@jungjaehoon/mama-os 0.32.0 → 0.32.1

package/dist/agent/gateway-tool-executor.js

@@ -68,6 +68,7 @@ const image_translation_tools_js_1 = require("./image-translation-tools.js");
 const attachment_text_extractor_js_1 = require("./attachment-text-extractor.js");
 const untrusted_content_js_1 = require("../utils/untrusted-content.js");
 const types_js_1 = require("./types.js");
+const external_lifecycle_candidates_js_1 = require("../operator/external-lifecycle-candidates.js");
 const sqlite_js_1 = __importDefault(require("../sqlite.js"));
 const mama_tool_handlers_js_1 = require("./mama-tool-handlers.js");
 const role_manager_js_1 = require("./role-manager.js");
@@ -77,6 +78,12 @@ const index_js_1 = require("../envelope/index.js");
 const wiki_publish_adapter_js_1 = require("../wiki-artifacts/wiki-publish-adapter.js");
 const changes_projection_js_1 = require("../operator/changes-projection.js");
 const read_js_1 = require("../evidence/read.js");
+const private_connector_policy_js_1 = require("../connectors/private-connector-policy.js");
+const DEFAULT_PRIVATE_CONNECTOR_POLICY = (0, private_connector_policy_js_1.resolvePrivateConnectorPolicy)({
+    ok: true,
+    config: {},
+    enabledNames: [],
+});
 function serializeTaskToolRecord(task) {
     return {
         ...task,
@@ -360,6 +367,7 @@ class GatewayToolExecutor {
     slackGateway = null;
     telegramGateway = null;
     roleManager;
+    privateConnectorPolicy;
     executionContextStorage = new async_hooks_1.AsyncLocalStorage();
     envelopeEnforcer = new index_js_1.EnvelopeEnforcer();
     channelGrantProvider;
@@ -592,6 +600,8 @@ class GatewayToolExecutor {
         this.wikiPublishAdapter = options.wikiPublishAdapter ?? null;
         // Pass rolesConfig from config.yaml to RoleManager
         this.roleManager = (0, role_manager_js_1.getRoleManager)(options.rolesConfig ? { rolesConfig: options.rolesConfig } : undefined);
+        this.privateConnectorPolicy =
+            options.privateConnectorPolicy ?? DEFAULT_PRIVATE_CONNECTOR_POLICY;
         if (options.mamaApi) {
             this.mamaApi = options.mamaApi;
         }
@@ -721,26 +731,34 @@ class GatewayToolExecutor {
      * @returns Object with allowed status and optional error message
      */
     checkToolPermission(toolName) {
-        // If no context set, allow all tools (backward compatibility)
         const context = this.getActiveContext();
-        if (!context) {
-            if (toolName === 'code_act') {
-                return {
-                    allowed: false,
-                    error: 'Permission denied: code_act requires an active agent role',
-                };
-            }
-            return { allowed: true };
+        if (!context && toolName === 'code_act') {
+            return {
+                allowed: false,
+                error: 'Permission denied: code_act requires an active agent role',
+            };
         }
-        const role = context.role;
+        const role = context
+            ? this.projectPrivateAgentContext(context).role
+            : this.privateConnectorPolicy.projectRole('legacy-unbound', { allowedTools: ['*'] });
         if (!this.roleManager.isToolAllowed(role, toolName)) {
             return {
                 allowed: false,
-                error: `Permission denied: ${toolName} is not allowed for role "${context.roleName}"`,
+                error: `Permission denied: ${toolName} is not allowed for role "${context?.roleName ?? 'legacy-unbound'}"`,
             };
         }
         return { allowed: true };
     }
+    projectPrivateAgentContext(context) {
+        const surface = (0, private_connector_policy_js_1.resolvePrivatePrincipalSurface)({ agentContext: context });
+        const role = this.privateConnectorPolicy.projectRole(surface, context.role);
+        return {
+            ...context,
+            role,
+            capabilities: this.roleManager.getCapabilities(role),
+            limitations: this.roleManager.getLimitations(role),
+        };
+    }
     /**
      * Check if a path is allowed for the current context
      * @param path - File path to check
@@ -1004,6 +1022,35 @@ class GatewayToolExecutor {
         }
         return result;
     }
+    /**
+     * External lifecycle decisions are only valid while the host-created model run that owns the
+     * claimed board attempt is still running. Tool input cannot name either authority.
