@jungjaehoon/mama-os 0.20.1 → 0.21.0

package/dist/cli/commands/start.js

@@ -85,6 +85,7 @@ const api_routes_init_js_1 = require("../runtime/api-routes-init.js");
 const server_start_js_1 = require("../runtime/server-start.js");
 const shutdown_js_1 = require("../runtime/shutdown.js");
 const envelope_bootstrap_js_1 = require("../runtime/envelope-bootstrap.js");
+const message_router_config_js_1 = require("../runtime/message-router-config.js");
 const reactive_config_js_1 = require("../../envelope/reactive-config.js");
 const scope_context_js_1 = require("../../memory/scope-context.js");
 const types_js_1 = require("../config/types.js");
@@ -498,7 +499,10 @@ async function runAgentLoop(config, options = {}) {
     }
     const agentLoopBackend = runtimeBackend === 'codex' || runtimeBackend === 'codex-mcp' ? 'codex-mcp' : 'claude';
     // Initialize main agent loop + client (reasoning state is closure-scoped inside)
-    const { agentLoop, agentLoopClient } = (0, agent_loop_init_js_1.initMainAgentLoop)(config, oauthManager, db, metricsStore, agentLoopBackend, { ...options, envelopeIssuanceMode: envelopeBootstrap.metadata.issuance });
+    const { agentLoop, agentLoopClient } = (0, agent_loop_init_js_1.initMainAgentLoop)(config, oauthManager, db, metricsStore, agentLoopBackend, {
+        ...options,
+        envelopeIssuanceMode: envelopeBootstrap.metadata.issuance,
+    });
     // ── Phase 3: MAMA Core API ────────────────────────────────────────────────
     const { mamaApi, mamaApiClient, connectorExtractionFn } = await (0, mama_core_init_js_1.initMamaCore)(config);
     // getAdapter is still used directly in this file for DB queries after initDB has run
@@ -510,9 +514,7 @@ async function runAgentLoop(config, options = {}) {
     toolExecutor.setContextCompileService(contextCompileService);
     agentLoop.setContextCompileService(contextCompileService);
     // ── Phase 4: Memory Agent + MessageRouter ─────────────────────────────────
-    const messageRouter = new index_js_2.MessageRouter(sessionStore, agentLoopClient, mamaApiClient, {
-        backend: runtimeBackend,
-    }, envelopeBootstrap.envelopeConfig, envelopeBootstrap.envelopeAuthority);
+    const messageRouter = new index_js_2.MessageRouter(sessionStore, agentLoopClient, mamaApiClient, (0, message_router_config_js_1.resolveMessageRouterConfig)(config, runtimeBackend), envelopeBootstrap.envelopeConfig, envelopeBootstrap.envelopeAuthority);
     messageRouter.setSessionsDb(db);
     // validationService wired after creation (Phase 5 below)
     const { memoryAgentLoop } = await (0, memory_agent_init_js_1.initMemoryAgent)(oauthManager, config, mamaApi, mamaApiClient, messageRouter, agentLoopBackend);
@@ -537,134 +539,132 @@ async function runAgentLoop(config, options = {}) {
     agentLoop.setUICommandQueue(uiCommandQueue);
     // Wire up Code-Act executor for POST /api/code-act endpoint
     // Always register: Dashboard/Wiki agents use code-act via MCP → HTTP proxy
-    {
-        graphHandlerOptions.executeCodeAct = async (code, codeActContext) => {
-            const { CodeActSandbox, HostBridge } = await import('../../agent/code-act/index.js');
-            const sandbox = new CodeActSandbox();
-            const resolvedCodeActPolicy = resolveCodeActAgentPolicy(codeActContext, config.multi_agent?.agents, config.multi_agent?.default_agent || 'conductor');
-            if (resolvedCodeActPolicy.error) {
-                return { success: false, error: resolvedCodeActPolicy.error };
-            }
-            const codeActAgentId = resolvedCodeActPolicy.agentId;
-            const codeActPolicy = resolvedCodeActPolicy.policy ?? {};
-            const codeActRole = buildCodeActRole(codeActPolicy);
-            const codeActReadOnly = isTruthyEnvValue(process.env.MAMA_CODE_ACT_READ_ONLY);
-            const codeActTier = codeActReadOnly ? 3 : 2;
-            const instanceId = (0, node_crypto_1.randomUUID)();
-            let executionContext = null;
-            if (envelopeBootstrap.envelopeAuthority && envelopeBootstrap.metadata.issuance !== 'off') {
-                const projectId = (0, reactive_config_js_1.resolveReactiveProjectRoot)(config, process.env);
-                const projectRef = { kind: 'project', id: projectId };
-                const memoryScopes = resolveCodeActMemoryScopes((0, scope_context_js_1.deriveMemoryScopes)({
-                    source: 'watch',
-                    channelId: 'api:code-act',
-                    userId: 'api',
-                    projectId,
-                }), getAdapter());
-                const wallSeconds = Math.min(Math.max(Math.floor((config.timeouts?.agent_ms ?? 300_000) / 1000), 1), 300);
-                const envelope = envelopeBootstrap.envelopeAuthority.buildAndPersist({
