@jungjaehoon/mama-os 0.32.0 → 0.32.2

package/dist/gateways/message-router.js

@@ -63,7 +63,8 @@ const session_pool_js_1 = require("../agent/session-pool.js");
 const agent_loop_js_1 = require("../agent/agent-loop.js");
 const console_brief_js_1 = require("../operator/console-brief.js");
 const role_manager_js_1 = require("../agent/role-manager.js");
-const tool_registry_js_1 = require("../agent/tool-registry.js");
+const gateway_tool_catalog_js_1 = require("../agent/gateway-tool-catalog.js");
+const private_prompt_overlay_js_1 = require("../connectors/private-prompt-overlay.js");
 const context_prompt_builder_js_1 = require("../agent/context-prompt-builder.js");
 const prompt_enhancer_js_1 = require("../agent/prompt-enhancer.js");
 const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
@@ -74,11 +75,16 @@ const recall_bundle_formatter_js_1 = require("../memory/recall-bundle-formatter.
 const save_candidate_extractor_js_1 = require("../memory/save-candidate-extractor.js");
 const untrusted_content_js_1 = require("../utils/untrusted-content.js");
 const security_monitor_js_1 = require("../security/security-monitor.js");
-const report_carry_js_1 = require("../operator/report-carry.js");
 const agent_store_js_1 = require("../db/agent-store.js");
 const reactive_config_js_1 = require("../envelope/reactive-config.js");
+const private_connector_policy_js_1 = require("../connectors/private-connector-policy.js");
 const { DebugLogger } = debugLogger;
 const logger = new DebugLogger('MessageRouter');
+const DEFAULT_PRIVATE_CONNECTOR_POLICY = (0, private_connector_policy_js_1.resolvePrivateConnectorPolicy)({
+    ok: true,
+    config: {},
+    enabledNames: [],
+});
 /**
  * The owner's message, as the cause of whatever the turn it started changes.
  *
@@ -158,7 +164,7 @@ function hashSessionPolicyFingerprint({ baseInstructions, agentsContent, rulesCo
     }
     return hash.digest('hex');
 }
-function buildStableRolePolicyInstructions(agentContext, roleManager, trelloAvailable, options = {}) {
+function buildStableRolePolicyInstructions(agentContext, roleManager, trelloAvailable, privateConnectorPolicy, options = {}) {
     if (agentContext.roleName !== 'owner_console') {
         return '';
     }
@@ -166,9 +172,12 @@ function buildStableRolePolicyInstructions(agentContext, roleManager, trelloAvai
     const trelloBoundary = trelloAvailable && roleManager.isToolAllowed(agentContext.role, 'context_compile')
         ? `
 - ${untrusted_content_js_1.UNTRUSTED_EXTERNAL_EVIDENCE_INSTRUCTION}
-- Trello is separate external connector evidence and is available only through context_compile. When intentionally isolating Trello evidence, use context_compile({ task: "...", connectors: ['trello'] }); never claim that kagemusha_* is Trello or substitute one store for the other.`
+- Trello is separate external connector evidence and is available only through context_compile. When intentionally isolating Trello evidence, use context_compile({ task: "...", connectors: ['trello'] }); never claim that one store is another or substitute lifecycle state across stores.`
+        : '';
+    const privateStoreBoundary = privateConnectorPolicy.enabledPrivateConnectors.length > 0
+        ? '\n- Private connector task tools are read-only evidence. Keep their lifecycle state separate from the native task board.'
