leedab 0.5.3 → 0.6.1

package/bin/scan-secrets-tree.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+#
+# Full-tree secret scanner. Complements .githooks/pre-commit by running
+# the same regex set over every file in the working tree (not just the
+# staged diff), so pre-existing committed secrets surface in CI.
+#
+# Used by:
+#   - .github/workflows/ci.yml (`secret-scan` job)
+#   - Manual: `bin/scan-secrets-tree.sh`
+#
+# Allowlist:
+#   .secret-scan-allowlist (one regex per line, anchored where you want)
+#   matches the file path. Use to suppress known-safe matches like
+#   doc fingerprints or fixture data. Comments start with '#'.
+#
+# Exit code:
+#   0 — no findings (or all suppressed)
+#   1 — at least one unsuppressed finding
+#   2 — usage / setup error
+
+set -euo pipefail
+
+PATTERNS=(
+  # LeedAB license keys
+  'am_live_[A-Za-z0-9]{32,}'
+  'am_test_[A-Za-z0-9]{32,}'
+  # Anthropic
+  'sk-ant-api[0-9]{2,3}-[A-Za-z0-9_-]{30,}'
+  # Stripe (live + test)
+  'sk_live_[A-Za-z0-9]{24,}'
+  'sk_test_[A-Za-z0-9]{24,}'
+  'pk_live_[A-Za-z0-9]{24,}'
+  # GitHub PATs
+  'gh[pours]_[A-Za-z0-9]{36,}'
+  # AWS access key id
+  'AKIA[0-9A-Z]{16}'
+  # Telegram bot token (9-10 digit user id : colon : 35-char alnum)
+  '\b[0-9]{9,10}:[A-Za-z0-9_-]{35}\b'
+  # JWT
+  'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
+)
+
+# Paths to never scan. Binary blobs, lockfiles, the scanner itself.
+EXCLUDE_GLOBS=(
+  ':!**/node_modules/**'
+  ':!**/.next/**'
+  ':!**/.git/**'
+  ':!**/dist/**'
+  ':!**/build/**'
+  ':!**/*.lock'
+  ':!**/package-lock.json'
+  ':!**/*.png'
+  ':!**/*.jpg'
+  ':!**/*.jpeg'
+  ':!**/*.webp'
+  ':!**/*.gif'
+  ':!**/*.pdf'
+  ':!**/*.docx'
+  ':!**/*.xlsx'
+  ':!.githooks/pre-commit'
+  ':!bin/scan-secrets-tree.sh'
+  ':!.secret-scan-allowlist'
+)
+
+ALLOWLIST_FILE=".secret-scan-allowlist"
+allowlist_patterns=()
+if [ -f "$ALLOWLIST_FILE" ]; then
+  while IFS= read -r line; do
+    # Strip comments + blank lines.
+    line="${line%%#*}"
+    line="${line## }"
+    line="${line%% }"
+    [ -z "$line" ] && continue
+    allowlist_patterns+=("$line")
+  done < "$ALLOWLIST_FILE"
+fi
+
+is_allowlisted() {
+  local f="$1"
+  # `set -u` guards an empty array under bash 3.x (default macOS) — short-
+  # circuit before the loop or the `${arr[@]}` expansion crashes.
+  if [ ${#allowlist_patterns[@]} -eq 0 ]; then
+    return 1
+  fi
+  for pat in "${allowlist_patterns[@]}"; do
+    if echo "$f" | grep -Eq "$pat"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Build the tree-wide grep. We use git ls-files so we respect .gitignore.
+files=$(git ls-files -- "${EXCLUDE_GLOBS[@]}")
+
+if [ -z "$files" ]; then
+  echo "scan-secrets-tree: no files in scope (empty tree?)" >&2
+  exit 2
+fi
+
+violations=""
+total_findings=0
+
+# Convert newline-separated file list to NUL-separated so we can use
+# xargs -0 (portable across GNU + BSD/macOS xargs). The earlier `xargs
+# -d '\n'` was GNU-only and silently no-op'd on macOS, turning the
+# scanner into a false-negative oracle. Verified 2026-05-08 against a
+# planted am_live_* fixture.
