@remnic/core 9.22.0 → 9.22.2

package/src/meetings/namespace-isolation.test.ts

@@ -0,0 +1,159 @@
+/**
+ * Caller-derived namespace-symmetry isolation tests (issue #2123).
+ *
+ * Two principals on distinct NON-default namespaces exercise the full
+ * wearablesSync -> meetingsBuild path against a real Orchestrator +
+ * EngramAccessService. Asserts (mirroring the extraction-run namespace-isolation
+ * pattern, keyed on storageForNs(ns).dir):
+ *   1. principal A's wearable source transcript, meeting record, and episode
+ *      memory physically land under A's namespace root;
+ *   2. principal B (a different non-default namespace) sees NONE of A's data;
+ *   3. a non-default caller receives NEITHER default-ns wearable days NOR the
+ *      machine-global activity store — a day with only default wearables + global
+ *      activity yields zero meetings for a non-default caller, while the
+ *      DEFAULT/machine-owner caller DOES consume both.
+ *
+ * These fail before the caller-derived namespace fix: with a single
+ * machine-default-pinned service, A's writes would land in the default root (not
+ * A's), B would observe them, and a non-default caller would fuse default
+ * wearables + global activity.
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { EngramAccessInputError } from "../access-service.js";
+
+import { MEETING_SOURCE_PREFIX } from "./memory-gen.js";
+import {
+  FAKE_WEARABLE_SOURCE,
+  buildMeetingsNamespaceHarness,
+} from "../testing/subjects/meetings-namespace-harness.js";
+
+const scope = (namespace: string, principal: string) => ({
+  namespace,
+  authenticatedPrincipal: principal,
+});
+
+function meetingMemoryCount(memories: ReadonlyArray<{ frontmatter: { tags?: readonly string[] } }>): number {
+  return memories.filter((m) => (m.frontmatter.tags ?? []).includes(MEETING_SOURCE_PREFIX)).length;
+}
+
+test("namespace isolation: principal A's wearable source, meeting record, and episode memory land under A's namespace root", async () => {
+  const h = await buildMeetingsNamespaceHarness();
+  const DATE = "2026-03-10";
+  try {
+    const sync = await h.service.wearablesSync({ date: DATE, ...scope("nsA", "pA") });
+    assert.equal(sync[0]?.transcriptsWritten.includes(DATE), true, "sync wrote a transcript for the day");
+
+    // The manual sync already flushed the debounced tail-step build (P2 fix;
+    // see manual-sync-flush.test.ts), so this explicit build is an idempotent
+    // rebuild: detection is stable (the audio meeting re-detects) and the
+    // unchanged record regenerates no duplicate episode. The record + episode
+    // that physically landed under nsA are asserted on storage below.
+    const build = await h.service.meetingsBuild(DATE, scope("nsA", "pA"));
+    assert.equal(build.enabled, true);
+    assert.equal(build.meetings.length, 1, "one audio-only meeting detected from A's wearables");
+    assert.equal(build.meetings[0]?.detectionSource, "audio");
+
+    const storageA = await h.storageForNs("nsA");
+    assert.notEqual(
+      await storageA.readWearableDayTranscript(FAKE_WEARABLE_SOURCE, DATE),
+      null,
+      "wearable source transcript physically under nsA root",
+    );
+    assert.deepEqual(
+      await storageA.meetingRecordStore().listMeetingDates(),
+      [DATE],
+      "meeting record physically under nsA root",
+    );
+    assert.equal(meetingMemoryCount(await storageA.readAllMemories()), 1, "episode memory under nsA root");
+  } finally {
+    await h.cleanup();
+  }
+});
+
+test("namespace isolation: principal B (a different non-default namespace) sees NONE of A's data", async () => {
+  const h = await buildMeetingsNamespaceHarness();
+  const DATE = "2026-03-10";
+  try {
+    await h.service.wearablesSync({ date: DATE, ...scope("nsA", "pA") });
+    await h.service.meetingsBuild(DATE, scope("nsA", "pA"));
+
+    const buildB = await h.service.meetingsBuild(DATE, scope("nsB", "pB"));
+    assert.equal(buildB.meetings.length, 0, "B builds zero meetings — A's wearables are not visible");
+
+    const storageB = await h.storageForNs("nsB");
+    assert.equal(
+      await storageB.readWearableDayTranscript(FAKE_WEARABLE_SOURCE, DATE),
+      null,
+      "no wearable transcript under nsB root",
+    );
+    assert.deepEqual(await storageB.meetingRecordStore().listMeetingDates(), [], "no meeting record under nsB root");
+    assert.equal(meetingMemoryCount(await storageB.readAllMemories()), 0, "no meeting memory under nsB root");
+  } finally {
+    await h.cleanup();
+  }
+});
+
+test("namespace isolation: a non-default caller gets neither default-ns wearables nor global activity; the machine-owner does", async () => {
+  const h = await buildMeetingsNamespaceHarness();
+  const DATE = "2026-05-20";
+  try {
+    // Only DEFAULT-ns wearables + the machine-global activity store exist for the day.
