verbolab 0.1.0-alpha.1

package/dist/src/core/pipeline-rollback.d.ts

@@ -0,0 +1,29 @@
+import type { SimpleGit } from 'simple-git';
+export interface StepRun {
+    id: string;
+    commitHash?: string | null;
+    status: 'pending' | 'success' | 'failed' | 'rolled_back';
+}
+export interface PipelineRun {
+    id: string;
+    stepRuns: StepRun[];
+}
+export declare class UnreachableCommitError extends Error {
+    readonly commitHash: string;
+    constructor(commitHash: string);
+}
+export declare class RollbackConflictError extends Error {
+    readonly commitHash: string;
+    constructor(commitHash: string);
+}
+/**
+ * Rolls back a pipeline run by reverting each step's commit in reverse order.
+ *
+ * - Verifies all commits are reachable before starting.
+ * - Reverts commits with `git revert --no-commit` in reverse step order.
+ * - Handles conflicts by cleaning up and throwing `RollbackConflictError`.
+ * - Creates a single rollback commit: `chore(rollback): revert pipeline <run.id>`.
+ * - Returns the updated run with reverted step_runs marked `'rolled_back'`.
+ */
+export declare function rollbackRun(run: PipelineRun, git: SimpleGit): Promise<PipelineRun>;
+//# sourceMappingURL=pipeline-rollback.d.ts.map

package/dist/src/core/pipeline-rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-rollback.d.ts","sourceRoot":"","sources":["../../../src/core/pipeline-rollback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAID,qBAAa,sBAAuB,SAAQ,KAAK;aACnB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;aAClB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAqDxF"}

package/dist/src/core/pipeline-rollback.js

@@ -0,0 +1,84 @@
+// ---- Errors ----
+export class UnreachableCommitError extends Error {
+    commitHash;
+    constructor(commitHash) {
+        super(`Commit ${commitHash} is not reachable in this repository`);
+        this.commitHash = commitHash;
+        this.name = 'UnreachableCommitError';
+    }
+}
+export class RollbackConflictError extends Error {
+    commitHash;
+    constructor(commitHash) {
+        super(`Conflict while reverting commit ${commitHash}`);
+        this.commitHash = commitHash;
+        this.name = 'RollbackConflictError';
+    }
+}
+// ---- Helpers ----
+async function isCommitReachable(git, hash) {
+    try {
+        await git.raw(['cat-file', '-e', `${hash}^{commit}`]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function hasConflicts(git) {
+    const status = await git.status();
+    return status.conflicted.length > 0;
+}
+// ---- Core function ----
+/**
+ * Rolls back a pipeline run by reverting each step's commit in reverse order.
+ *
+ * - Verifies all commits are reachable before starting.
+ * - Reverts commits with `git revert --no-commit` in reverse step order.
+ * - Handles conflicts by cleaning up and throwing `RollbackConflictError`.
+ * - Creates a single rollback commit: `chore(rollback): revert pipeline <run.id>`.
+ * - Returns the updated run with reverted step_runs marked `'rolled_back'`.
+ */
+export async function rollbackRun(run, git) {
+    const stepsToRevert = run.stepRuns.filter((s) => typeof s.commitHash === 'string' && s.commitHash.length > 0);
+    if (stepsToRevert.length === 0) {
+        return run;
+    }
+    // Verify all commits are reachable before touching anything
+    for (const step of stepsToRevert) {
+        if (!(await isCommitReachable(git, step.commitHash))) {
+            throw new UnreachableCommitError(step.commitHash);
+        }
+    }
+    // Revert in reverse order so each undo applies cleanly on top of the previous
+    const reversed = [...stepsToRevert].reverse();
+    const revertedIds = new Set();
+    for (const step of reversed) {
+        try {
+            await git.raw(['revert', '--no-commit', step.commitHash]);
+        }
+        catch {
+            // Revert failed — check if conflicts are the cause
+            const conflicted = await hasConflicts(git);
+            // Clean up any partial staged/working-tree changes
+            await git.raw(['reset', '--hard', 'HEAD']).catch(() => { });
+            if (conflicted) {
+                throw new RollbackConflictError(step.commitHash);
+            }
+            throw new RollbackConflictError(step.commitHash);
+        }
+        // Paranoia: check for silent conflicts (exit 0 but unmerged files)
+        if (await hasConflicts(git)) {
+            await git.raw(['reset', '--hard', 'HEAD']).catch(() => { });
+            throw new RollbackConflictError(step.commitHash);
+        }
+        revertedIds.add(step.id);
+    }
+    // Commit all staged reversals as a single rollback commit
+    await git.commit(`chore(rollback): revert pipeline ${run.id}`);
+    return {
+        ...run,
+        stepRuns: run.stepRuns.map((s) => revertedIds.has(s.id) ? { ...s, status: 'rolled_back' } : s),
+    };
+}
+//# sourceMappingURL=pipeline-rollback.js.map

