tycono 0.3.45-beta.2 → 0.3.45-beta.3

package/{src → packages/server/src}/api/src/engine/llm-adapter.ts

@@ -56,9 +56,12 @@ export interface ChatOptions {
   maxTokens?: number;
 }
 
+/** System prompt: plain string or structured blocks with cache_control for prompt caching */
+export type SystemPrompt = string | Array<{ type: 'text'; text: string; cache_control?: { type: 'ephemeral' } }>;
+
 export interface LLMProvider {
   chat(
-    systemPrompt: string,
+    systemPrompt: SystemPrompt,
     messages: LLMMessage[],
     tools?: ToolDefinition[],
     signal?: AbortSignal,
@@ -66,7 +69,7 @@ export interface LLMProvider {
   ): Promise<LLMResponse>;
 
   chatStream?(
-    systemPrompt: string,
+    systemPrompt: SystemPrompt,
     messages: LLMMessage[],
     tools: ToolDefinition[] | undefined,
     callbacks: StreamCallbacks,
@@ -90,7 +93,7 @@ export class AnthropicProvider implements LLMProvider {
    * Send a message and get a complete response (non-streaming)
    */
   async chat(
-    systemPrompt: string,
+    systemPrompt: SystemPrompt,
     messages: LLMMessage[],
     tools?: ToolDefinition[],
     signal?: AbortSignal,
@@ -99,7 +102,7 @@ export class AnthropicProvider implements LLMProvider {
     const params: Anthropic.MessageCreateParamsNonStreaming = {
       model: this.model,
       max_tokens: options?.maxTokens ?? 8192,
-      system: systemPrompt,
+      system: systemPrompt as Anthropic.MessageCreateParams['system'],
       messages: messages.map((m) => ({
         role: m.role,
         content: m.content as Anthropic.MessageCreateParams['messages'][0]['content'],
@@ -130,7 +133,7 @@ export class AnthropicProvider implements LLMProvider {
    * Send a message with streaming (for SSE)
    */
   async chatStream(
-    systemPrompt: string,
+    systemPrompt: SystemPrompt,
     messages: LLMMessage[],
     tools: ToolDefinition[] | undefined,
     callbacks: StreamCallbacks,
@@ -139,7 +142,7 @@ export class AnthropicProvider implements LLMProvider {
       model: this.model,
       max_tokens: 8192,
       stream: true,
-      system: systemPrompt,
+      system: systemPrompt as Anthropic.MessageCreateParams['system'],
       messages: messages.map((m) => ({
         role: m.role,
         content: m.content as Anthropic.MessageCreateParams['messages'][0]['content'],
@@ -257,7 +260,7 @@ export class ClaudeCliProvider implements LLMProvider {
         '--output-format', 'text',
         ...(useTools ? [
           '--tools', 'Read,Grep,Glob',
-          '--dangerously-skip-permissions',
+          '--permission-mode', process.env.TYCONO_PERMISSION_MODE || 'bypassPermissions',
         ] : []),
         userText,
       ];

package/{src → packages/server/src}/api/src/engine/org-tree.ts

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import YAML from 'yaml';
 
@@ -83,6 +84,17 @@ interface RawRoleYaml {
   };
 }
 
+/* ─── Default Roles (fallback when no roles/ directory) ── */
+
+const DEFAULT_ROLES: Array<{ id: string; name: string; level: 'c-level' | 'member'; reportsTo: string; persona: string }> = [
+  { id: 'cto', name: 'CTO', level: 'c-level', reportsTo: 'ceo', persona: 'Chief Technology Officer. Leads technical architecture and manages Engineer + QA.' },
+  { id: 'cbo', name: 'CBO', level: 'c-level', reportsTo: 'ceo', persona: 'Chief Business Officer. Leads product vision and manages PM + Designer.' },
+  { id: 'engineer', name: 'Engineer', level: 'member', reportsTo: 'cto', persona: 'Software Engineer. Writes working code.' },
+  { id: 'qa', name: 'QA', level: 'member', reportsTo: 'cto', persona: 'QA Engineer. Tests and validates.' },
+  { id: 'pm', name: 'PM', level: 'member', reportsTo: 'cbo', persona: 'Product Manager. Writes specs and requirements.' },
+  { id: 'designer', name: 'Designer', level: 'member', reportsTo: 'cbo', persona: 'UI/UX Designer.' },
+];
+
 /* ─── Build ──────────────────────────────────── */
 
 export function buildOrgTree(companyRoot: string, presetId?: string): OrgTree {
@@ -106,10 +118,17 @@ export function buildOrgTree(companyRoot: string, presetId?: string): OrgTree {
   const roleDirs: string[] = [];
   if (fs.existsSync(rolesDir)) roleDirs.push(rolesDir);
 
