@jungjaehoon/mama-os 0.28.6 → 0.29.0

package/dist/agent/gateway-tool-executor.js

@@ -61,6 +61,8 @@ const mama_core_1 = require("@jungjaehoon/mama-core");
 const security_monitor_js_1 = require("../security/security-monitor.js");
 const secret_filter_js_1 = require("../memory/secret-filter.js");
 const scope_context_js_1 = require("../memory/scope-context.js");
+const provenance_live_js_1 = require("../memory/provenance-live.js");
+const worker_envelope_js_1 = require("../api/worker-envelope.js");
 const drive_tools_js_1 = require("./drive-tools.js");
 const image_translation_tools_js_1 = require("./image-translation-tools.js");
 const attachment_text_extractor_js_1 = require("./attachment-text-extractor.js");
@@ -75,9 +77,10 @@ const agent_store_js_1 = require("../db/agent-store.js");
 const types_js_2 = require("../cli/config/types.js");
 const managed_agent_runtime_sync_js_1 = require("./managed-agent-runtime-sync.js");
 const managed_agent_validation_js_1 = require("./managed-agent-validation.js");
-const delegation_executor_js_1 = require("./delegation-executor.js");
 const index_js_1 = require("../envelope/index.js");
 const wiki_publish_adapter_js_1 = require("../wiki-artifacts/wiki-publish-adapter.js");
+const changes_projection_js_1 = require("../operator/changes-projection.js");
+const read_js_1 = require("../evidence/read.js");
 function serializeTaskToolRecord(task) {
     return {
         ...task,
@@ -168,6 +171,7 @@ const MEMORY_SCOPE_AUDIT_TOOLS = new Set([
     'mama_save',
     'mama_search',
     'mama_recall',
+    'mama_provenance',
     'context_compile',
     'mama_update',
     'mama_add',
@@ -219,6 +223,7 @@ const MEMORY_READ_PERMISSION_BEFORE_ENVELOPE_TOOLS = new Set([
     'mama_save',
     'mama_search',
     'mama_recall',
+    'mama_provenance',
     'context_compile',
 ]);
 const ENVELOPE_REQUIRED_SURFACES = new Set([
@@ -266,6 +271,10 @@ function sanitizeRecallMemory(value) {
         return null;
     }
     const safe = {};
+    const memoryId = stringField(record, 'id');
+    if (memoryId) {
+        safe.memoryId = memoryId;
+    }
     const topic = sanitizeRecallText(stringField(record, 'topic'));
     const kind = sanitizeRecallText(stringField(record, 'kind'));
     const summary = sanitizeRecallText(stringField(record, 'summary'));
@@ -416,7 +425,6 @@ class GatewayToolExecutor {
     currentContext = null;
     memoryAgentProcessManager = null;
     agentProcessManager = null;
-    delegationManagerRef = null;
     currentAgentId = '';
     currentSource = '';
     currentChannelId = '';
@@ -450,14 +458,11 @@ class GatewayToolExecutor {
     sessionsDb = null;
     setSessionsDb(db) {
         this.sessionsDb = db;
-        this.refreshDelegationExecutor();
-    }
-    rawStore = null;
-    setRawStore(store) {
-        this.rawStore = store;
-        this.refreshDelegationExecutor();
     }
-    delegationExecutor = null;
+    /** Accepted and discarded: the only reader was the delegation executor, which is gone.
