crewx 0.8.1 → 0.8.2-rc.2

package/dist-server/repository/thread.repository.js

@@ -29,12 +29,12 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
                     ? `WHERE (workspace_id = ? OR workspace_id IS NULL)`
                     : '';
                 const queryParams = workspaceId ? [workspaceId] : [];
-                const fetched = db.all(`
-          SELECT id, workspace_id, platform, title, first_message, last_message,
-                 message_count, created_at, updated_at, metadata
-          FROM threads
-          ${whereClause}
-          ORDER BY updated_at DESC
+                const fetched = db.all(`
+          SELECT id, workspace_id, platform, title, first_message, last_message,
+                 message_count, created_at, updated_at, metadata
+          FROM threads
+          ${whereClause}
+          ORDER BY updated_at DESC
         `, queryParams);
                 for (const row of fetched) {
                     if (!seenIds.has(row.id)) {
@@ -66,10 +66,10 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
                     continue;
                 const wsFilter = workspaceId ? ` AND (workspace_id = ? OR workspace_id IS NULL)` : '';
                 const params = workspaceId ? [threadId, workspaceId] : [threadId];
-                const row = db.get(`
-          SELECT id, workspace_id, platform, title, first_message, last_message,
-                 message_count, created_at, updated_at, metadata
-          FROM threads WHERE id = ?${wsFilter}
+                const row = db.get(`
+          SELECT id, workspace_id, platform, title, first_message, last_message,
+                 message_count, created_at, updated_at, metadata
+          FROM threads WHERE id = ?${wsFilter}
         `, params);
                 if (row)
                     return row;
@@ -129,22 +129,22 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
                     continue;
                 const wsFilter = workspaceId ? ` AND workspace_id = ?` : '';
                 const statsParams = workspaceId ? [threadId, workspaceId] : [threadId];
-                const stats = db.get(`
-          SELECT COUNT(*) as cnt,
-                 COALESCE(SUM(input_tokens), 0) as total_input,
-                 COALESCE(SUM(output_tokens), 0) as total_output,
-                 COALESCE(SUM(cost_usd), 0) as total_cost
-          FROM tasks
-          WHERE thread_id = ? AND (parent_task_id IS NULL OR parent_task_id = '')${wsFilter}
+                const stats = db.get(`
+          SELECT COUNT(*) as cnt,
+                 COALESCE(SUM(input_tokens), 0) as total_input,
+                 COALESCE(SUM(output_tokens), 0) as total_output,
+                 COALESCE(SUM(cost_usd), 0) as total_cost
+          FROM tasks
+          WHERE thread_id = ? AND (parent_task_id IS NULL OR parent_task_id = '')${wsFilter}
         `, statsParams);
                 taskCount += stats.cnt;
                 inputTokens += stats.total_input;
                 outputTokens += stats.total_output;
                 costUsd += stats.total_cost;
-                const agentRows = db.all(`
-          SELECT DISTINCT agent_id FROM tasks
-          WHERE thread_id = ? AND agent_id IS NOT NULL AND agent_id != ''
-            AND (parent_task_id IS NULL OR parent_task_id = '')${wsFilter}
+                const agentRows = db.all(`
+          SELECT DISTINCT agent_id FROM tasks
+          WHERE thread_id = ? AND agent_id IS NOT NULL AND agent_id != ''
+            AND (parent_task_id IS NULL OR parent_task_id = '')${wsFilter}
         `, statsParams);
                 for (const row of agentRows) {
                     agents.add(row.agent_id);
@@ -175,13 +175,13 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
                     continue;
                 const wsFilter = workspaceId ? ` AND workspace_id = ?` : '';
                 const taskParams = workspaceId ? [threadId, workspaceId] : [threadId];
-                const tasks = db.all(`
-          SELECT id, agent_id, prompt, result, status, started_at, completed_at,
-                 duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
-                 error, parent_task_id, caller_agent_id
-          FROM tasks
-          WHERE thread_id = ? AND (parent_task_id IS NULL OR parent_task_id = '')${wsFilter}
-          ORDER BY started_at ASC
+                const tasks = db.all(`
+          SELECT id, agent_id, prompt, result, status, started_at, completed_at,
+                 duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
+                 error, parent_task_id, caller_agent_id
+          FROM tasks
+          WHERE thread_id = ? AND (parent_task_id IS NULL OR parent_task_id = '')${wsFilter}
+          ORDER BY started_at ASC
         `, taskParams);
                 for (const t of tasks) {
                     if (!seenIds.has(t.id)) {
@@ -215,12 +215,12 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
                     continue;
                 const wsFilter = workspaceId ? ` AND workspace_id = ?` : '';
                 const taskParams = workspaceId ? [threadId, workspaceId] : [threadId];
-                const tasks = db.all(`
-          SELECT id, agent_id, prompt, result, status, started_at, completed_at,
-                 duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
-                 error, parent_task_id, caller_agent_id
-          FROM tasks WHERE thread_id = ?${wsFilter}
-          ORDER BY started_at ASC
+                const tasks = db.all(`
+          SELECT id, agent_id, prompt, result, status, started_at, completed_at,
+                 duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
+                 error, parent_task_id, caller_agent_id
+          FROM tasks WHERE thread_id = ?${wsFilter}
+          ORDER BY started_at ASC
         `, taskParams);
                 for (const t of tasks) {
                     if (!seenIds.has(t.id)) {
@@ -250,17 +250,17 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
             try {
                 const wsFilter = workspaceId ? ` AND workspace_id = ?` : '';
