teamcopilot 0.0.1

package/dist/workflows/index.js

@@ -0,0 +1,751 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = __importDefault(require("express"));
+const fs_1 = __importDefault(require("fs"));
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const multer_1 = __importDefault(require("multer"));
+const client_1 = __importDefault(require("../prisma/client"));
+const index_1 = require("../utils/index");
+const workflow_1 = require("../utils/workflow");
+const workflow_files_1 = require("../utils/workflow-files");
+const workflow_permissions_1 = require("../utils/workflow-permissions");
+const permission_common_1 = require("../utils/permission-common");
+const workflow_approval_snapshot_1 = require("../utils/workflow-approval-snapshot");
+const workspace_sync_1 = require("../utils/workspace-sync");
+const workflow_runner_1 = require("../utils/workflow-runner");
+const workflow_interruption_1 = require("../utils/workflow-interruption");
+const session_abort_1 = require("../utils/session-abort");
+const resource_file_routes_1 = require("../utils/resource-file-routes");
+const resource_access_1 = require("../utils/resource-access");
+const router = express_1.default.Router({ mergeParams: true });
+const uploadTmpDir = path_1.default.join(os_1.default.tmpdir(), "teamcopilot-workflow-uploads");
+fs_1.default.mkdirSync(uploadTmpDir, { recursive: true });
+const maxUploadBytes = (() => {
+    const parsed = Number(process.env.WORKFLOW_FILE_UPLOAD_MAX_MB ?? "1024");
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        return 1024 * 1024 * 1024;
+    }
+    return Math.floor(parsed * 1024 * 1024);
+})();
+const workflowFileUpload = (0, multer_1.default)({
+    dest: uploadTmpDir,
+    limits: {
+        files: 1,
+        fileSize: maxUploadBytes,
+    },
+});
+function isPathInside(childPath, parentPath) {
+    const parent = path_1.default.resolve(parentPath) + path_1.default.sep;
+    const child = path_1.default.resolve(childPath) + path_1.default.sep;
+    return child.startsWith(parent);
+}
+function sanitizeFilenamePart(value) {
+    return value.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+async function assertCurrentUserCanRunWorkflow(slug, userId) {
+    await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    const approvalState = await (0, workflow_approval_snapshot_1.getWorkflowSnapshotApprovalState)(slug);
+    if (!approvalState.is_current_code_approved) {
+        throw {
+            status: 403,
+            message: 'Workflow is not approved for the current code version'
+        };
+    }
+    const permissionSummary = await (0, resource_access_1.getResourceAccessSummary)("workflow", slug, userId);
+    if (!permissionSummary.can_edit) {
+        throw {
+            status: 403,
+            message: permissionSummary.is_locked_due_to_missing_users
+                ? 'Workflow cannot be run because no allowed users remain'
+                : 'You do not have permission to run this workflow. Please contact the workflow owner to request permission.'
+        };
+    }
+}
+async function getWorkflowEditorAccess(slug, userId) {
+    const accessSummary = await (0, resource_access_1.getResourceAccessSummary)("workflow", slug, userId);
+    const workflowStatus = accessSummary.is_approved ? "approved" : "pending";
+    return {
+        can_view: accessSummary.can_view,
+        can_edit: accessSummary.can_edit,
+        editor_status: workflowStatus,
+    };
+}
+async function assertCanEditWorkflowFiles(slug, userId) {
+    const access = await getWorkflowEditorAccess(slug, userId);
+    if (!access.can_edit) {
+        throw {
+            status: 403,
+            message: "You do not have permission to edit this workflow"
+        };
+    }
+}
+async function assertCanViewWorkflowFiles(slug, userId) {
+    const access = await getWorkflowEditorAccess(slug, userId);
+    if (!access.can_view) {
+        throw {
+            status: 403,
+            message: "You do not have permission to view this workflow"
+        };
+    }
+}
+const workflowExecutions = new Map();
+// GET /api/workflows - List available workflows from filesystem
+router.get('/', (0, index_1.apiHandler)(async (req, res) => {
+    const slugs = (0, workflow_1.listWorkflowSlugs)();
+    const workflows = [];
+    const creatorIds = new Set();
