ofiere-openclaw-plugin 4.56.1 → 4.56.3

package/dist/src/tools.js

@@ -17,7 +17,6 @@ import { handleProposeAttach, handleCommitAttach, registerAttachmentContextHook,
 import { invalidateAgentTier } from "./agent-tier.js";
 import { loadSubagentRow, readDispatchSubagentId, loadDispatchContextBySession } from "./staffPersona.js";
 import { expandPlanToDependencyEdges } from "./planExecute.js";
-import { registerGateOps } from "./gateOps.js";
 function ok(data) {
     return {
         content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
@@ -811,9 +810,21 @@ async function handleUpdateTask(supabase, userId, params) {
             "title", "description", "status", "priority", "progress",
             "agent_id", "start_date", "due_date", "tags",
         ];
+        // Fix #8 (2026-05-17): Postgres rejects empty-string for timestamptz columns,
+        // so LLM callers passing start_date/due_date="" to clear a stale value would
+        // error instead of nulling the column. Coerce empty/whitespace → null here
+        // to match the dashboard native executor (see tool-executor.ts handleTaskOps).
+        const TIMESTAMP_FIELDS = ["start_date", "due_date"];
         for (const f of fields) {
-            if (params[f] !== undefined)
-                updates[f] = params[f];
+            if (params[f] !== undefined) {
+                if (TIMESTAMP_FIELDS.includes(f)) {
+                    const v = params[f];
+                    updates[f] = (typeof v === "string" && v.trim() === "") ? null : v;
+                }
+                else {
+                    updates[f] = params[f];
+                }
+            }
         }
         // Cycle 13 (BUG 2): keep status and completed_at consistent. Setting status
         // to DONE stamps completed_at + progress=100. Setting status to anything
@@ -6914,6 +6925,168 @@ supabase, config) {
     api.logger.info(`[ofiere] ${toolCount} meta-tools registered (agent: ${agentLabel})`);
     return toolCount;
 }
+// ═══════════════════════════════════════════════════════════════════════════════
+// META-TOOL 18: OFIERE_GATE_OPS — Manual approval gates (PM Planning)
+// ═══════════════════════════════════════════════════════════════════════════════
+// v4.56.2: inlined from gateOps.ts. OpenClaw host 2026.5.7 tool-discovery only
+// indexes api.registerTool calls present in the same module its plugin entry
+// imports; registrations inside transitive modules (e.g. ./gateOps.ts) are
+// reachable at runtime but invisible to the discovery scan, so the tool router
+// throws `plugin tool runtime missing` even though boot logs show registration.
+async function _gateOpsCollectTransitiveSuccessors(supabase, userId, rootTaskId) {
+    const visited = new Set([rootTaskId]);
+    const out = [];
+    let frontier = [rootTaskId];
+    for (let depth = 0; depth < 20 && frontier.length > 0; depth++) {
+        const { data: deps } = await supabase
+            .from("pm_dependencies")
+            .select("successor_id")
+            .in("predecessor_id", frontier)
+            .eq("user_id", userId);
+        const next = [];
+        for (const d of (deps || [])) {
+            const sid = d.successor_id;
+            if (!sid || visited.has(sid))
+                continue;
+            visited.add(sid);
+            next.push(sid);
+        }
+        if (next.length === 0)
+            break;
+        const { data: tasks } = await supabase
+            .from("tasks")
+            .select("id, title")
+            .in("id", next)
+            .eq("user_id", userId);
+        for (const t of (tasks || []))
+            out.push({ id: t.id, title: t.title });
+        frontier = next;
+    }
+    return out;
+}
+function registerGateOps(api, supabase, userId, fallbackAgentId) {
+    api.registerTool({
+        name: "OFIERE_GATE_OPS",
+        label: "Ofiere Gate Operations",
+        description: `Approve or reject manual gates blocking task dispatch in the Planning Tab.\n\n` +
+            `Actions:\n` +
+            `- "list_pending": List manual gates pending approval. Optional: agent_id (filter to gates whose blocked task is assigned to this agent).\n` +
+            `- "get": Inspect a specific gate + see the cascade impact of rejecting. Required: gate_id. ALWAYS call before "reject" so you understand what will fail.\n` +
+            `- "approve": Approve a gate so the blocked task can dispatch. Required: gate_id, agent_id (the calling chief/staff). Optional: comment.\n` +
+            `- "reject": Reject a gate — FAILS the blocked task and BLOCKS all transitive successors (cascade). Required: gate_id, agent_id, reason (min 5 chars).\n\n` +
+            `Why agent_id is required: plugin runtime has no implicit agent identity. The agent invoking this tool MUST pass its own id so approval audit trail records 'agent:<id>' instead of 'user:<owner_uuid>'. Falls back to gateway OFIERE_AGENT_ID env when absent.`,
+        parameters: {
+            type: "object",
+            required: ["action"],
+            properties: {
+                action: { type: "string", enum: ["list_pending", "get", "approve", "reject"], description: "list_pending | get | approve | reject" },
+                gate_id: { type: "string", description: "Gate UUID (required for get, approve, reject)" },
+                agent_id: { type: "string", description: "Calling agent id (required for approve, reject — recorded as 'agent:<id>' in approved_by / rejected_by). Also optional filter for list_pending." },
+                comment: { type: "string", description: "Optional approval comment" },
+                reason: { type: "string", description: "Rejection reason (required for reject, min 5 chars)" },
+            },
+        },
+        async execute(_id, params) {
+            try {
+                const action = params.action;
+                const resolveActor = () => {
+                    const id = params.agent_id || fallbackAgentId;
+                    return id ? `agent:${id}` : `user:${userId}`;
+                };
+                switch (action) {
+                    case "list_pending": {
+                        let q = supabase
