@open-everywhere/core 0.1.0

package/dist/agent/tools/halt.js

@@ -0,0 +1,157 @@
+// `halt` — THE BRAKE PEDAL. It stops every consequential act at an address, now, with no card.
+//
+// 🔴 IT IS `open` TIER AND UNCARDED ON PURPOSE, AND THIS IS THE ONE PLACE THAT ARGUMENT IS MADE.
+// A card needs an approver who is present and clicks. During the incident a halt exists for, that is
+// exactly what is not guaranteed — so a carded brake is a brake that works when you do not need it.
+// The tree has already ruled the same way three times, on smaller blast radii: `task_cancel` ("a
+// card here would put a confirmation in front of the brake pedal"), `set_dm_delivery` and
+// `stand_down` (access/consequence.ts). This is that rule at deployment scale. Anyone in the room
+// can pull it.
+//
+// 🔴 THE COST IS STATED, NOT HIDDEN: an `open` verb is a verb a poisoned turn can call, so a halt is
+// a denial of service the model can trigger. That is the accepted trade — the failure is LOUD (the
+// seat says it is halted, in every room), VISIBLE (one `admin.halt.set` row) and REVERSIBLE by an
+// admin (`resume`, which is carded because it widens). The opposite trade — a card in front of the
+// brake — fails silently and is not reversible by anybody, because nothing stopped.
+//
+// 🔴 NO ADDRESS COMES FROM THE MODEL. `scope` is a two-value enum and the KEY is derived host-side
+// from this seat's own binding. A model-supplied scope key would let a poisoned turn halt an address
+// nobody in this conversation has anything to do with, and it would be the one string on this plane
+// that a person did not write.
+//
+// 🔴 THE ROOM IS TOLD BY THE HOST, NOT BY THE MODEL (OPE-1757). `execute` posts the confirmation
+// through the reply path itself, and the `admin.halt.set` row carries `announced` either way. The
+// old shape returned the sentence as a tool RESULT and trusted the turn to repeat it. In
+// soak-2026-09-12-a it did not: the halt stood 50 minutes, shaped four later steps, and the room
+// heard only that one task was cancelled. An uncarded brake is defended on its failure being LOUD,
+// so the announcement is the host's act, and a silent one is a row a reader can find.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { appendAudit } from "../audit/audit.js";
+import { orgWideWhere, whereFromScope } from "../approvals/actions.js";
+import { haltAddressFields } from "../access/halt.js";
+import { postHostNotice, REPLY_DEDUPE_SKIPPED_ID, resolveReplyTarget } from "../channels/reply-post.js";
+import { bindFrom, currentSessionId, currentWakeId } from "../identity/binding.js";
+import { principalIdOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { getOperationalStore } from "../operational/provider.js";
+/** The address the two chat verbs share. HOST-DERIVED from the binding — see the header. */
+export function chatHaltAddress(scope, surfaceKey) {
+    return scope === "org" ? { orgWide: true } : { orgWide: false, level: "surface", scopeKey: surfaceKey };
+}
+/**
+ * What the room is told, host-authored. Says what stopped, what did not, and how it ends.
+ *
+ * 🔴 IT NAMES WHAT KEEPS RUNNING AS PLAINLY AS WHAT STOPS (OPE-1758), because the room reads this
+ * line and the seat is told the same thing by `haltSeatParagraph`. The doctrine is that a
+ * consequential act is one whose effect ESCAPES the conversation (access/consequence.ts), so a READ
+ * does not stop, a REPLY does not stop, a file into THIS room does not stop (`post_file` is `open` —
+ * the consequence table calls it "same class as reply"), and the host's record of this conversation
+ * in memory does not stop. None of the four leaves the conversation the halt still admits.
+ * In soak-2026-09-12-a all of them ran under a halt whose text implied otherwise; the seat then
+ * refused a read-only pull-request question and refused to rewrite a file it had already posted,
+ * citing a pause that had never covered either. A line that overclaims is a line that stops work
+ * nobody stopped.
+ *
+ * 🔴 AND IT DOES NOT SAY "NO OUTBOUND NETWORK ACCESS". What a halt denies is the sandbox's reach and
+ * the open web (`web_fetch`, `web_search`, `assertEgressReach`). OE's own first-party transports are
+ * not egress arrows (docs/security/control-plane.md), so the very file post this line offers in its
+ * next breath is an outbound call. Name the fence, never the whole network.
+ */
+export function haltConfirmation(scope) {
+    const where = scope === "org" ? "everywhere in this deployment" : "in this conversation";
+    return (`Halted ${where}. Nothing consequential will run now — no approvals, no scheduled or event-driven ` +
+        `work, no borrowed credentials, and nothing fetched from the open web. I can still read, reply, ` +
+        `post a file into this conversation, and keep what we say in memory, so ask me anything I can ` +
+        `answer by reading. An admin lifts it with \`resume\`.`);
+}
+/**
+ * What the TOOL RESULT tells the model, which is never a second copy of the room's line when the
+ * host has already posted it. The `false` arm carries the confirmation VERBATIM, because a post that
+ * failed leaves the model as the only voice in the room — that arm is the recovery from a silent
+ * brake, and it is the arm the 50-minute soak failure needed.
+ */
+export function haltModelMessage(announced, scope) {
+    return announced
+        ? "The halt is on and this room has already been told, in the host's own words. Do not repeat the confirmation. Say in one line what you stopped and why."
+        : `The halt is on, but the confirmation could NOT be posted here. Say this in your own reply, now: ${haltConfirmation(scope)}`;
+}
+/**
+ * Tell the room the halt is on. NEVER THROWS — a brake that failed to announce itself must still be
+ * a brake, so every failure resolves `false` and the caller's audit row carries it.
+ *
+ * A SKIPPED post is not a delivered one: `postReply` answers a dedupe refusal with a sentinel id
+ * rather than a throw, so reading only "it did not throw" would record a delivery the room never got
+ * (the trap `connections/consent-resume.ts` names). 🔴 THAT BRANCH IS DEFENSIVE, NOT LOAD-BEARING
+ * HERE, and the difference is worth stating because the sentinel looks like idempotency evidence:
+ * `postHostNotice` is `postReply` with NO audit struct, so it passes `org: undefined` into
+ * `postOnce`, which fails OPEN on a missing org and claims no dedupe key. The confirmation is
+ * therefore NOT deduped — a re-run of this step posts a second identical line into the room. That is
+ * the loud direction and it is accepted: a brake that announces itself twice is a brake the room
+ * heard. The branch stays so an audited poster later cannot silently record a delivery that skipped.
+ */
+export async function announceHalt(ctx, scope, deps = {}) {
+    try {
+        const target = (deps.resolveTarget ?? resolveReplyTarget)(ctx);
+        if (target === null)
+            return false;
+        const id = await (deps.post ?? postHostNotice)(target, haltConfirmation(scope));
+        return id !== REPLY_DEDUPE_SKIPPED_ID;
+    }
+    catch {
+        return false;
+    }
+}
+export default defineTool({
+    description: "STOP EVERYTHING CONSEQUENTIAL, NOW — the break-glass halt, for the whole room or the whole deployment. It takes effect immediately and needs no approval: nothing gated runs, no routine fires, no borrowed credential is spendable, no tool from a connected integration is usable, the sandbox reaches no host, and `web_fetch` and `web_search` are withheld, until an admin runs `resume`. It does NOT stop reading: a halt pauses acts whose effect leaves the conversation, so you can still read, answer, delegate a read to a worker, post a file into this room, and keep what is said in memory. Pull it when someone asks you to halt, freeze, or pull the plug on EVERYTHING here, or when you have good reason to believe something is going wrong. 🔴 A REQUEST TO STOP ONE PIECE OF WORK IS NOT THIS VERB. \"stop that changelog one\", \"drop the PR task\", \"we're not doing that this release\" NAME something — a task, a thread, a topic — so cancel the named task with `task_cancel` and leave everything else running. A request to go quiet is `stand_down`. Read what the person named before you reach for this: the whole room is the default only when they named the whole room. When the ask really is everything, prefer it over asking whether you should: stopping everything is reversible, and the thing you would be asking permission to stop is not.",
+    inputSchema: z.object({
+        scope: z
+            .enum(["org", "surface"])
+            .default("org")
+            .describe('How far it reaches. "org" (the default) stops the whole deployment — the right answer for an incident. "surface" stops only this conversation. The address itself is resolved from this conversation; you never supply one.'),
+    }),
+    outputSchema: z.object({
+        halted: z.boolean(),
+        scope: z.enum(["org", "surface"]),
+        /** TRUE when the host itself posted the confirmation into this room. */
+        announced: z.boolean(),
+        /** What the MODEL is to do next — never a second copy of the room's line when the host posted it. */
+        message: z.string(),
+    }),
+    approval: never(),
+    async execute(input, ctx) {
+        const p = resolvePartition(ctx);
+        const scope = input.scope ?? "org";
+        const address = chatHaltAddress(scope, p.surfaceKey);
+        // The ACTING principal when there is one, and nothing when there is not. Deliberately NOT the
+        // bound creator on an unattended turn: a halt an unattended fire pulled must not be recorded as
+        // a person's decision. It still HAPPENS — the brake takes no attendance — it is just honest
+        // about who pulled it.
+        const setBy = principalIdOf(ctx);
+        const wakeId = currentWakeId(ctx);
+        const sessionId = currentSessionId(ctx);
+        const setAt = new Date().toISOString();
+        await getOperationalStore().setHalt(p.org, address, { ...(setBy ? { setBy } : {}), setAt, ...(wakeId ? { setRef: wakeId } : {}) });
+        // AFTER the row, so the room is never told about a halt the store refused — and BEFORE the audit
+        // row, so `announced` records what actually happened rather than what was attempted. A halt the
+        // room was NOT told about is the loudest thing this row can carry, so it is never omitted.
+        const announced = await announceHalt(ctx, scope);
+        await appendAudit({
+            ...(address.orgWide ? orgWideWhere(p.org) : whereFromScope(p.org, address.scopeKey)),
+            ...(setBy ? { principalId: setBy } : {}),
+            action: "admin.halt.set",
+            detail: {
+                ...haltAddressFields(address),
+                door: "chat",
+                platform: bindFrom(ctx).platform,
+                announced,
+                setAt,
+                ...(wakeId ? { wakeId } : {}),
+                ...(sessionId ? { sessionId } : {}),
+            },
+        }).catch(() => undefined);
+        return { halted: true, scope, announced, message: haltModelMessage(announced, scope) };
+    },
+});
+//# sourceMappingURL=halt.js.map