-                    agent_id: codeActAgentId,
-                    instance_id: instanceId,
-                    source: 'watch',
-                    channel_id: 'api:code-act',
-                    trigger_context: { user_text: '<api-code-act invocation>' },
-                    scope: {
-                        project_refs: [projectRef],
-                        raw_connectors: codeActRawConnectors,
-                        memory_scopes: memoryScopes,
-                        allowed_destinations: [],
-                    },
-                    tier: codeActTier,
-                    budget: { wall_seconds: wallSeconds },
-                    expires_at: new Date(Date.now() + wallSeconds * 1000 + 30_000).toISOString(),
-                });
-                const roleName = `code_act_${codeActAgentId}`;
-                const role = codeActRole;
-                const agentContext = {
-                    source: 'watch',
-                    platform: 'cli',
-                    roleName,
-                    role,
-                    session: {
-                        sessionId: `api:code-act:${instanceId}`,
-                        channelId: 'api:code-act',
-                        startedAt: new Date(),
-                    },
-                    capabilities: ['code_act'],
-                    limitations: codeActReadOnly ? ['Code-Act read-only mode: memory writes disabled'] : [],
-                    tier: codeActTier,
-                    backend: 'claude',
-                };
-                executionContext = {
-                    agentContext,
-                    agentId: codeActAgentId,
-                    source: 'watch',
-                    channelId: 'api:code-act',
-                    envelope,
-                    executionSurface: 'code_act',
-                };
-            }
-            const parentRun = bindCodeActParentModelRun(getAdapter(), executionContext, {
-                inputSnapshotRef: `code-act:${instanceId}`,
-                inputRefs: {
-                    tool: 'code_act',
-                    source: 'api',
-                    channel_id: 'api:code-act',
-                    read_only: codeActReadOnly,
+    graphHandlerOptions.executeCodeAct = async (code, codeActContext) => {
+        const { CodeActSandbox, HostBridge } = await import('../../agent/code-act/index.js');
+        const sandbox = new CodeActSandbox();
+        const resolvedCodeActPolicy = resolveCodeActAgentPolicy(codeActContext, config.multi_agent?.agents, config.multi_agent?.default_agent || 'conductor');
+        if (resolvedCodeActPolicy.error) {
+            return { success: false, error: resolvedCodeActPolicy.error };
+        }
+        const codeActAgentId = resolvedCodeActPolicy.agentId;
+        const codeActPolicy = resolvedCodeActPolicy.policy ?? {};
+        const codeActRole = buildCodeActRole(codeActPolicy);
+        const codeActReadOnly = isTruthyEnvValue(process.env.MAMA_CODE_ACT_READ_ONLY);
+        const codeActTier = codeActReadOnly ? 3 : 2;
+        const instanceId = (0, node_crypto_1.randomUUID)();
+        let executionContext = null;
+        if (envelopeBootstrap.envelopeAuthority && envelopeBootstrap.metadata.issuance !== 'off') {
+            const projectId = (0, reactive_config_js_1.resolveReactiveProjectRoot)(config, process.env);
+            const projectRef = { kind: 'project', id: projectId };
+            const memoryScopes = resolveCodeActMemoryScopes((0, scope_context_js_1.deriveMemoryScopes)({
+                source: 'watch',
+                channelId: 'api:code-act',
+                userId: 'api',
+                projectId,
+            }), getAdapter());
+            const wallSeconds = Math.min(Math.max(Math.floor((config.timeouts?.agent_ms ?? 300_000) / 1000), 1), 300);
+            const envelope = envelopeBootstrap.envelopeAuthority.buildAndPersist({
+                agent_id: codeActAgentId,
+                instance_id: instanceId,
+                source: 'watch',
+                channel_id: 'api:code-act',
+                trigger_context: { user_text: '<api-code-act invocation>' },
+                scope: {
+                    project_refs: [projectRef],
+                    raw_connectors: codeActRawConnectors,
+                    memory_scopes: memoryScopes,
+                    allowed_destinations: [],
                 },
+                tier: codeActTier,
+                budget: { wall_seconds: wallSeconds },
+                expires_at: new Date(Date.now() + wallSeconds * 1000 + 30_000).toISOString(),
             });
-            executionContext = parentRun.executionContext;
-            const bridge = new HostBridge(toolExecutor, new role_manager_js_1.RoleManager({ rolesConfig: config.roles ?? types_js_1.DEFAULT_ROLES }), executionContext);