package/dist/src/core/pipeline-rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-rollback.js","sourceRoot":"","sources":["../../../src/core/pipeline-rollback.ts"],"names":[],"mappings":"AAeA,mBAAmB;AAEnB,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACnB;IAA5B,YAA4B,UAAkB;QAC5C,KAAK,CAAC,UAAU,UAAU,sCAAsC,CAAC,CAAC;QADxC,eAAU,GAAV,UAAU,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAClB;IAA5B,YAA4B,UAAkB;QAC5C,KAAK,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;QAD7B,eAAU,GAAV,UAAU,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,oBAAoB;AAEpB,KAAK,UAAU,iBAAiB,CAAC,GAAc,EAAE,IAAY;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAc;IACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,0BAA0B;AAE1B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAgB,EAAE,GAAc;IAChE,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CACvC,CAAC,CAAC,EAAyC,EAAE,CAC3C,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC9D,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4DAA4D;IAC5D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;YACnD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,mDAAmD;YACnD,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,mEAAmE;QACnE,IAAI,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,0DAA0D;IAC1D,MAAM,GAAG,CAAC,MAAM,CAAC,oCAAoC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/D,OAAO;QACL,GAAG,GAAG;QACN,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,CACrE;KACF,CAAC;AACJ,CAAC"}

package/dist/src/core/pipeline-runner.d.ts

@@ -0,0 +1,73 @@
+import type { TaskStore } from './task-store.js';
+export type OnFailureAction = 'stop' | 'rollback' | 'continue';
+export type PipelineRunStatus = 'running' | 'paused_for_approval' | 'completed' | 'cancelled' | 'failed' | 'rolled_back';
+export type StepRunStatus = 'pending' | 'running' | 'done' | 'failed' | 'skipped';
+export interface PipelineStep {
+    id: string;
+    name: string;
+    /** ID of the Task in the TaskStore that represents this step's work. */
+    taskId: string;
+    /** What to do if the step's task ends in a non-done state. */
+    on_failure: OnFailureAction;
+    /** When true, the run pauses before this step starts and waits for human approval. */
+    requires_approval?: boolean;
+}
+export interface Pipeline {
+    id: string;
+    name: string;
+    steps: PipelineStep[];
+}
+export interface PipelineRunStep {
+    stepId: string;
+    taskId: string;
+    status: StepRunStatus;
+    startedAt?: string;
+    completedAt?: string;
+}
+export interface PipelineRun {
+    id: string;
+    pipelineId: string;
+    /** Snapshot of the pipeline definition at run creation time. */
+    pipeline: Pipeline;
+    status: PipelineRunStatus;
+    /** Index into pipeline.steps pointing at the active or most-recently-completed step. */
+    currentStepIndex: number;
+    steps: PipelineRunStep[];
+    createdAt: string;
+    updatedAt: string;
+    completedAt?: string;
+}
+export interface PipelineRunner {
+    /**
+     * Create and start a new pipeline run. The first step transitions to 'running'.
+     * Throws if the pipeline has no steps.
+     */
+    start(pipeline: Pipeline): PipelineRun;
+    /**
+     * Inspect the current step's task status and advance the state machine:
+     * - task done + last step  → run 'completed'
+     * - task done + next step has requires_approval → run 'paused_for_approval'
+     * - task done + next step  → currentStepIndex++, next step 'running'
+     * - task blocked           → apply on_failure: stop/rollback/continue
+     * - task todo/in_progress  → no-op (still running)
+     * No-ops if the run is not in 'running' status.
+     */
+    advance(runId: string): PipelineRun;
+    /**
+     * Resume (or reject) a run that is 'paused_for_approval'.
+     * - approved=true  → start the pending step, status → 'running'
+     * - approved=false → status → 'cancelled'
+     * Throws if the run is not paused for approval.
+     */
+    handleApproval(runId: string, approved: boolean): PipelineRun;
+    /**
+     * Cancel a run that has not yet reached a terminal state.
+     * The currently-running step (if any) is marked 'failed'.
+     * No-ops if already completed or cancelled.
+     */
+    cancel(runId: string): PipelineRun;
+    /** Return the current state of a run, or null if not found. */
+    getRun(runId: string): PipelineRun | null;
+}
+export declare function createPipelineRunner(taskStore: TaskStore): PipelineRunner;
+//# sourceMappingURL=pipeline-runner.d.ts.map

