@spinabot/brigade 0.1.2 → 1.0.1

package/dist/agents/tools/manage-channel-access-tool.js

@@ -0,0 +1,144 @@
+/**
+ * `manage_channel_access` — owner-only channel GROUP access control.
+ *
+ * The sanctioned, model-agnostic path for changing who the crew answers in
+ * group chats (WhatsApp / Slack / …). It reads/writes the `channels.<channel>`
+ * slice of brigade.json — `groupPolicy`, `groupAllowFrom`, `groupAllowJids`,
+ * `groupFollowUpWindowMs` — so the operator can say "be live in this group" or
+ * "stop making me tag you" and the crew does it, instead of hand-editing
+ * brigade.json (which the config-write guard refuses).
+ *
+ * Owner-gated (`ownerOnly: true`) — only the operator can move a security
+ * boundary. Writes the CONFIG layer only (same scope as a manual edit); the
+ * runtime list is the union of this + the file store in access-control/store.
+ */
+import { Type } from "typebox";
+import { loadConfig } from "../../core/config.js";
+import { mutateConfigAtomic } from "../../config/io.js";
+import { jsonResult } from "./common.js";
+const GROUP_POLICIES = ["disabled", "open", "allowlist", "pairing"];
+const ManageChannelAccessParams = Type.Object({
+    action: Type.Union([Type.Literal("show"), Type.Literal("set")], {
+        description: "show: print the channel's current group-access settings. set: change one or more of them (pass only what you want to change).",
+    }),
+    channel: Type.Optional(Type.String({
+        description: 'Channel id under config.channels (default "whatsapp").',
+        minLength: 1,
+        maxLength: 64,
+    })),
+    groupPolicy: Type.Optional(Type.Union(GROUP_POLICIES.map((p) => Type.Literal(p)), {
+        description: "channels.<ch>.groupPolicy. disabled=never respond in groups; open=respond when addressed; allowlist=only listed senders (default); pairing=degraded to allowlist in groups.",
+    })),
+    addAllowFrom: Type.Optional(Type.String({ description: "Sender id (phone / @lid) to ADD to groupAllowFrom.", maxLength: 256 })),
+    removeAllowFrom: Type.Optional(Type.String({ description: "Sender id to REMOVE from groupAllowFrom.", maxLength: 256 })),
+    addAllowJid: Type.Optional(Type.String({
+        description: "Group JID (…@g.us) to ADD to groupAllowJids — a FULLY-TRUSTED group the crew answers untagged. `*` = every group.",
+        maxLength: 256,
+    })),
+    removeAllowJid: Type.Optional(Type.String({ description: "Group JID to REMOVE from groupAllowJids.", maxLength: 256 })),
+    groupFollowUpWindowMs: Type.Optional(Type.Number({
+        description: "channels.<ch>.groupFollowUpWindowMs — after a member addresses the crew (mention / reply-to-bot), their untagged follow-ups count for this many ms. 0 = off (tag every message).",
+    })),
+});
+export function makeManageChannelAccessTool() {
+    return {
+        name: "manage_channel_access",
+        label: "Manage Channel Access",
+        displaySummary: "managing channel group access",
+        ownerOnly: true,
+        description: [
+            "Owner-only channel GROUP access control. Read or change who the crew answers in WhatsApp/Slack/etc. group chats — NEVER hand-edit brigade.json (the guard refuses it).",
+            "show: returns {groupPolicy, groupAllowFrom, groupAllowJids, groupFollowUpWindowMs} for the channel (default whatsapp).",
+            "set: change groupPolicy (disabled|open|allowlist|pairing), add/remove a sender via addAllowFrom/removeAllowFrom, add/remove a fully-trusted group JID via addAllowJid/removeAllowJid (so the crew answers untagged there), or set groupFollowUpWindowMs (tag-once-then-continue window). Pass only what changes.",
+            "Call ONLY on explicit operator request; report exactly what changed.",
+        ].join(" "),
+        parameters: ManageChannelAccessParams,
+        execute: async (_toolCallId, args) => {
+            const channel = (args.channel ?? "whatsapp").trim().toLowerCase() || "whatsapp";
+            if (args.action === "show") {
+                const snap = readChannelSnapshot(loadConfig(), channel);
+                return jsonResult({
+                    action: "show",
+                    ok: true,
+                    settings: snap,
+                    message: describeSnapshot(snap),
+                });
+            }
+            // action === "set"
+            const wantsPolicy = args.groupPolicy !== undefined;
+            const wantsWindow = args.groupFollowUpWindowMs !== undefined;
+            const addFrom = (args.addAllowFrom ?? "").trim();
+            const remFrom = (args.removeAllowFrom ?? "").trim();
+            const addJid = (args.addAllowJid ?? "").trim();
+            const remJid = (args.removeAllowJid ?? "").trim();
+            if (!wantsPolicy && !wantsWindow && !addFrom && !remFrom && !addJid && !remJid) {
+                return jsonResult({
+                    action: "set",
+                    ok: false,
+                    message: "manage_channel_access set: nothing to change — pass groupPolicy / addAllowFrom / removeAllowFrom / addAllowJid / removeAllowJid / groupFollowUpWindowMs.",
+                });
+            }
+            const before = readChannelSnapshot(loadConfig(), channel);
+            const next = await mutateConfigAtomic((current) => {
+                const merged = { ...current };
+                const channels = {
+                    ...(merged.channels ?? {}),
+                };
+                const entry = { ...(channels[channel] ?? {}) };