+     *  The setter stays because its callers are live - delete both together when a second
+     *  reader appears or the callers do not. */
+    setRawStore(_store) { }
     uiCommandQueue = null;
     setUICommandQueue(queue) {
         this.uiCommandQueue = queue;
@@ -470,21 +475,13 @@ class GatewayToolExecutor {
     setRestartMultiAgentAgent(fn) {
         this.restartMultiAgentAgent = fn;
     }
-    validationService = null;
-    setValidationService(svc) {
-        this.validationService = svc;
-        this.refreshDelegationExecutor();
-    }
+    /** Same as setRawStore: the only reader was the delegation executor. */
+    setValidationService(_svc) { }
     setMemoryAgent(processManager) {
         this.memoryAgentProcessManager = processManager;
     }
     setAgentProcessManager(pm) {
         this.agentProcessManager = pm;
-        this.refreshDelegationExecutor();
-    }
-    setDelegationManager(dm) {
-        this.delegationManagerRef = dm;
-        this.refreshDelegationExecutor();
     }
     /** Get AgentProcessManager (for cron/event triggers that need direct process access) */
     getAgentProcessManager() {
@@ -509,6 +506,7 @@ class GatewayToolExecutor {
             gatewayCallId: executionContext?.gatewayCallId,
             workorderAttemptId: executionContext?.workorderAttemptId,
             temporalWorkContext: executionContext?.temporalWorkContext,
+            causeEventIds: executionContext?.causeEventIds,
             signal: executionContext?.signal,
             parentToolName: executionContext?.parentToolName,
             backgroundTasks: executionContext?.backgroundTasks,
@@ -546,6 +544,7 @@ class GatewayToolExecutor {
             workorderAttemptId: active.workorderAttemptId,
             // Never merged from fallback - temporal authority belongs to one claimed run only.
             temporalWorkContext: active.temporalWorkContext,
+            causeEventIds: active.causeEventIds,
             signal: active.signal,
             parentToolName: active.parentToolName ?? fallback.parentToolName,
             backgroundTasks: active.backgroundTasks ?? fallback.backgroundTasks,
@@ -556,6 +555,7 @@ class GatewayToolExecutor {
     getActiveContext() {
         return this.getExecutionState().agentContext;
     }
+    /** Who and where the active turn is. Was typed by the delegation executor; now local. */
     getActiveRouting() {
         const state = this.getExecutionState();
         return {
@@ -564,14 +564,6 @@ class GatewayToolExecutor {
             channelId: state.channelId,
         };
     }
-    getActiveDelegationRouting() {
-        const routing = this.getActiveRouting();
-        return {
-            agentId: routing.agentId || 'conductor',
-            source: routing.source || 'viewer',
-            channelId: routing.channelId || 'default',
-        };
-    }
     async withExecutionContext(executionContext, fn) {
         if (!executionContext) {
             return fn();
@@ -715,32 +707,6 @@ class GatewayToolExecutor {
         return this.memoryAgentProcessManager !== null;
     }
     /** Check if delegate tool support is available (multi-agent wired). */
-    hasDelegateSupport() {
-        return this.agentProcessManager !== null && this.delegationManagerRef !== null;
-    }
-    /** Retry delay (ms) for delegate backoff. Initialized from config in constructor. */
-    _retryDelayMs = 1000;
-    createDelegationExecutor() {
-        return new delegation_executor_js_1.DelegationExecutor({
-            agentProcessManager: this.agentProcessManager,
-            delegationManagerRef: this.delegationManagerRef,
-            rawStore: this.rawStore,
-            sessionsDb: this.sessionsDb,
-            validationService: this.validationService,
-            retryDelayMs: this._retryDelayMs,
-            resolveManagedAgentId: (id) => this.resolveManagedAgentId(id),
-            checkViewerOnly: () => this.checkViewerOnly(),
-        });
-    }
-    refreshDelegationExecutor() {
-        this.delegationExecutor = this.createDelegationExecutor();
-    }
-    getDelegationExecutor() {
-        if (!this.delegationExecutor) {
-            this.refreshDelegationExecutor();
-        }
-        return this.delegationExecutor;
-    }
     constructor(options = {}) {
         const privateWorkspaceRoot = (0, path_1.resolve)(process.env.MAMA_WORKSPACE || (0, path_1.join)((0, os_1.homedir)(), '.mama', 'workspace'));
         this.driveTools = new drive_tools_js_1.DriveToolService({ workspaceRoot: privateWorkspaceRoot });
@@ -775,14 +741,6 @@ class GatewayToolExecutor {
         if (options.mamaApi) {
             this.mamaApi = options.mamaApi;
