@jungjaehoon/mama-os 0.35.0 → 0.36.1

package/dist/agent/gateway-tool-executor.js

@@ -79,11 +79,15 @@ const wiki_publish_adapter_js_1 = require("../wiki-artifacts/wiki-publish-adapte
 const changes_projection_js_1 = require("../operator/changes-projection.js");
 const read_js_1 = require("../evidence/read.js");
 const private_connector_policy_js_1 = require("../connectors/private-connector-policy.js");
+const member_candidate_store_js_1 = require("../gateways/member-candidate-store.js");
 const DEFAULT_PRIVATE_CONNECTOR_POLICY = (0, private_connector_policy_js_1.resolvePrivateConnectorPolicy)({
     ok: true,
     config: {},
     enabledNames: [],
 });
+function isReportPublishResult(value) {
+    return value !== undefined && !Array.isArray(value);
+}
 function serializeTaskToolRecord(task) {
     return {
         ...task,
@@ -202,6 +206,13 @@ const ENVELOPE_REQUIRED_SURFACES = new Set([
     'reactive_internal',
     'code_act',
 ]);
+const OWNER_CONSOLE_MEMBER_TOOLS = new Set([
+    'member_candidates',
+    'member_register',
+    'member_suspend',
+    'member_offboard',
+    'member_list',
+]);
 class ContextPacketProvenanceError extends Error {
 }
 function asRecord(value) {
@@ -373,6 +384,7 @@ class GatewayToolExecutor {
     channelGrantProvider;
     envelopeIssuanceMode;
     metricsStore;
+    principalRepository;
     contextCompileService;
     temporalContextPacketLookup;
     currentContext = null;
@@ -489,6 +501,8 @@ class GatewayToolExecutor {
             signal: active.signal,
             parentToolName: active.parentToolName ?? fallback.parentToolName,
             backgroundTasks: active.backgroundTasks ?? fallback.backgroundTasks,
+            // Never merged from fallback - one snapshot belongs to one gateway call only.
+            channelGrantSnapshot: active.channelGrantSnapshot,
             // Never merged from fallback - blocks are strictly per-call.
             disallowedGatewayTools: active.disallowedGatewayTools,
         };
@@ -566,6 +580,9 @@ class GatewayToolExecutor {
     setWikiPublishAdapter(adapter) {
         this.wikiPublishAdapter = adapter;
     }
+    setPrincipalRepository(repository) {
+        this.principalRepository = repository;
+    }
     /** Check if a memory agent is available for routing memory writes. */
     hasMemoryAgent() {
         return this.memoryAgentProcessManager !== null;
@@ -582,6 +599,7 @@ class GatewayToolExecutor {
         this.sessionStore = options.sessionStore;
         this.envelopeIssuanceMode = options.envelopeIssuanceMode ?? 'enabled';
         this.metricsStore = options.metricsStore ?? null;
+        this.principalRepository = options.principalRepository ?? null;
         this.contextCompileService = options.contextCompileService;
         this.temporalContextPacketLookup =
             options.temporalContextPacketLookup ??
@@ -838,7 +856,7 @@ class GatewayToolExecutor {
             }
             try {
                 this.envelopeEnforcer.check(ctx.envelope, toolName, enforcementInput, {
-                    readScopeMirror: this.readScopeMirrorFor(toolName, ctx.envelope),
+                    readScopeMirror: this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot),
                 });
                 return undefined;
             }
@@ -938,7 +956,10 @@ class GatewayToolExecutor {
         const baseCtx = this.mergeWithFallbackExecutionContext(this.executionContextStorage.getStore());
         baseCtx.signal?.throwIfAborted();
         const gatewayCallId = baseCtx.gatewayCallId ?? `gw_${(0, crypto_1.randomUUID)().replace(/-/g, '')}`;
-        const ctx = { ...baseCtx, gatewayCallId };
+        const channelGrantSnapshot = baseCtx.envelope && index_js_1.MIRROR_READABLE_TOOLS.has(toolName)
+            ? snapshotChannelGrant(this.channelGrantProvider)
+            : undefined;
+        const ctx = { ...baseCtx, gatewayCallId, channelGrantSnapshot };
         const effectiveInput = this.applyEnvelopeScopedReadDefaults(toolName, input, ctx);
         const computedScopeAudit = this.computeScopeAuditFields(toolName, effectiveInput, ctx);
         const scopeAudit = ctx.temporalWorkContext
@@ -995,7 +1016,7 @@ class GatewayToolExecutor {
             await this.failDirectModelRunIfNeeded(traceState, toolName, auditError).catch((finalizationError) => {
