@jungjaehoon/mama-os 0.18.2 → 0.19.0

package/dist/agent/gateway-tool-executor.js

@@ -47,6 +47,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GatewayToolExecutor = void 0;
 const fs_1 = require("fs");
+const async_hooks_1 = require("async_hooks");
 const crypto_1 = require("crypto");
 const path_1 = require("path");
 const os_1 = require("os");
@@ -60,9 +61,40 @@ const mama_tool_handlers_js_1 = require("./mama-tool-handlers.js");
 const browser_tool_js_1 = require("../tools/browser-tool.js");
 const role_manager_js_1 = require("./role-manager.js");
 const config_manager_js_1 = require("../cli/config/config-manager.js");
+const agent_store_js_1 = require("../db/agent-store.js");
 const types_js_2 = require("../cli/config/types.js");
+const managed_agent_runtime_sync_js_1 = require("./managed-agent-runtime-sync.js");
+const managed_agent_validation_js_1 = require("./managed-agent-validation.js");
 const { DebugLogger } = debugLogger;
 const securityLogger = new DebugLogger('SecurityAudit');
+const AGENT_DETAIL_TABS = new Set([
+    'config',
+    'persona',
+    'tools',
+    'activity',
+    'validation',
+    'history',
+]);
+const managedAgentMutationTails = new Map();
+async function withManagedAgentMutationLock(agentId, fn) {
+    const previous = managedAgentMutationTails.get(agentId) ?? Promise.resolve();
+    let release;
+    const current = new Promise((resolve) => {
+        release = resolve;
+    });
+    const tail = previous.then(() => current);
+    managedAgentMutationTails.set(agentId, tail);
+    await previous;
+    try {
+        return await fn();
+    }
+    finally {
+        release();
+        if (managedAgentMutationTails.get(agentId) === tail) {
+            managedAgentMutationTails.delete(agentId);
+        }
+    }
+}
 function sanitizeCommandForAudit(command) {
     const commandHash = (0, crypto_1.createHash)('sha256').update(command).digest('hex');
     const commandPreview = command
@@ -71,6 +103,20 @@ function sanitizeCommandForAudit(command) {
         .slice(0, 200);
     return { commandHash, commandPreview };
 }
+function summarizeActivityOutput(output) {
+    if (output === undefined || output === null) {
+        return undefined;
+    }
+    if (typeof output === 'string') {
+        return output.slice(0, 500);
+    }
+    try {
+        return JSON.stringify(output).slice(0, 500);
+    }
+    catch {
+        return String(output).slice(0, 500);
+    }
+}
 /**
  * Valid MAMA gateway tools — derived from ToolRegistry (SSOT).
  */
@@ -90,6 +136,7 @@ class GatewayToolExecutor {
     telegramGateway = null;
     browserTool;
     roleManager;
+    executionContextStorage = new async_hooks_1.AsyncLocalStorage();
     currentContext = null;
     memoryAgentProcessManager = null;
     agentProcessManager = null;
@@ -111,6 +158,31 @@ class GatewayToolExecutor {
     getAgentEventBus() {
         return this.agentEventBus;
     }
+    sessionsDb = null;
+    setSessionsDb(db) {
+        this.sessionsDb = db;
+    }
+    rawStore = null;
+    setRawStore(store) {
+        this.rawStore = store;
+    }
+    testInFlight = new Map();
+    uiCommandQueue = null;
+    setUICommandQueue(queue) {
+        this.uiCommandQueue = queue;
+    }
+    applyMultiAgentConfig = null;
+    setApplyMultiAgentConfig(fn) {
+        this.applyMultiAgentConfig = fn;
+    }
+    restartMultiAgentAgent = null;
+    setRestartMultiAgentAgent(fn) {
+        this.restartMultiAgentAgent = fn;
+    }
+    validationService = null;
+    setValidationService(svc) {
+        this.validationService = svc;
+    }
     setMemoryAgent(processManager) {
         this.memoryAgentProcessManager = processManager;
     }
@@ -124,14 +196,146 @@ class GatewayToolExecutor {
     getAgentProcessManager() {
         return this.agentProcessManager;
     }
+    normalizeExecutionContext(executionContext) {
+        const agentContext = executionContext?.agentContext ?? null;
+        const source = executionContext?.source ?? agentContext?.source ?? '';
+        const channelId = executionContext?.channelId ?? agentContext?.session?.channelId ?? '';
+        const agentId = executionContext?.agentId ??