+                if (wantsPolicy)
+                    entry.groupPolicy = args.groupPolicy;
+                if (wantsWindow)
+                    entry.groupFollowUpWindowMs = args.groupFollowUpWindowMs;
+                if (addFrom || remFrom)
+                    entry.groupAllowFrom = mutateList(entry.groupAllowFrom, addFrom, remFrom);
+                if (addJid || remJid)
+                    entry.groupAllowJids = mutateList(entry.groupAllowJids, addJid, remJid);
+                channels[channel] = entry;
+                merged.channels = channels;
+                return merged;
+            });
+            const after = readChannelSnapshot(next, channel);
+            return jsonResult({
+                action: "set",
+                ok: true,
+                before,
+                after,
+                message: `Updated channel "${channel}" group access. ${describeSnapshot(after)} Takes effect on new inbound — no restart needed.`,
+            });
+        },
+    };
+}
+/* ───────────────────────────── helpers ───────────────────────────── */
+/** Add/remove an entry idempotently (remove first, then add-if-absent). */
+function mutateList(raw, add, remove) {
+    const list = Array.isArray(raw) ? raw.map((x) => String(x)) : [];
+    let out = [...list];
+    if (remove)
+        out = out.filter((x) => x !== remove);
+    if (add && !out.includes(add))
+        out.push(add);
+    return out;
+}
+function readChannelSnapshot(cfg, channel) {
+    const entry = cfg.channels?.[channel] ?? {};
+    const list = (v) => Array.isArray(v) ? v.map((x) => String(x).trim()).filter(Boolean) : [];
+    return {
+        channel,
+        groupPolicy: typeof entry.groupPolicy === "string" ? entry.groupPolicy : "allowlist",
+        groupAllowFrom: list(entry.groupAllowFrom),
+        groupAllowJids: list(entry.groupAllowJids),
+        groupFollowUpWindowMs: typeof entry.groupFollowUpWindowMs === "number" ? entry.groupFollowUpWindowMs : 0,
+    };
+}
+function describeSnapshot(s) {
+    const jids = s.groupAllowJids.length === 1 && s.groupAllowJids[0] === "*"
+        ? "every group"
+        : `${s.groupAllowJids.length} group(s)`;
+    return [
+        `groupPolicy=${s.groupPolicy}`,
+        `groupAllowFrom=${s.groupAllowFrom.length} sender(s)`,
+        `groupAllowJids=${jids}`,
+        `groupFollowUpWindowMs=${s.groupFollowUpWindowMs}`,
+    ].join(", ").concat(".");
+}
+//# sourceMappingURL=manage-channel-access-tool.js.map

package/dist/agents/tools/manage-channel-access-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-channel-access-tool.js","sourceRoot":"","sources":["../../../src/agents/tools/manage-channel-access-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;AAE7E,MAAM,yBAAyB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE;QAC/D,WAAW,EACV,+HAA+H;KAChI,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,wDAAwD;QACrE,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;KACb,CAAC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,KAAK,CACT,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAC1C;QACC,WAAW,EACV,6KAA6K;KAC9K,CACD,CACD;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,oDAAoD,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAClG;IACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CACxF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,mHAAmH;QAChI,SAAS,EAAE,GAAG;KACd,CAAC,CACF;IACD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CACxF;IACD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CACnC,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EACV,kLAAkL;KACnL,CAAC,CACF;CACD,CAAC,CAAC;AAmBH,MAAM,UAAU,2BAA2B;IAI1C,OAAO;QACN,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,cAAc,EAAE,+BAA+B;QAC/C,SAAS,EAAE,IAAI;QACf,WAAW,EAAE;YACZ,wKAAwK;YACxK,wHAAwH;YACxH,kTAAkT;YAClT,sEAAsE;SACtE,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,UAAU,EAAE,yBAAyB;QACrC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAuD,EAAE;YACzF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC;YAEhF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,EAAmB,EAAE,OAAO,CAAC,CAAC;gBACzE,OAAO,UAAU,CAAC;oBACjB,MAAM,EAAE,MAAM;oBACd,EAAE,EAAE,IAAI;oBACR,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC;iBACK,CAA+C,CAAC;YACtF,CAAC;YAED,mBAAmB;YACnB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC;YACnD,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;YAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChF,OAAO,UAAU,CAAC;oBACjB,MAAM,EAAE,KAAK;oBACb,EAAE,EAAE,KAAK;oBACT,OAAO,EACN,0JAA0J;iBACvH,CAA+C,CAAC;YACtF,CAAC;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAmB,EAAE,OAAO,CAAC,CAAC;YAE3E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,CAAC,OAAsB,EAAE,EAAE;gBAChE,MAAM,MAAM,GAAkB,EAAE,GAAG,OAAO,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG;oBAChB,GAAG,CAAE,MAAiD,CAAC,QAAQ,IAAI,EAAE,CAAC;iBAC3B,CAAC;gBAC7C,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAA6B,CAAC;gBAE1E,IAAI,WAAW;oBAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;gBACtD,IAAI,WAAW;oBAAE,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CAAC;gBAC1E,IAAI,OAAO,IAAI,OAAO;oBAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAClG,IAAI,MAAM,IAAI,MAAM;oBAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAE9F,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;gBACzB,MAAkC,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACxD,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAqB,EAAE,OAAO,CAAC,CAAC;YAClE,OAAO,UAAU,CAAC;gBACjB,MAAM,EAAE,KAAK;gBACb,EAAE,EAAE,IAAI;gBACR,MAAM;gBACN,KAAK;gBACL,OAAO,EAAE,oBAAoB,OAAO,mBAAmB,gBAAgB,CAAC,KAAK,CAAC,mDAAmD;aAC7F,CAA+C,CAAC;QACtF,CAAC;KACD,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,2EAA2E;AAC3E,SAAS,UAAU,CAAC,GAAY,EAAE,GAAW,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACpB,IAAI,MAAM;QAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;IAClD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAkB,EAAE,OAAe;IAC/D,MAAM,KAAK,GAAI,GAA8D,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACxG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CACrC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO;QACN,OAAO;QACP,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;QACpF,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAC1C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAC1C,qBAAqB,EAAE,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;KACxG,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAwB;IACjD,MAAM,IAAI,GACT,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,GAAG;QAC3D,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,WAAW,CAAC;IAC1C,OAAO;QACN,eAAe,CAAC,CAAC,WAAW,EAAE;QAC9B,kBAAkB,CAAC,CAAC,cAAc,CAAC,MAAM,YAAY;QACrD,kBAAkB,IAAI,EAAE;QACxB,yBAAyB,CAAC,CAAC,qBAAqB,EAAE;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC"}

package/dist/agents/tools/manage-memory-tool.d.ts

@@ -0,0 +1,30 @@
+import { Type } from "typebox";
+import { type RelinkLlm } from "../memory/relationship-extract.js";
+import type { BrigadeTool } from "./types.js";
+declare const Params: Type.TObject<{
+    action: Type.TUnion<[Type.TLiteral<"dream">, Type.TLiteral<"purge">, Type.TLiteral<"inspect">, Type.TLiteral<"export">, Type.TLiteral<"retention">, Type.TLiteral<"vault">, Type.TLiteral<"propose">, Type.TLiteral<"retract">, Type.TLiteral<"restore">, Type.TLiteral<"relink">]>;
+    memory_id: Type.TOptional<Type.TString>;
+    ttl_days: Type.TOptional<Type.TNumber>;
+}>;
+interface ManageMemoryResult {
+    action: "dream" | "purge" | "inspect" | "export" | "retention" | "vault" | "propose" | "retract" | "restore" | "relink";
+    ok: boolean;
+    message: string;
+    [key: string]: unknown;
+}
+/**
+ * Optional injection for the `relink` action — the tool-less isolated LLM that judges
+ * relationships. Production wires this to a `makeIsolatedLlm(RELINK_PROMPT, …)` runner
+ * (one model call per fact-window, only on an explicit operator `relink`); when absent
+ * (the bare `makeManageMemoryTool(dir)` used by most call sites + tests) the action
+ * reports that relink isn't available rather than fabricating edges. Tests inject a stub.
+ */
+export interface ManageMemoryDeps {
+    relinkLlm?: RelinkLlm;
+    /** The owning agent id — lets `relink` resolve the gateway's boot-wired LLM
+     *  factory when no `relinkLlm` is injected directly. Defaults to "main". */
+    agentId?: string;
+}
+export declare function makeManageMemoryTool(workspaceDir: string, deps?: ManageMemoryDeps): BrigadeTool<typeof Params, ManageMemoryResult>;
+export {};
+//# sourceMappingURL=manage-memory-tool.d.ts.map

package/dist/agents/tools/manage-memory-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-memory-tool.d.ts","sourceRoot":"","sources":["../../../src/agents/tools/manage-memory-tool.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAM/B,OAAO,EAAE,KAAK,SAAS,EAAmC,MAAM,mCAAmC,CAAC;AAyBpG,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,YAAY,CAAC;AAI/D,QAAA,MAAM,MAAM;;;;EA4BV,CAAC;AAEH,UAAU,kBAAkB;IAC3B,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACxH,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAChC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;gFAC4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,oBAAoB,CACnC,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE,gBAAqB,GACzB,WAAW,CAAC,OAAO,MAAM,EAAE,kBAAkB,CAAC,CAgPhD"}

package/dist/agents/tools/manage-memory-tool.js

@@ -0,0 +1,309 @@
+// src/agents/tools/manage-memory-tool.ts
+//
+// `manage_memory` — the operator's owner-gated handle on Tideline's Phase-3
+// maintenance + governance (the live surface for the dream / purge / inspect /
+// export / retention behaviours that are otherwise library-only). Operates on
+// the OWNER origin (it's ownerOnly), constructing a FactStore over the agent's
+// workspace exactly like the rest of the memory path — so it works in both
+// filesystem and convex modes.
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { Type } from "typebox";
+import { tryGetRuntimeContext } from "../../storage/runtime-context.js";
+import { runDream } from "../memory/dream.js";
+import { applyRetention, exportMemory, inspect, purge } from "../memory/governance.js";
+import { FactStore } from "../memory/records.js";
+import { resolveRelinkLlm, runRelinkPass } from "../memory/relationship-extract.js";
+import { applyProposal, approve, proposeFromTelemetry, revertProposal } from "../memory/self-improve.js";
+import { writeVault } from "../memory/vault.js";
+const OWNER_ORIGIN = { kind: "owner" };
+/**
+ * After a destructive shred (purge / retention) in FILESYSTEM mode, re-render + prune
+ * the markdown vault so the shredded fact's PLAINTEXT note can't linger on disk — the
+ * integrity counterpart to the crypto-shred. No-op when the vault was never created, or
+ * in convex mode (no disk vault). Best-effort: a vault write failure must not fail the
+ * shred that already succeeded (a stale note is the lesser problem, surfaced on next render).