package/dist/agent/tools/halt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"halt.js","sourceRoot":"","sources":["../../../agent/tools/halt.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,oGAAoG;AACpG,iGAAiG;AACjG,0FAA0F;AAC1F,kGAAkG;AAClG,eAAe;AACf,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,oFAAoF;AACpF,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,oGAAoG;AACpG,+BAA+B;AAC/B,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,yFAAyF;AACzF,iGAAiG;AACjG,mGAAmG;AACnG,sFAAsF;AAEtF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,kBAAkB,EAAoB,MAAM,2BAA2B,CAAC;AAC1H,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,KAAwB,EAAE,UAAkB;IAC1E,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC1G,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,KAAK,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACzF,OAAO,CACL,UAAU,KAAK,oFAAoF;QACnG,iGAAiG;QACjG,+FAA+F;QAC/F,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB,EAAE,KAAwB;IAC3E,OAAO,SAAS;QACd,CAAC,CAAC,wJAAwJ;QAC1J,CAAC,CAAC,mGAAmG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AACnI,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,KAAwB,EAAE,IAAI,GAAqB,EAAE;IAC5G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,KAAK,uBAAuB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,6zCAA6zC;IAC/zC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aACxB,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,6NAA6N,CAC9N;KACJ,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;QACnB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACjC,wEAAwE;QACxE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,qGAAqG;QACrG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACrD,8FAA8F;QAC9F,gGAAgG;QAChG,4FAA4F;QAC5F,uBAAuB;QACvB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,mBAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnI,iGAAiG;QACjG,gGAAgG;QAChG,2FAA2F;QAC3F,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAsB,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,WAAW,CAAC;YAChB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,GAAG,iBAAiB,CAAC,OAAO,CAAC;gBAC7B,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ;gBAChC,SAAS;gBACT,KAAK;gBACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC;SACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;IACzF,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/link_identity.d.ts