+                            .from("pm_gates")
+                            .select("id, plan_id, plan_node_id, gate_label, task_id_blocked, created_at, tasks!inner(title, agent_id)")
+                            .eq("user_id", userId)
+                            .is("approved_at", null)
+                            .is("rejected_at", null)
+                            .order("created_at", { ascending: true });
+                        if (params.agent_id)
+                            q = q.eq("tasks.agent_id", params.agent_id);
+                        const { data, error } = await q;
+                        if (error)
+                            return { content: [{ type: "text", text: `Error: ${error.message}` }] };
+                        return { content: [{ type: "text", text: JSON.stringify({ pending: data || [], count: (data || []).length }, null, 2) }] };
+                    }
+                    case "get": {
+                        if (!params.gate_id)
+                            return { content: [{ type: "text", text: `Error: Missing required: gate_id` }] };
+                        const { data: gate, error } = await supabase
+                            .from("pm_gates")
+                            .select("*, tasks!inner(id, title, agent_id, status)")
+                            .eq("id", params.gate_id)
+                            .eq("user_id", userId)
+                            .maybeSingle();
+                        if (error)
+                            return { content: [{ type: "text", text: `Error: ${error.message}` }] };
+                        if (!gate)
+                            return { content: [{ type: "text", text: `Error: Gate not found` }] };
+                        const blockedTaskId = gate.task_id_blocked;
+                        const downstream = await _gateOpsCollectTransitiveSuccessors(supabase, userId, blockedTaskId);
+                        const blockedTitle = gate.tasks?.title || "blocked task";
+                        return { content: [{ type: "text", text: JSON.stringify({
+                                        gate,
+                                        impact_on_reject: {
+                                            failed_task: { id: blockedTaskId, title: blockedTitle },
+                                            blocked_downstream: downstream,
+                                            summary: `Rejecting will FAIL '${blockedTitle}' and BLOCK ${downstream.length} downstream task${downstream.length === 1 ? "" : "s"}.`,
+                                        },
+                                    }, null, 2) }] };
+                    }
+                    case "approve": {
+                        if (!params.gate_id)
+                            return { content: [{ type: "text", text: `Error: Missing required: gate_id` }] };
+                        if (!params.agent_id && !fallbackAgentId)
+                            return { content: [{ type: "text", text: `Error: Missing required: agent_id (calling agent identity — plugin has no implicit agent context)` }] };
+                        const actor = resolveActor();
+                        const { data, error } = await supabase
+                            .from("pm_gates")
+                            .update({
+                            approved_at: new Date().toISOString(),
+                            approved_by: actor,
+                            approval_comment: params.comment ?? null,
+                        })
+                            .eq("id", params.gate_id)
+                            .eq("user_id", userId)
+                            .is("approved_at", null)
+                            .is("rejected_at", null)
+                            .select("id");
+                        if (error)
+                            return { content: [{ type: "text", text: `Error: ${error.message}` }] };
+                        if (!data || data.length === 0)
+                            return { content: [{ type: "text", text: `Error: Gate not found or already resolved` }] };
+                        return { content: [{ type: "text", text: JSON.stringify({ approved: true, gate_id: params.gate_id, approved_by: actor }, null, 2) }] };
+                    }
+                    case "reject": {
+                        if (!params.gate_id)
+                            return { content: [{ type: "text", text: `Error: Missing required: gate_id` }] };
+                        if (!params.agent_id && !fallbackAgentId)
+                            return { content: [{ type: "text", text: `Error: Missing required: agent_id (calling agent identity — plugin has no implicit agent context)` }] };
+                        const reason = (params.reason || "").trim();
+                        if (reason.length < 5)
+                            return { content: [{ type: "text", text: `Error: Missing required: reason (min 5 chars) — rejection requires explanation` }] };
+                        const actor = resolveActor();
+                        const { data, error } = await supabase.rpc("cascade_reject_gate", {
+                            p_gate_id: params.gate_id,
+                            p_user_id: userId,
+                            p_reason: reason,
+                            p_actor: actor,
+                        });
+                        if (error)
+                            return { content: [{ type: "text", text: `Error: ${error.message}` }] };
+                        return { content: [{ type: "text", text: JSON.stringify({ rejected: true, gate_id: params.gate_id, rejected_by: actor, result: data }, null, 2) }] };
+                    }
+                    default:
+                        return { content: [{ type: "text", text: `Error: Unknown gate action: ${action}` }] };
+                }
+            }
+            catch (e) {
+                return { content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }] };
+            }
+        },
+    });
+}
 // ── Server-Side Brain Extraction (agent_end hook) ─────────────────────────
 // Fires after EVERY agent turn completes, regardless of channel.