+ */
+function repruneVaultAfterShred(workspaceDir, store) {
+    if (tryGetRuntimeContext()?.mode === "convex")
+        return;
+    const dir = path.join(workspaceDir, "memory-vault");
+    if (!fs.existsSync(dir))
+        return;
+    try {
+        writeVault(dir, store.listForVault(OWNER_ORIGIN), { prune: true });
+    }
+    catch {
+        /* best-effort */
+    }
+}
+import { jsonResult } from "./common.js";
+const OWNER = { kind: "owner" };
+const Params = Type.Object({
+    action: Type.Union([
+        Type.Literal("dream"),
+        Type.Literal("purge"),
+        Type.Literal("inspect"),
+        Type.Literal("export"),
+        Type.Literal("retention"),
+        Type.Literal("vault"),
+        Type.Literal("propose"),
+        Type.Literal("retract"),
+        Type.Literal("restore"),
+        Type.Literal("relink"),
+    ], {
+        description: "dream: run a reflection pass (confirm repeated beliefs, merge duplicates, evict decayed). " +
+            "purge: crypto-shred a fact AND everything derived from it (irreversible). " +
+            "inspect: a fact's links/backlinks/provenance. export: dump your facts. " +
+            "retention: hard-purge facts older than ttl_days (confirmed beliefs retained). " +
+            "vault: write your memory out as an Obsidian-style markdown vault (preserves your hand edits). " +
+            "propose: review behaviour-change suggestions drawn from your feedback. " +
+            "retract: stop acting on a fact (reversible). restore: undo a retract. " +
+            "relink: one LLM pass over your active facts that links genuinely-related ones (rebuilds the meaning graph).",
+    }),
+    memory_id: Type.Optional(Type.String({ description: "fact id — required for purge / inspect / retract / restore", maxLength: 128 })),
+    ttl_days: Type.Optional(Type.Number({ description: "retention age threshold in days — required for action=retention", minimum: 1 })),
+});
+export function makeManageMemoryTool(workspaceDir, deps = {}) {
+    const result = (r) => jsonResult(r);
+    return {
+        name: "manage_memory",
+        label: "Manage memory",
+        displaySummary: "managing long-term memory",
+        ownerOnly: true,
+        description: [
+            "Maintain + govern your long-term memory (owner only).",
+            "action 'dream': run a reflection pass now — promote a repeatedly-asserted/corrected belief to a confirmed preference, merge near-duplicates, evict decayed facts.",
+            "action 'purge': permanently crypto-shred the fact with `memory_id` AND every fact derived from it (no undo).",
+            "action 'inspect': show `memory_id`'s content, typed links, backlinks, and citation graph.",
+            "action 'export': dump all your stored facts.",
+            "action 'retention': hard-purge facts older than `ttl_days` (confirmed beliefs are kept).",
+            "action 'vault': save your memory as an Obsidian-style markdown vault, preserving your hand-pinned edits.",
+            "action 'propose': review behaviour-change suggestions drawn from your feedback (down-votes); review-only.",
+            "action 'retract': reversibly stop acting on the fact with `memory_id`. action 'restore': undo a retract.",
+            "action 'relink': run ONE LLM pass over your active facts and link the genuinely-related ones (semantic `relates` edges) — rebuilds the meaning graph; idempotent.",
+            "Call only on an explicit operator request.",
+        ].join(" "),
+        parameters: Params,
+        execute: async (_toolCallId, args) => {
+            const store = new FactStore(workspaceDir);
+            switch (args.action) {
+                case "dream": {
+                    const r = runDream(store, { origin: OWNER });
+                    return result({
+                        action: "dream",
+                        ok: true,
+                        confirmed: r.confirmed.length,
+                        consolidated: r.consolidated.length,
+                        evicted: r.evicted.length,
+                        reflected: r.reflected,
+                        message: `Reflection done: ${r.confirmed.length} confirmed, ${r.consolidated.length} merged, ${r.evicted.length} evicted (of ${r.reflected} active).`,
+                    });
+                }
+                case "purge": {
+                    if (!args.memory_id)
+                        return result({ action: "purge", ok: false, message: "memory_id is required for purge." });
+                    const r = purge(store, args.memory_id);
+                    if (r.purged.length > 0)
+                        repruneVaultAfterShred(workspaceDir, store);
+                    return result({
+                        action: "purge",
+                        ok: r.purged.length > 0,
+                        purged: r.purged,
+                        message: r.purged.length > 0
+                            ? `Crypto-shredded ${r.purged.length} fact(s) (the target + any derived citations).`
+                            : `No fact found with id ${args.memory_id}.`,
+                    });
+                }
+                case "inspect": {
+                    if (!args.memory_id)
+                        return result({ action: "inspect", ok: false, message: "memory_id is required for inspect." });
+                    const info = inspect(store, args.memory_id);
+                    if (!info)
+                        return result({ action: "inspect", ok: false, message: `No fact found with id ${args.memory_id}.` });
+                    return result({
+                        action: "inspect",
+                        ok: true,
+                        content: info.record.content,
+                        segment: info.record.segment,
+                        status: info.record.status ?? "asserted",
+                        links: info.outbound,
+                        backlinks: info.backlinks,
+                        derivedFrom: info.derivedFrom,
+                        derives: info.derives,
+                        message: `Fact ${args.memory_id}: ${info.outbound.length} links, ${info.backlinks.length} backlinks, derived-from ${info.derivedFrom.length}, derives ${info.derives.length}.`,
+                    });
+                }
+                case "export": {
+                    const facts = exportMemory(store, { origin: OWNER });
+                    const activeCount = facts.filter((f) => f.lifecycle === "active").length;
+                    return result({
+                        action: "export",
+                        ok: true,
+                        count: facts.length,
+                        activeCount,
+                        facts: facts.map((f) => ({
+                            id: f.memoryId,
+                            content: f.content,
+                            segment: f.segment,
+                            status: f.status ?? "asserted",
+                            // lifecycle distinguishes a LIVE fact from SUPERSEDED history — without
+                            // it, archived facts render identically to active ones, so "show my
+                            // memory" looks cluttered with stale beliefs that recall never returns.