+    await h.service.wearablesSync({ date: DATE, ...scope("default", "op") });
+    h.seedGlobalActivity(DATE);
+
+    // Non-default caller: strict isolation — no default-ns wearable fallback,
+    // no machine-global activity → zero meetings.
+    const buildNonDefault = await h.service.meetingsBuild(DATE, scope("nsB", "pB"));
+    assert.equal(buildNonDefault.meetings.length, 0, "non-default caller sees no default wearables and no activity");
+
+    // Machine-owner (default) caller: consumes default wearables AND global activity.
+    const buildDefault = await h.service.meetingsBuild(DATE, scope("default", "op"));
+    assert.equal(buildDefault.meetings.length, 1, "default caller detects the meeting from default wearables");
+    assert.ok(
+      (buildDefault.meetings[0]?.snapshotCount ?? 0) > 0,
+      "default caller consumed machine-global activity (screen context snapshots)",
+    );
+  } finally {
+    await h.cleanup();
+  }
+});
+
+test("namespace isolation: a write-only principal (in writePrincipals, not readPrincipals) is DENIED meetingsBuild, while read+write and the machine owner succeed", async () => {
+  const h = await buildMeetingsNamespaceHarness();
+  const DATE = "2026-07-14";
+  try {
+    // pWO can WRITE nsWO, so the sync (a pure write) is allowed and physically
+    // lands a source transcript under nsWO — the very data meetingsBuild reads
+    // back and derives from.
+    const sync = await h.service.wearablesSync({ date: DATE, ...scope("nsWO", "pWO") });
+    assert.equal(sync[0]?.transcriptsWritten.includes(DATE), true, "write-only principal's sync wrote a transcript");
+
+    // meetingsBuild READS those transcripts + meeting records to derive the day's
+    // meetings. A WRITE grant alone must NOT confer that read: pWO is omitted from
+    // nsWO.readPrincipals, so build is DENIED with the shared read-ACL error.
+    // (Pre-fix, meetingsBuild authorized via writableNamespaceFor only, so pWO
+    // would read nsWO's transcripts back and return meetings — the breach.)
+    await assert.rejects(
+      () => h.service.meetingsBuild(DATE, scope("nsWO", "pWO")),
+      (err: unknown) => err instanceof EngramAccessInputError && /not readable/.test((err as Error).message),
+      "write-only principal is denied meetingsBuild on a namespace it cannot read",
+    );
+
+    // Positive control: a principal with BOTH read and write on its namespace
+    // builds successfully.
+    await h.service.wearablesSync({ date: DATE, ...scope("nsA", "pA") });
+    const buildRW = await h.service.meetingsBuild(DATE, scope("nsA", "pA"));
+    assert.equal(buildRW.enabled, true, "read+write principal builds successfully");
+    assert.equal(buildRW.meetings.length, 1, "read+write principal derives its meeting");
+
+    // The default/machine-owner principal is unaffected (full access to default).
