@remnic/core 9.65.6 → 9.65.7

package/src/index.ts

@@ -1461,5 +1461,7 @@ export type {
 export type { ResolvedScopeProfilePlan } from "./namespaces/scope-profiles.js";
 export * from "./maintenance/atomic-file.js";
 
+// Privacy-safe action-to-outcome trajectory eval (issue #2345)
+export * from "./eval-trajectory.js";
 export { MemoryControllerCoordinator, chooseAction, computeEvidenceReportHash, controllerConfigHash, evaluateActiveGates, hashControllerState, verifyEvidenceReport } from "./memory-controller.js";
 export type { ActiveContextAdapter, ActiveContextMessage, ActiveContextPlan, MemoryControllerActionFamily, MemoryControllerChoice, MemoryControllerConfig, MemoryControllerDeps, MemoryControllerEvent, MemoryControllerEvidence, MemoryControllerEvidenceReport, MemoryControllerExecutors, MemoryControllerMode, MemoryControllerPairedSeedEvidence, MemoryControllerReceipt, MemoryControllerRecorder, MemoryControllerReportReader, MemoryControllerRunResult, MemoryControllerState } from "./memory-controller.js";

package/src/location/access-operations.ts

@@ -0,0 +1,84 @@
+/**
+ * Location boundary operations (issue #2047) — the five `location_*`
+ * operations registered through the access boundary so MCP, HTTP, and any
+ * batch transport share one validated dispatch. Handlers are thin: they run
+ * the same `location/surfaces.ts` runners the CLI uses. Fleet-wide: location
+ * config and day files are machine-level (no namespace scoping).
+ */
+
+import { z } from "zod";
+import { defineOperation } from "../access-boundary.js";
+import type { EngramAccessService } from "../access-service.js";
+import {
+  parseLocationBackfillRange,
+  runLocationCheck,
+  runLocationDay,
+  runLocationStatus,
+  runLocationSync,
+  type LocationSurfaceDeps,
+} from "./surfaces.js";
+
+/** Zod shape shared by the location operations (null-for-absent tolerant). */
+const dateField = z.union([z.string(), z.null()]).optional();
+const daysField = z.union([z.number(), z.string(), z.null()]).optional();
+
+function locationDeps(service: EngramAccessService): LocationSurfaceDeps {
+  return { config: service.configRef.location, memoryDir: service.memoryDir };
+}
+
+defineOperation({
+  name: "location_status",
+  description: "Location sync status (gates, providers, last sync, day counts).",
+  fleetWide: true,
+  schema: z.object({}).passthrough(),
+  handler: async (_input, ctx) => ({
+    result: await runLocationStatus(locationDeps(ctx.service)),
+  }),
+});
+
+defineOperation({
+  name: "location_check",
+  description: "Probe every enabled location provider.",
+  fleetWide: true,
+  schema: z.object({}).passthrough(),
+  handler: async (_input, ctx) => ({
+    result: await runLocationCheck(locationDeps(ctx.service)),
+  }),
+});
+
+defineOperation({
+  name: "location_sync",
+  description: "Sync location days (default window: syncDays ending yesterday).",
+  fleetWide: true,
+  schema: z.object({ date: dateField, days: daysField }).passthrough(),
+  handler: async (input, ctx) => ({
+    result: {
+      days: await runLocationSync(locationDeps(ctx.service), {
+        ...(input.date !== undefined && input.date !== null && input.date !== "" ? { endDate: input.date } : {}),
+        ...(input.days !== undefined && input.days !== null && input.days !== "" ? { days: Number(input.days) } : {}),
+      }),
+    },
+  }),
+});
+
+defineOperation({
+  name: "location_backfill",
+  description: "Sync an explicit historical day range (≤ 90 days).",
+  fleetWide: true,
+  schema: z.object({ from: dateField, to: dateField }).passthrough(),
+  handler: async (input, ctx) => {
+    const range = parseLocationBackfillRange(input.from, input.to);
+    return { result: { days: await runLocationSync(locationDeps(ctx.service), range) } };
+  },
+});
+
+defineOperation({
+  name: "location_day",
+  description: "Read one stored location day.",
+  fleetWide: true,
+  schema: z.object({ date: dateField }).passthrough(),
+  handler: async (input, ctx) => ({
+    result: await runLocationDay(locationDeps(ctx.service).memoryDir, input.date),
+  }),
+});
+