 // Extracts L1 raw fragments and lightweight L2 summaries.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofiere-openclaw-plugin",
-  "version": "4.56.1",
+  "version": "4.56.3",
   "type": "module",
   "description": "OpenClaw plugin for Ofiere PM - 18 meta-tools covering tasks, agents, projects, scheduling, knowledge, workflows, notifications, memory, prompts, constellation, space file management, execution plan builder, SOP management, agent brain, talent management, corporate frameworks, agent office canvas, and PM gate approvals",
   "keywords": [

package/src/tools.ts

@@ -24,7 +24,6 @@ import {
 import { invalidateAgentTier } from "./agent-tier.js";
 import { loadSubagentRow, readDispatchSubagentId, loadDispatchContextBySession, type DispatchContextRow } from "./staffPersona.js";
 import { expandPlanToDependencyEdges, type PlanNode } from "./planExecute.js";
-import { registerGateOps } from "./gateOps.js";
 
 // ─── Tool result shape (matches OpenClaw SDK) ────────────────────────────────
 
@@ -901,8 +900,20 @@ async function handleUpdateTask(
       "title", "description", "status", "priority", "progress",
       "agent_id", "start_date", "due_date", "tags",
     ];
+    // Fix #8 (2026-05-17): Postgres rejects empty-string for timestamptz columns,
+    // so LLM callers passing start_date/due_date="" to clear a stale value would
+    // error instead of nulling the column. Coerce empty/whitespace → null here
+    // to match the dashboard native executor (see tool-executor.ts handleTaskOps).
+    const TIMESTAMP_FIELDS = ["start_date", "due_date"];
     for (const f of fields) {
-      if (params[f] !== undefined) updates[f] = params[f];
+      if (params[f] !== undefined) {
+        if (TIMESTAMP_FIELDS.includes(f)) {
+          const v = params[f];
+          updates[f] = (typeof v === "string" && v.trim() === "") ? null : v;
+        } else {
+          updates[f] = params[f];
+        }
+      }
     }
     // Cycle 13 (BUG 2): keep status and completed_at consistent. Setting status
     // to DONE stamps completed_at + progress=100. Setting status to anything
@@ -7081,6 +7092,169 @@ export function registerTools(
   return toolCount;
 }
 
+// ═══════════════════════════════════════════════════════════════════════════════
+// META-TOOL 18: OFIERE_GATE_OPS — Manual approval gates (PM Planning)
+// ═══════════════════════════════════════════════════════════════════════════════
+// v4.56.2: inlined from gateOps.ts. OpenClaw host 2026.5.7 tool-discovery only
+// indexes api.registerTool calls present in the same module its plugin entry
+// imports; registrations inside transitive modules (e.g. ./gateOps.ts) are
+// reachable at runtime but invisible to the discovery scan, so the tool router
+// throws `plugin tool runtime missing` even though boot logs show registration.