+                            lifecycle: f.lifecycle,
+                        })),
+                        message: `Exported ${facts.length} fact(s): ${activeCount} active, ` +
+                            `${facts.length - activeCount} superseded/archived (history — NOT returned by recall).`,
+                    });
+                }
+                case "retention": {
+                    if (!args.ttl_days || args.ttl_days < 1) {
+                        return result({ action: "retention", ok: false, message: "ttl_days (>= 1) is required for retention." });
+                    }
+                    const r = applyRetention(store, { ttlMs: args.ttl_days * 86_400_000, origin: OWNER });
+                    if (r.purged.length > 0)
+                        repruneVaultAfterShred(workspaceDir, store);
+                    return result({
+                        action: "retention",
+                        ok: true,
+                        purged: r.purged.length,
+                        message: `Retention: purged ${r.purged.length} fact(s) older than ${args.ttl_days} day(s) (confirmed beliefs kept).`,
+                    });
+                }
+                case "vault": {
+                    // Render the owner's active memory to an Obsidian-style markdown vault,
+                    // preserving any human-pinned edits (the 3-way merge). A filesystem
+                    // artifact: in convex mode the store is authoritative, so a disk vault
+                    // is skipped (it would just be a transient, un-synced render).
+                    if (tryGetRuntimeContext()?.mode === "convex") {
+                        return result({
+                            action: "vault",
+                            ok: false,
+                            message: "The markdown vault is a filesystem-mode feature (your memory lives in the database in this mode). Export with action 'export' instead.",
+                        });
+                    }
+                    const dir = path.join(workspaceDir, "memory-vault");
+                    // Active PLUS restorable-archived (retracted/decayed): a reversibly-
+                    // retracted fact's note — and the operator's hand-pinned edits on it —
+                    // must survive the prune (only a hard-purged fact's note is removed).
+                    const records = store.listForVault(OWNER);
+                    const w = writeVault(dir, records, { prune: true });
+                    return result({
+                        action: "vault",
+                        ok: true,
+                        written: w.written,
+                        mergedPinned: w.mergedPinned,
+                        dir,
+                        message: `Wrote ${w.written} note(s) to your vault${w.mergedPinned > 0 ? ` (kept your edits on ${w.mergedPinned})` : ""}.`,
+                    });
+                }
+                case "propose": {
+                    // Lane B — surface behaviour-change suggestions derived from your
+                    // feedback telemetry (down-votes). Review-only; acting on one is a
+                    // separate, explicit 'retract'. The telemetry log is filesystem-mode
+                    // only in this version, so be honest rather than silently empty.
+                    if (tryGetRuntimeContext()?.mode === "convex") {
+                        return result({
+                            action: "propose",
+                            ok: false,
+                            message: "Behaviour-change proposals are drawn from the local feedback log, which is a filesystem-mode feature in this version.",
+                        });
+                    }
+                    const proposals = proposeFromTelemetry(store.readEvents(), { minDownvotes: 3 });
+                    return result({
+                        action: "propose",
+                        ok: true,
+                        count: proposals.length,
+                        proposals: proposals.map((p) => ({ id: p.id, target: p.diff.target, rationale: p.rationale, change: `${p.diff.before} → ${p.diff.after}` })),
+                        message: proposals.length > 0
+                            ? `${proposals.length} suggestion(s) from your feedback. Review, then 'retract' a fact's id if you agree (it's reversible).`
+                            : "No behaviour-change suggestions — nothing has been down-voted enough to warrant one.",
+                    });
+                }
+                case "retract": {
+                    // Reversibly stop acting on a fact. Runs the Lane-B human-gated state
+                    // machine in-process (the operator invoking this IS the approval):
+                    // propose → approve → reversible apply (archive). 'restore' undoes it.
+                    if (!args.memory_id)
+                        return result({ action: "retract", ok: false, message: "memory_id is required for retract." });
+                    const target = args.memory_id;
+                    let p = {
+                        id: `prop:${target}`,
+                        rationale: "operator-approved retraction",
+                        diff: { kind: "preference", target, before: "active", after: "retracted" },
+                        status: "pending",
+                    };
+                    p = approve(p);
+                    p = applyProposal(p, (diff) => {
+                        const rec = store.invalidate(diff.target);
+                        return rec ? "active" : undefined;
+                    }, { appliedLedger: new Set() });
+                    const applied = p.prior !== undefined;
+                    return result({
+                        action: "retract",
+                        ok: applied,
+                        message: applied
+                            ? `Retracted ${target} — it will no longer surface in recall. Use action 'restore' with the same id to undo.`
+                            : `No active fact found with id ${target}.`,
+                    });
+                }
+                case "restore": {
+                    // The reversible counterpart — re-activate a retracted (archived) fact.