package/src/location/http-glue.test.ts

@@ -0,0 +1,100 @@
+/**
+ * Location HTTP glue regression (issue #2047): the /engram/v1/location/...
+ * responders dispatch through the same boundary operations the MCP tools
+ * use — identical validation messages, 404 for unstored days, 200 otherwise.
+ */
+
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+import type { ServerResponse } from "node:http";
+
+// Import the operations module so getOperation() has the location_* set.
+import "../access-operations.js";
+import { EngramAccessInputError } from "../access-errors.js";
+import type { EngramAccessService } from "../access-service.js";
+import { parseLocationConfig } from "./config.js";
+import {
+  respondLocationBackfill,
+  respondLocationCheck,
+  respondLocationDay,
+  respondLocationStatus,
+  respondLocationSync,
+} from "./http-glue.js";
+
+const DUMMY_RES = {} as ServerResponse;
+
+function makeService(memoryDir: string): EngramAccessService {
+  const config = {
+    location: parseLocationConfig({ enabled: true, timezone: "UTC", sources: [{ id: "reitti" }] }),
+  };
+  return { configRef: config, memoryDir } as unknown as EngramAccessService;
+}
+
+test("status and check respond 200 with the shared runner's disabled/empty semantics", async () => {
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-location-http-"));
+  try {
+    const box: { s?: number; b?: unknown } = {};
+    const respondJson = (_res: ServerResponse, status: number, payload: unknown) => {
+      box.s = status;
+      box.b = payload;
+    };
+    const service = makeService(memoryDir);
+    await respondLocationStatus(DUMMY_RES, respondJson, service);
+    assert.equal(box.s, 200);
+    const report = box.b as { enabled: boolean; sources: Array<{ providerRegistered: boolean }> };
+    assert.equal(report.enabled, true);
+    assert.equal(report.sources[0]?.providerRegistered, false, "absent provider is a skip state");
+
+    await respondLocationCheck(DUMMY_RES, respondJson, service);
+    assert.equal(box.s, 200);
+    const check = box.b as { results: Array<{ id: string; ok: boolean; skipped?: string }> };
+    assert.deepEqual(check.results, [{ id: "reitti", ok: false, skipped: "provider-not-registered" }]);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("invalid sync/backfill/day inputs reject with the SAME messages as the CLI runner", async () => {
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-location-http-invalid-"));
+  const service = makeService(memoryDir);
+  const respondJson = () => {};
+  try {
+    await assert.rejects(
+      () => respondLocationSync({ date: "2026-13-99" }, DUMMY_RES, respondJson, service),
+      (err: unknown) => err instanceof EngramAccessInputError && /date is required \(YYYY-MM-DD\)/.test(err.message),
+    );
+    await assert.rejects(
+      () => respondLocationSync({ days: 0 }, DUMMY_RES, respondJson, service),
+      (err: unknown) => err instanceof EngramAccessInputError && /days expects an integer from 1 to 90/.test(err.message),
+    );
+    await assert.rejects(
+      () => respondLocationBackfill({ from: "2026-08-10", to: "2026-08-01" }, DUMMY_RES, respondJson, service),
+      (err: unknown) => err instanceof EngramAccessInputError && /--from must not be after --to/.test(err.message),
+    );
+    await assert.rejects(
+      () => respondLocationDay(null, DUMMY_RES, respondJson, service),
+      (err: unknown) => err instanceof EngramAccessInputError && /date is required \(YYYY-MM-DD\)/.test(err.message),
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("day responds 404 for an unstored day", async () => {
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-location-http-day-"));
+  try {
+    const box: { s?: number; b?: unknown } = {};
+    const respondJson = (_res: ServerResponse, status: number, payload: unknown) => {
+      box.s = status;
+      box.b = payload;
+    };
+    await respondLocationDay("2026-08-16", DUMMY_RES, respondJson, makeService(memoryDir));
+    assert.equal(box.s, 404);
+    assert.equal((box.b as { found: boolean }).found, false, "unstored day is an explicit not-found");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/location/http-glue.ts

