@open-everywhere/core 0.1.0

package/agent/access/worker-continuation.ts

@@ -0,0 +1,200 @@
+// Worker continuation is REFUSED, so a delegated worker stays single-turn: a second turn clears the child's taint bit while run 1's hostile content is still in its history. This module removes eve's `[Agents]` listing from the model call, strips `agentId` and `outputSchema` from the advertised schema, refuses a call carrying an `agentId`, and carries the wake's attachment ids into the brief — each keyed on the affordance itself, never on a setting.
+
+import { asSchema, jsonSchema } from "ai";
+import { defineState } from "eve/context";
+import { parseWakeAttachments, withDelegatedAttachments, type BriefAttachment } from "../channels/attachments.js";
+import { isWakeEnvelopeShaped } from "../channels/wake-envelope.js";
+
+/** eve's built-in delegation verb. OE mounts no dynamic tool of this name — eve's tool-loop throws
+ *  on the collision (access/untrusted-projection.ts's OPE-393 note), so this is the only `agent`. */
+const DELEGATION_TOOL_NAME = "agent";
+
+/** The continuation field on eve's PERSISTENT subagent input schema; it is absent from the non-persistent schema. */
+const CONTINUATION_FIELD = "agentId";
+
+/** eve's caller-supplied result-shape field on the same schema. It is stripped, because it puts the child's answer behind eve's output sink and destroys a prose refusal. */
+const CALLER_OUTPUT_SCHEMA_FIELD = "outputSchema";
+
+/** The model-facing refusal; it reaches the model as an ordinary tool-result error. Written to answer the seat's next question rather than to scold, because a refusal the model cannot act on becomes a retry loop. */
+export const CONTINUATION_REFUSAL_MESSAGE =
+  "Worker continuation is disabled on this deployment: `agentId` is not accepted. Start a fresh delegation and pass the context it needs in the brief.";
+
+/** The exact two-line opening eve's snippet renderers emit. Matching two lines rather than the label alone keeps a human message that starts with `[Agents]` out of the splice; both failure directions are safe. */
+const AGENTS_NOTE_PREFIX = "[Agents]\n<agents>";
+
+interface MessageLike {
+  role?: unknown;
+  content?: unknown;
+}
+
+function isAgentsNote(message: unknown): boolean {
+  if (message === null || typeof message !== "object") return false;
+  const m = message as MessageLike;
+  if (m.role !== "user") return false;
+  return typeof m.content === "string" && m.content.startsWith(AGENTS_NOTE_PREFIX);
+}
+
+/** Remove every framework `[Agents]` listing from ONE model call's message list, in place. The array must be the part-6 list freshly built for this call, never the session history, because a splice on the step.started resolver's copy does not reach the model. */
+export function suppressAgentsListing(messages: unknown): number {
+  try {
+    if (!Array.isArray(messages)) return 0;
+    let removed = 0;
+    for (let i = messages.length - 1; i >= 0; i--) {
+      if (!isAgentsNote(messages[i])) continue;
+      messages.splice(i, 1);
+      removed++;
+    }
+    noteWakeAttachments(messages);
+    return removed;
+  } catch {
+    return 0;
+  }
+}
+
+// The attachment leg: eve composes a child's opening message from the caller's `message` alone, so the wake's attachment ids are carried in here. The seam is the replacement schema's `validate` return, which AI-SDK takes as the call's input.
+
+// A caller `outputSchema` puts the child's answer behind eve's output sink, and a prose answer then fails the turn with OUTPUT_SCHEMA_NOT_FULFILLED — measured on deploy #195, where it destroyed a correct refusal. So the field is not offered and is dropped silently; a declared subagent's own schema is untouched.