+file_count=$(printf '%s\n' "$files" | wc -l | tr -d ' ')
+
+for pattern in "${PATTERNS[@]}"; do
+  # -F off, -E on; -n line numbers; -I skip binary; -H always show file path.
+  while IFS=: read -r file line match; do
+    [ -z "$file" ] && continue
+    if is_allowlisted "$file"; then
+      continue
+    fi
+    # Truncate the match for output — never echo the full secret.
+    preview=$(echo "$match" | grep -oE "$pattern" | head -1 | cut -c1-12)
+    violations+="${file}:${line}: matched (preview: ${preview}...)\n"
+    total_findings=$((total_findings + 1))
+  done < <(printf '%s\n' "$files" | tr '\n' '\0' | xargs -0 grep -nIE "$pattern" 2>/dev/null || true)
+done
+
+if [ -n "$violations" ]; then
+  echo "" >&2
+  echo "✗ scan-secrets-tree: ${total_findings} unsuppressed finding(s)" >&2
+  echo "" >&2
+  printf "$violations" >&2
+  echo "" >&2
+  echo "If a match is a known-safe fixture / fingerprint / doc reference," >&2
+  echo "add a pattern to .secret-scan-allowlist (one regex per line)." >&2
+  echo "" >&2
+  exit 1
+fi
+
+echo "✓ scan-secrets-tree: clean (${#PATTERNS[@]} patterns, allowlist=${#allowlist_patterns[@]})"
+exit 0

package/bin/seed-workflows.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+//
+// bin/seed-workflows.mjs — offline workflow seeder for a customer brain.
+//
+// Calls `regenerateBrainWorkflows(clientId, industry)` directly without
+// going through the dev server's /api/templates/regenerate endpoint.
+// Useful for:
+//   - bin/onboard-customer.sh when the dev server isn't running
+//   - CI / scripted provisioning where spinning up Next.js is overhead
+//   - Customer-side install where the dashboard might not be live yet
+//
+// Identical effect to /api/templates/regenerate (industry-only seed —
+// not the LLM-customised path; that's HTTP-only because it calls
+// Anthropic).
+//
+// Usage:
+//   bin/seed-workflows.mjs <clientId> [industry]
+//
+// Examples:
+//   bin/seed-workflows.mjs tarheel logistics
+//   bin/seed-workflows.mjs acme-coffee hospitality
+//
+// Exits 0 on success, 1 on failure. Prints summary to stdout.
+
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const args = process.argv.slice(2);
+if (args.length < 1) {
+  console.error("Usage: bin/seed-workflows.mjs <clientId> [industry]");
+  console.error("");
+  console.error("Industries with templates: logistics, hospitality, retail, trades, professional,");
+  console.error("                            manufacturing, food-service, ecommerce, agencies, healthcare");
+  process.exit(2);
+}
+
+const [clientId, industryArg] = args;
+const industry = industryArg ?? null;
+
+const SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,58}[a-z0-9])?$/;
+if (!SAFE_SLUG_RE.test(clientId)) {
+  console.error(`ERROR: clientId must be a valid slug (got "${clientId}")`);
+  process.exit(2);
+}
+
+// Resolve the regenerate helper from apps/console/lib. We use a file://
+// URL + dynamic import so this script works regardless of cwd.
+const SCRIPT_DIR = path.dirname(new URL(import.meta.url).pathname);
+const REPO_ROOT = path.resolve(SCRIPT_DIR, "..");
+const HELPER_PATH = path.join(REPO_ROOT, "apps", "console", "lib", "brain-workflows.ts");
+
+let regenerateBrainWorkflows;
+try {
+  // Need --experimental-strip-types support to import .ts directly.