+
+async function _gateOpsCollectTransitiveSuccessors(
+  supabase: SupabaseClient,
+  userId: string,
+  rootTaskId: string,
+): Promise<{ id: string; title: string }[]> {
+  const visited = new Set<string>([rootTaskId]);
+  const out: { id: string; title: string }[] = [];
+  let frontier: string[] = [rootTaskId];
+  for (let depth = 0; depth < 20 && frontier.length > 0; depth++) {
+    const { data: deps } = await supabase
+      .from("pm_dependencies")
+      .select("successor_id")
+      .in("predecessor_id", frontier)
+      .eq("user_id", userId);
+    const next: string[] = [];
+    for (const d of (deps || [])) {
+      const sid = (d as any).successor_id as string;
+      if (!sid || visited.has(sid)) continue;
+      visited.add(sid);
+      next.push(sid);
+    }
+    if (next.length === 0) break;
+    const { data: tasks } = await supabase
+      .from("tasks")
+      .select("id, title")
+      .in("id", next)
+      .eq("user_id", userId);
+    for (const t of (tasks || [])) out.push({ id: (t as any).id, title: (t as any).title });
+    frontier = next;
+  }
+  return out;
+}
+
+function registerGateOps(
+  api: any,
+  supabase: SupabaseClient,
+  userId: string,
+  fallbackAgentId: string | undefined,
+): void {
+  api.registerTool({
+    name: "OFIERE_GATE_OPS",
+    label: "Ofiere Gate Operations",
+    description:
+      `Approve or reject manual gates blocking task dispatch in the Planning Tab.\n\n` +
+      `Actions:\n` +
+      `- "list_pending": List manual gates pending approval. Optional: agent_id (filter to gates whose blocked task is assigned to this agent).\n` +
+      `- "get": Inspect a specific gate + see the cascade impact of rejecting. Required: gate_id. ALWAYS call before "reject" so you understand what will fail.\n` +
+      `- "approve": Approve a gate so the blocked task can dispatch. Required: gate_id, agent_id (the calling chief/staff). Optional: comment.\n` +
+      `- "reject": Reject a gate — FAILS the blocked task and BLOCKS all transitive successors (cascade). Required: gate_id, agent_id, reason (min 5 chars).\n\n` +
+      `Why agent_id is required: plugin runtime has no implicit agent identity. The agent invoking this tool MUST pass its own id so approval audit trail records 'agent:<id>' instead of 'user:<owner_uuid>'. Falls back to gateway OFIERE_AGENT_ID env when absent.`,
+    parameters: {
+      type: "object",
+      required: ["action"],
+      properties: {
+        action: { type: "string", enum: ["list_pending", "get", "approve", "reject"], description: "list_pending | get | approve | reject" },
+        gate_id: { type: "string", description: "Gate UUID (required for get, approve, reject)" },
+        agent_id: { type: "string", description: "Calling agent id (required for approve, reject — recorded as 'agent:<id>' in approved_by / rejected_by). Also optional filter for list_pending." },
+        comment: { type: "string", description: "Optional approval comment" },
+        reason: { type: "string", description: "Rejection reason (required for reject, min 5 chars)" },
+      },
+    },
+    async execute(_id: string, params: Record<string, unknown>) {
+      try {
+        const action = params.action as string;
+        const resolveActor = (): string => {
+          const id = (params.agent_id as string) || fallbackAgentId;
+          return id ? `agent:${id}` : `user:${userId}`;
+        };
+
+        switch (action) {
+          case "list_pending": {
+            let q = supabase
+              .from("pm_gates")
+              .select("id, plan_id, plan_node_id, gate_label, task_id_blocked, created_at, tasks!inner(title, agent_id)")
+              .eq("user_id", userId)
+              .is("approved_at", null)
+              .is("rejected_at", null)
+              .order("created_at", { ascending: true });
+            if (params.agent_id) q = q.eq("tasks.agent_id", params.agent_id as string);
+            const { data, error } = await q;
+            if (error) return { content: [{ type: "text" as const, text: `Error: ${error.message}` }] };
+            return { content: [{ type: "text" as const, text: JSON.stringify({ pending: data || [], count: (data || []).length }, null, 2) }] };
+          }
+
+          case "get": {
+            if (!params.gate_id) return { content: [{ type: "text" as const, text: `Error: Missing required: gate_id` }] };
+            const { data: gate, error } = await supabase
+              .from("pm_gates")
+              .select("*, tasks!inner(id, title, agent_id, status)")
+              .eq("id", params.gate_id as string)
+              .eq("user_id", userId)
+              .maybeSingle();
+            if (error) return { content: [{ type: "text" as const, text: `Error: ${error.message}` }] };