package/dist/src/core/pipeline-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-runner.d.ts","sourceRoot":"","sources":["../../../src/core/pipeline-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,qBAAqB,GACrB,WAAW,GACX,WAAW,GACX,QAAQ,GACR,aAAa,CAAC;AAElB,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,EAAE,eAAe,CAAC;IAC5B,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,wFAAwF;IACxF,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC;IAEvC;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC;IAEpC;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,WAAW,CAAC;IAE9D;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC;IAEnC,+DAA+D;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;CAC3C;AAiBD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAyKzE"}

package/dist/src/core/pipeline-runner.js

@@ -0,0 +1,165 @@
+import { ulid } from 'ulid';
+// ---- Internal helpers ----
+const TERMINAL_STATUSES = [
+    'completed',
+    'cancelled',
+    'failed',
+    'rolled_back',
+];
+function clone(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+// ---- Factory ----
+export function createPipelineRunner(taskStore) {
+    const runs = new Map();
+    function getRun(runId) {
+        const run = runs.get(runId);
+        return run ? clone(run) : null;
+    }
+    function start(pipeline) {
+        if (pipeline.steps.length === 0) {
+            throw new Error('Pipeline must have at least one step');
+        }
+        const now = new Date().toISOString();
+        const runSteps = pipeline.steps.map((step, i) => ({
+            stepId: step.id,
+            taskId: step.taskId,
+            status: i === 0 ? 'running' : 'pending',
+            startedAt: i === 0 ? now : undefined,
+        }));
+        const run = {
+            id: ulid(),
+            pipelineId: pipeline.id,
+            pipeline: clone(pipeline),
+            status: 'running',
+            currentStepIndex: 0,
+            steps: runSteps,
+            createdAt: now,
+            updatedAt: now,
+        };
+        runs.set(run.id, run);
+        return clone(run);
+    }
+    function advance(runId) {
+        const run = runs.get(runId);
+        if (!run)
+            throw new Error(`Pipeline run not found: ${runId}`);
+        if (run.status !== 'running')
+            return clone(run);
+        const currentStep = run.pipeline.steps[run.currentStepIndex];
+        const task = taskStore.get(currentStep.taskId);
+        if (!task)
+            throw new Error(`Task not found: ${currentStep.taskId}`);
+        const now = new Date().toISOString();
+        if (task.status === 'done') {
+            applyStepSuccess(run, now);
+        }
+        else if (task.status === 'blocked') {
+            applyStepFailure(run, currentStep, now);
+        }
+        // todo / in_progress → still running, no state change
+        run.updatedAt = now;
+        runs.set(runId, run);
+        return clone(run);
+    }
+    function applyStepSuccess(run, now) {
+        const idx = run.currentStepIndex;
+        run.steps[idx].status = 'done';
+        run.steps[idx].completedAt = now;
+        const isLastStep = idx === run.pipeline.steps.length - 1;
+        if (isLastStep) {
+            run.status = 'completed';
+            run.completedAt = now;
+            return;
+        }
+        const nextStep = run.pipeline.steps[idx + 1];