-            const toolCalls = [];
-            bridge.onToolUse = (toolName, input, result) => {
-                if (result !== undefined) {
-                    toolCalls.push({ name: toolName, input });
-                    if (CODE_ACT_MUTATION_TOOLS.has(toolName)) {
-                        codeActLogger.warn('[CodeAct] mutation tool call', {
-                            toolName,
-                            success: Boolean(result.success),
-                            readOnly: codeActReadOnly,
-                            envelopeHash: executionContext?.envelope?.envelope_hash ?? null,
-                        });
-                    }
-                }
+            const roleName = `code_act_${codeActAgentId}`;
+            const role = codeActRole;
+            const agentContext = {
+                source: 'watch',
+                platform: 'cli',
+                roleName,
+                role,
+                session: {
+                    sessionId: `api:code-act:${instanceId}`,
+                    channelId: 'api:code-act',
+                    startedAt: new Date(),
+                },
+                capabilities: ['code_act'],
+                limitations: codeActReadOnly ? ['Code-Act read-only mode: memory writes disabled'] : [],
+                tier: codeActTier,
+                backend: runtimeBackend,
             };
-            const previousRoutingContext = toolExecutor.getCurrentAgentRoutingContext();
-            try {
-                // Set default agent context for /api/code-act calls (Conductor, tiered sandbox).
-                // Per-request executionContext carries envelope data; this routing context is legacy fallback.
-                toolExecutor.setCurrentAgentContext(codeActAgentId, 'api', 'code-act');
-                bridge.injectInto(sandbox, codeActTier, codeActRole);
-                const result = await sandbox.execute(code);
-                finalizeCodeActParentModelRun(getAdapter(), parentRun.modelRunId, result);
-                return {
-                    success: result.success,
-                    value: result.value,
-                    logs: result.logs,
-                    error: result.error?.message,
-                    metrics: result.metrics,
-                    toolCalls,
-                };
-            }
-            catch (error) {
-                failCodeActParentModelRun(getAdapter(), parentRun.modelRunId, error);
-                throw error;
-            }
-            finally {
-                toolExecutor.restoreCurrentAgentRoutingContext(previousRoutingContext);
+            executionContext = {
+                agentContext,
+                agentId: codeActAgentId,
+                source: 'watch',
+                channelId: 'api:code-act',
+                envelope,
+                executionSurface: 'code_act',
+            };
+        }
+        const parentRun = bindCodeActParentModelRun(getAdapter(), executionContext, {
+            inputSnapshotRef: `code-act:${instanceId}`,
+            inputRefs: {
+                tool: 'code_act',
+                source: 'api',
+                channel_id: 'api:code-act',
+                read_only: codeActReadOnly,
+            },
+        });
+        executionContext = parentRun.executionContext;
+        const bridge = new HostBridge(toolExecutor, new role_manager_js_1.RoleManager({ rolesConfig: config.roles ?? types_js_1.DEFAULT_ROLES }), executionContext);
+        const toolCalls = [];
+        bridge.onToolUse = (toolName, input, result) => {
+            if (result !== undefined) {
+                toolCalls.push({ name: toolName, input });
+                if (CODE_ACT_MUTATION_TOOLS.has(toolName)) {
+                    codeActLogger.warn('[CodeAct] mutation tool call', {
+                        toolName,
+                        success: Boolean(result.success),
+                        readOnly: codeActReadOnly,
+                        envelopeHash: executionContext?.envelope?.envelope_hash ?? null,
+                    });
+                }
             }
         };
-        // Pre-warm Code-Act WASM module for fast first execution
-        (async () => {
-            try {
-                const { CodeActSandbox } = await import('../../agent/code-act/index.js');
-                await CodeActSandbox.warmup();
-            }
-            catch (err) {
-                console.warn('[CodeAct] WASM warmup failed (non-fatal):', err);
-            }
-        })();
-    }
+        const previousRoutingContext = toolExecutor.getCurrentAgentRoutingContext();
+        try {
+            // Set default agent context for /api/code-act calls (Conductor, tiered sandbox).
+            // Per-request executionContext carries envelope data; this routing context is legacy fallback.