+            (source === 'viewer' ? 'os-agent' : (agentContext?.roleName ?? ''));
+        return {
+            agentContext,
+            agentId,
+            source,
+            channelId,
+        };
+    }
+    getExecutionState() {
+        const active = this.executionContextStorage.getStore();
+        if (active) {
+            return active;
+        }
+        return this.normalizeExecutionContext({
+            agentContext: this.currentContext,
+            agentId: this.currentAgentId,
+            source: this.currentSource,
+            channelId: this.currentChannelId,
+        });
+    }
+    getActiveContext() {
+        return this.getExecutionState().agentContext;
+    }
+    getActiveRouting() {
+        const state = this.getExecutionState();
+        return {
+            agentId: state.agentId,
+            source: state.source,
+            channelId: state.channelId,
+        };
+    }
+    async withExecutionContext(executionContext, fn) {
+        if (!executionContext) {
+            return fn();
+        }
+        const activeContext = this.normalizeExecutionContext(executionContext);
+        return this.executionContextStorage.run(activeContext, fn);
+    }
     setCurrentAgentContext(agentId, source, channelId) {
         this.currentAgentId = agentId;
         this.currentSource = source;
         this.currentChannelId = channelId;
     }
+    clearCurrentAgentContext() {
+        this.currentAgentId = '';
+        this.currentSource = '';
+        this.currentChannelId = '';
+    }
     setDisallowedGatewayTools(tools) {
         this.disallowedGatewayTools = new Set(tools);
     }
+    cleanupValidationSessionOnTelemetryFailure(session, error, label) {
+        if (!session || !this.validationService) {
+            return null;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        try {
+            this.validationService.finalizeSession(session.id, {
+                execution_status: 'failed',
+                error_message: `${label}: ${message}`,
+            });
+        }
+        catch (cleanupErr) {
+            securityLogger.warn(`[Delegation telemetry] Failed to clean up validation session ${session.id}`, cleanupErr);
+        }
+        return null;
+    }
+    getPreferredViewerAgentTab() {
+        if (!this.uiCommandQueue) {
+            return 'activity';
+        }
+        const { channelId } = this.getActiveRouting();
+        const currentPageContext = this.uiCommandQueue.getPageContext(channelId || undefined);
+        if (!currentPageContext || currentPageContext.currentRoute !== 'agents') {
+            return 'activity';
+        }
+        const pageData = currentPageContext.pageData;
+        const activeTab = pageData?.activeTab;
+        if (typeof activeTab === 'string' && AGENT_DETAIL_TABS.has(activeTab)) {
+            return activeTab;
+        }
+        return 'activity';
+    }
+    syncViewerToAgentDetail(agentId, preferredTab) {
+        if (!this.uiCommandQueue) {
+            return;
+        }
+        const { source, channelId } = this.getActiveRouting();
+        if (source !== 'viewer') {
+            return;
+        }
+        const desiredTab = preferredTab && AGENT_DETAIL_TABS.has(preferredTab)
+            ? preferredTab
+            : this.getPreferredViewerAgentTab();
+        const currentPageContext = this.uiCommandQueue.getPageContext(channelId || undefined);
+        const currentPageData = currentPageContext?.pageData;
+        if (currentPageContext?.currentRoute === 'agents' &&
+            currentPageContext.selectedItem?.type === 'agent' &&
+            currentPageContext.selectedItem.id === agentId &&
+            currentPageData?.pageType === 'agent-detail' &&
+            currentPageData?.activeTab === desiredTab) {
+            return;
+        }
+        this.uiCommandQueue.push({
+            type: 'navigate',
+            payload: {
+                route: 'agents',
+                params: {
+                    id: agentId,
+                    tab: desiredTab,
+                },
+            },
+        });
+    }
+    resolveManagedAgentId(agentId) {
+        if (!this.sessionsDb) {
+            return agentId;
+        }
+        const normalized = agentId
+            .trim()
+            .toLowerCase()
+            .replace(/[_\s]+/g, '-');
+        const candidates = Array.from(new Set([
+            agentId,
+            agentId.trim(),
+            normalized,
+            normalized.endsWith('-agent') ? normalized.slice(0, -6) : `${normalized}-agent`,
+        ])).filter(Boolean);
+        for (const candidate of candidates) {
+            if ((0, agent_store_js_1.getLatestVersion)(this.sessionsDb, candidate)) {
+                return candidate;
+            }
+        }
+        return agentId;
+    }
     setReportPublisher(fn) {
         this.reportPublisher = fn;
     }
@@ -178,7 +382,7 @@ class GatewayToolExecutor {
      * Get the current agent context
      */
     getAgentContext() {
-        return this.currentContext;
+        return this.getActiveContext();
     }
     setDiscordGateway(gateway) {
         this.discordGateway = gateway;
@@ -233,14 +437,15 @@ class GatewayToolExecutor {
      */
     checkToolPermission(toolName) {
         // If no context set, allow all tools (backward compatibility)
-        if (!this.currentContext) {
+        const context = this.getActiveContext();
+        if (!context) {
             return { allowed: true };
         }
-        const role = this.currentContext.role;
+        const role = context.role;
         if (!this.roleManager.isToolAllowed(role, toolName)) {
             return {
                 allowed: false,
-                error: `Permission denied: ${toolName} is not allowed for role "${this.currentContext.roleName}"`,
+                error: `Permission denied: ${toolName} is not allowed for role "${context.roleName}"`,
             };
         }
         return { allowed: true };
@@ -252,14 +457,15 @@ class GatewayToolExecutor {
      */
     checkPathPermission(path) {
         // If no context set, allow all paths (backward compatibility)
-        if (!this.currentContext) {
+        const context = this.getActiveContext();
+        if (!context) {
             return { allowed: true };
         }
-        const role = this.currentContext.role;
+        const role = context.role;
         if (!this.roleManager.isPathAllowed(role, path)) {
             return {
                 allowed: false,
-                error: `Permission denied: Access to "${path}" is not allowed for role "${this.currentContext.roleName}"`,
+                error: `Permission denied: Access to "${path}" is not allowed for role "${context.roleName}"`,
             };
         }
         return { allowed: true };
@@ -272,7 +478,10 @@ class GatewayToolExecutor {
      * @returns Tool execution result
      * @throws AgentError on tool errors or permission denial
      */
-    async execute(toolName, input) {
+    async execute(toolName, input, executionContext) {
+        if (executionContext) {
+            return this.withExecutionContext(executionContext, () => this.execute(toolName, input));
+        }
         if (!VALID_TOOLS.includes(toolName)) {
             throw new types_js_1.AgentError(`Unknown tool: ${toolName}. Valid tools: ${VALID_TOOLS.join(', ')}`, 'UNKNOWN_TOOL', undefined, false);
         }
@@ -356,6 +565,204 @@ class GatewayToolExecutor {
                 // Obsidian vault management via CLI
                 case 'obsidian':
                     return await this.executeObsidian(input);
+                // Agent lifecycle tools
+                case 'agent_test':
+                    return await this.executeAgentTest(input);
+                // Agent management tools (Managed Agents pattern)