+        if (nextStep.requires_approval) {
+            // Advance index to the approval-gated step so handleApproval can start it.
+            run.currentStepIndex = idx + 1;
+            run.status = 'paused_for_approval';
+        }
+        else {
+            run.currentStepIndex = idx + 1;
+            run.steps[idx + 1].status = 'running';
+            run.steps[idx + 1].startedAt = now;
+        }
+    }
+    function applyStepFailure(run, step, now) {
+        const idx = run.currentStepIndex;
+        run.steps[idx].status = 'failed';
+        run.steps[idx].completedAt = now;
+        switch (step.on_failure) {
+            case 'stop':
+                run.status = 'failed';
+                run.completedAt = now;
+                break;
+            case 'rollback':
+                run.status = 'rolled_back';
+                run.completedAt = now;
+                break;
+            case 'continue': {
+                const nextIdx = idx + 1;
+                const isLastStep = nextIdx >= run.pipeline.steps.length;
+                if (isLastStep) {
+                    run.status = 'completed';
+                    run.completedAt = now;
+                }
+                else {
+                    const nextStep = run.pipeline.steps[nextIdx];
+                    if (nextStep.requires_approval) {
+                        run.currentStepIndex = nextIdx;
+                        run.status = 'paused_for_approval';
+                    }
+                    else {
+                        run.currentStepIndex = nextIdx;
+                        run.steps[nextIdx].status = 'running';
+                        run.steps[nextIdx].startedAt = now;
+                    }
+                }
+                break;
+            }
+        }
+    }
+    function handleApproval(runId, approved) {
+        const run = runs.get(runId);
+        if (!run)
+            throw new Error(`Pipeline run not found: ${runId}`);
+        if (run.status !== 'paused_for_approval') {
+            throw new Error(`Run ${runId} is not paused for approval (status: ${run.status})`);
+        }
+        const now = new Date().toISOString();
+        if (approved) {
+            // currentStepIndex already points at the step waiting for approval
+            run.steps[run.currentStepIndex].status = 'running';
+            run.steps[run.currentStepIndex].startedAt = now;
+            run.status = 'running';
+        }
+        else {
+            run.status = 'cancelled';
+            run.completedAt = now;
+        }
+        run.updatedAt = now;
+        runs.set(runId, run);
+        return clone(run);
+    }
+    function cancel(runId) {
+        const run = runs.get(runId);
+        if (!run)
+            throw new Error(`Pipeline run not found: ${runId}`);
+        if (TERMINAL_STATUSES.includes(run.status))
+            return clone(run);
+        const now = new Date().toISOString();
+        const currentStepRun = run.steps[run.currentStepIndex];
+        if (currentStepRun.status === 'running') {
+            currentStepRun.status = 'failed';
+            currentStepRun.completedAt = now;
+        }
+        run.status = 'cancelled';
+        run.completedAt = now;
+        run.updatedAt = now;
+        runs.set(runId, run);
+        return clone(run);
+    }
+    return { start, advance, handleApproval, cancel, getRun };
+}
+//# sourceMappingURL=pipeline-runner.js.map

