@lightcone-ai/daemon 0.9.78 → 0.10.0

package/src/chat-bridge.js

@@ -3,7 +3,10 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { readFileSync } from 'fs';
+import { createHash, randomUUID } from 'crypto';
 import path, { extname } from 'path';
+import { isLeaseInvalidated, clearInvalidatedLease } from './governance-state.js';
+import { classifyLeaseWindow } from './lease-window.js';
 
 const cliArgs = process.argv.slice(2);
 function getArg(name) {
@@ -14,12 +17,19 @@ function getArg(name) {
 const SERVER_URL      = process.env.SERVER_URL || getArg('--server-url') || 'http://localhost:8777';
 const MACHINE_API_KEY = process.env.MACHINE_API_KEY || getArg('--auth-token') || '';
 const AGENT_ID        = process.env.AGENT_ID || getArg('--agent-id') || '';
-const TEAM_ID      = process.env.TEAM_ID || getArg('--team-id') || '';  // injected per-team at spawn time
+const WORKSPACE_ID      = process.env.WORKSPACE_ID || getArg('--workspace-id') || '';  // injected per-workspace at spawn time
 const WORKSPACE_DIR = path.resolve(process.env.WORKSPACE_DIR || getArg('--workspace-dir') || process.cwd());
-const TEAM_WORKSPACE_DIR = path.dirname(WORKSPACE_DIR);
-
-// Current active teamId for memory isolation (defaults to spawn-time TEAM_ID)
-let currentTeamId = TEAM_ID;
+const WORKSPACE_ROOT_DIR = path.dirname(WORKSPACE_DIR);
+const GOVERNANCE_SPAWN_BUNDLE_ID = process.env.GOVERNANCE_SPAWN_BUNDLE_ID || getArg('--spawn-bundle-id') || null;
+const GOVERNANCE_POLICY_VERSION = process.env.GOVERNANCE_POLICY_VERSION || getArg('--policy-version') || 'mvp_policy_v1';
+const GOVERNANCE_POLICY_LEASE = process.env.GOVERNANCE_POLICY_LEASE || getArg('--policy-lease') || '';
+const GOVERNANCE_MCP_CLASSIFICATION = process.env.GOVERNANCE_MCP_CLASSIFICATION || getArg('--mcp-classification') || '';
+const GOVERNANCE_TIMEOUT_MS = Number(process.env.GOVERNANCE_TIMEOUT_MS ?? 5000);
+const LEASE_GRACE_MS = Number(process.env.GOVERNANCE_LEASE_GRACE_MS ?? 5000);
+const BUNDLE_EVENT_FLUSH_MS = Number(process.env.GOVERNANCE_BUNDLE_FLUSH_MS ?? 2000);
+
+// Current active workspaceId for memory isolation (defaults to spawn-time WORKSPACE_ID)
+let currentWorkspaceId = WORKSPACE_ID;
 
 const WORKSPACE_BINARY_MIME = {
   '.png': 'image/png',
@@ -62,14 +72,252 @@ function resolveLocalWorkspaceFile(filePath) {
   const resolved = path.resolve(WORKSPACE_DIR, filePath);
   if (isInsideDir(resolved, WORKSPACE_DIR)) return resolved;
 