                 const findParams = workspaceId ? [taskId, threadId, workspaceId] : [taskId, threadId];
-                const row = db.get(`
-          SELECT id, agent_id, prompt, result, status, started_at, completed_at,
-                 duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
-                 error, parent_task_id, caller_agent_id
-          FROM tasks WHERE id = ? AND thread_id = ?${wsFilter}
+                const row = db.get(`
+          SELECT id, agent_id, prompt, result, status, started_at, completed_at,
+                 duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
+                 error, parent_task_id, caller_agent_id
+          FROM tasks WHERE id = ? AND thread_id = ?${wsFilter}
         `, findParams);
                 if (!row)
                     continue;
-                const children = db.all(`SELECT id, agent_id, prompt, result, status, started_at, completed_at,
-                  duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
-                  error, parent_task_id, caller_agent_id
+                const children = db.all(`SELECT id, agent_id, prompt, result, status, started_at, completed_at,
+                  duration_ms, thread_id, logs, input_tokens, output_tokens, cost_usd,
+                  error, parent_task_id, caller_agent_id
            FROM tasks WHERE parent_task_id = ? ORDER BY started_at ASC`, [row.id]);
                 return { task: row, children };
             }
@@ -287,13 +287,13 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
                 continue;
             const db = this.openReadonly(dbPath);
             try {
-                const rows = db.all(`
-          SELECT id, agent_id, status, started_at, completed_at,
-                 duration_ms, thread_id, input_tokens, output_tokens, cost_usd, error
-          FROM tasks
-          WHERE thread_id IN (${placeholders})
-            AND (parent_task_id IS NULL OR parent_task_id = '')
-          ORDER BY started_at ASC
+                const rows = db.all(`
+          SELECT id, agent_id, status, started_at, completed_at,
+                 duration_ms, thread_id, input_tokens, output_tokens, cost_usd, error
+          FROM tasks
+          WHERE thread_id IN (${placeholders})
+            AND (parent_task_id IS NULL OR parent_task_id = '')
+          ORDER BY started_at ASC
         `, threadIds);
                 for (const row of rows) {
                     const tid = row.thread_id;
@@ -313,6 +313,26 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
         }
         return result;
     }
+    /** Update thread title and set title_locked=1 to prevent auto-overwrite.
+     *  Returns true if the thread was found and updated, false if not found. */
+    updateThreadTitle(threadId, title, workspaceId) {
+        const dbPath = this.resolveDbPath();
+        if (!(0, fs_1.existsSync)(dbPath))
+            return false;
+        const db = this.openReadWrite(dbPath);
+        try {
+            const wsFilter = workspaceId ? ` AND (workspace_id = ? OR workspace_id IS NULL)` : '';
+            const params = workspaceId ? [threadId, workspaceId] : [threadId];
+            const existing = db.get(`SELECT id FROM threads WHERE id = ?${wsFilter}`, params);
+            if (!existing)
+                return false;
+            db.run(`UPDATE threads SET title = ?, title_locked = 1, updated_at = datetime('now') WHERE id = ?`, [title, threadId]);
+            return true;
+        }
+        finally {
+            db.close();
+        }
+    }
     /** UPSERT thread (used by MSG.SEND).
      *  workspace_id is required on INSERT to prevent NULL workspace rows. */
     upsertThread(threadId, opts) {
@@ -323,18 +343,18 @@ let ThreadRepository = class ThreadRepository extends base_sqlite_repository_js_
         try {
             const existing = db.get('SELECT id, message_count FROM threads WHERE id = ?', [threadId]);
             if (existing) {
-                db.run(`
-          UPDATE threads
-          SET updated_at = datetime('now'), message_count = message_count + 1
-          WHERE id = ?
+                db.run(`
+          UPDATE threads
+          SET updated_at = datetime('now'), message_count = message_count + 1
+          WHERE id = ?
         `, [threadId]);
             }
             else {
-                db.run(`
-          INSERT OR REPLACE INTO threads
-            (id, workspace_id, platform, title, first_message, message_count, created_at, updated_at)
-          VALUES (?, ?, 'cli', ?, ?, 1, datetime('now'), datetime('now'))
-        `, [threadId, opts.workspaceId ?? null, opts.title, opts.firstMessage]);
+                db.run(`
+          INSERT OR REPLACE INTO threads
+            (id, workspace_id, platform, title, first_message, message_count, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, 1, datetime('now'), datetime('now'))
+        `, [threadId, opts.workspaceId ?? null, opts.platform ?? 'cli', opts.title, opts.firstMessage]);
             }
         }
         finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewx",
-  "version": "0.8.1",
+  "version": "0.8.2-rc.2",
   "description": "CrewX — AI agent team dashboard with Electron UI and CLI (Web + Electron + Global CLI)",
   "main": "server.js",
   "bin": {
@@ -97,17 +97,17 @@
     "yargs": "^17.7.0",
     "zod": "^3.22.0",
     "zustand": "^4.5.0",
+    "@crewx/cli": "0.8.2-rc.2",
     "@crewx/cron": "0.1.7",
-    "@crewx/cli": "0.8.1",
     "@crewx/doc": "0.1.7",
     "@crewx/knowledge-core": "0.1.5",
     "@crewx/memory": "0.1.9",
+    "@crewx/sdk": "0.8.2-rc.2",
     "@crewx/search": "0.1.8",
     "@crewx/shared": "0.0.4",
-    "@crewx/workflow": "0.3.8",
-    "@crewx/sdk": "0.8.1",
+    "@crewx/skill": "0.1.7",
     "@crewx/wbs": "0.1.8",
-    "@crewx/skill": "0.1.7"
+    "@crewx/workflow": "0.3.8"
   },
   "devDependencies": {
     "@nestjs/cli": "^11.0.16",
@@ -145,7 +145,7 @@
     "typescript": "^5.3.3",
     "vite": "^5.0.10",
     "vite-plugin-electron": "^0.29.0",
-    "vitest": "^4.0.18"
+    "vitest": "^3.2.4"
   },
   "optionalDependencies": {
     "electron": "^39.2.7"