package/dist/src/core/pipeline-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-runner.js","sourceRoot":"","sources":["../../../src/core/pipeline-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6F5B,6BAA6B;AAE7B,MAAM,iBAAiB,GAAwB;IAC7C,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa;CACd,CAAC;AAEF,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAChD,CAAC;AAED,oBAAoB;AAEpB,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE5C,SAAS,MAAM,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,SAAS,KAAK,CAAC,QAAkB;QAC/B,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAsB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACvC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;SACrC,CAAC,CAAC,CAAC;QAEJ,MAAM,GAAG,GAAgB;YACvB,EAAE,EAAE,IAAI,EAAE;YACV,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,CAAC;YACnB,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,SAAS,OAAO,CAAC,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhD,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,sDAAsD;QAEtD,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,SAAS,gBAAgB,CAAC,GAAgB,EAAE,GAAW;QACrD,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;QAEjC,MAAM,UAAU,GAAG,GAAG,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;YACzB,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,2EAA2E;YAC3E,GAAG,CAAC,gBAAgB,GAAG,GAAG,GAAG,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,qBAAqB,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,gBAAgB,GAAG,GAAG,GAAG,CAAC,CAAC;YAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;QACrC,CAAC;IACH,CAAC;IAED,SAAS,gBAAgB,CAAC,GAAgB,EAAE,IAAkB,EAAE,GAAW;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;QAEjC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,KAAK,MAAM;gBACT,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;gBACtB,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;gBACtB,MAAM;YAER,KAAK,UAAU;gBACb,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC;gBAC3B,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;gBACtB,MAAM;YAER,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC;gBACxB,MAAM,UAAU,GAAG,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;oBACzB,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC7C,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC;wBAC/B,GAAG,CAAC,MAAM,GAAG,qBAAqB,CAAC;oBACrC,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC;wBAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;wBACtC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;oBACrC,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,KAAa,EAAE,QAAiB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,wCAAwC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,QAAQ,EAAE,CAAC;YACb,mEAAmE;YACnE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;YAChD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;YACzB,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;QACxB,CAAC;QAED,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,SAAS,MAAM,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAE9D,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,cAAc,CAAC,MAAM,GAAG,QAAQ,CAAC;YACjC,cAAc,CAAC,WAAW,GAAG,GAAG,CAAC;QACnC,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;QACzB,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;QACtB,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;QAEpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC"}

package/dist/src/core/pr-creator.d.ts

@@ -0,0 +1,22 @@
+export interface PrCreateOptions {
+    taskId: string;
+    taskTitle: string;
+    summary: string;
+    branch: string;
+    baseBranch: string;
+    worktreePath: string;
+}
+export interface PrCreateResult {
+    success: boolean;
+    prUrl?: string;
+    error?: string;
+}
+export declare function buildPrTitle(taskTitle: string, titleFormat: string): string;
+export declare function buildPrBody(opts: {
+    taskId: string;
+    taskTitle: string;
+    summary: string;
+    branch: string;
+}): string;
+export declare function pushAndCreatePr(opts: PrCreateOptions): PrCreateResult;
+//# sourceMappingURL=pr-creator.d.ts.map

package/dist/src/core/pr-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-creator.d.ts","sourceRoot":"","sources":["../../../src/core/pr-creator.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAW3E;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAUhH;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAkCrE"}

package/dist/src/core/pr-creator.js

@@ -0,0 +1,55 @@
+import { execFileSync } from 'child_process';
+const FIX_KEYWORDS = ['fix', 'bug', 'patch', 'resolve', 'correct', 'repair'];
+const CHORE_KEYWORDS = ['update', 'upgrade', 'refactor', 'clean', 'remove', 'delete', 'chore', 'deps', 'dependency'];
+export function buildPrTitle(taskTitle, titleFormat) {
+    const lower = taskTitle.toLowerCase();
+    let prefix = 'feat';
+    if (FIX_KEYWORDS.some((kw) => lower.includes(kw))) {
+        prefix = 'fix';
+    }
+    else if (CHORE_KEYWORDS.some((kw) => lower.includes(kw))) {
+        prefix = 'chore';
+    }
+    return `${prefix}: ${taskTitle}`;
+}
+export function buildPrBody(opts) {
+    return `## ${opts.taskTitle}
+
+${opts.summary}
+
+---
+**Task ID:** \`${opts.taskId}\`
+**Branch:** \`${opts.branch}\`
+**Created by:** Verbo agent
+`;
+}
+export function pushAndCreatePr(opts) {
+    try {
+        // Push the branch
+        execFileSync('git', ['push', 'origin', opts.branch], {
+            cwd: opts.worktreePath,
+            encoding: 'utf-8',
+            timeout: 60000,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        // Create PR via gh CLI
+        const title = buildPrTitle(opts.taskTitle, 'feat|fix|chore: description');
+        const body = buildPrBody({
+            taskId: opts.taskId,
+            taskTitle: opts.taskTitle,
+            summary: opts.summary,
+            branch: opts.branch,
+        });
+        const prUrl = execFileSync('gh', ['pr', 'create', '--title', title, '--body', body, '--base', opts.baseBranch, '--head', opts.branch], {
+            cwd: opts.worktreePath,
+            encoding: 'utf-8',
+            timeout: 30000,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        return { success: true, prUrl };
+    }
+    catch (err) {
+        return { success: false, error: err.message };
+    }
+}
+//# sourceMappingURL=pr-creator.js.map