+  const mod = await import(pathToFileURL(HELPER_PATH).href);
+  regenerateBrainWorkflows = mod.regenerateBrainWorkflows;
+} catch (err) {
+  console.error(`ERROR: failed to load lib/brain-workflows.ts (${err.message})`);
+  console.error("       Run with: node --experimental-strip-types bin/seed-workflows.mjs ...");
+  process.exit(1);
+}
+
+if (typeof regenerateBrainWorkflows !== "function") {
+  console.error("ERROR: regenerateBrainWorkflows export not found in brain-workflows.ts");
+  process.exit(1);
+}
+
+console.log(`Seeding industry workflows for ${clientId}${industry ? ` (${industry})` : ""}...`);
+const result = await regenerateBrainWorkflows(clientId, industry);
+
+if (!result.ok) {
+  console.error(`✗ failed: ${result.errors.join(", ")}`);
+  process.exit(1);
+}
+
+console.log(`✓ wrote ${result.written} workflow(s) to ~/leedab-brains/${clientId}/_Workflows/`);
+if (result.skipped > 0) {
+  console.warn(`⚠ skipped ${result.skipped} (${result.errors.join(", ")})`);
+}
+process.exit(0);

package/bin/validate-manifests.sh

@@ -0,0 +1,256 @@
+#!/usr/bin/env bash
+#
+# bin/validate-manifests.sh — schema gate for clients/*/manifest.json.
+#
+# Catches drift early so a bad manifest doesn't blow up at runtime. Runs
+# on every customer manifest in the workspace and exits 1 if any fail.
+#
+# Checks:
+#   1. Valid JSON
+#   2. schema_version === "1.0"
+#   3. Required fields present (client_id, display_name, agents[],
+#      overrides{}, playbook_files[], industry, tier, license_key)
+#   4. client_id matches the directory name + slug rules
+#   5. Every agent in `agents` is in the canonical AGENTS registry
+#   6. Every key in `overrides` is also in `agents` (orphan check)
+#   7. Every playbook_files path actually resolves (exists on disk)
+#   8. status (when present) is one of: prospect / trial / active / churned
+#   9. tier (when set) is a known pack id (founder / logistics-pro /
+#      starter / null)
+#
+# Use:
+#   bash bin/validate-manifests.sh                      # validate all
+#   bash bin/validate-manifests.sh --client tarheel     # validate one
+#   bash bin/validate-manifests.sh --quiet              # only print fails
+#
+# Exits 0 on green, 1 on any fail. CI-friendly.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CLIENTS_DIR="$REPO_ROOT/clients"
+QUIET=0
+ONLY_CLIENT=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --quiet)  QUIET=1; shift ;;
+    --client) ONLY_CLIENT="$2"; shift 2 ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+# Canonical agent IDs — sourced from apps/console/lib/agents.ts.
+# Update this list if AGENTS in agents.ts changes.
+CANONICAL_AGENTS=(
+  coo marketing content video campaigns email product engineering
+  frontend backend devops strategy sales finance cx investor legal
+  automation data ops concierge brand research people procurement
+  compliance delivery solutions onboarding implementation champion
+)
+KNOWN_TIERS=(founder logistics-pro starter)
+KNOWN_STATUSES=(prospect trial active churned)
+
+is_in() {
+  local needle="$1"; shift
+  for v in "$@"; do [ "$v" = "$needle" ] && return 0; done
+  return 1
+}
+
+if [ ! -d "$CLIENTS_DIR" ]; then
+  echo "ERROR: clients dir not found at $CLIENTS_DIR" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+FAIL_DETAILS=()
+
+validate_one() {
+  local slug="$1"
+  local manifest_path="$CLIENTS_DIR/$slug/manifest.json"
+  local errors=()
+
+  if [ ! -f "$manifest_path" ]; then
+    errors+=("missing manifest.json")
+    print_result "$slug" "${errors[@]}"
+    return 1
+  fi
+
+  # 1. Valid JSON + extract fields via python (jq might not be installed
+  #    on every dev machine; python3 is universal on macOS).
