@rubytech/create-sitedesk-code 0.1.608 → 0.1.609

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/xacct-counters.test.js

@@ -0,0 +1,169 @@
+import { describe, it, expect, beforeEach, vi, afterEach } from "vitest";
+import { noteXacctWriteCall, noteXacctWriteOutcome, readXacctWindow, __resetXacctWindow, formatWriteOutcome, formatXacctCensus, writeOutcomeReason, startXacctCensus, } from "../xacct-counters.js";
+import { INVALID_ACCOUNT_ID_REASON } from "../../../../../../lib/graph-write/dist/index.js";
+// Task 2731 — the two signals that make an allow-then-refuse pair visible.
+//
+// Both halves of the defect were already logged before this task, in one file,
+// and nothing reconciled them: `[xacct] op=call … decision=allow` from the
+// resolver, `[graph-write] reject reason=invalid-account-id` from the gate. The
+// write-outcome line pairs them on one row. The census answers the other
+// question a per-call line cannot: whether the feature is being exercised at
+// all, because a capability nobody invokes reads identically to one that works.
+beforeEach(() => {
+    __resetXacctWindow();
+});
+describe("cross-account write counters", () => {
+    it("starts empty", () => {
+        expect(readXacctWindow()).toEqual({
+            writeCalls: 0,
+            allowed: 0,
+            gatePassed: 0,
+            gateRejected: 0,
+        });
+    });
+    it("counts an allowed call and its passing write", () => {
+        noteXacctWriteCall(true);
+        noteXacctWriteOutcome("passed");
+        expect(readXacctWindow()).toEqual({
+            writeCalls: 1,
+            allowed: 1,
+            gatePassed: 1,
+            gateRejected: 0,
+        });
+    });
+    it("counts a denied call as a call but never as allowed", () => {
+        noteXacctWriteCall(false);
+        expect(readXacctWindow()).toEqual({
+            writeCalls: 1,
+            allowed: 0,
+            gatePassed: 0,
+            gateRejected: 0,
+        });
+    });
+    it("counts a gate rejection separately from a pass", () => {
+        noteXacctWriteCall(true);
+        noteXacctWriteOutcome("rejected");
+        expect(readXacctWindow()).toEqual({
+            writeCalls: 1,
+            allowed: 1,
+            gatePassed: 0,
+            gateRejected: 1,
+        });
+    });
+});
+describe("write-outcome line", () => {
+    it("renders the pass case with reason=none", () => {
+        expect(formatWriteOutcome({
+            tool: "memory-write",
+            caller: "20028fb5-db26-4de7-bff6-c5ec2d4fc766",
+            target: "8a160746-1111-2222-3333-444444444444",
+            gate: "passed",
+            reason: null,
+        })).toBe("[xacct] op=write-outcome tool=memory-write caller=20028fb5 target=8a160746 gate=passed reason=none\n");
+    });
+    it("renders the defect signature: an allowed call the gate refused", () => {
+        expect(formatWriteOutcome({
+            tool: "memory-write",
+            caller: "20028fb5-db26-4de7-bff6-c5ec2d4fc766",
+            target: "8a160746-1111-2222-3333-444444444444",
+            gate: "rejected",
+            reason: "invalid-account-id",
+        })).toBe("[xacct] op=write-outcome tool=memory-write caller=20028fb5 target=8a160746 gate=rejected reason=invalid-account-id\n");
+    });
+    it("names a non-gate failure without claiming the gate refused it", () => {
+        const line = formatWriteOutcome({
+            tool: "memory-write",
+            caller: "20028fb5-db26-4de7-bff6-c5ec2d4fc766",
+            target: "8a160746-1111-2222-3333-444444444444",
+            gate: "passed",
+            reason: "schema-validation",
+        });
+        expect(line).toContain("gate=passed");
+        expect(line).toContain("reason=schema-validation");
+    });
+    it("collapses whitespace in a reason so one failure cannot become two fields", () => {
+        const line = formatWriteOutcome({
+            tool: "memory-write",
+            caller: "20028fb5-db26-4de7-bff6-c5ec2d4fc766",
+            target: "8a160746-1111-2222-3333-444444444444",
+            gate: "passed",
+            reason: "write blocked (system-managed-key)",
+        });
+        // [xacct] op= tool= caller= target= gate= reason= — seven, always.
