@remnic/core 9.21.0 → 9.22.1

package/src/wearables/mcp-tools.ts

@@ -0,0 +1,143 @@
+/**
+ * Wearables MCP tool definitions (issue #1900 / #2123) — the five
+ * `engram.wearables_*` / `engram.transcript_*` tool-def objects, extracted from
+ * access-mcp.ts so the surface file stays under its structural ceiling. Spread
+ * back into `this.tools` (`...WEARABLES_MCP_TOOLS`); tools/list is verified at
+ * runtime. MCP_MIGRATED_OPERATIONS + callTool dispatch stay inline in
+ * access-mcp.ts. Each schema carries `namespace` + `sessionKey` so the MCP
+ * scope-override injects the caller namespace (caller-derived symmetry, #2123).
+ */
+
+import type { McpTool } from "../access-mcp.js";
+
+export const WEARABLES_MCP_TOOLS: McpTool[] = [
+      {
+        name: "engram.wearables_status",
+        description:
+          "Status of wearable transcript sources (Limitless / Bee / Omi): configured sources, connector availability, last sync, stored transcript days.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            namespace: { type: "string", description: "Caller namespace to scope this operation to (issue #2123)." },
+            sessionKey: { type: "string", description: "Session key for principal/namespace resolution." },
+          },
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.wearables_sync",
+        description:
+          "Pull, clean, and store wearable transcripts for one source or all enabled sources; optionally creates trust-gated memories per the source's memoryMode.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            namespace: { type: "string", description: "Caller namespace to scope this operation to (issue #2123)." },
+            sessionKey: { type: "string", description: "Session key for principal/namespace resolution." },
+            source: {
+              type: "string",
+              description: "Source id (e.g. limitless, bee, omi). Omit to sync every enabled source.",
+            },
+            date: {
+              type: "string",
+              description: "Sync exactly this day (YYYY-MM-DD). Overrides days.",
+            },
+            days: {
+              type: "integer",
+              minimum: 1,
+              maximum: 90,
+              description: "Lookback window in days ending today (default 2).",
+            },
+            forceMemories: {
+              type: "boolean",
+              description: "Re-run memory extraction even for unchanged days.",
+            },
+          },
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.transcript_day",
+        description:
+          "Return the full stored wearable transcript(s) for a day, across all sources or one source, with cross-source overlap hints.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            namespace: { type: "string", description: "Caller namespace to scope this operation to (issue #2123)." },
+            sessionKey: { type: "string", description: "Session key for principal/namespace resolution." },
+            date: {
+              type: "string",
+              description: "Day to read (YYYY-MM-DD). Required.",
+            },
+            source: {
+              type: "string",
+              description: "Optional source id to scope to (e.g. limitless).",
+            },
+          },
+          required: ["date"],
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.transcript_search",
+        description:
+          "Search stored wearable transcripts. Results carry source + date so callers can pull the full day via engram.transcript_day.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            namespace: { type: "string", description: "Caller namespace to scope this operation to (issue #2123)." },
+            sessionKey: { type: "string", description: "Session key for principal/namespace resolution." },
+            query: {
+              type: "string",
+              description: "Search query. Required; non-empty.",
+            },
+            source: {
+              type: "string",
+              description: "Optional source id filter.",
+            },
+            from: {
+              type: "string",
+              description: "Optional inclusive start date (YYYY-MM-DD).",
+            },
+            to: {
+              type: "string",
+              description: "Optional inclusive end date (YYYY-MM-DD).",
+            },
+            limit: {
+              type: "integer",
+              minimum: 1,
+              maximum: 50,
+              description: "Maximum results (default 10).",
+            },
+          },
+          required: ["query"],
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.transcript_memories",
+        description:
+          "List memories created from wearable transcripts, filterable by source and/or day. Includes pending_review candidates awaiting approval.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            namespace: { type: "string", description: "Caller namespace to scope this operation to (issue #2123)." },
+            sessionKey: { type: "string", description: "Session key for principal/namespace resolution." },
+            source: {
+              type: "string",
+              description: "Optional source id filter (e.g. limitless).",
+            },
+            date: {
+              type: "string",
+              description: "Optional transcript day filter (YYYY-MM-DD).",
+            },
+            limit: {
+              type: "integer",
+              minimum: 1,
+              maximum: 200,
+              description: "Maximum results (default 50).",
+            },
+          },
+          additionalProperties: false,
+        },
+      }
+];