+            if (!gate) return { content: [{ type: "text" as const, text: `Error: Gate not found` }] };
+            const blockedTaskId = (gate as any).task_id_blocked as string;
+            const downstream = await _gateOpsCollectTransitiveSuccessors(supabase, userId, blockedTaskId);
+            const blockedTitle = (gate as any).tasks?.title || "blocked task";
+            return { content: [{ type: "text" as const, text: JSON.stringify({
+              gate,
+              impact_on_reject: {
+                failed_task: { id: blockedTaskId, title: blockedTitle },
+                blocked_downstream: downstream,
+                summary: `Rejecting will FAIL '${blockedTitle}' and BLOCK ${downstream.length} downstream task${downstream.length === 1 ? "" : "s"}.`,
+              },
+            }, null, 2) }] };
+          }
+
+          case "approve": {
+            if (!params.gate_id) return { content: [{ type: "text" as const, text: `Error: Missing required: gate_id` }] };
+            if (!params.agent_id && !fallbackAgentId) return { content: [{ type: "text" as const, text: `Error: Missing required: agent_id (calling agent identity — plugin has no implicit agent context)` }] };
+            const actor = resolveActor();
+            const { data, error } = await supabase
+              .from("pm_gates")
+              .update({
+                approved_at: new Date().toISOString(),
+                approved_by: actor,
+                approval_comment: (params.comment as string) ?? null,
+              })
+              .eq("id", params.gate_id as string)
+              .eq("user_id", userId)
+              .is("approved_at", null)
+              .is("rejected_at", null)
+              .select("id");
+            if (error) return { content: [{ type: "text" as const, text: `Error: ${error.message}` }] };
+            if (!data || data.length === 0) return { content: [{ type: "text" as const, text: `Error: Gate not found or already resolved` }] };
+            return { content: [{ type: "text" as const, text: JSON.stringify({ approved: true, gate_id: params.gate_id, approved_by: actor }, null, 2) }] };
+          }
+
+          case "reject": {
+            if (!params.gate_id) return { content: [{ type: "text" as const, text: `Error: Missing required: gate_id` }] };
+            if (!params.agent_id && !fallbackAgentId) return { content: [{ type: "text" as const, text: `Error: Missing required: agent_id (calling agent identity — plugin has no implicit agent context)` }] };
+            const reason = ((params.reason as string) || "").trim();
+            if (reason.length < 5) return { content: [{ type: "text" as const, text: `Error: Missing required: reason (min 5 chars) — rejection requires explanation` }] };
+            const actor = resolveActor();
+            const { data, error } = await supabase.rpc("cascade_reject_gate", {
+              p_gate_id: params.gate_id as string,
+              p_user_id: userId,
+              p_reason: reason,
+              p_actor: actor,
+            });
+            if (error) return { content: [{ type: "text" as const, text: `Error: ${error.message}` }] };
+            return { content: [{ type: "text" as const, text: JSON.stringify({ rejected: true, gate_id: params.gate_id, rejected_by: actor, result: data }, null, 2) }] };
+          }
+
+          default:
+            return { content: [{ type: "text" as const, text: `Error: Unknown gate action: ${action}` }] };
+        }
+      } catch (e) {
+        return { content: [{ type: "text" as const, text: `Error: ${e instanceof Error ? e.message : String(e)}` }] };
+      }
+    },
+  });
+}
+
 // ── Server-Side Brain Extraction (agent_end hook) ─────────────────────────
 // Fires after EVERY agent turn completes, regardless of channel.
 // Extracts L1 raw fragments and lightweight L2 summaries.

package/dist/src/gateOps.js

@@ -1,169 +0,0 @@
-// src/gateOps.ts — OFIERE_GATE_OPS meta-tool
-// Approve / reject manual gates blocking task dispatch in the Planning Tab.
-//
-// Phase 0 finding: plugin factory carries no implicit agentId in closure.
-// The CALLING chief / staff agent MUST pass `agent_id` explicitly for approve/reject
-// so the audit trail records "agent:<id>" in approved_by / rejected_by.
-// Fallback order: args.agent_id → fallbackAgentId (gateway OFIERE_AGENT_ID env) → "user:<userId>".
-function ok(data) {
-    return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-}
-function err(message) {
-    return { content: [{ type: "text", text: `Error: ${message}` }] };
-}
-// Bounded BFS — collect transitive successors so the agent sees cascade impact
-// before rejecting. Mirrors dashboard/lib/ofie/tool-executor.ts _collectTransitiveSuccessors.