package/dist/src/core/pr-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-creator.js","sourceRoot":"","sources":["../../../src/core/pr-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAiB7C,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC7E,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAErH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,WAAmB;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEtC,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;SAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAA4E;IACtG,OAAO,MAAM,IAAI,CAAC,SAAS;;EAE3B,IAAI,CAAC,OAAO;;;iBAGG,IAAI,CAAC,MAAM;gBACZ,IAAI,CAAC,MAAM;;CAE1B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,IAAI,CAAC;QACH,kBAAkB;QAClB,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACnD,GAAG,EAAE,IAAI,CAAC,YAAY;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QAEH,uBAAuB;QACvB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,YAAY,CACxB,IAAI,EACJ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EACpG;YACE,GAAG,EAAE,IAAI,CAAC,YAAY;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CACF,CAAC,IAAI,EAAE,CAAC;QAET,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/src/core/rbac.d.ts

@@ -0,0 +1,27 @@
+import type Database from 'better-sqlite3';
+export type Role = 'owner' | 'lead' | 'developer' | 'viewer';
+export type Action = 'list_tasks' | 'list_sessions' | 'create_task' | 'claim_task' | 'update_progress' | 'complete_task' | 'report_files' | 'get_conflicts' | 'unclaim_task' | 'flag_human_action' | 'list_human_actions' | 'resolve_human_action' | 'approve_tool' | 'change_role' | 'disable_sandbox';
+export declare class RbacError extends Error {
+    readonly humanId: string;
+    readonly role: Role;
+    readonly action: Action;
+    constructor(humanId: string, role: Role, action: Action);
+}
+export interface RbacStore {
+    /** Returns the role for humanId; defaults to 'viewer' if not registered. */
+    getRole(humanId: string): Role;
+    /** Upserts a team member's role and records the change in role_change_log. */
+    setRole(targetId: string, newRole: Role, changedBy: string, reason?: string): void;
+}
+export declare function createRbacStore(db: Database.Database): RbacStore;
+export interface RbacChecker {
+    /** Returns true if humanId's role permits action. */
+    can(humanId: string, action: Action): boolean;
+    /** Throws RbacError if humanId's role does not permit action. */
+    assert(humanId: string, action: Action): void;
+    /** Returns the effective role for humanId (defaults to 'viewer'). */
+    getRole(humanId: string): Role;
+    store: RbacStore;
+}
+export declare function createRbacChecker(store: RbacStore): RbacChecker;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/src/core/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/core/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAK3C,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE7D,MAAM,MAAM,MAAM,GACd,YAAY,GACZ,eAAe,GACf,aAAa,GACb,YAAY,GACZ,iBAAiB,GACjB,eAAe,GACf,cAAc,GACd,eAAe,GACf,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,aAAa,GACb,iBAAiB,CAAC;AAItB,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;CAOxD;AA6BD,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpF;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAiChE;AAID,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,iEAAiE;IACjE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,qEAAqE;IACrE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAkB/D"}