package/src/wearables/registry.test.ts

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { afterEach, test } from "node:test";
 
 import {
+  builtInConnectorPackageSpecifier,
   clearWearableConnectors,
   ensureBuiltInWearableConnectors,
   getWearableConnector,
@@ -60,3 +61,13 @@ test("ensureBuiltInWearableConnectors tolerates absent optional packages", async
   await ensureBuiltInWearableConnectors();
   assert.ok(Array.isArray(listWearableConnectors()));
 });
+
+test("builtInConnectorPackageSpecifier maps a source to its real optional package (AC9 install hint)", () => {
+  // desktop ships in @remnic/capture-audio, NOT the nonexistent
+  // @remnic/connector-desktop — the missing-package hint must be installable.
+  assert.equal(builtInConnectorPackageSpecifier("desktop"), "@remnic/capture-audio");
+  assert.equal(builtInConnectorPackageSpecifier("limitless"), "@remnic/connector-limitless");
+  assert.equal(builtInConnectorPackageSpecifier("bee"), "@remnic/connector-bee");
+  // An unknown id keeps the connector-<id> convention.
+  assert.equal(builtInConnectorPackageSpecifier("acme"), "@remnic/connector-acme");
+});

package/src/wearables/registry.ts

@@ -86,8 +86,21 @@ const BUILT_IN_CONNECTOR_PACKAGES: Array<{ id: string; suffix: string }> = [
   { id: "omi", suffix: "connector-omi" },
   { id: "fireflies", suffix: "connector-fireflies" },
   { id: "granola", suffix: "connector-granola" },
+  { id: "desktop", suffix: "capture-audio" },
 ];
 
+/**
+ * npm specifier of the optional package that provides a source's connector.
+ * Built-in sources map to their real package (e.g. `desktop` ->
+ * `@remnic/capture-audio`, not the nonexistent `@remnic/connector-desktop`);
+ * unknown ids fall back to the `connector-<id>` convention. Used by
+ * missing-connector install hints so they name the exact install command.
+ */
+export function builtInConnectorPackageSpecifier(id: string): string {
+  const entry = BUILT_IN_CONNECTOR_PACKAGES.find((e) => e.id === id);
+  return `@remnic/${entry ? entry.suffix : `connector-${id}`}`;
+}
+
 const loadFailuresWarned = new Set<string>();
 
 export async function ensureBuiltInWearableConnectors(): Promise<void> {

package/src/wearables/service.test.ts

@@ -31,7 +31,15 @@ import {
 } from "./service.js";
 import { sealedWriteToLegacyArgs } from "../write-envelope.js";
 import { defaultWearablesConfig, defaultWearableSourceSettings } from "./config.js";
-import type { WearableConversation, WearablesConfig } from "./types.js";
+import {
+  clearWearableConnectors,
+  registerWearableConnector,
+} from "./registry.js";
+import type {
+  WearableConversation,
+  WearableSourceConnector,
+  WearablesConfig,
+} from "./types.js";
 
 function makeStorage(memoryDir: string): WearableStorageIo & {
   files: Map<string, string>;
@@ -1621,3 +1629,56 @@ test("searchTranscripts scan decodes segment text so snippets show the original
     rmSync(dir, { recursive: true, force: true });
   }
 });
+
+function syncOnlyConnector(): WearableSourceConnector {
+  return {
+    id: "testsource",
+    displayName: "Test Source",
+    async verifyAuth() {
+      return { ok: true };
+    },
+    async fetchConversations() {
+      return { conversations: [], nextCursor: null };
+    },
+  };
+}
+
+test("sync fires onDaysSynced with the synced days so a MANUAL wearables sync triggers the meeting tail-step (issue #1900)", async () => {
+  const dir = mkdtempSync(path.join(tmpdir(), "wearables-on-days-synced-"));
+  try {
+    clearWearableConnectors();
+    registerWearableConnector({
+      id: "testsource",
+      displayName: "Test Source",
+      factory: () => syncOnlyConnector(),
+    });
+    const storage = makeStorage(dir);
+    const synced: string[][] = [];
+    const service = new WearablesService({
+      config: {
+        ...defaultWearablesConfig(),
+        enabled: true,
+        timezone: "UTC",
+        sources: { testsource: { ...defaultWearableSourceSettings(), enabled: true } },
+      },
+      getStorage: async () => storage,
+      extract: null,
+      searchBackend: null,
+      // Stands in for the workspace-ops wiring that calls the meetings service's
+      // debounced requestBuild — the manual HTTP/MCP/CLI sync path reaches this
+      // same shared service, so the tail-step must fire here, not only in the
+      // auto-sync adapter.
+      onDaysSynced: (days) => {
+        synced.push([...days]);
+      },
+    });
+    const summaries = await service.sync({ source: "testsource", days: 1 });
+    const expected = [...new Set(summaries.flatMap((summary) => summary.days))].sort();
+    assert.ok(expected.length > 0, "the sync touched at least one day");
+    assert.equal(synced.length, 1, "the shared sync path fires the meeting tail-step exactly once");
+    assert.deepEqual([...synced[0]!].sort(), expected, "the hook receives the union of synced days");
+  } finally {
+    clearWearableConnectors();
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/wearables/service.ts

