@haaaiawd/second-nature 0.1.30 → 0.1.32

package/index.js

@@ -71,7 +71,7 @@ process.stderr.write("[second-nature] module evaluated\n");
 const INTERNAL_RUNTIME_TRACE_PREFIX = "sn-runtime-";
 const HOST_SAFE_LIMITATION_MESSAGE = "Host-safe plugin package keeps synchronous register/load semantics, but mutating workspace runtime flows remain unavailable here.";
 const SETUP_MARKER_RELATIVE_PATH = path.join(".second-nature", "setup", "agent-inner-guide-ack.json");
-const SETUP_GUIDE_VERSION = "0.1.28";
+const SETUP_GUIDE_VERSION = "0.1.32";
 const SETUP_COMMANDS = new Set(["setup_hint", "setup_ack"]);
 let activationSpine = null;
 /** T1.1.4 — lazily opened full read bridge; closed when workspace root / resolution changes. */
@@ -1200,7 +1200,7 @@ export default {
                     };
                 }
                 const resolved = spine.router.resolve(parsed.command);
-                if (!resolved) {
+                if (!resolved && !isWorkspaceBridgeCommand(parsed.command, parsed.input)) {
                     return {
                         text: JSON.stringify({
                             ok: false,
@@ -1219,7 +1219,7 @@ export default {
             const spine = ensureActivationSpine();
             syncWorkspaceRootFromTool(spine, params.workspaceRoot);
             const resolved = spine.router.resolve(params.command);
-            if (!resolved) {
+            if (!resolved && !isWorkspaceBridgeCommand(params.command, params.args)) {
                 return {
                     content: [
                         {

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "second-nature",
   "name": "Second Nature",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "OpenClaw native plugin with synchronous surface registration and bundled runtime spine. Set SECOND_NATURE_WORKSPACE_ROOT or tool workspaceRoot to the same path as the agent workspace. Agent inner guide is packaged as agent-inner-guide.md. v7 ops surface: self_health, tool_affordance, heartbeat_digest, narrative:diff, timeline, restore, runtime_secret_bootstrap.",
   "activation": {
     "onStartup": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haaaiawd/second-nature",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "OpenClaw native plugin with synchronous registration, a packaged runtime artifact, and operator-facing status/explain flows.",
   "keywords": [
     "openclaw",

package/runtime/cli/commands/connector-status.d.ts

@@ -7,6 +7,7 @@ export interface ConnectorStatusInput {
 export interface ConnectorTestInput {
     platformId: string;
     dryRun?: boolean;
+    workspaceRoot?: string;
 }
 export declare function connectorStatus(registry: DynamicConnectorRegistry | undefined, ledger: ConnectorInventoryLedger | undefined, input?: ConnectorStatusInput): Promise<Record<string, unknown>>;
 export declare function connectorTest(registry: DynamicConnectorRegistry | undefined, input: ConnectorTestInput): Promise<Record<string, unknown>>;

package/runtime/cli/commands/connector-status.js

@@ -97,6 +97,11 @@ export async function connectorTest(registry, input) {
             },
         };
     }
+    // Workspace bridge calls are often process-isolated per tool invocation.
+    // Reload here as well as in connector_status so dry-run tests see the same inventory.
+    if (input.workspaceRoot) {
+        registry.reloadConnectors(input.workspaceRoot);
+    }
     const entry = registry.describeConnector(platformId);
     if (!entry) {
         return {