@@ -0,0 +1,48 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    platform?: string | undefined;
+    query?: string | undefined;
+    nativeId?: string | undefined;
+}, {
+    decided: string;
+    challengeId?: string | undefined;
+    expiresAt?: string | undefined;
+    candidates?: {
+        nativeId: string;
+        label: string;
+    }[] | undefined;
+    truncated?: boolean | undefined;
+    target?: string | undefined;
+    instructions: string;
+}> & {
+    execute(input: {
+        platform?: string | undefined;
+        query?: string | undefined;
+        nativeId?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        expiresAt?: undefined;
+        decided: string;
+        candidates: {
+            nativeId: string;
+            label: string;
+        }[];
+        truncated: boolean;
+        instructions: string;
+        challengeId?: undefined;
+        target?: undefined;
+    } | {
+        candidates?: undefined;
+        truncated?: undefined;
+        decided: string;
+        challengeId: string;
+        expiresAt: string;
+        target: string;
+        instructions: string;
+    } | {
+        decided: string;
+        challengeId: string;
+        expiresAt: string;
+        instructions: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=link_identity.d.ts.map

package/dist/agent/tools/link_identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link_identity.d.ts","sourceRoot":"","sources":["../../../agent/tools/link_identity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2QuB,MAAM;qBAAe,MAAM;mBAAa,MAAM;sBAAgB,MAAM"}

