openryoko 2026.8.27 → 2026.8.29

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "openryoko",
-    "version": "2026.8.27",
+    "version": "2026.8.29",
     "description": "OpenRyoko — Slackで空気を読んで働くAIアシスタント・ゲートウェイ（Jinnベース、Claude Code/Codex/Gemini CLI対応）",
     "license": "MIT",
     "type": "module",
@@ -40,7 +40,8 @@
         "qrcode": "^1.5.4",
         "qrcode-terminal": "^0.12.0",
         "uuid": "^11.1.1",
-        "ws": "^8.21.3"
+        "ws": "^8.21.3",
+        "zod": "^4.4.3"
     },
     "devDependencies": {
         "@types/better-sqlite3": "^7.6.0",

package/dist/src/cron/validation.d.ts

@@ -0,0 +1,14 @@
+export type CronScheduleField = 'schedule' | 'timezone' | 'until';
+export interface CronScheduleValidationError {
+    field: CronScheduleField;
+    message: string;
+}
+export interface CronScheduleInput {
+    schedule: unknown;
+    timezone?: unknown;
+    until?: unknown;
+}
+/** Validate with the same cron parser used by the scheduler plus the platform's
+ * IANA timezone implementation. This is safe to call before any persistence. */
+export declare function validateCronSchedule(input: CronScheduleInput): CronScheduleValidationError[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/src/cron/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/cron/validation.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;gFACgF;AAChF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,2BAA2B,EAAE,CAuB5F"}

package/dist/src/cron/validation.js

@@ -0,0 +1,30 @@
+import cron from 'node-cron';
+/** Validate with the same cron parser used by the scheduler plus the platform's
+ * IANA timezone implementation. This is safe to call before any persistence. */
+export function validateCronSchedule(input) {
+    const errors = [];
+    if (typeof input.schedule !== 'string' || !input.schedule.trim() || !cron.validate(input.schedule.trim())) {
+        errors.push({ field: 'schedule', message: 'schedule must be a valid cron expression' });
+    }
+    if (input.timezone !== undefined) {
+        if (typeof input.timezone !== 'string' || !input.timezone.trim()) {
+            errors.push({ field: 'timezone', message: 'timezone must be a non-empty IANA timezone' });
+        }
+        else {
+            try {
+                new Intl.DateTimeFormat('en-US', { timeZone: input.timezone.trim() }).format(0);
+            }
+            catch {
+                errors.push({ field: 'timezone', message: `timezone "${input.timezone}" is not a valid IANA timezone` });
+            }
+        }
+    }
+    if (input.until !== undefined) {
+        const timestamp = typeof input.until === 'string' && input.until.trim() ? Date.parse(input.until) : Number.NaN;
+        if (!Number.isFinite(timestamp)) {
+            errors.push({ field: 'until', message: 'until must be a finite ISO-8601 timestamp' });
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=validation.js.map

package/dist/src/cron/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/cron/validation.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAe7B;gFACgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,MAAM,MAAM,GAAkC,EAAE,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1G,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,KAAK,CAAC,QAAQ,gCAAgC,EAAE,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/G,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/gateway/api.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage as HttpRequest, ServerResponse } from "node:http";
 import type { JinnConfig } from "../shared/types.js";
 import type { SessionManager } from "../sessions/manager.js";
+import type { WorkflowService } from "../workflows/service.js";
 export interface ApiContext {
     config: JinnConfig;
     sessionManager: SessionManager;
@@ -47,6 +48,8 @@ export interface ApiContext {
     hookSecret?: string;
     authToken?: string;
     authHome?: string;
+    /** Present only when config.workflows.enabled — carries the Workflow engine. */
+    workflowService?: WorkflowService;
 }
 export declare function resumePendingWebQueueItems(context: ApiContext): void;
 export declare function deepMerge(target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown>;

package/dist/src/gateway/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/gateway/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,IAAI,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOhF,OAAO,KAAK,EAAoC,UAAU,EAAmB,MAAM,oBAAoB,CAAC;AAExG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAuF7D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,UAAU,CAAC;IAC5B,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAChD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,oBAAoB,EAAE,SAAS,CAAC,CAAC;IAChE,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACrG;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAChG;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,MAAM,IAAI,CAAC;IACzC;;;;OAIG;IACH,gCAAgC,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,oBAAoB,EAAE,YAAY,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CA4CpE;AA+MD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCnH;AA4CD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CA60Df"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/gateway/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,IAAI,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOhF,OAAO,KAAK,EAAoC,UAAU,EAAmB,MAAM,oBAAoB,CAAC;AAExG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA0E7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAgB/D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,UAAU,CAAC;IAC5B,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAChD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,oBAAoB,EAAE,SAAS,CAAC,CAAC;IAChE,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACrG;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAChG;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,MAAM,IAAI,CAAC;IACzC;;;;OAIG;IACH,gCAAgC,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,oBAAoB,EAAE,YAAY,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CA4CpE;AA+MD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCnH;AA4CD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CAw1Df"}

package/dist/src/gateway/api.js

@@ -31,6 +31,8 @@ import { recordTurnAccounting } from "../sessions/accounting.js";
 import { messageText } from "./message-body.js";
 import { decodeSessionCursor, encodeSessionCursor } from "./pagination.js";
 import { authCookieHeaders, clearAuthCookieHeaders, consumePairingCode, createAuthSession, currentDeviceId, issuePairingCode, listAuthSessions, requestIsSecure, revokeAuthSession, shouldRequireGatewayAuth, verifyGatewayAuth, } from "./auth.js";
+import { handleWorkflowApi } from "./workflow-api.js";
+import { shouldRequireGatewayAuth as workflowAuthRequired, verifyGatewayAuth as workflowVerifyAuth } from "./auth.js";
 import { getDiskSpaceStatus } from "../shared/storage-health.js";
 import { ptySnapshotStore } from "../engines/pty-snapshot.js";
 import { collectClaudeUsage } from "../shared/claude-usage.js";
@@ -357,6 +359,15 @@ export async function handleApiRequest(req, res, context) {
     const pathname = url.pathname;
     const method = req.method || "GET";
     try {
+        // /api/workflows/** — the Workflow engine (upstream port). Routed before the
+        // flat routes below; handleWorkflowApi returns false for everything else.
+        if (context.workflowService && pathname.startsWith("/api/workflows")) {
+            const authenticated = !workflowAuthRequired(context.getConfig())
+                || Boolean(context.authToken && context.authHome
+                    && workflowVerifyAuth(req.headers, context.authToken, context.authHome));
+            if (await handleWorkflowApi(req, res, { method, pathname, url }, { service: context.workflowService, authenticated }))
+                return;
+        }
         // POST /api/internal/hook — receive Claude Code turn hooks from hook-relay.mjs
         // (interactive PTY engine). Loopback-only + shared-secret authenticated.
         if (method === "POST" && pathname === "/api/internal/hook") {
@@ -1534,6 +1545,7 @@ Handle this as a priority request from a colleague.`;
                 "mcp",
                 "sessions",
                 "cron",
+                "workflows",
                 "notifications",
                 "portal",
                 "context",
@@ -2360,7 +2372,10 @@ deliverToConnector) {
     const orgHierarchy = resolveOrgHierarchy(scanOrgForHierarchy());
     try {
         const systemPrompt = buildContext({
-            source: "web",
+            // Preserve the session's true origin — labeling everything "web" here
+            // would grant web-level trust (MEMORY injection) to Slack/cron-origin
+            // sessions driven through this runner.
+            source: currentSession.source || "web",
             channel: currentSession.sourceRef,
             user: "web-user",
             employee,