@agent-native/core 0.111.3 → 0.112.0

package/corpus/templates/brain/actions/list-distillation-queue.ts

@@ -1,9 +1,10 @@
 import { defineAction } from "@agent-native/core";
 import { accessFilter } from "@agent-native/core/sharing";
-import { and, desc, eq, lte, or } from "drizzle-orm";
+import { and, desc, eq, inArray, isNull, lte, or } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { listAccessibleAudienceIds } from "../server/lib/audiences.js";
 import { redactSensitiveText } from "../server/lib/search.js";
 
 const queueStatuses = ["queued", "processing", "done", "failed"] as const;
@@ -118,27 +119,45 @@ export async function readDistillationQueue(
   const staleCutoff = staleProcessingCutoff(now);
   const issue = args.staleOnly ? "stale" : (args.issue ?? "all");
   const limit = args.limit ?? 100;
+  const accessibleAudienceIds = await listAccessibleAudienceIds();
+  const captureVisibility = or(
+    isNull(schema.brainIngestQueue.captureId),
+    accessibleAudienceIds.length
+      ? and(
+          eq(schema.brainRawCaptures.sensitivityDisposition, "allowed"),
+          inArray(
+            schema.brainCaptureAudiences.audienceId,
+            accessibleAudienceIds,
+          ),
+        )
+      : undefined,
+  );
   const baseClauses = [
     eq(schema.brainIngestQueue.operation, "distill"),
     accessFilter(schema.brainSources, schema.brainSourceShares),
+    captureVisibility,
   ];
   if (args.sourceId) {
     baseClauses.push(eq(schema.brainSources.id, args.sourceId));
   }
 
   const summaryRows = await db
-    .select({
+    .selectDistinct({
       status: schema.brainIngestQueue.status,
       updatedAt: schema.brainIngestQueue.updatedAt,
     })
     .from(schema.brainIngestQueue)
     .innerJoin(
+      schema.brainSources,
+      eq(schema.brainIngestQueue.sourceId, schema.brainSources.id),
+    )
+    .leftJoin(
       schema.brainRawCaptures,
       eq(schema.brainIngestQueue.captureId, schema.brainRawCaptures.id),
     )
-    .innerJoin(
-      schema.brainSources,
-      eq(schema.brainRawCaptures.sourceId, schema.brainSources.id),
+    .leftJoin(
+      schema.brainCaptureAudiences,
+      eq(schema.brainCaptureAudiences.captureId, schema.brainRawCaptures.id),
     )
     .where(and(...baseClauses));
 
@@ -164,7 +183,7 @@ export async function readDistillationQueue(
   }
 
   const rows = await db
-    .select({
+    .selectDistinct({
       id: schema.brainIngestQueue.id,
       sourceId: schema.brainIngestQueue.sourceId,
       captureId: schema.brainIngestQueue.captureId,
@@ -184,12 +203,16 @@ export async function readDistillationQueue(
     })
     .from(schema.brainIngestQueue)
     .innerJoin(
+      schema.brainSources,
+      eq(schema.brainIngestQueue.sourceId, schema.brainSources.id),
+    )
+    .leftJoin(
       schema.brainRawCaptures,
       eq(schema.brainIngestQueue.captureId, schema.brainRawCaptures.id),
     )
-    .innerJoin(
-      schema.brainSources,
-      eq(schema.brainRawCaptures.sourceId, schema.brainSources.id),
+    .leftJoin(
+      schema.brainCaptureAudiences,
+      eq(schema.brainCaptureAudiences.captureId, schema.brainRawCaptures.id),
     )
     .where(and(...clauses))
     .orderBy(desc(schema.brainIngestQueue.updatedAt))
@@ -223,11 +246,13 @@ export async function readDistillationQueue(
         provider: row.sourceProvider,
         status: row.sourceStatus,
       },
-      capture: {
-        id: row.captureId,
-        title: redactSensitiveText(row.captureTitle),
-        status: row.captureStatus,
-      },
+      capture: row.captureId
+        ? {
+            id: row.captureId,
+            title: redactOptionalText(row.captureTitle),
+            status: row.captureStatus,
+          }
+        : null,
     };
   });
 