+  local extracted
+  extracted="$(python3 - "$manifest_path" "$slug" <<'PY' 2>&1
+import json, sys
+path, expected_slug = sys.argv[1], sys.argv[2]
+try:
+  with open(path) as f:
+    m = json.load(f)
+except Exception as e:
+  print(f"INVALID_JSON::{e}")
+  sys.exit(0)
+
+errs = []
+def need(k):
+  if k not in m: errs.append(f"missing field: {k}")
+  return m.get(k)
+
+sv = need("schema_version")
+if sv is not None and sv != "1.0":
+  errs.append(f"schema_version != '1.0' (got {sv!r})")
+
+cid = need("client_id")
+if cid is not None and cid != expected_slug:
+  errs.append(f"client_id mismatch: manifest has {cid!r}, dir is {expected_slug!r}")
+import re
+SAFE_SLUG = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,58}[a-z0-9])?$")
+if cid is not None and not SAFE_SLUG.match(cid):
+  errs.append(f"client_id {cid!r} fails slug regex")
+
+for k in ("display_name", "industry", "tier", "license_key", "agents", "overrides", "playbook_files", "template_ids"):
+  if k not in m: errs.append(f"missing field: {k}")
+
+agents = m.get("agents", [])
+if not isinstance(agents, list):
+  errs.append("agents must be an array")
+overrides = m.get("overrides", {})
+if not isinstance(overrides, dict):
+  errs.append("overrides must be an object")
+playbook_files = m.get("playbook_files", [])
+if not isinstance(playbook_files, list):
+  errs.append("playbook_files must be an array")
+
+# Surface ALL errors found here, then dump the structured payload.
+for e in errs:
+  print(f"ERR::{e}")
+print("FIELDS_BEGIN")
+print("agents:" + ",".join(str(a) for a in agents))
+print("overrides:" + ",".join(str(k) for k in overrides.keys()))
+print("playbook_files:" + ",".join(str(p) for p in playbook_files))
+print("status:" + str(m.get("status", "")))
+print("tier:" + ("" if m.get("tier") is None else str(m.get("tier"))))
+PY
+  )"
+
+  # Extract errors from the python output.
+  while IFS= read -r line; do
+    case "$line" in
+      INVALID_JSON::*) errors+=("invalid JSON: ${line#INVALID_JSON::}") ;;
+      ERR::*) errors+=("${line#ERR::}") ;;
+    esac
+  done <<<"$extracted"
+
+  # If JSON was invalid, can't do further checks.
+  if echo "$extracted" | grep -q "INVALID_JSON::"; then
+    print_result "$slug" "${errors[@]}"
+    return 1
+  fi
+
+  # Pull structured fields for cross-checks.
+  local agents_csv overrides_csv playbook_csv status tier
+  agents_csv="$(echo "$extracted" | grep "^agents:" | head -1 | sed 's/^agents://')"
+  overrides_csv="$(echo "$extracted" | grep "^overrides:" | head -1 | sed 's/^overrides://')"
+  playbook_csv="$(echo "$extracted" | grep "^playbook_files:" | head -1 | sed 's/^playbook_files://')"
+  status="$(echo "$extracted" | grep "^status:" | head -1 | sed 's/^status://')"
+  tier="$(echo "$extracted" | grep "^tier:" | head -1 | sed 's/^tier://')"
+
+  # 5. Every agent in canonical registry.
+  if [ -n "$agents_csv" ]; then
+    IFS=',' read -ra agents_arr <<<"$agents_csv"
+    for a in "${agents_arr[@]}"; do
+      [ -z "$a" ] && continue
+      if ! is_in "$a" "${CANONICAL_AGENTS[@]}"; then
+        errors+=("agent not in canonical registry: $a")
+      fi
+    done
+  fi
+
+  # 6. Every override key is also in agents (orphan override check).
+  if [ -n "$overrides_csv" ] && [ -n "$agents_csv" ]; then
+    IFS=',' read -ra ov_arr <<<"$overrides_csv"
+    IFS=',' read -ra agents_arr <<<"$agents_csv"
+    for ok in "${ov_arr[@]}"; do
+      [ -z "$ok" ] && continue
+      if ! is_in "$ok" "${agents_arr[@]}"; then
+        errors+=("override key has no matching agent: $ok")
+      fi
+    done
+  fi
+
+  # 7. Every playbook_files path resolves on disk.
