@xenosystem/agent-interface-host 0.1.3

package/dist/policy/WorkspacePolicyService.js

@@ -0,0 +1,809 @@
+import { createHash } from 'crypto';
+import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { basename, dirname, join, resolve } from 'path';
+import { createScopeAcl, estimateTokens, stableDocumentId } from '../agentSearch/searchUtils.js';
+const DEFAULT_XENO_DIR = join(homedir(), '.xeno');
+const MAX_MEMORY_BYTES = 128_000;
+const MAX_ARTIFACT_CONTENT_BYTES = 10 * 1024 * 1024;
+const DEFAULT_COLUMNS = ['todo', 'in_progress', 'blocked', 'review', 'done'];
+const POLICY_AUDIT_ENV = 'XENO_POLICY_AUDIT_PATH';
+function ensureDir(path) {
+    if (!existsSync(path))
+        mkdirSync(path, { recursive: true });
+}
+function safeReadJson(path, fallback) {
+    try {
+        if (!existsSync(path))
+            return fallback;
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+function safeWriteJson(path, value) {
+    ensureDir(dirname(path));
+    const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+    writeFileSync(tmpPath, JSON.stringify(value, null, 2), 'utf-8');
+    renameSync(tmpPath, path);
+}
+function policyAuditPath() {
+    return process.env[POLICY_AUDIT_ENV] || join(DEFAULT_XENO_DIR, 'audit', 'policy-decisions.jsonl');
+}
+function shortHash(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 20);
+}
+function compactScope(scope) {
+    if (!scope)
+        return undefined;
+    const compact = {
+        workspaceId: scope.workspaceId,
+        teamId: scope.teamId,
+        agentId: scope.agentId,
+        conversationId: scope.conversationId,
+        sdkSessionId: scope.sdkSessionId,
+        rootDirectory: scope.rootDirectory ? `[path:${shortHash(resolve(scope.rootDirectory))}]` : undefined,
+    };
+    return Object.values(compact).some(Boolean) ? compact : undefined;
+}
+function writePolicyAudit(request, decision) {
+    try {
+        const resource = request.resource || { kind: 'conversation' };
+        const path = typeof resource.path === 'string' && resource.path.trim() ? resolve(resource.path) : '';
+        const allowedDirectories = request.caller?.allowedDirectories || [];
+        const entry = {
+            id: `policy_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`,
+            timestamp: new Date().toISOString(),
+            action: request.action,
+            resource: {
+                kind: resource.kind,
+                id: resource.id,
+                pathHash: path ? shortHash(path) : undefined,
+                pathBasename: path ? basename(path).slice(0, 200) : undefined,
+                scope: compactScope(resource.scope),
+                aclVisibility: resource.acl?.visibility,
+            },
+            caller: request.caller
+                ? {
+                    userId: request.caller.userId,
+                    workspaceId: request.caller.workspaceId,
+                    teamId: request.caller.teamId,
+                    agentId: request.caller.agentId,
+                    allowedDirectoryCount: allowedDirectories.length,
+                    allowedDirectoryHashes: allowedDirectories.map((dir) => shortHash(resolve(dir))).slice(0, 50),
+                }
+                : undefined,
+            decision: {
+                allowed: decision.allowed,
+                reason: decision.reason,
+                matchedVisibility: decision.matchedVisibility,
+                matchedScope: compactScope(decision.matchedScope),
+            },
+        };
+        const targetPath = policyAuditPath();
+        ensureDir(dirname(targetPath));
+        appendFileSync(targetPath, `${JSON.stringify(entry)}\n`, 'utf-8');
+    }
+    catch {
+        // Policy evaluation must never fail because audit storage is unavailable.
