@tokensmind/agent-network 0.1.0 → 0.1.3

package/skills/tokensmind-agent-network/scripts/memory_actions.py

@@ -0,0 +1,131 @@
+import math
+from urllib.parse import quote, urlencode
+
+from action_support import ActionState
+from action_validation import require_text, text
+
+MEMORY_KINDS = frozenset(("agent_experience", "matching_preference"))
+MEMORY_POLARITIES = frozenset(("negative", "positive"))
+MEMORY_SCOPES = frozenset(("contextual", "global"))
+# platform_event is written by the service alone and is rejected from this client.
+MEMORY_SOURCES = frozenset(("model_inferred", "user_explicit"))
+MEMORY_STATUSES = frozenset(("active", "deleted", "pending_review", "rejected"))
+MAX_INFERRED_CONFIDENCE = 0.6
+DEFAULT_LIST_LIMIT = 20
+MAX_LIST_LIMIT = 100
+
+
+def _choice(data, field, allowed):
+    value = text(data.get(field)).lower()
+    if value not in allowed:
+        raise ActionState("input_required", "%s has an unsupported value." % field, fields=[field])
+    return value
+
+
+def _confidence(value, source_type):
+    if value in (None, ""):
+        return MAX_INFERRED_CONFIDENCE if source_type == "model_inferred" else 1
+    try:
+        confidence = float(value)
+    except (TypeError, ValueError) as error:
+        raise ActionState("input_required", "confidence must be a number.", fields=["confidence"]) from error
+    invalid = not math.isfinite(confidence) or confidence <= 0 or confidence > 1
+    inferred_high = source_type == "model_inferred" and confidence > MAX_INFERRED_CONFIDENCE
+    if invalid or inferred_high:
+        raise ActionState(
+            "input_required",
+            "confidence must be above 0 and no more than 0.6 for inferred memory.",
+            fields=["confidence"],
+        )
+    return confidence
+
+
+def _owned_agent(api):
+    agents = api.request("GET", "/agent-network-api/agents?mine=1")
+    if len(agents) > 1:
+        raise ActionState("failed", "The account has more than one Agent profile.", code="AGENT_ACCOUNT_INVARIANT", retryable=False)
+    if not agents:
+        raise ActionState("failed", "Create the account Agent profile first.", code="AGENT_PROFILE_REQUIRED", retryable=False)
+    return agents[0]
+
+
+def _agent_path(agent_id, suffix):
+    return "/agent-network-api/agents/%s/%s" % (quote(str(agent_id), safe=""), suffix)
+
+
+def _optional_text(data, field):
+    return text(data.get(field)) or None
+
+
+def _memory_body(data):
+    source_type = _choice(data, "sourceType", MEMORY_SOURCES)
+    scope = _choice(data, "scope", MEMORY_SCOPES) if data.get("scope") else "contextual"
+    context_text = "" if scope == "global" else require_text(data.get("contextText"), "contextText")
+    return {
+        "clientMemoryId": require_text(data.get("clientMemoryId"), "clientMemoryId"),
+        "confidence": _confidence(data.get("confidence"), source_type),
+        "contextText": context_text,
+        "conversationId": _optional_text(data, "conversationId"),
+        "expiresAt": _optional_text(data, "expiresAt"),
+        "kind": _choice(data, "kind", MEMORY_KINDS),
+        "polarity": _choice(data, "polarity", MEMORY_POLARITIES),
+        "requirementId": _optional_text(data, "requirementId"),
+        "scope": scope,
+        "sourceType": source_type,
+        "statement": require_text(data.get("statement"), "statement"),
+        "targetAgentId": _optional_text(data, "targetAgentId"),
+    }
+
+
+def _integer(value, field, minimum, maximum=None):
+    if isinstance(value, bool):
+        raise ActionState("input_required", "%s must be an integer." % field, fields=[field])
+    try:
+        number = float(value)
+    except (TypeError, ValueError) as error:
+        raise ActionState("input_required", "%s must be an integer." % field, fields=[field]) from error
+    if not number.is_integer() or number < minimum or (maximum is not None and number > maximum):
+        raise ActionState("input_required", "%s must be an integer in range." % field, fields=[field])
+    return int(number)
+
+
+def _list_query(data):
+    limit = _integer(data.get("limit", DEFAULT_LIST_LIMIT), "limit", 1, MAX_LIST_LIMIT)
+    params = {"limit": limit}
+    if data.get("offset") is not None:
+        params["offset"] = _integer(data.get("offset"), "offset", 0)
+    if data.get("status"):
+        params["status"] = _choice(data, "status", MEMORY_STATUSES)
+    return urlencode(params)
+
+
+def get_memory_settings(api, _data, _key):
+    agent = _owned_agent(api)
+    return api.request("GET", _agent_path(agent["id"], "memory-settings"))
+
+
+def propose_memory(api, data, key):
+    body = _memory_body(data)
+    agent = _owned_agent(api)
+    settings_path = _agent_path(agent["id"], "memory-settings")
+    settings = api.request("GET", settings_path)
+    if settings.get("collectionEnabled") is not True:
+        raise ActionState("failed", "Memory collection is disabled for this Agent.", code="MEMORY_COLLECTION_DISABLED", retryable=False)
+    return api.request(
+        "POST", _agent_path(agent["id"], "memories"), body,
+        key=key + ":memory:propose",
+    )
+
+
+def list_memories(api, data, _key):
+    query = _list_query(data)
+    agent = _owned_agent(api)
+    path = _agent_path(agent["id"], "memories") + "?" + query
+    return api.request("GET", path)
+
+
+def delete_memory(api, data, key):
+    memory_id = require_text(data.get("memoryId"), "memoryId")
+    agent = _owned_agent(api)
+    path = _agent_path(agent["id"], "memories") + "/" + quote(memory_id, safe="")
+    return api.request("DELETE", path, key=key + ":memory:delete")