+    await h.service.wearablesSync({ date: DATE, ...scope("default", "op") });
+    const buildDefault = await h.service.meetingsBuild(DATE, scope("default", "op"));
+    assert.equal(buildDefault.enabled, true, "machine owner still builds on the default namespace");
+    assert.equal(buildDefault.meetings.length, 1, "machine owner derives its meeting");
+  } finally {
+    await h.cleanup();
+  }
+});

package/src/meetings/service.test.ts

@@ -0,0 +1,195 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import { MeetingsBuilder, type MeetingDayData, type MeetingsDaySource } from "./build.js";
+import { DEFAULT_MEETINGS_CONFIG } from "./config.js";
+import { MeetingRecordStore, type MeetingRecordFileIo } from "./store.js";
+import { MeetingsInputError } from "./errors.js";
+import { MeetingsService } from "./service.js";
+import type { MeetingsConfig } from "./types.js";
+
+const MEMORY_DIR = "/mem";
+const DATE = "2026-03-10";
+const START = "2026-03-10T14:00:00.000Z";
+const END = "2026-03-10T15:00:00.000Z";
+
+class InMemoryIo implements MeetingRecordFileIo {
+  files = new Map<string, string>();
+  async writeFile(p: string, c: string): Promise<void> {
+    this.files.set(p, c);
+  }
+  async readFile(p: string): Promise<string> {
+    const v = this.files.get(p);
+    if (v === undefined) throw enoent();
+    return v;
+  }
+  async readDir(dirPath: string): Promise<string[]> {
+    const prefix = dirPath.endsWith("/") ? dirPath : `${dirPath}/`;
+    const names = new Set<string>();
+    let found = false;
+    for (const key of this.files.keys()) {
+      if (!key.startsWith(prefix)) continue;
+      found = true;
+      names.add(key.slice(prefix.length).split("/")[0]!);
+    }
+    if (!found) throw enoent();
+    return [...names];
+  }
+  async deleteFile(p: string): Promise<void> {
+    if (!this.files.delete(p)) throw enoent();
+  }
+  async realpath(p: string): Promise<string> {
+    return p;
+  }
+  async lstat(): Promise<{ isSymbolicLink: boolean }> {
+    return { isSymbolicLink: false };
+  }
+}
+
+function enoent(): NodeJS.ErrnoException {
+  const err = new Error("ENOENT") as NodeJS.ErrnoException;
+  err.code = "ENOENT";
+  return err;
+}
+
+function config(overrides: Partial<MeetingsConfig> = {}): MeetingsConfig {
+  return {
+    ...DEFAULT_MEETINGS_CONFIG,
+    appPatterns: [...DEFAULT_MEETINGS_CONFIG.appPatterns],
+    enabled: true,
+    ...overrides,
+  };
+}
+
+/** A day source that detects one app+audio meeting for DATE. */
+function dayData(): MeetingDayData {
+  return {
+    detection: {
+      date: DATE,
+      appSpans: [{ app: "Zoom", startUtc: START, endUtc: END }],
+      audioWindows: [{ source: "desktop", startUtc: START, endUtc: END, distinctNonWearerSpeakers: 2 }],
+    },
+    conversations: [
+      {
+        source: "desktop",
+        conversationId: "c1",
+        startIso: START,
+        endIso: END,
+        segments: [{ speaker: "Jane", isSelf: false, text: "hello", startIso: "2026-03-10T14:05:00.000Z" }],
+      },
+    ],
+  };
+}
+
+function makeService(cfg: MeetingsConfig, source: MeetingsDaySource): {
+  service: MeetingsService;
+  store: MeetingRecordStore;
+} {
+  const store = new MeetingRecordStore(MEMORY_DIR, new InMemoryIo());
+  const builder = new MeetingsBuilder({ source, store, config: cfg });
+  const service = new MeetingsService({ config: cfg, store, builder, buildDebounceMs: 10_000 });
+  return { service, store };
+}
+
+test("meetingsBuild detects + stores, and meetingsList/meetingsGet then surface it", async () => {
+  const { service } = makeService(config(), { loadDayData: () => dayData() });
+  const built = await service.meetingsBuild(DATE);
+  assert.equal(built.enabled, true);
+  assert.equal(built.meetings.length, 1);
+  const id = built.meetings[0]!.id;
+