+    }
+}
+function safeSegment(value) {
+    return String(value || 'unknown').replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 160) || 'unknown';
+}
+function cleanString(value, max = 10_000) {
+    return typeof value === 'string' ? value.trim().slice(0, max) : '';
+}
+function uniqueStrings(values, maxItems = 50, maxLength = 80) {
+    if (!Array.isArray(values))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const value of values) {
+        const item = cleanString(value, maxLength);
+        if (!item || seen.has(item))
+            continue;
+        seen.add(item);
+        out.push(item);
+        if (out.length >= maxItems)
+            break;
+    }
+    return out;
+}
+function clampImportance(value) {
+    const num = typeof value === 'number' && Number.isFinite(value) ? value : 0.5;
+    return Math.max(0, Math.min(1, num));
+}
+function normalizePathForCompare(path) {
+    const resolved = resolve(path);
+    return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+function isPathInside(path, parent) {
+    const child = normalizePathForCompare(path);
+    const root = normalizePathForCompare(parent);
+    return child === root || child.startsWith(root.endsWith('\\') || root.endsWith('/') ? root : `${root}${process.platform === 'win32' ? '\\' : '/'}`);
+}
+function scopeFromRequest(input) {
+    return {
+        workspaceId: cleanString(input.workspaceId, 200) || undefined,
+        teamId: cleanString(input.teamId, 200) || undefined,
+        agentId: cleanString(input.agentId, 200) || undefined,
+        conversationId: cleanString(input.conversationId, 200) || undefined,
+    };
+}
+function defaultVisibility(scope, fallback = 'private') {
+    if (scope.agentId)
+        return 'agent';
+    if (scope.teamId)
+        return 'team';
+    if (scope.workspaceId)
+        return 'workspace';
+    return fallback;
+}
+function defaultAcl(scope, fallback = 'private') {
+    return createScopeAcl(scope, defaultVisibility(scope, fallback));
+}
+function aclAllows(caller, scope, acl, action) {
+    const effectiveAcl = acl || defaultAcl(scope || {}, 'global');
+    const writeLike = action !== 'read';
+    const callerAgentId = caller?.agentId;
+    const callerTeamId = caller?.teamId;
+    const callerWorkspaceId = caller?.workspaceId;
+    if (effectiveAcl.visibility !== 'global') {
+        if (scope?.workspaceId && callerWorkspaceId !== scope.workspaceId) {
+            return {
+                allowed: false,
+                reason: 'Caller workspace does not match the resource workspace. Switch to the matching workspace/team/agent or request access from the owner before retrying.',
+                matchedVisibility: effectiveAcl.visibility,
+                matchedScope: scope,
+            };
+        }
+        if ((effectiveAcl.visibility === 'team' || effectiveAcl.visibility === 'agent' || effectiveAcl.visibility === 'private') && scope?.teamId && callerTeamId !== scope.teamId) {
+            return {
+                allowed: false,
+                reason: 'Caller team does not match the resource team. Switch to the matching workspace/team/agent or request access from the owner before retrying.',
+                matchedVisibility: effectiveAcl.visibility,
+                matchedScope: scope,
+            };
+        }
+        if ((effectiveAcl.visibility === 'agent' || effectiveAcl.visibility === 'private') && scope?.agentId && callerAgentId !== scope.agentId) {
+            return {
+                allowed: false,
+                reason: 'Caller agent does not match the resource agent. Switch to the matching workspace/team/agent or request access from the owner before retrying.',
+                matchedVisibility: effectiveAcl.visibility,
+                matchedScope: scope,
+            };
+        }
+    }
+    const agentAllowed = !!callerAgentId && (effectiveAcl.ownerAgentId === callerAgentId
+        || effectiveAcl.allowedAgentIds?.includes(callerAgentId)
+        || scope?.agentId === callerAgentId);
+    const teamAllowed = !!callerTeamId && (effectiveAcl.allowedTeamIds?.includes(callerTeamId)
+        || scope?.teamId === callerTeamId);
+    const workspaceAllowed = !!callerWorkspaceId && (effectiveAcl.allowedWorkspaceIds?.includes(callerWorkspaceId)
+        || scope?.workspaceId === callerWorkspaceId);
+    if (effectiveAcl.visibility === 'global') {
+        if (writeLike && !agentAllowed && !teamAllowed && !workspaceAllowed) {
+            return {
+                allowed: false,
+                reason: 'Global resources require matching workspace, team, or agent scope for mutation. Select the correct workspace/team/agent context before retrying.',
+                matchedVisibility: effectiveAcl.visibility,
+                matchedScope: scope,
+            };
+        }