-async function collectTransitiveSuccessors(supabase, userId, rootTaskId) {
-    const visited = new Set([rootTaskId]);
-    const out = [];
-    let frontier = [rootTaskId];
-    for (let depth = 0; depth < 20 && frontier.length > 0; depth++) {
-        const { data: deps } = await supabase
-            .from("pm_dependencies")
-            .select("successor_id")
-            .in("predecessor_id", frontier)
-            .eq("user_id", userId);
-        const next = [];
-        for (const d of (deps || [])) {
-            const sid = d.successor_id;
-            if (!sid || visited.has(sid))
-                continue;
-            visited.add(sid);
-            next.push(sid);
-        }
-        if (next.length === 0)
-            break;
-        const { data: tasks } = await supabase
-            .from("tasks")
-            .select("id, title")
-            .in("id", next)
-            .eq("user_id", userId);
-        for (const t of (tasks || []))
-            out.push({ id: t.id, title: t.title });
-        frontier = next;
-    }
-    return out;
-}
-export function registerGateOps(api, supabase, userId, fallbackAgentId) {
-    api.registerTool({
-        name: "OFIERE_GATE_OPS",
-        label: "Ofiere Gate Operations",
-        description: `Approve or reject manual gates blocking task dispatch in the Planning Tab.\n\n` +
-            `Actions:\n` +
-            `- "list_pending": List manual gates pending approval. Optional: agent_id (filter to gates whose blocked task is assigned to this agent).\n` +
-            `- "get": Inspect a specific gate + see the cascade impact of rejecting. Required: gate_id. ALWAYS call before "reject" so you understand what will fail.\n` +
-            `- "approve": Approve a gate so the blocked task can dispatch. Required: gate_id, agent_id (the calling chief/staff). Optional: comment.\n` +
-            `- "reject": Reject a gate — FAILS the blocked task and BLOCKS all transitive successors (cascade). Required: gate_id, agent_id, reason (min 5 chars).\n\n` +
-            `Why agent_id is required: plugin runtime has no implicit agent identity. The agent invoking this tool MUST pass its own id so approval audit trail records 'agent:<id>' instead of 'user:<owner_uuid>'. Falls back to gateway OFIERE_AGENT_ID env when absent.`,
-        parameters: {
-            type: "object",
-            required: ["action"],
-            properties: {
-                action: { type: "string", enum: ["list_pending", "get", "approve", "reject"], description: "list_pending | get | approve | reject" },
-                gate_id: { type: "string", description: "Gate UUID (required for get, approve, reject)" },
-                agent_id: { type: "string", description: "Calling agent id (required for approve, reject — recorded as 'agent:<id>' in approved_by / rejected_by). Also optional filter for list_pending." },
-                comment: { type: "string", description: "Optional approval comment" },
-                reason: { type: "string", description: "Rejection reason (required for reject, min 5 chars)" },
-            },
-        },
-        async execute(_id, params) {
-            try {
-                const action = params.action;
-                const resolveActor = () => {
-                    const id = params.agent_id || fallbackAgentId;
-                    return id ? `agent:${id}` : `user:${userId}`;
-                };
-                switch (action) {
-                    case "list_pending": {
-                        let q = supabase
-                            .from("pm_gates")
-                            .select("id, plan_id, plan_node_id, gate_label, task_id_blocked, created_at, tasks!inner(title, agent_id)")
-                            .eq("user_id", userId)
-                            .is("approved_at", null)
-                            .is("rejected_at", null)
-                            .order("created_at", { ascending: true });
-                        if (params.agent_id)
-                            q = q.eq("tasks.agent_id", params.agent_id);
-                        const { data, error } = await q;
-                        if (error)
-                            return err(error.message);
-                        return ok({ pending: data || [], count: (data || []).length });
-                    }
-                    case "get": {
-                        if (!params.gate_id)
-                            return err("Missing required: gate_id");
-                        const { data: gate, error } = await supabase
-                            .from("pm_gates")
-                            .select("*, tasks!inner(id, title, agent_id, status)")
-                            .eq("id", params.gate_id)
-                            .eq("user_id", userId)
-                            .maybeSingle();
-                        if (error)
-                            return err(error.message);
-                        if (!gate)
-                            return err("Gate not found");
-                        const blockedTaskId = gate.task_id_blocked;
-                        const downstream = await collectTransitiveSuccessors(supabase, userId, blockedTaskId);
-                        const blockedTitle = gate.tasks?.title || "blocked task";
-                        return ok({
-                            gate,
-                            impact_on_reject: {
-                                failed_task: { id: blockedTaskId, title: blockedTitle },
-                                blocked_downstream: downstream,
-                                summary: `Rejecting will FAIL '${blockedTitle}' and BLOCK ${downstream.length} downstream task${downstream.length === 1 ? "" : "s"}.`,
