@remnic/core 9.15.0 → 9.15.1

package/src/access-namespace-preflight.ts

@@ -0,0 +1,111 @@
+import { getOperation } from "./access-boundary.js";
+import { capabilityAllowsOp, isNamespaceAllowed, type TokenCapabilities } from "./access-token-capabilities.js";
+import { EngramAccessForbiddenError, EngramAccessInputError, NamespaceNotWritableError } from "./access-errors.js";
+import type { WritableNamespaceResult } from "./scopes/scope-plan.js";
+
+export interface EngramAccessNamespaceWritableRequest {
+  namespace?: string;
+  sessionKey?: string;
+  authenticatedPrincipal?: string;
+  cwd?: string;
+  projectTag?: string;
+}
+
+export function namespaceWritableRequest(
+  params: URLSearchParams,
+  authenticatedPrincipal?: string,
+): EngramAccessNamespaceWritableRequest {
+  const namespace = params.get("namespace") || undefined;
+  return {
+    namespace,
+    sessionKey: params.get("session") || undefined,
+    authenticatedPrincipal,
+    cwd: params.get("cwd") || undefined,
+    projectTag: params.get("projectTag") || undefined,
+  };
+}
+
+export function parseNamespacePreflightWriteOp(
+  value: string | undefined,
+): "observe" | "memory_store" {
+  if (value === undefined || value === "observe") return "observe";
+  if (value === "memory_store") return "memory_store";
+  throw new EngramAccessInputError(`unsupported namespace preflight operation: ${value}`);
+}
+
+export function assertNamespacePreflightPermitted(
+  caps: TokenCapabilities | undefined | null,
+): void {
+  const allowedOps = getOperation("namespace_writable")?.spec.allowedByOps ?? [];
+  if (!allowedOps.some((op) => capabilityAllowsOp(caps, op))) {
+    throw new EngramAccessForbiddenError("token is not permitted to run the namespace preflight");
+  }
+}
+
+export type NamespaceWritableResolver = (
+  request: EngramAccessNamespaceWritableRequest,
+) => Promise<string>;
+export type NamespaceWritablePreflightResolver = (
+  request: EngramAccessNamespaceWritableRequest,
+) => Promise<WritableNamespaceResult>;
+
+export async function resolveNamespaceWritablePreflight(
+  request: EngramAccessNamespaceWritableRequest,
+  resolveWritable: NamespaceWritableResolver,
+): Promise<WritableNamespaceResult> {
+  try {
+    return { ok: true, namespace: await resolveWritable(request) };
+  } catch (error) {
+    if (error instanceof NamespaceNotWritableError) {
+      return { ok: false, reason: "not_writable", namespace: error.attemptedNamespace };
+    }
+    if (error instanceof EngramAccessInputError) {
+      return {
+        ok: false,
+        reason: "unsupported",
+        namespace: request.namespace?.trim() ?? "",
+      };
+    }
+    throw error;
+  }
+}
+
+export async function resolveAuthorizedNamespaceWritablePreflight(
+  caps: TokenCapabilities | undefined | null,
+  request: EngramAccessNamespaceWritableRequest,
+  defaultNamespace: string,
+  writeOp: "observe" | "memory_store",
+  resolvePreflight: NamespaceWritablePreflightResolver,
+): Promise<WritableNamespaceResult> {
+  if (!capabilityAllowsOp(caps, writeOp)) {
+    return {
+      ok: false,
+      reason: "not_writable",
+      namespace: request.namespace?.trim() || defaultNamespace,
+    };
+  }
+
+  const result = await resolvePreflight(request);
+  if (!isNamespaceAllowed(caps, result.namespace, defaultNamespace)) {
+
+    return { ok: false, reason: "not_writable", namespace: result.namespace };
+  }
+  return result;
+}
+
+export function resolveQueryNamespaceWritablePreflight(
+  caps: TokenCapabilities | undefined | null,
+  params: URLSearchParams,
+  authenticatedPrincipal: string | undefined,
+  defaultNamespace: string,
+  resolvePreflight: NamespaceWritablePreflightResolver,
+): Promise<WritableNamespaceResult> {
+  assertNamespacePreflightPermitted(caps);
+  return resolveAuthorizedNamespaceWritablePreflight(
+    caps,
+    namespaceWritableRequest(params, authenticatedPrincipal),
+    defaultNamespace,
+    parseNamespacePreflightWriteOp(params.get("op") ?? undefined),
+    resolvePreflight,
+  );
+}