package/runtime/cli/commands/index.js

@@ -23,6 +23,14 @@ function explainSubjectError(code, message) {
 }
 export function createCliCommands(deps) {
     const { readModels, actionBridge, opsRouter } = deps;
+    const opsCommand = (name, description) => ({
+        name,
+        description,
+        execute: async (input) => {
+            const surface = await Promise.resolve(opsRouter.dispatch(name, input));
+            return surface;
+        },
+    });
     return [
         {
             name: "status",
@@ -268,6 +276,14 @@ export function createCliCommands(deps) {
                 return surface;
             },
         },
+        opsCommand("connector:run", "T-ROS.C.3 — manually execute a connector capability outside heartbeat cadence"),
+        opsCommand("self_health", "T-ROS.C.1 — show v7 self-health snapshot and degraded dimensions"),
+        opsCommand("tool_affordance", "T-ROS.C.1 — show v7 tool affordance map or explicit unavailable state"),
+        opsCommand("heartbeat_digest", "T-ROS.C.1 — assemble v7 heartbeat digest for a day"),
+        opsCommand("narrative:diff", "T-ROS.C.1 — compare two narrative timeline versions"),
+        opsCommand("timeline", "T-ROS.C.1 — query v7 narrative timeline with cursor pagination"),
+        opsCommand("restore", "T-ROS.C.1 — apply bounded restore and write restore audit"),
+        opsCommand("runtime_secret_bootstrap", "T-ROS.C.1 — inspect runtime secret anchor health without exposing plaintext"),
         {
             name: "goal",
             description: "T1.2.4 — owner-governed goal operations: set, list, accept, reject",