+                case 'agent_get': {
+                    if (!this.sessionsDb) {
+                        return { success: false, error: 'Sessions DB not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const agentId = this.resolveManagedAgentId(input.agent_id);
+                    const latestVer = (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, agentId);
+                    if (!latestVer) {
+                        return { success: false, error: `Agent '${agentId}' not found` };
+                    }
+                    this.syncViewerToAgentDetail(agentId);
+                    return {
+                        success: true,
+                        agent_id: latestVer.agent_id,
+                        version: latestVer.version,
+                        config: JSON.parse(latestVer.snapshot),
+                        system: latestVer.persona_text,
+                        change_note: latestVer.change_note,
+                        created_at: latestVer.created_at,
+                    };
+                }
+                case 'agent_activity': {
+                    if (!this.sessionsDb) {
+                        return { success: false, error: 'Sessions DB not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const args = input;
+                    const agentId = this.resolveManagedAgentId(args.agent_id);
+                    const rawLimit = Number.parseInt(String(args.limit ?? 20), 10);
+                    const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 100) : 20;
+                    const latestVer = (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, agentId);
+                    if (!latestVer) {
+                        return { success: false, error: `Agent '${args.agent_id}' not found` };
+                    }
+                    this.syncViewerToAgentDetail(agentId, 'activity');
+                    return {
+                        success: true,
+                        agent_id: agentId,
+                        activity: (0, agent_store_js_1.getActivity)(this.sessionsDb, agentId, limit),
+                    };
+                }
+                case 'agent_update': {
+                    if (!this.sessionsDb) {
+                        return { success: false, error: 'Sessions DB not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const updateArgs = input;
+                    const updateError = (0, managed_agent_validation_js_1.validateManagedAgentChanges)(updateArgs.changes);
+                    if (updateError) {
+                        return { success: false, error: updateError };
+                    }
+                    const agentId = this.resolveManagedAgentId(updateArgs.agent_id);
+                    const initialLatest = (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, agentId);
+                    if (!initialLatest) {
+                        return { success: false, error: `Agent '${updateArgs.agent_id}' not found` };
+                    }
+                    return withManagedAgentMutationLock(agentId, async () => {
+                        const updateLatest = (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, agentId);
+                        if (!updateLatest) {
+                            return { success: false, error: `Agent '${updateArgs.agent_id}' not found` };
+                        }
+                        if (updateLatest.version !== updateArgs.version) {
+                            return {
+                                success: false,
+                                error: `Version conflict: current v${updateLatest.version}, sent v${updateArgs.version}`,
+                            };
+                        }
+                        const synced = await (0, managed_agent_runtime_sync_js_1.updateManagedAgentRuntime)({
+                            agentId,
+                            changes: updateArgs.changes,
+                        }, {
+                            loadConfig: config_manager_js_1.loadConfig,
+                            saveConfig: config_manager_js_1.saveConfig,
+                            applyMultiAgentConfig: this.applyMultiAgentConfig,
+                            restartMultiAgentAgent: this.restartMultiAgentAgent,
+                        });
+                        const updatedV = (0, agent_store_js_1.createAgentVersion)(this.sessionsDb, {
+                            agent_id: agentId,
+                            snapshot: synced.snapshot,
+                            persona_text: synced.personaText ?? updateLatest.persona_text,
+                            change_note: updateArgs.change_note,
+                        });
+                        return {
+                            success: true,
+                            new_version: updatedV.version,
+                            runtime_reloaded: synced.runtimeReloaded,
+                        };
+                    });
+                }
+                case 'agent_create': {
+                    if (!this.sessionsDb) {
+                        return { success: false, error: 'Sessions DB not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const createArgs = input;
+                    const createError = (0, managed_agent_validation_js_1.validateManagedAgentCreateInput)(createArgs);
+                    if (createError) {
+                        return { success: false, error: createError };
+                    }
+                    return withManagedAgentMutationLock(createArgs.id, async () => {
+                        const existingAgent = (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, createArgs.id);
+                        if (existingAgent) {
+                            return { success: false, error: `Agent '${createArgs.id}' already exists` };
+                        }
+                        const synced = await (0, managed_agent_runtime_sync_js_1.createManagedAgentRuntime)({
+                            id: createArgs.id,
+                            name: createArgs.name,
+                            model: createArgs.model,
+                            tier: createArgs.tier,
+                            backend: createArgs.backend,
+                            system: createArgs.system,
+                        }, {
+                            loadConfig: config_manager_js_1.loadConfig,
+                            saveConfig: config_manager_js_1.saveConfig,
+                            applyMultiAgentConfig: this.applyMultiAgentConfig,
+                            restartMultiAgentAgent: this.restartMultiAgentAgent,
+                        });
+                        const createdV = (0, agent_store_js_1.createAgentVersion)(this.sessionsDb, {
+                            agent_id: createArgs.id,
+                            snapshot: synced.snapshot,
+                            persona_text: synced.personaText,
+                            change_note: 'Created via agent_create tool',
+                        });
+                        return {
+                            success: true,
+                            id: createArgs.id,
+                            version: createdV.version,
+                            runtime_reloaded: synced.runtimeReloaded,
+                        };
+                    });
+                }
+                case 'agent_compare': {
+                    if (!this.sessionsDb) {
+                        return { success: false, error: 'Sessions DB not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const cmpArgs = input;
+                    const agentId = this.resolveManagedAgentId(cmpArgs.agent_id);
+                    const cmpResult = (0, agent_store_js_1.compareVersionMetrics)(this.sessionsDb, agentId, cmpArgs.version_a, cmpArgs.version_b);