package/packages/cli/dist/bootstrap/crewx-cli.js

@@ -1,12 +1,18 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCliCrewx = createCliCrewx;
 const fs_1 = require("fs");
 const path_1 = require("path");
+const os_1 = require("os");
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
 const sdk_1 = require("@crewx/sdk");
 const plugins_1 = require("@crewx/sdk/plugins");
 const register_builtin_tools_1 = require("../register-builtin-tools");
 const version_1 = require("../utils/version");
+const tasks_1 = require("../schema/tasks");
 /**
  * Build a Crewx instance with CLI-standard plugins (FileLogger + SqliteTracing)
  * and built-in tools registered. Use this from any CLI command that needs a
@@ -39,6 +45,12 @@ async function createCliCrewx(configPath = process.env.CREWX_CONFIG ?? 'crewx.ya
         // No explicit config and file doesn't exist — built-in-only mode
         yamlPath = undefined;
     }
+    // Ensure ~/.crewx/crewx.db schema exists before SqliteTracingPlugin opens it.
+    const dbDir = (0, path_1.join)((0, os_1.homedir)(), '.crewx');
+    (0, fs_1.mkdirSync)(dbDir, { recursive: true });
+    const schemaDb = new better_sqlite3_1.default((0, path_1.join)(dbDir, 'crewx.db'));
+    (0, tasks_1.ensureTasksSchema)(schemaDb);
+    schemaDb.close();
     // Pass ourselves back to the SDK: when this Crewx encounters a file:// remote
     // agent, the SDK uses this factory to bootstrap the target Crewx instance
     // with the same plugin set (FileLogger + SqliteTracing + built-in tools).