package/dist/src/core/rbac.js

@@ -0,0 +1,76 @@
+import { ulid } from 'ulid';
+// ---- Error ----
+export class RbacError extends Error {
+    humanId;
+    role;
+    action;
+    constructor(humanId, role, action) {
+        super(`Forbidden: ${humanId} (${role}) cannot perform '${action}'`);
+        this.name = 'RbacError';
+        this.humanId = humanId;
+        this.role = role;
+        this.action = action;
+    }
+}
+// ---- Permission matrix ----
+//
+// owner     — full access
+// lead      — all agent/task actions + resolve/approve/change-role/disable-sandbox
+// developer — task lifecycle only (claim, update, complete, create, report, flag)
+// viewer    — read-only (list tasks, conflicts, human actions)
+const PERMISSIONS = {
+    list_tasks: new Set(['owner', 'lead', 'developer', 'viewer']),
+    list_sessions: new Set(['owner', 'lead', 'developer', 'viewer']),
+    get_conflicts: new Set(['owner', 'lead', 'developer', 'viewer']),
+    list_human_actions: new Set(['owner', 'lead', 'developer', 'viewer']),
+    create_task: new Set(['owner', 'lead', 'developer']),
+    claim_task: new Set(['owner', 'lead', 'developer']),
+    update_progress: new Set(['owner', 'lead', 'developer']),
+    complete_task: new Set(['owner', 'lead', 'developer']),
+    report_files: new Set(['owner', 'lead', 'developer']),
+    unclaim_task: new Set(['owner', 'lead', 'developer']),
+    flag_human_action: new Set(['owner', 'lead', 'developer']),
+    resolve_human_action: new Set(['owner', 'lead']),
+    approve_tool: new Set(['owner', 'lead']),
+    change_role: new Set(['owner', 'lead']),
+    disable_sandbox: new Set(['owner', 'lead']),
+};
+export function createRbacStore(db) {
+    const stmtGetRole = db.prepare('SELECT role FROM team_members WHERE human_id = ?');
+    const stmtInsert = db.prepare('INSERT INTO team_members (human_id, role, created_at, updated_at) VALUES (?, ?, ?, ?)');
+    const stmtUpdate = db.prepare('UPDATE team_members SET role = ?, updated_at = ? WHERE human_id = ?');
+    const stmtLogChange = db.prepare('INSERT INTO role_change_log (id, target_human_id, changed_by, old_role, new_role, reason, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)');
+    function getRole(humanId) {
+        return stmtGetRole.get(humanId)?.role ?? 'viewer';
+    }
+    function setRole(targetId, newRole, changedBy, reason) {
+        const now = new Date().toISOString();
+        const existing = stmtGetRole.get(targetId);
+        const oldRole = existing?.role ?? null;
+        if (existing) {
+            stmtUpdate.run(newRole, now, targetId);
+        }
+        else {
+            stmtInsert.run(targetId, newRole, now, now);
+        }
+        stmtLogChange.run(ulid(), targetId, changedBy, oldRole, newRole, reason ?? null, now);
+    }
+    return { getRole, setRole };
+}
+export function createRbacChecker(store) {
+    function can(humanId, action) {
+        const role = store.getRole(humanId);
+        return PERMISSIONS[action].has(role);
+    }
+    function assert(humanId, action) {
+        const role = store.getRole(humanId);
+        if (!PERMISSIONS[action].has(role)) {
+            throw new RbacError(humanId, role, action);
+        }
+    }
+    function getRole(humanId) {
+        return store.getRole(humanId);
+    }
+    return { can, assert, getRole, store };
+}
+//# sourceMappingURL=rbac.js.map