+        expect(line.trimEnd().split(" ")).toHaveLength(7);
+        expect(line).toContain("reason=write-blocked-(system-managed-key)");
+    });
+});
+describe("reason vocabulary", () => {
+    it("names a gate rejection with the code an operator greps", () => {
+        expect(writeOutcomeReason("rejected", true)).toBe("invalid-account-id");
+    });
+    it("uses the chokepoint's own constant, so the two cannot drift", () => {
+        expect(writeOutcomeReason("rejected", true)).toBe(INVALID_ACCOUNT_ID_REASON);
+    });
+    it("names a non-gate failure without claiming the gate refused it", () => {
+        expect(writeOutcomeReason("passed", true)).toBe("write-failed");
+    });
+    it("is null when the write succeeded", () => {
+        expect(writeOutcomeReason("passed", false)).toBeNull();
+    });
+    it("never yields an error message, whatever the failure", () => {
+        // The whole point: `reason` is a name. A message would carry spaces,
+        // punctuation and an account slice into a field an operator greps by
+        // equality, and match nothing.
+        for (const gate of ["passed", "rejected"]) {
+            const reason = writeOutcomeReason(gate, true);
+            expect(reason).toMatch(/^[a-z-]+$/);
+        }
+    });
+});
+describe("census line", () => {
+    it("renders every counter for the window", () => {
+        expect(formatXacctCensus(1, {
+            writeCalls: 13,
+            allowed: 13,
+            gatePassed: 0,
+            gateRejected: 13,
+        })).toBe("[xacct-census] window=1 writeCalls=13 allowed=13 gatePassed=0 gateRejected=13\n");
+    });
+    it("emits a zero window rather than staying silent", () => {
+        // A quiet period and a broken feature must be distinguishable. Suppressing
+        // the zero line would render them identically.
+        expect(formatXacctCensus(1, readXacctWindow())).toBe("[xacct-census] window=1 writeCalls=0 allowed=0 gatePassed=0 gateRejected=0\n");
+    });
+});
+describe("census timer", () => {
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+    it("emits once per window and resets the counters", () => {
+        vi.useFakeTimers();
+        const emit = vi.fn();
+        const handle = startXacctCensus({ intervalMs: 1000, windowHours: 1, emit });
+        try {
+            noteXacctWriteCall(true);
+            noteXacctWriteOutcome("rejected");
+            vi.advanceTimersByTime(1000);
+            expect(emit).toHaveBeenCalledTimes(1);
+            expect(emit.mock.calls[0][0]).toBe("[xacct-census] window=1 writeCalls=1 allowed=1 gatePassed=0 gateRejected=1\n");
+            vi.advanceTimersByTime(1000);
+            expect(emit.mock.calls[1][0]).toBe("[xacct-census] window=1 writeCalls=0 allowed=0 gatePassed=0 gateRejected=0\n");
+        }
+        finally {
+            clearInterval(handle);
+        }
+    });
+    it("does not hold the MCP child open", () => {
+        // The memory plugin is a stdio child of a session. A referenced timer keeps
+        // the event loop alive, so the child would outlive the session that spawned
+        // it. Real timers here on purpose: a faked handle has no ref to inspect.