+            toolExecutor.setCurrentAgentContext(codeActAgentId, 'api', 'code-act');
+            bridge.injectInto(sandbox, codeActTier, codeActRole);
+            const result = await sandbox.execute(code);
+            finalizeCodeActParentModelRun(getAdapter(), parentRun.modelRunId, result);
+            return {
+                success: result.success,
+                value: result.value,
+                logs: result.logs,
+                error: result.error?.message,
+                metrics: result.metrics,
+                toolCalls,
+            };
+        }
+        catch (error) {
+            failCodeActParentModelRun(getAdapter(), parentRun.modelRunId, error);
+            throw error;
+        }
+        finally {
+            toolExecutor.restoreCurrentAgentRoutingContext(previousRoutingContext);
+        }
+    };
+    // Pre-warm Code-Act WASM module for fast first execution
+    (async () => {
+        try {
+            const { CodeActSandbox } = await import('../../agent/code-act/index.js');
+            await CodeActSandbox.warmup();
+        }
+        catch (err) {
+            console.warn('[CodeAct] WASM warmup failed (non-fatal):', err);
+        }
+    })();
     const graphHandler = (0, graph_api_js_1.createGraphHandler)(graphHandlerOptions);
     // Seed initial agent versions from config (version 1 for new agents)
     // initAgentTables is idempotent (CREATE IF NOT EXISTS) — safe to call before apiServer
@@ -675,134 +675,83 @@ async function runAgentLoop(config, options = {}) {
     toolExecutor.setValidationService(validationService);
     messageRouter.setValidationService(validationService);
     agentLoop.setValidationService(validationService);
-    {
-        // Ensure OS system agents exist in config (memory agent may be missing in older configs)
-        if (!config.multi_agent) {
-            config.multi_agent = (0, config_manager_js_1.getDefaultMultiAgentConfig)();
-        }
-        if (!config.multi_agent.agents) {
-            config.multi_agent.agents = {};
+    // Ensure current primary system agents exist in config. Legacy self-paced
+    // dashboard/wiki agents are opt-in and must not be backfilled here.
+    if (!config.multi_agent) {
+        config.multi_agent = (0, config_manager_js_1.getDefaultMultiAgentConfig)();
+    }
+    if (!config.multi_agent.agents) {
+        config.multi_agent.agents = {};
+    }
+    const osAgents = {
+        'os-agent': {
+            name: 'OS Agent',
+            display_name: '🖥️ OS Agent',
+            trigger_prefix: '!os',
+            persona_file: '~/.mama/personas/os-agent.md',
+            tier: 1,
+            backend: runtimeBackend,
+            model: config.agent.model,
+            can_delegate: true,
+            enabled: true,
+        },
+        memory: {
+            name: 'Memory Agent',
+            display_name: '🧠 Memory',
+            trigger_prefix: '!memory',
+            persona_file: '~/.mama/personas/memory.md',
+            tier: 3,
+            backend: runtimeBackend,
+            model: config.agent.model,
+            can_delegate: false,
+            enabled: true,
+        },
+    };
+    let osAgentsAdded = false;
+    for (const [id, cfg] of Object.entries(osAgents)) {
+        if (!config.multi_agent.agents[id]) {
+            config.multi_agent.agents[id] = cfg;
+            osAgentsAdded = true;
         }
-        const osAgents = {
-            'os-agent': {
-                name: 'OS Agent',
-                display_name: '🖥️ OS Agent',
-                trigger_prefix: '!os',
-                persona_file: '~/.mama/personas/os-agent.md',
-                tier: 1,
-                backend: runtimeBackend,
-                model: config.agent.model,
-                can_delegate: true,
-                enabled: true,
-            },
-            memory: {
-                name: 'Memory Agent',
-                display_name: '🧠 Memory',
-                trigger_prefix: '!memory',
-                persona_file: '~/.mama/personas/memory.md',
-                tier: 3,
-                backend: runtimeBackend,
-                model: config.agent.model,
-                can_delegate: false,
-                enabled: true,
-            },
-            'dashboard-agent': {
-                name: 'Dashboard Agent',
-                display_name: '📊 Dashboard',
-                trigger_prefix: '!dashboard',
-                persona_file: '~/.mama/personas/dashboard.md',
-                tier: 2,
-                backend: runtimeBackend,
-                model: config.agent.model,
-                can_delegate: false,
-                enabled: true,
-                useCodeAct: true,
-                tool_permissions: {
-                    allowed: ['Read', 'Grep', 'Glob', 'code_act'],
-                    blocked: ['Bash', 'Write', 'Edit', 'Agent', 'WebSearch', 'WebFetch'],
-                },
-                gateway_tool_permissions: {
-                    allowed: ['mama_search', 'context_compile', 'agent_notices', 'report_publish'],
-                    blocked: [],
-                },
-            },
-        };
-        const wikiConfig = config.wiki;
-        if (wikiConfig?.enabled) {
-            osAgents['wiki-agent'] = {
