@remnic/core 9.3.691 → 9.3.693

package/src/access-cli.ts

@@ -15,7 +15,7 @@ import { projectTagProjectId } from "./coding/coding-namespace.js";
 
 const OPENCLAW_REMNIC_PLUGIN_IDS = ["openclaw-remnic", "openclaw-engram"] as const;
 
-type CommandName = "browse" | "store" | "decision" | "architecture";
+type CommandName = "browse" | "store" | "decision" | "architecture" | "delta";
 
 type ParsedArgs = {
   command: CommandName;
@@ -138,6 +138,7 @@ function usage(): string {
     "  engram-access store [options]",
     "  engram-access decision [options]",
     "  engram-access architecture [options]",
+    "  engram-access delta [options]",
     "",
     "Browse options:",
     "  --namespace <name>",
@@ -248,6 +249,17 @@ const COMMAND_SPECS: Record<CommandName, CommandSpec> = {
     ]),
     flagOptions: new Set(),
   },
+  delta: {
+    valueOptions: new Set([
+      "subcommand",
+      "namespace",
+      "session-key",
+      "principal",
+      "project-tag",
+      "repo-root",
+    ]),
+    flagOptions: new Set(),
+  },
 };
 const BROWSE_SORT_VALUES = Object.freeze([
   "updated_desc",
@@ -265,7 +277,7 @@ type BrowseSort = (typeof BROWSE_SORT_VALUES)[number];
  * `command: commandRaw` assignment below (codex review P2).
  */
 function isCommandName(value: string): value is CommandName {
-  return value === "browse" || value === "store" || value === "decision" || value === "architecture";
+  return value === "browse" || value === "store" || value === "decision" || value === "architecture" || value === "delta";
 }
 
 function parseArgs(argv: string[]): ParsedArgs {
@@ -636,6 +648,53 @@ async function runArchitecture(args: ParsedArgs, preferredId?: string): Promise<
   console.log(JSON.stringify(output.result, null, 2));
 }
 
+/**
+ * Session-delta surface (issue #1548 Track A PR 4). Dispatches through the
+ * same `coding_delta` operation as the MCP tool and HTTP route — one
+ * validation boundary, three transports.
+ */
+async function runDelta(args: ParsedArgs, preferredId?: string): Promise<void> {
+  const subcommand = requireOption(args, "subcommand");
+  const { config, service } = buildRuntime(preferredId);
+  // Same coding-context attachment as runArchitecture/runDecision: the CLI's
+  // fresh Orchestrator has an empty session coding-context map, so attach a
+  // context BEFORE dispatching so the gate passes.
+  const projectTag = getLastOption(args, "project-tag");
+  const sessionKey = getLastOption(args, "session-key");
+  if (sessionKey && sessionKey.trim().length > 0) {
+    const repoRoot = expandOptionalPath(getLastOption(args, "repo-root")) ?? process.cwd();
+    const projectId =
+      projectTag && projectTag.trim().length > 0
+        ? projectTagProjectId(projectTag.trim())
+        : projectTagProjectId(path.basename(repoRoot));
+    service.setCodingContext({
+      sessionKey,
+      codingContext: {
+        projectId,
+        branch: null,
+        rootPath: repoRoot,
+        defaultBranch: null,
+      },
+    });
+  }
+  const op = getOperation("coding_delta");
+  if (!op) {
+    throw new Error("access-boundary: operation not registered: coding_delta");
+  }
+  const output = (await op.run(
+    {
+      subcommand,
+      namespace: getLastOption(args, "namespace"),
+      sessionKey,
+    },
+    {
+      service,
+      authenticatedPrincipal: getLastOption(args, "principal") ?? config.agentAccessHttp.principal,
+    },
+  )) as { result: unknown };
+  console.log(JSON.stringify(output.result, null, 2));
+}
+
 export async function main(
   argv: string[] = process.argv.slice(2),
   options: AccessCliOptions = {},
@@ -653,6 +712,10 @@ export async function main(
     await runArchitecture(args, options.preferredId);
     return;
   }
+  if (args.command === "delta") {
+    await runDelta(args, options.preferredId);
+    return;
+  }
   await runStore(args, options.preferredId);
 }
 

package/src/access-http.ts

@@ -317,6 +317,7 @@ export class EngramAccessHttpServer {
       emitLegacyTools: options.emitLegacyTools,
       codingDecisionVisible: this.service.decisionRecordSurfaceVisible,
       architectureCardVisible: this.service.architectureCardSurfaceVisible,
+      sessionDeltaVisible: this.service.sessionDeltaSurfaceVisible,
     });
   }
 