+        const handle = startXacctCensus({ intervalMs: 1000, windowHours: 1, emit: vi.fn() });
+        try {
+            expect(handle.hasRef()).toBe(false);
+        }
+        finally {
+            clearInterval(handle);
+        }
+    });
+});
+//# sourceMappingURL=xacct-counters.test.js.map

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/xacct-counters.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xacct-counters.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/xacct-counters.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAE5F,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,yEAAyE;AACzE,6EAA6E;AAC7E,gFAAgF;AAEhF,UAAU,CAAC,GAAG,EAAE;IACd,kBAAkB,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC;YAChC,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC;YAChC,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC;YAChC,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC;YAChC,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,IAAI;SACb,CAAC,CACH,CAAC,IAAI,CACJ,sGAAsG,CACvG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,oBAAoB;SAC7B,CAAC,CACH,CAAC,IAAI,CACJ,sHAAsH,CACvH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,kBAAkB,CAAC;YAC9B,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,mBAAmB;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,IAAI,GAAG,kBAAkB,CAAC;YAC9B,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,oCAAoC;SAC7C,CAAC,CAAC;QACH,mEAAmE;QACnE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,qEAAqE;QACrE,qEAAqE;QACrE,+BAA+B;QAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAU,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CACJ,iBAAiB,CAAC,CAAC,EAAE;YACnB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,EAAE;SACjB,CAAC,CACH,CAAC,IAAI,CACJ,iFAAiF,CAClF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,CAAC,iBAAiB,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAClD,8EAA8E,CAC/E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzB,qBAAqB,CAAC,UAAU,CAAC,CAAC;YAClC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAChC,8EAA8E,CAC/E,CAAC;YACF,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAChC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/memory/mcp/dist/lib/xacct-counters.d.ts

@@ -0,0 +1,63 @@
+export interface XacctWindow {
+    /** Write-tool calls that carried a `targetAccountId`. */
+    writeCalls: number;
+    /** Of those, the ones `resolveToolAccount` authorised. */
+    allowed: number;
+    /** Of those allowed, the ones that got past the graph-write account gate. */
+    gatePassed: number;
+    /** Of those allowed, the ones the account gate refused. Healthy = 0. */
+    gateRejected: number;
+}
+/** Record a cross-account write-tool call and whether the resolver allowed it. */
+export declare function noteXacctWriteCall(allowed: boolean): void;
+/** Record what the graph-write account gate did with an allowed call. */
+export declare function noteXacctWriteOutcome(gate: "passed" | "rejected"): void;
+export declare function readXacctWindow(): XacctWindow;
+/** Test seam. Production resets happen only on a census emit. */
+export declare function __resetXacctWindow(): void;
+export interface WriteOutcome {
+    tool: string;
+    /** The calling session's own account. */
+    caller: string;
+    /** The authorised target account this write was resolved to. */
+    target: string;
+    /**
+     * `rejected` iff the graph-write ACCOUNT gate refused the write. A write that
+     * failed for any other reason got past that gate, so it reads `passed` with
+     * the failure named in `reason` — conflating the two would hide the one
+     * pairing this line exists to catch.
+     */
+    gate: "passed" | "rejected";
+    /** `null` when the write succeeded. */
+    reason: string | null;
+}
+/**
+ * The three names `reason` may take, and nothing else. An operator greps
+ * `reason=invalid-account-id`; an error message pasted into the field would
+ * carry its own punctuation and account slice and match nothing. The detail of a
+ * non-gate failure is already on the `[mcp:memory] … result=error` line for the
+ * same call, so nothing is lost by naming it `write-failed` here.
+ */
+export declare function writeOutcomeReason(gate: "passed" | "rejected", failed: boolean): string | null;
+/**
+ * The paired line. `caller` and `target` are sliced to 8 characters to match the
+ * `[xacct] op=call` line a reader joins this against.
+ */
+export declare function formatWriteOutcome(o: WriteOutcome): string;
+export declare function formatXacctCensus(windowHours: number, w: XacctWindow): string;
+export interface CensusOptions {
+    intervalMs?: number;
+    windowHours?: number;
+    emit?: (line: string) => void;
+}
+/**
+ * Arm the standing census. The returned handle is unref'd: this runs inside a
+ * stdio child of a session, and a referenced timer would keep that child alive
+ * after the session it serves has gone.
+ *
+ * A window with no cross-account calls still emits. Suppressing the zero would
+ * make a quiet period and a dead feature look identical, which is the failure
+ * this census exists to catch.
+ */
+export declare function startXacctCensus(opts?: CensusOptions): NodeJS.Timeout;
+//# sourceMappingURL=xacct-counters.d.ts.map

package/payload/platform/plugins/memory/mcp/dist/lib/xacct-counters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xacct-counters.d.ts","sourceRoot":"","sources":["../../src/lib/xacct-counters.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;CACtB;AASD,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAGzD;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,IAAI,CAGvE;AAED,wBAAgB,eAAe,IAAI,WAAW,CAE7C;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC;AAWD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,uCAAuC;IACvC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,OAAO,GACd,MAAM,GAAG,IAAI,CAMf;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAM1D;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,CAK7E;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,aAAkB,GAAG,MAAM,CAAC,OAAO,CAUzE"}

package/payload/platform/plugins/memory/mcp/dist/lib/xacct-counters.js

@@ -0,0 +1,114 @@
+/**
+ * Cross-account write observability (Task 2731).