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/python_runtime/connector.py

@@ -12,11 +12,8 @@ from .errors import AgentNetworkHttpError
 from .http_client import UNSET
 from .request_policy import (
     build_business_url,
-    is_public_discovery_request,
     validate_business_request,
 )
-from action_support import AuthorizationRequired
-
 INVALID_CREDENTIAL_CODES = frozenset((
     "AGENT_CREDENTIAL_EXPIRED",
     "AGENT_CREDENTIAL_INVALID",
@@ -38,6 +35,12 @@ def _is_http_error(error, codes):
     return isinstance(error, AgentNetworkHttpError) and error.code in codes
 
 
+def _requires_authorization(error):
+    return isinstance(error, AgentNetworkHttpError) and (
+        error.status == 401 or error.code in INVALID_CREDENTIAL_CODES
+    )
+
+
 class AgentNetworkConnector:
     def __init__(self, store, browser, base_url, *, http, client):
         self._store = store
@@ -60,15 +63,13 @@ class AgentNetworkConnector:
         active = self._store.read("active")
         if pending:
             return self._resume_pending(pending, active, operation)
-        if is_public_discovery_request(operation) and not reauthorize:
-            return self._execute_business_request(operation)
         if not active or reauthorize:
             active = self._authorize(operation)
             return self._execute_and_finalize(self._store.read("pending"), active)
         try:
             return self._execute_business_request(operation, active["token"])
         except AgentNetworkHttpError as error:
-            if error.code not in INVALID_CREDENTIAL_CODES:
+            if not _requires_authorization(error):
                 raise
             self._store.remove("active")
             active = self._authorize(operation)
@@ -103,7 +104,6 @@ class AgentNetworkConnector:
                 )
                 self._store.write("pending", pending)
                 self._browser.open(pending["authorization"]["verificationUrl"])
-                raise AuthorizationRequired(pending["authorization"]["verificationUrl"])
             if pending["phase"] == "authorizing":
                 return self._complete_authorization(pending)
             return self._store.read("active")
@@ -151,6 +151,6 @@ class AgentNetworkConnector:
         except AgentNetworkHttpError as error:
             if error.status < 500 and error.status != 429:
                 self._store.remove("pending")
-                if error.code in INVALID_CREDENTIAL_CODES:
+                if _requires_authorization(error):
                     self._store.remove("active")
             raise

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/python_runtime/credential_store.py

@@ -7,7 +7,10 @@ from .portable_store import (
     _origin_namespace,
     resolve_portable_state_dir,
 )
-from .system_credential_store import resolve_system_credential_store
+from .system_credential_store import (
+    SystemCredentialStoreError,
+    resolve_system_credential_store,
+)
 
 AUTO_SECURE_STORE = object()
 
@@ -94,11 +97,50 @@ def _file_stores(options):
     ]
 