@@ -1386,6 +1387,25 @@ export class EngramAccessHttpServer {
       return;
     }
 
+    if (req.method === "POST" && pathname === "/engram/v1/coding/delta") {
+      // Migrated through the access boundary (issue #1525/#1548 PR4):
+      // get is read-only with respect to user memory content. It DOES write
+      // the operator-side state file (last-seen-head marker), but that is
+      // bookkeeping — the same way calibration.ts writes are uncounted. No
+      // write-quota enforcement.
+      const body = await this.readJsonBody(req);
+      const op = getOperation("coding_delta");
+      if (!op) {
+        throw new EngramAccessInputError("access-boundary: operation not registered: coding_delta");
+      }
+      const output = (await op.run(body, {
+        service: this.service,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req),
+      })) as { result: unknown };
+      this.respondJson(res, 200, output.result);
+      return;
+    }
+
     if (req.method === "POST" && pathname === "/engram/v1/suggestions") {
       const body = await this.readValidatedBody(req, "suggestionSubmit");
       const request = {

package/src/access-mcp.ts

@@ -111,6 +111,7 @@ const MCP_MIGRATED_OPERATIONS: Readonly<Record<string, OperationName>> = {
   "engram.memory_store": "memory_store",
   "engram.coding_decision": "coding_decision",
   "engram.coding_architecture": "coding_architecture",
+  "engram.coding_delta": "coding_delta",
 };
 
 function resolveChatGptInspectorRecallSessionKey(
@@ -331,6 +332,7 @@ export class EngramMcpServer {
    * (issue #1548 Track A PR 3, rule 39).
    */
   private readonly architectureCardVisible: boolean;
+  private readonly sessionDeltaVisible: boolean;
 
   constructor(
     private readonly service: EngramAccessService,
@@ -341,6 +343,7 @@ export class EngramMcpServer {
       emitLegacyTools?: boolean;
       codingDecisionVisible?: boolean;
       architectureCardVisible?: boolean;
+      sessionDeltaVisible?: boolean;
     } = {},
   ) {
     this.citationsEnabled = options.citationsEnabled === true;
@@ -348,6 +351,7 @@ export class EngramMcpServer {
     this.emitLegacyTools = options.emitLegacyTools !== false;
     this.codingDecisionVisible = options.codingDecisionVisible === true;
     this.architectureCardVisible = options.architectureCardVisible === true;
+    this.sessionDeltaVisible = options.sessionDeltaVisible === true;
     this.authenticatedPrincipal =
       options.principal?.trim() ||
       readEnvVar("OPENCLAW_ENGRAM_ACCESS_PRINCIPAL")?.trim() ||
@@ -2033,6 +2037,31 @@ export class EngramMcpServer {
       );
       this.tools = [...this.tools, ...architectureTools];
     }
+    if (this.sessionDeltaVisible) {
+      const deltaTools = withToolAliases(
+        {
+          name: "engram.coding_delta",
+          description:
+            "Get the session delta (commits + touched files since last seen) for the session's coding namespace (issue #1548 Track A PR 4). Subcommand: get.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              subcommand: {
+                type: "string",
+                enum: ["get"],
+                description: "Which delta operation to run.",
+              },
+              sessionKey: { type: "string", description: "Session identifier whose coding context scopes the operation." },
+              namespace: { type: "string", description: "Optional explicit namespace (overrides coding-context overlay)." },
+            },
+            required: ["subcommand"],
+            additionalProperties: false,
+          },
+        },
+        this.emitLegacyTools,
+      );
+      this.tools = [...this.tools, ...deltaTools];
+    }
   }
 
   /** Get clientInfo for a specific MCP session. Returns undefined for non-MCP requests. */

package/src/access-operations.ts

@@ -29,6 +29,11 @@ import {
   type ArchitectureSurfaceRequest,
   type ArchitectureSurfaceResponse,
 } from "./coding/architecture-surfaces.js";
+import {
+  DELTA_SUBCOMMANDS,
+  type DeltaSurfaceRequest,
+  type DeltaSurfaceResponse,
+} from "./coding/session-delta-surfaces.js";
 
