@remnic/core 9.3.613 → 9.3.615

package/dist/{chunk-2QANQKSQ.js → chunk-ZK32E74R.js}

@@ -2,21 +2,21 @@ import {
   exportWorkBoardMarkdown,
   exportWorkBoardSnapshot,
   importWorkBoardSnapshot
-} from "./chunk-ETUPBUHB.js";
+} from "./chunk-GDASG7NC.js";
 import {
   WorkStorage
-} from "./chunk-L227SKTB.js";
+} from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-DHGSZ3UD.js";
+} from "./chunk-DGNQRNLL.js";
+import {
+  toRecallExplainJson
+} from "./chunk-PSUB67YB.js";
 import {
   applyTagFilter,
   normalizeTags,
   parseTagMatch
 } from "./chunk-BT7NVCML.js";
-import {
-  toRecallExplainJson
-} from "./chunk-OXJBNGBK.js";
 import {
   decideDisclosureEscalation
 } from "./chunk-H7XKCNR6.js";
@@ -27,10 +27,12 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-OI27U2HT.js";
+} from "./chunk-5BTCT236.js";
 import {
   clusterByKey,
+  combineNamespaces,
   projectTagProjectId,
+  resolveCodingNamespaceOverlay,
   resolveGitContext
 } from "./chunk-EDQVAMQI.js";
 import {
@@ -44,10 +46,10 @@ import {
 } from "./chunk-JGSKJHF7.js";
 import {
   estimateRecallTokens
-} from "./chunk-FXKPZ3H6.js";
+} from "./chunk-BPSGLMQ4.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
-} from "./chunk-WSGF57U2.js";
+} from "./chunk-JQDZQ4TB.js";
 import {
   objectiveStateStoreOverrideForNamespace
 } from "./chunk-UEY3VB6W.js";
@@ -71,23 +73,23 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-EUML3N6B.js";
+} from "./chunk-IMA6GU4Y.js";
 import {
   CrossNamespaceBudget
-} from "./chunk-CHCA44C3.js";
+} from "./chunk-ODPLEWB6.js";
 import {
   FileCalendarSource,
   buildBriefing,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-QDDHYAKV.js";
+} from "./chunk-AZDOWD2L.js";
 import {
   parseEntityFile
-} from "./chunk-YFS5OEKO.js";
+} from "./chunk-7MLB4NCL.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-KGK2QKWL.js";
+} from "./chunk-4R4KTDIE.js";
 import {
   inferMemoryStatus,
   toMemoryPathRel
@@ -125,7 +127,7 @@ import {
 } from "./chunk-VFUEZZBS.js";
 import {
   exportCapsule
-} from "./chunk-KQAFEZQX.js";
+} from "./chunk-VDX2J7OX.js";
 import {
   OFFLINE_SYNC_SNAPSHOT_FORMAT,
   applyOfflineSyncChangeset,
@@ -664,6 +666,99 @@ var EngramAccessService = class {
     }
     return resolved;
   }
+  /**
+   * Resolve a coding context from `cwd`/`projectTag` WITHOUT persisting it to
+   * any session — the read-only half of `maybeAttachCodingContext`. Returns
+   * null when project scoping is off or nothing resolves. `projectTag` takes
+   * priority over `cwd` (matching `maybeAttachCodingContext`).
+   */
+  async resolveCodingContextFromOptions(options) {
+    if (!this.orchestrator.config.codingMode?.projectScope) return null;
+    if (typeof options.projectTag === "string" && options.projectTag.trim().length > 0) {
+      const projectId = projectTagProjectId(options.projectTag);
+      return { projectId, branch: null, rootPath: projectId, defaultBranch: null };
+    }
+    if (typeof options.cwd === "string" && options.cwd.trim().length > 0) {
+      try {
+        const gitCtx = await resolveGitContext(options.cwd);
+        if (gitCtx) {
+          return {
+            projectId: gitCtx.projectId,
+            branch: gitCtx.branch,
+            rootPath: gitCtx.rootPath,
+            defaultBranch: gitCtx.defaultBranch
+          };
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
+  /**
+   * Resolve the write namespace for explicit-write tools (memory_store /
+   * suggestion_submit), project-scoping the write the same way recall does so a
+   * memory stored with a client-injected `cwd`/`projectTag` is discoverable by
+   * project-scoped recall (#1434, rule 42).