+                    // Routed through the Lane-B revert machinery for symmetry with retract.
+                    if (!args.memory_id)
+                        return result({ action: "restore", ok: false, message: "memory_id is required for restore." });
+                    const target = args.memory_id;
+                    let restored = false;
+                    const p = {
+                        id: `prop:${target}`,
+                        rationale: "operator-requested restore",
+                        diff: { kind: "preference", target, before: "active", after: "retracted" },
+                        status: "applied",
+                        prior: "active",
+                    };
+                    revertProposal(p, () => {
+                        restored = store.reactivate(target) !== undefined;
+                    });
+                    return result({
+                        action: "restore",
+                        ok: restored,
+                        message: restored ? `Restored ${target} — it can surface in recall again.` : `No retracted fact found with id ${target}.`,
+                    });
+                }
+                case "relink": {
+                    // One-shot LLM pass that links genuinely-related ACTIVE facts (semantic
+                    // `relates` edges → the renderer's `## Related` wikilinks). Owner-scoped
+                    // (the tool is ownerOnly; the pass runs on the OWNER origin so no edge
+                    // crosses into a channel peer). Cost-bounded inside runRelinkPass (a hard
+                    // fact cap + windowed calls) and idempotent (linkRelated dedupes), so
+                    // re-running adds nothing already present. Resolve the LLM: an explicitly-
+                    // injected one (tests) wins; else the gateway's boot-wired factory builds
+                    // one for this workspace. The bare tool with neither (a library/unit-test
+                    // path) can't fabricate edges, so it says so honestly.
+                    const relinkLlm = deps.relinkLlm ?? resolveRelinkLlm(deps.agentId ?? "main");
+                    if (!relinkLlm) {
+                        return result({
+                            action: "relink",
+                            ok: false,
+                            message: "Relink needs a model and isn't available in this context.",
+                        });
+                    }
+                    const r = await runRelinkPass({ store, llm: relinkLlm, origin: OWNER });
+                    return result({
+                        action: "relink",
+                        ok: true,
+                        edgesWritten: r.edgesWritten,
+                        considered: r.considered,
+                        windows: r.windows,
+                        message: r.considered < 2
+                            ? "Relink: fewer than 2 active facts — nothing to link yet."
+                            : `Relink: wrote ${r.edgesWritten} new relationship edge(s) across ${r.considered} active fact(s) (${r.windows} pass${r.windows === 1 ? "" : "es"}). Re-running won't duplicate them.`,
+                    });
+                }
+                default:
+                    return result({ action: "export", ok: false, message: "unknown action" });
+            }
+        },
+    };
+}
+//# sourceMappingURL=manage-memory-tool.js.map

package/dist/agents/tools/manage-memory-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-memory-tool.js","sourceRoot":"","sources":["../../../src/agents/tools/manage-memory-tool.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,+BAA+B;AAE/B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,SAAS,EAA2B,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAkB,gBAAgB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,OAAO,EAAiB,oBAAoB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACxH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAEhD;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,KAAgB;IACrE,IAAI,oBAAoB,EAAE,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,IAAI,CAAC;QACJ,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACR,iBAAiB;IAClB,CAAC;AACF,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,KAAK,GAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,IAAI,CAAC,KAAK,CACjB;QACC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,EACD;QACC,WAAW,EACV,4FAA4F;YAC5F,4EAA4E;YAC5E,yEAAyE;YACzE,gFAAgF;YAChF,gGAAgG;YAChG,yEAAyE;YACzE,wEAAwE;YACxE,6GAA6G;KAC9G,CACD;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,4DAA4D,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACpI,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iEAAiE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACpI,CAAC,CAAC;AAuBH,MAAM,UAAU,oBAAoB,CACnC,YAAoB,EACpB,OAAyB,EAAE;IAE3B,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAuC,EAAE,CAC7E,UAAU,CAAC,CAAC,CAAwC,CAAC;IAEtD,OAAO;QACN,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,cAAc,EAAE,2BAA2B;QAC3C,SAAS,EAAE,IAAI;QACf,WAAW,EAAE;YACZ,uDAAuD;YACvD,mKAAmK;YACnK,8GAA8G;YAC9G,2FAA2F;YAC3F,8CAA8C;YAC9C,0FAA0F;YAC1F,0GAA0G;YAC1G,2GAA2G;YAC3G,0GAA0G;YAC1G,mKAAmK;YACnK,4CAA4C;SAC5C,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAgD,EAAE;YAClF,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC;YAE1C,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,OAAO,CAAC,CAAC,CAAC;oBACd,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,OAAO;wBACf,EAAE,EAAE,IAAI