+                    this.syncViewerToAgentDetail(agentId, 'validation');
+                    return { success: true, agent_id: agentId, ...cmpResult };
+                }
+                // Viewer control tools (SmartStore pattern)
+                case 'viewer_state': {
+                    if (!this.uiCommandQueue) {
+                        return { success: false, error: 'UI command queue not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const { channelId } = this.getActiveRouting();
+                    const ctx = this.uiCommandQueue.getPageContext(channelId || undefined);
+                    return { success: true, context: ctx || { currentRoute: 'unknown', pageData: null } };
+                }
+                case 'viewer_navigate': {
+                    if (!this.uiCommandQueue) {
+                        return { success: false, error: 'UI command queue not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const navArgs = input;
+                    this.uiCommandQueue.push({ type: 'navigate', payload: navArgs });
+                    return { success: true, navigated: navArgs.route };
+                }
+                case 'viewer_notify': {
+                    if (!this.uiCommandQueue) {
+                        return { success: false, error: 'UI command queue not available' };
+                    }
+                    const permError = this.checkViewerOnly();
+                    if (permError) {
+                        return { success: false, error: permError };
+                    }
+                    const args = input;
+                    this.uiCommandQueue.push({ type: 'notify', payload: args });
+                    return { success: true, notified: true };
+                }
                 // Multi-Agent delegation
                 case 'delegate':
                     return await this.executeDelegate(input);
@@ -486,7 +893,9 @@ class GatewayToolExecutor {
                 }
                 case 'agent_notices': {
                     const rawLimit = Number(input.limit);
-                    const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.floor(rawLimit), 1), 100) : 10;
+                    const limit = Number.isFinite(rawLimit)
+                        ? Math.min(Math.max(Math.floor(rawLimit), 1), 100)
+                        : 10;
                     if (!this.agentEventBus) {
                         return { success: false, error: 'Agent event bus not available' };
                     }
@@ -537,7 +946,8 @@ class GatewayToolExecutor {
         }
         // Fallback security for contexts without path restrictions:
         // Only allow reading from ~/.mama/ directory
-        if (!this.currentContext?.role.allowedPaths?.length) {
+        const context = this.getActiveContext();
+        if (!context?.role.allowedPaths?.length) {
             const mamaDir = (0, path_1.resolve)(homeDir, '.mama');
             const resolvedPath = (0, path_1.resolve)(expandedPath);
             // Use path.relative to prevent path traversal (e.g., ~/.mama-evil/)
@@ -587,7 +997,8 @@ class GatewayToolExecutor {
         }
         // Fallback security for contexts without path restrictions:
         // Only allow writing to ~/.mama/ directory
-        if (!this.currentContext?.role.allowedPaths?.length) {
+        const context = this.getActiveContext();
+        if (!context?.role.allowedPaths?.length) {
             const mamaDir = (0, path_1.resolve)(homeDir, '.mama');
             const resolvedPath = (0, path_1.resolve)(expandedPath);
             // Use path.relative to prevent path traversal (e.g., ~/.mama-evil/)
@@ -618,11 +1029,12 @@ class GatewayToolExecutor {
         const destructive = /(systemctl\s+(?:--user\s+)?(?:stop|disable)\s+mama(?:-os)?\b|(?:kill|pkill|killall)\b[^\n]*\bmama(?:-os)?\b|\brm\b(?:\s+(?:-[^\n\s]*[rf][^\n\s]*|--recursive|--force))+\s+(?:\/(?:\s|$)|~(?:\/|\s|$)|\$HOME(?:\/|\s|$)|\/home(?:\/|\s|$)))/i;
         if (destructive.test(command)) {
             const audit = sanitizeCommandForAudit(command);
+            const context = this.getActiveContext();
             const details = {
                 category: 'destructive',
                 ...audit,
-                source: this.currentContext?.source || null,
-                sessionId: this.currentContext?.session?.sessionId || null,
+                source: context?.source || null,
+                sessionId: context?.session?.sessionId || null,
             };
             securityLogger.warn('[SECURITY] Dangerous Bash command blocked', details);
             (0, security_monitor_js_1.recordSecurityEvent)({
@@ -656,12 +1068,13 @@ class GatewayToolExecutor {
         for (const pattern of dangerousPatterns) {
             if (pattern.test(command)) {
                 const audit = sanitizeCommandForAudit(command);
+                const context = this.getActiveContext();
                 const details = {
                     category: 'pattern',
                     pattern: pattern.toString(),
                     ...audit,
-                    source: this.currentContext?.source || null,
-                    sessionId: this.currentContext?.session?.sessionId || null,
+                    source: context?.source || null,
+                    sessionId: context?.session?.sessionId || null,
                 };
                 securityLogger.warn('[SECURITY] Dangerous Bash pattern blocked', details);
                 (0, security_monitor_js_1.recordSecurityEvent)({
@@ -975,15 +1388,16 @@ class GatewayToolExecutor {
      * Returns error message if not allowed
      */
     checkViewerOnly() {
-        if (!this.currentContext) {
+        const context = this.getActiveContext();
+        if (!context) {
             // No context = backward compatibility, allow
             return null;
         }
-        if (this.currentContext.source !== 'viewer') {
-            return `Permission denied: This operation is only available from MAMA OS Viewer. Current source: ${this.currentContext.source}`;
+        if (context.source !== 'viewer') {
+            return `Permission denied: This operation is only available from MAMA OS Viewer. Current source: ${context.source}`;
         }
-        if (!this.currentContext.role.systemControl) {
-            return `Permission denied: Role "${this.currentContext.roleName}" does not have system control permissions`;
+        if (!context.role.systemControl) {
+            return `Permission denied: Role "${context.roleName}" does not have system control permissions`;
         }
         return null;
     }
@@ -1124,9 +1538,8 @@ class GatewayToolExecutor {
         try {
             const config = await (0, config_manager_js_1.loadConfig)();
             // Determine if we should show sensitive data
-            const showSensitive = includeSensitive &&
-                this.currentContext?.source === 'viewer' &&
-                this.currentContext?.role.sensitiveAccess;
+            const context = this.getActiveContext();
+            const showSensitive = includeSensitive && context?.source === 'viewer' && context?.role.sensitiveAccess;
             // Mask sensitive data
             const maskedConfig = this.maskSensitiveData(config, showSensitive);
             // Return specific section or full config
@@ -1557,7 +1970,8 @@ class GatewayToolExecutor {
                 }
                 // Fallback security for contexts without path restrictions:
                 // Only allow reading from ~/.mama/ directory
-                if (!this.currentContext?.role.allowedPaths?.length) {
+                const context = this.getActiveContext();
+                if (!context?.role.allowedPaths?.length) {
                     const mamaDir = (0, path_1.resolve)(homeDir, '.mama');
                     const resolvedPath = (0, path_1.resolve)(expandedPath);