+ *
+ * Task 1455 authorises a house-scoped session to write into a sub-account
+ * subgraph; the graph-write account gate then refused that same write because
+ * the stamped account was not the process's own. Both halves were logged, in
+ * one file, and nothing reconciled them — so the feature was broken on every
+ * account and every install for as long as it existed, while the tool
+ * descriptions advertised it.
+ *
+ * Two signals close that. `formatWriteOutcome` pairs the resolver's decision
+ * with the write's fate on one row, so `decision=allow` followed by
+ * `gate=rejected` is a single greppable shape rather than two lines a reader
+ * has to join. `formatXacctCensus` answers the question a per-call line cannot:
+ * whether the capability is being exercised at all, because a feature nobody
+ * invokes reads identically to one that works.
+ *
+ * The counters live here, in the memory MCP child, because that is the process
+ * that observes both halves. A census keyed on grepping `server.log` would go
+ * blind exactly when the install is busiest — `dispatch-tg-census.ts` documents
+ * why. The cost of counting in the child is that the window is per-child: a
+ * short session emits no census at all.
+ *
+ * Only cross-account calls are counted, so `writeCalls=0` means precisely "no
+ * session targeted another account this window", not "no writes happened".
+ */
+import { INVALID_ACCOUNT_ID_REASON } from "../../../../../lib/graph-write/dist/index.js";
+const window = {
+    writeCalls: 0,
+    allowed: 0,
+    gatePassed: 0,
+    gateRejected: 0,
+};
+/** Record a cross-account write-tool call and whether the resolver allowed it. */
+export function noteXacctWriteCall(allowed) {
+    window.writeCalls++;
+    if (allowed)
+        window.allowed++;
+}
+/** Record what the graph-write account gate did with an allowed call. */
+export function noteXacctWriteOutcome(gate) {
+    if (gate === "passed")
+        window.gatePassed++;
+    else
+        window.gateRejected++;
+}
+export function readXacctWindow() {
+    return { ...window };
+}
+/** Test seam. Production resets happen only on a census emit. */
+export function __resetXacctWindow() {
+    window.writeCalls = 0;
+    window.allowed = 0;
+    window.gatePassed = 0;
+    window.gateRejected = 0;
+}
+/**
+ * A log field must never split into two. A reason sourced from an error message
+ * can carry spaces, which would shift every field after it and make the line
+ * unparseable, so whitespace collapses to a single dash.
+ */
+function field(value) {
+    return value.trim().replace(/\s+/g, "-");
+}
+/**
+ * The three names `reason` may take, and nothing else. An operator greps
+ * `reason=invalid-account-id`; an error message pasted into the field would
+ * carry its own punctuation and account slice and match nothing. The detail of a
+ * non-gate failure is already on the `[mcp:memory] … result=error` line for the
+ * same call, so nothing is lost by naming it `write-failed` here.
+ */
+export function writeOutcomeReason(gate, failed) {
+    if (!failed)
+        return null;
+    // Imported, never spelled out again: the operator's grep and the chokepoint's
+    // own reason code must be the same string, and a second literal would let
+    // them drift silently.
+    return gate === "rejected" ? INVALID_ACCOUNT_ID_REASON : "write-failed";
+}
+/**
+ * The paired line. `caller` and `target` are sliced to 8 characters to match the
+ * `[xacct] op=call` line a reader joins this against.
+ */
+export function formatWriteOutcome(o) {
+    return (`[xacct] op=write-outcome tool=${field(o.tool)} caller=${o.caller.slice(0, 8)} ` +
+        `target=${o.target.slice(0, 8)} gate=${o.gate} ` +
+        `reason=${o.reason === null ? "none" : field(o.reason)}\n`);
+}
+export function formatXacctCensus(windowHours, w) {
+    return (`[xacct-census] window=${windowHours} writeCalls=${w.writeCalls} ` +
+        `allowed=${w.allowed} gatePassed=${w.gatePassed} gateRejected=${w.gateRejected}\n`);
+}
+const HOUR_MS = 60 * 60 * 1000;
+/**
+ * Arm the standing census. The returned handle is unref'd: this runs inside a
+ * stdio child of a session, and a referenced timer would keep that child alive
+ * after the session it serves has gone.