+  if [ -n "$playbook_csv" ]; then
+    IFS=',' read -ra pf_arr <<<"$playbook_csv"
+    for pf in "${pf_arr[@]}"; do
+      [ -z "$pf" ] && continue
+      if [ ! -f "$REPO_ROOT/$pf" ]; then
+        errors+=("playbook_files path missing: $pf")
+      fi
+    done
+  fi
+
+  # 8. status (if present and non-empty) is known.
+  if [ -n "$status" ]; then
+    if ! is_in "$status" "${KNOWN_STATUSES[@]}"; then
+      errors+=("unknown status: $status (allowed: ${KNOWN_STATUSES[*]})")
+    fi
+  fi
+
+  # 9. tier (if non-empty) is known.
+  if [ -n "$tier" ]; then
+    if ! is_in "$tier" "${KNOWN_TIERS[@]}"; then
+      errors+=("unknown tier: $tier (allowed: ${KNOWN_TIERS[*]})")
+    fi
+  fi
+
+  if [ ${#errors[@]} -eq 0 ]; then
+    print_result "$slug"
+    return 0
+  else
+    print_result "$slug" "${errors[@]}"
+    return 1
+  fi
+}
+
+print_result() {
+  local slug="$1"; shift
+  local errs=("$@")
+  if [ ${#errs[@]} -eq 0 ]; then
+    PASS=$((PASS + 1))
+    [ "$QUIET" -eq 0 ] && printf "  \033[32m✓\033[0m %s\n" "$slug"
+  else
+    FAIL=$((FAIL + 1))
+    printf "  \033[31m✗\033[0m %s\n" "$slug"
+    for e in "${errs[@]}"; do
+      printf "      \033[90m· %s\033[0m\n" "$e"
+      FAIL_DETAILS+=("$slug: $e")
+    done
+  fi
+}
+
+# Find clients to validate.
+if [ -n "$ONLY_CLIENT" ]; then
+  TARGETS=("$ONLY_CLIENT")
+else
+  TARGETS=()
+  for d in "$CLIENTS_DIR"/*/; do
+    slug="$(basename "$d")"
+    [ "$slug" = "default" ] && continue
+    TARGETS+=("$slug")
+  done
+fi
+
+[ "$QUIET" -eq 0 ] && echo "Validating ${#TARGETS[@]} customer manifest(s)..."
+[ "$QUIET" -eq 0 ] && echo
+
+for slug in "${TARGETS[@]}"; do
+  validate_one "$slug" || true
+done
+
+echo
+if [ "$FAIL" -eq 0 ]; then
+  printf "\033[32m%d pass\033[0m · %d fail · %d total\n" "$PASS" "$FAIL" "$((PASS + FAIL))"
+  exit 0
+else
+  printf "\033[31m%d fail\033[0m · %d pass · %d total\n" "$FAIL" "$PASS" "$((PASS + FAIL))"
+  exit 1
+fi

package/bin/wiring-status.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+#
+# bin/wiring-status.sh — print live wiring stats per agent.
+#
+# For each canonical agent, reports:
+#   - endpoint count (route.ts files under apps/console/app/api/<agent>/)
+#   - audit-instrumented count (routes that import lib/agent-tools/audit)
+#   - license-gated count (routes that import lib/license-guard)
+#
+# Plus roster-wide totals + percentages. Used for handoff-confidence
+# verification — Muiez can grep this for "is the wiring really 31/31?"
+# without spelunking every route file.
+#
+# Run: bin/wiring-status.sh
+# Or:  bin/wiring-status.sh --csv     # machine-readable output
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
+API_DIR="$REPO_ROOT/apps/console/app/api"
+
+if [ ! -d "$API_DIR" ]; then
+  echo "ERROR: $API_DIR not found — run from a LeedAB-OS checkout" >&2
+  exit 1
+fi
+
+# 31 canonical agents (matches apps/console/lib/agents.ts AGENTS keys).