-  const allowedTeamRoots = ['artifacts', 'notes', 'tmp'].map(dir => path.join(TEAM_WORKSPACE_DIR, dir));
-  if (allowedTeamRoots.some(root => isInsideDir(resolved, root))) return resolved;
+  const allowedWorkspaceRoots = ['artifacts', 'notes', 'tmp'].map(dir => path.join(WORKSPACE_ROOT_DIR, dir));
+  if (allowedWorkspaceRoots.some(root => isInsideDir(resolved, root))) return resolved;
+
+  throw new Error(`Local file must be inside the agent workspace or workspace shared artifacts/notes/tmp directories. Got: ${filePath}`);
+}
+
+const DEFAULT_TOOL_CLASSIFICATION = {
+  check_messages: 'local',
+  list_memory: 'local',
+  read_memory: 'local',
+  upload_image: 'local',
+  read_file_base64: 'local',
+
+  send_message: 'mandatory',
+  create_tasks: 'mandatory',
+  claim_tasks: 'mandatory',
+  unclaim_task: 'mandatory',
+  update_task_status: 'mandatory',
+  write_memory: 'mandatory',
+  write_workspace: 'mandatory',
+  write_workspace_file: 'mandatory',
+  skill_create: 'mandatory',
+  skill_update: 'mandatory',
+  request_approval: 'mandatory',
+  execute_approved_action: 'mandatory',
+
+  search_messages: 'cacheable',
+  list_server: 'cacheable',
+  list_tasks: 'cacheable',
+  list_workspace: 'cacheable',
+  read_workspace: 'cacheable',
+  skill_list: 'cacheable',
+  skill_read: 'cacheable',
+  skill_search: 'cacheable',
+};
+
+const TOOL_CLASSIFICATION = Object.freeze({
+  ...DEFAULT_TOOL_CLASSIFICATION,
+  ...(parseJsonMaybe(GOVERNANCE_MCP_CLASSIFICATION) ?? {}),
+});
+
+const CACHE_INVALIDATION_TOOLS = new Set([
+  'send_message',
+  'create_tasks',
+  'claim_tasks',
+  'unclaim_task',
+  'update_task_status',
+  'write_memory',
+  'write_workspace',
+  'write_workspace_file',
+  'skill_create',
+  'skill_update',
+  'request_approval',
+  'execute_approved_action',
+]);
+
+const governanceContext = {
+  workspaceId: currentWorkspaceId || null,
+  spawnBundleId: GOVERNANCE_SPAWN_BUNDLE_ID,
+  policyVersion: GOVERNANCE_POLICY_VERSION,
+  lease: parseJsonMaybe(GOVERNANCE_POLICY_LEASE),
+  cache: new Map(),
+  renewalInFlight: new Set(),
+};
+
+function resetGovernanceContext(workspaceId) {
+  governanceContext.workspaceId = workspaceId ?? null;
+  governanceContext.spawnBundleId = GOVERNANCE_SPAWN_BUNDLE_ID;
+  governanceContext.policyVersion = GOVERNANCE_POLICY_VERSION;
+  governanceContext.lease = parseJsonMaybe(GOVERNANCE_POLICY_LEASE);
+  governanceContext.cache.clear();
+  governanceContext.renewalInFlight.clear();
+}
+
+function parseJsonMaybe(text) {
+  if (typeof text !== 'string' || !text.trim()) return null;
+  try { return JSON.parse(text); } catch { return null; }
+}
+
+function normalizeApiPath(apiPath) {
+  return (apiPath ?? '').split('?')[0] || '/';
+}
+
+function queryParamsFromPath(apiPath) {
+  const idx = (apiPath ?? '').indexOf('?');
+  if (idx === -1) return {};
+  const params = new URLSearchParams(apiPath.slice(idx + 1));
+  return Object.fromEntries(params.entries());
+}
+
+function inferToolForApi(method, apiPath, body) {
+  const cleanPath = normalizeApiPath(apiPath);
+  const query = queryParamsFromPath(apiPath);
+
+  if (method === 'GET' && cleanPath === '/receive') return 'check_messages';
+  if (method === 'POST' && cleanPath === '/send') return 'send_message';
+  if (method === 'GET' && cleanPath === '/search') return 'search_messages';
+  if (method === 'GET' && cleanPath === '/server') return 'list_server';
+  if (method === 'GET' && cleanPath === '/tasks') return 'list_tasks';
+  if (method === 'POST' && cleanPath === '/tasks') return 'create_tasks';
+  if (method === 'POST' && cleanPath === '/tasks/claim') return 'claim_tasks';
+  if (method === 'POST' && cleanPath === '/tasks/unclaim') return 'unclaim_task';
+  if (method === 'POST' && cleanPath === '/tasks/update-status') return 'update_task_status';
+  if (method === 'GET' && cleanPath === '/memory') return query.path ? 'read_memory' : 'list_memory';
+  if (method === 'PUT' && cleanPath === '/memory') return 'write_memory';
+  if (method === 'GET' && cleanPath === '/workspace-memory') return query.path ? 'read_workspace' : 'list_workspace';
+  if (method === 'PUT' && cleanPath === '/workspace-memory') {
+    if (typeof body?.content === 'string' && body.content.startsWith('data:')) return 'write_workspace_file';
+    return 'write_workspace';
+  }
+  if (method === 'POST' && cleanPath === '/upload') return 'upload_image';
+  if (method === 'GET' && cleanPath === '/skills') return 'skill_list';
+  if (method === 'GET' && cleanPath === '/skills/search') return 'skill_search';
+  if (method === 'GET' && cleanPath.startsWith('/skills/')) return 'skill_read';
+  if (method === 'POST' && cleanPath === '/skills') return 'skill_create';
+  if (method === 'PATCH' && cleanPath.startsWith('/skills/')) return 'skill_update';
+  if (method === 'POST' && cleanPath === '/actions/request') return 'request_approval';
+  if (method === 'POST' && /^\/actions\/[^/]+\/execute$/.test(cleanPath)) return 'execute_approved_action';
+  return null;
+}
 
-  throw new Error(`Local file must be inside the agent workspace or team shared artifacts/notes/tmp directories. Got: ${filePath}`);
+function cacheKeyFor(method, apiPath, body, {
+  leaseId = null,
+  policyHash = null,
+  workspaceId = null,
+} = {}) {
+  const payload = JSON.stringify({
+    method,
+    apiPath,
+    body: body ?? null,
+    leaseId,
+    policyHash,
+    workspaceId,
+  });
+  return createHash('sha256').update(payload, 'utf8').digest('hex');
 }
 