+ *
+ * A window with no cross-account calls still emits. Suppressing the zero would
+ * make a quiet period and a dead feature look identical, which is the failure
+ * this census exists to catch.
+ */
+export function startXacctCensus(opts = {}) {
+    const intervalMs = opts.intervalMs ?? HOUR_MS;
+    const windowHours = opts.windowHours ?? intervalMs / HOUR_MS;
+    const emit = opts.emit ?? ((line) => void process.stderr.write(line));
+    const handle = setInterval(() => {
+        emit(formatXacctCensus(windowHours, readXacctWindow()));
+        __resetXacctWindow();
+    }, intervalMs);
+    handle.unref();
+    return handle;
+}
+//# sourceMappingURL=xacct-counters.js.map

package/payload/platform/plugins/memory/mcp/dist/lib/xacct-counters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xacct-counters.js","sourceRoot":"","sources":["../../src/lib/xacct-counters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AAazF,MAAM,MAAM,GAAgB;IAC1B,UAAU,EAAE,CAAC;IACb,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,CAAC;IACb,YAAY,EAAE,CAAC;CAChB,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,MAAM,CAAC,UAAU,EAAE,CAAC;IACpB,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,IAAI,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,UAAU,EAAE,CAAC;;QACtC,MAAM,CAAC,YAAY,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IACnB,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAmBD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA2B,EAC3B,MAAe;IAEf,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,8EAA8E;IAC9E,0EAA0E;IAC1E,uBAAuB;IACvB,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAe;IAChD,OAAO,CACL,iCAAiC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;QAChF,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG;QAChD,UAAU,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,CAAc;IACnE,OAAO,CACL,yBAAyB,WAAW,eAAe,CAAC,CAAC,UAAU,GAAG;QAClE,WAAW,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,UAAU,iBAAiB,CAAC,CAAC,YAAY,IAAI,CACnF,CAAC;AACJ,CAAC;AAQD,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,GAAG,OAAO,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACxD,kBAAkB,EAAE,CAAC;IACvB,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-write-cross-account.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=memory-write-cross-account.test.d.ts.map

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-write-cross-account.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-write-cross-account.test.d.ts","sourceRoot":"","sources":["../../../src/tools/__tests__/memory-write-cross-account.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-write-cross-account.test.js

@@ -0,0 +1,123 @@
+// Task 2731 — a house-scoped session writing into an authorised sub-account.
+//
+// The graph-write account gate runs for real here. Only Neo4j and the embedder
+// are stubbed, so the test exercises the same chain the defect lived on:
+// `memoryWrite` receives the account `resolveToolAccount` authorised, stamps it
+// on the node, and hands it to the chokepoint as `expectedAccountId`. Before
+// this task the last step was missing, the chokepoint fell back to
+// `process.env.ACCOUNT_ID` (the house account), and every cross-account write
+// was allowed by the resolver and then refused by the chokepoint.
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+const HOUSE_ACCOUNT = "20028fb5-db26-4de7-bff6-c5ec2d4fc766";
+const SUB_ACCOUNT = "8a160746-1111-2222-3333-444444444444";
+const TARGET_NODE = "target-element-id";
+let createdProps = null;
+function rec(map) {
+    return { get: (k) => map[k] };
+}
+/** Resolves the edge-target pre-check, the node CREATE, and the edge CREATE. */
+function makeStubSession() {
+    const tx = {
+        run: vi.fn(async (cypher, params = {}) => {
+            if (cypher.includes("RETURN elementId(t) AS id, labels(t) AS labels")) {
+                const ids = params.ids ?? [];
+                return { records: ids.filter((id) => id === TARGET_NODE).map((id) => rec({ id, labels: ["Person"] })) };
+            }
+            if (cypher.includes("CREATE (n:")) {
+                createdProps = params.props;
+                return { records: [rec({ nodeId: "new-node-id", nodeLabels: ["Person"] })] };
+            }
+            return { summary: { counters: { updates: () => ({ relationshipsCreated: 1 }) } } };
+        }),
+    };
+    return {
+        run: vi.fn(async () => ({ records: [] })),
+        close: vi.fn(async () => undefined),
+        executeWrite: async (work) => work(tx),
+    };
+}
+vi.mock("../../lib/neo4j.js", () => ({ getSession: () => makeStubSession() }));
+vi.mock("../../lib/embeddings.js", () => ({ embed: async () => [0.1, 0.2, 0.3] }));
+const { memoryWrite } = await import("../memory-write.js");
+const PERSON = new Set(["Person"]);
+// The smallest validator env that lets a `Person` write through: `Person` is
+// recognised, nothing is a synonym, nothing is forbidden, nothing is required.