package/dist/agent/tools/link_identity.js

@@ -0,0 +1,283 @@
+// link_identity is ACT 1 of the linking flow and WRITES NO LINK: it opens a request the OTHER account must consent to and this person must then finalize. Two transports — DIRECTORY (name the account out of that platform's own user directory and it gets a consent ask in its own DM, so no bearer secret is ever posted) and CODE (the fallback, reached automatically whenever the directory transport cannot run, and it SAYS which capability was missing). DM-only, and the reason is not privacy: the finalize must be addressed to one identified human, and in any room with an audience anyone present could answer it.
+// 🔴 A DIRECTORY HIT IS NOT EVIDENCE — a name says nothing about whose account it is, and the proof is the CONSENT the named account gives. This tool sends an UNSOLICITED DM to a third party, bounded by WHO may fire it (DM-only, an acting human, the initiator-trust gate), by WHAT it can carry (core-owned copy plus an unspoofable anchor and a sanitized, attributed profile name — nothing the caller typed reaches the recipient), and by one DM per TTL-bounded single-use request. There is no per-initiator rate limit today: a known gap, not a silent hole.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { actingPrincipalIdOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { surfaceKeyOf } from "../access/resolver.js";
+import { issueLinkChallenge, openChallengeAnsweredBy } from "../identity/link-store.js";
+import { linkInitiatorRefusal } from "../identity/link-initiator.js";
+import { linkClaimInstructions, LINK_CHALLENGE_TTL_MS } from "../identity/link-challenge.js";
+import { asLinkTransport, linkConsentAsk, linkConsentPendingInstructions, linkStartOpenLoopRefusal } from "../identity/link-flow.js";
+import { linkConsentActions } from "../identity/link-consent.js";
+import { hasAccountDirectory, lookupAccountDirectory, accountDirectoryPlatforms, DIRECTORY_MAX_CANDIDATES } from "../identity/account-directory.js";
+import { accountProfileFor, humanAccountLabel } from "../identity/account-display-name.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+import { canDeliverDirectMessage, dispatchDirectMessage } from "../channels/post-arms.js";
+import { linkTenantOf, tryLinkTenantOf } from "../identity/link-tenant.js";
+import { ingestUntrusted } from "../access/untrusted.js";
+import { postSurfaceTextStrict } from "../channels/surface-message-ops.js";
+const TTL_MINUTES = Math.round(LINK_CHALLENGE_TTL_MS / 60_000);
+/**
+ * A candidate's human label, FENCED as untrusted content — for every site where a directory result reaches this tool's own JSON output, which the model reads.
+ * The name and handle are the candidate account's OWN self-set profile strings. The directory already sanitizes them structurally; the fence is what tells the model the span is DATA rather than part of this tool's own instruction.
+ */
+function fenced(text) {
+    return ingestUntrusted(text, { source: "account-display-name" });
+}
+export default defineTool({
+    description: "Start linking another account (GitHub, Linear, Slack, …) to the person you are talking to, so their work is attributed to ONE human across surfaces. DM only, and nothing is linked by this call. THREE WAYS TO CALL IT. (1) `{platform, query}` — SEARCH that platform's user directory for the person's other account and return candidates; show them the names and let them pick. (2) `{platform, nativeId}` — ask that exact account to consent, in its own DM; you then finalize with confirm_link once it answers. (3) `{}` — the fallback: the HOST privately posts a short single-use code into this DM for the person to carry to their other account. Ways 1 and 2 fall back to way 3 by themselves when the platform has no directory or no DM delivery, and say so. The tool result never contains the live code; do not ask for it or repeat one from history.",
+    inputSchema: z.object({
+        platform: z
+            .string()
+            .optional()
+            .describe("The platform the OTHER account is on (`github`, `slack`, `linear`, …). Needed for a directory search or a directory ask; omit for the code fallback."),
+        query: z.string().optional().describe("A name or handle to search that platform's user directory for. Returns candidates and writes nothing."),
+        nativeId: z
+            .string()
+            .optional()
+            .describe("The exact account id to ask, taken from a `query` search's candidates. Sends that account a consent request in its own DM. Never invent one — search first."),
+    }),
+    outputSchema: z.object({
+        /** `search` (candidates returned, nothing written), `awaiting_consent` (a directory request is
+         *  out), or `code` (the fallback code transport). */
+        decided: z.string(),
+        challengeId: z.string().optional(),
+        expiresAt: z.string().optional(),
+        /** Directory search only: the accounts that matched, newest question first. `nativeId` is what
+         *  to pass back; `label` is what to show the person. */
+        candidates: z.array(z.object({ nativeId: z.string(), label: z.string() })).optional(),
+        /** True when more accounts matched than were returned — ask for a narrower name. */
+        truncated: z.boolean().optional(),
+        /** Directory ask only: the account that was asked, named for a human. */
+        target: z.string().optional(),
+        instructions: z.string(),
+    }),
+    approval: never(),
+    async execute(input, ctx) {
+        const binding = bindFrom(ctx);
+        if (binding.mode !== "dm") {
+            throw new Error(`link_identity is DM-only (this conversation is "${binding.mode}"). Linking identities ends with a confirmation that only the person themselves may answer, and in a ${binding.mode === "mpim" ? "group DM" : "channel"} anyone present could answer it. Ask them to DM me.`);
+        }
+        // principal-gate: presence — a HUMAN must be here, acting. This opens a request whose whole
+        // meaning is "the person reading this DM asked to link an account"; an unattended fire has nobody
+        // reading it, so the acting principal is the right read and a fire must not satisfy it.
+        const actor = actingPrincipalIdOf(ctx);
+        if (!actor) {
+            throw new Error("link_identity needs a verified person on this turn — a link is a statement about a human, and there is nobody here to make it.");
+        }
+        // The initiator-trust gate: a link-set spans every surface, so the person growing one has to be somebody the org can vouch for, not merely somebody who found their way into a DM.
+        // SCOPED to platforms whose internal/external verdict was actually CHECKED — everywhere else `external` means "nobody checked", and refusing on it would delete the flow rather than gate it.
+        const refusal = linkInitiatorRefusal(binding, "start a link");
+        if (refusal)
+            throw new Error(refusal);
+        // ONE LIVE CODE PER PROOF-OF-CONTROL LOOP (Tommy, 2026-09-19). A person who has just ANSWERED a
+        // link request is in the MIDDLE of one: they still owe the initiator a step. A start here mints a
