@jungjaehoon/mama-os 0.36.0 → 0.37.0

package/dist/agent/gateway-tool-executor.js

@@ -85,6 +85,9 @@ const DEFAULT_PRIVATE_CONNECTOR_POLICY = (0, private_connector_policy_js_1.resol
     config: {},
     enabledNames: [],
 });
+function isReportPublishResult(value) {
+    return value !== undefined && !Array.isArray(value);
+}
 function serializeTaskToolRecord(task) {
     return {
         ...task,
@@ -404,12 +407,16 @@ class GatewayToolExecutor {
         this.obsidianVaultName = vaultName ?? null;
     }
     taskLedger = null;
+    ownerEventEffectLedger = null;
     setTaskLedger(ledger) {
         this.taskLedger = ledger;
     }
     getTaskLedger() {
         return this.taskLedger;
     }
+    setOwnerEventEffectLedger(ledger) {
+        this.ownerEventEffectLedger = ledger;
+    }
     agentEventBus = null;
     setAgentEventBus(bus) {
         this.agentEventBus = bus;
@@ -457,6 +464,7 @@ class GatewayToolExecutor {
             workorderAttemptId: executionContext?.workorderAttemptId,
             temporalWorkContext: executionContext?.temporalWorkContext,
             causeEventIds: executionContext?.causeEventIds,
+            ownerEventEffects: executionContext?.ownerEventEffects,
             signal: executionContext?.signal,
             parentToolName: executionContext?.parentToolName,
             backgroundTasks: executionContext?.backgroundTasks,
@@ -495,9 +503,12 @@ class GatewayToolExecutor {
             // Never merged from fallback - temporal authority belongs to one claimed run only.
             temporalWorkContext: active.temporalWorkContext,
             causeEventIds: active.causeEventIds,
+            ownerEventEffects: active.ownerEventEffects,
             signal: active.signal,
             parentToolName: active.parentToolName ?? fallback.parentToolName,
             backgroundTasks: active.backgroundTasks ?? fallback.backgroundTasks,
+            // Never merged from fallback - one snapshot belongs to one gateway call only.
+            channelGrantSnapshot: active.channelGrantSnapshot,
             // Never merged from fallback - blocks are strictly per-call.
             disallowedGatewayTools: active.disallowedGatewayTools,
         };
@@ -851,7 +862,7 @@ class GatewayToolExecutor {
             }
             try {
                 this.envelopeEnforcer.check(ctx.envelope, toolName, enforcementInput, {
-                    readScopeMirror: this.readScopeMirrorFor(toolName, ctx.envelope),
+                    readScopeMirror: this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot),
                 });
                 return undefined;
             }
@@ -951,7 +962,10 @@ class GatewayToolExecutor {
         const baseCtx = this.mergeWithFallbackExecutionContext(this.executionContextStorage.getStore());
         baseCtx.signal?.throwIfAborted();
         const gatewayCallId = baseCtx.gatewayCallId ?? `gw_${(0, crypto_1.randomUUID)().replace(/-/g, '')}`;
-        const ctx = { ...baseCtx, gatewayCallId };
+        const channelGrantSnapshot = baseCtx.envelope && index_js_1.MIRROR_READABLE_TOOLS.has(toolName)
+            ? snapshotChannelGrant(this.channelGrantProvider)
+            : undefined;
+        const ctx = { ...baseCtx, gatewayCallId, channelGrantSnapshot };
         const effectiveInput = this.applyEnvelopeScopedReadDefaults(toolName, input, ctx);
         const computedScopeAudit = this.computeScopeAuditFields(toolName, effectiveInput, ctx);
         const scopeAudit = ctx.temporalWorkContext
@@ -1008,7 +1022,7 @@ class GatewayToolExecutor {
             await this.failDirectModelRunIfNeeded(traceState, toolName, auditError).catch((finalizationError) => {
                 securityLogger.warn('[model-run] failed to finalize failed direct model run', finalizationError);
             });
-            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, auditError);
+            this.logGatewayToolCall(activeCtx, toolName, undefined, Date.now() - startedAt, scopeAudit, gatewayCallId, this.gatewayTraceDetails(toolName, undefined), auditError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