@@ -41,6 +41,7 @@ import {
   type WearableSyncOptions,
 } from "./pipeline.js";
 import {
+  builtInConnectorPackageSpecifier,
   ensureBuiltInWearableConnectors,
   getWearableConnector,
   listWearableConnectors,
@@ -132,6 +133,15 @@ export interface WearablesServiceDeps {
   searchBackend: WearableSearchBackend | null;
   /** Fired after transcript writes so the search index refreshes. */
   reindexSearch?: () => Promise<void>;
+  /**
+   * Meeting tail-step (issue #1900): fired once after a sync with the union of
+   * days it touched, so a dependent subsystem (meeting building) can rebuild the
+   * affected day(s). Wired for EVERY sync path — auto-sync AND manual
+   * HTTP/MCP/CLI backfill — because they all share this one service. Optional;
+   * omitted by hosts that do not build meetings. The hook self-gates and never
+   * fails the sync.
+   */
+  onDaysSynced?: (days: readonly string[]) => void | Promise<void>;
 }
 
 export interface WearableTranscriptSearchResult {
@@ -326,7 +336,7 @@ export class WearablesService {
       if (!registration) {
         throw new WearablesInputError(
           `wearable source '${sourceId}' is enabled but its connector package is not installed.\n` +
-            `Install it alongside Remnic:\n  npm install @remnic/connector-${sourceId}`,
+            `Install it alongside Remnic:\n  npm install ${builtInConnectorPackageSpecifier(sourceId)}`,
         );
       }
       const connector = registration.factory({
@@ -398,6 +408,24 @@ export class WearablesService {
       );
       summaries.push(summary);
     }
+    // Tail step (issue #1900): a wearable sync changed a day's audio, so fan out
+    // the affected days to the injected build hook (wired to the meetings
+    // service's debounced rebuild). Fires for every sync path — auto-sync and
+    // manual HTTP/MCP/CLI backfill alike — since they all share this service.
+    // The hook self-gates on meetings.enabled and coalesces; a failure here
+    // never fails the sync that called us.
+    const syncedDays = [...new Set(summaries.flatMap((summary) => summary.days))];
+    if (syncedDays.length > 0 && this.deps.onDaysSynced) {
+      try {
+        await this.deps.onDaysSynced(syncedDays);
+      } catch (err) {
+        log.warn(
+          `wearables: post-sync meeting build hook failed (non-fatal): ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      }
+    }
     return summaries;
   }
 
@@ -414,7 +442,7 @@ export class WearablesService {
     if (!registration) {
       return {
         ok: false,
-        detail: `connector package @remnic/connector-${sourceId} is not installed`,
+        detail: `connector package ${builtInConnectorPackageSpecifier(sourceId)} is not installed`,
       };
     }
     const connector = registration.factory({

