((c) => c.text)
-                .join('\n');
-        }
-        else if (parsed && typeof parsed === 'object' && parsed.result !== undefined) {
-            content = parsed.result || '';
-        }
-    }
-    catch {
-        content = stripCliNoise(content);
-    }
-    return content;
-}
-class SqliteConversationProvider {
-    db;
-    constructor(dbPath) {
-        const resolved = dbPath ?? (0, path_1.join)((0, os_1.homedir)(), '.crewx', 'crewx.db');
-        this.db = new better_sqlite3_1.default(resolved);
-        this.init();
-    }
-    init() {
-        this.db.pragma('journal_mode = WAL');
-        this.db.exec(THREADS_DDL);
-    }
-    async ensureThread(threadId, platform, workspaceId) {
-        const row = this.db.prepare('SELECT platform FROM threads WHERE id = ?').get(threadId);
-        if (row) {
-            if (row.platform !== platform) {
-                throw new Error(`Thread '${threadId}' already exists with platform '${row.platform}' — cannot change to '${platform}' (platform is immutable)`);
-            }
-            // Backfill workspace_id if missing on existing thread (WI-CONV-003)
-            if (workspaceId) {
-                this.db.prepare('UPDATE threads SET workspace_id = COALESCE(workspace_id, ?) WHERE id = ?').run(workspaceId, threadId);
-            }
-            return;
-        }
-        const now = new Date().toISOString();
-        this.db.prepare('INSERT INTO threads (id, platform, workspace_id, message_count, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)').run(threadId, platform, workspaceId ?? null, now, now);
-    }
-    async fetchHistory(threadId, options) {
-        const limit = options?.limit ?? 100;
-        const conditions = [
-            'thread_id = ?',
-            '(parent_task_id IS NULL OR parent_task_id = \'\')',
-            '(status IN (\'done\', \'completed\', \'success\') OR status IS NULL)',
-        ];
-        const params = [threadId];
-        if (options?.currentTraceId) {
-            conditions.push('trace_id != ?');
-            params.push(options.currentTraceId);
-        }
-        const where = conditions.join(' AND ');
-        const selectCols = COLUMNS.join(', ');
-        const sql = `SELECT ${selectCols} FROM tasks WHERE ${where} ORDER BY started_at ASC LIMIT ?`;
-        params.push(limit);
-        const rows = this.db.prepare(sql).all(...params);
-        const threadRow = this.db.prepare('SELECT platform, title, first_message, last_message, message_count, updated_at FROM threads WHERE id = ?').get(threadId);
-        const platform = threadRow?.platform ?? 'cli';
-        const messages = this.rowsToMessages(rows);
-        return {
-            threadId,
-            platform: platform,
-            messages,
-            metadata: {
-                title: threadRow?.title ?? undefined,
-                firstMessage: threadRow?.first_message ?? undefined,
-                lastMessage: threadRow?.last_message ?? undefined,
-                messageCount: threadRow?.message_count ?? 0,
-                updatedAt: threadRow?.updated_at ? new Date(threadRow.updated_at).getTime() : undefined,
-            },
-        };
-    }
-    async saveUserMessage(threadId, text, _userId, _metadata) {
-        const now = new Date().toISOString();
-        this.db.prepare(`UPDATE threads
-       SET first_message = COALESCE(first_message, ?),
-           last_message = ?,
-           message_count = message_count + 1,
-           updated_at = ?
-       WHERE id = ?`).run(text, text, now, threadId);
-    }
-    async saveAssistantMessage(threadId, text, _agentId, _metadata) {
-        const now = new Date().toISOString();
-        this.db.prepare(`UPDATE threads
-       SET last_message = ?,
-           updated_at = ?
-       WHERE id = ?`).run(text, now, threadId);
-    }
-    close() {
-        this.db.close();
-    }
-    rowsToMessages(rows) {
-        const messages = [];
-        for (const row of rows) {
-            if (row.prompt) {
-                messages.push({
-                    id: `${row.id}-user`,
-                    text: row.prompt,
-                    isAssistant: false,
-                    timestamp: new Date(row.started_at).getTime(),
-                });
-            }
-            const cleaned = cleanResult(row.result);
-            if (cleaned) {
-                messages.push({
-                    id: `${row.id}-assistant`,
-                    text: cleaned,
-                    isAssistant: true,
-                    timestamp: new Date(row.started_at).getTime(),
-                });
-            }
-        }
-        return messages;
-    }
-}
-exports.SqliteConversationProvider = SqliteConversationProvider;