+        return { allowed: true, reason: 'Global visibility allows access.', matchedVisibility: effectiveAcl.visibility, matchedScope: scope };
+    }
+    if (effectiveAcl.visibility === 'workspace' && (workspaceAllowed || teamAllowed || agentAllowed)) {
+        return { allowed: true, reason: 'Caller is in the resource workspace scope.', matchedVisibility: effectiveAcl.visibility, matchedScope: scope };
+    }
+    if (effectiveAcl.visibility === 'team' && (teamAllowed || agentAllowed)) {
+        return { allowed: true, reason: 'Caller is in the resource team scope.', matchedVisibility: effectiveAcl.visibility, matchedScope: scope };
+    }
+    if (effectiveAcl.visibility === 'agent' && agentAllowed) {
+        return { allowed: true, reason: 'Caller is in the resource agent scope.', matchedVisibility: effectiveAcl.visibility, matchedScope: scope };
+    }
+    if (effectiveAcl.visibility === 'private' && agentAllowed) {
+        return { allowed: true, reason: 'Caller owns the private resource.', matchedVisibility: effectiveAcl.visibility, matchedScope: scope };
+    }
+    return {
+        allowed: false,
+        reason: `Caller is outside ${effectiveAcl.visibility} visibility scope. Switch to the matching workspace/team/agent or request access from the owner before retrying.`,
+        matchedVisibility: effectiveAcl.visibility,
+        matchedScope: scope,
+    };
+}
+function getScopeTypeDirectory(scopeType) {
+    if (scopeType === 'workspace')
+        return 'workspace';
+    if (scopeType === 'team')
+        return 'team';
+    return 'agent';
+}
+function readJsonl(path) {
+    try {
+        if (!existsSync(path))
+            return [];
+        return readFileSync(path, 'utf-8')
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+    }
+    catch {
+        return [];
+    }
+}
+function artifactBody(record) {
+    return [
+        record.title,
+        record.type,
+        record.path,
+        record.uri,
+        record.conversationId,
+        record.subagentRunId,
+        Object.entries(record.metadata || {}).map(([key, value]) => `${key}: ${String(value)}`).join('\n'),
+    ].filter(Boolean).join('\n');
+}
+function memoryBody(entry) {
+    return [entry.content, entry.tags.join(' '), entry.sourceConversationId].filter(Boolean).join('\n');
+}
+function taskBody(task, board) {
+    return [
+        task.title,
+        task.description,
+        task.status,
+        task.priority,
+        task.labels.join(' '),
+        task.assigneeAgentId,
+        task.artifactIds.join(' '),
+        task.conversationIds.join(' '),
+        board.title,
+    ].filter(Boolean).join('\n');
+}
+export class WorkspacePolicyService {
+    baseDir;
+    memoryDir;
+    artifactsDir;
+    artifactRegistryPath;
+    artifactBlobDir;
+    taskBoardsDir;
+    constructor(baseDir = DEFAULT_XENO_DIR) {
+        this.baseDir = baseDir;
+        this.memoryDir = join(baseDir, 'memory');
+        this.artifactsDir = join(baseDir, 'artifacts');
+        this.artifactRegistryPath = join(this.artifactsDir, 'registry.json');
+        this.artifactBlobDir = join(this.artifactsDir, 'blobs');
+        this.taskBoardsDir = join(baseDir, 'task-boards');
+    }
+    evaluate(request) {
+        const resource = request.resource || { kind: 'conversation' };
+        const pathDecision = this.evaluatePath(request.caller, resource);
+        const decision = pathDecision.allowed
+            ? aclAllows(request.caller, resource.scope, resource.acl, request.action)
+            : pathDecision;
+        writePolicyAudit(request, decision);
+        return decision;
+    }
+    writeMemory(request) {
+        try {
+            const scopeId = cleanString(request.scopeId, 200);
+            const content = cleanString(request.content, MAX_MEMORY_BYTES);
+            if (!scopeId)
+                return { success: false, error: 'scopeId is required.' };
+            if (!content)
+                return { success: false, error: 'Memory content is required.' };
+            const scope = this.scopeForMemory(request.scopeType, scopeId, request);
+            const acl = request.acl || defaultAcl(scope);
+            const decision = this.evaluate({
+                action: 'write',
+                caller: request.caller || { workspaceId: scope.workspaceId, teamId: scope.teamId, agentId: request.authorAgentId || scope.agentId },
+                resource: { kind: 'memory', id: scopeId, scope, acl },
+            });
+            if (!decision.allowed)
+                return { success: false, error: decision.reason };
+            const now = Date.now();
+            const entry = {
+                id: stableDocumentId('memory', request.scopeType, scopeId, now, content.slice(0, 80)),
+                scopeType: request.scopeType,