+     */
+    async requireExternalLifecycleModelRun(attemptId) {
+        const modelRunId = this.getExecutionState().modelRunId;
+        if (typeof modelRunId !== 'string' ||
+            modelRunId.trim().length === 0 ||
+            modelRunId.trim() !== modelRunId) {
+            throw new types_js_1.AgentError('External lifecycle authority requires a current host-issued model run', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        const api = await this.initializeMAMAApi();
+        if (!api.getModelRun) {
+            throw new types_js_1.AgentError('External lifecycle model-run authority is unavailable', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        let modelRun;
+        try {
+            modelRun = await api.getModelRun(modelRunId);
+        }
+        catch (error) {
+            throw new types_js_1.AgentError('External lifecycle model-run authority could not be verified', 'WORKORDER_SUPERSEDED', error instanceof Error ? error : undefined, false);
+        }
+        if (!modelRun ||
+            modelRun.status !== 'running' ||
+            modelRun.input_refs?.workorderAttemptId !== attemptId) {
+            throw new types_js_1.AgentError('External lifecycle authority is no longer current for this claimed attempt', 'WORKORDER_SUPERSEDED', undefined, false);
+        }
+        return modelRunId;
+    }
     async beginTraceIfNeeded(ctx, gatewayCallId) {
         if (ctx.modelRunId) {
             const api = await this.initializeMAMAApi();
@@ -1445,7 +1492,7 @@ class GatewayToolExecutor {
     async executeWithEnvelopeAndPermissions(toolName, input, gatewayCallId) {
         this.getExecutionState().signal?.throwIfAborted();
         if (!VALID_TOOLS.includes(toolName)) {
-            throw new types_js_1.AgentError(`Unknown tool: ${toolName}. Valid tools: ${VALID_TOOLS.join(', ')}`, 'UNKNOWN_TOOL', undefined, false);
+            throw new types_js_1.AgentError(`Unknown tool: ${toolName}`, 'UNKNOWN_TOOL', undefined, false);
         }
         if (toolName.startsWith('drive_') &&
             this.getExecutionState().agentContext?.roleName !== 'owner_console') {
@@ -2063,6 +2110,84 @@ class GatewayToolExecutor {
                         };
                     }
                 }
+                case 'task_external_bind': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    const state = this.getExecutionState();
+                    const attemptId = state.workorderAttemptId;
+                    if (attemptId === undefined || !Number.isSafeInteger(attemptId) || attemptId <= 0) {
+                        throw new types_js_1.AgentError('task_external_bind requires a trusted claimed board attempt', 'WORKORDER_SUPERSEDED', undefined, false);
+                    }
+                    try {
+                        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('binding', input);
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error ? error.message : 'task_external_bind input is invalid', 'TOOL_ERROR', error instanceof Error ? error : undefined, false);
+                    }
+                    const modelRunId = await this.requireExternalLifecycleModelRun(attemptId);
+                    let candidate;
+                    try {
+                        candidate = this.taskLedger.loadBoardCandidate(attemptId, input.candidate_id, 'binding');
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error
+                            ? error.message
+                            : 'task_external_bind candidate is unavailable', 'WORKORDER_SUPERSEDED', error instanceof Error ? error : undefined, false);
+                    }
+                    const receipt = this.taskLedger.applyExternalBindingDecision(attemptId, input, {
+                        runId: modelRunId,
+                        workOrderAttemptId: attemptId,
+                        causeEventIds: [candidate.eventId],
+                    });
+                    return {
+                        success: true,
+                        receipt: {
+                            taskId: receipt.taskId,
+                            workorderAttemptId: receipt.workOrderAttemptId,
+                            outcome: receipt.outcome,
+                        },
+                    };
+                }
+                case 'task_lifecycle_reconcile': {
+                    if (!this.taskLedger) {
+                        return { success: false, error: 'Task ledger not configured' };
+                    }
+                    const state = this.getExecutionState();
+                    const attemptId = state.workorderAttemptId;
+                    if (attemptId === undefined || !Number.isSafeInteger(attemptId) || attemptId <= 0) {
+                        throw new types_js_1.AgentError('task_lifecycle_reconcile requires a trusted claimed board attempt', 'WORKORDER_SUPERSEDED', undefined, false);