         : '';
-    const evidencePolicy = `- Task-store canonicity: kagemusha_* is the READ-ONLY project-task truth; the task board (task_list/task_create/task_update) is the tracker YOU maintain - the owner only views it. Their status vocabularies DIFFER (e.g. kagemusha has no 'blocked') - when a status query returns nothing, say the vocabulary difference instead of inferring the work is gone.${trelloBoundary}
+    const evidencePolicy = `- Task-store canonicity: the task board (task_list/task_create/task_update) is the tracker YOU maintain for the owner. Every external store remains separate evidence; never copy or infer lifecycle state across stores.${privateStoreBoundary}${trelloBoundary}
 - Answer status questions from artifacts first (board_read, workorder_status, audit_findings_read), then live queries; memory recall is the LAST resort and may be stale - cite which source answered.`;
     return includeOperatingDiscipline
         ? `${evidencePolicy}\n\n${OWNER_CONSOLE_OPERATING_DISCIPLINE}`
@@ -219,7 +228,7 @@ const KOREAN_TARGETS = new Set(['korean', '한국어']);
 const VIEWER_CONTEXT_AGENT_LIST_LIMIT = 5;
 const VIEWER_CONTEXT_ALERT_LIMIT = 3;
 const REACTIVE_ENVELOPE_EXPIRY_MULTIPLIER = 4;
-function buildReactiveEnvelopeInput(message, config) {
+function buildReactiveEnvelopeInput(message, config, surface, privateConnectorPolicy) {
     const policy = (0, reactive_config_js_1.getReactiveRoutePolicy)(message, config);
     return {
         agent_id: 'worker',
@@ -229,7 +238,9 @@ function buildReactiveEnvelopeInput(message, config) {
         trigger_context: { user_text: message.text },
         scope: {
             project_refs: policy.projectRefs,
-            raw_connectors: policy.rawConnectors,
+            raw_connectors: [
+                ...privateConnectorPolicy.projectRawConnectors(surface, policy.rawConnectors),
+            ],
             // Identity scopes only - the grant mirror is an enforcement-layer READ
             // allowance, never issued into the envelope (PR #217 review: issuing it
             // here widened this chat's raw narrowing back to every sibling channel
@@ -308,6 +319,8 @@ class MessageRouter {
     config;
     envelopeConfig;
     envelopeAuthority;
+    privateConnectorPolicy;
+    reportCarry;
     roleManager;
     promptEnhancer;
     gatewayRegistry = null;
@@ -493,12 +506,15 @@ class MessageRouter {
         };
         return this.memoryAuditQueue.enqueue(auditJob);
     }
-    constructor(sessionStore, agentLoop, mamaApi, config = {}, envelopeConfig, envelopeAuthority) {
+    constructor(sessionStore, agentLoop, mamaApi, config = {}, envelopeConfig, envelopeAuthority, dependencies = {}) {
         this.sessionStore = sessionStore;
         this.agentLoop = agentLoop;
         this.mamaApi = mamaApi;
         this.envelopeConfig = envelopeConfig;
         this.envelopeAuthority = envelopeAuthority;
+        this.privateConnectorPolicy =
+            dependencies.privateConnectorPolicy ?? DEFAULT_PRIVATE_CONNECTOR_POLICY;
+        this.reportCarry = dependencies.reportCarry;
         if (this.envelopeConfig && !this.envelopeAuthority) {
             throw new Error('[envelope] ReactiveEnvelopeConfig provided without EnvelopeAuthority');
         }
@@ -522,13 +538,14 @@ class MessageRouter {
             maxDecisions: this.config.maxDecisions,
         });
     }
-    buildReactiveEnvelope(message) {
+    buildReactiveEnvelope(message, agentContext) {
         const config = this.envelopeConfig;
         const authority = this.envelopeAuthority;
         if (!config || !authority) {
             return undefined;
         }
-        return authority.buildAndPersist(buildReactiveEnvelopeInput(message, config));
+        const surface = (0, private_connector_policy_js_1.resolvePrivatePrincipalSurface)({ agentContext });
+        return authority.buildAndPersist(buildReactiveEnvelopeInput(message, config, surface, this.privateConnectorPolicy));
     }
     /**
      * Create AgentContext for a message
@@ -541,9 +558,15 @@ class MessageRouter {
             channelId: message.channelId,
             chatType: typeof message.metadata?.chatType === 'string' ? message.metadata.chatType : undefined,
         });
-        const capabilities = this.roleManager.getCapabilities(role);
-        const limitations = this.roleManager.getLimitations(role);
-        const ctx = (0, context_prompt_builder_js_1.createAgentContext)(message.source, roleName, role, {
+        const surface = roleName === 'owner_console'
+            ? 'owner_console'
+            : roleName === 'os_agent'
+                ? 'os_agent'
+                : 'multi-agent-generic';
+        const projectedRole = this.privateConnectorPolicy.projectRole(surface, role);
+        const capabilities = this.roleManager.getCapabilities(projectedRole);