package/src/access-operations-batch.ts

@@ -18,7 +18,11 @@ import { EngramAccessForbiddenError } from "./access-errors.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import { enforceNamespaceAllowList, tokenCapabilityStore } from "./access-token-capabilities.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
-import { resolveNamespacePreflight } from "./scopes/scope-plan.js";
+import {
+  parseNamespacePreflightWriteOp,
+  resolveAuthorizedNamespaceWritablePreflight,
+  type EngramAccessNamespaceWritableRequest,
+} from "./access-namespace-preflight.js";
 import { expandTildePath } from "./utils/path.js";
 import { resolvePrincipal } from "./namespaces/principal.js";
 import { getRecallTimingStatus, isRecallTimingsOperator } from "./recall-timings.js";
@@ -114,7 +118,26 @@ defineOperation({ name: "recall_xray", description: "X-ray recall.", schema: str
     return { result: await ctx.service.recallXray({ query: defStr(input.query, ""), sessionKey: optStr(input.sessionKey), namespace: optStr(input.namespace), budget, authenticatedPrincipal: ctx.authenticatedPrincipal, ...(dr && dr !== "" ? { disclosure: dr as RecallDisclosure } : {}), ...(ctx.abortSignal ? { abortSignal: ctx.abortSignal } : {}) }) };
   },
 });
-defineOperation({ name: "namespace_writable", description: "Read-only preflight: is a namespace writable for the caller's principal?", allowedByOps: ["namespace_writable", "observe", "memory_store"], schema: strictSchema({ namespace: S.str, sessionKey: S.str, op: S.str }), handler: async (input, ctx) => { const ns = optStr(input.namespace); const sk = optStr(input.sessionKey); const writeOp = optStr(input.op) === "memory_store" ? "memory_store" : "observe"; return { result: resolveNamespacePreflight(tokenCapabilityStore.getStore(), ns && ns.length > 0 ? ns : undefined, sk && sk.length > 0 ? sk : undefined, ctx.authenticatedPrincipal, ctx.service.configRef, writeOp) }; } });
+defineOperation({ name: "namespace_writable", description: "Read-only preflight: is a namespace writable for the caller's principal?", allowedByOps: ["namespace_writable", "observe", "memory_store"], schema: strictSchema({ namespace: S.str, sessionKey: S.str, op: S.str, cwd: S.str, projectTag: S.str }), handler: async (input, ctx) => {
+  const writeOp = parseNamespacePreflightWriteOp(optStr(input.op));
+  const namespace = optStr(input.namespace);
+  const request: EngramAccessNamespaceWritableRequest = {
+    sessionKey: optStr(input.sessionKey),
+    authenticatedPrincipal: ctx.authenticatedPrincipal,
+    cwd: optStr(input.cwd),
+    projectTag: optStr(input.projectTag),
+    ...(namespace ? { namespace } : {}),
+  };
+  return {
+    result: await resolveAuthorizedNamespaceWritablePreflight(
+      tokenCapabilityStore.getStore(),
+      request,
+      ctx.service.configRef.defaultNamespace,
+      writeOp,
+      (preflightRequest) => ctx.service.namespaceWritablePreflight(preflightRequest),
+    ),
+  };
+} });
 
 // === WEARABLES ===
 defineOperation({ name: "wearables_status", description: "Wearables status.", schema: strictSchema({}), handler: async (_i, ctx) => ({ result: await ctx.service.wearablesStatus() }) });

package/src/access-service-observe-scope.test.ts

@@ -33,6 +33,8 @@ import { join } from "node:path";
 import test from "node:test";
 
 import { EngramAccessService } from "./access-service.js";
+import { tokenCapabilityStore } from "./access-token-capabilities.js";
+import { resolveAuthorizedNamespaceWritablePreflight } from "./access-namespace-preflight.js";
 import { Orchestrator } from "./orchestrator.js";
 import type { StorageManager } from "./storage.js";
 import type { EngramAccessObserveRequest } from "./access-service.js";
@@ -604,6 +606,85 @@ test("#1505 (cursor hAp) scopeDebug.baseNamespace reports the principal self bas
   );
 });
 