-  // If preset specified, also scan preset's roles directory
+  // If preset specified, also scan preset/agency roles directories (2-Layer Knowledge)
+  // Search order: local presets > local agencies > global agencies
   if (presetId && presetId !== 'default') {
-    const presetRolesDir = path.join(companyRoot, 'knowledge', 'presets', presetId, 'roles');
-    if (fs.existsSync(presetRolesDir)) roleDirs.push(presetRolesDir);
+    const presetRoleCandidates = [
+      path.join(companyRoot, 'knowledge', 'presets', presetId, 'roles'),
+      path.join(companyRoot, '.tycono', 'agencies', presetId, 'roles'),
+      path.join(os.homedir(), '.tycono', 'agencies', presetId, 'roles'),
+    ];
+    for (const candidateDir of presetRoleCandidates) {
+      if (fs.existsSync(candidateDir)) roleDirs.push(candidateDir);
+    }
   }
 
   // Read all role.yaml files from all role directories
@@ -167,6 +186,27 @@ export function buildOrgTree(companyRoot: string, presetId?: string): OrgTree {
     }
   }
 
+  // Fallback: if no C-Level roles found, use built-in defaults
+  const hasCLevel = Array.from(tree.nodes.values()).some(
+    n => n.id !== 'ceo' && n.level === 'c-level'
+  );
+  if (!hasCLevel) {
+    for (const def of DEFAULT_ROLES) {
+      if (tree.nodes.has(def.id)) continue;
+      tree.nodes.set(def.id, {
+        id: def.id,
+        name: def.name,
+        level: def.level,
+        reportsTo: def.reportsTo,
+        children: [],
+        persona: def.persona,
+        authority: { autonomous: [], needsApproval: [] },
+        knowledge: { reads: [], writes: [] },
+        reports: { daily: '', weekly: '' },
+      });
+    }
+  }
+
   // Wire up children from reportsTo
   for (const [id, node] of tree.nodes) {
     if (id === 'ceo') continue;

package/{src → packages/server/src}/api/src/engine/runners/claude-cli.ts

@@ -407,7 +407,7 @@ else:
  */
 export class ClaudeCliRunner implements ExecutionRunner {
   execute(config: RunnerConfig, callbacks: RunnerCallbacks): RunnerHandle {
-    const { companyRoot, roleId, task, sourceRole, orgTree, readOnly = false, teamStatus, attachments, targetRoles, presetId } = config;
+    const { companyRoot, roleId, task, sourceRole, orgTree, readOnly = false, teamStatus, attachments, targetRoles, presetId, priorDispatches } = config;
 
     // Note: Claude CLI doesn't support inline image attachments.
     // Images will be ignored with a warning if passed.
@@ -416,7 +416,7 @@ export class ClaudeCliRunner implements ExecutionRunner {
     }
 
     // 1. Context Assembly
-    const context = assembleContext(companyRoot, roleId, task, sourceRole, orgTree, { teamStatus, targetRoles, presetId });
+    const context = assembleContext(companyRoot, roleId, task, sourceRole, orgTree, { teamStatus, targetRoles, presetId, priorDispatches });
 
     // Trace: capture assembled prompt for debugging
     callbacks.onPromptAssembled?.(context.systemPrompt, task);
@@ -471,18 +471,31 @@ export class ClaudeCliRunner implements ExecutionRunner {
 
     // 6. CLI args 구성
     const maxTurns = config.maxTurns ?? 25;
-    const args = [
-      '-p',
-      '--system-prompt', fs.readFileSync(promptFile, 'utf-8'),
-      '--output-format', 'stream-json',
-      '--verbose',
-      '--dangerously-skip-permissions',
-      '--model', config.model ?? 'claude-opus-4-6',
-      '--max-turns', String(maxTurns),
-      '--mcp-config', mcpConfig,
-      '--strict-mcp-config',
-      taskPrompt,
-    ];
+    const isResume = !!config.cliSessionId;
+    const args: string[] = isResume
+      ? [
+          '--resume', config.cliSessionId!,
+          '-p',
+          '--output-format', 'stream-json',
+          '--verbose',
+          '--permission-mode', process.env.TYCONO_PERMISSION_MODE || 'bypassPermissions',
+          '--max-turns', String(maxTurns),
+          '--mcp-config', mcpConfig,
+          '--strict-mcp-config',
+          taskPrompt,
+        ]
+      : [
+          '-p',
+          '--system-prompt', fs.readFileSync(promptFile, 'utf-8'),
+          '--output-format', 'stream-json',
+          '--verbose',
+          '--permission-mode', process.env.TYCONO_PERMISSION_MODE || 'bypassPermissions',
+          '--model', config.model ?? 'claude-opus-4-6',
+          '--max-turns', String(maxTurns),
+          '--mcp-config', mcpConfig,
+          '--strict-mcp-config',
+          taskPrompt,
+        ];
 