                     // Use path.relative to prevent path traversal (e.g., ~/.mama-evil/)
@@ -1603,6 +2017,272 @@ class GatewayToolExecutor {
     /**
      * Execute delegate tool — dispatch a task to another agent
      */
+    // ── Agent Test ─────────────────────────────────────────────────────────────
+    async executeAgentTest(input) {
+        const permError = this.checkViewerOnly();
+        if (permError) {
+            return { success: false, error: permError };
+        }
+        const { agent_id } = input;
+        const sample_count = Number.parseInt(String(input.sample_count ?? 2), 10);
+        const resolvedAgentId = this.resolveManagedAgentId(agent_id);
+        if (!Number.isFinite(sample_count) || sample_count < 1) {
+            securityLogger.warn('[Agent test] Invalid sample_count received', {
+                agent_id: resolvedAgentId,
+                sample_count: input.sample_count ?? null,
+            });
+            return {
+                success: false,
+                error: `Invalid sample_count for '${resolvedAgentId}': ${String(input.sample_count)}. Must be >= 1.`,
+            };
+        }
+        // Concurrency guard
+        if (this.testInFlight.has(resolvedAgentId)) {
+            return { success: false, error: 'test_already_running' };
+        }
+        const promise = this._runAgentTest(resolvedAgentId, sample_count, input.test_data);
+        this.testInFlight.set(resolvedAgentId, promise);
+        try {
+            return await promise;
+        }
+        finally {
+            this.testInFlight.delete(resolvedAgentId);
+        }
+    }
+    async _runAgentTest(agentId, sampleCount, testData) {
+        if (!this.agentProcessManager || !this.delegationManagerRef) {
+            return {
+                success: false,
+                error: 'agent_timeout: multi-agent not configured',
+            };
+        }
+        const startTime = Date.now();
+        // 1. Collect test data
+        let items;
+        if (testData && testData.length > 0) {
+            const normalizedItems = [];
+            for (let index = 0; index < testData.length; index++) {
+                const rawItem = testData[index];
+                if (typeof rawItem.input !== 'string') {
+                    return {
+                        success: false,
+                        error: `Invalid test_data[${index}].input: expected string`,
+                    };
+                }
+                if (rawItem.expected !== undefined && typeof rawItem.expected !== 'string') {
+                    return {
+                        success: false,
+                        error: `Invalid test_data[${index}].expected: expected string`,
+                    };
+                }
+                normalizedItems.push({
+                    input: rawItem.input,
+                    ...(typeof rawItem.expected === 'string' ? { expected: rawItem.expected } : {}),
+                });
+            }
+            items = normalizedItems;
+        }
+        else if (this.rawStore) {
+            const agentConfig = this.delegationManagerRef.getAgentConfig(agentId);
+            const connectors = agentConfig?.connectors ?? [];
+            if (connectors.length === 0) {
+                return {
+                    success: false,
+                    error: 'connector_unavailable: no connectors configured',
+                };
+            }
+            const allItems = [];
+            const missingConnectors = [];
+            for (const conn of connectors) {
+                if (!this.rawStore.hasConnector(conn)) {
+                    missingConnectors.push(conn);
+                    continue;
+                }
+                const recent = this.rawStore.getRecent(conn, sampleCount);
+                for (const item of recent) {
+                    allItems.push({ input: `[${item.type}] ${item.content}` });
+                }
+                if (allItems.length >= sampleCount) {
+                    break;
+                }
+            }
+            if (allItems.length === 0) {
+                const detail = missingConnectors.length > 0
+                    ? `connector(s) not found: ${missingConnectors.join(', ')}`
+                    : 'no recent data';
+                return {
+                    success: false,
+                    error: `connector_unavailable: ${detail}`,
+                };
+            }
+            items = allItems.slice(0, sampleCount);
+        }
+        else {
+            return {
+                success: false,
+                error: 'connector_unavailable: rawStore not available',
+            };
+        }
+        // 2. Start validation session for agent_test
+        const testVer = this.sessionsDb ? (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, agentId) : null;
+        const testAgentVersion = testVer?.version ?? 0;
+        let testValSession = null;
+        try {
+            testValSession =
+                this.validationService?.startSession(agentId, testAgentVersion, 'agent_test', {
+                    goal: `Test with ${items.length} items`,
+                    customBeforeSnapshot: JSON.stringify({
+                        schema_version: 1,
+                        test_input_summary: items.map((i) => i.input.slice(0, 80)).join('; '),
+                        sample_count: items.length,
+                    }),
+                }) ?? null;
+        }
+        catch (telemetryErr) {
+            securityLogger.warn('[Agent test telemetry] Failed to start validation session', {
+                agentId,
+                testAgentVersion,
+                error: telemetryErr instanceof Error ? telemetryErr.message : String(telemetryErr),
+            });
+        }
+        // 3. Log test_run start
+        let testRunId = null;
+        if (this.sessionsDb) {
+            try {
+                const row = (0, agent_store_js_1.logActivity)(this.sessionsDb, {
+                    agent_id: agentId,
+                    agent_version: testAgentVersion,
+                    type: 'test_run',
+                    input_summary: `Testing with ${items.length} items`,
+                    run_id: testValSession?.id,
+                    execution_status: 'started',
+                    trigger_reason: 'agent_test',
+                });
+                testRunId = row.id;
+                if (testValSession && this.validationService) {
+                    this.validationService.recordRun(testValSession.id, { activityId: row.id });
+                }
+            }
+            catch (telemetryErr) {
+                securityLogger.warn('[Agent test telemetry] Failed to persist startup activity', {
+                    agentId,
+                    testValSessionId: testValSession?.id ?? null,
+                    error: telemetryErr instanceof Error ? telemetryErr.message : String(telemetryErr),
+                });
+                testValSession = this.cleanupValidationSessionOnTelemetryFailure(testValSession, telemetryErr, 'agent_test startup telemetry failed');
+                testRunId = null;
+            }
+        }
+        // 4. Delegate with a small concurrency limit to keep tests responsive
+        const results = [];
+        const workerCount = Math.min(3, items.length);
+        let nextIndex = 0;
+        const workers = Array.from({ length: workerCount }, async () => {
+            for (;;) {
+                const currentIndex = nextIndex;
+                nextIndex++;
+                if (currentIndex >= items.length) {
+                    return;
+                }
+                const item = items[currentIndex];
+                try {
+                    const r = await this.executeDelegate({