-async function api(method, path, body) {
-  const url = `${SERVER_URL}/internal/agent/${AGENT_ID}${path}`;
+function toolInputFor(apiPath, body) {
+  return {
+    ...queryParamsFromPath(apiPath),
+    ...(body && typeof body === 'object' ? body : {}),
+  };
+}
+
+function governanceReasonCode(reason) {
+  if (!reason) return 'governance_unavailable';
+  if (typeof reason === 'string') return reason;
+  if (typeof reason.code === 'string') return reason.code;
+  if (typeof reason.message === 'string') return reason.message;
+  return 'governance_unavailable';
+}
+
+function governanceError(reason, detail = '') {
+  const suffix = detail ? ` (${detail})` : '';
+  const retryHintSeconds = 30;
+  const err = new Error(`Tool temporarily unavailable: ${reason}${suffix}. retry_hint_seconds=${retryHintSeconds}`);
+  err.code = reason;
+  err.retry_hint_seconds = retryHintSeconds;
+  return err;
+}
+
+function invalidateLeaseCache(leaseId) {
+  if (!leaseId) return;
+  for (const [key, value] of governanceContext.cache.entries()) {
+    if (value.leaseId === leaseId) governanceContext.cache.delete(key);
+  }
+  if (governanceContext.lease?.lease_id === leaseId) governanceContext.lease = null;
+  clearInvalidatedLease(leaseId);
+}
+
+function applyPolicyLease(lease) {
+  if (!lease?.lease_id) return;
+  governanceContext.lease = lease;
+}
+
+const bundleEventQueue = [];
+let bundleEventFlushTimer = null;
+let bundleEventFlushInFlight = false;
+
+function scheduleBundleEventFlush() {
+  if (bundleEventFlushTimer) return;
+  bundleEventFlushTimer = setTimeout(() => {
+    bundleEventFlushTimer = null;
+    void flushBundleEvents();
+  }, Math.max(100, BUNDLE_EVENT_FLUSH_MS));
+}
+
+async function postBundleEvent(event) {
+  const res = await fetch(`${SERVER_URL}/governance/bundle-event`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${MACHINE_API_KEY}`,
+    },
+    body: JSON.stringify(event),
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`bundle_event_failed:${res.status}:${text.slice(0, 300)}`);
+  }
+}
+
+async function flushBundleEvents() {
+  if (bundleEventFlushInFlight) return;
+  if (bundleEventQueue.length === 0) return;
+  bundleEventFlushInFlight = true;
+  try {
+    while (bundleEventQueue.length > 0) {
+      const event = bundleEventQueue[0];
+      try {
+        await postBundleEvent(event);
+        bundleEventQueue.shift();
+      } catch {
+        break;
+      }
+    }
+  } finally {
+    bundleEventFlushInFlight = false;
+    if (bundleEventQueue.length > 0) scheduleBundleEventFlush();
+  }
+}
+
+function enqueueBundleEvent(eventType, payload = {}) {
+  const push = () => {
+    if (!governanceContext.spawnBundleId) return;
+    bundleEventQueue.push({
+      idempotency_key: randomUUID(),
+      spawn_bundle_id: governanceContext.spawnBundleId,
+      policy_version: governanceContext.policyVersion,
+      event_type: eventType,
+      payload,
+      occurred_at: new Date().toISOString(),
+      agent_id: AGENT_ID,
+    });
+    scheduleBundleEventFlush();
+  };
+
+  if (governanceContext.spawnBundleId) {
+    push();
+    return;
+  }
+  void ensureGovernanceContext().then(push).catch(() => {});
+}
+
+async function directApi(method, apiPath, body) {
+  const url = `${SERVER_URL}/internal/agent/${AGENT_ID}${apiPath}`;
   const res = await fetch(url, {
     method,
     headers: {
@@ -80,11 +328,251 @@ async function api(method, path, body) {
   });
   if (!res.ok) {
     const text = await res.text();
-    throw new Error(`API ${method} ${path} → ${res.status}: ${text}`);
+    throw new Error(`API ${method} ${apiPath} → ${res.status}: ${text}`);
   }
   return res.json();
 }
 