+AGENTS=(
+  automation backend brand campaigns champion compliance concierge
+  content coo cx data delivery devops email engineering finance
+  frontend implementation investor legal marketing onboarding ops
+  people procurement product research sales solutions strategy video
+)
+
+CSV=0
+if [ "${1:-}" = "--csv" ]; then
+  CSV=1
+fi
+
+# Header
+if [ "$CSV" -eq 1 ]; then
+  echo "agent,endpoints,audit_instrumented,license_gated"
+else
+  printf "%-16s %10s %14s %14s\n" "agent" "endpoints" "audit" "license"
+  printf "%-16s %10s %14s %14s\n" "---------------" "---------" "-------------" "-------------"
+fi
+
+total_endpoints=0
+total_audited=0
+total_gated=0
+agents_with_routes=0
+
+for agent in "${AGENTS[@]}"; do
+  agent_dir="$API_DIR/$agent"
+  if [ ! -d "$agent_dir" ]; then
+    if [ "$CSV" -eq 1 ]; then
+      echo "$agent,0,0,0"
+    else
+      printf "%-16s %10s %14s %14s\n" "$agent" "0" "—" "—"
+    fi
+    continue
+  fi
+
+  agents_with_routes=$((agents_with_routes + 1))
+
+  # Find every route.ts under this agent's folder.
+  routes=$(find "$agent_dir" -name "route.ts" 2>/dev/null || true)
+  endpoint_count=0
+  if [ -n "$routes" ]; then
+    endpoint_count=$(echo "$routes" | grep -c . || true)
+  fi
+  total_endpoints=$((total_endpoints + endpoint_count))
+
+  # Count routes that import audit + license-guard.
+  audited=0
+  gated=0
+  if [ -n "$routes" ]; then
+    while IFS= read -r route; do
+      [ -z "$route" ] && continue
+      if grep -q 'from "@/lib/agent-tools/audit"' "$route"; then
+        audited=$((audited + 1))
+      fi
+      if grep -q 'from "@/lib/license-guard"' "$route"; then
+        gated=$((gated + 1))
+      fi
+    done <<< "$routes"
+  fi
+
+  total_audited=$((total_audited + audited))
+  total_gated=$((total_gated + gated))
+
+  if [ "$CSV" -eq 1 ]; then
+    echo "$agent,$endpoint_count,$audited,$gated"
+  else
+    printf "%-16s %10s %10s/%-3s %10s/%-3s\n" "$agent" "$endpoint_count" "$audited" "$endpoint_count" "$gated" "$endpoint_count"
+  fi
+done
+
+# Footer / totals.
+if [ "$CSV" -eq 1 ]; then
+  echo "TOTAL,$total_endpoints,$total_audited,$total_gated"
+else
+  printf "%-16s %10s %14s %14s\n" "---------------" "---------" "-------------" "-------------"
+  printf "%-16s %10s %10s/%-3s %10s/%-3s\n" "TOTAL" "$total_endpoints" "$total_audited" "$total_endpoints" "$total_gated" "$total_endpoints"
+  echo ""
+
+  if [ "$total_endpoints" -gt 0 ]; then
+    audit_pct=$(awk -v a="$total_audited" -v t="$total_endpoints" 'BEGIN { printf "%.0f", (a/t)*100 }')
+    gate_pct=$(awk -v g="$total_gated" -v t="$total_endpoints" 'BEGIN { printf "%.0f", (g/t)*100 }')
+  else
+    audit_pct=0
+    gate_pct=0
+  fi
+
+  echo "Roster:           $agents_with_routes of ${#AGENTS[@]} canonical agents have at least one endpoint"
+  echo "Endpoints:        $total_endpoints total"
+  echo "Audit coverage:   $total_audited of $total_endpoints (${audit_pct}%)"
+  echo "License coverage: $total_gated of $total_endpoints (${gate_pct}%)"
+  echo ""
+  echo "(Read-only state-getters + cross-customer aggregators may be intentionally"
+  echo " unaudited / un-gated; see ADR-012 for the policy.)"
+fi