@@ -0,0 +1,85 @@
+/**
+ * Location HTTP route glue (issue #2047) — the `/engram/v1/location/...` (and
+ * `/remnic/v1/...` alias) route bodies, extracted so access-http.ts (size-
+ * grandfathered) keeps only thin route branches (same pattern as
+ * meetings/http-glue.ts). Every responder dispatches through the access
+ * boundary operation — the identical validated path the MCP tools use — so
+ * HTTP and MCP can never diverge on validation or error mapping.
+ * EngramAccessInputError bubbles to the global 400 handler; backend faults
+ * keep flowing to the global 500 handler.
+ */
+
+import type { ServerResponse } from "node:http";
+import { getOperation, type OperationName } from "../access-boundary.js";
+import type { EngramAccessService } from "../access-service.js";
+
+type RespondJson = (res: ServerResponse, status: number, payload: unknown) => void;
+
+function requireLocationOperation(name: OperationName) {
+  const op = getOperation(name);
+  if (!op) {
+    throw new Error(`access-boundary: operation not registered: ${name}`);
+  }
+  return op;
+}
+
+export async function respondLocationStatus(
+  res: ServerResponse,
+  respondJson: RespondJson,
+  service: EngramAccessService,
+): Promise<void> {
+  const output = (await requireLocationOperation("location_status").run({}, { service })) as {
+    result: unknown;
+  };
+  respondJson(res, 200, output.result);
+}
+
+export async function respondLocationCheck(
+  res: ServerResponse,
+  respondJson: RespondJson,
+  service: EngramAccessService,
+): Promise<void> {
+  const output = (await requireLocationOperation("location_check").run({}, { service })) as {
+    result: unknown;
+  };
+  respondJson(res, 200, { results: output.result });
+}
+
+export async function respondLocationSync(
+  body: Record<string, unknown>,
+  res: ServerResponse,
+  respondJson: RespondJson,
+  service: EngramAccessService,
+): Promise<void> {
+  const output = (await requireLocationOperation("location_sync").run(
+    { date: body.date ?? null, days: body.days ?? null },
+    { service },
+  )) as { result: unknown };
+  respondJson(res, 200, output.result);
+}
+
+export async function respondLocationBackfill(
+  body: Record<string, unknown>,
+  res: ServerResponse,
+  respondJson: RespondJson,
+  service: EngramAccessService,
+): Promise<void> {
+  const output = (await requireLocationOperation("location_backfill").run(
+    { from: body.from ?? null, to: body.to ?? null },
+    { service },
+  )) as { result: unknown };
+  respondJson(res, 200, output.result);
+}
+
+export async function respondLocationDay(
+  date: string | null,
+  res: ServerResponse,
+  respondJson: RespondJson,
+  service: EngramAccessService,
+): Promise<void> {
+  const output = (await requireLocationOperation("location_day").run(
+    { date: date ?? null },
+    { service },
+  )) as { result: { found: boolean } & Record<string, unknown> };
+  respondJson(res, output.result.found ? 200 : 404, output.result);
+}

package/src/location/index.ts

@@ -13,4 +13,7 @@ export * from "./config.js";
 export * from "./intervals.js";
 export * from "./store.js";
 export * from "./pipeline.js";
+export * from "./surfaces.js";
+export * from "./provider-setup.js";
+export * from "./scheduler.js";
 export * from "./cli.js";