+
+const wakeAttachmentSlot = defineState<readonly BriefAttachment[]>("open-everywhere.wake-attachments", () => []);
+
+/** eve's own name for the child's opening message. Its field description is why this leg exists: the subagent does not see the parent's history. */
+const DELEGATION_BRIEF_FIELD = "message";
+
+/** The text of the LAST user message in a model call — the delivery that woke this turn. It does NOT narrow to the trigger message, and both content shapes are read: a plain string, or an array whose text parts are joined. */
+function lastUserText(messages: readonly unknown[]): string | undefined {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i];
+    if (m === null || typeof m !== "object") continue;
+    const like = m as MessageLike;
+    if (like.role !== "user") continue;
+    if (typeof like.content === "string") return like.content;
+    if (!Array.isArray(like.content)) return undefined;
+    const text = like.content
+      .map((part) => (part !== null && typeof part === "object" && typeof (part as { text?: unknown }).text === "string" ? (part as { text: string }).text : ""))
+      .join("\n");
+    return text.length > 0 ? text : undefined;
+  }
+  return undefined;
+}
+
+/** Record this model call's wake attachments. Best-effort in both directions: an unreadable list, an envelope with no `<attachment/>`, or no session context all leave the slot empty, and an empty slot appends nothing. */
+function noteWakeAttachments(messages: readonly unknown[]): void {
+  let found: readonly BriefAttachment[] = [];
+  try {
+    const text = lastUserText(messages);
+    // The envelope gate keeps the parser off an unrendered delivery, which carries an author's own unescaped bytes. It is a heuristic, not a proof: the control that holds is the admission inside parseWakeAttachments.
+    if (text !== undefined && isWakeEnvelopeShaped(text)) found = parseWakeAttachments(text);
+  } catch {
+    found = [];
+  }
+  try {
+    wakeAttachmentSlot.update(() => found);
+  } catch {
+    /* no eve context — nothing to remember, and the read below answers with the empty default */
+  }
+}
+
+function currentWakeAttachments(): readonly BriefAttachment[] {
+  try {
+    return wakeAttachmentSlot.get();
+  } catch {
+    return [];
+  }
+}
+
+/** Carry this wake's attachment ids into one worker brief, in place. A no-op unless the wake named an attachment and the call carries a non-empty `message`; never throws, because losing the call costs the seat its answer. */
+function carryAttachmentsIntoBrief(candidate: unknown): unknown {
+  try {
+    const attachments = currentWakeAttachments();
+    if (attachments.length === 0) return candidate;
+    if (candidate === null || typeof candidate !== "object") return candidate;
+    const message = (candidate as Record<string, unknown>)[DELEGATION_BRIEF_FIELD];
+    if (typeof message !== "string" || message.length === 0) return candidate;
+    return { ...(candidate as Record<string, unknown>), [DELEGATION_BRIEF_FIELD]: withDelegatedAttachments(message, attachments) };
+  } catch {
+    return candidate;
+  }
+}
+
+interface ToolWithInputSchema {
+  inputSchema?: unknown;
+}
+
+type JsonSchemaObject = {
+  properties?: Record<string, unknown>;
+  required?: readonly string[];
+  [k: string]: unknown;
+};
+
+/** One replacement per original schema object. The projection seam runs on every model call, so the cache keeps the advertised bytes and their identity stable, which is what the prompt cache wants. */
+const replacements = new WeakMap<object, unknown>();
+
+/** Spellings eve calls equivalent to omitting `agentId` — null, undefined, an empty string — are dropped and the call proceeds as a fresh delegation. Everything else is refused: the fail-closed direction. */
+function isBlankContinuationId(value: unknown): boolean {
+  if (value === null || value === undefined) return true;
+  return typeof value === "string" && value.trim().length === 0;
+}
+
