@jungjaehoon/mama-os 0.24.1 → 0.25.0

package/dist/agent/gateway-tool-executor.js

@@ -74,6 +74,61 @@ const managed_agent_validation_js_1 = require("./managed-agent-validation.js");
 const delegation_executor_js_1 = require("./delegation-executor.js");
 const index_js_1 = require("../envelope/index.js");
 const wiki_publish_adapter_js_1 = require("../wiki-artifacts/wiki-publish-adapter.js");
+function serializeTaskToolRecord(task) {
+    return {
+        ...task,
+        due_at: task.dueAt === null ? null : new Date(task.dueAt).toISOString(),
+        deadline_offset_minutes: task.deadlineOffsetMinutes,
+        temporal_epoch: task.temporalEpoch,
+        temporal_reconciled_occurrence_key: task.temporalReconciledOccurrenceKey,
+        last_temporal_checked_at: task.lastTemporalCheckedAt,
+        next_temporal_check_at: task.nextTemporalCheckAt,
+        last_temporal_attempt_id: task.lastTemporalAttemptId,
+        temporal_state: task.temporalState,
+    };
+}
+function temporalContextPacketBinding(context) {
+    return `temporal:${context.taskId}:${context.generationKey}`;
+}
+function bindTemporalContextPacketTask(context, task) {
+    if (typeof task !== 'string' || task.trim().length === 0) {
+        const error = new Error('task is required.');
+        error.code = 'context_compile_input_invalid';
+        throw error;
+    }
+    return `${temporalContextPacketBinding(context)}\n${task}`;
+}
+function temporalIdentifierRef(value) {
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(value).digest('hex')}`;
+}
+function temporalPacketRawSourcesWithinBoundSource(context, sourceRefs) {
+    const rawRefs = sourceRefs.filter((value) => typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        value.kind === 'raw');
+    if (!context.sourceChannel) {
+        return rawRefs.length === 0;
+    }
+    return rawRefs.every((ref) => {
+        const eventMatches = !context.sourceEventId ||
+            [ref.raw_id, ref.source_id].some((value) => typeof value === 'string' && temporalIdentifierRef(value) === context.sourceEventId);
+        const channelMatches = !context.sourceChannel ||
+            (typeof ref.connector === 'string' &&
+                typeof ref.channel_id === 'string' &&
+                temporalIdentifierRef(`${ref.connector}:${ref.channel_id}`) === context.sourceChannel);
+        return eventMatches && channelMatches;
+    });
+}
+function temporalPacketReferencesBoundSource(context, sourceRefs) {
+    const hasRawReference = sourceRefs.some((value) => typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        value.kind === 'raw');
+    if (context.sourceEventId || context.sourceChannel) {
+        return hasRawReference && temporalPacketRawSourcesWithinBoundSource(context, sourceRefs);
+    }
+    return temporalPacketRawSourcesWithinBoundSource(context, sourceRefs);
+}
 const { DebugLogger } = debugLogger;
 const securityLogger = new DebugLogger('SecurityAudit');
 const TRUTHY_ENV_VALUES = new Set(['1', 'true', 'yes', 'on']);
@@ -114,6 +169,48 @@ const MEMORY_SCOPE_AUDIT_TOOLS = new Set([
     'mama_add',
     'mama_ingest',
 ]);
+const TEMPORAL_WRITE_TOOLS = new Set([
+    'mama_save',
+    'context_compile',
+    'mama_update',
+    'mama_add',
+    'mama_ingest',
+    'report_publish',
+    'report_request',
+    'workorder_request',
+    'wiki_publish',
+    'obsidian',
+    'task_create',
+    'task_update',
+    'contract_no_update',
+    'task_temporal_reconcile',
+    'Write',
+    'Bash',
+    'discord_send',
+    'slack_send',
+    'telegram_send',
+    'webchat_send',
+    'delegate',
+    'os_add_bot',
+    'os_set_permissions',
+    'os_set_model',
+    'os_restart_bot',
+    'os_stop_bot',
+    'agent_update',
+    'agent_create',
+    'viewer_navigate',
+    'viewer_notify',
+    'save_integration_token',
+    'browser_navigate',
+    'browser_screenshot',
+    'browser_click',
+    'browser_type',
+    'browser_scroll',
+    'browser_evaluate',
+    'browser_pdf',
+    'browser_close',
+    'agent_test',
+]);
 const MEMORY_READ_PERMISSION_BEFORE_ENVELOPE_TOOLS = new Set([
     'mama_save',
     'mama_search',
@@ -284,6 +381,7 @@ class GatewayToolExecutor {
     envelopeIssuanceMode;
     metricsStore;
     contextCompileService;
+    temporalContextPacketLookup;
     currentContext = null;
     memoryAgentProcessManager = null;
     agentProcessManager = null;
@@ -378,6 +476,8 @@ class GatewayToolExecutor {
             sourceMessageRef: executionContext?.sourceMessageRef,
             modelRunId: executionContext?.modelRunId ?? null,
             gatewayCallId: executionContext?.gatewayCallId,
+            workorderAttemptId: executionContext?.workorderAttemptId,
+            temporalWorkContext: executionContext?.temporalWorkContext,
             signal: executionContext?.signal,
             parentToolName: executionContext?.parentToolName,
             backgroundTasks: executionContext?.backgroundTasks,
@@ -412,6 +512,10 @@ class GatewayToolExecutor {
             sourceMessageRef: active.sourceMessageRef ?? fallback.sourceMessageRef,
             modelRunId: active.modelRunId ?? fallback.modelRunId,
             gatewayCallId: active.gatewayCallId ?? fallback.gatewayCallId,
+            // Never merged from fallback - attempt identity is issued for one claimed run only.
