ofiere-openclaw-plugin 4.54.2 → 4.56.0

package/src/gateOps.ts

@@ -0,0 +1,177 @@
+// src/gateOps.ts — OFIERE_GATE_OPS meta-tool
+// Approve / reject manual gates blocking task dispatch in the Planning Tab.
+//
+// Phase 0 finding: plugin factory carries no implicit agentId in closure.
+// The CALLING chief / staff agent MUST pass `agent_id` explicitly for approve/reject
+// so the audit trail records "agent:<id>" in approved_by / rejected_by.
+// Fallback order: args.agent_id → fallbackAgentId (gateway OFIERE_AGENT_ID env) → "user:<userId>".
+
+import type { SupabaseClient } from "@supabase/supabase-js";
+
+interface ToolResult {
+  content: Array<{ type: "text"; text: string }>;
+}
+
+function ok(data: unknown): ToolResult {
+  return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
+}
+
+function err(message: string): ToolResult {
+  return { content: [{ type: "text" as const, text: `Error: ${message}` }] };
+}
+
+// Bounded BFS — collect transitive successors so the agent sees cascade impact
+// before rejecting. Mirrors dashboard/lib/ofie/tool-executor.ts _collectTransitiveSuccessors.
+async function collectTransitiveSuccessors(
+  supabase: SupabaseClient,
+  userId: string,
+  rootTaskId: string,
+): Promise<{ id: string; title: string }[]> {
+  const visited = new Set<string>([rootTaskId]);
+  const out: { id: string; title: string }[] = [];
+  let frontier: string[] = [rootTaskId];
+  for (let depth = 0; depth < 20 && frontier.length > 0; depth++) {
+    const { data: deps } = await supabase
+      .from("pm_dependencies")
+      .select("successor_id")
+      .in("predecessor_id", frontier)
+      .eq("user_id", userId);
+    const next: string[] = [];
+    for (const d of (deps || [])) {
+      const sid = (d as any).successor_id as string;
+      if (!sid || visited.has(sid)) continue;
+      visited.add(sid);
+      next.push(sid);
+    }
+    if (next.length === 0) break;
+    const { data: tasks } = await supabase
+      .from("tasks")
+      .select("id, title")
+      .in("id", next)
+      .eq("user_id", userId);
+    for (const t of (tasks || [])) out.push({ id: (t as any).id, title: (t as any).title });
+    frontier = next;
+  }
+  return out;
+}
+
+export function registerGateOps(
+  api: any,
+  supabase: SupabaseClient,
+  userId: string,
+  fallbackAgentId: string | undefined,
+): void {
+  api.registerTool({
+    name: "OFIERE_GATE_OPS",
+    label: "Ofiere Gate Operations",
+    description:
+      `Approve or reject manual gates blocking task dispatch in the Planning Tab.\n\n` +
+      `Actions:\n` +
+      `- "list_pending": List manual gates pending approval. Optional: agent_id (filter to gates whose blocked task is assigned to this agent).\n` +
+      `- "get": Inspect a specific gate + see the cascade impact of rejecting. Required: gate_id. ALWAYS call before "reject" so you understand what will fail.\n` +
+      `- "approve": Approve a gate so the blocked task can dispatch. Required: gate_id, agent_id (the calling chief/staff). Optional: comment.\n` +
+      `- "reject": Reject a gate — FAILS the blocked task and BLOCKS all transitive successors (cascade). Required: gate_id, agent_id, reason (min 5 chars).\n\n` +
+      `Why agent_id is required: plugin runtime has no implicit agent identity. The agent invoking this tool MUST pass its own id so approval audit trail records 'agent:<id>' instead of 'user:<owner_uuid>'. Falls back to gateway OFIERE_AGENT_ID env when absent.`,
+    parameters: {
+      type: "object",
+      required: ["action"],
+      properties: {
+        action: { type: "string", enum: ["list_pending", "get", "approve", "reject"], description: "list_pending | get | approve | reject" },
+        gate_id: { type: "string", description: "Gate UUID (required for get, approve, reject)" },
+        agent_id: { type: "string", description: "Calling agent id (required for approve, reject — recorded as 'agent:<id>' in approved_by / rejected_by). Also optional filter for list_pending." },
+        comment: { type: "string", description: "Optional approval comment" },
+        reason: { type: "string", description: "Rejection reason (required for reject, min 5 chars)" },
+      },
+    },
+    async execute(_id: string, params: Record<string, unknown>) {
+      try {
+        const action = params.action as string;
+        const resolveActor = (): string => {