+    const manifests = new Map();
+    const metadataBySlug = new Map();
+    for (const slug of slugs) {
+        const { manifest, metadata } = await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+        manifests.set(slug, manifest);
+        metadataBySlug.set(slug, metadata);
+        if (metadata.created_by_user_id) {
+            creatorIds.add(metadata.created_by_user_id);
+        }
+    }
+    const creators = creatorIds.size > 0
+        ? await client_1.default.users.findMany({
+            where: { id: { in: Array.from(creatorIds) } },
+            select: { id: true, name: true, email: true }
+        })
+        : [];
+    const creatorNameById = new Map(creators.map((creator) => [creator.id, creator.name]));
+    const creatorEmailById = new Map(creators.map((creator) => [creator.id, creator.email]));
+    for (const slug of slugs) {
+        const manifest = manifests.get(slug);
+        const metadata = metadataBySlug.get(slug);
+        if (!manifest)
+            continue;
+        if (!metadata)
+            continue;
+        const accessSummary = await (0, resource_access_1.getResourceAccessSummary)("workflow", slug, req.userId);
+        if (!accessSummary.can_view) {
+            continue;
+        }
+        const createdByUserId = metadata.created_by_user_id;
+        workflows.push({
+            slug,
+            name: slug,
+            intent_summary: manifest.intent_summary,
+            created_by_user_id: createdByUserId,
+            created_by_user_name: createdByUserId ? (creatorNameById.get(createdByUserId) ?? null) : null,
+            created_by_user_email: createdByUserId ? (creatorEmailById.get(createdByUserId) ?? null) : null,
+            approved_by_user_id: metadata.approved_by_user_id ?? null,
+            is_approved: accessSummary.is_approved,
+            can_view: accessSummary.can_view,
+            can_edit: accessSummary.can_edit,
+            permission_mode: accessSummary.permission_mode,
+            is_locked_due_to_missing_users: accessSummary.is_locked_due_to_missing_users
+        });
+    }
+    res.json({ workflows });
+}, true));
+// GET /api/workflows/runs - List workflow run history (last 50, all users)
+router.get('/runs', (0, index_1.apiHandler)(async (_req, res) => {
+    const runs = await client_1.default.workflow_runs.findMany({
+        orderBy: { started_at: 'desc' },
+        take: 50,
+        include: {
+            user: {
+                select: { name: true, email: true }
+            }
+        }
+    });
+    res.json({ runs });
+}, true));
+// GET /api/workflows/runs/logs - Get log file by run_id OR session_id+message_id
+router.get('/runs/logs', (0, index_1.apiHandler)(async (req, res) => {
+    const runIdRaw = req.query.run_id;
+    const sessionIdRaw = req.query.session_id;
+    const messageIdRaw = req.query.message_id;
+    const runId = typeof runIdRaw === 'string' && runIdRaw.trim().length > 0 ? runIdRaw : null;
+    const sessionId = typeof sessionIdRaw === 'string' && sessionIdRaw.trim().length > 0 ? sessionIdRaw : null;
+    const messageId = typeof messageIdRaw === 'string' && messageIdRaw.trim().length > 0 ? messageIdRaw : null;
+    if (!runId && !(sessionId && messageId)) {
+        throw {
+            status: 400,
+            message: 'Provide either run_id, or both session_id and message_id'
+        };
+    }
+    if (runId && (sessionId || messageId)) {
+        throw {
+            status: 400,
+            message: 'Provide either run_id, or session_id + message_id, not both'
+        };
+    }
+    const run = runId
+        ? await client_1.default.workflow_runs.findUnique({
+            where: { id: runId },
+            select: { session_id: true, message_id: true }
+        })
+        : await client_1.default.workflow_runs.findFirst({
+            where: {
+                session_id: sessionId,
+                message_id: messageId,
+            },
+            select: { session_id: true, message_id: true },
+            orderBy: { started_at: 'desc' }
+        });
+    if (!run?.session_id || !run.message_id) {
+        res.json({
+            found: false,
+            logs: null
+        });
+        return;
+    }
+    const workspaceDir = (0, workspace_sync_1.getWorkspaceDirFromEnv)();