+        const limitations = this.roleManager.getLimitations(projectedRole);
+        const ctx = (0, context_prompt_builder_js_1.createAgentContext)(message.source, roleName, projectedRole, {
             sessionId,
             channelId: message.channelId,
             userId: message.userId,
@@ -726,6 +749,15 @@ This protects your credentials from being exposed in chat logs.`;
         };
         try {
             const agentContext = this.createAgentContext(message, session.id);
+            const reportCarryTarget = agentContext.roleName === 'owner_console' && message.source === 'telegram'
+                ? { source: message.source, channelId: message.channelId }
+                : null;
+            const reportCarryChannelKey = reportCarryTarget
+                ? (0, session_pool_js_1.buildChannelKey)(reportCarryTarget.source, reportCarryTarget.channelId)
+                : null;
+            const reportCarryPeek = reportCarryTarget
+                ? (this.reportCarry?.peek(reportCarryTarget) ?? null)
+                : null;
             const mediaInstructions = buildUploadedMediaInstructions(message, agentContext.role.allowedTools, agentContext.roleName === 'owner_console');
             // Save user message immediately for crash/refresh resilience
             this.sessionStore.appendMessage(session.id, {
@@ -751,22 +783,26 @@ This protects your credentials from being exposed in chat logs.`;
                     ? { agentId: agentContext.roleName, channelId: message.channelId }
                     : undefined;
                 const enhanced = await this.promptEnhancer.enhance(message.text, workspacePath, ruleContext);
-                // CONTINUE: skip expensive embedding search — Codex retains full conversation via threadId
+                // TG-05: every main backend keeps its live conversation in a durable
+                // runtime session. Only a genuinely new/replacement session rebuilds
+                // bounded MAMA context.
+                const needsFullContext = isNewCliSession;
+                // Persistent backends skip repeated retrieval after the first turn.
                 context =
-                    isNewCliSession && this.config.implicitLegacyContextSearch
+                    needsFullContext && this.config.implicitLegacyContextSearch
                         ? await this.contextInjector.getRelevantContext(message.text)
                         : { prompt: '', decisions: [], hasContext: false };
-                if (!isNewCliSession) {
+                if (!needsFullContext) {
                     systemPrompt = '';
                     logger.info('CONTINUE turn: skipping context injection');
                 }
                 else {
-                    // NEW session: full prompt build
+                    // New persistent session: full prompt build.
                     const sessionStartupContext = await this.contextInjector.getSessionStartupContext({
                         source: message.source,
                         channelId: message.channelId,
                     });
-                    systemPrompt = this.buildSystemPrompt(session, context.prompt, historyContext, sessionStartupContext, agentContext, enhanced, isNewCliSession, trelloAvailable);
+                    systemPrompt = this.buildSystemPrompt(session, context.prompt, historyContext, sessionStartupContext, agentContext, enhanced, true, trelloAvailable);
                 }
                 // 7. Run agent loop (with session info for lane-based concurrency)
                 const roleModel = agentContext.role.model;
@@ -779,6 +815,9 @@ This protects your credentials from being exposed in chat logs.`;
                         '  Codex:  codex login → roles.definitions.' +
                         agentContext.roleName +
                         '.model: gpt-5.4\n\n' +
+                        '  Cline:  cline auth cline → roles.definitions.' +
+                        agentContext.roleName +
+                        '.model: deepseek/deepseek-v4-flash\n\n' +
                         'Or run: mama init --reconfigure');
                 }
                 const roleMaxTurns = agentContext.role.maxTurns;
@@ -833,7 +872,7 @@ This protects your credentials from being exposed in chat logs.`;
                 let pendingNotices = false;
                 let pendingChannelNoticeCount = 0;
                 let pendingBroadcastNoticeCount = 0;
-                const envelope = this.buildReactiveEnvelope(message);
+                const envelope = this.buildReactiveEnvelope(message, agentContext);
                 const options = {
                     systemPrompt: effectivePrompt,
                     sessionPolicyFingerprint,
@@ -866,7 +905,7 @@ This protects your credentials from being exposed in chat logs.`;
                     // citation this ledger exists to refuse.