+/** Take `agentId` off the `agent` tool and refuse any call that still carries one; it mutates the tool in place, so eve's approval WeakMap survives. The refusal reaches the model as an ordinary tool-result error, and the whole function is a no-op when the affordance is absent. */
+export function refuseAgentContinuation(toolset: Record<string, unknown>): boolean {
+  const raw = toolset[DELEGATION_TOOL_NAME];
+  if (raw === null || typeof raw !== "object") return false;
+  const tool = raw as ToolWithInputSchema;
+  const current = tool.inputSchema;
+  if (current === null || typeof current !== "object") return false;
+
+  const cached = replacements.get(current as object);
+  if (cached !== undefined) {
+    tool.inputSchema = cached;
+    return true;
+  }
+
+  const original = asSchema(current as never);
+  const source = original.jsonSchema as JsonSchemaObject | undefined;
+  const properties = source?.properties;
+  if (source === undefined || properties === undefined || !(CONTINUATION_FIELD in properties)) return false;
+
+  const { [CONTINUATION_FIELD]: _dropped, [CALLER_OUTPUT_SCHEMA_FIELD]: _shape, ...keptProperties } = properties;
+  const stripped: JsonSchemaObject = { ...source, properties: keptProperties };
+  if (Array.isArray(source.required)) {
+    stripped.required = source.required.filter((name) => name !== CONTINUATION_FIELD && name !== CALLER_OUTPUT_SCHEMA_FIELD);
+  }
+
+  const replacement = jsonSchema(stripped as never, {
+    validate: async (value: unknown) => {
+      let candidate = value;
+      if (candidate !== null && typeof candidate === "object" && CONTINUATION_FIELD in candidate) {
+        const id = (candidate as Record<string, unknown>)[CONTINUATION_FIELD];
+        if (!isBlankContinuationId(id)) {
+          return { success: false as const, error: new Error(CONTINUATION_REFUSAL_MESSAGE) };
+        }
+        const { [CONTINUATION_FIELD]: _blank, ...rest } = candidate as Record<string, unknown>;
+        candidate = rest;
+      }
+      // Drop a caller `outputSchema` before eve ever sees it, so the child keeps no output sink and its prose answer survives.
+      if (candidate !== null && typeof candidate === "object" && CALLER_OUTPUT_SCHEMA_FIELD in candidate) {
+        const { [CALLER_OUTPUT_SCHEMA_FIELD]: _shape, ...rest } = candidate as Record<string, unknown>;
+        candidate = rest;
+      }
+      // Carry the attachment ids BEFORE eve's own validation, so the augmented `message` is the value eve validates and the child receives. A refused continuation never reaches this line.
+      candidate = carryAttachmentsIntoBrief(candidate);
+      // Everything that is NOT a continuation attempt keeps eve's own validation, byte for byte —
+      // this replacement adds a rule, it does not become the rule.
+      if (typeof original.validate !== "function") return { success: true as const, value: candidate };
+      return await original.validate(candidate);
+    },
+  });
+
+  replacements.set(current as object, replacement);
+  tool.inputSchema = replacement;
+  return true;
+}
+
+const MODEL_MESSAGE_HOOK_KEY = "__oeModelMessageProjection";
+
+/** Install the hook eve's part-6 `__oeProjectModelMessages` consults — what makes the listing removal reach the model, since eve 0.48.0 builds the model list through a copy. Idempotent, and runs at module load. */
+function installAgentsListingProjectionHook(): void {
+  (globalThis as Record<string, unknown>)[MODEL_MESSAGE_HOOK_KEY] = suppressAgentsListing;
+}
+
+installAgentsListingProjectionHook();

package/agent/access/worker-seat-state.ts

@@ -0,0 +1,25 @@
+// Per-wake bit for "is this seat a delegated worker?", written at `turn.started` and read per model call. It clears to `false`, and `false` is the safe answer for BOTH consumers: the OPE-420 subtraction keeps `ask_question` (its unstranded direction) and the invoker-posture fence withholds the wide-hands family (its narrow direction), so an unclassified wake fails safe on both axes.