+  const list = await service.meetingsList(DATE);
+  assert.equal(list.enabled, true);
+  assert.equal(list.days.length, 1);
+  assert.equal(list.days[0]?.date, DATE);
+  assert.equal(list.days[0]?.meetings[0]?.id, id);
+
+  const listAll = await service.meetingsList();
+  assert.deepEqual(listAll.days.map((d) => d.date), [DATE]);
+
+  const got = await service.meetingsGet(id);
+  assert.equal(got.enabled, true);
+  assert.equal(got.found, true);
+  assert.equal(got.id, id);
+  assert.match(got.record ?? "", /## Transcript/);
+});
+
+test("meetingsGet reports a missing record without throwing", async () => {
+  const { service } = makeService(config(), { loadDayData: () => dayData() });
+  const got = await service.meetingsGet("mtg-2026-03-10-deadbeef");
+  assert.equal(got.found, false);
+  assert.equal(got.record, null);
+});
+
+test("disabled mode: every entrypoint is a no-op", async () => {
+  const { service, store } = makeService(config({ enabled: false }), { loadDayData: () => dayData() });
+
+  const built = await service.meetingsBuild(DATE);
+  assert.equal(built.enabled, false);
+  assert.deepEqual(built.meetings, []);
+  assert.deepEqual(await store.listMeetingDates(), [], "disabled build writes nothing");
+
+  const list = await service.meetingsList(DATE);
+  assert.equal(list.enabled, false);
+  assert.deepEqual(list.days, []);
+
+  const got = await service.meetingsGet("mtg-2026-03-10-deadbeef");
+  assert.equal(got.enabled, false);
+  assert.equal(got.found, false);
+
+  // requestBuild is a no-op when disabled: flushing must build nothing.
+  service.requestBuild(DATE);
+  await service.flushBuilds();
+  assert.deepEqual(await store.listMeetingDates(), []);
+});
+
+test("invalid inputs surface MeetingsInputError (mapped to 400 by the transports)", async () => {
+  const { service } = makeService(config(), { loadDayData: () => dayData() });
+  await assert.rejects(() => service.meetingsList("2026-13-40"), MeetingsInputError);
+  await assert.rejects(() => service.meetingsBuild("not-a-date"), MeetingsInputError);
+  await assert.rejects(() => service.meetingsGet("not-a-meeting-id"), MeetingsInputError);
+  await assert.rejects(() => service.meetingsGet("mtg-2026-13-40-abcdef01"), MeetingsInputError);
+});
+
+test("requestBuild + flush runs the debounced tail-step build when enabled", async () => {
+  const { service, store } = makeService(config(), { loadDayData: () => dayData() });
+  service.requestBuild(DATE);
+  service.requestBuild(DATE); // coalesced
+  await service.flushBuilds();
+  assert.deepEqual(await store.listMeetingDates(), [DATE], "the coalesced tail-step build persisted the day");
+  const summaries = await store.listMeetingSummaries(DATE);
+  assert.equal(summaries.length, 1);
+});
+
+test("requestBuildForActivitySync rebuilds every touched date, not just the sync tick's day (issue #1900)", async () => {
+  const source: MeetingsDaySource = {
+    loadDayData: (date) => ({
+      detection: {
+        date,
+        appSpans: [{ app: "Zoom", startUtc: `${date}T14:00:00.000Z`, endUtc: `${date}T15:00:00.000Z` }],
+        audioWindows: [
+          { source: "desktop", startUtc: `${date}T14:00:00.000Z`, endUtc: `${date}T15:00:00.000Z`, distinctNonWearerSpeakers: 2 },
+        ],
+      },
+      conversations: [
+        {
+          source: "desktop",
+          conversationId: "c1",
+          startIso: `${date}T14:00:00.000Z`,
+          endIso: `${date}T15:00:00.000Z`,
+          segments: [{ speaker: "Jane", isSelf: false, text: "hi", startIso: `${date}T14:05:00.000Z` }],
+        },
+      ],
+    }),
+  };
+  const { service, store } = makeService(config(), source);
+  // The sync tick ran today (2026-03-10); a rolling/backfill window also changed
+  // yesterday's activity. Both days must rebuild — not just the tick's local day.