+test("#2080 preflight resolves an implicit project scope through the observe write resolver", async () => {
+  const probe = makeObserveProbe({
+    ...withSelfPolicyPrefix("pi-geek"),
+    namespacePolicies: [
+      { name: "default", readPrincipals: ["admin"], writePrincipals: ["admin"] },
+      { name: "pi-geek", readPrincipals: ["pi-geek"], writePrincipals: ["pi-geek"] },
+    ],
+  });
+  const service = new EngramAccessService(probe.orch);
+  const expected = combineNamespaces(
+    "pi-geek",
+    projectNamespaceName(projectTagProjectId("Acme/Webshop")),
+  );
+
+  const result = await (
+    service as unknown as {
+      namespaceWritablePreflight: (request: {
+        sessionKey: string;
+        authenticatedPrincipal: string;
+        projectTag: string;
+      }) => Promise<{ ok: boolean; namespace: string }>;
+    }
+  ).namespaceWritablePreflight({
+    sessionKey: "pi-geek:abc123",
+    authenticatedPrincipal: "pi-geek",
+    projectTag: "Acme/Webshop",
+  });
+
+  assert.deepEqual(result, { ok: true, namespace: expected });
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run({ version: 1, namespaces: ["default"] }, () =>
+        (
+          service as unknown as {
+            resolveCodingScopedWriteNamespace: (request: {
+              sessionKey: string;
+              authenticatedPrincipal: string;
+              projectTag: string;
+            }) => Promise<string>;
+          }
+        ).resolveCodingScopedWriteNamespace({
+          sessionKey: "pi-geek:abc123",
+          authenticatedPrincipal: "pi-geek",
+          projectTag: "Acme/Webshop",
+        }),
+      ),
+    /not permitted/,
+  );
+  const deniedPreflight = await tokenCapabilityStore.run(
+    { version: 1, ops: ["observe"], namespaces: ["default"] },
+    () =>
+      resolveAuthorizedNamespaceWritablePreflight(
+        tokenCapabilityStore.getStore(),
+        {
+          sessionKey: "pi-geek:abc123",
+          authenticatedPrincipal: "pi-geek",
+          projectTag: "Acme/Webshop",
+        },
+        "default",
+        "observe",
+        (request) => service.namespaceWritablePreflight(request),
+      ),
+  );
+  assert.deepEqual(deniedPreflight, { ok: false, reason: "not_writable", namespace: expected });
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run({ version: 1, namespaces: ["default"] }, () =>
+        service.observe(
+          observeRequest({
+            sessionKey: "pi-geek:abc123",
+            authenticatedPrincipal: "pi-geek",
+            projectTag: "Acme/Webshop",
+          }),
+        ),
+      ),
+    /not permitted/,
+  );
+});
+
 test("#1495 the scope plan's writeNamespace matches resolveCodingScopedWriteNamespace (memory_store / suggestion_submit parity, rule 39)", async () => {
   // Regression guard: observe's effective scope MUST be identical to what the
   // explicit-write tools (memory_store / suggestion_submit) resolve via

package/src/access-service.ts

@@ -6,6 +6,7 @@ import { readdirSync, unlinkSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { ZodError } from "zod";
 import { AccessIdempotencyStore, hashAccessIdempotencyPayload } from "./access-idempotency.js";
+import { enforceNamespaceAllowList, tokenCapabilityStore } from "./access-token-capabilities.js";
 import {
   recordCitationUsage as recordCitationUsageForAccess,
   type CitationUsageRequest,
@@ -130,8 +131,11 @@ import {
 import {
   type ScopePlan,
   resolveScopePlan,
+  resolveScopedWritableNamespaceValue,
   resolveWritableNamespaceValue,
+  type WritableNamespaceResult,
 } from "./scopes/scope-plan.js";
+import { resolveNamespaceWritablePreflight, type EngramAccessNamespaceWritableRequest } from "./access-namespace-preflight.js";
 import { namespaceIdentityFromToken } from "./namespaces/identity.js";
 import { namespaceCollectionName } from "./namespaces/search.js";
 import { SecureStoreLockedError } from "./secure-store/index.js";
@@ -958,7 +962,7 @@ export interface CodingScopedWriteInput {
   cwd?: string;
   projectTag?: string;
 }
-
+export type { EngramAccessNamespaceWritableRequest } from "./access-namespace-preflight.js";
 /**
  * Internal, single-resolution plan describing the effective memory scope for a
  * write-producing access request (#1495, seed for epic #1494). One plan is
@@ -1588,6 +1592,14 @@ export class EngramAccessService {
     return { principal, codingContext, overlay, profilePlan };
   }
 