+    const workflowRunsDir = path_1.default.join(workspaceDir, 'workflow-runs');
+    const logPath = path_1.default.join(workflowRunsDir, `${sanitizeFilenamePart(run.session_id)}-${sanitizeFilenamePart(run.message_id)}.txt`);
+    if (!isPathInside(logPath, workflowRunsDir)) {
+        throw {
+            status: 400,
+            message: 'Invalid log path'
+        };
+    }
+    try {
+        const logs = await promises_1.default.readFile(logPath, 'utf-8');
+        res.json({
+            found: true,
+            logs
+        });
+    }
+    catch {
+        res.json({
+            found: false,
+            logs: null
+        });
+    }
+}, true));
+// GET /api/workflows/runs/:id - Get details for a specific workflow run
+router.get('/runs/:id', (0, index_1.apiHandler)(async (req, res) => {
+    const id = req.params.id;
+    const run = await client_1.default.workflow_runs.findUnique({
+        where: { id },
+        include: {
+            user: {
+                select: { name: true, email: true }
+            }
+        }
+    });
+    if (!run) {
+        throw {
+            status: 404,
+            message: 'Workflow run not found'
+        };
+    }
+    res.json({ run });
+}, true));
+// GET /api/workflows/interruption-status/:sessionId - Check if a workflow session should stop
+router.get('/interruption-status/:sessionId', (0, index_1.apiHandler)(async (req, res) => {
+    const sessionId = req.params.sessionId;
+    const workspaceDir = (0, workspace_sync_1.getWorkspaceDirFromEnv)();
+    const interrupted = await (0, workflow_interruption_1.isWorkflowSessionInterrupted)(sessionId, workspaceDir);
+    res.json({ interrupted });
+}, true));
+// POST /api/workflows/runs/:id/stop - Stop an in-progress workflow run
+router.post('/runs/:id/stop', (0, index_1.apiHandler)(async (req, res) => {
+    const id = req.params.id;
+    const run = await client_1.default.workflow_runs.findUnique({
+        where: { id }
+    });
+    if (!run) {
+        throw {
+            status: 404,
+            message: 'Workflow run not found'
+        };
+    }
+    if (run.status !== 'running') {
+        res.json({ success: true });
+        return;
+    }
+    const permissionSummary = await (0, resource_access_1.getResourceAccessSummary)("workflow", run.workflow_slug, req.userId);
+    if (!permissionSummary.can_edit) {
+        throw {
+            status: 403,
+            message: 'You do not have permission to stop this workflow run'
+        };
+    }
+    if (!run.session_id) {
+        throw {
+            status: 404,
+            message: 'Workflow run session not found'
+        };
+    }
+    const isManualSession = run.session_id.startsWith("manual-");
+    if (isManualSession) {
+        await (0, workflow_interruption_1.markWorkflowSessionAborted)(run.session_id);
+    }
+    else {
+        await (0, session_abort_1.abortOpencodeSession)(run.session_id);
+    }
+    res.json({ success: true });
+}, true));
+// POST /api/workflows/:slug/manual-run - Start a workflow run from manual mode UI
+router.post('/:slug/manual-run', (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const inputsRaw = req.body.inputs ?? {};
+    if (!inputsRaw || typeof inputsRaw !== 'object' || Array.isArray(inputsRaw)) {
+        throw {
+            status: 400,
+            message: 'inputs must be an object'
+        };
+    }
+    const inputs = inputsRaw;
+    const manualSessionId = `manual-${req.userId}-${(0, crypto_1.randomUUID)()}`;
+    const manualMessageId = `manual-message-${(0, crypto_1.randomUUID)()}`;
+    const manualCallId = `manual-call-${(0, crypto_1.randomUUID)()}`;
+    const workspaceDir = (0, workspace_sync_1.getWorkspaceDirFromEnv)();
+    await assertCurrentUserCanRunWorkflow(slug, req.userId);
+    const startedRun = await (0, workflow_runner_1.startWorkflowRunViaBackend)({
+        workspaceDir,
+        slug,
+        inputs,
+        authUserId: req.userId,
+        sessionId: manualSessionId,
+        messageId: manualMessageId,
+        callId: manualCallId,
+        requirePermissionPrompt: false,
+    });
+    void startedRun.completion.catch(() => undefined);
+    res.json({
+        run_id: startedRun.runId
+    });
+}, true));
+// POST /api/workflows/execute - Start workflow execution without blocking on completion.