         }
-        // Read retry delay from config (safe: falls back to 1000ms if config not yet initialized)
-        try {
-            this._retryDelayMs = (0, config_manager_js_1.getConfig)().timeouts?.busy_retry_ms ?? 1000;
-        }
-        catch {
-            // Config not initialized yet — keep default 1000ms
-        }
-        this.refreshDelegationExecutor();
     }
     async beginRuntimeModelRun(input) {
         const api = this.requireTraceApi(await this.initializeMAMAApi(), true);
@@ -1319,6 +1277,7 @@ class GatewayToolExecutor {
         }
         if (toolName === 'mama_search' ||
             toolName === 'mama_recall' ||
+            toolName === 'mama_provenance' ||
             toolName === 'context_compile') {
             return normalizeMemoryScopes(input.scopes);
         }
@@ -1350,7 +1309,7 @@ class GatewayToolExecutor {
             projectId: process.env.MAMA_WORKSPACE || process.cwd(),
         });
     }
-    resolveMamaRecallScopes(input) {
+    resolveMamaRecallScopes(input, toolName = 'mama_recall') {
         const ctx = this.getExecutionState();
         const requestedScopes = normalizeMemoryScopes(input.scopes);
         const callerProvidedScopes = input.scopes !== undefined;
@@ -1362,7 +1321,7 @@ class GatewayToolExecutor {
                 denial: {
                     success: false,
                     code: 'memory_scope_invalid',
-                    error: 'mama_recall scopes must be valid memory scope objects.',
+                    error: `${toolName} scopes must be valid memory scope objects.`,
                 },
             };
         }
@@ -1373,7 +1332,7 @@ class GatewayToolExecutor {
                     denial: {
                         success: false,
                         code: 'memory_scope_denied',
-                        error: 'mama_recall requires an active session or envelope for caller-supplied scopes.',
+                        error: `${toolName} requires an active session or envelope for caller-supplied scopes.`,
                     },
                 };
             }
@@ -1390,7 +1349,7 @@ class GatewayToolExecutor {
                 denial: {
                     success: false,
                     code: 'memory_scope_denied',
-                    error: 'mama_recall requested scopes outside the active session or envelope.',
+                    error: `${toolName} requested scopes outside the active session or envelope.`,
                 },
             };
         }
@@ -1759,9 +1718,6 @@ class GatewayToolExecutor {
                 // Obsidian vault management via CLI
                 case 'obsidian':
                     return await this.executeObsidian(input);
-                // Agent lifecycle tools
-                case 'agent_test':
-                    return await this.getDelegationExecutor().runAgentTest(input, this.getActiveDelegationRouting());
                 // Agent management tools (Managed Agents pattern)
                 case 'agent_get': {
                     if (!this.sessionsDb) {
@@ -1959,9 +1915,6 @@ class GatewayToolExecutor {
                     this.uiCommandQueue.push({ type: 'notify', payload: args });
                     return { success: true, notified: true };
                 }
-                // Multi-Agent delegation
-                case 'delegate':
-                    return await this.getDelegationExecutor().runDelegate(input, this.getActiveDelegationRouting());
             }
             // Lazy MAMA API init — only for tools that need it
             const getApi = () => this.initializeMAMAApi();
@@ -2045,6 +1998,8 @@ class GatewayToolExecutor {
                     return await (0, mama_tool_handlers_js_1.handleSearch)(await getApi(), input);
                 case 'mama_recall':
                     return await this.handleMamaRecall(input);
+                case 'mama_provenance':
+                    return await this.handleMamaProvenance(input);
                 case 'context_compile':
                     return await this.handleContextCompile(input);
                 case 'mama_update': {
@@ -2331,10 +2286,13 @@ class GatewayToolExecutor {
                     const { getTrelloKanban } = await import('../connectors/trello/query-tools.js');
                     const kanbanInput = input;
                     try {
-                        const columns = await getTrelloKanban({
+                        // Coverage rides alongside the data: `complete`/`boards`/`truncated`/
+                        // `observedAt` are what let a caller tell a truly empty board from one it
+                        // failed to read, and a whole column from a sliced one.