@@ -1023,13 +1037,13 @@ class GatewayToolExecutor {
             }
         }
         catch (postRunError) {
-            this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, postRunError);
+            this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, this.gatewayTraceDetails(toolName, auditResult), postRunError);
             if (scopeAudit.mismatch) {
                 this.alarmScopeMismatch(activeCtx, toolName);
             }
             throw postRunError;
         }
-        this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId);
+        this.logGatewayToolCall(activeCtx, toolName, auditResult, Date.now() - startedAt, scopeAudit, gatewayCallId, this.gatewayTraceDetails(toolName, auditResult));
         if (scopeAudit.mismatch) {
             this.alarmScopeMismatch(activeCtx, toolName);
         }
@@ -1187,7 +1201,9 @@ class GatewayToolExecutor {
             return { requestedScopes, envelopeScopesSnapshot, mismatch: 0 };
         }
         if (!requestedScopes || requestedScopes.length === 0) {
-            if (toolName === 'context_compile' && Array.isArray(input.scopes)) {
+            const requestedScopeValue = input.scopes;
+            if (toolName === 'context_compile' &&
+                (requestedScopeValue === undefined || Array.isArray(requestedScopeValue))) {
                 return { requestedScopes, envelopeScopesSnapshot, mismatch: 0 };
             }
             return {
@@ -1196,7 +1212,11 @@ class GatewayToolExecutor {
                 mismatch: envelopeScopesSnapshot.length > 0 ? 1 : 0,
             };
         }
-        const envelopeScopeKeys = new Set(envelopeScopesSnapshot.map(memoryScopeKey));
+        const effectiveAuditAllowance = [
+            ...envelopeScopesSnapshot,
+            ...(this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot) ?? []),
+        ];
+        const envelopeScopeKeys = new Set(effectiveAuditAllowance.map(memoryScopeKey));
         const hasOutOfEnvelopeScope = requestedScopes.some((scope) => !envelopeScopeKeys.has(memoryScopeKey(scope)));
         return {
             requestedScopes,
@@ -1243,7 +1263,7 @@ class GatewayToolExecutor {
         const envelopeScopes = ctx.envelope
             ? [
                 ...ctx.envelope.scope.memory_scopes,
-                ...(0, read_js_1.mirrorReadScopes)(ctx.envelope, this.channelGrantProvider()),
+                ...(this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot) ?? []),
             ]
             : null;
         const allowedScopes = envelopeScopes ?? this.deriveMemoryScopesFromActiveContext(ctx) ?? [];
@@ -1290,15 +1310,14 @@ class GatewayToolExecutor {
     }
     /**
      * The grant-mirror READ allowance for memory tools (see mirrorReadScopes):
-     * computed lazily - only memory-scoped tools pay the connector-config read -
-     * and against the LIVE grant, so a channel the owner removes stops being
-     * readable on the next call, mid-envelope included.
+     * computed from the gateway-call snapshot, so every authority check agrees
+     * within one call while the next call observes a fresh live grant.
      */
-    readScopeMirrorFor(toolName, envelope) {
-        if (!index_js_1.MIRROR_READABLE_TOOLS.has(toolName)) {
+    readScopeMirrorFor(toolName, envelope, channelGrantSnapshot) {
+        if (!index_js_1.MIRROR_READABLE_TOOLS.has(toolName) || !channelGrantSnapshot) {
             return undefined;
         }
-        return (0, read_js_1.mirrorReadScopes)(envelope, this.channelGrantProvider());
+        return (0, read_js_1.mirrorReadScopes)(envelope, channelGrantSnapshot);
     }
     applyEnvelopeScopedReadDefaults(toolName, input, ctx) {
         // Memory read tools must inherit envelope scopes consistently when the
@@ -1340,7 +1359,7 @@ class GatewayToolExecutor {
         // READ defaulting: identity scopes plus the grant mirror, so an omitted
         // scopes arg recalls everything this run is ALLOWED to read instead of
         // silently less than the enforcer would accept.
