@jungjaehoon/mama-os 0.53.0 → 0.57.0

package/dist/agent/role-manager.js

@@ -1,300 +0,0 @@
-"use strict";
-/**
- * Role Manager for Agent Permission Control
- *
- * Manages role-based permissions for different message sources (viewer, discord, etc.)
- * Determines which tools and paths are accessible based on the agent's role.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RoleManager = void 0;
-exports.getRoleManager = getRoleManager;
-exports.resetRoleManager = resetRoleManager;
-const minimatch_1 = require("minimatch");
-const types_js_1 = require("../cli/config/types.js");
-const OWNER_CONSOLE_CONNECTOR_SOURCES = new Set(['telegram', 'discord', 'slack', 'chatwork']);
-/**
- * RoleManager handles role-based permission checks
- */
-class RoleManager {
-    rolesConfig;
-    /**
-     * Telegram owner-trust state, computed from config.telegram.allowed_chats
-     * at boot and re-computed whenever that config changes. Fail-closed: with
-     * no trust configured, telegram resolves to its normal (chat_bot) mapping.
-     */
-    telegramOwnerChats = new Set();
-    constructor(options = {}) {
-        this.rolesConfig = options.rolesConfig ?? types_js_1.DEFAULT_ROLES;
-    }
-    /**
-     * Install the telegram inbound allowlist as the owner-trust anchor.
-     * An empty/undefined list clears trust (owner_console never resolves).
-     */
-    setTelegramTrust(allowedChats) {
-        this.telegramOwnerChats = new Set((allowedChats ?? []).map((id) => String(id).trim()));
-    }
-    /**
-     * Get the role configuration for a given source
-     * @param source - Message source (e.g., "viewer", "discord", "telegram")
-     * @param trust - Per-message trust context (channelId, chatType)
-     * @returns Role configuration for the source
-     */
-    getRoleForSource(source, trust) {
-        const normalizedSource = source.toLowerCase();
-        const principal = trust?.principal;
-        // Principal-aware roles are resolved before transport mappings. External
-        // and member principals share the same non-owner roles: an admitted public
-        // lane or the unreachable, zero-tool defense role for every other lane.
-        if (principal?.class === 'external' || principal?.class === 'member') {
-            const principalRoleName = principal.lane === 'public' ? 'public_lane' : 'external_data';
-            const principalRole = this.rolesConfig.definitions[principalRoleName];
-            if (!principalRole) {
-                throw new Error(`Required principal role "${principalRoleName}" is not defined`);
-            }
-            return { roleName: principalRoleName, role: principalRole };
-        }
-        if (principal?.lane === 'public') {
-            const publicRole = this.rolesConfig.definitions['public_lane'];
-            if (!publicRole) {
-                throw new Error('Required principal role "public_lane" is not defined');
-            }
-            return { roleName: 'public_lane', role: publicRole };
-        }
-        // A verified direct owner channel is one owner-console surface regardless
-        // of transport. Viewer/mobile/system retain their static mappings.
-        if (OWNER_CONSOLE_CONNECTOR_SOURCES.has(normalizedSource) &&
-            principal?.class === 'owner' &&
-            principal.consoleEligible === true) {
-            const ownerRole = this.rolesConfig.definitions['owner_console'];
-            if (ownerRole) {
-                return { roleName: 'owner_console', role: ownerRole };
-            }
-        }
-        // Trust-conditional escalation: telegram + allowlist locked + 1:1 DM from
-        // an allowlisted chat -> owner_console. Groups/supergroups NEVER escalate
-        // even when allowlisted (third parties in the room). Fail-closed: any
-        // missing piece (no trust, no chatType, undefined role) falls through to
-        // the normal transport mapping.
-        if (normalizedSource === 'telegram' &&
-            this.telegramOwnerChats.size > 0 &&
-            trust?.chatType === 'private' &&
-            trust.channelId !== undefined &&
-            this.telegramOwnerChats.has(String(trust.channelId))) {
-            const ownerRole = this.rolesConfig.definitions['owner_console'];
-            if (ownerRole) {
-                return { roleName: 'owner_console', role: ownerRole };
-            }
-        }
-        let roleName = this.rolesConfig.sourceMapping[normalizedSource];
-        // Runtime trust boundary (review: audit-only detection is not enforcement):
-        // a static sourceMapping to owner_console would grant the owner surface to
-        // UNVERIFIED inbound. Downgrade loudly - owner_console resolves ONLY via
-        // the trust-conditional branch above.