     // Disallow Agent and Task tools to force use of dispatch bridge
     // For roles with subordinates (C-Level), also disallow Edit/Write to enforce delegation
@@ -526,7 +539,7 @@ export class ClaudeCliRunner implements ExecutionRunner {
     cleanEnv.TYCONO_CODE_ROOT = codeRoot;
     cleanEnv.TYCONO_AKB_ROOT = companyRoot;
     cleanEnv.TYCONO_KNOWLEDGE_ROOT = knowledgeDir;
-    console.log(`[Runner] Spawning claude -p: role=${roleId}, model=${modelName}, maxTurns=${maxTurns}, sessionId=${config.sessionId}, cwd=${cwd}, subordinates=[${subordinates.join(',')}]`);
+    console.log(`[Runner] Spawning claude ${isResume ? '--resume ' + config.cliSessionId + ' ' : ''}-p: role=${roleId}, model=${modelName}, maxTurns=${maxTurns}, sessionId=${config.sessionId}, cwd=${cwd}, subordinates=[${subordinates.join(',')}]`);
 
     const proc = spawn('claude', args, {
       cwd,
@@ -538,6 +551,7 @@ export class ClaudeCliRunner implements ExecutionRunner {
     let turnCount = 0;
     let totalInput = 0;
     let totalOutput = 0;
+    let capturedCliSessionId: string | undefined;
     const toolCalls: RunnerResult['toolCalls'] = [];
     const dispatches: RunnerResult['dispatches'] = [];
     const tokenLedger = getTokenLedger(companyRoot);
@@ -567,6 +581,7 @@ export class ClaudeCliRunner implements ExecutionRunner {
               totalTokens: { input: totalInput, output: totalOutput },
               toolCalls,
               dispatches,
+              cliSessionId: capturedCliSessionId,
             });
           }
         }, 5000);
@@ -592,6 +607,7 @@ export class ClaudeCliRunner implements ExecutionRunner {
                 // JobManager.startJob() now auto-emits dispatch:start on parent stream.
               },
               incrementTurn: () => { turnCount++; callbacks.onTurnComplete?.(turnCount); },
+              captureCliSessionId: (id) => { capturedCliSessionId = id; },
               recordTokens: (input, out) => {
                 totalInput += input;
                 totalOutput += out;
@@ -694,6 +710,7 @@ interface StreamHandlers {
   addToolCall: (name: string, input?: Record<string, unknown>) => void;
   incrementTurn: () => void;
   recordTokens?: (inputTokens: number, outputTokens: number) => void;
+  captureCliSessionId?: (id: string) => void;
 }
 
 function processStreamEvent(
@@ -755,6 +772,11 @@ function processStreamEvent(
           handlers.recordTokens(inputTk, outputTk);
         }
       }
+      // Capture CLI session ID for --resume support
+      const sid = event.session_id ?? (event as Record<string, unknown>).sessionId;
+      if (typeof sid === 'string' && handlers.captureCliSessionId) {
+        handlers.captureCliSessionId(sid);
+      }
       break;
     }
 

package/{src → packages/server/src}/api/src/engine/runners/types.ts

@@ -47,6 +47,10 @@ export interface RunnerConfig {
   env?: Record<string, string>;
   /** Wave-scoped preset ID for knowledge injection */
   presetId?: string;
+  /** Handoff summary: prior dispatch results in this wave (for context carry-over) */
+  priorDispatches?: Array<{ roleId: string; task: string; result: string }>;
+  /** CLI session ID for --resume (context continuity across turn limits) */
+  cliSessionId?: string;
   /** SV-7: Supervision — abort a running session */
   onAbortSession?: (sessionId: string) => boolean;
   /** SV-6: Supervision — amend a running session */
@@ -75,6 +79,8 @@ export interface RunnerResult {
   totalTokens: { input: number; output: number };
   toolCalls: Array<{ name: string; input?: Record<string, unknown> }>;
   dispatches: Array<{ roleId: string; task: string; result?: string }>;
+  /** CLI session ID captured from stream-json result event (for --resume) */
+  cliSessionId?: string;
 }
 
 /* ─── Handle (for abort support) ──────────────── */

package/{src → packages/server/src}/api/src/engine/tools/executor.ts

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { glob } from 'glob';
@@ -55,7 +56,7 @@ export async function executeTool(
       case 'bash_execute':
         return bashExecute(id, input, codeRoot ?? companyRoot);
       case 'dispatch':
-        return await dispatchTask(id, input, onDispatch);
+        return await dispatchTask(id, input, onDispatch, options);
       case 'consult':
         return await consultTask(id, input, onConsult);
       case 'heartbeat_watch':
@@ -73,6 +74,22 @@ export async function executeTool(
   }
 }
 