-                name: 'Wiki Agent',
-                display_name: '📚 Wiki',
-                trigger_prefix: '!wiki',
-                persona_file: '~/.mama/personas/wiki.md',
-                tier: 2,
-                backend: runtimeBackend,
-                model: config.agent.model,
-                can_delegate: false,
-                enabled: true,
-                useCodeAct: true,
-                tool_permissions: {
-                    allowed: ['Read', 'Grep', 'Glob', 'code_act'],
-                    blocked: ['Bash', 'Write', 'Edit', 'Agent', 'WebSearch', 'WebFetch'],
-                },
-                gateway_tool_permissions: {
-                    allowed: [
-                        'mama_search',
-                        'context_compile',
-                        'agent_notices',
-                        'case_list',
-                        'case_assemble',
-                        'obsidian',
-                        'wiki_publish',
-                    ],
-                    blocked: [],
-                },
-            };
+    }
+    // Persist to config.yaml so /api/agents sees them too
+    if (osAgentsAdded) {
+        try {
+            const { saveConfig } = await import('../config/config-manager.js');
+            await saveConfig(config);
+            console.log('✓ OS agents added to config.yaml');
         }
-        let osAgentsAdded = false;
-        for (const [id, cfg] of Object.entries(osAgents)) {
-            if (!config.multi_agent.agents[id]) {
-                config.multi_agent.agents[id] = cfg;
-                osAgentsAdded = true;
-            }
+        catch {
+            /* non-fatal — runtime config still has them */
         }
-        // Persist to config.yaml so /api/agents sees them too
-        if (osAgentsAdded) {
+    }
+    const agents = config.multi_agent.agents;
+    for (const [id, cfg] of Object.entries(agents)) {
+        if (!(0, agent_store_js_1.getLatestVersion)(db, id)) {
+            let personaText = null;
             try {
-                const { saveConfig } = await import('../config/config-manager.js');
-                await saveConfig(config);
-                console.log('✓ OS agents added to config.yaml');
+                const pPath = (0, config_manager_js_1.expandPath)(cfg.persona_file);
+                if ((0, node_fs_1.existsSync)(pPath))
+                    personaText = (0, node_fs_1.readFileSync)(pPath, 'utf-8');
             }
             catch {
-                /* non-fatal — runtime config still has them */
-            }
-        }
-        const agents = config.multi_agent.agents;
-        for (const [id, cfg] of Object.entries(agents)) {
-            if (!(0, agent_store_js_1.getLatestVersion)(db, id)) {
-                let personaText = null;
-                try {
-                    const pPath = (0, config_manager_js_1.expandPath)(cfg.persona_file);
-                    if ((0, node_fs_1.existsSync)(pPath))
-                        personaText = (0, node_fs_1.readFileSync)(pPath, 'utf-8');
-                }
-                catch {
-                    /* ignore */
-                }
-                (0, agent_store_js_1.createAgentVersion)(db, {
-                    agent_id: id,
-                    snapshot: { model: cfg.model, tier: cfg.tier, backend: cfg.backend },
-                    persona_text: personaText,
-                    change_note: 'Initial version (migrated from config.yaml)',
-                });
+                /* ignore */
             }
+            (0, agent_store_js_1.createAgentVersion)(db, {
+                agent_id: id,
+                snapshot: { model: cfg.model, tier: cfg.tier, backend: cfg.backend },
+                persona_text: personaText,
+                change_note: 'Initial version (migrated from config.yaml)',
+            });
         }
-        console.log(`✓ Agent versions seeded (${Object.keys(agents).length} agents)`);
     }
+    console.log(`✓ Agent versions seeded (${Object.keys(agents).length} agents)`);
     await (0, utilities_js_1.startEmbeddingServerIfAvailable)(messageRouter, sessionStore, graphHandler);
     // ── Phase 6: Cron Scheduler ───────────────────────────────────────────────
     const { scheduler, cronWorker, cronEmitter } = (0, scheduler_init_js_1.initCronScheduler)(config);
     // ── Phase 7: Gateways ────────────────────────────────────────────────────
-    const { discordGateway, slackGateway, telegramGateway, gateways } = await (0, gateway_init_js_1.initGateways)(config, messageRouter, toolExecutor, agentLoop, runtimeBackend, db);
+    const gatewayInit = await (0, gateway_init_js_1.initGateways)(config, messageRouter, toolExecutor, agentLoop, runtimeBackend, db);
+    const { discordGateway, slackGateway, telegramGateway, gateways } = gatewayInit;
     // ── Phase 8: Gateway Wiring ──────────────────────────────────────────────
     const { pluginLoader } = await (0, gateway_wiring_js_1.wireGateways)({
         config,
@@ -829,11 +778,14 @@ async function runAgentLoop(config, options = {}) {
     // If no Discord/Slack handler wired the delegate tool, create standalone
     // DelegationManager + AgentProcessManager so delegate() works from any path
     // (Viewer, Telegram, iMessage, Terminal).