+// Schema rules are not what this test is about.
+const VALIDATOR = {
+    schema: {
+        markdownLabels: new Map(),
+        wrongToCorrect: new Map(),
+        forbiddenByLabel: new Map(),
+        documentedCanonicals: [],
+        sourceFiles: ["schema-base.md"],
+        brandVertical: null,
+        relationshipPatterns: [],
+    },
+    liveSource: {
+        liveLabels: () => PERSON,
+        declaredLabels: () => PERSON,
+        recognisedLabels: () => PERSON,
+    },
+};
+const RELATIONSHIPS = [
+    { type: "KNOWS", direction: "outgoing", targetNodeId: TARGET_NODE },
+];
+function write(accountId) {
+    return memoryWrite({
+        labels: ["Person"],
+        properties: { name: "Ada Lovelace" },
+        accountId,
+        scope: "admin",
+        relationships: RELATIONSHIPS,
+        createdBy: { agent: "test-agent", session: "s1", tool: "memory-write" },
+        validator: VALIDATOR,
+    });
+}
+describe("memory-write cross-account gate (Task 2731)", () => {
+    let originalAccountId;
+    beforeEach(() => {
+        createdProps = null;
+        originalAccountId = process.env.ACCOUNT_ID;
+        // The spawning process is the house account, as it is on every real
+        // cross-account call: the sub-account never spawns this child.
+        process.env.ACCOUNT_ID = HOUSE_ACCOUNT;
+    });
+    afterEach(() => {
+        if (originalAccountId === undefined)
+            delete process.env.ACCOUNT_ID;
+        else
+            process.env.ACCOUNT_ID = originalAccountId;
+    });
+    it("writes to an authorised sub-account and stamps that account", async () => {
+        const result = await write(SUB_ACCOUNT);
+        expect(result.nodeId).toBe("new-node-id");
+        expect(createdProps?.accountId).toBe(SUB_ACCOUNT);
+    });
+    it("still writes own-account when the resolver returned the house account", async () => {
+        const result = await write(HOUSE_ACCOUNT);
+        expect(result.nodeId).toBe("new-node-id");
+        expect(createdProps?.accountId).toBe(HOUSE_ACCOUNT);
+    });
+    it("ignores an operator-supplied accountId in the properties bag", async () => {
+        // `memoryWrite` overwrites `properties.accountId` with the authorised
+        // account, so a caller cannot smuggle a different account past the
+        // chokepoint by putting it in the bag. This is also why the red-green
+        // anchor for the gate itself lives in the graph-write suite
+        // (`account-id-gate.test.ts`) rather than here: inside `memoryWrite` the
+        // stamped account and `expectedAccountId` are the same variable, and an
+        // empty one is refused by schema validation before any write, so the two
+        // can never disagree at this layer.
