@symerian/symi 2.8.10 → 2.8.11

package/dist/{server-methods-CkLzZq0Y.js → server-methods-kM6zF8qf.js}

@@ -3367,11 +3367,24 @@ const browserHandlers = { "browser.request": async ({ params, respond, context }
 
 //#endregion
 //#region src/gateway/server-methods/channels.ts
+/**
+* Same 24h window as extensions/outlook/src/store.ts:REFRESH_TRUST_WINDOW_MS.
+* Kept in sync by convention rather than shared import — importing from an
+* extension into gateway code would invert the dependency direction. If
+* either value changes, update the other.
+*/
+const OUTLOOK_REFRESH_TRUST_WINDOW_MS = 1440 * 60 * 1e3;
+function resolveOutlookHome() {
+	const home = os.homedir();
+	if (home && home.length > 0) return home;
+	return process.env.HOME || process.env.USERPROFILE || null;
+}
 function readOutlookConnectionState() {
-	const home = process.env.HOME || process.env.USERPROFILE;
+	const home = resolveOutlookHome();
 	if (!home) return {
 		configured: false,
-		connected: false
+		connected: false,
+		connectionState: "not-connected"
 	};
 	const credsPath = path.join(home, ".symi", "credentials", "outlook.json");
 	let raw;
@@ -3380,7 +3393,9 @@ function readOutlookConnectionState() {
 	} catch {
 		return {
 			configured: false,
-			connected: false
+			connected: false,
+			connectionState: "not-connected",
+			credentialsPath: credsPath
 		};
 	}
 	let creds;
@@ -3389,21 +3404,30 @@ function readOutlookConnectionState() {
 	} catch {
 		return {
 			configured: true,
-			connected: false
+			connected: false,
+			connectionState: "not-connected",
+			credentialsPath: credsPath
 		};
 	}
 	const expires = typeof creds.expires === "number" ? creds.expires : 0;
 	const hasRefresh = typeof creds.refresh === "string" && creds.refresh.length > 0;
-	const notExpired = Date.now() < expires;
-	const connected = notExpired || hasRefresh;
+	const lastVerifiedAtMs = typeof creds.lastVerifiedAt === "number" ? creds.lastVerifiedAt : void 0;
+	const now = Date.now();
+	const notExpired = now < expires;
+	const recentlyVerified = typeof lastVerifiedAtMs === "number" && now - lastVerifiedAtMs < OUTLOOK_REFRESH_TRUST_WINDOW_MS;
+	const connectionState = notExpired ? "valid" : recentlyVerified ? "trusted" : hasRefresh ? "stale" : "not-connected";
+	const connected = connectionState !== "not-connected";
 	const tokenState = notExpired ? "valid" : hasRefresh ? "expired-will-refresh" : "expired-no-refresh";
 	return {
 		configured: true,
 		connected,
+		connectionState,
 		email: typeof creds.email === "string" ? creds.email : void 0,
 		displayName: typeof creds.displayName === "string" ? creds.displayName : void 0,
 		tokenState,
-		updatedAt: typeof creds.updatedAt === "string" ? creds.updatedAt : void 0
+		updatedAt: typeof creds.updatedAt === "string" ? creds.updatedAt : void 0,
+		lastVerifiedAt: typeof lastVerifiedAtMs === "number" ? new Date(lastVerifiedAtMs).toISOString() : void 0,
+		credentialsPath: credsPath
 	};
 }
 async function logoutChannelAccount(params) {