                     ...(causeFromOwnerMessage(sourceTurnId, sourceMessageRef) ?? {}),
                 };
-                if (this.config.backend === 'codex' && shouldResume) {
+                if ((this.config.backend === 'codex' || this.config.backend === 'cline') && shouldResume) {
                     options.freshSessionSystemPrompt = async () => {
                         const freshContext = this.config.implicitLegacyContextSearch
                             ? await this.contextInjector.getRelevantContext(message.text)
@@ -884,11 +923,9 @@ This protects your credentials from being exposed in chat logs.`;
                 else {
                     logger.info(`New CLI session (full: ${systemPrompt.length} chars)`);
                 }
-                // Context carry (plan v6 S1-T4): owner console turns reference the last
-                // DELIVERED full report. User-message prefix is the only channel that
-                // reaches the model on EVERY turn including CONTINUE (per-call system
-                // prompts never reach a pooled CLI process).
-                const carryPrefix = agentContext?.roleName === 'owner_console' ? (0, report_carry_js_1.buildReportCarryPrefix)() : '';
+                // TG-05/TG-06: carry is captured once before the model call and travels
+                // only in this turn's user message, never in a rebuilt system prompt.
+                const carryPrefix = reportCarryPeek?.prefix ?? '';
                 try {
                     if (shouldResume) {
                         // Per-channel notices PLUS the operator broadcast key: host-code
@@ -968,8 +1005,10 @@ This protects your credentials from being exposed in chat logs.`;
                     if (effectiveMessageText) {
                         contentBlocks.push({ type: 'text', text: effectiveMessageText });
                     }
-                    // Pre-analyze images via shared ImageAnalyzer
-                    if (hasImages) {
+                    // Claude uses its direct vision client. Durable Codex/Cline runtimes
+                    // receive the original image block and inspect the private workspace
+                    // media through their own native path, avoiding hidden Claude auth.
+                    if (hasImages && this.config.backend === 'claude') {
                         const { getImageAnalyzer } = await import('./image-analyzer.js');
                         const analysisText = protectImageAnalysis(message, await getImageAnalyzer().processContentBlocks(message.contentBlocks));
                         contentBlocks.length = 0;
@@ -983,6 +1022,9 @@ This protects your credentials from being exposed in chat logs.`;
                             if (block.type === 'text' && block.text) {
                                 contentBlocks.push(block);
                             }
+                            else if (block.type === 'image') {
+                                contentBlocks.push(block);
+                            }
                         }
                         if (mediaInstructions) {
                             contentBlocks.push({
@@ -1052,9 +1094,11 @@ This protects your credentials from being exposed in chat logs.`;
                 this.logAgentActivity(this.resolveFrontdoorAgentId(message), 'task_error', message.text?.slice(0, 200), undefined, durationMs, error instanceof Error ? error.message : String(error));
                 // CLI timeout or resume failure - invalidate session to force fresh start next time
                 const errorMsg = error instanceof Error ? error.message : String(error);
-                const isCriticalError = errorMsg.includes('timeout') ||
-                    errorMsg.includes('resume') ||
-                    errorMsg.includes('exited with code');
+                const normalizedErrorMsg = errorMsg.toLowerCase();
+                const isCriticalError = normalizedErrorMsg.includes('timeout') ||
+                    normalizedErrorMsg.includes('timed out') ||
+                    normalizedErrorMsg.includes('resume') ||
+                    normalizedErrorMsg.includes('exited with code');
                 if (isCriticalError) {
                     logger.warn(`CLI error detected, invalidating session: ${errorMsg}`);
                     sessionPool.invalidateSession(channelKey, cliSessionId);
@@ -1105,13 +1149,27 @@ This protects your credentials from being exposed in chat logs.`;
             // 6. Update session context — finalize assistant response
             // Use flushStreamingResponse first (updates existing turn from periodic flush),
             // fall back to appendMessage if no turn exists yet (non-streaming path)
-            const flushed = this.sessionStore.flushStreamingResponse(session.id, response);
-            if (!flushed) {
+            const persisted = this.sessionStore.flushStreamingResponse(session.id, response) ||