-    const hasSystemRunAgents = Boolean(config.multi_agent?.agents?.['dashboard-agent'] || config.multi_agent?.agents?.['wiki-agent']);
-    if (!toolExecutor.getAgentProcessManager() &&
-        (config.multi_agent?.enabled || hasSystemRunAgents)) {
+    const fallbackMultiAgentConfig = config.multi_agent;
+    const hasSystemRunAgents = Boolean(fallbackMultiAgentConfig?.agents?.['dashboard-agent'] ||
+        fallbackMultiAgentConfig?.agents?.['wiki-agent']);
+    if (fallbackMultiAgentConfig &&
+        !toolExecutor.getAgentProcessManager() &&
+        (fallbackMultiAgentConfig.enabled || hasSystemRunAgents)) {
         const { AgentProcessManager } = await import('../../multi-agent/agent-process-manager.js');
-        const pm = new AgentProcessManager(config.multi_agent, buildSystemAgentProcessDefaults(config), {
+        const pm = new AgentProcessManager(fallbackMultiAgentConfig, buildSystemAgentProcessDefaults(config), {
             backend: runtimeBackend,
             model: config.agent.model,
         });
@@ -850,9 +802,9 @@ async function runAgentLoop(config, options = {}) {
         toolExecutor.setRestartMultiAgentAgent(graphHandlerOptions.restartMultiAgentAgent);
         agentLoop.setApplyMultiAgentConfig(graphHandlerOptions.applyMultiAgentConfig);
         agentLoop.setRestartMultiAgentAgent(graphHandlerOptions.restartMultiAgentAgent);
-        if (config.multi_agent?.enabled && !toolExecutor.hasDelegateSupport()) {
+        if (fallbackMultiAgentConfig.enabled && !toolExecutor.hasDelegateSupport()) {
             const { DelegationManager } = await import('../../multi-agent/delegation-manager.js');
-            const agentConfigs = Object.entries(config.multi_agent.agents || {}).map(([id, cfg]) => ({
+            const agentConfigs = Object.entries(fallbackMultiAgentConfig.agents || {}).map(([id, cfg]) => ({
                 id,
                 ...cfg,
             }));
@@ -875,7 +827,12 @@ async function runAgentLoop(config, options = {}) {
     }
     // ── Phase 9: Heartbeat + Connectors ──────────────────────────────────────
     const { heartbeatScheduler, tokenKeepAlive, healthWarningInterval } = (0, scheduler_init_js_1.initHeartbeat)(config, agentLoop, discordGateway, scheduler, healthCheckService);
-    const { rawStoreForApi, enabledConnectorNames, connectorSchedulerStop } = await (0, connector_init_js_1.initConnectors)(connectorExtractionFn);
+    // M2.4 freshness: the connector sink nudges the trigger loop when a poll indexes new rows. The
+    // loop is constructed AFTER initConnectors (below), so hand initConnectors a stable forwarder now
+    // and point it at the loop once it exists. Null until then -> nudge no-ops (no loop = nothing to
+    // wake), which preserves today's behavior when MAMA_TRIGGER_LOOP is unset.
+    const triggerLoopNudge = { current: null };
+    const { rawStoreForApi, enabledConnectorNames, connectorSchedulerStop } = await (0, connector_init_js_1.initConnectors)(connectorExtractionFn, { nudge: () => triggerLoopNudge.current?.() });
     codeActRawConnectors = resolveCodeActRawConnectors(enabledConnectorNames);
     // Inject rawStore into tool executor for agent_test connector data access
     if (rawStoreForApi) {
@@ -886,6 +843,151 @@ async function runAgentLoop(config, options = {}) {
     if (connectorSchedulerStop) {
         gateways.push({ stop: () => Promise.resolve(connectorSchedulerStop()) });
     }
+    // ── Trigger loop (M1, flag-gated, additive): agent-evolved triggers on the live stream ──
+    // Runs ONLY with MAMA_TRIGGER_LOOP=1. Placed after initConnectors (which feeds
+    // connector_event_index) and after mama-core initDB. Read-only: recall/surface/log.
+    if (process.env.MAMA_TRIGGER_LOOP === '1') {
+        // Component isolation (PR #119 review): a trigger-loop bootstrap failure (bad import,
+        // DB permission, registry constructor) must not abort the whole daemon before Phase
+        // 10/11 - the gateways/viewer/agent serve independently of this optional leg. The
+        // failure is still surfaced LOUDLY below (console.error), never swallowed silently.