+router.post('/execute', (0, index_1.apiHandler)(async (req, res) => {
+    if (!req.opencode_session_id) {
+        throw {
+            status: 400,
+            message: 'This endpoint requires an opencode session token'
+        };
+    }
+    const body = req.body;
+    if (typeof body.slug !== "string") {
+        throw { status: 400, message: "slug is required" };
+    }
+    if (typeof body.message_id !== "string") {
+        throw { status: 400, message: "message_id is required" };
+    }
+    if (typeof body.call_id !== "string") {
+        throw { status: 400, message: "call_id is required" };
+    }
+    const slug = body.slug;
+    const inputs = body.inputs ?? {};
+    const messageId = body.message_id;
+    const callId = body.call_id;
+    const workspaceDir = (0, workspace_sync_1.getWorkspaceDirFromEnv)();
+    await assertCurrentUserCanRunWorkflow(slug, req.userId);
+    const startedRun = await (0, workflow_runner_1.startWorkflowRunViaBackend)({
+        workspaceDir,
+        slug,
+        inputs,
+        authUserId: req.userId,
+        sessionId: req.opencode_session_id,
+        messageId,
+        callId,
+        requirePermissionPrompt: true,
+    });
+    const executionId = (0, crypto_1.randomUUID)();
+    const executionRecord = {
+        slug,
+        runId: startedRun.runId,
+        timeoutSeconds: startedRun.timeoutSeconds,
+        status: "running",
+        output: null,
+        errorMessage: null,
+    };
+    workflowExecutions.set(executionId, executionRecord);
+    void startedRun.completion
+        .then((result) => {
+        executionRecord.output = result.output;
+        executionRecord.status = result.status;
+        executionRecord.errorMessage = result.status === "success" ? null : `Workflow execution ${result.status}`;
+    })
+        .catch((err) => {
+        const errorOutput = err instanceof Error ? err.message : JSON.stringify(err);
+        executionRecord.status = "error";
+        executionRecord.errorMessage = errorOutput;
+        executionRecord.output = errorOutput;
+    });
+    res.json({
+        execution_id: executionId,
+        status: "running",
+    });
+}, true));
+// GET /api/workflows/execute/:executionId - Get execution status/result.
+router.get('/execute/:executionId', (0, index_1.apiHandler)(async (req, res) => {
+    const executionId = req.params.executionId;
+    const execution = workflowExecutions.get(executionId);
+    if (!execution) {
+        throw {
+            status: 404,
+            message: 'Execution not found'
+        };
+    }
+    if (execution.status === "running") {
+        res.json({
+            execution_id: executionId,
+            status: "running",
+        });
+        return;
+    }
+    const responsePayload = {
+        status: execution.status,
+        output: execution.output,
+        workflow: execution.slug,
+        timeout_seconds: execution.timeoutSeconds,
+        run_id: execution.runId,
+    };
+    workflowExecutions.delete(executionId);
+    if (execution.status !== "success") {
+        throw {
+            status: 500,
+            message: "Workflow execution failed: " + JSON.stringify(responsePayload),
+            doLogging: false,
+            maskErrorMessage: false,
+        };
+    }
+    res.json(responsePayload);
+}, true));
+// PATCH /api/workflows/runs/:id - Update run status
+router.patch('/runs/:id', (0, index_1.apiHandler)(async (req, res) => {
+    const id = req.params.id;
+    const { status, error_message, output } = req.body;
+    if (!status || !['running', 'success', 'failed'].includes(status)) {
+        throw {
+            status: 400,
+            message: 'status must be "running", "success", or "failed"'
+        };
+    }
+    const existingRun = await client_1.default.workflow_runs.findUnique({ where: { id } });
+    if (!existingRun) {