+            workorderAttemptId: active.workorderAttemptId,
+            // Never merged from fallback - temporal authority belongs to one claimed run only.
+            temporalWorkContext: active.temporalWorkContext,
             signal: active.signal,
             parentToolName: active.parentToolName ?? fallback.parentToolName,
             backgroundTasks: active.backgroundTasks ?? fallback.backgroundTasks,
@@ -448,6 +552,23 @@ class GatewayToolExecutor {
         const activeContext = this.normalizeExecutionContext(executionContext);
         return this.executionContextStorage.run(activeContext, fn);
     }
+    requireActiveTemporalAuthority(toolName) {
+        const context = this.getExecutionState().temporalWorkContext;
+        if (toolName === 'task_temporal_reconcile' && !context) {
+            throw new types_js_1.AgentError('task_temporal_reconcile requires an active host-issued temporal work context', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        if (!context)
+            return null;
+        if (!this.taskLedger) {
+            throw new types_js_1.AgentError('Temporal work authority cannot be checked because the task ledger is unavailable', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        try {
+            return this.taskLedger.assertTemporalWorkContextActive(context);
+        }
+        catch {
+            throw new types_js_1.AgentError('Temporal workorder authority is no longer active', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+    }
     setCurrentAgentContext(agentId, source, channelId) {
         this.currentAgentId = agentId;
         this.currentSource = source;
@@ -599,6 +720,20 @@ class GatewayToolExecutor {
         this.envelopeIssuanceMode = options.envelopeIssuanceMode ?? 'enabled';
         this.metricsStore = options.metricsStore ?? null;
         this.contextCompileService = options.contextCompileService;
+        this.temporalContextPacketLookup =
+            options.temporalContextPacketLookup ??
+                (async (input) => {
+                    const packet = (0, mama_core_1.getContextPacketForTrustedUse)(await getContextPacketLookupAdapter(), input);
+                    if (!packet)
+                        return null;
+                    return {
+                        packet_id: packet.packet_id,
+                        task: packet.task,
+                        packet_json: packet.packet_json,
+                        source_refs: packet.source_refs,
+                        created_at: packet.created_at,
+                    };
+                });
         this.wikiPublishAdapter = options.wikiPublishAdapter ?? null;
         this.browserTool = (0, browser_tool_js_1.getBrowserTool)({
             screenshotDir: (0, path_1.join)(process.env.HOME || '', '.mama', 'workspace', 'media', 'outbound'),
@@ -798,10 +933,8 @@ class GatewayToolExecutor {
                     this.logEnvelopeActivity(ctx, 'envelope_violation', toolName, err.message);
                     const denial = {
                         success: false,
-                        error: err.message,
+                        error: `[${err.code}] Envelope policy denied this tool call`,
                         code: err.code,
-                        envelope_hash: ctx.envelope.envelope_hash,
-                        ...err.metadata,
                     };
                     return denial;
                 }
@@ -893,43 +1026,79 @@ class GatewayToolExecutor {
         const gatewayCallId = baseCtx.gatewayCallId ?? `gw_${(0, crypto_1.randomUUID)().replace(/-/g, '')}`;
         const ctx = { ...baseCtx, gatewayCallId };
         const effectiveInput = this.applyEnvelopeScopedReadDefaults(toolName, input, ctx);
-        const scopeAudit = this.computeScopeAuditFields(toolName, effectiveInput, ctx);
+        const computedScopeAudit = this.computeScopeAuditFields(toolName, effectiveInput, ctx);
+        const scopeAudit = ctx.temporalWorkContext
+            ? {
+                requestedScopes: null,
+                envelopeScopesSnapshot: null,
+                mismatch: computedScopeAudit.mismatch,
+            }
+            : {
+                ...computedScopeAudit,
+                requestedScopes: digestRequestedScopesForAudit(computedScopeAudit.requestedScopes),
+            };
+        if (ctx.temporalWorkContext && TEMPORAL_WRITE_TOOLS.has(toolName)) {
+            await this.executionContextStorage.run(ctx, async () => {
+                this.requireActiveTemporalAuthority(toolName);
+            });
+        }
         const traceState = await this.beginTraceIfNeeded(ctx, gatewayCallId);
         const activeCtx = traceState ? { ...ctx, modelRunId: traceState.modelRunId } : ctx;
         let result;
+        let auditResult;
         try {