package/src/location/mcp-tools.ts

@@ -0,0 +1,82 @@
+/**
+ * Location MCP tool definitions (issue #2047) — the five
+ * `engram.location_*` tool-def objects, extracted from access-mcp.ts so the
+ * surface file stays at its structural ceiling (same pattern as
+ * wearables/mcp-tools.ts). Spread back into `this.tools`
+ * (`...LOCATION_MCP_TOOLS`); MCP_MIGRATED_OPERATIONS + boundary dispatch
+ * stay inline in access-mcp.ts. Location is fleet-wide: no namespace arg
+ * (day files live under the memory root, outside every namespace).
+ */
+
+import type { McpTool } from "../access-mcp.js";
+
+export const LOCATION_MCP_TOOLS: McpTool[] = [
+  {
+    name: "engram.location_status",
+    description:
+      "Location sync status: master gate, timezone, per-source provider registration, last sync, and recent stored day counts. Never returns secrets, addresses, coordinates, or place labels.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "engram.location_check",
+    description:
+      "Probe every enabled location provider (auth/connectivity). Reports ok/detail per source; a disabled master gate or source reports a skip reason, never an error.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "engram.location_sync",
+    description:
+      "Sync local-day place observations from every enabled location provider (default: location.syncDays ending yesterday). Same shared runner as the CLI and HTTP surfaces; a forced sync never bypasses the enabled gates or validation. Returns per-day, per-source synced/skipped/failed results.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        date: {
+          type: "string",
+          description: "Optional exclusive-window end day (YYYY-MM-DD, inclusive); defaults to yesterday in location.timezone.",
+        },
+        days: {
+          type: "integer",
+          minimum: 1,
+          maximum: 90,
+          description: "Optional window size (1..90); defaults to location.syncDays.",
+        },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "engram.location_backfill",
+    description:
+      "Sync an explicit historical day range (inclusive, capped at 90 days) for every enabled location provider. Same shared sync runner as location_sync; never makes an unbounded scan.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        from: { type: "string", description: "Range start day (YYYY-MM-DD)." },
+        to: { type: "string", description: "Range end day (YYYY-MM-DD, inclusive)." },
+      },
+      required: ["from", "to"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "engram.location_day",
+    description:
+      "Return one stored location day (place segments per source). Coordinates appear only when location.retainCoordinates is enabled; an unstored day returns found:false.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        date: { type: "string", description: "Day to read (YYYY-MM-DD)." },
+      },
+      required: ["date"],
+      additionalProperties: false,
+    },
+  },
+];