+                scopeId,
+                workspaceId: scope.workspaceId,
+                teamId: scope.teamId,
+                agentId: scope.agentId,
+                content,
+                tags: uniqueStrings(request.tags),
+                createdAt: now,
+                updatedAt: now,
+                authorAgentId: cleanString(request.authorAgentId, 200) || undefined,
+                sourceConversationId: cleanString(request.sourceConversationId, 200) || undefined,
+                importance: clampImportance(request.importance),
+                acl,
+            };
+            const path = this.memoryFilePath(entry.scopeType, entry.scopeId);
+            ensureDir(dirname(path));
+            appendFileSync(path, `${JSON.stringify(entry)}\n`, 'utf-8');
+            return { success: true, entry };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    listMemory(request = {}) {
+        try {
+            const entries = this.readAllMemory()
+                .filter((entry) => this.matchesMemoryFilter(entry, request))
+                .filter((entry) => !request.caller || this.evaluate({
+                action: 'read',
+                caller: request.caller,
+                resource: { kind: 'memory', id: entry.id, scope: this.scopeForEntry(entry), acl: entry.acl },
+            }).allowed)
+                .sort((a, b) => b.updatedAt - a.updatedAt)
+                .slice(0, Math.max(1, Math.min(1000, request.limit || 100)));
+            return { success: true, entries };
+        }
+        catch (err) {
+            return { success: false, entries: [], error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    registerArtifact(request) {
+        try {
+            const title = cleanString(request.title, 300);
+            if (!title)
+                return { success: false, error: 'Artifact title is required.' };
+            const scope = scopeFromRequest(request);
+            const acl = request.acl || defaultAcl(scope, 'workspace');
+            const decision = this.evaluate({
+                action: 'write',
+                caller: request.caller || { workspaceId: scope.workspaceId, teamId: scope.teamId, agentId: request.createdByAgentId || scope.agentId },
+                resource: { kind: 'artifact', scope, acl, path: request.path },
+            });
+            if (!decision.allowed)
+                return { success: false, error: decision.reason };
+            const now = Date.now();
+            const artifacts = this.readArtifacts();
+            let blobSha256;
+            let sizeBytes;
+            if (typeof request.content === 'string') {
+                const encoding = request.contentEncoding === 'base64' ? 'base64' : 'utf8';
+                const buffer = Buffer.from(request.content, encoding);
+                if (buffer.length > MAX_ARTIFACT_CONTENT_BYTES) {
+                    return { success: false, error: `Artifact content exceeds ${MAX_ARTIFACT_CONTENT_BYTES} bytes.` };
+                }
+                blobSha256 = createHash('sha256').update(buffer).digest('hex');
+                sizeBytes = buffer.length;
+                this.writeBlob(blobSha256, buffer);
+            }
+            const artifact = {
+                id: stableDocumentId('artifact', title, now, request.path || request.uri || blobSha256 || ''),
+                type: request.type || 'other',
+                title,
+                path: cleanString(request.path, 2000) || undefined,
+                uri: cleanString(request.uri, 2000) || undefined,
+                blobSha256,
+                contentType: cleanString(request.contentType, 200) || undefined,
+                sizeBytes,
+                workspaceId: scope.workspaceId,
+                teamId: scope.teamId,
+                agentId: scope.agentId,
+                conversationId: scope.conversationId,
+                subagentRunId: cleanString(request.subagentRunId, 200) || undefined,
+                createdAt: now,
+                updatedAt: now,
+                createdByAgentId: cleanString(request.createdByAgentId, 200) || undefined,
+                metadata: request.metadata && typeof request.metadata === 'object' ? request.metadata : {},
+                acl,
+            };
+            artifacts.push(artifact);
+            this.saveArtifacts(artifacts);
+            return { success: true, artifact };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    listArtifacts(request = {}) {
+        try {
+            const query = cleanString(request.query, 500).toLowerCase();
+            const artifacts = this.readArtifacts()
+                .filter((artifact) => !request.workspaceId || artifact.workspaceId === request.workspaceId)
+                .filter((artifact) => !request.teamId || artifact.teamId === request.teamId)