 // ---------------------------------------------------------------------------
 // memory_get — fetch one memory by id
@@ -250,6 +255,46 @@ export const codingArchitectureOperation = defineOperation<
   },
 });
 
+// ---------------------------------------------------------------------------
+// coding_delta — session-delta surface (issue #1548 Track A PR 4)
+// ---------------------------------------------------------------------------
+
+const codingDeltaSchema = z.preprocess(
+  (data) => {
+    if (data !== null && typeof data === "object" && !Array.isArray(data)) {
+      const obj = data as Record<string, unknown>;
+      const cleaned: Record<string, unknown> = {};
+      for (const [key, value] of Object.entries(obj)) {
+        if (value !== null) cleaned[key] = value;
+      }
+      return cleaned;
+    }
+    return data;
+  },
+  z.object({
+    subcommand: z.enum(DELTA_SUBCOMMANDS),
+    sessionKey: z.string().trim().max(512).optional(),
+    namespace: z.string().trim().max(256).optional(),
+  }),
+);
+
+export type CodingDeltaInput = DeltaSurfaceRequest;
+export type CodingDeltaOutput = { result: DeltaSurfaceResponse };
+
+export const codingDeltaOperation = defineOperation<
+  CodingDeltaInput,
+  CodingDeltaOutput
+>({
+  name: "coding_delta",
+  description:
+    "Get the session delta (commits + touched files since last seen) for the session's coding namespace (issue #1548 Track A PR 4).",
+  schema: codingDeltaSchema as z.ZodType<CodingDeltaInput>,
+  handler: async (input, ctx) => {
+    const result = await ctx.service.codingDelta(input, ctx.authenticatedPrincipal);
+    return { result };
+  },
+});
+
 // ---------------------------------------------------------------------------
 // Surface registration map — what each transport calls the pilot ops
 // ---------------------------------------------------------------------------
@@ -265,4 +310,5 @@ export const REGISTERED_OPERATIONS = [
   memoryStoreOperation.spec.name,
   codingDecisionOperation.spec.name,
   codingArchitectureOperation.spec.name,
+  codingDeltaOperation.spec.name,
 ] as const;

package/src/access-service.ts

@@ -28,6 +28,13 @@ import {
   ARCHITECTURE_CARD_TAG,
 } from "./coding/architecture-surfaces.js";
 import { buildArchitectureCard, createArchitectureCardSummariser } from "./coding/architecture-card.js";
+import {
+  handleCodingDelta,
+  type DeltaSurfaceRequest,
+  type DeltaSurfaceResponse,
+  type DeltaSurfaceStorage,
+} from "./coding/session-delta-surfaces.js";
+import { defaultGitInvoker } from "./coding/git-context.js";
 import { createVersion } from "./page-versioning.js";
 import { WorkStorage } from "./work/storage.js";
 import {
@@ -4545,6 +4552,54 @@ export class EngramAccessService {
     });
   }
 
+  /** Whether the coding_delta tool should appear in tools/list (rule 39). */
+  get sessionDeltaSurfaceVisible(): boolean {
+    return this.orchestrator.config.codingKnowledge?.enabled === true
+      && this.orchestrator.config.codingKnowledge?.sessionDelta === true;
+  }
+  /**
+   * Thin delegate — handler logic in coding/session-delta-surfaces.ts (#1548 PR4).
+   * All three surfaces (MCP/HTTP/CLI) arrive here via the boundary operation.
+   * Namespace resolution uses the SAME coding-scoped read path as the other
+   * coding surfaces; the delta state file lives under
+   * `<memoryDir>/state/coding-knowledge/<namespace>.json`.
+   */
+  async codingDelta(
+    request: DeltaSurfaceRequest,
+    authenticatedPrincipal?: string,
+  ): Promise<DeltaSurfaceResponse> {
+    return handleCodingDelta(request, {
+      codingKnowledge: this.orchestrator.config.codingKnowledge,
+      getCodingContext: (sk) => this.orchestrator.getCodingContextForSession(sk),
+      resolveStorage: async (req) => {
+        const ns = await this.resolveCodingScopedReadableNamespace({
+          namespace: req.namespace,
+          sessionKey: req.sessionKey,
+          authenticatedPrincipal,
+        });
+        const storage = await this.orchestrator.getStorage(ns);
+        // Delta only needs memoryDir + namespace (no readAllMemories). Use the
+        // namespace-ROUTED root (storage.dir), not the global config.memoryDir:
+        // non-default namespaces route to memoryDir/namespaces/<token>, so
+        // session-delta markers must read/write from the routed tree, mirroring
+        // the decision/architecture siblings (cursor review).
+        return {
+          memoryDir: storage.dir,
+          namespace: ns,
+        } satisfies DeltaSurfaceStorage;
+      },
+      gitInvoker: (cwd, args) => {
+        // Reuse the existing defaultGitInvoker (2s timeout, never throws —
+        // the discipline git-context.ts already established). It returns
+        // { stdout, exitCode } so the handler can recover from non-zero
+        // exits without a try/catch.
+        const invoker = defaultGitInvoker();
+        return invoker(cwd, args);
+      },
+      throwInputError: (msg) => { throw new EngramAccessInputError(msg); },
+    });
+  }
+
   async memoryBrowse(
     request: EngramAccessMemoryBrowseRequest = {},
   ): Promise<EngramAccessMemoryBrowseResponse> {