-                            },
-                        });
-                    }
-                    case "approve": {
-                        if (!params.gate_id)
-                            return err("Missing required: gate_id");
-                        if (!params.agent_id && !fallbackAgentId)
-                            return err("Missing required: agent_id (calling agent identity — plugin has no implicit agent context)");
-                        const actor = resolveActor();
-                        const { data, error } = await supabase
-                            .from("pm_gates")
-                            .update({
-                            approved_at: new Date().toISOString(),
-                            approved_by: actor,
-                            approval_comment: params.comment ?? null,
-                        })
-                            .eq("id", params.gate_id)
-                            .eq("user_id", userId)
-                            .is("approved_at", null)
-                            .is("rejected_at", null)
-                            .select("id");
-                        if (error)
-                            return err(error.message);
-                        if (!data || data.length === 0)
-                            return err("Gate not found or already resolved");
-                        return ok({ approved: true, gate_id: params.gate_id, approved_by: actor });
-                    }
-                    case "reject": {
-                        if (!params.gate_id)
-                            return err("Missing required: gate_id");
-                        if (!params.agent_id && !fallbackAgentId)
-                            return err("Missing required: agent_id (calling agent identity — plugin has no implicit agent context)");
-                        const reason = (params.reason || "").trim();
-                        if (reason.length < 5)
-                            return err("Missing required: reason (min 5 chars) — rejection requires explanation");
-                        const actor = resolveActor();
-                        const { data, error } = await supabase.rpc("cascade_reject_gate", {
-                            p_gate_id: params.gate_id,
-                            p_user_id: userId,
-                            p_reason: reason,
-                            p_actor: actor,
-                        });
-                        if (error)
-                            return err(error.message);
-                        return ok({ rejected: true, gate_id: params.gate_id, rejected_by: actor, result: data });
-                    }
-                    default:
-                        return err(`Unknown gate action: ${action}`);
-                }
-            }
-            catch (e) {
-                return err(e instanceof Error ? e.message : String(e));
-            }
-        },
-    });
-}

package/src/gateOps.ts

@@ -1,177 +0,0 @@
-// src/gateOps.ts — OFIERE_GATE_OPS meta-tool
-// Approve / reject manual gates blocking task dispatch in the Planning Tab.
-//
-// Phase 0 finding: plugin factory carries no implicit agentId in closure.
-// The CALLING chief / staff agent MUST pass `agent_id` explicitly for approve/reject
-// so the audit trail records "agent:<id>" in approved_by / rejected_by.
-// Fallback order: args.agent_id → fallbackAgentId (gateway OFIERE_AGENT_ID env) → "user:<userId>".
-
-import type { SupabaseClient } from "@supabase/supabase-js";
-
-interface ToolResult {
-  content: Array<{ type: "text"; text: string }>;
-}
-
-function ok(data: unknown): ToolResult {
-  return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
-}
-
-function err(message: string): ToolResult {
-  return { content: [{ type: "text" as const, text: `Error: ${message}` }] };
-}
-
-// Bounded BFS — collect transitive successors so the agent sees cascade impact
-// before rejecting. Mirrors dashboard/lib/ofie/tool-executor.ts _collectTransitiveSuccessors.
-async function collectTransitiveSuccessors(
-  supabase: SupabaseClient,
-  userId: string,
-  rootTaskId: string,
-): Promise<{ id: string; title: string }[]> {
-  const visited = new Set<string>([rootTaskId]);
-  const out: { id: string; title: string }[] = [];
-  let frontier: string[] = [rootTaskId];
-  for (let depth = 0; depth < 20 && frontier.length > 0; depth++) {
-    const { data: deps } = await supabase
-      .from("pm_dependencies")
-      .select("successor_id")
-      .in("predecessor_id", frontier)
-      .eq("user_id", userId);
-    const next: string[] = [];
-    for (const d of (deps || [])) {
-      const sid = (d as any).successor_id as string;
-      if (!sid || visited.has(sid)) continue;
-      visited.add(sid);
-      next.push(sid);
-    }
-    if (next.length === 0) break;
-    const { data: tasks } = await supabase
-      .from("tasks")
-      .select("id, title")
-      .in("id", next)
-      .eq("user_id", userId);
-    for (const t of (tasks || [])) out.push({ id: (t as any).id, title: (t as any).title });
-    frontier = next;
-  }
-  return out;
-}
-
-export function registerGateOps(
-  api: any,
-  supabase: SupabaseClient,
-  userId: string,
-  fallbackAgentId: string | undefined,
-): void {
-  api.registerTool({
-    name: "OFIERE_GATE_OPS",
-    label: "Ofiere Gate Operations",
-    description:
-      `Approve or reject manual gates blocking task dispatch in the Planning Tab.\n\n` +
-      `Actions:\n` +
-      `- "list_pending": List manual gates pending approval. Optional: agent_id (filter to gates whose blocked task is assigned to this agent).\n` +
-      `- "get": Inspect a specific gate + see the cascade impact of rejecting. Required: gate_id. ALWAYS call before "reject" so you understand what will fail.\n` +