+                    }
+                    try {
+                        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('lifecycle', input);
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error ? error.message : 'task_lifecycle_reconcile input is invalid', 'TOOL_ERROR', error instanceof Error ? error : undefined, false);
+                    }
+                    const modelRunId = await this.requireExternalLifecycleModelRun(attemptId);
+                    let candidate;
+                    try {
+                        candidate = this.taskLedger.loadBoardCandidate(attemptId, input.candidate_id, 'lifecycle');
+                    }
+                    catch (error) {
+                        throw new types_js_1.AgentError(error instanceof Error
+                            ? error.message
+                            : 'task_lifecycle_reconcile candidate is unavailable', 'WORKORDER_SUPERSEDED', error instanceof Error ? error : undefined, false);
+                    }
+                    const receipt = this.taskLedger.applyExternalLifecycleDecision(attemptId, input, {
+                        runId: modelRunId,
+                        workOrderAttemptId: attemptId,
+                        causeEventIds: [candidate.eventId],
+                    });
+                    return {
+                        success: true,
+                        receipt: {
+                            taskId: receipt.taskId,
+                            workorderAttemptId: receipt.workOrderAttemptId,
+                            outcome: receipt.outcome,
+                        },
+                    };
+                }
                 case 'task_create': {
                     if (!this.taskLedger) {
                         return { success: false, error: 'Task ledger not configured' };
@@ -2075,6 +2200,7 @@ class GatewayToolExecutor {
                         // else's work with it.
                         this.taskLedger.create(input, {
                             runId: this.getExecutionState().modelRunId ?? null,
+                            workOrderAttemptId: this.getExecutionState().workorderAttemptId,
                             causeEventIds: this.getExecutionState().causeEventIds,
                             causeKind: this.getExecutionState().source === 'operator' ? 'clock' : 'owner_message',
                         })),
@@ -2092,6 +2218,7 @@ class GatewayToolExecutor {
                     }
                     const updated = this.taskLedger.update(id, patch, {
                         runId: this.getExecutionState().modelRunId ?? null,
+                        workOrderAttemptId: this.getExecutionState().workorderAttemptId,
                         // The batch this run was handed. A bounded run's changes rest on the delta it
                         // was given, and the system knew that before the run began - so there is
                         // nothing to ask the agent for.
@@ -2847,14 +2974,17 @@ class GatewayToolExecutor {
         const { CodeActSandbox, CodeActToolPolicyValidationError, CODE_ACT_MUTATION_COMMITTED_AFTER_ABORT, CODE_ACT_MUTATION_OUTCOME_UNKNOWN, HostBridge, projectCodeActToolPolicy, } = await import('./code-act/index.js');
         const sandbox = new CodeActSandbox();
         const state = this.getExecutionState();
-        const contextTier = state.agentContext?.tier;
+        const projectedAgentContext = state.agentContext
+            ? this.projectPrivateAgentContext(state.agentContext)
+            : undefined;
+        const contextTier = projectedAgentContext?.tier;
         const tier = contextTier === undefined ? 1 : contextTier;
         let policy;
         try {
             policy = projectCodeActToolPolicy({
                 tier,
-                roleName: state.agentContext?.roleName,
-                role: state.agentContext?.role,
+                roleName: projectedAgentContext?.roleName,
+                role: projectedAgentContext?.role,
                 disallowedTools: state.disallowedGatewayTools,
                 requestedAllowedTools: input.allowedTools,
                 requestedBlockedTools: input.blockedTools,
@@ -2878,6 +3008,10 @@ class GatewayToolExecutor {
         }
         const nestedExecutionContext = {
             ...state,
+            // Preserve the registry-supplied principal object as provenance. The
+            // policy above and every nested final authorization re-project it from
+            // the immutable boot snapshot; replacing the object would blur which
+            // trusted context the keyed call actually carried.
             agentContext: state.agentContext ?? undefined,
             executionSurface: 'code_act',
             parentToolName: 'code_act',