+                        const snapshot = await getTrelloKanban({
                             maxCardsPerList: kanbanInput.maxCardsPerList,
                         });
-                        return { success: true, columns };
+                        return { success: true, ...snapshot };
                     }
                     catch (err) {
                         return {
@@ -2352,6 +2310,16 @@ class GatewayToolExecutor {
                     }
                     return { success: true, messages: queryMessages(msgInput) };
                 }
+                case 'changes_read': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    // Coverage and totals ride with the rows for the same reason task_list carries
+                    // its own: "I changed 12 things" and "I can say why for 4 of them" are
+                    // different claims, and a page of rows without the count it was drawn from
+                    // states more than the ledger holds.
+                    return (0, changes_projection_js_1.readChanges)(this.taskLedger, input, Date.now());
+                }
                 case 'task_list': {
                     if (!this.taskLedger) {
                         return { success: false, error: 'Task ledger not configured' };
@@ -2368,26 +2336,100 @@ class GatewayToolExecutor {
                         };
                     }
                     const listInput = input;
+                    // total/returned/nextCursor ride with the rows: a bounded read (default 50,
+                    // max 200) is otherwise indistinguishable from the whole board, and a report
+                    // that says "the open items are..." from one page states more than it read.
+                    const page = this.taskLedger.listPage({
+                        status: listInput.status,
+                        channel: listInput.channel,
+                        search: listInput.search,
+                        limit: listInput.limit,
+                        order: listInput.order ?? 'deadline_priority',
+                        cursor: listInput.cursor,
+                    });
                     return {
                         success: true,
-                        tasks: this.taskLedger
-                            .list({
-                            status: listInput.status,
-                            channel: listInput.channel,
-                            search: listInput.search,
-                            limit: listInput.limit,
-                            order: listInput.order ?? 'deadline_priority',
-                        })
-                            .map(serializeTaskToolRecord),
+                        tasks: page.tasks.map(serializeTaskToolRecord),
+                        total: page.total,
+                        returned: page.returned,
+                        nextCursor: page.nextCursor,
                     };
                 }
+                case 'task_external_correlation': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    const { correlateTasksWithExternalItems } = await import('../operator/external-correlation.js');
+                    const { buildProvenanceLookup } = await import('../operator/provenance-lookup.js');
+                    const { getTrelloKanban } = await import('../connectors/trello/query-tools.js');
+                    try {
+                        // The whole open set is walked HERE, not by the model: a correlation over
+                        // one page would answer "what did the caller happen to see" rather than
+                        // "what is on the board", which is the substitution this tool exists to stop.
+                        const ledger = this.taskLedger;
+                        const open = [];
+                        let cursor;
+                        do {
+                            const page = ledger.listPage({ limit: 200, cursor });
+                            for (const task of page.tasks) {
+                                if (task.status !== 'done' && task.status !== 'cancelled') {
+                                    open.push({
+                                        id: task.id,
+                                        sourceChannel: task.sourceChannel,
+                                        sourceEventId: task.sourceEventId,
+                                    });
+                                }
+                            }
+                            cursor = page.nextCursor ?? undefined;
+                        } while (cursor);
+                        const snapshot = await getTrelloKanban({ maxCardsPerList: 100 });
+                        const liveItems = snapshot.columns.flatMap((column) => column.cards.map((card) => ({
+                            itemId: card.cardId,
+                            board: column.board,
+                            list: column.list,
+                        })));
+                        const result = correlateTasksWithExternalItems({
+                            connector: 'trello',
+                            rows: open,
+                            lookupProvenance: await buildProvenanceLookup(),
+                            liveItems,
+                            liveSnapshotComplete: snapshot.complete,
+                        });
+                        return {
+                            success: true,
+                            correlations: result.correlations,
+                            coverage: result.coverage,
+                            snapshot: {
+                                observedAt: snapshot.observedAt,
+                                cacheAgeMs: snapshot.cacheAgeMs,
+                                complete: snapshot.complete,
+                                truncated: snapshot.truncated,
+                                boards: snapshot.boards,
+                            },
+                        };
+                    }
+                    catch (err) {
+                        return {
+                            success: false,
+                            code: 'correlation_failed',
+                            error: err instanceof Error ? err.message : String(err),
+                        };
+                    }
+                }
                 case 'task_create': {
                     if (!this.taskLedger) {
                         return { success: false, error: 'Task ledger not configured' };
                     }
                     return {
                         success: true,
-                        task: serializeTaskToolRecord(this.taskLedger.create(input)),
+                        task: serializeTaskToolRecord(
+                        // The run id comes from trusted execution state, never from the tool call:
+                        // an agent that can name its own run in the effect ledger can sign someone
+                        // else's work with it.