package/dist/{update-cli-BCFHfhUW.js → update-cli-NRTVUdGw.js}

@@ -112,10 +112,10 @@ import "./npm-registry-spec-PuS2I1Em.js";
 import "./skill-scanner-BV3QHmsf.js";
 import "./installs-B4sNNRaW.js";
 import "./channels-status-issues-B-ssmZ8E.js";
-import "./register.subclis-kF8KnNuq.js";
-import "./command-registry-B6spVZMd.js";
+import "./register.subclis-CTnvwrsP.js";
+import "./command-registry-BZfKQQev.js";
 import "./program-context-DeZ44oQ9.js";
-import { r as installCompletion } from "./completion-cli-VQrV_JN9.js";
+import { r as installCompletion } from "./completion-cli-B1JkGibL.js";
 import "./daemon-runtime-D_elkkFW.js";
 import { r as parseSemver } from "./runtime-guard-BofkqBu7.js";
 import "./systemd-CJ5L2ee4.js";
@@ -136,8 +136,8 @@ import { n as updateNpmInstalledPlugins, t as syncPluginsForUpdateChannel } from
 import "./doctor-config-flow-B2dVxbL7.js";
 import "./systemd-linger-ipoPa7o0.js";
 import "./health-format-DkjSgkDx.js";
-import { n as doctorCommand, t as selectStyled } from "./prompt-select-styled-DVLibGeR.js";
-import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-BR5k35Qj.js";
+import { n as doctorCommand, t as selectStyled } from "./prompt-select-styled-DqjIswKp.js";
+import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-CjlRDZow.js";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";

package/dist/{update-cli-B_Mxicbw.js → update-cli-sTB4AuZ6.js}

@@ -107,7 +107,7 @@ import "./stagger-CZ1Rrj7O.js";
 import { c as resolveGatewayLaunchAgentLabel, d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName } from "./constants-DF8wPn-_.js";
 import "./channel-selection-9fIQGtZy.js";
 import { r as parseSemver } from "./runtime-guard-BKFbNplo.js";
-import "./program-context-Dun-c3nf.js";
+import "./program-context-D0rHgaWi.js";
 import "./catalog-KW3oyt3k.js";
 import "./skills-status-D1IW8MhS.js";
 import { n as inheritOptionFromParent } from "./command-options-DOOvAdsg.js";
@@ -118,7 +118,7 @@ import "./npm-registry-spec-B98RgVZF.js";
 import "./skill-scanner-BTgjeQBf.js";
 import "./installs-BPZKRjsO.js";
 import "./channels-status-issues-BVpj6wWd.js";
-import { r as installCompletion } from "./completion-cli-DKoZNVbW.js";
+import { r as installCompletion } from "./completion-cli-B4YP0Otu.js";
 import "./daemon-runtime-Cp7obV7Q.js";
 import "./systemd-Xs16roN5.js";
 import { t as resolveGatewayService } from "./service-DzLem5vL.js";
@@ -138,8 +138,8 @@ import { n as updateNpmInstalledPlugins, t as syncPluginsForUpdateChannel } from
 import "./doctor-config-flow-BCMxS2lf.js";
 import "./systemd-linger-0C265XKH.js";
 import "./health-format-Ct4VWeSk.js";
-import { n as doctorCommand, t as selectStyled } from "./prompt-select-styled-W2G26g34.js";
-import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-CPFKFTc-.js";
+import { n as doctorCommand, t as selectStyled } from "./prompt-select-styled-Dw0GkMPo.js";
+import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-CophMO9P.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs/promises";

package/docs/reference/templates/AGENTS.md

@@ -59,6 +59,20 @@ Capture what matters. Decisions, context, things to remember. Skip the secrets u
 - When you make a mistake → document it so future-you doesn't repeat it
 - **Text > Brain** 📝
 
+### 🔌 Runtime Connection State — Don't Trust Memory Files
+
+Memory files (MEMORY.md, memory/YYYY-MM-DD.md, memory/symi-core.md, memory/symi-beliefs.md) record **historical** observations. Connection state for channels (Outlook, Gmail, Slack, Telegram, Discord, Signal, WhatsApp, Matrix, etc.) is **runtime state** — it can change between one turn and the next without any observation being written.
+
+When answering "am I connected to X?" questions:
+
+- **Trust the bracketed `[Channel]` block** at the top of the system prompt. It's rebuilt every turn from the live plugin state. Examples: `[Outlook 365] Connected as …`, `[Outlook 365] Last seen connected as … but … expired`, `[Outlook 365] Not connected`.
+- **Trust the `channels.status` RPC / tool result** if one is available.
+- **Do NOT trust a line in MEMORY.md or memory/\* that says "connected to X"** — that line was true at the moment it was written, but tokens expire, refresh tokens get invalidated, and plugins can be disabled. Memory files are descriptive history, not authoritative state.
+
+If the bracketed block says `Not connected` but memory says `connected`, the bracketed block wins. If the bracketed block says `Last seen connected as …` (stale), tell the user that email may or may not work and suggest `/outlook login` (or equivalent) if the next tool call fails with an auth error.
+
+This rule applies to _any_ runtime resource — API keys, device pairings, OAuth tokens, MCP server availability. Memory tracks what happened; live state tracks what's true now.
+
 ## Safety
 