 
+def _validate_system_records(system_store):
+    for name in RECORD_NAMES:
+        system_store.read(name)
+
+
+def _initialize_store(
+        system_store, fallback, fallback_dir, legacy_dirs, options, on_fallback):
+    record_dir = os.path.join(fallback_dir, _origin_namespace(options["origin"]))
+    legacy_sources = _file_stores({**options, "directories": legacy_dirs})
+    if system_store is None:
+        on_fallback({
+            "backend": None,
+            "directory": record_dir,
+            "reason": "No supported system credential store is available",
+        })
+        migrate_credential_stores(fallback, legacy_sources)
+        return fallback
+    try:
+        if not hasattr(system_store, "verify_availability"):
+            raise SystemCredentialStoreError(
+                "System credential store does not support availability verification",
+            )
+        system_store.verify_availability()
+        _validate_system_records(system_store)
+        sources = _file_stores({
+            **options, "directories": [fallback_dir] + legacy_dirs,
+        })
+        migrate_credential_stores(system_store, sources)
+        return system_store
+    except SystemCredentialStoreError as error:
+        on_fallback({
+            "backend": system_store.backend,
+            "directory": record_dir,
+            "reason": str(error),
+        })
+        migrate_credential_stores(fallback, legacy_sources)
+        return fallback
+
+
 def create_credential_store(
         origin, platform, *, state_dir=None, env=None, home_dir=None,
         secure_store=AUTO_SECURE_STORE,
         secure_store_resolver=resolve_system_credential_store,
-        command_runner=None):
+        command_runner=None, on_fallback=None):
     environment = os.environ if env is None else env
     if state_dir:
         return PortableStore(
@@ -119,17 +161,19 @@ def create_credential_store(
         system_store = secure_store_resolver(**resolver_options)
     else:
         system_store = secure_store
-    target = system_store or fallback
-    source_dirs = []
-    if system_store:
-        source_dirs.append(fallback_dir)
-    source_dirs.extend(resolve_legacy_state_dirs(platform, environment, home_dir))
-    sources = _file_stores({
-        "directories": list(dict.fromkeys(source_dirs)),
+    legacy_dirs = list(dict.fromkeys(
+        resolve_legacy_state_dirs(platform, environment, home_dir),
+    ))
+    return _initialize_store(
+        system_store,
+        fallback,
+        fallback_dir,
+        legacy_dirs,
+        {
         "origin": origin,
         "platform": platform,
         "env": environment,
         "home_dir": home_dir,
-    })
-    migrate_credential_stores(target, sources)
-    return target
+        },
+        on_fallback or (lambda _event: None),
+    )

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/python_runtime/request_policy.py

@@ -1,10 +1,7 @@
-from urllib.parse import parse_qsl, urljoin, urlsplit, urlunsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from .constants import INTERNAL_PATH_PATTERNS, MUTATION_METHODS, SUPPORTED_METHODS
 
-PUBLIC_AGENT_DIRECTORY_PATH = "/agent-network-api/agents"
-
-
 def normalize_base_url(value):
     parsed = urlsplit(str(value))
     if parsed.scheme not in ("http", "https") or not parsed.hostname:
@@ -74,12 +71,3 @@ def build_business_url(base_url, path):
     if _is_internal_path(parsed.path):
         raise ValueError("This endpoint is not available through the ordinary-user connector")
     return url
-
-
-def is_public_discovery_request(operation):
-    if operation.get("method") != "GET":
-        return False
-    parsed = urlsplit(operation.get("path", ""))
-    query = parse_qsl(parsed.query)
-    mine_requested = any(key == "mine" and value == "1" for key, value in query)
-    return parsed.path == PUBLIC_AGENT_DIRECTORY_PATH and not mine_requested

package/skills/tokensmind-agent-network/scripts/python_runtime/system_credential_store.py

