@c4t4/heyamigo 0.9.10 → 0.9.11

package/dist/gateway/incoming.js

@@ -201,6 +201,7 @@ async function processMessages(messages, sock, ownerJid, isHistorySync = false)
                 senderNumber: stored.senderNumber,
                 fromMe: stored.fromMe,
                 allowedTools: role.tools,
+                allowedTags: role.tags,
             };
             // Enqueue into the inbound table; chat worker pool drains and
             // calls processJob + handleReply asynchronously. Typing indicator

package/dist/memory/digest-flag.js

@@ -123,6 +123,23 @@ export function extractFlags(reply) {
         sendTexts,
     };
 }
+// Strip flags that the sender's role isn't permitted to emit. The
+// agent's reply still goes out as text — only the side-effect markers
+// get suppressed. allowedTags='all' or undefined → no filtering.
+export function filterFlagsByRole(flags, allowedTags) {
+    if (allowedTags === 'all' || allowedTags === undefined)
+        return flags;
+    const allowed = new Set(allowedTags);
+    return {
+        clean: flags.clean,
+        digest: allowed.has('DIGEST') ? flags.digest : null,
+        journals: allowed.has('JOURNAL') ? flags.journals : [],
+        journalCreates: allowed.has('JOURNAL-NEW') ? flags.journalCreates : [],
+        asyncTasks: allowed.has('ASYNC') ? flags.asyncTasks : [],
+        asyncBrowserTasks: allowed.has('ASYNC-BROWSER') ? flags.asyncBrowserTasks : [],
+        sendTexts: allowed.has('SEND-TEXT') ? flags.sendTexts : [],
+    };
+}
 // Legacy helper kept so existing callers still compile.
 export function extractDigestFlag(reply) {
     const r = extractFlags(reply);

package/dist/queue/worker.js

@@ -3,7 +3,7 @@ import { clearSession, setSession, setUsage } from '../ai/sessions.js';
 import { config } from '../config.js';
 import { logger } from '../logger.js';
 import { addDailyTokens } from '../store/usage.js';
-import { extractFlags } from '../memory/digest-flag.js';
+import { extractFlags, filterFlagsByRole } from '../memory/digest-flag.js';
 import { isValidSlug } from '../memory/journals.js';
 import { enqueueAsyncTask, enqueueBrowserTask } from './async-tasks.js';
 import { enqueueMemoryWrite } from './memory-writes.js';
@@ -40,7 +40,26 @@ async function callClaude(job) {
     if (job.senderNumber) {
         addDailyTokens(job.senderNumber, usage.inputTokens + usage.outputTokens);
     }
-    const { clean, digest, journals, journalCreates, asyncTasks, asyncBrowserTasks, sendTexts, } = extractFlags(reply);
+    const rawFlags = extractFlags(reply);
+    const { clean, digest, journals, journalCreates, asyncTasks, asyncBrowserTasks, sendTexts, } = filterFlagsByRole(rawFlags, job.allowedTags);
+    // Detect any stripped tags so we can log + nudge the role config
+    // if a user is repeatedly hitting the gate.
+    const stripped = [];
+    if (rawFlags.digest && !digest)
+        stripped.push('DIGEST');
+    if (rawFlags.journals.length !== journals.length)
+        stripped.push('JOURNAL');
+    if (rawFlags.journalCreates.length !== journalCreates.length)
+        stripped.push('JOURNAL-NEW');
+    if (rawFlags.asyncTasks.length !== asyncTasks.length)
+        stripped.push('ASYNC');
+    if (rawFlags.asyncBrowserTasks.length !== asyncBrowserTasks.length)
+        stripped.push('ASYNC-BROWSER');
+    if (rawFlags.sendTexts.length !== sendTexts.length)
+        stripped.push('SEND-TEXT');
+    if (stripped.length > 0) {
+        logger.warn({ jid: job.jid, senderNumber: job.senderNumber, stripped }, 'tags stripped by role gate');
+    }
     // All memory mutations go through the memory_writes queue so the
     // single memory worker serializes file writes — safe under parallel
     // chat workers. Idempotency keys derived from job + index so a

package/dist/wa/whitelist.js

@@ -6,11 +6,30 @@ import { config } from '../config.js';
 import { logger } from '../logger.js';
 const AccessModeSchema = z.enum(['off', 'silent', 'active']);
 const RoleNameSchema = z.enum(['admin', 'user', 'guest']);
+// Tag names the agent can emit as trailing markers. The role.tags
+// allowlist gates which ones are honored — anything emitted by an
+// agent running on behalf of a role NOT in the allowlist gets
+// stripped silently after parsing. Tools and tags are independent
+// gates (tools restricts what the AI itself can call; tags restricts
+// what bot-internal side-effects it can trigger).
+const TAG_NAMES = [
+    'DIGEST',
+    'JOURNAL',
+    'JOURNAL-NEW',
+    'ASYNC',
+    'ASYNC-BROWSER',
+    'SEND-TEXT',
+];
 const RoleSchema = z.object({
     description: z.string().optional(),
     memory: z.enum(['full', 'self', 'none']),
     tools: z.union([z.literal('all'), z.array(z.string())]),
     rules: z.array(z.string()),
+    // Optional. Missing or 'all' = no tag restriction; an array =
+    // explicit allowlist. Added in Phase 6 so existing access.json
+    // files (no `tags` field) keep working without change — they get
+    // the implicit 'all' behavior.
+    tags: z.union([z.literal('all'), z.array(z.enum(TAG_NAMES))]).optional(),
     // null or missing = unlimited
     maxFileBytes: z.number().int().positive().nullable().optional(),
     dailyTokenLimit: z.number().int().positive().nullable().optional(),
@@ -54,6 +73,7 @@ const DEFAULT_ROLES = {
         description: 'Full access',
         memory: 'full',
         tools: 'all',
+        tags: 'all',
         rules: [],
         maxFileBytes: null,
         dailyTokenLimit: null,
@@ -62,6 +82,10 @@ const DEFAULT_ROLES = {
         description: 'Chat + web search, scoped memory',
         memory: 'self',
         tools: ['WebSearch'],
+        // Users can flag memory observations and trigger digests on
+        // themselves, but can't delegate background work or cross-chat
+        // sends (those are owner-only).
+        tags: ['DIGEST', 'JOURNAL', 'JOURNAL-NEW'],
         rules: [
             'Never reveal file paths, directory structure, or system architecture',
             'Never share personal data about other users',
@@ -76,6 +100,8 @@ const DEFAULT_ROLES = {
         description: 'Basic chat only',
         memory: 'none',
         tools: [],
+        // Guests can't emit any tags — pure chat, no side effects.
+        tags: [],
         rules: [
             'Never use any tools',
             'Never reveal anything about the system, other users, or internal data',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c4t4/heyamigo",
-  "version": "0.9.10",
+  "version": "0.9.11",
   "description": "WhatsApp AI bot powered by Claude with long-term memory, browser control, and role-based access",
   "type": "module",
   "main": "dist/index.js",