@jungjaehoon/mama-os 0.31.5 → 0.32.1

package/dist/agent/gateway-tool-executor.js

@@ -68,6 +68,7 @@ const image_translation_tools_js_1 = require("./image-translation-tools.js");
 const attachment_text_extractor_js_1 = require("./attachment-text-extractor.js");
 const untrusted_content_js_1 = require("../utils/untrusted-content.js");
 const types_js_1 = require("./types.js");
+const external_lifecycle_candidates_js_1 = require("../operator/external-lifecycle-candidates.js");
 const sqlite_js_1 = __importDefault(require("../sqlite.js"));
 const mama_tool_handlers_js_1 = require("./mama-tool-handlers.js");
 const role_manager_js_1 = require("./role-manager.js");
@@ -77,6 +78,12 @@ const index_js_1 = require("../envelope/index.js");
 const wiki_publish_adapter_js_1 = require("../wiki-artifacts/wiki-publish-adapter.js");
 const changes_projection_js_1 = require("../operator/changes-projection.js");
 const read_js_1 = require("../evidence/read.js");
+const private_connector_policy_js_1 = require("../connectors/private-connector-policy.js");
+const DEFAULT_PRIVATE_CONNECTOR_POLICY = (0, private_connector_policy_js_1.resolvePrivateConnectorPolicy)({
+    ok: true,
+    config: {},
+    enabledNames: [],
+});
 function serializeTaskToolRecord(task) {
     return {
         ...task,
@@ -360,6 +367,7 @@ class GatewayToolExecutor {
     slackGateway = null;
     telegramGateway = null;
     roleManager;
+    privateConnectorPolicy;
     executionContextStorage = new async_hooks_1.AsyncLocalStorage();
     envelopeEnforcer = new index_js_1.EnvelopeEnforcer();
     channelGrantProvider;
@@ -592,6 +600,8 @@ class GatewayToolExecutor {
         this.wikiPublishAdapter = options.wikiPublishAdapter ?? null;
         // Pass rolesConfig from config.yaml to RoleManager
         this.roleManager = (0, role_manager_js_1.getRoleManager)(options.rolesConfig ? { rolesConfig: options.rolesConfig } : undefined);
+        this.privateConnectorPolicy =
+            options.privateConnectorPolicy ?? DEFAULT_PRIVATE_CONNECTOR_POLICY;
         if (options.mamaApi) {
             this.mamaApi = options.mamaApi;
         }
@@ -721,26 +731,34 @@ class GatewayToolExecutor {
      * @returns Object with allowed status and optional error message
      */
     checkToolPermission(toolName) {
-        // If no context set, allow all tools (backward compatibility)
         const context = this.getActiveContext();
-        if (!context) {
-            if (toolName === 'code_act') {
-                return {
-                    allowed: false,
-                    error: 'Permission denied: code_act requires an active agent role',
-                };
-            }
-            return { allowed: true };
+        if (!context && toolName === 'code_act') {
+            return {
+                allowed: false,
+                error: 'Permission denied: code_act requires an active agent role',
+            };
         }
-        const role = context.role;
+        const role = context
+            ? this.projectPrivateAgentContext(context).role
+            : this.privateConnectorPolicy.projectRole('legacy-unbound', { allowedTools: ['*'] });
         if (!this.roleManager.isToolAllowed(role, toolName)) {
             return {
                 allowed: false,
-                error: `Permission denied: ${toolName} is not allowed for role "${context.roleName}"`,
+                error: `Permission denied: ${toolName} is not allowed for role "${context?.roleName ?? 'legacy-unbound'}"`,
             };
         }
         return { allowed: true };
     }
+    projectPrivateAgentContext(context) {
+        const surface = (0, private_connector_policy_js_1.resolvePrivatePrincipalSurface)({ agentContext: context });
+        const role = this.privateConnectorPolicy.projectRole(surface, context.role);
+        return {
+            ...context,
+            role,
+            capabilities: this.roleManager.getCapabilities(role),
+            limitations: this.roleManager.getLimitations(role),
+        };
+    }
     /**
      * Check if a path is allowed for the current context
      * @param path - File path to check
@@ -955,7 +973,7 @@ class GatewayToolExecutor {
                 toolName === 'context_compile' ||
                 toolName === 'code_act';
             auditResult = shouldSanitizeAuditFailure
-                ? sanitizeGatewayFailureResult(rawResult, Boolean(activeCtx.temporalWorkContext))
+                ? sanitizeGatewayFailureResult(rawResult, Boolean(activeCtx.temporalWorkContext), toolName === 'code_act')
                 : rawResult;
             result = activeCtx.temporalWorkContext ? auditResult : rawResult;
             const rawResultRecord = rawResult;
@@ -1004,6 +1022,35 @@ class GatewayToolExecutor {
         }
         return result;
     }
+    /**
+     * External lifecycle decisions are only valid while the host-created model run that owns the
+     * claimed board attempt is still running. Tool input cannot name either authority.