+                .filter((artifact) => !request.agentId || artifact.agentId === request.agentId)
+                .filter((artifact) => !request.conversationId || artifact.conversationId === request.conversationId)
+                .filter((artifact) => !request.subagentRunId || artifact.subagentRunId === request.subagentRunId)
+                .filter((artifact) => !request.types?.length || request.types.includes(artifact.type))
+                .filter((artifact) => !query || artifactBody(artifact).toLowerCase().includes(query))
+                .filter((artifact) => !request.caller || this.evaluate({
+                action: 'read',
+                caller: request.caller,
+                resource: { kind: 'artifact', id: artifact.id, path: artifact.path, scope: this.scopeForArtifact(artifact), acl: artifact.acl },
+            }).allowed)
+                .sort((a, b) => b.updatedAt - a.updatedAt)
+                .slice(0, Math.max(1, Math.min(1000, request.limit || 100)));
+            return { success: true, artifacts };
+        }
+        catch (err) {
+            return { success: false, artifacts: [], error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    getArtifact(request) {
+        try {
+            const id = cleanString(request.id, 240);
+            const artifact = this.readArtifacts().find((item) => item.id === id);
+            if (!artifact)
+                return { success: false, error: 'Artifact not found.' };
+            const decision = this.evaluate({
+                action: 'read',
+                caller: request.caller,
+                resource: { kind: 'artifact', id: artifact.id, path: artifact.path, scope: this.scopeForArtifact(artifact), acl: artifact.acl },
+            });
+            if (!decision.allowed)
+                return { success: false, error: decision.reason };
+            const result = { artifact };
+            if (request.includeContent && artifact.blobSha256) {
+                const blob = this.readBlob(artifact.blobSha256);
+                result.content = blob.toString('base64');
+                result.contentEncoding = 'base64';
+            }
+            return { success: true, result };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    deleteArtifact(request) {
+        try {
+            const id = cleanString(request.id, 240);
+            const artifacts = this.readArtifacts();
+            const artifact = artifacts.find((item) => item.id === id);
+            if (!artifact)
+                return { success: false, error: 'Artifact not found.' };
+            const decision = this.evaluate({
+                action: 'delete',
+                caller: request.caller,
+                resource: { kind: 'artifact', id: artifact.id, path: artifact.path, scope: this.scopeForArtifact(artifact), acl: artifact.acl },
+            });
+            if (!decision.allowed)
+                return { success: false, error: decision.reason };
+            this.saveArtifacts(artifacts.filter((item) => item.id !== id));
+            return { success: true };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    getTaskBoard(request) {
+        try {
+            const board = this.loadOrCreateBoard(request);
+            if (!board)
+                return { success: false, error: 'Task board not found.' };
+            const decision = this.evaluate({
+                action: 'read',
+                caller: request.caller,
+                resource: { kind: 'task', id: board.id, scope: this.scopeForBoard(board), acl: board.acl },
+            });
+            if (!decision.allowed)
+                return { success: false, error: decision.reason };
+            return { success: true, board };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    upsertTask(request) {
+        try {
+            const board = this.loadOrCreateBoard({ ...request, createIfMissing: true });
+            if (!board)
+                return { success: false, error: 'Task board not found.' };
+            const decision = this.evaluate({
+                action: 'write',
+                caller: request.caller || { workspaceId: board.workspaceId, teamId: board.teamId, agentId: request.task?.creatorAgentId },
+                resource: { kind: 'task', id: board.id, scope: this.scopeForBoard(board), acl: board.acl },
+            });
+            if (!decision.allowed)
+                return { success: false, error: decision.reason };
+            const now = Date.now();
+            const input = request.task || {};
+            const existingIndex = input.id ? board.tasks.findIndex((task) => task.id === input.id) : -1;
+            const current = existingIndex >= 0 ? board.tasks[existingIndex] : undefined;
+            const title = cleanString(input.title, 300) || current?.title;