package/corpus/templates/brain/actions/list-projects.ts

@@ -0,0 +1,51 @@
+import { defineAction } from "@agent-native/core";
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
+import { getUserSetting } from "@agent-native/core/settings";
+import { accessFilter } from "@agent-native/core/sharing";
+import { inArray } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb, schema } from "../server/db/index.js";
+
+const DEFAULT_PROJECT_SETTING = "brain-default-project";
+
+export default defineAction({
+  description: "List accessible Brain projects and their source membership.",
+  schema: z.object({}),
+  http: { method: "GET" },
+  readOnly: true,
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  run: async () => {
+    const db = getDb();
+    const projects = await db
+      .select()
+      .from(schema.brainProjects)
+      .where(accessFilter(schema.brainProjects, schema.brainProjectShares));
+    const projectIds = projects.map((project) => project.id);
+    const links = projectIds.length
+      ? await db
+          .select()
+          .from(schema.brainProjectSources)
+          .where(inArray(schema.brainProjectSources.projectId, projectIds))
+      : [];
+    const userEmail = getRequestUserEmail();
+    const setting = userEmail
+      ? ((await getUserSetting(userEmail, DEFAULT_PROJECT_SETTING)) as {
+          projectId?: string;
+        } | null)
+      : null;
+    return {
+      projects: projects.map((project) => ({
+        id: project.id,
+        title: project.title,
+        description: project.description,
+        visibility: project.visibility,
+        sourceIds: links
+          .filter((link) => link.projectId === project.id)
+          .map((link) => link.sourceId),
+        isDefault: setting?.projectId === project.id,
+        updatedAt: project.updatedAt,
+      })),
+    };
+  },
+});

package/corpus/templates/brain/actions/list-proposals.ts

@@ -1,26 +1,102 @@
 import { defineAction } from "@agent-native/core";
-import { accessFilter } from "@agent-native/core/sharing";
-import { and, desc, eq } from "drizzle-orm";
+import { accessFilter, assertAccess } from "@agent-native/core/sharing";
+import { and, desc, eq, inArray, isNull, or, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
-import { serializeProposal } from "../server/lib/brain.js";
+import { listAccessibleAudienceIds } from "../server/lib/audiences.js";
+import { parseJson, serializeProposal } from "../server/lib/brain.js";
 
 export default defineAction({
   description: "List Brain knowledge proposals requiring review.",
   schema: z.object({
-    status: z.enum(["pending", "approved", "rejected"]).default("pending"),
+    status: z
+      .enum(["pending", "approved", "rejected", "quarantine"])
+      .default("pending"),
     limit: z.coerce.number().int().min(1).max(100).default(50),
   }),
   http: { method: "GET" },
   readOnly: true,
   run: async ({ status, limit }) => {
+    if (status === "quarantine") {
+      const accessibleSources = await getDb()
+        .select({ id: schema.brainSources.id })
+        .from(schema.brainSources)
+        .where(accessFilter(schema.brainSources, schema.brainSourceShares));
+      const adminSourceIds = (
+        await Promise.all(
+          accessibleSources.map(async ({ id }) => {
+            try {
+              await assertAccess("brain-source", id, "admin");
+              return id;
+            } catch {
+              return null;
+            }
+          }),
+        )
+      ).filter((sourceId): sourceId is string => Boolean(sourceId));
+      if (!adminSourceIds.length) return { count: 0, proposals: [] };
+      const rows = await getDb()
+        .select({
+          id: schema.brainSensitivityEvents.id,
+          sourceId: schema.brainSensitivityEvents.sourceId,
+          sourceName: schema.brainSources.title,
+          disposition: schema.brainSensitivityEvents.disposition,
+          categoriesJson: schema.brainSensitivityEvents.categoriesJson,
+          confidenceBand: schema.brainSensitivityEvents.confidenceBand,
+          expiresAt: schema.brainSensitivityEvents.expiresAt,
+          createdAt: schema.brainSensitivityEvents.createdAt,
+          updatedAt: schema.brainSensitivityEvents.updatedAt,
+        })
+        .from(schema.brainSensitivityEvents)
+        .innerJoin(
+          schema.brainSources,
+          eq(schema.brainSources.id, schema.brainSensitivityEvents.sourceId),
+        )
+        .where(
+          and(
+            eq(schema.brainSensitivityEvents.disposition, "quarantined"),
+            inArray(schema.brainSensitivityEvents.sourceId, adminSourceIds),
+          ),
+        )
+        .orderBy(desc(schema.brainSensitivityEvents.createdAt))
+        .limit(limit);
+      const proposals = rows.map((row) => ({
+        id: row.id,
+        title: "Privacy quarantine",
+        sourceId: row.sourceId,
+        sourceName: row.sourceName,
+        reason: [
+          row.confidenceBand,
+          ...parseJson<string[]>(row.categoriesJson, []),
+          row.expiresAt ? `expires ${row.expiresAt}` : "metadata-only",
+        ].join(" · "),
+        status: "quarantine" as const,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+      }));
+      return { count: proposals.length, proposals };
+    }
+    const audienceIds = await listAccessibleAudienceIds();
     const rows = await getDb()
       .select()
       .from(schema.brainProposals)
       .where(
         and(
           accessFilter(schema.brainProposals, schema.brainProposalShares),
+          or(
+            isNull(schema.brainProposals.captureId),
+            audienceIds.length
+              ? and(
+                  sql`exists (
+                    select 1 from ${schema.brainSources}
+                    where ${schema.brainSources.id} = ${schema.brainProposals.sourceId}
+                      and ${accessFilter(schema.brainSources, schema.brainSourceShares)}
+                  )`,
+                  inArray(schema.brainProposals.audienceId, audienceIds),
+                )
+              : undefined,
+          ),
           eq(schema.brainProposals.status, status),
         ),
       )

