@jungjaehoon/mama-os 0.24.2 → 0.26.0

package/dist/agent/gateway-tool-executor.js

@@ -61,6 +61,8 @@ const mama_core_1 = require("@jungjaehoon/mama-core");
 const security_monitor_js_1 = require("../security/security-monitor.js");
 const secret_filter_js_1 = require("../memory/secret-filter.js");
 const scope_context_js_1 = require("../memory/scope-context.js");
+const drive_tools_js_1 = require("./drive-tools.js");
+const untrusted_content_js_1 = require("../utils/untrusted-content.js");
 const types_js_1 = require("./types.js");
 const sqlite_js_1 = __importDefault(require("../sqlite.js"));
 const mama_tool_handlers_js_1 = require("./mama-tool-handlers.js");
@@ -74,6 +76,61 @@ const managed_agent_validation_js_1 = require("./managed-agent-validation.js");
 const delegation_executor_js_1 = require("./delegation-executor.js");
 const index_js_1 = require("../envelope/index.js");
 const wiki_publish_adapter_js_1 = require("../wiki-artifacts/wiki-publish-adapter.js");
+function serializeTaskToolRecord(task) {
+    return {
+        ...task,
+        due_at: task.dueAt === null ? null : new Date(task.dueAt).toISOString(),
+        deadline_offset_minutes: task.deadlineOffsetMinutes,
+        temporal_epoch: task.temporalEpoch,
+        temporal_reconciled_occurrence_key: task.temporalReconciledOccurrenceKey,
+        last_temporal_checked_at: task.lastTemporalCheckedAt,
+        next_temporal_check_at: task.nextTemporalCheckAt,
+        last_temporal_attempt_id: task.lastTemporalAttemptId,
+        temporal_state: task.temporalState,
+    };
+}
+function temporalContextPacketBinding(context) {
+    return `temporal:${context.taskId}:${context.generationKey}`;
+}
+function bindTemporalContextPacketTask(context, task) {
+    if (typeof task !== 'string' || task.trim().length === 0) {
+        const error = new Error('task is required.');
+        error.code = 'context_compile_input_invalid';
+        throw error;
+    }
+    return `${temporalContextPacketBinding(context)}\n${task}`;
+}
+function temporalIdentifierRef(value) {
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(value).digest('hex')}`;
+}
+function temporalPacketRawSourcesWithinBoundSource(context, sourceRefs) {
+    const rawRefs = sourceRefs.filter((value) => typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        value.kind === 'raw');
+    if (!context.sourceChannel) {
+        return rawRefs.length === 0;
+    }
+    return rawRefs.every((ref) => {
+        const eventMatches = !context.sourceEventId ||
+            [ref.raw_id, ref.source_id].some((value) => typeof value === 'string' && temporalIdentifierRef(value) === context.sourceEventId);
+        const channelMatches = !context.sourceChannel ||
+            (typeof ref.connector === 'string' &&
+                typeof ref.channel_id === 'string' &&
+                temporalIdentifierRef(`${ref.connector}:${ref.channel_id}`) === context.sourceChannel);
+        return eventMatches && channelMatches;
+    });
+}
+function temporalPacketReferencesBoundSource(context, sourceRefs) {
+    const hasRawReference = sourceRefs.some((value) => typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        value.kind === 'raw');
+    if (context.sourceEventId || context.sourceChannel) {
+        return hasRawReference && temporalPacketRawSourcesWithinBoundSource(context, sourceRefs);
+    }
+    return temporalPacketRawSourcesWithinBoundSource(context, sourceRefs);
+}
 const { DebugLogger } = debugLogger;
 const securityLogger = new DebugLogger('SecurityAudit');
 const TRUTHY_ENV_VALUES = new Set(['1', 'true', 'yes', 'on']);
@@ -114,6 +171,48 @@ const MEMORY_SCOPE_AUDIT_TOOLS = new Set([
     'mama_add',
     'mama_ingest',
 ]);
+const TEMPORAL_WRITE_TOOLS = new Set([
+    'mama_save',
+    'context_compile',
+    'mama_update',
+    'mama_add',
+    'mama_ingest',
+    'report_publish',
+    'report_request',
+    'workorder_request',
+    'wiki_publish',
+    'obsidian',
+    'task_create',
+    'task_update',
+    'contract_no_update',
+    'task_temporal_reconcile',
+    'Write',
+    'Bash',
+    'discord_send',
+    'slack_send',
+    'telegram_send',