+            if (!title)
+                return { success: false, error: 'Task title is required.' };
+            const task = {
+                id: current?.id || stableDocumentId('task', board.id, title, now),
+                title,
+                description: cleanString(input.description, 5000) || current?.description,
+                status: this.normalizeStatus(input.status || current?.status || 'todo'),
+                priority: input.priority || current?.priority || 'normal',
+                assigneeAgentId: cleanString(input.assigneeAgentId, 200) || current?.assigneeAgentId,
+                creatorAgentId: cleanString(input.creatorAgentId, 200) || current?.creatorAgentId,
+                artifactIds: uniqueStrings(input.artifactIds || current?.artifactIds || []),
+                conversationIds: uniqueStrings(input.conversationIds || current?.conversationIds || []),
+                labels: uniqueStrings(input.labels || current?.labels || []),
+                dueAt: typeof input.dueAt === 'number' ? input.dueAt : current?.dueAt,
+                createdAt: current?.createdAt || now,
+                updatedAt: now,
+            };
+            if (existingIndex >= 0)
+                board.tasks[existingIndex] = task;
+            else
+                board.tasks.push(task);
+            board.updatedAt = now;
+            this.saveBoard(board);
+            return { success: true, board, task };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    deleteTask(request) {
+        try {
+            const board = this.loadOrCreateBoard(request);
+            if (!board)
+                return { success: false, error: 'Task board not found.' };
+            const decision = this.evaluate({
+                action: 'delete',
+                caller: request.caller,
+                resource: { kind: 'task', id: board.id, scope: this.scopeForBoard(board), acl: board.acl },
+            });
+            if (!decision.allowed)
+                return { success: false, error: decision.reason };
+            board.tasks = board.tasks.filter((task) => task.id !== request.taskId);
+            board.updatedAt = Date.now();
+            this.saveBoard(board);
+            return { success: true, board };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    listTaskBoards(request = {}) {
+        try {
+            const boards = this.readBoards()
+                .filter((board) => !request.workspaceId || board.workspaceId === request.workspaceId)
+                .filter((board) => !request.teamId || board.teamId === request.teamId)
+                .filter((board) => !request.caller || this.evaluate({
+                action: 'read',
+                caller: request.caller,
+                resource: { kind: 'task', id: board.id, scope: this.scopeForBoard(board), acl: board.acl },
+            }).allowed)
+                .sort((a, b) => b.updatedAt - a.updatedAt);
+            return { success: true, boards };
+        }
+        catch (err) {
+            return { success: false, boards: [], error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    getSnapshot(caller) {
+        const memory = this.listMemory({ caller, limit: 10_000 }).entries;
+        const artifacts = this.listArtifacts({ caller, limit: 10_000 }).artifacts;
+        const taskBoards = this.listTaskBoards({ caller }).boards;
+        return {
+            memory,
+            artifacts,
+            taskBoards,
+            searchDocuments: this.toSearchDocuments(caller),
+        };
+    }
+    toSearchDocuments(caller) {
+        const documents = [];
+        for (const entry of this.listMemory({ caller, limit: 10_000 }).entries) {
+            const scope = this.scopeForEntry(entry);
+            documents.push({
+                id: stableDocumentId('search-memory', entry.id),
+                type: 'memory',
+                scope,
+                acl: entry.acl,
+                title: `Memory: ${entry.tags[0] || entry.scopeType} ${entry.scopeId}`,
+                body: memoryBody(entry),
+                keywords: ['memory', entry.scopeType, ...entry.tags],
+                timestamps: { createdAt: entry.createdAt, updatedAt: entry.updatedAt },
+                sourceRef: { artifactId: undefined },
+                metrics: { tokenEstimate: estimateTokens(entry.content), bodyBytes: entry.content.length, importance: entry.importance },
+            });
+        }
+        for (const artifact of this.listArtifacts({ caller, limit: 10_000 }).artifacts) {
+            const scope = this.scopeForArtifact(artifact);
+            documents.push({
+                id: stableDocumentId('search-artifact', artifact.id),
+                type: 'artifact',
+                scope,
+                acl: artifact.acl,