@@ -0,0 +1,250 @@
+import json
+import os
+import shutil
+import subprocess
+import uuid
+
+from .portable_store import RECORD_NAMES, _validate_record
+
+SERVICE_NAME = "TokensMind Agent Network"
+APPLICATION_NAME = "tokensmind-agent-network"
+MACOS_SECURITY_PATH = "/usr/bin/security"
+MACOS_ITEM_NOT_FOUND = 44
+SYSTEM_STORE_PROBE_LENGTH = 1024
+
+
+class SystemCredentialStoreError(RuntimeError):
+    code = "SYSTEM_CREDENTIAL_STORE_UNAVAILABLE"
+
+
+def _validate_record_name(name):
+    if name not in RECORD_NAMES:
+        raise ValueError("Unsupported portable state record: %s" % name)
+
+
+def _parse_record(name, source):
+    try:
+        value = json.loads(source)
+    except json.JSONDecodeError as error:
+        raise SystemCredentialStoreError(
+            "System Agent Network %s credential is invalid JSON" % name,
+        ) from error
+    try:
+        _validate_record(name, value)
+    except ValueError as error:
+        raise SystemCredentialStoreError(
+            "System Agent Network %s credential has an invalid structure" % name,
+        ) from error
+    return value
+
+
+def _command_failure(backend, operation, result):
+    return SystemCredentialStoreError(
+        "%s %s failed with exit code %s" % (backend, operation, result.returncode),
+    )
+
+
+def run_credential_command(args, input_text=""):
+    return subprocess.run(
+        args,
+        input=input_text,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+    )
+
+
+def _run(runner, args, input_text, backend, operation):
+    try:
+        return runner(args, input_text)
+    except OSError as error:
+        raise SystemCredentialStoreError(
+            "%s %s failed" % (backend, operation),
+        ) from error
+
+
+def _verify_round_trip(write, read, remove, expected):
+    failure = None
+    try:
+        write(expected)
+        if read() != expected:
+            failure = SystemCredentialStoreError(
+                "System credential store round-trip failed",
+            )
+    except SystemCredentialStoreError as error:
+        failure = error
+    try:
+        remove()
+    except SystemCredentialStoreError as error:
+        if failure is None:
+            failure = error
+    if failure is not None:
+        raise failure
+
+
+def _probe_value():
+    return str(uuid.uuid4()).ljust(SYSTEM_STORE_PROBE_LENGTH, "x")
+
+
+class MacOSCredentialStore:
+    def __init__(self, namespace, runner=run_credential_command):
+        self._namespace = namespace
+        self._runner = runner
+
+    def _account(self, name):
+        _validate_record_name(name)
+        return "%s:%s" % (self._namespace, name)
+
+    def _read_source(self, account):
+        result = _run(self._runner, [
+            MACOS_SECURITY_PATH, "find-generic-password",
+            "-a", account, "-s", SERVICE_NAME, "-w",
+        ], "", "macOS Keychain", "read")
+        if result.returncode == MACOS_ITEM_NOT_FOUND:
+            return None
+        if result.returncode != 0:
+            raise _command_failure("macOS Keychain", "read", result)
+        return result.stdout.strip()
+
+    def _write_source(self, account, source):
+        result = _run(self._runner, [
+            MACOS_SECURITY_PATH, "add-generic-password",
+            "-a", account, "-s", SERVICE_NAME, "-U", "-w",
+        ], "%s\n%s\n" % (source, source), "macOS Keychain", "write")
+        if result.returncode != 0:
+            raise _command_failure("macOS Keychain", "write", result)
+
+    def _remove_account(self, account):
+        result = _run(self._runner, [
+            MACOS_SECURITY_PATH, "delete-generic-password",
+            "-a", account, "-s", SERVICE_NAME,
+        ], "", "macOS Keychain", "remove")
+        if result.returncode not in (0, MACOS_ITEM_NOT_FOUND):
+            raise _command_failure("macOS Keychain", "remove", result)
+
+    def read(self, name):
+        source = self._read_source(self._account(name))
+        return None if source is None else _parse_record(name, source)
+
+    def write(self, name, value):
+        _validate_record(name, value)
+        self._write_source(
+            self._account(name), json.dumps(value, separators=(",", ":")),
+        )
+        if self.read(name) != value:
+            raise SystemCredentialStoreError(
+                "macOS Keychain %s write verification failed" % name,
+            )
+
+    def remove(self, name):
+        self._remove_account(self._account(name))
+
+    def verify_availability(self):
+        account = "%s:probe:%s" % (self._namespace, uuid.uuid4())
+        expected = _probe_value()
+        _verify_round_trip(
+            lambda source: self._write_source(account, source),
+            lambda: self._read_source(account),
+            lambda: self._remove_account(account),
+            expected,
+        )
+
+    backend = "macos-keychain"
+
+
+class LinuxSecretServiceStore:
+    def __init__(self, namespace, command, runner=run_credential_command):
+        self._namespace = namespace
+        self._command = command
+        self._runner = runner
+
+    def _attributes(self, name):
+        _validate_record_name(name)
+        return [
+            "application", APPLICATION_NAME,
+            "origin", self._namespace,
+            "record", name,
+        ]
+
+    def _lookup_source(self, attributes):
+        result = _run(
+            self._runner, [self._command, "lookup"] + attributes,
+            "", "Linux Secret Service", "read",
+        )
+        missing = (
+            result.returncode == 1
+            and not result.stdout.strip()
+            and not result.stderr.strip()
+        )
+        if missing:
+            return None
+        if result.returncode != 0:
+            raise _command_failure("Linux Secret Service", "read", result)
+        return result.stdout.strip()
+
+    def _write_source(self, attributes, source):
+        result = _run(self._runner, [
+            self._command, "store", "--label=%s" % SERVICE_NAME,
+        ] + attributes, source + "\n", "Linux Secret Service", "write")
+        if result.returncode != 0:
+            raise _command_failure("Linux Secret Service", "write", result)
+
+    def _remove_attributes(self, attributes):
+        if self._lookup_source(attributes) is None:
+            return
+        result = _run(
+            self._runner, [self._command, "clear"] + attributes,
+            "", "Linux Secret Service", "remove",
+        )
+        if result.returncode != 0:
+            raise _command_failure("Linux Secret Service", "remove", result)
+
+    def read(self, name):
+        source = self._lookup_source(self._attributes(name))
+        return None if source is None else _parse_record(name, source)
+
+    def write(self, name, value):
+        _validate_record(name, value)
+        self._write_source(
+            self._attributes(name), json.dumps(value, separators=(",", ":")),
+        )
+        if self.read(name) != value:
+            raise SystemCredentialStoreError(
+                "Linux Secret Service %s write verification failed" % name,
+            )
+
+    def remove(self, name):
+        self._remove_attributes(self._attributes(name))
+
+    def verify_availability(self):
+        attributes = [
+            "application", APPLICATION_NAME,
+            "origin", self._namespace,
+            "record", "probe-%s" % uuid.uuid4(),
+        ]
+        expected = _probe_value()
+        _verify_round_trip(
+            lambda source: self._write_source(attributes, source),
+            lambda: self._lookup_source(attributes),
+            lambda: self._remove_attributes(attributes),
+            expected,
+        )
+
+    backend = "linux-secret-service"
+
+
+def resolve_system_credential_store(
+        platform, namespace, env=None, *, runner=run_credential_command):
+    if platform == "darwin":
+        if not os.path.isfile(MACOS_SECURITY_PATH):
+            return None
+        if not os.access(MACOS_SECURITY_PATH, os.X_OK):
+            return None
+        return MacOSCredentialStore(namespace, runner)
+    if platform == "linux":
+        environment = os.environ if env is None else env
+        command = shutil.which("secret-tool", path=environment.get("PATH"))
+        if command:
+            return LinuxSecretServiceStore(namespace, command, runner)
+    return None