package/corpus/templates/brain/actions/list-sources.ts

@@ -1,20 +1,34 @@
 import { defineAction } from "@agent-native/core";
 import { accessFilter } from "@agent-native/core/sharing";
-import { and, count, desc, eq, ne } from "drizzle-orm";
+import { and, countDistinct, desc, eq, inArray, ne } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 import { nextBrainSourceSyncAt } from "../server/jobs/sync-sources.js";
+import { listAccessibleAudienceIds } from "../server/lib/audiences.js";
 import { parseJson, serializeSource } from "../server/lib/brain.js";
 import { sourceProviderSchema } from "./_schemas.js";
 
 async function sourceRecordCount(sourceId: string): Promise<number> {
+  const audienceIds = await listAccessibleAudienceIds([sourceId]);
+  if (!audienceIds.length) return 0;
+
   // Count only — never load the heavy `content` blob of every capture row
   // just to take `.length`.
   const [row] = await getDb()
-    .select({ value: count() })
+    .select({ value: countDistinct(schema.brainRawCaptures.id) })
     .from(schema.brainRawCaptures)
-    .where(eq(schema.brainRawCaptures.sourceId, sourceId));
+    .innerJoin(
+      schema.brainCaptureAudiences,
+      eq(schema.brainCaptureAudiences.captureId, schema.brainRawCaptures.id),
+    )
+    .where(
+      and(
+        eq(schema.brainRawCaptures.sourceId, sourceId),
+        eq(schema.brainRawCaptures.sensitivityDisposition, "allowed"),
+        inArray(schema.brainCaptureAudiences.audienceId, audienceIds),
+      ),
+    );
   return row?.value ?? 0;
 }
 