-            result = await this.executionContextStorage.run(activeCtx, () => this.executeWithEnvelopeAndPermissions(toolName, effectiveInput, gatewayCallId));
+            const rawResult = await this.executionContextStorage.run(activeCtx, () => this.executeWithEnvelopeAndPermissions(toolName, effectiveInput, gatewayCallId));
+            if (activeCtx.temporalWorkContext &&
+                toolName !== 'task_temporal_reconcile' &&
+                toolName !== 'code_act') {
+                await this.executionContextStorage.run(activeCtx, async () => {
+                    this.requireActiveTemporalAuthority(toolName);
+                });
+            }
+            const shouldSanitizeAuditFailure = Boolean(activeCtx.temporalWorkContext) ||
+                toolName === 'context_compile' ||
+                toolName === 'code_act';
+            auditResult = shouldSanitizeAuditFailure
+                ? sanitizeGatewayFailureResult(rawResult, Boolean(activeCtx.temporalWorkContext))
+                : rawResult;
+            result = activeCtx.temporalWorkContext ? auditResult : rawResult;
             activeCtx.signal?.throwIfAborted();
         }
         catch (error) {
-            await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, undefined, Date.now() - startedAt, gatewayCallId, error).catch((appendError) => {
+            const shouldSanitizeAuditFailure = Boolean(activeCtx.temporalWorkContext) ||
+                toolName === 'context_compile' ||
+                toolName === 'code_act';
+            const auditError = shouldSanitizeAuditFailure
+                ? sanitizeGatewayError(error, Boolean(activeCtx.temporalWorkContext))
+                : error;
+            await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, undefined, Date.now() - startedAt, gatewayCallId, auditError).catch((appendError) => {
                 securityLogger.warn('[model-run] failed to append failed tool trace before finalization', appendError);
             });
-            await this.failDirectModelRunIfNeeded(traceState, toolName, error).catch((finalizationError) => {
+            await this.failDirectModelRunIfNeeded(traceState, toolName, auditError).catch((finalizationError) => {
                 securityLogger.warn('[model-run] failed to finalize failed direct model run', finalizationError);
             });
-            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, error);
+            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, auditError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
-            throw error;
+            throw activeCtx.temporalWorkContext ? auditError : error;
         }
         try {
             try {
-                await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, result, Date.now() - startedAt, gatewayCallId);
+                await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, auditResult, Date.now() - startedAt, gatewayCallId);
             }
             finally {
-                await this.completeDirectModelRunIfNeeded(traceState, toolName, result);
+                await this.completeDirectModelRunIfNeeded(traceState, toolName, auditResult);
             }
         }
         catch (postRunError) {
-            this.logGatewayToolCall(activeCtx, toolName, result, Date.now() - startedAt, scopeAudit, gatewayCallId, postRunError);
+            this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, postRunError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
             throw postRunError;
         }
-        this.logGatewayToolCall(activeCtx, toolName, result, Date.now() - startedAt, scopeAudit, gatewayCallId);
+        this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId);
         if (scopeAudit.mismatch) {
             this.alarmScopeMismatch(activeCtx, toolName);
         }
@@ -1277,6 +1446,9 @@ class GatewayToolExecutor {
                     gateway_call_id: gatewayCallId,
                     ...(resultCode ? { code: resultCode } : {}),
                     ...(ctx?.parentToolName ? { parent: ctx.parentToolName } : {}),
+                    ...(ctx?.workorderAttemptId !== undefined
+                        ? { workorder_attempt_id: ctx.workorderAttemptId }
+                        : {}),
                 },
             });
         }
@@ -1337,6 +1509,7 @@ class GatewayToolExecutor {
                 };
             }
         }
+        this.requireActiveTemporalAuthority(toolName);
         const envelopeDenied = this.enforceEnvelopeForToolCall(toolName, input);
         if (envelopeDenied) {
             return envelopeDenied;
@@ -1752,6 +1925,14 @@ class GatewayToolExecutor {
                     if (!slotsInput || typeof slotsInput !== 'object') {
                         throw new types_js_1.AgentError('report_publish requires slots object', 'TOOL_ERROR', undefined, false);
                     }
+                    if (this.getExecutionState().temporalWorkContext) {