;wBACR,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM;wBAC7B,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;wBACnC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;wBACzB,SAAS,EAAE,CAAC,CAAC,SAAS;wBACtB,OAAO,EAAE,oBAAoB,CAAC,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,CAAC,YAAY,CAAC,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC,SAAS,WAAW;qBACrJ,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,OAAO,CAAC,CAAC,CAAC;oBACd,IAAI,CAAC,IAAI,CAAC,SAAS;wBAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;oBAChH,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBACvC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;wBAAE,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;oBACrE,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,OAAO;wBACf,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;wBACvB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;4BAC3B,CAAC,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,MAAM,gDAAgD;4BACpF,CAAC,CAAC,yBAAyB,IAAI,CAAC,SAAS,GAAG;qBAC7C,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBAChB,IAAI,CAAC,IAAI,CAAC,SAAS;wBAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;oBACpH,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC5C,IAAI,CAAC,IAAI;wBAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;oBAChH,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,SAAS;wBACjB,EAAE,EAAE,IAAI;wBACR,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;wBAC5B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;wBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,UAAU;wBACxC,KAAK,EAAE,IAAI,CAAC,QAAQ;wBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,4BAA4B,IAAI,CAAC,WAAW,CAAC,MAAM,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG;qBAC9K,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACf,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;oBACzE,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,QAAQ;wBAChB,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,KAAK,CAAC,MAAM;wBACnB,WAAW;wBACX,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACxB,EAAE,EAAE,CAAC,CAAC,QAAQ;4BACd,OAAO,EAAE,CAAC,CAAC,OAAO;4BAClB,OAAO,EAAE,CAAC,CAAC,OAAO;4BAClB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,UAAU;4BAC9B,wEAAwE;4BACxE,oEAAoE;4BACpE,wEAAwE;4BACxE,SAAS,EAAE,CAAC,CAAC,SAAS;yBACtB,CAAC,CAAC;wBACH,OAAO,EACN,YAAY,KAAK,CAAC,MAAM,aAAa,WAAW,WAAW;4BAC3D,GAAG,KAAK,CAAC,MAAM,GAAG,WAAW,0DAA0D;qBACxF,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,WAAW,CAAC,CAAC,CAAC;oBAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;wBACzC,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;oBAC1G,CAAC;oBACD,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,GAAG,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtF,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;wBAAE,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;oBACrE,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,WAAW;wBACnB,EAAE,EAAE,IAAI;wBACR,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;wBACvB,OAAO,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAAC,MAAM,uBAAuB,IAAI,CAAC,QAAQ,mCAAmC;qBACpH,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,OAAO,CAAC,CAAC,CAAC;oBACd,wEAAwE;oBACxE,oEAAoE;oBACpE,uEAAuE;oBACvE,+DAA+D;oBAC/D,IAAI,oBAAoB,EAAE,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC/C,OAAO,MAAM,CAAC;4BACb,MAAM,EAAE,OAAO;4BACf,EAAE,EAAE,KAAK;4BACT,OAAO,EAAE,wIAAwI;yBACjJ,CAAC,CAAC;oBACJ,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;oBACpD,qEAAqE;oBACrE,uEAAuE;oBACvE,sEAAsE;oBACtE,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC1C,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,OAAO;wBACf,EAAE,EAAE,IAAI;wBACR,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,GAAG;wBACH,OAAO,EAAE,SAAS,CAAC,CAAC,OAAO,yBAAyB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;qBAC1H,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBAChB,kEAAkE;oBAClE,mEAAmE;oBACnE,qEAAqE;oBACrE,iEAAiE;oBACjE,IAAI,oBAAoB,EAAE,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC/C,OAAO,MAAM,CAAC;4BACb,MAAM,EAAE,SAAS;4BACjB,EAAE,EAAE,KAAK;4BACT,OAAO,EAAE,uHAAuH;yBAChI,CAAC,CAAC;oBACJ,CAAC;oBACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;oBAChF,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,SAAS;wBACjB,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,SAAS,CAAC,MAAM;wBACvB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5I,OAAO,EACN,SAAS,CAAC,MAAM,GAAG,CAAC;4BACnB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,uGAAuG;4BAC5H,CAAC,CAAC,sFAAsF;qBAC1F,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBAChB,sEAAsE;oBACtE,mEAAmE;oBACnE,uEAAuE;oBACvE,IAAI,CAAC,IAAI,CAAC,SAAS;wBAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;oBACpH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;oBAC9B,IAAI,CAAC,GAAa;wBACjB,EAAE,EAAE,QAAQ,MAAM,EAAE;wBACpB,SAAS,EAAE,8BAA8B;wBACzC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBAC1E,MAAM,EAAE,SAAS;qBACjB,CAAC;oBACF,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;oBACf,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;wBAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;oBACnC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC,CAAC;oBACzC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;oBACtC,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,SAAS;wBACjB,EAAE,EAAE,OAAO;wBACX,OAAO,EAAE,OAAO;4BACf,CAAC,CAAC,aAAa,MAAM,wFAAwF;4BAC7G,CAAC,CAAC,gCAAgC,MAAM,GAAG;qBAC5C,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBAChB,wEAAwE;oBACxE,wEAAwE;oBACxE,IAAI,CAAC,IAAI,CAAC,SAAS;wBAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;oBACpH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;oBAC9B,IAAI,QAAQ,GAAG,KAAK,CAAC;oBACrB,MAAM,CAAC,GAAa;wBACnB,EAAE,EAAE,QAAQ,MAAM,EAAE;wBACpB,SAAS,EAAE,4BAA4B;wBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBAC1E,MAAM,EAAE,SAAS;wBACjB,KAAK,EAAE,QAAQ;qBACf,CAAC;oBACF,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE;wBACtB,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;oBACnD,CAAC,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,SAAS;wBACjB,EAAE,EAAE,QAAQ;wBACZ,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,MAAM,oCAAoC,CAAC,CAAC,CAAC,mCAAmC,MAAM,GAAG;qBACzH,CAAC,CAAC;gBACJ,CAAC;gBACD,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACf,wEAAwE;oBACxE,yEAAyE;oBACzE,uEAAuE;oBACvE,0EAA0E;oBAC1E,sEAAsE;oBACtE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,uDAAuD;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;oBAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;wBAChB,OAAO,MAAM,CAAC;4BACb,MAAM,EAAE,QAAQ;4BAChB,EAAE,EAAE,KAAK;4BACT,OAAO,EAAE,2DAA2D;yBACpE,CAAC,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBACxE,OAAO,MAAM,CAAC;wBACb,MAAM,EAAE,QAAQ;wBAChB,EAAE,EAAE,IAAI;wBACR,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,OAAO,EACN,CAAC,CAAC,UAAU,GAAG,CAAC;4BACf,CAAC,CAAC,0DAA0D;4BAC5D,CAAC,CAAC,iBAAiB,CAAC,CAAC,YAAY,oCAAoC,CAAC,CAAC,UAAU,oBAAoB,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,qCAAqC;qBACxL,CAAC,CAAC;gBACJ,CAAC;gBACD;oBACC,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC5E,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/agents/tools/manage-provider-tool.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `manage_provider` tool — owner-only provider credential + per-agent model
+ * management. The Brigade answer to "save this API key" and "agent X should
+ * run on openai/gpt-4o".
+ *
+ * Why this tool exists (production, 2026-06-11)
+ * ---------------------------------------------
+ * Handed an OpenAI key mid-chat, the model wrote it PLAINTEXT into
+ * `workspace/.env` ("that's the standard place") and then, asked to point an
+ * agent at it, dumped hand-edit JSON instructions — with a config shape
+ * Brigade doesn't even read. The reference architecture studied for this has
+ * the same hole: its agent-driven config path lands keys plaintext in the
+ * main config file, its canonical 0600 credential store has NO model-reachable
+ * writer, and nothing in its prompts tells the model how to treat a secret.
+ * This tool closes all three gaps at once:
+ *
+ *   - `save-key` writes the CANONICAL per-agent credential store
+ *     (`agents/<id>/agent/auth-profiles.json`, 0600, atomic tmp+rename,
+ *     sealed-column sync in convex mode) via the same `upsertApiKeyProfile`
+ *     path onboarding uses. The result NEVER echoes the key — masked tail
+ *     only.
+ *   - `set-agent-model` edits `agents.<id>.provider` + `model.primary`
+ *     through the atomic config helpers (same path as manage_agent), and
+ *     SEEDS the provider key into the target agent's own store when only the
+ *     default agent has it — write-time inheritance, so "marketing-lead uses
+ *     gpt-4o" works on the next turn instead of failing on a missing key.
+ *     The gateway hot-reloads runtime models on config change.
+ *   - `list` reports which providers have keys (masked) so the model can
+ *     answer "what providers are set up?" without filesystem spelunking.
+ *
+ * Secret-handling contract (the guidance the reference lacks): keys go HERE,
+ * never into .env / workspace files / memory / config / chat echoes.
+ */
+import { Type } from "typebox";
+import type { BrigadeTool } from "./types.js";
+declare const ManageProviderParams: Type.TObject<{
+    action: Type.TUnion<[Type.TLiteral<"save-key">, Type.TLiteral<"set-agent-model">, Type.TLiteral<"list">]>;
+    provider: Type.TOptional<Type.TString>;
+    key: Type.TOptional<Type.TString>;
+    model: Type.TOptional<Type.TString>;
+    agentId: Type.TOptional<Type.TString>;
+}>;
+interface ManageProviderDetails {
+    action: "save-key" | "set-agent-model" | "list";
+    ok: boolean;
+    message: string;
+    provider?: string;
+    agentId?: string;
+    model?: string;
+    maskedKey?: string;
+    seededKey?: boolean;
+    providers?: Array<{
+        provider: string;
+        hasKey: boolean;
+        maskedKey?: string;
+        source: string;
+    }>;
+}
+export interface MakeManageProviderToolOptions {
+    /** Caller's agent id — default target for save-key. */
+    requesterAgentId?: string;
+}
+export declare function makeManageProviderTool(opts?: MakeManageProviderToolOptions): BrigadeTool<typeof ManageProviderParams, ManageProviderDetails>;
+export {};
+//# sourceMappingURL=manage-provider-tool.d.ts.map

package/dist/agents/tools/manage-provider-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-provider-tool.d.ts","sourceRoot":"","sources":["../../../src/agents/tools/manage-provider-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAa/B,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,YAAY,CAAC;AAE/D,QAAA,MAAM,oBAAoB;;;;;;EAwCxB,CAAC;AAEH,UAAU,qBAAqB;IAC9B,MAAM,EAAE,UAAU,GAAG,iBAAiB,GAAG,MAAM,CAAC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7F;AAED,MAAM,WAAW,6BAA6B;IAC7C,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,sBAAsB,CACrC,IAAI,GAAE,6BAAkC,GACtC,WAAW,CAAC,OAAO,oBAAoB,EAAE,qBAAqB,CAAC,CAqHjE"}