package/src/location/provider-setup.test.ts

@@ -0,0 +1,106 @@
+/**
+ * Provider setup regression (issue #2047): env-credential bootstrapping of
+ * optional provider packages — absent credentials or package are skips
+ * (never errors), tokens never reach logs, and registration is idempotent.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { parseLocationConfig } from "./config.js";
+import { clearLocationProviders, getLocationProvider, registerLocationProvider } from "./registry.js";
+import { ensureConfiguredLocationProviders, type LocationProviderEnv } from "./provider-setup.js";
+import type { LocationProvider } from "./types.js";
+
+const ENV: LocationProviderEnv = {
+  baseUrl: "https://reitti.example.invalid",
+  token: "secret-token",
+  authMode: "x-api-token",
+};
+
+function importModuleDouble(options: { registered: boolean; failWith?: Error }) {
+  const calls: Array<Record<string, unknown>> = [];
+  return {
+    calls,
+    importModule: async () => {
+      if (options.failWith) throw options.failWith;
+      return {
+        ensureReittiProviderRegistered: (opts: Record<string, unknown>) => {
+          calls.push(opts);
+          if (options.registered) {
+            registerLocationProvider({
+              id: "reitti",
+              displayName: "Reitti",
+              verify: async () => ({ ok: true }),
+              fetchObservations: async () => ({ observations: [], nextCursor: null }),
+            } satisfies LocationProvider);
+            return true;
+          }
+          return false;
+        },
+      };
+    },
+  };
+}
+
+test.afterEach(() => clearLocationProviders());
+
+test("registers reitti from env credentials with timezone threaded through", async () => {
+  const config = parseLocationConfig({ enabled: true, timezone: "Europe/Berlin", sources: [{ id: "reitti" }] });
+  const loader = importModuleDouble({ registered: true });
+  const registered = await ensureConfiguredLocationProviders(config, { env: ENV, importModule: loader.importModule });
+  assert.deepEqual(registered, ["reitti"]);
+  assert.ok(getLocationProvider("reitti"));
+  assert.deepEqual(loader.calls, [
+    { baseUrl: ENV.baseUrl, token: ENV.token, timezone: "Europe/Berlin", authMode: "x-api-token" },
+  ]);
+
+  // Idempotent: a second call sees the registry and never re-imports.
+  const registeredAgain = await ensureConfiguredLocationProviders(config, { env: ENV, importModule: loader.importModule });
+  assert.deepEqual(registeredAgain, []);
+  assert.equal(loader.calls.length, 1);
+});
+
+test("missing credentials or disabled config stay unregistered — skip, not error", async () => {
+  const loader = importModuleDouble({ registered: true });
+  const disabled = parseLocationConfig({ enabled: false, sources: [{ id: "reitti" }] });
+  assert.deepEqual(await ensureConfiguredLocationProviders(disabled, { env: ENV, importModule: loader.importModule }), []);
+  assert.equal(loader.calls.length, 0, "disabled config never loads packages");
+
+  const missingToken = await ensureConfiguredLocationProviders(
+    parseLocationConfig({ enabled: true, sources: [{ id: "reitti" }] }),
+    { env: { baseUrl: ENV.baseUrl }, importModule: loader.importModule },
+  );
+  assert.deepEqual(missingToken, []);
+  assert.equal(loader.calls.length, 0, "missing token never loads packages");
+  assert.equal(getLocationProvider("reitti"), undefined);
+});
+
+test("optional package absent (module-not-found naming the specifier) is silent", async () => {
+  const config = parseLocationConfig({ enabled: true, sources: [{ id: "reitti" }] });
+  const registered = await ensureConfiguredLocationProviders(config, {
+    env: ENV,
+    importModule: async () => {
+      throw Object.assign(new Error("Cannot find module '@remnic/connector-reitti'"), { code: "ERR_MODULE_NOT_FOUND" });
+    },
+  });
+  assert.deepEqual(registered, []);
+  assert.equal(getLocationProvider("reitti"), undefined);
+});
+
+test("unknown provider ids and unknown sources are skipped without imports", async () => {
+  const loader = importModuleDouble({ registered: true });
+  const config = parseLocationConfig({ enabled: true, sources: [{ id: "future-provider" }, { id: "reitti", enabled: false }] });
+  assert.deepEqual(await ensureConfiguredLocationProviders(config, { env: ENV, importModule: loader.importModule }), []);
+  assert.equal(loader.calls.length, 0, "unknown + disabled sources never load packages");
+});
+
+test("invalid authMode falls back to the connector default (single header form)", async () => {
+  const loader = importModuleDouble({ registered: true });
+  const config = parseLocationConfig({ enabled: true, sources: [{ id: "reitti" }] });
+  await ensureConfiguredLocationProviders(config, {
+    env: { ...ENV, authMode: "both" },
+    importModule: loader.importModule,
+  });
+  assert.equal("authMode" in (loader.calls[0] ?? {}), false, "invalid mode must not be forwarded");
+});