+                        const slotNames = Object.keys(slotsInput);
+                        if (slotNames.length !== 1 ||
+                            slotNames[0] !== 'pipeline' ||
+                            typeof slotsInput.pipeline !== 'string') {
+                            throw new types_js_1.AgentError('Temporal report_publish accepts exactly the host-derived pipeline slot', 'TOOL_ERROR', undefined, false);
+                        }
+                    }
                     // Stage-2 shadow seam: a per-run capture override takes precedence
                     // over the global singleton (capture runs never touch the live store).
                     const activePublisher = this.getExecutionState().reportPublisherOverride ?? this.reportPublisher;
@@ -1926,16 +2107,29 @@ class GatewayToolExecutor {
                     if (!this.taskLedger) {
                         return { success: false, error: 'Task ledger not configured' };
                     }
+                    const temporalContext = this.getExecutionState().temporalWorkContext;
+                    if (temporalContext) {
+                        const boundTask = this.taskLedger.getById(temporalContext.taskId);
+                        if (!boundTask) {
+                            throw new types_js_1.AgentError('Host-bound temporal owner task is unavailable', 'WORKORDER_SUPERSEDED', undefined, false);
+                        }
+                        return {
+                            success: true,
+                            tasks: [serializeTaskToolRecord(boundTask)],
+                        };
+                    }
                     const listInput = input;
                     return {
                         success: true,
-                        tasks: this.taskLedger.list({
+                        tasks: this.taskLedger
+                            .list({
                             status: listInput.status,
                             channel: listInput.channel,
                             search: listInput.search,
                             limit: listInput.limit,
                             order: listInput.order ?? 'deadline_priority',
-                        }),
+                        })
+                            .map(serializeTaskToolRecord),
                     };
                 }
                 case 'task_create': {
@@ -1944,7 +2138,7 @@ class GatewayToolExecutor {
                     }
                     return {
                         success: true,
-                        task: this.taskLedger.create(input),
+                        task: serializeTaskToolRecord(this.taskLedger.create(input)),
                     };
                 }
                 case 'task_update': {
@@ -1959,7 +2153,59 @@ class GatewayToolExecutor {
                     }
                     return {
                         success: true,
-                        task: this.taskLedger.update(id, patch),
+                        task: serializeTaskToolRecord(this.taskLedger.update(id, patch)),
+                    };
+                }
+                case 'task_temporal_reconcile': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    const context = this.getExecutionState().temporalWorkContext;
+                    if (!context) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile requires trusted temporal context', 'WORKORDER_SUPERSEDED', undefined, false);
+                    }
+                    const contextPacketId = input.context_packet_id;
+                    if (typeof contextPacketId !== 'string' || contextPacketId.trim().length === 0) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile requires a fresh context_packet_id', 'TOOL_ERROR', undefined, false);
+                    }
+                    const executionState = this.getExecutionState();
+                    if (!executionState.envelope || !executionState.modelRunId) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile evidence requires an active envelope and model run', 'TOOL_ERROR', undefined, false);
+                    }
+                    const packet = await this.temporalContextPacketLookup({
+                        packetId: contextPacketId,
+                        envelopeHash: executionState.envelope.envelope_hash,
+                        callerModelRunId: executionState.modelRunId,
+                    });
+                    if (!packet || packet.packet_id !== contextPacketId) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile context packet is unavailable', 'TOOL_ERROR', undefined, false);
+                    }
+                    const attempt = this.taskLedger.inspectTemporalAttempt(context.attemptId);
+                    if (!Number.isSafeInteger(packet.created_at) ||