                 securityLogger.warn('[model-run] failed to finalize failed direct model run', finalizationError);
             });
-            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, auditError);
+            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, this.gatewayTraceDetails(toolName, undefined), auditError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
@@ -1010,13 +1031,13 @@ class GatewayToolExecutor {
             }
         }
         catch (postRunError) {
-            this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, postRunError);
+            this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, this.gatewayTraceDetails(toolName, auditResult), postRunError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
             throw postRunError;
         }
-        this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId);
+        this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, this.gatewayTraceDetails(toolName, auditResult));
         if (scopeAudit.mismatch) {
             this.alarmScopeMismatch(activeCtx, toolName);
         }
@@ -1174,7 +1195,9 @@ class GatewayToolExecutor {
             return { requestedScopes, envelopeScopesSnapshot, mismatch: 0 };
         }
         if (!requestedScopes || requestedScopes.length === 0) {
-            if (toolName === 'context_compile' && Array.isArray(input.scopes)) {
+            const requestedScopeValue = input.scopes;
+            if (toolName === 'context_compile' &&
+                (requestedScopeValue === undefined || Array.isArray(requestedScopeValue))) {
                 return { requestedScopes, envelopeScopesSnapshot, mismatch: 0 };
             }
             return {
@@ -1183,7 +1206,11 @@ class GatewayToolExecutor {
                 mismatch: envelopeScopesSnapshot.length > 0 ? 1 : 0,
             };
         }
-        const envelopeScopeKeys = new Set(envelopeScopesSnapshot.map(memoryScopeKey));
+        const effectiveAuditAllowance = [
+            ...envelopeScopesSnapshot,
+            ...(this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot) ?? []),
+        ];
+        const envelopeScopeKeys = new Set(effectiveAuditAllowance.map(memoryScopeKey));
         const hasOutOfEnvelopeScope = requestedScopes.some((scope) => !envelopeScopeKeys.has(memoryScopeKey(scope)));
         return {
             requestedScopes,
@@ -1230,7 +1257,7 @@ class GatewayToolExecutor {
         const envelopeScopes = ctx.envelope
             ? [
                 ...ctx.envelope.scope.memory_scopes,
-                ...(0, read_js_1.mirrorReadScopes)(ctx.envelope, this.channelGrantProvider()),
+                ...(this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot) ?? []),
             ]
             : null;
         const allowedScopes = envelopeScopes ?? this.deriveMemoryScopesFromActiveContext(ctx) ?? [];
@@ -1277,15 +1304,14 @@ class GatewayToolExecutor {
     }
     /**
      * The grant-mirror READ allowance for memory tools (see mirrorReadScopes):
-     * computed lazily - only memory-scoped tools pay the connector-config read -
-     * and against the LIVE grant, so a channel the owner removes stops being
-     * readable on the next call, mid-envelope included.
+     * computed from the gateway-call snapshot, so every authority check agrees
+     * within one call while the next call observes a fresh live grant.
      */
-    readScopeMirrorFor(toolName, envelope) {
-        if (!index_js_1.MIRROR_READABLE_TOOLS.has(toolName)) {
+    readScopeMirrorFor(toolName, envelope, channelGrantSnapshot) {
+        if (!index_js_1.MIRROR_READABLE_TOOLS.has(toolName) || !channelGrantSnapshot) {
             return undefined;
         }
-        return (0, read_js_1.mirrorReadScopes)(envelope, this.channelGrantProvider());
+        return (0, read_js_1.mirrorReadScopes)(envelope, channelGrantSnapshot);
     }
     applyEnvelopeScopedReadDefaults(toolName, input, ctx) {
         // Memory read tools must inherit envelope scopes consistently when the
@@ -1327,7 +1353,7 @@ class GatewayToolExecutor {
         // READ defaulting: identity scopes plus the grant mirror, so an omitted
         // scopes arg recalls everything this run is ALLOWED to read instead of
         // silently less than the enforcer would accept.