+          const id = (params.agent_id as string) || fallbackAgentId;
+          return id ? `agent:${id}` : `user:${userId}`;
+        };
+
+        switch (action) {
+          case "list_pending": {
+            let q = supabase
+              .from("pm_gates")
+              .select("id, plan_id, plan_node_id, gate_label, task_id_blocked, created_at, tasks!inner(title, agent_id)")
+              .eq("user_id", userId)
+              .is("approved_at", null)
+              .is("rejected_at", null)
+              .order("created_at", { ascending: true });
+            if (params.agent_id) q = q.eq("tasks.agent_id", params.agent_id as string);
+            const { data, error } = await q;
+            if (error) return err(error.message);
+            return ok({ pending: data || [], count: (data || []).length });
+          }
+
+          case "get": {
+            if (!params.gate_id) return err("Missing required: gate_id");
+            const { data: gate, error } = await supabase
+              .from("pm_gates")
+              .select("*, tasks!inner(id, title, agent_id, status)")
+              .eq("id", params.gate_id as string)
+              .eq("user_id", userId)
+              .maybeSingle();
+            if (error) return err(error.message);
+            if (!gate) return err("Gate not found");
+            const blockedTaskId = (gate as any).task_id_blocked as string;
+            const downstream = await collectTransitiveSuccessors(supabase, userId, blockedTaskId);
+            const blockedTitle = (gate as any).tasks?.title || "blocked task";
+            return ok({
+              gate,
+              impact_on_reject: {
+                failed_task: { id: blockedTaskId, title: blockedTitle },
+                blocked_downstream: downstream,
+                summary: `Rejecting will FAIL '${blockedTitle}' and BLOCK ${downstream.length} downstream task${downstream.length === 1 ? "" : "s"}.`,
+              },
+            });
+          }
+
+          case "approve": {
+            if (!params.gate_id) return err("Missing required: gate_id");
+            if (!params.agent_id && !fallbackAgentId) return err("Missing required: agent_id (calling agent identity — plugin has no implicit agent context)");
+            const actor = resolveActor();
+            const { data, error } = await supabase
+              .from("pm_gates")
+              .update({
+                approved_at: new Date().toISOString(),
+                approved_by: actor,
+                approval_comment: (params.comment as string) ?? null,
+              })
+              .eq("id", params.gate_id as string)
+              .eq("user_id", userId)
+              .is("approved_at", null)
+              .is("rejected_at", null)
+              .select("id");
+            if (error) return err(error.message);
+            if (!data || data.length === 0) return err("Gate not found or already resolved");
+            return ok({ approved: true, gate_id: params.gate_id, approved_by: actor });
+          }
+
+          case "reject": {
+            if (!params.gate_id) return err("Missing required: gate_id");
+            if (!params.agent_id && !fallbackAgentId) return err("Missing required: agent_id (calling agent identity — plugin has no implicit agent context)");
+            const reason = ((params.reason as string) || "").trim();
+            if (reason.length < 5) return err("Missing required: reason (min 5 chars) — rejection requires explanation");
+            const actor = resolveActor();
+            const { data, error } = await supabase.rpc("cascade_reject_gate", {
+              p_gate_id: params.gate_id as string,
+              p_user_id: userId,
+              p_reason: reason,
+              p_actor: actor,
+            });
+            if (error) return err(error.message);
+            return ok({ rejected: true, gate_id: params.gate_id, rejected_by: actor, result: data });
+          }
+
+          default:
+            return err(`Unknown gate action: ${action}`);
+        }
+      } catch (e) {
+        return err(e instanceof Error ? e.message : String(e));
+      }
+    },
+  });
+}

package/src/planExecute.ts

@@ -0,0 +1,197 @@
+// MIRROR — sync manually with dashboard/lib/pm/planExecute.ts
+// Plugin is a separate npm package and cannot import from dashboard/.