+                        packet.created_at < attempt.workOrder.updatedAt) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile context packet predates the active attempt', 'TOOL_ERROR', undefined, false);
+                    }
+                    const effectInput = input;
+                    if (effectInput.outcome !== 'deferred' &&
+                        (!Array.isArray(packet.source_refs) || packet.source_refs.length === 0)) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile requires source-backed fresh evidence', 'TOOL_ERROR', undefined, false);
+                    }
+                    if (!packet.task.startsWith(`${temporalContextPacketBinding(context)}\n`) ||
+                        (effectInput.outcome === 'deferred'
+                            ? Array.isArray(packet.source_refs) &&
+                                packet.source_refs.length > 0 &&
+                                !temporalPacketReferencesBoundSource(context, packet.source_refs)
+                            : !temporalPacketReferencesBoundSource(context, packet.source_refs))) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile context packet is not bound to the active task source', 'TOOL_ERROR', undefined, false);
+                    }
+                    const evidence = {
+                        contextPacketId,
+                        contextPacketSha256: (0, crypto_1.createHash)('sha256').update(packet.packet_json).digest('hex'),
+                    };
+                    const { context_packet_id: _contextPacketId, ...trustedEffectInput } = effectInput;
+                    return {
+                        success: true,
+                        receipt: this.taskLedger.applyTemporalEffect(context, trustedEffectInput, evidence),
                     };
                 }
                 case 'schedule_upcoming': {
@@ -3423,13 +3669,26 @@ class GatewayToolExecutor {
             };
         }
         try {
+            const temporalContext = ctx.temporalWorkContext;
+            const effectiveInput = temporalContext
+                ? { ...input, task: bindTemporalContextPacketTask(temporalContext, input.task) }
+                : input;
             const result = await this.contextCompileService.compileAndPersistContext({
                 caller: 'gateway',
                 envelope: ctx.envelope,
                 modelRunId: ctx.modelRunId ?? null,
-                input,
+                input: effectiveInput,
                 signal: ctx.signal,
+                beforePersist: temporalContext
+                    ? () => {
+                        this.requireActiveTemporalAuthority('context_compile');
+                    }
+                    : undefined,
             });
+            if (temporalContext &&
+                !temporalPacketRawSourcesWithinBoundSource(temporalContext, result.packet.source_refs)) {
+                throw new Error('context_compile packet exceeds the active temporal task source');
+            }
             return {
                 success: true,
                 packet: result.packet,
@@ -3565,6 +3824,15 @@ function isMemoryScope(value) {
 function memoryScopeKey(scope) {
     return `${scope.kind}:${scope.id}`;
 }
+function digestRequestedScopesForAudit(scopes) {
+    if (!scopes) {
+        return null;
+    }
+    return scopes.map((scope) => ({
+        kind: scope.kind,
+        id: `sha256:${(0, crypto_1.createHash)('sha256').update(scope.id).digest('hex')}`,
+    }));
+}
 function getFailureMessage(result) {
     if (!result || result.success !== false) {
         return undefined;
@@ -3573,4 +3841,30 @@ function getFailureMessage(result) {
     const message = record.error ?? record.message ?? 'Tool returned success:false';
     return String(message);
 }
+function gatewayFailureRef(value, temporal) {
+    const digest = (0, crypto_1.createHash)('sha256').update(value).digest('hex');
+    const label = temporal ? 'temporal_tool_failed' : 'gateway_tool_failed';
+    return `${label};sha256=${digest};length=${value.length}`;
+}
+function sanitizeGatewayFailureResult(result, temporal) {
+    const failure = getFailureMessage(result);
+    if (!failure) {
+        return result;
+    }
+    const record = result;
+    return {
+        success: false,
+        error: gatewayFailureRef(failure, temporal),
+        ...(typeof record.code === 'string' ? { code: record.code } : {}),
+    };
+}
+function sanitizeGatewayError(error, temporal) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (error instanceof types_js_1.AgentError) {
+        return new types_js_1.AgentError(error.code === 'WORKORDER_SUPERSEDED'
+            ? 'Temporal workorder authority is no longer active'
+            : gatewayFailureRef(message, temporal), error.code, undefined, error.retryable);
+    }
+    return new Error(gatewayFailureRef(message, temporal));
+}
 //# sourceMappingURL=gateway-tool-executor.js.map