@contextableai/openclaw-memory-rebac 0.3.1 → 0.3.3

package/README.md

@@ -168,7 +168,10 @@ When enabled (default: `true`), the plugin captures the last N messages from eac
 The SpiceDB schema defines four object types:
 
 ```
-definition person {}
+definition person {
+    relation agent: agent
+    permission represents = agent
+}
 
 definition agent {
     relation owner: person
@@ -186,7 +189,8 @@ definition memory_fragment {
     relation involves: person | agent
     relation shared_by: person | agent
 
-    permission view = involves + shared_by + source_group->access
+    // involves->represents: if a person is involved, their agent can also view
+    permission view = involves + shared_by + source_group->access + involves->represents
     permission delete = shared_by
 }
 ```

package/dist/cli.js

@@ -70,31 +70,42 @@ export function registerCommands(cmd, ctx) {
                 limit: parseInt(opts.limit),
             })
             : [];
-        // Owner-aware recall: if agent, resolve owner and find involves fragments
-        let ownerResults = [];
-        if (subject.type === "agent" && backend.getFragmentsByIds) {
+        // Fragment-based recall via involves/view permission
+        let fragmentResults = [];
+        if (backend.getFragmentsByIds) {
             try {
-                const ownerId = await lookupAgentOwner(spicedb, subject.id, token);
-                if (ownerId) {
-                    const ownerSubject = { type: "person", id: ownerId };
-                    const viewableIds = await lookupViewableFragments(spicedb, ownerSubject, token);
+                // Determine the person to search as
+                let personSubject;
+                if (subject.type === "person") {
+                    // Direct person search — look up fragments they can view
+                    personSubject = subject;
+                }
+                else if (subject.type === "agent") {
+                    // Agent search — resolve owner identity first
+                    const ownerId = await lookupAgentOwner(spicedb, subject.id, token);
+                    if (ownerId) {
+                        personSubject = { type: "person", id: ownerId };
+                    }
+                }
+                if (personSubject) {
+                    const viewableIds = await lookupViewableFragments(spicedb, personSubject, token);
                     if (viewableIds.length > 0) {
                         const groupResultIds = new Set(groupResults.map((r) => r.uuid));
                         const newIds = viewableIds.filter((id) => !groupResultIds.has(id));
                         if (newIds.length > 0) {
-                            ownerResults = await backend.getFragmentsByIds(newIds);
+                            fragmentResults = await backend.getFragmentsByIds(newIds);
                         }
                     }
-                    if (ownerResults.length > 0) {
-                        console.log(`  + ${ownerResults.length} result(s) via owner identity (person:${ownerId})`);
+                    if (fragmentResults.length > 0) {
+                        console.log(`  + ${fragmentResults.length} result(s) via involves (${personSubject.type}:${personSubject.id})`);
                     }
                 }
             }
             catch {
-                // Owner lookup failed — proceed with group results only
+                // Fragment lookup failed — proceed with group results only
             }
         }
-        const allResults = [...groupResults, ...ownerResults];
+        const allResults = [...groupResults, ...fragmentResults];
         if (allResults.length === 0) {
             console.log("No results found.");
             return;
@@ -552,14 +563,23 @@ export function registerCommands(cmd, ctx) {
         .argument("<person-id>", "Owner person ID")
         .action(async (agentId, personId) => {
         try {
-            await spicedb.writeRelationships([{
+            await spicedb.writeRelationships([
+                {
                     resourceType: "agent",
                     resourceId: agentId,
                     relation: "owner",
                     subjectType: "person",
                     subjectId: personId,
-                }]);
-            console.log(`Linked agent:${agentId} → person:${personId}`);
+                },
+                {
+                    resourceType: "person",
+                    resourceId: personId,
+                    relation: "agent",
+                    subjectType: "agent",
+                    subjectId: agentId,
+                },
+            ]);
+            console.log(`Linked agent:${agentId} ↔ person:${personId}`);
         }
         catch (err) {
             console.error(`Failed to write identity link: ${err instanceof Error ? err.message : String(err)}`);
@@ -579,14 +599,23 @@ export function registerCommands(cmd, ctx) {
                 console.log(`No owner link found for agent:${agentId}`);
                 return;
             }
-            await spicedb.deleteRelationships([{
+            await spicedb.deleteRelationships([
+                {
                     resourceType: "agent",
                     resourceId: agentId,
                     relation: "owner",
                     subjectType: "person",
                     subjectId: ownerId,
-                }]);
-            console.log(`Unlinked agent:${agentId} (was → person:${ownerId})`);
+                },
+                {
+                    resourceType: "person",
+                    resourceId: ownerId,
+                    relation: "agent",
+                    subjectType: "agent",
+                    subjectId: agentId,
+                },
+            ]);
+            console.log(`Unlinked agent:${agentId} (was ↔ person:${ownerId})`);
         }
         catch (err) {
             console.error(`Failed to remove identity link: ${err instanceof Error ? err.message : String(err)}`);

package/dist/index.js

@@ -686,16 +686,25 @@ const rebacMemoryPlugin = {
                     // Write agent → owner relationships from identities config
                     for (const [agentId, personId] of Object.entries(cfg.identities)) {
                         try {
-                            const token = await spicedb.writeRelationships([{
+                            const token = await spicedb.writeRelationships([
+                                {
                                     resourceType: "agent",
                                     resourceId: agentId,
                                     relation: "owner",
                                     subjectType: "person",
                                     subjectId: personId,
-                                }]);
+                                },
+                                {
+                                    resourceType: "person",
+                                    resourceId: personId,
+                                    relation: "agent",
+                                    subjectType: "agent",
+                                    subjectId: agentId,
+                                },
+                            ]);
                             if (token)
                                 defaultState.lastWriteToken = token;
-                            api.logger.info(`openclaw-memory-rebac: linked agent:${agentId} → person:${personId}`);
+                            api.logger.info(`openclaw-memory-rebac: linked agent:${agentId} ↔ person:${personId}`);
                         }
                         catch (err) {
                             api.logger.warn(`openclaw-memory-rebac: failed to write owner for agent:${agentId}: ${err}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contextableai/openclaw-memory-rebac",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "OpenClaw two-layer memory plugin: SpiceDB ReBAC authorization + Graphiti knowledge graph",
   "type": "module",
   "license": "MIT",

package/schema.zed

@@ -1,4 +1,7 @@
-definition person {}
+definition person {
+    relation agent: agent
+    permission represents = agent
+}
 
 definition agent {
     relation owner: person
@@ -16,8 +19,9 @@ definition memory_fragment {
     relation involves: person | agent
     relation shared_by: person | agent
 
-    // Can view if: directly involved, shared it, or have access to the source group
-    permission view = involves + shared_by + source_group->access
+    // Can view if: directly involved, shared it, have access to the source group,
+    // or are an agent whose owner is involved (involves->agent traversal)
+    permission view = involves + shared_by + source_group->access + involves->represents
     // Can delete if: you shared it (owner-level control)
     permission delete = shared_by
 }