package/src/action-executor.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { ActionState, serializeFailure } from './action-errors.js';
 import { createActionContext } from './action-context.js';
 import { validateActionRequest } from './action-validation.js';
-import { ensureAgent, getMyAgent, searchAgents } from './agent-actions.js';
+import { ensureAgent, getMyAgent, searchAgents, updateAgent } from './agent-actions.js';
 import { contactAgent } from './contact-action.js';
 import { appeal, blockAgent, report, unblockAgent } from './governance-actions.js';
 import {
@@ -12,12 +12,19 @@ import {
   reply,
   withdrawMessage,
 } from './messaging-actions.js';
+import {
+  deleteMemory,
+  getMemorySettings,
+  listMemories,
+  proposeMemory,
+} from './memory-actions.js';
 
 const ACTIONS = Object.freeze({
   appeal,
   block_agent: blockAgent,
   contact_agent: contactAgent,
   ensure_agent: ensureAgent,
+  update_agent: updateAgent,
   get_conversation: getConversation,
   get_my_agent: getMyAgent,
   list_inbox: listInbox,
@@ -27,6 +34,10 @@ const ACTIONS = Object.freeze({
   search_agents: searchAgents,
   unblock_agent: unblockAgent,
   withdraw_message: withdrawMessage,
+  delete_memory: deleteMemory,
+  get_memory_settings: getMemorySettings,
+  list_memories: listMemories,
+  propose_memory: proposeMemory,
 });
 
 function canonicalize(value) {

package/src/action-validation.js

@@ -5,6 +5,7 @@ export const OPERATIONS = Object.freeze([
   'search_agents',
   'get_my_agent',
   'ensure_agent',
+  'update_agent',
   'contact_agent',
   'list_inbox',
   'get_conversation',
@@ -15,6 +16,10 @@ export const OPERATIONS = Object.freeze([
   'unblock_agent',
   'report',
   'appeal',
+  'get_memory_settings',
+  'propose_memory',
+  'list_memories',
+  'delete_memory',
 ]);
 
 const OPERATION_SET = new Set(OPERATIONS);