+    'webchat_send',
+    'delegate',
+    'os_add_bot',
+    'os_set_permissions',
+    'os_set_model',
+    'os_restart_bot',
+    'os_stop_bot',
+    'agent_update',
+    'agent_create',
+    'viewer_navigate',
+    'viewer_notify',
+    'save_integration_token',
+    'browser_navigate',
+    'browser_screenshot',
+    'browser_click',
+    'browser_type',
+    'browser_scroll',
+    'browser_evaluate',
+    'browser_pdf',
+    'browser_close',
+    'agent_test',
+]);
 const MEMORY_READ_PERMISSION_BEFORE_ENVELOPE_TOOLS = new Set([
     'mama_save',
     'mama_search',
@@ -271,6 +370,7 @@ const VALID_TOOLS = tool_registry_js_1.ToolRegistry.getValidToolNames();
 const SENSITIVE_KEYS = ['token', 'bot_token', 'app_token', 'api_token', 'api_key', 'secret'];
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 class GatewayToolExecutor {
+    driveTools = new drive_tools_js_1.DriveToolService();
     mamaApi = null;
     mamaDbPath;
     sessionStore;
@@ -284,6 +384,7 @@ class GatewayToolExecutor {
     envelopeIssuanceMode;
     metricsStore;
     contextCompileService;
+    temporalContextPacketLookup;
     currentContext = null;
     memoryAgentProcessManager = null;
     agentProcessManager = null;
@@ -378,6 +479,8 @@ class GatewayToolExecutor {
             sourceMessageRef: executionContext?.sourceMessageRef,
             modelRunId: executionContext?.modelRunId ?? null,
             gatewayCallId: executionContext?.gatewayCallId,
+            workorderAttemptId: executionContext?.workorderAttemptId,
+            temporalWorkContext: executionContext?.temporalWorkContext,
             signal: executionContext?.signal,
             parentToolName: executionContext?.parentToolName,
             backgroundTasks: executionContext?.backgroundTasks,
@@ -412,6 +515,10 @@ class GatewayToolExecutor {
             sourceMessageRef: active.sourceMessageRef ?? fallback.sourceMessageRef,
             modelRunId: active.modelRunId ?? fallback.modelRunId,
             gatewayCallId: active.gatewayCallId ?? fallback.gatewayCallId,
+            // Never merged from fallback - attempt identity is issued for one claimed run only.
+            workorderAttemptId: active.workorderAttemptId,
+            // Never merged from fallback - temporal authority belongs to one claimed run only.
+            temporalWorkContext: active.temporalWorkContext,
             signal: active.signal,
             parentToolName: active.parentToolName ?? fallback.parentToolName,
             backgroundTasks: active.backgroundTasks ?? fallback.backgroundTasks,
@@ -448,6 +555,23 @@ class GatewayToolExecutor {
         const activeContext = this.normalizeExecutionContext(executionContext);
         return this.executionContextStorage.run(activeContext, fn);
     }
+    requireActiveTemporalAuthority(toolName) {
+        const context = this.getExecutionState().temporalWorkContext;
+        if (toolName === 'task_temporal_reconcile' && !context) {
+            throw new types_js_1.AgentError('task_temporal_reconcile requires an active host-issued temporal work context', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        if (!context)
+            return null;
+        if (!this.taskLedger) {
+            throw new types_js_1.AgentError('Temporal work authority cannot be checked because the task ledger is unavailable', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        try {
+            return this.taskLedger.assertTemporalWorkContextActive(context);
+        }
+        catch {
+            throw new types_js_1.AgentError('Temporal workorder authority is no longer active', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+    }
     setCurrentAgentContext(agentId, source, channelId) {
         this.currentAgentId = agentId;
         this.currentSource = source;
@@ -599,6 +723,20 @@ class GatewayToolExecutor {
         this.envelopeIssuanceMode = options.envelopeIssuanceMode ?? 'enabled';
         this.metricsStore = options.metricsStore ?? null;
         this.contextCompileService = options.contextCompileService;
+        this.temporalContextPacketLookup =
+            options.temporalContextPacketLookup ??