+     */
+    async requireExternalLifecycleModelRun(attemptId) {
+        const modelRunId = this.getExecutionState().modelRunId;
+        if (typeof modelRunId !== 'string' ||
+            modelRunId.trim().length === 0 ||
+            modelRunId.trim() !== modelRunId) {
+            throw new types_js_1.AgentError('External lifecycle authority requires a current host-issued model run', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        const api = await this.initializeMAMAApi();
+        if (!api.getModelRun) {
+            throw new types_js_1.AgentError('External lifecycle model-run authority is unavailable', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        let modelRun;
+        try {
+            modelRun = await api.getModelRun(modelRunId);
+        }
+        catch (error) {
+            throw new types_js_1.AgentError('External lifecycle model-run authority could not be verified', 'WORKORDER_SUPERSEDED', error instanceof Error ? error : undefined, false);
+        }
+        if (!modelRun ||
+            modelRun.status !== 'running' ||
+            modelRun.input_refs?.workorderAttemptId !== attemptId) {
+            throw new types_js_1.AgentError('External lifecycle authority is no longer current for this claimed attempt', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        return modelRunId;
+    }
     async beginTraceIfNeeded(ctx, gatewayCallId) {
         if (ctx.modelRunId) {
             const api = await this.initializeMAMAApi();
@@ -1445,7 +1492,7 @@ class GatewayToolExecutor {
     async executeWithEnvelopeAndPermissions(toolName, input, gatewayCallId) {
         this.getExecutionState().signal?.throwIfAborted();
         if (!VALID_TOOLS.includes(toolName)) {
-            throw new types_js_1.AgentError(`Unknown tool: ${toolName}. Valid tools: ${VALID_TOOLS.join(', ')}`, 'UNKNOWN_TOOL', undefined, false);
+            throw new types_js_1.AgentError(`Unknown tool: ${toolName}`, 'UNKNOWN_TOOL', undefined, false);
         }
         if (toolName.startsWith('drive_') &&
             this.getExecutionState().agentContext?.roleName !== 'owner_console') {
@@ -2063,6 +2110,84 @@ class GatewayToolExecutor {
                         };
                     }
                 }
+                case 'task_external_bind': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    const state = this.getExecutionState();
+                    const attemptId = state.workorderAttemptId;
+                    if (attemptId === undefined || !Number.isSafeInteger(attemptId) || attemptId <= 0) {
+                        throw new types_js_1.AgentError('task_external_bind requires a trusted claimed board attempt', 'WORKORDER_SUPERSEDED', undefined, false);
+                    }
+                    try {
+                        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('binding', input);
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error ? error.message : 'task_external_bind input is invalid', 'TOOL_ERROR', error instanceof Error ? error : undefined, false);
+                    }
+                    const modelRunId = await this.requireExternalLifecycleModelRun(attemptId);
+                    let candidate;
+                    try {
+                        candidate = this.taskLedger.loadBoardCandidate(attemptId, input.candidate_id, 'binding');
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error
+                            ? error.message
+                            : 'task_external_bind candidate is unavailable', 'WORKORDER_SUPERSEDED', error instanceof Error ? error : undefined, false);
+                    }
+                    const receipt = this.taskLedger.applyExternalBindingDecision(attemptId, input, {
+                        runId: modelRunId,
+                        workOrderAttemptId: attemptId,
+                        causeEventIds: [candidate.eventId],
+                    });
+                    return {
+                        success: true,
+                        receipt: {
+                            taskId: receipt.taskId,
+                            workorderAttemptId: receipt.workOrderAttemptId,
+                            outcome: receipt.outcome,
+                        },
+                    };
+                }
+                case 'task_lifecycle_reconcile': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    const state = this.getExecutionState();
+                    const attemptId = state.workorderAttemptId;
+                    if (attemptId === undefined || !Number.isSafeInteger(attemptId) || attemptId <= 0) {
+                        throw new types_js_1.AgentError('task_lifecycle_reconcile requires a trusted claimed board attempt', 'WORKORDER_SUPERSEDED', undefined, false);
+                    }