+        try {
+            const { OperatorTriggerLoop } = await import('../../operator/operator-trigger-loop.js');
+            const { ConnectorDeltaRepo } = await import('../../operator/connector-delta-repo.js');
+            const { TriggerRegistry } = await import('../../operator/trigger-registry.js');
+            const { createMamaMemoryPort } = await import('../../operator/mama-memory-port.js');
+            const { askAgentCLI } = await import('../../operator/trigger-author.js');
+            const { reviewTriggerCLI } = await import('../../operator/trigger-review.js');
+            const { mkdirSync } = await import('node:fs');
+            const { dirname } = await import('node:path');
+            const { ReportScheduler, FileReportScheduleStore, parseReportHours } = await import('../../operator/report-scheduler.js');
+            const { createPersonaReportAsk, OPERATOR_REPORT_SESSION_KEY } = await import('../../operator/report-run.js');
+            const { OPERATOR_FULL_REPORT_TAG } = await import('../../operator/situation-report.js');
+            const { buildBoardPublishLines } = await import('../../operator/board-slot-instructions.js');
+            const triggerDbPath = (0, config_manager_js_1.expandPath)('~/.mama/operator/triggers.db');
+            mkdirSync(dirname(triggerDbPath), { recursive: true });
+            const triggerRegistry = new TriggerRegistry(new sqlite_js_1.default(triggerDbPath));
+            // Owner-report leg (M1.5): destination chat comes from env (~/.mama/start.sh),
+            // never source. No chat configured or no telegram gateway -> loop stays read-only.
+            const reportChatId = process.env.MAMA_TRIGGER_LOOP_REPORT_CHAT || '';
+            const reportOutput = reportChatId && telegramGateway
+                ? { send: (text) => telegramGateway.sendMessage(reportChatId, text) }
+                : undefined;
+            // Scheduled full-report leg (M2): local hours from env (~/.mama/start.sh), never source.
+            // Empty/absent -> [] -> leg off. Requires the same telegram sink as the digest leg.
+            const fullReportHours = parseReportHours(process.env.MAMA_TRIGGER_LOOP_FULL_REPORT_HOURS || '');
+            const reportScheduler = fullReportHours.length > 0 && reportOutput
+                ? new ReportScheduler(fullReportHours, new FileReportScheduleStore((0, config_manager_js_1.expandPath)('~/.mama/operator/report-schedule-state.json')))
+                : undefined;
+            const triggerLoop = new OperatorTriggerLoop({
+                delta: new ConnectorDeltaRepo(getAdapter(), (0, config_manager_js_1.expandPath)('~/.mama/operator/trigger-loop-cursors.json')),
+                memory: createMamaMemoryPort(),
+                registry: triggerRegistry,
+                askAgent: askAgentCLI,
+                // M2.2: reports go through the daemon's persona agent (system prompt, pinned model,
+                // session lanes) instead of the bare CLI - report tone comes from generation inputs.
+                // JSON tasks (authoring/review) stay on the bare CLI for reliable parsing.
+                // M3 (GAP1+GAP2): run reports in a dedicated persona session lane so the multi-turn gather
+                // loop is isolated from chat and continuous across cadences (runWithContent honors
+                // options.sessionKey - agent-loop.ts:879, no agent-loop internal change). Gateway
+                // 'model_tool' executions are envelope-gated (gateway-tool-executor.ts:252-256) and
+                // issuance defaults to 'enabled' (envelope-bootstrap.ts:28-30), so each report carries a
+                // per-run scoped envelope (mirrors the code-act issuance at start.ts:1834-1865); without it
+                // every call is denied with code 'envelope_missing'. Then audit the gateway tools the agent
+                // actually EXECUTED: a full report that executed NO gateway gather tool is logged loudly
+                // (no-fallback), and every write (mama_save) is logged (observability).
+                reportAsk: createPersonaReportAsk({
+                    issueEnvelope: envelopeBootstrap.envelopeAuthority && envelopeBootstrap.metadata.issuance !== 'off'
+                        ? async () => {
+                            const projectId = (0, reactive_config_js_1.resolveReactiveProjectRoot)(config, process.env);
+                            const wallSeconds = Math.min(Math.max(Math.floor((config.timeouts?.agent_ms ?? 300_000) / 1000), 1), 300);
+                            return envelopeBootstrap.envelopeAuthority.buildAndPersist({
+                                agent_id: 'operator-report',
+                                instance_id: (0, node_crypto_1.randomUUID)(),
+                                // 'operator' is not a member of EnvelopeSource (envelope/types.ts is a closed
+                                // union); 'watch' is the daemon-internal source used by the mirrored code-act
+                                // issuance (start.ts:1834-1865). This field is issuing-source metadata only -
+                                // enforcement authorizes on scope.memory_scopes (which cover the operator:report
+                                // run below), never on envelope.source (gateway-tool-executor.ts:1421,1511,1590).