package/dist-server/packages/sdk/src/conversation/to-template-messages.js

@@ -1,33 +0,0 @@
-"use strict";
-/**
- * toTemplateMessages — maps ConversationThread messages to TemplateMessage[]
- * for consumption by the formatConversation block helper.
- *
- * Includes SEC-M1 sanitization at the provider boundary:
- * <, > are entity-escaped to prevent XML structure tag injection in the
- * <conversation_history> block.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.toTemplateMessages = toTemplateMessages;
-/**
- * SEC-M1: sanitize message text to prevent conversation_history XML block pollution.
- * User input containing </conversation_history> or <system_prompt> could be
- * misinterpreted by the LLM as breaking out of the structured block.
- */
-function sanitizeMessageText(text) {
-    if (typeof text !== 'string')
-        return '';
-    return text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
-/**
- * Convert a ConversationThread to a TemplateMessage array suitable for
- * formatConversation block helper consumption.
- */
-function toTemplateMessages(thread) {
-    return thread.messages.map(m => ({
-        text: sanitizeMessageText(m.text),
-        isAssistant: m.isAssistant,
-        metadata: m.metadata,
-        files: undefined,
-    }));
-}

package/dist-server/packages/sdk/src/conversation/types.js

@@ -1,9 +0,0 @@
-"use strict";
-/**
- * Conversation history types — SDK public API for reading/writing thread history.
- *
- * **Security (SEC-3):** history content is untrusted user input.
- * Consumers (e.g. Phase 2 CLI wiring) MUST delimit history from system prompts
- * using structured blocks (e.g. `[HISTORY START]...[HISTORY END]`).
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist-server/packages/sdk/src/events/TypedEventEmitter.js

@@ -1,64 +0,0 @@
-"use strict";
-/**
- * TypedEventEmitter — typed wrapper around Node's EventEmitter.
- *
- * Design:
- * - `on` / `once` are public (callers subscribe)
- * - `emit` is protected (only subclasses like Crewx can emit)
- * - Async listeners are supported (fire-and-forget, errors isolated)
- * - Returns an UnsubscribeFn from on/once for easy cleanup
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TypedEventEmitter = void 0;
-const events_1 = require("events");
-/**
- * Wraps a listener to isolate errors and support async fire-and-forget.
- */
-function makeSafeListener(event, listener) {
-    return (payload) => {
-        try {
-            const result = listener(payload);
-            if (result instanceof Promise) {
-                result.catch((err) => {
-                    // Fire-and-forget: isolate async listener errors
-                    console.error(`[crewx] event listener error (${event}): ${err instanceof Error ? err.message : String(err)}`);
-                });
-            }
-        }
-        catch (err) {
-            // Synchronous listener error — log and continue
-            console.error(`[crewx] event listener error (${event}): ${err instanceof Error ? err.message : String(err)}`);
-        }
-    };
-}
-class TypedEventEmitter {
-    _emitter = new events_1.EventEmitter();
-    /**
-     * Subscribe to an event. Returns an unsubscribe function.
-     *
-     * @example
-     * const unsub = crewx.on('task:start', (e) => console.log(e.agentRef));
-     * // later:
-     * unsub();
-     */
-    on(event, listener) {
-        const safeListener = makeSafeListener(event, listener);
-        this._emitter.on(event, safeListener);
-        return () => this._emitter.off(event, safeListener);
-    }
-    /**
-     * Subscribe to an event exactly once.
-     */
-    once(event, listener) {
-        const safeListener = makeSafeListener(event, listener);
-        this._emitter.once(event, safeListener);
-        return () => this._emitter.off(event, safeListener);
-    }
-    /**
-     * Emit an event with payload. Only accessible to subclasses.
-     */
-    emit(event, payload) {
-        this._emitter.emit(event, payload);
-    }
-}
-exports.TypedEventEmitter = TypedEventEmitter;

package/dist-server/packages/sdk/src/events/types.js

@@ -1,8 +0,0 @@
-"use strict";
-/**
- * Event types for the CrewX SDK event system.
- *
- * SDK emits events; callers (CLI, users) subscribe to persist or react.
- * No DB dependencies in the SDK — storage is the caller's responsibility.
- */
-Object.defineProperty(exports, "__esModule", { value: true });