@dsh-enhanced/assistant-delivery 0.1.67 → 0.1.70

package/lib/service.js

@@ -446,6 +446,23 @@ const ownerRequestedChangeArgumentBytes = 64 * 1024;
 const toolApprovalIdentityBytes = 512;
 /** Bounded owner-ordered linked fallback list for one report route. */
 const maxLinkedReportFallback = 8;
+/**
+ * Host-native tool arguments normalized exactly as Delivery attests them:
+ * JSON.parse then JSON.stringify, preserving key order and rejecting any
+ * non-object payload. Other components must hash this exact text instead of
+ * re-canonicalizing it, otherwise a foreground witness cannot be matched.
+ */
+export function normalizeForegroundToolArguments(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        return JSON.stringify(parsed);
+    }
+    catch {
+        return undefined;
+    }
+}
 function inspectUnsettledNativeCall(events, turn, callId, toolName, argumentsJson, argumentBytes = toolApprovalArgumentBytes) {
     if (!callId || !toolName || Buffer.byteLength(callId) > toolApprovalIdentityBytes
         || Buffer.byteLength(toolName) > toolApprovalIdentityBytes
@@ -474,16 +491,9 @@ function inspectUnsettledNativeCall(events, turn, callId, toolName, argumentsJso
         || events.filter(event => event.type === 'step/start' && event.data.turn === turn
             && event.data.step === call.data.step).length !== 1)
         return undefined;
-    let normalizedArguments;
-    try {
-        const parsed = JSON.parse(call.data.arguments);
-        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
-            return undefined;
-        normalizedArguments = JSON.stringify(parsed);
-    }
-    catch {
+    const normalizedArguments = normalizeForegroundToolArguments(call.data.arguments);
+    if (normalizedArguments === undefined)
         return undefined;
-    }
     const argumentsDigest = createHash('sha256').update(normalizedArguments).digest('hex');
     if (argumentsDigest !== createHash('sha256').update(argumentsJson).digest('hex'))
         return undefined;
@@ -2104,10 +2114,53 @@ export class AssistantDeliveryService extends Service {
             completeExecution: (inboxId, input) => this.completeForegroundTaskExecution(inboxId, input),
             recordExecutionModelSelection: (inboxId, input) => this.deliveryStore.recordForegroundExecutionModelSelection({ inboxId, ...input }),
             claimed: (agent, envelope, turn) => this.capturePreferenceTurn(agent, { kind: 'delivery', channel: envelope.channel, account: envelope.account, eventId: envelope.eventId }, turn),
-            notifications: binding => this.deliveryStore.listOutbox({ bindingId: binding.id, limit: 50 }).filter(record => record.status === 'accepted'
-                // Already-accepted notices stay listed: withdrawal only gates the send attempt.
+            notifications: binding => this.deliveryStore.listOutbox({ bindingId: binding.id, limit: 50 }).filter(record => (record.status === 'accepted' || record.status === 'delivered')
+                // Acknowledged notices stay listed until read; withdrawal only gates the send attempt.
                 && record.intent.metadata?.['dsh.native-notice'] === 'v1' && this.#notificationGuard(record, { withdrawal: false }) === undefined)
-                .map(record => ({ id: record.id, text: record.intent.text, createdAt: record.createdAt })),
+                .map(record => ({ id: record.id, text: record.intent.text, createdAt: record.createdAt,
+                status: record.status === 'delivered' ? 'delivered' : 'accepted' })),
+            acknowledgeNotices: (binding, ids, status) => {
+                // Validate the whole batch against this binding and the exact send-path
+                // guard before writing anything: one foreign/forged/expired id, drifted
+                // owner/binding/route/policy or withdrawn notice rejects the batch with
+                // zero receipts.
+                const byId = new Map(this.deliveryStore.listOutbox({ bindingId: binding.id, limit: 100 }).map(record => [record.id, record]));
+                const targets = ids.map(id => {
+                    const record = byId.get(id);
+                    if (record === undefined || record.intent.metadata?.['dsh.native-notice'] !== 'v1'
+                        || (record.status !== 'accepted' && record.status !== 'delivered' && record.status !== 'read')
+                        || record.providerMessageId === undefined) {
+                        throw new Error('assistant-delivery: native notice acknowledgement is invalid');
+                    }
+                    // Re-run the exact send-path guard: expiry, owner/binding version or
+                    // generation drift, route/policy change and withdrawal all fail closed
+                    // before any receipt is written. withdrawal:true is required so a
+                    // withdrawn notice cannot be acknowledged after it was sent.
+                    const refused = this.#nativeNoticeGuard(record.intent, { withdrawal: true });
+                    if (refused !== undefined)
+                        throw new Error(`assistant-delivery: native notice acknowledgement is ${refused.failureCode}`);
+                    return record;
+                });
+                const rank = { accepted: 1, delivered: 2, read: 3 };
+                for (const record of targets) {
+                    // A late lower-rank ack is a no-op: it must not append a stale receipt
+                    // after read/delivered nor downgrade the outbox state.
+                    if (rank[status] <= rank[record.status])
+                        continue;
+                    try {
+                        this.deliveryStore.recordReceipt({ channel: binding.conversation.channel, account: binding.conversation.account,
+                            providerMessageId: record.providerMessageId, status, occurredAt: Date.now() });
+                    }
+                    catch (error) {
+                        // The web client re-acks every rendered notice. A repeat with a new
+                        // timestamp is an idempotent no-op, not a client error; other
+                        // storage failures still propagate.