+async function callGovernance(payload, { retry = true } = {}) {
+  const attempts = retry ? 2 : 1;
+  let lastError = null;
+
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), GOVERNANCE_TIMEOUT_MS);
+    try {
+      const res = await fetch(`${SERVER_URL}/governance/mcp-call`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Authorization': `Bearer ${MACHINE_API_KEY}`,
+        },
+        body: JSON.stringify(payload),
+        signal: controller.signal,
+      });
+
+      const text = await res.text();
+      const data = parseJsonMaybe(text) ?? { reason: text };
+      if (!res.ok) {
+        const err = new Error(`governance_call_failed:${res.status}`);
+        err.status = res.status;
+        err.response = data;
+        throw err;
+      }
+      return data;
+    } catch (err) {
+      const reasonCode = err.response?.reason?.code;
+      const retriable = err.name === 'AbortError'
+        || err.status == null
+        || (err.status >= 500 && reasonCode !== 'governance_timeout');
+      lastError = err;
+      if (!retriable || attempt === attempts - 1) break;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  if (lastError?.name === 'AbortError') {
+    throw governanceError('timeout');
+  }
+  if (lastError?.response?.reason?.code === 'governance_timeout') {
+    throw governanceError('timeout');
+  }
+  throw governanceError('server_error', lastError?.message ?? '');
+}
+
+async function ensureGovernanceContext() {
+  const workspaceId = currentWorkspaceId || WORKSPACE_ID || null;
+  if (governanceContext.workspaceId !== workspaceId) {
+    resetGovernanceContext(workspaceId);
+  }
+  if (!governanceContext.spawnBundleId || !governanceContext.policyVersion) {
+    throw governanceError('governance_context_missing');
+  }
+}
+
+async function governanceRoundTrip({ method, apiPath, body, toolName, classification, retry }) {
+  await ensureGovernanceContext();
+
+  const payload = {
+    spawn_bundle_id: governanceContext.spawnBundleId,
+    policy_version: governanceContext.policyVersion,
+    tool_name: toolName,
+    tool_input: toolInputFor(apiPath, body),
+    tool_classification: classification,
+    agent_id: AGENT_ID,
+    idempotency_key: randomUUID(),
+    lease_id: governanceContext.lease?.lease_id ?? null,
+  };
+
+  const governance = await callGovernance(payload, { retry });
+  if (governance.policy_lease) applyPolicyLease(governance.policy_lease);
+
+  if (governance.verdict === 'reject' || governance.verdict === 'defer_human') {
+    throw governanceError(governanceReasonCode(governance.reason));
+  }
+
+  let nextBody = body;
+  if (governance.verdict === 'modify' && governance.modified_input && body && typeof body === 'object') {
+    nextBody = { ...body, ...governance.modified_input };
+  }
+
+  return directApi(method, apiPath, nextBody);
+}
+
+function renewCacheInBackground({ method, apiPath, body, toolName, cacheKey }) {
+  if (governanceContext.renewalInFlight.has(cacheKey)) return;
+  governanceContext.renewalInFlight.add(cacheKey);
+  void governanceRoundTrip({
+    method,
+    apiPath,
+    body,
+    toolName,
+    classification: 'cacheable',
+    retry: false,
+  })
+    .then((data) => {
+      governanceContext.cache.set(cacheKey, {
+        data,
+        leaseId: governanceContext.lease?.lease_id ?? null,
+      });
+    })
+    .catch(() => {})
+    .finally(() => {
+      governanceContext.renewalInFlight.delete(cacheKey);
+    });
+}
+
+function auditLocalCall(toolName, apiPath, body) {
+  void ensureGovernanceContext()
+    .then(() => callGovernance({
+      spawn_bundle_id: governanceContext.spawnBundleId,
+      policy_version: governanceContext.policyVersion,
+      tool_name: toolName,
+      tool_input: toolInputFor(apiPath, body),
+      tool_classification: 'local',
+      agent_id: AGENT_ID,
+      idempotency_key: randomUUID(),
+    }, { retry: false }))
+    .catch(() => {});
+}
+
+async function api(method, apiPath, body) {
+  const toolName = inferToolForApi(method, apiPath, body);
+  if (!toolName) {
+    return directApi(method, apiPath, body);
+  }
+
+  const classification = TOOL_CLASSIFICATION[toolName] ?? 'local';
+  const traceId = randomUUID();
+  enqueueBundleEvent('tool_call_started', {
+    trace_id: traceId,
+    tool_name: toolName,
+    tool_classification: classification,
+    method,
+    api_path: normalizeApiPath(apiPath),
+  });
+
+  try {
+    if (classification === 'local') {
+      const data = await directApi(method, apiPath, body);
+      auditLocalCall(toolName, apiPath, body);
+      enqueueBundleEvent('tool_call_succeeded', {
+        trace_id: traceId,
+        tool_name: toolName,
+        tool_classification: classification,
+        source: 'local',
+      });
+      return data;
+    }
+
+    if (classification === 'cacheable') {
+      await ensureGovernanceContext();
+      const leaseId = governanceContext.lease?.lease_id ?? null;
+      const policyHash = governanceContext.lease?.policy_hash ?? null;
+      const workspaceId = governanceContext.workspaceId ?? WORKSPACE_ID ?? null;
+      if (leaseId && isLeaseInvalidated(leaseId)) {
+        invalidateLeaseCache(leaseId);
+      }
+
+      const cacheKey = cacheKeyFor(method, apiPath, body, { leaseId, policyHash, workspaceId });
+      const cacheEntry = governanceContext.cache.get(cacheKey);
+      const now = Date.now();
+      const sameLease = cacheEntry && leaseId && cacheEntry.leaseId === leaseId;
+      const leaseWindow = classifyLeaseWindow(governanceContext.lease?.valid_until, now, LEASE_GRACE_MS);
+      const hasValidLease = sameLease && leaseWindow === 'valid';
+      const hasGraceLease = sameLease && leaseWindow === 'grace';
+
+      if (hasValidLease) {
+        enqueueBundleEvent('tool_call_succeeded', {
+          trace_id: traceId,
+          tool_name: toolName,
+          tool_classification: classification,
+          source: 'cache_hit',
+        });
+        return cacheEntry.data;
+      }
+      if (hasGraceLease) {
+        renewCacheInBackground({ method, apiPath, body, toolName, cacheKey });
+        enqueueBundleEvent('tool_call_succeeded', {
+          trace_id: traceId,
+          tool_name: toolName,
+          tool_classification: classification,
+          source: 'cache_grace',
+        });
+        return cacheEntry.data;
+      }
+
+      const data = await governanceRoundTrip({
+        method,
+        apiPath,
+        body,
+        toolName,
+        classification,
+        retry: true,
+      });
+      governanceContext.cache.set(cacheKey, {
+        data,
+        leaseId: governanceContext.lease?.lease_id ?? null,
+      });
+      enqueueBundleEvent('tool_call_succeeded', {
+        trace_id: traceId,
+        tool_name: toolName,
+        tool_classification: classification,
+        source: 'governance_roundtrip',
+      });
+      return data;
+    }
+
+    const data = await governanceRoundTrip({
+      method,
+      apiPath,
+      body,
+      toolName,
+      classification,
+      retry: true,
+    });
+    if (CACHE_INVALIDATION_TOOLS.has(toolName)) {
+      governanceContext.cache.clear();
+    }
+    enqueueBundleEvent('tool_call_succeeded', {
+      trace_id: traceId,
+      tool_name: toolName,
+      tool_classification: classification,
+      source: 'governance_roundtrip',
+    });
+    return data;
+  } catch (err) {
+    enqueueBundleEvent('tool_call_failed', {
+      trace_id: traceId,
+      tool_name: toolName,
+      tool_classification: classification,
+      reason: err?.code ?? err?.message ?? 'unknown_error',
+    });
+    throw err;
+  }
+}
+
 const server = new McpServer({ name: 'chat', version: '0.1.0' });
 
 // ── check_messages ────────────────────────────────────────────────────────────
@@ -93,20 +581,20 @@ server.tool('check_messages', 'Check for new messages in your inbox', {}, async
   const msgs = data.messages ?? [];
   if (msgs.length === 0) return { content: [{ type: 'text', text: 'No new messages.' }] };
 