+                (async (input) => {
+                    const packet = (0, mama_core_1.getContextPacketForTrustedUse)(await getContextPacketLookupAdapter(), input);
+                    if (!packet)
+                        return null;
+                    return {
+                        packet_id: packet.packet_id,
+                        task: packet.task,
+                        packet_json: packet.packet_json,
+                        source_refs: packet.source_refs,
+                        created_at: packet.created_at,
+                    };
+                });
         this.wikiPublishAdapter = options.wikiPublishAdapter ?? null;
         this.browserTool = (0, browser_tool_js_1.getBrowserTool)({
             screenshotDir: (0, path_1.join)(process.env.HOME || '', '.mama', 'workspace', 'media', 'outbound'),
@@ -798,10 +936,8 @@ class GatewayToolExecutor {
                     this.logEnvelopeActivity(ctx, 'envelope_violation', toolName, err.message);
                     const denial = {
                         success: false,
-                        error: err.message,
+                        error: `[${err.code}] Envelope policy denied this tool call`,
                         code: err.code,
-                        envelope_hash: ctx.envelope.envelope_hash,
-                        ...err.metadata,
                     };
                     return denial;
                 }
@@ -893,43 +1029,79 @@ class GatewayToolExecutor {
         const gatewayCallId = baseCtx.gatewayCallId ?? `gw_${(0, crypto_1.randomUUID)().replace(/-/g, '')}`;
         const ctx = { ...baseCtx, gatewayCallId };
         const effectiveInput = this.applyEnvelopeScopedReadDefaults(toolName, input, ctx);
-        const scopeAudit = this.computeScopeAuditFields(toolName, effectiveInput, ctx);
+        const computedScopeAudit = this.computeScopeAuditFields(toolName, effectiveInput, ctx);
+        const scopeAudit = ctx.temporalWorkContext
+            ? {
+                requestedScopes: null,
+                envelopeScopesSnapshot: null,
+                mismatch: computedScopeAudit.mismatch,
+            }
+            : {
+                ...computedScopeAudit,
+                requestedScopes: digestRequestedScopesForAudit(computedScopeAudit.requestedScopes),
+            };
+        if (ctx.temporalWorkContext && TEMPORAL_WRITE_TOOLS.has(toolName)) {
+            await this.executionContextStorage.run(ctx, async () => {
+                this.requireActiveTemporalAuthority(toolName);
+            });
+        }
         const traceState = await this.beginTraceIfNeeded(ctx, gatewayCallId);
         const activeCtx = traceState ? { ...ctx, modelRunId: traceState.modelRunId } : ctx;
         let result;
+        let auditResult;
         try {
-            result = await this.executionContextStorage.run(activeCtx, () => this.executeWithEnvelopeAndPermissions(toolName, effectiveInput, gatewayCallId));
+            const rawResult = await this.executionContextStorage.run(activeCtx, () => this.executeWithEnvelopeAndPermissions(toolName, effectiveInput, gatewayCallId));
+            if (activeCtx.temporalWorkContext &&
+                toolName !== 'task_temporal_reconcile' &&
+                toolName !== 'code_act') {
+                await this.executionContextStorage.run(activeCtx, async () => {
+                    this.requireActiveTemporalAuthority(toolName);
+                });
+            }
+            const shouldSanitizeAuditFailure = Boolean(activeCtx.temporalWorkContext) ||
+                toolName === 'context_compile' ||
+                toolName === 'code_act';
+            auditResult = shouldSanitizeAuditFailure
+                ? sanitizeGatewayFailureResult(rawResult, Boolean(activeCtx.temporalWorkContext))
+                : rawResult;
+            result = activeCtx.temporalWorkContext ? auditResult : rawResult;
             activeCtx.signal?.throwIfAborted();
         }
         catch (error) {
-            await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, undefined, Date.now() - startedAt, gatewayCallId, error).catch((appendError) => {
+            const shouldSanitizeAuditFailure = Boolean(activeCtx.temporalWorkContext) ||
+                toolName === 'context_compile' ||
+                toolName === 'code_act';
+            const auditError = shouldSanitizeAuditFailure
+                ? sanitizeGatewayError(error, Boolean(activeCtx.temporalWorkContext))
+                : error;
+            await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, undefined, Date.now() - startedAt, gatewayCallId, auditError).catch((appendError) => {
                 securityLogger.warn('[model-run] failed to append failed tool trace before finalization', appendError);
             });
-            await this.failDirectModelRunIfNeeded(traceState, toolName, error).catch((finalizationError) => {
+            await this.failDirectModelRunIfNeeded(traceState, toolName, auditError).catch((finalizationError) => {
                 securityLogger.warn('[model-run] failed to finalize failed direct model run', finalizationError);
             });
-            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, error);
+            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, auditError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
-            throw error;