-        const mirror = (0, read_js_1.mirrorReadScopes)(ctx.envelope, this.channelGrantProvider());
+        const mirror = this.readScopeMirrorFor(toolName, ctx.envelope, ctx.channelGrantSnapshot) ?? [];
         const seen = new Set(ctx.envelope.scope.memory_scopes.map((scope) => `${scope.kind}:${scope.id}`));
         return {
             ...scopedInput,
@@ -1433,7 +1452,7 @@ class GatewayToolExecutor {
             typeof candidate.reasoning === 'string' &&
             candidate.reasoning.length > 0);
     }
-    logGatewayToolCall(ctx, toolName, result, durationMs, scopeAudit, gatewayCallId, error) {
+    logGatewayToolCall(ctx, toolName, result, durationMs, scopeAudit, gatewayCallId, toolDetails, error) {
         try {
             if (!this.sessionsDb) {
                 return;
@@ -1467,6 +1486,7 @@ class GatewayToolExecutor {
                     ...(ctx?.workorderAttemptId !== undefined
                         ? { workorder_attempt_id: ctx.workorderAttemptId }
                         : {}),
+                    ...toolDetails,
                 },
             });
         }
@@ -1474,6 +1494,16 @@ class GatewayToolExecutor {
             securityLogger.warn('[envelope] gateway audit log failed (non-fatal)', logErr);
         }
     }
+    gatewayTraceDetails(toolName, result) {
+        if (toolName !== 'report_publish')
+            return {};
+        const slotIds = result?.acceptedSlotIds;
+        if (!Array.isArray(slotIds) || slotIds.some((slotId) => typeof slotId !== 'string'))
+            return {};
+        // Audit only the structural slot identity. Board HTML/content must never
+        // enter gateway trace details.
+        return { report_slot_ids: [...slotIds].sort() };
+    }
     alarmScopeMismatch(ctx, toolName) {
         try {
             this.metricsStore?.record({
@@ -1643,11 +1673,73 @@ class GatewayToolExecutor {
                         success: true,
                         result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.download(input, this.getExecutionState().signal)),
                     };
-                case 'drive_upload':
-                    return {
-                        success: true,
-                        result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.upload(input)),
-                    };
+                case 'drive_upload': {
+                    const uploadInput = input;
+                    const state = this.getExecutionState();
+                    const sourceMessageRef = state.sourceMessageRef;
+                    if (!sourceMessageRef?.startsWith('owner-event:')) {
+                        return {
+                            success: true,
+                            result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(await this.driveTools.upload(uploadInput)),
+                        };
+                    }
+                    const effect = this.requireOwnerEventEffect(uploadInput.effect_key, 'drive_upload');
+                    const ledger = this.requireOwnerEventEffectLedger();
+                    const occurrence = `${sourceMessageRef}:drive:${effect.actionKey}`;
+                    let reservation = ledger.inspect(effect.batchId, effect.actionKey, 'drive_upload');
+                    if (reservation?.state === 'confirmed') {
+                        if (!reservation.result) {
+                            throw new Error('Confirmed Drive upload is missing its durable result');
+                        }
+                        return { success: true, result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(reservation.result) };
+                    }
+                    if (!reservation) {
+                        // Local validation and the read-only marker lookup are safely retryable.
+                        // Do them before the durable transition that means a create may have escaped.
+                        const preparation = await this.driveTools.prepareUpload(uploadInput, occurrence);
+                        reservation = ledger.begin(effect.batchId, effect.actionKey, 'drive_upload', {
+                            folderId: preparation.prepared.folderId,
+                            fileName: preparation.prepared.fileName,
+                        });
+                        if (reservation.state === 'confirmed') {
+                            if (!reservation.result) {
+                                throw new Error('Confirmed Drive upload is missing its durable result');
+                            }
+                            return { success: true, result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(reservation.result) };
+                        }
+                        if (reservation.state === 'execute' && preparation.existing) {
+                            ledger.confirm(effect.batchId, effect.actionKey, 'drive_upload', preparation.existing);
+                            return {
+                                success: true,
+                                result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(preparation.existing),
+                            };
+                        }
+                        if (reservation.state === 'execute') {
+                            try {
+                                const result = await this.driveTools.transmitPreparedUpload(preparation.prepared);
+                                ledger.confirm(effect.batchId, effect.actionKey, 'drive_upload', result);
+                                return { success: true, result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(result) };
+                            }
+                            catch (error) {
+                                ledger.markUnknown(effect.batchId, effect.actionKey, 'drive_upload', error instanceof Error ? error.message : String(error));
+                                throw error;
+                            }
+                        }
+                    }
+                    const folderId = reservation.intent.folderId;
+                    if (typeof folderId !== 'string') {
+                        throw new Error('Owner-event Drive reservation has invalid durable intent');
+                    }
+                    try {
+                        const result = await this.driveTools.recoverUpload(folderId, occurrence);
+                        ledger.confirm(effect.batchId, effect.actionKey, 'drive_upload', result);
+                        return { success: true, result: (0, drive_tools_js_1.asUntrustedDriveEvidence)(result) };
+                    }
+                    catch (error) {
+                        ledger.markUnknown(effect.batchId, effect.actionKey, 'drive_upload', error instanceof Error ? error.message : String(error));
+                        throw error;
+                    }
+                }
                 // Browser tools
                 case 'os_get_config':
                     return await this.executeGetConfig(input);
@@ -1771,11 +1863,28 @@ class GatewayToolExecutor {
                         }
                     }
                     if (this.reportPublisher) {
-                        this.reportPublisher(slotsInput);
-                        const slotNames = Object.keys(slotsInput);
+                        const publication = this.reportPublisher(slotsInput);
+                        // Backward compatibility: older injected publishers return void
+                        // or the exact changed slot array. Production distinguishes slots
+                        // accepted as present from slots whose HTML actually changed.