                 this.sessionStore.appendMessage(session.id, {
                     role: 'assistant',
                     content: response,
                     timestamp: Date.now(),
                 });
+            if (!persisted) {
+                throw new Error('Unable to persist final assistant response');
+            }
+            if (reportCarryPeek && reportCarryTarget && reportCarryChannelKey) {
+                try {
+                    this.reportCarry?.acknowledge({
+                        deliveryId: reportCarryPeek.deliveryId,
+                        target: reportCarryTarget,
+                        consumingChannelKey: reportCarryChannelKey,
+                        consumedAtIso: new Date().toISOString(),
+                    });
+                }
+                catch (error) {
+                    logger.warn(`[report-carry] acknowledgement failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
             }
             // Release session lock AFTER final persistence to prevent out-of-order turns
             releaseCliSessionLock();
@@ -1149,19 +1207,42 @@ This protects your credentials from being exposed in chat logs.`;
         const isOnboarding = !(0, node_fs_1.existsSync)(soulPath);
         // Hoist session history — reuse across onboarding check and prompt build
         const sessionHistory = this.sessionStore.formatContextForPrompt(session.id);
+        const surface = agentContext
+            ? (0, private_connector_policy_js_1.resolvePrivatePrincipalSurface)({ agentContext })
+            : 'multi-agent-generic';
+        const gatewayCatalog = agentContext
+            ? (0, gateway_tool_catalog_js_1.buildGatewayToolCatalog)({
+                surface,
+                allowedTools: agentContext.role.allowedTools,
+                blockedTools: agentContext.role.blockedTools,
+                privateConnectorPolicy: this.privateConnectorPolicy,
+            })
+            : null;
+        const durableNativeBackend = this.config.backend === 'codex' || this.config.backend === 'cline';
+        const privatePolicyPrompt = durableNativeBackend && surface === 'owner_console'
+            ? (0, console_brief_js_1.projectConsoleBriefForPrompt)('', this.privateConnectorPolicy).trim()
+            : '';
         const stableRolePolicy = agentContext
-            ? buildStableRolePolicyInstructions(agentContext, this.roleManager, trelloAvailable)
+            ? [
+                buildStableRolePolicyInstructions(agentContext, this.roleManager, trelloAvailable, this.privateConnectorPolicy),
+                privatePolicyPrompt,
+            ]
+                .filter(Boolean)
+                .join('\n\n')
             : '';
         // Onboarding is guided first contact, not operator duty. The awakening persona asks the
         // user's name and runs a personality quiz; ordering it to gather via gateway tools and
         // execute multi-step work would fight that flow and aim it at connectors that do not
         // exist yet. Evidence policy still travels; the operating posture does not.
         const onboardingRolePolicy = agentContext
-            ? buildStableRolePolicyInstructions(agentContext, this.roleManager, trelloAvailable, {
-                includeOperatingDiscipline: false,
-            })
+            ? [
+                buildStableRolePolicyInstructions(agentContext, this.roleManager, trelloAvailable, this.privateConnectorPolicy, { includeOperatingDiscipline: false }),
+                privatePolicyPrompt,
+            ]
+                .filter(Boolean)
+                .join('\n\n')
             : '';
-        const appendOnboardingRolePolicy = (basePrompt) => onboardingRolePolicy ? `${basePrompt}\n\n${onboardingRolePolicy}\n` : basePrompt;
+        const appendOnboardingRolePolicy = (basePrompt) => this.projectPrivatePromptText(onboardingRolePolicy ? `${basePrompt}\n\n${onboardingRolePolicy}\n` : basePrompt);
         if (isOnboarding) {
             // Check if we have existing conversation
             const hasHistory = sessionHistory && sessionHistory !== 'New conversation';
@@ -1284,7 +1365,10 @@ ${historyContext}
             if (agentContext.roleName === 'owner_console') {
                 const consoleBrief = (0, console_brief_js_1.loadConsoleBrief)();
                 if (consoleBrief.trim()) {
-                    prompt += `\n\n${consoleBrief.trim()}\n`;
+                    const projectedBrief = (0, console_brief_js_1.projectConsoleBriefForPrompt)(consoleBrief, this.privateConnectorPolicy);
+                    prompt += `\n\n${((gatewayCatalog && !durableNativeBackend) || privatePolicyPrompt
+                        ? (0, private_prompt_overlay_js_1.stripMarkedPrivatePromptOverlays)(projectedBrief)
+                        : projectedBrief).trim()}\n`;
                 }
             }
         }
@@ -1297,38 +1381,48 @@ ${historyContext}
         // See process() method for user-message injection.