+            throw activeCtx.temporalWorkContext ? auditError : error;
         }
         try {
             try {
-                await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, result, Date.now() - startedAt, gatewayCallId);
+                await this.appendToolTraceIfNeeded(traceState, activeCtx, toolName, auditResult, Date.now() - startedAt, gatewayCallId);
             }
             finally {
-                await this.completeDirectModelRunIfNeeded(traceState, toolName, result);
+                await this.completeDirectModelRunIfNeeded(traceState, toolName, auditResult);
             }
         }
         catch (postRunError) {
-            this.logGatewayToolCall(activeCtx, toolName, result, Date.now() - startedAt, scopeAudit, gatewayCallId, postRunError);
+            this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, postRunError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
             throw postRunError;
         }
-        this.logGatewayToolCall(activeCtx, toolName, result, Date.now() - startedAt, scopeAudit, gatewayCallId);
+        this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId);
         if (scopeAudit.mismatch) {
             this.alarmScopeMismatch(activeCtx, toolName);
         }
@@ -1277,6 +1449,9 @@ class GatewayToolExecutor {
                     gateway_call_id: gatewayCallId,
                     ...(resultCode ? { code: resultCode } : {}),
                     ...(ctx?.parentToolName ? { parent: ctx.parentToolName } : {}),
+                    ...(ctx?.workorderAttemptId !== undefined
+                        ? { workorder_attempt_id: ctx.workorderAttemptId }
+                        : {}),
                 },
             });
         }
@@ -1317,6 +1492,13 @@ class GatewayToolExecutor {
         if (!VALID_TOOLS.includes(toolName)) {
             throw new types_js_1.AgentError(`Unknown tool: ${toolName}. Valid tools: ${VALID_TOOLS.join(', ')}`, 'UNKNOWN_TOOL', undefined, false);
         }
+        if (toolName.startsWith('drive_') &&
+            this.getExecutionState().agentContext?.roleName !== 'owner_console') {
+            return {
+                success: false,
+                error: 'Permission denied: Google Drive tools are restricted to owner_console.',
+            };
+        }
         // Structurally disallowed tools are per-call policy carried by the execution
         // context (a shared executor serves many agents with different blocks).
         const activeDisallowed = this.getExecutionState()?.disallowedGatewayTools;
@@ -1337,6 +1519,7 @@ class GatewayToolExecutor {
                 };
             }
         }
+        this.requireActiveTemporalAuthority(toolName);
         const envelopeDenied = this.enforceEnvelopeForToolCall(toolName, input);
         if (envelopeDenied) {
             return envelopeDenied;
@@ -1365,6 +1548,31 @@ class GatewayToolExecutor {
                     return await this.executeSlackSend(input);
                 case 'telegram_send':
                     return await this.executeTelegramSend(input);
+                case 'drive_list_drives':
+                    return {
+                        success: true,
+                        result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.listDrives()),
+                    };
+                case 'drive_browse':
+                    return {
+                        success: true,
+                        result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.browse(input)),
+                    };
+                case 'drive_find_folder':
+                    return {
+                        success: true,
+                        result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.findFolder(input)),
+                    };
+                case 'drive_download':
+                    return {
+                        success: true,
+                        result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.download(input)),
+                    };
+                case 'drive_upload':
+                    return {
+                        success: true,
+                        result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.upload(input)),
+                    };
                 // Browser tools
                 case 'browser_navigate':
                     return await this.executeBrowserNavigate(input);
@@ -1752,6 +1960,14 @@ class GatewayToolExecutor {
                     if (!slotsInput || typeof slotsInput !== 'object') {
                         throw new types_js_1.AgentError('report_publish requires slots object', 'TOOL_ERROR', undefined, false);
                     }
+                    if (this.getExecutionState().temporalWorkContext) {
+                        const slotNames = Object.keys(slotsInput);
+                        if (slotNames.length !== 1 ||
+                            slotNames[0] !== 'pipeline' ||
+                            typeof slotsInput.pipeline !== 'string') {
+                            throw new types_js_1.AgentError('Temporal report_publish accepts exactly the host-derived pipeline slot', 'TOOL_ERROR', undefined, false);
+                        }
+                    }
                     // Stage-2 shadow seam: a per-run capture override takes precedence
                     // over the global singleton (capture runs never touch the live store).