+                title: `Artifact: ${artifact.title}`,
+                body: artifactBody(artifact),
+                keywords: ['artifact', artifact.type, artifact.contentType || '', basename(artifact.path || '')].filter(Boolean),
+                sourcePath: artifact.path,
+                sourceRef: { artifactId: artifact.id, filePath: artifact.path },
+                timestamps: { createdAt: artifact.createdAt, updatedAt: artifact.updatedAt },
+                metrics: { tokenEstimate: estimateTokens(artifactBody(artifact)), bodyBytes: artifact.sizeBytes },
+            });
+        }
+        for (const board of this.listTaskBoards({ caller }).boards) {
+            for (const task of board.tasks) {
+                const body = taskBody(task, board);
+                documents.push({
+                    id: stableDocumentId('search-task', board.id, task.id),
+                    type: 'task',
+                    scope: this.scopeForBoard(board),
+                    acl: board.acl,
+                    title: `Task: ${task.title}`,
+                    body,
+                    keywords: ['task', task.status, task.priority, ...task.labels],
+                    sourceRef: { taskId: task.id },
+                    timestamps: { createdAt: task.createdAt, updatedAt: task.updatedAt },
+                    metrics: { tokenEstimate: estimateTokens(body), bodyBytes: body.length, importance: task.priority === 'critical' ? 1 : task.priority === 'high' ? 0.8 : 0.5 },
+                });
+            }
+        }
+        return documents;
+    }
+    evaluatePath(caller, resource) {
+        if (resource.kind !== 'file' && !resource.path)
+            return { allowed: true, reason: 'No path policy required.' };
+        if (!resource.path)
+            return { allowed: true, reason: 'No path policy required.' };
+        const allowedDirectories = Array.isArray(caller?.allowedDirectories) ? caller?.allowedDirectories || [] : [];
+        if (allowedDirectories.length === 0) {
+            return {
+                allowed: false,
+                reason: 'No allowed directories were provided for path-scoped access. Select a workspace folder or grant the agent directory access before retrying.',
+                matchedScope: resource.scope,
+            };
+        }
+        const allowed = allowedDirectories.some((dir) => isPathInside(resource.path || '', dir));
+        if (!allowed) {
+            return {
+                allowed: false,
+                reason: 'Path is outside the caller allowed directories. Choose a folder inside the workspace, add the folder to directory access, or switch to an agent with the required grant.',
+                matchedScope: resource.scope,
+            };
+        }
+        return { allowed: true, reason: 'Path is inside an allowed directory.', matchedScope: resource.scope };
+    }
+    memoryFilePath(scopeType, scopeId) {
+        return join(this.memoryDir, getScopeTypeDirectory(scopeType), `${safeSegment(scopeId)}.jsonl`);
+    }
+    scopeForMemory(scopeType, scopeId, input) {
+        if (scopeType === 'workspace')
+            return { workspaceId: cleanString(input.workspaceId || scopeId, 200) || scopeId };
+        if (scopeType === 'team')
+            return { workspaceId: cleanString(input.workspaceId, 200) || undefined, teamId: cleanString(input.teamId || scopeId, 200) || scopeId };
+        return {
+            workspaceId: cleanString(input.workspaceId, 200) || undefined,
+            teamId: cleanString(input.teamId, 200) || undefined,
+            agentId: cleanString(input.agentId || scopeId, 200) || scopeId,
+        };
+    }
+    scopeForEntry(entry) {
+        return {
+            workspaceId: entry.workspaceId,
+            teamId: entry.teamId,
+            agentId: entry.agentId,
+        };
+    }
+    scopeForArtifact(artifact) {
+        return {
+            workspaceId: artifact.workspaceId,
+            teamId: artifact.teamId,
+            agentId: artifact.agentId,
+            conversationId: artifact.conversationId,
+        };
+    }
+    scopeForBoard(board) {
+        return {
+            workspaceId: board.workspaceId,
+            teamId: board.teamId,
+        };
+    }
+    readAllMemory() {
+        const entries = [];
+        for (const scopeType of ['workspace', 'team', 'agent']) {
+            const dir = join(this.memoryDir, getScopeTypeDirectory(scopeType));
+            try {
+                if (!existsSync(dir))
+                    continue;
+                for (const file of readdirSync(dir).filter((item) => item.endsWith('.jsonl')).sort()) {
+                    entries.push(...readJsonl(join(dir, file)));
+                }
+            }
+            catch {
+                // Continue reading other scopes when one file is corrupt or unavailable.