+                        if (!(error instanceof DeliveryStoreError) || error.code !== 'idempotency-conflict')
+                            throw error;
+                    }
+                }
+                return Object.freeze({ acknowledged: targets.length });
+            },
         }, config);
         this.nativeWebOwner = access;
         this.nativeWebBound = true;
@@ -2198,6 +2251,55 @@ export class AssistantDeliveryService extends Service {
         return Object.freeze({ protocol: 'assistant-delivery/foreground-tool-input/v1',
             attestation, ...page });
     }
+    /**
+     * The live caller's unique configured owner route. A caller never names a
+     * route here: zero matching routes (anonymous, unconfigured, or failed
+     * revalidation) and more than one matching route (ambiguous owner authority)
+     * both fail closed.
+     */
+    ownerRouteForAgent(agent) {
+        if (!this.active || typeof agent !== 'object' || agent === null || agent.session === undefined)
+            return undefined;
+        let resolved;
+        try {
+            for (const authorityId of this.ownerRoutes.keys()) {
+                if (this.validateOwnerAgentForRoute(agent, authorityId) === undefined)
+                    continue;
+                if (resolved !== undefined)
+                    return undefined;
+                resolved = authorityId;
+            }
+        }
+        catch {
+            return undefined;
+        }
+        return resolved;
+    }
+    /** Host-only proof resolved from the caller Agent's unique live owner route. */
+    inspectOwnerForegroundToolCallForAgent(agent, input) {
+        if (!input || typeof input !== 'object' || Reflect.ownKeys(input).some(key => typeof key !== 'string'
+            || !['callId', 'toolName', 'argumentsJson'].includes(key)))
+            return undefined;
+        const authorityId = this.ownerRouteForAgent(agent);
+        if (authorityId === undefined)
+            return undefined;
+        return this.inspectOwnerForegroundToolCall({ agent, authorityId, callId: input.callId,
+            toolName: input.toolName, argumentsJson: input.argumentsJson });
+    }
+    /** Read-only human-input pages resolved from the caller Agent's unique live
+     * owner route; the caller cannot select an Inbox, route, owner or replacement text. */
+    readOwnerForegroundToolInputForAgent(agent, input) {
+        if (!input || typeof input !== 'object' || Reflect.ownKeys(input).some(key => typeof key !== 'string'
+            || !['callId', 'toolName', 'argumentsJson', 'offset', 'maxBytes'].includes(key)))
+            return undefined;
+        const authorityId = this.ownerRouteForAgent(agent);
+        if (authorityId === undefined)
+            return undefined;
+        return this.readOwnerForegroundToolInput({ agent, authorityId, callId: input.callId,
+            toolName: input.toolName, argumentsJson: input.argumentsJson,
+            ...(input.offset === undefined ? {} : { offset: input.offset }),
+            ...(input.maxBytes === undefined ? {} : { maxBytes: input.maxBytes }) });
+    }
     /** Host-only, read-only source proof for an owner's live memory or wiki tool call. */
     inspectOwnerRequestedChange(execution, input) {
         if (!this.active || !execution || typeof execution !== 'object'
@@ -5268,7 +5370,7 @@ export class AssistantDeliveryService extends Service {
                 throw new AssistantDeliveryError('runtime-conflict', 'invalid notification outcome lookup');
             }
             return Object.freeze({ protocol: NOTIFICATION_OUTCOME_FACTS_PROTOCOL,
-                facts: this.deliveryStore.attentionAudit.outcomeFactsFor([...new Set(input.outboxIds)]), hasMore: false, nextAfterSequence: null });
+                facts: this.notificationOutcomeFacts([...new Set(input.outboxIds)]), hasMore: false, nextAfterSequence: null });
         }
         const afterSequence = input.afterSequence ?? 0;
         const limit = input.limit ?? 100;
@@ -5276,10 +5378,24 @@ export class AssistantDeliveryService extends Service {
             throw new AssistantDeliveryError('runtime-conflict', 'invalid notification outcome scan');
         }
         const page = this.deliveryStore.attentionAudit.list(afterSequence, limit);
-        const facts = this.deliveryStore.attentionAudit.outcomeFactsFor(page.entries.map(entry => entry.outboxId));
+        const facts = this.notificationOutcomeFacts(page.entries.map(entry => entry.outboxId));
         return Object.freeze({ protocol: NOTIFICATION_OUTCOME_FACTS_PROTOCOL, facts, hasMore: page.hasMore,
             nextAfterSequence: page.entries.length === 0 ? null : page.entries.at(-1).sequence });
     }
+    /**
+     * Attach the registered adapter's read-receipt completeness to each fact.
+     * The Delivery store owns transport facts but not adapter capabilities; only
+     * this read boundary can combine them. An undeclared capability stays absent
+     * so older Evaluation classifiers keep their pinned v1 digests.
+     */
+    notificationOutcomeFacts(outboxIds) {
+        return this.deliveryStore.attentionAudit.outcomeFactsFor(outboxIds).map(fact => {
+            const binding = this.deliveryStore.getBinding(fact.bindingId);
+            const readReceipts = binding === undefined ? undefined
+                : this.registry.get(binding.conversation.channel, binding.conversation.account)?.capabilities.readReceipts;
+            return readReceipts === undefined ? fact : Object.freeze({ ...fact, readReceipts });
+        });
+    }
     /**
      * Read-only WP19 stage-2c progress audit page in append order; never exposes
      * progress text. Entries are process-local (`durable: false`), bounded, and