package/packages/cli/dist/commands/agent.js

@@ -219,28 +219,28 @@ function loadAgentSkills() {
     }
 }
 function printAgentHelp() {
-    console.log(`
-CrewX Agent Management
-
-Usage:
-  crewx agent             # List configured agents (default)
-  crewx agent ls          # List configured agents
-  crewx agent list        # Alias for ls
-  crewx agent prompt <id> # Inspect rendered agent prompt
-
-Filter Options (for agent ls):
-  --role <value>      Filter by agent role (comma-separated for multiple: PM,Dev)
-  --team <value>      Filter by agent team (comma-separated for multiple)
-  --provider <value>  Filter by provider (comma-separated, partial match: claude)
-
-Examples:
-  crewx agent
-  crewx agent ls
-  crewx agent ls --role=PM
-  crewx agent ls --team="CrewX Core 개발팀"
-  crewx agent ls --provider=claude
-  crewx agent ls --role=PM --provider=claude
-  crewx agent ls --role=PM,general
-  CREWX_CONFIG=./crewx.yaml crewx agent list
+    console.log(`
+CrewX Agent Management
+
+Usage:
+  crewx agent             # List configured agents (default)
+  crewx agent ls          # List configured agents
+  crewx agent list        # Alias for ls
+  crewx agent prompt <id> # Inspect rendered agent prompt
+
+Filter Options (for agent ls):
+  --role <value>      Filter by agent role (comma-separated for multiple: PM,Dev)
+  --team <value>      Filter by agent team (comma-separated for multiple)
+  --provider <value>  Filter by provider (comma-separated, partial match: claude)
+
+Examples:
+  crewx agent
+  crewx agent ls
+  crewx agent ls --role=PM
+  crewx agent ls --team="CrewX Core 개발팀"
+  crewx agent ls --provider=claude
+  crewx agent ls --role=PM --provider=claude
+  crewx agent ls --role=PM,general
+  CREWX_CONFIG=./crewx.yaml crewx agent list
 `.trim());
 }

package/packages/cli/dist/commands/init.js

@@ -56,27 +56,27 @@ function escapeYamlBlock(text) {
 }
 function generateDefaultYaml(agents) {
     const agentBlocks = agents
-        .map((a) => `  - id: "${a.id}"
-    name: "${a.name}"
-    role: "${a.role}"
-    team: "${a.team}"
-    provider: "${a.provider}"
-    default_model: "${a.default_model}"
-    working_directory: "${a.working_directory}"
-    description: "${a.description}"
-    system_prompt: |
+        .map((a) => `  - id: "${a.id}"
+    name: "${a.name}"
+    role: "${a.role}"
+    team: "${a.team}"
+    provider: "${a.provider}"
+    default_model: "${a.default_model}"
+    working_directory: "${a.working_directory}"
+    description: "${a.description}"
+    system_prompt: |
 ${escapeYamlBlock(a.system_prompt)}`)
         .join('\n\n');
-    return `# CrewX Agents Configuration
-# Generated by 'crewx init'
-
-agents:
-${agentBlocks}
-
-# Usage examples:
-#   crewx query "@planner analyze this codebase"
-#   crewx execute "@developer implement the feature described above"
-#   crewx agent ls
+    return `# CrewX Agents Configuration
+# Generated by 'crewx init'
+
+agents:
+${agentBlocks}
+
+# Usage examples:
+#   crewx query "@planner analyze this codebase"
+#   crewx execute "@developer implement the feature described above"
+#   crewx agent ls
 `;
 }
 /**