         // Include gateway tools directly in system prompt (priority 1 protection)
         // so they don't get truncated by PromptSizeMonitor as a separate layer.
-        // Prompt-permission coherence: advertise ONLY the tools this role can
-        // execute - the previous role-agnostic single cache advertised the full
-        // catalog, teaching the model to call tools the executor then denied.
-        // getGatewayToolsPrompt keeps its own per-disallowed-key cache, and its
-        // per-bullet filter preserves the '## Gateway Tools' marker - AgentLoop
-        // must keep seeing that marker or it double-injects an UNFILTERED catalog
-        // (agent-loop alreadyHasTools check).
-        const disallowedForRole = agentContext
-            ? tool_registry_js_1.ToolRegistry.getValidToolNames().filter((name) => !this.roleManager.isToolAllowed(agentContext.role, name))
-            : undefined;
-        const gatewayToolsPrompt = this.config.backend === 'codex' ? '' : (0, agent_loop_js_1.getGatewayToolsPrompt)(disallowedForRole) || '';
+        // Prompt-permission coherence: the policy-keyed catalog is generated from
+        // the final exact role projection, so cached private text cannot cross a
+        // connector-policy or principal boundary.
+        const gatewayToolsPrompt = durableNativeBackend ? '' : (gatewayCatalog?.prompt ?? '');
         if (gatewayToolsPrompt) {
             prompt += `\n---\n\n${gatewayToolsPrompt}\n`;
         }
-        return prompt;
+        return this.projectPrivatePromptText(prompt);
     }
     buildSessionPolicyFingerprint(agentContext, enhanced, model, trelloAvailable) {
         const soulPath = (0, node_path_1.join)((0, node_os_1.homedir)(), '.mama', 'SOUL.md');
         const baseInstructions = (0, node_fs_1.existsSync)(soulPath)
             ? (0, agent_loop_js_1.loadComposedSystemPrompt)(false, agentContext)
             : complete_autonomous_prompt_js_1.COMPLETE_AUTONOMOUS_PROMPT;
+        const surface = (0, private_connector_policy_js_1.resolvePrivatePrincipalSurface)({ agentContext });
+        const gatewayCatalog = (0, gateway_tool_catalog_js_1.buildGatewayToolCatalog)({
+            surface,
+            allowedTools: agentContext.role.allowedTools,
+            blockedTools: agentContext.role.blockedTools,
+            privateConnectorPolicy: this.privateConnectorPolicy,
+        });
         return hashSessionPolicyFingerprint({
             baseInstructions,
             agentsContent: enhanced.agentsContent,
             rulesContent: enhanced.rulesContent,
             model,
-            stableRolePolicy: buildStableRolePolicyInstructions(agentContext, this.roleManager, trelloAvailable) +
+            stableRolePolicy: buildStableRolePolicyInstructions(agentContext, this.roleManager, trelloAvailable, this.privateConnectorPolicy) +
                 // Brief edits must rotate the durable-session policy (re-anchor carries
                 // the new manual); non-owner roles contribute an empty string.
-                (agentContext.roleName === 'owner_console' ? `\n${(0, console_brief_js_1.loadConsoleBrief)()}` : ''),
+                (agentContext.roleName === 'owner_console'
+                    ? `\n${(0, console_brief_js_1.projectConsoleBriefForPrompt)((0, console_brief_js_1.loadConsoleBrief)(), this.privateConnectorPolicy)}`
+                    : '') +
+                `\n${gatewayCatalog.cacheKey}`,
         });
     }
+    /** Remove only a complete, structurally valid host-generated private overlay. */
+    projectPrivatePromptText(prompt) {
+        if (this.privateConnectorPolicy.enabledPrivateConnectors.length > 0) {
+            return prompt;
+        }
+        return (0, private_prompt_overlay_js_1.stripMarkedPrivatePromptOverlays)(prompt);
+    }
     /**
      * Build minimal prompt for resumed CLI sessions.
      * CLI already has full system prompt from initial request.