+   *
+   * Precedence:
+   *  - An explicit `namespace` always wins and is authorized strictly via
+   *    `resolveWritableNamespace` → `canWriteNamespace`. A coding-overlay
+   *    namespace string (`<base>-project-*`) is NOT a writable target via the
+   *    explicit field — project scoping is requested with `cwd`/`projectTag`,
+   *    never by naming the derived namespace — so there is no way to bypass the
+   *    policy allow-list by guessing/forging an overlay name (Codex review).
+   *  - With NO coding overlay, the write stays on `config.defaultNamespace` —
+   *    exactly the pre-#1434 behavior, so an unqualified write is NOT silently
+   *    moved to a principal self namespace (Codex review).
+   *  - WITH a coding overlay, the base is the principal self namespace
+   *    (`defaultNamespaceForPrincipal`, write-checked) — the SAME base recall,
+   *    observe, and the orchestrator buffer-flush write path overlay onto
+   *    (rule 42 / Cursor) — so a project-scoped store lands exactly where
+   *    project-scoped recall searches. The overlay namespace is always REBUILT
+   *    from the authenticated principal's base, never accepted as a caller
+   *    string, so a caller can never reach another principal's subtree.
+   *
+   * Read-only: this NEVER mutates session coding context, so the idempotency
+   * peeks and dryRun preflights that call it stay side-effect free (Codex
+   * review). It prefers the per-call `cwd`/`projectTag` (the project explicitly
+   * identified for this write), else the session's existing context. The HTTP
+   * surface lets the peek and the write each resolve independently; the peek's
+   * namespace only gates rate-limiting (memory_store/suggestion_submit run their
+   * own idempotency check), so a benign session-context change between the two
+   * never fails a write — there is no namespace to "pin".
+   */
+  async resolveCodingScopedWriteNamespace(request) {
+    const hasExplicitNamespace = typeof request.namespace === "string" && request.namespace.trim().length > 0;
+    if (hasExplicitNamespace) {
+      return this.resolveWritableNamespace(
+        request.namespace,
+        request.sessionKey,
+        request.authenticatedPrincipal
+      );
+    }
+    const hasSession = typeof request.sessionKey === "string" && request.sessionKey.length > 0;
+    const overlay = hasSession && this.orchestrator.config.namespacesEnabled && this.orchestrator.config.codingMode?.projectScope ? resolveCodingNamespaceOverlay(
+      this.orchestrator.getCodingContextForSession(request.sessionKey) ?? await this.resolveCodingContextFromOptions(request),
+      this.orchestrator.config.codingMode,
+      this.orchestrator.config.defaultNamespace
+    ) : null;
+    if (!overlay) {
+      return this.resolveWritableNamespace(
+        void 0,
+        request.sessionKey,
+        request.authenticatedPrincipal
+      );
+    }
+    const principal = this.resolveRequestPrincipal(
+      request.sessionKey,
+      request.authenticatedPrincipal
+    );
+    const base = defaultNamespaceForPrincipal(principal, this.orchestrator.config);
+    if (!canWriteNamespace(principal, base, this.orchestrator.config)) {
+      throw new EngramAccessInputError(`namespace is not writable: ${base}`);
+    }
+    return combineNamespaces(base, overlay.namespace);
+  }
   async objectiveStateStoreLocationForNamespace(namespace) {
     if (!this.orchestrator.config.namespacesEnabled) {
       return {
@@ -858,6 +953,7 @@ var EngramAccessService = class {
     }
     const key = options.idempotencyKey?.trim();
     if (!key) {
+      if (options.beforeExecute) await options.beforeExecute();
       return options.execute();
     }
     return this.withIdempotencyLock(key, async () => {
@@ -876,6 +972,7 @@ var EngramAccessService = class {
             idempotencyReplay: true
           };
         }
+        if (options.beforeExecute) await options.beforeExecute();
         const response = await options.execute();
         await this.idempotency.put(key, requestHash, response);
         return response;
@@ -1148,6 +1245,24 @@ var EngramAccessService = class {
       }
     }
   }
+  /**
+   * Seed the session's coding binding AFTER a committed, project-scoped explicit
+   * write (memory_store / suggestion_submit), mirroring the recall path's
+   * `maybeAttachCodingContext` so a later bare recall/write on the same session
+   * is scoped to the same project. Called only from the post-persist path, so it
+   * never fires on dryRun, replay/conflict, or quota-rejected requests. Skips
+   * when an explicit `namespace` was supplied — that write bypassed the coding
+   * overlay, so binding the session to a project it never wrote to would make
+   * later bare recalls miss (Codex review).