package/runtime/cli/index.js

@@ -9,6 +9,15 @@ import { resolvePackagedRuntime } from "./runtime/runtime-artifact-boundary.js";
 import { createRestoreSnapshotStore, } from "../storage/services/restore-snapshot-store.js";
 import { createRuntimeDecisionRecorder, } from "../observability/services/runtime-decision-recorder.js";
 import { createConnectorExecutorAdapter, } from "../connectors/services/connector-executor-adapter.js";
+import { CapabilityContractRegistry } from "../connectors/base/manifest.js";
+import { CapabilityContractRegistryV7 } from "../connectors/base/manifest-v7.js";
+import { moltbookManifest } from "../connectors/social-community/moltbook/manifest.js";
+import { evomapManifest } from "../connectors/agent-network/evomap/manifest.js";
+import { agentWorldManifest } from "../connectors/agent-network/agent-world/manifest.js";
+import { instreetManifest } from "../connectors/social-community/instreet/manifest.js";
+import { createAffordanceAssembler, } from "../core/second-nature/body/tool-affordance/affordance-assembler.js";
+import { createHistoryDigestStore, } from "../storage/services/history-digest-store.js";
+import { probeCredentialHealth, } from "../storage/services/credential-vault.js";
 import { DynamicConnectorRegistry, createRegistrySnapshotStore, } from "../connectors/registry/index.js";
 /** Built-in connector manifests for DynamicConnectorRegistry. */
 const BUILT_IN_CONNECTOR_MANIFESTS = [
@@ -54,6 +63,154 @@ const BUILT_IN_CONNECTOR_MANIFESTS = [
         sourceRefPolicy: { minSourceRefs: 1 },
     },
 ];
+const BUILT_IN_CAPABILITY_MANIFESTS = [
+    moltbookManifest,
+    evomapManifest,
+    agentWorldManifest,
+    instreetManifest,
+];
+function idempotencyClassForCapability(capabilityId) {
+    return capabilityId.includes("read") ||
+        capabilityId.includes("discover") ||
+        capabilityId.includes("list") ||
+        capabilityId.includes("heartbeat")
+        ? "read_only"
+        : "idempotent_write";
+}
+function createCapabilityRegistry() {
+    const registry = new CapabilityContractRegistry();
+    for (const manifest of BUILT_IN_CAPABILITY_MANIFESTS) {
+        registry.register(manifest);
+    }
+    return registry;
+}
+function createAffordanceRegistry(registry, workspaceRoot) {
+    registry.reloadConnectors(workspaceRoot);
+    const v7 = new CapabilityContractRegistryV7();
+    for (const entry of registry.listConnectors()) {
+        v7.register({
+            platformId: entry.platformId,
+            capabilities: entry.capabilities.map((capabilityId) => ({
+                capabilityId,
+                intent: capabilityId,
+                probeConfig: {
+                    safeEndpoint: `connector://${entry.platformId}/${capabilityId}`,
+                    idempotencyClass: idempotencyClassForCapability(capabilityId),
+                },
+            })),
+            channelPriority: ["api_rest"],
+            credentialTypes: ["api_key"],
+            sourceRefPolicy: { minSourceRefs: 1 },
+        });
+    }
+    return v7;
+}
+function createWorkspaceAffordanceAssembler(registry, workspaceRoot) {
+    return createAffordanceAssembler({
+        registry: createAffordanceRegistry(registry, workspaceRoot),
+        probeReader: {
+            getLatestProbeResult() {
+                return undefined;
+            },
+        },
+        credentialRequired: () => false,
+    });
+}
+function stringifyDeltaField(delta, key) {
+    const value = delta[key];
+    if (value === undefined || value === null)
+        return undefined;
+    return typeof value === "string" ? value : JSON.stringify(value);
+}
+function asStringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string")
+        : [];
+}
+function createNarrativeTimelineDeps(stateDb) {
+    const historyStore = createHistoryDigestStore(stateDb);
+    return {
+        stateMemoryPort: {
+            async listNarrativeTimeline(from, to, opts) {
+                const rows = await historyStore.listNarrativeTimeline({
+                    limit: Math.max(opts?.limit ?? 100, 100),
+                });
+                return rows
+                    .filter((row) => row.createdAt >= from && row.createdAt <= to)
+                    .filter((row) => opts?.afterTimestamp ? row.createdAt > opts.afterTimestamp : true)
+                    .sort((a, b) => a.createdAt.localeCompare(b.createdAt))
+                    .slice(0, opts?.limit ?? rows.length)
+                    .map((row) => ({
+                    version: row.timelineId,
+                    createdAt: row.createdAt,
+                    triggerKind: row.entryType === "restore.applied" ||
+                        row.entryType === "goal.transition" ||
+                        row.entryType === "dream.projection" ||
+                        row.entryType === "owner.override"
+                        ? row.entryType
+                        : "heartbeat.decision",
+                    sourceRefs: asStringArray(row.delta.sourceRefs),
+                    reasonCode: stringifyDeltaField(row.delta, "reasonCode"),
+                    summaryText: stringifyDeltaField(row.delta, "summaryText") ??
+                        `${row.entryType}:${row.subjectId}`,
+                }));
+            },
+            async getNarrativeSnapshot(version) {
+                const rows = await historyStore.listNarrativeTimeline({ limit: 500 });
+                const row = rows.find((candidate) => candidate.timelineId === version || candidate.subjectId === version);
+                if (!row)
+                    return null;
+                const delta = row.delta;
+                return {
+                    version,
+                    focus: delta.focus,
+                    progress: delta.progress,
+                    nextIntent: delta.nextIntent,
+                    toneSignal: delta.toneSignal,
+                    acceptedGoalId: delta.acceptedGoalId,
+                    sourceRefs: asStringArray(delta.sourceRefs),
+                    lastChangeReasonCode: stringifyDeltaField(delta, "reasonCode"),
+                };
+            },
+        },
+    };
+}
+function createSecretAnchorDeps(stateDb) {
+    return {
+        runtimeOpsPort: {
+            getEncryptionKeyPath: () => "SECOND_NATURE_ENCRYPTION_KEY",
+            checkKeyPathExists: async () => {
+                const key = process.env.SECOND_NATURE_ENCRYPTION_KEY?.trim();
+                return Boolean(key && key.length >= 32);
+            },
+        },
+        credentialPort: {
+            verifySampleDecrypt: async () => {
+                const result = stateDb.sqlite.exec(`SELECT platform_id, encrypted_value
+           FROM credential_records
+           WHERE encrypted_value IS NOT NULL AND encrypted_value != ''
+           LIMIT 3`);
+                if (result.length === 0 || result[0].values.length === 0) {
+                    return { status: "ok", checkedIds: [] };
+                }
+                const checkedIds = [];
+                for (const row of result[0].values) {
+                    const platformId = String(row[0] ?? "unknown");
+                    const encryptedValue = typeof row[1] === "string" ? row[1] : "";
+                    checkedIds.push(platformId);
+                    const probe = probeCredentialHealth(platformId, encryptedValue, undefined);
+                    if (probe.keyHealth === "wrong_key") {
+                        return { status: "wrong_key", checkedIds };
+                    }
+                    if (probe.keyHealth !== "ok") {
+                        return { status: "error", checkedIds };
+                    }
+                }
+                return { status: "ok", checkedIds };
+            },
+        },
+    };
+}
 export function createCliRuntimeDeps(overrides = {}) {
     const workspaceRoot = overrides.workspaceRoot ?? process.cwd();
     const stateDb = overrides.stateDb ?? createStateDatabase();
@@ -79,6 +236,11 @@ export function createCliRuntimeDeps(overrides = {}) {
             builtInManifests: BUILT_IN_CONNECTOR_MANIFESTS,
             snapshotStore: createRegistrySnapshotStore(),
         });
+    const capabilityRegistry = overrides.capabilityRegistry ?? createCapabilityRegistry();
+    const affordanceAssembler = overrides.affordanceAssembler ??
+        createWorkspaceAffordanceAssembler(registry, workspaceRoot);
+    const narrativeTimelineDeps = overrides.narrativeTimelineDeps ?? createNarrativeTimelineDeps(stateDb);
+    const secretAnchorDeps = overrides.secretAnchorDeps ?? createSecretAnchorDeps(stateDb);
     const restoreSnapshotStore = overrides.restoreSnapshotStore ?? createRestoreSnapshotStore(stateDb);
     return {
         stateDb,
@@ -88,7 +250,11 @@ export function createCliRuntimeDeps(overrides = {}) {
         actionBridge,
         runtimeRecorder,
         connectorExecutor,
+        capabilityRegistry,
         registry,
+        affordanceAssembler,
+        narrativeTimelineDeps,
+        secretAnchorDeps,
         restoreSnapshotStore,
     };
 }
@@ -104,7 +270,11 @@ export function createCommandRouter(options = {}) {
         workspaceRoot,
         observabilityDb: runtime.observabilityDb,
         connectorExecutor: runtime.connectorExecutor,
+        connectorRegistry: runtime.capabilityRegistry,
         registry: runtime.registry,
+        toolAffordancePort: runtime.affordanceAssembler,
+        narrativeTimelineDeps: runtime.narrativeTimelineDeps,
+        secretAnchorDeps: runtime.secretAnchorDeps,
         restoreSnapshotStore: runtime.restoreSnapshotStore,
     });
     const commands = createCliCommands({