-  // Track the teamId of the most recent message for memory isolation
+  // Track the workspaceId of the most recent message for memory isolation
   const lastMsg = msgs[msgs.length - 1];
-  if (lastMsg.team_id) currentTeamId = lastMsg.team_id;
+  if (lastMsg.workspace_id) currentWorkspaceId = lastMsg.workspace_id;
 
   const text = msgs.map(m =>
-    `[${m.team_type === 'dm' ? `dm:@${m.team_name}` : `#${m.team_name}`}] ${m.sender_name}: ${m.content}`
+    `[${m.workspace_type === 'dm' ? `dm:@${m.workspace_name}` : `#${m.workspace_name}`}] ${m.sender_name}: ${m.content}`
     + (m.task_status ? ` [task #${m.task_number} ${m.task_status}]` : '')
   ).join('\n');
   return { content: [{ type: 'text', text }] };
 });
 
 // ── send_message ──────────────────────────────────────────────────────────────
-server.tool('send_message', 'Send a message to a team, DM, or thread', {
-  target:  z.string().describe('Target: #team-name | dm:@agentName | #team-name:shortMsgId'),
+server.tool('send_message', 'Send a message to a workspace, DM, or thread', {
+  target:  z.string().describe('Target: #workspace-name | dm:@agentName | #workspace-name:shortMsgId'),
   content: z.string().describe('Message content'),
 }, async ({ target, content }) => {
   const data = await api('POST', '/send', { target, content });
@@ -114,23 +602,23 @@ server.tool('send_message', 'Send a message to a team, DM, or thread', {
 });
 
 // ── search_messages ──────────────────────────────────────────────────────────
-server.tool('search_messages', 'Search messages within a specific team. You must specify the team. Use this to find relevant conversations by keyword.', {
+server.tool('search_messages', 'Search messages within a specific workspace. You must specify the workspace. Use this to find relevant conversations by keyword.', {
   query:   z.string().describe('Search query'),
-  team: z.string().describe('Target team to search within, e.g. "#general", "dm:@richard". Required — you may only search teams you are a member of.'),
+  workspace: z.string().describe('Target workspace to search within, e.g. "#general", "dm:@richard". Required — you may only search workspaces you are a member of.'),
   limit:   z.number().optional().describe('Max results (default 10, max 20)'),
-}, async ({ query, team, limit }) => {
+}, async ({ query, workspace, limit }) => {
   const trimmed = query.trim();
   if (!trimmed) return { content: [{ type: 'text', text: 'Search query cannot be empty.' }] };
-  if (!team?.trim()) return { content: [{ type: 'text', text: 'team is required. Specify which team to search, e.g. "#general".' }] };
+  if (!workspace?.trim()) return { content: [{ type: 'text', text: 'workspace is required. Specify which workspace to search, e.g. "#general".' }] };
   const params = new URLSearchParams({ q: trimmed, limit: String(Math.min(limit ?? 10, 20)) });
-  params.set('team', team);
+  params.set('workspace', workspace);
   try {
     const data = await api('GET', `/search?${params}`);
     if (!data.results || data.results.length === 0)
       return { content: [{ type: 'text', text: 'No search results.' }] };
     const formatted = data.results.map((r, i) => [
       `[${i + 1}] msg=${r.id} seq=${r.seq} time=${r.createdAt}`,
-      `team: #${r.teamName}`,
+      `workspace: #${r.workspaceName}`,
       `sender: @${r.senderName}${r.senderType === 'agent' ? ' (agent)' : ''}`,
       `content: ${r.snippet}`,
     ].join('\n')).join('\n\n');
@@ -173,20 +661,20 @@ server.tool('view_file', 'Download an attached image by its attachment ID and sa
 });
 
 // ── list_server ───────────────────────────────────────────────────────────────
-server.tool('list_server', 'List teams, agents, and humans on the server', {}, async () => {
+server.tool('list_server', 'List workspaces, agents, and humans on the server', {}, async () => {
   const data = await api('GET', '/server');
-  const teams = (data.teams ?? []).map(c => `  #${c.name}${c.joined ? ' (joined)' : ''} — ${c.description}`).join('\n');
+  const workspaces = (data.workspaces ?? []).map(c => `  #${c.name}${c.joined ? ' (joined)' : ''} — ${c.description}`).join('\n');
   const agents   = (data.agents   ?? []).map(a => `  @${a.name} [${a.status}]`).join('\n');
   const humans   = (data.humans   ?? []).map(h => `  @${h.name}`).join('\n');
-  return { content: [{ type: 'text', text: `Teams:\n${teams}\n\nAgents:\n${agents}\n\nHumans:\n${humans}` }] };
+  return { content: [{ type: 'text', text: `Workspaces:\n${workspaces}\n\nAgents:\n${agents}\n\nHumans:\n${humans}` }] };
 });
 
 // ── list_tasks ────────────────────────────────────────────────────────────────
-server.tool('list_tasks', 'List tasks in a team', {
-  team: z.string().describe('Target: #team-name'),
-  status:  z.enum(['all', 'todo', 'in_progress', 'in_review', 'done']).optional(),
-}, async ({ team, status }) => {
-  const params = new URLSearchParams({ team, status: status ?? 'all' });
+server.tool('list_tasks', 'List tasks in a workspace', {
+  workspace: z.string().describe('Target: #workspace-name'),
+  status:  z.enum(['all', 'todo', 'in_progress', 'in_review', 'done', 'cancelled']).optional(),
+}, async ({ workspace, status }) => {
+  const params = new URLSearchParams({ workspace, status: status ?? 'all' });
   const data = await api('GET', `/tasks?${params}`);
   const tasks = data.tasks ?? [];
   if (tasks.length === 0) return { content: [{ type: 'text', text: 'No tasks found.' }] };
@@ -199,22 +687,27 @@ server.tool('list_tasks', 'List tasks in a team', {
 });
 