+  private assertTokenCanWriteNamespace(namespace: string): void {
+    enforceNamespaceAllowList(
+      tokenCapabilityStore.getStore(),
+      namespace,
+      this.orchestrator.config.defaultNamespace,
+    );
+  }
+
   /**
    * Resolve the write namespace for explicit-write tools (memory_store /
    * suggestion_submit), project-scoping the write the same way recall does so a
@@ -1603,49 +1615,56 @@ export class EngramAccessService {
       sessionKey?: string;
       authenticatedPrincipal?: string;
     },
+    enforceToken: boolean = true,
   ): Promise<string> {
-    const hasExplicitNamespace =
-      typeof request.namespace === "string" && request.namespace.trim().length > 0;
-    if (hasExplicitNamespace) {
-      return this.writableNamespaceFor(
-        request.namespace,
+    const requested = request.namespace?.trim();
+    if (requested) {
+      const namespace = this.writableNamespaceFor(
+        requested,
         request.sessionKey,
         request.authenticatedPrincipal,
       );
+      if (enforceToken) this.assertTokenCanWriteNamespace(namespace);
+      return namespace;
     }
+
     const { principal, overlay, profilePlan } = await this.resolveCodingScopeInputs(request);
-    if (profilePlan) {
-      const selectedLayer = profilePlan.layers.find((layer) => layer.id === profilePlan.writeLayer);
-      const writeNamespaceReadable =
-        profilePlan.writeNamespace.length > 0 &&
-        profilePlan.readNamespaces.includes(profilePlan.writeNamespace);
-      if (!selectedLayer?.writable || !writeNamespaceReadable) {
-        throw new NamespaceNotWritableError(profilePlan.writeNamespace, principal,
-          `scope profile ${profilePlan.profileId} has no writable layer for principal ${principal ?? "anonymous"}`);
-      }
-      return profilePlan.writeNamespace;
+    const result = resolveScopedWritableNamespaceValue({
+      sessionKey: request.sessionKey,
+      authenticatedPrincipal: request.authenticatedPrincipal,
+      principal,
+      codingOverlay: overlay,
+      scopeProfile: profilePlan,
+      config: this.orchestrator.config,
+    });
+    if (result.ok) {
+      if (enforceToken) this.assertTokenCanWriteNamespace(result.namespace);
+      return result.namespace;
     }
-    if (!overlay) {
-      // No coding overlay → unqualified write stays on config.defaultNamespace,
-      // exactly the pre-#1434 behavior (auth-checked, like the legacy path).
-      return this.writableNamespaceFor(
-        undefined,
-        request.sessionKey,
-        request.authenticatedPrincipal,
+    if (profilePlan && result.namespace === profilePlan.writeNamespace) {
+      throw new NamespaceNotWritableError(
+        result.namespace,
+        principal,
+        `scope profile ${profilePlan.profileId} has no writable layer for principal ${principal ?? "anonymous"}`,
       );
     }
-    // Coding overlay → overlay onto the principal self base, the SAME namespace
-    // recall/observe/buffer-flush use. The result is a principal-owned
-    // `project-*` sub-namespace derived from this authorized base, so it needs
-    // no separate write policy.
-    const base = defaultNamespaceForPrincipal(principal, this.orchestrator.config);
-    if (!canWriteNamespace(principal, base, this.orchestrator.config)) {
-      throw new NamespaceNotWritableError(base, principal);
+
+    if (result.reason === "unsupported") {
+      throw new EngramAccessInputError(`unsupported namespace: ${result.namespace}`);
     }
-    return combineNamespaces(base, overlay.namespace);
+    throw new NamespaceNotWritableError(result.namespace, principal);
+  }
+
+  async namespaceWritablePreflight(
+    request: EngramAccessNamespaceWritableRequest,
+  ): Promise<WritableNamespaceResult> {
+    return resolveNamespaceWritablePreflight(
+      request,
+      (preflightRequest) => this.resolveCodingScopedWriteNamespace(preflightRequest, false),
+    );
   }
 