+        // SECOND live code into the same conversation and tells them to send it from their other
+        // account, which is two codes and two contradictory instructions in one DM. identity/link-flow.ts
+        // carries the reasoning and the copy; identity/link-store.ts compares the TTL, so an expired
+        // answer strands nobody.
+        // 🔴 IT COVERS EVERY WAY OF CALLING THE TOOL, THE DIRECTORY SEARCH INCLUDED. A search writes
+        // nothing, so this is not where the second code would be minted — but a search is act 1 of the
+        // start the very next call makes, and the person's own next step is the pending code-back rather
+        // than a candidate list. Refusing here is what puts that step in front of them.
+        // The account triple exactly as the answering step stamped it (`agent/hooks/link-claim.ts` for a
+        // claim, `agent/identity/link-consent.ts` for a consent), and the VALUE form of the tenant read
+        // rather than the throwing one: a CROSS-PLATFORM directory search reached this point before
+        // without ever naming THIS binding's own tenant, and a narrowing guard must not turn a call that
+        // worked into an exception. An unnameable tenant skips the read, which is vacuous rather than
+        // open — both answering steps stamp the account with the SAME derivation, so such an account has
+        // no answered row to find.
+        const actorTenant = tryLinkTenantOf(binding.platform, binding.workspace);
+        const openLoop = actorTenant === undefined ? undefined : await openChallengeAnsweredBy({ org: binding.org, account: { platform: binding.platform, tenant: actorTenant, nativeId: actor } });
+        // `transport` off the ROW, never assumed: a consenter never claimed anything, and the refusal is
+        // the one line they read.
+        const openLoopRefusal = linkStartOpenLoopRefusal({
+            openLoop: openLoop !== undefined,
+            transport: asLinkTransport(openLoop?.transport),
+            codeBack: openLoop?.backNonceHash !== undefined,
+        });
+        if (openLoopRefusal)
+            throw new Error(openLoopRefusal);
+        const p = resolvePartition(ctx);
+        const surfaceKey = surfaceKeyOf({ platform: p.platform, workspace: p.workspace, channel: p.surface });
+        const platform = input.platform?.trim();
+        const query = input.query?.trim();
+        const nativeId = input.nativeId?.trim();
+        const shortfall = platform ? directoryShortfall(platform) : "no platform named";
+        if (!platform || (!query && !nativeId) || shortfall) {
+            return await issueCodeChallenge({
+                org: binding.org,
+                platform: binding.platform,
+                tenant: binding.workspace,
+                nativeId: actor,
+                surfaceKey,
+                channelId: p.surface,
+                // The note names WHICH capability was missing. A person told "use the code instead" with no
+                // reason cannot tell a misconfiguration from a design; an operator reading it can go and
+                // grant the scope.
+                why: platform && (query || nativeId) ? `I can't look ${platform} accounts up: ${shortfall}.` : undefined,
+            });
+        }
+        // Which workspace the search and the request are scoped to: the same platform as this DM uses THIS conversation's own workspace, which is the roster the agent can actually read; another platform uses the deployment's sole admitted workspace.
+        // `undefined` means the deployment declares several and cannot say which, so it falls back to the code transport rather than naming an account in a workspace nobody chose.
+        const targetTenant = platform === binding.platform ? linkTenantOf(platform, binding.workspace) : tryLinkTenantOf(platform);
+        if (targetTenant === undefined) {
+            return await issueCodeChallenge({
+                org: binding.org,
+                platform: binding.platform,
+                tenant: binding.workspace,
+                nativeId: actor,
+                surfaceKey,
+                channelId: p.surface,
+                why: `I can't tell which ${platform} workspace to look in — this deployment serves more than one.`,
+            });
+        }
+        if (!nativeId) {
+            const found = await lookupAccountDirectory(platform, query, targetTenant || undefined);
+            if (found.candidates.length === 0) {
+                return {
+                    decided: "search",
+                    candidates: [],
+                    truncated: false,
+                    instructions: `No ${platform} account matched that. Ask them how their name or handle is spelled there and search again — ` +
+                        `or start the code flow instead by calling link_identity with no arguments.`,
+                };
+            }
+            const candidates = await Promise.all(found.candidates.map(async (c) => ({ nativeId: c.nativeId, label: fenced(await humanAccountLabel(platform, c.nativeId, targetTenant || undefined)) })));
+            return {
+                decided: "search",
+                candidates,
+                truncated: found.truncated,
+                instructions: `Nothing is linked and nothing has been asked yet. Show them these ${platform} accounts and let them pick ONE, then ` +
+                    `call link_identity again with that account's nativeId. A name proves nothing on its own — the account itself has to agree.` +
+                    (found.truncated ? ` More than ${DIRECTORY_MAX_CANDIDATES} matched; ask for a fuller name if none of these is right.` : ""),
+            };
+        }
+        if (platform === binding.platform && targetTenant === linkTenantOf(binding.platform, binding.workspace) && nativeId === actor) {
+            throw new Error("that is the account you are speaking from — linking joins two DIFFERENT accounts. Name the other one.");
+        }
+        const targetName = await humanAccountLabel(platform, nativeId, targetTenant || undefined);
+        const issued = await issueLinkChallenge({
+            org: binding.org,
+            platform: binding.platform,
+            tenant: binding.workspace,
+            nativeId: actor,
+            surfaceKey,
+            transport: "directory",
+            target: { platform, tenant: targetTenant, nativeId },
+        });
+        // The consent ask NAMES the initiator: the whole value of the reverse flow is that an attacker who initiates AT your account produces an unexpected DM naming a stranger, which is an easy human judgement. A nameless ask would throw that away.
+        // The ANCHOR and the NAME are passed separately. The anchor is composed from facts this deployment's own mapper captured and nobody can choose it; the name is the initiating account's own self-set profile string, which the copy attributes as a claim. Composing them into one label would put unattributed attacker-chosen prose in front of a stranger.
+        const initiatorAnchor = accountAnchor(binding.platform, binding.workspace, actor);