 // ── create_tasks ──────────────────────────────────────────────────────────────
-server.tool('create_tasks', 'Create one or more tasks in a team', {
-  team: z.string().describe('Target: #team-name'),
-  tasks:   z.array(z.object({ title: z.string() })).describe('Array of tasks to create'),
-}, async ({ team, tasks }) => {
-  const data = await api('POST', '/tasks', { team, tasks });
+server.tool('create_tasks', 'Create one or more tasks in a workspace', {
+  workspace: z.string().describe('Target: #workspace-name'),
+  tasks: z.array(z.object({
+    title: z.string(),
+    scenario_type: z.string().optional().describe('Optional scenario task type, e.g. research/analysis'),
+    priority: z.enum(['low', 'medium', 'high']).optional().describe('Task priority'),
+    parent_task_number: z.number().optional().describe('Optional parent task number (single parent)'),
+  })).describe('Array of tasks to create'),
+}, async ({ workspace, tasks }) => {
+  const data = await api('POST', '/tasks', { workspace, tasks });
   const created = (data.tasks ?? []).map(t => `#${t.taskNumber} ${t.title}`).join('\n');
   return { content: [{ type: 'text', text: `Created:\n${created}` }] };
 });
 
 // ── claim_tasks ───────────────────────────────────────────────────────────────
 server.tool('claim_tasks', 'Claim one or more tasks to work on', {
-  team:         z.string().describe('Target: #team-name'),
+  workspace:         z.string().describe('Target: #workspace-name'),
   task_numbers: z.array(z.number()).optional().describe('Task numbers to claim'),
   message_ids:  z.array(z.string()).optional().describe('Short message IDs to claim'),
-}, async ({ team, task_numbers, message_ids }) => {
-  const data = await api('POST', '/tasks/claim', { team, task_numbers, message_ids });
+}, async ({ workspace, task_numbers, message_ids }) => {
+  const data = await api('POST', '/tasks/claim', { workspace, task_numbers, message_ids });
   const results = (data.results ?? []).map(r =>
     `#${r.taskNumber}: ${r.success ? 'claimed' : `failed (${r.reason})`}`
   ).join('\n');
@@ -223,26 +716,26 @@ server.tool('claim_tasks', 'Claim one or more tasks to work on', {
 
 // ── unclaim_task ──────────────────────────────────────────────────────────────
 server.tool('unclaim_task', 'Release a claimed task', {
-  team:        z.string().describe('Target: #team-name'),
+  workspace:        z.string().describe('Target: #workspace-name'),
   task_number: z.number().describe('Task number to unclaim'),
-}, async ({ team, task_number }) => {
-  await api('POST', '/tasks/unclaim', { team, task_number });
+}, async ({ workspace, task_number }) => {
+  await api('POST', '/tasks/unclaim', { workspace, task_number });
   return { content: [{ type: 'text', text: `Task #${task_number} unclaimed.` }] };
 });
 
 // ── update_task_status ────────────────────────────────────────────────────────
 server.tool('update_task_status', 'Update the status of a task', {
-  team:        z.string().describe('Target: #team-name'),
+  workspace:        z.string().describe('Target: #workspace-name'),
   task_number: z.number().describe('Task number'),
-  status:      z.enum(['todo', 'in_progress', 'in_review', 'done']).describe('New status'),
-}, async ({ team, task_number, status }) => {
-  await api('POST', '/tasks/update-status', { team, task_number, status });
+  status:      z.enum(['todo', 'in_progress', 'in_review', 'done', 'cancelled']).describe('New status'),
+}, async ({ workspace, task_number, status }) => {
+  await api('POST', '/tasks/update-status', { workspace, task_number, status });
   return { content: [{ type: 'text', text: `Task #${task_number} → ${status}` }] };
 });
 
 // ── list_memory ───────────────────────────────────────────────────────────────
-server.tool('list_memory', 'List all memory files stored for this agent in the current team', {}, async () => {
-  const chParam = currentTeamId ? `&teamId=${encodeURIComponent(currentTeamId)}` : '';
+server.tool('list_memory', 'List all memory files stored for this agent in the current workspace', {}, async () => {
+  const chParam = currentWorkspaceId ? `&workspaceId=${encodeURIComponent(currentWorkspaceId)}` : '';
   const data = await api('GET', `/memory?_=1${chParam}`);
   const files = data.files ?? [];
   if (files.length === 0) return { content: [{ type: 'text', text: 'No memory files yet.' }] };
@@ -251,9 +744,9 @@ server.tool('list_memory', 'List all memory files stored for this agent in the c
 