-        if (roleName === 'owner_console') {
-            console.warn(`[RoleManager] static owner_console mapping for source "${source}" downgraded to chat_bot - owner_console is granted per-message by trust checks only`);
-            roleName = 'chat_bot';
-        }
-        if (!roleName) {
-            // Default to chat_bot for unknown sources (secure default)
-            const defaultRoleName = 'chat_bot';
-            const defaultRole = this.rolesConfig.definitions[defaultRoleName];
-            if (!defaultRole) {
-                // Fallback to minimal permissions if chat_bot not defined
-                return {
-                    roleName: 'restricted',
-                    role: {
-                        allowedTools: ['mama_search', 'Read'],
-                        blockedTools: ['Bash', 'Write', 'save_integration_token'],
-                        allowedPaths: [],
-                        systemControl: false,
-                        sensitiveAccess: false,
-                    },
-                };
-            }
-            return { roleName: defaultRoleName, role: defaultRole };
-        }
-        const role = this.rolesConfig.definitions[roleName];
-        if (!role) {
-            // Role name exists in mapping but definition is missing
-            throw new Error(`Role "${roleName}" is mapped to source "${source}" but not defined in roles.definitions`);
-        }
-        return { roleName, role };
-    }
-    /**
-     * Check if a tool is allowed for the given role
-     * @param role - Role configuration
-     * @param toolName - Name of the tool to check
-     * @returns true if tool is allowed, false otherwise
-     */
-    isToolAllowed(role, toolName) {
-        // Check blocked tools first (takes precedence)
-        if (role.blockedTools && role.blockedTools.length > 0) {
-            for (const pattern of role.blockedTools) {
-                if (this.matchesPattern(toolName, pattern)) {
-                    return false;
-                }
-            }
-        }
-        // Check allowed tools
-        for (const pattern of role.allowedTools) {
-            if (this.matchesPattern(toolName, pattern)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /**
-     * Check if a path is allowed for the given role
-     * @param role - Role configuration
-     * @param path - File path to check
-     * @returns true if path is allowed, false otherwise
-     */
-    isPathAllowed(role, path) {
-        // If no path restrictions, allow all
-        if (!role.allowedPaths || role.allowedPaths.length === 0) {
-            return true;
-        }
-        // Expand ~ to home directory for comparison
-        const expandedPath = this.expandPath(path);
-        const configuredWorkspace = process.env.MAMA_WORKSPACE?.replace(/\/$/, '');
-        const allowedPatterns = role.allowedPaths.map((pattern) => configuredWorkspace && pattern === '~/.mama/workspace/**'
-            ? `${configuredWorkspace}/**`
-            : pattern);
-        // `~/.mama/workspace/**` is the logical private-workspace capability,
-        // not a hard-coded deployment path. The start command resolves a custom
-        // workspace into MAMA_WORKSPACE, so permission checks must project the
-        // same capability onto that runtime root.
-        for (const pattern of allowedPatterns) {
-            const expandedPattern = this.expandPath(pattern);
-            if ((0, minimatch_1.minimatch)(expandedPath, expandedPattern, { dot: true })) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /**
-     * Check if the role can perform system control operations
-     * @param role - Role configuration
-     * @returns true if system control is allowed
-     */
-    canSystemControl(role) {
-        return role.systemControl ?? false;
-    }
-    /**
-     * Check if the role can access sensitive data
-     * @param role - Role configuration
-     * @returns true if sensitive access is allowed
-     */
-    canAccessSensitive(role) {
-        return role.sensitiveAccess ?? false;
-    }
-    /**
-     * Get human-readable capabilities list for a role
-     * @param role - Role configuration
-     * @returns Array of capability descriptions
-     */
-    getCapabilities(role) {
-        const capabilities = [];
-        // Add allowed tools (expand wildcards to readable format)
-        for (const pattern of role.allowedTools) {
-            if (pattern === '*') {
-                capabilities.push('All tools');
-            }
-            else if (pattern.includes('*')) {
-                capabilities.push(`${pattern.replace('*', '').replaceAll('_', ' ')} tools`);