+        const result = await memoryWrite({
+            labels: ["Person"],
+            properties: { name: "Ada Lovelace", accountId: "ffffffff-9999-9999-9999-999999999999" },
+            accountId: SUB_ACCOUNT,
+            scope: "admin",
+            relationships: RELATIONSHIPS,
+            createdBy: { agent: "test-agent", session: "s1", tool: "memory-write" },
+            validator: VALIDATOR,
+        });
+        expect(result.nodeId).toBe("new-node-id");
+        expect(createdProps?.accountId).toBe(SUB_ACCOUNT);
+    });
+});
+//# sourceMappingURL=memory-write-cross-account.test.js.map

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-write-cross-account.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-write-cross-account.test.js","sourceRoot":"","sources":["../../../src/tools/__tests__/memory-write-cross-account.test.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,mEAAmE;AACnE,8EAA8E;AAC9E,kEAAkE;AAElE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEzE,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAC3D,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,IAAI,YAAY,GAAmC,IAAI,CAAC;AAExD,SAAS,GAAG,CAAC,GAA4B;IACvC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe;IACtB,MAAM,EAAE,GAAG;QACT,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,SAAkC,EAAE,EAAE,EAAE;YACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,gDAAgD,CAAC,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAI,MAAM,CAAC,GAAgB,IAAI,EAAE,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1G,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,YAAY,GAAG,MAAM,CAAC,KAAgC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/E,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACrF,CAAC,CAAC;KACH,CAAC;IACF,OAAO;QACL,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;QACnC,YAAY,EAAE,KAAK,EAAM,IAAkC,EAAc,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/E,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAEnF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAE3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnC,6EAA6E;AAC7E,+EAA+E;AAC/E,gDAAgD;AAChD,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE;QACN,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,oBAAoB,EAAE,EAAE;QACxB,WAAW,EAAE,CAAC,gBAAgB,CAAC;QAC/B,aAAa,EAAE,IAAI;QACnB,oBAAoB,EAAE,EAAE;KACzB;IACD,UAAU,EAAE;QACV,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM;QACxB,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM;QAC5B,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM;KAC/B;CACO,CAAC;AAEX,MAAM,aAAa,GAAG;IACpB,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE;CAC3D,CAAC;AAEX,SAAS,KAAK,CAAC,SAAiB;IAC9B,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;QACpC,SAAS;QACT,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,aAAa;QAC5B,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAW;QAChF,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,IAAI,iBAAqC,CAAC;IAE1C,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,GAAG,IAAI,CAAC;QACpB,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3C,oEAAoE;QACpE,+DAA+D;QAC/D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,aAAa,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,iBAAiB,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;;YAC9D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,iBAAiB,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,4DAA4D;QAC5D,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,sCAAsC,EAAE;YACvF,SAAS,EAAE,WAAW;YACtB,KAAK,EAAE,OAAO;YACd,aAAa,EAAE,aAAa;YAC5B,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAW;YAChF,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/xacct-write-gate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=xacct-write-gate.test.d.ts.map

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/xacct-write-gate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xacct-write-gate.test.d.ts","sourceRoot":"","sources":["../../../src/tools/__tests__/xacct-write-gate.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/xacct-write-gate.test.js

@@ -0,0 +1,110 @@
+import { describe, it, expect } from "vitest";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { resolve, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+// Task 2731 — the audit that stops this defect recurring.
+//
+// Task 1455 lets a house-scoped session resolve a sub-account target, and
+// `resolveToolAccount` returns that authorised account. `writeNodeWithEdges`
+// then compares the stamped `accountId` against `process.env.ACCOUNT_ID` unless
+// the caller supplies `expectedAccountId`. A call site that omits it therefore
+// gets `decision=allow` from the resolver and `reason=invalid-account-id` from
+// the gate, one for one, inside a single process — which is how every
+// cross-account memory write failed from Task 1455 until this fix.
+//
+// The guard is static because the failure is a missing argument, not a wrong
+// value: a behavioural test only sees it on the cross-account path, which is
+// exactly the path nobody exercised for the months the defect lived.
+const SRC = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+/** Every `.ts` under `src/`, excluding test files and compiled output. */
+function sourceFiles(dir) {
+    const out = [];
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        if (statSync(full).isDirectory()) {
+            if (entry === "__tests__" || entry === "dist" || entry === "node_modules")
+                continue;
+            out.push(...sourceFiles(full));
+            continue;
+        }
+        if (entry.endsWith(".ts") && !entry.endsWith(".test.ts"))
+            out.push(full);
+    }
+    return out;
+}
+/**
+ * The argument list of every `writeNodeWithEdges({ ... })` call in `src`, as
+ * `{ file, args }`. The call is always written as a single object literal, so
+ * the extent is found by counting braces from the opening `{` — no parser, and
+ * no line-window heuristic that a longer call would silently outgrow.