+                    try {
+                        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('lifecycle', input);
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error ? error.message : 'task_lifecycle_reconcile input is invalid', 'TOOL_ERROR', error instanceof Error ? error : undefined, false);
+                    }
+                    const modelRunId = await this.requireExternalLifecycleModelRun(attemptId);
+                    let candidate;
+                    try {
+                        candidate = this.taskLedger.loadBoardCandidate(attemptId, input.candidate_id, 'lifecycle');
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error
+                            ? error.message
+                            : 'task_lifecycle_reconcile candidate is unavailable', 'WORKORDER_SUPERSEDED', error instanceof Error ? error : undefined, false);
+                    }
+                    const receipt = this.taskLedger.applyExternalLifecycleDecision(attemptId, input, {
+                        runId: modelRunId,
+                        workOrderAttemptId: attemptId,
+                        causeEventIds: [candidate.eventId],
+                    });
+                    return {
+                        success: true,
+                        receipt: {
+                            taskId: receipt.taskId,
+                            workorderAttemptId: receipt.workOrderAttemptId,
+                            outcome: receipt.outcome,
+                        },
+                    };
+                }
                 case 'task_create': {
                     if (!this.taskLedger) {
                         return { success: false, error: 'Task ledger not configured' };
@@ -2075,6 +2200,7 @@ class GatewayToolExecutor {
                         // else's work with it.
                         this.taskLedger.create(input, {
                             runId: this.getExecutionState().modelRunId ?? null,
+                            workOrderAttemptId: this.getExecutionState().workorderAttemptId,
                             causeEventIds: this.getExecutionState().causeEventIds,
                             causeKind: this.getExecutionState().source === 'operator' ? 'clock' : 'owner_message',
                         })),
@@ -2092,6 +2218,7 @@ class GatewayToolExecutor {
                     }
                     const updated = this.taskLedger.update(id, patch, {
                         runId: this.getExecutionState().modelRunId ?? null,
+                        workOrderAttemptId: this.getExecutionState().workorderAttemptId,
                         // The batch this run was handed. A bounded run's changes rest on the delta it
                         // was given, and the system knew that before the run began - so there is
                         // nothing to ask the agent for.
@@ -2847,14 +2974,17 @@ class GatewayToolExecutor {
         const { CodeActSandbox, CodeActToolPolicyValidationError, CODE_ACT_MUTATION_COMMITTED_AFTER_ABORT, CODE_ACT_MUTATION_OUTCOME_UNKNOWN, HostBridge, projectCodeActToolPolicy, } = await import('./code-act/index.js');
         const sandbox = new CodeActSandbox();
         const state = this.getExecutionState();
-        const contextTier = state.agentContext?.tier;
+        const projectedAgentContext = state.agentContext
+            ? this.projectPrivateAgentContext(state.agentContext)
+            : undefined;
+        const contextTier = projectedAgentContext?.tier;
         const tier = contextTier === undefined ? 1 : contextTier;
         let policy;
         try {
             policy = projectCodeActToolPolicy({
                 tier,
-                roleName: state.agentContext?.roleName,
-                role: state.agentContext?.role,
+                roleName: projectedAgentContext?.roleName,
+                role: projectedAgentContext?.role,
                 disallowedTools: state.disallowedGatewayTools,
                 requestedAllowedTools: input.allowedTools,
                 requestedBlockedTools: input.blockedTools,
@@ -2878,6 +3008,10 @@ class GatewayToolExecutor {
         }
         const nestedExecutionContext = {
             ...state,
+            // Preserve the registry-supplied principal object as provenance. The
+            // policy above and every nested final authorization re-project it from
+            // the immutable boot snapshot; replacing the object would blur which
+            // trusted context the keyed call actually carried.
             agentContext: state.agentContext ?? undefined,
             executionSurface: 'code_act',
             parentToolName: 'code_act',
@@ -2888,12 +3022,24 @@ class GatewayToolExecutor {
         // result !== undefined - host-bridge.ts:1049; the pre-call fire at :1037 is skipped).