+// If you edit either file, update both. Helper algorithm must stay byte-identical
+// across runtimes so pm_dependencies + pm_gates rows have the same shape regardless
+// of whether the plan was executed via dashboard / native ofiere_plan_ops / plugin OFIERE_PLAN_OPS.
+
+/**
+ * Shared plan-execute helper — converts a tree of PlanNodes into concrete
+ * pm_dependencies edges + pm_gates rows.
+ *
+ * Single source of truth for gate semantics (Option A skip-through + Option B
+ * OR-join via group_id + Option C manual gates via pm_gates rows).
+ */
+
+// Minimum PlanNode shape this helper needs. Mirrors the subset of
+// dashboard/lib/pm/planning-types.ts PlanNode used by the algorithm.
+export interface PlanNode {
+  id: string;
+  type: 'task' | 'gate' | 'milestone';
+  title?: string;
+  children: PlanNode[];
+  parallel?: boolean;
+  gateCondition?: 'all_predecessors_complete' | 'any_predecessor_complete' | 'manual';
+}
+
+export interface ExpandedEdge {
+  predTaskId: string;
+  succTaskId: string;
+  groupId: string | null; // non-null = OR-join group key (shared across same-group edges)
+  lagDays: number;
+  dependencyType: 'finish_to_start';
+}
+
+export interface ExpandedGate {
+  planNodeId: string;
+  gateLabel: string;
+  gateCondition: 'manual'; // helper only emits rows for manual gates
+  taskIdBlocked: string;
+}
+
+export interface ExpandResult {
+  edges: ExpandedEdge[];
+  gates: ExpandedGate[];
+  emptyGates: string[]; // plan_node_id of gates whose descendants have zero tasks (diagnostic)
+}
+
+interface LeafHit {
+  taskId: string;
+  gateChain: PlanNode[]; // gates traversed from the leaf up to (and excluding) the starting node
+}
+
+/**
+ * Walk plan tree → emit concrete predecessor edges + manual-gate rows.
+ *
+ * Predecessor resolution (per task/milestone node, walking UP from succ):
+ *   - Root + idx=0                            → no predecessor
+ *   - Root + idx>0                            → leaves of rootSibling[idx-1]
+ *   - Parent.parallel = true + parent is task → predecessor = parent
+ *   - Parent.parallel = true + parent is gate → recurse upward through gate
+ *   - Non-parallel parent + idx>0             → leaves of parent.children[idx-1]
+ *   - Non-parallel parent + idx=0             → parent (recurse if gate)
+ *
+ * Group-id rule: if any gate on the traversal path has
+ * `gateCondition='any_predecessor_complete'`, all resolved sources for this
+ * successor share one UUID-flavored group_id (dispatcher treats as OR-join).
+ *
+ * Manual-gate emission: for each task/milestone, walk UP through `parentOf`
+ * chain and emit one pm_gates row for every `manual` gate ancestor. Nested
+ * manual gates produce N rows; dispatcher AND-joins them.
+ */
+export function expandPlanToDependencyEdges(
+  rootNodes: PlanNode[],
+  idMap: Map<string, string>,
+): ExpandResult {
+  const edges: ExpandedEdge[] = [];
+  const gates: ExpandedGate[] = [];
+  const emptyGates: string[] = [];
+  const seenEdgeKey = new Set<string>();
+  const seenGateKey = new Set<string>();
+
+  const parentOf = new Map<string, PlanNode | null>();
+  const indexInParent = new Map<string, number>();
+  const allNodes: PlanNode[] = [];
+
+  function indexTree(nodes: PlanNode[], parent: PlanNode | null) {
+    nodes.forEach((n, i) => {
+      parentOf.set(n.id, parent);
+      indexInParent.set(n.id, i);
+      allNodes.push(n);
+      if (Array.isArray(n.children) && n.children.length > 0) indexTree(n.children, n);
+    });
+  }
+  indexTree(rootNodes, null);
+
+  // Resolve a node (possibly a gate) to its task-leaf set, tracking gates traversed.