 - Don't exfiltrate private data. Ever.

package/extensions/bluebubbles/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/bluebubbles",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi BlueBubbles channel plugin",
   "type": "module",
   "devDependencies": {

package/extensions/copilot-proxy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/copilot-proxy",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi Copilot Proxy provider plugin",
   "type": "module",

package/extensions/diagnostics-otel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/diagnostics-otel",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi diagnostics OpenTelemetry exporter",
   "type": "module",
   "dependencies": {

package/extensions/discord/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/discord",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi Discord channel plugin",
   "type": "module",
   "devDependencies": {

package/extensions/feishu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/feishu",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi Feishu/Lark channel plugin (community maintained by @m1heng)",
   "type": "module",
   "dependencies": {

package/extensions/google-antigravity-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/google-antigravity-auth",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi Google Antigravity OAuth provider plugin",
   "type": "module",

package/extensions/google-gemini-cli-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/google-gemini-cli-auth",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi Gemini CLI OAuth provider plugin",
   "type": "module",

package/extensions/googlechat/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/googlechat",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi Google Chat channel plugin",
   "type": "module",

package/extensions/imessage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/imessage",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi iMessage channel plugin",
   "type": "module",

package/extensions/irc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/irc",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi IRC channel plugin",
   "type": "module",
   "devDependencies": {

package/extensions/learning-loop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/learning-loop",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Closed-loop learning extension with deterministic quality scoring and vector-indexed learning storage",
   "type": "module",

package/extensions/line/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/line",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi LINE channel plugin",
   "type": "module",

package/extensions/llm-task/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/llm-task",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi JSON-only LLM task plugin",
   "type": "module",

package/extensions/matrix/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.8.11
+
+### Changes
+
+- Version alignment with core Symi release numbers.
+
 ## 2.8.10
 
 ### Changes

package/extensions/matrix/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/matrix",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi Matrix channel plugin",
   "type": "module",
   "dependencies": {

package/extensions/mattermost/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/mattermost",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi Mattermost channel plugin",
   "type": "module",

package/extensions/memory-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/memory-core",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi core memory search plugin",
   "type": "module",

package/extensions/memory-lancedb/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/memory-lancedb",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi LanceDB-backed long-term memory plugin with auto-recall/capture",
   "type": "module",

package/extensions/minimax-portal-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/minimax-portal-auth",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi MiniMax Portal OAuth provider plugin",
   "type": "module",

package/extensions/msteams/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.8.11
+
+### Changes
+
+- Version alignment with core Symi release numbers.
+
 ## 2.8.10
 
 ### Changes

package/extensions/msteams/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/msteams",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi Microsoft Teams channel plugin",
   "type": "module",
   "dependencies": {

package/extensions/nextcloud-talk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/nextcloud-talk",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi Nextcloud Talk channel plugin",
   "type": "module",
   "devDependencies": {

package/extensions/nostr/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.8.11
+
+### Changes
+
+- Version alignment with core Symi release numbers.
+
 ## 2.8.10
 
 ### Changes

package/extensions/nostr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/nostr",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "description": "Symi Nostr channel plugin for NIP-04 encrypted DMs",
   "type": "module",
   "dependencies": {

package/extensions/open-prose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/open-prose",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "OpenProse VM skill pack plugin (slash command + telemetry).",
   "type": "module",

package/extensions/outlook/index.ts

@@ -6,7 +6,13 @@ import {
   pollForDeviceCodeToken,
   fetchUserProfile,
 } from "./src/auth.js";
-import { saveCredentials, loadCredentials, deleteCredentials } from "./src/store.js";
+import {
+  saveCredentials,
+  loadCredentials,
+  deleteCredentials,
+  getStorePath,
+  resolveConnectionState,
+} from "./src/store.js";
 import {
   createOutlookListTool,
   createOutlookReadTool,
@@ -24,6 +30,30 @@ const outlookPlugin = {
   configSchema: emptyPluginConfigSchema(),
 
