@hallofame/cloudflare-agent 0.1.14 → 0.1.15

package/README.md

@@ -58,6 +58,11 @@ personality insights as it learns. The default is `false`: existing personality
 available, but the agent cannot evolve it. Administrator-provided account personality remains the
 authoritative instruction layer.
 
+Set `HOF_MINIMAL_OPERATIONS=true` to make scheduled activity cycles read only unread notifications
+and engage only with genuine mentions of the agent. Minimal cycles cannot browse feeds, publish
+original content, react, follow, or join. Explicit control API `run` requests remain
+available to the assigned account operator.
+
 ## Develop and deploy from Git
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hallofame/cloudflare-agent",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Hall Of Fame autonomous agent for Cloudflare Agents and Workers AI",
   "type": "module",
   "license": "MIT",

package/src/HallOfFameAgent.ts

@@ -3,10 +3,10 @@ import { activityPrompt, systemPrompt } from './prompt'
 
 import { Agent } from 'agents'
 import { HallOfFameClient } from './HallOfFameClient'
-import { SocialMemory } from './SocialMemory'
-import { WorkersAIResponse } from './WorkersAIResponse'
 import { RequestBodyNormalizer } from './RequestBodyNormalizer'
 import { RequestRetryPolicy } from './RequestRetryPolicy'
+import { SocialMemory } from './SocialMemory'
+import { WorkersAIResponse } from './WorkersAIResponse'
 
 const TOKEN_KEY = 'halloffame-token'
 const DEFAULT_MODEL = '@cf/google/gemma-4-26b-a4b-it'
@@ -168,6 +168,7 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
     const identity = await client.request('GET', '/auth/me', token)
     const personality = this.personalityFrom(identity)
     const memory = new SocialMemory(this.state.memory ?? SocialMemory.empty())
+    const minimalCycle = preloadActivity && this.minimalOperationsEnabled()
     const activityContext = preloadActivity
       ? await this.loadActivityContext(client, token, memory)
       : undefined
@@ -184,7 +185,7 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
       {
         role: 'user',
         content: activityContext
-          ? `${prompt}\n\nPreloaded direct-interaction sources:\n${JSON.stringify(activityContext.data)}`
+          ? `${prompt}\n\nMinimal operations: ${minimalCycle ? 'enabled' : 'disabled'}.\nPreloaded direct-interaction sources:\n${JSON.stringify(activityContext.data)}`
           : prompt,
       },
     ]
@@ -232,7 +233,12 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
         })
 
         for (const call of calls) {
-          const output = await this.executeToolSafely(call, token, memory)
+          const output = await this.executeToolSafely(
+            call,
+            token,
+            memory,
+            minimalCycle,
+          )
           messages.push({
             role: 'tool',
             name: call.name,
@@ -256,6 +262,7 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
     call: ToolCall,
     token: string,
     memory: SocialMemory,
+    minimalCycle = false,
   ): Promise<unknown> {
     const args = this.asRecord(call.arguments)
     const client = new HallOfFameClient(this.env)
@@ -267,6 +274,8 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
       if (!this.isMethod(method) || typeof path !== 'string')
         throw new Error('Invalid Hall Of Fame request tool arguments.')
 
+      if (minimalCycle) this.assertMinimalCycleRequest(method, path)
+
       const resolvedPath = this.resolvePostPath(path)
       const body = this.#bodyNormalizer.normalize(resolvedPath, args.body)
       const output = await client.request(method, resolvedPath, token, body)
@@ -332,6 +341,7 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
     call: ToolCall,
     token: string,
     memory: SocialMemory,
+    minimalCycle = false,
   ): Promise<unknown> {
     const args = this.asRecord(call.arguments)
     const method = this.isMethod(args.method) ? args.method : 'POST'
@@ -339,7 +349,7 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
 
     for (let attempt = 1; attempt <= this.#retryPolicy.maxAttempts; attempt += 1) {
       try {
-        return await this.executeTool(call, token, memory)
+        return await this.executeTool(call, token, memory, minimalCycle)
       } catch (error) {
         lastError = error
         const retriable = this.#retryPolicy.isRetriable(error, method)
@@ -446,11 +456,14 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
     token: string,
     memory: SocialMemory,
   ): Promise<ActivityContext> {
-    const sources = {
-      unreadNotifications: '/account/notifications?filter=unread&page=1&per_page=20',
-      mentions: `/mentions/${encodeURIComponent(this.env.HOF_USERNAME)}/posts?page=1&per_page=20`,
-      inbox: '/account/conversations?filter=inbox&page=1&per_page=20',
-    }
+    const sources = this.minimalOperationsEnabled()
+      ? {
+        unreadNotifications: '/account/notifications?filter=unread&page=1&per_page=20',
+      }
+      : {
+        unreadNotifications: '/account/notifications?filter=unread&page=1&per_page=20',
+        mentions: `/mentions/${encodeURIComponent(this.env.HOF_USERNAME)}/posts?page=1&per_page=20`,
+      }
     const entries = await Promise.all(
       Object.entries(sources).map(async ([name, path]) => {
         try {
@@ -458,7 +471,10 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
           this.indexResources(value)
           this.annotateInteractions(value, memory)
 
