@segmentstream/agent 0.5.0 → 0.5.1

package/dist/extension/lib/attachment-tools.d.ts

@@ -5,14 +5,15 @@ import { type Environment } from "./environment.js";
 import { type RuntimeToken } from "./runtime-token.js";
 /**
  * What the `segmentstream__attachments_*` tools share. The owner of every call comes from the turn:
- * the member and chat on the session's principal, which the channel set from the pairing, and the
- * session's own id. A tool's arguments name only the attachment and what to do with it.
+ * the member and chat on the session's principal, which the channel set from the pairing or a
+ * verified member request, and the session's own id. A tool's arguments name only the attachment
+ * and what to do with it.
  */
 /** Maximum characters in a read/query response; remaining data is available by continuation. */
 export declare const MAXIMUM_TEXT_CHARACTERS = 50000;
 /** The largest file `attachments_read` hands the model inline. */
 export declare const MAXIMUM_INLINE_BYTES: number;
-/** The turn has no member and chat to own attachments, such as a caller who never paired. */
+/** The turn has no member and chat to authorize attachments. */
 export declare class AttachmentOwnerError extends Error {
     readonly name = "AttachmentOwnerError";
 }

package/dist/extension/lib/attachment-tools.mjs

@@ -17,9 +17,11 @@ var AttachmentOwnerError = class extends Error {
 	name = "AttachmentOwnerError";
 };
 function attachmentOwner(input) {
-	const memberId = memberIdOf(input.principal);
+	const attributes = input.principal?.attributes;
+	const requesterId = attributes?.requesterKind === "member" && attributes.chatType === "group" ? attributes.requesterId : void 0;
+	const memberId = memberIdOf(input.principal) ?? (typeof requesterId === "string" ? requesterId : void 0);
 	const chatId = input.principal?.attributes.chatId;
-	if (memberId === void 0 || typeof chatId !== "string" || chatId === "") throw new AttachmentOwnerError("Attachments are available only to a paired member in a chat with the agent.");
+	if (memberId === void 0 || memberId === "" || typeof chatId !== "string" || chatId === "") throw new AttachmentOwnerError("Attachments require a workspace member in a chat with the agent.");
 	return {
 		memberId,
 		conversation: telegramConversation(chatId),

package/dist/extension/lib/attachments.d.ts

@@ -2,7 +2,7 @@ import type { RuntimeToken } from "./runtime-token.js";
 /**
  * The ontology service's attachment routes (`docs/agent.md`, "Attachments"). A file a member sends
  * the agent is stored once in the workspace's private file storage, for 24 hours, and belongs to
- * that member, the chat it arrived in and the agent session that first reads it. The agent calls
+ * the chat's authorized members in groups, or its sender and session in private chats. The agent calls
  * these routes as the deployment, with its OIDC token, naming the member, the chat and the session
  * from the turn's own context; nothing a model writes reaches these headers.
  */
@@ -14,7 +14,7 @@ export declare const CONVERSATION_HEADER = "X-SegmentStream-Agent-Conversation";
 export declare const SESSION_HEADER = "X-SegmentStream-Agent-Session";
 /** The URL protocol of a file part that names a stored attachment instead of a Telegram file. */
 export declare const ATTACHMENT_URL_PROTOCOL = "segmentstream-attachment:";
-/** Whose attachment it is, from the turn: the member, the chat and the agent session. */
+/** Who asks for attachment access, from the turn: the member, chat and agent session. */
 export interface AttachmentOwner {
     readonly memberId: string;
     /** The chat, such as `telegram:12345`. */

package/dist/extension/lib/telegram/files.mjs

@@ -68,7 +68,7 @@ async function stageFiles(input) {
 }
 function attachmentsContext(input) {
 	if (input.files.size === 0) return [];
-	const lines = ["<attachments>", `The member's files from this message, kept for 24 hours for this member in this chat only. Read, discard or promote them with the segmentstream__attachments_* tools and these ids; promote only what should be kept.`];
+	const lines = ["<attachments>", `Files from this message, kept for 24 hours ` + (input.group ? "for authorized members of this group only. " : "for this member in this private chat only. ") + "Read, discard or promote them with the segmentstream__attachments_* tools and these ids; promote only what should be kept."];
 	for (const staged of input.files.values()) lines.push(staged.status === "stored" ? `- id: ${staged.attachment.id}, filename: ${JSON.stringify(staged.attachment.filename)}, type: ${staged.attachment.contentType}, size: ${staged.attachment.size} bytes, expires_at: ${staged.attachment.expiresAt}` : `- ${JSON.stringify(staged.filename)}: not received, ${staged.reason}`);
 	if (input.group) lines.push("This is a group chat: everyone in it shares this conversation's history, so do not repeat a private file's contents here. Suggest sending private files in a direct message.");
 	lines.push("</attachments>");

package/dist/extension/lib/telegram/inbound.mjs

@@ -284,6 +284,7 @@ async function handleInboundMessage(input) {
 		dependencies.sessionPolicy.delivered(address);
 	}
 	await context.telegram.startTyping();
+	await report;
 	const files = sent.attachments.length === 0 || dependencies.attachments === void 0 || input.request === void 0 ? new Map() : await stageFiles({
 		message: sent,
 		memberId: lookup.member.id,
@@ -291,7 +292,6 @@ async function handleInboundMessage(input) {
 		download: dependencies.download
 	});
 	if (input.request !== void 0 && files.size > 0) input.request.files = files;
-	await report;
 	dependencies.observed.remember(chat, observedMessage(sent, text, lookup.member));
 	const principal = telegramPrincipal({
 		message: sent,

package/dist/extension/lib/telegram/requests.mjs

@@ -76,6 +76,7 @@ function requestPrincipal(request) {
 		subject: requester.id,
 		attributes: {
 			requesterId: requester.id,
+			requesterKind: requester.kind,
 			requesterName: requester.name,
 			roles: requester.roles,
 			chatId: target.chatId,
@@ -94,7 +95,10 @@ function requestContext(request) {
 		"If the addressed person has a linked Telegram username, mention them with @username; otherwise address them by name without a tag. Never invent a username."
 	];
 	if (request.documentIds !== void 0 && request.documentIds.length > 0) lines.push(`documentIds: ${JSON.stringify(request.documentIds)}`, "Send these documents with the question using segmentstream__attachments_send in this chat. Use the question as the caption (at most 1024 characters), one question per message. In groups send documents only when the chat's purpose allows; never send restricted documents there.");
-	if (requester.kind === "service" || !requester.actAs) lines.push(`${requester.kind === "service" ? "The requester is a service, not a member" : "The requester has not paired a Telegram account with the agent"}, so this turn runs without a member and the ontology is not available in it. Each member who replies acts with their own permissions.`);
+	if (requester.kind === "service" || !requester.actAs) {
+		lines.push(`${requester.kind === "service" ? "The requester is a service, not a member" : "The requester has not paired a Telegram account with the agent"}, so this turn runs without a member and the ontology is not available in it. Each member who replies acts with their own permissions.`);
+		if (requester.kind === "member" && request.target.kind === "group") lines.push("Temporary attachments in this group are available through segmentstream__attachments_* when the requester is a current chat participant or chat administrator. Promotion still requires the requester's permission for the target ontology action.");
+	}
 	lines.push("</agent_request>");
 	return lines.join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream/agent",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Mount a SegmentStream workspace's agent on eve: the ontology as tools, acting as the member who writes, and Telegram through the workspace's connection.",
   "license": "Apache-2.0",
   "author": "SegmentStream",