         // Ride in the result message so downstream audits (report-run summarizeReportToolUse)
         // can classify nested gather/write without code_act becoming an opaque blob.
+        const hostToolExecutions = [];
         const hostToolsInvoked = [];
+        const successfulHostToolNames = new Set();
         bridge.onToolUse = (toolName, _toolInput, result) => {
             if (result === undefined) {
                 return;
             }
-            hostToolsInvoked.push(toolName);
+            const resultRecord = result;
+            const success = resultRecord.success === true;
+            hostToolExecutions.push({
+                name: toolName,
+                success,
+                ...(typeof resultRecord.code === 'string' ? { code: resultRecord.code } : {}),
+            });
+            if (success && !successfulHostToolNames.has(toolName)) {
+                successfulHostToolNames.add(toolName);
+                hostToolsInvoked.push(toolName);
+            }
             // Board/card text is written by people outside this system and now reaches the
             // report lane, whose composed text is delivered to the owner verbatim by host
             // code with no intervening model. Deriving this from the connector map keeps a
@@ -2911,9 +3057,15 @@ class GatewayToolExecutor {
         if (result.error?.code && terminalMutationCodes.has(result.error.code)) {
             return {
                 success: false,
+                value: result.value,
+                logs: result.logs,
+                error: result.error.message,
                 code: result.error.code,
                 retryable: false,
                 abort: true,
+                metrics: result.metrics,
+                hostToolExecutions,
+                hostToolsInvoked,
                 message: `Code-Act error: ${result.error.message}`,
             };
         }
@@ -2925,6 +3077,12 @@ class GatewayToolExecutor {
         });
         return {
             success: result.success,
+            value: result.value,
+            logs: result.logs,
+            ...(result.error?.message ? { error: result.error.message } : {}),
+            metrics: result.metrics,
+            hostToolExecutions,
+            hostToolsInvoked,
             message: result.success
                 ? usedUntrustedExternalEvidence
                     ? (0, untrusted_content_js_1.wrapUntrustedContent)('external-evidence-code-act', successfulMessage)
@@ -3318,20 +3476,56 @@ function gatewayFailureRef(value, temporal) {
     const label = temporal ? 'temporal_tool_failed' : 'gateway_tool_failed';
     return `${label};sha256=${digest};length=${value.length}`;
 }
-function sanitizeGatewayFailureResult(result, temporal) {
+function sanitizeGatewayFailureResult(result, temporal, preserveCodeActAudit = false) {
     const failure = getFailureMessage(result);
     if (!failure) {
         return result;
     }
     const record = result;
+    const hostToolExecutions = preserveCodeActAudit
+        ? normalizeHostToolExecutionAudit(record.hostToolExecutions)
+        : [];
+    const hostToolsInvoked = [
+        ...new Set(hostToolExecutions.filter((execution) => execution.success).map((execution) => execution.name)),
+    ];
     return {
         success: false,
         error: gatewayFailureRef(failure, temporal),
         ...(typeof record.code === 'string' ? { code: record.code } : {}),
         ...(record.retryable === false ? { retryable: false } : {}),
         ...(record.abort === true ? { abort: true } : {}),
+        ...(preserveCodeActAudit ? { hostToolExecutions, hostToolsInvoked } : {}),
     };
 }
+function normalizeHostToolExecutionAudit(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    const executions = [];
+    let droppedCount = 0;
+    for (const entry of value) {
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            droppedCount += 1;
+            continue;
+        }
+        const record = entry;
+        if (typeof record.name !== 'string' || typeof record.success !== 'boolean') {
+            droppedCount += 1;
+            continue;
+        }
+        executions.push({
+            name: record.name,
+            success: record.success,
+            ...(typeof record.code === 'string' ? { code: record.code } : {}),
+        });
+    }
+    if (droppedCount > 0) {
+        securityLogger.warn('[code-act] dropped malformed host-tool audit entries', {
+            droppedCount,
+        });
+    }
+    return executions;
+}
 function sanitizeGatewayError(error, temporal) {
     const message = error instanceof Error ? error.message : String(error);
     if (error instanceof types_js_1.AgentError) {