package/runtime/cli/ops/heartbeat-surface.d.ts

@@ -10,6 +10,7 @@ import type { CliReadModels } from "../read-models/index.js";
 import type { RuntimeDecisionRecorder } from "../../observability/services/runtime-decision-recorder.js";
 import type { StateDatabase } from "../../storage/db/index.js";
 import type { ConnectorExecutor } from "../../core/second-nature/orchestrator/effect-dispatcher.js";
+import type { CapabilityContractRegistry } from "../../connectors/base/manifest.js";
 export type HeartbeatSurfaceStatus = "heartbeat_ok" | "intent_selected" | "denied" | "deferred" | "runtime_carrier_only" | "delivery_unavailable";
 export interface HeartbeatSurfaceResult {
     ok: boolean;
@@ -47,5 +48,7 @@ export interface HeartbeatCheckInput {
      * connector-system instead of returning connector_dispatch_unwired.
      */
     connectorExecutor?: ConnectorExecutor;
+    /** Capability registry used by planner to avoid platform/capability protocol mismatches. */
+    connectorRegistry?: CapabilityContractRegistry;
 }
 export declare function heartbeatCheck(input: HeartbeatCheckInput): Promise<HeartbeatSurfaceResult>;

package/runtime/cli/ops/heartbeat-surface.js

@@ -74,6 +74,7 @@ export async function heartbeatCheck(input) {
         state: input.state,
         workspaceRoot: input.workspaceRoot ?? process.cwd(),
         connectorExecutor: input.connectorExecutor,
+        connectorRegistry: input.connectorRegistry,
     });
     const cycle = await run(signal);
     return mapCycleToSurface(cycle, "workspace_full_runtime");