                     const activePublisher = this.getExecutionState().reportPublisherOverride ?? this.reportPublisher;
@@ -1926,16 +2142,29 @@ class GatewayToolExecutor {
                     if (!this.taskLedger) {
                         return { success: false, error: 'Task ledger not configured' };
                     }
+                    const temporalContext = this.getExecutionState().temporalWorkContext;
+                    if (temporalContext) {
+                        const boundTask = this.taskLedger.getById(temporalContext.taskId);
+                        if (!boundTask) {
+                            throw new types_js_1.AgentError('Host-bound temporal owner task is unavailable', 'WORKORDER_SUPERSEDED', undefined, false);
+                        }
+                        return {
+                            success: true,
+                            tasks: [serializeTaskToolRecord(boundTask)],
+                        };
+                    }
                     const listInput = input;
                     return {
                         success: true,
-                        tasks: this.taskLedger.list({
+                        tasks: this.taskLedger
+                            .list({
                             status: listInput.status,
                             channel: listInput.channel,
                             search: listInput.search,
                             limit: listInput.limit,
                             order: listInput.order ?? 'deadline_priority',
-                        }),
+                        })
+                            .map(serializeTaskToolRecord),
                     };
                 }
                 case 'task_create': {
@@ -1944,7 +2173,7 @@ class GatewayToolExecutor {
                     }
                     return {
                         success: true,
-                        task: this.taskLedger.create(input),
+                        task: serializeTaskToolRecord(this.taskLedger.create(input)),
                     };
                 }
                 case 'task_update': {
@@ -1959,7 +2188,59 @@ class GatewayToolExecutor {
                     }
                     return {
                         success: true,
-                        task: this.taskLedger.update(id, patch),
+                        task: serializeTaskToolRecord(this.taskLedger.update(id, patch)),
+                    };
+                }
+                case 'task_temporal_reconcile': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    const context = this.getExecutionState().temporalWorkContext;
+                    if (!context) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile requires trusted temporal context', 'WORKORDER_SUPERSEDED', undefined, false);
+                    }
+                    const contextPacketId = input.context_packet_id;
+                    if (typeof contextPacketId !== 'string' || contextPacketId.trim().length === 0) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile requires a fresh context_packet_id', 'TOOL_ERROR', undefined, false);
+                    }
+                    const executionState = this.getExecutionState();
+                    if (!executionState.envelope || !executionState.modelRunId) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile evidence requires an active envelope and model run', 'TOOL_ERROR', undefined, false);
+                    }
+                    const packet = await this.temporalContextPacketLookup({
+                        packetId: contextPacketId,
+                        envelopeHash: executionState.envelope.envelope_hash,
+                        callerModelRunId: executionState.modelRunId,
+                    });
+                    if (!packet || packet.packet_id !== contextPacketId) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile context packet is unavailable', 'TOOL_ERROR', undefined, false);
+                    }
+                    const attempt = this.taskLedger.inspectTemporalAttempt(context.attemptId);
+                    if (!Number.isSafeInteger(packet.created_at) ||
+                        packet.created_at < attempt.workOrder.updatedAt) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile context packet predates the active attempt', 'TOOL_ERROR', undefined, false);
+                    }
+                    const effectInput = input;
+                    if (effectInput.outcome !== 'deferred' &&
+                        (!Array.isArray(packet.source_refs) || packet.source_refs.length === 0)) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile requires source-backed fresh evidence', 'TOOL_ERROR', undefined, false);
+                    }
+                    if (!packet.task.startsWith(`${temporalContextPacketBinding(context)}\n`) ||
+                        (effectInput.outcome === 'deferred'
+                            ? Array.isArray(packet.source_refs) &&
+                                packet.source_refs.length > 0 &&
+                                !temporalPacketReferencesBoundSource(context, packet.source_refs)
+                            : !temporalPacketReferencesBoundSource(context, packet.source_refs))) {
+                        throw new types_js_1.AgentError('task_temporal_reconcile context packet is not bound to the active task source', 'TOOL_ERROR', undefined, false);