+
+import { defineState } from "eve/context";
+
+const slot = defineState<boolean>("open-everywhere.worker-seat", () => false);
+
+/** Record whether THIS wake is a delegated worker. Written CLEAR-FIRST by hooks/lean-seat.ts:
+ *  `setWorkerWake(false)` runs before any classification. Fail-soft outside an eve context. */
+export function setWorkerWake(worker: boolean): void {
+  try {
+    slot.update(() => worker);
+  } catch {
+  }
+}
+
+/** Is the wake in flight a delegated worker? `false` for every context-less caller (a unit test, a
+ *  non-session code path, a model call eve runs outside the container) — with no context there is no
+ *  delegation parent to have been asked a question on behalf of. */
+export function currentWorkerWake(): boolean {
+  try {
+    return slot.get();
+  } catch {
+    return false;
+  }
+}

package/agent/access/worker-seat.ts

@@ -0,0 +1,54 @@
+// The delegated-worker subtraction, and two sets that answer different questions. WORKER_WITHHELD_TOOLS holds verbs that are STRUCTURALLY WRONG on a worker: the answer cannot reach it, the verb acts on the delegating seat's conversational state, or it is the chat surface's verb while a worker holds the work surface. WORKER_SEAT_RESERVED_TOOLS holds verbs the SEAT SHAPE reserves; keep the two apart.
+// FAIL DIRECTION: toward KEEPING the tool - an unclassified wake is not a worker, so a misread seat keeps its whole kit.
+
+// Type-only, erased at compile — the module stays PURE (see the header).
+import type { WindowGrain } from "../identity/binding.js";
+
+/**
+ * Names withheld from a delegated worker. `no_reply` and `stand_down` act on the delegating SEAT's turn and engagement state; `read_channel` / `read_thread` are the chat surface's verbs, while a worker reads its work surface natively under the domain's grant.
+ * The cost, named: a worker delegated from Slack, Discord, Teams or GitHub holds no chat read at all. OPE-938 owns that gap; do not close it by taking these two names back out.
+ */
+export const WORKER_WITHHELD_TOOLS: ReadonlySet<string> = new Set<string>([
+  "no_reply",
+  "stand_down",
+  "read_channel",
+  "read_thread",
+]);
+
+/**
+ * The DM-seat carve-in, withheld from a worker so the carve-in is CONTAINMENT and not merely routing. Each verb's authority comes from the SHAPE of the seat, and a worker inherits that shape - an inherited DM binding, the seat's acting principal - without the person who earned it.
+ * The names are spelled here to keep this module pure, and `checkWorkerSeatReservedTools` refuses any disagreement with `DM_SEAT_CARVE_IN`.
+ */
+export const WORKER_SEAT_RESERVED_TOOLS: ReadonlySet<string> = new Set<string>([
+  "link_identity",
+  "confirm_link",
+  "unlink_identity",
+  "revoke_credential_grant",
+]);
+
+/** The union of the two sets above, and the default of both decision functions below, so the enforcement point, the lint and the unit tests keep sharing one answer. */
+export const WORKER_UNMOUNTED_TOOLS: ReadonlySet<string> = new Set<string>([...WORKER_WITHHELD_TOOLS, ...WORKER_SEAT_RESERVED_TOOLS]);
+
+/**
+ * A vendor container read keeps its CHAT arm on the `task` grain and no other, because a delegated worker holds no generic `read_channel` / `read_thread` and would otherwise have no container read on Linear or Notion at all.
+ * It decides the CHAT arm and nothing else: the WORK arm stays grain-blind, or a non-delegating conversational seat would be stranded.
+ */
+export function chatArmGrain(grain: WindowGrain): boolean {
+  return grain === "task";
+}
+
+/** Allow-by-default, the opposite direction to the job kit's and the lean roster's: this is a handful-of-names exclusion of verbs that are broken or reserved on this seat, so an unknown name is neither and keeping it is correct. */
+export function allowedOnWorkerSeat(name: string, withheld: ReadonlySet<string> = WORKER_UNMOUNTED_TOOLS): boolean {
+  return !withheld.has(name);
+}
+
+/** Applies the subtraction in place and returns the removed names, sorted. Mutation rather than replacement, because eve keys tool approvals in a WeakMap on the tool OBJECTS; and absence rather than refusal, so nothing invites a retry. */
+export function restrictToolsetForWorkerSeat(toolset: Record<string, unknown>, withheld: ReadonlySet<string> = WORKER_UNMOUNTED_TOOLS): string[] {
+  const removed: string[] = [];
+  for (const name of Object.keys(toolset)) {
+    if (allowedOnWorkerSeat(name, withheld)) continue;
+    delete toolset[name];
+    removed.push(name);
+  }
+  return removed.sort();
+}

package/agent/access/worker-toolset-state.ts

@@ -0,0 +1,65 @@
+// Carries the delegated worker's evidence identity from the hook that knows the ids to the projection seam that holds the mounted names, which has no eve context of its own. Fail direction is NO ROW: a lost row costs the audit trail one entry and can never cost a control. The dedupe keys on the ROSTER, not on "have I written a row", because eve resolves connection-discovered tools only after `connection_search` has run, so a worker's roster grows after its first model call.