+  service.requestBuildForActivitySync("2026-03-10T14:30:00.000Z", "UTC", ["2026-03-09", "2026-03-10"]);
+  await service.flushBuilds();
+  assert.deepEqual(
+    (await store.listMeetingDates()).sort(),
+    ["2026-03-09", "2026-03-10"],
+    "the backfilled older day is rebuilt too, not only the tick's local day",
+  );
+});

package/src/meetings/service.ts

@@ -0,0 +1,157 @@
+/**
+ * Meetings service (issue #1900) — the orchestrator-owned facade every meeting
+ * surface (CLI, MCP tools, HTTP routes) shares, so behavior + validation never
+ * fork across hosts (the same rule the wearables service follows). It owns the
+ * record store, the store-backed builder, and the debounced post-sync build
+ * scheduler.
+ *
+ * `meetings.enabled` is honored at every entrypoint: `meetingsList`/`meetingsGet`
+ * short-circuit to an empty/absent result when disabled, `meetingsBuild`
+ * delegates to the builder (which already reports `enabled: false` and writes
+ * nothing), and the tail-step `requestBuild` is a no-op. Caller-correctable
+ * faults (bad dates/ids) throw `MeetingsInputError`, which the transports map to
+ * 400-class responses; the CLI reuses the store + builder directly through the
+ * shared `runMeetingsCliCommand` runner.
+ */
+
+import { isValidTranscriptDate } from "../wearables/day-store.js";
+import { formatDateInTimeZone } from "../orchestration/orchestrator-helpers.js";
+import { MeetingsBuildScheduler } from "./build-scheduler.js";
+import type { MeetingsBuilder, MeetingsDayBuildSummary } from "./build.js";
+import { MeetingsInputError } from "./errors.js";
+import { meetingIdDate, type MeetingRecordStore, type MeetingRecordSummary } from "./store.js";
+import type { MeetingsConfig } from "./types.js";
+
+/** One day's stored meeting summaries in a list result. */
+export interface MeetingsListDay {
+  date: string;
+  meetings: MeetingRecordSummary[];
+}
+
+/** Structured result of a meetings list query (all days, or one day). */
+export interface MeetingsListResult {
+  /** False when `meetings.enabled` is off (zero behavior). */
+  enabled: boolean;
+  days: MeetingsListDay[];
+}
+
+/** Structured result of fetching one stored meeting record. */
+export interface MeetingsGetResult {
+  /** False when `meetings.enabled` is off (zero behavior). */
+  enabled: boolean;
+  found: boolean;
+  id: string;
+  /** Raw persisted markdown, or null when disabled/absent. */
+  record: string | null;
+}
+
+export interface MeetingsServiceDeps {
+  config: MeetingsConfig;
+  store: MeetingRecordStore;
+  builder: MeetingsBuilder;
+  /** Trailing-edge coalescing window for post-sync rebuilds (ms). */
+  buildDebounceMs: number;
+  /** Observe a tail-step build failure (logging); never called on success. */
+  onBuildError?(date: string, err: unknown): void;
+}
+
+export class MeetingsService {
+  readonly store: MeetingRecordStore;
+  readonly builder: MeetingsBuilder;
+  readonly config: MeetingsConfig;
+  private readonly scheduler: MeetingsBuildScheduler;
+
+  constructor(deps: MeetingsServiceDeps) {
+    this.config = deps.config;
+    this.store = deps.store;
+    this.builder = deps.builder;
+    this.scheduler = new MeetingsBuildScheduler({
+      debounceMs: deps.buildDebounceMs,
+      build: (date) => this.builder.buildDay(date),
+      ...(deps.onBuildError ? { onError: deps.onBuildError } : {}),
+    });
+  }
+
+  /** List stored meetings for one day, or across all days when no date given. */