package/src/location/provider-setup.ts

@@ -0,0 +1,103 @@
+/**
+ * Location provider bootstrapping (issue #2047).
+ *
+ * Core never statically imports a provider package (adapter-isolation test),
+ * so every surface calls this before status/check/sync: it registers
+ * configured providers from optional packages via computed-specifier dynamic
+ * imports, with credentials read from environment variables — tokens never
+ * enter config files, errors, or logs. A source whose package or credentials
+ * are absent stays unregistered and the pipeline reports
+ * `provider-not-registered`; that is a skip reason, never an error (the
+ * connector-reitti package's README contract).
+ */
+
+import { readEnvVar } from "../runtime/env.js";
+import { log } from "../logger.js";
+import { getLocationProvider } from "./registry.js";
+import type { LocationConfig } from "./types.js";
+
+/** Environment shape the setup reads for the `reitti` source. */
+export interface LocationProviderEnv {
+  baseUrl?: string;
+  token?: string;
+  authMode?: string;
+}
+
+export interface LocationProviderSetupDeps {
+  /** Injectable env (tests); defaults to REITTI_* process variables. */
+  env?: LocationProviderEnv;
+  /** Injectable module loader (tests); defaults to a dynamic import. */
+  importModule?: (specifier: string) => Promise<unknown>;
+}
+
+interface ReittiProviderModule {
+  ensureReittiProviderRegistered(options: {
+    baseUrl: string;
+    token: string;
+    timezone: string;
+    authMode?: "x-api-token" | "bearer";
+  }): boolean;
+}
+
+const loadFailuresWarned = new Set<string>();
+
+function readReittiEnv(): LocationProviderEnv {
+  return {
+    baseUrl: readEnvVar("REITTI_BASE_URL"),
+    token: readEnvVar("REITTI_TOKEN"),
+    authMode: readEnvVar("REITTI_AUTH_MODE"),
+  };
+}
+
+/**
+ * Register every configured+enabled source's provider when its optional
+ * package and credentials are available. Idempotent; returns the ids this
+ * call registered. Never throws — a missing package or credential set is
+ * reported downstream as `provider-not-registered`.
+ */
+export async function ensureConfiguredLocationProviders(
+  config: LocationConfig,
+  deps: LocationProviderSetupDeps = {},
+): Promise<string[]> {
+  const registered: string[] = [];
+  if (!config.enabled) return registered;
+  for (const source of config.sources) {
+    if (!source.enabled) continue;
+    if (getLocationProvider(source.id) !== undefined) continue;
+    // ponytail: only the `reitti` built-in exists today; add cases here as
+    // provider packages land — a registry table when there is more than one.
+    if (source.id !== "reitti") continue;
+    const env = deps.env ?? readReittiEnv();
+    const baseUrl = env.baseUrl?.trim();
+    const token = env.token?.trim();
+    if (!baseUrl || !token) continue;
+    const authMode =
+      env.authMode === "x-api-token" || env.authMode === "bearer" ? env.authMode : undefined;
+    const specifier = "@remnic/" + "connector-reitti";
+    const load = deps.importModule ?? ((s: string) => import(s));
+    try {
+      const mod = (await load(specifier)) as ReittiProviderModule;
+      if (
+        mod.ensureReittiProviderRegistered({
+          baseUrl,
+          token,
+          timezone: config.timezone,
+          ...(authMode !== undefined ? { authMode } : {}),
+        })
+      ) {
+        registered.push("reitti");
+      }
+    } catch (err) {
+      // Absent optional package is the common case (skip silently); a real
+      // load failure is worth one warn line, never credentials.
+      const message = err instanceof Error ? err.message : String(err);
+      if (!message.includes(specifier)) {
+        if (!loadFailuresWarned.has(specifier)) {
+          loadFailuresWarned.add(specifier);
+          log.warn(`location: failed to load optional provider package ${specifier}: ${message}`);
+        }
+      }
+    }
+  }
+  return registered;
+}