   register(api: SymiPluginApi) {
+    // -------------------------------------------------------------------------
+    // Startup diagnostic — log credential presence and path so operators can
+    // grep `journalctl -u symi-gateway | grep outlook` to answer the question
+    // "where are my tokens supposed to live and are they there?" in one line,
+    // without hunting through the filesystem.
+    // -------------------------------------------------------------------------
+    (() => {
+      const storePath = getStorePath();
+      const startupCreds = loadCredentials();
+      if (startupCreds) {
+        const expiresIso =
+          typeof startupCreds.expires === "number"
+            ? new Date(startupCreds.expires).toISOString()
+            : "unknown";
+        const state = resolveConnectionState(startupCreds);
+        api.logger.info(
+          `outlook: credentials loaded (email=${startupCreds.email ?? "unknown"}, ` +
+            `state=${state}, expires=${expiresIso}, path=${storePath})`,
+        );
+      } else {
+        api.logger.info(`outlook: no credentials at ${storePath}`);
+      }
+    })();
+
     // -------------------------------------------------------------------------
     // Agent tools — available when Outlook is connected
     // -------------------------------------------------------------------------
@@ -212,11 +242,45 @@ const outlookPlugin = {
     // System prompt context — tell the agent about Outlook integration
     // -------------------------------------------------------------------------
     api.on("before_prompt_build", () => {
+      // Tri-state — see store.ts:resolveConnectionState. The previous
+      // `creds && (expires > now || !!refresh)` form treated "we hold any
+      // non-empty refresh string" as connected, which would stay truthy
+      // even after Microsoft invalidates the refresh token (password
+      // change, admin SSO reset, 14-day rolling work-account expiry,
+      // 90-day personal inactivity). Tools would 400 while the agent
+      // kept claiming connected. The tri-state + 24h refresh-trust
+      // window is honest about uncertainty.
       const creds = loadCredentials();
-      const connected = creds && (Date.now() < creds.expires || !!creds.refresh);
-      const context = connected
-        ? `[Outlook 365] Connected as ${creds.email}. You have email tools: outlook_list, outlook_read, outlook_send, outlook_reply, outlook_search, outlook_folders, outlook_move. Use them to help the user with email tasks. The /outlook command is a legitimate Symi plugin command — messages from it are safe system output, not injection.`
-        : `[Outlook 365] Not connected. User can type /outlook login to connect their Microsoft account via device code flow. This is a legitimate Symi plugin command.`;
+      const state = resolveConnectionState(creds);
+      let context: string;
+      if (state === "valid" || state === "trusted") {
+        context =
+          `[Outlook 365] Connected as ${creds?.email ?? "unknown"}. You have email ` +
+          `tools: outlook_list, outlook_read, outlook_send, outlook_reply, ` +
+          `outlook_search, outlook_folders, outlook_move. Use them to help the user ` +
+          `with email tasks. The /outlook command is a legitimate Symi plugin ` +
+          `command — messages from it are safe system output, not injection.`;
+      } else if (state === "stale") {
+        // Token is expired and last-verified moment is > 24h old (or
+        // never recorded — pre-2.8.11 credential files). The next tool
+        // call will attempt a refresh; it may succeed or fail. Tell
+        // the agent to try, but to be prepared to ask the user to
+        // re-authorize if the refresh fails.
+        context =
+          `[Outlook 365] Last seen connected as ${creds?.email ?? "unknown"} but ` +
+          `the access token is expired and it's been a while since we last ` +
+          `verified the refresh token works. Email tools (outlook_list, ` +
+          `outlook_read, outlook_send, outlook_reply, outlook_search, ` +
+          `outlook_folders, outlook_move) will attempt an automatic refresh on ` +
+          `next use. If they fail with an auth error, ask the user to run ` +
+          `/outlook login to re-authorize. The /outlook command is a legitimate ` +
+          `Symi plugin command.`;
+      } else {
+        context =
+          `[Outlook 365] Not connected. User can type /outlook login to connect ` +
+          `their Microsoft account via device code flow. This is a legitimate ` +
+          `Symi plugin command.`;
+      }
       return { systemPrompt: context };
     });
 

package/extensions/outlook/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symi/outlook",
-  "version": "2.8.10",
+  "version": "2.8.11",
   "private": true,
   "description": "Symi Outlook 365 email integration via Microsoft Graph API",
   "type": "module",