+        throw {
+            status: 404,
+            message: 'Workflow run not found'
+        };
+    }
+    if (existingRun.status !== 'running') {
+        throw {
+            status: 400,
+            message: 'Can only update runs that are in running status'
+        };
+    }
+    const updateData = { status };
+    if (status === 'success' || status === 'failed') {
+        updateData.completed_at = BigInt(Date.now());
+    }
+    if (status === 'failed' && error_message) {
+        updateData.error_message = error_message;
+    }
+    if (output) {
+        updateData.output = output;
+    }
+    const run = await client_1.default.workflow_runs.update({
+        where: { id },
+        data: updateData
+    });
+    res.json({ run });
+}, true));
+// POST /api/workflows/:slug/approve - Approve a workflow
+router.post('/:slug/approve', (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const approvalResult = await (0, workflow_approval_snapshot_1.approveWorkflowWithSnapshot)(slug, req.userId);
+    const { metadata: approvedMetadata } = await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    await (0, workflow_permissions_1.addApproverToWorkflowRunPermissionsIfRestricted)(slug, req.userId, approvedMetadata.created_by_user_id);
+    res.json({
+        workflow: {
+            slug,
+            approved_by_user_id: approvalResult.approved_by_user_id,
+            is_approved: true,
+            snapshot_hash: approvalResult.snapshot_hash,
+            snapshot_file_count: approvalResult.snapshot_file_count
+        }
+    });
+}, true));
+// POST /api/workflows/:slug/reject-restore - Restore workflow files to last approved snapshot
+router.post('/:slug/reject-restore', (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const result = await (0, workflow_approval_snapshot_1.restoreWorkflowToApprovedSnapshot)(slug, req.userId);
+    res.json({
+        workflow: {
+            slug,
+            restored_file_count: result.restored_file_count,
+            snapshot_hash: result.snapshot_hash,
+        }
+    });
+}, true));
+// POST /api/workflows/:slug/creator - Set the creator user id for a workflow
+router.post('/:slug/creator', (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const { metadata } = await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    const existingCreator = metadata.created_by_user_id ?? null;
+    if (existingCreator && existingCreator !== req.userId) {
+        throw {
+            status: 409,
+            message: 'Workflow creator is already set and cannot be changed'
+        };
+    }
+    const updatedMetadata = existingCreator
+        ? metadata
+        : await (0, workflow_1.setWorkflowCreator)(slug, req.userId);
+    await (0, workflow_permissions_1.initializeWorkflowRunPermissionsForCreator)(slug, req.userId);
+    res.json({
+        workflow: {
+            slug,
+            created_by_user_id: updatedMetadata.created_by_user_id
+        }
+    });
+}, true));
+// DELETE /api/workflows/:slug - Delete workflow directory and all past runs
+router.delete('/:slug', (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const { metadata } = await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    const creatorUserId = metadata.created_by_user_id ?? null;
+    const creator = creatorUserId
+        ? await client_1.default.users.findUnique({
+            where: { id: creatorUserId },
+            select: { id: true }
+        })
+        : null;
+    const isOwner = creatorUserId === req.userId;
+    const hasNoCreatorUser = creator === null;
+    const isEngineer = req.role === 'Engineer';
+    if (!isOwner && !(hasNoCreatorUser && isEngineer)) {
+        throw {
+            status: 403,
+            message: 'Only the workflow owner can delete this workflow. Engineers can only delete workflows whose owner no longer exists.'