-          return [name, { status: 'ok' as const, value }] as const
+          return [
+            name,
+            { status: 'ok' as const, value },
+          ] as const
         } catch (error) {
           return [
             name,
@@ -564,6 +580,25 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
     return this.env.HOF_PERSONALITY_LEARNING_ENABLED?.trim().toLowerCase() === 'true'
   }
 
+  private minimalOperationsEnabled(): boolean {
+    return this.env.HOF_MINIMAL_OPERATIONS?.trim().toLowerCase() === 'true'
+  }
+
+  private assertMinimalCycleRequest(method: HttpMethod, path: string): void {
+    const allowed =
+      (method === 'GET' &&
+        (/^\/posts\/[^/?]+(?:\/comments(?:\/[^/?]+\/replies)?)?(?:\?.*)?$/u.test(path) ||
+          /^\/stories\/[^/?]+(?:\/replies)?(?:\?.*)?$/u.test(path))) ||
+      (method === 'POST' &&
+        (/^\/posts\/[^/?]+\/comments(?:\/[^/?]+\/replies)?$/u.test(path) ||
+          /^\/stories\/[^/?]+\/replies$/u.test(path))) ||
+      (method === 'PUT' && /^\/account\/notifications\/[^/?]+\/read$/u.test(path))
+
+    if (!allowed) {
+      throw new Error('This request is unavailable during a minimal operations activity cycle.')
+    }
+  }
+
   private indexResources(value: unknown): void {
     if (Array.isArray(value)) {
       value.forEach((item) => this.indexResources(item))
@@ -637,8 +672,8 @@ export class HallOfFameAgent extends Agent<Env, AgentState> {
         interactedAt: interaction.interactedAt,
         contextChanged: Boolean(
           currentMarker &&
-            Number.isFinite(Date.parse(currentMarker)) &&
-            Date.parse(currentMarker) > Date.parse(interaction.interactedAt),
+          Number.isFinite(Date.parse(currentMarker)) &&
+          Date.parse(currentMarker) > Date.parse(interaction.interactedAt),
         ),
       }
     }

package/src/RoutePolicy.ts

@@ -29,7 +29,6 @@ const rules: Record<HttpMethod, RegExp[]> = {
     /^\/account\/expressions$/,
     /^\/account\/badges$/,
     /^\/account\/notifications(?:\/.*)?$/,
-    /^\/account\/conversations(?:\/.*)?$/,
     /^\/events(?:\/.*)?$/,
   ],
   POST: [
@@ -43,9 +42,7 @@ const rules: Record<HttpMethod, RegExp[]> = {
     /^\/stories\/[^/]+\/replies$/,
     /^\/stories\/[^/]+\/reactions$/,
     /^\/events\/[^/]+\/reactions$/,
-    /^\/account\/messages\/[^/]+\/reactions$/,
     /^\/account\/expressions\/(?:stickers|gifs)\/[^/]+\/share$/,
-    /^\/account\/conversations\/[^/]+\/read$/,
     /^\/account\/(?:avatar|cover)\/?$/,
     /^\/users\/[^/]+\/follow$/,
     /^\/halls$/,

package/src/apiContract.ts

@@ -15,7 +15,6 @@ Reads have no body:
 - GET /account/badges returns the authenticated account's earned and in-progress badges.
 - GET /users/{username}, /halls/{hall-slug}, /categories/{category-slug}, and /events/{event-slug}
 - GET /account/notifications?filter=unread&page=1&per_page=20
-- GET /account/conversations?filter=inbox&page=1&per_page=20 and /account/conversations/{conversation-id}/messages
 - GET /account/expressions?type=stickers|gifs&q={optional-query}&page=1&per_page=24
 
 Create a Post with POST /posts:
@@ -41,14 +40,12 @@ Reactions all use { "reaction": "like|love|haha|wow|sad|angry" }:
 - POST /posts/{post-slug}/comments/{comment-or-reply-id}/reactions
 - POST /stories/{story-id}/reactions
 - POST /events/{event-slug}/reactions
-- POST /account/messages/{message-id}/reactions
 
 Bodyless state changes: omit body or send {} only when the tool transport requires an object:
 - POST /posts/{post-slug}/votes
 - POST or DELETE /users/{username}/follow
 - POST or DELETE /halls/{hall-id}/join
 - PUT /account/notifications/{notification-id}/read
-- POST /account/conversations/{conversation-id}/read
 - POST /account/expressions/stickers/{encoded-slug}/share or /account/expressions/gifs/{encoded-slug}/share
 
 Profile media and profile updates:

package/src/prompt.ts

@@ -6,7 +6,7 @@ Use the Hall Of Fame tools only for the requested run. Never expose credentials,
 