package/src/wearables/transcript-search-namespace-isolation.test.ts

@@ -0,0 +1,98 @@
+/**
+ * Wearable transcript SEARCH namespace isolation (issue #2123, P1 gap).
+ *
+ * getWearablesService(namespace) reads transcript FILES from the caller's
+ * namespace storage, but the injected `searchBackend.search` used to call the
+ * ROOT qmd collection unconditionally. In a namespace-enabled deployment that
+ * let a non-default caller's transcript_search surface root/other-namespace
+ * transcripts — a data-isolation breach that the file-scoping alone did not
+ * close (the indexed path returns hits using the index snippet even when the
+ * caller-namespace file read is null).
+ *
+ * The fix scopes the indexed search to the CALLER namespace's collection. This
+ * two-principal test drives a fake collection-partitioned qmd backend:
+ *   1. principal A (non-default nsA) sees ONLY nsA's transcript;
+ *   2. principal B (non-default nsB) sees ONLY nsB's transcript — a transcript
+ *      that exists only under the default/root namespace is NOT returned to B;
+ *   3. the default/machine-owner caller still sees the default transcript.
+ *
+ * Before the fix every caller searched the root collection (collection
+ * undefined), so B received the default transcript and this fails.
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { namespaceCollectionName } from "../namespaces/search.js";
+import type { SearchBackend, SearchResult } from "../search/port.js";
+import { buildMeetingsNamespaceHarness } from "../testing/subjects/meetings-namespace-harness.js";
+
+const SOURCE = "faketest";
+const DATE_A = "2026-04-01";
+const DATE_B = "2026-04-02";
+const DATE_DEFAULT = "2026-04-03";
+
+const transcriptFile = (body: string): string =>
+  `---\nkind: wearable-transcript\n---\n\n${body}\n`;
+
+const dates = (results: ReadonlyArray<{ date: string }>): string[] =>
+  results.map((r) => r.date).sort();
+
+test("transcript search is scoped to the caller namespace: A sees only A, B never sees the default transcript, the default caller still sees default (#2123)", async () => {
+  const h = await buildMeetingsNamespaceHarness();
+  try {
+    // Physical transcripts under each namespace root.
+    await (await h.storageForNs("nsA")).writeWearableDayTranscript(SOURCE, DATE_A, transcriptFile("alpha standup notes"));
+    await (await h.storageForNs("nsB")).writeWearableDayTranscript(SOURCE, DATE_B, transcriptFile("bravo standup notes"));
+    await (await h.storageForNs("default")).writeWearableDayTranscript(SOURCE, DATE_DEFAULT, transcriptFile("delta standup notes"));
+
+    const base = h.orchestrator.config.qmdCollection;
+    const collFor = (ns: string, legacy: boolean): string =>
+      namespaceCollectionName(base, ns, { defaultNamespace: "default", useLegacyDefaultCollection: legacy });
+    const hit = (date: string, snippet: string): SearchResult =>
+      ({ path: `wearables/${SOURCE}/${date}.md`, score: 0.9, snippet } as unknown as SearchResult);
+
+    // Collection-partitioned index. The default hit is ALSO registered under
+    // the root key (collection === undefined) so a non-scoped (pre-fix) search
+    // returns the default transcript — that is exactly the breach under test.
+    const index: Record<string, SearchResult[]> = {
+      "\u0000root": [hit(DATE_DEFAULT, "delta standup notes")],
+      [base]: [hit(DATE_DEFAULT, "delta standup notes")],
+      [collFor("default", false)]: [hit(DATE_DEFAULT, "delta standup notes")],
+      [collFor("nsA", false)]: [hit(DATE_A, "alpha standup notes")],
+      [collFor("nsB", false)]: [hit(DATE_B, "bravo standup notes")],
+    };
+    const searchedCollections: Array<string | undefined> = [];
+    h.orchestrator.qmd = {
+      isAvailable: () => true,
+      search: async (_query: string, collection?: string, maxResults?: number) => {
+        searchedCollections.push(collection);
+        return (index[collection ?? "\u0000root"] ?? []).slice(0, maxResults);
+      },
+    } as unknown as SearchBackend;
+
+    const search = (namespace: string, authenticatedPrincipal: string) =>
+      h.service.wearablesTranscriptSearch({ query: "standup", namespace, authenticatedPrincipal });
+
+    const aRes = await search("nsA", "pA");
+    assert.deepEqual(dates(aRes), [DATE_A], "principal A sees only nsA's transcript");
+
+    const bRes = await search("nsB", "pB");
+    assert.deepEqual(dates(bRes), [DATE_B], "principal B sees only nsB's transcript");
+    assert.ok(
+      !bRes.some((r) => r.date === DATE_DEFAULT),
+      "the default/root transcript is NOT leaked to a non-default caller",
+    );
+
+    const dRes = await search("default", "op");
+    assert.deepEqual(dates(dRes), [DATE_DEFAULT], "the default/machine-owner caller still sees default transcripts");
+
+    // The indexed search was scoped per caller: no query ran against the root
+    // collection (undefined) — that is the pre-fix breach.
+    assert.ok(
+      !searchedCollections.includes(undefined),
+      "no transcript search targeted the unscoped root collection",
+    );
+  } finally {
+    await h.cleanup();
+  }
+});