-            }
-            else {
-                capabilities.push(pattern);
-            }
-        }
-        if (role.systemControl) {
-            capabilities.push('System control');
-        }
-        if (role.sensitiveAccess) {
-            capabilities.push('Sensitive data access');
-        }
-        return capabilities;
-    }
-    /**
-     * Get human-readable limitations list for a role
-     * @param role - Role configuration
-     * @returns Array of limitation descriptions
-     */
-    getLimitations(role) {
-        const limitations = [];
-        // Add blocked tools
-        if (role.blockedTools && role.blockedTools.length > 0) {
-            for (const tool of role.blockedTools) {
-                limitations.push(`Cannot use ${tool}`);
-            }
-        }
-        // Add path restrictions
-        if (role.allowedPaths && role.allowedPaths.length > 0) {
-            limitations.push('Limited file access');
-        }
-        if (!role.systemControl) {
-            limitations.push('No system control');
-        }
-        if (!role.sensitiveAccess) {
-            limitations.push('No sensitive data access');
-        }
-        return limitations;
-    }
-    /**
-     * Update roles configuration
-     * @param newConfig - New roles configuration
-     */
-    updateRolesConfig(newConfig) {
-        this.rolesConfig = newConfig;
-    }
-    /**
-     * Get current roles configuration
-     * @returns Current roles configuration
-     */
-    getRolesConfig() {
-        return this.rolesConfig;
-    }
-    /**
-     * Match a string against a wildcard pattern
-     * Supports glob patterns: "mama_*" matches "mama_search", "mama_save"
-     * Uses minimatch for consistent pattern matching with isPathAllowed
-     */
-    matchesPattern(value, pattern) {
-        // Use minimatch for consistent glob pattern matching
-        // minimatch handles '*' pattern correctly (matches everything)
-        return (0, minimatch_1.minimatch)(value, pattern);
-    }
-    /**
-     * Expand ~ to home directory in path
-     */
-    expandPath(path) {
-        if (path.startsWith('~')) {
-            const home = process.env.HOME || process.env.USERPROFILE || '';
-            return path.replace(/^~/, home);
-        }
-        return path;
-    }
-}
-exports.RoleManager = RoleManager;
-/**
- * Singleton instance for global access
- */
-let globalRoleManager = null;
-/**
- * Get or create the global RoleManager instance
- * @param options - Options for initialization (only used on first call)
- * @returns Global RoleManager instance
- */
-function getRoleManager(options) {
-    if (!globalRoleManager) {
-        globalRoleManager = new RoleManager(options);
-    }
-    return globalRoleManager;
-}
-/**
- * Reset the global RoleManager instance (for testing)
- */
-function resetRoleManager() {
-    globalRoleManager = null;
-}
-//# sourceMappingURL=role-manager.js.map

package/dist/agent/role-manager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"role-manager.js","sourceRoot":"","sources":["../../src/agent/role-manager.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA8VH,wCAKC;AAKD,4CAEC;AAxWD,yCAAsC;AACtC,qDAAgF;AAGhF,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAqB9F;;GAEG;AACH,MAAa,WAAW;IACd,WAAW,CAAc;IACjC;;;;OAIG;IACK,kBAAkB,GAAgB,IAAI,GAAG,EAAE,CAAC;IAEpD,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,wBAAa,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,YAAkC;QACjD,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CACd,MAAc,EACd,KAA0B;QAE1B,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAC;QAEnC,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,SAAS,EAAE,KAAK,KAAK,UAAU,IAAI,SAAS,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC;YACxF,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,4BAA4B,iBAAiB,kBAAkB,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC9D,CAAC;QAED,IAAI,SAAS,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,mEAAmE;QACnE,IACE,+BAA+B,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACrD,SAAS,EAAE,KAAK,KAAK,OAAO;YAC5B,SAAS,CAAC,eAAe,KAAK,IAAI,EAClC,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAChE,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,gCAAgC;QAChC,IACE,gBAAgB,KAAK,UAAU;YAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC;YAChC,KAAK,EAAE,QAAQ,KAAK,SAAS;YAC7B,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACpD,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAChE,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhE,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