+        };
+    }
+    await (0, workflow_1.deleteWorkflow)(slug);
+    res.json({ success: true });
+}, true));
+// GET /api/workflows/:slug/approval-diff - Preview current code diff vs approved snapshot
+router.get('/:slug/approval-diff', (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    if (req.role !== 'Engineer') {
+        throw {
+            status: 403,
+            message: 'Only Engineers can review approval diffs'
+        };
+    }
+    await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    const previousSnapshot = await (0, workflow_approval_snapshot_1.loadApprovedSnapshotFromDb)(slug);
+    const currentSnapshot = (0, workflow_approval_snapshot_1.collectCurrentWorkflowSnapshot)(slug);
+    const diff = (0, workflow_approval_snapshot_1.buildApprovalDiffResponse)(previousSnapshot, currentSnapshot);
+    res.locals.skipResponseSanitization = true;
+    res.json(diff);
+}, true));
+(0, resource_file_routes_1.registerResourceFileRoutes)({
+    router,
+    uploadMiddleware: workflowFileUpload.single("file"),
+    assertCanView: assertCanViewWorkflowFiles,
+    ensureResourceExists: async (slug) => {
+        await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    },
+    getEditorAccess: getWorkflowEditorAccess,
+    assertCanEdit: assertCanEditWorkflowFiles,
+    listDirectory: workflow_files_1.listWorkflowDirectory,
+    readFileContent: workflow_files_1.readWorkflowFileContent,
+    saveFileContent: workflow_files_1.saveWorkflowFileContent,
+    createFileOrFolder: workflow_files_1.createWorkflowFileOrFolder,
+    uploadFileFromTempPath: workflow_files_1.uploadWorkflowFileFromTempPath,
+    renamePath: workflow_files_1.renameWorkflowPath,
+    deletePath: workflow_files_1.deleteWorkflowPath,
+});
+// GET /api/workflows/:slug - Get workflow details from filesystem
+router.get('/:slug', (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    await assertCanViewWorkflowFiles(slug, req.userId);
+    const { manifest, metadata } = await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    const permission = await (0, workflow_permissions_1.getWorkflowRunPermissionWithUsers)(slug);
+    const accessSummary = await (0, resource_access_1.getResourceAccessSummary)("workflow", slug, req.userId);
+    const createdByUserId = metadata.created_by_user_id ?? null;
+    const approvedByUserId = metadata.approved_by_user_id ?? null;
+    const userIds = [createdByUserId, approvedByUserId].filter((id) => typeof id === "string");
+    const users = userIds.length > 0
+        ? await client_1.default.users.findMany({
+            where: { id: { in: userIds } },
+            select: { id: true, name: true, email: true }
+        })
+        : [];
+    const usersById = new Map(users.map((user) => [user.id, user]));
+    const creator = createdByUserId ? (usersById.get(createdByUserId) ?? null) : null;
+    const approver = approvedByUserId ? (usersById.get(approvedByUserId) ?? null) : null;
+    const permissionMode = (0, permission_common_1.assertCommonPermissionMode)(permission.permission_mode, "workflow run");
+    const permissions = permissionMode === "everyone"
+        ? { mode: "everyone" }
+        : { mode: "restricted", allowed_user_ids: permission.allowedUsers.map((row) => row.user_id) };
+    res.json({
+        workflow: {
+            slug,
+            name: slug,
+            intent_summary: manifest.intent_summary,
+            created_by_user_id: createdByUserId,
+            created_by_user_name: creator?.name ?? null,
+            created_by_user_email: creator?.email ?? null,
+            approved_by_user_id: approvedByUserId,
+            is_approved: accessSummary.is_approved,
+            approved_by_user_name: approver?.name ?? null,
+            approved_by_user_email: approver?.email ?? null,
+            can_view: accessSummary.can_view,
+            can_edit: accessSummary.can_edit,
+            permission_mode: accessSummary.permission_mode,
+            is_locked_due_to_missing_users: accessSummary.is_locked_due_to_missing_users,
+            permissions,
+            allowed_users_resolved: permission.allowedUsers.map((row) => ({
+                user_id: row.user.id,
+                name: row.user.name,
+                email: row.user.email,
+                is_owner: row.user.id === metadata.created_by_user_id,
+                is_approver: row.user.id === metadata.approved_by_user_id
+            })),
+            manifest
+        }
+    });
+}, true));
+const updateWorkflowPermissionsHandler = (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const { metadata } = await (0, workflow_1.readWorkflowManifestAndEnsurePermissions)(slug);
+    const approvalState = await (0, workflow_approval_snapshot_1.getWorkflowSnapshotApprovalState)(slug);
+    if (!approvalState.is_current_code_approved) {
+        throw {
+            status: 403,
+            message: 'Workflow must be approved before updating run permissions'
+        };
+    }
+    const currentSummary = await (0, resource_access_1.getResourceAccessSummary)("workflow", slug, req.userId);
+    if (!currentSummary.can_edit) {
+        throw {
+            status: 403,