-        const mirror = (0, read_js_1.mirrorReadScopes)(ctx.envelope, this.channelGrantProvider());
+        const mirror = this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot) ?? [];
         const seen = new Set(ctx.envelope.scope.memory_scopes.map((scope) => `${scope.kind}:${scope.id}`));
         return {
             ...scopedInput,
@@ -1420,7 +1446,7 @@ class GatewayToolExecutor {
             typeof candidate.reasoning === 'string' &&
             candidate.reasoning.length > 0);
     }
-    logGatewayToolCall(ctx, toolName, result, durationMs, scopeAudit, gatewayCallId, error) {
+    logGatewayToolCall(ctx, toolName, result, durationMs, scopeAudit, gatewayCallId, toolDetails, error) {
         try {
             if (!this.sessionsDb) {
                 return;
@@ -1454,6 +1480,7 @@ class GatewayToolExecutor {
                     ...(ctx?.workorderAttemptId !== undefined
                         ? { workorder_attempt_id: ctx.workorderAttemptId }
                         : {}),
+                    ...toolDetails,
                 },
             });
         }
@@ -1461,6 +1488,16 @@ class GatewayToolExecutor {
             securityLogger.warn('[envelope] gateway audit log failed (non-fatal)', logErr);
         }
     }
+    gatewayTraceDetails(toolName, result) {
+        if (toolName !== 'report_publish')
+            return {};
+        const slotIds = result?.acceptedSlotIds;
+        if (!Array.isArray(slotIds) || slotIds.some((slotId) => typeof slotId !== 'string'))
+            return {};
+        // Audit only the structural slot identity. Board HTML/content must never
+        // enter gateway trace details.
+        return { report_slot_ids: [...slotIds].sort() };
+    }
     alarmScopeMismatch(ctx, toolName) {
         try {
             this.metricsStore?.record({
@@ -1494,6 +1531,13 @@ class GatewayToolExecutor {
         if (!VALID_TOOLS.includes(toolName)) {
             throw new types_js_1.AgentError(`Unknown tool: ${toolName}`, 'UNKNOWN_TOOL', undefined, false);
         }
+        if (OWNER_CONSOLE_MEMBER_TOOLS.has(toolName) &&
+            this.getExecutionState().agentContext?.roleName !== 'owner_console') {
+            return {
+                success: false,
+                error: `Permission denied: ${toolName} is restricted to owner_console.`,
+            };
+        }
         if (toolName.startsWith('drive_') &&
             this.getExecutionState().agentContext?.roleName !== 'owner_console') {
             return {
@@ -1751,11 +1795,28 @@ class GatewayToolExecutor {
                         }
                     }
                     if (this.reportPublisher) {
-                        this.reportPublisher(slotsInput);
-                        const slotNames = Object.keys(slotsInput);
+                        const publication = this.reportPublisher(slotsInput);
+                        // Backward compatibility: older injected publishers return void
+                        // or the exact changed slot array. Production distinguishes slots
+                        // accepted as present from slots whose HTML actually changed.
+                        const acceptedSlotIds = Array.isArray(publication)
+                            ? [...new Set(publication)].sort()
+                            : isReportPublishResult(publication)
+                                ? [...new Set(publication.acceptedSlotIds)].sort()
+                                : Object.keys(slotsInput).sort();
+                        const changedSlotIds = Array.isArray(publication)
+                            ? [...acceptedSlotIds]
+                            : isReportPublishResult(publication)
+                                ? [...new Set(publication.changedSlotIds)].sort()
+                                : [...acceptedSlotIds];
+                        if (acceptedSlotIds.length === 0) {
+                            throw new types_js_1.AgentError('Report publisher accepted no slots', 'TOOL_ERROR', undefined, false);
+                        }
                         return {
                             success: true,
-                            message: `Dashboard updated: ${slotNames.join(', ')} (${slotNames.length} slots)`,
+                            acceptedSlotIds,
+                            changedSlotIds,
+                            message: `Dashboard report accepted: ${acceptedSlotIds.join(', ')} (${acceptedSlotIds.length} accepted, ${changedSlotIds.length} changed)`,
                         };
                     }
                     throw new types_js_1.AgentError('Report publisher not configured', 'TOOL_ERROR', undefined, false);
@@ -1862,6 +1923,103 @@ class GatewayToolExecutor {
                         message: 'Lesson appended to your operating brief; it applies from the next session re-anchor.',
                     };
                 }
+                case 'member_candidates': {
+                    const candidates = (0, member_candidate_store_js_1.getMemberCandidateStore)()
+                        .list(Date.now())
+                        .map((candidate) => ({
+                        candidateId: candidate.candidateId,
+                        ...(candidate.displayName === undefined
+                            ? {}
+                            : {
+                                displayName: (0, untrusted_content_js_1.wrapUntrustedContent)('member-candidate-display-name', candidate.displayName),
+                            }),
+                        firstSeen: candidate.firstSeen,
+                    }));
+                    return { success: true, candidates };
+                }
+                case 'member_register': {
+                    const fields = Object.keys(input);
+                    const candidateId = input.candidate_id;