+        const initiatorProfile = await accountProfileFor(binding.platform, actor, binding.workspace);
+        const initiatorName = profileName(initiatorProfile);
+        try {
+            await dispatchDirectMessage(platform, {
+                principalId: nativeId,
+                text: linkConsentAsk({
+                    initiatorAnchor,
+                    ...(initiatorName ? { initiatorName } : {}),
+                    targetAnchor: accountAnchor(platform, targetTenant, nativeId),
+                    ttlMinutes: TTL_MINUTES,
+                }),
+                // The two TAP shortcuts (OPE-622). A surface with no component plane ignores them and the
+                // ask delivers as text alone — which is why the copy above still tells the person to answer
+                // in words and never mentions a button. The labels are core-owned and carry no
+                // interpolation, so nothing attacker-chosen can reach one.
+                actions: linkConsentActions(issued.challenge.id),
+            });
+        }
+        catch (err) {
+            // The ask never landed, so nothing can consent to it — and the row would sit pending until its
+            // TTL. Tell the initiator plainly rather than leaving them waiting on a DM nobody got. The row
+            // is left to expire on its own: a challenge that writes nothing costs nothing, and deleting it
+            // here would be a second write path over a table with exactly one writer.
+            console.log(`[open-everywhere:identity] link request ${issued.challenge.id}: the consent ask could not be delivered: ${String(err)}`);
+            throw new Error(`I could not DM that ${platform} account, so nobody can consent to the request — it will expire on its own and nothing was linked. ` +
+                `Try the code flow instead: call link_identity with no arguments.`);
+        }
+        return {
+            decided: "awaiting_consent",
+            challengeId: issued.challenge.id,
+            expiresAt: issued.challenge.expiresAt,
+            target: fenced(targetName),
+            // 🔴 `instructions` is UNFENCED and `target` is fenced, the same split every other notice in this flow uses. `instructions` is copy the model is told to RELAY VERBATIM into a chat message a human reads, and a fence's XML-ish markup pasted there would be confusing bytes.
+            // The name inside it is already sanitized, which is what a plain-text human sink needs. `target` is the structured field a MODEL reads, and that one carries the fence.
+            instructions: linkConsentPendingInstructions(targetName, TTL_MINUTES),
+        };
+    },
+});
+/**
+ * The UNSPOOFABLE half of naming an account in the consent ask: its principal key, or platform-named prose when the workspace cannot be composed.
+ * Every part comes from what this deployment's own mapper captured, never from a profile, so it is the one line in an unsolicited DM a reader can trust.
+ */
+function accountAnchor(platform, tenant, nativeId) {
+    return tryPrincipalKey(platform, tenant, nativeId) ?? `the ${platform} account "${nativeId}"`;
+}
+/** The account's own self-set name, already SANITIZED by the display-name registry, or undefined when
+ *  none resolves. Deliberately NOT `humanAccountLabel`: that composes the name and the id into one
+ *  string, and the consent ask needs them apart so the copy can attribute the name as a claim. */
+function profileName(profile) {
+    if (!profile)
+        return undefined;
+    if (profile.name && profile.handle && profile.name !== profile.handle)
+        return `${profile.name} (@${profile.handle})`;
+    return profile.name ?? (profile.handle ? `@${profile.handle}` : undefined);
+}
+/** WHY this platform cannot run the directory transport, or undefined when it can. Both halves are
+ *  required and neither is substitutable: without a directory there is no account to name, and
+ *  without a DM arm there is nowhere private for that account to be asked. */
+function directoryShortfall(platform) {
+    if (!hasAccountDirectory(platform)) {
+        const have = accountDirectoryPlatforms();
+        return `I have no user directory for it${have.length ? ` (I do for: ${have.join(", ")})` : ""}`;
+    }
+    if (!canDeliverDirectMessage(platform))
+        return "I have no way to DM an account there, so nobody could consent privately";
+    return undefined;
+}
+/** The CODE transport's issue step. */
+async function issueCodeChallenge(input) {
+    const issued = await issueLinkChallenge({
+        org: input.org,
+        platform: input.platform,
+        // OPE-309 phase 2: the initiating DM's own workspace, recorded on the challenge so the finalize
+        // days later joins the account this turn actually named — `binding.workspace`, the same fact
+        // every surface key already carries, never tool input.
+        ...(input.tenant ? { tenant: input.tenant } : {}),
+        nativeId: input.nativeId,
+        surfaceKey: input.surfaceKey,
+    });
+    // `code` is present by construction on the code transport (link-store.ts mints one there and only
+    // there); the guard states that rather than asserting it, so a future transport that forgets to
+    // mint gets a readable failure instead of "undefined" printed into somebody's DM.
+    if (!issued.code)
+        throw new Error("internal: the code transport issued no code.");
+    const privateInstructions = (input.why ? `${input.why} Use the code instead.\n\n` : "") + linkClaimInstructions(issued.code, TTL_MINUTES);
+    try {
+        // Host-owned delivery to the exact verified DM that invoked the tool. This bypasses the model's
+        // tool result and the reply/session-tail recorder; provider history may still return the post,
+        // which is why the shared machine-message projections redact link codes as a second guard.
+        await postSurfaceTextStrict(input.platform, { channelId: input.channelId, text: privateInstructions });
+    }
+    catch (err) {
+        // The transport error is token-free by postSurfaceTextStrict's contract. Never include the
+        // instructions or code here. The pending digest expires after ten minutes. We cannot cancel on
+        // an ambiguous throw: the post may have landed, and invalidating it would show a human a dead
+        // code. On a definitive failure nobody received the raw value, so the undisclosed row is not a
+        // usable orphan.
+        console.log(`[open-everywhere:identity] link request ${issued.challenge.id}: private-code delivery outcome is unknown: ${String(err)}`);
+        throw new Error("I could not confirm whether the private link code was posted. Check this DM: if a code appeared, use that one; if none appeared, ask me to start again. Nothing was linked.");
+    }
+    return {
+        decided: "code",
+        challengeId: issued.challenge.id,
+        expiresAt: issued.challenge.expiresAt,
+        instructions: (input.why ? `${input.why} ` : "") +
+            "I posted the private single-use code and its instructions directly in this DM. The host delivery is already complete; do not repeat or quote the code.",
+    };
+}
+//# sourceMappingURL=link_identity.js.map