+   */
+  async attachCodingContextAfterScopedWrite(request) {
+    const hasExplicitNamespace = typeof request.namespace === "string" && request.namespace.trim().length > 0;
+    if (hasExplicitNamespace) return;
+    await this.maybeAttachCodingContext(request.sessionKey, {
+      cwd: request.cwd,
+      projectTag: request.projectTag
+    });
+  }
   async recall(request) {
     const query = request.query.trim();
     if (query.length === 0) {
@@ -1696,12 +1811,8 @@ var EngramAccessService = class {
   // shares it, and so separate services in the same process (e.g.
   // per-tenant) do not block each other.
   xrayQueue = Promise.resolve();
-  async memoryStore(request) {
-    const namespace = this.resolveWritableNamespace(
-      request.namespace,
-      request.sessionKey,
-      request.authenticatedPrincipal
-    );
+  async memoryStore(request, hooks) {
+    const namespace = await this.resolveCodingScopedWriteNamespace(request);
     const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
     if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
       throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
@@ -1721,6 +1832,7 @@ var EngramAccessService = class {
         };
       }
       const result = await persistExplicitCapture(this.orchestrator, candidate, "memory_store");
+      await this.attachCodingContextAfterScopedWrite(request);
       const response = {
         schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
         operation: "memory_store",
@@ -1753,15 +1865,12 @@ var EngramAccessService = class {
         sourceReason: request.sourceReason
       },
       skip: request.dryRun === true,
+      beforeExecute: hooks?.enforceWriteQuota,
       execute
     });
   }
   async peekMemoryStoreIdempotency(request) {
-    const namespace = this.resolveWritableNamespace(
-      request.namespace,
-      request.sessionKey,
-      request.authenticatedPrincipal
-    );
+    const namespace = await this.resolveCodingScopedWriteNamespace(request);
     const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
     if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
       throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
@@ -1783,12 +1892,8 @@ var EngramAccessService = class {
       skip: request.dryRun === true
     });
   }
-  async suggestionSubmit(request) {
-    const namespace = this.resolveWritableNamespace(
-      request.namespace,
-      request.sessionKey,
-      request.authenticatedPrincipal
-    );
+  async suggestionSubmit(request, hooks) {
+    const namespace = await this.resolveCodingScopedWriteNamespace(request);
     const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
     if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
       throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
@@ -1813,6 +1918,7 @@ var EngramAccessService = class {
         "suggestion_submit",
         new Error(request.sourceReason?.trim() || "submitted via engram suggestion_submit")
       );
+      await this.attachCodingContextAfterScopedWrite(request);
       const response = {
         schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
         operation: "suggestion_submit",
@@ -1845,15 +1951,12 @@ var EngramAccessService = class {
         sourceReason: request.sourceReason
       },
       skip: request.dryRun === true,
+      beforeExecute: hooks?.enforceWriteQuota,
       execute
     });
   }
   async peekSuggestionSubmitIdempotency(request) {
-    const namespace = this.resolveWritableNamespace(
-      request.namespace,
-      request.sessionKey,
-      request.authenticatedPrincipal
-    );
+    const namespace = await this.resolveCodingScopedWriteNamespace(request);
     const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
     if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
       throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
@@ -1877,13 +1980,21 @@ var EngramAccessService = class {
   }
   validateWriteCandidate(request, namespace) {
     try {
-      return validateExplicitCaptureInput(
-        {
-          ...request,
-          namespace
-        },
-        "legacy_tool"
-      );
+      return {
+        ...validateExplicitCaptureInput(
+          {
+            ...request,
+            namespace
+          },
+          "legacy_tool"
+        ),
+        // The namespace was resolved AND authorized by
+        // resolveCodingScopedWriteNamespace (explicit namespaces via
+        // resolveWritableNamespace; otherwise an auth-checked base + a
+        // session-owned project overlay), so the persist/queue layer must not
+        // re-reject a legitimately-derived dynamic project namespace (#1434).
+        namespacePreResolved: true
+      };
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       throw new EngramAccessInputError(message);
@@ -4238,4 +4349,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-2QANQKSQ.js.map
+//# sourceMappingURL=chunk-ZK32E74R.js.map