package/packages/cli/dist/commands/parse-common-flags.d.ts

@@ -3,7 +3,11 @@
  *
  * Supports both `--flag=value` and `--flag value` forms.
  * Handles: --thread, --provider, --metadata, --verbose, --config/-c,
- *          --output-format, --effort.
+ *          --output-format, --effort, --prompt-file/-f.
+ *
+ * Strict mode: unknown --xxx tokens after known flags are consumed throw an
+ * error instead of silently leaking into the message prompt.
+ * Use `--` sentinel to pass literal flag-like tokens as positional args.
  */
 export interface CommonFlags {
     /** Thread name for conversation continuity. */
@@ -22,12 +26,24 @@ export interface CommonFlags {
     effort?: string;
     /** Path to a file whose content is used as the prompt body (-f/--prompt-file). */
     promptFile?: string;
-    /** Remaining non-flag arguments. */
+    /** Remaining non-flag positional arguments. */
     rest: string[];
 }
+/**
+ * Thrown by parseCommonFlags when an unrecognized --xxx flag is encountered.
+ * Callers can distinguish this from other errors to map to exit code 2.
+ */
+export declare class UnknownOptionError extends Error {
+    constructor(message: string);
+}
 /**
  * Parse common CLI flags from an args array.
- * Returns parsed flags and remaining positional arguments.
+ *
+ * Strict mode: any unconsumed `--xxx` token (outside a `--` escape block)
+ * throws `UnknownOptionError: Unknown option: --xxx.`
+ *
+ * Tokens after `--` are treated as positional and included in `rest` as-is.
+ * The `--` sentinel itself is NOT included in `rest`.
  */
 export declare function parseCommonFlags(args: string[]): CommonFlags;
 /**

package/packages/cli/dist/commands/parse-common-flags.js

@@ -4,9 +4,14 @@
  *
  * Supports both `--flag=value` and `--flag value` forms.
  * Handles: --thread, --provider, --metadata, --verbose, --config/-c,
- *          --output-format, --effort.
+ *          --output-format, --effort, --prompt-file/-f.
+ *
+ * Strict mode: unknown --xxx tokens after known flags are consumed throw an
+ * error instead of silently leaking into the message prompt.
+ * Use `--` sentinel to pass literal flag-like tokens as positional args.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnknownOptionError = void 0;
 exports.parseCommonFlags = parseCommonFlags;
 exports.parseMetadata = parseMetadata;
 /**
@@ -35,9 +40,25 @@ function parseFlag(args, ...names) {
 function hasFlag(args, ...names) {
     return names.some(name => args.includes(name));
 }
+/**
+ * Thrown by parseCommonFlags when an unrecognized --xxx flag is encountered.
+ * Callers can distinguish this from other errors to map to exit code 2.
+ */
+class UnknownOptionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UnknownOptionError';
+    }
+}
+exports.UnknownOptionError = UnknownOptionError;
 /**
  * Parse common CLI flags from an args array.
- * Returns parsed flags and remaining positional arguments.
+ *
+ * Strict mode: any unconsumed `--xxx` token (outside a `--` escape block)
+ * throws `UnknownOptionError: Unknown option: --xxx.`
+ *
+ * Tokens after `--` are treated as positional and included in `rest` as-is.
+ * The `--` sentinel itself is NOT included in `rest`.
  */
 function parseCommonFlags(args) {
     const thread = parseFlag(args, '--thread');
@@ -48,7 +69,7 @@ function parseCommonFlags(args) {
     const effort = parseFlag(args, '--effort');
     const promptFile = parseFlag(args, '--prompt-file', '-f');
     const verbose = hasFlag(args, '--verbose');
-    // Collect the set of consumed positions
+    // Collect consumed positions for known flags
     const consumed = new Set();
     const flagPairs = [
         { names: ['--thread'] },
@@ -61,12 +82,10 @@ function parseCommonFlags(args) {
     ];
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
-        // Boolean flags
         if (arg === '--verbose') {
             consumed.add(i);
             continue;
         }
-        // Value flags
         for (const { names } of flagPairs) {
             for (const name of names) {
                 if (arg.startsWith(`${name}=`)) {
@@ -80,7 +99,28 @@ function parseCommonFlags(args) {
             }
         }
     }
-    const rest = args.filter((_, i) => !consumed.has(i));
+    // Build rest with strict unknown-flag detection and -- escape support
+    const rest = [];
+    let escapeMode = false;
+    for (let i = 0; i < args.length; i++) {
+        if (consumed.has(i))
+            continue;
+        const token = args[i];
+        if (!escapeMode && token === '--') {
+            escapeMode = true; // consume -- sentinel; everything after is positional
+            continue;
+        }
+        if (!escapeMode && token.startsWith('--')) {
+            throw new UnknownOptionError(`Unknown option: ${token}. Use "--" to pass literal flag-like tokens as message.\n` +
+                `   Did you mean: crewx serve ${token}\n` +
+                `              or: crewx q -- ${token} <message>   (to include in message)`);
+        }
+        // Reject short -x flags that are not numeric (e.g. -f was consumed above)
+        if (!escapeMode && token.startsWith('-') && token.length > 1 && !/^-?\d/.test(token)) {
+            throw new UnknownOptionError(`Unknown option: ${token}`);
+        }
+        rest.push(token);
+    }
     return { thread, provider, metadata, verbose, config, outputFormat, effort, promptFile, rest };
 }
 /**