+                        agentId,
+                        task: `Process this data:\n${item.input}`,
+                    });
+                    const rAny = r;
+                    const output = r.success
+                        ? String(rAny.data?.response ?? '')
+                        : undefined;
+                    results[currentIndex] = {
+                        input: item.input,
+                        output,
+                        error: r.success ? undefined : String(rAny.error ?? 'unknown'),
+                    };
+                }
+                catch (err) {
+                    results[currentIndex] = { input: item.input, error: String(err) };
+                }
+            }
+        });
+        await Promise.all(workers);
+        // 5. Auto-score: pass/fail ratio
+        const passed = results.filter((r, index) => {
+            if (r.error) {
+                return false;
+            }
+            const expected = items[index]?.expected;
+            if (expected === undefined) {
+                return true;
+            }
+            return (r.output ?? '').trim() === expected.trim();
+        }).length;
+        const failed = results.length - passed;
+        const autoScore = results.length > 0 ? Math.round((passed / results.length) * 100) : 0;
+        if (this.sessionsDb && testRunId) {
+            try {
+                (0, agent_store_js_1.updateActivityScore)(this.sessionsDb, testRunId, autoScore, {
+                    total: results.length,
+                    passed,
+                    failed,
+                    items: results.map((r, index) => ({
+                        input: r.input.slice(0, 100),
+                        result: r.error ||
+                            (items[index]?.expected !== undefined &&
+                                (r.output ?? '').trim() !== items[index].expected.trim())
+                            ? 'fail'
+                            : 'pass',
+                    })),
+                }, 'completed');
+            }
+            catch (telemetryErr) {
+                securityLogger.warn('[Agent test telemetry] Failed to persist test score', {
+                    agentId,
+                    testRunId,
+                    autoScore,
+                    totalResults: results.length,
+                    error: telemetryErr instanceof Error ? telemetryErr.message : String(telemetryErr),
+                });
+            }
+        }
+        // 6. Finalize validation session with test metrics
+        const testDurationMs = Date.now() - startTime;
+        if (testValSession && this.validationService) {
+            try {
+                this.validationService.finalizeSession(testValSession.id, {
+                    execution_status: 'completed',
+                    metrics: {
+                        duration_ms: testDurationMs,
+                        completion_rate: results.length > 0 ? passed / results.length : 0,
+                        auto_score: autoScore,
+                    },
+                    test_input_summary: items.map((i) => i.input.slice(0, 80)).join('; '),
+                });
+            }
+            catch (telemetryErr) {
+                securityLogger.warn('[Agent test telemetry] Failed to finalize validation session', {
+                    agentId,
+                    testValSessionId: testValSession.id,
+                    autoScore,
+                    totalResults: results.length,
+                    error: telemetryErr instanceof Error ? telemetryErr.message : String(telemetryErr),
+                });
+            }
+        }
+        return {
+            success: true,
+            data: {
+                test_run_id: testRunId,
+                agent_id: agentId,
+                results,
+                auto_score: autoScore,
+                duration_ms: testDurationMs,
+                validation_session_id: testValSession?.id ?? null,
+                ...(testRunId === null ? { warning: 'score_not_persisted' } : {}),
+            },
+        };
+    }
+    // ── Delegation ────────────────────────────────────────────────────────────
     async executeDelegate(input) {
         const { agentId, task, background } = input;
         // Resolve skill path safely — reject path traversal attempts
@@ -1623,7 +2303,8 @@ class GatewayToolExecutor {
         // Permission check using existing DelegationManager
         // Default to 'conductor' when no agent context is set (e.g., MessageRouter path, audit cron)
         // Conductor is the default agent and the only tier-1 agent that should delegate
-        const sourceAgentId = this.currentAgentId || 'conductor';
+        const { agentId: activeAgentId, source: activeSource, channelId: activeChannelId, } = this.getActiveRouting();
+        const sourceAgentId = activeAgentId || 'conductor';
         const check = this.delegationManagerRef.isDelegationAllowed(sourceAgentId, agentId);
         if (!check.allowed) {
             return {
@@ -1631,16 +2312,44 @@ class GatewayToolExecutor {
                 error: `Delegation denied: ${check.reason}`,
             };
         }
-        // Background delegation: fire-and-forget
+        // Background delegation: fire-and-forget with async validation finalize
         if (background) {
-            const source = this.currentSource || 'viewer';
-            const channelId = this.currentChannelId || 'default';
-            // Fire-and-forget: spawn process and send message without awaiting result
+            const source = activeSource || 'viewer';
+            const channelId = activeChannelId || 'default';
+            // Start validation session for background delegation
+            let bgAgentVersion = 0;
+            let bgValSession = null;
+            try {
+                const bgVer = this.sessionsDb ? (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, agentId) : null;
+                bgAgentVersion = bgVer?.version ?? 0;
+                bgValSession =
+                    this.validationService?.startSession(agentId, bgAgentVersion, 'delegate_run') ?? null;
+                if (this.sessionsDb) {
+                    const row = (0, agent_store_js_1.logActivity)(this.sessionsDb, {
+                        agent_id: agentId,
+                        agent_version: bgAgentVersion,
+                        type: 'task_start',
+                        input_summary: task?.slice(0, 200),
+                        run_id: bgValSession?.id,
+                        execution_status: 'started',
+                        trigger_reason: 'delegate_run',
+                    });
+                    if (bgValSession && this.validationService) {
+                        this.validationService.recordRun(bgValSession.id, { activityId: row.id });
+                    }
+                }
+            }
+            catch (telemetryErr) {
+                securityLogger.warn('[Delegation telemetry] Background bootstrap failed', telemetryErr);
+                bgAgentVersion = 0;
+                bgValSession = this.cleanupValidationSessionOnTelemetryFailure(bgValSession, telemetryErr, 'background delegate bootstrap failed');
+            }
+            // Fire-and-forget: finalize validation when complete
+            const bgStartTime = Date.now();
             void (async () => {
                 try {
                     const process = await this.agentProcessManager.getProcess(source, channelId, agentId);
                     let delegationPrompt = this.delegationManagerRef.buildDelegationPrompt(sourceAgentId, task);
-                    // Inject skill content if specified
                     if (input.skill) {
                         const skillPath = resolveSkillPath(input.skill);
                         if (skillPath && (0, fs_1.existsSync)(skillPath)) {