+                        const acceptedSlotIds = Array.isArray(publication)
+                            ? [...new Set(publication)].sort()
+                            : isReportPublishResult(publication)
+                                ? [...new Set(publication.acceptedSlotIds)].sort()
+                                : Object.keys(slotsInput).sort();
+                        const changedSlotIds = Array.isArray(publication)
+                            ? [...acceptedSlotIds]
+                            : isReportPublishResult(publication)
+                                ? [...new Set(publication.changedSlotIds)].sort()
+                                : [...acceptedSlotIds];
+                        if (acceptedSlotIds.length === 0) {
+                            throw new types_js_1.AgentError('Report publisher accepted no slots', 'TOOL_ERROR', undefined, false);
+                        }
                         return {
                             success: true,
-                            message: `Dashboard updated: ${slotNames.join(', ')} (${slotNames.length} slots)`,
+                            acceptedSlotIds,
+                            changedSlotIds,
+                            message: `Dashboard report accepted: ${acceptedSlotIds.join(', ')} (${acceptedSlotIds.length} accepted, ${changedSlotIds.length} changed)`,
                         };
                     }
                     throw new types_js_1.AgentError('Report publisher not configured', 'TOOL_ERROR', undefined, false);
@@ -2747,7 +2856,7 @@ class GatewayToolExecutor {
      * Execute telegram_send tool - Send message/file to Telegram chat
      */
     async executeTelegramSend(input) {
-        const { chat_id, message, file_path, sticker_emotion } = input;
+        const { chat_id, message, file_path, sticker_emotion, delivery_key } = input;
         if (!chat_id) {
             return { success: false, error: 'chat_id is required' };
         }
@@ -2755,21 +2864,56 @@ class GatewayToolExecutor {
             return { success: false, error: 'Telegram gateway not configured' };
         }
         const sourceMessageRef = this.getExecutionState().sourceMessageRef;
+        const ownerEvent = sourceMessageRef?.startsWith('owner-event:') === true;
+        const deliveryVariant = sticker_emotion
+            ? 'sticker'
+            : file_path
+                ? TELEGRAM_PHOTO_EXTENSIONS.has((0, path_1.extname)(file_path).toLowerCase())
+                    ? 'image'
+                    : 'file'
+                : 'text';
+        let ownerEffect = null;
+        let ownerLedger = null;
+        try {
+            if (ownerEvent) {
+                ownerEffect = this.requireOwnerEventEffect(delivery_key, 'telegram_send');
+                ownerLedger = this.requireOwnerEventEffectLedger();
+                const reservation = ownerLedger.begin(ownerEffect.batchId, ownerEffect.actionKey, 'telegram_send', { chatId: chat_id, variant: deliveryVariant });
+                if (reservation.state === 'confirmed')
+                    return { success: true };
+                if (reservation.intent.chatId !== chat_id) {
+                    return {
+                        success: false,
+                        error: 'owner-event Telegram target differs from the host-reserved destination',
+                    };
+                }
+                if (reservation.intent.variant !== deliveryVariant) {
+                    return {
+                        success: false,
+                        error: 'owner-event Telegram retry must use the originally reserved delivery variant',
+                    };
+                }
+            }
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
         const idempotencyKey = sourceMessageRef
-            ? (0, crypto_1.createHash)('sha256')
-                .update(JSON.stringify([
-                sourceMessageRef,
-                chat_id,
-                message ?? null,
-                file_path ?? null,
-                sticker_emotion ?? null,
-            ]))
-                .digest('hex')
+            ? ownerEvent
+                ? `${sourceMessageRef}:telegram:${delivery_key}`
+                : (0, crypto_1.createHash)('sha256')
+                    .update(JSON.stringify([
+                    sourceMessageRef,
+                    chat_id,
+                    message ?? null,
+                    file_path ?? null,
+                    sticker_emotion ?? null,
+                ]))
+                    .digest('hex')
             : undefined;
         try {
             if (sticker_emotion) {
-                await (this.telegramGateway.sendStickerFromActiveTurn?.(chat_id, sticker_emotion) ??