 // ── read_memory ───────────────────────────────────────────────────────────────
 server.tool('read_memory', 'Read a memory file by path (e.g. "MEMORY.md" or "notes/work-log.md")', {
-  path: z.string().describe('File path, e.g. "MEMORY.md" or "notes/teams.md"'),
+  path: z.string().describe('File path, e.g. "MEMORY.md" or "notes/workspaces.md"'),
 }, async ({ path }) => {
-  const chParam = currentTeamId ? `&teamId=${encodeURIComponent(currentTeamId)}` : '';
+  const chParam = currentWorkspaceId ? `&workspaceId=${encodeURIComponent(currentWorkspaceId)}` : '';
   try {
     const data = await api('GET', `/memory?path=${encodeURIComponent(path)}${chParam}`);
     return { content: [{ type: 'text', text: data.content }] };
@@ -268,27 +761,27 @@ server.tool('write_memory', 'Write or update a memory file (full content replace
   path:    z.string().describe('File path, e.g. "MEMORY.md" or "notes/work-log.md"'),
   content: z.string().describe('Full file content to store'),
 }, async ({ path, content }) => {
-  const chParam = currentTeamId ? `&teamId=${encodeURIComponent(currentTeamId)}` : '';
+  const chParam = currentWorkspaceId ? `&workspaceId=${encodeURIComponent(currentWorkspaceId)}` : '';
   await api('PUT', `/memory?path=${encodeURIComponent(path)}${chParam}`, { content });
   return { content: [{ type: 'text', text: `Saved ${path}` }] };
 });
 
 // ── list_workspace ────────────────────────────────────────────────────────────
-server.tool('list_workspace', 'List all files in the shared team workspace (BRIEF.md, KNOWLEDGE.md, artifacts/, notes/)', {}, async () => {
-  if (!currentTeamId) return { content: [{ type: 'text', text: 'No team context.' }] };
-  const data = await api('GET', `/team-memory?teamId=${encodeURIComponent(currentTeamId)}`);
+server.tool('list_workspace', 'List all files in the shared workspace (BRIEF.md, KNOWLEDGE.md, artifacts/, notes/)', {}, async () => {
+  if (!currentWorkspaceId) return { content: [{ type: 'text', text: 'No workspace context.' }] };
+  const data = await api('GET', `/workspace-memory?workspaceId=${encodeURIComponent(currentWorkspaceId)}`);
   const files = data.files ?? [];
-  if (files.length === 0) return { content: [{ type: 'text', text: 'Team workspace is empty.' }] };
+  if (files.length === 0) return { content: [{ type: 'text', text: 'Workspace workspace is empty.' }] };
   return { content: [{ type: 'text', text: files.map(f => f.path).join('\n') }] };
 });
 
 // ── read_workspace ────────────────────────────────────────────────────────────
-server.tool('read_workspace', 'Read a file from the shared team workspace (e.g. "BRIEF.md", "KNOWLEDGE.md", "artifacts/report.html")', {
-  path: z.string().describe('File path relative to team workspace root'),
+server.tool('read_workspace', 'Read a file from the shared workspace (e.g. "BRIEF.md", "KNOWLEDGE.md", "artifacts/report.html")', {
+  path: z.string().describe('File path relative to workspace root'),
 }, async ({ path }) => {
-  if (!currentTeamId) return { content: [{ type: 'text', text: 'No team context.' }] };
+  if (!currentWorkspaceId) return { content: [{ type: 'text', text: 'No workspace context.' }] };
   try {
-    const data = await api('GET', `/team-memory?path=${encodeURIComponent(path)}&teamId=${encodeURIComponent(currentTeamId)}`);
+    const data = await api('GET', `/workspace-memory?path=${encodeURIComponent(path)}&workspaceId=${encodeURIComponent(currentWorkspaceId)}`);
     const summary = dataUrlSummary(data.content);
     if (summary) {
       return {
@@ -306,51 +799,33 @@ server.tool('read_workspace', 'Read a file from the shared team workspace (e.g.
 });
 
 // ── write_workspace ───────────────────────────────────────────────────────────
-server.tool('write_workspace', 'Write a file to the shared team workspace. Use this to save ALL deliverables: code, HTML, scripts, reports, data files, images — everything goes under artifacts/. Also use for KNOWLEDGE.md and shared notes. For binary files (images/PNG/JPG), encode as base64 data URL: read the file with fs.readFileSync, then format as "data:image/png;base64," + buf.toString("base64"). The server will decode and serve them correctly.', {
-  path:    z.string().describe('File path relative to team workspace root, e.g. "artifacts/result.html" or "artifacts/cover.png"'),
+server.tool('write_workspace', 'Write a file to the shared workspace. Use this to save ALL deliverables: code, HTML, scripts, reports, data files, images — everything goes under artifacts/. Also use for KNOWLEDGE.md and shared notes. For binary files (images/PNG/JPG), encode as base64 data URL: read the file with fs.readFileSync, then format as "data:image/png;base64," + buf.toString("base64"). The server will decode and serve them correctly.', {
+  path:    z.string().describe('File path relative to workspace root, e.g. "artifacts/result.html" or "artifacts/cover.png"'),
   content: z.string().describe('File content. For images: base64 data URL "data:image/png;base64,<base64data>"'),
 }, async ({ path, content }) => {
-  if (!currentTeamId) return { content: [{ type: 'text', text: 'No team context.' }] };
-  await api('PUT', `/team-memory?path=${encodeURIComponent(path)}&teamId=${encodeURIComponent(currentTeamId)}`, { content });
-  return { content: [{ type: 'text', text: `Saved to team workspace: ${path}` }] };
+  if (!currentWorkspaceId) return { content: [{ type: 'text', text: 'No workspace context.' }] };
+  await api('PUT', `/workspace-memory?path=${encodeURIComponent(path)}&workspaceId=${encodeURIComponent(currentWorkspaceId)}`, { content });
+  return { content: [{ type: 'text', text: `Saved to workspace: ${path}` }] };
 });
 