-      `- "approve": Approve a gate so the blocked task can dispatch. Required: gate_id, agent_id (the calling chief/staff). Optional: comment.\n` +
-      `- "reject": Reject a gate — FAILS the blocked task and BLOCKS all transitive successors (cascade). Required: gate_id, agent_id, reason (min 5 chars).\n\n` +
-      `Why agent_id is required: plugin runtime has no implicit agent identity. The agent invoking this tool MUST pass its own id so approval audit trail records 'agent:<id>' instead of 'user:<owner_uuid>'. Falls back to gateway OFIERE_AGENT_ID env when absent.`,
-    parameters: {
-      type: "object",
-      required: ["action"],
-      properties: {
-        action: { type: "string", enum: ["list_pending", "get", "approve", "reject"], description: "list_pending | get | approve | reject" },
-        gate_id: { type: "string", description: "Gate UUID (required for get, approve, reject)" },
-        agent_id: { type: "string", description: "Calling agent id (required for approve, reject — recorded as 'agent:<id>' in approved_by / rejected_by). Also optional filter for list_pending." },
-        comment: { type: "string", description: "Optional approval comment" },
-        reason: { type: "string", description: "Rejection reason (required for reject, min 5 chars)" },
-      },
-    },
-    async execute(_id: string, params: Record<string, unknown>) {
-      try {
-        const action = params.action as string;
-        const resolveActor = (): string => {
-          const id = (params.agent_id as string) || fallbackAgentId;
-          return id ? `agent:${id}` : `user:${userId}`;
-        };
-
-        switch (action) {
-          case "list_pending": {
-            let q = supabase
-              .from("pm_gates")
-              .select("id, plan_id, plan_node_id, gate_label, task_id_blocked, created_at, tasks!inner(title, agent_id)")
-              .eq("user_id", userId)
-              .is("approved_at", null)
-              .is("rejected_at", null)
-              .order("created_at", { ascending: true });
-            if (params.agent_id) q = q.eq("tasks.agent_id", params.agent_id as string);
-            const { data, error } = await q;
-            if (error) return err(error.message);
-            return ok({ pending: data || [], count: (data || []).length });
-          }
-
-          case "get": {
-            if (!params.gate_id) return err("Missing required: gate_id");
-            const { data: gate, error } = await supabase
-              .from("pm_gates")
-              .select("*, tasks!inner(id, title, agent_id, status)")
-              .eq("id", params.gate_id as string)
-              .eq("user_id", userId)
-              .maybeSingle();
-            if (error) return err(error.message);
-            if (!gate) return err("Gate not found");
-            const blockedTaskId = (gate as any).task_id_blocked as string;
-            const downstream = await collectTransitiveSuccessors(supabase, userId, blockedTaskId);
-            const blockedTitle = (gate as any).tasks?.title || "blocked task";
-            return ok({
-              gate,
-              impact_on_reject: {
-                failed_task: { id: blockedTaskId, title: blockedTitle },
-                blocked_downstream: downstream,
-                summary: `Rejecting will FAIL '${blockedTitle}' and BLOCK ${downstream.length} downstream task${downstream.length === 1 ? "" : "s"}.`,
-              },
-            });
-          }
-
-          case "approve": {
-            if (!params.gate_id) return err("Missing required: gate_id");
-            if (!params.agent_id && !fallbackAgentId) return err("Missing required: agent_id (calling agent identity — plugin has no implicit agent context)");
-            const actor = resolveActor();
-            const { data, error } = await supabase
-              .from("pm_gates")
-              .update({
-                approved_at: new Date().toISOString(),
-                approved_by: actor,
-                approval_comment: (params.comment as string) ?? null,
-              })
-              .eq("id", params.gate_id as string)
-              .eq("user_id", userId)
-              .is("approved_at", null)
-              .is("rejected_at", null)
-              .select("id");
-            if (error) return err(error.message);
-            if (!data || data.length === 0) return err("Gate not found or already resolved");
-            return ok({ approved: true, gate_id: params.gate_id, approved_by: actor });
-          }
-
-          case "reject": {
-            if (!params.gate_id) return err("Missing required: gate_id");
-            if (!params.agent_id && !fallbackAgentId) return err("Missing required: agent_id (calling agent identity — plugin has no implicit agent context)");
-            const reason = ((params.reason as string) || "").trim();
-            if (reason.length < 5) return err("Missing required: reason (min 5 chars) — rejection requires explanation");
-            const actor = resolveActor();
-            const { data, error } = await supabase.rpc("cascade_reject_gate", {
-              p_gate_id: params.gate_id as string,
-              p_user_id: userId,
-              p_reason: reason,
-              p_actor: actor,
-            });
-            if (error) return err(error.message);
-            return ok({ rejected: true, gate_id: params.gate_id, rejected_by: actor, result: data });
-          }
-
-          default:
-            return err(`Unknown gate action: ${action}`);
-        }
-      } catch (e) {
-        return err(e instanceof Error ? e.message : String(e));
-      }
-    },
-  });
-}