package/corpus/templates/brain/actions/manage-project.ts

@@ -0,0 +1,118 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
+import { putUserSetting } from "@agent-native/core/settings";
+import { accessFilter, assertAccess } from "@agent-native/core/sharing";
+import { and, eq, inArray } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb, schema } from "../server/db/index.js";
+import { nanoid, nowIso } from "../server/lib/brain.js";
+
+const DEFAULT_PROJECT_SETTING = "brain-default-project";
+
+export default defineAction({
+  description:
+    "Create, update, remove, or select a Brain project that scopes related knowledge sources.",
+  schema: z.object({
+    operation: z.enum(["create", "update", "delete", "set-default"]),
+    projectId: z.string().optional(),
+    title: z.string().min(1).optional(),
+    description: z.string().optional(),
+    sourceIds: z.array(z.string().min(1)).optional(),
+  }),
+  run: async (args) => {
+    const userEmail = getRequestUserEmail();
+    if (!userEmail) throw new Error("Not authenticated");
+    const db = getDb();
+    const now = nowIso();
+
+    if (args.operation === "create") {
+      if (!args.title) throw new Error("title is required");
+      const id = args.projectId ?? nanoid();
+      await db.insert(schema.brainProjects).values({
+        id,
+        title: args.title,
+        description: args.description ?? "",
+        ownerEmail: userEmail,
+        orgId: getRequestOrgId() ?? null,
+        visibility: "private",
+        createdAt: now,
+        updatedAt: now,
+      });
+      await replaceProjectSources(id, args.sourceIds ?? []);
+      return { projectId: id, operation: args.operation };
+    }
+
+    if (!args.projectId) throw new Error("projectId is required");
+    if (args.operation === "set-default") {
+      await assertAccess("brain-project", args.projectId, "viewer");
+      await putUserSetting(userEmail, DEFAULT_PROJECT_SETTING, {
+        projectId: args.projectId,
+      });
+      return { projectId: args.projectId, default: true };
+    }
+
+    await assertAccess("brain-project", args.projectId, "editor");
+    if (args.operation === "delete") {
+      await db
+        .delete(schema.brainProjectSources)
+        .where(eq(schema.brainProjectSources.projectId, args.projectId));
+      await db
+        .delete(schema.brainProjectShares)
+        .where(eq(schema.brainProjectShares.resourceId, args.projectId));
+      await db
+        .delete(schema.brainProjects)
+        .where(eq(schema.brainProjects.id, args.projectId));
+      return { projectId: args.projectId, deleted: true };
+    }
+
+    await db
+      .update(schema.brainProjects)
+      .set({
+        ...(args.title ? { title: args.title } : {}),
+        ...(args.description !== undefined
+          ? { description: args.description }
+          : {}),
+        updatedAt: now,
+      })
+      .where(eq(schema.brainProjects.id, args.projectId));
+    if (args.sourceIds) {
+      await replaceProjectSources(args.projectId, args.sourceIds);
+    }
+    return { projectId: args.projectId, operation: args.operation };
+  },
+});
+
+async function replaceProjectSources(projectId: string, sourceIds: string[]) {
+  const db = getDb();
+  const unique = Array.from(new Set(sourceIds));
+  if (unique.length) {
+    const accessible = await db
+      .select({ id: schema.brainSources.id })
+      .from(schema.brainSources)
+      .where(
+        and(
+          accessFilter(schema.brainSources, schema.brainSourceShares),
+          inArray(schema.brainSources.id, unique),
+        ),
+      );
+    if (accessible.length !== unique.length) {
+      throw new Error("One or more Brain sources were not found");
+    }
+  }
+  await db
+    .delete(schema.brainProjectSources)
+    .where(eq(schema.brainProjectSources.projectId, projectId));
+  if (!unique.length) return;
+  await db.insert(schema.brainProjectSources).values(
+    unique.map((sourceId) => ({
+      id: nanoid(),
+      projectId,
+      sourceId,
+      createdAt: nowIso(),
+    })),
+  );
+}

package/corpus/templates/brain/actions/mark-capture-distilled.ts

@@ -1,5 +1,6 @@
 import { defineAction } from "@agent-native/core";
-import { and, eq, inArray } from "drizzle-orm";
+import { getDbExec } from "@agent-native/core/db";
+import { and, desc, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
@@ -15,15 +16,76 @@ import {
 