+
+import { defineState } from "eve/context";
+
+/** The ids one `worker.toolset` row is stamped with. Names and ids ONLY — this type may never grow
+ *  a field carrying message or tool-input text (audit/worker-toolset.ts states the taint rule). */
+export interface WorkerToolsetIdentity {
+  readonly org: string;
+  /** The domain label the row's `workspace` column carries — hooks/lean-seat.ts's `domainLabelOf`. */
+  readonly domain: string;
+  /** The WORKER's own eve session id: the answer to "which spawn is this row about". */
+  readonly worker: string;
+  /** The session that dispatched this worker (eve's typed `session.parent.sessionId`), or `null`. */
+  readonly parentSession: string | null;
+  /** eve's own id for the dispatch (`session.parent.callId`), or `null`. It names ONE spawn, which
+   *  is what joins this row to the parent's `delegation.task_started` row for that call. */
+  readonly parentCallId: string | null;
+  /** The SEAT at the root of the delegation (identity/binding.ts `delegationRootSessionId`), or
+   *  `null`. Equal to `parentSession` under today's leaf rule; recorded separately so a reader never
+   *  has to know that. */
+  readonly rootSession: string | null;
+  /** The WORKER's own turn id, never the parent's. There is deliberately no wake id beside it: `currentWakeId` answers `undefined` for an eve subagent child, so the field would be `null` on every row ever written and a reader would try to join on it. */
+  readonly turn: string | null;
+}
+
+const identity = defineState<WorkerToolsetIdentity | null>("open-everywhere.worker-toolset.identity", () => null);
+const lastRoster = defineState<string | null>("open-everywhere.worker-toolset.last-roster", () => null);
+
+/** Record who this wake is, or clear the slot. Written CLEAR-FIRST by hooks/lean-seat.ts on every
+ *  turn, so a slot can never outlive the session shape that wrote it. Fail-soft outside an eve
+ *  context. */
+export function setWorkerToolsetIdentity(next: WorkerToolsetIdentity | null): void {
+  try {
+    identity.update(() => next);
+  } catch {
+  }
+}
+
+/** Who the wake in flight is, or `null` for every context-less caller and every unclassified wake. */
+export function currentWorkerToolsetIdentity(): WorkerToolsetIdentity | null {
+  try {
+    return identity.get();
+  } catch {
+    return null;
+  }
+}
+
+/** Why one `worker.toolset` row was written: the worker's FIRST roster, or a roster that CHANGED
+ *  under it (see this module's header — a discovered connector op is the case that changes one). */
+export type WorkerToolsetClaim = "mount" | "changed";
+
+/** Claim a row for the roster `key` names, or `null` when this session already recorded that exact roster. `key` must be a stable rendering of the SORTED mounted names. A context-less caller answers `null`, since a row per model call is the trail-burying failure this rule prevents. */
+export function claimWorkerToolsetEvidence(key: string): WorkerToolsetClaim | null {
+  try {
+    let claim: WorkerToolsetClaim | null = null;
+    lastRoster.update((cur) => {
+      if (cur === key) return cur;
+      claim = cur === null ? "mount" : "changed";
+      return key;
+    });
+    return claim;
+  } catch {
+    return null;
+  }
+}