package/dist/agent/tools/link_identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link_identity.js","sourceRoot":"","sources":["../../../agent/tools/link_identity.ts"],"names":[],"mappings":"AAAA,qmBAAqmB;AACrmB,4iBAA4iB;AAE5iB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACrI,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACpJ,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,MAAM,CAAC,CAAC;AAE/D;;;GAGG;AACH,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,80BAA80B;IACh1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,sJAAsJ,CAAC;QACnK,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;QAC9I,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,6JAA6J,CAAC;KAC3K,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB;6DACqD;QACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC;gEACwD;QACxD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrF,oFAAoF;QACpF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,yEAAyE;QACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,mDAAmD,OAAO,CAAC,IAAI,wGAAwG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,qDAAqD,CAC7Q,CAAC;QACJ,CAAC;QACD,4FAA4F;QAC5F,kGAAkG;QAClG,wFAAwF;QACxF,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,gIAAgI,CAAC,CAAC;QACpJ,CAAC;QACD,mLAAmL;QACnL,8LAA8L;QAC9L,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,gGAAgG;QAChG,kGAAkG;QAClG,yFAAyF;QACzF,kGAAkG;QAClG,6FAA6F;QAC7F,yBAAyB;QACzB,6FAA6F;QAC7F,+FAA+F;QAC/F,iGAAiG;QACjG,gFAAgF;QAChF,iGAAiG;QACjG,gGAAgG;QAChG,4FAA4F;QAC5F,iGAAiG;QACjG,8FAA8F;QAC9F,iGAAiG;QACjG,2BAA2B;QAC3B,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7K,iGAAiG;QACjG,0BAA0B;QAC1B,MAAM,eAAe,GAAG,wBAAwB,CAAC;YAC/C,QAAQ,EAAE,QAAQ,KAAK,SAAS;YAChC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC/C,QAAQ,EAAE,QAAQ,EAAE,aAAa,KAAK,SAAS;SAChD,CAAC,CAAC;QACH,IAAI,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAEtG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QAExC,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAChF,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;YACpD,OAAO,MAAM,kBAAkB,CAAC;gBAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,SAAS;gBACzB,QAAQ,EAAE,KAAK;gBACf,UAAU;gBACV,SAAS,EAAE,CAAC,CAAC,OAAO;gBACpB,4FAA4F;gBAC5F,yFAAyF;gBACzF,mBAAmB;gBACnB,GAAG,EAAE,QAAQ,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,iBAAiB,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS;aACzG,CAAC,CAAC;QACL,CAAC;QAED,kPAAkP;QAClP,4KAA4K;QAC5K,MAAM,YAAY,GAAG,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3H,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,MAAM,kBAAkB,CAAC;gBAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,SAAS;gBACzB,QAAQ,EAAE,KAAK;gBACf,UAAU;gBACV,SAAS,EAAE,CAAC,CAAC,OAAO;gBACpB,GAAG,EAAE,sBAAsB,QAAQ,+DAA+D;aACnG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,KAAM,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,EAAE;oBACd,SAAS,EAAE,KAAK;oBAChB,YAAY,EACV,MAAM,QAAQ,+FAA+F;wBAC7G,4EAA4E;iBAC/E,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CACvJ,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,QAAQ;gBACjB,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EACV,qEAAqE,QAAQ,wCAAwC;oBACrH,4HAA4H;oBAC5H,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,wBAAwB,4DAA4D,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9H,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,YAAY,KAAK,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9H,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,SAAS;YACzB,QAAQ,EAAE,KAAK;YACf,UAAU;YACV,SAAS,EAAE,WAAW;YACtB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE;SACrD,CAAC,CAAC;QACH,kPAAkP;QAClP,8VAA8V;QAC9V,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClF,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,aAAa,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,QAAQ,EAAE;gBACpC,WAAW,EAAE,QAAQ;gBACrB,IAAI,EAAE,cAAc,CAAC;oBACnB,eAAe;oBACf,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,YAAY,EAAE,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;oBAC7D,UAAU,EAAE,WAAW;iBACxB,CAAC;gBACF,0FAA0F;gBAC1F,4FAA4F;gBAC5F,+EAA+E;gBAC/E,2DAA2D;gBAC3D,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+FAA+F;YAC/F,+FAA+F;YAC/F,+FAA+F;YAC/F,0EAA0E;YAC1E,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,CAAC,SAAS,CAAC,EAAE,6CAA6C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtI,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,qGAAqG;gBAClI,kEAAkE,CACrE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,kBAAkB;YAC3B,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC;YAC1B,+QAA+Q;YAC/Q,wKAAwK;YACxK,YAAY,EAAE,8BAA8B,CAAC,UAAU,EAAE,WAAW,CAAC;SACtE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,MAA0B,EAAE,QAAgB;IACnF,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,OAAO,QAAQ,aAAa,QAAQ,GAAG,CAAC;AAChG,CAAC;AAED;;kGAEkG;AAClG,SAAS,WAAW,CAAC,OAAyE;IAC5F,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,GAAG,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,MAAM,GAAG,CAAC;IACrH,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED;;8EAE8E;AAC9E,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACzC,OAAO,kCAAkC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,yEAAyE,CAAC;IACzH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uCAAuC;AACvC,KAAK,UAAU,kBAAkB,CAAC,KASjC;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gGAAgG;QAChG,6FAA6F;QAC7F,uDAAuD;QACvD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,kGAAkG;IAClG,gGAAgG;IAChG,kFAAkF;IAClF,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClF,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1I,IAAI,CAAC;QACH,gGAAgG;QAChG,+FAA+F;QAC/F,2FAA2F;QAC3F,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2FAA2F;QAC3F,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,CAAC,SAAS,CAAC,EAAE,+CAA+C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxI,MAAM,IAAI,KAAK,CACb,6KAA6K,CAC9K,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;QACrC,YAAY,EACV,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,wJAAwJ;KAC3J,CAAC;AACJ,CAAC"}