+/* ─── 2-Layer Knowledge: allowed read paths ──── */
+
+/**
+ * For READ operations, agents may access agency-bundled knowledge
+ * in addition to the user's companyRoot (knowledge/).
+ * Write operations remain restricted to companyRoot only.
+ */
+function isAllowedReadPath(absolute: string, companyRoot: string): boolean {
+  const allowedPaths = [
+    companyRoot,
+    path.join(companyRoot, '.tycono', 'agencies'),
+    path.join(os.homedir(), '.tycono', 'agencies'),
+  ];
+  return allowedPaths.some(p => absolute.startsWith(p));
+}
+
 /* ─── Tool Implementations ───────────────────── */
 
 function readFile(
@@ -95,8 +112,8 @@ function readFile(
 
   const absolute = path.resolve(companyRoot, filePath);
 
-  // Security: prevent path traversal
-  if (!absolute.startsWith(companyRoot)) {
+  // Security: prevent path traversal (2-Layer: allow agency knowledge paths for reads)
+  if (!isAllowedReadPath(absolute, companyRoot)) {
     return { tool_use_id: id, content: 'Error: path traversal not allowed', is_error: true };
   }
 
@@ -134,7 +151,8 @@ function listFiles(
   }
 
   const absolute = path.resolve(companyRoot, directory);
-  if (!absolute.startsWith(companyRoot)) {
+  // 2-Layer: allow agency knowledge paths for reads
+  if (!isAllowedReadPath(absolute, companyRoot)) {
     return { tool_use_id: id, content: 'Error: path traversal not allowed', is_error: true };
   }
 
@@ -168,7 +186,8 @@ function searchFiles(
   }
 
   const absolute = path.resolve(companyRoot, directory);
-  if (!absolute.startsWith(companyRoot)) {
+  // 2-Layer: allow agency knowledge paths for reads
+  if (!isAllowedReadPath(absolute, companyRoot)) {
     return { tool_use_id: id, content: 'Error: path traversal not allowed', is_error: true };
   }
 
@@ -394,19 +413,44 @@ async function dispatchTask(
   id: string,
   input: Record<string, unknown>,
   onDispatch?: (roleId: string, task: string) => Promise<string>,
+  options?: ToolExecutorOptions,
 ): Promise<ToolResult> {
-  const roleId = String(input.roleId ?? '');
+  const targetRoleId = String(input.roleId ?? '');
   const task = String(input.task ?? '');
 
-  if (!roleId || !task) {
+  if (!targetRoleId || !task) {
     return { tool_use_id: id, content: 'Error: roleId and task are required', is_error: true };
   }
 
   if (!onDispatch) {
+    // Emit dispatch:error — dispatch not available
+    if (options?.sessionId) {
+      const stream = ActivityStream.getOrCreate(options.sessionId, options.roleId);
+      stream.emit('dispatch:error', options.roleId, {
+        sourceRole: options.roleId,
+        targetRole: targetRoleId,
+        error: 'dispatch not available in this context',
+        timestamp: Date.now(),
+      });
+    }
     return { tool_use_id: id, content: 'Error: dispatch not available in this context', is_error: true };
   }
 
-  const result = await onDispatch(roleId, task);
+  const result = await onDispatch(targetRoleId, task);
+
+  // Detect dispatch rejection and emit dispatch:error event
+  if (result.startsWith('Dispatch rejected:') || result.startsWith('[DISPATCH BLOCKED]')) {
+    if (options?.sessionId) {
+      const stream = ActivityStream.getOrCreate(options.sessionId, options.roleId);
+      stream.emit('dispatch:error', options.roleId, {
+        sourceRole: options.roleId,
+        targetRole: targetRoleId,
+        error: result,
+        timestamp: Date.now(),
+      });
+    }
+  }
+
   return { tool_use_id: id, content: result };
 }
 
@@ -496,7 +540,10 @@ async function heartbeatWatch(
     unsubscribers.push(() => stream.unsubscribe(handler));
   }
 
-  // Wait for duration or early return
+  // Pre-compute waveId for directive checking during poll loop
+  const waveIdForPoll = findWaveIdForSessions(sessionIds);
+
+  // Wait for duration or early return (also breaks on pending CEO directive)
   await new Promise<void>((resolve) => {
     const timeout = setTimeout(resolve, durationSec * 1000);
     const checkInterval = setInterval(() => {
@@ -504,6 +551,15 @@ async function heartbeatWatch(
         clearTimeout(timeout);
         clearInterval(checkInterval);
         resolve();
+        return;
+      }
+      // Early-return on pending CEO directive — don't block for 180s when user is waiting
+      if (waveIdForPoll && supervisorHeartbeat.getPendingDirectives(waveIdForPoll).length > 0) {
+        earlyReturn = true;
+        clearTimeout(timeout);
+        clearInterval(checkInterval);
+        resolve();
+        return;
       }
     }, 500); // Check every 500ms
     // Ensure cleanup even if early