+                    }
+                    const evidence = {
+                        contextPacketId,
+                        contextPacketSha256: (0, crypto_1.createHash)('sha256').update(packet.packet_json).digest('hex'),
+                    };
+                    const { context_packet_id: _contextPacketId, ...trustedEffectInput } = effectInput;
+                    return {
+                        success: true,
+                        receipt: this.taskLedger.applyTemporalEffect(context, trustedEffectInput, evidence),
                     };
                 }
                 case 'schedule_upcoming': {
@@ -3229,6 +3510,7 @@ class GatewayToolExecutor {
         try {
             policy = projectCodeActToolPolicy({
                 tier,
+                roleName: state.agentContext?.roleName,
                 role: state.agentContext?.role,
                 disallowedTools: state.disallowedGatewayTools,
                 requestedAllowedTools: input.allowedTools,
@@ -3251,12 +3533,25 @@ class GatewayToolExecutor {
             parentToolName: 'code_act',
         };
         const bridge = new HostBridge(this, this.roleManager, nestedExecutionContext);
+        let usedUntrustedDriveEvidence = false;
+        bridge.onToolUse = (toolName, _toolInput, result) => {
+            if (result !== undefined && toolName.startsWith('drive_') && toolName !== 'drive_upload') {
+                usedUntrustedDriveEvidence = true;
+            }
+        };
         bridge.injectInto(sandbox, policy.names);
         const result = await sandbox.execute(input.code);
+        const successfulMessage = JSON.stringify({
+            value: result.value,
+            logs: result.logs,
+            metrics: result.metrics,
+        });
         return {
             success: result.success,
             message: result.success
-                ? JSON.stringify({ value: result.value, logs: result.logs, metrics: result.metrics })
+                ? usedUntrustedDriveEvidence
+                    ? (0, untrusted_content_js_1.wrapUntrustedContent)('google-drive-code-act', successfulMessage)
+                    : successfulMessage
                 : `Code-Act error: ${result.error?.message || 'Unknown error'}`,
         };
     }
@@ -3423,13 +3718,26 @@ class GatewayToolExecutor {
             };
         }
         try {
+            const temporalContext = ctx.temporalWorkContext;
+            const effectiveInput = temporalContext
+                ? { ...input, task: bindTemporalContextPacketTask(temporalContext, input.task) }
+                : input;
             const result = await this.contextCompileService.compileAndPersistContext({
                 caller: 'gateway',
                 envelope: ctx.envelope,
                 modelRunId: ctx.modelRunId ?? null,
-                input,
+                input: effectiveInput,
                 signal: ctx.signal,
+                beforePersist: temporalContext
+                    ? () => {
+                        this.requireActiveTemporalAuthority('context_compile');
+                    }
+                    : undefined,
             });
+            if (temporalContext &&
+                !temporalPacketRawSourcesWithinBoundSource(temporalContext, result.packet.source_refs)) {
+                throw new Error('context_compile packet exceeds the active temporal task source');
+            }
             return {
                 success: true,
                 packet: result.packet,
@@ -3565,6 +3873,15 @@ function isMemoryScope(value) {
 function memoryScopeKey(scope) {
     return `${scope.kind}:${scope.id}`;
 }
+function digestRequestedScopesForAudit(scopes) {
+    if (!scopes) {
+        return null;
+    }
+    return scopes.map((scope) => ({
+        kind: scope.kind,
+        id: `sha256:${(0, crypto_1.createHash)('sha256').update(scope.id).digest('hex')}`,
+    }));
+}
 function getFailureMessage(result) {
     if (!result || result.success !== false) {
         return undefined;
@@ -3573,4 +3890,30 @@ function getFailureMessage(result) {
     const message = record.error ?? record.message ?? 'Tool returned success:false';
     return String(message);
 }
+function gatewayFailureRef(value, temporal) {
+    const digest = (0, crypto_1.createHash)('sha256').update(value).digest('hex');
+    const label = temporal ? 'temporal_tool_failed' : 'gateway_tool_failed';
+    return `${label};sha256=${digest};length=${value.length}`;
+}
+function sanitizeGatewayFailureResult(result, temporal) {
+    const failure = getFailureMessage(result);
+    if (!failure) {
+        return result;
+    }
+    const record = result;
+    return {
+        success: false,
+        error: gatewayFailureRef(failure, temporal),
+        ...(typeof record.code === 'string' ? { code: record.code } : {}),
+    };
+}
+function sanitizeGatewayError(error, temporal) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (error instanceof types_js_1.AgentError) {
+        return new types_js_1.AgentError(error.code === 'WORKORDER_SUPERSEDED'
+            ? 'Temporal workorder authority is no longer active'
+            : gatewayFailureRef(message, temporal), error.code, undefined, error.retryable);
+    }
+    return new Error(gatewayFailureRef(message, temporal));
+}
 //# sourceMappingURL=gateway-tool-executor.js.map