+                    if (fields.length !== 1 ||
+                        fields[0] !== 'candidate_id' ||
+                        typeof candidateId !== 'string' ||
+                        candidateId.trim().length === 0) {
+                        return {
+                            success: false,
+                            code: 'member_candidate_required',
+                            error: 'member_register accepts exactly one candidate_id from member_candidates.',
+                        };
+                    }
+                    if (!this.principalRepository) {
+                        return {
+                            success: false,
+                            code: 'principal_repository_unavailable',
+                            error: 'Principal repository is not wired on this deployment.',
+                        };
+                    }
+                    const now = Date.now();
+                    const candidateStore = (0, member_candidate_store_js_1.getMemberCandidateStore)();
+                    const candidate = candidateStore.get(candidateId, now);
+                    if (!candidate) {
+                        return {
+                            success: false,
+                            code: 'member_candidate_missing',
+                            error: 'Member candidate is missing or expired.',
+                        };
+                    }
+                    const principalId = this.principalRepository.registerMember({
+                        connector: candidate.connector,
+                        namespace: candidate.namespace,
+                        externalId: candidate.externalId,
+                        ...(candidate.displayName === undefined ? {} : { displayName: candidate.displayName }),
+                        now,
+                    });
+                    candidateStore.delete(candidate.candidateId);
+                    return { success: true, principalId };
+                }
+                case 'member_suspend':
+                case 'member_offboard': {
+                    const principalId = input.principal_id;
+                    if (typeof principalId !== 'string' || principalId.trim().length === 0) {
+                        return {
+                            success: false,
+                            code: 'principal_id_required',
+                            error: `${toolName} requires principal_id.`,
+                        };
+                    }
+                    if (!this.principalRepository) {
+                        return {
+                            success: false,
+                            code: 'principal_repository_unavailable',
+                            error: 'Principal repository is not wired on this deployment.',
+                        };
+                    }
+                    const now = Date.now();
+                    if (toolName === 'member_suspend') {
+                        this.principalRepository.suspend(principalId, now);
+                        return { success: true, principalId, status: 'suspended' };
+                    }
+                    this.principalRepository.offboard(principalId, now);
+                    return { success: true, principalId, status: 'offboarded' };
+                }
+                case 'member_list': {
+                    if (!this.principalRepository) {
+                        return {
+                            success: false,
+                            code: 'principal_repository_unavailable',
+                            error: 'Principal repository is not wired on this deployment.',
+                        };
+                    }
+                    const members = this.principalRepository.listMembers().map((member) => ({
+                        ...member,
+                        ...(member.displayName === undefined
+                            ? {}
+                            : {
+                                displayName: (0, untrusted_content_js_1.wrapUntrustedContent)('member-list-display-name', member.displayName),
+                            }),
+                    }));
+                    return { success: true, members };
+                }
                 case 'board_read': {
                     if (!this.reportReader) {
                         return {
@@ -3162,7 +3320,7 @@ class GatewayToolExecutor {
             // back excerpts from every other channel of the connector. Citation would then be
             // strictly wider than reading, which is the one thing this path must never be.
             const citationChannels = ctx.envelope
-                ? (0, read_js_1.narrowGrantToEnvelope)((0, read_js_1.liveBoundaryChannels)(), {
+                ? (0, read_js_1.narrowGrantToEnvelope)(ctx.channelGrantSnapshot ?? {}, {
                     connectors,
                     scopes: ctx.envelope.scope.memory_scopes ?? [],
                 })
@@ -3307,6 +3465,7 @@ class GatewayToolExecutor {
                 caller: 'gateway',
                 envelope: ctx.envelope,
                 modelRunId: ctx.modelRunId ?? null,
+                channelGrantSnapshot: ctx.channelGrantSnapshot,
                 input: effectiveInput,
                 signal: ctx.signal,
                 beforePersist: temporalContext
@@ -3428,6 +3587,10 @@ function getContextPacketIdForTrustedProvenance(input) {
 function dedupeSourceRefs(refs) {
     return [...new Set(refs)];
 }
+function snapshotChannelGrant(provider) {
+    const liveGrant = provider();
+    return Object.fromEntries(Object.entries(liveGrant).map(([connector, channels]) => [connector, [...channels]]));
+}
 function normalizeMemoryScopes(value) {
     if (!Array.isArray(value) || value.length === 0) {
         return null;