,sCAAsC;QACtC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,0DAA0D,MAAM,sFAAsF,CACvJ,CAAC;YACF,QAAQ,GAAG,UAAU,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,2DAA2D;YAC3D,MAAM,eAAe,GAAG,UAAU,CAAC;YACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAElE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,0DAA0D;gBAC1D,OAAO;oBACL,QAAQ,EAAE,YAAY;oBACtB,IAAI,EAAE;wBACJ,YAAY,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC;wBACrC,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC;wBACzD,YAAY,EAAE,EAAE;wBAChB,aAAa,EAAE,KAAK;wBACpB,eAAe,EAAE,KAAK;qBACvB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,wDAAwD;YACxD,MAAM,IAAI,KAAK,CACb,SAAS,QAAQ,0BAA0B,MAAM,wCAAwC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAgB,EAAE,QAAgB;QAC9C,+CAA+C;QAC/C,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC3C,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAgB,EAAE,IAAY;QAC1C,qCAAqC;QACrC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4CAA4C;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACxD,mBAAmB,IAAI,OAAO,KAAK,sBAAsB;YACvD,CAAC,CAAC,GAAG,mBAAmB,KAAK;YAC7B,CAAC,CAAC,OAAO,CACZ,CAAC;QACF,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,0CAA0C;QAC1C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,IAAA,qBAAS,EAAC,YAAY,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,IAAgB;QAC/B,OAAO,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,IAAgB;QACjC,OAAO,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,IAAgB;QAC9B,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,0DAA0D;QAC1D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9E,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,IAAgB;QAC7B,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,oBAAoB;QACpB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrC,WAAW,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,SAAsB;QACtC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,KAAa,EAAE,OAAe;QACnD,qDAAqD;QACrD,+DAA+D;QAC/D,OAAO,IAAA,qBAAS,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,IAAY;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AApTD,kCAoTC;AAED;;GAEG;AACH,IAAI,iBAAiB,GAAuB,IAAI,CAAC;AAEjD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,OAA4B;IACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB;IAC9B,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC"}

package/dist/agent/session-pool.d.ts

@@ -1,176 +0,0 @@
-/**
- * Session Pool - Claude CLI Session Reuse Manager
- *
- * Manages Claude CLI session IDs per channel to enable conversation continuity.
- * Instead of creating new sessions for each message, reuses existing sessions
- * so Claude CLI maintains its own conversation history.
- *
- * Benefits:
- * - 6x token reduction (no manual history injection needed)
- * - Natural conversation flow (Claude remembers context)
- * - Automatic summarization by Claude when context fills up
- */
-/**
- * Session entry with metadata
- */
-interface SessionEntry {
-    /** Claude CLI session ID */
-    sessionId: string;
-    /** Last activity timestamp */
-    lastActive: number;
-    /** Message count in this session */
-    messageCount: number;
-    /** Creation timestamp */
-    createdAt: number;
-    /** Whether session is currently in use (locked) */
-    inUse: boolean;
-    /** Legacy context occupancy field; durable runtimes own compaction, so this stays zero */
-    totalInputTokens: number;
-}
-/**
- * Session Pool configuration
- */
-export interface SessionPoolConfig {
-    /** Session timeout in milliseconds (default: 30 minutes) */
-    sessionTimeoutMs?: number;
-    /** Maximum sessions to keep in pool (default: 100) */
-    maxSessions?: number;
-    /** Cleanup interval in milliseconds (default: 5 minutes) */
-    cleanupIntervalMs?: number;
-}
-/**
- * Session Pool for Claude CLI session management
- *
- * Key design:
- * - Channel key format: "{source}:{channelId}" (e.g., "discord:123456")
- * - Sessions expire after timeout (default 30 min)
- * - Automatic cleanup of stale sessions
- */
-export declare class SessionPool {
-    private sessions;
-    private config;
-    private cleanupTimer;
-    constructor(config?: SessionPoolConfig);
-    /**
-     * Get or create session ID for a channel
-     *
-     * With --no-session-persistence flag, Claude CLI doesn't lock session IDs.
-     * This allows session reuse for conversation continuity.
-     *
-     * Durable backends own model-aware context compaction. This pool rotates only
-     * for explicit resets and session-lifecycle expiry.
-     * If session is in use, returns busy=true immediately (no waiting).