+  async meetingsList(date?: string): Promise<MeetingsListResult> {
+    if (!this.config.enabled) return { enabled: false, days: [] };
+    if (date !== undefined) {
+      if (!isValidTranscriptDate(date)) {
+        throw new MeetingsInputError(`date must be a real YYYY-MM-DD; got '${date}'`);
+      }
+      return { enabled: true, days: [{ date, meetings: await this.store.listMeetingSummaries(date) }] };
+    }
+    const dates = await this.store.listMeetingDates();
+    const days: MeetingsListDay[] = [];
+    for (const day of dates) {
+      days.push({ date: day, meetings: await this.store.listMeetingSummaries(day) });
+    }
+    return { enabled: true, days };
+  }
+
+  /** Fetch one stored meeting record's raw markdown by id. */
+  async meetingsGet(id: string): Promise<MeetingsGetResult> {
+    if (!this.config.enabled) return { enabled: false, found: false, id, record: null };
+    const date = meetingIdDate(id);
+    if (date === null) {
+      throw new MeetingsInputError(`invalid meeting id '${id}' — expected mtg-YYYY-MM-DD-<hash>`);
+    }
+    // A syntactically valid id can still embed an impossible calendar date
+    // (mtg-2026-13-40-...); surface that as a clean input error, not a 500 from
+    // the store's path validator.
+    if (!isValidTranscriptDate(date)) {
+      throw new MeetingsInputError(`invalid meeting id '${id}' — '${date}' is not a real calendar date`);
+    }
+    const record = await this.store.readMeetingRecord(date, id);
+    return { enabled: true, found: record !== null, id, record };
+  }
+
+  /** Detect + fuse + store the day's meetings. Gated inside the builder. */
+  async meetingsBuild(date: string): Promise<MeetingsDayBuildSummary> {
+    if (!isValidTranscriptDate(date)) {
+      throw new MeetingsInputError(`date must be a real YYYY-MM-DD; got '${date}'`);
+    }
+    return this.builder.buildDay(date);
+  }
+
+  /**
+   * Tail-step after a sync touched a day: schedule a debounced (re)build. A
+   * no-op when the subsystem is disabled, so a sync of other signals never
+   * spins up meeting building behind the master gate.
+   */
+  requestBuild(date: string): void {
+    if (!this.config.enabled) return;
+    this.scheduler.requestBuild(date);
+  }
+
+  /**
+   * Activity tail-step (issue #1900): schedule a debounced (re)build for every
+   * local day the sync touched. The tick's own local day (from `ranAtIso`, in
+   * the activity timezone) is always eligible; `touchedDates` adds any OTHER
+   * days a rolling/backfill sync changed, so a change to yesterday's activity
+   * rebuilds yesterday's meetings rather than only today's. No-op when disabled,
+   * so a sync of other signals never spins up meeting building behind the gate.
+   */
+  requestBuildForActivitySync(
+    ranAtIso: string,
+    timezone: string,
+    touchedDates: readonly string[] = [],
+  ): void {
+    if (!this.config.enabled) return;
+    const days = new Set<string>([formatDateInTimeZone(new Date(ranAtIso), timezone)]);
+    for (const date of touchedDates) {
+      if (isValidTranscriptDate(date)) days.add(date);
+    }
+    for (const date of days) this.scheduler.requestBuild(date);
+  }
+
+  /** Force any pending debounced builds to run now (teardown/tests). */
+  flushBuilds(): Promise<void> {
+    return this.scheduler.flush();
+  }
+
+  /** Cancel armed build timers (orchestrator teardown). */
+  dispose(): void {
+    this.scheduler.dispose();
+  }
+}