-                    this.telegramGateway.sendSticker(chat_id, sticker_emotion));
+                await (this.telegramGateway.sendStickerFromActiveTurn?.(chat_id, sticker_emotion, idempotencyKey) ?? this.telegramGateway.sendSticker(chat_id, sticker_emotion, idempotencyKey));
             }
             else if (file_path) {
                 const safePath = resolvePrivateWorkspaceFile(file_path);
@@ -2820,12 +2964,36 @@ class GatewayToolExecutor {
                     error: 'Either message, file_path, or sticker_emotion is required',
                 };
             }
+            if (ownerEffect && ownerLedger) {
+                ownerLedger.confirm(ownerEffect.batchId, ownerEffect.actionKey, 'telegram_send', null);
+            }
             return { success: true };
         }
         catch (err) {
+            if (ownerEffect && ownerLedger) {
+                ownerLedger.markUnknown(ownerEffect.batchId, ownerEffect.actionKey, 'telegram_send', err instanceof Error ? err.message : String(err));
+            }
             return { success: false, error: `Failed to send to Telegram: ${err}` };
         }
     }
+    requireOwnerEventEffect(actionKey, toolName) {
+        const state = this.getExecutionState();
+        const authority = state.ownerEventEffects;
+        if (!authority || state.sourceMessageRef !== `owner-event:${authority.batchId}`) {
+            throw new Error(`owner-event ${toolName} requires host-issued effect authority`);
+        }
+        const expectedKey = authority.effectKeys[toolName];
+        if (actionKey !== expectedKey) {
+            throw new Error(`owner-event ${toolName} requires the host-issued ${toolName} key ${expectedKey}`);
+        }
+        return { batchId: authority.batchId, actionKey };
+    }
+    requireOwnerEventEffectLedger() {
+        if (!this.ownerEventEffectLedger) {
+            throw new Error('owner-event external effects are disabled without the durable effect ledger');
+        }
+        return this.ownerEventEffectLedger;
+    }
     /**
      * Execute os_get_config tool - Get current configuration
      * Masks sensitive data for non-viewer sources
@@ -3279,7 +3447,7 @@ class GatewayToolExecutor {
             // back excerpts from every other channel of the connector. Citation would then be
             // strictly wider than reading, which is the one thing this path must never be.
             const citationChannels = ctx.envelope
-                ? (0, read_js_1.narrowGrantToEnvelope)((0, read_js_1.liveBoundaryChannels)(), {
+                ? (0, read_js_1.narrowGrantToEnvelope)(ctx.channelGrantSnapshot ?? {}, {
                     connectors,
                     scopes: ctx.envelope.scope.memory_scopes ?? [],
                 })
@@ -3424,6 +3592,7 @@ class GatewayToolExecutor {
                 caller: 'gateway',
                 envelope: ctx.envelope,
                 modelRunId: ctx.modelRunId ?? null,
+                channelGrantSnapshot: ctx.channelGrantSnapshot,
                 input: effectiveInput,
                 signal: ctx.signal,
                 beforePersist: temporalContext
@@ -3545,6 +3714,10 @@ function getContextPacketIdForTrustedProvenance(input) {
 function dedupeSourceRefs(refs) {
     return [...new Set(refs)];
 }
+function snapshotChannelGrant(provider) {
+    const liveGrant = provider();
+    return Object.fromEntries(Object.entries(liveGrant).map(([connector, channels]) => [connector, [...channels]]));
+}
 function normalizeMemoryScopes(value) {
     if (!Array.isArray(value) || value.length === 0) {
         return null;