-     *
-     * @param channelKey - Channel identifier (format: "{source}:{channelId}")
-     * @returns Object with sessionId, isNew flag, and busy status
-     */
-    getSession(channelKey: string): {
-        sessionId: string;
-        isNew: boolean;
-        busy: boolean;
-    };
-    /**
-     * Read-only check for session busy status
-     * Does NOT modify session state (no lock, no messageCount increment)
-     *
-     * @param channelKey - Channel identifier
-     * @returns Object with sessionId (if exists) and busy status
-     */
-    peekSession(channelKey: string): {
-        sessionId?: string;
-        busy: boolean;
-    };
-    /**
-     * Preserve the legacy token-status interface without interpreting billing
-     * usage as context occupancy. Claude Code, Codex app-server, and Cline Hub
-     * each compact from their own model-aware request state.
-     *
-     * @param channelKey - Channel identifier
-     * @param _inputTokens - Usage telemetry from this run; recorded separately by AgentLoop
-     * @param _backend - Runtime that owns the durable session
-     * @returns Zero occupancy because the host has no authoritative context-size signal
-     */
-    updateTokens(channelKey: string, _inputTokens: number, _backend?: 'claude' | 'codex' | 'cline'): {
-        totalTokens: number;
-        nearThreshold: boolean;
-    };
-    /**
-     * Get current token usage for a session
-     */
-    getTokenUsage(channelKey: string): number;
-    /**
-     * Legacy method for backward compatibility
-     * @deprecated Use getSession() instead
-     */
-    getSessionId(channelKey: string): string;
-    /**
-     * Release a session after use
-     * This allows the session to be reused by future requests
-     */
-    releaseSession(channelKey: string, expectedSessionId?: string): void;
-    /**
-     * Override session ID for a channel (e.g., when backend returns its own thread ID)
-     */
-    setSessionId(channelKey: string, sessionId: string): void;
-    /**
-     * Create a new session for a channel
-     */
-    private createSession;
-    /**
-     * Force create a new session (for /clear command)
-     */
-    resetSession(channelKey: string): string;
-    /**
-     * Remove a session without creating a replacement.
-     *
-     * Use this after a failed reset attempt: the next request must observe a
-     * genuinely new session and rebuild its complete policy prompt.
-     */
-    invalidateSession(channelKey: string, expectedSessionId?: string): void;
-    /**
-     * Check if a session exists and is active
-     */
-    hasActiveSession(channelKey: string): boolean;
-    /**
-     * Get session info for a channel
-     */
-    getSessionInfo(channelKey: string): SessionEntry | null;
-    /**
-     * Get all active sessions (for debugging/monitoring)
-     */
-    listSessions(): Map<string, SessionEntry>;
-    /**
-     * Get active session count
-     */
-    getActiveSessionCount(): number;
-    /**
-     * Evict the oldest (least recently used) session
-     */
-    private evictOldestSession;
-    /**
-     * Clean up expired sessions and force-release stuck inUse sessions
-     */
-    cleanup(): number;
-    /**
-     * Start periodic cleanup timer
-     */
-    private startCleanupTimer;
-    /**
-     * Stop cleanup timer and clear all sessions
-     */
-    dispose(): void;
-}
-/**
- * Get global session pool instance
- */
-export declare function getSessionPool(): SessionPool;
-/**
- * Set global session pool instance (for testing)
- */
-export declare function setSessionPool(pool: SessionPool): void;
-/**
- * Build channel key from source and channel ID
- */
-export declare function buildChannelKey(source: string, channelId: string): string;
-export {};
-//# sourceMappingURL=session-pool.d.ts.map

package/dist/agent/session-pool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-pool.d.ts","sourceRoot":"","sources":["../../src/agent/session-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH;;GAEG;AACH,UAAU,YAAY;IACpB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAMD;;;;;;;GAOG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,YAAY,CAA+B;gBAEvC,MAAM,GAAE,iBAAsB;IAW1C;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,EAAE,OAAO,CAAC;KACf;IAmCD;;;;;;OAMG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE;IAQtE;;;;;;;;;OASG;IACH,YAAY,CACV,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,GACtC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE;IAUlD;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAKzC;;;OAGG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAIxC;;;OAGG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI;IAQpE;;OAEG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAwBzD;;OAEG;IACH,OAAO,CAAC,aAAa;IAwBrB;;OAEG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAKxC;;;;;OAKG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI;IAUvE;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAU7C;;OAEG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIvD;;OAEG;IACH,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC;IAIzC;;OAEG;IACH,qBAAqB,IAAI,MAAM;IAI/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;OAEG;IACH,OAAO,IAAI,MAAM;IAyBjB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB;AAOD;;GAEG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAK5C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAEtD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzE"}