+            }
+        }
+        return entries;
+    }
+    matchesMemoryFilter(entry, request) {
+        if (request.scopeType && entry.scopeType !== request.scopeType)
+            return false;
+        if (request.scopeId && entry.scopeId !== request.scopeId)
+            return false;
+        if (request.workspaceId && entry.workspaceId !== request.workspaceId)
+            return false;
+        if (request.teamId && entry.teamId !== request.teamId)
+            return false;
+        if (request.agentId && entry.agentId !== request.agentId)
+            return false;
+        if (request.tags?.length && !request.tags.every((tag) => entry.tags.includes(tag)))
+            return false;
+        const query = cleanString(request.query, 500).toLowerCase();
+        if (query && !memoryBody(entry).toLowerCase().includes(query))
+            return false;
+        return true;
+    }
+    readArtifacts() {
+        const artifacts = safeReadJson(this.artifactRegistryPath, []);
+        return Array.isArray(artifacts) ? artifacts : [];
+    }
+    saveArtifacts(artifacts) {
+        safeWriteJson(this.artifactRegistryPath, artifacts.slice(-20_000));
+    }
+    writeBlob(sha256, buffer) {
+        const dir = join(this.artifactBlobDir, sha256.slice(0, 2));
+        ensureDir(dir);
+        writeFileSync(join(dir, sha256), buffer);
+    }
+    readBlob(sha256) {
+        return readFileSync(join(this.artifactBlobDir, sha256.slice(0, 2), sha256));
+    }
+    boardPath(scopeType, scopeId) {
+        return join(this.taskBoardsDir, `${scopeType}-${safeSegment(scopeId)}.json`);
+    }
+    loadOrCreateBoard(request) {
+        const scopeId = cleanString(request.scopeId, 200);
+        if (!scopeId)
+            return null;
+        const path = this.boardPath(request.scopeType, scopeId);
+        const existing = safeReadJson(path, null);
+        if (existing)
+            return existing;
+        if (!request.createIfMissing)
+            return null;
+        const now = Date.now();
+        const scope = request.scopeType === 'workspace'
+            ? { workspaceId: request.workspaceId || scopeId }
+            : { workspaceId: request.workspaceId, teamId: request.teamId || scopeId };
+        const board = {
+            id: stableDocumentId('task-board', request.scopeType, scopeId),
+            scopeType: request.scopeType,
+            scopeId,
+            workspaceId: scope.workspaceId,
+            teamId: scope.teamId,
+            title: request.scopeType === 'workspace' ? `Workspace tasks ${scopeId}` : `Team tasks ${scopeId}`,
+            columns: DEFAULT_COLUMNS,
+            tasks: [],
+            createdAt: now,
+            updatedAt: now,
+            acl: defaultAcl(scope),
+        };
+        this.saveBoard(board);
+        return board;
+    }
+    saveBoard(board) {
+        safeWriteJson(this.boardPath(board.scopeType, board.scopeId), board);
+    }
+    readBoards() {
+        try {
+            if (!existsSync(this.taskBoardsDir))
+                return [];
+            return readdirSync(this.taskBoardsDir)
+                .filter((file) => file.endsWith('.json'))
+                .map((file) => safeReadJson(join(this.taskBoardsDir, file), null))
+                .filter((board) => !!board);
+        }
+        catch {
+            return [];
+        }
+    }
+    normalizeStatus(status) {
+        if (status === 'todo' || status === 'in_progress' || status === 'blocked' || status === 'review' || status === 'done' || status === 'archived') {
+            return status;
+        }
+        return 'todo';
+    }
+}
+let singleton = null;
+export function getWorkspacePolicyService() {
+    if (!singleton)
+        singleton = new WorkspacePolicyService();
+    return singleton;
+}
+//# sourceMappingURL=WorkspacePolicyService.js.map