+            message: currentSummary.is_locked_due_to_missing_users
+                ? 'Workflow permissions cannot be modified because no allowed users remain'
+                : 'You do not have permission to modify workflow run permissions'
+        };
+    }
+    const { mode, allowed_user_ids } = req.body;
+    if (mode !== 'restricted' && mode !== 'everyone') {
+        throw {
+            status: 400,
+            message: 'mode must be "restricted" or "everyone"'
+        };
+    }
+    const updatedPermission = mode === 'everyone'
+        ? await (0, workflow_permissions_1.setWorkflowRunPermissions)(slug, { mode: 'everyone' }, metadata.created_by_user_id)
+        : await (0, workflow_permissions_1.setWorkflowRunPermissions)(slug, {
+            mode: 'restricted',
+            allowed_user_ids: Array.isArray(allowed_user_ids) ? allowed_user_ids.map((id) => String(id)) : []
+        }, metadata.created_by_user_id);
+    const updatedSummary = await (0, resource_access_1.getResourceAccessSummary)("workflow", slug, req.userId);
+    const updatedPermissionMode = (0, permission_common_1.assertCommonPermissionMode)(updatedPermission.permission_mode, "workflow run");
+    const permissions = updatedPermissionMode === "everyone"
+        ? { mode: "everyone" }
+        : { mode: "restricted", allowed_user_ids: updatedPermission.allowedUsers.map((row) => row.user_id) };
+    res.json({
+        workflow: {
+            slug,
+            ...updatedSummary,
+            permissions,
+            allowed_users_resolved: updatedPermission.allowedUsers.map((row) => ({
+                user_id: row.user.id,
+                name: row.user.name,
+                email: row.user.email,
+                is_owner: row.user.id === metadata.created_by_user_id,
+                is_approver: row.user.id === metadata.approved_by_user_id
+            }))
+        }
+    });
+}, true);
+// PATCH /api/workflows/:slug/permissions - Update permissions (canonical)
+router.patch('/:slug/permissions', updateWorkflowPermissionsHandler);
+// POST /api/workflows/request-permission - Create a tool execution permission request
+router.post('/request-permission', (0, index_1.apiHandler)(async (req, res) => {
+    const { message_id, call_id } = req.body;
+    if (!message_id || !call_id) {
+        throw {
+            status: 400,
+            message: 'opencode_session_id, message_id, and call_id are required'
+        };
+    }
+    // Create or update permission request in database
+    const permission = await client_1.default.tool_execution_permissions.upsert({
+        where: {
+            opencode_session_id_message_id_call_id: {
+                opencode_session_id: req.opencode_session_id,
+                message_id,
+                call_id
+            }
+        },
+        create: {
+            opencode_session_id: req.opencode_session_id,
+            message_id,
+            call_id,
+            status: 'pending',
+            created_at: BigInt(Date.now())
+        },
+        update: {
+            status: 'pending',
+            responded_at: null
+        }
+    });
+    res.json({ permission_id: permission.id });
+}, true)); // Plugin authenticates with opencode session token
+// GET /api/workflows/permission-status/:id - Check permission status
+router.get('/permission-status/:id', (0, index_1.apiHandler)(async (req, res) => {
+    const id = req.params.id;
+    const permission = await client_1.default.tool_execution_permissions.findUnique({
+        where: { id }
+    });
+    if (!permission) {
+        throw {
+            status: 404,
+            message: 'Permission request not found'
+        };
+    }
+    if (req.opencode_session_id !== permission.opencode_session_id) {
+        throw {
+            status: 403,
+            message: 'Authorization token does not match permission session'
+        };
+    }
+    res.json({
+        status: permission.status,
+        approved: permission.status === 'approved'
+    });
+}, true)); // Plugin authenticates with opencode session token
+// POST /api/workflows/permission-reject/:id - Reject a pending permission request (plugin cleanup)
+router.post('/permission-reject/:id', (0, index_1.apiHandler)(async (req, res) => {
+    const id = req.params.id;
+    const permission = await client_1.default.tool_execution_permissions.findUnique({
+        where: { id }
+    });
+    if (!permission) {
+        throw {
+            status: 404,
+            message: 'Permission request not found'
+        };
+    }
+    if (req.opencode_session_id !== permission.opencode_session_id) {
+        throw {
+            status: 403,
+            message: 'Authorization token does not match permission session'
+        };
+    }
+    if (permission.status === 'pending') {
+        await client_1.default.tool_execution_permissions.update({
+            where: { id },
+            data: {
+                status: 'rejected',
+                responded_at: BigInt(Date.now())
+            }
+        });
+    }
+    res.json({ success: true });
+}, true)); // Plugin authenticates with opencode session token
+exports.default = router;