+                                source: 'watch',
+                                channel_id: 'report',
+                                trigger_context: { user_text: '<operator scheduled report>' },
+                                scope: {
+                                    // Reads: the enabled raw connectors (kagemusha_* gathers) + memory scopes
+                                    // covering mama_recall/mama_save. allowed_destinations stays [] - NO new
+                                    // send surface (constraint 2).
+                                    project_refs: [{ kind: 'project', id: projectId }],
+                                    raw_connectors: codeActRawConnectors,
+                                    memory_scopes: resolveCodeActMemoryScopes((0, scope_context_js_1.deriveMemoryScopes)({ source: 'operator', channelId: 'report', projectId }), getAdapter()),
+                                    allowed_destinations: [],
+                                },
+                                tier: 2, // write tier: the report may mama_save (matches code-act write tier)
+                                budget: { wall_seconds: wallSeconds },
+                                expires_at: new Date(Date.now() + wallSeconds * 1000 + 30_000).toISOString(),
+                            });
+                        }
+                        : undefined,
+                    run: async (prompt, envelope) => {
+                        const result = await agentLoop.runWithContent([{ type: 'text', text: prompt }], {
+                            sessionKey: OPERATOR_REPORT_SESSION_KEY,
+                            source: 'operator',
+                            channelId: 'report',
+                            ...(envelope ? { envelope } : {}),
+                        });
+                        return { response: result.response, history: result.history };
+                    },
+                    log: (line) => console.log(line),
+                    fullReportTag: OPERATOR_FULL_REPORT_TAG,
+                }),
+                review: (trigger, context) => reviewTriggerCLI(trigger, context),
+                output: reportOutput,
+                reportScheduler,
+                // M2.3: the scheduled full report self-gathers via the persona agent's gateway tools
+                // (the Kagemusha lesson: a reporter with tools has substance; a window summary alone
+                // reports "quiet" whenever polling is between batches).
+                fullReportSelfGather: [
+                    'kagemusha_overview() for room/task/message counts',
+                    'kagemusha_tasks({}) for the open task board, plus kagemusha_tasks({ status: "review" }) for items awaiting review (status values must be real board statuses like pending/in_progress/review - invented labels match nothing)',
+                    'kagemusha_entities({ activeOnly: true }) for active channels, then kagemusha_messages({ channelId }) on the busiest 2-3 (since defaults to the last 7 days; pass an ISO-8601 timestamp like since: "2026-07-09T00:00:00Z" to narrow it - never a phrase like "24h ago")',
+                    'mama_recall(query) for memory relevant to what you find',
+                ],
+                // Kagemusha dual output: the same scheduled run updates the /ui operator board
+                // slots via report_publish, then writes the plain-text owner report.
+                fullReportBoardLines: buildBoardPublishLines(),
+                config: {
+                    tickMs: Number(process.env.MAMA_TRIGGER_LOOP_TICK_MS || 60_000),
+                    drainLimit: Number(process.env.MAMA_TRIGGER_LOOP_DRAIN_LIMIT || 200),
+                    authorEveryNTicks: Number(process.env.MAMA_TRIGGER_LOOP_AUTHOR_EVERY || 30),
+                    reviewEveryNTicks: Number(process.env.MAMA_TRIGGER_LOOP_REVIEW_EVERY || 240),
+                    authorWindowSize: 50,
+                    reportEveryNTicks: Number(process.env.MAMA_TRIGGER_LOOP_REPORT_EVERY || 15),
+                    nudgeDebounceMs: Number(process.env.MAMA_TRIGGER_LOOP_NUDGE_DEBOUNCE_MS || 15_000),
+                },
+                log: (line) => console.log(line),
+            });
+            if (reportOutput) {
+                console.log('✓ Trigger loop owner-report leg enabled (telegram)');
+            }
+            if (reportScheduler) {
+                console.log(`✓ Trigger loop scheduled full-report leg enabled (local hours: ${fullReportHours.join(', ')})`);
+            }
+            const stopTriggerLoop = triggerLoop.start();
+            // M2.4: point the connector sink's forwarder at this loop now that it exists.
+            triggerLoopNudge.current = () => triggerLoop.nudge();
+            gateways.push({
+                stop: async () => {
+                    triggerLoopNudge.current = null;
+                    stopTriggerLoop();
+                    // Close the operator triggers.db handle (PR #119 review: was leaked on shutdown).
+                    triggerRegistry.close();
+                },
+            });
+            console.log('✓ Trigger loop enabled (MAMA_TRIGGER_LOOP=1, read-only surface mode)');
+        }
+        catch (error) {
+            console.error('[trigger-loop] FAILED to start - daemon continues WITHOUT the trigger loop. Fix and restart:', error);
+        }
+    }
     // ── Phase 10: API Server + Routes ────────────────────────────────────────
     const { apiServer, eventBus } = await (0, api_server_init_js_1.initApiServer)({
         config,