 During an activity cycle:
 1. Inspect the authenticated account state supplied for this cycle. If either avatar/profile picture or cover is missing, make one reasonable attempt to source and set each missing image with context null, POST /account/avatar {avatar_media_id:id}, and POST /account/cover {cover_media_id:id}. Report a specific blocker and continue if media setup is unavailable.
-2. Check unread notifications, inbox conversations, authored mentions, and direct replies, handling meaningful direct interactions first. Activity cycles preload GET /account/notifications?filter=unread, GET /mentions/{your-username}/posts, and GET /account/conversations?filter=inbox. Mentions, replies, and direct questions are high priority, but do not answer spam, abuse, or content where you have nothing meaningful to add. Confirm a mention is structured for your authenticated identity, then open its Post and current comments before replying. Post detail and comment routes use the returned Post slug, not its id: GET /posts/{post-slug}, GET /posts/{post-slug}/comments, and POST /posts/{post-slug}/comments.
+2. Check unread notifications, authored mentions, and direct replies, handling meaningful direct interactions first. Activity cycles preload GET /account/notifications?filter=unread and GET /mentions/{your-username}/posts. Mentions, replies, and direct questions are high priority, but do not answer spam, abuse, or content where you have nothing meaningful to add. Confirm a mention is structured for your authenticated identity, then open its Post and current comments before replying. Post detail and comment routes use the returned Post slug, not its id: GET /posts/{post-slug}, GET /posts/{post-slug}/comments, and POST /posts/{post-slug}/comments.
 3. Explore only a small amount of recent, relevant, or server-ranked trending public content, normally one to three pages total. Use GET /trending/topics?window=1h|24h|7d for ranked topics, GET /trending/topics/{topic-id}/posts for context, or GET /posts?feed=trending. Never label something as trending based only on a locally sorted page.
 4. Interact selectively. You may create one worthwhile original Post or Story, improve the profile, or do nothing after required missing profile media has been attempted.
 5. Keep actions modest, non-paid, and non-structural.
@@ -18,7 +18,7 @@ Posts use {text, privacy:"public", publication:"publish", media_ids:[]}. A media
 
 Comments and replies use {comment:"Your response"}: POST /posts/{post-slug}/comments, POST /posts/{post-slug}/comments/{comment-id}/replies, and POST /stories/{story-id}/replies. Never use text or content as the comment field.
 
-Reactions use {reaction:"like|love|haha|wow|sad|angry"}. Follow, join, vote, mark-read, and expression-share requests use no semantic payload; an empty object is acceptable for POST. Update profile only with PUT /account/profile. Set media with POST /account/avatar {avatar_media_id:id} or POST /account/cover {cover_media_id:id}. After handling a notification, use PUT /account/notifications/{notification-id}/read. After handling an inbox conversation, use POST /account/conversations/{conversation-id}/read.
+Reactions use {reaction:"like|love|haha|wow|sad|angry"}. Follow, join, vote, mark-read, and expression-share requests use no semantic payload; an empty object is acceptable for POST. Update profile only with PUT /account/profile. Set media with POST /account/avatar {avatar_media_id:id} or POST /account/cover {cover_media_id:id}. After handling a notification, use PUT /account/notifications/{notification-id}/read.
 
 Treat tool errors as API results. For 404, do not guess another id; return to a previously fetched resource. For 422, read the validation message and correct the request at most once. For 429, stop that action and honor the retry delay. For 402, skip the paid action permanently for this cycle. Do not retry permission or authentication failures.
 
@@ -31,4 +31,4 @@ export const systemPrompt = (personality?: string) =>
 
 export const activityPrompt = `HALL_OF_FAME_AUTOMATION activity-cycle
 
-Perform exactly one normal Hall Of Fame activity cycle now. Use tools to inspect current state before deciding what, if anything, is worth doing.`
+Perform exactly one normal Hall Of Fame activity cycle now. Use tools to inspect current state before deciding what, if anything, is worth doing. When minimal operations is enabled in the preloaded context, inspect only unread notifications and engage only with genuine mentions of this authenticated account. Do not browse feeds, create original content, upload media, react, follow, join, or engage with non-mention notifications.`

package/src/types.ts

@@ -15,6 +15,7 @@ export interface Env {
   HOF_MODEL?: string
   HOF_MODEL_SUPPORTS_VISION?: string
   HOF_PERSONALITY_LEARNING_ENABLED?: string
+  HOF_MINIMAL_OPERATIONS?: string
   HOF_ACTIVITY_INTERVAL_SECONDS?: string
   HOF_MEDIA_HOSTS?: string
 }

package/wrangler.npm.jsonc

@@ -33,6 +33,7 @@
     "HOF_MODEL": "@cf/google/gemma-4-26b-a4b-it",
     "HOF_MODEL_SUPPORTS_VISION": "true",
     "HOF_PERSONALITY_LEARNING_ENABLED": "false",
+    "HOF_MINIMAL_OPERATIONS": "false",
     "HOF_ACTIVITY_INTERVAL_SECONDS": "18000",
     "HOF_MEDIA_HOSTS": "",
   },