@@ -1648,10 +2357,82 @@ class GatewayToolExecutor {
                             delegationPrompt = skillContent + '\n\n---\n\n' + delegationPrompt;
                         }
                     }
-                    await process.sendMessage(delegationPrompt);
+                    const result = await process.sendMessage(delegationPrompt);
+                    const durationMs = Date.now() - bgStartTime;
+                    try {
+                        if (this.sessionsDb) {
+                            const row = (0, agent_store_js_1.logActivity)(this.sessionsDb, {
+                                agent_id: agentId,
+                                agent_version: bgAgentVersion,
+                                type: 'task_complete',
+                                input_summary: task?.slice(0, 200),
+                                output_summary: summarizeActivityOutput(result?.response),
+                                duration_ms: durationMs,
+                                run_id: bgValSession?.id,
+                                execution_status: 'completed',
+                                trigger_reason: 'delegate_run',
+                            });
+                            if (bgValSession && this.validationService) {
+                                this.validationService.recordRun(bgValSession.id, {
+                                    activityId: row.id,
+                                    duration_ms: durationMs,
+                                });
+                            }
+                        }
+                    }
+                    catch (telemetryErr) {
+                        securityLogger.warn('[Delegation telemetry] Background completion activity failed', telemetryErr);
+                    }
+                    try {
+                        if (bgValSession && this.validationService) {
+                            this.validationService.finalizeSession(bgValSession.id, {
+                                execution_status: 'completed',
+                                metrics: { duration_ms: durationMs },
+                            });
+                        }
+                    }
+                    catch (telemetryErr) {
+                        securityLogger.warn('[Delegation telemetry] Background completion finalize failed', telemetryErr);
+                    }
                 }
-                catch {
-                    // Background task failures are silently ignored
+                catch (err) {
+                    const durationMs = Date.now() - bgStartTime;
+                    try {
+                        if (this.sessionsDb) {
+                            const row = (0, agent_store_js_1.logActivity)(this.sessionsDb, {
+                                agent_id: agentId,
+                                agent_version: bgAgentVersion,
+                                type: 'task_error',
+                                input_summary: task?.slice(0, 200),
+                                error_message: String(err),
+                                duration_ms: durationMs,
+                                run_id: bgValSession?.id,
+                                execution_status: 'failed',
+                                trigger_reason: 'delegate_run',
+                            });
+                            if (bgValSession && this.validationService) {
+                                this.validationService.recordRun(bgValSession.id, {
+                                    activityId: row.id,
+                                    duration_ms: durationMs,
+                                });
+                            }
+                        }
+                    }
+                    catch (telemetryErr) {
+                        securityLogger.warn('[Delegation telemetry] Background failure activity failed', telemetryErr);
+                    }
+                    try {
+                        if (bgValSession && this.validationService) {
+                            this.validationService.finalizeSession(bgValSession.id, {
+                                execution_status: 'failed',
+                                error_message: String(err),
+                                metrics: { duration_ms: durationMs },
+                            });
+                        }
+                    }
+                    catch (telemetryErr) {
+                        securityLogger.warn('[Delegation telemetry] Background failure finalize failed', telemetryErr);
+                    }
                 }
             })();
             return {
@@ -1660,9 +2441,37 @@ class GatewayToolExecutor {
             };
         }
         // Synchronous delegation with retry + backoff for resilience
-        const source = this.currentSource || 'viewer';
-        const channelId = this.currentChannelId || 'default';
+        const source = activeSource || 'viewer';
+        const channelId = activeChannelId || 'default';
         const startTime = Date.now();
+        // Start validation session for this delegation
+        let agentVersion = 0;
+        let valSession = null;
+        try {
+            const ver = this.sessionsDb ? (0, agent_store_js_1.getLatestVersion)(this.sessionsDb, agentId) : null;
+            agentVersion = ver?.version ?? 0;
+            valSession =
+                this.validationService?.startSession(agentId, agentVersion, 'delegate_run') ?? null;
+            if (this.sessionsDb) {
+                const row = (0, agent_store_js_1.logActivity)(this.sessionsDb, {
+                    agent_id: agentId,
+                    agent_version: agentVersion,
+                    type: 'task_start',
+                    input_summary: task?.slice(0, 200),
+                    run_id: valSession?.id,
+                    execution_status: 'started',
+                    trigger_reason: 'delegate_run',
+                });
+                if (valSession && this.validationService) {
+                    this.validationService.recordRun(valSession.id, { activityId: row.id });
+                }
+            }
+        }
+        catch (telemetryErr) {
+            securityLogger.warn('[Delegation telemetry] Validation bootstrap failed', telemetryErr);
+            agentVersion = 0;
+            valSession = this.cleanupValidationSessionOnTelemetryFailure(valSession, telemetryErr, 'delegate bootstrap failed');
+        }
         const MAX_RETRIES = 3;
         let lastError = null;
         for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
@@ -1680,7 +2489,6 @@ class GatewayToolExecutor {
                 // Inject channel history for fresh processes (no prior context)
                 const sessionId = process.getSessionId?.();
                 if (!sessionId || attempt > 0) {
-                    // Fresh process or retried after crash — inject channel history for context
                     try {
                         const { getChannelHistory } = await import('../gateways/channel-history.js');
                         const channelHistory = getChannelHistory();
@@ -1692,13 +2500,49 @@ class GatewayToolExecutor {
                         }
                     }
                     catch {
-                        // Channel history injection is best-effort — proceed without it
+                        // Channel history injection is best-effort
                     }
                 }
                 const result = await process.sendMessage(delegationPrompt);
+                const durationMs = Date.now() - startTime;
+                try {
+                    if (this.sessionsDb) {
+                        const row = (0, agent_store_js_1.logActivity)(this.sessionsDb, {
+                            agent_id: agentId,