package/dist/agent/tools/list_recent_events.d.ts

@@ -0,0 +1,19 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    source: string;
+    filter?: string | undefined;
+}, {
+    ok: boolean;
+    events: string;
+    message: string;
+}> & {
+    execute(input: {
+        source: string;
+        filter?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        ok: boolean;
+        events: string;
+        message: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=list_recent_events.d.ts.map

package/dist/agent/tools/list_recent_events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list_recent_events.d.ts","sourceRoot":"","sources":["../../../agent/tools/list_recent_events.ts"],"names":[],"mappings":""}

package/dist/agent/tools/list_recent_events.js

@@ -0,0 +1,55 @@
+// list_recent_events answers "what does this webhook actually SEND?" from its own captured traffic, and "would this filter have matched it?" against the same rows. For a hook with no vendor schema the field names are knowable only from what actually arrived, so the schema is discovered empirically: arm a window, let real deliveries land, read them back NUMBERED, then pass a jq filter back to score it against every captured row.
+// ⭐ THE NEGATIVES ARE THE FEATURE: a filter that selects the rows someone pointed at is correct only if it also REJECTS the others, and both columns are on the page, so that is checkable rather than hoped for. 🔴 The output is an outside party's bytes and is fenced as such — this is the fattest injection surface in the product, because the attacker-controlled text and the thing the model was asked to reason about are the same object. No hook id, no URL and no secret: the model addresses a hook by its source handle.
+// The read is audited on both verdicts, and the principal is passed from here, because that row's stated purpose is answering who looked at what an outside party sent us.
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { ingestUntrustedModelOutput } from "../access/untrusted.js";
+import { principalIdOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { readCaptureWindow, renderCaptureWindow } from "../control/capture-window-read.js";
+export default defineTool({
+    description: "Read the deliveries a webhook has actually sent, numbered, so a subscription filter can be written against real traffic instead of guesswork. Use when someone wants a routine to fire on some-but-not-all events from a webhook, when you don't know what fields a sender puts in its payload, or to CHECK a filter you just wrote. Requires a capture window to have been armed first with capture_events. Pass `filter` with a candidate jq expression to see exactly which captured deliveries it would have matched and which it would have missed.",
+    inputSchema: z.object({
+        source: z.string().min(1).describe("The webhook's source handle, e.g. 'deploy-status' (from list_webhooks)."),
+        filter: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Optional candidate jq predicate to score against every captured delivery, e.g. '.event == \"build\" and .fields.status == \"failed\"'. Nothing is saved; this is a dry run. Use create_routine to store one."),
+    }),
+    outputSchema: z.object({
+        ok: z.boolean(),
+        /** Host-composed scaffold around payload-derived content — fenced whole. Empty when `ok` is false. */
+        events: z.string(),
+        /** The refusal sentence when `ok` is false (unknown hook, not readable, or nothing captured). */
+        message: z.string(),
+    }),
+    async execute(input, ctx) {
+        const partition = resolvePartition(ctx);
+        const principalId = principalIdOf(ctx);
+        const result = await readCaptureWindow({
+            partition,
+            source: input.source,
+            ...(principalId !== undefined ? { principalId } : {}),
+            ...(input.filter !== undefined ? { candidate: input.filter } : {}),
+        });
+        if (!result.ok)
+            return { ok: false, events: "", message: result.message };
+        return { ok: true, events: renderCaptureWindow(result.view), message: "" };
+    },
+    toModelOutput(output) {
+        // A REFUSAL IS HOST-COMPOSED AND STAYS OUTSIDE THE FENCE — it carries no off-host string (the
+        // handle it echoes came from our own store, the grant rendering is describeReadableBy's), and
+        // wrapping OE's own diagnosis as untrusted data would teach the model to discount the one
+        // sentence it must act on. Identical reasoning to read_webhook_history.
+        if (!output.ok)
+            return { type: "text", value: output.message };
+        // Declare the source: these are captured WEBHOOK deliveries replayed out of the capture window, so the kind is the same one the live dispatch path declares — a delivery does not become less third-party-authored for having been stored first.
+        // The in-turn read agrees with the table's untrusted webhook row, so the declaration is coverage rather than a log entry.
+        return ingestUntrustedModelOutput(output.events, {
+            source: "captured webhook deliveries",
+            ingestion: { kind: "webhook", label: "list_recent_events" },
+        });
+    },
+});
+//# sourceMappingURL=list_recent_events.js.map

package/dist/agent/tools/list_recent_events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list_recent_events.js","sourceRoot":"","sources":["../../../agent/tools/list_recent_events.ts"],"names":[],"mappings":"AAAA,gbAAgb;AAChb,ygBAAygB;AAEzgB,2KAA2K;AAE3K,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE3F,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,0hBAA0hB;IAC5hB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yEAAyE,CAAC;QAC7G,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,8MAA8M,CAC/M;KACJ,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;QACf,sGAAsG;QACtG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,iGAAiG;QACjG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,aAAa,CAAC,MAAM;QAClB,8FAA8F;QAC9F,8FAA8F;QAC9F,0FAA0F;QAC1F,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACxE,iPAAiP;QACjP,0HAA0H;QAC1H,OAAO,0BAA0B,CAAC,MAAM,CAAC,MAAM,EAAE;YAC/C,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/list_repos.d.ts

@@ -0,0 +1,11 @@
+declare const _default: import("eve/tools").ToolDefinition<Record<string, never>, {
+    repos: string[];
+    sourceControlConfigured: boolean;
+}> & {
+    execute(input: Record<string, never>, ctx: import("eve/tools").ToolContext): Promise<{
+        repos: string[];
+        sourceControlConfigured: boolean;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=list_repos.d.ts.map