+ */
+function writeCallSites() {
+    const sites = [];
+    for (const file of sourceFiles(SRC)) {
+        const src = readFileSync(file, "utf8");
+        const needle = "writeNodeWithEdges({";
+        let from = 0;
+        for (;;) {
+            const at = src.indexOf(needle, from);
+            if (at === -1)
+                break;
+            let depth = 0;
+            let end = at + needle.length - 1;
+            for (let i = end; i < src.length; i++) {
+                if (src[i] === "{")
+                    depth++;
+                else if (src[i] === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        end = i;
+                        break;
+                    }
+                }
+            }
+            sites.push({ file, args: src.slice(at, end + 1) });
+            from = at + needle.length;
+        }
+    }
+    return sites;
+}
+/** Every `writeNodeWithEdges(` invocation, whatever the argument's formatting. */
+function totalInvocations() {
+    let n = 0;
+    for (const file of sourceFiles(SRC)) {
+        // The import binding is not an invocation.
+        n += (readFileSync(file, "utf8").match(/writeNodeWithEdges\(/g) ?? []).length;
+    }
+    return n;
+}
+describe("cross-account write gate (Task 2731)", () => {
+    it("finds the memory plugin's writeNodeWithEdges call sites", () => {
+        // A zero-site pass would make every assertion below vacuous: the guard
+        // could not tell "all call sites are correct" from "the call moved and this
+        // test stopped measuring anything".
+        expect(writeCallSites().length).toBeGreaterThan(0);
+    });
+    it("matches every invocation, so no call site can slip past unmeasured", () => {
+        // The extent scan keys on `writeNodeWithEdges({`. A call formatted with a
+        // line break before the brace would not match, and the assertions below
+        // would quietly stop covering it — the exact silent-gap failure this guard
+        // exists to prevent. Counting invocations independently turns that into a
+        // failure instead.
+        expect(writeCallSites().length).toBe(totalInvocations());
+    });
+    it("passes expectedAccountId at every writeNodeWithEdges call site", () => {
+        const missing = writeCallSites()
+            .filter((s) => !/\bexpectedAccountId\s*:/.test(s.args))
+            .map((s) => s.file.slice(SRC.length + 1));
+        expect(missing).toEqual([]);
+    });
+    it("passes the resolved account, never the process env, as expectedAccountId", () => {
+        // `process.env.ACCOUNT_ID` is the house account on a cross-account call.
+        // Passing it explicitly would restore the exact defect while satisfying the
+        // presence check above.
+        const wrong = writeCallSites()
+            .filter((s) => /expectedAccountId\s*:\s*process\.env/.test(s.args))
+            .map((s) => s.file.slice(SRC.length + 1));
+        expect(wrong).toEqual([]);
+    });
+});
+//# sourceMappingURL=xacct-write-gate.test.js.map

package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/xacct-write-gate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xacct-write-gate.test.js","sourceRoot":"","sources":["../../../src/tools/__tests__/xacct-write-gate.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,0DAA0D;AAC1D,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AACtE,mEAAmE;AACnE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,qEAAqE;AACrE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEtE,0EAA0E;AAC1E,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,cAAc;gBAAE,SAAS;YACpF,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc;IACrB,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,sBAAsB,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,SAAS,CAAC;YACR,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,MAAM;YACrB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACjC,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBACvB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,KAAK,EAAE,CAAC;oBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;wBAChB,GAAG,GAAG,CAAC,CAAC;wBACR,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB;IACvB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,2CAA2C;QAC3C,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,uEAAuE;QACvE,4EAA4E;QAC5E,oCAAoC;QACpC,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,mBAAmB;QACnB,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,OAAO,GAAG,cAAc,EAAE;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,yEAAyE;QACzE,4EAA4E;QAC5E,wBAAwB;QACxB,MAAM,KAAK,GAAG,cAAc,EAAE;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAClE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/memory/mcp/dist/tools/memory-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-write.d.ts","sourceRoot":"","sources":["../../src/tools/memory-write.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAoB9E,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACf,MAAM,8CAA8C,CAAC;AAEtD,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6HAA6H;IAC7H,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,+EAA+E;IAC/E,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,SAAS,EAAE,YAAY,CAAC;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AA+CD,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAS3E;AA4XD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EAAE,EAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,CAYR"}
+{"version":3,"file":"memory-write.d.ts","sourceRoot":"","sources":["../../src/tools/memory-write.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAoB9E,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACf,MAAM,8CAA8C,CAAC;AAEtD,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6HAA6H;IAC7H,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,+EAA+E;IAC/E,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,SAAS,EAAE,YAAY,CAAC;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AA+CD,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAS3E;AAmYD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EAAE,EAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,CAYR"}