package/dist/src/core/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/core/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAuB5B,kBAAkB;AAElB,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,OAAO,CAAS;IAChB,IAAI,CAAO;IACX,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,IAAU,EAAE,MAAc;QACrD,KAAK,CAAC,cAAc,OAAO,KAAK,IAAI,qBAAqB,MAAM,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,8BAA8B;AAC9B,EAAE;AACF,0BAA0B;AAC1B,mFAAmF;AACnF,kFAAkF;AAClF,+DAA+D;AAE/D,MAAM,WAAW,GAA8B;IAC7C,UAAU,EAAY,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvE,aAAa,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvE,aAAa,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvE,kBAAkB,EAAI,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvE,WAAW,EAAW,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,UAAU,EAAY,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,eAAe,EAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,aAAa,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,YAAY,EAAU,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,YAAY,EAAU,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,iBAAiB,EAAK,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7D,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,YAAY,EAAU,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,WAAW,EAAW,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,eAAe,EAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CACjD,CAAC;AAWF,MAAM,UAAU,eAAe,CAAC,EAAqB;IACnD,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B,kDAAkD,CACnD,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,uFAAuF,CACxF,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,qEAAqE,CACtE,CAAC;IACF,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAC9B,oIAAoI,CACrI,CAAC;IAEF,SAAS,OAAO,CAAC,OAAe;QAC9B,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;IACpD,CAAC;IAED,SAAS,OAAO,CAAC,QAAgB,EAAE,OAAa,EAAE,SAAiB,EAAE,MAAe;QAClF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;QAEvC,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAcD,MAAM,UAAU,iBAAiB,CAAC,KAAgB;IAChD,SAAS,GAAG,CAAC,OAAe,EAAE,MAAc;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,MAAM,CAAC,OAAe,EAAE,MAAc;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,OAAe;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC"}

package/dist/src/core/startup-cleanup.d.ts

@@ -0,0 +1,47 @@
+import type { TaskStore } from './task-store.js';
+import type { AgentSessionStore } from './agent-session-store.js';
+import type { ApprovalStore } from '../approval/approval-store.js';
+import type { AgentLauncher } from '../agent/agent-launcher.js';
+import type { PipelineRunner } from './pipeline-runner.js';
+import type Database from 'better-sqlite3';
+export interface CleanupDeps {
+    tasks: TaskStore;
+    sessions: AgentSessionStore;
+    approvals: ApprovalStore;
+    /** Optional — if provided, orphaned worktrees will be removed from disk. */
+    launcher?: AgentLauncher;
+    /** The project root directory — needed to scan .verbo/agents/. */
+    projectDir?: string;
+    /** Override for testing — defaults to checking process.kill(pid, 0). */
+    isPidAlive?: (pid: number) => boolean;
+    /**
+     * Optional pipeline runner — if provided and pipelineRunIds is given,
+     * active runs that belong to reset tasks will be cancelled at startup.
+     */
+    pipelineRunner?: PipelineRunner;
+    /** Set of pipeline run IDs to cancel when their tasks are reset on startup. */
+    pipelineRunIds?: Set<string>;
+}
+export interface CleanupResult {
+    pendingApprovalsDenied: number;
+    sessionsErrored: number;
+    tasksReset: number;
+    worktreesCleaned: number;
+    staleHooksCleaned: boolean;
+}
+/**
+ * Clean up stale state left over from a previous Verbo run.
+ * Called once at startup before the TUI or any command that launches agents.
+ *
+ * 1. Deny all pending approval requests (agents that asked are gone).
+ * 2. Mark orphaned sessions (starting/active/stalled with no live PID) as errored.
+ * 3. Reset in_progress tasks whose session has no live PID back to todo.
+ */
+export declare function cleanStaleState(deps: CleanupDeps): Promise<CleanupResult>;
+/**
+ * Delete audit_log rows older than `retainDays` (default 90).
+ * Called at startup to keep the audit table from growing unbounded.
+ * Returns the number of rows pruned.
+ */
+export declare function pruneAuditLog(db: Database.Database, retainDays?: number): number;
+//# sourceMappingURL=startup-cleanup.d.ts.map

package/dist/src/core/startup-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-cleanup.d.ts","sourceRoot":"","sources":["../../../src/core/startup-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAI3C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAWD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA8H/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,SAAK,GAAG,MAAM,CAO5E"}