-  /** Read-side mirror of {@link resolveCodingScopedWriteNamespace}. Decision
+  /**
    *  `list`/`get` use this so a record written by a project-scoped session is
    *  listable/fetchable by the SAME session without manually supplying the
    *  overlaid namespace (review P2). Derivation is IDENTICAL to the write path
@@ -1748,6 +1767,7 @@ export class EngramAccessService {
         request.sessionKey,
         request.authenticatedPrincipal,
       );
+      this.assertTokenCanWriteNamespace(writeNamespace);
       return {
         principal,
         explicitNamespace: request.namespace!.trim(),
@@ -1825,6 +1845,15 @@ export class EngramAccessService {
         this.orchestrator.setCodingContextForSession(request.sessionKey!, null);
       }
     };
+    const assertWriteNamespaceAllowed = (namespace: string): void => {
+      try {
+        this.assertTokenCanWriteNamespace(namespace);
+      } catch (error) {
+        clearSeededContext();
+        throw error;
+      }
+    };
+
 
     const overlaidBase = this.orchestrator.applyCodingNamespaceOverlay(
       request.sessionKey,
@@ -1876,6 +1905,7 @@ export class EngramAccessService {
               readNamespaces.includes(layer.namespace),
           ),
       );
+      assertWriteNamespaceAllowed(profilePlan.writeNamespace);
       return {
         principal,
         baseNamespace: profilePlan.baseNamespace,
@@ -1928,6 +1958,7 @@ export class EngramAccessService {
         clearSeededContext();
         throw new NamespaceNotWritableError(baseNamespace, principal);
       }
+      assertWriteNamespaceAllowed(writeNamespace);
       return {
         principal,
         // scopeDebug.baseNamespace must report the principal SELF base
@@ -1965,6 +1996,7 @@ export class EngramAccessService {
       const ns = combineNamespaces(baseNamespace, fallback);
       if (!readNamespaces.includes(ns)) readNamespaces.push(ns);
     }
+    assertWriteNamespaceAllowed(writeNamespace);
     return {
       principal,
       baseNamespace,

package/src/scopes/scope-plan.ts

@@ -489,6 +489,72 @@ export function resolveWritableNamespaceValue(
   return { ok: true, namespace: resolved };
 }
 
+/**
+ * Inputs already derived by the access-service's read-only coding-context
+ * resolver. Keeping context discovery outside this pure function lets writes
+ * and preflight checks apply identical namespace and ACL rules.
+ */
+export interface ScopedWritableNamespaceInput {
+  readonly namespace?: string;
+  readonly sessionKey?: string;
+  readonly authenticatedPrincipal?: string;
+  readonly principal: string | undefined;
+  readonly codingOverlay: CodingNamespaceOverlay | null;
+  readonly scopeProfile: ResolvedScopeProfilePlan | null;
+  readonly config: PluginConfig;
+}
+
+/**
+ * Resolve the namespace an explicit write or implicit coding-scoped write
+ * would use. The caller supplies the same derived coding inputs for the real
+ * write and the read-only preflight.
+ */
+export function resolveScopedWritableNamespaceValue(
+  input: ScopedWritableNamespaceInput,
+): WritableNamespaceResult {
+  const requested = input.namespace?.trim();
+  if (requested) {
+    return resolveWritableNamespaceValue(
+      requested,
+      input.sessionKey,
+      input.authenticatedPrincipal,
+      input.config,
+    );
+  }
+  if (input.scopeProfile) {
+    const selectedLayer = input.scopeProfile.layers.find(
+      (layer) => layer.id === input.scopeProfile?.writeLayer,
+    );
+    const writeNamespaceReadable =
+      input.scopeProfile.writeNamespace.length > 0 &&
+      input.scopeProfile.readNamespaces.includes(input.scopeProfile.writeNamespace);
+    if (!selectedLayer?.writable || !writeNamespaceReadable) {
+      return {
+        ok: false,
+        reason: "not_writable",
+        namespace: input.scopeProfile.writeNamespace,
+      };
+    }
+    return { ok: true, namespace: input.scopeProfile.writeNamespace };
+  }
+  if (!input.codingOverlay) {
+    return resolveWritableNamespaceValue(
+      undefined,
+      input.sessionKey,
+      input.authenticatedPrincipal,
+      input.config,
+    );
+  }
+  const baseNamespace = defaultNamespaceForPrincipal(input.principal, input.config);
+  if (!canWriteNamespace(input.principal, baseNamespace, input.config)) {
+    return { ok: false, reason: "not_writable", namespace: baseNamespace };
+  }
+  return {
+    ok: true,
+    namespace: combineNamespaces(baseNamespace, input.codingOverlay.namespace),
+  };
+}
+
 /**
  * Namespace preflight (issue #1888 part 3): would a write to `namespace` by a
  * caller carrying `caps` succeed? Combines the token's write-op scope, its