package/packages/cli/dist/commands/registry.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CLI command registry — SSOT for commands handled by the CLI engine.
+ *
+ * Consumed by:
+ *   - main.ts dispatch (to avoid switch/case literal drift)
+ *   - bin/__tests__/crewx-entrypoint.test.ts (SSOT assertion vs CLI_SUBCOMMANDS)
+ */
+/** Core commands handled by the main.ts switch/case or hook routing. */
+export declare const KNOWN_COMMANDS: Set<string>;
+/** Built-in tool commands routed via handleBuiltin(). */
+export declare const BUILTIN_COMMAND_NAMES: Set<string>;
+/** Commands not yet migrated from cli-bak — show a migration message. */
+export declare const NOT_YET_MIGRATED: Set<string>;

package/packages/cli/dist/commands/registry.js

@@ -0,0 +1,29 @@
+"use strict";
+/**
+ * CLI command registry — SSOT for commands handled by the CLI engine.
+ *
+ * Consumed by:
+ *   - main.ts dispatch (to avoid switch/case literal drift)
+ *   - bin/__tests__/crewx-entrypoint.test.ts (SSOT assertion vs CLI_SUBCOMMANDS)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NOT_YET_MIGRATED = exports.BUILTIN_COMMAND_NAMES = exports.KNOWN_COMMANDS = void 0;
+/** Core commands handled by the main.ts switch/case or hook routing. */
+exports.KNOWN_COMMANDS = new Set([
+    'q', 'query',
+    'x', 'execute',
+    'agent',
+    'ps', 'kill', 'result', 'log',
+    'doctor', 'init',
+    'help',
+    'slack', 'slack:files',
+    'hook', 'hook-dispatch',
+]);
+/** Built-in tool commands routed via handleBuiltin(). */
+exports.BUILTIN_COMMAND_NAMES = new Set([
+    'memory', 'search', 'doc', 'wbs', 'cron', 'workflow', 'skill',
+]);
+/** Commands not yet migrated from cli-bak — show a migration message. */
+exports.NOT_YET_MIGRATED = new Set([
+    'template', 'templates', 'chat', 'mcp',
+]);