+                        this.taskLedger.create(input, {
+                            runId: this.getExecutionState().modelRunId ?? null,
+                            causeEventIds: this.getExecutionState().causeEventIds,
+                        })),
                     };
                 }
                 case 'task_update': {
@@ -2400,10 +2442,14 @@ class GatewayToolExecutor {
                     if (!Number.isInteger(id) || id <= 0) {
                         throw new types_js_1.AgentError(`task_update requires a numeric id, got: ${String(rawId)}`, 'TOOL_ERROR', undefined, false);
                     }
-                    return {
-                        success: true,
-                        task: serializeTaskToolRecord(this.taskLedger.update(id, patch)),
-                    };
+                    const updated = this.taskLedger.update(id, patch, {
+                        runId: this.getExecutionState().modelRunId ?? null,
+                        // The batch this run was handed. A bounded run's changes rest on the delta it
+                        // was given, and the system knew that before the run began - so there is
+                        // nothing to ask the agent for.
+                        causeEventIds: this.getExecutionState().causeEventIds,
+                    });
+                    return { success: true, task: serializeTaskToolRecord(updated) };
                 }
                 case 'task_temporal_reconcile': {
                     if (!this.taskLedger) {
@@ -3806,9 +3852,11 @@ class GatewayToolExecutor {
                 return;
             }
             hostToolsInvoked.push(toolName);
-            if ((toolName.startsWith('drive_') && toolName !== 'drive_upload') ||
-                toolName === 'ocr_image' ||
-                toolName === 'translate_conti') {
+            // Board/card text is written by people outside this system and now reaches the
+            // report lane, whose composed text is delivered to the owner verbatim by host
+            // code with no intervening model. Deriving this from the connector map keeps a
+            // newly registered reader from arriving unfenced.
+            if ((0, untrusted_content_js_1.isUntrustedExternalEvidenceTool)(toolName)) {
                 usedUntrustedExternalEvidence = true;
             }
         };
@@ -3937,6 +3985,104 @@ class GatewayToolExecutor {
             };
         }
     }
+    /**
+     * Answer what a stored claim rests on.
+     *
+     * The counterpart to recall, and the reason recall now returns an id at all: an agent
+     * that can only read memories can assert them, while an agent that can resolve them can
+     * say which ones a statement stands on - or that a statement stands on nothing. That
+     * second answer is the one the original bad report could not produce.
+     *
+     * Scope is re-derived here rather than trusted from the caller, and the connector grant
+     * is read off the active envelope, so this path can never show an event that the normal
+     * raw read would refuse.
+     */
+    async handleMamaProvenance(input) {
+        const memoryId = typeof input.memory_id === 'string' ? input.memory_id.trim() : '';
+        if (memoryId.length === 0) {
+            return {
+                success: false,
+                error: 'memory_id is required',
+            };
+        }
+        // Tier 3 is denied context_compile, its sanctioned path to raw connector data. A
+        // per-citation event reader would reopen exactly that, one event at a time, so the
+        // same denial applies here - fail closed on a Tier-3 designation from either source.