-server.tool('write_workspace_file', 'Write a local file directly to the shared team workspace. Prefer this over write_workspace for images/PDFs/binary files so large base64 content never enters the model context. The source file may be a relative path under the current agent workspace, or an absolute path inside the agent workspace/team shared artifacts/notes/tmp directories.', {
-  file_path: z.string().describe('Local file path. Relative paths resolve from the current agent workspace. Absolute paths must stay inside the agent/team workspace.'),
-  path:      z.string().describe('Destination path relative to team workspace root, e.g. "artifacts/cover.png"'),
+server.tool('write_workspace_file', 'Write a local file directly to the shared workspace. Prefer this over write_workspace for images/PDFs/binary files so large base64 content never enters the model context. The source file may be a relative path under the current agent workspace, or an absolute path inside the agent workspace/workspace shared artifacts/notes/tmp directories.', {
+  file_path: z.string().describe('Local file path. Relative paths resolve from the current agent workspace. Absolute paths must stay inside the agent/workspace.'),
+  path:      z.string().describe('Destination path relative to workspace root, e.g. "artifacts/cover.png"'),
 }, async ({ file_path, path }) => {
-  if (!currentTeamId) return { content: [{ type: 'text', text: 'No team context.' }] };
+  if (!currentWorkspaceId) return { content: [{ type: 'text', text: 'No workspace context.' }] };
   const localPath = resolveLocalWorkspaceFile(file_path);
   const ext = extname(path || localPath).toLowerCase();
   const mime = WORKSPACE_BINARY_MIME[ext] ?? 'application/octet-stream';
   const buf = readFileSync(localPath);
   const content = `data:${mime};base64,${buf.toString('base64')}`;
-  await api('PUT', `/team-memory?path=${encodeURIComponent(path)}&teamId=${encodeURIComponent(currentTeamId)}`, { content });
-  return { content: [{ type: 'text', text: `Saved local file to team workspace: ${path} (${mime}, ${formatBytes(buf.length)})` }] };
+  await api('PUT', `/workspace-memory?path=${encodeURIComponent(path)}&workspaceId=${encodeURIComponent(currentWorkspaceId)}`, { content });
+  return { content: [{ type: 'text', text: `Saved local file to workspace: ${path} (${mime}, ${formatBytes(buf.length)})` }] };
 });
 
-// ── get_credential ───────────────────────────────────────────────────────────
-server.tool('get_credential',
-  'Retrieve decrypted credential fields for a platform granted to this agent (e.g. XHS_COOKIE for "xhs"). Use when you need to inject credentials into a browser session or external call.',
-  {
-    platform: z.string().describe('Platform key, e.g. "xhs", "x", "youtube"'),
-  },
-  async ({ platform }) => {
-    try {
-      const grants = await api('GET', '/credential-grants');
-      const match = grants.find(g => g.platform === platform);
-      if (!match) return { content: [{ type: 'text', text: `No credential found for platform "${platform}". Ask the human to connect the account via Settings → 连接外部账号.` }] };
-      const fields = Object.entries(match.envVars).map(([k, v]) => `${k}=${v}`).join('\n');
-      return { content: [{ type: 'text', text: fields }] };
-    } catch (err) {
-      return { isError: true, content: [{ type: 'text', text: `Error: ${err.message}` }] };
-    }
-  }
-);
-
 // ── skill_list ───────────────────────────────────────────────────────────────
 server.tool('skill_list', 'List all skills available to you (platform + bound). Returns index only (name + description), not full content.', {}, async () => {
-  const skills = await api('GET', `/skills`);
+  const workspaceQuery = currentWorkspaceId ? `?workspaceId=${encodeURIComponent(currentWorkspaceId)}` : '';
+  const skills = await api('GET', `/skills${workspaceQuery}`);
   if (!skills || skills.length === 0) return { content: [{ type: 'text', text: 'No skills available.' }] };
   const lines = skills.map(s => `- [${s.type}] **${s.name}** — ${s.description}`);
   return { content: [{ type: 'text', text: lines.join('\n') }] };
@@ -410,7 +885,7 @@ server.tool('skill_search', 'Search for skills by keyword across all accessible
 server.tool('read_file_base64',
   '读取本机文件内容，返回 base64 编码。优先使用 write_workspace_file 保存正式产出；只有外部工具明确需要 base64 字符串时才使用。',
   {
-    file_path: z.string().describe('本机文件路径。相对路径从当前 agent workspace 解析；绝对路径必须在 agent/team workspace 内。'),
+    file_path: z.string().describe('本机文件路径。相对路径从当前 agent workspace 解析；绝对路径必须在 agent/workspace 内。'),
   },
   async ({ file_path }) => {
     const localPath = resolveLocalWorkspaceFile(file_path);
@@ -423,7 +898,7 @@ server.tool('read_file_base64',
 server.tool('upload_image',
   '将本机图片文件上传为临时公开 URL，用于聊天预览、二维码截图或外部平台临时访问。它不会保存正式产出；正式产出必须同时写入 artifacts/，优先使用 write_workspace_file。',
   {
-    file_path: z.string().describe('本机图片文件路径。相对路径从当前 agent workspace 解析；绝对路径必须在 agent/team workspace 内。'),
+    file_path: z.string().describe('本机图片文件路径。相对路径从当前 agent workspace 解析；绝对路径必须在 agent/workspace 内。'),
   },
   async ({ file_path }) => {
     const { extname, basename } = await import('path');
@@ -451,7 +926,7 @@ server.tool('request_approval',
         action_type, platform, description,
         payload: JSON.stringify(payload),
         credential_id,
-        team_id: currentTeamId,
+        workspace_id: currentWorkspaceId,
       });
       return { content: [{ type: 'text', text:
         `Approval requested (action_id="${data.id}"). Waiting for human review.\n` +