+  function leavesOf(n: PlanNode, gatesAbove: PlanNode[]): LeafHit[] {
+    if (n.type === 'task' || n.type === 'milestone') {
+      const tid = idMap.get(n.id);
+      return tid ? [{ taskId: tid, gateChain: gatesAbove }] : [];
+    }
+    if (n.type === 'gate') {
+      const nextGates = [...gatesAbove, n];
+      const out: LeafHit[] = [];
+      for (const c of (n.children || [])) out.push(...leavesOf(c, nextGates));
+      if (out.length === 0) emptyGates.push(n.id);
+      return out;
+    }
+    return [];
+  }
+
+  // Walk UP from succ to find predecessor leaves + whether any gate on the path is OR-join.
+  function predecessorsFor(succ: PlanNode): { sources: LeafHit[]; orJoin: boolean } {
+    let orJoin = false;
+    let cursor: PlanNode | null = succ;
+
+    while (cursor) {
+      const parent: PlanNode | null = parentOf.get(cursor.id) ?? null;
+      const idx = indexInParent.get(cursor.id) ?? 0;
+
+      if (!parent) {
+        // root-level sibling chain
+        if (idx === 0) return { sources: [], orJoin };
+        return { sources: leavesOf(rootNodes[idx - 1], []), orJoin };
+      }
+
+      // OR-detection happens whenever we traverse into a gate ancestor
+      if (parent.type === 'gate' && parent.gateCondition === 'any_predecessor_complete') {
+        orJoin = true;
+      }
+
+      if (parent.parallel) {
+        // parallel fan-out: predecessor IS the parent
+        if (parent.type === 'gate') { cursor = parent; continue; }
+        const pid = idMap.get(parent.id);
+        return pid ? { sources: [{ taskId: pid, gateChain: [] }], orJoin } : { sources: [], orJoin };
+      }
+
+      if (idx > 0) {
+        // non-parallel: pred is the previous sibling (may itself be a gate)
+        return { sources: leavesOf(parent.children[idx - 1], []), orJoin };
+      }
+
+      // first child of non-parallel parent → pred is the parent (recurse if gate)
+      if (parent.type === 'gate') { cursor = parent; continue; }
+      const pid = idMap.get(parent.id);
+      return pid ? { sources: [{ taskId: pid, gateChain: [] }], orJoin } : { sources: [], orJoin };
+    }
+
+    return { sources: [], orJoin };
+  }
+
+  for (const node of allNodes) {
+    if (node.type !== 'task' && node.type !== 'milestone') continue;
+    const succTaskId = idMap.get(node.id);
+    if (!succTaskId) continue;
+
+    const { sources, orJoin: orJoinFromWalk } = predecessorsFor(node);
+    // OR-join also fires if the resolved leaves passed THROUGH an OR gate on their way up
+    // (e.g., succ is a root-sibling downstream of an OR gate — leavesOf walks INTO the gate).
+    const orJoinFromLeaves = sources.some(s => s.gateChain.some(g => g.type === 'gate' && g.gateCondition === 'any_predecessor_complete'));
+    const orJoin = orJoinFromWalk || orJoinFromLeaves;
+    const groupId = (orJoin && sources.length > 1) ? `grp-${succTaskId}-${node.id.slice(-6)}` : null;
+
+    for (const s of sources) {
+      const key = `${s.taskId}->${succTaskId}|${groupId ?? ''}`;
+      if (seenEdgeKey.has(key)) continue;
+      seenEdgeKey.add(key);
+      edges.push({
+        predTaskId: s.taskId,
+        succTaskId,
+        groupId,
+        lagDays: 0,
+        dependencyType: 'finish_to_start',
+      });
+    }
+
+    // Manual-gate rows: walk UP through every ancestor gate; emit one row per manual gate.
+    let cur: PlanNode | null = parentOf.get(node.id) || null;
+    while (cur) {
+      if (cur.type === 'gate' && cur.gateCondition === 'manual') {
+        const k = `${cur.id}::${succTaskId}`;
+        if (!seenGateKey.has(k)) {
+          seenGateKey.add(k);
+          gates.push({
+            planNodeId: cur.id,
+            gateLabel: cur.title || 'Manual gate',
+            gateCondition: 'manual',
+            taskIdBlocked: succTaskId,
+          });
+        }
+      }
+      cur = parentOf.get(cur.id) || null;
+    }
+  }
+
+  return { edges, gates, emptyGates };
+}