+        const tierContext = this.getExecutionState();
+        if (tierContext.agentContext?.tier === 3 || tierContext.envelope?.tier === 3) {
+            return {
+                success: false,
+                code: 'permission_denied_tier3',
+                error: 'mama_provenance is not allowed for Tier 3 agents.',
+            };
+        }
+        const scopeResolution = this.resolveMamaRecallScopes(input, 'mama_provenance');
+        if (scopeResolution.denial) {
+            return scopeResolution.denial;
+        }
+        if (scopeResolution.scopes.length === 0) {
+            return {
+                success: false,
+                error: 'mama_provenance requires scopes (provide via input or active agent context)',
+            };
+        }
+        const ctx = this.getExecutionState();
+        // No envelope means no connector grant, and no grant means NO raw events - never all
+        // of them. The raw reader fails closed on exactly this input and so does this call.
+        const connectors = ctx.envelope?.scope.raw_connectors ?? [];
+        // Derived exactly the way the compile path derives them, through the same functions.
+        // Taking `project_refs` off the envelope directly and skipping tenant entirely is what
+        // made an earlier version wider than the reader: the reader always resolves a tenant
+        // ('default' today), and an absent tenant on this side skipped the filter rather than
+        // narrowing it - so tenant-null and cross-tenant rows resolved that reading refuses.
+        const projectIds = ctx.envelope
+            ? (0, worker_envelope_js_1.deriveEffectiveProjectRefs)(ctx.envelope).map((project) => project.id)
+            : [];
+        // deriveEffectiveTenantId() is a constant today and is load-bearing: the reader
+        // resolves the same value on every call, so passing anything else - or nothing -
+        // makes citation and reading disagree.
+        const tenantId = (0, worker_envelope_js_1.deriveEffectiveTenantId)();
+        // Declared on the envelope and assigned nowhere yet. Threaded so the clamp holds for
+        // citation on the day it is, rather than becoming the next uncovered filter.
+        const asOfMs = ctx.envelope?.scope.as_of ? Date.parse(ctx.envelope.scope.as_of) : NaN;
+        const maxObservedMs = Number.isNaN(asOfMs) ? null : asOfMs;
+        try {
+            // The SAME grant the compile path reads under, derived by the same function. This is
+            // what makes citation and reading answer the same question: while these were separate
+            // rules, this tool refused excerpts for the very events context_compile was citing.
+            // Narrowed by the ENVELOPE's scopes, never by the caller's requested subset.
+            // scopeResolution.scopes is any subset the caller asked for that the envelope allows,
+            // so narrowing by it let a caller widen its own grant by simply omitting the channel
+            // scope: ask with global:system alone and the channel narrowing disappears, handing
+            // back excerpts from every other channel of the connector. Citation would then be
+            // strictly wider than reading, which is the one thing this path must never be.
+            const citationChannels = ctx.envelope
+                ? (0, read_js_1.narrowGrantToEnvelope)((0, read_js_1.liveBoundaryChannels)(), {
+                    connectors,
+                    scopes: ctx.envelope.scope.memory_scopes ?? [],
+                })
+                : undefined;
+            const resolution = await (0, provenance_live_js_1.resolveMemoryProvenanceLive)(memoryId, {
+                scopes: scopeResolution.scopes,
+                connectors,
+                ...(citationChannels ? { channels: citationChannels } : {}),
+                projectIds,
+                tenantId,
+                maxObservedMs,
+                // The same scrubbing recall applies to memory text. Without it this surface would
+                // emit connector content that its sibling redacts, which is only invisible today
+                // because no event excerpt has ever been produced.
+                redact: (text) => sanitizeRecallText(text) ?? '',
+            });
+            return { success: true, data: resolution };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: `Failed to resolve provenance: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+    }
     async handleMamaRecall(input) {
         const api = await this.initializeMAMAApi();
         if (!api.recallMemory || typeof input.query !== 'string' || input.query.length === 0) {