package/runtime/cli/ops/ops-router.d.ts

@@ -10,6 +10,8 @@ import { type NarrativeTimelineDeps } from "../../observability/services/narrati
 import { type SecretAnchorDeps } from "../../observability/services/runtime-secret-anchor-view.js";
 import { AppendOnlyAuditStore } from "../../observability/audit/append-only-audit-store.js";
 import type { RestoreSnapshotStore } from "../../storage/services/restore-snapshot-store.js";
+import type { CapabilityContractRegistry } from "../../connectors/base/manifest.js";
+import type { AffordanceAssembler } from "../../core/second-nature/body/tool-affordance/affordance-assembler.js";
 /** Unified response envelope for all v7 runtime-ops commands. */
 export interface RuntimeOpsEnvelope<T = unknown> {
     ok: boolean;
@@ -49,6 +51,8 @@ export interface OpsRouterDeps {
      * connector-system instead of returning connector_dispatch_unwired.
      */
     connectorExecutor?: ConnectorExecutor;
+    /** Capability registry used by heartbeat planner to avoid platform/capability mismatches. */
+    connectorRegistry?: CapabilityContractRegistry;
     /**
      * T1.2.3: DynamicConnectorRegistry for connector:status and connector:test commands.
      */
@@ -67,6 +71,8 @@ export interface OpsRouterDeps {
      * Deps for narrative timeline (narrative:diff, timeline commands).
      */
     narrativeTimelineDeps?: NarrativeTimelineDeps;
+    /** Port for tool_affordance command. */
+    toolAffordancePort?: AffordanceAssembler;
     /**
      * Deps for runtime_secret_bootstrap (key anchor health check).
      */

package/runtime/cli/ops/ops-router.js

@@ -63,6 +63,8 @@ export function createOpsRouter(deps) {
             state: input.state ?? deps.state,
             workspaceRoot: input.workspaceRoot ?? deps.workspaceRoot,
             connectorExecutor: input.connectorExecutor ?? deps.connectorExecutor,
+            connectorRegistry: input
+                ?.connectorRegistry ?? deps.connectorRegistry,
         }),
         async dispatch(command, input) {
             if (command === "heartbeat_check") {
@@ -91,6 +93,8 @@ export function createOpsRouter(deps) {
                     scopeHint: input?.scopeHint,
                     connectorExecutor: input
                         ?.connectorExecutor ?? deps.connectorExecutor,
+                    connectorRegistry: input
+                        ?.connectorRegistry ?? deps.connectorRegistry,
                 });
             }
             if (command === "fallback") {
@@ -249,6 +253,9 @@ export function createOpsRouter(deps) {
                 const result = await connectorTest(deps.registry, {
                     platformId: typeof input?.platformId === "string" ? input.platformId : "",
                     dryRun: isWet ? false : (input?.dryRun === false ? false : true),
+                    workspaceRoot: typeof input?.workspaceRoot === "string"
+                        ? input.workspaceRoot
+                        : deps.workspaceRoot,
                 });
                 if (isWet && result.ok) {
                     // Annotate result with manual trigger context (DR-038 / T-ROS.C.3)
@@ -428,6 +435,38 @@ export function createOpsRouter(deps) {
              */
             if (command === "tool_affordance") {
                 const generatedAt = new Date().toISOString();
+                if (deps.toolAffordancePort) {
+                    const allStatuses = [
+                        "safe",
+                        "exploratory",
+                        "needs_auth",
+                        "painful",
+                        "unavailable",
+                    ];
+                    const platformIds = Array.isArray(input?.platformIds)
+                        ? input.platformIds.filter((item) => typeof item === "string")
+                        : typeof input?.platformId === "string"
+                            ? [input.platformId]
+                            : undefined;
+                    const data = await deps.toolAffordancePort.assembleAffordanceMap({
+                        platformIds,
+                        allowedStatuses: allStatuses,
+                        goalKind: typeof input?.goalKind === "string" ? input.goalKind : undefined,
+                    });
+                    const envelope = {
+                        ok: true,
+                        command: "tool_affordance",
+                        runtimeMode: "workspace_full_runtime",
+                        surfaceMode: "cli",
+                        generatedAt,
+                        data,
+                        warnings: [],
+                        sourceRefs: [
+                            "core/second-nature/body/tool-affordance/affordance-assembler.ts",
+                        ],
+                    };
+                    return envelope;
+                }
                 const envelope = {
                     ok: false,
                     command: "tool_affordance",