package/packages/cli/dist/commands/task-db.js

@@ -33,8 +33,8 @@ function getRunningTasks(dbRoot) {
     if (!db)
         return [];
     try {
-        return db.prepare(`SELECT id, agent_id, prompt, mode, status, pid, started_at, completed_at,
-              result, error, duration_ms
+        return db.prepare(`SELECT id, agent_id, prompt, mode, status, pid, started_at, completed_at,
+              result, error, duration_ms
        FROM tasks WHERE status = 'running' ORDER BY started_at DESC`).all();
     }
     finally {
@@ -47,8 +47,8 @@ function getAllTasks(dbRoot) {
     if (!db)
         return [];
     try {
-        return db.prepare(`SELECT id, agent_id, prompt, mode, status, pid, started_at, completed_at,
-              result, error, duration_ms
+        return db.prepare(`SELECT id, agent_id, prompt, mode, status, pid, started_at, completed_at,
+              result, error, duration_ms
        FROM tasks ORDER BY started_at DESC`).all();
     }
     finally {
@@ -61,8 +61,8 @@ function getTask(id, dbRoot) {
     if (!db)
         return undefined;
     try {
-        return db.prepare(`SELECT id, agent_id, prompt, mode, status, pid, started_at, completed_at,
-              result, error, duration_ms
+        return db.prepare(`SELECT id, agent_id, prompt, mode, status, pid, started_at, completed_at,
+              result, error, duration_ms
        FROM tasks WHERE id = ?`).get(id);
     }
     finally {
@@ -97,7 +97,7 @@ function killTask(id, dbRoot) {
                 // ESRCH = process already gone — still clean up the record
             }
         }
-        db.prepare(`UPDATE tasks SET status='failed', error='killed by user',
+        db.prepare(`UPDATE tasks SET status='failed', error='killed by user',
        completed_at=?, pid=NULL WHERE id=?`).run(new Date().toISOString(), id);
         return { ok: true, message: `Killed task ${id}${task.pid ? ` (PID: ${task.pid})` : ''}` };
     }

package/packages/cli/dist/examples/deny-secrets-plugin.d.ts

@@ -0,0 +1,22 @@
+/**
+ * DenyIfTouchesSecretsPlugin — Phase 0 demo HookPlugin.
+ *
+ * Denies Bash tool calls whose command string contains ".env".
+ * Pure string matching — trivially bypassable (see README).
+ *
+ * SECURITY NOTE:
+ *   Do NOT include tool.input content in deny reasons.
+ *   Use static messages only to prevent prompt injection.
+ *   ✅ return ctx.deny('Secrets-related command');
+ *   ❌ return ctx.deny(`Blocked: ${cmd}`);
+ */
+import { HookPlugin } from '@crewx/sdk/hooks';
+import type { HookContext, HookResult } from '@crewx/sdk/hooks';
+export declare class DenyIfTouchesSecretsPlugin extends HookPlugin {
+    readonly name = "deny-secrets";
+    readonly version = "0.1.0";
+    readonly capabilities: {
+        required: readonly ["deny"];
+    };
+    run(ctx: HookContext): Promise<HookResult>;
+}

package/packages/cli/dist/examples/deny-secrets-plugin.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * DenyIfTouchesSecretsPlugin — Phase 0 demo HookPlugin.
+ *
+ * Denies Bash tool calls whose command string contains ".env".
+ * Pure string matching — trivially bypassable (see README).
+ *
+ * SECURITY NOTE:
+ *   Do NOT include tool.input content in deny reasons.
+ *   Use static messages only to prevent prompt injection.
+ *   ✅ return ctx.deny('Secrets-related command');
+ *   ❌ return ctx.deny(`Blocked: ${cmd}`);
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DenyIfTouchesSecretsPlugin = void 0;
+const hooks_1 = require("@crewx/sdk/hooks");
+const SECRET_PATTERNS = ['.env', 'credentials.json', 'service-account-key.json'];
+const SHELL_TOOL_NAMES = new Set(['Bash', 'shell', 'local_shell']);
+class DenyIfTouchesSecretsPlugin extends hooks_1.HookPlugin {
+    name = 'deny-secrets';
+    version = '0.1.0';
+    capabilities = { required: ['deny'] };
+    async run(ctx) {
+        if (!SHELL_TOOL_NAMES.has(ctx.tool.rawName) && ctx.tool.name !== 'shell') {
+            return ctx.pass();
+        }
+        const input = ctx.tool.input;
+        const command = input?.command;
+        if (typeof command !== 'string') {
+            return ctx.pass();
+        }
+        for (const pattern of SECRET_PATTERNS) {
+            if (command.includes(pattern)) {
+                return ctx.deny('Secrets-related command');
+            }
+        }
+        return ctx.pass();
+    }
+}
+exports.DenyIfTouchesSecretsPlugin = DenyIfTouchesSecretsPlugin;