+                            agent_version: agentVersion,
+                            type: 'task_complete',
+                            input_summary: task?.slice(0, 200),
+                            output_summary: summarizeActivityOutput(result.response),
+                            duration_ms: durationMs,
+                            run_id: valSession?.id,
+                            execution_status: 'completed',
+                            trigger_reason: 'delegate_run',
+                        });
+                        if (valSession && this.validationService) {
+                            this.validationService.recordRun(valSession.id, {
+                                activityId: row.id,
+                                duration_ms: durationMs,
+                            });
+                        }
+                    }
+                }
+                catch (telemetryErr) {
+                    securityLogger.warn('[Delegation telemetry] Completion activity failed', telemetryErr);
+                }
+                try {
+                    if (valSession && this.validationService) {
+                        this.validationService.finalizeSession(valSession.id, {
+                            execution_status: 'completed',
+                            metrics: { duration_ms: durationMs },
+                        });
+                    }
+                }
+                catch (telemetryErr) {
+                    securityLogger.warn('[Delegation telemetry] Completion finalize failed', telemetryErr);
+                }
                 return {
                     success: true,
-                    data: { agentId, response: result.response, duration_ms: Date.now() - startTime },
+                    data: { agentId, response: result.response, duration_ms: durationMs },
                 };
             }
             catch (err) {
@@ -1706,7 +2550,6 @@ class GatewayToolExecutor {
                 const isBusy = lastError.message.includes('busy');
                 const isCrash = lastError.message.includes('exited with code');
                 if (isCrash) {
-                    // Force remove crashed process so next getProcess() creates a fresh one
                     this.agentProcessManager.stopProcess(source, channelId, agentId);
                 }
                 if (attempt < MAX_RETRIES - 1 && (isBusy || isCrash)) {
@@ -1716,6 +2559,43 @@ class GatewayToolExecutor {
                 break;
             }
         }
+        const failedDurationMs = Date.now() - startTime;
+        try {
+            if (this.sessionsDb) {
+                const row = (0, agent_store_js_1.logActivity)(this.sessionsDb, {
+                    agent_id: agentId,
+                    agent_version: agentVersion,
+                    type: 'task_error',
+                    input_summary: task?.slice(0, 200),
+                    error_message: lastError?.message,
+                    duration_ms: failedDurationMs,
+                    run_id: valSession?.id,
+                    execution_status: 'failed',
+                    trigger_reason: 'delegate_run',
+                });
+                if (valSession && this.validationService) {
+                    this.validationService.recordRun(valSession.id, {
+                        activityId: row.id,
+                        duration_ms: failedDurationMs,
+                    });
+                }
+            }
+        }
+        catch (telemetryErr) {
+            securityLogger.warn('[Delegation telemetry] Failure activity failed', telemetryErr);
+        }
+        try {
+            if (valSession && this.validationService) {
+                this.validationService.finalizeSession(valSession.id, {
+                    execution_status: 'failed',
+                    error_message: lastError?.message,
+                    metrics: { duration_ms: failedDurationMs },
+                });
+            }
+        }
+        catch (telemetryErr) {
+            securityLogger.warn('[Delegation telemetry] Failure finalize failed', telemetryErr);
+        }
         return {
             success: false,
             error: `Delegation to ${agentId} failed after ${MAX_RETRIES} attempts: ${lastError?.message}`,
@@ -1772,8 +2652,9 @@ class GatewayToolExecutor {
         const { CodeActSandbox, HostBridge } = await import('./code-act/index.js');
         const sandbox = new CodeActSandbox();
         const bridge = new HostBridge(this);
-        const tier = (this.currentContext?.tier ?? 1);
-        bridge.injectInto(sandbox, tier, this.currentContext?.role);
+        const context = this.getActiveContext();
+        const tier = (context?.tier ?? 1);
+        bridge.injectInto(sandbox, tier, context?.role);
         const result = await sandbox.execute(input.code);
         return {
             success: result.success,
@@ -1786,16 +2667,17 @@ class GatewayToolExecutor {
      * Handle mama_add — auto-extract facts from conversation content with derived memory scopes.
      */
     async handleMamaAdd(input) {
-        if (!this.currentContext) {
+        const context = this.getActiveContext();
+        if (!context) {
             return {
                 success: false,
                 error: 'mama_add requires an active agent context',
             };
         }
         const scopes = (0, scope_context_js_1.deriveMemoryScopes)({
-            source: this.currentContext.source,
-            channelId: this.currentContext.session.channelId,
-            userId: this.currentContext.session.userId,
+            source: context.source,
+            channelId: context.session.channelId,
+            userId: context.session.userId,
             projectId: process.env.MAMA_WORKSPACE || process.cwd(),
         });
         return this.handleMamaIngest({
@@ -1819,11 +2701,12 @@ class GatewayToolExecutor {
                     error: 'Memory ingest API not available.',
                 };
             }
-            const fallbackScopes = this.currentContext
+            const context = this.getActiveContext();
+            const fallbackScopes = context
                 ? (0, scope_context_js_1.deriveMemoryScopes)({
-                    source: this.currentContext.source,
-                    channelId: this.currentContext.session.channelId,
-                    userId: this.currentContext.session.userId,
+                    source: context.source,
+                    channelId: context.session.channelId,
+                    userId: context.session.userId,
                     projectId: process.env.MAMA_WORKSPACE || process.cwd(),
                 })
                 : [];
@@ -1845,7 +2728,7 @@ class GatewayToolExecutor {
                 source: {
                     package: 'standalone',
                     source_type: 'gateway_tool_executor',
-                    source: this.currentContext?.source || null,
+                    source: context?.source || null,
                 },
             });
             return {
@@ -1870,11 +2753,12 @@ class GatewayToolExecutor {
                 error: 'query is required and recallMemory API must be available',
             };
         }
-        const fallbackScopes = this.currentContext
+        const context = this.getActiveContext();
+        const fallbackScopes = context
             ? (0, scope_context_js_1.deriveMemoryScopes)({
-                source: this.currentContext.source,
-                channelId: this.currentContext.session.channelId,
-                userId: this.currentContext.session.userId,
+                source: context.source,
+                channelId: context.session.channelId,
+                userId: context.session.userId,
                 projectId: process.env.MAMA_WORKSPACE || process.cwd(),
             })
             : [];