 export default defineAction({
   description: "Mark a raw Brain capture as distilled or ignored.",
-  schema: z.object({
-    captureId: z.string().min(1),
-    status: z.enum(["distilled", "ignored"]).default("distilled"),
-  }),
-  run: async ({ captureId, status }) => {
+  schema: z
+    .object({
+      captureId: z.string().min(1),
+      status: z.enum(["distilled", "ignored"]).default("distilled"),
+      queueId: z.string().min(1).optional(),
+      claimToken: z.string().min(1).optional(),
+    })
+    .superRefine((value, ctx) => {
+      if (Boolean(value.queueId) !== Boolean(value.claimToken)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "queueId and claimToken must be supplied together.",
+        });
+      }
+    }),
+  run: async ({ captureId, status, queueId, claimToken }) => {
     const access = await getAccessibleCapture(captureId);
     if (!access) throw new Error(`No access to capture ${captureId}`);
     const db = getDb();
     const now = nowIso();
+
+    if (queueId && claimToken) {
+      const result = await getDbExec().execute({
+        sql: `UPDATE brain_ingest_queue
+          SET status = ?, error = NULL, lease_token = NULL,
+              lease_expires_at = NULL, updated_at = ?
+          WHERE id = ? AND capture_id = ? AND operation = 'distill'
+            AND status = 'processing' AND lease_token = ?`,
+        args: ["done", now, queueId, captureId, claimToken],
+      });
+      if (result.rowsAffected === 0) {
+        throw new Error(
+          "The distillation claim is no longer active; do not complete a newer worker's queue item.",
+        );
+      }
+    } else {
+      const [processing] = await db
+        .select()
+        .from(schema.brainIngestQueue)
+        .where(
+          and(
+            eq(schema.brainIngestQueue.captureId, captureId),
+            eq(schema.brainIngestQueue.operation, "distill"),
+            eq(schema.brainIngestQueue.status, "processing"),
+          ),
+        )
+        .orderBy(desc(schema.brainIngestQueue.updatedAt))
+        .limit(1);
+      if (processing) {
+        throw new Error(
+          "This capture has an active distillation claim. Supply its queueId and claimToken to complete it.",
+        );
+      }
+      await db
+        .update(schema.brainIngestQueue)
+        .set({
+          status: "done",
+          error: null,
+          leaseToken: null,
+          leaseExpiresAt: null,
+          updatedAt: now,
+        })
+        .where(
+          and(
+            eq(schema.brainIngestQueue.captureId, captureId),
+            eq(schema.brainIngestQueue.operation, "distill"),
+            eq(schema.brainIngestQueue.status, "queued"),
+          ),
+        );
+    }
     await db
       .update(schema.brainRawCaptures)
       .set({
@@ -32,20 +94,6 @@ export default defineAction({
         updatedAt: now,
       })
       .where(eq(schema.brainRawCaptures.id, captureId));
-    await db
-      .update(schema.brainIngestQueue)
-      .set({
-        status: "done",
-        error: null,
-        updatedAt: now,
-      })
-      .where(
-        and(
-          eq(schema.brainIngestQueue.captureId, captureId),
-          eq(schema.brainIngestQueue.operation, "distill"),
-          inArray(schema.brainIngestQueue.status, ["queued", "processing"]),
-        ),
-      );
     const updated = await getAccessibleCapture(captureId);
     if (!updated) return { capture: null };
     const capture = serializeCapture(updated.capture);

package/corpus/templates/brain/actions/navigate.ts

@@ -28,6 +28,7 @@ export default defineAction({
     proposalId: z.string().optional(),
     extensionId: z.string().optional(),
     query: z.string().optional(),
+    projectId: z.string().optional(),
     type: z.enum(["knowledge", "capture", "source", "all"]).optional(),
     provider: z.string().optional(),
     status: z.string().optional(),

package/corpus/templates/brain/actions/reject-proposal.ts

@@ -5,7 +5,11 @@ import { eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
-import { nowIso, serializeProposal } from "../server/lib/brain.js";
+import {
+  assertDerivedAudienceAccess,
+  nowIso,
+  serializeProposal,
+} from "../server/lib/brain.js";
 
 export default defineAction({
   description: "Reject a pending Brain proposal with optional reviewer notes.",
@@ -15,6 +19,7 @@ export default defineAction({
   }),
   run: async ({ proposalId, reviewerNotes }) => {
     const access = await assertAccess("brain-proposal", proposalId, "editor");
+    await assertDerivedAudienceAccess(access.resource);
     if (access.resource.status !== "pending") {
       throw new Error(
         `Proposal ${proposalId} is already ${access.resource.status}`,