package/src/access-surface-catalog.test.ts

@@ -67,7 +67,7 @@ function shortToolName(advertised: string): string {
 /** Spin up a server with emitLegacyTools=true and read the deduped short names. */
 async function liveMcpToolShortNames(): Promise<ReadonlySet<string>> {
   const stub = { briefingEnabled: true } as unknown as EngramAccessService;
-  const server = new EngramMcpServer(stub, { emitLegacyTools: true, codingDecisionVisible: true, architectureCardVisible: true });
+  const server = new EngramMcpServer(stub, { emitLegacyTools: true, codingDecisionVisible: true, architectureCardVisible: true, sessionDeltaVisible: true });
   const response = await server.handleRequest({ jsonrpc: "2.0", id: 1, method: "tools/list" });
   const result = (response as { result?: { tools?: Array<{ name: string }> } }).result;
   const names = new Set<string>();

package/src/access-surface-catalog.ts

@@ -74,6 +74,7 @@ export const MCP_TOOLS: readonly McpToolEntry[] = [
   { tool: "memory_store", operation: "memory_store" },
   { tool: "coding_decision", operation: "coding_decision" },
   { tool: "coding_architecture", operation: "coding_architecture" },
+  { tool: "coding_delta", operation: "coding_delta" },
   { tool: "suggestion_submit", operation: null },
   { tool: "entity_get", operation: null },
   { tool: "review_queue_list", operation: null },
@@ -172,6 +173,7 @@ export const HTTP_ROUTES: readonly HttpRouteEntry[] = [
   { method: "POST", pathname: "/engram/v1/memories", operation: "memory_store" },
   { method: "POST", pathname: "/engram/v1/coding/decisions", operation: "coding_decision" },
   { method: "POST", pathname: "/engram/v1/coding/architecture", operation: "coding_architecture" },
+  { method: "POST", pathname: "/engram/v1/coding/delta", operation: "coding_delta" },
   { method: "POST", pathname: "/engram/v1/suggestions", operation: null },
   { method: "GET", pathname: "/engram/v1/memories", operation: null },
   { method: "GET", pathname: "/engram/v1/memories/:id", operation: "memory_get" },

package/src/cli.ts

@@ -2803,6 +2803,7 @@ export async function runAccessMcpServeCliCommand(
       emitLegacyTools: options.emitLegacyTools,
       codingDecisionVisible: service.decisionRecordSurfaceVisible,
       architectureCardVisible: service.architectureCardSurfaceVisible,
+      sessionDeltaVisible: service.sessionDeltaSurfaceVisible,
     });
   await server.runStdio(options.stdin ?? process.stdin, options.stdout ?? process.stdout);
   return { ok: true };

package/src/coding/coding-namespace.ts

@@ -66,7 +66,7 @@ export interface CodingNamespaceOverlay {
  * greedy quantifiers) closes the polynomial-backtracking surface that
  * CodeQL flagged on patterns like `-+` and `^-+|-+$`.
  */
-function sanitizeFragment(input: string): string {
+export function sanitizeFragment(input: string): string {
   if (typeof input !== "string") return "";
   const trimmed = input.trim().toLowerCase();
   let out = "";