package/runtime/core/second-nature/orchestrator/intent-planner.js

@@ -79,6 +79,9 @@ export function planIntentWithKind(kind, basePriority, runtime, context, registr
         return [];
     const config = INTENT_CONFIGS[kind];
     const platformId = resolvePlatformForIntent(kind, context ?? {}, registry);
+    if (kind === "work" && !options?.multiSource && !platformId) {
+        return [];
+    }
     let priority = basePriority;
     // Social budget exhaustion → cap priority.
     if (kind === "social" &&

package/runtime/core/second-nature/orchestrator/platform-capability-router.js

@@ -14,7 +14,19 @@ function getPlatformIds(registry) {
         return registry.listRegisteredPlatformIds();
     }
     // Fallback: built-in platforms when registry is absent (backward compat)
-    return ["moltbook", "instreet", "evomap"];
+    return ["moltbook", "instreet", "evomap", "agent-world"];
+}
+const FALLBACK_PLATFORM_CAPABILITIES = {
+    "moltbook": ["feed.read", "post.publish", "comment.reply", "message.send"],
+    "instreet": ["notification.list", "message.send", "comment.reply", "agent.heartbeat"],
+    "evomap": ["agent.register", "agent.heartbeat", "work.discover", "task.claim"],
+    "agent-world": ["feed.read", "work.discover", "task.claim"],
+};
+function fallbackPlatformSupportsCapability(platformId, kind) {
+    const capability = kindToCapability(kind);
+    if (!capability)
+        return false;
+    return (FALLBACK_PLATFORM_CAPABILITIES[platformId] ?? []).includes(capability);
 }
 function extractPlatformIdsFromGoals(goals, kind, platformIds) {
     const capability = kindToCapability(kind);
@@ -110,6 +122,10 @@ export function resolvePlatformForIntent(kind, context, registry) {
         // Registry says unsupported → undefined (guard layer will deny)
         return undefined;
     }
-    // No registry: best-effort return the single candidate (backward compat)
+    // No registry: keep legacy platform-name fallback, but do not invent an
+    // unsupported platform/capability pair that later fails as protocol_mismatch.
+    if (!fallbackPlatformSupportsCapability(single, kind)) {
+        return undefined;
+    }
     return single;
 }

package/workspace-ops-bridge.js

@@ -23,7 +23,19 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 export async function openWorkspaceOpsBridge(workspaceRoot) {
-    const resolvedRoot = path.resolve(workspaceRoot);
+    const declaredRoot = typeof workspaceRoot === "string" ? workspaceRoot.trim() : "";
+    if (!declaredRoot) {
+        return {
+            ok: false,
+            error: {
+                code: "WORKSPACE_ROOT_REQUIRED",
+                message: "openWorkspaceOpsBridge requires a workspaceRoot path. Set SECOND_NATURE_WORKSPACE_ROOT or pass tool workspaceRoot.",
+                nextStep: "reinvoke_with_workspaceRoot_or_set_SECOND_NATURE_WORKSPACE_ROOT",
+                requiredUserInput: ["workspaceRoot"],
+            },
+        };
+    }
+    const resolvedRoot = path.resolve(declaredRoot);
     try {
         const pluginPackageRoot = path.dirname(fileURLToPath(import.meta.url));
         // Packaged `plugin/runtime` is emitted JS without sibling `.d.ts` in this repo layout.
@@ -59,9 +71,13 @@ export async function openWorkspaceOpsBridge(workspaceRoot) {
             state: stateDb,
             workspaceRoot: resolvedRoot,
             connectorExecutor: deps.connectorExecutor,
+            connectorRegistry: deps.capabilityRegistry,
             registry: deps.registry,
+            toolAffordancePort: deps.affordanceAssembler,
             // v7 (T-ROS.C.2): in-memory audit store for heartbeat_digest / restore / self_health
             auditStore,
+            narrativeTimelineDeps: deps.narrativeTimelineDeps,
+            secretAnchorDeps: deps.secretAnchorDeps,
             restoreSnapshotStore: deps.restoreSnapshotStore,
         });
         const commands = commandsMod.createCliCommands({